resource "kubernetes_service_account" "operator_service_account" {
  metadata {
    name      = "operator"
    namespace = "default"
  }
}

resource "kubernetes_cluster_role" "operator_maintenance_role" {
  metadata {
    name = "operator-maintenance-role"
  }

  # Allow managing Pods (create, delete, exec, restart)
  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"]
  }

  rule {
    api_groups = [""]
    resources  = ["replicationcontrollers"]
    verbs      = ["get", "list"]
  }

  rule {
    api_groups = ["autoscaling"]
    resources  = ["horizontalpodautoscalers"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["apps"]
    resources  = ["deployments", "replicasets", "statefulsets", "daemonsets"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["batch"]
    resources  = ["cronjobs"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["batch"]
    resources  = ["jobs"]
    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update"]
  }



  # Allow reading Pod logs
  rule {
    api_groups = [""]
    resources  = ["pods/log"]
    verbs      = ["get", "list"]
  }

  # Allow managing Pod eviction for draining nodes, etc.
  rule {
    api_groups = ["policy"]
    resources  = ["pods/eviction"]
    verbs      = ["create"]
  }

  # Allow reading Namespaces (usually required for multi-namespace tools)
  rule {
    api_groups = [""]
    resources  = ["namespaces"]
    verbs      = ["get", "list", "watch"]
  }

  # Allow reading and managing PodDisruptionBudgets (useful for draining nodes)
  rule {
    api_groups = ["policy"]
    resources  = ["poddisruptionbudgets"]
    verbs      = ["get", "list", "watch", "patch", "update"]
  }

  # Allow managing Nodes (e.g., for cordoning, draining)
  rule {
    api_groups = [""]
    resources  = ["nodes"]
    verbs      = ["get", "list", "patch", "update"]
  }

  # Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes
  rule {
    api_groups = [""]
    resources  = ["persistentvolumeclaims"]
    verbs      = ["get", "list", "watch"]
  }

  # Allow listing and getting services and endpoints (but not updating)
  rule {
    api_groups = [""]
    resources  = ["services", "endpoints"]
    verbs      = ["get", "list", "watch"]
  }
}

resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" {
  metadata {
    name = "operator-maintenance-binding"
  }

  role_ref {
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name
    api_group = "rbac.authorization.k8s.io"
  }

  subject {
    kind      = "ServiceAccount"
    namespace = "default"
    name      = kubernetes_service_account.operator_service_account.metadata[0].name
  }
}

resource "kubernetes_secret" "operator_access_token" {
  metadata {
    annotations = {
      "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
    }
    name      = "operator-token"
    namespace = "default"
  }

  type                           = "kubernetes.io/service-account-token"
  wait_for_service_account_token = true
}