<p>Given the following kustomize patch:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: flux
spec:
  template:
    spec:
      containers:
        - name: some-name
          args:
            - --some-key=some-value
            ...
            - --git-url=https://user:${PASSWORD}@domain.de
</code></pre>

<p>I want to use <code>kubectl apply -k</code> and somehow pass a value for <code>${PASSWORD}</code> which I can set from my build script. </p>

<p>The only solution I got to work so far was replacing the <code>${PASSWORD}</code> with <code>sed</code>, but I would prefer a kustomize solution.</p>

<p>As @Jonas already suggested you should consider using <code>Secret</code>. It's nicely described in <a href="https://blog.stack-labs.com/code/kustomize-101/" rel="noreferrer">this</a> article.</p>

<blockquote>
  <p>I want to use kubectl apply -k and somehow pass a value for
  ${PASSWORD} which I can set from my build script.</p>
</blockquote>

<p>I guess your script can store the generated password as a variable or save it to some file. You can easily create a <code>Secret</code> as follows:</p>

<pre><code>$ kustomize edit add secret sl-demo-app --from-literal=db-password=$PASSWORD
</code></pre>

<p>or from a file:</p>

<pre><code>$ kustomize edit add secret sl-demo-app --from-file=file/path
</code></pre>

<p>As you can read in the mentioned article:</p>

<blockquote>
  <p>These commands will modify your <code>kustomization.yaml</code> and add a
  <code>SecretGenerator</code> inside it.</p>

<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

bases:
- ../../base

patchesStrategicMerge:
- custom-env.yaml
- replica-and-rollout-strategy.yaml

secretGenerator:
- literals:
  - db-password=12345
  name: sl-demo-app
  type: Opaque
</code></pre>
</blockquote>

<p><code>kustomize build</code> run in your project directory will create among others following <code>Secret</code>:</p>

<pre><code>apiVersion: v1
data:
  db-password: MTIzNDU=
kind: Secret
metadata:
  name: sl-demo-app-6ft88t2625
type: Opaque
...
</code></pre>

<p>More details you can fine in the <a href="https://blog.stack-labs.com/code/kustomize-101/" rel="noreferrer">article</a>.</p>

<blockquote>
  <p>If we want to use this secret from our deployment, we just have, like
  before, to add a new layer definition which uses the secret.</p>
  
  <p>For example, this file will mount the db-password value as
  environement variables</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: sl-demo-app
spec:
  template:
    spec:
      containers:
      - name: app
        env:
        - name: "DB_PASSWORD"
          valueFrom:
            secretKeyRef:
              name: sl-demo-app
              key: db.password
</code></pre>
</blockquote>

<p>In your <code>Deployment</code> definition file it may look similar to this:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: flux
spec:
  template:
    spec:
      containers:
        - name: some-name
          env:
            - name: "PASSWORD"
              valueFrom:
                secretKeyRef:
                  name: git-secret
                  key: git.password
          args:
            - --some-key=some-value
            ...
            - --git-url=https://user:${PASSWORD}@domain.de
</code></pre>
