locals {
  ca_roots = {
    internal = "pki"
    postgres = "pki_postgres"
    opnsense = "pki_opnsense"
  }
}

resource "vault_kv_secret_v2" "ca" {
  for_each             = local.ca_roots
  mount                = vault_mount.secret.path
  name                 = "ca/${each.key}"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({ certificate = "PLACEHOLDER" })
}

resource "vault_policy" "ca_sync" {
  name = "ca-sync"
  policy = join("\n", concat(
    [for mount in values(local.ca_roots) :
      "path \"${mount}/cert/ca\" { capabilities = [\"read\"] }"
    ],
    [for name in keys(local.ca_roots) :
      "path \"secret/data/ca/${name}\" { capabilities = [\"read\", \"update\"] }"
    ],
  ))
}

resource "vault_kubernetes_auth_backend_role" "ca_sync" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "ca-sync"
  bound_service_account_names      = ["ca-sync"]
  bound_service_account_namespaces = ["vault"]
  token_policies                   = [vault_policy.ca_sync.name]
  token_ttl                        = 300
  token_max_ttl                    = 300
}

resource "vault_policy" "ca_sync_pull" {
  name   = "ca-sync-pull"
  policy = <<-EOT
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
    path "pki/cert/ca" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "ca_sync_pull" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "ca-sync-pull"
  bound_service_account_names      = ["ca-sync-vso"]
  bound_service_account_namespaces = ["vault"]
  token_policies                   = [vault_policy.ca_sync_pull.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}