Kustomize build failures are silently ignored, resulting in no Kubernetes checks being executed

[ltshb]

Describe the issue

When Checkov invokes Kustomize and the build fails, Checkov silently continues instead of reporting an error.

As a result:

• No Kubernetes manifests are generated.
• No Kubernetes checks are executed.
• Checkov exits without clearly indicating that the Kustomize build failed.
• Users may incorrectly assume that all checks passed, while in reality nothing was scanned.

This behavior is particularly misleading in CI pipelines, where a failing Kustomize build should cause the scan to fail rather than produce an apparently successful run with no Kubernetes results.

I would expect Checkov to:

• report that the Kustomize build failed,
• display the stderr output from Kustomize,
• return a non-zero exit code,
• not continue scanning as if nothing happened.

---

Examples

Example directory:

kustomization.yaml
deployment.yaml

Suppose kustomization.yaml references a resource that does not exist:

resources:
  - deployment.yaml
  - missing-resource.yaml

Running:

checkov -d . --framework kustomize

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By Prisma Cloud | version: 3.3.6 

Current behavior:

• Checkov invokes Kustomize.
• Kustomize fails.
• Checkov silently skips scanning the generated manifests.
• No Kubernetes checks are reported.
• The user receives little or no indication that the scan never actually occurred.

Expected behavior:

Error: Kustomize build failed.

<stderr from kustomize>

Scanning aborted.

The process should exit with a non-zero exit code so that CI pipelines correctly fail.

---

Exception Trace

Running with debug logging:

LOG_LEVL=DEBUG checkov -d . --framework kustomize           

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By Prisma Cloud | version: 3.3.6 

Debug output shows that Kustomize failed, but Checkov continues execution instead of treating it as an error.

kustomize build .
Error: accumulating resources: accumulation err='accumulating resources from 'deploment.yaml': evalsymlink failure on '/tmp/checkov-bug/deploment.yaml' : lstat /tmp/checkov-bug/deploment.yaml: no such file or directory': must build at directory: not a valid directory: evalsymlink failure on '/tmp/checkov-bug/deploment.yaml' : lstat /tmp/checkov-bug/deploment.yaml: no such file or directory

---

Desktop (please complete the following information)

• OS: Ubuntu 24.04
• Checkov Version: 3.3.6

---

Additional context

This issue can be difficult to notice because the output may simply contain no Kubernetes results, leading users to believe that their manifests were successfully scanned.

This is especially problematic in combination with the current Kustomize executable auto-detection (kubectl kustomize vs kustomize), where users may already be troubleshooting different Kustomize implementations. If the selected implementation fails and Checkov silently ignores the failure, diagnosing the root cause becomes significantly more difficult.

In general, a failure to generate manifests should be treated as a fatal error rather than allowing the scan to continue with no resources to evaluate.