diff --git a/pkg/commands/testdata/testcase-variable-ref/expected.yaml b/pkg/commands/testdata/testcase-variable-ref/expected.yaml
index 74b64270a..4a82e01fe 100644
--- a/pkg/commands/testdata/testcase-variable-ref/expected.yaml
+++ b/pkg/commands/testdata/testcase-variable-ref/expected.yaml
@@ -1,4 +1,72 @@
 apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: cockroachdb
+  name: dev-base-cockroachdb
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  labels:
+    app: cockroachdb
+  name: dev-base-cockroachdb
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    app: cockroachdb
+  name: dev-base-cockroachdb
+rules:
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    app: cockroachdb
+  name: dev-base-cockroachdb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dev-base-cockroachdb
+subjects:
+- kind: ServiceAccount
+  name: dev-base-cockroachdb
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: cockroachdb
+  name: dev-base-cockroachdb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: dev-base-cockroachdb
+subjects:
+- kind: ServiceAccount
+  name: dev-base-cockroachdb
+  namespace: default
+---
+apiVersion: v1
 kind: Service
 metadata:
   annotations:
@@ -38,13 +106,6 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app: cockroachdb
-  name: dev-base-cockroachdb
----
 apiVersion: apps/v1beta1
 kind: StatefulSet
 metadata:
@@ -142,64 +203,3 @@ spec:
   selector:
     matchLabels:
       app: cockroachdb
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  labels:
-    app: cockroachdb
-  name: dev-base-cockroachdb
-rules:
-- apiGroups:
-  - certificates.k8s.io
-  resources:
-  - certificatesigningrequests
-  verbs:
-  - create
-  - get
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app: cockroachdb
-  name: dev-base-cockroachdb
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: dev-base-cockroachdb
-subjects:
-- kind: ServiceAccount
-  name: dev-base-cockroachdb
-  namespace: default
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
-metadata:
-  labels:
-    app: cockroachdb
-  name: dev-base-cockroachdb
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  labels:
-    app: cockroachdb
-  name: dev-base-cockroachdb
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: dev-base-cockroachdb
-subjects:
-- kind: ServiceAccount
-  name: dev-base-cockroachdb
-  namespace: default
diff --git a/pkg/resmap/idslice.go b/pkg/resmap/idslice.go
index 04623d284..3b4652608 100644
--- a/pkg/resmap/idslice.go
+++ b/pkg/resmap/idslice.go
@@ -37,12 +37,27 @@ func (a IdSlice) Less(i, j int) bool {
 	return a[i].Name() < a[j].Name()
 }
 
-func gvkLess(i, j schema.GroupVersionKind) bool {
-	if i.Kind == "Namespace" {
-		return true
-	} else if j.Kind == "Namespace" {
-		return false
-	} else {
-		return i.String() < j.String()
+var order = []string{"Namespace", "CustomResourceDefinition", "ServiceAccount",
+	"Role", "ClusterRole", "RoleBinding", "ClusterRoleBinding"}
+var typeOrders = func() map[string]int {
+	m := map[string]int{}
+	for i, n := range order {
+		m[n] = i
 	}
+	return m
+}()
+
+func gvkLess(i, j schema.GroupVersionKind) bool {
+	indexi, foundi := typeOrders[i.Kind]
+	indexj, foundj := typeOrders[j.Kind]
+	if foundi && foundj {
+		return indexi < indexj
+	}
+	if foundi && !foundj {
+		return true
+	}
+	if !foundi && foundj {
+		return false
+	}
+	return i.String() < j.String()
 }
diff --git a/pkg/resmap/idslice_test.go b/pkg/resmap/idslice_test.go
index b60b92772..be709a06f 100644
--- a/pkg/resmap/idslice_test.go
+++ b/pkg/resmap/idslice_test.go
@@ -31,10 +31,18 @@ func TestLess(t *testing.T) {
 		resource.NewResId(schema.GroupVersionKind{Kind: "Pod"}, "pod"),
 		resource.NewResId(schema.GroupVersionKind{Kind: "Namespace"}, "ns1"),
 		resource.NewResId(schema.GroupVersionKind{Kind: "Namespace"}, "ns2"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "Role"}, "ro"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "RoleBinding"}, "rb"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "CustomResourceDefinition"}, "crd"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "ServiceAccount"}, "sa"),
 	}
 	expected := IdSlice{
 		resource.NewResId(schema.GroupVersionKind{Kind: "Namespace"}, "ns1"),
 		resource.NewResId(schema.GroupVersionKind{Kind: "Namespace"}, "ns2"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "CustomResourceDefinition"}, "crd"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "ServiceAccount"}, "sa"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "Role"}, "ro"),
+		resource.NewResId(schema.GroupVersionKind{Kind: "RoleBinding"}, "rb"),
 		resource.NewResId(schema.GroupVersionKind{Kind: "ConfigMap"}, "cm"),
 		resource.NewResId(schema.GroupVersionKind{Kind: "Pod"}, "pod"),
 	}