#!/usr/bin/env bash

set -euo pipefail

########################################

# Shared utilities

########################################

OS="$(uname -s)"

ARCH="$(uname -m)"

DRIVER=""

CONTAINER_CMD=""

# In-cluster container registry, referenced by its Kubernetes service DNS name.

REGISTRY_HOST="registry.thorium.svc.cluster.local"

REGISTRY_PORT=5000

# Cluster-internal names that must never traverse an HTTP proxy and that the

# minikube node must reach directly (CoreDNS is pod-facing only, so the node's

# container runtime can't resolve/route these through a proxy). Suffix entries

# (leading dot) match subdomains in Go's httpproxy matcher used by the runtime.

CLUSTER_NO_PROXY="${REGISTRY_HOST},.svc.cluster.local,svc.cluster.local,cluster.local"

kctl() { minikube kubectl -- "$@"; }

log() { echo -e "\n====== $1 ======\n"; }

########################################

# Port-forward + loopback alias helpers (shared)

#

# Used by `expose`, `expose --stop`, `cleanup`, and `minikube delete` so that

# dev port-forwards and the loopback aliases they create are always torn down

# together.

########################################

# Where expose writes its logs and tracks the loopback aliases it created

EXPOSE_LOG_DIR="/tmp/minithor-expose-logs"

LOOPBACK_STATE_FILE="${EXPOSE_LOG_DIR}/loopback-aliases"

CURRENT_USER="$(id -un)"

# Scylla connection details (the operator runs Thorium's Scylla in this ns)

SCYLLA_NAMESPACE="scylla"

SCYLLA_CQL_PORT=9042

# In-cluster service DNS names baked into the thorium secret. Used by

# `get-config --local` to rewrite the config for host access via exposed ports.

ELASTIC_CLUSTER_HOST="elastic-es-http.elastic-system.svc.cluster.local"

REDIS_CLUSTER_HOST="redis.redis.svc.cluster.local"

MINIO_CLUSTER_HOST="minio.minio.svc.cluster.local"

SCYLLA_CLUSTER_HOST="scylla-client.scylla.svc.cluster.local"

# Local API listen port written into a `--local` config (80 needs root)

LOCAL_API_PORT=8888

# List the minikube kubectl port-forward processes we manage. The `[p]ort`

# trick keeps grep from matching itself; `.*svc/` tolerates an interspersed

# `--address` flag (used for the Scylla forwards). `ps -A -o user,pid,args` is

# portable across GNU (Linux) and BSD (macOS) ps — unlike `ps -eo user:20,...`,

# whose `-e`/`:width` syntax means different things on macOS.

find_forwards() {

ps -A -o user,pid,args 2>/dev/null \

| grep 'minikube kubectl.*[p]ort-forward.*svc/' \

|| true

}

parse_service() { echo "$1" | sed -n 's/.*svc\/\([^ ]*\).*/\1/p'; }

parse_ports() { echo "$1" | awk '{print $NF}'; }

kill_process() {

local pid=$1 owner=$2

if [ "$owner" = "$CURRENT_USER" ]; then

pkill -P "$pid" 2>/dev/null || true

kill "$pid" 2>/dev/null || true

else

echo " Port-forward owned by $owner, using sudo to stop"

sudo pkill -P "$pid" 2>/dev/null || true

sudo kill "$pid" 2>/dev/null || true

fi

}

is_forward_alive() { find_forwards | grep -q "svc/$1"; }

stop_forward() {

local service=$1 line owner pid

while IFS= read -r line; do

[ -n "$line" ] || continue

owner=$(echo "$line" | awk '{print $1}')

pid=$(echo "$line" | awk '{print $2}')

kill_process "$pid" "$owner"

echo "Stopped $service (PID $pid, owner $owner)"

done < <(find_forwards | grep "svc/$service")

}

stop_all_forwards() {

local found=false line owner pid service

while IFS= read -r line; do

[ -n "$line" ] || continue

found=true

owner=$(echo "$line" | awk '{print $1}')

pid=$(echo "$line" | awk '{print $2}')

service=$(parse_service "$line")

kill_process "$pid" "$owner"

echo "Stopped $service (PID $pid, owner $owner)"

done < <(find_forwards)

if [ "$found" = false ]; then

echo "No port-forwards running"

fi

}

show_status() {

local found=false line owner pid service ports

while IFS= read -r line; do

[ -n "$line" ] || continue

found=true

owner=$(echo "$line" | awk '{print $1}')

pid=$(echo "$line" | awk '{print $2}')

service=$(parse_service "$line")

ports=$(parse_ports "$line")

echo " $service: running as $owner (PID $pid) -> $ports"

done < <(find_forwards)

if [ "$found" = false ]; then

echo " No port-forwards running"

fi

}

# Start a single port-forward. Accepts an optional leading `--address <ip>` to

# bind the forward to a specific local IP (used for Scylla, see forward_scylla_dev).

#

# start_forward [--address <ip>] <name> <namespace> <service> <ports...>

start_forward() {

local bind_addr=""

if [ "${1:-}" = "--address" ]; then

bind_addr="$2"

shift 2

fi

local name=$1 namespace=$2 service=$3

shift 3

local ports=("$@")

if is_forward_alive "$service"; then

local existing owner pid

existing=$(find_forwards | grep "svc/$service" | head -1)

owner=$(echo "$existing" | awk '{print $1}')

pid=$(echo "$existing" | awk '{print $2}')

echo " $name: already running as $owner (PID $pid), skipping"

return

fi

if ! kctl get svc "$service" -n "$namespace" &>/dev/null; then

echo " $name: SKIPPED (service $service not found in namespace $namespace)"

return 1

fi

# Kill any stale process holding the local port. When bound to a specific

# address, scope the check to that address so sibling forwards on the same

# port (e.g. multiple Scylla nodes on :9042) aren't killed.

local local_port="${ports[0]%%:*}"

local stale_pid stale_owner

if command -v ss &>/dev/null; then

if [ -n "$bind_addr" ]; then

stale_pid=$(ss -tlnp "src ${bind_addr}:${local_port}" 2>/dev/null | sed -n 's/.*pid=\([0-9]*\).*/\1/p' | head -1 || true)

else

stale_pid=$(ss -tlnp "sport = :$local_port" 2>/dev/null | sed -n 's/.*pid=\([0-9]*\).*/\1/p' | head -1 || true)

fi

elif [ -n "$bind_addr" ]; then

stale_pid=$(lsof -nP -ti "TCP@${bind_addr}:${local_port}" -sTCP:LISTEN 2>/dev/null | head -1 || true)

else

stale_pid=$(lsof -nP -ti "TCP:$local_port" -sTCP:LISTEN 2>/dev/null | head -1 || true)

fi

if [ -n "$stale_pid" ]; then

stale_owner=$(ps -o user= -p "$stale_pid" 2>/dev/null | awk '{print $1}' || true)

echo " $name: killing stale process on port ${bind_addr:+$bind_addr:}$local_port (PID $stale_pid, owner ${stale_owner:-unknown})"

kill_process "$stale_pid" "${stale_owner:-$CURRENT_USER}"

sleep 1

fi

local addr_flag=()

[ -n "$bind_addr" ] && addr_flag=(--address "$bind_addr")

local log_file="$EXPOSE_LOG_DIR/$name.log"

kctl port-forward ${addr_flag[@]+"${addr_flag[@]}"} "svc/$service" -n "$namespace" "${ports[@]}" >/dev/null 2>"$log_file" &

local pid=$!

sleep 1

if is_forward_alive "$service"; then

echo " $name: forwarding ${bind_addr:+$bind_addr }${ports[*]} (PID $pid)"

else

echo " $name: FAILED to start (port-forward exited immediately)"

if [ -s "$log_file" ]; then

echo " $name: log: $(cat "$log_file")"

fi

return 1

fi

}

# Is the given IP currently configured as a loopback alias?

loopback_alias_present() {

local ip=$1

case "$OS" in

Linux) ip addr show dev lo 2>/dev/null | grep -qw "$ip" ;;

Darwin) ifconfig lo0 2>/dev/null | grep -qw "$ip" ;;

*) return 1 ;;

esac

}

# Add an IP as a loopback alias so a port-forward can bind to it, recording it

# in the state file so teardown knows to remove it. Idempotent.

loopback_alias_add() {

local ip=$1

mkdir -p "$EXPOSE_LOG_DIR"

if ! { [ -f "$LOOPBACK_STATE_FILE" ] && grep -qxF "$ip" "$LOOPBACK_STATE_FILE"; }; then

echo "$ip" >> "$LOOPBACK_STATE_FILE"

fi

if loopback_alias_present "$ip"; then

return 0

fi

case "$OS" in

Linux) sudo ip addr add "$ip/32" dev lo ;;

Darwin) sudo ifconfig lo0 alias "$ip" 255.255.255.255 ;;

*) echo " WARNING: don't know how to add a loopback alias on $OS" >&2; return 1 ;;

esac

}

# Remove a single loopback alias if present.

loopback_alias_del() {

local ip=$1

if loopback_alias_present "$ip"; then

case "$OS" in

Linux) sudo ip addr del "$ip/32" dev lo 2>/dev/null || true ;;

Darwin) sudo ifconfig lo0 -alias "$ip" 2>/dev/null || true ;;

esac

echo " Removed loopback alias $ip"

fi

}

# Remove every loopback alias expose created and clear the state file.

remove_all_loopback_aliases() {

[ -f "$LOOPBACK_STATE_FILE" ] || return 0

local ip

while IFS= read -r ip; do

[ -n "$ip" ] || continue

loopback_alias_del "$ip"

done < "$LOOPBACK_STATE_FILE"

rm -f "$LOOPBACK_STATE_FILE"

}

# Discover Thorium's Scylla nodes and the address each advertises to clients

# (its broadcast_rpc_address, which the Scylla driver re-dials after the initial

# connection). With scylla-operator each node gets a per-pod ClusterIP "member"

# service whose name matches the pod and whose ClusterIP is that advertised

# address. Prints "<member-service-name> <advertised-ip>" per node.

discover_scylla_nodes() {

local pods pod ip

pods=$(kctl get pods -n "$SCYLLA_NAMESPACE" \

-l app.kubernetes.io/name=scylla \

-o jsonpath='{.items[*].metadata.name}' 2>/dev/null) || true

for pod in $pods; do

ip=$(kctl get svc "$pod" -n "$SCYLLA_NAMESPACE" \

-o jsonpath='{.spec.clusterIP}' 2>/dev/null) || true

if [ -n "$ip" ] && [ "$ip" != "None" ]; then

echo "$pod $ip"

fi

done

}

# Set up dev port-forwards for Scylla. A plain localhost forward does NOT work:

# the driver connects to the seed, learns each node's advertised

# broadcast_rpc_address (the per-pod ClusterIP) and re-dials *that* address,

# which a localhost tunnel can't satisfy. So for each node we add its advertised

# IP as a loopback alias and bind the forward to that exact IP, so both the seed

# connection and the driver's re-dial land on the forward.

forward_scylla_dev() {

local nodes

nodes=$(discover_scylla_nodes)

if [ -z "$nodes" ]; then

echo " scylla: SKIPPED (no Scylla nodes found in namespace $SCYLLA_NAMESPACE)"

return 1

fi

local svc ip

while read -r svc ip; do

[ -n "$svc" ] || continue

if ! loopback_alias_add "$ip"; then

echo " scylla[$svc]: FAILED to add loopback alias $ip"

continue

fi

start_forward --address "$ip" "scylla-$svc" "$SCYLLA_NAMESPACE" "$svc" \

"$SCYLLA_CQL_PORT:$SCYLLA_CQL_PORT"

done <<< "$nodes"

}

generate_password() {

openssl rand -base64 32 | tr -d '/+=' | head -c 32

}

has_podman() {

command -v podman >/dev/null 2>&1 &&

podman info >/dev/null 2>&1

}

has_docker() {

command -v docker >/dev/null 2>&1 &&

env -u DOCKER_HOST docker info >/dev/null 2>&1

}

has_kvm2() {

[ "$OS" = "Linux" ] || return 1

command -v virsh >/dev/null 2>&1 &&

[ -e /dev/kvm ] &&

(

systemctl is-active --quiet libvirtd 2>/dev/null ||

systemctl is-active --quiet virtqemud 2>/dev/null

)

}

select_driver() {

if has_podman; then

DRIVER="podman"

CONTAINER_CMD="podman"

elif has_docker; then

DRIVER="docker"

CONTAINER_CMD="docker"

elif has_kvm2; then

DRIVER="kvm2"

CONTAINER_CMD=""

else

echo "No supported and working minikube driver found."

return 1

fi

}

minikube_start() {

# Trust the in-cluster registry as insecure (HTTP) at cluster-creation time.

# The node's container runtime defaults to HTTPS for every registry; without

# this, pulling from the HTTP-only internal registry fails the TLS handshake

# with "unexpected EOF" -> ErrImagePull/ImagePullBackOff. The flag must be set

# when the node is created since it bakes into the runtime's daemon config.

local insecure_registry="${REGISTRY_HOST}:${REGISTRY_PORT}"

# Ensure the cluster-internal names bypass any configured HTTP proxy. minikube

# propagates these env vars into the node runtime's proxy config at create time;

# without the cluster domain here, registry pulls get routed through the proxy

# and fail with "denied: Access denied". Merge (don't clobber) any user value.

export NO_PROXY="${NO_PROXY:+$NO_PROXY,}${CLUSTER_NO_PROXY}"

export no_proxy="${no_proxy:+$no_proxy,}${CLUSTER_NO_PROXY}"

if [ "$DRIVER" = "docker" ]; then

env -u DOCKER_HOST minikube start --cni calico --driver="$DRIVER" --insecure-registry="$insecure_registry"

elif [ "$DRIVER" = "podman" ]; then

minikube start --cni calico --container-runtime=containerd --driver="$DRIVER" --insecure-registry="$insecure_registry"

else

minikube start --cni calico --driver="$DRIVER" --insecure-registry="$insecure_registry"

fi

}

fix_container_config() {

if [ -n "$CONTAINER_CMD" ]; then

local api_port cluster

api_port="$($CONTAINER_CMD port minikube 8443/tcp | awk -F: '{print $2}')"

cluster="$(kctl config view --minify -o jsonpath='{.contexts[0].context.cluster}')"

kctl config set-cluster "$cluster" --server="https://127.0.0.1:${api_port}"

fi

}

ensure_minikube_running() {

local status_output

status_output="$(minikube status 2>/dev/null)" || true

local host_status

host_status="$(echo "$status_output" | awk '/^host:/ {print $2}')" || true

if [[ "$host_status" != "Running" ]]; then

echo "ERROR: minikube is not running. Start it with: minithor start" >&2

exit 1

fi

# Auto-fix stale kubeconfig (e.g. after host reboot changed the container port mapping)

local kube_status

kube_status="$(echo "$status_output" | awk '/^kubeconfig:/ {print $2}')" || true

if [[ "$kube_status" != "Configured" ]]; then

echo "Kubeconfig is stale, updating context..." >&2

minikube update-context >/dev/null 2>&1

fi

}

wait_for_rollout() {

local resource=$1 namespace=$2 timeout=${3:-300}

kctl rollout status --watch --timeout="${timeout}s" "$resource" -n "$namespace"

}

wait_for_resource() {

local resource_type=$1 resource_name=$2 namespace=$3 timeout=${4:-300}

local elapsed=0

local ns_flag=()

if [ -n "$namespace" ]; then

ns_flag=(-n "$namespace")

fi

echo "Waiting for $resource_type/$resource_name${namespace:+ in $namespace} (timeout: ${timeout}s)..."

until kctl get "$resource_type" "$resource_name" ${ns_flag[@]+"${ns_flag[@]}"} &>/dev/null; do

sleep 5

elapsed=$((elapsed + 5))

if [ "$elapsed" -ge "$timeout" ]; then

echo "ERROR: Timed out waiting for $resource_type/$resource_name${namespace:+ in $namespace}" >&2

return 1

fi

done

}

wait_for_port_forward() {

local port=$1 max_attempts=${2:-20}

for attempt in $(seq 1 "$max_attempts"); do

if curl -sf -o /dev/null "http://localhost:$port" 2>/dev/null; then return 0; fi

sleep 1

done

echo "ERROR: Port-forward on port $port not ready after ${max_attempts}s" >&2

return 1

}

# Error-tolerant execution — uses FAILURES global set by the caller

run_step() {

if ! "$@"; then

FAILURES=$((FAILURES + 1))

echo "ERROR: Command failed (continuing): $*" >&2

fi

}

tune_kernel_params() {

local target="${1:-host}"

local params=(

"fs.inotify.max_user_instances=1024"

"fs.file-max=2097152"

"fs.nr_open=1048576"

"vm.max_map_count=262144"

)

for param in "${params[@]}"; do

local key="${param%%=*}"

local desired="${param#*=}"

local current

if [ "$target" = "minikube" ]; then

current=$(minikube ssh -- /sbin/sysctl -n "$key" 2>/dev/null | tr -d '\r') || true

else

current=$(sysctl -n "$key" 2>/dev/null) || true

fi

if [ -z "$current" ]; then

echo " $key: could not read current value, skipping"

continue

fi

if [ "$current" -ge "$desired" ] 2>/dev/null; then

echo " $key = $current (already >= $desired)"

else

echo " $key: $current -> $desired"

if [ "$target" = "minikube" ]; then

minikube ssh -- sudo /sbin/sysctl -w "$param" >/dev/null 2>&1 || echo " WARNING: failed to set $key on minikube node"

else

sudo sysctl -w "$param" >/dev/null 2>&1 || echo " WARNING: failed to set $key (may require root)"

fi

fi

done

if [ "$target" = "host" ] && [ "$OS" = "Linux" ]; then

local conf="/etc/sysctl.d/99-minithor.conf"

echo " Persisting to $conf"

printf '%s\n' "${params[@]}" | sudo tee "$conf" >/dev/null 2>&1 || echo " WARNING: failed to write $conf"

fi

}

# Map the in-cluster registry's service DNS name to its ClusterIP in the minikube

# node's /etc/hosts. The node's container runtime pulls images using the node's

# resolver (not CoreDNS), so without this it cannot resolve REGISTRY_HOST and

# image pulls fail with "no such host". Idempotent; no-op when the registry isn't

# deployed. The docker driver regenerates /etc/hosts on node restart, so this is

# re-asserted on every `minithor start`.

ensure_registry_node_dns() {

local ip

ip="$(kctl get svc registry -n thorium -o jsonpath='{.spec.clusterIP}' 2>/dev/null)" || return 0

[ -n "$ip" ] || return 0

echo " Mapping ${REGISTRY_HOST} -> ${ip} on the minikube node"

# /etc/hosts is a bind-mount in the node; rewrite in place (rename-based edits

# like `sed -i` fail with "Device or resource busy").

minikube ssh -- "sudo cp /etc/hosts /tmp/minithor-hosts && \

grep -v ' ${REGISTRY_HOST}\$' /tmp/minithor-hosts | sudo tee /etc/hosts >/dev/null && \

echo '${ip} ${REGISTRY_HOST}' | sudo tee -a /etc/hosts >/dev/null" >/dev/null 2>&1 \

|| echo " WARNING: failed to set registry hosts entry on the minikube node"

}

helm_uninstall() {

local release=$1 namespace=$2

if helm status "$release" -n "$namespace" &>/dev/null; then

run_step helm uninstall "$release" -n "$namespace" --timeout=120s

else

echo "Helm release '$release' not found in namespace '$namespace', skipping"

fi

}

clear_finalizers_and_delete() {

local crd=$1 resource_type=$2 namespace=$3

if kctl get crd "$crd" &>/dev/null; then

for item in $(kctl get "$resource_type" -n "$namespace" -o name 2>/dev/null); do

run_step kctl patch "$item" -n "$namespace" --type merge -p '{"metadata":{"finalizers":[]}}'

done

run_step kctl delete "$resource_type" --all -n "$namespace" --ignore-not-found --timeout=60s

fi

}

force_delete_ns() {

local ns=$1

echo "Force-clearing finalizers on stuck namespace '$ns'..."

kctl get ns "$ns" -o json \

| sed 's/"finalizers":[^]]*]/"finalizers":[]/' \

| kctl replace --raw "/api/v1/namespaces/$ns/finalize" -f -

}

wait_for_ns_termination() {

local timeout=${1:-300}

local elapsed=0

while kctl get ns 2>&1 | grep -q Terminating; do

sleep 5

elapsed=$((elapsed + 5))

if [ "$elapsed" -ge "$timeout" ]; then

echo "WARNING: Namespaces still terminating after ${timeout}s, force-clearing..." >&2

local stuck_ns

stuck_ns=$(kctl get ns -o jsonpath='{range .items[?(@.status.phase=="Terminating")]}{.metadata.name}{"\n"}{end}' 2>/dev/null)

for ns in $stuck_ns; do

force_delete_ns "$ns" || true

done

sleep 5

if kctl get ns 2>&1 | grep -q Terminating; then

echo "ERROR: Namespaces still stuck after force-clear:" >&2

kctl get ns 2>&1 | grep Terminating >&2 || true

return 1

fi

return 0

fi

done

}

########################################

# Usage / help functions

########################################

usage() {

cat <<EOF

minithor — manage a local Thorium instance on Minikube

Usage: minithor <command> [options]

Commands:

minikube Manage the minikube cluster (install, delete)

start Start a previously stopped minikube cluster

deploy Deploy all Thorium services and backing infrastructure

get-config Extract the running Thorium config to ~/thorium.yml

expose Port-forward Thorium (and optionally backing services) to localhost

stop Stop the minikube cluster (preserves state)

cleanup Remove all Thorium resources for a fresh deploy (requires --confirm)

Global options:

-h, --help Show this help message

Run 'minithor <command> --help' for command-specific options.

EOF

}

usage_minikube() {

cat <<EOF

minithor minikube — manage the minikube cluster

Usage: minithor minikube <subcommand> [options]

Subcommands:

install Install minikube and start a Kubernetes cluster

delete Completely remove minikube and all associated data (requires --confirm)

Run 'minithor minikube <subcommand> --help' for subcommand-specific options.

EOF

}

usage_minikube_install() {

cat <<EOF

minithor minikube install — install minikube and start a Kubernetes cluster

Usage: minithor minikube install [options]

Options:

--cpus <n> Number of CPUs to allocate to minikube (default: 8)

--memory <n> Memory in GiB to allocate to minikube (default: 16)

--certs-dir <path> Directory containing .crt files to trust

(default: \$PWD/.certs/)

-h, --help Show this help message

Detects the best available driver (podman > docker > kvm2), downloads

minikube for your OS/architecture, configures resource limits, and starts

the cluster with Calico CNI, CSI, and Ingress addons.

EOF

}

usage_minikube_delete() {

cat <<EOF

minithor minikube delete — completely remove minikube

Usage: minithor minikube delete --confirm

Options:

--confirm Required. Confirms you want to remove minikube entirely.

-h, --help Show this help message

Runs 'minikube delete --all --purge', removes ~/.minikube and ~/.kube,

uninstalls the minikube and kubectl binaries, and prunes unused container

images. This is irreversible.

EOF

}

usage_start() {

cat <<EOF

minithor start — start a stopped minikube cluster

Usage: minithor start

Detects the container driver, starts minikube, corrects the kubeconfig

API server address if needed, and cleans up pods stuck in terminal

failure states.

EOF

}

usage_deploy() {

cat <<EOF

minithor deploy — deploy Thorium and all backing services

Usage: minithor deploy [options]

Options:

--config <path> Path to thorium-cluster.yml

(default: \$PWD/thorium-cluster.yml)

--docker-config <path> Path to .dockerconfigjson for private registries

(default: \$PWD/.dockerconfigjson)

--banner <path> Path to banner.txt for the login banner

(default: \$PWD/banner.txt, generates a default if absent)

--bin <path> Directory for downloaded binaries (e.g. thorctl)

(default: /usr/local/bin)

--toolbox <path> Download location for toolbox.json

(default: \$PWD/toolbox.json)

--user <name> Username for the initial admin user (default: test)

--password <pass> Password for the initial admin user

(default: INSECURE_DEV_PASSWORD)

--rand-password Generate a random password for the admin user

--registry Deploy a container registry in the thorium namespace

--registry-user <name> Enable registry basic auth for this user (implies --registry,

password is auto-generated and printed to stdout)

--timeout <seconds> Timeout in seconds for each service rollout/wait

(default: 600)

-h, --help Show this help message

Deploys the full stack: Redis, Elasticsearch (ECK), cert-manager,

ScyllaDB, MinIO, Jaeger, Kubegres, Quickwit, and the Thorium operator.

Optionally deploys a container registry (registry:2) with persistent storage.

Configures databases, creates a test user, installs thorctl, and imports

the default toolbox. Service passwords are randomly generated per deploy.

EOF

}

usage_get_config() {

cat <<EOF

minithor get-config — extract Thorium config from the cluster

Usage: minithor get-config [options]

Options:

--local Rewrite the config to connect to the databases through the

local ports created by 'minithor expose --dev', and write it

to ~/thorium.local.yml (the raw ~/thorium.yml is left alone).

-h, --help Show this help message

Reads the 'thorium' secret in the thorium namespace. By default writes the raw

in-cluster config to thorium.yml in your home directory (~/).

With --local it translates the config for running a local build of the API/tools

against the cluster's databases via exposed ports:

* elastic / redis / minio hosts -> localhost

* elastic insecure_certificates -> true (localhost won't match the cluster cert)

* scylla.nodes -> each node's advertised cluster IP (matches

the loopback-aliased forward expose creates)

* thorium.port -> ${LOCAL_API_PORT} (80 needs root)

* thorium.tracing.external -> null (in-cluster collector isn't reachable)

Run 'minithor expose --dev' first so those ports are actually forwarded.

EOF

}

usage_expose() {

cat <<EOF

minithor expose — port-forward services to localhost

Usage: minithor expose [options]

Options:

--dev Also forward database ports (Elastic, Kibana, Redis, MinIO, Scylla)

--no-api Forward only the backing services (skip api/registry) so a

locally-run API can use them; implies the database ports

--port <port> Local port for the Thorium API (default: 8080)

--stop Stop all running port-forwards

--status Show which port-forwards are running

-h, --help Show this help message

EOF

}

usage_stop() {

cat <<EOF

minithor stop — stop the minikube cluster

Usage: minithor stop

Gracefully stops the minikube VM/container. Cluster state is preserved

and can be resumed with 'minithor start'.

EOF

}

usage_cleanup() {

cat <<EOF

minithor cleanup — remove all Thorium resources for a fresh deploy

Usage: minithor cleanup --confirm

Options:

--confirm Required. Confirms you want to remove all resources.

--timeout <seconds> Timeout in seconds for each delete/wait operation

(default: 300)

-h, --help Show this help message

Removes all Thorium services, backing infrastructure, Helm releases,

namespaces, and CRDs. The minikube cluster itself is preserved — use

'minithor minikube delete --confirm' to fully remove minikube.

EOF

}

########################################

# Subcommand: minikube install

########################################

cmd_minikube_install() {

local certs_dir="$PWD/.certs"

local install_cpus=8

local install_memory_gib=16

while [ $# -gt 0 ]; do

case "$1" in

-h|--help) usage_minikube_install; return 0 ;;

--cpus)

shift

if [ $# -eq 0 ] || ! [[ "$1" =~ ^[0-9]+$ ]]; then

echo "ERROR: --cpus requires a numeric argument" >&2; exit 1

fi

install_cpus="$1"

;;

--memory)

shift

if [ $# -eq 0 ] || ! [[ "$1" =~ ^[0-9]+$ ]]; then

echo "ERROR: --memory requires a numeric argument (GiB)" >&2; exit 1

fi

install_memory_gib="$1"

;;

--certs-dir)

shift

if [ $# -eq 0 ]; then

echo "ERROR: --certs-dir requires an argument" >&2; exit 1

fi

certs_dir="$1"

;;

*) echo "Unknown option: $1"; usage_minikube_install; exit 1 ;;

esac

shift

done

select_driver

echo "Selected driver: $DRIVER"

# Inject org certs into podman VM on macOS

if [ "$DRIVER" = "podman" ] && [ "$OS" = "Darwin" ]; then

podman machine ssh "sudo mkdir -p /etc/pki/ca-trust/source/anchors/"

cat "$certs_dir"/*.crt | podman machine ssh "sudo tee /etc/pki/ca-trust/source/anchors/thorium-org-cert.crt > /dev/null"

podman machine ssh "sudo update-ca-trust"

fi

# Download and install minikube

local tmp_dir

tmp_dir=$(mktemp -d)

trap "rm -rf '$tmp_dir'" RETURN

case "$OS" in

Darwin)

if [ "$ARCH" = "arm64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-darwin-arm64

sudo install "$tmp_dir/minikube-darwin-arm64" /usr/local/bin/minikube

else

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-darwin-amd64

sudo install "$tmp_dir/minikube-darwin-amd64" /usr/local/bin/minikube

fi

;;

Linux)

if [ "$ARCH" = "x86_64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64

sudo install "$tmp_dir/minikube-linux-amd64" /usr/local/bin/minikube

elif [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then

curl -LO --output-dir "$tmp_dir" https://storage.googleapis.com/minikube/releases/latest/minikube-linux-arm64

sudo install "$tmp_dir/minikube-linux-arm64" /usr/local/bin/minikube

else

echo "Unsupported Linux architecture: $ARCH"

exit 1

fi

;;

*)

echo "Unsupported OS: $OS"

exit 1

;;

esac

local install_memory_mib=$((install_memory_gib * 1024))

minikube config set cpus "$install_cpus"

minikube config set memory "$install_memory_mib"

touch ~/.bashrc

if ! grep -q 'alias kubectl="minikube kubectl --"' ~/.bashrc 2>/dev/null; then

echo 'alias kubectl="minikube kubectl --"' >> ~/.bashrc

fi

touch ~/.zshrc

if ! grep -q 'alias kubectl="minikube kubectl --"' ~/.zshrc 2>/dev/null; then

echo 'alias kubectl="minikube kubectl --"' >> ~/.zshrc

fi

local proxy_bypass="localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16,${CLUSTER_NO_PROXY}"

# Merge (don't clobber) any NO_PROXY the user already has in their environment,

# so minikube bakes env-provided bypass entries into the node alongside ours.

export NO_PROXY="${NO_PROXY:+$NO_PROXY,}$proxy_bypass"

export no_proxy="${no_proxy:+$no_proxy,}$proxy_bypass"

for rc in ~/.bashrc ~/.zshrc; do

if ! grep -q 'NO_PROXY=.*192\.168\.0\.0' "$rc" 2>/dev/null; then

cat >> "$rc" <<RCEOF

export NO_PROXY="$proxy_bypass"

export no_proxy="$proxy_bypass"

RCEOF

fi

done

mkdir -p ~/.minikube/certs/

cp "$certs_dir"/*.crt ~/.minikube/certs/ 2>/dev/null || true

minikube_start

fix_container_config

kctl config view --minify

minikube addons enable csi-hostpath-driver

minikube addons enable ingress

minikube addons enable ingress-dns

}

########################################

# Subcommand: minikube delete

########################################

cmd_minikube_delete() {

local confirm=false

for arg in "$@"; do

case "$arg" in

-h|--help) usage_minikube_delete; return 0 ;;

--confirm) confirm=true ;;

*) echo "Unknown option: $arg"; usage_minikube_delete; exit 1 ;;

esac

done

if [ "$confirm" = false ]; then

echo "ERROR: --confirm flag is required to delete minikube." >&2

echo "" >&2

usage_minikube_delete >&2

return 1

fi

select_driver

if [ -n "$DRIVER" ]; then

echo "Detected available driver: $DRIVER"

else

echo "No working podman/docker/kvm2 driver detected."

fi

# Tear down any dev port-forwards and the loopback aliases they created

# before destroying the cluster they point at.

echo "Stopping dev port-forwards and removing loopback aliases..."

stop_all_forwards || true

remove_all_loopback_aliases || true

if command -v minikube >/dev/null 2>&1; then

minikube delete --all --purge || true

else

echo "minikube not found; skipping minikube delete."

fi

rm -rf ~/.minikube ~/.kube

sudo rm -f /usr/local/bin/minikube

sudo rm -f /usr/local/bin/kubectl

if [ "$CONTAINER_CMD" = "podman" ]; then

echo "Using podman for container cleanup..."

podman system prune --force

podman image prune -a --force

elif [ "$CONTAINER_CMD" = "docker" ]; then

echo "Using docker for container cleanup..."

env -u DOCKER_HOST docker system prune --force

env -u DOCKER_HOST docker image prune -a --force

else

echo "No working container runtime found; skipping container cleanup."

fi

}

########################################

# Subcommand: minikube (dispatcher)

########################################

cmd_minikube() {

if [ $# -eq 0 ]; then

usage_minikube

exit 1

fi

local subcmd="$1"

shift

case "$subcmd" in

install) cmd_minikube_install "$@" ;;

delete) cmd_minikube_delete "$@" ;;

-h|--help) usage_minikube; return 0 ;;

*)

echo "Unknown minikube subcommand: $subcmd" >&2

echo "" >&2

usage_minikube >&2

exit 1

;;

esac

}

########################################

# Subcommand: start

########################################

cmd_start() {

for arg in "$@"; do

case "$arg" in

-h|--help) usage_start; return 0 ;;

esac

done

select_driver

echo "Detected driver: $DRIVER"

minikube_start

fix_container_config

log "Tuning minikube node kernel parameters"

tune_kernel_params minikube

sleep 30

# Re-assert the registry hosts entry (lost when the node restarts) so pulls

# resolve before we clear any stuck ImagePullBackOff pods below.

ensure_registry_node_dns

# Delete pods stuck in terminal failure states

kctl get pods -A --no-headers 2>/dev/null \

| grep -E 'CrashLoopBackOff|Error|ImagePullBackOff|ErrImagePull|InvalidImageName' \

| awk '{print $2 " -n " $1}' \

| while read -r line; do

kctl delete pod $line --ignore-not-found 2>/dev/null || true

done

}

########################################

# Subcommand: stop

########################################

cmd_stop() {

for arg in "$@"; do

case "$arg" in

-h|--help) usage_stop; return 0 ;;

esac

done

ensure_minikube_running

minikube stop

}

########################################

# Subcommand: deploy

########################################

cmd_deploy() {

local cluster_config="$PWD/thorium-cluster.yml"

local docker_config="$PWD/.dockerconfigjson"

local banner_path="$PWD/banner.txt"

local bin_dir="/usr/local/bin"

local toolbox_path="$PWD/toolbox.json"

local deploy_user="test"

local deploy_pass="INSECURE_DEV_PASSWORD"

local deploy_registry=false

local registry_user=""

local deploy_timeout=600

while [ $# -gt 0 ]; do

case "$1" in