diff --git a/Makefile b/Makefile
index 77dd382678a1..88eec4086bdb 100644
--- a/Makefile
+++ b/Makefile
@@ -50,6 +50,8 @@ LINK_CHECKER_BIN := bin/liche
 LINK_CHECKER := $(TOOLS_DIR)/$(LINK_CHECKER_BIN)
 GO_APIDIFF_BIN := bin/go-apidiff
 GO_APIDIFF := $(TOOLS_DIR)/$(GO_APIDIFF_BIN)
+ENVSUBST_BIN := bin/envsubst
+ENVSUBST := $(TOOLS_DIR)/$(ENVSUBST_BIN)
 
 # Binaries.
 # Need to use abspath so we can invoke these from subdirectories
@@ -57,6 +59,7 @@ KUSTOMIZE := $(abspath $(TOOLS_BIN_DIR)/kustomize)
 CONTROLLER_GEN := $(abspath $(TOOLS_BIN_DIR)/controller-gen)
 GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/golangci-lint)
 CONVERSION_GEN := $(abspath $(TOOLS_BIN_DIR)/conversion-gen)
+ENVSUBST := $(abspath $(TOOLS_BIN_DIR)/envsubst)
 
 # Bindata.
 GOBINDATA := $(abspath $(TOOLS_BIN_DIR)/go-bindata)
@@ -173,6 +176,11 @@ $(LINK_CHECKER): $(TOOLS_DIR)/go.mod
 $(GO_APIDIFF): $(TOOLS_DIR)/go.mod
 	cd $(TOOLS_DIR) && go build -tags=tools -o $(GO_APIDIFF_BIN) github.com/joelanford/go-apidiff
 
+$(ENVSUBST): $(TOOLS_DIR)/go.mod
+	cd $(TOOLS_DIR) && go build -tags=tools -o $(ENVSUBST_BIN) github.com/drone/envsubst/cmd/envsubst
+
+envsubst: $(ENVSUBST)
+
 .PHONY: e2e-framework
 e2e-framework: ## Builds the CAPI e2e framework
 	cd $(E2E_FRAMEWORK_DIR); go build ./...
diff --git a/Tiltfile b/Tiltfile
index e9cfb4863bf0..03ed46360c3d 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -2,6 +2,8 @@
 
 # set defaults
 
+envsubst_cmd = "./hack/tools/bin/envsubst"
+
 settings = {
     "deploy_cert_manager": True,
     "preload_images_for_kind": True,
@@ -189,11 +191,12 @@ def enable_provider(name):
     )
 
     # Apply the kustomized yaml for this provider
-    yaml = str(kustomize(context + "/config"))
+    yaml = str(kustomize_with_envsubst(context + "/config"))
     substitutions = settings.get("kustomize_substitutions", {})
     for substitution in substitutions:
         value = substitutions[substitution]
         yaml = yaml.replace("${" + substitution + "}", value)
+
     if yaml.count("${") == 0:
         k8s_yaml(blob(yaml))
     else:
@@ -226,11 +229,15 @@ def include_user_tilt_files():
 
 # Enable core cluster-api plus everything listed in 'enable_providers' in tilt-settings.json
 def enable_providers():
+    local("make envsubst")
     user_enable_providers = settings.get("enable_providers", [])
     union_enable_providers = {k: "" for k in user_enable_providers + always_enable_providers}.keys()
     for name in union_enable_providers:
         enable_provider(name)
 
+def kustomize_with_envsubst(path):
+    return str(local("kustomize build {} | {}".format(path, envsubst_cmd), quiet = True))
+
 ##############################
 # Actual work happens here
 ##############################
diff --git a/docs/book/src/developer/tilt.md b/docs/book/src/developer/tilt.md
index 25b553fe333d..b6e40aefe837 100644
--- a/docs/book/src/developer/tilt.md
+++ b/docs/book/src/developer/tilt.md
@@ -13,9 +13,19 @@ workflow that offers easy deployments and rapid iterative builds.
 1. [kustomize](https://github.com/kubernetes-sigs/kustomize/blob/master/docs/INSTALL.md) standalone
    (`kubectl kustomize` does not work because it is missing some features of kustomize v3)
 1. [Tilt](https://docs.tilt.dev/install.html) v0.12.0 or newer
+1. [envsubst](https://github.com/drone/envsubst) v1.0.2 or similar to handle clusterctl var replacement.
 1. Clone the [Cluster API](https://github.com/kubernetes-sigs/cluster-api) repository locally
 1. Clone the provider(s) you want to deploy locally as well
 
+We provider a make target to generate the envsubst binary if desired.
+See the [provider contract](./../clusterctl/provider-contract.md) for
+more details about how clusterctl uses variables.
+
+
+```
+make envsubst
+```
+
 ## Getting started
 
 ### Create a kind cluster
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index d7f84e29820a..9be467fb84ac 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -4,6 +4,7 @@ go 1.13
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
+	github.com/drone/envsubst v1.0.3-0.20200709231038-aa43e1c1a629
 	github.com/go-bindata/go-bindata v3.1.2+incompatible
 	github.com/golangci/golangci-lint v1.27.0
 	github.com/joelanford/go-apidiff v0.0.0-20191206194835-106bcff5f060
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index b9a35420aec3..1d3a59e91f2a 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -96,6 +96,8 @@ github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96 h1:cenwrSVm+Z7QL
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/drone/envsubst v1.0.3-0.20200709231038-aa43e1c1a629 h1:rIaZZalMGGPb2cU/+ypuggZ8aMlpa17RUlJUtsMv8pw=
+github.com/drone/envsubst v1.0.3-0.20200709231038-aa43e1c1a629/go.mod h1:N2jZmlMufstn1KEqvbHjw40h1KyTmnVzHcSc9bFiJ2g=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e h1:p1yVGRW3nmb85p1Sh1ZJSDm4A4iKLS5QNbvUHMgGu/M=
diff --git a/hack/tools/tools.go b/hack/tools/tools.go
index 4029a5fdd5d2..53cef8b77998 100644
--- a/hack/tools/tools.go
+++ b/hack/tools/tools.go
@@ -20,6 +20,7 @@ limitations under the License.
 package tools
 
 import (
+	_ "github.com/drone/envsubst/cmd/envsubst"
 	_ "github.com/go-bindata/go-bindata"
 	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
 	_ "github.com/joelanford/go-apidiff"
diff --git a/test/infrastructure/docker/hack/tools/go.sum b/test/infrastructure/docker/hack/tools/go.sum
index 85807ed13bf4..2ec0c55054ec 100644
--- a/test/infrastructure/docker/hack/tools/go.sum
+++ b/test/infrastructure/docker/hack/tools/go.sum
@@ -76,6 +76,7 @@ github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/drone/envsubst v1.0.3-0.20200709231038-aa43e1c1a629/go.mod h1:N2jZmlMufstn1KEqvbHjw40h1KyTmnVzHcSc9bFiJ2g=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=