1.5 KiB
1.5 KiB
k8s/overlays AGENTS
Role:
- own environment-specific Kustomize composition
- express only the differences between environments and reusable bases
- make environment-level render, diff, apply, audit, and GitOps sync straightforward
Scope:
dev/staging/prod/
Allowed:
- namespace selection
- replicas
- resource requests/limits overrides
- image tags or image references
- ingress host/TLS differences
- environment-specific patches
- environment-specific secret references
- storage class and retention differences
Forbidden:
- copying full base manifests into overlays
- redefining base resources wholesale without a clear environment-only reason
- placing production secret values in Git
- changing service ownership or workload kind without updating the base and standards
- mixing multiple environments in one overlay
Read first:
/docs/standards/infra/kustomize.md/docs/standards/infra/architecture-environments.md/docs/standards/infra/config-and-secrets.md/docs/standards/infra/network-ingress-tls.md/docs/standards/infra/resources-probes-availability.md/docs/standards/infra/security-hardening.md/docs/standards/infra/operations-runbook-upgrade-rollback.md
Rules:
- overlays are environment-first by design
- keep patches small and named by target and intent
- render and diff the target environment before apply
- prod overlays must be the most conservative environment
- if an overlay starts re-declaring most of a resource, move common shape back into
k8s/base