resource "random_password" "pg_backup_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "pg_backup" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/pg-backup"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    access_key_id     = "********"
    secret_access_key = random_password.pg_backup_key.result
    internal_ca_cert  = vault_pki_secret_backend_root_cert.root.certificate
  })
}

resource "vault_policy" "pg_backup" {
  name = "pg-backup"

  policy = <<-EOT
    path "secret/data/versitygw/users/pg-backup" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "pg_backup" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "pg-backup"
  bound_service_account_names      = ["pg-vso"]
  bound_service_account_namespaces = ["postgres"]
  token_policies                   = [vault_policy.pg_backup.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}