# T17 run 2 (r2) — combined reference manifest.
# Adaptation applied on top of the original spec (see harness-notes.md CORRECTION
# 2026-07-05 + this run's own finding below):
#   - Namespace substituted: ISTIO_VT_NS -> istio-vt-t17-r2
#   - ServiceEntry target replaced: mock.istio-verify-ext.svc.homelab.local -> httpbin.org
#     Reason: the original spec used an IN-CLUSTER k8s Service (svc/mock in ns
#     istio-verify-ext) dressed up as a "MESH_EXTERNAL" ServiceEntry host to
#     simulate an unregistered/external destination. Per harness-notes.md
#     correction bullet 4: "For 'unregistered destination' semantics (REGISTRY_ONLY
#     etc.): use a real external host (e.g. httpbin.org) — an in-cluster k8s
#     Service is IN the registry and is a wrong stand-in." svc/mock is a real k8s
#     Service, so istiod already carries an auto-registered entry for it
#     (mock.istio-verify-ext.svc.cluster.local, protocol http, via the Service's
#     port name) BEFORE any ServiceEntry is applied — this is exactly the
#     confound the correction warns about, independent of the homelab.local vs
#     cluster.local FQDN issue. httpbin.org is a genuine external host with no
#     pre-existing Istio registry entry, matching the established pattern already
#     used elsewhere in this cluster (mesh-test/{cnn-ext,httpbin-ext,wiki-ext,...}).
#   - The "cluster.local SE/DR hosts" part of the generic re-run guidance does NOT
#     apply here: ServiceEntry hosts are literal (harness-notes bullet 3) and are
#     NOT remapped by istiod's --domain=cluster.local flag (that flag only affects
#     auto-registered k8s Service hostnames). Rewriting the SE host to
#     "...svc.cluster.local" would break DNS resolution outright, since CoreDNS's
#     kubernetes zone is homelab.local and does not serve cluster.local records
#     (verified: Corefile has `kubernetes homelab.local ...`, no cluster.local
#     zone, forward-only for anything else).
#   - "short-name curls" guidance: not applicable — this test never curls an
#     in-mesh k8s Service directly (echo/mock); it only exercises a ServiceEntry
#     path. echo Deployment/Service are kept only for fixture parity with the
#     original spec's manifest; they are not exercised by any command below.
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: istio-vt-t17-r2
  labels:
    app: client
  annotations:
    sidecar.istio.io/inject: "true"
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo
  namespace: istio-vt-t17-r2
  labels:
    app: echo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: echo
  template:
    metadata:
      labels:
        app: echo
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: echo
        image: mendhak/http-https-echo:37
        env:
        - name: HTTP_PORT
          value: "8080"
        - name: HTTPS_PORT
          value: "8443"
        ports:
        - containerPort: 8080
        - containerPort: 8443
---
apiVersion: v1
kind: Service
metadata:
  name: echo
  namespace: istio-vt-t17-r2
spec:
  selector:
    app: echo
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443
---
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: httpbin-http-correct-se
  namespace: istio-vt-t17-r2
spec:
  hosts:
  - httpbin.org
  location: MESH_EXTERNAL
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS