step.
1. Overlays in the user CR are applied to the rendered manifests. No values are ever defined in configuration profile
CRs at this layer, so no merge is performed in this step.

## CLI

The CLI `mesh` command is implemented in the [cmd/mesh](../operator/cmd/mesh/)
subdirectory as a Cobra command with the following subcommands:

		switch e.tok {
		case token.COMMENT:
			// no CRs in comments
			elit = string(stripCR([]byte(e.lit), e.lit[1] == '*'))
			//-style comment literal doesn't contain newline
			if elit[1] == '/' {
				elit = elit[0 : len(elit)-1]
			}
		case token.IDENT:
			elit = e.lit
		case token.SEMICOLON:
			elit = ";"
		default:
			if e.tok.IsLiteral() {
				// no CRs in raw string literals
				elit = e.lit

		}
		multiple := false
		multiple, err = hasMultipleIOPs(string(b))
		if err != nil {
			return "", err
		}
		if multiple {
			return "", fmt.Errorf("input file %s contains multiple IstioOperator CRs, only one per file is supported", fn)
		}
		ly, err = util.OverlayIOP(ly, string(b))
		if err != nil {
			return "", err
		}
	}
	return ly, nil
}

func hasMultipleIOPs(s string) (bool, error) {

	for {
		if s.ch == '`' {
			s.nextch()
			break
		}
		if s.ch < 0 {
			s.errorAtf(0, "string not terminated")
			ok = false
			break
		}
		s.nextch()
	}
	// We leave CRs in the string since they are part of the
	// literal (even though they are not part of the literal
	// value).

	s.setLit(StringLit, ok)
}

func (s *scanner) comment(text string) {
	s.errorAtf(0, "%s", text)

	ret, err := t.RESTOptionsGetter.GetRESTOptions(resource)
	if err == nil {
		d := schemaCoercingDecoder{delegate: ret.StorageConfig.Codec, validator: unstructuredSchemaCoercer{
			// drop invalid fields while decoding old CRs (before we haven't had any ObjectMeta validation)
			dropInvalidMetadata:   true,
			repairGeneration:      true,
			structuralSchemas:     t.structuralSchemas,
			structuralSchemaGK:    t.structuralSchemaGK,

		patchBytes, err = injector.Inject(pod, namespace)
	}
	if err != nil {
		return nil, err
	}
	// TODO(Monkeyanator) istioctl injection still applies just the pod annotation since we don't have
	// the ProxyConfig CRs here.
	if pca, f := metadata.GetAnnotations()[annotation.ProxyConfig.Name]; f {
		var merr error
		meshconfig, merr = mesh.ApplyProxyConfig(pca, meshconfig)
		if merr != nil {
			return nil, merr
		}
	}

	_, err := runManifestGenerate([]string{inPathBase}, "", liveCharts, []string{"templates/deployment.yaml"})
	if !strings.Contains(err.Error(), "contains multiple IstioOperator CRs, only one per file is supported") {
		t.Fatalf("got %v, expected error for file with multiple IOPs", err)
	}
}

func TestBareValues(t *testing.T) {
	inPathBase := filepath.Join(testDataDir, "input/bare_values.yaml")

	return func(t *testing.T, ctc *conversionTestContext) {
		ns := ctc.namespace
		clients := ctc.versionedClients(ns)

		// Create CRs at all storage versions
		objNames := []string{}
		for _, version := range versions {
			ctc.setAndWaitStorageVersion(t, version)

			name := "mixedstorage-stored-as-" + version

bew,?,??e&c&narusnihtlaehezitavirp,rofelacs.j,?gd&e&eruza,iamaka,?irbtib,?ht-no-eciffo,l&acs&liat.ateb,noom,?ibom-eruza,?m&ecnuob,itnuroieboda,ohtanyd,tcerider,?n&ilno-evreser,ozdop,?rehurht,s:abapus,,ti&s-repparcs,usegde,?zam&aym,kcar,??f&aeletis,crs.&cos,resu,?ehc-a-si,?g&ni&gats-&d&eziamaka,hiamaka,?e&gdeiamaka,tiusegde,?iamaka,nigiroiamaka,yekegde,?reesnes,sirkcilc,tsohnnylf,?olbevres,?i&amaka,pa-eruza,?k&catsvano,eeg-a&-si,si,?u,?l&acolottad,iamwt,meteh,s&d-ni,s-77ndc,??m&ac&asac,ih,?urofni...

bew,?,??e&c&narusnihtlaehezitavirp,rofelacs.j,?gd&e&eruza,iamaka,?irbtib,?ht-no-eciffo,l&acs&liat.ateb,noom,?ibom-eruza,?m&ecnuob,itnuroieboda,ohtanyd,tcerider,?n&ilno-evreser,ozdop,?rehurht,s:abapus,,ti&s-repparcs,usegde,?zam&aym,kcar,??f&aeletis,crs.&cos,resu,?ehc-a-si,?g&ni&gats-&d&eziamaka,hiamaka,?e&gdeiamaka,tiusegde,?iamaka,nigiroiamaka,yekegde,?reesnes,sirkcilc,tsohnnylf,?olbevres,?i&amaka,pa-eruza,?k&catsvano,eeg-a&-si,si,?u,?l&acolottad,iamwt,meteh,s&d-ni,s-77ndc,??m&ac&asac,ih,?urofni...