resource "vault_policy" "agentgateway" {
  name = "agentgateway"

  policy = <<-EOT
    path "secret/data/agentgateway/*" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "agentgateway" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "agentgateway"
  bound_service_account_names      = ["agentgateway-vso"]
  bound_service_account_namespaces = ["agentgateway-system"]
  token_policies                   = [vault_policy.agentgateway.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}