For 2.x -> 3.0 migration we need to run both control planes in parallel. It is possible when running them in the same namespace. But when they are in different namespaces, 2.x and 3.0 istiod are fighting over CA certs.

We have to decide to either:

• restrict where to install new control plane in the migration guide
• investigate if it's possible to use discovery selectors to fix this issue properly