resource "vault_kv_secret_v2" "short_api" {
  mount                = vault_mount.secret.path
  name                 = "short/api"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({ private_key = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "short_public" {
  mount                = vault_mount.secret.path
  name                 = "short/public"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({ public_key = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "short_peers" {
  mount                = vault_mount.secret.path
  name                 = "short/peers"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({ config = "{}" })
}

locals {
  short_policies = {
    short-seed = {
      "secret/data/short/api"    = ["read", "update"]
      "secret/data/short/public" = ["read", "update"]
    }
    short-controller = {
      "secret/data/short/peers" = ["read", "update"]
    }
    short-vso = {
      "secret/data/short/api"                  = ["read"]
      "secret/data/short/cloud"                = ["read"]
      "secret/data/short/peers"                = ["read"]
      "secret/data/quay/robots/cluster_pull"   = ["read"]
      "secret/data/opnsense/interface-watcher" = ["read"]
      "secret/data/ca/opnsense"                = ["read"]
      "pki/cert/ca"                            = ["read"]
    }
  }
}

resource "vault_policy" "short" {
  for_each = local.short_policies
  name     = each.key
  policy = join("\n", [for path, capabilities in each.value :
    "path \"${path}\" { capabilities = ${jsonencode(capabilities)} }"
  ])
}

resource "vault_kubernetes_auth_backend_role" "short" {
  for_each                         = local.short_policies
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = each.key
  bound_service_account_names      = [each.key]
  bound_service_account_namespaces = ["short"]
  token_policies                   = [vault_policy.short[each.key].name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}