<p>A common requirement when deploying Kubernetes manifests to a cluster is to prefix the container names with a trusted registry prefix that mirrors the allowed images. Usually used along with an admission controller.</p>
<p>Is there a sensible way to do this using Kustomize without having to list every single image by name in the <code>kustomization.yaml</code> <code>images:</code> transformer stanza?</p>
<p>Given this <code>kustomization.yaml</code>:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - &quot;https://github.com/prometheus-operator/kube-prometheus&quot;
</code></pre>
<p>if I want to prefix all the images it references with <code>mytrusted.registry/</code> I need to append this to my <code>kustomization.yaml</code>:</p>
<pre><code>images:
- name: grafana/grafana
  newName: mytrusted.registry/grafana/grafana
- name: jimmidyson/configmap-reload
  newName: mytrusted.registry/jimmidyson/configmap-reload
- name: k8s.gcr.io/kube-state-metrics/kube-state-metrics
  newName: mytrusted.registry/k8s.gcr.io/kube-state-metrics/kube-state-metrics
- name: k8s.gcr.io/prometheus-adapter/prometheus-adapter
  newName: mytrusted.registry/k8s.gcr.io/prometheus-adapter/prometheus-adapter
- name: quay.io/brancz/kube-rbac-proxy
  newName: mytrusted.registry/quay.io/brancz/kube-rbac-proxy
- name: quay.io/prometheus/alertmanager
  newName: mytrusted.registry/quay.io/prometheus/alertmanager
- name: quay.io/prometheus/blackbox-exporter
  newName: mytrusted.registry/quay.io/prometheus/blackbox-exporter
- name: quay.io/prometheus/node-exporter
  newName: mytrusted.registry/quay.io/prometheus/node-exporter
- name: quay.io/prometheus-operator/prometheus-operator
  newName: mytrusted.registry/quay.io/prometheus-operator/prometheus-operator
- name: quay.io/prometheus/prometheus
  newName: mytrusted.registry/quay.io/prometheus/prometheus
</code></pre>
<p>which I generated with this putrid, fragile monstrosity (which WILL break if your containers are specified by hash, or you have a port in your registry prefix):</p>
<pre><code>kustomize build | \
  grep 'image:' | \
  awk '$2 != &quot;&quot; { print $2}' | \
  sort -u | \
  cut -d : -f 1 | \
  jq --raw-input '{ name: ., newName: (&quot;mytrusted.registry/&quot; + .) }' | \
  faq -s -fjson -oyaml '{ images: .}' 
</code></pre>
<p>(Note that the above will also NOT WORK completely, because Kustomize doesn't recognise images outside <code>PodTemplate</code>s, such as those in the <code>kind: Alertmanager</code> <code>spec.image</code> or the <code>kind: Prometheus</code> <code>spec.image</code>; it'd still be better than the current situation).</p>
<p>What I want instead is to able to express this in the image transformer without generating and maintaining lists of images, with something like the <strong>imaginary, does not work example</strong>:</p>
<pre><code>images:
  - name: &quot;(*)&quot;
    newName: &quot;mytrusted.registry/$1&quot;
</code></pre>
<p>i.e. use a capture group. Or something functionally similar, like an image transformer &quot;prependName&quot; option or similar.</p>
<p>This must be such a common problem to have, but I can't for the life of me find a well established way this is done by convention in the k8s world. Just lots of DIY fragile hacks.</p>

Craig Ringer
<p>This answer is probably too late to help the original asker, but maybe it will help others who stumble upon this question through Google, like I did.</p>
<p>Kustomize has a built-in <code>PrefixTransformer</code> that can add a prefix to all your images, or indeed to any arbitrary field in your specs.</p>
<p>Create a file named <code>image-prefix.yaml</code> with the following contents:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: builtin
kind: PrefixTransformer
metadata:
  name: image-prefix

prefix: mytrusted.registry/

fieldSpecs:
- path: spec/template/spec/containers/image
- path: spec/template/spec/initContainers/image
- path: spec/image  # for kind Prometheus and Alertmanager
</code></pre>
<p>Then add this transformer to your <code>kustomization.yaml</code> as follows:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- &quot;https://github.com/prometheus-operator/kube-prometheus&quot;

transformers:
- image-prefix.yaml
</code></pre>
<p>That should do it.</p>
<p>When you build this, you should see your prefix automatically added to all the images:</p>
<pre class="lang-bash prettyprint-override"><code>$ kubectl kustomize | grep image:
...
        image: mytrusted.registry/quay.io/prometheus/blackbox-exporter:v0.22.0
        image: mytrusted.registry/jimmidyson/configmap-reload:v0.5.0
        image: mytrusted.registry/quay.io/brancz/kube-rbac-proxy:v0.13.0
        image: mytrusted.registry/grafana/grafana:my-tag
        image: mytrusted.registry/k8s.gcr.io/kube-state-metrics/kube-state-metrics:v2.6.0
...
</code></pre>
<p>I tested this with <code>kubectl</code> 1.25 and the version of Kustomize that comes bundled with it:</p>
<pre class="lang-bash prettyprint-override"><code>$ kubectl version --short --client
...
Client Version: v1.25.0
Kustomize Version: v4.5.7
</code></pre>
<p>You can further restrict the <code>PrefixTransformer</code> by using GVK (group/version/kind) triplets. For example, if for some reason you wanted to apply your image prefix only to Deployments, but not to DaemonSets, StatefulSets, or others, you would put something like this in your <code>image-prefix.yaml</code> file:</p>
<pre class="lang-yaml prettyprint-override"><code>fieldSpecs:
- kind: Deployment
  path: spec/template/spec/containers/image
- kind: Deployment
  path: spec/template/spec/initContainers/image
</code></pre>
<p>Also note that the <code>ImageTransformer</code> runs before the <code>PrefixTransformer</code>, so if you wanted to override the tag of a particular image in your <code>kustomization.yaml</code>, you should use the original image name without the prefix:</p>
<pre class="lang-yaml prettyprint-override"><code>images:
- name: grafana/grafana
  newTag: my-tag
</code></pre>
<p>Unfortunately there is no clear documentation for <code>PrefixTransformer</code> that I could find, or I would have linked it here. I discovered all this by digging through Kustomize source code.</p>
<p>There are quite a few other built-in transformers that might be of interest, you can glean their usage by looking at the <code>*_test.go</code> files in each of the subfolders here:</p>
<p><a href="https://github.com/kubernetes-sigs/kustomize/tree/master/plugin/builtin" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/kustomize/tree/master/plugin/builtin</a></p>
