Kustomize
repository·master·Indexed 11 days ago
https://github.com/kubernetes-sigs/kustomizeA tool for customizing raw, template-free YAML files for Kubernetes. It uses a base and overlay pattern to manage multiple environment configurations (such as dev, staging, and prod) by applying patches, name prefixes, and common labels to a common base without modifying original files.
What's inside Kustomize
- kustomize is a tool for customizing raw, template-free YAML files for Kubernetes. It allows you to modify Kubernetes API objects using patches and other customization rules without altering the original source YAML files. This makes it possible to maintain a clean 'base' configuration while generating environment-specific variants.
Overview of Kustomize Go Modules
masterThe Kustomize repository is organized into several semantically versioned Go modules:
Module Purpose apiHigh-level Kustomize code suitable for import by other programs (e.g., kubectl). Containskrusty,filters,loader, andresmapkustomizeThe main CLI entry point containing main.goand Cobra command implementationskyamlA Kubernetes-focused enhancement of go-yamlused for low-level YAML manipulation and RNode handlingcmd/configProvides Unix-like file manipulation commands (like grepandtree) for Kubernetes YAML filesWhat is a Kustomization file?
masterThekustomization.yamlfile serves as the primary entry point for Kustomize execution. It defines the configuration, resources, and transformations (such as patches, generators, and transformers) that Kustomize should apply to a set of Kubernetes resources during the build process.What is Kustomize and how does it work?
masterKustomize is a tool for customizing Kubernetes resource configurations without using templates or Domain Specific Languages (DSLs). It works by taking raw, template-free YAML files and applying customizations to them while leaving the original files untouched.
Key characteristics:
- Template-free: You work with standard Kubernetes API objects rather than complex templating engines.
- Patch-based: It uses patches to introduce environment-specific changes to existing standard configuration files.
- Declarative: Like
make, what Kustomize does is declared in a configuration file. - Transformation-oriented: Like
sed, it emits edited text (YAML) based on the input and instructions.
The Kustomize build lifecycle and ordering
masterKustomize processes a kustomization file in a specific sequence of stages. Understanding this order is critical for predicting how resources are modified:
- Process
resources: Kustomize reads the YAML files or hydrates recursive kustomizations to create the initial list of input objects. - Process
generators: Kustomize executes generators, adding the newly created KRM objects to the resource list. - Process
transformers: Kustomize applies transformers to modify, add, remove, or reorder the current list of objects. - Process
validators: Kustomize runs validators to check the final list for errors. Validators can fail the build but are intended to be non-mutating.
- Process
How Validator Plugins work in Kustomize
masterA Validator Plugin is a specialized plugin type used to validate the resulting YAML output of a Kustomize build. Unlike transformers, validators are intended to inspect resources rather than modify them.
Key Assumptions and Constraints
- Input/Output: Resources are passed to the plugin via
stdin. The plugin must write the validated resources tostdout. If no changes are needed, the plugin can print nothing tostdout. - Configuration: The plugin's configuration file is passed as the first argument.
- Working Directory: The plugin's working directory is the
kustomizationdirectory where it is being invoked. - Modification Restrictions: Validators cannot modify the input YAML content. The only permitted modification is adding a label named
validated-by(case-sensitive) to the top-level resources. Any other modifications will cause Kustomize to throw an error. - Failure Signaling: A non-zero exit code from the plugin indicates a validation failure. Kustomize will treat this as a build error and report the
stderroutput.
You can implement validators using either an
execplugin (e.g., a bash script) or a Go plugin.- Input/Output: Resources are passed to the plugin via
Understand the `kustomize localize` command
masterThekustomize localizecommand is designed to download all remote resources referenced in a kustomization file and save them into a local directory. This allows a kustomization layer to become self-contained, making it possible to version control a fully localized directory without relying on external network calls duringkustomize build.Perform partial string replacements with delimiter and index
masterYou can perform partial string replacements by splitting a field value and replacing a specific segment.
Use the
optionsobject withinsourceortargetsto configure this:delimiter: The string used to split the field.index: The position in the split array to replace (default is0).
Behavioral Notes:
- In a Source: If the
indexis out of bounds, Kustomize throws an error. - In a Target: If the
indexis less than 0, the value is prefixed. If theindexis beyond the length of the split, the value is suffixed.
# If source value is 'path/to/VALUE' options: delimiter: '/' index: 2 # Resulting target value: 'path/to/NEW_VALUE'Use inline patches in kustomization files
masterSince version 3.2.0, Kustomize supports 'inline patches', allowing you to define patch content directly within the
kustomization.yamlfile as a single string using the|-YAML block scalar. This eliminates the need to manage separate patch files for simple modifications.There are three primary ways to apply patches in a
kustomization.yamlfile:patchesStrategicMerge: A list of patches parsed as Strategic Merge Patches.patchesJSON6902: A list of JSON Patches that must include an associatedtarget. Each patch can only be applied to one target resource.patches: A flexible list of patches and their associated targets. Kustomize automatically detects whether the provided patch is a Strategic Merge Patch or a JSON Patch. This method allows a single patch to be applied to multiple objects.
How globbing works in Kustomize
masterKustomize does not support globbing (e.g.,
*.yaml) directly insidekustomizationfiles duringkustomize build. This prevents the configuration from depending on the local file system state in an undeclared way.Instead, you should use
kustomize editcommands that accept globbed arguments. These commands expand the globs at edit time relative to your local file system and write the resulting explicit filenames into thekustomizationfile. This preserves the requirement that all resources are explicitly declared in version control.Use patchStrategicMerge for Kubernetes resources
masterA
patchStrategicMerge(SMP) is a strategic-merge-style patch that uses an incomplete YAML specification of a Kubernetes resource. It includesTypeMetafields (group, version, kind, name) to identify the target resource, followed by the specific fields you wish to change (e.g., an image tag).Key Behaviors:
- Default Behavior: By default, an SMP replaces values. This is ideal for simple strings but may not be the intended behavior for lists.
- Directives: You can change the default replacement behavior by adding a directive to the YAML patch. Supported directives are:
replace(the default)delete
- Custom Resources: For custom resources, SMPs are treated as JSON Merge Patches.
- Flexibility: Any valid resource file can be used as an SMP; it will overwrite matching fields in a target resource with the same group/version/kind/name while leaving all other fields untouched.
Kustomization file field change policy
masterKustomize manages changes to the
kustomization.yamlschema using the following rules:- Meaning: A field's semantic meaning cannot be changed.
- Deprecation: A field may be marked as deprecated. This triggers a minor (semver) version bump in the Go API. The tool will provide a migration path via a non-fatal error message.
- Removal: A field may be removed. This triggers a major (semver) version bump in the Go API. If an encounter with a removed field occurs, the tool will return a fatal error.