rootCertPem, err := os.ReadFile(tc.rootCertForMeshConfig)
				if err != nil {
					t.Errorf("Failed to read sample %s", tc.rootCertForMeshConfig)
				}
				caCertificates := []*meshconfig.MeshConfig_CertificateData{
					{CertificateData: &meshconfig.MeshConfig_CertificateData_Pem{Pem: string(rootCertPem)}, CertSigners: []string{signer}},
				}
				ra.SetCACertificatesFromMeshConfig(caCertificates)
			}

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry

releaseNotes:
  - |

apiVersion: release-notes/v2
kind: feature
area: telemetry
issue:
- 50001
releaseNotes:
  - |

    # with Istiod configuration.
    clusterName: ""

  # meshConfig defines runtime configuration of components.
  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
  # components.
  # TODO: https://github.com/istio/istio/issues/43248
  meshConfig:
    defaultConfig:
      proxyMetadata: {}

  # This value defines:

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry
issue:
- 28597
releaseNotes:
- |

			if !c.Settings().EnableDualStack {
				cfg.ControlPlaneValues = `
values:
  pilot: 
    env: 
      PILOT_JWT_ENABLE_REMOTE_JWKS: true
      ENABLE_SELECTOR_BASED_K8S_GATEWAY_POLICY: false
meshConfig:
  defaultConfig:
    gatewayTopology:
      numTrustedProxies: 1 # Needed for X-Forwarded-For (See https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/)
`
			} else {

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
- |

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    extensionProviders:
      - name: otel
        envoyOtelAls:
          service: opentelemetry-collector.istio-system.svc.cluster.local
          port: 4317
          logFormat:
            labels:
              pod: "%ENVIRONMENT(POD_NAME)%"
              namespace: "%ENVIRONMENT(POD_NAMESPACE)%"
              cluster: "%ENVIRONMENT(ISTIO_META_CLUSTER_ID)%"

apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
  - 27734
releaseNotes:
  - |

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  hub: docker.io/istio
  tag: 1.1.4
  meshConfig:
    enablePrometheusMerge: true
    rootNamespace: istio-control
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY
    defaultConfig:
      discoveryAddress: my-discovery:123
      drainDuration: 12s
      controlPlaneAuthPolicy: NONE
    accessLogFormat: |
      {
        "key": "val"
      }