"""Shared helpers for CKA task banks."""

NS = r"""
mkns() {
  $K create ns "$1" --dry-run=client -o yaml | $K apply -f - >/dev/null
  # Wait for the namespace's `default` ServiceAccount before returning. The controller creates it
  # asynchronously, and a Pod applied in the gap is rejected outright:
  #   error looking up service account <ns>/default: serviceaccount "default" not found
  # Setups that create a namespace and immediately apply Pods lose that race under load,
  # which fails the seed and costs the candidate a whole task. It belongs here, not in each task.
  # 90 s, not 30: the ServiceAccount controller runs in kube-controller-manager, and a manager that
  # is restarting (it takes ~60 s to be back and leading) left bare Pods rejected with no trace.
  for _ in $(seq 1 90); do $K -n "$1" get sa default >/dev/null 2>&1 && return 0; sleep 1; done
  echo "namespace $1 still has no default ServiceAccount after 90 s - is kube-controller-manager running?" >&2
  return 1
}
"""

def C(name, pts, script):
    return {"name": name, "pts": pts, "script": script}

def ns_pick(r, base):
    """Namespace name with a random suffix so the same task never lands on the same namespace twice."""
    return f"{base}-{r.choice(['alpha', 'bravo', 'delta', 'echo', 'kilo', 'nova', 'omega', 'zulu'])}"

def name_pick(r, base):
    return f"{base}-{r.randint(10, 99)}"