Transformers: images, names, labels

Cross-cutting edits declaratively.

Transformers apply cross-cutting changes across all matched resources at once, declared as fields in kustomization.yaml. The built-in ones cover the common needs: images (change an image name/tag/digest everywhere it appears), replicas (set counts), namespace, namePrefix/nameSuffix, commonLabels/commonAnnotations, and the newer labels/annotations transformers with finer control. These handle the edits that would be tedious and error-prone to patch resource-by-resource.

images:
  - name: registry.internal/payments-api
    newName: registry.internal/payments-api   # optionally repoint
    newTag: "2.1.0"                            # or use digest: for immutability
replicas:
  - { name: payments-api, count: 4 }
namespace: payments-prod
commonAnnotations:
  managed-by: kustomize

The images transformer and pinning

The images transformer is the one you use most: it finds the image across every Deployment, StatefulSet, CronJob, and rewrites the tag (or, better, the digest) in one place. Setting digest: sha256:... instead of newTag pins the exact image bytes per environment — the same immutability discipline as the container courses, applied through Kustomize. This is how an overlay promotes the exact artifact tested in staging into prod.

images:
  - name: payments-api
    digest: sha256:9f2a44c1e0b7...    # pin the exact bytes, not a mutable tag