package k3k_test

import (
	"context"

	"sigs.k8s.io/controller-runtime/pkg/client"

	networkingv1 "k8s.io/api/networking/v1"

	k3kcontroller "github.com/rancher/k3k/pkg/controller"
	"github.com/rancher/k3k/pkg/controller/policy"
	fwk3k "github.com/rancher/k3k/tests/framework/k3k"

	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
)

var _ = When("two virtual clusters are installed", Label(networkingTestsLabel), Label(slowTestsLabel), func() {
	var (
		cluster1 *VirtualCluster
		cluster2 *VirtualCluster
	)

	BeforeEach(func() {
		clusters := NewVirtualClusters(2)
		cluster1 = clusters[0]
		cluster2 = clusters[1]
	})

	AfterEach(func() {
		fwk3k.DeleteNamespaces(k8s, cluster1.Cluster.Namespace, cluster2.Cluster.Namespace)
	})

	It("can create pods in each of them that are isolated", func() {
		pod1Cluster1, pod1Cluster1IP := cluster1.NewNginxPod("")
		pod2Cluster1, pod2Cluster1IP := cluster1.NewNginxPod("")
		pod1Cluster2, pod1Cluster2IP := cluster2.NewNginxPod("")

		var (
			stdout  string
			curlCmd string
			err     error
		)

		By("Checking that Pods can reach themselves")

		curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
		stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
		Expect(err).To(Not(HaveOccurred()))
		Expect(stdout).To(ContainSubstring("Welcome to nginx!"))

		curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
		stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
		Expect(err).To(Not(HaveOccurred()))
		Expect(stdout).To(ContainSubstring("Welcome to nginx!"))

		curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
		stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
		Expect(err).To(Not(HaveOccurred()))
		Expect(stdout).To(ContainSubstring("Welcome to nginx!"))

		// Pods in the same Virtual Cluster should be able to reach each other
		// Pod1 should be able to call Pod2, and viceversa

		By("Checking that Pods in the same virtual clusters can reach each other")

		curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
		stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
		Expect(err).To(Not(HaveOccurred()))
		Expect(stdout).To(ContainSubstring("Welcome to nginx!"))

		curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
		stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
		Expect(err).To(Not(HaveOccurred()))
		Expect(stdout).To(ContainSubstring("Welcome to nginx!"))

		By("Checking that Pods in the different virtual clusters cannot reach each other")

		// Pods in Cluster 1 should not be able to reach the Pod in Cluster 2

		curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
		stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
		Expect(err).Should(HaveOccurred())
		Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))

		curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
		stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
		Expect(err).To(HaveOccurred())
		Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))

		// Pod in Cluster 2 should not be able to reach Pods in Cluster 1

		curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
		stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
		Expect(err).To(HaveOccurred())
		Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))

		curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
		stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
		Expect(err).To(HaveOccurred())
		Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))
	})

	It("excludes the real host pod CIDR from the isolation NetworkPolicy, not a hardcoded guess", func(ctx context.Context) {
		// compute the same value the controller should have derived from the live host
		// Nodes, so this assertion doesn't rely on the host's real pod CIDR coincidentally
		// matching a hardcoded constant
		expectedCIDRs, err := policy.FindPodCIDRs(ctx, k8sClient, "")
		Expect(err).NotTo(HaveOccurred())
		Expect(expectedCIDRs).NotTo(BeEmpty())

		for _, vc := range []*VirtualCluster{cluster1, cluster2} {
			var networkPolicy networkingv1.NetworkPolicy

			key := client.ObjectKey{
				Name:      k3kcontroller.SafeConcatNameWithPrefix(vc.Cluster.Name),
				Namespace: vc.Cluster.Namespace,
			}

			Expect(k8sClient.Get(ctx, key, &networkPolicy)).To(Succeed())

			Expect(networkPolicy.Spec.Egress[0].To).To(ContainElement(networkingv1.NetworkPolicyPeer{
				IPBlock: &networkingv1.IPBlock{
					CIDR:   "0.0.0.0/0",
					Except: expectedCIDRs,
				},
			}))
		}
	})
})