Feature Request: Allow configuring the Kustomize executable instead of automatically preferring kubectl kustomize

[ltshb]

Describe the feature

Allow users to explicitly configure which Kustomize implementation Checkov should use instead of relying on the current automatic detection logic.

Today, Checkov attempts to execute:

1. kubectl kustomize
2. Falls back to kustomize if the first command is unavailable.

While this seems convenient, it can easily lead to inconsistent behavior between local development and CI environments.

For example:

• A developer has both kubectl and kustomize installed locally.
• kubectl embeds an older Kustomize version.
• The CI environment only installs the standalone kustomize binary.
• Checkov silently uses different implementations in each environment.

This makes builds difficult to reproduce and can be very confusing because users might assume Checkov is using the standalone kustomize binary.

This becomes particularly problematic because of the existing issue where Checkov silently continues when the Kustomize build fails instead of surfacing an error: #7599

As a result, users may spend significant time debugging differences caused only by Checkov selecting a different Kustomize implementation.

A possible solution would be to provide one or more of the following:

• A CLI flag such as:

  --kustomize=kustomize
  

  or

  --kustomize="kubectl kustomize"
  

• An environment variable with the same purpose.
• A configuration option in the Checkov configuration file.

Explicit configuration would make scans deterministic and reproducible across local machines and CI environments.

---

Examples

Local environment

Installed tools:

kubectl -> embedded Kustomize v5.0.x
kustomize -> v5.8.x

Current behavior:

Checkov executes:

kubectl kustomize

although the user expects it to use:

kustomize

CI environment

Installed tools:

kustomize -> v5.8.x

Current behavior:

Checkov executes:

kustomize

Result:

• Local and CI produce different manifests.
• Different policy violations may be reported.
• Troubleshooting is difficult because users may only verify the standalone kustomize version, while Checkov actually used kubectl kustomize locally.

Expected behavior

Users should be able to explicitly configure the executable:

checkov --kustomize=kustomize

or

checkov --kustomize="kubectl kustomize"

Checkov should consistently use the configured command in every environment.

---

Additional context

This feature would improve:

• reproducibility between local development and CI
• easier debugging
• deterministic scans
• compatibility with organizations that standardize on a specific Kustomize version