# Kubernetes-native auth for the InfisicalSecret operator.
# infisical-auth: the identity the CRDs mint short-lived tokens for.
# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: infisical-auth
  namespace: infisical
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: infisical-token-reviewer
  namespace: infisical
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: infisical-token-reviewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: infisical-token-reviewer
    namespace: infisical
---
# The operator needs to mint tokens for infisical-auth; without this it falls
# back to the legacy SA .secrets[] lookup and never gets a token.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: infisical-operator-token-creator
rules:
  - apiGroups: [""]
    resources: ["serviceaccounts/token"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: infisical-operator-token-creator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: infisical-operator-token-creator
subjects:
  - kind: ServiceAccount
    name: infisical-opera-controller-manager
    namespace: infisical-operator
---
# Long-lived token for the reviewer SA. `kubectl create token` expires; the
# value pasted into Infisical's Kubernetes Auth config must not.
apiVersion: v1
kind: Secret
metadata:
  name: infisical-token-reviewer
  namespace: infisical
  annotations:
    kubernetes.io/service-account.name: infisical-token-reviewer
type: kubernetes.io/service-account-token