#!/usr/bin/env bash
# Regression test: knoe-auth manifest should not hard-require the `knoe-auth-keytab`
# secret and should include a keytab bootstrap initContainer.

set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
KNOE_HOME=$(cd "$SCRIPT_DIR/../.." && pwd)

MANIFEST="$KNOE_HOME/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml"

if [[ ! -f "$MANIFEST" ]]; then
  echo "FAILURE: manifest not found: $MANIFEST" >&2
  exit 1
fi

if ! grep -q "^[[:space:]]*initContainers:" "$MANIFEST"; then
  echo "FAILURE: expected initContainers in knoe-auth deployment" >&2
  exit 1
fi

if ! grep -q "^[[:space:]]*- name: keytab-bootstrap" "$MANIFEST"; then
  echo "FAILURE: expected initContainer named keytab-bootstrap" >&2
  exit 1
fi

if ! grep -Fq "secretName: knoe-auth-keytab" "$MANIFEST"; then
  echo "FAILURE: expected reference to secretName knoe-auth-keytab (optional)" >&2
  exit 1
fi

if ! grep -Fq "optional: true" "$MANIFEST"; then
  echo "FAILURE: expected knoe-auth-keytab secret to be optional" >&2
  exit 1
fi

if ! grep -Fq "emptyDir: {}" "$MANIFEST"; then
  echo "FAILURE: expected keytab volume to be emptyDir" >&2
  exit 1
fi

echo "SUCCESS"