#!/usr/bin/env bash
# T74 - SPIFFE ID in cert SAN (URI type), empty Subject, SDS memory-only delivery,
#       and client-side secure naming (matchSubjectAltNames) verification.
set -euo pipefail

NS="istio-vt-t74"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "[cleanup] deleting namespace ${NS}"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "[setup] creating namespace ${NS} with istio-injection=enabled"
kubectl create namespace "${NS}"
kubectl label namespace "${NS}" istio-injection=enabled --overwrite

echo "[setup] applying manifest.yaml"
kubectl apply -f "${SCRIPT_DIR}/manifest.yaml"

echo "[setup] waiting for client pod Ready"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s

echo "[setup] waiting for echo deployment rollout"
kubectl -n "${NS}" rollout status deployment/echo --timeout=120s

echo "[spec] sleep 5 (let sidecars settle / cert issuance complete)"
sleep 5

echo "[spec] echo pod serviceAccountName:"
kubectl -n "${NS}" get pod -l app=echo -o jsonpath='{.items[0].spec.serviceAccountName}{"\n"}'

echo "[spec] echo's istio-proxy certs (pilot-agent request GET certs):"
kubectl -n "${NS}" exec deploy/echo -c istio-proxy -- pilot-agent request GET certs 2>/dev/null | head -60

echo "[spec] find leaf cert/key files on echo's istio-proxy filesystem (expect: none, only CA root CM / OS trust store):"
kubectl -n "${NS}" exec deploy/echo -c istio-proxy -- find / -xdev -iname '*.pem' -o -iname '*cert*' 2>/dev/null | grep -v proc | head -20

echo "[spec] client's outbound TLS validation_context for echo cluster (secure naming check):"
echo "  NOTE: this cluster's real k8s DNS domain is homelab.local, but Istio's proxy"
echo "  clusterDomain defaults to cluster.local, so the Envoy cluster name uses"
echo "  *.svc.cluster.local (not *.svc.homelab.local) -- use the corrected FQDN below."
istioctl proxy-config cluster "client.${NS}" --fqdn "echo.${NS}.svc.cluster.local" -o json \
  | jq '.[1].transportSocketMatches // .[0].transportSocket.typedConfig.commonTlsContext.combinedValidationContext.defaultValidationContext.matchSubjectAltNames'

echo "[done] see result.txt in this directory for the original run's full captured output."