}

	_, err = tc.CoreV1().Pods("nsB").Create(context.TODO(), testPod("", "pod-1"), metav1.CreateOptions{})
	if err != nil {
		t.Fatalf("Pods.Create nsB/pod-1: %s", err)
	}

	podB1, err := tc.CoreV1().Pods("nsB").Get(context.TODO(), "pod-1", metav1.GetOptions{})
	if err != nil {
		t.Fatalf("Pods.Get nsB/pod-1: %s", err)
	}
	if podB1 == nil {
		t.Fatalf("Expected to find pod nsB/pod-1 but it wasn't found")
	}

		constants.CACertNamespaceConfigMapDataName: string(caBundle),
	}

	nsA := "nsA"
	nsB := "nsB"

	// Create a namespace with discovery selector enabled
	createNamespace(t, client.Kube(), nsA, map[string]string{"discovery-selectors": "enabled"})
	// Create a namespace without discovery selector enabled
	createNamespace(t, client.Kube(), nsB, map[string]string{})
	expectConfigMap(t, nc.configmaps, CACertNamespaceConfigMap, nsA, expectedData)

apiVersion: v1
kind: Pod
metadata:
  name: b
  namespace: nsb
  labels:
    prune-group: "true"
spec:
  containers:
  - name: kubernetes-pause

		controller,
	)

	// namespace nsB, nsC deselected
	fx.AssertEmpty(t, 0)

	// create vs1 in nsA
	createVirtualService(controller, "vs1", nsA, map[string]string{}, t)

	// create vs1 in nsB
	createVirtualService(controller, "vs2", nsB, map[string]string{}, t)

	// expand namespaces to nsA and nsB with selectors (expect events svc3 and a full push event for nsB selected)
	updateMeshConfig(

// standalone apiserver.
func initTestEnv(t *testing.T, ki kubernetes.Interface, fx *xdsfake.Updater) {
	cleanup(ki)
	for _, n := range []string{"nsa", "nsb"} {
		_, err := ki.CoreV1().Namespaces().Create(context.TODO(), &v1.Namespace{
			ObjectMeta: metav1.ObjectMeta{
				Name: n,
				Labels: map[string]string{
					"istio-injection": "enabled",
				},
			},