Add: minio-operator TF management (v4.5.8 downgrade) - WIP due to helm conflicts

terraform/minio-operator.tf

@@ -0,0 +1,78 @@
+# MinIO Operator - v4.5.8 (compatible with installed CRD)
+# v5.0.0 has credential validation bug that breaks tenants
+# Downgrading to stable v4.5.8 until upstream fixes validation logic
+
+resource "kubernetes_namespace" "minio_operator" {
+  metadata {
+    name = "minio-operator"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+    }
+  }
+}
+
+resource "helm_release" "minio_operator" {
+  name       = "minio-operator"
+  repository = "https://operator.min.io"
+  chart      = "operator"
+  version    = "4.5.8"
+  namespace  = kubernetes_namespace.minio_operator.metadata[0].name
+
+  values = [
+    yamlencode({
+      operator = {
+        image = {
+          repository = "minio/operator"
+          tag        = "v4.5.8"
+        }
+        replicaCount = 1
+      }
+      console = {
+        enabled = true
+      }
+    })
+  ]
+
+  depends_on = [
+    kubernetes_namespace.minio_operator
+  ]
+}
+
+# MinIO credentials secret - v4.5.8 format (credsSecret with individual keys)
+resource "kubernetes_secret" "minio_creds" {
+  metadata {
+    name      = "minio-creds"
+    namespace = "storage"
+  }
+  type = "Opaque"
+
+  data = {
+    accesskey = base64encode("minioadmin")
+    secretkey = base64encode(var.minio_root_password)
+  }
+
+  depends_on = [
+    kubernetes_namespace.storage
+  ]
+}
+
+# Placeholder: kubernetes_namespace.storage should exist from bootstrap
+# If not, create:
+resource "kubernetes_namespace" "storage" {
+  count = var.create_storage_namespace ? 1 : 0
+
+  metadata {
+    name = "storage"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+    }
+  }
+}
+
+variable "create_storage_namespace" {
+  description = "Create storage namespace if it doesn't exist"
+  type        = bool
+  default     = false
+}