# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Egress class  (R-NET-05, R-NET-07)
# Catalog: docs/14 "Egress class (R-NET-05)" + "Egress flip (R-NET-07)"
#
# GIVEN one `egress: internet` and one `egress: vpn` workload,
# WHEN  each queries an external echo of its own public IP,
# THEN  internet shows the home/WAN IP and vpn shows the VPN (PIA) IP.
# AND   (R-NET-07) flipping the class in git re-routes with no workload rewrite.
#
# STATUS: scaffold — needs T-3.1/T-3.2 (egress gateway + PIA/Gluetun).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: egress-class
  labels:
    conformance.home.k3s/R-NET-05: "true"
    conformance.home.k3s/R-NET-07: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-05, R-NET-07"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      internet-class egress shows WAN IP; vpn-class shows VPN IP; git flip re-routes.
spec:
  steps:
    - name: given-two-egress-classes
      try:
        - apply:
            file: fixtures/internet-and-vpn-pods.yaml   # TODO(T-3.1): author fixtures
    - name: then-internet-shows-wan-ip
      try:
        - script:
            # external echo of public IP; assert it is NOT the known VPN egress range.
            content: |
              set -euo pipefail
              ip=$(kubectl -n "$NAMESPACE" exec egress-internet -- \
                     curl -fsS https://api.ipify.org)
              echo "internet_ip=$ip"
              # TODO: assert ip is in home/WAN set, not the PIA range.
            check: { ($stdout =~ 'internet_ip='): true }
    - name: then-vpn-shows-vpn-ip
      try:
        - script:
            content: |
              set -euo pipefail
              ip=$(kubectl -n "$NAMESPACE" exec egress-vpn -- \
                     curl -fsS https://api.ipify.org)
              echo "vpn_ip=$ip"
              # TODO: assert ip is a PIA egress address (distinct from WAN IP).
            check: { ($stdout =~ 'vpn_ip='): true }
    - name: when-flip-egress-class-in-git
      try:
        - script:
            # R-NET-07: patch the egress class (simulating a git/Flux change) and
            # assert the observed egress path changes with NO pod recreation.
            content: |
              set -euo pipefail
              echo "TODO(T-3.4): patch egress class, reconcile, re-check public IP,"
              echo "assert path changed and pod UID/generation unchanged (no rewrite)."