---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: rspamd
  namespace: mail
---
# Separate auth for the litellm engine: the `rspamd` k8s role is the only one
# whose policy grants litellm/creds/rspamd.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: rspamd
  namespace: mail
spec:
  allowedNamespaces:
    - mail
  kubernetes:
    audiences:
      - vault
    role: rspamd
    serviceAccount: rspamd
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: k8s/au/syd1
  vaultConnectionRef: vso-system/default
---
# Haiku-scoped LiteLLM virtual key for the gpt module (field `key`).
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: rspamd-litellm
  namespace: mail
spec:
  allowStaticCreds: false
  destination:
    create: true
    name: rspamd-litellm
    overwrite: true
  mount: litellm
  path: creds/rspamd
  revoke: true
  vaultAuthRef: rspamd
---
# DKIM private key for unkin.net, selector `mail` (field `private_key`).
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: dkim-unkin-net
  namespace: mail
spec:
  destination:
    create: true
    name: dkim-unkin-net
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/mail/default/dkim-unkin-net
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Controller (web UI) password; config reads the `rspamadm pw` hash (field `password_hash`).
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: rspamd-controller
  namespace: mail
spec:
  destination:
    create: true
    name: rspamd-controller
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/mail/default/rspamd-controller
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default