<p>On a Kubernetes cluster, I have multiple <code>Deployment</code> resources. For security, I am using a sidecar proxy pattern where the <code>Service</code> will proxy traffic to the sidecar, which will ensure authentication before passing on to the deployed application.</p>
<p>I am trying to set up Kustomize to do this. Since the sidecar definition is likely environment specific, I don't want to include the sidecar in my base manifests, but would like it to be an overlay. Since I have multiple deployments that will need to attach that sidecar, it seemed appropriate to have the sidecar specification be a common shared component. This seemed like appropriate use of the Kustomize <code>Component</code> resource, but perhaps I'm wrong.</p>
<p>I have something similar to the following:</p>
<pre><code>.
├── base
│   ├── app1
│   │   ├── deployment.yaml
│   │   └── kustomization.yaml
│   ├── app2
│   │   ├── deployment.yaml
│   │   └── kustomization.yaml
│   └── app3
│       ├── deployment.yaml
│       └── kustomization.yaml
├── components
│   └── sidecar
│       ├── deployment-sidecar.yaml
│       └── kustomization.yaml
└── overlays
    └── dev
        └── kustomization.yaml
</code></pre>
<p>I'd like the sidecar component to be applied to the 3 app deployments, but I can't seem to find a way to do this. Am I misusing components here?</p>
<p>My <code>components/sidecar/kustomization.yaml</code> file looks like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

patches:
  - path: deployment-sidecar.yaml
    target:
      labelSelector: xxx
</code></pre>
<p>This works, however it specifies the target of the patch in the component, whereas I would like to leave the component more generic and instead specify the target in <code>overlays/dev</code>.</p>
<p>Is there a better way to be handling this? In summary, I want the overlay to be able to define when the sidecar should be added, and to which specific deployments to add it to.</p>

<blockquote>
<p>In summary, I want the overlay to be able to define when the sidecar should be added, and to which specific deployments to add it to.</p>
</blockquote>
<p>My first thought was that you could have a label that means &quot;apply the sidecar patch&quot;, and use that in the Component:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

patches:
  - path: deployment-sidecar.yaml
    target:
      labelSelector: &quot;inject-sidecar=true&quot;
</code></pre>
<p>And then in your overlay(s), use a patch to apply that label to specific deployments:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../base

components:
  - ../../sidecar

patches:
  - target:
      kind: Deployment
      labelSelector: &quot;app=app1&quot;
    patch: |
      - op: add
        path: /metadata/labels/inject-sidecar
        value: &quot;true&quot;
</code></pre>
<p>Unfortunately, this won't work because patches are applied <strong>after</strong> processing all resources and components.</p>
<p>We can still do this, but it requires an intermediate stage.  We can get that by creating another component inside the <code>dev</code> overlay that is responsible for applying the labels. In <code>overlays/dev/apply-labels/kustomization.yaml</code> you have a <code>kustomization.yaml</code> that contains the logic for applying the <code>inject-sidecar</code> label to specific Deployments (using a label selector, name patterns, or other criteria):</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

patches:
  - target:
      kind: Deployment
      labelSelector: &quot;app=app1&quot;
    patch: |
      - op: add
        path: /metadata/labels/inject-sidecar
        value: &quot;true&quot;
</code></pre>
<p>And then in <code>overlays/dev/kustomization.yaml</code> you have:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

components:
  - apply-labels
  - ../../components/sidecar
</code></pre>
<p>This gets you what you want:</p>
<ul>
<li>The sidecar patch is specified in a single place</li>
<li>Your overlay determines to which deployments you apply the sidecar patch</li>
</ul>
<p>There's a level of complexity here that is only necessary if:</p>
<ul>
<li>You have multiple overlays</li>
<li>You want to selectively apply the sidecar only to some deployments</li>
<li>You want the overlay to control to which deployments the patch is applied</li>
</ul>
<p>If any of those things aren't true you can simplify the configuration.</p>
