'kustomize' components

This repository contains reusable kustomize components for Kubernetes deployments. Below is a list of the available components:

• barbacane-sidecar: puts a Barbacane gateway in front of a service, validating requests against its OpenAPI contract
• cloud-sql-proxy: deploys a Cloud SQL Proxy for secure database connections
• db-sync: handles PostgreSQL database "syncs", typically between 'staging' and 'devel'
• db-upgrade: handles PostgreSQL upgrades and migrations between instances
• gcs-bucket-proxy: provides a proxy for easy access to Google Cloud Storage buckets
• migrator: runs database migration jobs using alembic or goose
• nginx-sidecar: puts an nginx sidecar, configured by the project, in front of a service
• nightwatch: integrates our "Nachtwache" tests
• oauth2-proxy: integrates OAuth2 Proxy to authenticate against Keycloak
• pg-services: provides database credentials as PostgreSQL "connection service files"
• postgresql: provides PostgreSQL database deployments intended for testing
• postgrest: provides PostgREST deployments
• security-config: provides container hardening (dropped capabilities, r/o filesystem, /tmp volume)
• testrunner: run project test suites in Kubernetes
• wait-for-migrations: waits for database migrations to complete before starting dependent services

Each component is located in its dedicated subdirectory under components/.

Skills

Three workflows that are fiddlier than they look are written up as Claude Code skills under plugins/. Install them from this repository to have them available in the projects that need them:

/plugin marketplace add ZeitOnline/kustomize
/plugin install harden-k8s-workloads@zeitonline-kustomize
/plugin install adopt-goose-migrations@zeitonline-kustomize
/plugin install barbacane-migration@zeitonline-kustomize

Hardening skill

The steps for rolling out security-config and nginx-sidecar in a project — and the kustomize ordering rules that make it trickier than it looks — are written up as a Claude Code skill in plugins/harden-k8s-workloads/.

Migration skill

Converting a project's migrations to goose and running them with the migrator component — including the version jump, the job's bookkeeping and the connection service file — is written up in plugins/adopt-goose-migrations/.

Gateway skill

Putting a Barbacane gateway in front of a PostgREST service with the barbacane-sidecar component — the audit that has to come first, what the contract now decides, and the headers it stops forwarding — is written up in plugins/barbacane-migration/.