# services/vault/hermes-auth-role-bootstrap-job.yaml
# Purpose: apply the Vault read/write boundaries needed by Hermes operator OIDC.
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-k8s-auth-hermes-1
  namespace: vault
spec:
  backoffLimit: 2
  template:
    spec:
      serviceAccountName: vault-admin
      restartPolicy: Never
      nodeSelector:
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      containers:
        - name: configure-k8s-auth
          image: hashicorp/vault:1.21.4
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - /scripts/vault_k8s_auth_configure.sh
          env:
            - name: VAULT_ADDR
              value: http://10.43.57.249:8200
            - name: VAULT_K8S_ROLE
              value: vault-admin
            - name: VAULT_K8S_TOKEN_REVIEWER_JWT_FILE
              value: /var/run/secrets/vault-token-reviewer/token
            - name: VAULT_K8S_ROLE_TTL
              value: 1h
          volumeMounts:
            - name: k8s-auth-config-script
              mountPath: /scripts
              readOnly: true
            - name: token-reviewer
              mountPath: /var/run/secrets/vault-token-reviewer
              readOnly: true
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
      volumes:
        - name: k8s-auth-config-script
          configMap:
            name: vault-k8s-auth-config-script
            defaultMode: 0555
        - name: token-reviewer
          secret:
            secretName: vault-admin-token-reviewer