// Using an index for selectoes is problematic because selector != label
	// We can match a label to a selector, but we can't generate a selector from a label.
	c.ForEach(gvk.Telemetry, func(rs *resource.Instance) bool {
		s := rs.Message.(*v1alpha1.Telemetry)

		// For this analysis, ignore Telemetries with no selectors specified at all.
		if s.Selector == nil || len(s.GetSelector().MatchLabels) == 0 {

	"istio.io/istio/pkg/config/analysis/msg"
	"istio.io/istio/pkg/config/resource"
	"istio.io/istio/pkg/config/schema/gvk"
)

// SelectorAnalyzer validates, per namespace, that:
// * sidecar resources that define a workload selector match at least one pod
// * there aren't multiple sidecar resources that select overlapping pods
type SelectorAnalyzer struct{}

var _ analysis.Analyzer = &SelectorAnalyzer{}

// Metadata implements Analyzer

)

// ByServiceSelector returns a predicate that matches workload instances
// of a given service.
func ByServiceSelector(namespace string, selector labels.Instance) func(*model.WorkloadInstance) bool {
	return func(wi *model.WorkloadInstance) bool {
		return wi.Namespace == namespace && selector.Match(wi.Endpoint.Labels)
	}
}

// FindAllInIndex returns a list of workload instances in the index
// that match given predicate.
//

        result.projectPath == selector.projectPath
        result.projectPath() == selector.projectPath()
        result.projectName == selector.projectName
        result.requestedCapabilities == selector.requestedCapabilities
    }

    def "serializes root build ProjectComponentSelector"() {
        given:

kind: Telemetry
metadata:
  name: dupe-1
  namespace: default
spec:
  selector:
    matchLabels:
      app: reviews # Multiple telemetries have the same selector, should generate errors for both
  metrics:
    - providers:
        - name: prometheus
      overrides:
        - match:
            metric: ALL_METRICS
          disabled: false
---
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:

spec:
  containers:
  - image: proxyv2:1.3.1
    name: istio-proxy
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  namespace: default
  name: ra-ineffective
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1

    labels:
      app: reviews # Multiple sidecars have the same selector, should generate errors for both
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: dupe-2
  namespace: default
spec:
  workloadSelector:
    labels:
      app: reviews # Multiple sidecars have the same selector, should generate errors for both
  egress:
  - hosts:
    - "./*"

kind: Telemetry
metadata:
  name: no-selector # Since this is the only Telemetry in the namespace without a selector, no conflict
  namespace: ns1
spec:
  metrics:
  - providers:
    - name: prometheus
    overrides:
    - match:
        metric: ALL_METRICS
      disabled: false
---
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: has-selector
  namespace: ns1
spec:

kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace

apiVersion: v1
kind: Pod
metadata:
  name: selector-test-pod
  labels:
    name: selector-test-pod
    unique-label: bingbang
spec:
  containers:
  - name: kubernetes-pause