kustomize: inherit labels from base on overlay generator

I don't know how to handle it.

My service is deployed into 3 environments: des, pre and pro.

I only need to generate secret on des environment.

On pre and pro it's deployed by customer devops team.

My base/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

configurations:
  - kustomizeconfig/configurations/references-configuration.yaml

transformers:
  - kustomizeconfig/transformers/labels-transformer.yaml

generators:
  - kustomizeconfig/generators/configmap-generator.yaml

resources:
  - resources/deployment.yaml
  - resources/service.yaml

As you can see, I've created a labels-transformer.yaml where I put all my common labels:

apiVersion: builtin
kind: LabelTransformer
metadata:
  name: notImportantHere
labels:
    app.kubernetes.io/name: security-pwd
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/component: security-pwd
    app.kubernetes.io/part-of: espaidoc
    app.kubernetes.io/managed-by: kustomize
fieldSpecs:
- kind: Service
  path: metadata/labels
  create: true
- kind: Service
  path: spec/selector
  create: true
- kind: DeploymentConfig
  path: metadata/labels
  create: true
- kind: DeploymentConfig
  path: spec/template/metadata/labels
  create: true
- kind: ConfigMap
  path: metadata/labels
  create: true
- kind: Secret
  path: metadata/labels
  create: true

Into my des overlay I'm using a secret-generator in order to create the secret.

kustomize/overlays/des/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

transformers:
  # - kustomizeconfig/transformers/name-transformer.yaml
  - kustomizeconfig/transformers/labels-transformer.yaml
  - kustomizeconfig/transformers/image-transformer.yaml

generators:
  - kustomizeconfig/generators/config-generator.yaml
  - kustomizeconfig/generators/secret-generator.yaml

resources:
  - ../../base

kustomize/overlays/des/kustomizeconfig/generators/secret-generator.yaml:

apiVersion: builtin
kind: SecretGenerator
metadata:
    name: security-pwd
envs:
    - env/secret.env

However, my secret doesn't inherit labels from base:

apiVersion: v1
data:
  XXX:YYY
kind: Secret
metadata:
  labels:
    stage: development
  name: security-pwd-7g4h45kbc8
type: Opaque

As you can see, generated secret has only stage:development label.

My question, how should I address it?

Remember that secret is always needed, nevertheless, on pre and pro is externally provided. I mean, I can't put an empty generator on base layer since, I don't need to provide it on pre and pro. Only on des...

Any ideas?

With kustomize, nothing is "inherited". Transformations are only applied to manifests generated by the kustomization.yaml that defines the transformations. If you want a set of common labels applied to all your resources, you need to set those labels in the "outermost" kustomization.yaml.

If you need the same set of labels in multiple overlays and you want to avoid repeating yourself, you can bundle them into a component.

Directory layout

For this example, my directory layout look like:

.
├── base
│   ├── deployment.yaml
│   ├── kustomization.yaml
│   └── service.yaml
├── components
│   └── common-labels
│       ├── kustomization.yaml
│       └── labels-transformer.yaml
└── overlays
    ├── des
    │   └── kustomization.yaml
    └── pro
        └── kustomization.yaml

Base configuration

In components/common-labels/kustomization.yaml I have:

apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

transformers:
  - labels-transformer.yaml

And in components/common-labels/labels-transformer.yaml I have the example from your question.

In base/kustomization.yaml I have a kustomization.yaml that generates a deploymentconfig, a service, and a configmap:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - deployment.yaml
  - service.yaml

configMapGenerator:
  - name: example
    literals:
      - name=alice
      - email=alice@example.com

components:
  - ../components/common-labels

Running kustomize build base from the top level will generate manifests that have your common labels applied in all the locations specified by your transformer configuration:

apiVersion: v1
data:
  email: alice@example.com
  name: alice
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: security-pwd
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: security-pwd
    app.kubernetes.io/part-of: espaidoc
    app.kubernetes.io/version: 1.0.0
  name: example-b5hhtcf222
---
[...]

Overlay configuration

In overlays/des/kustomization.yaml, I have:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base

components:
- ../../components/common-labels

secretGenerator:
  - name: security-pwd
    literals:
      - password=secret

This outputs the same content as kustomize build base with the addition of a Secret resource, which is also appropriately labelled:

apiVersion: v1
data:
  password: c2VjcmV0
kind: Secret
metadata:
  labels:
    app.kubernetes.io/component: security-pwd
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: security-pwd
    app.kubernetes.io/part-of: espaidoc
    app.kubernetes.io/version: 1.0.0
  name: security-pwd-m4d885dchh
type: Opaque

Unrelated to your question, but openshift recommends using native Deployment resources rather than OpenShift-specific DeploymentConfig resources:

> Both Kubernetes Deployment objects and OpenShift Container Platform-provided DeploymentConfig objects are supported in OpenShift Container Platform; however, it is recommended to use Deployment objects unless you need a specific feature or behavior provided by DeploymentConfig objects.

If you use Deployment objects, you don't need a LabelsTransformer configuration (because kustomize knows where to apply labels on a Deployment object); you can just use the commonLabels directive in your kustomization.yaml.

You can find all the code shown in this answer in this repository.