如何用单个Kustomize补丁为Deployment和CronJob配置环境变量？

针对你遇到的Deployment和CronJob因Schema差异导致补丁无法复用的问题，以下是几种可行的官方支持方案：

方案一：通过组件(Component)复用容器环境配置 #

组件是Kustomize中专门用于跨资源复用配置的特性，可同时适配Deployment和CronJob的路径差异：

1. 创建组件目录及配置文件

mkdir -p components/env-config

在components/env-config/container-env-patch.yaml中编写适配两个资源的补丁：

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: my_app
          $patch: merge
          env:
            - name: SOME_SECRET
              valueFrom:
                secretKeyRef:
                  name: my_secret
                  key: my_key
          envFrom:
            - configmapRef:
                name: some_config_map
---
apiVersion: batch/v1
kind: CronJob
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: my_app
              $patch: merge
              env:
                - name: SOME_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: my_secret
                      key: my_key
              envFrom:
                - configmapRef:
                    name: some_config_map

组件的kustomization.yaml：

apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
patchesStrategicMerge:
- container-env-patch.yaml

2. 在主kustomization.yaml中引用组件

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- deployment.yaml
- cronjob.yaml

components:
- ../components/env-config

执行kustomize build后，环境配置会自动合并到两个资源的对应容器中。

方案二：通过统一的ConfigMap/Secret作为中间层 #

将多个ConfigMap和Secret的环境变量整合为统一资源，再在Deployment和CronJob中统一引用：

1. 用Kustomize生成统一环境资源
   假设你已将原有ConfigMap和Secret的键值对导出为some_config_map.env和my_secret.env文件，在主kustomization.yaml中添加：

configMapGenerator:
- name: unified-env-config
  behavior: merge
  envs:
  - some_config_map.env

secretGenerator:
- name: unified-env-secret
  behavior: merge
  envs:
  - my_secret.env

2. 修改容器配置
   去掉原有的env和envFrom，替换为：

envFrom:
  - configMapRef:
      name: unified-env-config
  - secretRef:
      name: unified-env-secret

这种方式无需处理Schema差异，只需维护统一的中间资源即可。

方案三：用Replacements动态替换配置（Kustomize 4.0+） #

通过Replacements定义通用环境模板，自动替换到两个资源的对应路径：

1. 创建环境模板ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: env-template
data:
  env_entries: |
    - name: SOME_SECRET
      valueFrom:
        secretKeyRef:
          name: my_secret
          key: my_key
  env_from_entries: |
    - configmapRef:
        name: some_config_map

2. 在主kustomization.yaml中配置Replacements

replacements:
- source:
    kind: ConfigMap
    name: env-template
    fieldPath: data.env_entries
  targets:
  - select:
      kind: Deployment
    fieldPaths:
    - spec.template.spec.containers.[name=my_app].env
    options:
      create: true
  - select:
      kind: CronJob
    fieldPaths:
    - spec.jobTemplate.spec.template.spec.containers.[name=my_app].env
    options:
      create: true
- source:
    kind: ConfigMap
    name: env-template
    fieldPath: data.env_from_entries
  targets:
  - select:
      kind: Deployment
    fieldPaths:
    - spec.template.spec.containers.[name=my_app].envFrom
    options:
      create: true
  - select:
      kind: CronJob
    fieldPaths:
    - spec.jobTemplate.spec.template.spec.containers.[name=my_app].envFrom
    options:
      create: true

以上方案均为Kubernetes和Kustomize官方支持特性，可根据配置复杂度选择：组件方案适合复用复杂容器配置，中间层方案适合简化注入逻辑，Replacements适合灵活的动态配置场景。

内容的提问来源于stack exchange，提问作者tonyc