#!/usr/bin/env bash
# T08: 같은 gateway workload/포트(8443)에 PASSTHROUGH server(host A)와
# ISTIO_MUTUAL server(host B)를 동시에 선언했을 때 filter chain이 SNI로
# 정상 공존하는지, 아니면 머지 충돌로 한쪽이 드롭되는지 관찰한다.
set -euo pipefail

NS="istio-vt-t08"
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "--- cleanup: deleting namespace ${NS} ---"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "--- create namespace ${NS} (istio-injection=enabled) ---"
kubectl create namespace "${NS}" --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace "${NS}" istio-injection=enabled --overwrite

echo "--- apply manifest ---"
kubectl apply -f "${DIR}/manifest.yaml"

echo "--- wait for workloads ready ---"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "${NS}" rollout status deploy/portconflict-gw --timeout=90s
kubectl -n "${NS}" rollout status deploy/echo --timeout=90s

echo "--- observe: filter chain count on port 8443 ---"
istioctl proxy-config listener "deploy/portconflict-gw.${NS}" --port 8443 -o json \
  | jq '.[0].filterChains | length'

echo "--- observe: filter chain match (SNI) per chain ---"
istioctl proxy-config listener "deploy/portconflict-gw.${NS}" --port 8443 -o json \
  | jq '.[0].filterChains[].filterChainMatch'

echo "--- observe: istiod logs for conflict/filter_chain_not_found ---"
kubectl -n istio-system logs deploy/istiod --since=1m \
  | grep -iE 'portconflict|conflict|filter_chain_not_found' | tail -10 || true

echo "--- observe: via_A (PASSTHROUGH -> mock.istio-verify-ext) ---"
kubectl -n "${NS}" exec client -c curl -- curl -sk -o /dev/null -w 'via_A_passthrough=%{http_code}\n' \
  --connect-to "mock.istio-verify-ext.svc.homelab.local:443:portconflict-gw.${NS}.svc.homelab.local:8443" \
  "https://mock.istio-verify-ext.svc.homelab.local/" || true

echo "--- observe: via_B (ISTIO_MUTUAL -> echo.${NS}) ---"
kubectl -n "${NS}" exec client -c curl -- curl -sk -o /dev/null -w 'via_B_mutual=%{http_code}\n' \
  --connect-to "echo.${NS}.svc.homelab.local:443:portconflict-gw.${NS}.svc.homelab.local:8443" \
  "https://echo.${NS}.svc.homelab.local/" || true

echo "--- done (see result.txt in this session's run for the captured judgement) ---"