resource "vault_database_secret_backend_static_role" "hf_chat_ui" {
  backend           = vault_mount.database.path
  name              = "hf-chat-ui"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "hf_chat_ui"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_policy" "hf_chat_ui" {
  name   = "hf-chat-ui"
  policy = <<-EOT
    path "secret/data/hf-chat-ui/oidc/zitadel" {
      capabilities = ["read"]
    }
    path "database/static-creds/hf-chat-ui" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
    path "secret/data/ca/internal" {
      capabilities = ["read"]
    }
    path "secret/data/ca/postgres" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "hf_chat_ui" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "hf-chat-ui"
  bound_service_account_names      = ["hf-chat-ui-vso"]
  bound_service_account_namespaces = ["hf-chat-ui"]
  token_policies                   = [vault_policy.hf_chat_ui.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}