# Kustomize quiz questions > 60 multiple-choice questions on overlays, patches, generators, components, replacements and kubectl apply -k, with answers and explanations. Quiz page: https://k8wiz.com/kustomize/difficulty ## Beginner (Easy): 20 questions Interactive quiz: https://k8wiz.com/kustomize/quiz/easy ### What is Kustomize? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-is-kustomize - A. A templating engine that renders Kubernetes charts from Go templates and values - B. A controller that keeps a cluster in sync with a Git repository - C. A registry for publishing and sharing Kubernetes manifests - D. A tool that customizes Kubernetes YAML through overlays, without templates **Answer:** A tool that customizes Kubernetes YAML through overlays, without templates **Explanation:** Kustomize reads plain Kubernetes manifests and a kustomization.yaml, then patches, labels, renames and generates objects to produce the final YAML. There is no templating language, so every input file is valid Kubernetes YAML on its own. ### Which file tells Kustomize which resources to build and how to change them? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-file-tells-kustomize-which-resources-to-build-and-how-to-change-them - A. values.yaml - B. Chart.yaml - C. kustomization.yaml - D. kustomize.json **Answer:** kustomization.yaml **Explanation:** Every directory Kustomize builds has a kustomization file. It lists the resources, patches and generators, plus changes that apply to everything, such as a namespace or a name prefix. ### Which command prints the built output of a kustomization directory with kubectl, without applying it? Kustomize, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-prints-the-built-output-of-a-kustomization-directory-with-kubectl-without-applying-it - A. kubectl kustomize - B. kubectl render - C. kubectl build -k - D. kubectl template **Answer:** kubectl kustomize **Explanation:** 'kubectl kustomize ' prints the built YAML, like the standalone 'kustomize build '. kubectl has included Kustomize since version 1.14, though the bundled version can be older than the standalone release. ### Which flag makes kubectl apply a kustomization directory? Kustomize, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-flag-makes-kubectl-apply-a-kustomization-directory - A. -k, or --kustomize - B. -f with the directory's path - C. --overlay - D. --build **Answer:** -k, or --kustomize **Explanation:** 'kubectl apply -k ' builds the directory with Kustomize and applies the result. '-f ' would try to apply each file as it is, including kustomization.yaml, which isn't an object the cluster knows. ### Which field lists the manifest files and directories a kustomization builds from? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-field-lists-the-manifest-files-and-directories-a-kustomization-builds-from - A. bases - B. resources - C. includes - D. manifests **Answer:** resources **Explanation:** resources takes files, directories that have their own kustomization file, and remote URLs. The older bases field was deprecated in v2.1.0, and bases now go under resources too. ### What is an overlay in Kustomize? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-is-an-overlay-in-kustomize - A. A kustomization that builds on a base and adds one environment's changes - B. A Helm values file that is layered on top of the chart's own default values - C. A Git branch that holds the manifests for one environment only - D. A namespace that receives a copy of every resource in the base **Answer:** A kustomization that builds on a base and adds one environment's changes **Explanation:** A typical layout has a base with the shared manifests and overlays such as overlays/dev and overlays/prod. Each overlay lists the base under resources and adds patches, a namespace or image tags. The base knows nothing about its overlays. ### What does namePrefix: dev- do? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-nameprefix-dev-do - A. Adds dev- to the names of Deployments and Services, but not other kinds - B. Creates a namespace called dev- for all the resources - C. Adds dev- to the value of every label in the output - D. Adds dev- to every resource's name and updates references to them **Answer:** Adds dev- to every resource's name and updates references to them **Explanation:** Kustomize prefixes every resource's name and fixes references to the renamed objects, such as a Deployment's configMapRef or a RoleBinding's roleRef. nameSuffix does the same at the end of the name. ### What does the namespace field in a kustomization.yaml do? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-the-namespace-field-in-a-kustomizationyaml-do - A. Creates the Namespace object first if it doesn't exist in the cluster yet - B. Sets the namespace only on resources that don't have one - C. Sets it on every namespaced resource, replacing existing values - D. Limits kubectl apply -k to objects in that namespace **Answer:** Sets it on every namespaced resource, replacing existing values **Explanation:** The namespace field overrides namespaces already written in the manifests. Kustomize doesn't create the Namespace object itself, so add a Namespace manifest to resources or create it separately. ### How do you change an image tag in every Deployment without writing a patch? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/how-do-you-change-an-image-tag-in-every-deployment-without-writing-a-patch - A. Set spec.template.image in the kustomization.yaml - B. Put the tag in namePrefix so it's added everywhere - C. Add an images entry with the image name and newTag - D. Add the tag to commonAnnotations as image-tag **Answer:** Add an images entry with the image name and newTag **Explanation:** The images field matches containers by image name and can set newName, newTag or a digest. 'kustomize edit set image nginx=nginx:1.27' writes the entry for you, which suits CI pipelines. ### Which field generates a ConfigMap from files or literal values? Kustomize, Easy (Beginner), Generation. https://k8wiz.com/uquiz/which-field-generates-a-configmap-from-files-or-literal-values - A. configMapGenerator - B. configMapRef - C. generatorOptions - D. configMaps **Answer:** configMapGenerator **Explanation:** configMapGenerator builds a ConfigMap from files, env files or literals, and secretGenerator does the same for Secrets. generatorOptions changes settings for every generated object, such as labels or the name suffix. ### Why does a ConfigMap generated by Kustomize get a name like app-config-5g2m8k7h? Kustomize, Easy (Beginner), Generation. https://k8wiz.com/uquiz/why-does-a-configmap-generated-by-kustomize-get-a-name-like-app-config-5g2m8k7h - A. Kustomize appends a hash of the data, so new data gives a new name - B. Kubernetes adds a random suffix to every generated object to avoid clashes - C. The suffix is the short Git commit SHA the build ran from - D. Kustomize adds the date the ConfigMap was generated **Answer:** Kustomize appends a hash of the data, so new data gives a new name **Explanation:** Because the name changes whenever the data changes, and Kustomize updates every reference to it, Deployments that use the ConfigMap roll out with the new values. generatorOptions.disableNameSuffixHash: true keeps a fixed name. ### Which command builds a kustomization with the standalone Kustomize CLI? Kustomize, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-builds-a-kustomization-with-the-standalone-kustomize-cli - A. kustomize build - B. kustomize render - C. kustomize apply - D. kustomize template **Answer:** kustomize build **Explanation:** 'kustomize build' prints the result to standard output, so you can pipe it to 'kubectl apply -f -' or save it to a file. The standalone CLI is often newer than the version inside kubectl. ### What does commonAnnotations do? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-commonannotations-do - A. Adds the annotations to Pods only - B. Copies annotations from the base into overlays - C. Removes annotations that aren't in the list - D. Adds the listed annotations to every resource **Answer:** Adds the listed annotations to every resource **Explanation:** commonAnnotations applies to every resource, like namespace and namePrefix. It suits metadata such as a team name or a link to the source repository. ### Which field is the current way to patch resources in Kustomize v5? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-field-is-the-current-way-to-patch-resources-in-kustomize-v5 - A. patchesStrategicMerge - B. patchesJson6902 - C. patches - D. overrides **Answer:** patches **Explanation:** patches accepts both strategic merge patches and JSON 6902 patches, from a file or inline, and can target several resources at once. patchesStrategicMerge and patchesJson6902 are the older, separate fields; patchesStrategicMerge was deprecated in v5.0.0. ### Which command writes a kustomization.yaml that lists the YAML files in the current directory? Kustomize, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-writes-a-kustomizationyaml-that-lists-the-yaml-files-in-the-current-directory - A. kustomize init - B. kubectl kustomize --init - C. kustomize create --autodetect - D. kustomize new --scan **Answer:** kustomize create --autodetect **Explanation:** 'kustomize create --autodetect' writes a kustomization.yaml whose resources list the manifests it finds, and --recursive includes subdirectories. It's a quick way to start using Kustomize on a folder of plain manifests. ### What does kubectl delete -k on an overlay remove? Kustomize, Easy (Beginner), Commands. https://k8wiz.com/uquiz/what-does-kubectl-delete-k-on-an-overlay-remove - A. The overlay's kustomization.yaml file from disk - B. Only the objects that the overlay itself patched - C. Everything the overlay builds, base included - D. The overlay's entries from the base **Answer:** Everything the overlay builds, base included **Explanation:** 'kubectl delete -k' builds the directory and deletes the resulting objects, so everything pulled in from the base goes too. Run 'kubectl kustomize' first to see exactly what will be removed. ### What does the replicas field in a kustomization.yaml do? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-the-replicas-field-in-a-kustomizationyaml-do - A. Sets the replica count of a named Deployment or StatefulSet - B. Sets the minimum and maximum replicas of a HorizontalPodAutoscaler - C. Duplicates a Deployment once for each number listed - D. Sets how many Pods per node a DaemonSet may run **Answer:** Sets the replica count of a named Deployment or StatefulSet **Explanation:** Each entry has a name and a count, and it applies to Deployments, ReplicationControllers, ReplicaSets and StatefulSets with that name. For anything else, such as an HPA, use a patch. ### Do Kustomize input files need special syntax, like Helm's {{ }} placeholders? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/do-kustomize-input-files-need-special-syntax-like-helms-placeholders - A. No, every input file is plain Kubernetes YAML - B. Yes, values are written as {{ .Values.name }} - C. Yes, variables use the ${var} syntax - D. Yes, input files must use the .kyaml extension **Answer:** No, every input file is plain Kubernetes YAML **Explanation:** Kustomize is template-free. Bases and patches are ordinary manifests you can apply on their own, and the kustomization.yaml describes how to change them. Flux adds ${var} substitution on top, but that's a Flux feature. ### How does an overlay include a base kustomization? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/how-does-an-overlay-include-a-base-kustomization - A. By listing the base's directory under patches - B. By listing the base's directory under resources - C. By copying the base's files into the overlay - D. By setting a base field to the directory's path **Answer:** By listing the base's directory under resources **Explanation:** Entries under resources can be files or directories, and a directory must have its own kustomization file. Paths are relative to the overlay, such as ../../base. ### Which project maintains Kustomize? Kustomize, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-project-maintains-kustomize - A. Kubernetes SIG CLI, and kubectl includes it - B. The Helm project, as a Helm plugin - C. The Flux project, which is the only place it runs - D. A commercial vendor that offers a free tier **Answer:** Kubernetes SIG CLI, and kubectl includes it **Explanation:** Kustomize lives in the kubernetes-sigs/kustomize repository under SIG CLI. kubectl has included it since 1.14, and GitOps tools such as Flux and Argo CD use it to build manifests. ## Advanced (Medium): 20 questions Interactive quiz: https://k8wiz.com/kustomize/quiz/medium ### Why can adding a label through commonLabels make kubectl apply fail for an existing Deployment? Kustomize, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/why-can-adding-a-label-through-commonlabels-make-kubectl-apply-fail-for-an-existing-deployment - A. It removes every label the Deployment already had before the build - B. It renames the Deployment, which forces Kubernetes to create a whole new one - C. It also adds the label to selectors, which can't change on a Deployment - D. It labels the Pods only, so the Deployment's selector stops matching **Answer:** It also adds the label to selectors, which can't change on a Deployment **Explanation:** commonLabels adds its labels to resources, selectors and pod templates. A new label changes spec.selector, which Kubernetes rejects on an existing Deployment. commonLabels is deprecated in favor of the labels field, which leaves selectors alone unless you ask for them. ### How do you add a label to every resource without changing any selectors? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/how-do-you-add-a-label-to-every-resource-without-changing-any-selectors - A. Use commonLabels with a selectors: false option - B. Use commonAnnotations, which Kubernetes also treats as labels on every object - C. Use generatorOptions.labels, which applies to every resource - D. Use labels with pairs, leaving includeSelectors at its default of false **Answer:** Use labels with pairs, leaving includeSelectors at its default of false **Explanation:** labels takes a list of entries, each with pairs and options. includeSelectors defaults to false, and includeTemplates adds the labels to pod templates as well. generatorOptions.labels only reaches generated ConfigMaps and Secrets. ### What does an images entry with name: nginx and a digest: sha256:... value do? Kustomize, Medium (Advanced), Security. https://k8wiz.com/uquiz/what-does-an-images-entry-with-name-nginx-and-a-digest-sha256-value-do - A. Pins nginx containers to that exact image digest - B. Verifies the image signature before applying - C. Pulls the image to check that the digest exists - D. Adds the digest to Pods as an annotation **Answer:** Pins nginx containers to that exact image digest **Explanation:** With digest set, Kustomize writes the image as nginx@sha256:..., so every node runs exactly that image even if the tag moves later. Kustomize never contacts the registry; a CI job usually looks up the digest and writes it. ### A strategic merge patch lists one container with a new image. What happens to the base's other containers? Kustomize, Medium (Advanced), Mutation. https://k8wiz.com/uquiz/a-strategic-merge-patch-lists-one-container-with-a-new-image-what-happens-to-the-bases-other-containers - A. They are removed, because the patch's list replaces the base's - B. They stay as they are, because containers are merged by name - C. The patch's container is appended as an extra container - D. The build fails, because lists need a JSON patch **Answer:** They stay as they are, because containers are merged by name **Explanation:** Strategic merge patches know that containers are keyed by name, so a patch with name: app and a new image only changes that container. A JSON 6902 patch addresses list items by index instead, which breaks when the order changes. ### How do you remove a container from a base Deployment with a strategic merge patch? Kustomize, Medium (Advanced), Mutation. https://k8wiz.com/uquiz/how-do-you-remove-a-container-from-a-base-deployment-with-a-strategic-merge-patch - A. Set the container's image to an empty string - B. List the container's name under a remove: field in the patch file - C. Set replicas: 0 on that container in the patch - D. Add $patch: delete to that container's entry in the patch **Answer:** Add $patch: delete to that container's entry in the patch **Explanation:** The $patch directive changes how a strategic merge patch treats an element: delete removes the matching entry and replace swaps it out entirely. Both work in patch files and in inline patches. ### When is a JSON 6902 patch a better choice than a strategic merge patch? Kustomize, Medium (Advanced), Mutation. https://k8wiz.com/uquiz/when-is-a-json-6902-patch-a-better-choice-than-a-strategic-merge-patch - A. When strategic merge can't express it, like removing one string from a list - B. Whenever a single patch has to change more than one resource at the same time - C. Only for custom resources, since built-in kinds reject JSON patches - D. Only when the base was rendered from a Helm chart with helmCharts **Answer:** When strategic merge can't express it, like removing one string from a list **Explanation:** JSON 6902 patches use explicit operations such as add, remove and replace at a path like /spec/template/spec/containers/0/args/1. They're precise but depend on list positions. Custom resources often need them too, because strategic merge has no merge keys for their lists. ### A patch target sets kind: Deployment and labelSelector: tier=backend. Which resources does the patch change? Kustomize, Medium (Advanced), Mutation. https://k8wiz.com/uquiz/a-patch-target-sets-kind-deployment-and-labelselector-tierbackend-which-resources-does-the-patch-change - A. Every resource with tier=backend, of any kind - B. Only the first Deployment that matches - C. Only Deployments whose name is backend - D. Every Deployment that has the label tier=backend **Answer:** Every Deployment that has the label tier=backend **Explanation:** A patch target selects by group, version, kind, name, namespace, labelSelector and annotationSelector, and a resource has to match every field you set. Leaving out the name lets one patch change many objects. ### What are Kustomize components for? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/what-are-kustomize-components-for - A. Splitting a large base into one file per resource kind - B. Packaging a kustomization so it can be pushed to an OCI registry - C. Setting the order in which resources are applied - D. Optional features that several overlays can include or leave out **Answer:** Optional features that several overlays can include or leave out **Explanation:** A component is a kustomization with apiVersion kustomize.config.k8s.io/v1alpha1 and kind: Component, listed under components. It can patch the resources of whatever includes it, so one component can turn on a feature, such as an external database, in any overlay. ### Which field replaces the deprecated vars for copying a value from one resource into another? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/which-field-replaces-the-deprecated-vars-for-copying-a-value-from-one-resource-into-another - A. patches - B. replacements - C. configurations - D. transformers **Answer:** replacements **Explanation:** A replacement names a source, such as a Service's metadata.name, and targets with field paths where the value goes. vars was deprecated in v5.0.0, and 'kustomize edit fix --vars' converts them. ### How do you reference a base from a Git repository under resources? Kustomize, Medium (Advanced), Integration. https://k8wiz.com/uquiz/how-do-you-reference-a-base-from-a-git-repository-under-resources - A. git::github.com/org/repo/path/to/base@v1.2.0 - B. github.com/org/repo/tree/v1.2.0/path/to/base - C. oci://github.com/org/repo/path/to/base:v1.2.0 - D. https://github.com/org/repo//path/to/base?ref=v1.2.0 **Answer:** https://github.com/org/repo//path/to/base?ref=v1.2.0 **Explanation:** The double slash separates the repository from the directory inside it, and ref picks a branch, tag or commit. Pin ref to a tag or commit so a change in the other repository can't silently change your build. ### kustomize build fails because a patch file sits outside the kustomization's directory. What does the default load restrictor require? Kustomize, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/kustomize-build-fails-because-a-patch-file-sits-outside-the-kustomizations-directory-what-does-the-default-load-restrictor-requi - A. Every referenced file must be listed in a .kustomizeignore file - B. Every referenced file must be inside the kustomization's directory tree - C. Every referenced file must be tracked by Git in the same repository as the overlay - D. Every referenced file must use the .yaml extension, not .yml **Answer:** Every referenced file must be inside the kustomization's directory tree **Explanation:** The default, LoadRestrictionsRootOnly, stops a kustomization from reading files outside its own tree. resources can still point at another directory that has its own kustomization file. '--load-restrictor LoadRestrictionsNone' turns the check off, which is best avoided. ### How do you generate a TLS Secret with Kustomize? Kustomize, Medium (Advanced), Generation. https://k8wiz.com/uquiz/how-do-you-generate-a-tls-secret-with-kustomize - A. A configMapGenerator entry with secret: true that lists both the certificate and key files - B. A secretGenerator entry with type: kubernetes.io/tls and the files tls.crt and tls.key - C. A secretGenerator entry with tls: true and any two certificate files - D. A patch that changes a generated ConfigMap's kind to Secret **Answer:** A secretGenerator entry with type: kubernetes.io/tls and the files tls.crt and tls.key **Explanation:** secretGenerator's type defaults to Opaque. With kubernetes.io/tls, the entry must have exactly two keys, tls.crt and tls.key, from files or literals. The Secret gets a hash suffix like any generated object. ### What does sortOptions.order: fifo change in the build output? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/what-does-sortoptionsorder-fifo-change-in-the-build-output - A. kubectl applies the resources one at a time, waiting for each to be ready - B. Kustomize runs the patches in reverse order - C. Generated objects are placed before all other resources - D. Resources stay in the order they were listed instead of being sorted **Answer:** Resources stay in the order they were listed instead of being sorted **Explanation:** The default, legacy, sorts output with an orderFirst list, such as Namespaces, an orderLast list, and everything else in between by apiVersion and kind. fifo keeps the order from resources, which helps when another tool applies the output in sequence. ### What does generatorOptions.disableNameSuffixHash: true change? Kustomize, Medium (Advanced), Generation. https://k8wiz.com/uquiz/what-does-generatoroptionsdisablenamesuffixhash-true-change - A. Generated ConfigMaps and Secrets are marked immutable, so they can't change - B. The content hash moves from the name into a label - C. Generated ConfigMaps and Secrets keep a fixed name, without the hash - D. Generators run only when their input files change **Answer:** Generated ConfigMaps and Secrets keep a fixed name, without the hash **Explanation:** Without the hash, new data no longer means a new name, so Deployments that use the ConfigMap don't roll out on their own. Use it when another tool expects a fixed name. generatorOptions.immutable is a separate setting. ### How can you see what kubectl apply -k would change in the cluster before applying it? Kustomize, Medium (Advanced), Commands. https://k8wiz.com/uquiz/how-can-you-see-what-kubectl-apply-k-would-change-in-the-cluster-before-applying-it - A. Run kustomize build --diff - B. Run kubectl apply -k --preview - C. Run kubectl kustomize --cluster - D. Run kubectl diff -k **Answer:** Run kubectl diff -k **Explanation:** 'kubectl diff -k' builds the kustomization and compares it with the live objects using a server-side dry run. It exits with 1 when it finds differences, which CI jobs can check. ### Can a kustomization include a Helm chart? Kustomize, Medium (Advanced), Integration. https://k8wiz.com/uquiz/can-a-kustomization-include-a-helm-chart - A. No, Kustomize has no way to use Helm charts - B. Yes, any resources entry that ends in .tgz is rendered as a Helm chart - C. Yes, through a charts field that runs helm install - D. Yes, through helmCharts, when the build runs with --enable-helm **Answer:** Yes, through helmCharts, when the build runs with --enable-helm **Explanation:** The helmCharts field renders a chart with Helm, and kustomize build only allows it with --enable-helm. The Kustomize docs call this support limited, so many teams render the chart separately or use a tool that runs Helm itself. ### What does kustomize edit fix do? Kustomize, Medium (Advanced), Commands. https://k8wiz.com/uquiz/what-does-kustomize-edit-fix-do - A. Formats the kustomization.yaml and sorts all of its keys alphabetically - B. Rewrites deprecated fields, such as bases, into the fields that replace them - C. Repairs the references between resources that point at names that don't exist - D. Updates every remote base to the newest tag published in its repository **Answer:** Rewrites deprecated fields, such as bases, into the fields that replace them **Explanation:** It moves bases into resources, imageTags into images, and patchesStrategicMerge and patchesJson6902 into patches. With --vars it also converts vars into replacements. Review the diff before committing it. ### An overlay's strategic merge patch fails with "failed to find unique target for patch". What is the usual cause? Kustomize, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/an-overlays-strategic-merge-patch-fails-with-failed-to-find-unique-target-for-patch-what-is-the-usual-cause - A. The patch file is listed under resources in the overlay instead of under patches - B. The patch's apiVersion, kind or name doesn't match any resource in the build - C. Patches can only target resources defined in the same file - D. The base hasn't been applied to the cluster yet **Answer:** The patch's apiVersion, kind or name doesn't match any resource in the build **Explanation:** A strategic merge patch finds its target by apiVersion, kind and name. A typo, a different API group, or a resource the base doesn't actually include leaves the patch with nothing to change. Run kustomize build on the base to see the names it produces. ### A base and an overlay both have an images entry for nginx with different tags. Which tag ends up in the output? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/a-base-and-an-overlay-both-have-an-images-entry-for-nginx-with-different-tags-which-tag-ends-up-in-the-output - A. The base's, because it was defined first - B. Neither, because the build fails on the conflict - C. Whichever tag has the higher version number - D. The overlay's, because it runs on the base's output **Answer:** The overlay's, because it runs on the base's output **Explanation:** Kustomize builds the base first and then runs the overlay's transformers on the result, so the overlay's images entry changes whatever tag the base set. That ordering is what lets each environment override shared defaults. ### Which file names does Kustomize accept for the kustomization file in a directory? Kustomize, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/which-file-names-does-kustomize-accept-for-the-kustomization-file-in-a-directory - A. Any YAML file in the directory whose kind is Kustomization - B. kustomize.yaml or kustomize.yml - C. Only kustomization.yaml - D. kustomization.yaml, kustomization.yml or Kustomization **Answer:** kustomization.yaml, kustomization.yml or Kustomization **Explanation:** Kustomize looks for one of those three names in each directory it builds, and fails if a directory has more than one. Inside the file, kind is Kustomization, or Component for a component. ## Expert (Hard): 20 questions Interactive quiz: https://k8wiz.com/kustomize/quiz/hard ### Why can a component patch resources defined in the overlay that includes it, when a base can't? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/why-can-a-component-patch-resources-defined-in-the-overlay-that-includes-it-when-a-base-cant - A. A base builds alone; a component runs against whatever includes it - B. Bases can only contain resources, while components can contain patches - C. Bases run after overlays, so their patches are overwritten - D. Components are applied by kubectl, not by Kustomize **Answer:** A base builds alone; a component runs against whatever includes it **Explanation:** A base is a self-contained build, so its patches can only touch its own resources. A component is merged into the kustomization that lists it, so it can patch objects from the base or the overlay. That's why components suit optional features shared by several overlays. ### Which field path selects the value of the env var SERVICE_HOST in the container named app, for a replacement target? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/which-field-path-selects-the-value-of-the-env-var-service_host-in-the-container-named-app-for-a-replacement-target - A. spec.template.spec.containers[app].env[SERVICE_HOST].value - B. spec.template.spec.containers.0.env.SERVICE_HOST.value - C. spec.template.spec.containers.[name=app].env.[name=SERVICE_HOST].value - D. $.spec.template.spec.containers[?(@.name=='app')].env **Answer:** spec.template.spec.containers.[name=app].env.[name=SERVICE_HOST].value **Explanation:** Kustomize field paths use dots and select list items by a field value with [name=app], or every item with *. A replacement's options include delimiter and index, which let you replace one part of a value, such as the host in a URL. ### A production overlay lists a remote base with ?ref=main. What's the risk? Kustomize, Hard (Expert), Security. https://k8wiz.com/uquiz/a-production-overlay-lists-a-remote-base-with-refmain-whats-the-risk - A. Kustomize caches main on the first build and never sees any later updates to it - B. Remote bases can't use branch names, so the build fails - C. kubectl apply -k skips remote resources without warning - D. The build changes whenever main changes, even if your own repository doesn't **Answer:** The build changes whenever main changes, even if your own repository doesn't **Explanation:** Kustomize fetches the remote repository at the given ref on every build. A branch moves, so two builds of the same commit can produce different YAML. Pin ref to a tag or, better, a commit SHA, and update it on purpose. ### A strategic merge patch adds one item to a list in a custom resource, but the build replaces the whole list. Why? Kustomize, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-strategic-merge-patch-adds-one-item-to-a-list-in-a-custom-resource-but-the-build-replaces-the-whole-list-why - A. Custom resources don't support patches of any kind - B. Kustomize has no merge key for that list, so strategic merge replaces it - C. The patch needs a $patch: append directive on the list - D. Lists in custom resources are always sorted and rewritten by the API server **Answer:** Kustomize has no merge key for that list, so strategic merge replaces it **Explanation:** Strategic merge relies on schema information such as merge keys, which Kustomize's built-in schema only has for Kubernetes types. For a custom resource, a list in the patch replaces the original. Use a JSON 6902 patch, or provide the CRD's schema through the openapi field. ### A custom resource refers to a generated ConfigMap by name, but after the build it still uses the name without the hash suffix. Why? Kustomize, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-custom-resource-refers-to-a-generated-configmap-by-name-but-after-the-build-it-still-uses-the-name-without-the-hash-suffix-why - A. Kustomize only updates name references in fields it knows about - B. Generated ConfigMaps can't be referenced by custom resources - C. The hash is only added when the build runs with --enable-helm - D. kubectl adds the suffix at apply time, not Kustomize **Answer:** Kustomize only updates name references in fields it knows about **Explanation:** Kustomize updates references through a list of known fields, such as a Pod's volumes and envFrom. List the CRD under the crds field so Kustomize learns its references, or set disableNameSuffixHash on that generator. ### An overlay's configMapGenerator uses the same name as one generated in the base, with no behavior set. What happens? Kustomize, Hard (Expert), Generation. https://k8wiz.com/uquiz/an-overlays-configmapgenerator-uses-the-same-name-as-one-generated-in-the-base-with-no-behavior-set-what-happens - A. The overlay's ConfigMap silently replaces the one from the base - B. Both ConfigMaps are generated side by side, each with a different hash suffix - C. The build fails, because the default behavior, create, needs a new name - D. The keys from both ConfigMaps are merged automatically **Answer:** The build fails, because the default behavior, create, needs a new name **Explanation:** create is the default and only makes new ConfigMaps. To change one generated in the base, the overlay sets behavior: merge to add or override keys, or behavior: replace to swap the whole contents. ### A kustomization sets namespace: team-a and includes a ClusterRole. What happens to the ClusterRole? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/a-kustomization-sets-namespace-team-a-and-includes-a-clusterrole-what-happens-to-the-clusterrole - A. It gets metadata.namespace: team-a, and the API server then rejects it - B. Nothing, because cluster-scoped resources don't get a namespace - C. It is converted into a Role in the team-a namespace - D. The build fails because the scopes are mixed **Answer:** Nothing, because cluster-scoped resources don't get a namespace **Explanation:** Kustomize knows which built-in kinds are cluster-scoped, such as ClusterRole, Namespace and CustomResourceDefinition, and leaves them alone. Namespaced resources get team-a whatever the manifests said. ### In a strategic merge patch, what does $patch: replace inside a container's resources map do? Kustomize, Hard (Expert), Mutation. https://k8wiz.com/uquiz/in-a-strategic-merge-patch-what-does-patch-replace-inside-a-containers-resources-map-do - A. Replaces only the keys the patch lists and keeps all of the other keys as they were - B. Makes the patch's map the whole value, dropping keys the patch leaves out - C. Deletes the resources map from the container - D. Moves the resources map to the end of the container **Answer:** Makes the patch's map the whole value, dropping keys the patch leaves out **Explanation:** Strategic merge normally merges maps key by key, so leaving out limits.memory in a patch doesn't remove it. $patch: replace makes the patch's map the full value, and $patch: delete removes it. ### A patch target sets name: app. Does it also match a Deployment named app-worker? Kustomize, Hard (Expert), Mutation. https://k8wiz.com/uquiz/a-patch-target-sets-name-app-does-it-also-match-a-deployment-named-app-worker - A. No, target names are anchored regexes, so app means ^app$ - B. Yes, because target names are matched as prefixes - C. Yes, because target names match anywhere in the name - D. Only if the target also sets a labelSelector **Answer:** No, target names are anchored regexes, so app means ^app$ **Explanation:** The name and namespace fields of a patch target are regular expressions anchored at both ends. Write name: app.* to match every name that starts with app, or select with labelSelector instead. ### A patch changes the metadata.name of its target, and the build fails. What allows the rename? Kustomize, Hard (Expert), Mutation. https://k8wiz.com/uquiz/a-patch-changes-the-metadataname-of-its-target-and-the-build-fails-what-allows-the-rename - A. Adding a nameSuffix field to the patch file - B. Moving the patch to patchesStrategicMerge - C. Setting generatorOptions.disableNameSuffixHash - D. Setting options.allowNameChange: true on that patch **Answer:** Setting options.allowNameChange: true on that patch **Explanation:** Kustomize refuses a patch that renames its target unless the patch entry sets options.allowNameChange. options.allowKindChange does the same for changing the kind. ### Which query parameter of a remote resource URL sets how long Kustomize waits for the fetch? Kustomize, Hard (Expert), Integration. https://k8wiz.com/uquiz/which-query-parameter-of-a-remote-resource-url-sets-how-long-kustomize-waits-for-the-fetch - A. ttl - B. deadline - C. wait - D. timeout **Answer:** timeout **Explanation:** Remote URLs accept ref to pick a branch, tag or commit, timeout, which defaults to 27 seconds, and submodules, which defaults to true. Needing a long timeout usually means a large repository that is slow to fetch on every build. ### A replacement's target field doesn't exist yet in the target resource. What makes Kustomize add it? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/a-replacements-target-field-doesnt-exist-yet-in-the-target-resource-what-makes-kustomize-add-it - A. options.create: true on that target - B. options.force: true on that target - C. Listing the field under patches - D. Setting options.delimiter to an empty string **Answer:** options.create: true on that target **Explanation:** create defaults to false, so a replacement only writes to fields that already exist. With create: true Kustomize adds the missing field. delimiter and index are for replacing one part of a value. ### An overlay sets replicas for a Deployment that a HorizontalPodAutoscaler scales. What happens on each kubectl apply -k? Kustomize, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/an-overlay-sets-replicas-for-a-deployment-that-a-horizontalpodautoscaler-scales-what-happens-on-each-kubectl-apply-k - A. The HPA's minReplicas is updated to match the overlay - B. Each apply resets spec.replicas to the overlay's value - C. kubectl skips spec.replicas because an HPA exists - D. The build fails because an HPA targets the Deployment **Answer:** Each apply resets spec.replicas to the overlay's value **Explanation:** Kustomize writes spec.replicas into the Deployment, and every apply sets it back to that number, which can remove Pods the HPA added. Leave replicas out of the manifests of autoscaled workloads and let the HPA own the field. ### A configMapGenerator entry has files: [config/app.properties]. Which key holds the file's content? Kustomize, Hard (Expert), Generation. https://k8wiz.com/uquiz/a-configmapgenerator-entry-has-files-configappproperties-which-key-holds-the-files-content - A. config/app.properties, the full path - B. app.properties, the file's name - C. The ConfigMap's name - D. data, a fixed key **Answer:** app.properties, the file's name **Explanation:** Each file becomes one key named after the file. Write files: [settings=config/app.properties] to choose the key yourself, or use envs to turn each KEY=value line of a file into its own key. ### labels sets includeSelectors: false and includeTemplates: true. Where do the labels end up? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/labels-sets-includeselectors-false-and-includetemplates-true-where-do-the-labels-end-up - A. Only on the pod templates, not on the resources - B. On the resources and their pod templates, but not on selectors - C. On the selectors and the pod templates, but not the resources - D. Only on the resources, because includeTemplates needs selectors **Answer:** On the resources and their pod templates, but not on selectors **Explanation:** includeTemplates adds the labels to spec.template.metadata, so Pods carry them for monitoring or cost tools, while includeSelectors: false keeps them out of selectors that Kubernetes won't let you change. ### What does the openapi field in a kustomization.yaml provide? Kustomize, Hard (Expert), Concepts. https://k8wiz.com/uquiz/what-does-the-openapi-field-in-a-kustomizationyaml-provide - A. The address of the API server that Kustomize uses to validate the built output - B. A list of API versions the build is allowed to produce - C. A schema with merge keys so strategic merge patches handle custom resources - D. The schema kubectl uses to convert the output to JSON **Answer:** A schema with merge keys so strategic merge patches handle custom resources **Explanation:** Kustomize ships OpenAPI data only for built-in Kubernetes types. The openapi field points at a schema with merge keys and patch strategies for your custom resources, so strategic merge patches can merge their lists instead of replacing them. ### Two bases included by one overlay both define a ConfigMap named settings in the same namespace. What happens? Kustomize, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/two-bases-included-by-one-overlay-both-define-a-configmap-named-settings-in-the-same-namespace-what-happens - A. The second ConfigMap replaces the first - B. The build fails, because two resources have the same ID - C. Kustomize merges the data of both ConfigMaps into a single one - D. Both are kept, each with its own hash suffix **Answer:** The build fails, because two resources have the same ID **Explanation:** Kustomize identifies resources by group, version, kind, namespace and name, and two with the same ID are a conflict. Give the bases different name prefixes, or move the ConfigMap into one shared base. ### A JSON 6902 patch adds an annotation named example.com/owner. How is that key written in the patch path? Kustomize, Hard (Expert), Mutation. https://k8wiz.com/uquiz/a-json-6902-patch-adds-an-annotation-named-examplecomowner-how-is-that-key-written-in-the-patch-path - A. /metadata/annotations/example.com/owner - B. /metadata/annotations/'example.com/owner' - C. /metadata/annotations/example.com~1owner - D. /metadata/annotations/example.com\/owner **Answer:** /metadata/annotations/example.com~1owner **Explanation:** JSON Pointer escapes / as ~1 and ~ as ~0. Without the escape, the path points at a key named owner nested under example.com, and the patch fails or lands in the wrong place. ### Why can a kustomization build with the kustomize CLI but fail with kubectl apply -k? Kustomize, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/why-can-a-kustomization-build-with-the-kustomize-cli-but-fail-with-kubectl-apply-k - A. kubectl kustomize doesn't support overlays or remote bases - B. kubectl only reads files named kustomization.yml, and ignores kustomization.yaml - C. kubectl bundles a fixed Kustomize version, which may be older than the CLI - D. kubectl requires every resource to be a local file **Answer:** kubectl bundles a fixed Kustomize version, which may be older than the CLI **Explanation:** Each kubectl release ships one Kustomize version. Fields added in newer Kustomize releases, or changed behavior, make the two disagree. Use the same tool and version in CI and in production. ### Why does generatorOptions.immutable: true work well with Kustomize's default hash suffix? Kustomize, Hard (Expert), Generation. https://k8wiz.com/uquiz/why-does-generatoroptionsimmutable-true-work-well-with-kustomizes-default-hash-suffix - A. The hash proves to the API server that nobody changed the data inside the cluster - B. Immutable objects skip the hash, which keeps their names stable - C. New data gets a new name, so the old immutable ConfigMap never has to change - D. Kubernetes only accepts immutable ConfigMaps with hashed names **Answer:** New data gets a new name, so the old immutable ConfigMap never has to change **Explanation:** An immutable ConfigMap or Secret can't be edited, only deleted and recreated, and the kubelet stops watching it for changes, which lowers the load on the API server. With the hash suffix, every change already produces a new object. Without the hash, an apply that changes the data would fail.