#!/usr/bin/env bash
# T06: pod-label 기반 NetworkPolicy가 mTLS handshake 없이도 커널 레벨에서
# '비-핸드셰이크 신원' 역할을 하는지 검증.
set -euo pipefail

NS="istio-vt-t06"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "--- cleanup: deleting namespace ${NS} ---"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "--- create namespace ---"
kubectl create namespace "${NS}"
kubectl label namespace "${NS}" istio-injection=enabled

echo "--- apply manifest ---"
kubectl apply -f "${SCRIPT_DIR}/manifest.yaml"

echo "--- wait for pods ready ---"
kubectl -n "${NS}" wait --for=condition=Ready pod/target pod/trusted-caller pod/other-caller --timeout=120s

echo "--- trusted-caller (role=trusted) -> target:8080 ---"
kubectl -n "${NS}" exec trusted-caller -- curl -s -o /dev/null -w 'trusted=%{http_code}\n' --max-time 4 http://target:8080/

echo "--- other-caller (role=other) -> target:8080 ---"
set +e
kubectl -n "${NS}" exec other-caller -- curl -s -o /dev/null -w 'other=%{http_code}\n' --max-time 4 http://target:8080/
echo "other_exit=$?"
set -e