// Add a new pod to the service, we should see it
	s.addWorkloadEntries(t, "127.0.0.4", "name4", "sa4", map[string]string{"app": "a"})
	s.assertWorkloads(t, "", workloadapi.WorkloadStatus_HEALTHY, "name1", "name2", "name3", "name4")
	s.assertWorkloads(t, s.addrXdsName("10.0.0.1"), workloadapi.WorkloadStatus_HEALTHY, "name1", "name2", "name4")
	s.assertEvent(t, s.wleXdsName("name4"))

	// Delete it, should remove from the Service as well

		ObjectMeta: metav1.ObjectMeta{Name: "name3", Namespace: "not-selected"},
	})
	vst.Create(&istionetclient.VirtualService{
		ObjectMeta: metav1.ObjectMeta{Name: "name4", Namespace: "selected"},
	})
	tracker.WaitOrdered("add/name4")
}

func TestFilterClusterScoped(t *testing.T) {
	tracker := assert.NewTracker[string](t)
	c := kube.NewFakeClient()

	gwHTTPWildcard := makeConfig("foo3", "not-default", "*", "name3", "http", 8, "ingressgateway", "", networking.ServerTLSSettings_SIMPLE)
	gwTCPWildcard := makeConfig("foo4", "not-default-2", "*", "name4", "tcp", 8, "ingressgateway", "", networking.ServerTLSSettings_SIMPLE)

	gwHTTPWildcardAlternate := makeConfig("foo2", "not-default", "*", "name2", "http", 7, "ingressgateway2", "", networking.ServerTLSSettings_SIMPLE)

	}

	checkObject(t, store, "ns1", "name1", true)
	checkObject(t, store, "ns2", "name2", false)
	checkObject(t, store, "ns3", "name3", true)
	checkObject(t, store, "ns4", "name4", false)
}

func TestSecretStoreDeletingSecret(t *testing.T) {
	fakeClient := &fake.Clientset{}
	store := newSecretStore(fakeClient, clock.RealClock{}, noObjectTTL, 0)
	store.AddReference("ns", "name", "pod")