feat: Add minio-mc bucket initialization Job to MinIO Helm chart

- Created bucket-init-job.yaml as Helm hook for post-install bucket creation
- Uses minio/mc:RELEASE.2025-07-21T05-28-08Z image for bucket management
- Configurable bucket list and policies via values.yaml
- Implemented across all environments (staging, production, prestaging)
- Job runs as Helm post-install hook with proper cleanup policies
- Updated MinIO image versions to RELEASE.2025-07-23T15-54-02Z across environments
- Addresses missing minio_mc functionality from docker-compose setup

Resolves bucket initialization that was previously handled by docker-compose createbucket service.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: NotYuSheng

helm/minio/templates/bucket-init-job.yaml

@@ -0,0 +1,78 @@
+{{- if .Values.bucketInit.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "minio.fullname" . }}-bucket-init
+  labels:
+    {{- include "minio.labels" . | nindent 4 }}
+    app.kubernetes.io/component: bucket-init
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      labels:
+        {{- include "minio.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: bucket-init
+    spec:
+      restartPolicy: OnFailure
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "minio.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: bucket-init
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.bucketInit.image.repository }}:{{ .Values.bucketInit.image.tag }}"
+          imagePullPolicy: {{ .Values.bucketInit.image.pullPolicy }}
+          env:
+            - name: MINIO_ROOT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "minio.secretName" . }}
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "minio.secretName" . }}
+                  key: MINIO_ROOT_PASSWORD
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+              echo "Waiting for MinIO to be ready..."
+              until mc alias set minio-local http://{{ include "minio.fullname" . }}:9000 $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD; do
+                echo "MinIO not ready yet, waiting..."
+                sleep 2
+              done
+              echo "MinIO is healthy, creating buckets..."
+              {{- range .Values.bucketInit.buckets }}
+              echo "Creating bucket: {{ . }}"
+              mc mb --ignore-existing minio-local/{{ . }}
+              {{- end }}
+              {{- if .Values.bucketInit.policies }}
+              echo "Setting bucket policies..."
+              {{- range .Values.bucketInit.policies }}
+              echo "Setting policy for {{ .bucket }}: {{ .policy }}"
+              mc anonymous set {{ .policy }} minio-local/{{ .bucket }}
+              {{- end }}
+              {{- end }}
+              echo "Bucket initialization completed successfully"
+          resources:
+            {{- toYaml .Values.bucketInit.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

helm/minio/values-prestaging.yaml

@@ -6,9 +6,17 @@ replicaCount: 1
 # Use official MinIO image
 image:
   repository: minio/minio
-  tag: "RELEASE.2024-01-16T16-07-38Z"
+  tag: "RELEASE.2025-07-23T15-54-02Z"
   pullPolicy: Always
 
+# Prestaging bucket initialization
+bucketInit:
+  enabled: true
+  image:
+    repository: minio/mc
+    tag: "RELEASE.2025-07-21T05-28-08Z"
+    pullPolicy: Always
+
 # Reduced resources for prestaging
 resources:
   limits:

helm/minio/values-prod.yaml

@@ -6,9 +6,17 @@ replicaCount: 1
 # Use official MinIO image with specific stable version
 image:
   repository: minio/minio
-  tag: "RELEASE.2024-01-16T16-07-38Z"
+  tag: "RELEASE.2025-07-23T15-54-02Z"
   pullPolicy: Always
 
+# Production bucket initialization
+bucketInit:
+  enabled: true
+  image:
+    repository: minio/mc
+    tag: "RELEASE.2025-07-21T05-28-08Z"
+    pullPolicy: Always
+
 # Production resources
 resources:
   limits:

helm/minio/values-staging.yaml

@@ -6,9 +6,17 @@ replicaCount: 1
 # Use official MinIO image
 image:
   repository: minio/minio
-  tag: "RELEASE.2024-01-16T16-07-38Z"
+  tag: "RELEASE.2025-07-23T15-54-02Z"
   pullPolicy: Always
 
+# Staging bucket initialization
+bucketInit:
+  enabled: true
+  image:
+    repository: minio/mc
+    tag: "RELEASE.2025-07-21T05-28-08Z"
+    pullPolicy: Always
+
 # Staging resources
 resources:
   limits:

helm/minio/values.yaml

@@ -8,7 +8,7 @@ image:
   repository: minio/minio
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "RELEASE.2025-07-23T15-54-02Z"
 
 imagePullSecrets: []
 nameOverride: ""
@@ -204,6 +204,28 @@ podDisruptionBudget:
 deploymentStrategy:
   type: Recreate  # MinIO typically uses Recreate for single-node
 
+# Bucket initialization configuration using minio/mc
+bucketInit:
+  enabled: true
+  image:
+    repository: minio/mc
+    tag: "RELEASE.2025-07-21T05-28-08Z"
+    pullPolicy: Always
+  # List of buckets to create
+  buckets:
+    - omnifiles
+  # Optional bucket policies
+  policies: []
+    # - bucket: omnifiles
+    #   policy: download  # none, download, upload, public
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi
+
 # Resource quota (optional)
 serviceMonitor:
   enabled: false