🚨 Kustomize Error: 'accumulating resources ... evalsymlink failure ... no such file or directory' — Cause, Fix, and Troubleshooting Guide

Overview

When Kustomize builds, it walks every entry in resources: (and components:, bases:) and accumulates them into one resource set. If an entry points at a path it cannot resolve on disk — a wrong filename, a directory with no kustomization.yaml, a path that escapes the kustomization root, or an unreachable remote base — it fails while resolving the symlinked/absolute path:

Error: accumulating resources: accumulation err='accumulating resources from
'deployment.yaml': evalsymlink failure on '/repo/overlays/prod/deployment.yaml':
lstat /repo/overlays/prod/deployment.yaml: no such file or directory':
must build at directory: '/repo/overlays/prod/deployment.yaml': file does not exist

evalsymlink failure means Kustomize tried to canonicalize the path (resolving any symlinks) and the file/dir simply is not there — or is not somewhere Kustomize is allowed to read. It is a filesystem/pathing error, distinct from a patch-matching error.

Symptoms

• kustomize build / kubectl kustomize aborts with accumulating resources: accumulation err=....
• The message contains evalsymlink failure and no such file or directory.
• It names the exact entry (deployment.yaml) and the resolved absolute path.
• May instead say security; file '...' is not in or below '...' for paths outside root.
• Remote bases fail with a git/URL resolution error under the same accumulation wrapper.

Common Root Causes

1. Typo or wrong filename in resources

The entry does not match the file on disk.

resources:
  - deployment.yaml   # file is actually deployment.yaml

2. Pointing at a directory that has no kustomization.yaml

A directory entry must itself be a kustomization (contain kustomization.yaml/.yml/Kustomization).

resources:
  - ../base        # ../base has raw YAML but no kustomization.yaml

3. Path escapes the kustomization root (load restrictor)

By default Kustomize refuses to read files outside the directory tree of the kustomization for security.

security; file '/repo/shared/deployment.yaml' is not in or below
'/repo/overlays/prod'

4. Wrong relative depth

./ vs ../ confusion, or the file moved during a refactor.

resources:
  - ./deployment.yaml   # actually one level up: ../deployment.yaml

5. Unreachable or malformed remote base

A git URL with a bad ref, private repo without credentials, or wrong ?ref= fails to fetch.

resources:
  - github.com/example/repo/base?ref=nonexistent-tag

6. A broken symlink in the tree

evalsymlink follows symlinks; a dangling symlink resolves to nothing.

How to Diagnose

Read the resolved absolute path from the error

The evalsymlink failure on '/repo/overlays/prod/deployment.yaml' line is literal. Check that exact path:

ls -l /repo/overlays/prod/deployment.yaml

Verify each resources entry exists

cd overlays/prod
for f in $(grep -A50 '^resources:' kustomization.yaml \
           | grep -E '^\s*-' | sed 's/^[[:space:]]*-[[:space:]]*//'); do
  [ -e "$f" ] && echo "OK   $f" || echo "MISS $f"
done

Check a directory entry is a real kustomization

ls ../base/kustomization.yaml ../base/kustomization.yml 2>/dev/null

Reproduce with verbose/relaxed load restriction to isolate cause

kustomize build overlays/prod
# if it is a root-escape (security) message, confirm with:
kustomize build overlays/prod --load-restrictor LoadRestrictionsNone

If it builds only with LoadRestrictionsNone, the real problem is a path outside root.

Fixes

Correct the path or filename

resources:
  - deployment.yaml    # spelled to match the actual file
  - ../base            # a directory that DOES contain kustomization.yaml

Add a kustomization.yaml to the referenced base

cd ../base
cat > kustomization.yaml <<'EOF'
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml
EOF

Keep shared files inside the root, or use a component

Move shared manifests under a common base directory both overlays include, rather than reaching sideways out of the tree:

# overlays/prod/kustomization.yaml
resources:
  - ../../base        # inside the repo tree, no root escape
components:
  - ../../components/logging

Reserve --load-restrictor LoadRestrictionsNone for trusted local dev only; do not bake it into pipelines.

Fix a remote base reference

resources:
  - github.com/example/repo/base?ref=v1.4.0   # valid tag/branch/commit

Verify network and credentials for private repos.

What to Watch Out For

• Point resources: at directories that contain a kustomization.yaml, or at files that actually exist — nothing in between.
• Keep everything a kustomization needs inside its own directory tree; structure with bases and components instead of ../../.. reaches.
• Avoid disabling the load restrictor in CI; it exists to keep builds hermetic.
• Pin remote bases to an immutable ?ref=<tag-or-sha> so builds are reproducible.
• Run kustomize build in CI to catch a missing path before it hits kubectl apply.

Related Guides

• Kustomize no matches for Id — Patch Target
• Helm Resource Already Exists
• IaC Module Registry Versioning with SemVer