@abgov/nx-oc 12.9.0 → 12.11.0

package/generators.json

@@ -22,6 +22,16 @@
       "factory": "./src/generators/deployment/deployment",
       "schema": "./src/generators/deployment/schema.json",
       "description": "Generator that creates OpenShift manifests for project deployment."
+    },
+    "sandbox": {
+      "factory": "./src/generators/sandbox/sandbox",
+      "schema": "./src/generators/sandbox/schema.json",
+      "description": "Generator that creates a sandbox deployment for rapid local iteration (local build, push to OC internal registry)."
+    },
+    "teardown": {
+      "factory": "./src/generators/teardown/teardown",
+      "schema": "./src/generators/teardown/schema.json",
+      "description": "Adds a teardown target to remove an application's resources from a specific OpenShift environment."
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-oc",
-  "version": "12.9.0",
+  "version": "12.11.0",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for OpenShift.",

package/src/generators/deployment/deployment.js

@@ -50,8 +50,8 @@ function normalizeOptions(host, options) {
     });
 }
 function addFiles(host, options) {
-    var _a;
-    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { sourceRepositoryUrl: (0, git_utils_1.getGitRemoteUrl)(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', tmpl: '' });
+    var _a, _b;
+    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { sourceRepositoryUrl: (0, git_utils_1.getGitRemoteUrl)(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', sandbox: (_b = options.sandbox) !== null && _b !== void 0 ? _b : false, tmpl: '' });
     (0, devkit_1.generateFiles)(host, path.join(__dirname, `${options.appType}-files`), `./.openshift/${options.projectName}`, templateOptions);
 }
 function default_1(host, options) {

package/src/generators/deployment/deployment.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/deployment/deployment.ts"],"names":[],"mappings":";;AAoFA,4BAqCC;;AAzHD,uCAOoB;AACpB,6BAA6B;AAC7B,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AAExD,qCAAkD;AAElD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,CAAA,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAAE,SAAS,KAAI,EAAE,CAAC;QAE3D,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAoB,OAAO,CAAC,OAAO,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtC,KAAK,iBAAiB,CAAC;gBACvB,KAAK,uCAAuC;oBAC1C,OAAO,GAAG,UAAU,CAAC;oBACrB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,OAAO,GAAG,QAAQ,CAAC;oBACnB,MAAM;gBACR,KAAK,qBAAqB,CAAC,CAAC,CAAC;oBAC3B,mFAAmF;oBACnF,OAAO;wBACL,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;oBACvE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW;YACX,cAAc;YACd,aAAa,IACb;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,mBAAmB,EAAE,IAAA,2BAAe,GAAE,EACtC,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,EAChD,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,YAAY,EAAE;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;;wBAAC,OAAA,CAAC;4BAC9D,OAAO;4BACP,GAAG,EAAE,MAAA,4BAAI,CAAC,CAAC,CAAC,0CAAE,WAAW,EAAE;yBAC5B,CAAC,CAAA;qBAAA,CAAC;iBACJ;aACF,GACF,CAAC;QAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/deployment/deployment.ts"],"names":[],"mappings":";;AAqFA,4BAqCC;;AA1HD,uCAOoB;AACpB,6BAA6B;AAC7B,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AAExD,qCAAkD;AAElD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,CAAA,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAAE,SAAS,KAAI,EAAE,CAAC;QAE3D,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAoB,OAAO,CAAC,OAAO,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtC,KAAK,iBAAiB,CAAC;gBACvB,KAAK,uCAAuC;oBAC1C,OAAO,GAAG,UAAU,CAAC;oBACrB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,OAAO,GAAG,QAAQ,CAAC;oBACnB,MAAM;gBACR,KAAK,qBAAqB,CAAC,CAAC,CAAC;oBAC3B,mFAAmF;oBACnF,OAAO;wBACL,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;oBACvE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW;YACX,cAAc;YACd,aAAa,IACb;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,mBAAmB,EAAE,IAAA,2BAAe,GAAE,EACtC,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,KAAK,EACjC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,EAChD,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,YAAY,EAAE;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;;wBAAC,OAAA,CAAC;4BAC9D,OAAO;4BACP,GAAG,EAAE,MAAA,4BAAI,CAAC,CAAC,CAAC,0CAAE,WAAW,EAAE;yBAC5B,CAAC,CAAA;qBAAA,CAAC;iBACJ;aACF,GACF,CAAC;QAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}

package/src/generators/deployment/dotnet-files/__projectName__.yml__tmpl__

@@ -5,11 +5,13 @@ metadata:
 labels:
   app: <%= projectName %>
 parameters:
+<% if (!sandbox) { %>
   - name: INFRA_PROJECT
     description: Project used for build infrastructure.
     displayName: Infrastructure Project
     value: <%= ocInfraProject %>
     required: true
+<% } %>
   - name: PROJECT
     description: Project to deploy into.
     displayName: Project
@@ -19,17 +21,21 @@ parameters:
     displayName: Application Name
     value: <%= projectName %>
     required: true
+<% if (!sandbox) { %>
   - name: DEPLOY_TAG
     description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
+<% } %>
 objects:
+<% if (!sandbox) { %>
   - apiVersion: image.openshift.io/v1
     kind: ImageStream
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
+<% } %>
   - apiVersion: v1
     kind: ConfigMap
     metadata:
@@ -61,6 +67,7 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+<% if (!sandbox) { %>
       annotations:
         image.openshift.io/triggers: |-
           [
@@ -74,6 +81,7 @@ objects:
               "paused": true
             }
           ]
+<% } %>
     spec:
       replicas: 1
       selector:
@@ -93,14 +101,18 @@ objects:
         spec:
           containers:
             - name: ${APP_NAME}
+<% if (sandbox) { %>
+              image: image-registry.openshift-image-registry.svc:5000/${PROJECT}/<%= projectName %>:sandbox
+<% } else { %>
               image: ${APP_NAME}:${DEPLOY_TAG}
+<% } %>
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
               env:
                 - name: LOG_LEVEL
                   value: info
-              imagePullPolicy: IfNotPresent
+              imagePullPolicy: <%= sandbox ? 'Always' : 'IfNotPresent' %>
               ports:
                 - containerPort: 5000
                   name: http

package/src/generators/deployment/frontend-files/__projectName__.yml__tmpl__

@@ -5,11 +5,13 @@ metadata:
 labels:
   app: <%= projectName %>
 parameters:
+<% if (!sandbox) { %>
   - name: INFRA_PROJECT
     description: Project used for build infrastructure.
     displayName: Infrastructure Project
     value: <%= ocInfraProject %>
     required: true
+<% } %>
   - name: PROJECT
     description: Project to deploy into.
     displayName: Project
@@ -19,17 +21,21 @@ parameters:
     displayName: Application Name
     value: <%= projectName %>
     required: true
+<% if (!sandbox) { %>
   - name: DEPLOY_TAG
     description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
+<% } %>
 objects:
+<% if (!sandbox) { %>
   - apiVersion: image.openshift.io/v1
     kind: ImageStream
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
+<% } %>
   - apiVersion: v1
     kind: ConfigMap
     metadata:
@@ -51,6 +57,7 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+<% if (!sandbox) { %>
       annotations:
         image.openshift.io/triggers: |-
           [
@@ -64,6 +71,7 @@ objects:
               "paused": true
             }
           ]
+<% } %>
     spec:
       replicas: 1
       selector:
@@ -83,8 +91,12 @@ objects:
         spec:
           containers:
             - name: ${APP_NAME}
+<% if (sandbox) { %>
+              image: image-registry.openshift-image-registry.svc:5000/${PROJECT}/<%= projectName %>:sandbox
+<% } else { %>
               image: ${APP_NAME}:${DEPLOY_TAG}
-              imagePullPolicy: IfNotPresent
+<% } %>
+              imagePullPolicy: <%= sandbox ? 'Always' : 'IfNotPresent' %>
               ports:
                 - containerPort: 8080
                   name: http

package/src/generators/deployment/node-files/__projectName__.yml__tmpl__

@@ -5,11 +5,13 @@ metadata:
 labels:
   app: <%= projectName %>
 parameters:
+<% if (!sandbox) { %>
   - name: INFRA_PROJECT
     description: Project used for build infrastructure.
     displayName: Infrastructure Project
     value: <%= ocInfraProject %>
     required: true
+<% } %>
   - name: PROJECT
     description: Project to deploy into.
     displayName: Project
@@ -19,17 +21,21 @@ parameters:
     displayName: Application Name
     value: <%= projectName %>
     required: true
+<% if (!sandbox) { %>
   - name: DEPLOY_TAG
     description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
+<% } %>
 objects:
+<% if (!sandbox) { %>
   - apiVersion: image.openshift.io/v1
     kind: ImageStream
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
+<% } %>
   - apiVersion: v1
     kind: ConfigMap
     metadata:
@@ -45,6 +51,7 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+<% if (!sandbox) { %>
       annotations:
         image.openshift.io/triggers: |-
           [
@@ -58,6 +65,7 @@ objects:
               "paused": true
             }
           ]
+<% } %>
     spec:
       replicas: 1
       selector:
@@ -78,21 +86,39 @@ objects:
 <% if (database === 'postgres') { %>
           initContainers:
             - name: ${APP_NAME}-migrate
+<% if (sandbox) { %>
+              image: image-registry.openshift-image-registry.svc:5000/${PROJECT}/<%= projectName %>:sandbox
+<% } else { %>
               image: image-registry.openshift-image-registry.svc:5000/${INFRA_PROJECT}/${APP_NAME}:${DEPLOY_TAG}
+<% } %>
               command: ["npx", "prisma", "migrate", "deploy"]
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
               env:
+<% if (sandbox) { %>
+                - name: POSTGRES_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: sandbox-postgres-creds
+                      key: POSTGRESQL_ADMIN_PASSWORD
+                - name: DATABASE_URL
+                  value: postgresql://postgres:$(POSTGRES_PASSWORD)@sandbox-postgres:5432/<%= projectName %>_sandbox
+<% } else { %>
                 - name: DATABASE_URL
                   valueFrom:
                     secretKeyRef:
                       name: ${APP_NAME}-database
                       key: DATABASE_URL
+<% } %>
 <% } %>
           containers:
             - name: ${APP_NAME}
+<% if (sandbox) { %>
+              image: image-registry.openshift-image-registry.svc:5000/${PROJECT}/<%= projectName %>:sandbox
+<% } else { %>
               image: ${APP_NAME}:${DEPLOY_TAG}
+<% } %>
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
@@ -102,13 +128,32 @@ objects:
                 - name: LOG_LEVEL
                   value: info
 <% if (database === 'postgres') { %>
+<% if (sandbox) { %>
+                - name: POSTGRES_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: sandbox-postgres-creds
+                      key: POSTGRESQL_ADMIN_PASSWORD
+                - name: DATABASE_URL
+                  value: postgresql://postgres:$(POSTGRES_PASSWORD)@sandbox-postgres:5432/<%= projectName %>_sandbox
+<% } else { %>
                 # Set via: oc create secret generic ${APP_NAME}-database --from-literal=DATABASE_URL=<connection-string>
                 - name: DATABASE_URL
                   valueFrom:
                     secretKeyRef:
                       name: ${APP_NAME}-database
                       key: DATABASE_URL
+<% } %>
 <% } else if (database === 'mongo') { %>
+<% if (sandbox) { %>
+                - name: MONGO_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: sandbox-mongodb-creds
+                      key: MONGODB_ADMIN_PASSWORD
+                - name: MONGODB_URI
+                  value: mongodb://admin:$(MONGO_PASSWORD)@sandbox-mongodb:27017/<%= projectName %>_sandbox?authSource=admin
+<% } else { %>
                 # Set via: oc create secret generic ${APP_NAME}-database --from-literal=MONGODB_URI=<connection-string>
                 - name: MONGODB_URI
                   valueFrom:
@@ -116,7 +161,8 @@ objects:
                       name: ${APP_NAME}-database
                       key: MONGODB_URI
 <% } %>
-              imagePullPolicy: IfNotPresent
+<% } %>
+              imagePullPolicy: <%= sandbox ? 'Always' : 'IfNotPresent' %>
               ports:
                 - containerPort: 3333
                   name: http

package/src/generators/deployment/schema.d.ts

@@ -10,6 +10,7 @@ export interface Schema {
   adsp?: AdspConfiguration;
   accessToken?: string;
   database?: DatabaseType;
+  sandbox?: boolean;
 }
 
 export interface NormalizedSchema extends Schema {

package/src/generators/deployment/schema.json

@@ -58,6 +58,10 @@
       "type": "string",
       "description": "Database type used by the service. When set, the deployment manifest references the appropriate Secret.",
       "enum": ["none", "postgres", "mongo"]
+    },
+    "sandbox": {
+      "type": "boolean",
+      "description": "Generate a sandbox deployment manifest (local image push, no ImageStream trigger)."
     }
   },
   "required": [

package/src/generators/sandbox/database-files/sandbox-mongodb.yml__tmpl__

@@ -0,0 +1,104 @@
+# Shared MongoDB instance for the sandbox namespace on GoA ARO OpenShift.
+# Applied once per namespace — idempotent, safe to re-run. The PVC is never
+# deleted on re-apply, so data persists across deployments.
+#
+# Multiple apps in the same namespace share this instance. Each app uses its
+# own database (<appName>_sandbox); MongoDB creates it on first write.
+#
+# Credentials are stored in the sandbox-mongodb-creds Secret, created once
+# per namespace by `nx run <app>:sandbox` on first use. Subsequent apps read
+# from the same Secret so all apps share consistent credentials.
+#
+# StorageClass: azure-disk is required on GoA ARO.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sandbox-mongodb-data
+spec:
+  storageClassName: azure-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sandbox-mongodb
+  labels:
+    app: sandbox-mongodb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sandbox-mongodb
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: sandbox-mongodb
+    spec:
+      containers:
+        - name: mongodb
+          image: quay.io/sclorg/mongodb-70-c9s:latest
+          ports:
+            - containerPort: 27017
+              protocol: TCP
+          env:
+            - name: MONGODB_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sandbox-mongodb-creds
+                  key: MONGODB_ADMIN_PASSWORD
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/mongodb/data
+          readinessProbe:
+            exec:
+              command:
+                - mongosh
+                - --eval
+                - "db.adminCommand('ping')"
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            exec:
+              command:
+                - mongosh
+                - --eval
+                - "db.adminCommand('ping')"
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "256Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: sandbox-mongodb-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sandbox-mongodb
+  labels:
+    app: sandbox-mongodb
+spec:
+  selector:
+    app: sandbox-mongodb
+  ports:
+    - name: mongodb
+      port: 27017
+      targetPort: 27017
+      protocol: TCP

package/src/generators/sandbox/database-files/sandbox-postgres.yml__tmpl__

@@ -0,0 +1,100 @@
+# Shared Postgres instance for the sandbox namespace on GoA ARO OpenShift.
+# Applied once per namespace — idempotent, safe to re-run. The PVC is never
+# deleted on re-apply, so data persists across deployments.
+#
+# Multiple apps in the same namespace share this instance. Each app uses its
+# own database (<appName>_sandbox) created automatically by Prisma migrate.
+#
+# Credentials are stored in the sandbox-postgres-creds Secret, created once
+# per namespace by `nx run <app>:sandbox` on first use. Subsequent apps read
+# from the same Secret so all apps share consistent credentials.
+#
+# StorageClass: azure-disk is required on GoA ARO.
+# azure-file will NOT work: SMB mounts with root ownership and Postgres
+# refuses to start on a data directory it does not own.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sandbox-postgres-data
+spec:
+  storageClassName: azure-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sandbox-postgres
+  labels:
+    app: sandbox-postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sandbox-postgres
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: sandbox-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: quay.io/sclorg/postgresql-16-c9s:latest
+          ports:
+            - containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRESQL_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sandbox-postgres-creds
+                  key: POSTGRESQL_ADMIN_PASSWORD
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/pgsql/data
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres"]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres"]
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "256Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: sandbox-postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sandbox-postgres
+  labels:
+    app: sandbox-postgres
+spec:
+  selector:
+    app: sandbox-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+      protocol: TCP

package/src/generators/sandbox/sandbox.d.ts

@@ -0,0 +1,3 @@
+import { Tree } from '@nx/devkit';
+import { Schema } from './schema';
+export default function (host: Tree, options: Schema): Promise<void>;

package/src/generators/sandbox/sandbox.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = default_1;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+const path = require("path");
+const adsp_1 = require("../../adsp");
+const git_utils_1 = require("../../utils/git-utils");
+function normalizeOptions(host, options) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const projectName = (0, devkit_1.names)(options.project).fileName;
+        const config = (0, devkit_1.readProjectConfiguration)(host, projectName);
+        let appType = options.appType;
+        if (!appType) {
+            switch (config.targets.build.executor) {
+                case '@nx/web:webpack':
+                case '@angular-devkit/build-angular:browser':
+                    appType = 'frontend';
+                    break;
+                case '@nx/node:build':
+                    appType = 'node';
+                    break;
+                case '@nx-dotnet/core:build':
+                    appType = 'dotnet';
+                    break;
+                case '@nx/webpack:webpack':
+                    appType =
+                        config.targets.build.options.target === 'node' ? 'node' : 'frontend';
+                    break;
+            }
+        }
+        const adsp = yield (0, adsp_1.getAdspConfiguration)(host, Object.assign(Object.assign({}, options), { env: (_a = options.env) !== null && _a !== void 0 ? _a : 'dev' }));
+        return Object.assign(Object.assign({}, options), { appType,
+            adsp,
+            projectName });
+    });
+}
+function addManifestFiles(host, options) {
+    var _a;
+    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { sourceRepositoryUrl: (0, git_utils_1.getGitRemoteUrl)(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', sandbox: true, ocInfraProject: options.sandboxProject, tmpl: '' });
+    (0, devkit_1.generateFiles)(host, path.join(__dirname, `../deployment/${options.appType}-files`), `./.openshift/${options.projectName}`, templateOptions);
+}
+function addDatabaseFiles(host, options) {
+    if (!options.database || options.database === 'none')
+        return;
+    (0, devkit_1.generateFiles)(host, path.join(__dirname, 'database-files'), './.openshift/sandbox', { database: options.database, tmpl: '' });
+}
+function addSandboxTarget(host, options) {
+    const config = (0, devkit_1.readProjectConfiguration)(host, options.project);
+    const { projectName, sandboxProject, database } = options;
+    const commands = [];
+    if (database === 'postgres') {
+        commands.push(`oc get secret sandbox-postgres-creds -n ${sandboxProject} 2>/dev/null || ` +
+            `oc create secret generic sandbox-postgres-creds ` +
+            `--from-literal=POSTGRESQL_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+            `-n ${sandboxProject}`);
+        commands.push(`oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${sandboxProject}`);
+    }
+    else if (database === 'mongo') {
+        commands.push(`oc get secret sandbox-mongodb-creds -n ${sandboxProject} 2>/dev/null || ` +
+            `oc create secret generic sandbox-mongodb-creds ` +
+            `--from-literal=MONGODB_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+            `-n ${sandboxProject}`);
+        commands.push(`oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${sandboxProject}`);
+    }
+    commands.push(`oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`);
+    commands.push([
+        `REGISTRY=$(oc registry info)`,
+        `CONTAINER_CLI=$(command -v podman || command -v docker)`,
+        `$CONTAINER_CLI login -u $(oc whoami) -p $(oc whoami -t) $REGISTRY`,
+        `$CONTAINER_CLI build -t $REGISTRY/${sandboxProject}/${projectName}:sandbox -f .openshift/${projectName}/Dockerfile .`,
+        `$CONTAINER_CLI push $REGISTRY/${sandboxProject}/${projectName}:sandbox`,
+    ].join(' && '));
+    commands.push(`oc rollout restart deployment/${projectName} -n ${sandboxProject}`);
+    commands.push(`oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=120s`);
+    config.targets = Object.assign(Object.assign({}, config.targets), { sandbox: {
+            executor: 'nx:run-commands',
+            options: {
+                commands,
+                sequential: true,
+            },
+        }, 'sandbox-teardown': {
+            executor: 'nx:run-commands',
+            options: {
+                commands: [
+                    `oc delete all,configmap -l app=${projectName} -n ${sandboxProject} --ignore-not-found`,
+                ],
+            },
+        } });
+    (0, devkit_1.updateProjectConfiguration)(host, options.project, config);
+}
+function default_1(host, options) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        const normalizedOptions = yield normalizeOptions(host, options);
+        if (!normalizedOptions.appType) {
+            console.log('Cannot generate sandbox deployment for unknown project type.');
+            return;
+        }
+        addManifestFiles(host, normalizedOptions);
+        addDatabaseFiles(host, normalizedOptions);
+        addSandboxTarget(host, normalizedOptions);
+        yield (0, devkit_1.formatFiles)(host);
+    });
+}
+//# sourceMappingURL=sandbox.js.map

package/src/generators/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/sandbox/sandbox.ts"],"names":[],"mappings":";;AAyJA,4BAWC;;AApKD,uCAOoB;AACpB,6BAA6B;AAC7B,qCAAkD;AAClD,qDAAwD;AAIxD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAoB,OAAO,CAAC,OAAO,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtC,KAAK,iBAAiB,CAAC;gBACvB,KAAK,uCAAuC;oBAC1C,OAAO,GAAG,UAAU,CAAC;oBACrB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,OAAO,GAAG,QAAQ,CAAC;oBACnB,MAAM;gBACR,KAAK,qBAAqB;oBACxB,OAAO;wBACL,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;oBACvE,MAAM;YACV,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,kCACvC,OAAO,KACV,GAAG,EAAE,MAAC,OAAO,CAAC,GAA+B,mCAAI,KAAK,IACtD,CAAC;QAEH,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW,IACX;IACJ,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,mBAAmB,EAAE,IAAA,2BAAe,GAAE,EACtC,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,IAAI,EACb,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,OAAO,QAAQ,CAAC,EAC9D,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO;IAC7D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,sBAAsB,EACtB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,2CAA2C,cAAc,kBAAkB;YACzE,kDAAkD;YAClD,oFAAoF;YACpF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,0DAA0D,cAAc,EAAE,CAC3E,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,0CAA0C,cAAc,kBAAkB;YACxE,iDAAiD;YACjD,iFAAiF;YACjF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,yDAAyD,cAAc,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,4BAA4B,WAAW,IAAI,WAAW,mBAAmB,cAAc,kBAAkB,CAC1G,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX;QACE,8BAA8B;QAC9B,yDAAyD;QACzD,mEAAmE;QACnE,qCAAqC,cAAc,IAAI,WAAW,0BAA0B,WAAW,eAAe;QACtH,iCAAiC,cAAc,IAAI,WAAW,UAAU;KACzE,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX,iCAAiC,WAAW,OAAO,cAAc,EAAE,CACpE,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,gCAAgC,WAAW,OAAO,cAAc,iBAAiB,CAClF,CAAC;IAEF,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,OAAO,EAAE;YACP,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ;gBACR,UAAU,EAAE,IAAI;aACjB;SACF,EACD,kBAAkB,EAAE;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,kCAAkC,WAAW,OAAO,cAAc,qBAAqB;iBACxF;aACF;SACF,GACF,CAAC;IAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}

package/src/generators/sandbox/sandbox.spec.ts

@@ -0,0 +1,149 @@
+import {
+  addProjectConfiguration,
+  readProjectConfiguration,
+} from '@nx/devkit';
+import { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';
+import * as utils from '../../adsp';
+import { environments } from '../../adsp';
+import generator from './sandbox';
+import { Schema } from './schema';
+
+jest.mock('../../adsp');
+const utilsMock = utils as jest.Mocked<typeof utils>;
+utilsMock.getAdspConfiguration.mockResolvedValue({
+  tenant: 'test',
+  tenantRealm: 'test',
+  accessServiceUrl: environments.test.accessServiceUrl,
+  directoryServiceUrl: environments.test.directoryServiceUrl,
+});
+
+describe('Sandbox Generator', () => {
+  const options: Schema = {
+    project: 'test',
+    sandboxProject: 'test-sandbox',
+  };
+
+  function addNodeProject(host) {
+    addProjectConfiguration(host, 'test', {
+      root: 'apps/test',
+      projectType: 'application',
+      targets: {
+        build: {
+          executor: '@nx/webpack:webpack',
+          options: { compiler: 'tsc', target: 'node' },
+        },
+      },
+    });
+  }
+
+  function addFrontendProject(host) {
+    addProjectConfiguration(host, 'test', {
+      root: 'apps/test',
+      projectType: 'application',
+      targets: {
+        build: {
+          executor: '@nx/webpack:webpack',
+          options: { compiler: 'babel' },
+        },
+      },
+    });
+  }
+
+  it('generates sandbox manifest for node app', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, options);
+
+    expect(host.exists('.openshift/test/test.yml')).toBeTruthy();
+    const manifest = host.read('.openshift/test/test.yml').toString();
+    expect(manifest).toContain('imagePullPolicy: Always');
+    expect(manifest).not.toContain('ImageStream');
+    expect(manifest).not.toContain('DEPLOY_TAG');
+    expect(manifest).toContain('sandbox');
+  });
+
+  it('generates sandbox manifest for frontend app', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addFrontendProject(host);
+
+    await generator(host, options);
+
+    expect(host.exists('.openshift/test/test.yml')).toBeTruthy();
+    const manifest = host.read('.openshift/test/test.yml').toString();
+    expect(manifest).toContain('imagePullPolicy: Always');
+    expect(manifest).not.toContain('ImageStream');
+  });
+
+  it('adds sandbox nx target', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, options);
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['sandbox']).toBeTruthy();
+    expect(config.targets['sandbox'].executor).toBe('nx:run-commands');
+    const cmds: string[] = config.targets['sandbox'].options.commands;
+    expect(cmds.some((c) => c.includes('oc rollout restart'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('oc rollout status'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('command -v podman'))).toBeTruthy();
+  });
+
+  it('adds sandbox-teardown nx target', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, options);
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['sandbox-teardown']).toBeTruthy();
+    const cmds: string[] = config.targets['sandbox-teardown'].options.commands;
+    expect(cmds.some((c) => c.includes('oc delete'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('--ignore-not-found'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('test-sandbox'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('-l app=test'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('all,configmap'))).toBeTruthy();
+  });
+
+  it('generates shared postgres manifest with secret-backed DATABASE_URL', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, { ...options, database: 'postgres' });
+
+    expect(host.exists('.openshift/sandbox/sandbox-postgres.yml')).toBeTruthy();
+
+    const dbManifest = host.read('.openshift/sandbox/sandbox-postgres.yml').toString();
+    expect(dbManifest).toContain('sandbox-postgres-creds');
+
+    const appManifest = host.read('.openshift/test/test.yml').toString();
+    expect(appManifest).toContain('sandbox-postgres-creds');
+    expect(appManifest).toContain('$(POSTGRES_PASSWORD)');
+
+    const config = readProjectConfiguration(host, 'test');
+    const cmds: string[] = config.targets['sandbox'].options.commands;
+    expect(cmds.some((c) => c.includes('sandbox-postgres-creds'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('sandbox-postgres.yml'))).toBeTruthy();
+  });
+
+  it('generates shared mongodb manifest with secret-backed MONGODB_URI', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, { ...options, database: 'mongo' });
+
+    expect(host.exists('.openshift/sandbox/sandbox-mongodb.yml')).toBeTruthy();
+
+    const dbManifest = host.read('.openshift/sandbox/sandbox-mongodb.yml').toString();
+    expect(dbManifest).toContain('sandbox-mongodb-creds');
+
+    const appManifest = host.read('.openshift/test/test.yml').toString();
+    expect(appManifest).toContain('sandbox-mongodb-creds');
+    expect(appManifest).toContain('$(MONGO_PASSWORD)');
+
+    const config = readProjectConfiguration(host, 'test');
+    const cmds: string[] = config.targets['sandbox'].options.commands;
+    expect(cmds.some((c) => c.includes('sandbox-mongodb-creds'))).toBeTruthy();
+  });
+});

package/src/generators/sandbox/schema.d.ts

@@ -0,0 +1,18 @@
+import { AdspConfiguration } from '../../adsp';
+import { ApplicationType, DatabaseType } from '../deployment/schema';
+
+export interface Schema {
+  project: string;
+  appType?: ApplicationType;
+  sandboxProject: string;
+  database?: DatabaseType;
+  env?: string;
+  adsp?: AdspConfiguration;
+  accessToken?: string;
+}
+
+export interface NormalizedSchema extends Schema {
+  projectName: string;
+  appType: ApplicationType;
+  adsp: AdspConfiguration;
+}

package/src/generators/sandbox/schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "id": "NxOcSandbox",
+  "title": "OpenShift Sandbox Deployment",
+  "type": "object",
+  "properties": {
+    "project": {
+      "type": "string",
+      "description": "Project to add sandbox deployment for.",
+      "$default": {
+        "$source": "argv",
+        "index": 0
+      },
+      "x-prompt": "Which project to add sandbox deployment for?"
+    },
+    "sandboxProject": {
+      "type": "string",
+      "description": "OpenShift namespace to deploy the sandbox into.",
+      "alias": "s",
+      "x-prompt": "Which OpenShift namespace should be used for the sandbox?"
+    },
+    "appType": {
+      "type": "string",
+      "description": "Type of application.",
+      "alias": "t",
+      "x-prompt": {
+        "message": "What type of application is the project?",
+        "type": "list",
+        "items": ["frontend", "dotnet", "node"]
+      }
+    },
+    "database": {
+      "type": "string",
+      "description": "Database type. A shared containerized instance will be deployed to the sandbox namespace.",
+      "enum": ["none", "postgres", "mongo"]
+    },
+    "env": {
+      "type": "string",
+      "description": "ADSP environment to target.",
+      "default": "dev"
+    },
+    "accessToken": {
+      "type": "string",
+      "description": "Access token for retrieving configuration from ADSP APIs.",
+      "alias": "at"
+    }
+  },
+  "required": ["project", "sandboxProject"],
+  "additionalProperties": false
+}

package/src/generators/teardown/schema.d.ts

@@ -0,0 +1,10 @@
+export interface Schema {
+  project: string;
+  env: 'dev' | 'test' | 'prod';
+}
+
+export interface NormalizedSchema extends Schema {
+  projectName: string;
+  envProject: string;
+  ocInfraProject: string;
+}

package/src/generators/teardown/schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "id": "NxOcTeardown",
+  "title": "OpenShift Environment Teardown",
+  "type": "object",
+  "properties": {
+    "project": {
+      "type": "string",
+      "description": "Project to add teardown target for.",
+      "$default": {
+        "$source": "argv",
+        "index": 0
+      },
+      "x-prompt": "Which project to add teardown for?"
+    },
+    "env": {
+      "type": "string",
+      "description": "Environment to target for teardown.",
+      "$default": {
+        "$source": "argv",
+        "index": 1
+      },
+      "alias": "e",
+      "x-prompt": {
+        "message": "Which environment to target?",
+        "type": "list",
+        "items": ["dev", "test", "prod"]
+      }
+    }
+  },
+  "required": ["project", "env"],
+  "additionalProperties": false
+}

package/src/generators/teardown/teardown.d.ts

@@ -0,0 +1,3 @@
+import { Tree } from '@nx/devkit';
+import { Schema } from './schema';
+export default function (host: Tree, options: Schema): Promise<void>;

package/src/generators/teardown/teardown.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = default_1;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+const yaml = require("yaml");
+const pipeline_envs_1 = require("../../pipeline-envs");
+const infraManifestFile = '.openshift/environments.yml';
+function normalizeOptions(host, options) {
+    var _a, _b, _c, _d;
+    const projectName = (0, devkit_1.names)(options.project).fileName;
+    const result = host.read(infraManifestFile).toString();
+    const { items } = yaml.parse(result);
+    const ocInfraProject = ((_b = (_a = items[0]) === null || _a === void 0 ? void 0 : _a.metadata) === null || _b === void 0 ? void 0 : _b.namespace) || '';
+    const SA_PREFIX = 'system:serviceaccounts:';
+    const ocEnvProjects = (_d = (_c = items[0]) === null || _c === void 0 ? void 0 : _c.subjects) === null || _d === void 0 ? void 0 : _d.filter((s) => s.kind === 'Group' && s.name.startsWith(SA_PREFIX)).map((s) => s.name.replace(SA_PREFIX, ''));
+    const envIndex = pipeline_envs_1.pipelineEnvs.map((e) => e.toLowerCase()).indexOf(options.env.toLowerCase());
+    const envProject = (ocEnvProjects === null || ocEnvProjects === void 0 ? void 0 : ocEnvProjects[envIndex]) || '';
+    return Object.assign(Object.assign({}, options), { projectName,
+        ocInfraProject,
+        envProject });
+}
+function default_1(host, options) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        if (!host.exists(infraManifestFile)) {
+            console.log(`Cannot generate teardown; run 'nx g @abgov/nx-oc:pipeline' first.`);
+            return;
+        }
+        const normalizedOptions = normalizeOptions(host, options);
+        if (!normalizedOptions.envProject) {
+            console.log(`Cannot find project for environment '${options.env}'.`);
+            return;
+        }
+        const config = (0, devkit_1.readProjectConfiguration)(host, options.project);
+        const { projectName, envProject } = normalizedOptions;
+        config.targets = Object.assign(Object.assign({}, config.targets), { [`teardown-${options.env}`]: {
+                executor: 'nx:run-commands',
+                options: {
+                    commands: [
+                        `oc delete all,configmap -l app=${projectName} -n ${envProject} --ignore-not-found`,
+                    ],
+                },
+            } });
+        (0, devkit_1.updateProjectConfiguration)(host, options.project, config);
+        yield (0, devkit_1.formatFiles)(host);
+    });
+}
+//# sourceMappingURL=teardown.js.map

package/src/generators/teardown/teardown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/teardown/teardown.ts"],"names":[],"mappings":";;AAoCA,4BA6BC;;AAjED,uCAMoB;AACpB,6BAA6B;AAC7B,uDAA2D;AAG3D,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAe;;IACnD,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,CAAA,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAAE,SAAS,KAAI,EAAE,CAAC;IAE3D,MAAM,SAAS,GAAG,yBAAyB,CAAC;IAC5C,MAAM,aAAa,GAAa,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,4BAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,QAAQ,CAAC,KAAI,EAAE,CAAC;IAEnD,uCACK,OAAO,KACV,WAAW;QACX,cAAc;QACd,UAAU,IACV;AACJ,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,wCAAwC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;QAEtD,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE;gBAC3B,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,kCAAkC,WAAW,OAAO,UAAU,qBAAqB;qBACpF;iBACF;aACF,GACF,CAAC;QAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}

package/src/generators/teardown/teardown.spec.ts

@@ -0,0 +1,100 @@
+import {
+  addProjectConfiguration,
+  readProjectConfiguration,
+} from '@nx/devkit';
+import { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';
+import pipeline from '../pipeline/pipeline';
+import generator from './teardown';
+import { Schema } from './schema';
+
+describe('Teardown Generator', () => {
+  const options: Schema = {
+    project: 'test',
+    env: 'dev',
+  };
+
+  async function setup(host, envs = 'test-dev test-test test-prod') {
+    await pipeline(host, {
+      pipeline: 'test',
+      registry: 'ghcr.io/test-org',
+      type: 'jenkins',
+      infra: 'test-infra',
+      envs,
+    });
+    addProjectConfiguration(host, 'test', {
+      root: 'apps/test',
+      projectType: 'application',
+      targets: {
+        build: { executor: '@nx/webpack:webpack', options: { compiler: 'tsc', target: 'node' } },
+      },
+    });
+  }
+
+  it('adds teardown-dev target for dev environment', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await setup(host);
+
+    await generator(host, options);
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['teardown-dev']).toBeTruthy();
+    const cmds: string[] = config.targets['teardown-dev'].options.commands;
+    expect(cmds.some((c) => c.includes('oc delete'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('test-dev'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('--ignore-not-found'))).toBeTruthy();
+  });
+
+  it('adds teardown-prod target for prod environment', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await setup(host);
+
+    await generator(host, { ...options, env: 'prod' });
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['teardown-prod']).toBeTruthy();
+    const cmds: string[] = config.targets['teardown-prod'].options.commands;
+    expect(cmds.some((c) => c.includes('test-prod'))).toBeTruthy();
+  });
+
+  it('teardown targets for multiple environments are additive', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await setup(host);
+
+    await generator(host, { ...options, env: 'dev' });
+    await generator(host, { ...options, env: 'test' });
+    await generator(host, { ...options, env: 'prod' });
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['teardown-dev']).toBeTruthy();
+    expect(config.targets['teardown-test']).toBeTruthy();
+    expect(config.targets['teardown-prod']).toBeTruthy();
+  });
+
+  it('skips gracefully when environments.yml does not exist', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addProjectConfiguration(host, 'test', {
+      root: 'apps/test',
+      projectType: 'application',
+      targets: {
+        build: { executor: '@nx/webpack:webpack', options: { compiler: 'tsc', target: 'node' } },
+      },
+    });
+
+    await generator(host, options);
+
+    const config = readProjectConfiguration(host, 'test');
+    expect(config.targets['teardown-dev']).toBeFalsy();
+  });
+
+  it('uses label selector with project name in delete command', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await setup(host);
+
+    await generator(host, options);
+
+    const config = readProjectConfiguration(host, 'test');
+    const cmds: string[] = config.targets['teardown-dev'].options.commands;
+    expect(cmds.some((c) => c.includes('-l app=test'))).toBeTruthy();
+    expect(cmds.some((c) => c.includes('all,configmap'))).toBeTruthy();
+  });
+});