ResourceNamesSubscribe: []string{},
	})
	resp := ads.ExpectResponse()
	assertResources(resp, "outbound|80||test-1.default", "outbound|8080||eds.test.svc.cluster.local", "inbound|80||")
	assert.Equal(t, resp.RemovedResources, nil)

	// On remove, just get the removal
	s.MemRegistry.RemoveService("test-1.default")
	resp = ads.ExpectResponse()

		expectRemoved(ads.ExpectResponse(), "/127.0.0.2")

		// Once we create it, we should get a push
		createPod(s, "pod2", "sa", "127.0.0.2", "node")
		expect(ads.ExpectResponse(), "Kubernetes//Pod/default/pod2")

		// TODO: implement pod update; this actually cannot really be done without waypoints or VIPs
		deletePod(s, "pod")
		expectRemoved(ads.ExpectResponse(), "Kubernetes//Pod/default/pod")

	for {
		select {
		case <-a.context.Done():
			return
		case r := <-a.responses:
			log.Infof("drained response %v", r.TypeUrl)
		}
	}
}

// ExpectResponse waits until a response is received and returns it
func (a *DeltaAdsTest) ExpectResponse() *discovery.DeltaDiscoveryResponse {
	a.t.Helper()
	select {
	case <-time.After(a.timeout):
		a.t.Fatalf("did not get response in time")
	case resp := <-a.responses:

	for {
		select {
		case <-a.context.Done():
			return
		case r := <-a.responses:
			log.Infof("drained response %v", r.TypeUrl)
		}
	}
}

// ExpectResponse waits until a response is received and returns it
func (a *AdsTest) ExpectResponse(t test.Failer) *discovery.DiscoveryResponse {
	t.Helper()
	select {
	case <-time.After(a.timeout):
		t.Fatalf("did not get response in time")
	case resp := <-a.responses:

	// A push should get a response for both
	s.Discovery.ConfigUpdate(&model.PushRequest{Full: true})
	ads.ExpectResponse(t)
	ads.ExpectResponse(t)
	// Close the connection and reconnect
	ads.Cleanup()
	ads = s.ConnectADS()

	// Send a request for EDS version 1 - we do not explicitly ACK this.
	ads.Request(t, &discovery.DiscoveryRequest{

	)

	testcases := []struct {
		name       string
		attrs      *admission.VersionedAttributes
		invocation *generic.WebhookInvocation

		expectRequest  func(uid types.UID) runtime.Object
		expectResponse runtime.Object
		expectErr      string
	}{
		{
			name: "no supported versions",
			invocation: &generic.WebhookInvocation{

				Response: &v1.ConversionResponse{},
			},
			ExpectResponse: &v1.ConversionReview{},
		},
		{
			Name:     "v1beta1",
			Versions: []string{"v1beta1", "v1", "v2"},
			ExpectRequest: &v1beta1.ConversionReview{
				Request:  &v1beta1.ConversionRequest{UID: "uid", DesiredAPIVersion: "foo/v1", Objects: objects},
				Response: &v1beta1.ConversionResponse{},
			},
			ExpectResponse: &v1beta1.ConversionReview{},
		},
	}

					content, _ := io.ReadAll(result.Body)
					if e, a := expectStatus, result.StatusCode; e != a {
						t.Log(string(content))
						t.Errorf("expected %v, got %v", e, a)
					}
					if tc.ExpectResponse != nil {
						tc.ExpectResponse(t, result, content)
					}

					// Make sure error responses come back with status objects in all encodings, including unknown encodings
					if !delegateCalled && expectStatus >= 300 {

		cert.ExpectNoResponse(t)
		root.ExpectNoResponse(t)

		s.UpdateSecret(testResourceName, pushSecret)
		s.Verify(cert.ExpectResponse(t), Expectation{
			ResourceName: testResourceName,
			CertChain:    fakePushCertificateChain,
			Key:          fakePushPrivateKey,
		})
		// No need to push a new root if just the cert changes