#!/usr/bin/env bash
set -Eeuo pipefail

export KUBECONFIG="/opt/cks-lab/kubeconfig"
expected_context="kind-cks-lab"
context="$(kubectl config current-context 2>/dev/null || true)"

if [[ "$context" != "$expected_context" ]]; then
  echo "Safety check failed: expected $expected_context, got ${context:-none}." >&2
  exit 1
fi

kubectl wait --for=condition=Ready nodes --all --timeout=60s
kubectl get nodes -o wide
kubectl get pods -A

for node in cks-lab-control-plane cks-lab-worker; do
  docker inspect "$node" >/dev/null
  docker exec "$node" /opt/kube-bench/kube-bench version
done

echo "Verified isolated context: $context"