From 457abed9f92ab2128d1a9f2872f4416e8c393876 Mon Sep 17 00:00:00 2001
From: Ghassan Malke <gmalke@shiftbase.com>
Date: Mon, 30 Mar 2026 13:11:33 +0200
Subject: [PATCH] fix: validate --source flag in create kustomization command

Signed-off-by: Ghassan Malke <gmalke@shiftbase.com>
---
 cmd/flux/create_kustomization.go      |  3 ++
 cmd/flux/create_kustomization_test.go | 48 +++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 cmd/flux/create_kustomization_test.go

diff --git a/cmd/flux/create_kustomization.go b/cmd/flux/create_kustomization.go
index a7ae93ab..45740c34 100644
--- a/cmd/flux/create_kustomization.go
+++ b/cmd/flux/create_kustomization.go
@@ -136,6 +136,9 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 	if !strings.HasPrefix(kustomizationArgs.path.String(), "./") {
 		return fmt.Errorf("path must begin with ./")
 	}
+	if kustomizationArgs.source.Name == "" {
+		return fmt.Errorf("source is required")
+	}
 
 	if !createArgs.export {
 		logger.Generatef("generating Kustomization")
diff --git a/cmd/flux/create_kustomization_test.go b/cmd/flux/create_kustomization_test.go
new file mode 100644
index 00000000..ee743816
--- /dev/null
+++ b/cmd/flux/create_kustomization_test.go
@@ -0,0 +1,48 @@
+//go:build unit
+// +build unit
+
+/*
+Copyright 2026 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import "testing"
+
+func TestCreateKustomization(t *testing.T) {
+	tests := []struct {
+		name   string
+		args   string
+		assert assertFunc
+	}{
+		{
+			// A user creating a kustomization without --source gets a confusing
+			// API-level error about spec.sourceRef.kind instead of a clear message.
+			name:   "missing source",
+			args:   "create kustomization my-app --path=./deploy --export",
+			assert: assertError("source is required"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := cmdTestCase{
+				args:   tt.args,
+				assert: tt.assert,
+			}
+			cmd.runTestCmd(t)
+		})
+	}
+}