#!/usr/bin/env bash
# T68: DestinationRule subset은 정의만으로는 트래픽을 제한하지 않으며,
#      CDS subset cluster 생성 자체도 DR이 있어야 istiod가 만든다.
#      VirtualService가 subset을 명시적으로 가리켜야 실제 라우팅 제한이 발동한다.
#
# NOTE on this cluster (2026-07 istio-vt-t68 run):
#   istiod runs with --domain cluster.local (its internal service-registry
#   domain), which is INDEPENDENT of and DIFFERENT FROM this k8s cluster's
#   real kubeadm clusterDomain (homelab.local, confirmed via /etc/resolv.conf).
#   `istioctl analyze` flags DR/VS objects written with the real DNS suffix
#   (*.svc.homelab.local) as IST0174 "does not match any services in the
#   mesh" -- such objects are silently orphaned (no CDS/RDS effect at all).
#   So this script deliberately uses the *.svc.cluster.local host in the
#   DestinationRule/VirtualService (to match istiod's actual registry), and
#   uses the bare short Service name ("gate-echo") as the curl target,
#   because that bare name IS one of the domain aliases Envoy's RDS virtual
#   host matches on for this Service (confirmed via
#   `istioctl proxy-config routes` domains list), while the real
#   *.svc.homelab.local FQDN is NOT in that alias list and falls through to
#   an unrelated default/passthrough path.
set -euo pipefail

NS=istio-vt-t68
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  kubectl delete namespace "$NS" --wait=false --ignore-not-found >/dev/null 2>&1 || true
}
trap cleanup EXIT

kubectl create namespace "$NS"
kubectl label namespace "$NS" istio-injection=enabled

kubectl apply -f "$DIR/manifest.yaml"
kubectl -n "$NS" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "$NS" wait --for=condition=available deploy/gate-echo-v1 deploy/gate-echo-v2 --timeout=60s

echo "### 1) BEFORE any DestinationRule: subset cluster count for name-contains(gate-echo)+|v1| (expect 0)"
istioctl proxy-config cluster "client.$NS" -o json \
  | jq '[.[] | select(.name | contains("gate-echo") and contains("|v1|"))] | length'

echo "### 2) apply DestinationRule with v1/v2 subsets (host matches istiod's actual internal domain: cluster.local)"
kubectl apply -f - <<YAML
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: gate-echo-dr
  namespace: $NS
spec:
  host: gate-echo.$NS.svc.cluster.local
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
YAML
sleep 5

echo "### 3) AFTER DestinationRule (no VirtualService yet): subset clusters should now exist in CDS"
istioctl proxy-config cluster "client.$NS" -o json \
  | jq '[.[] | select(.name | contains("gate-echo"))] | map(.name)'

echo "### 4) 20x curl (DR only, no VS) via short-name host that matches Envoy's route table -> expect MIXED v1-ok/v2-ok"
kubectl -n "$NS" exec client -c curl -- sh -c 'for i in $(seq 1 20); do curl -s http://gate-echo/; echo; done' \
  | sort | uniq -c

echo "### 5) apply VirtualService routing explicitly to subset v1"
kubectl apply -f - <<YAML
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: gate-echo-vs
  namespace: $NS
spec:
  hosts:
  - gate-echo.$NS.svc.cluster.local
  http:
  - route:
    - destination:
        host: gate-echo.$NS.svc.cluster.local
        subset: v1
YAML
sleep 5

echo "### 6) 20x curl (VS now pins subset:v1) -> expect ONLY v1-ok"
kubectl -n "$NS" exec client -c curl -- sh -c 'for i in $(seq 1 20); do curl -s http://gate-echo/; echo; done' \
  | sort | uniq -c

echo "### done -- namespace $NS will be deleted on exit (trap)"