45 lines
1.5 KiB
Markdown
45 lines
1.5 KiB
Markdown
# k8s/overlays AGENTS
|
|
|
|
Role:
|
|
- own environment-specific Kustomize composition
|
|
- express only the differences between environments and reusable bases
|
|
- make environment-level render, diff, apply, audit, and GitOps sync straightforward
|
|
|
|
Scope:
|
|
- `dev/`
|
|
- `staging/`
|
|
- `prod/`
|
|
|
|
Allowed:
|
|
- namespace selection
|
|
- replicas
|
|
- resource requests/limits overrides
|
|
- image tags or image references
|
|
- ingress host/TLS differences
|
|
- environment-specific patches
|
|
- environment-specific secret references
|
|
- storage class and retention differences
|
|
|
|
Forbidden:
|
|
- copying full base manifests into overlays
|
|
- redefining base resources wholesale without a clear environment-only reason
|
|
- placing production secret values in Git
|
|
- changing service ownership or workload kind without updating the base and standards
|
|
- mixing multiple environments in one overlay
|
|
|
|
Read first:
|
|
- `/docs/standards/infra/kustomize.md`
|
|
- `/docs/standards/infra/architecture-environments.md`
|
|
- `/docs/standards/infra/config-and-secrets.md`
|
|
- `/docs/standards/infra/network-ingress-tls.md`
|
|
- `/docs/standards/infra/resources-probes-availability.md`
|
|
- `/docs/standards/infra/security-hardening.md`
|
|
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
|
|
|
|
Rules:
|
|
- overlays are environment-first by design
|
|
- keep patches small and named by target and intent
|
|
- render and diff the target environment before apply
|
|
- prod overlays must be the most conservative environment
|
|
- if an overlay starts re-declaring most of a resource, move common shape back into `k8s/base`
|