# services/vault/hermes-auth-role-bootstrap-job.yaml
# Purpose: apply the Vault read/write boundaries needed by Hermes operator OIDC.
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-k8s-auth-hermes-10
  namespace: vault
spec:
  backoffLimit: 2
  template:
    spec:
      serviceAccountName: vault-admin
      restartPolicy: Never
      nodeSelector:
        hardware: rpi5
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/hostname
                    operator: NotIn
                    values: [titan-04, titan-14, titan-18, titan-19, titan-24]
      containers:
        - name: configure-k8s-auth
          image: docker.io/hashicorp/vault@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - /scripts/vault_k8s_auth_configure.sh
          env:
            - name: HOME
              value: /tmp
            - name: VAULT_ADDR
              value: http://vault.vault.svc.cluster.local:8200
            - name: VAULT_K8S_ROLE
              value: vault-admin
            - name: VAULT_K8S_TOKEN_REVIEWER_JWT_FILE
              value: /var/run/secrets/vault-token-reviewer/token
            - name: VAULT_K8S_ROLE_TTL
              value: 1h
          volumeMounts:
            - name: k8s-auth-config-script
              mountPath: /scripts
              readOnly: true
            - name: token-reviewer
              mountPath: /var/run/secrets/vault-token-reviewer
              readOnly: true
            - name: tmp
              mountPath: /tmp
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 100
            seccompProfile:
              type: RuntimeDefault
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
      volumes:
        - name: k8s-auth-config-script
          configMap:
            name: vault-k8s-auth-config-script
            defaultMode: 0555
        - name: token-reviewer
          secret:
            secretName: vault-admin-token-reviewer
        - name: tmp
          emptyDir: {}