From 9ca95ca252da80bc4a41b5c49aca657cc4b26b03 Mon Sep 17 00:00:00 2001
From: Adrien Bouvais <adrienbouvais@device-102.home>
Date: Mon, 17 Aug 2026 12:06:22 +0200
Subject: [PATCH] Fix minio setup

---
 charts/tenant/templates/minio-setup.yaml | 50 ++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/charts/tenant/templates/minio-setup.yaml b/charts/tenant/templates/minio-setup.yaml
index c14ed93..6dccc0e 100644
--- a/charts/tenant/templates/minio-setup.yaml
+++ b/charts/tenant/templates/minio-setup.yaml
@@ -19,20 +19,64 @@ spec:
           command: ["/bin/sh", "-c"]
           args:
             - |
+              set -e
+
+              # Generate password
+              SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)
+
+              # Configure MinIO alias
               mc alias set local http://minio.minio.svc:9000 \
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
+              # Create buckets
               mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
-              mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
-              mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
+
+              # Create user with generated credentials
+              mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET"
+
+              # Inline policy generation to avoid missing mount issues
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Sid": "ReadOnlyRefBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:GetBucketLocation",
+                      "s3:ListBucket",
+                      "s3:GetObject"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::{{ .Values.name }}-ref",
+                      "arn:aws:s3:::{{ .Values.name }}-ref/*"
+                    ]
+                  },
+                  {
+                    "Sid": "ReadWriteWorkBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:*"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::{{ .Values.name }}-work",
+                      "arn:aws:s3:::{{ .Values.name }}-work/*"
+                    ]
+                  }
+                ]
+              }
+              EOF
+              # Apply policy and attach to user
+              mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json
               mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
 
-              # write the SCOPED secret in this same namespace
+              # Create target secret with matching credentials
               kubectl create secret generic {{ .Values.name }}-s3-credentials \
                 --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
                 --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
                 -n minio --dry-run=client -o yaml | kubectl apply -f -
 
+              # Annotate for Emberstack Reflector
               kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
                 reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                 reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \