#!/usr/bin/env bash
# Regression test: prole-auth manifest should not hard-require the `prole-auth-keytab`
# secret and should include a keytab bootstrap initContainer.

set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
PROLE_HOME=$(cd "$SCRIPT_DIR/../.." && pwd)

MANIFEST="$PROLE_HOME/deploy/opentofu/k3s/manifests/prole/prole-auth-deployment.yaml"

if [[ ! -f "$MANIFEST" ]]; then
  echo "FAILURE: manifest not found: $MANIFEST" >&2
  exit 1
fi

if ! grep -q "^[[:space:]]*initContainers:" "$MANIFEST"; then
  echo "FAILURE: expected initContainers in prole-auth deployment" >&2
  exit 1
fi

if ! grep -q "^[[:space:]]*- name: keytab-bootstrap" "$MANIFEST"; then
  echo "FAILURE: expected initContainer named keytab-bootstrap" >&2
  exit 1
fi

if ! grep -Fq "secretName: prole-auth-keytab" "$MANIFEST"; then
  echo "FAILURE: expected reference to secretName prole-auth-keytab (optional)" >&2
  exit 1
fi

if ! grep -Fq "optional: true" "$MANIFEST"; then
  echo "FAILURE: expected prole-auth-keytab secret to be optional" >&2
  exit 1
fi

if ! grep -Fq "emptyDir: {}" "$MANIFEST"; then
  echo "FAILURE: expected keytab volume to be emptyDir" >&2
  exit 1
fi

echo "SUCCESS"