Don't Panic — Kustomize

Kustomize is the part of Kubernetes configuration work that takes a pile of ordinary YAML and makes it less likely that three environments become three incompatible folk religions. It reads a directory, follows its kustomization.yaml, gathers resources, changes them by declared rules, and emits plain Kubernetes objects. There is no Kustomize creature waiting in the cluster to interpret them later.

The useful trick is the base and overlay pair. A base holds the shared shape. An overlay includes it and supplies the target-specific delta, such as a production image or label. This is less mystical than copying the whole application into a production directory and hoping future edits remember all three copies. The base does not know who uses it, which is a pleasantly firm boundary for a file system.

Most changes have a named tool before they need a general patch. Transformations handle common cross-cutting work such as labels, annotations, namespaces, names, and images. A patch changes a selected structure when those fields do not fit. A replacement copies one resource value into another. Choose the narrowest one, because patches run in order and overlapping patches make configuration into a small detective novel.

Generators add another useful wrinkle. A ConfigMap or Secret generator creates an object from files or literals, usually with a name suffix derived from its content. When the content changes, Kustomize can update recognized references to the new name. This helps a workload point at changed configuration. It does not encrypt a Secret, clean up old objects, or negotiate with reality on your behalf.

The important boundary is rendering. kustomize build and kubectl kustomize produce YAML. kubectl apply -k produces YAML and submits it. Neither result says the API server will admit it or that the workload will become healthy. Pin the renderer version, build every overlay, and inspect the rendered diff. The Cheatsheet names the fields and commands; the slides map the flow; the practice task turns that flow into a local test. After that, Kustomize is mostly visible configuration with a strict refusal to do the invisible bits for you.