@localctl/cli 0.5.0-beta.2 → 0.5.0

package/src/commands/doctor.js

@@ -1,7 +1,5 @@
 const { commandExists, capture } = require('../lib/exec');
-const { detectEngine, warnIfExperimental, warnIfExperimentalPlatform } = require('../lib/engine');
-const { ensurePodmanSocket, blockedPrivilegedPorts, engineMemoryMb } = require('../lib/podman');
-const { DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT } = require('../lib/constants');
+const { detectEngine, warnIfExperimental } = require('../lib/engine');
 const { getActive, clusterNameFor } = require('../lib/profileStore');
 const ui = require('../lib/ui');
 const logger = require('../lib/logger');
@@ -23,7 +21,6 @@ module.exports = (program) => {
     .description('Check the local environment for missing/broken pieces')
     .action(() => {
       logger.step('Checking environment...');
-      warnIfExperimentalPlatform();
       const detected = detectEngine();
       check(`container engine available${detected ? ` (${detected.engine})` : ''}`, () => Boolean(detected));
       if (detected) warnIfExperimental(detected.engine);
@@ -41,18 +38,6 @@ module.exports = (program) => {
         const res = capture('k3d', ['cluster', 'list']);
         return res.stdout.split('\n').some((line) => line.trim().split(/\s+/)[0] === activeCluster);
       });
-      if (process.platform === 'linux' && detected && detected.engine === 'podman') {
-        check('podman API socket available (needed by k3d)', () => ensurePodmanSocket() === null);
-        check('rootless podman can bind :80/:443', () => blockedPrivilegedPorts([DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT]).length === 0);
-      }
-      if (detected) {
-        // One k3s cluster idles around 0.6-0.7 GB, and apps/addons come on top. Below ~3 GB the
-        // engine's VM starts swapping and the API server times out.
-        const mb = engineMemoryMb(detected.bin);
-        if (mb !== null) {
-          check(`engine has at least 3 GB of memory (${(mb / 1024).toFixed(1)} GB available)`, () => mb >= 3000);
-        }
-      }
       check('kubectl context reachable', () => capture('kubectl', ['cluster-info']).status === 0);
       logger.step(`Fix any ${ui.cross} above, or run "localctl setup" (or "localctl profiles switch ${active}" for a non-default project) to (re)install/repair.`);
     });

package/src/commands/down.js

@@ -3,6 +3,7 @@ const { loadConfig } = require('../lib/loadConfig');
 const { run, isRunning, sleepSync } = require('../lib/exec');
 const { ensureClusterUp } = require('../lib/clusterProvision');
 const { runFiles } = require('../lib/paths');
+const { assertNamespaceOwnership } = require('../lib/namespaces');
 const logger = require('../lib/logger');
 
 module.exports = (program) => {
@@ -12,6 +13,7 @@ module.exports = (program) => {
     .action(() => {
       const cfg = loadConfig();
       ensureClusterUp(cfg.clusterName, cfg.profile);
+      assertNamespaceOwnership(cfg);
       const { pidFile, portFile, logFile } = runFiles(cfg.name);
 
       // If `localctl up` started a detached Tilt process for this app, it needs to be stopped
@@ -19,7 +21,7 @@ module.exports = (program) => {
       // about to delete out from under it.
       if (fs.existsSync(pidFile)) {
         const pid = parseInt(fs.readFileSync(pidFile, 'utf8'), 10);
-        if (Number.isFinite(pid) && isRunning(pid)) {
+        if (Number.isInteger(pid) && pid > 1 && isRunning(pid)) {
           logger.step(`Stopping background Tilt process (pid ${pid})...`);
           process.kill(pid, 'SIGTERM');
           for (let i = 0; i < 20 && isRunning(pid); i += 1) sleepSync(250);

package/src/commands/generateManifests.js

@@ -1,5 +1,6 @@
 const { loadConfig } = require('../lib/loadConfig');
 const { generateManifests } = require('../lib/manifestGen');
+const { assertNamespaceOwnership } = require('../lib/namespaces');
 
 module.exports = (program) => {
   program
@@ -7,6 +8,9 @@ module.exports = (program) => {
     .description('[internal, called by Tiltfile] Render k8s manifests for the app in the current directory to stdout')
     .action(() => {
       const cfg = loadConfig();
+      // Rendering creates Secrets and ConfigMaps for dependencies, so check the namespace first:
+      // Tilt calls this on every evaluation, whatever `localctl app up` checked earlier.
+      assertNamespaceOwnership(cfg);
       process.stdout.write(generateManifests(cfg));
     });
 };

package/src/commands/logs.js

@@ -12,6 +12,7 @@ module.exports = (program) => {
     .option('-f, --follow', 'follow log output')
     .description('Tail logs for a deployed app - run inside the app\'s repo to resolve it (and its project\'s namespace prefix) automatically, or pass a name')
     .action((name, opts) => {
+      if (name !== undefined && !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(name)) throw new Error(`"${name}" is not a valid app name.`);
       let targetName = name;
       let namespace = opts.namespace;
 

package/src/commands/new.js

@@ -6,41 +6,63 @@ const logger = require('../lib/logger');
 module.exports = (program) => {
   program
     .command('new')
-    .description('Scaffold .local/config.json and a Tiltfile in the current app repo')
+    .description('Scaffold .local/config.yaml and a Tiltfile in the current app repo')
     .action(async () => {
       const cwd = process.cwd();
       const localDir = path.join(cwd, '.local');
-      const configPath = path.join(localDir, 'config.json');
+      const configPath = path.join(localDir, 'config.yaml');
 
       if (fs.existsSync(configPath)) {
-        logger.warn('.local/config.json already exists, aborting.');
+        logger.warn('.local/config.yaml already exists, aborting.');
         return;
       }
 
-      const defaultName = path.basename(cwd).toLowerCase().replace(/[^a-z0-9-]/g, '-');
+      const defaultName = path.basename(cwd).toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/^-+|-+$/g, '').slice(0, 63) || 'app';
       const [name, portAnswer] = await askAll([
         { text: 'App name', def: defaultName },
         { text: 'App port', def: '3000' },
       ]);
 
       const port = parseInt(portAnswer, 10);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`"${portAnswer}" is not a valid port (1-65535).`);
+      }
+      if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(name) || name.length > 63) {
+        throw new Error(`"${name}" is not a valid app name: use lowercase letters, digits and dashes only.`);
+      }
 
       fs.mkdirSync(localDir, { recursive: true });
 
-      const config = {
-        $schema: '../../localctl/schema/app.schema.json',
-        name,
-        subdomain: name,
-        port,
-        build: { context: '.', dockerfile: 'Dockerfile' },
-        env: {},
-        replicas: 1,
-        debug: { enabled: false },
-        dependencies: [],
-        sync: [{ localPath: './src', remotePath: '/app/src' }],
-        tls: true,
-      };
-      fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+      const config = [
+        '# yaml-language-server: $schema=https://raw.githubusercontent.com/psilvmoreira/localctl/master/schema/app.schema.json',
+        '# Infrastructure config for this app. Reference: https://psilvmoreira.github.io/localctl/config-schema/',
+        `name: ${JSON.stringify(name)}`,
+        `subdomain: ${JSON.stringify(name)}`,
+        `port: ${port}`,
+        'build:',
+        '  context: .',
+        '  dockerfile: Dockerfile',
+        '# Plain environment variables. Quote values whose exact text matters ("1.10", "no").',
+        '# API keys and passwords belong in "secrets" below, never here.',
+        'env: {}',
+        '# Names only; set values with: localctl app secrets set <NAME>',
+        '# secrets:',
+        '#   - API_KEY',
+        '# Other options (see the config schema reference): command / args to override the image',
+        '# CMD, envFile: .env.local for non-secret settings, build.target / build.args, run steps after sync.',
+        'replicas: 1',
+        'debug:',
+        '  enabled: false',
+        '# Databases and caches deployed next to the app: postgres, redis or mongo.',
+        'dependencies: []',
+        '# Files copied into the running container on save (live update).',
+        'sync:',
+        '  - localPath: ./src',
+        '    remotePath: /app/src',
+        'tls: true',
+        '',
+      ].join('\n');
+      fs.writeFileSync(configPath, config);
 
       const tiltTemplatePath = path.join(__dirname, '..', '..', 'templates', 'Tiltfile.tmpl');
       const tiltTemplate = fs.readFileSync(tiltTemplatePath, 'utf8');
@@ -49,7 +71,7 @@ module.exports = (program) => {
         fs.writeFileSync(tiltfilePath, tiltTemplate);
       }
 
-      logger.success(`Created .local/config.json and Tiltfile for "${name}".`);
-      logger.info('Edit .local/config.json (env, dependencies, debug), then run "localctl app up".');
+      logger.success(`Created .local/config.yaml and Tiltfile for "${name}".`);
+      logger.info('Edit .local/config.yaml (env, dependencies, debug), then run "localctl app up".');
     });
 };

package/src/commands/prune.js

@@ -4,6 +4,7 @@ const { run, capture } = require('../lib/exec');
 const { getList } = require('../lib/workloadReadiness');
 const { confirm } = require('../lib/prompt');
 const logger = require('../lib/logger');
+const { assertNamespaceOwnership } = require('../lib/namespaces');
 
 module.exports = (program) => {
   program
@@ -13,6 +14,7 @@ module.exports = (program) => {
     .action(async (opts) => {
       const cfg = loadConfig();
       ensureClusterUp(cfg.clusterName, cfg.profile);
+      assertNamespaceOwnership(cfg);
 
       if (capture('kubectl', ['get', 'deployment', cfg.name, '-n', cfg.namespace]).status === 0) {
         throw new Error(`"${cfg.name}" is still deployed - run "localctl app down" first, then "localctl app prune" to also wipe its data.`);
@@ -43,6 +45,8 @@ module.exports = (program) => {
         }
       }
 
+      // The prompt can take a while; make sure the namespace is still ours before deleting it.
+      assertNamespaceOwnership(cfg);
       run('kubectl', ['delete', 'namespace', cfg.namespace]);
       logger.success(`Namespace "${cfg.namespace}" and everything in it deleted.`);
     });

package/src/commands/reload.js

@@ -2,12 +2,20 @@ const fs = require('fs');
 const { CONFIG_PATH, runFiles } = require('../lib/paths');
 const { run, isRunning } = require('../lib/exec');
 const logger = require('../lib/logger');
+const { readRawConfig } = require('../lib/loadConfig');
+
+const APP_NAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 
 function resolveAppName(opts) {
-  if (opts.app) return opts.app;
+  if (opts.app) {
+    if (!APP_NAME.test(opts.app) || opts.app.length > 63) throw new Error(`"${opts.app}" is not a valid app name.`);
+    return opts.app;
+  }
   if (fs.existsSync(CONFIG_PATH)) {
     try {
-      return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')).name;
+      const name = readRawConfig(CONFIG_PATH).name;
+      // Only a plain app name: it becomes part of file names and a tilt argument.
+      return typeof name === 'string' && /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(name) ? name : null;
     } catch (e) {
       // fall through
     }
@@ -32,7 +40,7 @@ module.exports = (program) => {
       }
 
       const pid = parseInt(fs.readFileSync(pidFile, 'utf8'), 10);
-      if (!Number.isFinite(pid) || !isRunning(pid)) {
+      if (!Number.isInteger(pid) || pid <= 1 || !isRunning(pid)) {
         throw new Error(`"${name}"'s dev loop isn't running. Run "localctl app up" to start it.`);
       }
 

package/src/commands/secrets.js

@@ -10,12 +10,12 @@ module.exports = (program) => {
 
   secrets
     .command('set <key> [value]')
-    .description('Set a secret value (prompts, hidden, if not given) - stored as a real k8s Secret, never in .local/config.json')
+    .description('Set a secret value (prompts, hidden, if not given) - stored as a real k8s Secret, never in .local/config.yaml')
     .action(async (key, value) => {
       const cfg = loadConfig();
       ensureClusterUp(cfg.clusterName, cfg.profile);
       if (!cfg.secrets.includes(key)) {
-        logger.warn(`"${key}" isn't listed in .local/config.json's "secrets" array - it won't be injected into the app until you add it there too.`);
+        logger.warn(`"${key}" isn't listed in .local/config.yaml's "secrets" array - it won't be injected into the app until you add it there too.`);
       }
       const finalValue = value || (await promptHidden(`Value for ${key}`));
       if (!finalValue) throw new Error('No value given.');
@@ -48,7 +48,7 @@ module.exports = (program) => {
       const rows = [...new Set([...cfg.secrets, ...set])].map((key) => [
         key,
         set.has(key) ? ui.ok('set') : ui.warn('missing'),
-        cfg.secrets.includes(key) ? '' : ui.dim('(not in config.json)'),
+        cfg.secrets.includes(key) ? '' : ui.dim('(not in config.yaml)'),
       ]);
       ui.printTable(['KEY', 'STATUS', ''], rows);
     });

package/src/commands/setup.js

@@ -3,17 +3,8 @@ const { syncHosts } = require('../lib/hostsFile');
 const { setActive } = require('../lib/profileStore');
 const { DEFAULT_CLUSTER_NAME, DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT, DOMAIN, REGISTRY_HOST_PORT } = require('../lib/constants');
 const logger = require('../lib/logger');
-const { detectEngine } = require('../lib/engine');
-const { installDocker } = require('../lib/linuxDistro');
 
-function setup(opts) {
-  if (opts.installDocker) {
-    if (process.platform !== 'linux') {
-      throw new Error('--install-docker is only available on Linux. Install Docker Desktop or Podman Desktop instead.');
-    }
-    if (detectEngine()) logger.success('A container engine is already running, nothing to install');
-    else installDocker();
-  }
+function setup() {
   provisionCluster({
     clusterName: DEFAULT_CLUSTER_NAME,
     httpPort: DEFAULT_HTTP_PORT,
@@ -41,6 +32,5 @@ module.exports = (program) => {
   program
     .command('setup')
     .description('One-click local infra setup for the default project: container engine, tools, k3d cluster, TLS, hosts')
-    .option('--install-docker', 'Linux only: install Docker Engine first if no container engine is running (needs sudo)')
     .action(setup);
 };

package/src/commands/tiltConfig.js

@@ -0,0 +1,11 @@
+const { loadConfig } = require('../lib/loadConfig');
+const { tiltConfig } = require('../lib/tiltConfig');
+
+module.exports = (program) => {
+  program
+    .command('tilt-config')
+    .description('[internal, called by Tiltfile] Print the resolved build/sync/port settings of the app in the current directory as JSON')
+    .action(() => {
+      process.stdout.write(JSON.stringify(tiltConfig(loadConfig())));
+    });
+};

package/src/commands/uninstall.js

@@ -1,3 +1,4 @@
+const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { isRunning } = require('../lib/exec');
@@ -7,7 +8,7 @@ const { teardownInsecureRegistry } = require('../lib/podman');
 const { clearHosts } = require('../lib/hostsFile');
 const { listProfiles } = require('../lib/profileStore');
 const { confirm } = require('../lib/prompt');
-const { RUN_DIR, PROFILES_PATH, CERTS_DIR, APPS_REGISTRY_PATH } = require('../lib/paths');
+const { RUN_DIR, PROFILES_PATH } = require('../lib/paths');
 const logger = require('../lib/logger');
 
 // Every Main (cluster-isolation) project this machine knows about - each one owns a real,
@@ -23,7 +24,7 @@ async function uninstall(opts) {
   console.log('This will remove everything "localctl setup"/"localctl profiles" set up:');
   console.log(`  - Every project's k3d cluster (${projects.map((p) => p.cluster).join(', ')}) and everything deployed in them`);
   console.log('  - Their local image registry containers');
-  console.log('  - Podman insecure-registry config (Podman only, if present)');
+  console.log('  - Podman VM insecure-registry config (Podman only, if present)');
   console.log('  - The *.local.test block in your hosts file');
   console.log('  - Any background dev loop `localctl app up` left running, and its state');
   console.log('  - ~/.localctl/certs, the app registry state, and the project registry (~/.localctl/profiles.json)');
@@ -79,8 +80,8 @@ async function uninstall(opts) {
     fs.rmSync(RUN_DIR, { recursive: true, force: true });
   }
 
-  const certsDir = CERTS_DIR;
-  const appsRegistry = APPS_REGISTRY_PATH;
+  const certsDir = path.join(os.homedir(), '.localctl', 'certs');
+  const appsRegistry = path.join(os.homedir(), '.localctl', 'apps.json');
   if (fs.existsSync(certsDir)) fs.rmSync(certsDir, { recursive: true, force: true });
   if (fs.existsSync(appsRegistry)) fs.rmSync(appsRegistry, { force: true });
   if (fs.existsSync(PROFILES_PATH)) fs.rmSync(PROFILES_PATH, { force: true });
@@ -93,8 +94,6 @@ async function uninstall(opts) {
   if (process.platform === 'win32') {
     console.log('  winget uninstall k3d.k3d Kubernetes.kubectl FiloSottile.mkcert Helm.Helm   # only if nothing else needs them');
     console.log('  Remove-Item -Recurse -Force ~\\.localctl\\tools   # tilt, if localctl installed it');
-  } else if (process.platform === 'linux') {
-    console.log('  rm -rf ~/.localctl/tools   # k3d, kubectl, tilt, mkcert and helm, if localctl installed them');
   } else {
     console.log('  brew uninstall k3d kubectl tilt mkcert helm   # only if nothing else needs them');
   }

package/src/commands/up.js

@@ -6,6 +6,8 @@ const { detectEngine } = require('../lib/engine');
 const { ensureClusterUp } = require('../lib/clusterProvision');
 const { portsFor } = require('../lib/profileStore');
 const { listKeys } = require('../lib/appSecrets');
+const { assertNamespaceOwnership } = require('../lib/namespaces');
+const { assertHostsFree } = require('../lib/hostGuard');
 const { runFiles } = require('../lib/paths');
 const { DOMAIN, DEFAULT_HTTPS_PORT } = require('../lib/constants');
 const ui = require('../lib/ui');
@@ -29,6 +31,7 @@ function printEndpoints(cfg) {
   const url = `https://${cfg.subdomain}.${DOMAIN}${suffix}`;
   console.log('');
   console.log(`${ui.check} ${ui.bold(cfg.name)} -> ${ui.url(url)}`);
+  cfg.hosts.slice(1).forEach((host) => console.log(`  also:   ${ui.url(`https://${host}.${DOMAIN}${suffix}`)}`));
   if (cfg.debug.enabled && cfg.debug.port) {
     console.log(`  debug:  localhost:${cfg.debug.port}`);
   }
@@ -47,10 +50,15 @@ module.exports = (program) => {
   program
     .command('up')
     .option('-f, --foreground', 'run in the foreground with the interactive Tilt UI (default: detached, survives closing this terminal)')
+    .option('-e, --env <name>', 'apply an entry of "environments" from .local/config.yaml over the base config')
     .description('Deploy/dev-loop the app in the current directory')
     .action(async (opts) => {
+      // Tilt (and the localctl calls in the Tiltfile) inherit this, so every step sees the same config.
+      if (opts.env) process.env.LOCALCTL_ENV = opts.env;
       const cfg = loadConfig();
       ensureClusterUp(cfg.clusterName, cfg.profile);
+      assertNamespaceOwnership(cfg);
+      assertHostsFree(cfg);
 
       if (cfg.secrets.length > 0) {
         const set = new Set(listKeys(cfg));
@@ -64,7 +72,7 @@ module.exports = (program) => {
         }
       }
 
-      registerApp(cfg.subdomain);
+      registerApp(cfg.hosts);
       syncHosts();
       const env = podmanBuildEnv();
 

package/src/commands/validate.js

@@ -0,0 +1,48 @@
+const { readRawConfig, applyEnvironment } = require('../lib/loadConfig');
+const { appConfigSchema, describeIssues } = require('../lib/configSchema');
+const { CONFIG_PATH } = require('../lib/paths');
+const logger = require('../lib/logger');
+const path = require('path');
+const { readEnvFile } = require('../lib/envFile');
+const { assertPathsInsideProject } = require('../lib/pathGuard');
+
+module.exports = (program) => {
+  program
+    .command('validate')
+    .description('Check .local/config.yaml and each of its environments (unknown fields, wrong types, bad values) without touching the cluster')
+    .action(() => {
+      const raw = readRawConfig(CONFIG_PATH);
+      const names = Object.keys(raw.environments && typeof raw.environments === 'object' ? raw.environments : {});
+      const problems = [];
+      let base;
+      // The base file, then each environment applied over it.
+      for (const envName of [null, ...names]) {
+        const label = envName ? `environment "${envName}"` : 'base config';
+        try {
+          const parsed = appConfigSchema.safeParse(applyEnvironment(raw, envName || ''));
+          if (parsed.success) {
+            // Same path check `app up` makes, so "valid" means it will be accepted there too.
+            assertPathsInsideProject(parsed.data, path.dirname(path.dirname(CONFIG_PATH)));
+            if (!envName) base = parsed.data;
+          } else {
+            problems.push(`${label}:\n${describeIssues(parsed.error.issues)}`);
+          }
+        } catch (e) {
+          problems.push(`${label}: ${e.message}`);
+        }
+      }
+      if (typeof raw.envFile === 'string') {
+        try {
+          readEnvFile(path.dirname(path.dirname(CONFIG_PATH)), raw.envFile);
+        } catch (e) {
+          problems.push(e.message);
+        }
+      }
+      if (problems.length) throw new Error(`Invalid .local/config.yaml:\n${problems.join('\n')}`);
+      const deps = base.dependencies.map((d) => d.type);
+      logger.success(
+        `.local/config.yaml is valid: "${base.name}" on port ${base.port}` +
+        `${deps.length ? `, with ${deps.join(', ')}` : ''}${names.length ? `; environments: ${names.join(', ')}` : ''}.`,
+      );
+    });
+};

package/src/index.js

@@ -27,6 +27,8 @@ require('./commands/status')(app);
 require('./commands/logs')(app);
 require('./commands/reload')(app);
 require('./commands/generateManifests')(app);
+require('./commands/tiltConfig')(app);
+require('./commands/validate')(app);
 require('./commands/registryInfo')(app);
 require('./commands/exec')(app);
 require('./commands/prune')(app);

package/src/lib/addonDirs.js

@@ -1,7 +1,6 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { HOME_STATE_DIR } = require('./paths');
 
 // Addons are searched in two places, in precedence order:
 //   1. USER_DIR   - yours, never touched by a `localctl` update/reinstall. Defaults to
@@ -12,7 +11,7 @@ const { HOME_STATE_DIR } = require('./paths');
 // This is what lets someone install this tool without inheriting its author's addon set, and
 // without forking the tool to add their own - see docs/adding-tools.md.
 const BUILTIN_DIR = path.join(__dirname, 'addons');
-const USER_DIR = process.env.LOCALCTL_ADDONS_DIR || path.join(HOME_STATE_DIR, 'addons');
+const USER_DIR = process.env.LOCALCTL_ADDONS_DIR || path.join(os.homedir(), '.localctl', 'addons');
 
 function roots(...segments) {
   return [path.join(USER_DIR, ...segments), path.join(BUILTIN_DIR, ...segments)];

package/src/lib/addonLoader.js

@@ -24,22 +24,18 @@ function ensureRepo(url) {
 
 function substitute(template, vars) {
   return String(template).replace(/\{\{\s*([\w.]+)\s*\}\}/g, (match, key) => {
-    if (!(key in vars)) throw new Error(`Addon references unknown template variable "{{${key}}}"`);
+    if (!Object.prototype.hasOwnProperty.call(vars, key)) throw new Error(`Addon references unknown template variable "{{${key}}}"`);
     return vars[key];
   });
 }
 
-function ensureNamespace(ns) {
-  if (capture('kubectl', ['get', 'namespace', ns]).status !== 0) {
-    run('kubectl', ['create', 'namespace', ns], { stdio: 'ignore', allowFail: true });
-  }
-}
+const { ensureManagedNamespace: ensureNamespace } = require('./namespaces');
 
 // Generates each secret's value once and stores it as a real k8s Secret; a re-run that finds the
 // Secret already there leaves it alone, so app data doesn't lose its password out from under it
 // on every `localctl up`.
-function ensureSecret(name, namespace, keys) {
-  ensureNamespace(namespace);
+function ensureSecret(name, namespace, keys, owner) {
+  ensureNamespace(namespace, owner);
   if (capture('kubectl', ['get', 'secret', name, '-n', namespace]).status === 0) return;
   const args = ['create', 'secret', 'generic', name, '-n', namespace];
   for (const key of keys) {
@@ -50,8 +46,8 @@ function ensureSecret(name, namespace, keys) {
 
 // Turns a folder of literal files (dashboards, datasource definitions, init scripts - whatever
 // the chart expects to mount, not a Helm value) into a real ConfigMap.
-function ensureConfigMap(name, namespace, configDir) {
-  ensureNamespace(namespace);
+function ensureConfigMap(name, namespace, configDir, owner) {
+  ensureNamespace(namespace, owner);
   const files = fs.readdirSync(configDir).filter((f) => fs.statSync(path.join(configDir, f)).isFile());
   const args = ['create', 'configmap', name, '-n', namespace, '--dry-run=client', '-o', 'yaml'];
   files.forEach((f) => args.push(`--from-file=${path.join(configDir, f)}`));
@@ -62,8 +58,10 @@ function ensureConfigMap(name, namespace, configDir) {
 
 function helmTemplate(release, chart, valuesObj, namespace) {
   const repoName = ensureRepo(chart.repo);
-  const tmpValues = path.join(os.tmpdir(), `localctl-addon-values-${process.pid}-${Date.now()}.yaml`);
-  fs.writeFileSync(tmpValues, yaml.dump(valuesObj));
+  // A private directory (mode 0700): a predictable file name in /tmp could be swapped by another user.
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'localctl-addon-'));
+  const tmpValues = path.join(tmpDir, 'values.yaml');
+  fs.writeFileSync(tmpValues, yaml.dump(valuesObj), { flag: 'wx', mode: 0o600 });
   try {
     // --no-hooks: excludes `helm test` pods and similar hook resources from the rendered output -
     // we apply this YAML with plain `kubectl apply`, not `helm install`, so nothing would ever
@@ -76,7 +74,7 @@ function helmTemplate(release, chart, valuesObj, namespace) {
     }
     return res.stdout;
   } finally {
-    fs.rmSync(tmpValues, { force: true });
+    fs.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 
@@ -129,9 +127,31 @@ function buildAddonRecord({ release, namespace, addonName, chart, owner }) {
   };
 }
 
+// Writes a dependency's `resources:` into the chart values at the addon's `resourcesPath` (a dotted
+// path such as `primary.resources`). Set as an object, never through text substitution, so the
+// values can't change the YAML structure around them.
+function applyResources(valuesObj, resourcesPath, resources, addonName) {
+  if (!resourcesPath) {
+    throw new Error(
+      `The "${addonName}" addon can't take "resources" yet: its addon.yaml has no "resourcesPath" ` +
+      '(where the chart keeps its resources, e.g. primary.resources). See docs/adding-tools.md.',
+    );
+  }
+  const keys = resourcesPath.split('.');
+  if (keys.some((k) => ['__proto__', 'constructor', 'prototype'].includes(k))) {
+    throw new Error(`Invalid resourcesPath "${resourcesPath}" in the ${addonName} addon.`);
+  }
+  let node = valuesObj;
+  for (const key of keys.slice(0, -1)) {
+    if (typeof node[key] !== 'object' || node[key] === null) node[key] = {};
+    node = node[key];
+  }
+  node[keys[keys.length - 1]] = JSON.parse(JSON.stringify(resources));
+}
+
 // Loads one addon (given its folder) and returns the rendered manifest YAML, plus any env vars
 // it wants injected into the caller's own container (per-app addons only - see manifestGen.js).
-function loadAddon(addonDir, { release, namespace, addonName, owner, extraVars = {}, chartVersionOverride }) {
+function loadAddon(addonDir, { release, namespace, addonName, owner, extraVars = {}, chartVersionOverride, resources }) {
   const specPath = path.join(addonDir, 'addon.yaml');
   const spec = yaml.load(fs.readFileSync(specPath, 'utf8'));
 
@@ -140,19 +160,20 @@ function loadAddon(addonDir, { release, namespace, addonName, owner, extraVars =
 
   if (spec.secrets) {
     const secretName = `${release}-secret`;
-    ensureSecret(secretName, namespace, Object.keys(spec.secrets));
+    ensureSecret(secretName, namespace, Object.keys(spec.secrets), owner);
     vars.secretName = secretName;
   }
 
   const configDir = path.join(addonDir, 'config');
   if (spec.config && fs.existsSync(configDir)) {
     const configMapName = `${release}-config`;
-    ensureConfigMap(configMapName, namespace, configDir);
+    ensureConfigMap(configMapName, namespace, configDir, owner);
     vars.configMapName = configMapName;
   }
 
   const valuesYaml = substitute(spec.values, vars);
   const valuesObj = yaml.load(valuesYaml) || {};
+  if (resources) applyResources(valuesObj, spec.resourcesPath, resources, addonName || path.basename(addonDir));
   const manifestYaml = helmTemplate(release, chart, valuesObj, namespace);
   vars.serviceHost = findServiceHost(manifestYaml);
   const servicePort = findServicePort(manifestYaml);
@@ -187,4 +208,4 @@ function loadAddon(addonDir, { release, namespace, addonName, owner, extraVars =
   return { manifestYaml: fullManifestYaml, env, envFromSecret, connect };
 }
 
-module.exports = { loadAddon, substitute };
+module.exports = { loadAddon, substitute, applyResources };

package/src/lib/addons/mongo/addon.yaml

@@ -11,6 +11,8 @@ env:
   MONGO_HOST: "{{serviceHost}}"
   MONGO_PORT: "27017"
 
+resourcesPath: resources
+
 values: |
   auth:
     enabled: false

package/src/lib/addons/postgres/addon.yaml

@@ -26,8 +26,12 @@ envFromSecret:
     secret: "{{secretName}}"
     key: password
 
+# Where in the chart's values a dependency's `resources:` (cpu/memory requests and limits from the
+# app's config) are written. Charts differ, so each addon says where its main workload's live.
+resourcesPath: primary.resources
+
 # Passed to `helm template` as -f values.yaml. {{...}} is substituted first: {{database}}/
-# {{storage}}/{{version}} come from the app's own .local/config.json dependency entry (with
+# {{storage}}/{{version}} come from the app's own .local/config.yaml dependency entry (with
 # fallback defaults), {{secretName}} from the generated Secret above.
 values: |
   auth:

package/src/lib/addons/redis/addon.yaml

@@ -19,6 +19,8 @@ envFromSecret:
     secret: "{{secretName}}"
     key: password
 
+resourcesPath: master.resources
+
 values: |
   architecture: standalone
   auth: