#!/usr/bin/env bash
# T12: consecutiveGatewayErrors vs TCP connect failure accounting.
#
# IMPORTANT deviation from the original spec's exec target: the spec commands
# said `kubectl exec client -c istio-proxy -- curl ...`. The istio-proxy
# container runs as UID 1337, and Istio's iptables interception rules
# explicitly RETURN (skip redirect) for traffic owned by UID 1337 to avoid
# routing the proxy's own traffic back into itself. That means curl run
# inside -c istio-proxy never transits the sidecar at all (verified:
# cx_total/cx_connect_fail stayed 0 the whole time). The correct vantage
# point to actually exercise sidecar interception + outlier detection is the
# application container ("-c curl" here), which this script uses.
set -euo pipefail

NS=istio-vt-t12
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "[cleanup] deleting namespace ${NS}"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "[setup] creating namespace ${NS} with istio-injection=enabled"
kubectl create namespace "${NS}" --dry-run=client -o yaml | \
  kubectl label -f - istio-injection=enabled --local -o yaml | \
  kubectl apply -f -

echo "[setup] applying manifest.yaml"
kubectl apply -f "${DIR}/manifest.yaml"

echo "[wait] pod/client Ready"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s

echo "[wait] deploy/echo rollout"
kubectl -n "${NS}" rollout status deploy/echo --timeout=90s

echo "[observe] 14x request to dead port 8299 from the APP container (uid 100),"
echo "          polling /clusters health_flags after every attempt"
for i in $(seq 1 14); do
  code=$(kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null -w '%{http_code}' \
    --max-time 2 http://mock.istio-verify-ext.svc.homelab.local:8299/ 2>&1 || true)
  hf=$(kubectl -n "${NS}" exec client -c istio-proxy -- curl -s 'localhost:15000/clusters' 2>&1 | \
    grep 'outbound|8299||mock.istio-verify-ext.svc.homelab.local::10.250.183.220:8299::health_flags' || true)
  echo "attempt ${i}: http_code=${code} | ${hf}"
  sleep 1
done

echo "[observe] final /clusters dump for the target cluster"
kubectl -n "${NS}" exec client -c istio-proxy -- curl -s 'localhost:15000/clusters' | \
  grep 'outbound|8299||mock.istio-verify-ext.svc.homelab.local'

echo "[done] look for health_flags flipping to /failed_outlier_check after the 3rd failed attempt"