#!/usr/bin/env bash
set -Eeuo pipefail

manifest=${1:?Usage: lesson-37-verify.sh PATH_TO_MANIFEST}
[[ -f "$manifest" ]] || { echo "FAIL manifest not found"; exit 1; }

required=(
  '--client-cert-auth=true'
  '--auto-tls=false'
  '--peer-client-cert-auth=true'
  '--peer-auto-tls=false'
  '--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt'
  '--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt'
  '--listen-metrics-urls=http://127.0.0.1:2381'
)
for flag in "${required[@]}"; do
  if grep -Fqx "        - $flag" "$manifest"; then
    echo "PASS $flag"
  else
    echo "FAIL $flag"
  fi
done

if grep -Eq 'http://0\.0\.0\.0:2381|http://127\.0\.0\.1:2379' "$manifest"; then
  echo 'FAIL insecure etcd listener remains'
else
  echo 'PASS no insecure etcd listener'
fi