Skip to content

Room 43

KUSTOMIZE

The Overlay Workshop

  • Kustomize patches YAML without templates. Base + overlays = customized deployments.
  • Apply overlays to transform a base deployment and reveal the password.

📜 Mission Briefing

  1. Examine the base/ directory - contains a deployment and service.
  2. Examine the overlays/production/ directory - patches the base.
  3. Build and apply: kubectl apply -k overlays/production/.
  4. The production overlay adds an annotation with the password.
  5. The password is kustomiz.
Key Commands
Command Purpose
kubectl apply -k DIR Apply a kustomization
kubectl kustomize DIR Preview without applying
kustomize build DIR Build with standalone kustomize
How Kustomize Works
# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml
commonLabels:
  app: my-app

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../base
namePrefix: prod-
namespace: production
commonAnnotations:
  escape-password: "kustomiz"
patches:
  - target:
      kind: Deployment
      name: my-app
    patch: |
      - op: replace
        path: /spec/replicas
        value: 5
images:
  - name: nginx
    newTag: "1.25"

# Kustomize structure:
# base/                    # Shared manifests
#   kustomization.yaml
#   deployment.yaml
#   service.yaml
# overlays/
#   dev/                   # Dev customization
#     kustomization.yaml
#   production/            # Prod customization
#     kustomization.yaml

# Kustomize features:
# namePrefix/nameSuffix: Add prefix/suffix to names
# namespace:            Set namespace for all resources
# commonLabels:         Add labels to all resources
# commonAnnotations:    Add annotations to all resources
# images:               Override image tags
# patches:              Strategic merge or JSON patches
# configMapGenerator:   Generate ConfigMaps
# secretGenerator:      Generate Secrets

# Preview
kubectl kustomize overlays/production/

# Apply
kubectl apply -k overlays/production/

# Kustomize vs Helm:
# Kustomize: Template-free, patch-based, built into kubectl
# Helm: Full templating engine, package management, release tracking
Hints

Hint 1

kubectl kustomize overlays/production/  # Preview
kubectl apply -k overlays/production/

Hint 2

Check the annotations on the deployed resources: 

kubectl get deploy -n production -o jsonpath='{.items[0].metadata.annotations}'

Hint 3

The password is kustomiz.

🔓 Unlock Room 44

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_44/README -out ../room_44/README.txt -pass pass:PASSWORD
cat ../room_44/README.txt