apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-secrets-config
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
data:
  init-secrets.sh: |
    #!/bin/sh
    
    # Wait for Vault to be ready
    until vault status; do
      echo "Waiting for Vault to be ready..."
      sleep 2
    done
    
    # Initialize Vault
    vault operator init -key-shares=5 -key-threshold=3 > /tmp/vault-init.txt
    
    # Unseal Vault (in production, this should be done manually)
    VAULT_TOKEN=$(grep 'Initial Root Token:' /tmp/vault-init.txt | awk '{print $4}')
    export VAULT_TOKEN
    
    # Unseal with 3 keys
    vault operator unseal $(grep 'Key 1:' /tmp/vault-init.txt | awk '{print $3}')
    vault operator unseal $(grep 'Key 2:' /tmp/vault-init.txt | awk '{print $3}')
    vault operator unseal $(grep 'Key 3:' /tmp/vault-init.txt | awk '{print $3}')
    
    # Enable auth methods
    vault auth enable kubernetes
    vault auth enable oidc
    vault auth enable userpass
    
    # Enable secrets engines
    vault secrets enable kv-v2
    vault secrets enable database
    vault secrets enable transit
    
    # Configure Kubernetes auth
    vault write auth/kubernetes/config \
      token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
      kubernetes_host="https://${KUBERNETES_PORT_443_TCP_ADDR}:443" \
      kubernetes_ca_cert="$(cat /var/run/secrets/kubernetes.io.serviceaccount/ca.crt)"
    
    # Create policies
    vault policy write telecom-platform - <<EOF
    path "kv/data/telecom-platform/*" {
      capabilities = ["read", "list"]
    }
    
    path "database/creds/telecom-platform" {
      capabilities = ["read"]
    }
    
    path "transit/encrypt/*" {
      capabilities = ["update"]
    }
    
    path "transit/decrypt/*" {
      capabilities = ["update"]
    }
    EOF
    
    vault policy write telecom-platform-admin - <<EOF
    path "kv/data/telecom-platform/*" {
      capabilities = ["create", "read", "update", "delete", "list"]
    }
    
    path "database/creds/telecom-platform" {
      capabilities = ["read"]
    }
    
    path "database/config/telecom-platform" {
      capabilities = ["create", "read", "update", "delete"]
    }
    
    path "transit/*" {
      capabilities = ["create", "read", "update", "delete", "list"]
    }
    EOF
    
    # Configure database secrets engine
    vault write database/config/telecom-platform \
      plugin_name="postgresql-database-plugin" \
      connection_url="postgresql://{{username}}:{{password}}@postgres:5432/telecom_platform" \
      allowed_roles="telecom-platform" \
      username="vault" \
      password="vault_password"
    
    vault write database/roles/telecom-platform \
      db_name="telecom-platform" \
      creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
      default_ttl="1h" \
      max_ttl="24h"
    
    # Store telecom platform secrets
    vault kv put kv/telecom-platform/database \
      url="postgresql://postgres:prod123@postgres:5432/telecom_prod" \
      max_connections=100 \
      connection_timeout=30
    
    vault kv put kv/telecom-platform/redis \
      url="redis://redis:6379" \
      max_connections=50 \
      connection_timeout=10
    
    vault kv put kv/telecom-platform/jwt \
      secret="prod-jwt-secret-key" \
      expiration="24h"
    
    vault kv put kv/telecom-platform/encryption \
      key="prod-encryption-key-256bits" \
      algorithm="AES-256-GCM"
    
    vault kv put kv/telecom-platform/payment \
      stripe_secret_key="sk_live_..." \
      paypal_client_id="..." \
      paypal_client_secret="..."
    
    # Create transit encryption key
    vault write -f transit/keys/telecom-platform
    
    # Create Kubernetes roles
    vault write auth/kubernetes/role/telecom-platform \
      bound_service_account_names=telecom-platform \
      bound_service_account_namespaces=telecom-platform \
      policies=telecom-platform \
      ttl=24h
    
    vault write auth/kubernetes/role/telecom-platform-admin \
      bound_service_account_names=telecom-platform-admin \
      bound_service_account_namespaces=telecom-platform \
      policies=telecom-platform-admin \
      ttl=8h
    
    echo "Vault configuration completed successfully!"
---
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-init
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault
        app.kubernetes.io/component: secrets
    spec:
      serviceAccountName: vault
      restartPolicy: OnFailure
      containers:
      - name: vault-init
        image: hashicorp/vault:1.14.0
        env:
        - name: VAULT_ADDR
          value: "http://vault:8200"
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              name: vault-token
              key: token
        - name: KUBERNETES_PORT_443_TCP_ADDR
          value: "kubernetes.default.svc"
        command:
        - sh
        - /scripts/init-secrets.sh
        volumeMounts:
        - name: scripts
          mountPath: /scripts
      volumes:
      - name: scripts
        configMap:
          name: vault-secrets-config
          defaultMode: 0755