如何用单个Kustomization.yml从同一Base生成两个不同参数的Deployment

我们通过Kustomize复用同一个Kafka Exporter Deployment Base，为多个客户做定制化配置。现在有新客户需要两个独立的Deployment（而非副本），各自带有不同的启动参数。但在overlay的kustomization.yml中添加第二个补丁文件后，最终仍然只生成一个Deployment。

目录结构 #

/base/
     /kustomization.yml
     /kafka-exporter.yml
/overlays/
         /overlay1/
                  /kustomization.yml
                  /kafka-exporter.yml
                  /kafka-exporter-passive.yml

关键配置文件 #

/base/kafka-exporter.yml #

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: kafka-exporter
  name: kafka-exporter
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kafka-exporter
  template:
    metadata:
      labels:
        app: kafka-exporter
    spec:
      imagePullSecrets:
      - name: docker-token
      containers:
      - name: kafka-exporter
        image: XXXXX
        ports:
        - name: kafka-exporter
          containerPort: 9308
          protocol: TCP
        args:
          - "--kafka.server=xxxxxxxx"
          - --tls.enabled
          - --tls.insecure-skip-tls-verify
          - --tls.cert-file=/etc/tls-certs/tls.crt
          - --tls.key-file=/etc/tls-certs/tls.key
          - --refresh.metadata=60s
          #- "--topic.filter=DUMMY"
        volumeMounts:
          - name: tls-certs
            readOnly: true
            mountPath: "/etc/tls-certs"
        resources:
          limits:
              cpu: 500m
              memory: 200Mi
          requests:
              cpu: 250m
              memory: 100Mi
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
      restartPolicy: Always
      volumes:
        - name: tls-certs
          secret:
            secretName: xxxxxx
        - name: policy-volume
          emptyDir:
            sizeLimit: 5Mi 

/base/kustomization.yml #

---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./kafka-exporter.yml

/overlays/overlay1/kustomization.yml（原配置） #

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: example
nameSuffix: -example
resources:
- ../base
patches:
  - path: ./kafka-exporter.yml
    target:
      kind: Deployment
  - path: ./kafka-exporter-passive.yml
    target:
      kind: Deployment

/overlays/overlay1/kafka-exporter.yml #

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka-exporter
spec:
  template:
    spec:
      containers:
      - name: kafka-exporter
        args:
          - "--kafka.server="
          - --tls.enabled
          - --tls.insecure-skip-tls-verify
          - --tls.cert-file=/etc/tls-certs/tls.crt
          - --tls.key-file=/etc/tls-certs/tls.key
          - --refresh.metadata=60s
          - "--topic.filter=.*test*"

/overlays/overlay1/kafka-exporter-passive.yml #

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka-exporter
spec:
  template:
    spec:
      containers:
      - name: kafka-exporter
        args:
          - "--kafka.server=xxxxx"
          - --tls.enabled
          - --tls.insecure-skip-tls-verify
          - --tls.cert-file=/etc/tls-certs/tls.crt
          - --tls.key-file=/etc/tls-certs/tls.key
          - --refresh.metadata=60s
          - "--topic.filter=.*something_else.*"

问题原因 #

Kustomize的补丁机制是修改已存在的资源实例，而非创建新资源。原配置中两次补丁都指向Base中同一个Deployment，相当于对同一个对象先后执行两次修改，最终只会保留最后一次补丁的结果，因此只生成一个Deployment。

解决方案 #

要生成两个独立的Deployment，需要两次引入Base资源，分别创建两个独立的资源实例，再对每个实例单独修改名称、标签和启动参数。

修改后的overlay/kustomization.yml #

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: example

# 第一个Deployment：主动模式（对应原kafka-exporter.yml补丁）
resources:
- ../base
patches:
  # 修改Deployment名称和关联标签
  - patch: |-
      - op: replace
        path: /metadata/name
        value: kafka-exporter-active
      - op: replace
        path: /metadata/labels/app
        value: kafka-exporter-active
      - op: replace
        path: /spec/selector/matchLabels/app
        value: kafka-exporter-active
      - op: replace
        path: /spec/template/metadata/labels/app
        value: kafka-exporter-active
    target:
      kind: Deployment
      name: kafka-exporter
  # 应用启动参数补丁
  - path: ./kafka-exporter.yml
    target:
      kind: Deployment
      name: kafka-exporter

# 第二个Deployment：被动模式（对应原kafka-exporter-passive.yml补丁）
resources:
- ../base
patches:
  # 修改Deployment名称和关联标签
  - patch: |-
      - op: replace
        path: /metadata/name
        value: kafka-exporter-passive
      - op: replace
        path: /metadata/labels/app
        value: kafka-exporter-passive
      - op: replace
        path: /spec/selector/matchLabels/app
        value: kafka-exporter-passive
      - op: replace
        path: /spec/template/metadata/labels/app
        value: kafka-exporter-passive
    target:
      kind: Deployment
      name: kafka-exporter
  # 应用启动参数补丁
  - path: ./kafka-exporter-passive.yml
    target:
      kind: Deployment
      name: kafka-exporter

说明 #

1. 两次引入../base资源，会生成两个独立的Deployment初始实例
2. 对每个实例分别执行两个补丁：
   • 第一个补丁修改Deployment的名称和标签（包括Pod标签和选择器），确保两个Deployment管理各自的Pod，避免冲突
   • 第二个补丁应用对应的启动参数配置
3. 最终会生成kafka-exporter-active和kafka-exporter-passive两个独立的Deployment，各自使用不同的启动参数

内容的提问来源于stack exchange，提问作者Sascha