diff --git a/internal/loadertest/fakeloader.go b/internal/loadertest/fakeloader.go
index df2507dd4..9dabe4bbb 100644
--- a/internal/loadertest/fakeloader.go
+++ b/internal/loadertest/fakeloader.go
@@ -10,8 +10,6 @@ import (
 	"sigs.k8s.io/kustomize/v3/filesys"
 	"sigs.k8s.io/kustomize/v3/pkg/ifc"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
-	"sigs.k8s.io/kustomize/v3/pkg/types"
-	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
 // FakeLoader encapsulates the delegate Loader and the fake file system.
@@ -36,8 +34,7 @@ func NewFakeLoaderWithRestrictor(
 	// Create fake filesystem and inject it into initial Loader.
 	fSys := filesys.MakeFsInMemory()
 	fSys.Mkdir(initialDir)
-	ldr, err := loader.NewLoader(
-		lr, validators.MakeFakeValidator(), initialDir, fSys)
+	ldr, err := loader.NewLoader(lr, initialDir, fSys)
 	if err != nil {
 		log.Fatalf("Unable to make loader: %v", err)
 	}
@@ -77,13 +74,3 @@ func (f FakeLoader) Load(location string) ([]byte, error) {
 func (f FakeLoader) Cleanup() error {
 	return f.delegate.Cleanup()
 }
-
-// Validator delegates.
-func (f FakeLoader) Validator() ifc.Validator {
-	return f.delegate.Validator()
-}
-
-// LoadKvPairs delegates.
-func (f FakeLoader) LoadKvPairs(args types.GeneratorArgs) ([]types.Pair, error) {
-	return f.delegate.LoadKvPairs(args)
-}
diff --git a/k8sdeps/configmapandsecret/configmapfactory.go b/k8sdeps/configmapandsecret/configmapfactory.go
index 41c4b09f0..9825186a2 100644
--- a/k8sdeps/configmapandsecret/configmapfactory.go
+++ b/k8sdeps/configmapandsecret/configmapfactory.go
@@ -27,7 +27,7 @@ func makeFreshConfigMap(
 // MakeConfigMap returns a new ConfigMap, or nil and an error.
 func (f *Factory) MakeConfigMap(
 	args *types.ConfigMapArgs) (*v1.ConfigMap, error) {
-	all, err := f.ldr.LoadKvPairs(args.GeneratorArgs)
+	all, err := f.kvLdr.Load(args.KvPairSources)
 	if err != nil {
 		return nil, errors.Wrap(err, "loading KV pairs")
 	}
@@ -48,7 +48,7 @@ func (f *Factory) MakeConfigMap(
 // addKvToConfigMap adds the given key and data to the given config map.
 // Error if key invalid, or already exists.
 func (f *Factory) addKvToConfigMap(configMap *v1.ConfigMap, p types.Pair) error {
-	if err := f.ldr.Validator().ErrIfInvalidKey(p.Key); err != nil {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(p.Key); err != nil {
 		return err
 	}
 	// If the configmap data contains byte sequences that are all in the UTF-8
diff --git a/k8sdeps/configmapandsecret/configmapfactory_test.go b/k8sdeps/configmapandsecret/configmapfactory_test.go
index 8cac3130a..fcbaa95c3 100644
--- a/k8sdeps/configmapandsecret/configmapfactory_test.go
+++ b/k8sdeps/configmapandsecret/configmapfactory_test.go
@@ -11,6 +11,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/kustomize/v3/filesys"
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/kustomize/v3/pkg/validators"
@@ -141,9 +142,11 @@ func TestConstructConfigMap(t *testing.T) {
 	fSys.WriteFile(
 		filesys.RootedPath("configmap", "app.bin"),
 		[]byte{0xff, 0xfd})
-	ldr := loader.NewFileLoaderAtRoot(validators.MakeFakeValidator(), fSys)
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		validators.MakeFakeValidator())
 	for _, tc := range testCases {
-		f := NewFactory(ldr, tc.options)
+		f := NewFactory(kvLdr, tc.options)
 		cm, err := f.MakeConfigMap(&tc.input)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
diff --git a/k8sdeps/configmapandsecret/factory.go b/k8sdeps/configmapandsecret/factory.go
index 9b6e3f885..8e3def053 100644
--- a/k8sdeps/configmapandsecret/factory.go
+++ b/k8sdeps/configmapandsecret/factory.go
@@ -10,14 +10,14 @@ import (
 
 // Factory makes ConfigMaps and Secrets.
 type Factory struct {
-	ldr     ifc.Loader
+	kvLdr   ifc.KvLoader
 	options *types.GeneratorOptions
 }
 
 // NewFactory returns a new factory that makes ConfigMaps and Secrets.
 func NewFactory(
-	ldr ifc.Loader, o *types.GeneratorOptions) *Factory {
-	return &Factory{ldr: ldr, options: o}
+	kvLdr ifc.KvLoader, o *types.GeneratorOptions) *Factory {
+	return &Factory{kvLdr: kvLdr, options: o}
 }
 
 const keyExistsErrorMsg = "cannot add key %s, another key by that name already exists: %v"
diff --git a/k8sdeps/configmapandsecret/secretfactory.go b/k8sdeps/configmapandsecret/secretfactory.go
index 7d17fb4df..bdd2440cd 100644
--- a/k8sdeps/configmapandsecret/secretfactory.go
+++ b/k8sdeps/configmapandsecret/secretfactory.go
@@ -28,7 +28,7 @@ func makeFreshSecret(
 // MakeSecret returns a new secret.
 func (f *Factory) MakeSecret(
 	args *types.SecretArgs) (*corev1.Secret, error) {
-	all, err := f.ldr.LoadKvPairs(args.GeneratorArgs)
+	all, err := f.kvLdr.Load(args.KvPairSources)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +47,7 @@ func (f *Factory) MakeSecret(
 }
 
 func (f *Factory) addKvToSecret(secret *corev1.Secret, keyName, data string) error {
-	if err := f.ldr.Validator().ErrIfInvalidKey(keyName); err != nil {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(keyName); err != nil {
 		return err
 	}
 	if _, entryExists := secret.Data[keyName]; entryExists {
diff --git a/k8sdeps/configmapandsecret/secretfactory_test.go b/k8sdeps/configmapandsecret/secretfactory_test.go
index 85119675d..bd0fcbead 100644
--- a/k8sdeps/configmapandsecret/secretfactory_test.go
+++ b/k8sdeps/configmapandsecret/secretfactory_test.go
@@ -10,6 +10,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/kustomize/v3/filesys"
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/kustomize/v3/pkg/validators"
@@ -126,9 +127,11 @@ func TestConstructSecret(t *testing.T) {
 	fSys := filesys.MakeFsInMemory()
 	fSys.WriteFile("/secret/app.env", []byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
 	fSys.WriteFile("/secret/app-init.ini", []byte("FOO=bar\nBAR=baz\n"))
-	ldr := loader.NewFileLoaderAtRoot(validators.MakeFakeValidator(), fSys)
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		validators.MakeFakeValidator())
 	for _, tc := range testCases {
-		f := NewFactory(ldr, tc.options)
+		f := NewFactory(kvLdr, tc.options)
 		cm, err := f.MakeSecret(&tc.input)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
diff --git a/k8sdeps/kunstruct/factory.go b/k8sdeps/kunstruct/factory.go
index d8871a0e1..074fe3ae8 100644
--- a/k8sdeps/kunstruct/factory.go
+++ b/k8sdeps/kunstruct/factory.go
@@ -73,11 +73,11 @@ func (kf *KunstructuredFactoryImpl) FromMap(
 
 // MakeConfigMap returns an instance of Kunstructured for ConfigMap
 func (kf *KunstructuredFactoryImpl) MakeConfigMap(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
 	o, err := configmapandsecret.NewFactory(
-		ldr, options).MakeConfigMap(args)
+		kvLdr, options).MakeConfigMap(args)
 	if err != nil {
 		return nil, err
 	}
@@ -86,11 +86,11 @@ func (kf *KunstructuredFactoryImpl) MakeConfigMap(
 
 // MakeSecret returns an instance of Kunstructured for Secret
 func (kf *KunstructuredFactoryImpl) MakeSecret(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args *types.SecretArgs) (ifc.Kunstructured, error) {
 	o, err := configmapandsecret.NewFactory(
-		ldr, options).MakeSecret(args)
+		kvLdr, options).MakeSecret(args)
 	if err != nil {
 		return nil, err
 	}
diff --git a/kustomize/internal/commands/build/build.go b/kustomize/internal/commands/build/build.go
index c2eba9a3f..09fd01db1 100644
--- a/kustomize/internal/commands/build/build.go
+++ b/kustomize/internal/commands/build/build.go
@@ -119,12 +119,12 @@ func (o *Options) RunBuild(
 	rf *resmap.Factory, ptf resmap.PatchFactory,
 	pl *plugins.Loader) error {
 	ldr, err := loader.NewLoader(
-		o.loadRestrictor, v, o.kustomizationPath, fSys)
+		o.loadRestrictor, o.kustomizationPath, fSys)
 	if err != nil {
 		return err
 	}
 	defer ldr.Cleanup()
-	kt, err := target.NewKustTarget(ldr, rf, ptf, pl)
+	kt, err := target.NewKustTarget(ldr, v, rf, ptf, pl)
 	if err != nil {
 		return err
 	}
@@ -140,12 +140,12 @@ func (o *Options) RunBuildPrune(
 	rf *resmap.Factory, ptf resmap.PatchFactory,
 	pl *plugins.Loader) error {
 	ldr, err := loader.NewLoader(
-		o.loadRestrictor, v, o.kustomizationPath, fSys)
+		o.loadRestrictor, o.kustomizationPath, fSys)
 	if err != nil {
 		return err
 	}
 	defer ldr.Cleanup()
-	kt, err := target.NewKustTarget(ldr, rf, ptf, pl)
+	kt, err := target.NewKustTarget(ldr, v, rf, ptf, pl)
 	if err != nil {
 		return err
 	}
diff --git a/kustomize/internal/commands/edit/add/all.go b/kustomize/internal/commands/edit/add/all.go
index d83081f99..b5d9cf256 100644
--- a/kustomize/internal/commands/edit/add/all.go
+++ b/kustomize/internal/commands/edit/add/all.go
@@ -12,7 +12,7 @@ import (
 // NewCmdAdd returns an instance of 'add' subcommand.
 func NewCmdAdd(
 	fSys filesys.FileSystem,
-	ldr ifc.Loader,
+	ldr ifc.KvLoader,
 	kf ifc.KunstructuredFactory) *cobra.Command {
 	c := &cobra.Command{
 		Use:   "add",
diff --git a/kustomize/internal/commands/edit/add/configmap.go b/kustomize/internal/commands/edit/add/configmap.go
index 62d40c5b9..f9d09b8a7 100644
--- a/kustomize/internal/commands/edit/add/configmap.go
+++ b/kustomize/internal/commands/edit/add/configmap.go
@@ -14,7 +14,7 @@ import (
 // newCmdAddConfigMap returns a new command.
 func newCmdAddConfigMap(
 	fSys filesys.FileSystem,
-	ldr ifc.Loader,
+	ldr ifc.KvLoader,
 	kf ifc.KunstructuredFactory) *cobra.Command {
 	var flags flagsAndArgs
 	cmd := &cobra.Command{
@@ -89,7 +89,7 @@ func newCmdAddConfigMap(
 // Note: error may leave kustomization file in an undefined state.
 // Suggest passing a copy of kustomization file.
 func addConfigMap(
-	ldr ifc.Loader,
+	ldr ifc.KvLoader,
 	k *types.Kustomization,
 	flags flagsAndArgs, kf ifc.KunstructuredFactory) error {
 	args := findOrMakeConfigMapArgs(k, flags.Name)
diff --git a/kustomize/internal/commands/edit/add/configmap_test.go b/kustomize/internal/commands/edit/add/configmap_test.go
index 649ded0db..dbb03fc45 100644
--- a/kustomize/internal/commands/edit/add/configmap_test.go
+++ b/kustomize/internal/commands/edit/add/configmap_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/v3/filesys"
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/kustomize/v3/pkg/validators"
@@ -14,8 +15,12 @@ import (
 
 func TestNewAddConfigMapIsNotNil(t *testing.T) {
 	fSys := filesys.MakeFsInMemory()
-	ldr := loader.NewFileLoaderAtCwd(validators.MakeFakeValidator(), fSys)
-	if newCmdAddConfigMap(fSys, ldr, nil) == nil {
+	if newCmdAddConfigMap(
+		fSys,
+		kv.NewLoader(
+			loader.NewFileLoaderAtCwd(fSys),
+			validators.MakeFakeValidator()),
+			nil) == nil {
 		t.Fatal("newCmdAddConfigMap shouldn't be nil")
 	}
 }
diff --git a/kustomize/internal/commands/edit/add/secret.go b/kustomize/internal/commands/edit/add/secret.go
index 5ec01b4d3..41e83a3e4 100644
--- a/kustomize/internal/commands/edit/add/secret.go
+++ b/kustomize/internal/commands/edit/add/secret.go
@@ -14,7 +14,7 @@ import (
 // newCmdAddSecret returns a new command.
 func newCmdAddSecret(
 	fSys filesys.FileSystem,
-	ldr ifc.Loader,
+	ldr ifc.KvLoader,
 	kf ifc.KunstructuredFactory) *cobra.Command {
 	var flags flagsAndArgs
 	cmd := &cobra.Command{
@@ -94,7 +94,7 @@ func newCmdAddSecret(
 // Note: error may leave kustomization file in an undefined state.
 // Suggest passing a copy of kustomization file.
 func addSecret(
-	ldr ifc.Loader,
+	ldr ifc.KvLoader,
 	k *types.Kustomization,
 	flags flagsAndArgs, kf ifc.KunstructuredFactory) error {
 	args := findOrMakeSecretArgs(k, flags.Name, flags.Type)
diff --git a/kustomize/internal/commands/edit/add/secret_test.go b/kustomize/internal/commands/edit/add/secret_test.go
index d8ded3a64..286f42a08 100644
--- a/kustomize/internal/commands/edit/add/secret_test.go
+++ b/kustomize/internal/commands/edit/add/secret_test.go
@@ -6,6 +6,8 @@ package add
 import (
 	"testing"
 
+	"sigs.k8s.io/kustomize/v3/kv"
+
 	"sigs.k8s.io/kustomize/v3/filesys"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
@@ -14,8 +16,12 @@ import (
 
 func TestNewCmdAddSecretIsNotNil(t *testing.T) {
 	fSys := filesys.MakeFsInMemory()
-	ldr := loader.NewFileLoaderAtCwd(validators.MakeFakeValidator(), fSys)
-	if newCmdAddSecret(fSys, ldr, nil) == nil {
+	if newCmdAddSecret(
+		fSys,
+		kv.NewLoader(
+			loader.NewFileLoaderAtCwd(fSys),
+			validators.MakeFakeValidator()),
+		nil) == nil {
 		t.Fatal("newCmdAddSecret shouldn't be nil")
 	}
 }
diff --git a/kustomize/internal/commands/edit/all.go b/kustomize/internal/commands/edit/all.go
index b0efb0e43..80b3bfc4e 100644
--- a/kustomize/internal/commands/edit/all.go
+++ b/kustomize/internal/commands/edit/all.go
@@ -10,6 +10,7 @@ import (
 	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/edit/remove"
 	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/edit/set"
 	"sigs.k8s.io/kustomize/v3/filesys"
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/ifc"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
 )
@@ -35,10 +36,13 @@ func NewCmdEdit(
 	}
 
 	c.AddCommand(
-		add.NewCmdAdd(fSys, loader.NewFileLoaderAtCwd(v, fSys), kf),
+		add.NewCmdAdd(
+			fSys,
+			kv.NewLoader(loader.NewFileLoaderAtCwd(fSys), v),
+			kf),
 		set.NewCmdSet(fSys, v),
 		fix.NewCmdFix(fSys),
-		remove.NewCmdRemove(fSys, loader.NewFileLoaderAtCwd(v, fSys)),
+		remove.NewCmdRemove(fSys, v),
 	)
 	return c
 }
diff --git a/kustomize/internal/commands/edit/remove/all.go b/kustomize/internal/commands/edit/remove/all.go
index 4b25fd209..c05768e32 100644
--- a/kustomize/internal/commands/edit/remove/all.go
+++ b/kustomize/internal/commands/edit/remove/all.go
@@ -12,7 +12,7 @@ import (
 // NewCmdRemove returns an instance of 'remove' subcommand.
 func NewCmdRemove(
 	fSys filesys.FileSystem,
-	ldr ifc.Loader) *cobra.Command {
+	v ifc.Validator) *cobra.Command {
 	c := &cobra.Command{
 		Use:   "remove",
 		Short: "Removes items from the kustomization file.",
@@ -35,8 +35,8 @@ func NewCmdRemove(
 	}
 	c.AddCommand(
 		newCmdRemoveResource(fSys),
-		newCmdRemoveLabel(fSys, ldr.Validator().MakeLabelNameValidator()),
-		newCmdRemoveAnnotation(fSys, ldr.Validator().MakeAnnotationNameValidator()),
+		newCmdRemoveLabel(fSys, v.MakeLabelNameValidator()),
+		newCmdRemoveAnnotation(fSys, v.MakeAnnotationNameValidator()),
 		newCmdRemovePatch(fSys),
 	)
 	return c
diff --git a/pkg/loader/kv.go b/kv/kv.go
similarity index 80%
rename from pkg/loader/kv.go
rename to kv/kv.go
index a6952dc44..b3310ff56 100644
--- a/pkg/loader/kv.go
+++ b/kv/kv.go
@@ -1,7 +1,7 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package loader
+package kv
 
 import (
 	"bufio"
@@ -20,13 +20,26 @@ import (
 
 var utf8bom = []byte{0xEF, 0xBB, 0xBF}
 
-func (fl *fileLoader) Validator() ifc.Validator {
-	return fl.validator
+// loader reads and validates KV pairs.
+type loader struct {
+	// Used to read the filesystem.
+	ldr ifc.Loader
+
+	// Used to validate various k8s data fields.
+	validator ifc.Validator
 }
 
-func (fl *fileLoader) LoadKvPairs(
-	args types.GeneratorArgs) (all []types.Pair, err error) {
-	pairs, err := fl.keyValuesFromEnvFiles(args.EnvSources)
+func NewLoader(ldr ifc.Loader, v ifc.Validator) ifc.KvLoader {
+	return &loader{ldr: ldr, validator: v}
+}
+
+func (kvl *loader) Validator() ifc.Validator {
+	return kvl.validator
+}
+
+func (kvl *loader) Load(
+	args types.KvPairSources) (all []types.Pair, err error) {
+	pairs, err := kvl.keyValuesFromEnvFiles(args.EnvSources)
 	if err != nil {
 		return nil, errors.Wrap(err, fmt.Sprintf(
 			"env source files: %v",
@@ -41,7 +54,7 @@ func (fl *fileLoader) LoadKvPairs(
 	}
 	all = append(all, pairs...)
 
-	pairs, err = fl.keyValuesFromFileSources(args.FileSources)
+	pairs, err = kvl.keyValuesFromFileSources(args.FileSources)
 	if err != nil {
 		return nil, errors.Wrap(err, fmt.Sprintf(
 			"file sources: %v", args.FileSources))
@@ -61,14 +74,14 @@ func keyValuesFromLiteralSources(sources []string) ([]types.Pair, error) {
 	return kvs, nil
 }
 
-func (fl *fileLoader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
+func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
 	var kvs []types.Pair
 	for _, s := range sources {
 		k, fPath, err := parseFileSource(s)
 		if err != nil {
 			return nil, err
 		}
-		content, err := fl.Load(fPath)
+		content, err := kvl.ldr.Load(fPath)
 		if err != nil {
 			return nil, err
 		}
@@ -77,14 +90,14 @@ func (fl *fileLoader) keyValuesFromFileSources(sources []string) ([]types.Pair,
 	return kvs, nil
 }
 
-func (fl *fileLoader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error) {
+func (kvl *loader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error) {
 	var kvs []types.Pair
 	for _, p := range paths {
-		content, err := fl.Load(p)
+		content, err := kvl.ldr.Load(p)
 		if err != nil {
 			return nil, err
 		}
-		more, err := fl.keyValuesFromLines(content)
+		more, err := kvl.keyValuesFromLines(content)
 		if err != nil {
 			return nil, err
 		}
@@ -94,7 +107,7 @@ func (fl *fileLoader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error
 }
 
 // keyValuesFromLines parses given content in to a list of key-value pairs.
-func (fl *fileLoader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
+func (kvl *loader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
 	var kvs []types.Pair
 
 	scanner := bufio.NewScanner(bytes.NewReader(content))
@@ -103,7 +116,7 @@ func (fl *fileLoader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
 		// Process the current line, retrieving a key/value pair if
 		// possible.
 		scannedBytes := scanner.Bytes()
-		kv, err := fl.keyValuesFromLine(scannedBytes, currentLine)
+		kv, err := kvl.keyValuesFromLine(scannedBytes, currentLine)
 		if err != nil {
 			return nil, err
 		}
@@ -121,7 +134,7 @@ func (fl *fileLoader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
 
 // KeyValuesFromLine returns a kv with blank key if the line is empty or a comment.
 // The value will be retrieved from the environment if necessary.
-func (fl *fileLoader) keyValuesFromLine(line []byte, currentLine int) (types.Pair, error) {
+func (kvl *loader) keyValuesFromLine(line []byte, currentLine int) (types.Pair, error) {
 	kv := types.Pair{}
 
 	if !utf8.Valid(line) {
@@ -143,7 +156,7 @@ func (fl *fileLoader) keyValuesFromLine(line []byte, currentLine int) (types.Pai
 
 	data := strings.SplitN(string(line), "=", 2)
 	key := data[0]
-	if err := fl.validator.IsEnvVarName(key); err != nil {
+	if err := kvl.validator.IsEnvVarName(key); err != nil {
 		return kv, err
 	}
 
diff --git a/pkg/loader/kv_test.go b/kv/kv_test.go
similarity index 81%
rename from pkg/loader/kv_test.go
rename to kv/kv_test.go
index 0c3fe4cae..d755441c1 100644
--- a/pkg/loader/kv_test.go
+++ b/kv/kv_test.go
@@ -1,17 +1,24 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package loader
+package kv
 
 import (
 	"reflect"
 	"testing"
 
 	"sigs.k8s.io/kustomize/v3/filesys"
+	ldr "sigs.k8s.io/kustomize/v3/pkg/loader"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
+func makeKvLoader(fSys filesys.FileSystem) *loader {
+	return &loader{
+		ldr:       ldr.NewFileLoaderAtRoot(fSys),
+		validator: validators.MakeFakeValidator()}
+}
+
 func TestKeyValuesFromLines(t *testing.T) {
 	tests := []struct {
 		desc          string
@@ -45,10 +52,9 @@ func TestKeyValuesFromLines(t *testing.T) {
 		// TODO: add negative testcases
 	}
 
-	l := NewFileLoaderAtRoot(
-		validators.MakeFakeValidator(), filesys.MakeFsInMemory())
+	kvl := makeKvLoader(filesys.MakeFsInMemory())
 	for _, test := range tests {
-		pairs, err := l.keyValuesFromLines([]byte(test.content))
+		pairs, err := kvl.keyValuesFromLines([]byte(test.content))
 		if test.expectedErr && err == nil {
 			t.Fatalf("%s should not return error", test.desc)
 		}
@@ -78,9 +84,9 @@ func TestKeyValuesFromFileSources(t *testing.T) {
 
 	fSys := filesys.MakeFsInMemory()
 	fSys.WriteFile("/files/app-init.ini", []byte("FOO=bar"))
-	l := NewFileLoaderAtRoot(validators.MakeFakeValidator(), fSys)
+	kvl := makeKvLoader(fSys)
 	for _, tc := range tests {
-		kvs, err := l.keyValuesFromFileSources(tc.sources)
+		kvs, err := kvl.keyValuesFromFileSources(tc.sources)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
diff --git a/pkg/ifc/ifc.go b/pkg/ifc/ifc.go
index 6f8e892c6..6fd18b473 100644
--- a/pkg/ifc/ifc.go
+++ b/pkg/ifc/ifc.go
@@ -20,6 +20,12 @@ type Validator interface {
 	IsEnvVarName(k string) error
 }
 
+// KvLoader reads and validates KV pairs.
+type KvLoader interface {
+	Validator() Validator
+	Load(args types.KvPairSources) (all []types.Pair, err error)
+}
+
 // Loader interface exposes methods to read bytes.
 type Loader interface {
 	// Root returns the root location for this Loader.
@@ -30,10 +36,6 @@ type Loader interface {
 	Load(location string) ([]byte, error)
 	// Cleanup cleans the loader
 	Cleanup() error
-	// Validator validates data for use in various k8s fields.
-	Validator() Validator
-	// Loads pairs.
-	LoadKvPairs(args types.GeneratorArgs) ([]types.Pair, error)
 }
 
 // Kunstructured allows manipulation of k8s objects
@@ -74,11 +76,11 @@ type KunstructuredFactory interface {
 	FromMap(m map[string]interface{}) Kunstructured
 	Hasher() KunstructuredHasher
 	MakeConfigMap(
-		ldr Loader,
+		kvLdr KvLoader,
 		options *types.GeneratorOptions,
 		args *types.ConfigMapArgs) (Kunstructured, error)
 	MakeSecret(
-		ldr Loader,
+		kvLdr KvLoader,
 		options *types.GeneratorOptions,
 		args *types.SecretArgs) (Kunstructured, error)
 }
diff --git a/pkg/kusttest/kusttestharness.go b/pkg/kusttest/kusttestharness.go
index c37c5abbc..b816c4d8f 100644
--- a/pkg/kusttest/kusttestharness.go
+++ b/pkg/kusttest/kusttestharness.go
@@ -20,6 +20,7 @@ import (
 	"sigs.k8s.io/kustomize/v3/pkg/target"
 	"sigs.k8s.io/kustomize/v3/pkg/transformers/config/defaultconfig"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
+	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
 // KustTestHarness helps test kustomization generation and transformation.
@@ -59,7 +60,8 @@ func NewKustTestHarnessFull(
 
 func (th *KustTestHarness) MakeKustTarget() *target.KustTarget {
 	kt, err := target.NewKustTarget(
-		th.ldr, th.rf, transformer.NewFactoryImpl(), th.pl)
+		th.ldr, validators.MakeFakeValidator(), th.rf,
+		transformer.NewFactoryImpl(), th.pl)
 	if err != nil {
 		th.t.Fatalf("Unexpected construction error %v", err)
 	}
@@ -113,7 +115,8 @@ func (th *KustTestHarness) LoadAndRunGenerator(
 	if err != nil {
 		th.t.Fatalf("Err: %v", err)
 	}
-	g, err := th.pl.LoadGenerator(th.ldr, res)
+	g, err := th.pl.LoadGenerator(
+		th.ldr, validators.MakeFakeValidator(), res)
 	if err != nil {
 		th.t.Fatalf("Err: %v", err)
 	}
@@ -154,7 +157,8 @@ func (th *KustTestHarness) RunTransformerFromResMap(
 	if err != nil {
 		th.t.Fatalf("Err: %v", err)
 	}
-	g, err := th.pl.LoadTransformer(th.ldr, transConfig)
+	g, err := th.pl.LoadTransformer(
+		th.ldr, validators.MakeFakeValidator(), transConfig)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/loader/fileloader.go b/pkg/loader/fileloader.go
index d9e10c478..db1fc88b0 100644
--- a/pkg/loader/fileloader.go
+++ b/pkg/loader/fileloader.go
@@ -79,9 +79,6 @@ type fileLoader struct {
 	// Restricts behavior of Load function.
 	loadRestrictor LoadRestrictorFunc
 
-	// Used to validate various k8s data fields.
-	validator ifc.Validator
-
 	// If this is non-nil, the files were
 	// obtained from the given repository.
 	repoSpec *git.RepoSpec
@@ -100,16 +97,16 @@ const CWD = "."
 
 // NewFileLoaderAtCwd returns a loader that loads from ".".
 // A convenience for kustomize edit commands.
-func NewFileLoaderAtCwd(v ifc.Validator, fSys filesys.FileSystem) *fileLoader {
+func NewFileLoaderAtCwd(fSys filesys.FileSystem) *fileLoader {
 	return newLoaderOrDie(
-		RestrictionRootOnly, v, fSys, CWD)
+		RestrictionRootOnly, fSys, CWD)
 }
 
 // NewFileLoaderAtRoot returns a loader that loads from "/".
 // A convenience for tests.
-func NewFileLoaderAtRoot(v ifc.Validator, fSys filesys.FileSystem) *fileLoader {
+func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
 	return newLoaderOrDie(
-		RestrictionRootOnly, v, fSys, string(filepath.Separator))
+		RestrictionRootOnly, fSys, string(filepath.Separator))
 }
 
 // Root returns the absolute path that is prepended to any
@@ -119,25 +116,23 @@ func (fl *fileLoader) Root() string {
 }
 
 func newLoaderOrDie(
-	lr LoadRestrictorFunc, v ifc.Validator,
+	lr LoadRestrictorFunc,
 	fSys filesys.FileSystem, path string) *fileLoader {
 	root, err := demandDirectoryRoot(fSys, path)
 	if err != nil {
 		log.Fatalf("unable to make loader at '%s'; %v", path, err)
 	}
 	return newLoaderAtConfirmedDir(
-		lr, v, root, fSys, nil, git.ClonerUsingGitExec)
+		lr, root, fSys, nil, git.ClonerUsingGitExec)
 }
 
 // newLoaderAtConfirmedDir returns a new fileLoader with given root.
 func newLoaderAtConfirmedDir(
 	lr LoadRestrictorFunc,
-	v ifc.Validator,
 	root filesys.ConfirmedDir, fSys filesys.FileSystem,
 	referrer *fileLoader, cloner git.Cloner) *fileLoader {
 	return &fileLoader{
 		loadRestrictor: lr,
-		validator:      v,
 		root:           root,
 		referrer:       referrer,
 		fSys:           fSys,
@@ -179,7 +174,7 @@ func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 			return nil, err
 		}
 		return newLoaderAtGitClone(
-			repoSpec, fl.validator, fl.fSys, fl, fl.cloner)
+			repoSpec, fl.fSys, fl, fl.cloner)
 	}
 	if filepath.IsAbs(path) {
 		return nil, fmt.Errorf("new root '%s' cannot be absolute", path)
@@ -195,14 +190,13 @@ func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 		return nil, err
 	}
 	return newLoaderAtConfirmedDir(
-		fl.loadRestrictor, fl.validator, root, fl.fSys, fl, fl.cloner), nil
+		fl.loadRestrictor, root, fl.fSys, fl, fl.cloner), nil
 }
 
 // newLoaderAtGitClone returns a new Loader pinned to a temporary
 // directory holding a cloned git repo.
 func newLoaderAtGitClone(
-	repoSpec *git.RepoSpec,
-	v ifc.Validator, fSys filesys.FileSystem,
+	repoSpec *git.RepoSpec, fSys filesys.FileSystem,
 	referrer *fileLoader, cloner git.Cloner) (ifc.Loader, error) {
 	cleaner := repoSpec.Cleaner(fSys)
 	err := cloner(repoSpec)
@@ -228,7 +222,6 @@ func newLoaderAtGitClone(
 	return &fileLoader{
 		// Clones never allowed to escape root.
 		loadRestrictor: RestrictionRootOnly,
-		validator:      v,
 		root:           root,
 		referrer:       referrer,
 		repoSpec:       repoSpec,
diff --git a/pkg/loader/fileloader_test.go b/pkg/loader/fileloader_test.go
index 1d6ec3a0d..87e654db6 100644
--- a/pkg/loader/fileloader_test.go
+++ b/pkg/loader/fileloader_test.go
@@ -29,7 +29,6 @@ import (
 	"sigs.k8s.io/kustomize/v3/pkg/git"
 	"sigs.k8s.io/kustomize/v3/pkg/ifc"
 	"sigs.k8s.io/kustomize/v3/pkg/pgmconfig"
-	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
 type testData struct {
@@ -65,7 +64,7 @@ func MakeFakeFs(td []testData) filesys.FileSystem {
 }
 
 func makeLoader() *fileLoader {
-	return NewFileLoaderAtRoot(validators.MakeFakeValidator(), MakeFakeFs(testCases))
+	return NewFileLoaderAtRoot(MakeFakeFs(testCases))
 
 }
 func TestLoaderLoad(t *testing.T) {
@@ -302,8 +301,7 @@ func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
 
 	var l ifc.Loader
 
-	l = newLoaderOrDie(
-		RestrictionRootOnly, validators.MakeFakeValidator(), fSys, dir)
+	l = newLoaderOrDie(RestrictionRootOnly, fSys, dir)
 
 	l = doSanityChecksAndDropIntoBase(t, l)
 
@@ -336,8 +334,7 @@ func TestRestrictionNoneInRealLoader(t *testing.T) {
 
 	var l ifc.Loader
 
-	l = newLoaderOrDie(
-		RestrictionNone, validators.MakeFakeValidator(), fSys, dir)
+	l = newLoaderOrDie(RestrictionNone, fSys, dir)
 
 	l = doSanityChecksAndDropIntoBase(t, l)
 
@@ -400,7 +397,7 @@ whatever
 		t.Fatalf("unexpected err: %v\n", err)
 	}
 	l, err := newLoaderAtGitClone(
-		repoSpec, validators.MakeFakeValidator(), fSys, nil,
+		repoSpec, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(coRoot)))
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
@@ -443,7 +440,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	// Establish that a local overlay can navigate
 	// to the local bases.
 	l1 = newLoaderOrDie(
-		RestrictionRootOnly, validators.MakeFakeValidator(), fSys, cloneRoot+"/foo/overlay")
+		RestrictionRootOnly, fSys, cloneRoot+"/foo/overlay")
 	if l1.Root() != cloneRoot+"/foo/overlay" {
 		t.Fatalf("unexpected root %s", l1.Root())
 	}
@@ -479,7 +476,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
 	l1, err = newLoaderAtGitClone(
-		repoSpec, validators.MakeFakeValidator(), fSys, nil,
+		repoSpec, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
@@ -518,7 +515,7 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 		t.Fatalf("unexpected err:  %v\n", err)
 	}
 	l1 := newLoaderAtConfirmedDir(
-		RestrictionRootOnly, validators.MakeFakeValidator(), root, fSys, nil,
+		RestrictionRootOnly, root, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	if l1.Root() != topDir {
 		t.Fatalf("unexpected root %s", l1.Root())
@@ -544,7 +541,7 @@ func TestRepoDirectCycleDetection(t *testing.T) {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
 	l1 := newLoaderAtConfirmedDir(
-		RestrictionRootOnly, validators.MakeFakeValidator(), root, fSys, nil,
+		RestrictionRootOnly, root, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	p1 := "github.com/someOrg/someRepo/foo"
 	rs1, err := git.NewRepoSpecFromUrl(p1)
@@ -573,7 +570,7 @@ func TestRepoIndirectCycleDetection(t *testing.T) {
 		t.Fatalf("unexpected err: %v", err)
 	}
 	l0 := newLoaderAtConfirmedDir(
-		RestrictionRootOnly, validators.MakeFakeValidator(), root, fSys, nil,
+		RestrictionRootOnly, root, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 
 	p1 := "github.com/someOrg/someRepo1"
diff --git a/pkg/loader/loader.go b/pkg/loader/loader.go
index cd51c85c5..4c4b1fe74 100644
--- a/pkg/loader/loader.go
+++ b/pkg/loader/loader.go
@@ -18,18 +18,17 @@ import (
 // the remote bases will all be root-only restricted.
 func NewLoader(
 	lr LoadRestrictorFunc,
-	v ifc.Validator,
 	target string, fSys filesys.FileSystem) (ifc.Loader, error) {
 	repoSpec, err := git.NewRepoSpecFromUrl(target)
 	if err == nil {
 		// The target qualifies as a remote git target.
 		return newLoaderAtGitClone(
-			repoSpec, v, fSys, nil, git.ClonerUsingGitExec)
+			repoSpec, fSys, nil, git.ClonerUsingGitExec)
 	}
 	root, err := demandDirectoryRoot(fSys, target)
 	if err != nil {
 		return nil, err
 	}
 	return newLoaderAtConfirmedDir(
-		lr, v, root, fSys, nil, git.ClonerUsingGitExec), nil
+		lr, root, fSys, nil, git.ClonerUsingGitExec), nil
 }
diff --git a/pkg/plugins/execplugin_test.go b/pkg/plugins/execplugin_test.go
index 2175e98ba..28eddaca1 100644
--- a/pkg/plugins/execplugin_test.go
+++ b/pkg/plugins/execplugin_test.go
@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/resource"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
+	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
 func TestExecPluginConfig(t *testing.T) {
@@ -21,6 +22,7 @@ func TestExecPluginConfig(t *testing.T) {
 		resource.NewFactory(
 			kunstruct.NewKunstructuredFactoryImpl()), nil)
 	ldr := loadertest.NewFakeLoader(path)
+	v := validators.MakeFakeValidator()
 	pluginConfig := rf.RF().FromMap(
 		map[string]interface{}{
 			"apiVersion": "someteam.example.com/v1",
@@ -47,7 +49,7 @@ s/$BAR/bar/g
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	p.Config(resmap.NewPluginHelpers(ldr, rf), yaml)
+	p.Config(resmap.NewPluginHelpers(ldr, v, rf), yaml)
 
 	expected := "/kustomize/plugin/someteam.example.com/v1/sedtransformer/SedTransformer"
 	if !strings.HasSuffix(p.path, expected) {
diff --git a/pkg/plugins/loader.go b/pkg/plugins/loader.go
index afb864e11..6f7c45a40 100644
--- a/pkg/plugins/loader.go
+++ b/pkg/plugins/loader.go
@@ -30,10 +30,10 @@ func NewLoader(
 }
 
 func (l *Loader) LoadGenerators(
-	ldr ifc.Loader, rm resmap.ResMap) ([]resmap.Generator, error) {
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]resmap.Generator, error) {
 	var result []resmap.Generator
 	for _, res := range rm.Resources() {
-		g, err := l.LoadGenerator(ldr, res)
+		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
 			return nil, err
 		}
@@ -43,8 +43,8 @@ func (l *Loader) LoadGenerators(
 }
 
 func (l *Loader) LoadGenerator(
-	ldr ifc.Loader, res *resource.Resource) (resmap.Generator, error) {
-	c, err := l.loadAndConfigurePlugin(ldr, res)
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (resmap.Generator, error) {
+	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
 	}
@@ -56,10 +56,10 @@ func (l *Loader) LoadGenerator(
 }
 
 func (l *Loader) LoadTransformers(
-	ldr ifc.Loader, rm resmap.ResMap) ([]resmap.Transformer, error) {
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]resmap.Transformer, error) {
 	var result []resmap.Transformer
 	for _, res := range rm.Resources() {
-		t, err := l.LoadTransformer(ldr, res)
+		t, err := l.LoadTransformer(ldr, v, res)
 		if err != nil {
 			return nil, err
 		}
@@ -69,8 +69,8 @@ func (l *Loader) LoadTransformers(
 }
 
 func (l *Loader) LoadTransformer(
-	ldr ifc.Loader, res *resource.Resource) (resmap.Transformer, error) {
-	c, err := l.loadAndConfigurePlugin(ldr, res)
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (resmap.Transformer, error) {
+	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +104,7 @@ func isBuiltinPlugin(res *resource.Resource) bool {
 }
 
 func (l *Loader) loadAndConfigurePlugin(
-	ldr ifc.Loader, res *resource.Resource) (c resmap.Configurable, err error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (c resmap.Configurable, err error) {
 	if isBuiltinPlugin(res) {
 		// Instead of looking for and loading a .so file, just
 		// instantiate the plugin from a generated factory
@@ -123,7 +123,7 @@ func (l *Loader) loadAndConfigurePlugin(
 	if err != nil {
 		return nil, errors.Wrapf(err, "marshalling yaml from res %s", res.OrgId())
 	}
-	err = c.Config(resmap.NewPluginHelpers(ldr, l.rf), yaml)
+	err = c.Config(resmap.NewPluginHelpers(ldr, v, l.rf), yaml)
 	if err != nil {
 		return nil, errors.Wrapf(
 			err, "plugin %s fails configuration", res.OrgId())
diff --git a/pkg/plugins/loader_test.go b/pkg/plugins/loader_test.go
index 66768413e..727e4dc55 100644
--- a/pkg/plugins/loader_test.go
+++ b/pkg/plugins/loader_test.go
@@ -6,13 +6,13 @@ package plugins_test
 import (
 	"testing"
 
-	"sigs.k8s.io/kustomize/v3/pluglib"
-
 	"sigs.k8s.io/kustomize/v3/internal/loadertest"
 	"sigs.k8s.io/kustomize/v3/k8sdeps/kunstruct"
 	. "sigs.k8s.io/kustomize/v3/pkg/plugins"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/resource"
+	"sigs.k8s.io/kustomize/v3/pkg/validators"
+	"sigs.k8s.io/kustomize/v3/pluglib"
 )
 
 const (
@@ -54,20 +54,20 @@ func TestLoader(t *testing.T) {
 	rmF := resmap.NewFactory(resource.NewFactory(
 		kunstruct.NewKunstructuredFactoryImpl()), nil)
 
-	l := NewLoader(ActivePluginConfig(), rmF)
-	if l == nil {
+	ldr := loadertest.NewFakeLoader("/foo")
+
+	pLdr := NewLoader(ActivePluginConfig(), rmF)
+	if pLdr == nil {
 		t.Fatal("expect non-nil loader")
 	}
 
-	ldr := loadertest.NewFakeLoader("/foo")
-
 	m, err := rmF.NewResMapFromBytes([]byte(
 		someServiceGenerator + "---\n" + secretGenerator))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_, err = l.LoadGenerators(ldr, m)
+	_, err = pLdr.LoadGenerators(ldr, validators.MakeFakeValidator(), m)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/resmap/factory.go b/pkg/resmap/factory.go
index ebe44752e..6d1049116 100644
--- a/pkg/resmap/factory.go
+++ b/pkg/resmap/factory.go
@@ -66,12 +66,12 @@ func (rmF *Factory) NewResMapFromBytes(b []byte) (ResMap, error) {
 // NewResMapFromConfigMapArgs returns a Resource slice given
 // a configmap metadata slice from kustomization file.
 func (rmF *Factory) NewResMapFromConfigMapArgs(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	argList []types.ConfigMapArgs) (ResMap, error) {
 	var resources []*resource.Resource
 	for _, args := range argList {
-		res, err := rmF.resF.MakeConfigMap(ldr, options, &args)
+		res, err := rmF.resF.MakeConfigMap(kvLdr, options, &args)
 		if err != nil {
 			return nil, errors.Wrap(err, "NewResMapFromConfigMapArgs")
 		}
@@ -81,10 +81,10 @@ func (rmF *Factory) NewResMapFromConfigMapArgs(
 }
 
 func (rmF *Factory) FromConfigMapArgs(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args types.ConfigMapArgs) (ResMap, error) {
-	res, err := rmF.resF.MakeConfigMap(ldr, options, &args)
+	res, err := rmF.resF.MakeConfigMap(kvLdr, options, &args)
 	if err != nil {
 		return nil, err
 	}
@@ -94,12 +94,12 @@ func (rmF *Factory) FromConfigMapArgs(
 // NewResMapFromSecretArgs takes a SecretArgs slice, generates
 // secrets from each entry, and accumulates them in a ResMap.
 func (rmF *Factory) NewResMapFromSecretArgs(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	argsList []types.SecretArgs) (ResMap, error) {
 	var resources []*resource.Resource
 	for _, args := range argsList {
-		res, err := rmF.resF.MakeSecret(ldr, options, &args)
+		res, err := rmF.resF.MakeSecret(kvLdr, options, &args)
 		if err != nil {
 			return nil, errors.Wrap(err, "NewResMapFromSecretArgs")
 		}
@@ -109,10 +109,10 @@ func (rmF *Factory) NewResMapFromSecretArgs(
 }
 
 func (rmF *Factory) FromSecretArgs(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args types.SecretArgs) (ResMap, error) {
-	res, err := rmF.resF.MakeSecret(ldr, options, &args)
+	res, err := rmF.resF.MakeSecret(kvLdr, options, &args)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/resmap/factory_test.go b/pkg/resmap/factory_test.go
index 3571bc7a2..cd8171123 100644
--- a/pkg/resmap/factory_test.go
+++ b/pkg/resmap/factory_test.go
@@ -10,6 +10,7 @@ import (
 
 	"sigs.k8s.io/kustomize/v3/filesys"
 	"sigs.k8s.io/kustomize/v3/internal/loadertest"
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/gvk"
 	"sigs.k8s.io/kustomize/v3/pkg/ifc"
 	"sigs.k8s.io/kustomize/v3/pkg/loader"
@@ -119,6 +120,7 @@ func TestNewFromConfigMaps(t *testing.T) {
 	}
 
 	l := loadertest.NewFakeLoader("/whatever/project")
+	kvLdr := kv.NewLoader(l, validators.MakeFakeValidator())
 	testCases := []testCase{
 		{
 			description: "construct config map from env",
@@ -206,10 +208,10 @@ BAR=baz
 		// files/literal/env etc.
 	}
 	for _, tc := range testCases {
-		if ferr := l.AddFile(tc.filepath, []byte(tc.content)); ferr != nil {
-			t.Fatalf("Error adding fake file: %v\n", ferr)
+		if fErr := l.AddFile(tc.filepath, []byte(tc.content)); fErr != nil {
+			t.Fatalf("Error adding fake file: %v\n", fErr)
 		}
-		r, err := rmF.NewResMapFromConfigMapArgs(l, nil, tc.input)
+		r, err := rmF.NewResMapFromConfigMapArgs(kvLdr, nil, tc.input)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -236,8 +238,11 @@ func TestNewResMapFromSecretArgs(t *testing.T) {
 	}
 	fSys := filesys.MakeFsInMemory()
 	fSys.Mkdir(".")
+
 	actual, err := rmF.NewResMapFromSecretArgs(
-		loader.NewFileLoaderAtRoot(validators.MakeFakeValidator(), fSys), nil, secrets)
+		kv.NewLoader(
+			loader.NewFileLoaderAtRoot(fSys),
+			validators.MakeFakeValidator()), nil, secrets)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
diff --git a/pkg/resmap/resmap.go b/pkg/resmap/resmap.go
index f352bacd1..912239f78 100644
--- a/pkg/resmap/resmap.go
+++ b/pkg/resmap/resmap.go
@@ -38,8 +38,8 @@ type Configurable interface {
 }
 
 // NewPluginHelpers makes an instance of PluginHelpers.
-func NewPluginHelpers(ldr ifc.Loader, rf *Factory) *PluginHelpers {
-	return &PluginHelpers{ldr: ldr, rf: rf}
+func NewPluginHelpers(ldr ifc.Loader, v ifc.Validator, rf *Factory) *PluginHelpers {
+	return &PluginHelpers{ldr: ldr, v: v, rf: rf}
 }
 
 // PluginHelpers holds things that any or all plugins might need.
@@ -47,6 +47,7 @@ func NewPluginHelpers(ldr ifc.Loader, rf *Factory) *PluginHelpers {
 // any plugin-specific configuration.
 type PluginHelpers struct {
 	ldr ifc.Loader
+	v   ifc.Validator
 	rf  *Factory
 }
 
@@ -58,6 +59,10 @@ func (c *PluginHelpers) ResmapFactory() *Factory {
 	return c.rf
 }
 
+func (c *PluginHelpers) Validator() ifc.Validator {
+	return c.v
+}
+
 type GeneratorPlugin interface {
 	Generator
 	Configurable
diff --git a/pkg/resource/factory.go b/pkg/resource/factory.go
index a409f2dd8..c1649b932 100644
--- a/pkg/resource/factory.go
+++ b/pkg/resource/factory.go
@@ -148,10 +148,10 @@ func (rf *Factory) SliceFromBytes(in []byte) ([]*Resource, error) {
 
 // MakeConfigMap makes an instance of Resource for ConfigMap
 func (rf *Factory) MakeConfigMap(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args *types.ConfigMapArgs) (*Resource, error) {
-	u, err := rf.kf.MakeConfigMap(ldr, options, args)
+	u, err := rf.kf.MakeConfigMap(kvLdr, options, args)
 	if err != nil {
 		return nil, err
 	}
@@ -164,10 +164,10 @@ func (rf *Factory) MakeConfigMap(
 
 // MakeSecret makes an instance of Resource for Secret
 func (rf *Factory) MakeSecret(
-	ldr ifc.Loader,
+	kvLdr ifc.KvLoader,
 	options *types.GeneratorOptions,
 	args *types.SecretArgs) (*Resource, error) {
-	u, err := rf.kf.MakeSecret(ldr, options, args)
+	u, err := rf.kf.MakeSecret(kvLdr, options, args)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/target/kusttarget.go b/pkg/target/kusttarget.go
index 778484991..6fdbb80cc 100644
--- a/pkg/target/kusttarget.go
+++ b/pkg/target/kusttarget.go
@@ -29,6 +29,7 @@ import (
 type KustTarget struct {
 	kustomization *types.Kustomization
 	ldr           ifc.Loader
+	validator     ifc.Validator
 	rFactory      *resmap.Factory
 	tFactory      resmap.PatchFactory
 	pLdr          *plugins.Loader
@@ -37,6 +38,7 @@ type KustTarget struct {
 // NewKustTarget returns a new instance of KustTarget primed with a Loader.
 func NewKustTarget(
 	ldr ifc.Loader,
+	validator ifc.Validator,
 	rFactory *resmap.Factory,
 	tFactory resmap.PatchFactory,
 	pLdr *plugins.Loader) (*KustTarget, error) {
@@ -60,6 +62,7 @@ func NewKustTarget(
 	return &KustTarget{
 		kustomization: &k,
 		ldr:           ldr,
+		validator:     validator,
 		rFactory:      rFactory,
 		tFactory:      tFactory,
 		pLdr:          pLdr,
@@ -281,7 +284,7 @@ func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error)
 	if err != nil {
 		return nil, err
 	}
-	return kt.pLdr.LoadGenerators(kt.ldr, ra.ResMap())
+	return kt.pLdr.LoadGenerators(kt.ldr, kt.validator, ra.ResMap())
 }
 
 func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
@@ -307,7 +310,7 @@ func (kt *KustTarget) configureExternalTransformers() ([]resmap.Transformer, err
 	if err != nil {
 		return nil, err
 	}
-	return kt.pLdr.LoadTransformers(kt.ldr, ra.ResMap())
+	return kt.pLdr.LoadTransformers(kt.ldr, kt.validator, ra.ResMap())
 }
 
 // accumulateResources fills the given resourceAccumulator
@@ -337,7 +340,7 @@ func (kt *KustTarget) accumulateDirectory(
 	ra *accumulator.ResAccumulator, ldr ifc.Loader, path string) error {
 	defer ldr.Cleanup()
 	subKt, err := NewKustTarget(
-		ldr, kt.rFactory, kt.tFactory, kt.pLdr)
+		ldr, kt.validator, kt.rFactory, kt.tFactory, kt.pLdr)
 	if err != nil {
 		return errors.Wrapf(err, "couldn't make target for path '%s'", path)
 	}
@@ -377,7 +380,7 @@ func (kt *KustTarget) configureBuiltinPlugin(
 				err, "builtin %s marshal", bpt)
 		}
 	}
-	err = p.Config(resmap.NewPluginHelpers(kt.ldr, kt.rFactory), y)
+	err = p.Config(resmap.NewPluginHelpers(kt.ldr, kt.validator, kt.rFactory), y)
 	if err != nil {
 		return errors.Wrapf(err, "builtin %s config: %v", bpt, y)
 	}
diff --git a/pkg/target/kusttarget_test.go b/pkg/target/kusttarget_test.go
index a66416d4d..21ce080f1 100644
--- a/pkg/target/kusttarget_test.go
+++ b/pkg/target/kusttarget_test.go
@@ -17,6 +17,7 @@ import (
 	"sigs.k8s.io/kustomize/v3/pkg/resource"
 	. "sigs.k8s.io/kustomize/v3/pkg/target"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
+	"sigs.k8s.io/kustomize/v3/pkg/validators"
 )
 
 const (
@@ -184,7 +185,8 @@ func TestResources(t *testing.T) {
 
 func TestKustomizationNotFound(t *testing.T) {
 	_, err := NewKustTarget(
-		loadertest.NewFakeLoader("/foo"), nil, nil, nil)
+		loadertest.NewFakeLoader("/foo"),
+		validators.MakeFakeValidator(), nil, nil, nil)
 	if err == nil {
 		t.Fatalf("expected an error")
 	}
diff --git a/pkg/target/plugindir_test.go b/pkg/target/plugindir_test.go
index b7fb3d87c..9afa37950 100644
--- a/pkg/target/plugindir_test.go
+++ b/pkg/target/plugindir_test.go
@@ -59,7 +59,7 @@ metadata:
 	}
 
 	ldr, err := loader.NewLoader(
-		loader.RestrictionRootOnly, validators.MakeFakeValidator(), dir, fSys)
+		loader.RestrictionRootOnly, dir, fSys)
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
@@ -67,7 +67,8 @@ metadata:
 		kunstruct.NewKunstructuredFactoryImpl()), nil)
 
 	pl := plugins.NewLoader(plugins.ActivePluginConfig(), rf)
-	tg, err := target.NewKustTarget(ldr, rf, transformer.NewFactoryImpl(), pl)
+	tg, err := target.NewKustTarget(
+		ldr, validators.MakeFakeValidator(), rf, transformer.NewFactoryImpl(), pl)
 	if err != nil {
 		t.Fatalf("err %v", err)
 	}
diff --git a/pkg/types/kustomization.go b/pkg/types/kustomization.go
index bc5ef0d6e..2b97eb73f 100644
--- a/pkg/types/kustomization.go
+++ b/pkg/types/kustomization.go
@@ -182,12 +182,6 @@ type PluginConfig struct {
 	Enabled bool
 }
 
-// Pair is a key value pair.
-type Pair struct {
-	Key   string
-	Value string
-}
-
 type PluginType string
 
 func (p PluginType) IsUndefined() bool {
diff --git a/pkg/types/kvpairsources.go b/pkg/types/kvpairsources.go
index fb487bd34..61252c064 100644
--- a/pkg/types/kvpairsources.go
+++ b/pkg/types/kvpairsources.go
@@ -3,7 +3,7 @@
 
 package types
 
-// KvPairSources contains some generic sources for generators.
+// KvPairSources defines places to obtain key value pairs.
 type KvPairSources struct {
 	// LiteralSources is a list of literal
 	// pair sources. Each literal source should
diff --git a/pkg/types/pair.go b/pkg/types/pair.go
new file mode 100644
index 000000000..63cfb776e
--- /dev/null
+++ b/pkg/types/pair.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package types
+
+// Pair is a key value pair.
+type Pair struct {
+	Key   string
+	Value string
+}
diff --git a/plugin/builtin/ConfigMapGenerator.go b/plugin/builtin/ConfigMapGenerator.go
index 032160b56..ad5d3d72a 100644
--- a/plugin/builtin/ConfigMapGenerator.go
+++ b/plugin/builtin/ConfigMapGenerator.go
@@ -2,6 +2,7 @@
 package builtin
 
 import (
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/yaml"
@@ -31,7 +32,8 @@ func (p *ConfigMapGeneratorPlugin) Config(
 
 func (p *ConfigMapGeneratorPlugin) Generate() (resmap.ResMap, error) {
 	return p.h.ResmapFactory().FromConfigMapArgs(
-		p.h.Loader(), &p.GeneratorOptions, p.ConfigMapArgs)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.ConfigMapArgs)
 }
 
 func NewConfigMapGeneratorPlugin() resmap.GeneratorPlugin {
diff --git a/plugin/builtin/InventoryTransformer.go b/plugin/builtin/InventoryTransformer.go
index 8633842ab..cd7922854 100644
--- a/plugin/builtin/InventoryTransformer.go
+++ b/plugin/builtin/InventoryTransformer.go
@@ -4,6 +4,7 @@ package builtin
 import (
 	"fmt"
 
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/hasher"
 	"sigs.k8s.io/kustomize/v3/pkg/inventory"
 	"sigs.k8s.io/kustomize/v3/pkg/resid"
@@ -71,7 +72,7 @@ func (p *InventoryTransformerPlugin) Transform(m resmap.ResMap) error {
 	}
 
 	cm, err := p.h.ResmapFactory().RF().MakeConfigMap(
-		p.h.Loader(), opts, &args)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()), opts, &args)
 	if err != nil {
 		return err
 	}
diff --git a/plugin/builtin/SecretGenerator.go b/plugin/builtin/SecretGenerator.go
index f61864a96..af9dde280 100644
--- a/plugin/builtin/SecretGenerator.go
+++ b/plugin/builtin/SecretGenerator.go
@@ -2,6 +2,7 @@
 package builtin
 
 import (
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/yaml"
@@ -30,7 +31,8 @@ func (p *SecretGeneratorPlugin) Config(h *resmap.PluginHelpers, config []byte) (
 
 func (p *SecretGeneratorPlugin) Generate() (resmap.ResMap, error) {
 	return p.h.ResmapFactory().FromSecretArgs(
-		p.h.Loader(), &p.GeneratorOptions, p.SecretArgs)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.SecretArgs)
 }
 
 func NewSecretGeneratorPlugin() resmap.GeneratorPlugin {
diff --git a/plugin/builtin/configmapgenerator/ConfigMapGenerator.go b/plugin/builtin/configmapgenerator/ConfigMapGenerator.go
index a4e405850..10e28e319 100644
--- a/plugin/builtin/configmapgenerator/ConfigMapGenerator.go
+++ b/plugin/builtin/configmapgenerator/ConfigMapGenerator.go
@@ -5,6 +5,7 @@
 package main
 
 import (
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/yaml"
@@ -37,5 +38,6 @@ func (p *plugin) Config(
 
 func (p *plugin) Generate() (resmap.ResMap, error) {
 	return p.h.ResmapFactory().FromConfigMapArgs(
-		p.h.Loader(), &p.GeneratorOptions, p.ConfigMapArgs)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.ConfigMapArgs)
 }
diff --git a/plugin/builtin/inventorytransformer/InventoryTransformer.go b/plugin/builtin/inventorytransformer/InventoryTransformer.go
index 320e58b07..88b1e6503 100644
--- a/plugin/builtin/inventorytransformer/InventoryTransformer.go
+++ b/plugin/builtin/inventorytransformer/InventoryTransformer.go
@@ -7,6 +7,7 @@ package main
 import (
 	"fmt"
 
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/hasher"
 	"sigs.k8s.io/kustomize/v3/pkg/inventory"
 	"sigs.k8s.io/kustomize/v3/pkg/resid"
@@ -77,7 +78,7 @@ func (p *plugin) Transform(m resmap.ResMap) error {
 	}
 
 	cm, err := p.h.ResmapFactory().RF().MakeConfigMap(
-		p.h.Loader(), opts, &args)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()), opts, &args)
 	if err != nil {
 		return err
 	}
diff --git a/plugin/builtin/secretgenerator/SecretGenerator.go b/plugin/builtin/secretgenerator/SecretGenerator.go
index bebbcea1e..f4fc5431d 100644
--- a/plugin/builtin/secretgenerator/SecretGenerator.go
+++ b/plugin/builtin/secretgenerator/SecretGenerator.go
@@ -5,6 +5,7 @@
 package main
 
 import (
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/yaml"
@@ -36,5 +37,6 @@ func (p *plugin) Config(h *resmap.PluginHelpers, config []byte) (err error) {
 
 func (p *plugin) Generate() (resmap.ResMap, error) {
 	return p.h.ResmapFactory().FromSecretArgs(
-		p.h.Loader(), &p.GeneratorOptions, p.SecretArgs)
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.SecretArgs)
 }
diff --git a/plugin/someteam.example.com/v1/secretsfromdatabase/SecretsFromDatabase.go b/plugin/someteam.example.com/v1/secretsfromdatabase/SecretsFromDatabase.go
index 0af96b25b..aefa4fd25 100644
--- a/plugin/someteam.example.com/v1/secretsfromdatabase/SecretsFromDatabase.go
+++ b/plugin/someteam.example.com/v1/secretsfromdatabase/SecretsFromDatabase.go
@@ -4,6 +4,7 @@
 package main
 
 import (
+	"sigs.k8s.io/kustomize/v3/kv"
 	"sigs.k8s.io/kustomize/v3/pkg/resmap"
 	"sigs.k8s.io/kustomize/v3/pkg/types"
 	"sigs.k8s.io/yaml"
@@ -47,5 +48,6 @@ func (p *plugin) Generate() (resmap.ResMap, error) {
 				args.LiteralSources, k+"="+v)
 		}
 	}
-	return p.h.ResmapFactory().FromSecretArgs(p.h.Loader(), nil, args)
+	return p.h.ResmapFactory().FromSecretArgs(
+		kv.NewLoader(p.h.Loader(), p.h.Validator()), nil, args)
 }