# kubectl kustomize: Render Overlays in CI

> kubectl kustomize builds rendered manifests from a kustomization directory. Reference for the build path, apply -k, --enable-helm, and the unknown-field error.

Source: https://latchkey.dev/learn/command-reference/kubectl-kustomize-build  
Updated: 2026-06-30

kubectl kustomize renders a kustomization directory into final YAML on stdout, the same engine used by kubectl apply -k.

Kustomize layers patches and generators onto base manifests without templating. Rendering with kubectl kustomize lets a pipeline inspect the output before applying it.

## What it does

kubectl kustomize reads a `kustomization.yaml` in the given directory, applies its bases, patches, name prefixes, and generators, and prints the combined manifests to stdout. `kubectl apply -k <dir>` runs the same render and applies the result.

## Common usage

```Terminal
kubectl kustomize ./overlays/prod
# render and apply in one step
kubectl apply -k ./overlays/prod
# render to a file for review/diff
kubectl kustomize ./overlays/prod > rendered.yaml
```

## Options

| Flag | What it does |
| --- | --- |
| <dir> | Directory containing kustomization.yaml |
| -o, --output | Write rendered output to a file or directory |
| --enable-helm | Allow the helmCharts generator (off by default) |
| --load-restrictor | Control reading files outside the kustomization root |
| -k (on apply/diff) | Treat the path as a kustomize directory |

## In CI

kubectl ships an embedded kustomize that often lags the standalone `kustomize` binary; pin and document which one your pipeline uses to avoid version-skew surprises. Render once with `kubectl kustomize` and feed the output to `kubectl diff -f -` to preview, then `apply -k` to deploy.

## Common errors in CI

"error: unable to find one of 'kustomization.yaml' ... in directory" means the path is wrong or the file is named differently. "json: unknown field \"<x>\"" means a key not supported by the embedded kustomize version, usually because a newer field needs a newer kubectl. "must specify --enable-helm" appears when a kustomization uses helmCharts; add the flag or pre-render the chart.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### kubectl kustomize: Render Overlays in CI?

Kustomize layers patches and generators onto base manifests without templating. Rendering with kubectl kustomize lets a pipeline inspect the output before applying it.

### What it does?

kubectl kustomize reads a kustomization.yaml in the given directory, applies its bases, patches, name prefixes, and generators, and prints the combined manifests to stdout. kubectl apply -k <dir> runs the same render and applies the result.

### In CI?

kubectl ships an embedded kustomize that often lags the standalone kustomize binary; pin and document which one your pipeline uses to avoid version-skew surprises. Render once with kubectl kustomize and feed the output to kubectl diff -f - to preview, then apply -k to deploy.

### Common errors in CI?

"error: unable to find one of 'kustomization.yaml' ... in directory" means the path is wrong or the file is named differently. "json: unknown field \"<x>\"" means a key not supported by the embedded kustomize version, usually because a newer field needs a newer kubectl.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt