#!/usr/bin/env bash
# T01: Sidecar egress.hosts narrows push scope but does NOT block traffic
# (scope reduction != traffic block; ALLOW_ANY default still passes through
# PassthroughCluster; an idle egress-gateway pod with no routing carries no traffic).
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NS=istio-vt-t01

cleanup() {
  echo "=== cleanup: deleting namespace $NS ==="
  kubectl delete namespace "$NS" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "=== create namespace ==="
kubectl create namespace "$NS"
kubectl label namespace "$NS" istio-injection=enabled

echo "=== phase 1: apply client+echo, wait for Ready ==="
kubectl apply -f "$SCRIPT_DIR/client-echo.yaml"
kubectl -n "$NS" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "$NS" rollout status deploy/echo --timeout=90s

echo "=== baseline observations (no Sidecar scoping yet) ==="
N0=$(istioctl proxy-config cluster client."$NS" 2>/dev/null | tail -n +2 | wc -l)
echo "baseline_clusters=$N0"

kubectl -n "$NS" exec client -c curl -- curl -s -o /dev/null -w 'baseline_mock_http=%{http_code}\n' \
  http://mock.istio-verify-ext.svc.homelab.local/
kubectl -n "$NS" exec client -c curl -- curl -sk -o /dev/null -w 'baseline_mock_https=%{http_code}\n' \
  https://mock.istio-verify-ext.svc.homelab.local:443/

echo "=== phase 2: apply idle egress-gateway pod + narrow-egress Sidecar ==="
kubectl apply -f "$SCRIPT_DIR/idle-egressgw.yaml" -f "$SCRIPT_DIR/narrow-egress-sidecar.yaml"
kubectl -n "$NS" wait --for=condition=Ready pod/idle-egressgw --timeout=90s
sleep 8   # allow xDS push to converge

echo "=== scoped observations (after narrow-egress Sidecar applied) ==="
N1=$(istioctl proxy-config cluster client."$NS" 2>/dev/null | tail -n +2 | wc -l)
echo "scoped_clusters=$N1"

# NOTE: istioctl proxy-config cluster prints FQDNs using Istio's internal
# proxy.clusterDomain convention ("cluster.local"), which is independent of
# this cluster's actual kubelet/CoreDNS clusterDomain (homelab.local). Grep
# on the domain istioctl actually emits, not the cluster's real DNS domain.
echo "scoped namespace set (should be exactly: istio-system, $NS):"
istioctl proxy-config cluster client."$NS" 2>/dev/null | tail -n +2 | awk '{print $1}' \
  | grep -oE '[a-zA-Z0-9-]+\.[a-zA-Z0-9-]+\.svc\.cluster\.local' \
  | awk -F. '{print $2}' | sort -u

kubectl -n "$NS" exec client -c curl -- curl -s -o /dev/null -w 'scoped_mock_http=%{http_code}\n' \
  http://mock.istio-verify-ext.svc.homelab.local/
kubectl -n "$NS" exec client -c curl -- curl -sk -o /dev/null -w 'scoped_mock_https=%{http_code}\n' \
  https://mock.istio-verify-ext.svc.homelab.local:443/

# NOTE: idle-egressgw is a bare Pod (not a Deployment) in the manifest, so
# `kubectl logs deploy/idle-egressgw` 404s -- use `pod/idle-egressgw`.
kubectl -n "$NS" logs pod/idle-egressgw -c istio-proxy --since=2m | grep -ci mock || \
  echo 'idle-egressgw saw 0 mock-related log lines (no VirtualService routes to it, so it never carried this traffic)'

echo "=== done ==="