apiVersion: batch/v1
kind: Job
metadata:
  name: 'tenant-{{ .Values.name }}-minio-setup'
  namespace: {{ .Release.Namespace }}
  annotations:
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: mc
          image: minio/mc:RELEASE.2024-03-03T00-13-08Z
          env:
            # 1. MinIO Admin Credentials (Replicated from argocd namespace)
            - name: MINIO_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: minio-admin-credentials
                  key: MINIO_ROOT_USER
            - name: MINIO_ADMIN_PASS
              valueFrom:
                secretKeyRef:
                  name: minio-admin-credentials
                  key: MINIO_ROOT_PASSWORD

            # 2. Randomly Generated Tenant Credentials
            - name: TENANT_USER
              valueFrom:
                secretKeyRef:
                  name: s3-credentials
                  key: AWS_ACCESS_KEY_ID
            - name: TENANT_PASS
              valueFrom:
                secretKeyRef:
                  name: s3-credentials
                  key: AWS_SECRET_ACCESS_KEY
            - name: BUCKET_REF
              valueFrom:
                secretKeyRef:
                  name: s3-credentials
                  key: BUCKET_REF
            - name: BUCKET_WORK
              valueFrom:
                secretKeyRef:
                  name: s3-credentials
                  key: BUCKET_WORK
          command:
            - /bin/sh
            - -c
            - |
              # Fail immediately if any command fails
              set -e 

              # Connect to MinIO using quotes to protect special characters in passwords
              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 "$MINIO_ADMIN_USER" "$MINIO_ADMIN_PASS"

              # Create buckets
              mc mb --ignore-existing minioadmin/$BUCKET_REF
              mc mb --ignore-existing minioadmin/$BUCKET_WORK

              # Create tenant user (REMOVED || true)
              mc admin user add minioadmin "$TENANT_USER" "$TENANT_PASS"

              # Apply IAM isolation policy
              cat <<EOF > /tmp/policy.json
              {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
                    "Resource": [
                      "arn:aws:s3:::$BUCKET_REF",
                      "arn:aws:s3:::$BUCKET_WORK"
                    ]
                  },
                  {
                    "Effect": "Allow",
                    "Action": ["s3:GetObject"],
                    "Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
                  },
                  {
                    "Effect": "Allow",
                    "Action": ["s3:*"],
                    "Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
                  }
                ]
              }
              EOF

              # The rest remains the same...
              mc admin policy create minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin {{ .Values.name }}-policy /tmp/policy.json
              # Good enough for now, would need better error handeling
              mc admin policy attach minioadmin tenant-{{ .Values.name }}-policy --user="$TENANT_USER" || echo "Policy already attached, skipping."
              echo "MinIO setup completed for tenant-{{ .Values.name }}"