<p>I'm working on this cloud project where we have several development repositories in GitHub and in each we have the overlays containing config files that are specific for a local K8S cluster, a dev Azure cluster and a prod Azure cluster.</p>
<p>In order to have different repos for these envs we use a repo with a kustomization file for each service that fetches the overlay of the dev/test/prod and uses it as it's base.</p>
<p>However the issue is managing this resources since we don't want to share the dev repos to possible clients or other end users in order for them to deploy these services into their K8S environment but not giving them permissions will imply that they will not be able to fetch these overlays and bases and deploy them.</p>
<p>What is the best practice in order to have a protected and restrictive dev repos and yet be able to do the deployment operation?</p>
<p>I know this is a abstract question but I've never dealt with organization of repos in a scale like this.</p>

Fábio Caramelo
<p>To clarify I am posting Community Wiki answer.</p>
<p>The solution you suggested in comment's section:</p>
<blockquote>
<p>We will have the deployments/namespaces/services manifests in the same repo as the application source code as well the an overlay with a customization with the necessary resources to fully deploy in the dev environment.</p>
<p>As for test/ prod environments we created a structure to add an overlay per app with the same resource files but with the env details in the files to be used as configmaps.</p>
<p>And a customization using the dev repository as the base. Unfortunately this will imply that the cluster admin will have access to all repos of an application.</p>
</blockquote>
