resource "vault_mount" "layshaft" {
  path    = "layshaft"
  type    = "kv"
  options = { version = "2" }
}

resource "vault_policy" "layshaft" {
  name = "layshaft"

  policy = <<-EOT
    path "${vault_mount.layshaft.path}/data/server" {
      capabilities = ["create", "read", "update"]
    }
    path "${vault_mount.layshaft.path}/data/unlock/+" {
      capabilities = ["create", "read", "update"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "layshaft" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "layshaft"
  bound_service_account_names      = ["layshaft"]
  bound_service_account_namespaces = ["layshaft"]
  audience                         = "layshaft-vault"
  token_policies                   = [vault_policy.layshaft.name]
  token_no_default_policy          = true
  token_ttl                        = 300
  token_max_ttl                    = 300
}

resource "vault_policy" "layshaft_vso" {
  name = "layshaft-vso"

  policy = <<-EOT
    path "auth/token/renew-self" {
      capabilities = ["update"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
    path "pki/cert/ca" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "layshaft_vso" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "layshaft-vso"
  bound_service_account_names      = ["layshaft-vso"]
  bound_service_account_namespaces = ["layshaft"]
  token_policies                   = [vault_policy.layshaft_vso.name]
  token_no_default_policy          = true
  token_ttl                        = 300
  token_max_ttl                    = 300
}