if policy == nil {
		return configs
	}
	rootNamespace := policy.RootNamespace
	namespace := selectionOpts.Namespace
	var lookupInNamespaces []string

	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{rootNamespace, namespace}
	} else {
		lookupInNamespaces = []string{namespace}

      service_type: ""
      tolerations: []
      version_label: v1.85.0
      view_only_mode: false
    external_services:
      custom_dashboards:
        enabled: true
      istio:
        root_namespace: istio-system
      tracing:
        enabled: false
    identity:
      cert_file: ""
      private_key_file: ""
    istio_namespace: istio-system
    kiali_feature_flags:

type Telemetries struct {
	// Maps from namespace to the Telemetry configs.
	NamespaceToTelemetries map[string][]Telemetry `json:"namespace_to_telemetries"`

	// The name of the root namespace.
	RootNamespace string `json:"root_namespace"`

	// Computed meshConfig
	meshConfig *meshconfig.MeshConfig

	// computedMetricsFilters contains the set of cached HCM/listener filters for the metrics portion.

func NewEffectiveProxyConfigResolver(c analysis.Context) *EffectiveProxyConfigResolver {
	mc := &meshconfig.MeshConfig{}
	rootNamespace := ""
	c.ForEach(gvk.MeshConfig, func(r *resource.Instance) bool {
		meshConfig := r.Message.(*meshconfig.MeshConfig)
		rootNamespace = meshConfig.GetRootNamespace()
		if rootNamespace == "" {
			rootNamespace = "istio-system"
		}
		mc = meshConfig
		return true
	})

	resolver := &EffectiveProxyConfigResolver{

	return getConfigsForWorkload(policy.rootNamespace, policy.requestAuthentications, policyMatcher)
}

// GetPeerAuthenticationsForWorkload returns a list of peer authentication policies matching to labels.
func (policy *AuthenticationPolicies) GetPeerAuthenticationsForWorkload(policyMatcher WorkloadPolicyMatcher) []*config.Config {
	return getConfigsForWorkload(policy.rootNamespace, policy.peerAuthentications, policyMatcher)
}

	// Merge the proxy config from default config.
	effectiveProxyConfig = mergeWithPrecedence(mc.GetDefaultConfig(), effectiveProxyConfig)
	if p.rootNamespace != "" {
		effectiveProxyConfig = mergeWithPrecedence(p.mergedGlobalConfig(), effectiveProxyConfig)
	}

	if meta.Namespace != p.rootNamespace {
		namespacedConfig := p.mergedNamespaceConfig(meta.Namespace)
		effectiveProxyConfig = mergeWithPrecedence(namespacedConfig, effectiveProxyConfig)
	}

			createTestPeerAuthenticationResource("ignored-newer", rootNamespace, baseTimestamp.Add(time.Second*2),
				nil, securityBeta.PeerAuthentication_MutualTLS_UNSET),
			createTestPeerAuthenticationResource("default", rootNamespace, baseTimestamp,
				nil, securityBeta.PeerAuthentication_MutualTLS_UNSET),
			createTestPeerAuthenticationResource("ignored-another-newer", rootNamespace, baseTimestamp.Add(time.Second),

			}
		}
	}

	return effectivePeerAuthenticationKeys(rootNamespace, isEffectiveStrictPolicy, effectivePortLevelPolicyKey)
}

func effectivePeerAuthenticationKeys(rootNamespace string, isEffectiveStringPolicy bool, effectiveWorkloadPolicyKey string) []string {
	res := sets.New[string]()

	if isEffectiveStringPolicy {
		res.Insert(fmt.Sprintf("%s/%s", rootNamespace, staticStrictPolicyName))
	}

defaultConfig:
  discoveryAddress: istiod.istio-system.svc:15012
defaultProviders:
  metrics:
  - prometheus
enablePrometheusMerge: true
rootNamespace: istio-system

defaultConfig:
  discoveryAddress: istiod.istio-system.svc:15012
defaultProviders:
  metrics:
  - prometheus
enablePrometheusMerge: true
rootNamespace: istio-system