resource "kubernetes_service_account" "operator_service_account" {
  metadata {
    name      = "operator"
    namespace = "default"
  }
}

resource "kubernetes_cluster_role_binding" "operator_admin_access" {

  metadata {
    name = "operator-admin-access"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "cluster-admin"
  }

  subject {
    kind      = "ServiceAccount"
    namespace = "default"
    name      = kubernetes_service_account.operator_service_account.metadata[0].name
  }
}

resource "kubernetes_secret" "operator_access_token" {
  metadata {
    annotations = {
      "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
    }
    name      = "operator-token"
    namespace = "default"
  }

  type                           = "kubernetes.io/service-account-token"
  wait_for_service_account_token = true
}