- Remove ../../vault path from base kustomization (security) - Reference vault/mas-postgres.yaml directly from prod overlay