How to override a namespace override

Unfortunately it is not possible, the namespace override in kustomization assume all resources should belong to the same namespace.

Your alternative are:

• Create separate kustomization for resources that does not belong to the same namespace.
• Deploy resources that does not need kustomization by using kubectl apply -f .
• Use alternative replacement approach like suggested by Eric staples.

I generally create one kustomization per set of resources, that are deployed together in a namespace to make the kustomization simple and independent from any other resources.

This functionality doesn't exist in Kustomize yet. There's an open issue addressing this, but no open PRs at the time of this writing.

The quickest solution here is to remove the namespace setting in the dev/kustomize.yaml and hand-set the namespace in all resources in dev.

Another option, shamelessly copied from the issue I cited earlier, is to create a transformer to get around this:

#!/usr/bin/env /usr/bin/python3import sysimport yamlwith open(sys.argv[1], "r") as stream:    try:        data = yaml.safe_load(stream)    except yaml.YAMLError as exc:        print("Error parsing NamespaceTransformer input", file=sys.stderr)# See kubectl api-resources --namespaced=falsedenylist = [    "ComponentStatus",    "Namespace",    "Node",    "PersistentVolume",    "MutatingWebhookConfiguration",    "ValidatingWebhookConfiguration",    "CustomResourceDefinition",    "APIService",    "MeshPolicy",    "TokenReview",    "SelfSubjectAccessReview",    "SelfSubjectRulesReview",    "SubjectAccessReview",    "CertificateSigningRequest",    "ClusterIssuer",    "BGPConfiguration",    "ClusterInformation",    "FelixConfiguration",    "GlobalBGPConfig",    "GlobalFelixConfig",    "GlobalNetworkPolicy",    "GlobalNetworkSet",    "HostEndpoint",    "IPPool",    "PodSecurityPolicy",    "NodeMetrics",    "PodSecurityPolicy",    "ClusterRoleBinding",    "ClusterRole",    "ClusterRbacConfig",    "PriorityClass",    "StorageClass",    "VolumeAttachment",]try:    for yaml_input in yaml.safe_load_all(sys.stdin):        if yaml_input['kind'] not in denylist:            if "namespace" not in yaml_input["metadata"]:                yaml_input["metadata"]["namespace"] = data["namespace"]        print("---")        print(yaml.dump(yaml_input, default_flow_style=False))except yaml.YAMLError as exc:    print("Error parsing YAML input\n\n%s\n\n" % input, file=sys.stderr)

I am faced with the same problem.
My approach to this problem is to break it up into multiple steps.

I would have stepone, steptwo folders.

tree ./project/./project/├── stepone│   ├── base│   └── overlay└── steptwo    ├── base    └── overlay

Now I can move the part of the deployment that should not have the namespace override into steptwo or vice versa. Depending on your deployment needs.I am working on complex transitions from a heml template with over 200 files outputted from the templates.

I am simply breaking up the deployment into different steps and use kustomize at each step to manage just the portion of the deployment where isolation is required.

It does add some effort, but it still gives the isolation I need till kustomize finds a good way to handle this complexity of the namespace overide. This takes @Diego-mendes answer and encapsulates the different parts into their own folders.