quorate/terraform/internal/vault/kv.tf

# KV v2 secrets engine — canonical store for application secrets.
resource "vault_mount" "secret" {
  path    = "secret"
  type    = "kv"
  options = { version = "2" }
}

resource "vault_kv_secret_v2" "project_delivery_quay_reader" {
  mount = vault_mount.secret.path
  name  = "quay/oauth/project-delivery-reader"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "project_delivery_quay_writer" {
  mount = vault_mount.secret.path
  name  = "quay/oauth/project-delivery-writer"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "apk_signing" {
  mount = vault_mount.secret.path
  name  = "project-delivery/apk-signing"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    private = "PLACEHOLDER"
    public  = "PLACEHOLDER"
  })
}

resource "vault_kv_secret_v2" "cloudflare_cert_manager_dns01" {
  mount = vault_mount.secret.path
  name  = "cloudflare/cert-manager-dns01"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "oci_l4_relay_wan_controller_api" {
  mount = vault_mount.secret.path
  name  = "oci/relay/wan-controller-api"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "opnsense_certificate_rotator" {
  mount = vault_mount.secret.path
  name  = "opnsense/certificate-rotator"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "cloudflare_oci_relay_dns" {
  mount = vault_mount.secret.path
  name  = "cloudflare/oci-relay-dns"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "cloudflare_pages_infrastructure" {
  mount = vault_mount.secret.path
  name  = "cloudflare/pages-infrastructure"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "cloudflare_pages_publisher" {
  mount = vault_mount.secret.path
  name  = "cloudflare/pages-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "forge_cache" {
  mount = vault_mount.secret.path
  name  = "cloudflare/forge-cache"

  data_json_wo_version = 2
  data_json_wo         = jsonencode({ api-token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "waf_edit" {
  mount = vault_mount.secret.path
  name  = "cloudflare/waf-edit"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ api-token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "cloudflare_radar" {
  mount = vault_mount.secret.path
  name  = "cloudflare/radar"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "cloudflare_tier_o_tunnel_config" {
  mount = vault_mount.secret.path
  name  = "cloudflare/tier-o-tunnel-config"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "cloudflare_tunnel_connector" {
  mount = vault_mount.secret.path
  name  = "cloudflare/tunnel-connector"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

# Zitadel

resource "random_password" "zitadel_master_key" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "zitadel_master_key" {
  mount                = vault_mount.secret.path
  name                 = "zitadel/master-key"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({ masterkey = random_password.zitadel_master_key.result })
}

# VersityGW

resource "random_password" "versitygw_root_access_key_id" {
  length  = 32
  special = false
}

resource "random_password" "versitygw_root_secret_access_key" {
  length  = 64
  special = false
}

resource "vault_kv_secret_v2" "versitygw_root" {
  mount = vault_mount.secret.path
  name  = "versitygw/root"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    rootAccessKeyId     = random_password.versitygw_root_access_key_id.result
    rootSecretAccessKey = random_password.versitygw_root_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate root credentials.
}

resource "random_password" "versitygw_canary_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_canary_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/canary"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_canary_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

resource "random_password" "versitygw_terraform_state_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_terraform_state_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/terraform-state"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_terraform_state_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

# VictoriaMetrics

resource "random_password" "victoriametrics_vmauth_query_token" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "victoriametrics_vmauth_query" {
  mount = vault_mount.secret.path
  name  = "victoriametrics/vmauth/query"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    token = random_password.victoriametrics_vmauth_query_token.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate the token.
}

resource "random_password" "victorialogs_vmauth_query_token" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "victorialogs_vmauth_query" {
  mount = vault_mount.secret.path
  name  = "victorialogs/vmauth/query"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    token = random_password.victorialogs_vmauth_query_token.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate the token.
}

resource "random_password" "victorialogs_vmauth_relay_ingest_token" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "victorialogs_vmauth_relay_ingest" {
  mount = vault_mount.secret.path
  name  = "victorialogs/vmauth/relay-ingest"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    token = random_password.victorialogs_vmauth_relay_ingest_token.result
  })
}

# Policies

resource "vault_policy" "cloudflare_cert_manager_dns01" {
  name = "cloudflare-cert-manager-dns01"

  policy = <<-EOT
    path "secret/data/cloudflare/cert-manager-dns01" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_oci_relay_dns" {
  name = "cloudflare-oci-relay-dns"

  policy = <<-EOT
    path "secret/data/cloudflare/oci-relay-dns" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_pages_infrastructure" {
  name = "cloudflare-pages-infrastructure"

  policy = <<-EOT
    path "secret/data/cloudflare/pages-infrastructure" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_pages_publisher" {
  name = "cloudflare-pages-publisher"

  policy = <<-EOT
    path "secret/data/cloudflare/pages-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "forge_cache" {
  name = "forge-cache"

  policy = <<-EOT
    path "secret/data/cloudflare/forge-cache" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "waf_edit" {
  name = "waf-edit"

  policy = <<-EOT
    path "secret/data/cloudflare/waf-edit" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_radar" {
  name = "cloudflare-radar"

  policy = <<-EOT
    path "secret/data/cloudflare/radar" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "bot_redirect" {
  name   = "bot-redirect"
  policy = <<-EOT
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_tier_o_tunnel_config" {
  name = "cloudflare-tier-o-tunnel-config"

  policy = <<-EOT
    path "secret/data/cloudflare/tier-o-tunnel-config" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "cloudflare_tunnel_connector" {
  name = "cloudflare-tunnel-connector"

  policy = <<-EOT
    path "secret/data/cloudflare/tunnel-connector" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "oci_l4_relay_wan_controller" {
  name = "oci-l4-relay-wan-controller"

  policy = <<-EOT
    path "secret/data/opnsense/interface-watcher" {
      capabilities = ["read"]
    }
    path "secret/data/ca/opnsense" {
      capabilities = ["read"]
    }
    path "secret/data/oci/relay/wan-controller-api" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "zitadel" {
  name = "zitadel"

  policy = <<-EOT
    path "secret/data/zitadel/*" {
      capabilities = ["read"]
    }
    path "database/static-creds/zitadel" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "forgejo" {
  name = "forgejo"

  policy = <<-EOT
    path "secret/data/forgejo/*" {
      capabilities = ["read"]
    }
    path "database/static-creds/forgejo" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "forgejo_public" {
  name = "forgejo-public"

  policy = <<-EOT
    path "secret/data/forgejo-public/*" {
      capabilities = ["read"]
    }
    path "database/static-creds/forgejo-public" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "versitygw" {
  name = "versitygw"

  policy = <<-EOT
    path "secret/data/versitygw/*" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "victoriametrics" {
  name = "victoriametrics"

  policy = <<-EOT
    path "secret/data/victoriametrics/*" {
      capabilities = ["read"]
    }
    path "secret/data/victorialogs/*" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "grafana" {
  name = "grafana"

  policy = <<-EOT
    path "secret/data/grafana/*" {
      capabilities = ["read"]
    }
    path "secret/data/versitygw/users/grafana" {
      capabilities = ["read"]
    }
    path "secret/data/minecraft/rcon" {
      capabilities = ["read"]
    }
    path "secret/data/quay/oauth/project-delivery-reader" {
      capabilities = ["read"]
    }
    path "pki/cert/ca" {
      capabilities = ["read"]
    }
    path "secret/data/victoriametrics/vmauth/query" {
      capabilities = ["read"]
    }
    path "secret/data/victorialogs/vmauth/query" {
      capabilities = ["read"]
    }
    path "database/static-creds/grafana" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "longhorn" {
  name = "longhorn"

  policy = <<-EOT
    path "secret/data/longhorn/*" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "quay" {
  name = "quay"

  policy = <<-EOT
    path "secret/data/quay/*" {
      capabilities = ["read"]
    }
    path "database/static-creds/quay" {
      capabilities = ["read"]
    }
    path "database/static-creds/quay_clair" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "dragonfly" {
  name = "dragonfly"

  policy = <<-EOT
    path "secret/data/dragonfly/quay/acl" {
      capabilities = ["read"]
    }
    path "secret/data/dragonfly/forgejo/acl" {
      capabilities = ["read"]
    }
    path "secret/data/dragonfly/forgejo-public/acl" {
      capabilities = ["read"]
    }
    path "secret/data/dragonfly/stalwart/acl" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "flux" {
  name = "flux"

  policy = <<-EOT
    path "secret/data/flux/*" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "oci_l4_relay" {
  name = "oci-l4-relay"

  policy = <<-EOT
    path "secret/data/oci/relay/home-wireguard" {
      capabilities = ["read"]
    }

    path "secret/data/oci/relay/peer" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "argo" {
  name = "argo"

  policy = <<-EOT
    path "secret/data/argo/*" {
      capabilities = ["read"]
    }
    path "database/static-creds/argo" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_artifacts" {
  name = "project-delivery-artifacts"

  policy = <<-EOT
    path "secret/data/argo/artifacts" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "apk_signing" {
  name = "apk-signing"

  policy = <<-EOT
    path "secret/data/project-delivery/apk-signing" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_cache_reader" {
  name = "project-delivery-cache-reader"

  policy = <<-EOT
    path "secret/data/versitygw/users/project-delivery-cache-reader" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_cache_writer" {
  name = "project-delivery-cache-writer"

  policy = <<-EOT
    path "secret/data/versitygw/users/project-delivery-cache-writer" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "lazaret_publisher" {
  name = "lazaret-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/lazaret-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "quorate_pull" {
  name = "quorate-pull"

  policy = <<-EOT
    path "secret/data/forgejo/tokens/quorate-pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "quorate_push" {
  name = "quorate-push"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/quorate-push" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "remora_qualification_artifacts" {
  name = "remora-qualification-artifacts"

  policy = <<-EOT
    path "secret/data/argo/artifacts" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "remora_qualification_quay_reader" {
  name = "remora-qualification-quay-reader"

  policy = <<-EOT
    path "secret/data/quay/oauth/project-delivery-reader" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_source" {
  name = "project-delivery-source"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/project-delivery-source" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_quay_reader" {
  name = "project-delivery-quay-reader"

  policy = <<-EOT
    path "secret/data/quay/oauth/project-delivery-reader" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "project_delivery_quay_writer" {
  name = "project-delivery-quay-writer"

  policy = <<-EOT
    path "secret/data/quay/oauth/project-delivery-writer" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "argo_relay_admission" {
  name = "argo-relay-admission"

  policy = <<-EOT
    path "secret/data/mindmax" {
      capabilities = ["read"]
    }
    path "secret/data/ip2location" {
      capabilities = ["read"]
    }
    path "secret/data/oci/relay/publisher-api" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "argo_relay_smtp_deny" {
  name = "argo-relay-smtp-deny"

  policy = <<-EOT
    path "secret/data/oci/relay/smtp-deny-publisher-api" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_policy" "argo_opnsense_certificate_kv" {
  name = "argo-opnsense-certificate-kv"

  policy = <<-EOT
    path "secret/data/opnsense/certificate-rotator" {
      capabilities = ["read"]
    }
    path "secret/data/opnsense/web-certificate" {
      capabilities = ["read"]
    }
    path "pki_opnsense/cert/ca" {
      capabilities = ["read"]
    }
    path "pki/cert/ca" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

# K8s auth roles (used by VSO to authenticate and pull KV secrets)

# cert-manager SA reads the Cloudflare token for Let's Encrypt DNS-01.
resource "vault_kubernetes_auth_backend_role" "cert_manager_kv" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "cert-manager-kv"
  bound_service_account_names      = ["cert-manager"]
  bound_service_account_namespaces = ["cert-manager"]
  token_policies                   = [vault_policy.cloudflare_cert_manager_dns01.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "cloudflare_tunnel_vso" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "cloudflare-tunnel-vso"
  bound_service_account_names      = ["cloudflare-tunnel-vso"]
  bound_service_account_namespaces = ["cloudflare-tunnel"]
  token_policies                   = [vault_policy.cloudflare_tunnel_connector.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "oci_l4_relay_wan_controller" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "oci-l4-relay-wan-controller"
  bound_service_account_names      = ["oci-l4-relay-wan-controller"]
  bound_service_account_namespaces = ["kube-system"]
  token_policies                   = [vault_policy.oci_l4_relay_wan_controller.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "zitadel" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "zitadel"
  bound_service_account_names      = ["zitadel"]
  bound_service_account_namespaces = ["zitadel"]
  token_policies                   = [vault_policy.zitadel.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "forgejo" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "forgejo"
  bound_service_account_names      = ["forgejo"]
  bound_service_account_namespaces = ["forgejo"]
  token_policies                   = [vault_policy.forgejo.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "forgejo_public" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "forgejo-public"
  bound_service_account_names      = ["forgejo-public"]
  bound_service_account_namespaces = ["forgejo-public"]
  token_policies                   = [vault_policy.forgejo_public.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "versitygw" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "versitygw"
  bound_service_account_names      = ["versitygw"]
  bound_service_account_namespaces = ["versitygw"]
  token_policies                   = [vault_policy.versitygw.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "victoriametrics" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "victoriametrics"
  bound_service_account_names      = ["victoriametrics-vso"]
  bound_service_account_namespaces = ["victoriametrics"]
  token_policies                   = [vault_policy.victoriametrics.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "grafana" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "grafana"
  bound_service_account_names      = ["grafana-vso"]
  bound_service_account_namespaces = ["grafana"]
  token_policies                   = [vault_policy.grafana.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "longhorn" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "longhorn"
  bound_service_account_names      = ["longhorn-vso"]
  bound_service_account_namespaces = ["longhorn"]
  token_policies                   = [vault_policy.longhorn.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "quay" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "quay"
  bound_service_account_names      = ["quay-vso"]
  bound_service_account_namespaces = ["quay"]
  token_policies                   = [vault_policy.quay.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "dragonfly" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "dragonfly"
  bound_service_account_names      = ["dragonfly-vso"]
  bound_service_account_namespaces = ["dragonfly"]
  token_policies                   = [vault_policy.dragonfly.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "flux" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "flux"
  bound_service_account_names      = ["flux-vso"]
  bound_service_account_namespaces = ["flux-system"]
  token_policies                   = [vault_policy.flux.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "oci_l4_relay" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "oci-l4-relay"
  bound_service_account_names      = ["oci-l4-relay"]
  bound_service_account_namespaces = ["kube-system"]
  token_policies                   = [vault_policy.oci_l4_relay.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "argo" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "argo"
  bound_service_account_names      = ["argo-vso"]
  bound_service_account_namespaces = ["argo"]
  token_policies                   = [vault_policy.argo.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_artifacts" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-artifacts"
  bound_service_account_names      = ["project-delivery-artifacts-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_artifacts.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "apk_signing" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "apk-signing"
  bound_service_account_names      = ["apk-signing-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.apk_signing.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_cache_reader" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-cache-reader"
  bound_service_account_names      = ["project-delivery-cache-reader-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_cache_reader.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_cache_writer" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-cache-writer"
  bound_service_account_names      = ["project-delivery-cache-writer-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_cache_writer.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "lazaret_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "lazaret-publisher"
  bound_service_account_names      = ["lazaret-publisher-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.lazaret_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "quorate_pull" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "quorate-pull"
  bound_service_account_names      = ["quorate-pull-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.quorate_pull.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "quorate_push" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "quorate-push"
  bound_service_account_names      = ["quorate-push-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.quorate_push.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "remora_qualification_artifacts" {
  backend                     = vault_auth_backend.kubernetes.path
  role_name                   = "remora-qualification-artifacts"
  bound_service_account_names = ["remora-qualification-artifacts-vso"]
  bound_service_account_namespace_selector = jsonencode({
    matchLabels = {
      "qualification.quorate.dev/project" = "remora"
    }
  })
  token_policies = [vault_policy.remora_qualification_artifacts.name]
  token_ttl      = 3600
  token_max_ttl  = 3600
}

resource "vault_kubernetes_auth_backend_role" "remora_qualification_quay_reader" {
  backend                     = vault_auth_backend.kubernetes.path
  role_name                   = "remora-qualification-quay-reader"
  bound_service_account_names = ["remora-qualification-quay-reader-vso"]
  bound_service_account_namespace_selector = jsonencode({
    matchLabels = {
      "qualification.quorate.dev/project" = "remora"
    }
  })
  token_policies = [vault_policy.remora_qualification_quay_reader.name]
  token_ttl      = 3600
  token_max_ttl  = 3600
}

resource "vault_kubernetes_auth_backend_role" "bot_redirect" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "bot-redirect"
  bound_service_account_names      = ["bot-redirect-vso"]
  bound_service_account_namespaces = ["argo"]
  token_policies                   = [vault_policy.cloudflare_radar.name, vault_policy.bot_redirect.name]
  token_ttl                        = 3600
}

moved {
  from = vault_kubernetes_auth_backend_role.home_pages
  to   = vault_kubernetes_auth_backend_role.locutory_pages
}

resource "vault_kubernetes_auth_backend_role" "locutory_pages" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "locutory-pages"
  bound_service_account_names      = ["locutory-pages-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.cloudflare_pages_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_source" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-source"
  bound_service_account_names      = ["project-delivery-source-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_source.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_quay_reader" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-quay-reader"
  bound_service_account_names      = ["project-delivery-quay-reader-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_quay_reader.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "project_delivery_quay_writer" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "project-delivery-quay-writer"
  bound_service_account_names      = ["project-delivery-quay-writer-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.project_delivery_quay_writer.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "argo_relay_admission" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "argo-relay-admission"
  bound_service_account_names      = ["relay-admission-vso"]
  bound_service_account_namespaces = ["argo-relay-admission"]
  token_policies                   = [vault_policy.argo_relay_admission.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "argo_relay_smtp_deny" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "argo-relay-smtp-deny"
  bound_service_account_names      = ["relay-smtp-deny-vso"]
  bound_service_account_namespaces = ["argo-relay-smtp-deny"]
  token_policies                   = [vault_policy.argo_relay_smtp_deny.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kubernetes_auth_backend_role" "argo_opnsense_certificate_kv" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "argo-opnsense-certificate-kv"
  bound_service_account_names      = ["opnsense-certificate-vso"]
  bound_service_account_namespaces = ["argo-opnsense-certificate"]
  token_policies                   = [vault_policy.argo_opnsense_certificate_kv.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}