resource "kubernetes_role" "gitea_ssh_access" {
  metadata {
    name      = "gitea-ssh-access"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }
  rule {
    api_groups = [""]
    resources  = ["pods", "pods/log"]
    verbs      = ["get", "list"]
  }
  rule {
    api_groups = [""]
    resources  = ["pods/exec"]
    verbs      = ["create"]
  }
}

resource "kubernetes_role_binding" "gitea_ssh_access" {
  metadata {
    name      = "gitea-ssh-access"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = kubernetes_role.gitea_ssh_access.metadata[0].name
  }
  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.gitea_service_account.metadata[0].name
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }
}

resource "kubernetes_secret" "gitea_access_token" {
  metadata {
    annotations = {
      "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name
    }
    name      = "git-token"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }

  type                           = "kubernetes.io/service-account-token"
  wait_for_service_account_token = true
}