#!/usr/bin/env bash
# A kind cluster with a NetworkPolicy-ENFORCING CNI (Calico) for the
# egress-denial e2e: kind's default kindnet accepts NetworkPolicy objects
# but never enforces them, so only this cluster can prove the §15
# default-deny actually drops packets in the kernel.
#
# Usage: scripts/netpol-cluster.sh {up|down}
set -euo pipefail

CLUSTER="clawmates-netpol-test"
CALICO_VERSION="v3.29.1"

case "${1:-up}" in
  up)
    if kind get clusters 2>/dev/null | grep -qx "$CLUSTER"; then
      echo "$CLUSTER already exists"
    else
      kind create cluster --name "$CLUSTER" --wait 120s --config - <<'EOF'
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
networking:
  disableDefaultCNI: true
  podSubnet: 192.168.0.0/16
EOF
      kubectl --context "kind-$CLUSTER" apply -f \
        "https://raw.githubusercontent.com/projectcalico/calico/$CALICO_VERSION/manifests/calico.yaml"
    fi
    echo "waiting for calico + node readiness..."
    kubectl --context "kind-$CLUSTER" -n kube-system rollout status \
      daemonset/calico-node --timeout=300s
    kubectl --context "kind-$CLUSTER" wait --for=condition=Ready node --all --timeout=120s
    echo "$CLUSTER ready (calico enforcing)"
    ;;
  down)
    kind delete cluster --name "$CLUSTER"
    ;;
  *)
    echo "usage: $0 {up|down}" >&2
    exit 1
    ;;
esac