---
# SecretumVault Service
apiVersion: v1
kind: Service
metadata:
  name: vault
  namespace: secretumvault
  labels:
    app: vault
spec:
  type: ClusterIP
  selector:
    app: vault
  ports:
  - name: api
    port: 8200
    targetPort: api
    protocol: TCP
  - name: metrics
    port: 9090
    targetPort: metrics
    protocol: TCP

---
# Internal headless service for direct pod access
apiVersion: v1
kind: Service
metadata:
  name: vault-headless
  namespace: secretumvault
  labels:
    app: vault
spec:
  clusterIP: None
  selector:
    app: vault
  ports:
  - name: api
    port: 8200
    targetPort: api
    protocol: TCP

---
# Kubernetes Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault
  namespace: secretumvault

---
# RBAC - ClusterRole for vault
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: vault
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["services", "endpoints"]
  verbs: ["get", "list", "watch"]

---
# RBAC - ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vault
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: vault
subjects:
- kind: ServiceAccount
  name: vault
  namespace: secretumvault