# Database "vaultwarden": password, role, database and read access for the app.
# To add another database copy this file and replace the name.

# Generated once; the role and the application both read this Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vaultwarden-db
  namespace: psql
spec:
  refreshPolicy: CreatedOnce
  target:
    name: vaultwarden-db
    template:
      type: kubernetes.io/basic-auth
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        username: vaultwarden
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: db-password
---
apiVersion: postgresql.cnpg.io/v1
kind: DatabaseRole
metadata:
  name: main-vaultwarden
  namespace: psql
spec:
  cluster:
    name: main
  name: vaultwarden
  login: true
  passwordSecret:
    name: vaultwarden-db
---
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: main-vaultwarden
  namespace: psql
spec:
  cluster:
    name: main
  name: vaultwarden
  owner: vaultwarden
  databaseReclaimPolicy: retain
---
# Lets the vaultwarden namespace read only its own credentials Secret.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: vaultwarden-db-reader
  namespace: psql
rules:
  - apiGroups: [""]
    resources: [secrets]
    resourceNames: [vaultwarden-db]
    verbs: [get, list, watch]
  - apiGroups: [authorization.k8s.io]
    resources: [selfsubjectrulesreviews]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vaultwarden-db-reader
  namespace: psql
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vaultwarden-db-reader
subjects:
  - kind: ServiceAccount
    name: db-credentials-reader
    namespace: vaultwarden