Interview › Infrastructure as Code (Terraform, Ansible)

When would you choose Kustomize over Helm, and can you use them together?

Infrastructure as Code (Terraform, Ansible) · Advanced level

Answer

I choose Kustomize when I already have Kubernetes YAML and need clean overlays without templating. I choose Helm when I need chart packaging, broad configurability, dependencies, or third-party application installs. They can be combined, but the pipeline should clearly separate rendering from patching.

Technical explanation

Helm plus Kustomize is common for third-party charts that need final organization-specific patches.

Do not stack too many rendering layers or debugging becomes hard.

Prefer one primary packaging model per service.

Keep source manifests or IaC definitions readable enough that reviewers can understand the final desired state.

Use overlays, modules, or roles for reuse, but keep environment-specific differences explicit and reviewable.

Validate generated output in CI before applying it through kubectl, Argo CD, Terraform, or Ansible.

Hands-on example

1. Create a Kustomize base and overlay for: When would you choose Kustomize over Helm, and can you use them together?

2. Base files:

base/deployment.yaml

base/service.yaml

base/kustomization.yaml

base/kustomization.yaml:

resources:

- deployment.yaml

- service.yaml

commonLabels:

app.kubernetes.io/name: payments

3. prod overlay:

resources:

- ../../base

namePrefix: prod-

namespace: payments-prod

images:

- name: ghcr.io/company/payments

newTag: 1.8.4

configMapGenerator:

- name: app-config

literals:

- LOG_LEVEL=info

patches:

- path: replica-patch.yaml

4. Render and apply:

kubectl kustomize overlays/prod

kubectl diff -k overlays/prod

kubectl apply -k overlays/prod

5. In GitOps, point Argo CD at overlays/prod and let it render, compare, and sync the desired state.

More Infrastructure as Code (Terraform, Ansible) interview questions

• What is Infrastructure as Code, and what problems does it solve over click-ops?
• What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
• What is the difference between configuration management and provisioning?
• What is Terraform, and what is the core plan/apply workflow?
• What does terraform init do?
• What is the Terraform state file, and why is it critical?
• Why should state be stored remotely, and what backend would you use on AWS?
• What is state locking, and why does it matter for teams?

← All Infrastructure as Code (Terraform, Ansible) questions