ResourceNamesSubscribe: []string{},
	})
	resp := ads.ExpectResponse()
	assertResources(resp, "outbound|80||test-1.default", "outbound|8080||eds.test.svc.cluster.local", "inbound|80||")
	assert.Equal(t, resp.RemovedResources, nil)

	// On remove, just get the removal
	s.MemRegistry.RemoveService("test-1.default")
	resp = ads.ExpectResponse()

		expectRemoved(ads.ExpectResponse(), "/127.0.0.2")

		// Once we create it, we should get a push
		createPod(s, "pod2", "sa", "127.0.0.2", "node")
		expect(ads.ExpectResponse(), "Kubernetes//Pod/default/pod2")

		// TODO: implement pod update; this actually cannot really be done without waypoints or VIPs
		deletePod(s, "pod")
		expectRemoved(ads.ExpectResponse(), "Kubernetes//Pod/default/pod")

	for {
		select {
		case <-a.context.Done():
			return
		case r := <-a.responses:
			log.Infof("drained response %v", r.TypeUrl)
		}
	}
}

// ExpectResponse waits until a response is received and returns it
func (a *DeltaAdsTest) ExpectResponse() *discovery.DeltaDiscoveryResponse {
	a.t.Helper()
	select {
	case <-time.After(a.timeout):
		a.t.Fatalf("did not get response in time")
	case resp := <-a.responses:

	for {
		select {
		case <-a.context.Done():
			return
		case r := <-a.responses:
			log.Infof("drained response %v", r.TypeUrl)
		}
	}
}

// ExpectResponse waits until a response is received and returns it
func (a *AdsTest) ExpectResponse(t test.Failer) *discovery.DiscoveryResponse {
	t.Helper()
	select {
	case <-time.After(a.timeout):
		t.Fatalf("did not get response in time")
	case resp := <-a.responses:

	// A push should get a response for both
	s.Discovery.ConfigUpdate(&model.PushRequest{Full: true})
	ads.ExpectResponse(t)
	ads.ExpectResponse(t)
	// Close the connection and reconnect
	ads.Cleanup()
	ads = s.ConnectADS()

	// Send a request for EDS version 1 - we do not explicitly ACK this.
	ads.Request(t, &discovery.DiscoveryRequest{

		cert.ExpectNoResponse(t)
		root.ExpectNoResponse(t)

		s.UpdateSecret(testResourceName, pushSecret)
		s.Verify(cert.ExpectResponse(t), Expectation{
			ResourceName: testResourceName,
			CertChain:    fakePushCertificateChain,
			Key:          fakePushPrivateKey,
		})
		// No need to push a new root if just the cert changes