#!/usr/bin/env bash
# T36: Sidecar workloadSelector scope is not merge but the narrowest-match wins (full override)
set -euo pipefail

NS="istio-vt-t36"
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "=== cleanup: deleting namespace ${NS} ==="
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "=== create namespace ${NS} (istio-injection=enabled) ==="
kubectl create namespace "${NS}"
kubectl label namespace "${NS}" istio-injection=enabled

echo "=== apply client + echo workloads ==="
kubectl apply -f "${DIR}/client-echo.yaml"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "${NS}" rollout status deployment/echo --timeout=120s
kubectl -n "${NS}" get pods -o wide

echo "=== apply namespace-wide broad Sidecar (egress: ./* , istio-system/*) ==="
kubectl apply -f "${DIR}/ns-wide-sidecar.yaml"
sleep 5

echo "=== BEFORE workload-specific Sidecar: count of istio-system clusters on client (expect > 0) ==="
istioctl proxy-config cluster client."${NS}" 2>/dev/null | grep -c 'istio-system' || true
echo "above should be > 0 (ns-wide default allows istio-system)"

echo "=== apply workload-specific narrow Sidecar selecting app=client (egress: ./* only) ==="
kubectl apply -f "${DIR}/workload-narrow-sidecar.yaml"
sleep 5

echo "=== AFTER workload-specific Sidecar: count of istio-system clusters on client (expect 0) ==="
istioctl proxy-config cluster client."${NS}" 2>/dev/null | grep -c 'istio-system' || true
echo "above should be 0 now (workload Sidecar overrides, does not inherit ns-wide istio-system entry)"

echo "=== sanity: cluster count still non-zero (namespace-local echo still reachable) ==="
istioctl proxy-config cluster client."${NS}" 2>/dev/null | tail -n +2 | wc -l

echo "=== full cluster listing for inspection ==="
istioctl proxy-config cluster client."${NS}" 2>/dev/null

echo "=== done ==="