How to Set the Image Tag Dynamically in CI With kustomize edit set image

Run kustomize edit set image inside the overlay to rewrite the image tag to the SHA you just built, then apply the result.

After building and pushing, cd into the overlay and run kustomize edit set image app=<registry>/app:<sha>. This pins the tag in kustomization.yaml before kubectl apply -k.

Steps

• Push the image tagged with ${{ github.sha }}.
• In the overlay, run kustomize edit set image app=registry/app:${{ github.sha }}.
• Apply with kubectl apply -k.

Workflow

steps:
  - name: Pin image tag
    working-directory: overlays/prod
    run: |
      kustomize edit set image \
        app=ghcr.io/acme/app:${{ github.sha }}
  - run: kubectl apply -k overlays/prod
  - run: kubectl rollout status deployment/app -n prod --timeout=120s

Gotchas

• A plain yq edit of .spec.template.spec.containers[0].image works too if you do not use Kustomize.
• Prefer the image digest over a moving tag so the rollout is reproducible.

Related guides