# Fix a Kustomize overlay for production

> The prod overlay doesn't build, and once it does it still ships the wrong image. Fix the generator, the patch and the image rule.

Level: Intermediate · Topic: GitOps · About 12 minutes
Try it in the browser: https://k8wiz.com/playground/fix-a-kustomize-overlay-for-production

The playground is a simulated Kubernetes cluster that runs in the browser. kubectl output and errors follow the real ones.

## The situation

The app has a `base` and two overlays. Staging is deployed and fine. The prod overlay has never worked.

Prod should run 3 replicas of `ghcr.io/k8wiz/hello:1.1` in the `prod` namespace, with a 256Mi memory limit and its own greeting.

`kubectl kustomize overlays/prod` builds it without touching the cluster. Edit the files in the editor (or with `cat > file`), then `kubectl apply -k overlays/prod`.

## Objectives

1. Build the prod overlay without errors (`kubectl kustomize overlays/prod`)
2. prod runs 3 replicas of hello 1.1
3. prod-web has a 256Mi memory limit
4. prod greets with its own message (Its generated ConfigMap says `Hello from production`)
5. staging is unchanged

## Hints

1. The base already generates `web-config`. An overlay that generates the same name must say what to do with it: `behavior: merge` keeps the base's keys and overrides some.
2. A patch finds its target by kind and name as the base calls it. The base's Deployment is `web`, not `webapp` (the `prod-` prefix comes later).
3. The build passes, but look at the image in its output. An `images` entry matches the full image name, `ghcr.io/k8wiz/hello`, not just `hello`.
4. Build again, read the output, then `kubectl apply -k overlays/prod`.

## Solution

```bash
kubectl kustomize overlays/prod
```
```bash
cat > overlays/prod/kustomization.yaml <<'EOF'
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: prod
namePrefix: prod-
resources:
- ../../base
replicas:
- name: web
  count: 3
images:
- name: ghcr.io/k8wiz/hello
  newTag: "1.1"
configMapGenerator:
- name: web-config
  behavior: merge
  literals:
  - GREETING=Hello from production
patches:
- path: memory.yaml
EOF
```
```bash
cat > overlays/prod/memory.yaml <<'EOF'
# Production gets a memory limit
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  template:
    spec:
      containers:
      - name: web
        resources:
          limits:
            memory: 256Mi
EOF
```
```bash
kubectl kustomize overlays/prod
```
```bash
kubectl apply -k overlays/prod
```
```bash
kubectl rollout status deployment prod-web -n prod
```

## What it teaches

- Overlays change a base without copying it: `namespace`, `namePrefix`, `images`, `replicas` and `patches` are applied on top.
- Patches and `replicas` target names as the base defines them. The prefix and the generators' hash suffix are added afterwards, and references to renamed objects are updated for you.
- A generated ConfigMap's name ends in a hash of its content, so changing the content renames it and rolls the Pods that use it.
- An `images` rule that doesn't match fails silently. Always read the built output (`kubectl kustomize` or `kubectl diff -k`) before applying.