KustomizeGoat

No Change
trial
First Added:June 15, 2026 Updated: July 2, 2026

KustomizeGoat. Is Bridgecrew’s “Vulnerable by Design” Kustomize manifest repository.

Blurb

Vulnerable Kustomize Kubernetes templates for training and education - bridgecrewio/kustomizegoat

Summary

Garden stance: We trial KustomizeGoat for our estate.

When to use: Evaluate on a project when the capability clearly fits the requirement.

When to skip: When a simpler alternative already covers the need.

Details

Compared to Kubernetes Goat

LensKustomizeGoatKubernetes Goat
FormatKustomize bases and overlaysFull vulnerable cluster lab
Primary useCheckov scan calibrationHands-on cluster exploitation
Deploy riskManifest apply to a lab cluster onlyIntentionally vulnerable running workloads
Best fitOverlay-aware static scanning drillsRuntime K8s security training

Overlay Scan Results (Typical)

OverlayPosture
baseInsecure NGINX deployment (many policy failures)
testPartial hardening; still fails most checks
devSame as base (empty overlay merge)
prodCompliant additions; clean Checkov scan

Lab Guardrails

  • Treat rendered manifests as lab artifacts; apply only in disposable namespaces or clusters.
  • Prefer scan-only workflows unless the exercise requires a live deploy.
  • Compare overlay results to explain inherited vs environment-specific misconfigurations.

Scan-First Lab Sketch 

1
2
3
4

git clone https://github.com/bridgecrewio/kustomizegoat.git
cd kustomizegoat
checkov --framework kustomize -d .
# Optional: checkov --framework kustomize -d . --check CKV_K8S_11 --compact