This repository contains reusable kustomize components for Kubernetes deployments. Below is a list of the available components:
- cloud-sql-proxy: deploys a Cloud SQL Proxy for secure database connections
- db-sync: handles PostgreSQL database "syncs", typically between 'staging' and 'devel'
- db-upgrade: handles PostgreSQL upgrades and migrations between instances
- gcs-bucket-proxy: provides a proxy for easy access to Google Cloud Storage buckets
- migrator: runs database migration jobs using alembic
- nginx-sidecar: puts an nginx sidecar, configured by the project, in front of a service
- nightwatch: integrates our "Nachtwache" tests
- oauth2-proxy: integrates OAuth2 Proxy to authenticate against Keycloak
- pg-services: provides database credentials as PostgreSQL "connection service files"
- postgresql: provides PostgreSQL database deployments intended for testing
- postgrest: provides PostgREST deployments
- security-config: provides container hardening (dropped capabilities, r/o filesystem,
/tmpvolume) - testrunner: run project test suites in Kubernetes
- wait-for-migrations: waits for database migrations to complete before starting dependent services
Each component is located in its dedicated subdirectory under components/.
The steps for rolling out security-config and
nginx-sidecar in a project — and the kustomize ordering rules that
make it trickier than it looks — are written up as a Claude Code skill in
plugins/harden-k8s-workloads/. Install it from this repository
to have it available in the projects that need it:
/plugin marketplace add ZeitOnline/kustomize
/plugin install harden-k8s-workloads@zeitonline-kustomize