Kustomize in GitOps & securing it

Argo/Flux, build, scan, deploy.

Advanced14 min · lesson 12 of 12

Kustomize is a natural fit for GitOps: overlays are plain YAML in Git, and Argo CD and Flux both build kustomizations natively — point the GitOps controller at an overlay directory and it renders and applies it, keeping the cluster synced to Git. You rarely run kubectl apply -k by hand in this model; Git is the source of truth and the controller reconciles. The security work is to make the build reviewable and the deploy least-privilege.

.gitlab-ci.yml

render-scan:
  script:
    - kustomize build overlays/prod > out.yaml       # pinned standalone kustomize
    - kubeconform -strict out.yaml                    # schema validity
    - checkov -f out.yaml --framework kubernetes      # security posture
    - trivy config out.yaml                           # misconfig scan
  # gate the merge on the assembled result, before the GitOps controller applies it

Securing the pipeline

The controls mirror every IaC pipeline. Render the overlay and scan the assembled manifests in CI before merge — a patch can quietly drop a securityContext or a remote base can add a privileged pod, and only the built output reveals it. Let the GitOps controller hold cluster credentials with scoped RBAC (not cluster-admin), pin remote bases and helmCharts to immutable refs, and keep secrets out of the repo with SOPS or an external secrets operator.

The secure Kustomize pipeline

1PR: build

kustomize build

2scan

schema + security + policy

3merge

reviewed overlay

4sync

GitOps applies, scoped RBAC

Build the overlay, scan the real output, review, then let Git drive the apply with least-privilege credentials.

Review the build output, not just the overlay diff

A one-line overlay change or a bumped remote-base ref can transform the assembled manifests in ways the small diff hides — a dropped securityContext, a widened RBAC rule, a new privileged workload. Make CI render the full kustomize build and scan/diff that, and gate merges on it. The rendered result is what the cluster runs; the overlay file is only the instructions to produce it.

Kustomize vs Helm (and together)Finish · self-test