# MinIO Operator - v4.5.8 (compatible with installed CRD)
# v5.0.0 has credential validation bug that breaks tenants
# Downgrading to stable v4.5.8 until upstream fixes validation logic

resource "kubernetes_namespace" "minio_operator" {
  metadata {
    name = "minio-operator"
    labels = {
      "pod-security.kubernetes.io/enforce"         = "baseline"
      "pod-security.kubernetes.io/enforce-version" = "latest"
    }
  }
}

resource "helm_release" "minio_operator" {
  name       = "minio-operator"
  repository = "https://operator.min.io"
  chart      = "operator"
  version    = "4.5.8"
  namespace  = kubernetes_namespace.minio_operator.metadata[0].name

  values = [
    yamlencode({
      operator = {
        image = {
          repository = "minio/operator"
          tag        = "v4.5.8"
        }
        replicaCount = 1
      }
      console = {
        enabled = true
      }
    })
  ]

  depends_on = [
    kubernetes_namespace.minio_operator
  ]
}

# MinIO credentials secret - v4.5.8 format (credsSecret with individual keys)
resource "kubernetes_secret" "minio_creds" {
  metadata {
    name      = "minio-creds"
    namespace = "storage"
  }
  type = "Opaque"

  data = {
    accesskey = base64encode("minioadmin")
    secretkey = base64encode(var.minio_root_password)
  }

  depends_on = [
    kubernetes_namespace.storage
  ]
}

# Placeholder: kubernetes_namespace.storage should exist from bootstrap
# If not, create:
resource "kubernetes_namespace" "storage" {
  count = var.create_storage_namespace ? 1 : 0

  metadata {
    name = "storage"
    labels = {
      "pod-security.kubernetes.io/enforce"         = "baseline"
      "pod-security.kubernetes.io/enforce-version" = "latest"
    }
  }
}

variable "create_storage_namespace" {
  description = "Create storage namespace if it doesn't exist"
  type        = bool
  default     = false
}