Kustomize
Hard
Security
A production overlay lists a remote base with ?ref=main. What's the risk?
Select your answer:
Show answer and explanation
Answer: The build changes whenever main changes, even if your own repository doesn't
Explanation
Kustomize fetches the remote repository at the given ref on every build. A branch moves, so two builds of the same commit can produce different YAML. Pin ref to a tag or, better, a commit SHA, and update it on purpose.
More hard Kustomize questions
- A strategic merge patch adds one item to a list in a custom resource, but the build replaces the whole list. Why?
- A custom resource refers to a generated ConfigMap by name, but after the build it still uses the name without the hash suffix. Why?
- An overlay's configMapGenerator uses the same name as one generated in the base, with no behavior set. What happens?
- A kustomization sets namespace: team-a and includes a ClusterRole. What happens to the ClusterRole?
- In a strategic merge patch, what does $patch: replace inside a container's resources map do?
- A patch target sets name: app. Does it also match a Deployment named app-worker?