locals {
  mirror_personas = toset([
    "candidates-bot",
    "mirror-bot",
  ])
  mirror_oauth = {
    candidates-reader = {
      service_account = "cand-read-vso"
    }
    candidates-writer = {
      service_account = "cand-write-vso"
    }
    mirror-reader = {
      service_account = "mirror-read-vso"
    }
    mirror-writer = {
      service_account = "mirror-write-vso"
    }
  }
}

resource "vault_kv_secret_v2" "mirror_persona" {
  for_each = local.mirror_personas

  mount = vault_mount.secret.path
  name  = "quay/personas/${each.key}"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ password = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "mirror_oauth" {
  for_each = local.mirror_oauth

  mount = vault_mount.secret.path
  name  = "quay/oauth/${each.key}"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "mirror_oauth" {
  for_each = local.mirror_oauth

  name = each.key

  policy = <<-EOT
    path "secret/data/quay/oauth/${each.key}" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "mirror_oauth" {
  for_each = local.mirror_oauth

  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = each.key
  bound_service_account_names      = [each.value.service_account]
  bound_service_account_namespaces = ["mirrored-image"]
  token_policies                   = [vault_policy.mirror_oauth[each.key].name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_policy" "mirror_support" {
  name = "mirror-support"

  policy = <<-EOT
    path "secret/data/argo/artifacts" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "mirror_support" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "mirror-support"
  bound_service_account_names      = ["mirror-sup-vso"]
  bound_service_account_namespaces = ["mirrored-image"]
  token_policies                   = [vault_policy.mirror_support.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_policy" "mirror_bootstrap" {
  name = "mirror-bootstrap"

  policy = <<-EOT
    path "secret/data/quay/bootstrap" {
      capabilities = ["read"]
    }
    path "secret/data/quay/personas/candidates-bot" {
      capabilities = ["read"]
    }
    path "secret/data/quay/personas/mirror-bot" {
      capabilities = ["read"]
    }
    path "secret/data/quay/oauth/candidates-reader" {
      capabilities = ["read", "update"]
    }
    path "secret/data/quay/oauth/candidates-writer" {
      capabilities = ["read", "update"]
    }
    path "secret/data/quay/oauth/mirror-reader" {
      capabilities = ["read", "update"]
    }
    path "secret/data/quay/oauth/mirror-writer" {
      capabilities = ["read", "update"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "mirror_bootstrap" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "mirror-bootstrap"
  bound_service_account_names      = ["mirror-bootstrap"]
  bound_service_account_namespaces = ["mirrored-image"]
  token_policies                   = [vault_policy.mirror_bootstrap.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}