#!/usr/bin/env bash

set -euo pipefail

########################################

# Shared utilities

########################################

OS="$(uname -s)"

ARCH="$(uname -m)"

DRIVER=""

CONTAINER_CMD=""

kctl() { minikube kubectl -- "$@"; }

log() { echo -e "\n====== $1 ======\n"; }

generate_password() {

openssl rand -base64 32 | tr -d '/+=' | head -c 32

}

has_podman() {

command -v podman >/dev/null 2>&1 &&

podman info >/dev/null 2>&1

}

has_docker() {

command -v docker >/dev/null 2>&1 &&

env -u DOCKER_HOST docker info >/dev/null 2>&1

}

has_kvm2() {

[ "$OS" = "Linux" ] || return 1

command -v virsh >/dev/null 2>&1 &&

[ -e /dev/kvm ] &&

(

systemctl is-active --quiet libvirtd 2>/dev/null ||

systemctl is-active --quiet virtqemud 2>/dev/null

)

}

select_driver() {

if has_podman; then

DRIVER="podman"

CONTAINER_CMD="podman"

elif has_docker; then

DRIVER="docker"

CONTAINER_CMD="docker"

elif has_kvm2; then

DRIVER="kvm2"

CONTAINER_CMD=""

else

echo "No supported and working minikube driver found."

return 1

fi

}

minikube_start() {

if [ "$DRIVER" = "docker" ]; then

env -u DOCKER_HOST minikube start --cni calico --driver="$DRIVER"

elif [ "$DRIVER" = "podman" ]; then

minikube start --cni calico --container-runtime=containerd --driver="$DRIVER"

else

minikube start --cni calico --driver="$DRIVER"

fi

}

fix_container_config() {

if [ -n "$CONTAINER_CMD" ]; then

local api_port cluster

api_port="$($CONTAINER_CMD port minikube 8443/tcp | awk -F: '{print $2}')"

cluster="$(kctl config view --minify -o jsonpath='{.contexts[0].context.cluster}')"

kctl config set-cluster "$cluster" --server="https://127.0.0.1:${api_port}"

fi

}

ensure_minikube_running() {

local status_output

status_output="$(minikube status 2>/dev/null)" || true

local host_status

host_status="$(echo "$status_output" | awk '/^host:/ {print $2}')" || true

if [[ "$host_status" != "Running" ]]; then

echo "ERROR: minikube is not running. Start it with: minithor start" >&2

exit 1

fi

# Auto-fix stale kubeconfig (e.g. after host reboot changed the container port mapping)

local kube_status

kube_status="$(echo "$status_output" | awk '/^kubeconfig:/ {print $2}')" || true

if [[ "$kube_status" != "Configured" ]]; then

echo "Kubeconfig is stale, updating context..." >&2

minikube update-context >/dev/null 2>&1

fi

}

wait_for_rollout() {

local resource=$1 namespace=$2 timeout=${3:-300}

kctl rollout status --watch --timeout="${timeout}s" "$resource" -n "$namespace"

}

wait_for_resource() {

local resource_type=$1 resource_name=$2 namespace=$3 timeout=${4:-300}

local elapsed=0

local ns_flag=()

if [ -n "$namespace" ]; then

ns_flag=(-n "$namespace")

fi

echo "Waiting for $resource_type/$resource_name${namespace:+ in $namespace} (timeout: ${timeout}s)..."

until kctl get "$resource_type" "$resource_name" ${ns_flag[@]+"${ns_flag[@]}"} &>/dev/null; do

sleep 5

elapsed=$((elapsed + 5))

if [ "$elapsed" -ge "$timeout" ]; then

echo "ERROR: Timed out waiting for $resource_type/$resource_name${namespace:+ in $namespace}" >&2

return 1

fi

done

}

wait_for_port_forward() {

local port=$1 max_attempts=${2:-20}

for attempt in $(seq 1 "$max_attempts"); do

if curl -sf -o /dev/null "http://localhost:$port" 2>/dev/null; then return 0; fi

sleep 1

done

echo "ERROR: Port-forward on port $port not ready after ${max_attempts}s" >&2

return 1

}

# Error-tolerant execution — uses FAILURES global set by the caller

run_step() {

if ! "$@"; then

FAILURES=$((FAILURES + 1))

echo "ERROR: Command failed (continuing): $*" >&2

fi

}

tune_kernel_params() {

local target="${1:-host}"

local params=(

"fs.inotify.max_user_instances=1024"

"fs.file-max=2097152"

"fs.nr_open=1048576"

"vm.max_map_count=262144"

)

for param in "${params[@]}"; do

local key="${param%%=*}"

local desired="${param#*=}"

local current

if [ "$target" = "minikube" ]; then

current=$(minikube ssh -- /sbin/sysctl -n "$key" 2>/dev/null | tr -d '\r') || true

else

current=$(sysctl -n "$key" 2>/dev/null) || true

fi

if [ -z "$current" ]; then

echo " $key: could not read current value, skipping"

continue

fi

if [ "$current" -ge "$desired" ] 2>/dev/null; then

echo " $key = $current (already >= $desired)"

else

echo " $key: $current -> $desired"

if [ "$target" = "minikube" ]; then

minikube ssh -- sudo /sbin/sysctl -w "$param" >/dev/null 2>&1 || echo " WARNING: failed to set $key on minikube node"

else

sudo sysctl -w "$param" >/dev/null 2>&1 || echo " WARNING: failed to set $key (may require root)"

fi

fi

done

if [ "$target" = "host" ] && [ "$OS" = "Linux" ]; then

local conf="/etc/sysctl.d/99-minithor.conf"

echo " Persisting to $conf"

printf '%s\n' "${params[@]}" | sudo tee "$conf" >/dev/null 2>&1 || echo " WARNING: failed to write $conf"

fi

}

helm_uninstall() {

local release=$1 namespace=$2

if helm status "$release" -n "$namespace" &>/dev/null; then

run_step helm uninstall "$release" -n "$namespace" --timeout=120s

else

echo "Helm release '$release' not found in namespace '$namespace', skipping"

fi

}

clear_finalizers_and_delete() {

local crd=$1 resource_type=$2 namespace=$3

if kctl get crd "$crd" &>/dev/null; then

for item in $(kctl get "$resource_type" -n "$namespace" -o name 2>/dev/null); do

run_step kctl patch "$item" -n "$namespace" --type merge -p '{"metadata":{"finalizers":[]}}'

done

run_step kctl delete "$resource_type" --all -n "$namespace" --ignore-not-found --timeout=60s

fi

}

force_delete_ns() {

local ns=$1

echo "Force-clearing finalizers on stuck namespace '$ns'..."

kctl get ns "$ns" -o json \

| sed 's/"finalizers":[^]]*]/"finalizers":[]/' \

| kctl replace --raw "/api/v1/namespaces/$ns/finalize" -f -

}

wait_for_ns_termination() {

local timeout=${1:-300}

local elapsed=0

while kctl get ns 2>&1 | grep -q Terminating; do

sleep 5

elapsed=$((elapsed + 5))

if [ "$elapsed" -ge "$timeout" ]; then

echo "WARNING: Namespaces still terminating after ${timeout}s, force-clearing..." >&2

local stuck_ns

stuck_ns=$(kctl get ns -o jsonpath='{range .items[?(@.status.phase=="Terminating")]}{.metadata.name}{"\n"}{end}' 2>/dev/null)

for ns in $stuck_ns; do

force_delete_ns "$ns" || true

done

sleep 5

if kctl get ns 2>&1 | grep -q Terminating; then

echo "ERROR: Namespaces still stuck after force-clear:" >&2

kctl get ns 2>&1 | grep Terminating >&2 || true

return 1

fi

return 0

fi

done

}

########################################

# Usage / help functions

########################################

usage() {

cat <<EOF

minithor — manage a local Thorium instance on Minikube

Usage: minithor <command> [options]

Commands:

minikube Manage the minikube cluster (install, delete)

start Start a previously stopped minikube cluster

deploy Deploy all Thorium services and backing infrastructure

get-config Extract the running Thorium config to ~/thorium.yml

expose Port-forward Thorium (and optionally backing services) to localhost

stop Stop the minikube cluster (preserves state)

cleanup Remove all Thorium resources for a fresh deploy (requires --confirm)

Global options:

-h, --help Show this help message

Run 'minithor <command> --help' for command-specific options.

EOF

}

usage_minikube() {

cat <<EOF

minithor minikube — manage the minikube cluster

Usage: minithor minikube <subcommand> [options]

Subcommands:

install Install minikube and start a Kubernetes cluster

delete Completely remove minikube and all associated data (requires --confirm)

Run 'minithor minikube <subcommand> --help' for subcommand-specific options.

EOF

}

usage_minikube_install() {

cat <<EOF

minithor minikube install — install minikube and start a Kubernetes cluster

Usage: minithor minikube install [options]

Options:

--cpus <n> Number of CPUs to allocate to minikube (default: 8)

--memory <n> Memory in GiB to allocate to minikube (default: 16)

--certs-dir <path> Directory containing .crt files to trust

(default: \$PWD/.certs/)

-h, --help Show this help message

Detects the best available driver (podman > docker > kvm2), downloads

minikube for your OS/architecture, configures resource limits, and starts

the cluster with Calico CNI, CSI, and Ingress addons.

EOF

}

usage_minikube_delete() {

cat <<EOF

minithor minikube delete — completely remove minikube

Usage: minithor minikube delete --confirm

Options:

--confirm Required. Confirms you want to remove minikube entirely.

-h, --help Show this help message

Runs 'minikube delete --all --purge', removes ~/.minikube and ~/.kube,

uninstalls the minikube and kubectl binaries, and prunes unused container

images. This is irreversible.

EOF

}

usage_start() {

cat <<EOF

minithor start — start a stopped minikube cluster

Usage: minithor start

Detects the container driver, starts minikube, corrects the kubeconfig

API server address if needed, and cleans up pods stuck in terminal

failure states.

EOF

}

usage_deploy() {

cat <<EOF

minithor deploy — deploy Thorium and all backing services

Usage: minithor deploy [options]

Options:

--config <path> Path to thorium-cluster.yml

(default: \$PWD/thorium-cluster.yml)

--docker-config <path> Path to .dockerconfigjson for private registries

(default: \$PWD/.dockerconfigjson)

--banner <path> Path to banner.txt for the login banner

(default: \$PWD/banner.txt, generates a default if absent)

--bin <path> Directory for downloaded binaries (e.g. thorctl)

(default: /usr/local/bin)

--toolbox <path> Download location for toolbox.json

(default: \$PWD/toolbox.json)

--user <name> Username for the initial admin user (default: test)

--password <pass> Password for the initial admin user

(default: INSECURE_DEV_PASSWORD)

--rand-password Generate a random password for the admin user

--registry Deploy a container registry in the thorium namespace

--registry-user <name> Enable registry basic auth for this user (implies --registry,

password is auto-generated and printed to stdout)

--timeout <seconds> Timeout in seconds for each service rollout/wait

(default: 600)

-h, --help Show this help message

Deploys the full stack: Redis, Elasticsearch (ECK), cert-manager,

ScyllaDB, MinIO, Jaeger, Kubegres, Quickwit, and the Thorium operator.

Optionally deploys a container registry (registry:2) with persistent storage.

Configures databases, creates a test user, installs thorctl, and imports

the default toolbox. Service passwords are randomly generated per deploy.

EOF

}

usage_get_config() {

cat <<EOF

minithor get-config — extract Thorium config from the cluster

Usage: minithor get-config

Reads the 'thorium' secret in the thorium namespace and writes

thorium.yml to your home directory (~/).

EOF

}

usage_expose() {

cat <<EOF

minithor expose — port-forward services to localhost

Usage: minithor expose [options]

Options:

--dev Also forward database ports (Elastic, Kibana, Redis, MinIO, Scylla)

--port <port> Local port for the Thorium API (default: 8080)

--stop Stop all running port-forwards

--status Show which port-forwards are running

-h, --help Show this help message

EOF

}

usage_stop() {

cat <<EOF

minithor stop — stop the minikube cluster

Usage: minithor stop

Gracefully stops the minikube VM/container. Cluster state is preserved

and can be resumed with 'minithor start'.

EOF

}

usage_cleanup() {

cat <<EOF

minithor cleanup — remove all Thorium resources for a fresh deploy

Usage: minithor cleanup --confirm

Options:

--confirm Required. Confirms you want to remove all resources.

--timeout <seconds> Timeout in seconds for each delete/wait operation

(default: 300)

-h, --help Show this help message

Removes all Thorium services, backing infrastructure, Helm releases,

namespaces, and CRDs. The minikube cluster itself is preserved — use

'minithor minikube delete --confirm' to fully remove minikube.

EOF

}

########################################

# Subcommand: minikube install

########################################

cmd_minikube_install() {

local certs_dir="$PWD/.certs"

local install_cpus=8

local install_memory_gib=16

while [ $# -gt 0 ]; do

case "$1" in

-h|--help) usage_minikube_install; return 0 ;;

--cpus)

shift

if [ $# -eq 0 ] || ! [[ "$1" =~ ^[0-9]+$ ]]; then

echo "ERROR: --cpus requires a numeric argument" >&2; exit 1

fi

install_cpus="$1"

;;

--memory)

shift

if [ $# -eq 0 ] || ! [[ "$1" =~ ^[0-9]+$ ]]; then

echo "ERROR: --memory requires a numeric argument (GiB)" >&2; exit 1

fi

install_memory_gib="$1"

;;

--certs-dir)

shift

if [ $# -eq 0 ]; then

echo "ERROR: --certs-dir requires an argument" >&2; exit 1

fi

certs_dir="$1"

;;

*) echo "Unknown option: $1"; usage_minikube_install; exit 1 ;;

esac

shift

done

select_driver

echo "Selected driver: $DRIVER"

# Inject org certs into podman VM on macOS

if [ "$DRIVER" = "podman" ] && [ "$OS" = "Darwin" ]; then

podman machine ssh "sudo mkdir -p /etc/pki/ca-trust/source/anchors/"

cat "$certs_dir"/*.crt | podman machine ssh "sudo tee /etc/pki/ca-trust/source/anchors/thorium-org-cert.crt > /dev/null"

podman machine ssh "sudo update-ca-trust"

fi

# Download and install minikube

local tmp_dir

tmp_dir=$(mktemp -d)

trap "rm -rf '$tmp_dir'" RETURN

case "$OS" in

Darwin)

if [ "$ARCH" = "arm64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-darwin-arm64

sudo install "$tmp_dir/minikube-darwin-arm64" /usr/local/bin/minikube

else

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-darwin-amd64

sudo install "$tmp_dir/minikube-darwin-amd64" /usr/local/bin/minikube

fi

;;

Linux)

if [ "$ARCH" = "x86_64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64

sudo install "$tmp_dir/minikube-linux-amd64" /usr/local/bin/minikube

elif [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-linux-arm64

sudo install "$tmp_dir/minikube-linux-arm64" /usr/local/bin/minikube

else

echo "Unsupported Linux architecture: $ARCH"

exit 1

fi

;;

*)

echo "Unsupported OS: $OS"

exit 1

;;

esac

local install_memory_mib=$((install_memory_gib * 1024))

minikube config set cpus "$install_cpus"

minikube config set memory "$install_memory_mib"

touch ~/.bashrc

if ! grep -q 'alias kubectl="minikube kubectl --"' ~/.bashrc 2>/dev/null; then

echo 'alias kubectl="minikube kubectl --"' >> ~/.bashrc

fi

touch ~/.zshrc

if ! grep -q 'alias kubectl="minikube kubectl --"' ~/.zshrc 2>/dev/null; then

echo 'alias kubectl="minikube kubectl --"' >> ~/.zshrc

fi

local proxy_bypass="localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16"

export NO_PROXY="$proxy_bypass"

export no_proxy="$proxy_bypass"

for rc in ~/.bashrc ~/.zshrc; do

if ! grep -q 'NO_PROXY=.*192\.168\.0\.0' "$rc" 2>/dev/null; then

cat >> "$rc" <<RCEOF

export NO_PROXY="$proxy_bypass"

export no_proxy="$proxy_bypass"

RCEOF

fi

done

mkdir -p ~/.minikube/certs/

cp "$certs_dir"/*.crt ~/.minikube/certs/ 2>/dev/null || true

minikube_start

fix_container_config

kctl config view --minify

minikube addons enable csi-hostpath-driver

minikube addons enable ingress

minikube addons enable ingress-dns

}

########################################

# Subcommand: minikube delete

########################################

cmd_minikube_delete() {

local confirm=false

for arg in "$@"; do

case "$arg" in

-h|--help) usage_minikube_delete; return 0 ;;

--confirm) confirm=true ;;

*) echo "Unknown option: $arg"; usage_minikube_delete; exit 1 ;;

esac

done

if [ "$confirm" = false ]; then

echo "ERROR: --confirm flag is required to delete minikube." >&2

echo "" >&2

usage_minikube_delete >&2

return 1

fi

select_driver

if [ -n "$DRIVER" ]; then

echo "Detected available driver: $DRIVER"

else

echo "No working podman/docker/kvm2 driver detected."

fi

if command -v minikube >/dev/null 2>&1; then

minikube delete --all --purge || true

else

echo "minikube not found; skipping minikube delete."

fi

rm -rf ~/.minikube ~/.kube

sudo rm -f /usr/local/bin/minikube

sudo rm -f /usr/local/bin/kubectl

if [ "$CONTAINER_CMD" = "podman" ]; then

echo "Using podman for container cleanup..."

podman system prune --force

podman image prune -a --force

elif [ "$CONTAINER_CMD" = "docker" ]; then

echo "Using docker for container cleanup..."

env -u DOCKER_HOST docker system prune --force

env -u DOCKER_HOST docker image prune -a --force

else

echo "No working container runtime found; skipping container cleanup."

fi

}

########################################

# Subcommand: minikube (dispatcher)

########################################

cmd_minikube() {

if [ $# -eq 0 ]; then

usage_minikube

exit 1

fi

local subcmd="$1"

shift

case "$subcmd" in

install) cmd_minikube_install "$@" ;;

delete) cmd_minikube_delete "$@" ;;

-h|--help) usage_minikube; return 0 ;;

*)

echo "Unknown minikube subcommand: $subcmd" >&2

echo "" >&2

usage_minikube >&2

exit 1

;;

esac

}

########################################

# Subcommand: start

########################################

cmd_start() {

for arg in "$@"; do

case "$arg" in

-h|--help) usage_start; return 0 ;;

esac

done

select_driver

echo "Detected driver: $DRIVER"

minikube_start

fix_container_config

log "Tuning minikube node kernel parameters"

tune_kernel_params minikube

sleep 30

# Delete pods stuck in terminal failure states

kctl get pods -A --no-headers 2>/dev/null \

| grep -E 'CrashLoopBackOff|Error|ImagePullBackOff|ErrImagePull|InvalidImageName' \

| awk '{print $2 " -n " $1}' \

| while read -r line; do

kctl delete pod $line --ignore-not-found 2>/dev/null || true

done

}

########################################

# Subcommand: stop

########################################

cmd_stop() {

for arg in "$@"; do

case "$arg" in

-h|--help) usage_stop; return 0 ;;

esac

done

ensure_minikube_running

minikube stop

}

########################################

# Subcommand: deploy

########################################

cmd_deploy() {

local cluster_config="$PWD/thorium-cluster.yml"

local docker_config="$PWD/.dockerconfigjson"

local banner_path="$PWD/banner.txt"

local bin_dir="/usr/local/bin"

local toolbox_path="$PWD/toolbox.json"

local deploy_user="test"

local deploy_pass="INSECURE_DEV_PASSWORD"

local deploy_registry=false

local registry_user=""

local deploy_timeout=600

while [ $# -gt 0 ]; do

case "$1" in

-h|--help) usage_deploy; return 0 ;;

--config)

shift

if [ $# -eq 0 ]; then echo "ERROR: --config requires an argument" >&2; exit 1; fi

cluster_config="$1"

;;

--docker-config)

shift

if [ $# -eq 0 ]; then echo "ERROR: --docker-config requires an argument" >&2; exit 1; fi

docker_config="$1"

;;

--banner)

shift

if [ $# -eq 0 ]; then echo "ERROR: --banner requires an argument" >&2; exit 1; fi

banner_path="$1"

;;

--bin)

shift

if [ $# -eq 0 ]; then echo "ERROR: --bin requires an argument" >&2; exit 1; fi

bin_dir="$1"

;;

--toolbox)

shift

if [ $# -eq 0 ]; then echo "ERROR: --toolbox requires an argument" >&2; exit 1; fi

toolbox_path="$1"

;;

--user)

shift

if [ $# -eq 0 ]; then echo "ERROR: --user requires an argument" >&2; exit 1; fi

deploy_user="$1"

;;

--password)

shift

if [ $# -eq 0 ]; then echo "ERROR: --password requires an argument" >&2; exit 1; fi

deploy_pass="$1"

;;

--rand-password)

deploy_pass=$(generate_password)

;;

--registry)

deploy_registry=true

;;

--registry-user)

shift

if [ $# -eq 0 ]; then echo "ERROR: --registry-user requires an argument" >&2; exit 1; fi

registry_user="$1"

deploy_registry=true

;;

--timeout)

shift

if [ $# -eq 0 ] || ! [[ "$1" =~ ^[0-9]+$ ]]; then

echo "ERROR: --timeout requires a numeric argument (seconds)" >&2; exit 1

fi

deploy_timeout="$1"

;;

*) echo "Unknown option: $1"; usage_deploy; exit 1 ;;

esac

shift

done

local REDIS_PASS PG_PASS SCYLLA_PASS ES_PASS MINIO_AK MINIO_SK THORIUM_SECRET

REDIS_PASS=$(generate_password)

PG_PASS=$(generate_password)

SCYLLA_PASS=$(generate_password)

ES_PASS=$(generate_password)

MINIO_AK=$(generate_password)

MINIO_SK=$(generate_password)

THORIUM_SECRET=$(generate_password)

CURRENT_SECTION="startup"

trap 'echo "FATAL: Failed in \"$CURRENT_SECTION\" at line $LINENO (command: $BASH_COMMAND)" >&2' ERR

ensure_minikube_running

########################################

# Wait for healthy cluster

########################################

CURRENT_SECTION="Wait for healthy cluster"

wait_for_healthy_cluster() {

kctl wait --for=condition=Ready node/minikube --timeout=120s &&

kctl wait --for=condition=Ready pod -l k8s-app=calico-node -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l k8s-app=calico-kube-controllers -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l k8s-app=kube-dns -n kube-system --timeout=120s &&

kctl rollout status deployment.apps/coredns -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l app.kubernetes.io/name=csi-hostpath-attacher -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l app.kubernetes.io/name=csi-hostpath-resizer -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l app.kubernetes.io/name=csi-hostpathplugin -n kube-system --timeout=120s &&

kctl wait --for=condition=Ready pod -l app.kubernetes.io/component=controller -n ingress-nginx --timeout=120s

}

log "Waiting for cluster to be healthy"

max_retries=30

retry_delay=10

for attempt in $(seq 1 $max_retries); do

output=$(wait_for_healthy_cluster 2>&1) && break

echo "Cluster not ready yet (attempt $attempt/$max_retries): $(echo "$output" | tail -1)"

if [ "$attempt" -eq "$max_retries" ]; then

echo "Cluster did not become ready after $max_retries attempts"

echo "$output" >&2

exit 1

fi

sleep "$retry_delay"

done

########################################

# Kernel parameter tuning

########################################

CURRENT_SECTION="Kernel parameter tuning"

if [ "$OS" = "Linux" ]; then

log "Tuning host kernel parameters"

tune_kernel_params host

fi

log "Tuning minikube node kernel parameters"

tune_kernel_params minikube

########################################

# Helm setup

########################################

CURRENT_SECTION="Helm setup"

if ! command -v helm &>/dev/null; then

log "Installing Helm"

local helm_script

helm_script=$(mktemp)

curl -fsSL -o "$helm_script" https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3

chmod 700 "$helm_script"

"$helm_script"

rm -f "$helm_script"

else

log "Helm already installed, skipping download"

fi

log "Adding Helm repos"

helm repo add --force-update jetstack https://charts.jetstack.io

helm repo add --force-update scylla https://scylla-operator-charts.storage.googleapis.com/stable

helm repo add --force-update elastic https://helm.elastic.co

helm repo add --force-update quickwit https://helm.quickwit.io

helm repo update

########################################

# Redis

########################################

CURRENT_SECTION="Redis"

log "Deploying Redis"

kctl apply -f - <<EOF

---

apiVersion: v1

kind: Namespace

metadata:

name: redis

---

apiVersion: v1

kind: Secret

metadata:

name: redis-conf

namespace: redis

type: Opaque

stringData:

redis.conf: |

bind 0.0.0.0

protected-mode yes

port 6379

tcp-backlog 511

timeout 0

tcp-keepalive 300

daemonize no

supervised no

pidfile /var/run/redis_6379.pid

loglevel notice

logfile ""

databases 16

always-show-logo yes

save 900 1

save 300 10

save 60 10000

stop-writes-on-bgsave-error yes

rdbcompression yes

rdbchecksum yes

dbfilename dump2.rdb

dir /data

requirepass $REDIS_PASS

appendonly no

appendfilename "appendonly.aof"

appendfsync everysec

no-appendfsync-on-rewrite no

auto-aof-rewrite-percentage 100

auto-aof-rewrite-min-size 64mb

aof-load-truncated yes

aof-use-rdb-preamble yes

lua-time-limit 5000

slowlog-log-slower-than 10000

slowlog-max-len 128

latency-monitor-threshold 0

notify-keyspace-events ""

hash-max-ziplist-entries 512

hash-max-ziplist-value 64

list-max-ziplist-size -2

list-compress-depth 0

set-max-intset-entries 512

zset-max-ziplist-entries 128

zset-max-ziplist-value 64

hll-sparse-max-bytes 3000

stream-node-max-bytes 4096

stream-node-max-entries 100

activerehashing yes

hz 10

dynamic-hz yes

aof-rewrite-incremental-fsync yes

rdb-save-incremental-fsync yes

jemalloc-bg-thread yes

---

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: redis-persistent-storage-claim

namespace: redis

spec:

storageClassName: csi-hostpath-sc

resources:

requests:

storage: 16Gi

accessModes:

- ReadWriteOnce

---

apiVersion: v1

kind: Service

metadata:

name: redis

namespace: redis

spec:

type: ClusterIP

selector:

app: redis

ports:

- name: redis

port: 6379

targetPort: 6379

---

apiVersion: apps/v1

kind: StatefulSet

metadata:

name: redis

namespace: redis

labels:

app: redis

spec:

serviceName: redis

replicas: 1

selector:

matchLabels:

app: redis

template:

metadata:

labels:

app: redis

spec:

containers:

- name: redis

image: docker.io/redis:7

imagePullPolicy: Always

command: ["redis-server", "/var/lib/redis/redis.conf"]

resources:

requests:

cpu: 0

memory: 0

limits:

cpu: 500m

memory: 512Mi

volumeMounts:

- mountPath: "/data"

name: redis-data

- mountPath: "/var/lib/redis/"

name: redis-conf

volumes:

- name: redis-conf

secret:

secretName: redis-conf

- name: redis-data

persistentVolumeClaim:

claimName: redis-persistent-storage-claim

EOF

########################################

# Elasticsearch

########################################

CURRENT_SECTION="Elasticsearch"

log "Deploying ECK Operator"

helm upgrade --install elastic-operator elastic/eck-operator \

--namespace elastic-system --create-namespace

wait_for_rollout statefulset/elastic-operator elastic-system "$deploy_timeout"

wait_for_resource crd elasticsearches.elasticsearch.k8s.elastic.co "" "$deploy_timeout"

wait_for_resource crd kibanas.kibana.k8s.elastic.co "" "$deploy_timeout"

kctl wait --for condition=established \

crd/elasticsearches.elasticsearch.k8s.elastic.co \

crd/kibanas.kibana.k8s.elastic.co --timeout="${deploy_timeout}s"

log "Deploying Elasticsearch and Kibana"

kctl apply -f - <<'EOF'

---

apiVersion: elasticsearch.k8s.elastic.co/v1

kind: Elasticsearch

metadata:

name: elastic

namespace: elastic-system

spec:

version: 8.19.2

volumeClaimDeletePolicy: DeleteOnScaledownOnly

nodeSets:

- name: default

count: 1

podTemplate:

spec:

containers:

- name: elasticsearch

env:

- name: ES_JAVA_OPTS

value: -Xms1g -Xmx1g

resources:

requests:

cpu: 0

memory: 0

limits:

cpu: 1

memory: 2Gi

volumeClaimTemplates:

- metadata:

name: elasticsearch-data

spec:

storageClassName: csi-hostpath-sc

accessModes:

- ReadWriteOnce