kustomize build: Usage, Options & Common CI Errors

Render final Kubernetes manifests from a kustomization overlay.

kustomize build evaluates a kustomization directory and emits the fully rendered Kubernetes YAML. In CI you build an overlay and pipe it to kubectl apply, or diff it as a gate.

What it does

kustomize build <dir> reads the kustomization.yaml at that path, applies its bases, patches, name prefixes, images, and generators, and writes the resulting multi-document YAML to stdout. kubectl apply -k <dir> does the same build inline before applying.

Common usage

# Render an overlay to stdout
kustomize build overlays/prod

# Render and apply in one step
kustomize build overlays/prod | kubectl apply -f -

# kubectl’s built-in kustomize
kubectl apply -k overlays/prod

Common error in CI: resource not found / security flag needed

build fails with "accumulating resources ... evalsymlink failure / no such file" when a resources path is wrong, or "security; file is not in or below the current directory ... use --load-restrictor LoadRestrictionsNone" when referencing files outside the root. Fix: make resource paths relative to the kustomization and committed, and only add --load-restrictor LoadRestrictionsNone when you deliberately reference shared files outside the dir (it loosens a safety check). Pin the kustomize version so transformer behavior is stable across runs.

Key options

Related guides