apiVersion: batch/v1
kind: Job
metadata:
  name: 'tenant-{{ .Values.name }}-minio-setup'
  namespace: minio
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      serviceAccountName: minio-provisioner
      restartPolicy: OnFailure
      imagePullSecrets:
        - name: registry-credentials
      containers:
        - name: setup
          image: registry.bouvais.lu/minio-runner:1.0.0
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -e

              # Generate password
              SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)

              # Configure MinIO alias
              mc alias set local http://minio.minio.svc:9000 \
                "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"

              # Create buckets
              mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}

              # Create user with generated credentials
              mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"

              # Inline policy generation to avoid missing mount issues
              cat <<EOF > /tmp/policy.json
              {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Sid": "ReadOnlyRefBucket",
                    "Effect": "Allow",
                    "Action": [
                      "s3:GetBucketLocation",
                      "s3:ListBucket",
                      "s3:GetObject"
                    ],
                    "Resource": [
                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}",
                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
                    ]
                  },
                  {
                    "Sid": "ReadWriteWorkBucket",
                    "Effect": "Allow",
                    "Action": [
                      "s3:*"
                    ],
                    "Resource": [
                      "arn:aws:s3:::work-tenant-{{ .Values.name }}",
                      "arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
                    ]
                  }
                ]
              }
              EOF
              # Apply policy and attach to user
              mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
              mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user

              # Create target secret with matching credentials
              kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
                --from-literal=S3_ENDPOINT="http://minio.minio.svc.cluster.local:9000" \
                --from-literal=MINIO_ACCESS_KEY_ID={{ .Values.name }}-user \
                --from-literal=MINIO_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
                --from-literal=BUCKET_REF="ref-tenant-{{ .Values.name }}" \
                --from-literal=BUCKET_WORK="work-tenant-{{ .Values.name }}" \
                -n minio --dry-run=client -o yaml | kubectl apply -f -

              # Annotate for Emberstack Reflector
              kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
                reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
                reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \
                reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-{{ .Values.name }}"
          envFrom:
            - secretRef:
                name: minio-admin-credentials