apiVersion: v1
kind: ServiceAccount
metadata:
  name: secret-rotation-controller
  namespace: secret-rotation

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-rotation-controller
rules:
# Read SecretRotation CRDs
- apiGroups: ["homelab.riotpiao.com"]
  resources: ["secretrotations"]
  verbs: ["get", "list", "watch"]

# Update status
- apiGroups: ["homelab.riotpiao.com"]
  resources: ["secretrotations/status"]
  verbs: ["get", "patch", "update"]

# Read k8s secrets that will be rotated
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]

# For recording events
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: secret-rotation-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: secret-rotation-controller
subjects:
- kind: ServiceAccount
  name: secret-rotation-controller
  namespace: secret-rotation

---
apiVersion: v1
kind: Namespace
metadata:
  name: secret-rotation
  labels:
    kubernetes.io/metadata.name: secret-rotation