@jr2/orchestrator 0.3.0 → 0.5.1

package/src/content-hash.ts

@@ -0,0 +1,105 @@
+// The content address jr2 takes of a tree (ADR-0038, ADR-0069). It lives here, not in the CLI,
+// because two ends compute it over one Assembly: `jr2 up` hashes the staged tree, and the door
+// recomputes the hash over the unpacked tree before it accepts a publish. One implementation, so
+// the two ends cannot drift.
+
+import { createHash } from "node:crypto";
+import { readdir, readFile, readlink, stat } from "node:fs/promises";
+import { basename, join, relative } from "node:path";
+
+/** The salt of an Assembly's hash (ADR-0069). The host and the door both hash with it. */
+export const ASSEMBLY_HASH_SALT = "assembly";
+
+/**
+ * The name of an Assembly (ADR-0069): a hash over every entry the Assembly's archive carries. The
+ * host names its staged tree with it, and the door recomputes it over the unpacked tree. The door
+ * then trusts "one hash names one Assembly" three times: `jr2 up` skips a publish whose hash is
+ * current, the door answers `unchanged`, and the door reuses an `assemblies/<hash>/` it already
+ * holds. So the hash covers what the archive carries, and nothing can change under one hash:
+ *
+ * - Each directory is a record, so an empty one counts.
+ * - Each symlink is a record with its target. `contentHash` skips links (an image tag must not see
+ *   pnpm's store links twice), but an Assembly's links travel, and a changed target is a changed
+ *   Assembly.
+ * - Each record is framed: a type, then every field as its byte length and its bytes. Without the
+ *   frame, a file `a` that holds `X0:b\nY` hashes as the files `a` = `X` and `b` = `Y`.
+ *
+ * The walk is in byte order (`byteOrder`). Modes are not in the hash: nothing at the door reads
+ * them, and an umask must not move an Assembly's name. Other entry types (a socket, a FIFO) are not
+ * records: the archive refuses them, so they never reach the door. Nothing is excluded: the hash
+ * names every byte the archive carries.
+ */
+export async function assemblyHash(dir: string): Promise<string> {
+  const h = createHash("sha256");
+  h.update(`salt:${ASSEMBLY_HASH_SALT}\n`);
+  const field = (bytes: Buffer): void => {
+    h.update(`${bytes.length}:`);
+    h.update(bytes);
+  };
+  const walk = async (d: string, rel: string): Promise<void> => {
+    const entries = (await readdir(d, { withFileTypes: true })).sort((a, b) => byteOrder(a.name, b.name));
+    for (const e of entries) {
+      const p = join(d, e.name);
+      const path = Buffer.from(rel === "" ? e.name : `${rel}/${e.name}`, "utf8");
+      if (e.isSymbolicLink()) {
+        h.update("l");
+        field(path);
+        field(Buffer.from(await readlink(p), "utf8"));
+      } else if (e.isDirectory()) {
+        h.update("d");
+        field(path);
+        await walk(p, path.toString("utf8"));
+      } else if (e.isFile()) {
+        h.update("f");
+        field(path);
+        field(await readFile(p));
+      }
+    }
+  };
+  await walk(dir, "");
+  return h.digest("hex").slice(0, 12);
+}
+
+/**
+ * The order a content address walks a directory in: UTF-8 byte order of the entry names, never a
+ * locale's collation. `localeCompare` reads the ICU locale from `LANG`/`LC_ALL`, and the two ends
+ * of a hash run in different locales: in `cs_CZ`, "ch" sorts after "h", so a host there would
+ * hash `node_modules/chalk` after `hono` while the Kit image hashes it first, and every publish
+ * would fail the door's check. The Assembly's tar orders its entries by the same rule.
+ */
+export function byteOrder(a: string, b: string): number {
+  return Buffer.compare(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+}
+
+/**
+ * A short content hash over `paths` (files and/or directories, sorted walk), salted with `salt`.
+ * Symlinks are skipped rather than followed: in a pnpm bundle `node_modules/<pkg>` links into the
+ * virtual store, whose real files the walk already visits — following would hash the same bytes
+ * twice. Each path contributes its entries under its own index prefix, so two directories that
+ * happen to hold the same relative filenames stay distinguishable.
+ */
+export async function contentHash(paths: string[], salt: string, exclude: Set<string> = new Set()): Promise<string> {
+  const h = createHash("sha256");
+  h.update(`salt:${salt}\n`);
+  const walk = async (root: string, d: string, index: number): Promise<void> => {
+    const entries = (await readdir(d, { withFileTypes: true })).sort((a, b) => byteOrder(a.name, b.name));
+    for (const e of entries) {
+      if (exclude.has(e.name)) continue;
+      const p = join(d, e.name);
+      if (e.isDirectory()) await walk(root, p, index);
+      else if (e.isFile()) {
+        h.update(`${index}:${relative(root, p)}\n`);
+        h.update(await readFile(p));
+      }
+    }
+  };
+  for (const [index, p] of paths.entries()) {
+    const st = await stat(p);
+    if (st.isDirectory()) await walk(p, p, index);
+    else {
+      h.update(`${index}:${basename(p)}\n`);
+      h.update(await readFile(p));
+    }
+  }
+  return h.digest("hex").slice(0, 12);
+}

package/src/custodian.lua

@@ -1,11 +1,12 @@
 -- The Custodian's decisions (ADR-0059), run by Envoy's Lua filter on every listener it owns.
 --
 -- Envoy carries the bytes: the CONNECT listener, TLS on both sides, the upstream pools, streaming.
--- This script makes every choice about a credential, and nothing else. `jr2 up` prepends a
--- generated `HELD` table (names, headers, paths, bound targets — never a value) and ships the
--- whole file in the `jr2-held` ConfigMap. Envoy loads it once per Lua state at start, so the
--- top-level code below runs before any listener serves: a value that is missing or cannot ride a
--- header stops the start-up with a line that names the secret, never the value.
+-- This script makes every choice about a credential, and nothing else. It ships once per Instance
+-- in the `jr2-held` ConfigMap (`program.lua`); each pod's own `custodian.lua` is a generated `HELD`
+-- table (names, headers, paths, bound targets — never a value) that ends by loading this file.
+-- Envoy loads that once per Lua state at start, so the top-level code below runs before any
+-- listener serves, with `HELD` already set: a value that is missing or cannot ride a header stops
+-- the start-up with a line that names the secret, never the value.
 --
 -- Four roles, one per route family, read from the route's metadata:
 --

package/src/custodian.ts

@@ -5,22 +5,29 @@
 // Its engine is Envoy, the upstream distroless image pinned by digest: jr2 deploys it and never
 // builds it (ADR-0038). This module is the jr2 half — everything Envoy is told, and where:
 //
-//   custodianBootstrap(...)   the static bootstrap `jr2 up` writes into the `jr2-held` ConfigMap:
+//   custodianBootstrap(...)   the static bootstrap, one per pod, from that pod's manifest:
 //                             no admin listener, no xDS, one internal listener per bound host
-//   custodianScript(...)      the Lua the bootstrap runs: `custodian.lua`, with a generated table
-//                             of names, headers, paths and targets in front — never a value
+//   custodianScript(...)      the Lua the bootstrap runs: a generated table of names, headers,
+//                             paths and targets — never a value — then `dofile` of the program
+//   CUSTODIAN_PROGRAM         `custodian.lua` as written: in `jr2-held` once per Instance
+//
+// Who renders the two per-pod files is who makes the pod: the Orchestrator at provision, into a
+// ConfigMap the Sandbox CR owns; `jr2 up` for the Instance Harness. `jr2 up` DECLARES — each pod's
+// manifest, the program — and nothing rendered per pod lands in a shared object (a ConfigMap
+// stops at 1 MiB; a per-pod copy of Envoy's files reached it at nine Workspaces).
 //   custodianComposition(...) what a Harness pod gains: the Custodian container, its volumes, and
 //                             the Harness container's env and mounts. BOTH placements call it —
-//                             `kubectlSandbox` per provision, `instanceHarnessObjects` at converge —
+//                             `kubeSandbox` per provision, `instanceHarnessObjects` at converge —
 //                             so the two pod shapes cannot drift
 //
 // The Custodian is a separate container from the Harness, and that is the point: the Agent
 // executes code in the Harness container and nothing here (ADR-0005). What it holds — the
-// Sandbox token and every held secret — is mounted into this container alone, and
+// Sandbox token and every held secret its pod claims — is mounted into this container alone, and
 // `shareProcessNamespace` stays off, so the Agent cannot read its env, its files or its `/proc`.
 
 import { readFileSync } from "node:fs";
 import type { HarnessEnvVar } from "./config.ts";
+import type { ResourceRequirements } from "./size.ts";
 import {
   CREDENTIAL_HEADERS,
   SANDBOX_TOKEN_NAME,
@@ -33,9 +40,10 @@ import {
   CUSTODIAN_CONTROL_PORT,
   CUSTODIAN_HEALTH_PORT,
   CUSTODIAN_PORT,
+  CUSTODIAN_PROGRAM_KEY,
   HELD_CONFIGMAP,
-  HELD_SECRETS_SECRET,
   HELD_TLS_SECRET,
+  heldSecretsSecret,
 } from "./names.ts";
 
 /**
@@ -62,7 +70,10 @@ export function custodianRef(kitRegistry?: string): string {
 export const CUSTODIAN_VALUES = "/etc/jr2/custodian/values";
 export const CUSTODIAN_TLS = "/etc/jr2/custodian/tls";
 export const CUSTODIAN_CONFIG = "/etc/jr2/custodian/config";
-/** The two keys of the `jr2-held` ConfigMap the Custodian reads (beside `held.json`). */
+/** The files the Custodian reads under its config mount: its own pod's rendered bootstrap and
+ * script (the two keys of the pod's Custodian ConfigMap — `sandboxCustodianConfigMap`,
+ * `INSTANCE_CUSTODIAN_CONFIGMAP`), and the fixed program the script loads, projected from
+ * `jr2-held` (`CUSTODIAN_PROGRAM_KEY`). */
 export const CUSTODIAN_BOOTSTRAP_KEY = "envoy.json";
 export const CUSTODIAN_SCRIPT_KEY = "custodian.lua";
 
@@ -206,30 +217,72 @@ function meta(fields: Record<string, string>): Json {
   return { filter_metadata: { [LUA_FILTER]: fields } };
 }
 
-/** An upstream that never answered, said as the Custodian's own 502 (§5.4) — the host and Envoy's
- * reason, never a retry without verification. */
-function unreachable(target: string): Json {
+/** Envoy's flags for a request it did not send to the target (ADR-0059): the connection failed, no
+ * host was healthy, the DNS lookup failed. */
+export const NOT_SENT_FLAGS = ["UF", "UH", "DF"] as const;
+
+/** Envoy's flags for a request that may have reached the target before the stream ended (ADR-0059):
+ * the target closed the connection or reset the stream, Envoy reset it, a protocol error on either
+ * side (a body framing error can come after the headers went). `UMSDR` (the maximum stream
+ * duration) ends a stream that was sent. `URX` (the retry limit) comes with the last attempt's own
+ * flag (`UF,URX`, `UC,URX`), so alone it says nothing of the send; the mapper for
+ * {@link NOT_SENT_FLAGS} comes first, so `UF,URX` still reads "could not be reached". These routes
+ * set no retry policy and no `max_stream_duration`, so Envoy sets neither flag on them; they keep
+ * the union equal to ORCHESTRATOR_UNREACHABLE's. */
+export const MAY_HAVE_SENT_FLAGS = ["UC", "DPE", "UMSDR", "URX", "UPE", "UR", "LR"] as const;
+
+/** One of the Custodian's own 502s for a target that gave no answer (§5.4): the target, what
+ * jr2 knows about the request, and Envoy's reason — never a retry without verification. */
+function noAnswer(target: string, flags: readonly string[], words: string): Json {
   return {
-    mappers: [
-      {
-        filter: { response_flag_filter: { flags: ["UF", "URX", "UH", "UC", "DF", "DPE", "UMSDR"] } },
-        status_code: 502,
-        body_format_override: {
-          text_format_source: {
-            inline_string: `jr2 custodian: ${target} could not be reached: %RESPONSE_CODE_DETAILS% %UPSTREAM_TRANSPORT_FAILURE_REASON%\n`,
-          },
-        },
+    filter: { response_flag_filter: { flags: [...flags] } },
+    status_code: 502,
+    body_format_override: {
+      text_format_source: {
+        inline_string: `jr2 custodian: ${target} ${words}: %RESPONSE_CODE_DETAILS% %UPSTREAM_TRANSPORT_FAILURE_REASON%\n`,
       },
-    ],
+    },
   };
 }
 
+const NOT_REACHED = "could not be reached";
+const MAY_HAVE_REACHED = "did not answer; the request may have reached it";
+
+/**
+ * An intercepted target that gave no answer (ADR-0059). Two mappers, because the words must be
+ * true: after a `NOT_SENT_FLAGS` failure the target did not get the request, and after a
+ * `MAY_HAVE_SENT_FLAGS` one it may have it — so an Agent that sends a POST again can write twice,
+ * and the text must not tell it the first one went nowhere. One reply can carry several flags,
+ * and Envoy uses the first mapper that matches, in order: the `NOT_SENT_FLAGS` mapper is first, so
+ * a reply with `UF`, `UH` or `DF` reads "could not be reached" whatever else it carries. Without
+ * the mappers, Envoy answers each of these flags itself (503 for most, 502 for `UPE`) with a body
+ * that names no target, which a caller can read as the target's answer. No caller reads the flags;
+ * the Orchestrator route's go to the Harness, which tells "never reached" from "not known"
+ * (ADR-0002).
+ */
+function unreachable(target: string): Json {
+  return {
+    mappers: [noAnswer(target, NOT_SENT_FLAGS, NOT_REACHED), noAnswer(target, MAY_HAVE_SENT_FLAGS, MAY_HAVE_REACHED)],
+  };
+}
+
+/** The tunnel's 502 (ADR-0059): every flag, one text. Envoy answers a `CONNECT` with 200 only after
+ * its TCP connection to the target is up, and no byte of the Agent's request goes before that 200.
+ * So a 502 on the tunnel always comes before the request reached the target, whatever its flag. */
+function tunnelUnreachable(target: string): Json {
+  return { mappers: [noAnswer(target, [...NOT_SENT_FLAGS, ...MAY_HAVE_SENT_FLAGS], NOT_REACHED)] };
+}
+
 /** The Orchestrator unreachable, said so the Harness can tell it from an answer and retry the
  * surface read the way ADR-0042 asks — the one route on this pod that retries. */
 const ORCHESTRATOR_UNREACHABLE: Json = {
   mappers: [
     {
-      filter: { response_flag_filter: { flags: ["UF", "URX", "UH", "UC", "DF", "DPE", "UMSDR"] } },
+      // Envoy's own answers for a stream it reset (`UPE`, `UR`, `LR`: 503, or 502 for `UPE`) are said
+      // here too, so the Harness reads them as "not known" and not as a stopping Orchestrator's 503
+      // (ADR-0002). One text for
+      // both lists: the Harness reads the flags, not the words.
+      filter: { response_flag_filter: { flags: [...NOT_SENT_FLAGS, ...MAY_HAVE_SENT_FLAGS] } },
       status_code: 502,
       headers_to_add: [
         { header: { key: "x-jr2-custodian", value: "unreachable" }, append_action: "OVERWRITE_IF_EXISTS_OR_ADD" },
@@ -322,7 +375,7 @@ function egressReplies(): Json {
           },
         },
       },
-      ...(unreachable("%REQ(:AUTHORITY)%").mappers as Json[]),
+      ...(tunnelUnreachable("%REQ(:AUTHORITY)%").mappers as Json[]),
     ],
   };
 }
@@ -356,8 +409,8 @@ function isIpLiteral(host: string): boolean {
  * The Custodian's static bootstrap (ADR-0059): Envoy's whole configuration, rendered once per
  * converge by `jr2 up`, identical for every Harness pod of the Instance.
  *
- *   control   127.0.0.1:8081   the Menu and the ask, plain HTTP, to the Orchestrator's Service —
- *                              three routes and nothing else, each swapping the Sandbox token's
+ *   control   127.0.0.1:8081   the Menu, a pick's answer and the ask, plain HTTP, to the Orchestrator's Service —
+ *                              four routes and nothing else, each swapping the Sandbox token's
  *                              Stand-in for the token (ADR-0013, ADR-0053)
  *   health    0.0.0.0:15021    GET /healthz, for the kubelet, which cannot reach loopback
  *   egress    127.0.0.1:15001  CONNECT only — present when a held secret exists; a bound target
@@ -401,6 +454,11 @@ export function custodianBootstrap(manifest: HeldManifest, orchestrator: Orchest
                       route("events", "POST", "/agents/[^/]+/events", {
                         retry_policy: { retry_on: "reset-before-request,connect-failure", num_retries: 2 },
                       }),
+                      // An outstanding pick's answer, long-polled (ADR-0024): a read, so any reset
+                      // is retried — an Orchestrator restart mid-poll costs a retry, not the pick.
+                      route("deliveries", "GET", "/agents/[^/]+/deliveries/[^/]+", {
+                        retry_policy: { retry_on: "reset,connect-failure", num_retries: 2 },
+                      }),
                       route("fetch", "POST", "/fetch", {
                         retry_policy: { retry_on: "reset-before-request,connect-failure", num_retries: 2 },
                       }),
@@ -715,8 +773,11 @@ export function custodianBootstrap(manifest: HeldManifest, orchestrator: Orchest
 
 // ---- the script ---------------------------------------------------------------------------------
 
-/** `custodian.lua` beside this module — the fixed half of the script. */
-const SCRIPT = readFileSync(new URL("./custodian.lua", import.meta.url), "utf8");
+/** `custodian.lua` beside this module — the fixed half of the script, as written. `jr2 up` puts it
+ * in `jr2-held` once (`CUSTODIAN_PROGRAM_KEY`); every pod's own script loads it from the config
+ * mount. The per-pod half is the table alone, so a pod's rendered files stay small and nothing
+ * fixed is copied per Workspace. */
+export const CUSTODIAN_PROGRAM: string = readFileSync(new URL("./custodian.lua", import.meta.url), "utf8");
 
 /** A Lua string literal. Every string that reaches here passed `heldSecretsOf`'s rules (names,
  * header tokens, printable paths), so escaping the two characters Lua gives meaning to is enough. */
@@ -729,14 +790,15 @@ function luaList(values: readonly string[]): string {
 }
 
 /**
- * The script the Custodian runs: a generated `HELD` table in front of `custodian.lua`. The table
- * names every secret this pod holds — the Sandbox token first, then the manifest's — with the
- * headers and paths each may ride and the targets each is bound to. It never holds a value: the
- * script reads those from the mounted files at start.
+ * The script the Custodian runs: a generated `HELD` table, then `dofile` of the fixed program
+ * (`CUSTODIAN_PROGRAM`, mounted beside it from `jr2-held`). The table names every secret this pod
+ * holds — the Sandbox token first, then the manifest's — with the headers and paths each may ride
+ * and the targets each is bound to. It never holds a value: the program reads those from the
+ * mounted files at start.
  */
 export function custodianScript(manifest: HeldManifest): string {
   const lines = [
-    "-- Generated by `jr2 up` from held.json (ADR-0059). Names, headers, paths, targets; never a value.",
+    "-- Generated by `jr2 up` from its pod's held manifest (ADR-0059). Names, headers, paths, targets; never a value.",
     `HELD = { secrets = {}, targets = {}, hosts = ${targetsOf(manifest).length} }`,
     `HELD.credential = ${luaList(CREDENTIAL_HEADERS)}`,
     `HELD.secrets[1] = { name = ${lua(SANDBOX_TOKEN_NAME)}, headers = { "authorization" } }`,
@@ -750,7 +812,10 @@ export function custodianScript(manifest: HeldManifest): string {
     const refs = t.secrets.map((s) => `HELD.secrets[${manifest.secrets.indexOf(s) + 2}]`);
     lines.push(`HELD.targets[${lua(t.key)}] = { ${refs.join(", ")} }`);
   }
-  return `${lines.join("\n")}\n\n${SCRIPT}`;
+  // `dofile`, not a copy: Envoy's Lua opens the standard libraries (the program already reads its
+  // values with `io`), and the program's top-level code runs here, after the table it reads.
+  lines.push(`dofile(${lua(`${CUSTODIAN_CONFIG}/${CUSTODIAN_PROGRAM_KEY}`)})`);
+  return `${lines.join("\n")}\n`;
 }
 
 // ---- the composition ----------------------------------------------------------------------------
@@ -758,14 +823,30 @@ export function custodianScript(manifest: HeldManifest): string {
 export type CustodianCompositionOptions = {
   /** The Custodian's resolved ref (`custodianRef`, from the image map). */
   image: string;
+  /** The pod whose held objects these are (ADR-0059): `INSTANCE_HARNESS_HELD_POD`, or a Workspace's
+   * `workspaceHeldPod` — its manifest and its literal values' Secret. */
+  pod: string;
+  /** The ConfigMap with THIS pod's rendered `envoy.json` and `custodian.lua` — written by whoever
+   * makes the pod: the Orchestrator at provision (`sandboxCustodianConfigMap`, owned by the CR),
+   * `jr2 up` for the Instance Harness (`INSTANCE_CUSTODIAN_CONFIGMAP`). */
+  config: string;
   /** Where the Sandbox token lives: a Sandbox's `<name>-token` Secret, or the Instance Harness's key
    * of `jr2-instance`. Mounted into the Custodian alone (ADR-0013). */
   token: { secret: string; key: string };
   /** This pod's Sandbox — the name the ask is addressed by (ADR-0053). Absent on the Instance
    * Harness, which mounts no Repo and answers an ask by saying so. */
   sandbox?: string;
+  /** The names of the Instance objects that this Custodian reads in place of the defaults. The
+   * defaults are the Instance's own: `pod`'s literal values (`heldSecretsSecret(pod)`),
+   * `jr2-held-tls`, `jr2-ca`, and the program in `jr2-held`.
+   * The check pod (ADR-0019) reads its own copies, so a check pod writes nothing that a running pod
+   * of the Instance reads. */
+  reads?: { literals: string; tls: string; trust: string; program: string };
   /** The Instance ships a `harness.caBundle` (ADR-0020). */
   caBundle: boolean;
+  /** The Custodian container's resources (ADR-0060) — the placement's to choose: a Sandbox's fixed
+   * slice of its Size (requests = limits), the Instance Harness's kit-sized request. */
+  resources?: ResourceRequirements;
 };
 
 type Container = Record<string, unknown>;
@@ -804,6 +885,12 @@ const CUSTODIAN_SECURITY = {
 export function custodianComposition(manifest: HeldManifest, opts: CustodianCompositionOptions): CustodianComposition {
   const held = manifest.secrets.length > 0;
   const literal = manifest.secrets.filter((s) => s.source.kind === "literal").map((s) => s.name);
+  const {
+    literals = heldSecretsSecret(opts.pod),
+    tls = HELD_TLS_SECRET,
+    trust: trustMap = CA_CONFIGMAP,
+    program = HELD_CONFIGMAP,
+  } = opts.reads ?? {};
 
   const harnessEnv: HarnessEnvVar[] = [
     { name: "JR2_CUSTODIAN_URL", value: CUSTODIAN_URL },
@@ -837,9 +924,7 @@ export function custodianComposition(manifest: HeldManifest, opts: CustodianComp
         defaultMode: 0o440,
         sources: [
           { secret: { name: opts.token.secret, items: [{ key: opts.token.key, path: SANDBOX_TOKEN_NAME }] } },
-          ...(literal.length
-            ? [{ secret: { name: HELD_SECRETS_SECRET, items: literal.map((n) => ({ key: n, path: n })) } }]
-            : []),
+          ...(literal.length ? [{ secret: { name: literals, items: literal.map((n) => ({ key: n, path: n })) } }] : []),
           ...manifest.secrets.flatMap((s) =>
             s.source.kind === "secret"
               ? [{ secret: { name: s.source.secret, items: [{ key: s.source.key, path: s.name }] } }]
@@ -848,17 +933,35 @@ export function custodianComposition(manifest: HeldManifest, opts: CustodianComp
         ],
       },
     },
-    { name: "custodian-config", configMap: { name: HELD_CONFIGMAP } },
+    // This pod's own bootstrap and script, under the names Envoy is started with, beside the fixed
+    // program the script loads — the one thing every pod shares, from `jr2-held`.
+    {
+      name: "custodian-config",
+      projected: {
+        sources: [
+          {
+            configMap: {
+              name: opts.config,
+              items: [
+                { key: CUSTODIAN_BOOTSTRAP_KEY, path: CUSTODIAN_BOOTSTRAP_KEY },
+                { key: CUSTODIAN_SCRIPT_KEY, path: CUSTODIAN_SCRIPT_KEY },
+              ],
+            },
+          },
+          { configMap: { name: program, items: [{ key: CUSTODIAN_PROGRAM_KEY, path: CUSTODIAN_PROGRAM_KEY }] } },
+        ],
+      },
+    },
     ...(held
       ? [
-          { name: "custodian-tls", secret: { secretName: HELD_TLS_SECRET, defaultMode: 0o440 } },
+          { name: "custodian-tls", secret: { secretName: tls, defaultMode: 0o440 } },
           {
             name: "custodian-trust",
-            configMap: { name: CA_CONFIGMAP, items: [{ key: "upstream.crt", path: "upstream.crt" }] },
+            configMap: { name: trustMap, items: [{ key: "upstream.crt", path: "upstream.crt" }] },
           },
         ]
       : []),
-    ...(trust ? [{ name: "ca", configMap: { name: CA_CONFIGMAP } }] : []),
+    ...(trust ? [{ name: "ca", configMap: { name: trustMap } }] : []),
   ];
 
   const custodianContainer: Container = {
@@ -887,6 +990,7 @@ export function custodianComposition(manifest: HeldManifest, opts: CustodianComp
       periodSeconds: 2,
       failureThreshold: 15,
     },
+    ...(opts.resources !== undefined ? { resources: opts.resources } : {}),
     securityContext: CUSTODIAN_SECURITY,
   };