Architecture
Overlay model
Generic base, per-environment overlay. The diff between dev and prod should fit in a review.
Kustomize splits what is shared from what is this environment.
<service>/
base/ # generic deployment, service, ingress
kustomization.yaml
overlays/
dev/
stg/
prod/
The base declares resources with a placeholder image (:latest or an internal name). Labels, ports, and probes live here. No production hostname. No real tag.
The overlay does three things, and almost only those:
images:newName+newTagfor the registry and that environment’s tag.- patches: env vars, replicas, resources, HPA/PDB in prod.
- ingress or HTTPRoute hosts.
Boring environment names on purpose
Use a closed set: dev, hom / stg, prod. Do not invent prod2 because the cluster is different — the ApplicationSet destination changes, not the overlay vocabulary.
What an overlay is not
It is not a fork of the whole deployment. If the overlay file grows until it duplicates the base, the model broke: move the shared bits back and leave only the delta.
Secrets are not overlays. Credentials belong in a cluster Secret (pre-created, Sealed Secrets, External Secrets, Vault). The overlay at most references the Secret name.
Review
A PR that only changes images.newTag is an image bump. A PR that touches hostname, replicas, and env is an environment change. Both should be obvious in the diff. If they are not, the overlay is doing too much.