#!/usr/bin/env bash
# T07: ISTIO_MUTUAL Gateway + HTTPS-over-mTLS 2-leg pattern; leg-2 tcp vs tls/sniHosts filter chain count.
#
# NOTE on this cluster's environment (see result.txt for full diagnosis):
#   - Real k8s/CoreDNS DNS domain is homelab.local (kubeadm clusterDomain), so DNS names actually
#     resolved (curl URL host, --connect-to target, Gateway/VirtualService "hosts" SNI-match fields)
#     correctly use *.svc.homelab.local.
#   - BUT Istio's control plane here was installed with the default global.proxy.clusterDomain
#     (=cluster.local), so its internal ServiceRegistry hostnames (used for DestinationRule.host and
#     VirtualService route destination.host, which must match a *known* Istio service) are
#     *.svc.cluster.local, NOT homelab.local. Using homelab.local there yields "NC"/no-cluster.
#   - A DestinationRule with tls.mode: ISTIO_MUTUAL also needs an explicit trafficPolicy.tls.sni
#     pinned to the value the receiving Gateway's `hosts:` list matches on -- otherwise Envoy's
#     default auto-generated SNI ("outbound_.<port>_._.<host>") won't match the Gateway's SNI-based
#     filter chain and the connection is rejected with filter_chain_not_found.
set -euo pipefail

NS=istio-vt-t07
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "+ kubectl delete namespace $NS --wait=false --ignore-not-found"
  kubectl delete namespace "$NS" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "+ kubectl create namespace $NS"
kubectl create namespace "$NS"
echo "+ kubectl label namespace $NS istio-injection=enabled"
kubectl label namespace "$NS" istio-injection=enabled

echo "+ kubectl apply -f $DIR/manifest.yaml"
kubectl apply -f "$DIR/manifest.yaml"

echo "+ kubectl -n $NS wait --for=condition=Ready pod/client --timeout=120s"
kubectl -n "$NS" wait --for=condition=Ready pod/client --timeout=120s
echo "+ kubectl -n $NS rollout status deploy/echo --timeout=120s"
kubectl -n "$NS" rollout status deploy/echo --timeout=120s
echo "+ kubectl -n $NS rollout status deploy/httpsmtls-gw --timeout=120s"
kubectl -n "$NS" rollout status deploy/httpsmtls-gw --timeout=120s

CT="mock.istio-verify-ext.svc.homelab.local:443:httpsmtls-gw.$NS.svc.homelab.local:8443"
URL="https://mock.istio-verify-ext.svc.homelab.local/"

echo "+ curl leg2_tcp_baseline (expect 200)"
kubectl -n "$NS" exec client -c curl -- curl -sk -o /dev/null -w 'leg2_tcp_baseline=%{http_code}\n' \
  --connect-to "$CT" "$URL"

echo "+ filterChains baseline (expect >0)"
istioctl proxy-config listener "deploy/httpsmtls-gw.$NS" --port 8443 -o json | jq '.[0].filterChains | length'

echo "+ switch leg-2 route to tls/sniHosts"
kubectl -n "$NS" apply -f - <<YAML
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpsmtls-leg2-tcp
  namespace: $NS
spec:
  hosts:
  - mock.istio-verify-ext.svc.homelab.local
  gateways:
  - httpsmtls-gw
  tls:
  - match:
    - port: 8443
      sniHosts:
      - mock.istio-verify-ext.svc.homelab.local
    route:
    - destination:
        host: mock.istio-verify-ext.svc.cluster.local
        port:
          number: 443
YAML

sleep 8

echo "+ filterChains after switch (expect 0)"
istioctl proxy-config listener "deploy/httpsmtls-gw.$NS" --port 8443 -o json | jq '.[0].filterChains | length'

echo "+ istiod log grep 'must have more than 0 chain'"
kubectl -n istio-system logs deploy/istiod --since=1m | grep -i 'must have more than 0 chain' | tail -5 || true

echo "+ curl leg2_tls_broken (expect failure, exit != 0)"
set +e
kubectl -n "$NS" exec client -c curl -- curl -sk -o /dev/null -w 'leg2_tls_broken=%{http_code}\n' --max-time 4 \
  --connect-to "$CT" "$URL"
echo "exit=$?"
set -e

echo "+ revert leg-2 back to tcp"
kubectl apply -f "$DIR/manifest.yaml"

sleep 8

echo "+ curl leg2_tcp_restored (expect 200)"
kubectl -n "$NS" exec client -c curl -- curl -sk -o /dev/null -w 'leg2_tcp_restored=%{http_code}\n' \
  --connect-to "$CT" "$URL"

echo "Done."