data "vault_policy_document" "dal_policy_hcl" {
  rule {
    path         = "secret/data/${var.environment}/${var.stack}/*"
    capabilities = ["read", "list"]
    description  = "allow all on secrets"
  }
  rule {
    path         = "secret/metadata/${var.environment}/${var.stack}/*"
    capabilities = ["read", "list"]
    description  = "allow all on secrets"
  }
}

resource "vault_policy" "dal_policy" {
  name   = "${var.environment}-${var.stack}-${var.service}-policy"
  policy = data.vault_policy_document.dal_policy_hcl.hcl
}

resource "vault_kubernetes_auth_backend_role" "dal_role" {
  backend                          = var.cluster_name
  role_name                        = "${var.environment}-${var.stack}-${var.service}-role"
  bound_service_account_names      = [var.service]
  bound_service_account_namespaces = [var.namespace_name]
  token_ttl                        = 3600
  token_policies                   = ["default", "${var.environment}-${var.stack}-${var.service}-policy"]
}

resource "vault_generic_secret" "dal_url" {
  path      = "secret/${var.environment}/${var.stack}/${var.service}/url"
  data_json = <<EOT
{
  "value": "${var.dal_url}"
}
EOT
}