Kustomize adversary

The Kustomize adversary reviews Kustomize source configuration before it is rendered or deployed. Its goal is to find high-confidence security, supply-chain, and reliability problems introduced by bases, generators, transformers, and overlays.

Scope

The adversary scans Kustomization files named Kustomization, kustomization.yaml, or kustomization.yml, together with YAML patch files in the repository. It focuses on risks that are specific to the Kustomize composition layer, including mutable inputs, unsafe generator data, risky overlay patches, and configuration that makes deployments non-reproducible or stale.

Findings are deterministic and include file and line evidence. The complete detector inventory is in CHECKS.md.

Boundaries

This adversary evaluates authored Kustomize configuration, not the fully rendered Kubernetes resources. Security policy for rendered workloads, RBAC, and raw manifests belongs to the kubernetes adversary. Helm chart analysis belongs to helm, and generic secrets outside Kustomize generators belong to security/secrets.

SDK source coverage

This release uses SDK 0.1.43. This reviewer uses deterministic prepared evidence rather than repository-tool model retrieval, so it has no model coverage result to reinterpret. Existing evidence gates and deterministic findings are preserved.

SDK 0.1.43

This release rebuilds with SDK 0.1.43. SDK PR #73 adds a tested neutral fallback to formatOpinionAsync when concern wording validation is exhausted, preserving completed findings and the ship decision. Reviewers that do not call this API retain their existing opinion behavior. Provider and transport failures remain errors. Domain rules and evidence requirements are unchanged.