resource "random_password" "versitygw_argo_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_argo_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/argo"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_argo_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

resource "vault_kv_secret_v2" "argo_artifacts" {
  mount = vault_mount.secret.path
  name  = "argo/artifacts"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    access_key_id     = "********"
    secret_access_key = random_password.versitygw_argo_secret_access_key.result
    internal_ca_cert  = vault_pki_secret_backend_root_cert.root.certificate
  })

  # Keep in lockstep with versitygw/users/argo until rotation is designed.
}