Add load_restrictor flag.

pkg/loader/fileloader_test.go

@@ -288,7 +288,7 @@ func doSanityChecksAndDropIntoBase(
 	return l
 }
 
-func TestRestrictionRootInRealLoader(t *testing.T) {
+func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
 	dir, fSys, err := commonSetupForLoaderRestrictionTest()
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)

pkg/loader/loader.go

@@ -26,10 +26,11 @@ import (
 // NewLoader returns a Loader pointed at the given target.
 // If the target is remote, the loader will be restricted
 // to the root and below only.  If the target is local, the
-// loader will have no restrictions.  If the local target
-// attempts to transitively load remote bases, they will all
-// be root-only restricted.
+// loader will have the restrictions passed in.  Regardless,
+// if a local target attempts to transitively load remote bases,
+// the remote bases will all be root-only restricted.
 func NewLoader(
+	lr LoadRestrictorFunc,
 	target string, fSys fs.FileSystem) (ifc.Loader, error) {
 	repoSpec, err := git.NewRepoSpecFromUrl(target)
 	if err == nil {
@@ -42,5 +43,5 @@ func NewLoader(
 		return nil, err
 	}
 	return newLoaderAtConfirmedDir(
-		RestrictionNone, root, fSys, nil, git.ClonerUsingGitExec), nil
+		lr, root, fSys, nil, git.ClonerUsingGitExec), nil
 }

pkg/loader/loadrestrictions.go

@@ -19,9 +19,50 @@ package loader
 import (
 	"fmt"
 
+	"github.com/spf13/pflag"
 	"sigs.k8s.io/kustomize/pkg/fs"
 )
 
+//go:generate stringer -type=loadRestrictions
+type loadRestrictions int
+
+const (
+	unknown loadRestrictions = iota
+	rootOnly
+	none
+)
+
+const (
+	flagName = "load_restrictor"
+)
+
+var (
+	flagValue = rootOnly.String()
+	flagHelp  = "if set to '" + none.String() +
+		"', local kustomizations may load files from outside their root. " +
+		"This does, however, break the relocatability of the kustomization."
+)
+
+func AddLoadRestrictionsFlag(set *pflag.FlagSet) {
+	set.StringVar(
+		&flagValue, flagName,
+		rootOnly.String(), flagHelp)
+}
+
+func ValidateLoadRestrictorFlag() (LoadRestrictorFunc, error) {
+	switch flagValue {
+	case rootOnly.String():
+		return RestrictionRootOnly, nil
+	case none.String():
+		return RestrictionNone, nil
+	default:
+		return nil, fmt.Errorf(
+			"illegal flag value --%s %s; legal values: %v",
+			flagName, flagValue,
+			[]string{rootOnly.String(), none.String()})
+	}
+}
+
 type LoadRestrictorFunc func(
 	fs.FileSystem, fs.ConfirmedDir, string) (string, error)
 

pkg/loader/loadrestrictions_string.go

@@ -0,0 +1,25 @@
+// Code generated by "stringer -type=loadRestrictions"; DO NOT EDIT.
+
+package loader
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[unknown-0]
+	_ = x[rootOnly-1]
+	_ = x[none-2]
+}
+
+const _loadRestrictions_name = "unknownrootOnlynone"
+
+var _loadRestrictions_index = [...]uint8{0, 7, 15, 19}
+
+func (i loadRestrictions) String() string {
+	if i < 0 || i >= loadRestrictions(len(_loadRestrictions_index)-1) {
+		return "loadRestrictions(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _loadRestrictions_name[_loadRestrictions_index[i]:_loadRestrictions_index[i+1]]
+}