#!/usr/bin/env bash
# T19: Istio 1.30 default protocol sniffing L7 routing without http/http2/grpc port-name prefix
set -euo pipefail

NS="istio-vt-t19"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "[cleanup] deleting namespace ${NS}"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "[setup] creating namespace ${NS} with istio-injection=enabled"
kubectl create namespace "${NS}" --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace "${NS}" istio-injection=enabled --overwrite

echo "[apply] manifest.yaml (client pod, unnamed-port-echo deploy/svc, VirtualService w/ 418 fault)"
kubectl apply -f "${SCRIPT_DIR}/manifest.yaml"

echo "[wait] client pod Ready, unnamed-port-echo deploy Available"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "${NS}" wait --for=condition=available deploy/unnamed-port-echo --timeout=60s

echo "[wait] 5s for xDS config propagation"
sleep 5

echo "[observe] curl through mesh to unnamed (no-prefix) port -- as literally specified"
kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null \
  -w 'noprefix_l7_fault=%{http_code}\n' \
  "http://unnamed-port-echo.${NS}.svc.homelab.local/"

echo "[observe] client outbound listener filter chain for port 80 (expect http_connection_manager if sniffed as L7)"
istioctl proxy-config listener "client.${NS}" --port 80 -o json \
  | jq '.[0].filterChains[0].filters[].name'

# --- Diagnostic note (see result.txt for full writeup) ---
# In this cluster, istiod's internal service registry domain is "cluster.local" (istiod --domain
# flag), which differs from the cluster's real kubeadm/CoreDNS clusterDomain "homelab.local" used
# for actual name resolution. A VirtualService's `hosts:` must match Istio's registry domain
# (cluster.local) to be attached to the route, NOT the real DNS domain. The manifest.yaml VS in
# this repo already uses `.svc.homelab.local` per harness-notes DNS-domain convention, which will
# NOT match the registry and will NOT show the fault (200, not 418) -- this is a known, isolated
# confound in this cluster, not a refutation of protocol sniffing itself. To directly observe the
# sniffing claim, run the corrective check below (matches what was done during manual T19 execution):
echo "[corrective check] re-point VS host at Istio's actual registry domain (svc.cluster.local) to isolate the sniffing claim from the registry-domain confound"
cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: unnamed-port-echo-vs
  namespace: ${NS}
spec:
  hosts:
  - unnamed-port-echo.${NS}.svc.cluster.local
  http:
  - fault:
      abort:
        percentage:
          value: 100
        httpStatus: 418
    route:
    - destination:
        host: unnamed-port-echo.${NS}.svc.cluster.local
EOF
sleep 5
kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null \
  -w 'corrected_vs_l7_fault=%{http_code}\n' \
  "http://unnamed-port-echo.${NS}.svc.homelab.local/"

echo "[done] see result.txt / verdict.json from the original run for full analysis"