apiVersion: v1
kind: ServiceAccount
metadata:
  name: key-rotation-controller
  namespace: iam
---
# Cluster-wide because a credential and its consumer live in different namespaces:
# the Secret in one, the workload in another.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: key-rotation-controller
rules:
  - apiGroups: ["iam.homelab.riotpiao.com"]
    resources: ["keyrotations"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["iam.homelab.riotpiao.com"]
    resources: ["keyrotations/status"]
    verbs: ["get", "update", "patch"]
  # The controller writes the credential it just created. list and watch are needed
  # because the manager caches Secrets; without them the cache cannot start and
  # every reconcile fails.
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  # Rolling a consumer that cannot hot reload.
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets"]
    verbs: ["get", "list", "watch", "patch"]
  # Leader election. Without this the controller cannot acquire its Lease and never
  # starts reconciling.
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: key-rotation-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: key-rotation-controller
subjects:
  - kind: ServiceAccount
    name: key-rotation-controller
    namespace: iam