apiVersion: batch/v1
kind: Job
metadata:
  name: 'tenant-{{ .Values.name }}-minio-setup'
  namespace: minio
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      serviceAccountName: minio-provisioner
      restartPolicy: OnFailure
      imagePullSecrets:
        - name: registry-credentials
      containers:
        - name: setup
          image: registry.bouvais.lu/minio-runner:1.0.0
          command: ["/bin/sh", "-c"]
          args:
            - |
              mc alias set local http://minio.minio.svc:9000 \
                "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"

              mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
              mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
              mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
              mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user

              # write the SCOPED secret in this same namespace
              kubectl create secret generic {{ .Values.name }}-s3-credentials \
                --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
                --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
                -n minio --dry-run=client -o yaml | kubectl apply -f -

              kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
                reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
                reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \
                reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-{{ .Values.name }}"
          envFrom:
            - secretRef:
                name: minio-admin-credentials