resource "random_password" "versitygw_zot_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_zot_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/zot"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_zot_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

resource "random_password" "zot_admin_password" {
  length  = 48
  special = false
}

resource "random_password" "quay_custom" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "quay_custom" {
  mount = vault_mount.secret.path
  name  = "zot/quay-custom"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    username = "********"
    password = random_password.quay_custom.result
  })
}

resource "vault_policy" "quay_custom" {
  name = "quay-custom-writer"

  policy = <<-EOT
    path "secret/data/zot/quay-custom" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "quay_custom" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "quay-custom-writer"
  bound_service_account_names      = ["quay-custom-zot-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.quay_custom.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "zot_config" {
  mount = vault_mount.secret.path
  name  = "zot/config"

  data_json_wo_version = 2
  data_json_wo = jsonencode({
    AWS_ACCESS_KEY_ID     = "********"
    AWS_SECRET_ACCESS_KEY = random_password.versitygw_zot_secret_access_key.result
    htpasswd              = "********"
  })

  # Vault is source of truth after first write. Re-runs do not rotate Zot config.
}

resource "vault_kv_secret_v2" "zot_admin" {
  mount = vault_mount.secret.path
  name  = "zot/admin"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    username = "********"
    password = random_password.zot_admin_password.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate admin credentials.
}

resource "vault_policy" "zot" {
  name = "zot"

  policy = <<-EOT
    path "secret/data/zot/config" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "zot" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "zot"
  bound_service_account_names      = ["zot-vso"]
  bound_service_account_namespaces = ["zot"]
  token_policies                   = [vault_policy.zot.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}