From ebeb4948d47681c82b74dc41f703e014bf92a042 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:04:50 -0700
Subject: [PATCH] Add: minio-operator TF management (v4.5.8 downgrade) - WIP
 due to helm conflicts

---
 terraform/minio-operator.tf | 78 +++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 terraform/minio-operator.tf

diff --git a/terraform/minio-operator.tf b/terraform/minio-operator.tf
new file mode 100644
index 0000000..e26c7fc
--- /dev/null
+++ b/terraform/minio-operator.tf
@@ -0,0 +1,78 @@
+# MinIO Operator - v4.5.8 (compatible with installed CRD)
+# v5.0.0 has credential validation bug that breaks tenants
+# Downgrading to stable v4.5.8 until upstream fixes validation logic
+
+resource "kubernetes_namespace" "minio_operator" {
+  metadata {
+    name = "minio-operator"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+    }
+  }
+}
+
+resource "helm_release" "minio_operator" {
+  name       = "minio-operator"
+  repository = "https://operator.min.io"
+  chart      = "operator"
+  version    = "4.5.8"
+  namespace  = kubernetes_namespace.minio_operator.metadata[0].name
+
+  values = [
+    yamlencode({
+      operator = {
+        image = {
+          repository = "minio/operator"
+          tag        = "v4.5.8"
+        }
+        replicaCount = 1
+      }
+      console = {
+        enabled = true
+      }
+    })
+  ]
+
+  depends_on = [
+    kubernetes_namespace.minio_operator
+  ]
+}
+
+# MinIO credentials secret - v4.5.8 format (credsSecret with individual keys)
+resource "kubernetes_secret" "minio_creds" {
+  metadata {
+    name      = "minio-creds"
+    namespace = "storage"
+  }
+  type = "Opaque"
+
+  data = {
+    accesskey = base64encode("minioadmin")
+    secretkey = base64encode(var.minio_root_password)
+  }
+
+  depends_on = [
+    kubernetes_namespace.storage
+  ]
+}
+
+# Placeholder: kubernetes_namespace.storage should exist from bootstrap
+# If not, create:
+resource "kubernetes_namespace" "storage" {
+  count = var.create_storage_namespace ? 1 : 0
+
+  metadata {
+    name = "storage"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+    }
+  }
+}
+
+variable "create_storage_namespace" {
+  description = "Create storage namespace if it doesn't exist"
+  type        = bool
+  default     = false
+}