<p>I am curious to know if there is a way to do a Kustomize replacement or other operation to inject the contents of a non-yaml file into a yaml file using Kustomize. I know Kustomize is not a template engine and that this could be accomplished with Helm, but using the tool I am already using, is this possible?</p>
<p>My use case is to store OPA policies as native rego, which allows use of OPA unit tests, and to inject the content of these rego files into Gatekeeper constraints during Kustomize deployment. This will remove the requirement for custom pipeline processing or manual copy/paste to accomplish this.</p>
<p>Example opaRule.rego file</p>
<pre><code>package k8sdisallowedtags

violation[{&quot;msg&quot;: msg}] {
    container := input_containers[_]
    tags := [forbid | tag = input.parameters.tags[_] ; forbid = endswith(container.image, concat(&quot;:&quot;, [&quot;&quot;, tag]))]
    any(tags)
    msg := sprintf(&quot;container &lt;%v&gt; uses a disallowed tag &lt;%v&gt;; disallowed tags are %v&quot;, [container.name, container.image, input.parameters.tags])
}
...
</code></pre>
<p>Example constraintTemplate.yaml file</p>
<pre><code>apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sdisallowedtags
  namespace: kube-system
  annotations:
    description: Requires container images to have an image tag different
      from the ones in a specified list.
spec:
  crd:
    spec:
      names:
        kind: K8sDisallowedTags
      validation:
        openAPIV3Schema:
          properties:
            tags:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |-
        {CONTENT OF OPA RULE POLICY HERE}
</code></pre>

Michael L Rhyndress
<h2 id="answer-will-contain-two-parts">Answer will contain two parts:</h2>
<ul>
<li>idea on how to address the asked question (because no built-in functionality is available for it + integrate with the second part)</li>
<li>using patches (can be useful for others in community)</li>
</ul>
<h2 id="create-own-plugin">Create own plugin</h2>
<p>Kustomize allows to create plugins to extend its functionality. And there are almost zero limitations including <a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/#no-security" rel="nofollow noreferrer">security</a> - this should be handled by author of the plugin.</p>
<p>There are two kinds of plugins:</p>
<ul>
<li><a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/#authoring" rel="nofollow noreferrer">exec</a></li>
<li><a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/#go-plugins" rel="nofollow noreferrer">go-plugins</a></li>
</ul>
<p>All available information can be found in <a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/" rel="nofollow noreferrer">Extending Kustomize - documentation</a>.</p>
<p><a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/execpluginguidedexample/#build-your-app-using-the-plugin" rel="nofollow noreferrer">Example of exec plugin</a>. <strong>Note!</strong> correct flag is <code>--enable-alpha-plugins</code> (with <code>-</code>, not with <code>_</code> as in example).</p>
<h2 id="using-patches">Using patches</h2>
<blockquote>
<p>Patches (also call overlays) add or override fields on resources. They
are provided using the patches Kustomization field.</p>
<p>The patches field contains a list of patches to be applied in the
order they are specified.</p>
<p>Each patch may:</p>
<ul>
<li>be either a strategic merge patch, or a JSON6902 patch</li>
<li>be either a file, or an inline string target</li>
<li>a single resource or multiple resources</li>
</ul>
</blockquote>
<p><a href="https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/" rel="nofollow noreferrer">Reference to kustomize - patches</a></p>
<p>Below is example how to patch <code>gatekeeper.yaml</code> object.</p>
<p>Structure:</p>
<p>$ tree</p>
<pre><code>.
├── gatekeeper.yaml
├── kustomization.yaml
└── opa-gk.yaml
</code></pre>
<p>$ cat gatekeeper.yaml</p>
<pre><code>apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sdisallowedtags
  namespace: kube-system
  annotations:
    description: Requires container images to have an image tag different
      from the ones in a specified list.
spec:
  crd:
    spec:
      names:
        kind: K8sDisallowedTags
      validation:
        openAPIV3Schema:
          properties:
            tags:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |-
        {CONTENT OF OPA RULE POLICY HERE}
</code></pre>
<p>$ cat kustomization.yaml</p>
<pre><code>resources:
- gatekeeper.yaml

patches:
- path: opa-gk.yaml
  target:
    group: templates.gatekeeper.sh
    version: v1beta1
    kind: ConstraintTemplate
    name: k8sdisallowedtags
</code></pre>
<p>$ cat opa-gk.yaml</p>
<pre><code>- op: add
  path: /spec/targets/0/rego
  value: |
    package k8sdisallowedtags
    
    violation[{&quot;msg&quot;: msg}] {
        container := input_containers[_]
        tags := [forbid | tag = input.parameters.tags[_] ; forbid = endswith(container.image, concat(&quot;:&quot;, [&quot;&quot;, tag]))]
        any(tags)
        msg := sprintf(&quot;container &lt;%v&gt; uses a disallowed tag &lt;%v&gt;; disallowed tags are %v&quot;, [container.name, container.image, input.parameters.tags])
    }
    ...
</code></pre>
<p><strong>End result:</strong></p>
<p>$ kubectl kustomize .</p>
<pre><code>apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  annotations:
    description: Requires container images to have an image tag different from the
      ones in a specified list.
  name: k8sdisallowedtags
  namespace: kube-system
spec:
  crd:
    spec:
      names:
        kind: K8sDisallowedTags
      validation:
        openAPIV3Schema:
          properties:
            tags:
              items:
                type: string
              type: array
  targets:
  - rego: |
      package k8sdisallowedtags

      violation[{&quot;msg&quot;: msg}] {
          container := input_containers[_]
          tags := [forbid | tag = input.parameters.tags[_] ; forbid = endswith(container.image, concat(&quot;:&quot;, [&quot;&quot;, tag]))]
          any(tags)
          msg := sprintf(&quot;container &lt;%v&gt; uses a disallowed tag &lt;%v&gt;; disallowed tags are %v&quot;, [container.name, container.image, input.parameters.tags])
      }
      ...
    target: admission.k8s.gatekeeper.sh
</code></pre>
<h2 id="useful-links">Useful links:</h2>
<ul>
<li><a href="https://kubectl.docs.kubernetes.io/guides/extending_kustomize/" rel="nofollow noreferrer">Extending kustomize</a></li>
<li><a href="https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/" rel="nofollow noreferrer">kustomize patches</a></li>
</ul>
