Feature: Wireguardctl manages wireguard VPN connections via VPNCofigs

Scenario: Wireguard VPN connection established when new VPNConfig is created
    Given the cluster-infra cluster is in a healthy state
    When a new VPNConfig is created for a store cluster
    Then a finalizer is added to the VPNConfig
    And an ownerReference to the cluster is added to the VPNConfig
    And a kubernetes secret is created for the store wireguard instance key pairs
    And a secret manager secret is created for the store wireguard configuration
    And the store wireguard configuration is created on the store via the secret manager secret
    And the relay wireguard configuration is updated
    And the client wireguard configuration is updated
    And there is a successful handshake between store and relay wireguard instances
    And there is a successful handshake between relay and client wireguard instances

Scenario: Wireguard VPN connection updated when new VPNConfig is updated
    Given the cluster-infra cluster is in a healthy state
    When a VPNConfig for a store cluster is updated
    Then the secret manager secret for the store wireguard configuration is updated
    And the store wireguard configuration is updated on the store via the secret manager secret
    And the relay wireguard configuration is updated
    And the client wireguard configuration is updated
    And there is a successful handshake between store and relay wireguard instances
    And there is a successful handshake between relay and client wireguard instances

Scenario: Wireguard VPN disconnected when store cluster is deleted
    Given the cluster-infra cluster is in a healthy state
    When a store cluster has been deleted 
    Then its associated VPNConfig should be marked for deletion
    And the secertmanager secret for the store wireguard configuration is deleted
    And the emissary mappings for the store are deleted
    And kubernetes secret for the store wireguard instance key pairs is deleted
    And the relay wireguard configuration is updated
    And the client wireguard configuration is updated
    And there is a successful handshake between relay and client wireguard instances
    And the VPNConfig is removed