Re：Kustomize

ディレクトリ構成

k8s/
├─ base/
│  ├─ namespace.yaml
│  ├─ kustomization.yaml
│  ├─ postgres/
│  │  ├─ statefulset.yaml
│  │  ├─ service.yaml
│  │  ├─ init-configmap.yaml
│  │  └─ auth-secret.yaml            # 実運用では overlays 側で生成推奨
│  ├─ odoo/
│  │  ├─ deployment.yaml
│  │  ├─ service.yaml
│  │  └─ ingress.yaml
│  ├─ portal-api/
│  │  ├─ deployment.yaml
│  │  ├─ service.yaml
│  │  ├─ ingress.yaml
│  │  ├─ hpa.yaml
│  │  ├─ api-configmap.yaml
│  │  └─ api-secret.yaml             # 実運用では overlays 側で secretGenerator 推奨
│  ├─ chroma/
│  │  ├─ statefulset.yaml
│  │  └─ service.yaml
│  └─ cronjobs/
│     ├─ ir-src-rebuild.yaml
│     ├─ cj-extract-view.yaml
│     ├─ cj-extract-field.yaml
│     ├─ cj-translate-run.yaml
│     ├─ cj-chroma-package.yaml
│     └─ cj-chroma-upsert.yaml
└─ overlays/
   ├─ dev/
   │  ├─ kustomization.yaml
   │  ├─ patch-portal-api-image.yaml
   │  ├─ patch-ingress-hosts.yaml
   │  ├─ secret-generator.yaml
   │  └─ configmap-generator.yaml
   └─ prod/
      ├─ kustomization.yaml
      ├─ patch-portal-api-image.yaml
      ├─ patch-replicas-resources.yaml
      ├─ patch-ingress-hosts.yaml
      ├─ secret-generator.yaml
      └─ configmap-generator.yaml

k8s/base/kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: portal-dev

resources:
  - namespace.yaml
  - postgres/statefulset.yaml
  - postgres/service.yaml
  - postgres/init-configmap.yaml
  - postgres/auth-secret.yaml
  - odoo/deployment.yaml
  - odoo/service.yaml
  - odoo/ingress.yaml
  - chroma/statefulset.yaml
  - chroma/service.yaml
  - portal-api/deployment.yaml
  - portal-api/service.yaml
  - portal-api/ingress.yaml
  - portal-api/hpa.yaml
  - portal-api/api-configmap.yaml
  - portal-api/api-secret.yaml
  - cronjobs/ir-src-rebuild.yaml
  - cronjobs/cj-extract-view.yaml
  - cronjobs/cj-extract-field.yaml
  - cronjobs/cj-translate-run.yaml
  - cronjobs/cj-chroma-package.yaml
  - cronjobs/cj-chroma-upsert.yaml

base の中身は、これまで使っていた YAML を単純に移してOK（Namespace名だけ ${NAMESPACE} にせず固定で良いならこのまま）。

k8s/overlays/dev/kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
nameSuffix: -dev
namespace: portal-dev

resources:
  - ../../base

patchesStrategicMerge:
  - patch-portal-api-image.yaml
  - patch-ingress-hosts.yaml

# dev用 Secret/ConfigMap を generator で上書き（再現性のため literals 例）
generators:
  - secret-generator.yaml
  - configmap-generator.yaml

k8s/overlays/dev/patch-portal-api-image.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: portal-api
spec:
  replicas: 2
  template:
    spec:
      containers:
        - name: api
          image: your-registry/portal-api:dev

k8s/overlays/dev/patch-ingress-hosts.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: odoo
spec:
  rules:
    - host: odoo.dev.example.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: portal-api
spec:
  rules:
    - host: api.dev.example.com

k8s/overlays/dev/secret-generator.yaml

apiVersion: generators.kustomize.dev/v1beta1
kind: SecretGenerator
metadata:
  name: overlay-secrets
  labels: { app: portal-api }
type: Opaque
literals:
  - DB_USER=portal
  - DB_PASSWORD=change-portal-pass
  - API_BEARER_TOKEN=dev-token
# 生成名衝突を避けたいなら behavior: replace と nameReference を利用

k8s/overlays/dev/configmap-generator.yaml

apiVersion: generators.kustomize.dev/v1beta1
kind: ConfigMapGenerator
metadata:
  name: overlay-config
literals:
  - APP_ENV=dev
  - LOG_LEVEL=info
  - API_PORT=8000
  - DB_HOST=postgres
  - DB_PORT=5432
  - DB_NAME=portal
  - CHROMA_HOST=chroma
  - CHROMA_PORT=8000
  - CHROMA_COLLECTION_FIELD_JA=portal_field_ja
  - CHROMA_COLLECTION_VIEW_JA=portal_view_common_ja

実運用では base 側の api-secret.yaml / api-configmap.yaml を削り、overlays の generator で作るのがセオリーです（ここでは分かりやすさ重視で両方式の雛形を提示）。

k8s/overlays/prod/kustomization.yaml（例）

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
nameSuffix: -prod
namespace: portal-prod

resources:
  - ../../base

patchesStrategicMerge:
  - patch-portal-api-image.yaml
  - patch-replicas-resources.yaml
  - patch-ingress-hosts.yaml

generators:
  - secret-generator.yaml
  - configmap-generator.yaml

k8s/overlays/prod/patch-portal-api-image.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: portal-api
spec:
  template:
    spec:
      containers:
        - name: api
          image: your-registry/portal-api:1.0.0

k8s/overlays/prod/patch-replicas-resources.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: portal-api
spec:
  replicas: 4
  template:
    spec:
      containers:
        - name: api
          resources:
            requests: { cpu: "500m", memory: "512Mi" }
            limits:   { cpu: "2",    memory: "2Gi" }
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  replicas: 1
  volumeClaimTemplates:
    - metadata: { name: data }
      spec:
        resources: { requests: { storage: 100Gi } }

k8s/overlays/prod/patch-ingress-hosts.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: odoo
spec:
  rules:
    - host: odoo.example.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: portal-api
spec:
  rules:
    - host: api.example.com

k8s/overlays/prod/secret-generator.yaml（例）

apiVersion: generators.kustomize.dev/v1beta1
kind: SecretGenerator
metadata: { name: overlay-secrets }
type: Opaque
literals:
  - DB_USER=portal
  - DB_PASSWORD=***REDACTED***
  - API_BEARER_TOKEN=***REDACTED***

k8s/overlays/prod/configmap-generator.yaml（例）

apiVersion: generators.kustomize.dev/v1beta1
kind: ConfigMapGenerator
metadata: { name: overlay-config }
literals:
  - APP_ENV=prod
  - LOG_LEVEL=info
  - API_PORT=8000
  - DB_HOST=postgres
  - DB_PORT=5432
  - DB_NAME=portal
  - CHROMA_HOST=chroma
  - CHROMA_PORT=8000
  - CHROMA_COLLECTION_FIELD_JA=portal_field_ja
  - CHROMA_COLLECTION_VIEW_JA=portal_view_common_ja