apiVersion: batch/v1
kind: Job
metadata:
  name: minio-site-replication-setup
  namespace: storage
spec:
  # Auto-delete the Job pod 10 minutes after completion
  ttlSecondsAfterFinished: 600
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: mc
          image: minio/mc:latest
          command:
            - /bin/sh
            - -c
            - |
              set -e

              # Alias every site. Service names follow the release naming
              # convention minio-<site>.storage.svc.cluster.local.
              for site in $SITES; do
                mc alias set "$site" "http://minio-${site}.storage.svc.cluster.local:9000" \
                  "$ROOT_USER" "$ROOT_PASSWORD"
              done

              first=$(echo $SITES | cut -d' ' -f1)

              # Idempotent: skip only if every requested site is already part
              # of the replication group. A partially-configured group (e.g.
              # az-c newly added to SITES) falls through to `replicate add`,
              # which expands an existing group in place.
              # NOTE: pure-shell matching — the minio/mc image has no grep.
              info=$(mc admin replicate info "$first" 2>/dev/null || true)
              missing=0
              for site in $SITES; do
                case "$info" in
                  *"$site"*) ;;
                  *) missing=1 ;;
                esac
              done
              if [ "$missing" -eq 0 ]; then
                echo "Site replication already spans all sites ($SITES) — nothing to do"
                mc admin replicate info "$first"
                exit 0
              fi

              echo "Configuring site replication across: $SITES"
              mc admin replicate add $SITES

              echo "Replication status:"
              mc admin replicate info "$first"
          env:
            # Space-separated list of replication sites, named after the AZ
            # node labels. Each site must have a Helm release minio-<site>
            # (e.g. minio-az-a) so the Service DNS resolves. To add an AZ
            # later: deploy minio-az-<X>, append "az-<X>" here, then delete
            # and re-apply this Job.
            - name: SITES
              value: "az-a az-b az-c"
            # MinIO site replication requires identical root credentials on
            # every site, so reading one release's Secret covers all of them.
            # The MinIO chart creates a Secret named after the release with
            # keys rootUser and rootPassword.
            - name: ROOT_USER
              valueFrom:
                secretKeyRef:
                  name: minio-az-a
                  key: rootUser
            - name: ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: minio-az-a
                  key: rootPassword