From d631e7a93040bd02fa05e2313594db98526d5a7b Mon Sep 17 00:00:00 2001
From: Juliano Mohr <1110178+juliaaano@users.noreply.github.com>
Date: Fri, 25 Sep 2026 12:24:08 +0100
Subject: [PATCH] [GPTEINFRA-18050] Fix S4 bucket creation with a pinned MinIO
 mirror

Make the bucket Job image configurable and pin the Red Hat AI Services
mirror by release and digest, preserving the existing mc script.

https://redhat.atlassian.net/browse/GPTEINFRA-18050
---
 roles/ocp4_workload_s4/defaults/main.yml            | 4 ++++
 roles/ocp4_workload_s4/readme.adoc                  | 1 +
 roles/ocp4_workload_s4/templates/bucket-job.yaml.j2 | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/roles/ocp4_workload_s4/defaults/main.yml b/roles/ocp4_workload_s4/defaults/main.yml
index 1b72f0d1..1a641192 100644
--- a/roles/ocp4_workload_s4/defaults/main.yml
+++ b/roles/ocp4_workload_s4/defaults/main.yml
@@ -105,6 +105,10 @@ ocp4_workload_s4_s3_api_host: ""  # Auto-generated if empty
 # Example: ['datasets', 'ml-models', 'backups']
 ocp4_workload_s4_buckets: []
 
+# Image containing the mc client for bucket creation (amd64)
+ocp4_workload_s4_bucket_job_image: >-
+  quay.io/rh-aiservices-bu/minio:RELEASE.2025-09-07T16-13-09Z@sha256:a614d3fd833e346ab37cd0ff0c540f88d5d7ed0d6f0034b20418bb91e1769a51
+
 # --------------------------------------------------
 # ArgoCD sync configuration
 # --------------------------------------------------
diff --git a/roles/ocp4_workload_s4/readme.adoc b/roles/ocp4_workload_s4/readme.adoc
index 54ed7110..95f6bdcb 100644
--- a/roles/ocp4_workload_s4/readme.adoc
+++ b/roles/ocp4_workload_s4/readme.adoc
@@ -87,6 +87,7 @@ Username and password can be passed in as parameters. If not provided, username
 * `ocp4_workload_s4_buckets`: List of S3 bucket names to create (default: `[]`)
 ** If empty or not defined, no buckets will be created
 ** Example: `['datasets', 'ml-models', 'backups']`
+* `ocp4_workload_s4_bucket_job_image`: Image providing `mc` and `/bin/sh` for bucket creation. Defaults to the digest-pinned Red Hat AI Services MinIO mirror (amd64).
 
 === Sync Policy
 
diff --git a/roles/ocp4_workload_s4/templates/bucket-job.yaml.j2 b/roles/ocp4_workload_s4/templates/bucket-job.yaml.j2
index 21021c45..a818b04f 100644
--- a/roles/ocp4_workload_s4/templates/bucket-job.yaml.j2
+++ b/roles/ocp4_workload_s4/templates/bucket-job.yaml.j2
@@ -21,7 +21,7 @@ spec:
       serviceAccountName: s4
       containers:
       - name: create-bucket
-        image: quay.io/minio/mc:latest
+        image: {{ ocp4_workload_s4_bucket_job_image | to_json }}
         command:
         - /bin/sh
         - -c