from __future__ import annotations

from pathlib import Path


def test_init_kerberos_waits_for_ad_forwarder_ready_and_endpoints():
    """Regression: Kerberos test must not run against an AD forwarder Service with no endpoints.

    Historically `init_kerberos.sh` would `kubectl apply` the AD forwarder Deployment/Service and then
    proceed immediately (or ignore rollout failures), which could yield `kinit: Cannot contact any KDC`.
    """

    text = Path("etc/init_kerberos.sh").read_text(encoding="utf-8")

    assert "wait_for_ad_forwarder_ready" in text
    assert "wait_for_ad_forwarder_ready \"$KRB5_AD_NAMESPACE\" \"$KRB5_AD_PROXY_NAME\" \"$KRB5_AD_SERVICE_NAME\"" in text

    # Ensure we don't silently ignore readiness.
    assert "rollout status deploy/${KRB5_AD_PROXY_NAME} --timeout=120s || true" not in text