kubeflow · Misha6Sharma · Nov 4, 2025 · Nov 4, 2025
diff --git a/applications/admission-webhook/upstream/base/kustomization.yaml b/applications/admission-webhook/upstream/base/kustomization.yaml
@@ -8,25 +8,20 @@ resources:
 - service-account.yaml
 - service.yaml
 - crd.yaml
-commonLabels:
-  app: poddefaults
-  kustomize.component: poddefaults
-  app.kubernetes.io/component: poddefaults
-  app.kubernetes.io/name: poddefaults
 images:
 - name: ghcr.io/kubeflow/kubeflow/poddefaults-webhook
   newName: ghcr.io/kubeflow/kubeflow/poddefaults-webhook
   newTag: v1.10.0
 namespace: kubeflow
 generatorOptions:
   disableNameSuffixHash: true
-vars:
 # These vars are used to substitute in the namespace, service name and
 # deployment name into the mutating WebHookConfiguration.
 # Since its a CR kustomize isn't aware of those fields and won't
 # transform them.
 # We need the var names to be relatively unique so that when we
 # compose with other applications they won't conflict.
+vars:
 - fieldref:
     fieldPath: metadata.namespace
   name: podDefaultsNamespace
@@ -50,3 +45,10 @@ vars:
     name: deployment
 configurations:
 - params.yaml
+labels:
+- includeSelectors: true
+  pairs:
+    app: poddefaults
+    app.kubernetes.io/component: poddefaults
+    app.kubernetes.io/name: poddefaults
+    kustomize.component: poddefaults
diff --git a/applications/admission-webhook/upstream/overlays/cert-manager/kustomization.yaml b/applications/admission-webhook/upstream/overlays/cert-manager/kustomization.yaml
@@ -4,44 +4,47 @@
 # the certificate.
 # TODO(jlewi): We should eventually refactor the manifests to delete
 # bootstrap and use certmanager by default.
-bases:
-- ../../base
 
 resources:
 - certificate.yaml
+- ../../base
 
 namespace: kubeflow
 
 namePrefix: admission-webhook-
 
-commonLabels:
-  app: poddefaults
-  kustomize.component: poddefaults
-  app.kubernetes.io/component: poddefaults
-  app.kubernetes.io/name: poddefaults
 
-patchesStrategicMerge:
-- mutating-webhook-configuration.yaml
-- deployment.yaml
 
 generatorOptions:
   disableNameSuffixHash: true
 
-vars:
 # These vars are used to substitute in the namespace, service name and
 # deployment name into the mutating WebHookConfiguration.
 # Since its a CR kustomize isn't aware of those fields and won't
 # transform them.
 # We need the var names to be relatively unique so that when we
 # compose with other applications they won't conflict.
-- name: podDefaultsCertName
+vars:
+- fieldref:
+    fieldPath: metadata.name
+  name: podDefaultsCertName
   objref:
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: cert
-  fieldref:
-    fieldpath: metadata.name
+    group: cert-manager.io
+    kind: Certificate
+    name: cert
+    version: v1
 
 configurations:
 - params.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app: poddefaults
+    app.kubernetes.io/component: poddefaults
+    app.kubernetes.io/name: poddefaults
+    kustomize.component: poddefaults
+patches:
+- path: mutating-webhook-configuration.yaml
+- path: deployment.yaml
diff --git a/applications/jupyter/jupyter-web-app/upstream/base/kustomization.yaml b/applications/jupyter/jupyter-web-app/upstream/base/kustomization.yaml
@@ -17,9 +17,6 @@ resources:
 - configs/logos-configmap.yaml
 namePrefix: jupyter-web-app-
 namespace: kubeflow
-commonLabels:
-  app: jupyter-web-app
-  kustomize.component: jupyter-web-app
 images:
 - name: ghcr.io/kubeflow/kubeflow/jupyter-web-app
   newName: ghcr.io/kubeflow/kubeflow/jupyter-web-app
@@ -76,17 +73,22 @@ vars:
     apiVersion: v1
     kind: ConfigMap
     name: parameters
-- name: JWA_APP_SECURE_COOKIES
-  fieldref:
+- fieldref:
     fieldPath: data.JWA_APP_SECURE_COOKIES
+  name: JWA_APP_SECURE_COOKIES
   objref:
     apiVersion: v1
     kind: ConfigMap
     name: parameters
-- name: JWA_APP_ENABLE_METRICS
-  fieldref:
+- fieldref:
     fieldPath: data.JWA_APP_ENABLE_METRICS
+  name: JWA_APP_ENABLE_METRICS
   objref:
     apiVersion: v1
     kind: ConfigMap
     name: parameters
+labels:
+- includeSelectors: true
+  pairs:
+    app: jupyter-web-app
+    kustomize.component: jupyter-web-app
diff --git a/applications/jupyter/notebook-controller/upstream/default/kustomization.yaml b/applications/jupyter/notebook-controller/upstream/default/kustomization.yaml
@@ -9,15 +9,8 @@ namespace: notebook-controller-system
 namePrefix: notebook-controller-
 
 # Labels to add to all resources and selectors.
-commonLabels:
-  app: notebook-controller
-  kustomize.component: notebook-controller
 
 
-bases:
-- ../rbac
-- ../manager
-- ../crd
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in crd/kustomization.yaml
 #- ../webhook
 # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
@@ -45,31 +38,14 @@ bases:
 #- webhookcainjection_patch.yaml
 
 # the following config is for teaching kustomize how to do var substitution
-vars:
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
-# - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
-#   objref:
-#     kind: Certificate
-#     group: certmanager.k8s.io
-#     version: v1alpha1
-#     name: serving-cert # this name should match the one in certificate.yaml
-#   fieldref:
-#     fieldpath: metadata.namespace
-# - name: CERTIFICATE_NAME
-#   objref:
-#     kind: Certificate
-#     group: certmanager.k8s.io
-#     version: v1alpha1
-#     name: serving-cert # this name should match the one in certificate.yaml
-# - name: SERVICE_NAMESPACE # namespace of the service
-#   objref:
-#     kind: Service
-#     version: v1
-#     name: webhook-service
-#   fieldref:
-#     fieldpath: metadata.namespace
-# - name: SERVICE_NAME
-#   objref:
-#     kind: Service
-#     version: v1
-#     name: webhook-service
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../rbac
+- ../manager
+- ../crd
+labels:
+- includeSelectors: true
+  pairs:
+    app: notebook-controller
+    kustomize.component: notebook-controller
diff --git a/applications/katib/upstream/installs/katib-cert-manager/kustomization.yaml b/applications/katib/upstream/installs/katib-cert-manager/kustomization.yaml
@@ -1,69 +1,68 @@
----
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kubeflow
-resources:
   # Namespace.
-  - ../../components/namespace
   # Katib controller.
-  - ../../components/controller/
   # Katib CRDs.
-  - ../../components/crd/
   # Katib DB manager.
-  - ../../components/db-manager/
   # Katib DB mysql.
-  - ../../components/mysql/
   # Katib UI.
-  - ../../components/ui/
   # Katib webhooks.
-  - ../../components/webhook/
   # Cert-manager certificate for webhooks
-  - certificate.yaml
+resources:
+- ../../components/namespace
+- ../../components/controller/
+- ../../components/crd/
+- ../../components/db-manager/
+- ../../components/mysql/
+- ../../components/ui/
+- ../../components/webhook/
+- certificate.yaml
 images:
-  - name: ghcr.io/kubeflow/katib/katib-controller
-    newName: ghcr.io/kubeflow/katib/katib-controller
-    newTag: v0.18.0
-  - name: ghcr.io/kubeflow/katib/katib-db-manager
-    newName: ghcr.io/kubeflow/katib/katib-db-manager
-    newTag: v0.18.0
-  - name: ghcr.io/kubeflow/katib/katib-ui
-    newName: ghcr.io/kubeflow/katib/katib-ui
-    newTag: v0.18.0
+- name: ghcr.io/kubeflow/katib/katib-controller
+  newName: ghcr.io/kubeflow/katib/katib-controller
+  newTag: v0.18.0
+- name: ghcr.io/kubeflow/katib/katib-db-manager
+  newName: ghcr.io/kubeflow/katib/katib-db-manager
+  newTag: v0.18.0
+- name: ghcr.io/kubeflow/katib/katib-ui
+  newName: ghcr.io/kubeflow/katib/katib-ui
+  newTag: v0.18.0
 
-patchesStrategicMerge:
-  - patches/katib-cert-injection.yaml
 
 vars:
-  - fieldref:
-      fieldPath: metadata.namespace
-    name: KATIB_NAMESPACE
-    objref:
-      apiVersion: v1
-      kind: Service
-      name: katib-controller
-  - fieldref:
-      fieldPath: metadata.name
-    name: KATIB_SERVICE_NAME
-    objref:
-      apiVersion: v1
-      kind: Service
-      name: katib-controller
-  - name: KATIB_CERT_NAME
-    objref:
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: katib-webhook-cert
-    fieldref:
-      fieldpath: metadata.name
+- fieldref:
+    fieldPath: metadata.namespace
+  name: KATIB_NAMESPACE
+  objref:
+    apiVersion: v1
+    kind: Service
+    name: katib-controller
+- fieldref:
+    fieldPath: metadata.name
+  name: KATIB_SERVICE_NAME
+  objref:
+    apiVersion: v1
+    kind: Service
+    name: katib-controller
+- fieldref:
+    fieldPath: metadata.name
+  name: KATIB_CERT_NAME
+  objref:
+    group: cert-manager.io
+    kind: Certificate
+    name: katib-webhook-cert
+    version: v1
 
 configurations:
-  - params.yaml
+- params.yaml
 
 configMapGenerator:
-  - name: katib-config
-    behavior: create
-    files:
-      - katib-config.yaml
-    options:
-      disableNameSuffixHash: true
+- behavior: create
+  files:
+  - katib-config.yaml
+  name: katib-config
+  options:
+    disableNameSuffixHash: true
+patches:
+- path: patches/katib-cert-injection.yaml