# NOTE: harness-notes.md states cluster DNS domain = homelab.local (NOT cluster.local).
# This is TRUE for actual DNS resolution (kubeadm clusterDomain / CoreDNS Corefile confirmed = homelab.local,
# and getent hosts echo.istio-vt-t13.svc.homelab.local resolves fine).
# HOWEVER istiod's own --domain flag is hardcoded to 'cluster.local' (confirmed via
# kubectl -n istio-system get deploy istiod -o jsonpath='{.spec.template.spec.containers[0].args}'),
# independent of the k8s cluster's actual clusterDomain. This means Istio's internal service
# registry / xDS naming for in-mesh k8s Services uses *.svc.cluster.local regardless of the real
# cluster DNS domain. A DestinationRule with host=echo.istio-vt-t13.svc.homelab.local produced
# istioctl analyze warning IST0174 'does not match any services in the mesh', and all istioctl
# proxy-config cluster --fqdn ...svc.homelab.local queries returned 0 results / null fields.
# Corrected host to echo.istio-vt-t13.svc.cluster.local (matching istiod's actual registry domain)
# to properly exercise the DestinationRule trafficPolicy field-mapping claim under test (T13's goal
# is unrelated to DNS domain semantics).

$ kubectl apply -f manifest.yaml && kubectl -n istio-vt-t13 wait --for=condition=Ready pod/client --timeout=90s
pod/client configured
deployment.apps/echo unchanged
service/echo unchanged
destinationrule.networking.istio.io/echo-field-map unchanged
pod/client condition met

$ sleep 5

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].circuitBreakers.thresholds[0] | {maxConnections, maxPendingRequests, maxRequests}'
{
  "maxConnections": 77,
  "maxPendingRequests": 42,
  "maxRequests": 88
}

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].upstreamConnectionOptions.tcpKeepalive'
{
  "keepaliveProbes": 3,
  "keepaliveTime": 60,
  "keepaliveInterval": 5
}

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].maxRequestsPerConnection'
null

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].lbPolicy'
"LEAST_REQUEST"

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].outlierDetection'
{
  "consecutive5xx": 4,
  "interval": "9s",
  "baseEjectionTime": "33s",
  "enforcingConsecutive5xx": 100,
  "enforcingSuccessRate": 0
}

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq 'length'   # expect exactly 1 cluster object holding all of the above
2


# ADDITIONAL DIAGNOSTIC: jq length returned 2, not 1 as pass_criteria's comment expected.
# Investigating: the echo Service in this test's own manifest exposes 2 ports (80 http, 443 https).
# istioctl proxy-config cluster --fqdn matches by HOST across ALL ports, so 2 separate Envoy
# cluster objects (one per port: 80 and 443) match the fqdn filter. This is expected Envoy/Istio
# behavior (cluster granularity = host+port), independent of DestinationRule structure. Checking
# whether BOTH per-port cluster objects individually contain the full co-located field set from
# the single DR (which is the real substance of the claim under test).

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '[.[] | {name, lbPolicy, maxRequestsPerConnection, circuitBreakers: .circuitBreakers.thresholds[0], tcpKeepalive: .upstreamConnectionOptions.tcpKeepalive, outlierDetection: (.outlierDetection != null)}]'
[
  {
    "name": "outbound|80||echo.istio-vt-t13.svc.cluster.local",
    "lbPolicy": "LEAST_REQUEST",
    "maxRequestsPerConnection": null,
    "circuitBreakers": {
      "maxConnections": 77,
      "maxPendingRequests": 42,
      "maxRequests": 88,
      "maxRetries": 4294967295
    },
    "tcpKeepalive": {
      "keepaliveProbes": 3,
      "keepaliveTime": 60,
      "keepaliveInterval": 5
    },
    "outlierDetection": true
  },
  {
    "name": "outbound|443||echo.istio-vt-t13.svc.cluster.local",
    "lbPolicy": "LEAST_REQUEST",
    "maxRequestsPerConnection": null,
    "circuitBreakers": {
      "maxConnections": 77,
      "maxPendingRequests": 42,
      "maxRequests": 88,
      "maxRetries": 4294967295
    },
    "tcpKeepalive": {
      "keepaliveProbes": 3,
      "keepaliveTime": 60,
      "keepaliveInterval": 5
    },
    "outlierDetection": true
  }
]


# maxRequestsPerConnection returned null at .[0].maxRequestsPerConnection (deprecated top-level
# Cluster field). Checking typedExtensionProtocolOptions, where modern Envoy relocates this
# setting under HttpProtocolOptions.common_http_protocol_options.max_requests_per_connection.

$ istioctl proxy-config cluster client.istio-vt-t13 --fqdn echo.istio-vt-t13.svc.cluster.local -o json | jq '.[0].typedExtensionProtocolOptions'
{
  "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
    "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
    "commonHttpProtocolOptions": {
      "maxRequestsPerConnection": 5
    },
    "explicitHttpConfig": {
      "httpProtocolOptions": {}
    }
  }
}