<p>Any ideas how can I replace variables via Kustomize? I simply want to use a different ACCOUNT_ID and IAM_ROLE_NAME for each overlay.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::${ACCOUNT_ID}:role/${IAM_ROLE_NAME}
</code></pre>
<p>Thanks in advance!</p>

cosmos-1905-14
<p>Kustomize doesn't use &quot;variables&quot;. The way you would typically handle this is by patching the annotation in an overlay. That is, you might start with a base directory that looks like:</p>
<pre><code>base
├── kustomization.yaml
└── serviceaccount.yaml
</code></pre>
<p>Where <code>serviceaccount.yaml</code> contains your <code>ServiceAccount</code> manifest:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
    name: my-service-account
    annotions:
      eks.amazonaws.com/role-arn: &quot;THIS VALUE DOESN'T MATTER&quot;
</code></pre>
<p>And <code>kustomization.yaml</code> looks like:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: my-namespace

resources:
  - serviceaccount.yaml
</code></pre>
<p>Then in your overlays, you would replace the <code>eks.amazonaws.com/role-arn</code> annotation by using a patch. For example, if you had an overlay called <code>production</code>, you might end up with this layout:</p>
<pre><code>.
├── base
│   ├── kustomization.yaml
│   └── serviceaccount.yaml
└── overlay
    └── production
        ├── kustomization.yaml
        └── patch_aws_creds.yaml
</code></pre>
<p>Where <code>overlay/production/patch_aws_creds.yaml</code> looks like:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::1234:role/production-role
</code></pre>
<p>And <code>overlay/production/kustomization.yaml</code> looks like:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../base

patches:
  - patch_aws_creds.yaml
</code></pre>
<p>With this in place, running...</p>
<pre><code>kustomize build overlay/production
</code></pre>
<p>...would generate output using your production role information, and so forth for any other overlays you choose to create.</p>
<hr />
<p>If you don't like the format of the strategic merge patch, you can use a json patch document instead. Here's what it would look like inline in your <code>kustomization.yaml</code>:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../base

patches:
  - target:
      version: v1
      kind: ServiceAccount
      name: my-service-account
    patch: |-
      - op: replace
        path: /metadata/annotations/eks.amazonaws.com~1role-arn
        value: arn:aws:iam::1234:role/production-role
</code></pre>
<p>I don't think this really gets you anything, though.</p>
