#!/usr/bin/env bash
# T54 - Multiple DestinationRules on the same host: subsets merge (union),
# but only the OLDEST DR's top-level trafficPolicy applies (newer DR's
# top-level trafficPolicy is silently ignored).
#
# NOTE ON HOST DOMAIN: this cluster's real k8s DNS domain is homelab.local
# (kubelet clusterDomain=homelab.local, CoreDNS serves homelab.local), but
# Istio's control plane on this cluster was installed with istiod --domain
# cluster.local (global.proxy.clusterDomain=cluster.local), which is what
# istiod uses to build internal service-registry hostnames for k8s Services
# regardless of the real cluster DNS domain. Envoy clusters are therefore
# named *.svc.cluster.local, and DestinationRule/VirtualService "host" fields
# MUST use that suffix to actually attach to real traffic. Using
# *.svc.homelab.local (which works fine for plain DNS/curl targets) does NOT
# match any Envoy cluster and silently produces a DR with zero effect.
set -euo pipefail

NS="istio-vt-t54"
WORKDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "[cleanup] deleting namespace ${NS}"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "[setup] creating namespace ${NS} (istio-injection=enabled)"
kubectl create namespace "${NS}" --dry-run=client -o yaml \
  | kubectl label -f - istio-injection=enabled --local -o yaml \
  | kubectl apply -f -

echo "[apply] client pod + multidr-echo v1/v2 deployments + svc (manifest.yaml, no DRs)"
# manifest.yaml also contains the initial "multidr-first" DR (host = svc.cluster.local,
# corrected). We apply everything at once here for simplicity; ordering vs. the
# second DR below is what matters for the "oldest DR wins" behavior.
kubectl apply -f "${WORKDIR}/manifest.yaml"

echo "[wait] client pod Ready"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s

echo "[wait] multidr-echo-v1 / multidr-echo-v2 Available"
kubectl -n "${NS}" wait --for=condition=available deploy/multidr-echo-v1 deploy/multidr-echo-v2 --timeout=60s

echo "[settle] sleep 3 (let multidr-first DR propagate to sidecars)"
sleep 3

echo "[apply] second DestinationRule (multidr-second, maxConnections=999, subset v2)"
kubectl apply -f - <<YAML
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: multidr-second
  namespace: ${NS}
spec:
  host: multidr-echo.${NS}.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 999
  subsets:
  - name: v2
    labels:
      version: v2
YAML

echo "[settle] sleep 5 (let multidr-second DR propagate to sidecars)"
sleep 5

echo "[observe] istioctl proxy-config cluster (expect: v1 + v2 subset clusters both present;"
echo "          default/no-subset cluster maxConnections=11 (multidr-first, oldest), NOT 999)"
istioctl proxy-config cluster "client.${NS}" \
  --fqdn "multidr-echo.${NS}.svc.cluster.local" -o json \
  | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}'