#!/usr/bin/env bash
# T15 — portLevelSettings full-replace-vs-partial-inherit test
#
# NOTE on FQDN: harness-notes.md states the cluster DNS domain is homelab.local
# (kubeadm dnsDomain / CoreDNS zone), and that IS correct for actual DNS
# resolution. However istiod's internal Envoy cluster registry names
# Kubernetes Services with a hardcoded "cluster.local" suffix regardless of the
# real kubeadm cluster domain (confirmed empirically — see result.txt). A
# DestinationRule authored with `host: ...svc.homelab.local` therefore never
# attaches to any real cluster in THIS install. This script uses the FQDN that
# actually matches istiod's Envoy cluster names (svc.cluster.local) so the
# DestinationRule/VirtualService take effect and the portLevelSettings
# override behavior can be observed.
set -euo pipefail

NS="istio-vt-t15"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  kubectl delete namespace "$NS" --wait=false --ignore-not-found
}
trap cleanup EXIT

kubectl create namespace "$NS"
kubectl label namespace "$NS" istio-injection=enabled

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: ${NS}
  labels:
    app: client
  annotations:
    sidecar.istio.io/inject: "true"
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: portlevel-echo
  namespace: ${NS}
  labels:
    app: portlevel-echo
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: portlevel-echo
      version: v1
  template:
    metadata:
      labels:
        app: portlevel-echo
        version: v1
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: echo
        image: mendhak/http-https-echo:37
        ports:
        - containerPort: 8080
        - containerPort: 8443
---
apiVersion: v1
kind: Service
metadata:
  name: portlevel-echo
  namespace: ${NS}
spec:
  selector:
    app: portlevel-echo
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443
---
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: portlevel-echo-dr
  namespace: ${NS}
spec:
  host: portlevel-echo.${NS}.svc.cluster.local
  subsets:
  - name: v1
    labels:
      version: v1
    trafficPolicy:
      connectionPool:
        tcp:
          maxConnections: 55
      portLevelSettings:
      - port:
          number: 443
        tls:
          mode: DISABLE
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: portlevel-echo-vs
  namespace: ${NS}
spec:
  hosts:
  - portlevel-echo.${NS}.svc.cluster.local
  http:
  - match:
    - port: 443
    route:
    - destination:
        host: portlevel-echo.${NS}.svc.cluster.local
        subset: v1
        port:
          number: 443
  - route:
    - destination:
        host: portlevel-echo.${NS}.svc.cluster.local
        subset: v1
        port:
          number: 80
EOF

kubectl -n "$NS" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "$NS" wait --for=condition=available deploy/portlevel-echo --timeout=60s

sleep 5

echo "=== cluster circuit-breaker maxConnections per port/subset ==="
istioctl proxy-config cluster "client.${NS}" \
  --fqdn "portlevel-echo.${NS}.svc.cluster.local" -o json \
  | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}'

echo
echo "Expected: outbound|80|v1|...   -> maxConn 55"
echo "Expected: outbound|443|v1|...  -> maxConn 4294967295 (default/absent — connectionPool wiped by portLevelSettings override)"