
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
kustomize lets you customize raw, template-free YAML
files for multiple purposes, leaving the original YAML
untouched and usable as is.
kustomize targets kubernetes; it understands and can
patch kubernetes style API objects. It's like
make, in that what it does is declared in a file,
and it's like sed, in that it emits editted text.
This tool is sponsored by sig-cli (KEP), and inspired by DAM.
Installation: Download a binary from the release page, or see these install notes. Then try one of the tested examples.
In some directory containing your YAML resource files (deployments, services, configmaps, etc.), create a kustomization file.
This file should declare those resources, and any customization to apply to them, e.g. add a common label.

File structure:
~/someApp ├── deployment.yaml ├── kustomization.yaml └── service.yaml
The resources in this directory could be a fork of someone else's configuration. If so, you can easily rebase from the source material to capture improvements, because you don't modify the resources directly.
Generate customized YAML with:
kustomize build ~/someApp
The YAML can be directly applied to a cluster:
kustomize build ~/someApp | kubectl apply -f -
Manage traditional variants of a configuration - like development, staging and production - using overlays that modify a common base.

File structure:
~/someApp ├── base │ ├── deployment.yaml │ ├── kustomization.yaml │ └── service.yaml └── overlays ├── development │ ├── cpu_count.yaml │ ├── kustomization.yaml │ └── replica_count.yaml └── production ├── cpu_count.yaml ├── kustomization.yaml └── replica_count.yaml
Take the work from step (1) above, move it into a
someApp subdirectory called base, then
place overlays in a sibling directory.
An overlay is just another kustomization, refering to the base, and referring to patches to apply to that base.
This arrangement makes it easy to manage your
configuration with git. The base could have files
from an upstream repository managed by someone else.
The overlays could be in a repository you own.
Arranging the repo clones as siblings on disk avoids
the need for git submodules (though that works fine, if
you are a submodule fan).
Generate YAML with
kustomize build ~/someApp/overlays/production
The YAML can be directly applied to a cluster:
kustomize build ~/someApp/overlays/production | kubectl apply -f -
kustomize version,kustomization.yaml
and any files it refers to),Kustomize has a simple test harness in the target package for specifying a kustomization's input and the expected output. See this example of a target test.
The pattern is
NewKustTestHarnessmakeKustTarget().MakeCustomizedResMap()In a bug reproduction test, the expected output string initially contains the wrong (unexpected) output, thus unambiguously reproducing the bug.
Nearby comments should explain what the output should be, and have a TODO pointing to the related issue.
The person who fixes the bug then has a clear bug reproduction and a test to modify when the bug is fixed.
The bug reporter can then see the bug was fixed, and has permanent regression coverage to prevent its reintroduction.
Feature requests are welcome.
Before working on an implementation, please
Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.