#!/bin/bash
# Safe MinIO bucket initialization via Job (credentials in Secret, not env)
# Usage: ./minio-bucket-init.sh <namespace> <bucket1> [bucket2] ...
set -euo pipefail

NAMESPACE="${1:?Missing namespace}"
shift
BUCKETS=("$@")

if [ ${#BUCKETS[@]} -eq 0 ]; then
  echo "Usage: $0 <namespace> <bucket1> [bucket2] ..." >&2
  exit 1
fi

# Create Secret with Minio credentials (safe: sourced from env, not exposed in pod)
kubectl create secret generic minio-creds -n "$NAMESPACE" \
  --from-literal=MINIO_ROOT_USER="${MINIO_ROOT_USER:?Missing MINIO_ROOT_USER}" \
  --from-literal=MINIO_ROOT_PASSWORD="${MINIO_ROOT_PASSWORD:?Missing MINIO_ROOT_PASSWORD}" \
  --dry-run=client -o yaml | kubectl apply -f -

# Create init Job that mounts Secret as volume, preventing env exposure
BUCKET_ARGS=$(printf '"%s", ' "${BUCKETS[@]}" | sed 's/, $//')
kubectl apply -f - <<EOF
apiVersion: batch/v1
kind: Job
metadata:
  name: minio-bucket-init-$RANDOM
  namespace: $NAMESPACE
spec:
  ttlSecondsAfterFinished: 300
  backoffLimit: 2
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: minio-init
        image: minio/mc:latest
        volumeMounts:
        - name: minio-secret
          mountPath: /var/run/secrets/minio
          readOnly: true
        command:
        - sh
        - -c
        - |
          MINIO_ROOT_USER=\$(cat /var/run/secrets/minio/MINIO_ROOT_USER)
          MINIO_ROOT_PASSWORD=\$(cat /var/run/secrets/minio/MINIO_ROOT_PASSWORD)
          mc alias set local http://minio.storage.svc.cluster.local:9000 "\$MINIO_ROOT_USER" "\$MINIO_ROOT_PASSWORD"
          mc mb --ignore-existing $BUCKET_ARGS
      volumes:
      - name: minio-secret
        secret:
          secretName: minio-creds
EOF

echo "✓ MinIO bucket init job submitted for: ${BUCKETS[*]}"