<p>All namespaces in my cluster are supposed to trust the same root CA. I have a mono repo with all my Kustomize files, and I'm trying to avoid having to add the root CA certificate everywhere.</p>
<p>My idea was to go for something like that in my kustomization files:</p>
<pre><code># [project_name]/[namespace_name]/bases/project/kustomization.yml
configMapGenerator:
  - name: trusted-root-ca
    files:
      - ../../../../root-ca/root-ca.pem
</code></pre>
<p>So at least if I want to update the root CA, I do it in one place. This results to</p>
<pre><code>file sources: [../../../../root-ca/root-ca.pem]: security; file 'root-ca/root-ca.pem' is not in or below [project_name]/[namespace_name]/bases/project/
</code></pre>
<p>So I guess this is not the way to go. (Reading from <a href="https://stackoverflow.com/questions/65150509/common-config-across-multiple-environments-and-applications-with-kustomize">Common config across multiple environments and applications with Kustomize</a> I can see why it's behaving like that and disable that behavior seems to be a bad idea). I'm looking for a better way to do this.</p>

Yohan Courbe
<p>This seems like a good place to use a <a href="https://github.com/kubernetes-sigs/kustomize/blob/master/examples/components.md" rel="nofollow noreferrer">component</a>. For example, if I have my files organized like this:</p>
<pre><code>.
├── components
│   └── trusted-root-ca
│       ├── kustomization.yaml
│       └── root-ca.pem
└── projects
    ├── kustomization.yaml
    ├── project1
    │   ├── kustomization.yaml
    │   └── namespace.yaml
    └── project2
        ├── kustomization.yaml
        └── namespace.yaml
</code></pre>
<p>And in <code>components/trusted-root-ca/kustomization.yaml</code> I have:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

configMapGenerator:
  - name: trusted-root-ca
    files:
      - root-ca.pem

generatorOptions:
  disableNameSuffixHash: true
</code></pre>
<p>Then in <code>projects/project1/kustomization.yaml</code> I can write:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: project1

components:
- ../../components/trusted-root-ca
resources:
- namespace.yaml
</code></pre>
<p>And similarly in <code>projects/project2/kustomization.yaml</code>:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: project2

components:
- ../../components/trusted-root-ca
resources:
- namespace.yaml
</code></pre>
<p>And in <code>projects/kustomization.yaml</code> I have:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- project1
- project2
</code></pre>
<p>Then if, from the top directory, I run <code>kustomize build projects</code>, the output will look like:</p>
<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: project1
spec: {}
---
apiVersion: v1
kind: Namespace
metadata:
  name: project2
spec: {}
---
apiVersion: v1
data:
  root-ca.pem: |
    ...cert data here...
kind: ConfigMap
metadata:
  name: trusted-root-ca
  namespace: project1
---
apiVersion: v1
data:
  root-ca.pem: |
    ...cert data here...
kind: ConfigMap
metadata:
  name: trusted-root-ca
  namespace: project2
</code></pre>
