{"id":15089286,"url":"https://github.com/angelcamposm/kustomize-iac-skeleton","last_synced_at":"2026-01-26T19:37:18.484Z","repository":{"id":252534069,"uuid":"840704925","full_name":"angelcamposm/kustomize-iac-skeleton","owner":"angelcamposm","description":"This repository provides a foundational structure for Kubernetes deployments, serving as a starting point for rapid application deployment.","archived":false,"fork":false,"pushed_at":"2024-08-17T01:13:24.000Z","size":95,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-04T10:22:32.373Z","etag":null,"topics":["deployment","devops","kubernetes","kustomization","kustomize","skeleton","yaml","yamlfmt","yamllint"],"latest_commit_sha":null,"homepage":"","language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/angelcamposm.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"angelcamposm"}},"created_at":"2024-08-10T12:37:35.000Z","updated_at":"2024-08-17T01:13:27.000Z","dependencies_parsed_at":"2024-09-29T23:01:02.930Z","dependency_job_id":null,"html_url":"https://github.com/angelcamposm/kustomize-iac-skeleton","commit_stats":{"total_commits":51,"total_committers":2,"mean_commits":25.5,"dds":"0.039215686274509776","last_synced_commit":"7605b3b368c62973ddbc7fa3ffe580e04df6ed8b"},"previous_names":["angelcamposm/kustomize-iac-skeleton"],"tags_count":0,"template":true,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelcamposm%2Fkustomize-iac-skeleton","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelcamposm%2Fkustomize-iac-skeleton/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelcamposm%2Fkustomize-iac-skeleton/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelcamposm%2Fkustomize-iac-skeleton/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/angelcamposm","download_url":"https://codeload.github.com/angelcamposm/kustomize-iac-skeleton/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239785294,"owners_count":19696749,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["deployment","devops","kubernetes","kustomization","kustomize","skeleton","yaml","yamlfmt","yamllint"],"created_at":"2024-09-25T08:44:17.117Z","updated_at":"2026-01-26T19:37:18.447Z","avatar_url":"https://github.com/angelcamposm.png","language":"Makefile","funding_links":["https://github.com/sponsors/angelcamposm"],"categories":[],"sub_categories":[],"readme":"# kustomize-iac-skeleton\n\n[Kustomization](https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/) Skeleton Repository\n\n* [About](#about)\n* [Benefits of using Kustomize](#benefits-of-using-kustomize)\n* [Best Practices](#best-practices)\n* [Structure](#structure)\n* [Usage](#usage)\n\t- [Build](#build-resources)\n\t- [Format](#format-yaml-resources)\n\t- [Lint](#lint-project-resources)\n\t- [Scan](#security-scan)\n\t- [Validate](#validate-resources)\n* [Contributing](#contributing)\n* [Changelog](#changelog)\n* [Requirements](#requirements)\n* [Maintainers](#maintainers)\n\n## About\n\nThis repository provides a foundational structure for Kubernetes deployments, serving as a starting point for rapid application deployment. It includes a pre-configured Kustomization overlay with essential resources like Deployments, Services, ConfigMaps, and Secrets, providing a solid base for building complex applications.\n\nThink of this as a \"skeleton\" of your [Kubernetes](https://kubernetes.io) infrastructure, ready to be fleshed out with your specific application requirements. Customize and extend the provided resources to match your application needs without starting from scratch.\n\nBy leveraging this repository, you can significantly accelerate your deployment cycles while maintaining consistency and best practices.\n\nKey Features:\n\n- Pre-configured Kustomization overlay\n- Essential Kubernetes resource templates\n- Flexible and customizable structure\n- Clear documentation and examples\n- Promotes best practices for Kubernetes deployments\n\n## Benefits of using Kustomize\n\nBelow are some of the benefits of Kustomize.\n\n1. **Simplified Configuration Management**:  \nKustomize is easy to use and allows you to manage and customize your Kubernetes configurations in a structured and modular way.\n\n2. **Reusability**:  \nKustomize allows you to reuse one base file across all of your environments (development, staging, production) and then overlay unique specifications for each.\n\n3. **Version Control**:  \nKustomize files are plain text files, so you can use a `git` repository to version control your Kubernetes configurations, making it easier to track changes and roll back to previous versions when necessary.\n\n4. **Template Free**:  \nKustomize provides a solution for customizing Kubernetes resource configuration free from templates and DSLs. Only raw `YAML` files.\n\n5. **Extendability**:  \nKustomize has buil-in transformers to modify resources and It can be extended with a plug-in mechanism.\n\n6. **Easier to Debug**  \nYAML itself is easy to understand and debug when things go wrong. Pair that with the fact that your configurations are isolated in patches, and you’ll be able to triangulate the root cause of performance issues in no time. Simply compare performance to your base configuration and any other variations that are running.\n\n## Best Practices\n\nHere are some [Kustomize](https://github.com/kubernetes-sigs/kustomize) best practices:\n\n1. Keep base resources, overlays and patches in separate directories. This helps us to maintain clarity between different configurations.\n2. Adhere to Kubernetes best practices.\n3. Keep the common resources like `Namespace` resource in the `base` directory.\n4. Before deploying your Kustomize IaC, validate It.\n\n\n## Structure\n\n```text\n.\n├── base\n│   ├── resources\n│   └── kustomization.yaml\n├── components\n├── config\n│   └── dev\n├── overlays\n│   ├── dev\n│   │   ├── patches\n│   │   ├── replacements\n│   │   ├── resources\n│   │   └── kustomization.yaml\n│   └── pro\n│       ├── patches\n│       ├── replacements\n│       ├── resources\n│       └── kustomization.yaml\n├── .editorconfig\n├── .gitattributes\n├── .gitignore\n├── .trivy.yaml\n├── .yamlfmt.yaml\n├── .yamllint.yaml\n├── CHANGELOG.md\n├── CITATION.cff\n├── CODE_OF_CONDUCT.md\n├── CODEOWNERS\n├── CONTRIBUTING.md\n├── LICENSE.md\n├── Makefile\n├── NOTICE\n├── README.md\n├── SECURITY.md\n└── STYLE.md\n```\n\n### base\n\nSpecifies the most common resources for the project.\n\nAs a good practice, the `base` layer can't contains any patches.\n\n### components\n\nThe `components` directory contains any [Kustomize component](https://kubectl.docs.kubernetes.io/guides/config_management/components/) that is agnostic from any environment and adds capabilities for an specific environment.\n\nAny component created inside this directory, can be referenced using `components` node in the Kustomization file in any overlay.\n\n### config\n\nThe `config` directory in the root of the project, holds each of the layers and resources generated in the build process with the `make build` command. \n\nEach of the layers in this directory gives us an idea of the final result of the build process and allows us to review what will be applied using the `kubectl apply -k config/\u003coverlay\u003e` command.\n\n###  overlays\n\nThe `overlays` directory holds environment-specific settings. Within this directory there are as many overlays as required environments.\n\nIn an overlay, there are 3 directories:\n\n- patches\n- replacements\n- resources\n\n#### patches\n\nThe `patches` directory holds any file that can add or override fields on resources.\n\nAny file created inside this directory, can be referenced using `patches` node in the Kustomization file.\n\n```yaml\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\n\npatches:\n  - path: patches/update-revision-history-limit-patch.yaml\n    target:\n      group: apps\n      kind: Deployment\n      version: v1\n```\n\n#### replacements\n\nThe `replacements` directory holds any file that are used to copy fields from one source into any number of specified targets.\n\nAny file created inside this directory, can be referenced using `replacements` node in the Kustomization file.\n\n```yaml\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\n\nreplacements:\n  - replacements/update-revision-history-limit-patch.yaml\n```\n\n#### resources\n\nThe `resources` directory holds any new resource that must be included in the overlay.\n\nAny file created inside this directory, can be referenced using `resources` node in the Kustomization file.\n\n```yaml\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\n\nresources:\n  - resources/pvc.yaml\n```\n\n## Usage\n\n### Build resources\n\nFor build all overlays, you can execute `make build` command. We use [kustomize](https://github.com/kubernetes-sigs/kustomize) tool under the hood.\n\n```shell\nmake build\n```\n\nThis command will launch a build process that will build all the overlays present in the `overlays/` directory and store the generated resources in the `config/` directory.\n\n```text\nCheck for installed tools\n - kustomize [OK]\n\nBuild all overlays for the project\n\nBuilding DEV overlay\n - Create config directory for DEV overlay\n - Running kustomize build on dev overlay\n\n\nBuilding PRO overlay\n - Create config directory for PRO overlay\n - Running kustomize build on pro overlay\n\n\u003e\u003e\u003e build process finished \u003c\u003c\u003c\n```\n\n### Format YAML resources\n\nYou can run code formatters to format YAML files to a standarized format. We use [yamlfmt](https://github.com/google/yamlfmt) tool under the hood.\n\n```shell\nmake format\n```\n\n```text\nCheck for installed tools\n - yamlfmt [OK]\n\nRunning YAML formatters on all resources using yamlfmt\n\u003e\u003e\u003e YAML format finished \u003c\u003c\u003c\n```\n\n### Lint project resources\n\nYou can lint all YAML files to check syntax and correct problems such as lines length, trailing spaces, indentation, etc. We use [yamllint](https://github.com/adrienverge/yamllint) tool under the hood.\n\n```shell\nmake lint\n```\n\nThis output will be printed on successful lint.\n\n```text\nCheck for installed tools\n - yamllint [OK]\n\nRunning linters on all resources using yamllint\n\u003e\u003e\u003e lint process finished \u003c\u003c\u003c\n```\n\nThis output will be printed on when lint fails.\n\n```text\nCheck for installed tools\n - yamllint [OK]\n\nRunning linters on all resources using yamllint\n./config/pro/apps_v1_deployment_my-awesome-application.yaml\n  1:1       warning  found forbidden document start \"---\"  (document-start)\n  56:13     error    trailing spaces  (trailing-spaces)\n  95:41     error    no new line character at the end of file  (new-line-at-end-of-file)\n\n\u003e\u003e\u003e lint process finished \u003c\u003c\u003c\n```\n\n### Security Scan\n\nYou can run security scans on your IaC YAML files to find vulnerabilities and IaC misconfigurations, SBOM discovery, Kubernetes security risks, and much more. \n\nWe use [trivy](https://github.com/aquasecurity/trivy) tool under the hood.\n\n```shell\nmake scan\n```\n\nThis output will be printed when no problem is found in your IaC resources.\n\n```text\nCheck for installed tools\n - trivy [OK]\n\nRunning security scan on all resources using trivy\n2024-08-16T14:44:00+02:00       INFO    [vuln] Vulnerability scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [misconfig] Misconfiguration scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [secret] Secret scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning\n2024-08-16T14:44:00+02:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.54/docs/scanner/secret#recommendation for faster secret detection      \n2024-08-16T14:44:01+02:00       INFO    Number of language-specific files       num=0\n2024-08-16T14:44:01+02:00       INFO    Detected config files   num=7\n\u003e\u003e\u003e security scan finished \u003c\u003c\u003c\n\n```\n\nThis output will be printed on when [trivy](https://trivy.dev) founds any issue.\n\n```text\nCheck for installed tools\n - trivy [OK]\n\nRunning security scan on all resources using trivy\n2024-08-16T14:44:00+02:00       INFO    [vuln] Vulnerability scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [misconfig] Misconfiguration scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [secret] Secret scanning is enabled\n2024-08-16T14:44:00+02:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning\n2024-08-16T14:44:00+02:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.54/docs/scanner/secret#recommendation for faster secret detection      \n2024-08-16T14:44:01+02:00       INFO    Number of language-specific files       num=0\n2024-08-16T14:44:01+02:00       INFO    Detected config files   num=7\n\npro/apps_v1_deployment_my-awesome-application.yaml (kubernetes)\n\nTests: 95 (SUCCESSES: 94, FAILURES: 1, EXCEPTIONS: 0)\nFailures: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)\n\nLOW: Container 'my-app' of Deployment 'my-awesome-application' should set 'securityContext.runAsUser' \u003e 10000\n══════════════════════════════════════════════════════════════════════════════════════════════════════════════════\nForce the container to run with user ID \u003e 10000 to avoid conflicts with the host’s user table.\n\nSee https://avd.aquasec.com/misconfig/ksv020\n──────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n pro/apps_v1_deployment_my-awesome-application.yaml:51-104\n──────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n  51 ┌       - args:\n  52 │         - infinity\n  53 │         command:\n  54 │         - sleep\n  55 │         env:\n  56 │         - name: APP_NAME\n  57 │           value: my-awesome-application\n  58 │         - name: POD_NAME\n  59 └           valueFrom:\n  ..   \n──────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n\u003e\u003e\u003e security scan finished \u003c\u003c\u003c\n\n```\n\n### Validate resources\n\nTo validate the resources generated through the build process with `make validate` command, we use [kubeconform](https://github.com/yannh/kubeconform) tool under the hood.\n\n```shell\nmake validate\n```\n\nThis output will be printed on successful validation.\n\n```text\nCheck for installed tools\n - kubeconform [OK]\n\nValidating all resources using Kubeconform\n - DEV\n\nValidating DEV overlay resources\n{\n  \"resources\": [],\n  \"summary\": {\n    \"valid\": 4,\n    \"invalid\": 0,\n    \"errors\": 0,\n    \"skipped\": 0\n  }\n}\n```\n  \nThis output will be printed on failed validation.\n\n```text\nCheck for installed tools\n - kubeconform [OK]\n\nValidating all resources using Kubeconform\n - DEV\n\nValidating DEV overlay resources\n{\n  \"resources\": [\n    {\n      \"filename\": \"config/dev/apps_v1_deployment_my-awesome-application.yaml\",\n      \"kind\": \"Deployment\",\n      \"name\": \"my-awesome-application\",\n      \"version\": \"apps/v2\",\n      \"status\": \"statusError\",\n      \"msg\": \"could not find schema for Deployment\"\n    }\n  ],\n  \"summary\": {\n    \"valid\": 3,\n    \"invalid\": 0,\n    \"errors\": 1,\n    \"skipped\": 0\n  }\n}\n```\n\n## Contributing\n\nPlease see [CONTRIBUTING.md](https://github.com/angelcamposm/kustomize-iac-skeleton/CONTRIBUTING.md) for more details.\n\n## Changelog\n\nThe changelog is available on [CHANGELOG.md](https://github.com/angelcamposm/kustomize-iac-skeleton/CHANGELOG.md).\n\n## Requirements\n\nThese are the tools needed to take advantage of the full potential of this skeleton package.\n\n- [kustomize](https://github.com/kubernetes-sigs/kustomize) \u003csup\u003e(required)\u003c/sup\u003e\n- [kubeconform](https://github.com/yannh/kubeconform) (Only required if you will validate kubernetes resources with this tool)\n- [make](https://www.gnu.org/software/make/) (Only required if you run make commands)\n- [python3](https://www.python.org/) (Only required if you run lint over YAML files)\n- [trivy](https://github.com/aquasecurity/trivy) (Only required if you run security scans over your IaC generated resources)\n- [yamlfmt](https://github.com/google/yamlfmt) (Only required if you run format over YAML files)\n- [yamllint](https://github.com/adrienverge/yamllint) (Only required if you run lint over YAML files)\n\n## Maintainers\n\n- 🧑‍💻 Angel Campos Muñoz\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelcamposm%2Fkustomize-iac-skeleton","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fangelcamposm%2Fkustomize-iac-skeleton","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelcamposm%2Fkustomize-iac-skeleton/lists"}