Remove target package from exposed API.

api/internal/target/accumulation_test.go

@@ -0,0 +1,60 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/internal/target"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestTargetMustHaveKustomizationFile(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteF("/app/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: aService
+`)
+	th.WriteF("/app/deeper/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: anotherService
+`)
+	_, err := th.MakeKustTargetOrErr()
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+	if !IsMissingKustomizationFileError(err) {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}
+
+func TestResourceDirectoryMustHaveKustomizationFile(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+resources:
+- base
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+spec:
+  selector:
+    backend: bungie
+  ports:
+    - port: 7002
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+	if !IsMissingKustomizationFileError(err) {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}

api/internal/target/baseandoverlaymedium_test.go

@@ -0,0 +1,313 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func writeMediumBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+namePrefix: baseprefix-
+commonLabels:
+  foo: bar
+commonAnnotations:
+  baseAnno: This is a base annotation
+resources:
+- deployment/deployment.yaml
+- service/service.yaml
+`)
+	th.WriteF("/app/base/service/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: mungebot-service
+  labels:
+    app: mungebot
+spec:
+  ports:
+    - port: 7002
+  selector:
+    app: mungebot
+`)
+	th.WriteF("/app/base/deployment/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mungebot
+  labels:
+    app: mungebot
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: mungebot
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+        env:
+        - name: foo
+          value: bar
+        ports:
+        - containerPort: 80
+`)
+}
+
+func TestMediumBase(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	writeMediumBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      foo: bar
+  template:
+    metadata:
+      annotations:
+        baseAnno: This is a base annotation
+      labels:
+        app: mungebot
+        foo: bar
+    spec:
+      containers:
+      - env:
+        - name: foo
+          value: bar
+        image: nginx
+        name: nginx
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot-service
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: mungebot
+    foo: bar
+`)
+}
+
+func TestMediumOverlay(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	writeMediumBase(th)
+	th.WriteK("/app/overlay", `
+namePrefix: test-infra-
+commonLabels:
+  app: mungebot
+  org: kubernetes
+  repo: test-infra
+commonAnnotations:
+  note: This is a test annotation
+resources:
+- ../base
+patchesStrategicMerge:
+- deployment/deployment.yaml
+configMapGenerator:
+- name: app-env
+  envs:
+  - configmap/db.env
+  - configmap/units.ini
+  - configmap/food.ini
+- name: app-config
+  files:
+  - nonsense=configmap/dummy.txt
+images:
+- name: nginx
+  newTag: 1.8.0`)
+
+	th.WriteF("/app/overlay/configmap/db.env", `
+DB_USERNAME=admin
+DB_PASSWORD=somepw
+`)
+	th.WriteF("/app/overlay/configmap/units.ini", `
+LENGTH=kilometer
+ENERGY=electronvolt
+`)
+	th.WriteF("/app/overlay/configmap/food.ini", `
+FRUIT=banana
+LEGUME=chickpea
+`)
+	th.WriteF("/app/overlay/configmap/dummy.txt",
+		`Lorem ipsum dolor sit amet, consectetur
+adipiscing elit, sed do eiusmod tempor
+incididunt ut labore et dolore magna aliqua. 
+`)
+	th.WriteF("/app/overlay/deployment/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mungebot
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.7.9
+        env:
+        - name: FOO
+          valueFrom:
+            configMapKeyRef:
+              name: app-env
+              key: somekey
+      - name: busybox
+        image: busybox
+        envFrom:
+        - configMapRef:
+            name: someConfigMap
+        - configMapRef:
+            name: app-env
+        volumeMounts:
+        - mountPath: /tmp/env
+          name: app-env
+      volumes:
+      - configMap:
+          name: app-env
+        name: app-env
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+    note: This is a test annotation
+  labels:
+    app: mungebot
+    foo: bar
+    org: kubernetes
+    repo: test-infra
+  name: test-infra-baseprefix-mungebot
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mungebot
+      foo: bar
+      org: kubernetes
+      repo: test-infra
+  template:
+    metadata:
+      annotations:
+        baseAnno: This is a base annotation
+        note: This is a test annotation
+      labels:
+        app: mungebot
+        foo: bar
+        org: kubernetes
+        repo: test-infra
+    spec:
+      containers:
+      - env:
+        - name: FOO
+          valueFrom:
+            configMapKeyRef:
+              key: somekey
+              name: test-infra-app-env-ffmd9b969m
+        - name: foo
+          value: bar
+        image: nginx:1.8.0
+        name: nginx
+        ports:
+        - containerPort: 80
+      - envFrom:
+        - configMapRef:
+            name: someConfigMap
+        - configMapRef:
+            name: test-infra-app-env-ffmd9b969m
+        image: busybox
+        name: busybox
+        volumeMounts:
+        - mountPath: /tmp/env
+          name: app-env
+      volumes:
+      - configMap:
+          name: test-infra-app-env-ffmd9b969m
+        name: app-env
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+    note: This is a test annotation
+  labels:
+    app: mungebot
+    foo: bar
+    org: kubernetes
+    repo: test-infra
+  name: test-infra-baseprefix-mungebot-service
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: mungebot
+    foo: bar
+    org: kubernetes
+    repo: test-infra
+---
+apiVersion: v1
+data:
+  DB_PASSWORD: somepw
+  DB_USERNAME: admin
+  ENERGY: electronvolt
+  FRUIT: banana
+  LEGUME: chickpea
+  LENGTH: kilometer
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mungebot
+    org: kubernetes
+    repo: test-infra
+  name: test-infra-app-env-ffmd9b969m
+---
+apiVersion: v1
+data:
+  nonsense: "Lorem ipsum dolor sit amet, consectetur\nadipiscing elit, sed do eiusmod
+    tempor\nincididunt ut labore et dolore magna aliqua. \n"
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mungebot
+    org: kubernetes
+    repo: test-infra
+  name: test-infra-app-config-f462h769f9
+`)
+}

api/internal/target/baseandoverlaysmall_test.go

@@ -0,0 +1,456 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/loader"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestOrderPreserved(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	th.WriteK("/app/base", `
+namePrefix: b-
+resources:
+- namespace.yaml
+- role.yaml
+- service.yaml
+- deployment.yaml
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+`)
+	th.WriteF("/app/base/namespace.yaml", `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: myNs
+`)
+	th.WriteF("/app/base/role.yaml", `
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: myDep
+`)
+	th.WriteK("/app/prod", `
+namePrefix: p-
+resources:
+- ../base
+- service.yaml
+- namespace.yaml
+`)
+	th.WriteF("/app/prod/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService2
+`)
+	th.WriteF("/app/prod/namespace.yaml", `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: myNs2
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: p-b-myNs
+---
+apiVersion: v1
+kind: Role
+metadata:
+  name: p-b-myRole
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: p-b-myService
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: p-b-myDep
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: p-myService2
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: p-myNs2
+`)
+}
+
+func TestBaseInResourceList(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	th.WriteK("/app/prod", `
+namePrefix: b-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+namePrefix: a-
+resources:
+- service.yaml
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+spec:
+  selector:
+    backend: bungie
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Service
+metadata:
+  name: b-a-myService
+spec:
+  selector:
+    backend: bungie
+`)
+}
+
+func writeSmallBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+namePrefix: a-
+commonLabels:
+  app: myApp
+resources:
+- deployment.yaml
+- service.yaml
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+spec:
+  selector:
+    backend: bungie
+  ports:
+    - port: 7002
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - name: whatever
+        image: whatever
+`)
+}
+
+func TestSmallBase(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	writeSmallBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: myApp
+  name: a-myDeployment
+spec:
+  selector:
+    matchLabels:
+      app: myApp
+  template:
+    metadata:
+      labels:
+        app: myApp
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: myApp
+  name: a-myService
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: myApp
+    backend: bungie
+`)
+}
+
+func TestSmallOverlay(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	writeSmallBase(th)
+	th.WriteK("/app/overlay", `
+namePrefix: b-
+commonLabels:
+  env: prod
+resources:
+- ../base
+patchesStrategicMerge:
+- deployment/deployment.yaml
+images:
+- name: whatever
+  newTag: 1.8.0
+`)
+
+	th.WriteF("/app/overlay/configmap/app.env", `
+DB_USERNAME=admin
+DB_PASSWORD=somepw
+`)
+	th.WriteF("/app/overlay/configmap/app-init.ini", `
+FOO=bar
+BAR=baz
+`)
+	th.WriteF("/app/overlay/deployment/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 1000
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: myApp
+    env: prod
+  name: b-a-myDeployment
+spec:
+  replicas: 1000
+  selector:
+    matchLabels:
+      app: myApp
+      env: prod
+  template:
+    metadata:
+      labels:
+        app: myApp
+        backend: awesome
+        env: prod
+    spec:
+      containers:
+      - image: whatever:1.8.0
+        name: whatever
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: myApp
+    env: prod
+  name: b-a-myService
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: myApp
+    backend: bungie
+    env: prod
+`)
+}
+
+func TestSharedPatchDisAllowed(t *testing.T) {
+	th := kusttest_test.NewKustTestHarnessFull(
+		t, "/app/overlay",
+		loader.RestrictionRootOnly, konfig.DisabledPluginConfig())
+	writeSmallBase(th)
+	th.WriteK("/app/overlay", `
+commonLabels:
+  env: prod
+resources:
+- ../base
+patchesStrategicMerge:
+- ../shared/deployment-patch.yaml
+`)
+	th.WriteF("/app/shared/deployment-patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 1000
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"security; file '/app/shared/deployment-patch.yaml' is not in or below '/app/overlay'") {
+		t.Fatalf("unexpected error: %s", err)
+	}
+}
+
+func TestSharedPatchAllowed(t *testing.T) {
+	th := kusttest_test.NewKustTestHarnessFull(
+		t, "/app/overlay",
+		loader.RestrictionNone, konfig.DisabledPluginConfig())
+	writeSmallBase(th)
+	th.WriteK("/app/overlay", `
+commonLabels:
+  env: prod
+resources:
+- ../base
+patchesStrategicMerge:
+- ../shared/deployment-patch.yaml
+`)
+	th.WriteF("/app/shared/deployment-patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 1000
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: myApp
+    env: prod
+  name: a-myDeployment
+spec:
+  replicas: 1000
+  selector:
+    matchLabels:
+      app: myApp
+      env: prod
+  template:
+    metadata:
+      labels:
+        app: myApp
+        backend: awesome
+        env: prod
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: myApp
+    env: prod
+  name: a-myService
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: myApp
+    backend: bungie
+    env: prod
+`)
+}
+
+func TestSmallOverlayJSONPatch(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	writeSmallBase(th)
+	th.WriteK("/app/overlay", `
+resources:
+- ../base
+patchesJson6902:
+- target:
+    version: v1
+    kind: Service
+    name: a-myService
+  path: service-patch.yaml
+`)
+
+	th.WriteF("/app/overlay/service-patch.yaml", `
+- op: add
+  path: /spec/selector/backend
+  value: beagle
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: myApp
+  name: a-myDeployment
+spec:
+  selector:
+    matchLabels:
+      app: myApp
+  template:
+    metadata:
+      labels:
+        app: myApp
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: myApp
+  name: a-myService
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: myApp
+    backend: beagle
+`)
+}

api/internal/target/basereusenameprefix_test.go

@@ -0,0 +1,199 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Here is a structure of a kustomization of two components, component1
+// and component2, that both use a shared postgres definition, which
+// they would individually adjust. This test case checks that the name
+// prefix does not cause a name reference conflict.
+//
+//                   root
+//              /            \
+//  component1/overlay  component2/overlay
+//             |              |
+//    component1/base    component2/base
+//              \            /
+//                   base
+//
+// This is the directory layout:
+//
+// ├── component1
+// │   ├── base
+// │   │   └── kustomization.yaml
+// │   └── overlay
+// │       └── kustomization.yaml
+// ├── component2
+// │   ├── base
+// │   │   └── kustomization.yaml
+// │   └── overlay
+// │       └── kustomization.yaml
+// ├── shared
+// │   ├── kustomization.yaml
+// │   └── resources.yaml
+// ├── kustomization.yaml
+
+func TestBaseReuseNameConflict(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app/component1/base", `
+resources:
+  - ../../shared
+
+namePrefix: component1-
+`)
+	th.WriteK("/app/component1/overlay", `
+resources:
+  - ../base
+
+namePrefix: overlay-
+`)
+
+	th.WriteK("/app/component2/base", `
+resources:
+  - ../../shared
+
+namePrefix: component2-
+`)
+	th.WriteK("/app/component2/overlay", `
+resources:
+  - ../base
+
+namePrefix: overlay-
+`)
+
+	th.WriteK("/app/shared", `
+resources:
+  - resources.yaml
+`)
+	th.WriteF("/app/shared/resources.yaml", `
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: postgres
+spec:
+  resources:
+    requests:
+      storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+spec:
+  selector:
+    matchLabels: {}
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+        - name: postgres
+          image: postgres
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - mountPath: /var/lib/postgresql
+              name: data
+          ports:
+            - name: postgres
+              containerPort: 5432
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: postgres
+`)
+
+	th.WriteK("/app", `
+resources:
+  - component1/overlay
+  - component2/overlay
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: overlay-component1-postgres
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: overlay-component1-postgres
+spec:
+  selector:
+    matchLabels: {}
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+      - image: postgres
+        imagePullPolicy: IfNotPresent
+        name: postgres
+        ports:
+        - containerPort: 5432
+          name: postgres
+        volumeMounts:
+        - mountPath: /var/lib/postgresql
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: overlay-component1-postgres
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: overlay-component2-postgres
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: overlay-component2-postgres
+spec:
+  selector:
+    matchLabels: {}
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+      - image: postgres
+        imagePullPolicy: IfNotPresent
+        name: postgres
+        ports:
+        - containerPort: 5432
+          name: postgres
+        volumeMounts:
+        - mountPath: /var/lib/postgresql
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: overlay-component2-postgres
+`)
+}

api/internal/target/chartinflatorplugin_test.go

@@ -0,0 +1,111 @@
+// +build notravis
+
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Disabled on travis, because don't want to install helm on travis.
+
+package target_test
+
+import (
+	"regexp"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// This is an example of using a helm chart as a base,
+// inflating it and then customizing it with a nameprefix
+// applied to all its resources.
+//
+// The helm chart used is downloaded from
+//   https://github.com/helm/charts/tree/master/stable/minecraft
+// with each test run, so it's a bit brittle as that
+// chart could change obviously and break the test.
+//
+// This test requires having the helm binary on the PATH.
+//
+// TODO: Download and inflate the chart, and check that
+// in for the test.
+func TestChartInflatorPlugin(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildExecPlugin(
+		"someteam.example.com", "v1", "ChartInflator")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app")
+	th.WriteK("/app", `
+generators:
+- chartInflator.yaml
+namePrefix: LOOOOOOOONG-
+`)
+
+	th.WriteF("/app/chartInflator.yaml", `
+apiVersion: someteam.example.com/v1
+kind: ChartInflator
+metadata:
+  name: notImportantHere
+chartName: minecraft
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	chartName := regexp.MustCompile("chart: minecraft-[0-9.]+")
+	th.AssertActualEqualsExpectedWithTweak(m,
+		func(x []byte) []byte {
+			return chartName.ReplaceAll(x, []byte("chart: minecraft-SOMEVERSION"))
+		}, `
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: release-name-minecraft
+    chart: minecraft-SOMEVERSION
+    heritage: Tiller
+    release: release-name
+  name: LOOOOOOOONG-release-name-minecraft
+type: Opaque
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    volume.alpha.kubernetes.io/storage-class: default
+  labels:
+    app: release-name-minecraft
+    chart: minecraft-SOMEVERSION
+    heritage: Tiller
+    release: release-name
+  name: LOOOOOOOONG-release-name-minecraft-datadir
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: release-name-minecraft
+    chart: minecraft-SOMEVERSION
+    heritage: Tiller
+    release: release-name
+  name: LOOOOOOOONG-release-name-minecraft
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: release-name-minecraft
+  type: LoadBalancer
+`)
+}

api/internal/target/complexcomposition_test.go

@@ -0,0 +1,557 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+const httpsService = `
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-https-svc
+spec:
+  ports:
+  - port: 443
+    protocol: TCP
+    name: https
+  selector:
+    app: my-app
+`
+
+func writeStatefulSetBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- statefulset.yaml
+`)
+	th.WriteF("/app/base/statefulset.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  serviceName: my-svc
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: app
+        image: my-image
+  volumeClaimTemplates:
+  - spec:
+      storageClassName: default
+`)
+}
+
+func writeHTTPSOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/https", `
+resources:
+- ../base
+- https-svc.yaml
+patchesStrategicMerge:
+- sts-patch.yaml
+`)
+	th.WriteF("/app/https/https-svc.yaml", httpsService)
+	th.WriteF("/app/https/sts-patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  serviceName: my-https-svc
+`)
+}
+
+func writeHTTPSTransformerRaw(th *kusttest_test.KustTestHarness) {
+	th.WriteF("/app/https/service/https-svc.yaml", httpsService)
+	th.WriteF("/app/https/transformer/transformer.yaml", `
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: svcNameTran
+target: 
+  group: apps
+  version: v1
+  kind: StatefulSet
+  name: my-sts
+patch: |-
+  apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    name: my-sts
+  spec:
+    serviceName: my-https-svc
+`)
+}
+
+func writeHTTPSTransformerBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/https/service", `
+resources:
+- https-svc.yaml
+`)
+	th.WriteK("/app/https/transformer", `
+resources:
+- transformer.yaml
+`)
+	writeHTTPSTransformerRaw(th)
+}
+
+func writeConfigFromEnvOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/config", `
+resources:
+- ../base
+configMapGenerator:
+- name: my-config
+  literals:
+  - MY_ENV=foo
+generatorOptions:
+  disableNameSuffixHash: true
+patchesStrategicMerge:
+- sts-patch.yaml
+`)
+	th.WriteF("/app/config/sts-patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        envFrom:
+        - configMapRef:
+            name: my-config
+`)
+}
+
+func writeConfigFromEnvTransformerRaw(th *kusttest_test.KustTestHarness) {
+	th.WriteF("/app/config/map/generator.yaml", `
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: my-config
+disableNameSuffixHash: true
+literals:
+- MY_ENV=foo
+`)
+	th.WriteF("/app/config/transformer/transformer.yaml", `
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: envFromConfigTrans
+target: 
+  group: apps
+  version: v1
+  kind: StatefulSet
+  name: my-sts
+patch: |-
+  apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    name: my-sts
+  spec:
+    template:
+      spec:
+        containers:
+        - name: app
+          envFrom:
+          - configMapRef:
+              name: my-config
+`)
+}
+func writeConfigFromEnvTransformerBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/config/map", `
+resources:
+- generator.yaml
+`)
+	th.WriteK("/app/config/transformer", `
+resources:
+- transformer.yaml
+`)
+	writeConfigFromEnvTransformerRaw(th)
+}
+
+func writeTolerationsOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/tolerations", `
+resources:
+- ../base
+patchesStrategicMerge:
+- sts-patch.yaml
+`)
+	th.WriteF("/app/tolerations/sts-patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  template:
+    spec:
+      tolerations:
+      - effect: NoExecute
+        key: node.kubernetes.io/not-ready
+        tolerationSeconds: 30
+`)
+}
+
+func writeTolerationsTransformerRaw(th *kusttest_test.KustTestHarness) {
+	th.WriteF("/app/tolerations/transformer.yaml", `
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: tolTrans
+target: 
+  group: apps
+  version: v1
+  kind: StatefulSet
+  name: my-sts
+patch: |-
+  apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    name: my-sts
+  spec:
+    template:
+      spec:
+        tolerations:
+        - effect: NoExecute
+          key: node.kubernetes.io/not-ready
+          tolerationSeconds: 30
+`)
+}
+
+func writeTolerationsTransformerBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/tolerations", `
+resources:
+- transformer.yaml
+`)
+	writeTolerationsTransformerRaw(th)
+}
+
+func writeStorageOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/storage", `
+resources:
+- ../base
+patchesJson6902:
+- target:
+    group: apps
+    version: v1
+    kind: StatefulSet
+    name: my-sts
+  path: sts-patch.json
+`)
+	th.WriteF("/app/storage/sts-patch.json", `
+[{"op": "replace", "path": "/spec/volumeClaimTemplates/0/spec/storageClassName", "value": "my-sc"}]
+`)
+}
+
+func writeStorageTransformerRaw(th *kusttest_test.KustTestHarness) {
+	th.WriteF("/app/storage/transformer.yaml", `
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: storageTrans
+target: 
+  group: apps
+  version: v1
+  kind: StatefulSet
+  name: my-sts
+patch: |-
+  [{"op": "replace", "path": "/spec/volumeClaimTemplates/0/spec/storageClassName", "value": "my-sc"}]
+`)
+}
+
+func writeStorageTransformerBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/storage", `
+resources:
+- transformer.yaml
+`)
+	writeStorageTransformerRaw(th)
+}
+
+func writePatchingOverlays(th *kusttest_test.KustTestHarness) {
+	writeStorageOverlay(th)
+	writeConfigFromEnvOverlay(th)
+	writeTolerationsOverlay(th)
+	writeHTTPSOverlay(th)
+}
+
+func writePatchingTransformersRaw(th *kusttest_test.KustTestHarness) {
+	writeStorageTransformerRaw(th)
+	writeConfigFromEnvTransformerRaw(th)
+	writeTolerationsTransformerRaw(th)
+	writeHTTPSTransformerRaw(th)
+}
+
+// Similar to writePatchingTransformersRaw, except here the
+// transformers and related artifacts are addressable as _bases_.
+// They are listed in a kustomization file, and consumers of
+// the plugin refer to the kustomization instead of to the local
+// file in the "transformers:" field.
+//
+// Using bases makes the set of files relocatable with
+// respect to the overlays, and avoids the need to relax load
+// restrictions on file paths reaching outside the `dev` and
+// `prod` kustomization roots.  I.e. with bases tests can use
+// NewKustTestHarness instead of NewKustTestHarnessNoLoadRestrictor.
+//
+// Using transformer plugins from _bases_ means the plugin config
+// must be self-contained, i.e. the config may not have fields that
+// refer to local files, since those files won't be present when
+// the plugin is instantiated and used.
+func writePatchingTransformerBases(th *kusttest_test.KustTestHarness) {
+	writeStorageTransformerBase(th)
+	writeConfigFromEnvTransformerBase(th)
+	writeTolerationsTransformerBase(th)
+	writeHTTPSTransformerBase(th)
+}
+
+// Here's a complex kustomization scenario that combines multiple overlays
+// on a common base:
+//
+//                 dev                       prod
+//                  |                         |
+//                  |                         |
+//        + ------- +          + ------------ + ------------- +
+//        |         |          |              |               |
+//        |         |          |              |               |
+//        v         |          v              v               v
+//     storage      + -----> config       tolerations       https
+//        |                    |              |               |
+//        |                    |              |               |
+//        |                    + --- +  + --- +               |
+//        |                          |  |                     |
+//        |                          v  v                     |
+//        + -----------------------> base <------------------ +
+//
+// The base resource is a statefulset. Each intermediate overlay manages or
+// generates new resources and patches different aspects of the same base
+// resource, without using any of the `namePrefix`, `nameSuffix` or `namespace`
+// kustomization keywords.
+//
+// Intermediate overlays:
+//   - storage: Changes the storage class of the stateful set with a JSON patch.
+//   - config: Generates a config map and adds a field as an environment
+//             variable.
+//   - tolerations: Adds a new tolerations field in the spec.
+//   - https: Adds a new service resource and changes the service name in the
+//            stateful set.
+//
+// Top overlays:
+//   - dev: Combines the storage and config intermediate overlays.
+//   - prod: Combines the config, tolerations and https intermediate overlays.
+
+func TestComplexComposition_Dev_Failure(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/dev")
+	writeStatefulSetBase(th)
+	writePatchingOverlays(th)
+	th.WriteK("/app/dev", `
+resources:
+- ../storage
+- ../config
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("Expected resource accumulation error")
+	}
+	if !strings.Contains(
+		err.Error(), "already registered id: apps_v1_StatefulSet|~X|my-sts") {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+}
+
+const devDesiredResult = `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  serviceName: my-svc
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: my-config
+        image: my-image
+        name: app
+  volumeClaimTemplates:
+  - spec:
+      storageClassName: my-sc
+---
+apiVersion: v1
+data:
+  MY_ENV: foo
+kind: ConfigMap
+metadata:
+  name: my-config
+`
+
+func TestComplexComposition_Dev_SuccessWithRawTransformers(t *testing.T) {
+	th := kusttest_test.NewKustTestHarnessNoLoadRestrictor(t, "/app/dev")
+	writeStatefulSetBase(th)
+	writePatchingTransformersRaw(th)
+	th.WriteK("/app/dev", `
+resources:
+- ../base
+generators:
+- ../config/map/generator.yaml
+transformers:
+- ../config/transformer/transformer.yaml
+- ../storage/transformer.yaml
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, devDesiredResult)
+}
+
+func TestComplexComposition_Dev_SuccessWithBaseTransformers(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/dev")
+	writeStatefulSetBase(th)
+	writePatchingTransformerBases(th)
+	th.WriteK("/app/dev", `
+resources:
+- ../base
+generators:
+- ../config/map
+transformers:
+- ../config/transformer
+- ../storage
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, devDesiredResult)
+}
+
+func TestComplexComposition_Prod_Failure(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	writeStatefulSetBase(th)
+	writePatchingOverlays(th)
+	th.WriteK("/app/prod", `
+resources:
+- ../config
+- ../tolerations
+- ../https
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("Expected resource accumulation error")
+	}
+	if !strings.Contains(
+		err.Error(), "already registered id: apps_v1_StatefulSet|~X|my-sts") {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+}
+
+const prodDesiredResult = `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-sts
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  serviceName: my-https-svc
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: my-config
+        image: my-image
+        name: app
+      tolerations:
+      - effect: NoExecute
+        key: node.kubernetes.io/not-ready
+        tolerationSeconds: 30
+  volumeClaimTemplates:
+  - spec:
+      storageClassName: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-https-svc
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+  selector:
+    app: my-app
+---
+apiVersion: v1
+data:
+  MY_ENV: foo
+kind: ConfigMap
+metadata:
+  name: my-config
+`
+
+func TestComplexComposition_Prod_SuccessWithRawTransformers(t *testing.T) {
+	th := kusttest_test.NewKustTestHarnessNoLoadRestrictor(t, "/app/prod")
+	writeStatefulSetBase(th)
+	writePatchingTransformersRaw(th)
+	th.WriteK("/app/prod", `
+resources:
+- ../base
+- ../https/service/https-svc.yaml
+generators:
+- ../config/map/generator.yaml
+transformers:
+- ../config/transformer/transformer.yaml
+- ../https/transformer/transformer.yaml
+- ../tolerations/transformer.yaml
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDesiredResult)
+}
+
+func TestComplexComposition_Prod_SuccessWithBaseTransformers(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	writeStatefulSetBase(th)
+	writePatchingTransformerBases(th)
+	th.WriteK("/app/prod", `
+resources:
+- ../base
+- ../https/service
+generators:
+- ../config/map
+transformers:
+- ../config/transformer
+- ../https/transformer
+- ../tolerations
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDesiredResult)
+}

api/internal/target/configmaps_test.go

@@ -0,0 +1,313 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Generate a Secret and a ConfigMap from the same data
+// to compare the result.
+func TestGeneratorBasics(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  literals:
+  - fruit=apple
+  - vegetable=broccoli
+  envs:
+  - foo.env
+  files:
+  - passphrase=phrase.dat
+  - forces.txt
+- name: json
+  literals:
+  - 'v2=[{"path": "var/druid/segment-cache"}]'
+  - >- 
+    druid_segmentCache_locations=[{"path": 
+    "var/druid/segment-cache", 
+    "maxSize": 32000000000, 
+    "freeSpacePercent": 1.0}]
+secretGenerator:
+- name: bob
+  literals:
+  - fruit=apple
+  - vegetable=broccoli
+  envs:
+  - foo.env
+  files:
+  - passphrase=phrase.dat
+  - forces.txt
+`)
+	th.WriteF("/app/foo.env", `
+MOUNTAIN=everest
+OCEAN=pacific
+`)
+	th.WriteF("/app/phrase.dat", `
+Life is short.
+But the years are long.
+Not while the evil days come not.
+`)
+	th.WriteF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  MOUNTAIN: everest
+  OCEAN: pacific
+  forces.txt: |2
+
+    gravitational
+    electromagnetic
+    strong nuclear
+    weak nuclear
+  fruit: apple
+  passphrase: |2
+
+    Life is short.
+    But the years are long.
+    Not while the evil days come not.
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-k772g5db55
+---
+apiVersion: v1
+data:
+  druid_segmentCache_locations: '[{"path":  "var/druid/segment-cache",  "maxSize":
+    32000000000,  "freeSpacePercent": 1.0}]'
+  v2: '[{"path": "var/druid/segment-cache"}]'
+kind: ConfigMap
+metadata:
+  name: blah-json-9gtcc2fgb4
+---
+apiVersion: v1
+data:
+  MOUNTAIN: ZXZlcmVzdA==
+  OCEAN: cGFjaWZpYw==
+  forces.txt: CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbnVjbGVhcgo=
+  fruit: YXBwbGU=
+  passphrase: CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aGUgZXZpbCBkYXlzIGNvbWUgbm90Lgo=
+  vegetable: YnJvY2NvbGk=
+kind: Secret
+metadata:
+  name: blah-bob-gmc2824f4b
+type: Opaque
+`)
+}
+
+// TODO: These should be errors instead.
+func TestGeneratorRepeatsInKustomization(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  behavior: create
+  literals:
+  - bean=pinto
+  - star=wolf-rayet
+  literals:
+  - fruit=apple
+  - vegetable=broccoli
+  files:
+  - forces.txt
+  files:
+  - nobles=nobility.txt
+`)
+	th.WriteF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	th.WriteF("/app/nobility.txt", `
+helium
+neon
+argon
+krypton
+xenon
+radon
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  fruit: apple
+  nobles: |2
+
+    helium
+    neon
+    argon
+    krypton
+    xenon
+    radon
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-gfkcbk5ckf
+`)
+}
+
+func TestGeneratorOverlays(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	th.WriteK("/app/base1", `
+namePrefix: p1-
+configMapGenerator:
+- name: com1
+  behavior: create
+  literals:
+  - from=base
+`)
+	th.WriteK("/app/base2", `
+namePrefix: p2-
+configMapGenerator:
+- name: com2
+  behavior: create
+  literals:
+  - from=base
+`)
+	th.WriteK("/app/overlay/o1", `
+resources:
+- ../../base1
+configMapGenerator:
+- name: com1
+  behavior: merge
+  literals:
+  - from=overlay
+`)
+	th.WriteK("/app/overlay/o2", `
+resources:
+- ../../base2
+configMapGenerator:
+- name: com2
+  behavior: merge
+  literals:
+  - from=overlay
+`)
+	th.WriteK("/app/overlay", `
+resources:
+- o1
+- o2
+configMapGenerator:
+- name: com1
+  behavior: merge
+  literals:
+  - foo=bar
+  - baz=qux
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  baz: qux
+  foo: bar
+  from: overlay
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels: {}
+  name: p1-com1-dhbbm922gd
+---
+apiVersion: v1
+data:
+  from: overlay
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels: {}
+  name: p2-com2-c4b8md75k9
+`)
+}
+
+func TestConfigMapGeneratorMergeNamePrefix(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app/base", `
+configMapGenerator:
+- name: cm
+  behavior: create
+  literals:
+  - foo=bar
+`)
+	th.WriteK("/app/o1", `
+resources:
+- ../base
+namePrefix: o1-
+`)
+	th.WriteK("/app/o2", `
+resources:
+- ../base
+nameSuffix: -o2
+`)
+	th.WriteK("/app", `
+resources:
+- o1
+- o2
+configMapGenerator:
+- name: o1-cm
+  behavior: merge
+  literals:
+  - big=bang
+- name: cm-o2
+  behavior: merge
+  literals:
+  - big=crunch
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  big: bang
+  foo: bar
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels: {}
+  name: o1-cm-28g596k77k
+---
+apiVersion: v1
+data:
+  big: crunch
+  foo: bar
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels: {}
+  name: cm-o2-gfcc59fg5m
+`)
+}

api/internal/target/crd_test.go

@@ -0,0 +1,384 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func writeBaseWithCrd(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+crds:
+- mycrd.json
+
+resources:
+- secret.yaml
+- mykind.yaml
+- bee.yaml
+
+namePrefix: x-
+`)
+	th.WriteF("/app/base/bee.yaml", `
+apiVersion: v1beta1
+kind: Bee
+metadata:
+  name: bee
+spec:
+  action: fly
+`)
+	th.WriteF("/app/base/mykind.yaml", `
+apiVersion: jingfang.example.com/v1beta1
+kind: MyKind
+metadata:
+  name: mykind
+spec:
+  secretRef:
+    name: crdsecret
+  beeRef:
+    name: bee
+`)
+	th.WriteF("/app/base/secret.yaml", `
+apiVersion: v1
+kind: Secret
+metadata:
+  name: crdsecret
+data:
+  PATH: yellowBrickRoad
+`)
+	th.WriteF("/app/base/mycrd.json", `
+{
+  "github.com/example/pkg/apis/jingfang/v1beta1.Bee": {
+    "Schema": {
+      "description": "Bee",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents.",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+        },
+        "spec": {
+          "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec"
+        },
+        "status": {
+          "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus"
+        }
+      }
+    },
+    "Dependencies": [
+      "github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec",
+      "github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus",
+      "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+    ]
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.BeeList": {
+    "Schema": {
+      "required": [
+        "items"
+      ],
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object.",
+          "type": "string"
+        },
+        "items": {
+          "type": "array",
+          "items": {
+            "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.Bee"
+          }
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents.",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"
+        }
+      }
+    },
+    "Dependencies": [
+      "github.com/example/pkg/apis/jingfang/v1beta1.Bee",
+      "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"
+    ]
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.BeeObjectReference": {
+    "Schema": {
+      "properties": {
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "Dependencies": []
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec": {
+    "Schema": {
+      "description": "BeeSpec defines the desired state of Bee"
+    },
+    "Dependencies": []
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus": {
+    "Schema": {
+      "description": "BeeStatus defines the observed state of Bee"
+    },
+    "Dependencies": []
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.MyKind": {
+    "Schema": {
+      "description": "MyKind",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents.",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+        },
+        "spec": {
+          "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec"
+        },
+        "status": {
+          "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus"
+        }
+      }
+    },
+    "Dependencies": [
+      "github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec",
+      "github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus",
+      "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+    ]
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.MyKindList": {
+    "Schema": {
+      "required": [
+        "items"
+      ],
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object.",
+          "type": "string"
+        },
+        "items": {
+          "type": "array",
+          "items": {
+            "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.MyKind"
+          }
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents.",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"
+        }
+      }
+    },
+    "Dependencies": [
+      "github.com/example/pkg/apis/jingfang/v1beta1.MyKind",
+      "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"
+    ]
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec": {
+    "Schema": {
+      "description": "MyKindSpec defines the desired state of MyKind",
+      "properties": {
+        "beeRef": {
+          "x-kubernetes-object-ref-api-version": "v1beta1",
+          "x-kubernetes-object-ref-kind": "Bee",
+          "$ref": "github.com/example/pkg/apis/jingfang/v1beta1.BeeObjectReference"
+        },
+        "secretRef": {
+          "description": "If defined, use this secret for configuring the MYSQL_ROOT_PASSWORD",
+          "x-kubernetes-object-ref-api-version": "v1",
+          "x-kubernetes-object-ref-kind": "Secret",
+          "$ref": "k8s.io/api/core/v1.LocalObjectReference"
+        }
+      }
+    },
+    "Dependencies": [
+      "github.com/example/pkg/apis/jingfang/v1beta1.BeeObjectReference",
+      "k8s.io/api/core/v1.LocalObjectReference"
+    ]
+  },
+  "github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus": {
+    "Schema": {
+      "description": "MyKindStatus defines the observed state of MyKind"
+    },
+    "Dependencies": []
+  }
+}
+`)
+}
+
+func TestCrdBase(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	writeBaseWithCrd(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  PATH: yellowBrickRoad
+kind: Secret
+metadata:
+  name: x-crdsecret
+---
+apiVersion: jingfang.example.com/v1beta1
+kind: MyKind
+metadata:
+  name: x-mykind
+spec:
+  beeRef:
+    name: x-bee
+  secretRef:
+    name: x-crdsecret
+---
+apiVersion: v1beta1
+kind: Bee
+metadata:
+  name: x-bee
+spec:
+  action: fly
+`)
+}
+
+func TestCrdWithOverlay(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	writeBaseWithCrd(th)
+	th.WriteK("/app/overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: prod-
+resources:
+- ../base
+patchesStrategicMerge:
+- bee.yaml
+`)
+	th.WriteF("/app/overlay/bee.yaml", `
+apiVersion: v1beta1
+kind: Bee
+metadata:
+  name: bee
+spec:
+  action: makehoney
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  PATH: yellowBrickRoad
+kind: Secret
+metadata:
+  name: prod-x-crdsecret
+---
+apiVersion: jingfang.example.com/v1beta1
+kind: MyKind
+metadata:
+  name: prod-x-mykind
+spec:
+  beeRef:
+    name: prod-x-bee
+  secretRef:
+    name: prod-x-crdsecret
+---
+apiVersion: v1beta1
+kind: Bee
+metadata:
+  name: prod-x-bee
+spec:
+  action: makehoney
+`)
+}
+
+func TestCrdWithContainers(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/crd/containers")
+	th.WriteK("/app/crd/containers", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crd.yaml
+images:
+  - name: test/test
+    newName: registry.gitlab.com/test
+    newTag: latest
+`)
+	th.WriteF("/app/crd/containers/crd.yaml", `
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: crontabs.stable.example.com
+spec:
+  group: stable.example.com
+  scope: Namespaced
+  names:
+    plural: crontabs
+    singular: crontab
+    kind: CronTab
+    shortNames:
+    - ct
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          containers:
+            description: Containers allows injecting additional containers
+  `)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: crontabs.stable.example.com
+spec:
+  group: stable.example.com
+  names:
+    kind: CronTab
+    plural: crontabs
+    shortNames:
+    - ct
+    singular: crontab
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          containers:
+            description: Containers allows injecting additional containers
+`)
+}

api/internal/target/customconfig_test.go

@@ -0,0 +1,332 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func makeBaseReferencingCustomConfig(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+namePrefix: x-
+commonLabels:
+  app: myApp
+vars:
+- name: APRIL_DIET
+  objref:
+    kind: Giraffe
+    name: april
+  fieldref:
+    fieldpath: spec.diet
+- name: KOKO_DIET
+  objref:
+    kind: Gorilla
+    name: koko
+  fieldref:
+    fieldpath: spec.diet
+resources:
+- animalPark.yaml
+- giraffes.yaml
+- gorilla.yaml
+configurations:
+- config/defaults.yaml
+- config/custom.yaml
+`)
+	th.WriteF("/app/base/giraffes.yaml", `
+kind: Giraffe
+metadata:
+  name: april
+spec:
+  diet: mimosa
+  location: NE
+---
+kind: Giraffe
+metadata:
+  name: may
+spec:
+  diet: acacia
+  location: SE
+`)
+	th.WriteF("/app/base/gorilla.yaml", `
+kind: Gorilla
+metadata:
+  name: koko
+spec:
+  diet: bambooshoots
+  location: SW
+`)
+	th.WriteF("/app/base/animalPark.yaml", `
+kind: AnimalPark
+metadata:
+  name: sandiego
+spec:
+  gorillaRef:
+    name: koko
+  giraffeRef:
+    name: april
+  food:
+  - "$(APRIL_DIET)"
+  - "$(KOKO_DIET)"
+`)
+}
+
+func TestCustomConfig(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeBaseReferencingCustomConfig(th)
+	th.WriteDefaultConfigs("/app/base/config/defaults.yaml")
+	th.WriteF("/app/base/config/custom.yaml", `
+nameReference:
+- kind: Gorilla
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/gorillaRef/name
+- kind: Giraffe
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/giraffeRef/name
+varReference:
+- path: spec/food
+  kind: AnimalPark
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+kind: AnimalPark
+metadata:
+  labels:
+    app: myApp
+  name: x-sandiego
+spec:
+  food:
+  - mimosa
+  - bambooshoots
+  giraffeRef:
+    name: x-april
+  gorillaRef:
+    name: x-koko
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+  name: x-april
+spec:
+  diet: mimosa
+  location: NE
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+  name: x-may
+spec:
+  diet: acacia
+  location: SE
+---
+kind: Gorilla
+metadata:
+  labels:
+    app: myApp
+  name: x-koko
+spec:
+  diet: bambooshoots
+  location: SW
+`)
+}
+
+func TestCustomConfigWithDefaultOverspecification(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeBaseReferencingCustomConfig(th)
+	th.WriteDefaultConfigs("/app/base/config/defaults.yaml")
+	// Specifying namePrefix here conflicts with (is the same as)
+	// the defaults written above.  This is intentional in the
+	// test to assure duplicate config doesn't cause problems.
+	th.WriteF("/app/base/config/custom.yaml", `
+namePrefix:
+- path: metadata/name
+nameReference:
+- kind: Gorilla
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/gorillaRef/name
+- kind: Giraffe
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/giraffeRef/name
+varReference:
+- path: spec/food
+  kind: AnimalPark
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+kind: AnimalPark
+metadata:
+  labels:
+    app: myApp
+  name: x-sandiego
+spec:
+  food:
+  - mimosa
+  - bambooshoots
+  giraffeRef:
+    name: x-april
+  gorillaRef:
+    name: x-koko
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+  name: x-april
+spec:
+  diet: mimosa
+  location: NE
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+  name: x-may
+spec:
+  diet: acacia
+  location: SE
+---
+kind: Gorilla
+metadata:
+  labels:
+    app: myApp
+  name: x-koko
+spec:
+  diet: bambooshoots
+  location: SW
+`)
+}
+
+func TestFixedBug605_BaseCustomizationAvailableInOverlay(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	makeBaseReferencingCustomConfig(th)
+	th.WriteDefaultConfigs("/app/base/config/defaults.yaml")
+	th.WriteF("/app/base/config/custom.yaml", `
+nameReference:
+- kind: Gorilla
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/gorillaRef/name
+- kind: Giraffe
+  fieldSpecs:
+  - kind: AnimalPark
+    path: spec/giraffeRef/name
+varReference:
+- path: spec/food
+  kind: AnimalPark
+`)
+	th.WriteK("/app/overlay", `
+namePrefix: o-
+commonLabels:
+  movie: planetOfTheApes
+patchesStrategicMerge:
+- animalPark.yaml
+resources:
+- ../base
+- ursus.yaml
+`)
+	th.WriteF("/app/overlay/ursus.yaml", `
+kind: Gorilla
+metadata:
+  name: ursus
+spec:
+  diet: heston
+  location: Arizona
+`)
+	// The following replaces the gorillaRef in the AnimalPark.
+	th.WriteF("/app/overlay/animalPark.yaml", `
+kind: AnimalPark
+metadata:
+  name: sandiego
+spec:
+  gorillaRef:
+    name: ursus
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+
+	th.AssertActualEqualsExpected(m, `
+kind: AnimalPark
+metadata:
+  labels:
+    app: myApp
+    movie: planetOfTheApes
+  name: o-x-sandiego
+spec:
+  food:
+  - mimosa
+  - bambooshoots
+  giraffeRef:
+    name: o-x-april
+  gorillaRef:
+    name: o-ursus
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+    movie: planetOfTheApes
+  name: o-x-april
+spec:
+  diet: mimosa
+  location: NE
+---
+kind: Giraffe
+metadata:
+  labels:
+    app: myApp
+    movie: planetOfTheApes
+  name: o-x-may
+spec:
+  diet: acacia
+  location: SE
+---
+kind: Gorilla
+metadata:
+  labels:
+    app: myApp
+    movie: planetOfTheApes
+  name: o-x-koko
+spec:
+  diet: bambooshoots
+  location: SW
+---
+kind: Gorilla
+metadata:
+  labels:
+    movie: planetOfTheApes
+  name: o-ursus
+spec:
+  diet: heston
+  location: Arizona
+`)
+}

api/internal/target/customconfigofbuiltinplugin_test.go

@@ -0,0 +1,216 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Demo custom configuration of a builtin transformation.
+// This is a NamePrefixer that only touches Deployments
+// and Services.
+func TestCustomNamePrefixer(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"builtin", "", "PrefixSuffixTransformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app")
+
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+- role.yaml
+- service.yaml
+transformers:
+- prefixer.yaml
+`)
+	th.WriteF("/app/prefixer.yaml", `
+apiVersion: builtin
+kind: PrefixSuffixTransformer
+metadata:
+  name: customPrefixer
+prefix: zzz-
+fieldSpecs:
+- kind: Deployment
+  path: metadata/name
+- kind: Service
+  path: metadata/name
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - name: whatever
+        image: whatever
+`)
+	th.WriteF("/app/role.yaml", `
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+`)
+	th.WriteF("/app/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zzz-myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+---
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zzz-myService
+`)
+}
+
+// Demo custom configuration as a base.
+func TestReusableCustomNamePrefixer(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"builtin", "", "PrefixSuffixTransformer")
+	tc.BuildGoPlugin(
+		"builtin", "", "LabelTransformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/foo")
+
+	// This kustomization file contains resources that
+	// all happen to be plugin configurations. This makes
+	// these plugins all available as part of a base,
+	// re-usable in any number of other kustomizations.
+	// Just specify the path (or URL) to this base in the
+	// "transformers:" field (not the "resources" field).
+	th.WriteK("/app/mytransformers", `
+resources:
+- prefixer.yaml
+- labeller.yaml
+`)
+	th.WriteF("/app/mytransformers/prefixer.yaml", `
+apiVersion: builtin
+kind: PrefixSuffixTransformer
+metadata:
+  name: myPrefixer
+prefix: zzz-
+fieldSpecs:
+- kind: Deployment
+  path: metadata/name
+- kind: Service
+  path: metadata/name
+`)
+	th.WriteF("/app/mytransformers/labeller.yaml", `
+apiVersion: builtin
+kind: LabelTransformer
+metadata:
+  name: myLabeller
+labels:
+  company: acmeCorp
+fieldSpecs:
+- path: spec/template/metadata/labels
+  kind: Deployment
+`)
+
+	th.WriteK("/app/foo", `
+resources:
+- deployment.yaml
+- role.yaml
+- service.yaml
+transformers:
+- ../mytransformers
+`)
+	th.WriteF("/app/foo/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - name: whatever
+        image: whatever
+`)
+	th.WriteF("/app/foo/role.yaml", `
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+`)
+	th.WriteF("/app/foo/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zzz-myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+        company: acmeCorp
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+---
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zzz-myService
+`)
+}

api/internal/target/diamondcomposition_test.go

@@ -0,0 +1,490 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+const patchAddProbe = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: my-deployment
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+`
+
+const container = `{ "image": "my-image", "livenessProbe": { "httpGet" : {"path": "/healthz", "port": 8080 } }, "name": "my-deployment"}`
+
+const patchJsonAddProbe = `[{"op": "replace", "path": "/spec/template/spec/containers/0", "value": ` +
+	container + `}]`
+
+const patchDnsPolicy = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      dnsPolicy: ClusterFirst
+`
+const patchJsonDnsPolicy = `[{"op": "add", "path": "/spec/template/spec/dnsPolicy", "value": "ClusterFirst"}]`
+
+const patchRestartPolicy = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      restartPolicy: Always
+`
+const patchJsonRestartPolicy = `[{"op": "add", "path": "/spec/template/spec/restartPolicy", "value": "Always"}]`
+
+func writeDeploymentBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      dnsPolicy: "None"
+      containers:
+      - name: my-deployment
+        image: my-image
+`)
+}
+
+func writeProbeOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/probe", `
+resources:
+- ../base
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/probe/dep-patch.yaml", patchAddProbe)
+}
+
+func writeDNSOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/dns", `
+resources:
+- ../base
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/dns/dep-patch.yaml", patchDnsPolicy)
+}
+
+func writeRestartOverlay(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/restart", `
+resources:
+- ../base
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/restart/dep-patch.yaml", patchRestartPolicy)
+}
+
+// Here's a composite kustomization, that combines multiple overlays
+// (replicas, dns and metadata) which patch the same base resource.
+//
+// The base resource is a deployment and the overlays patch aspects
+// of it, without using any of the `namePrefix`, `nameSuffix` or `namespace`
+// kustomization keywords.
+//
+//            composite
+//          /     |     \
+//       probe   dns  restart
+//          \     |     /
+//              base
+//
+func TestIssue1251_CompositeDiamond_Failure(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/composite")
+	writeDeploymentBase(th)
+	writeProbeOverlay(th)
+	writeDNSOverlay(th)
+	writeRestartOverlay(th)
+
+	th.WriteK("/app/composite", `
+resources:
+- ../probe
+- ../dns
+- ../restart
+`)
+
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("Expected resource accumulation error")
+	}
+	if !strings.Contains(
+		err.Error(), "already registered id: apps_v1_Deployment|~X|my-deployment") {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+}
+
+const expectedPatchedDeployment = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: my-image
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+        name: my-deployment
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+`
+
+// This test reuses some methods from TestIssue1251_CompositeDiamond,
+// but overwrites the kustomization files in the overlays.
+func TestIssue1251_Patches_Overlayed(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/restart")
+	writeDeploymentBase(th)
+
+	// probe overlays base.
+	writeProbeOverlay(th)
+
+	// dns overlays probe.
+	writeDNSOverlay(th)
+	th.WriteK("/app/dns", `
+resources:
+- ../probe
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+
+	// restart overlays dns.
+	writeRestartOverlay(th)
+	th.WriteK("/app/restart", `
+resources:
+- ../dns
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, expectedPatchedDeployment)
+}
+
+func TestIssue1251_Patches_Local(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/composite")
+	writeDeploymentBase(th)
+
+	th.WriteK("/app/composite", `
+resources:
+- ../base
+patchesStrategicMerge:
+- patchAddProbe.yaml
+- patchDnsPolicy.yaml
+- patchRestartPolicy.yaml
+`)
+	th.WriteF("/app/composite/patchRestartPolicy.yaml", patchRestartPolicy)
+	th.WriteF("/app/composite/patchDnsPolicy.yaml", patchDnsPolicy)
+	th.WriteF("/app/composite/patchAddProbe.yaml", patchAddProbe)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, expectedPatchedDeployment)
+}
+
+func definePatchDirStructure(th *kusttest_test.KustTestHarness) {
+	writeDeploymentBase(th)
+
+	th.WriteF("/app/patches/patchRestartPolicy.yaml", patchRestartPolicy)
+	th.WriteF("/app/patches/patchDnsPolicy.yaml", patchDnsPolicy)
+	th.WriteF("/app/patches/patchAddProbe.yaml", patchAddProbe)
+}
+
+// Fails due to file load restrictor.
+func TestIssue1251_Patches_ProdVsDev_Failure(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	definePatchDirStructure(th)
+
+	th.WriteK("/app/prod", `
+resources:
+- ../base
+patchesStrategicMerge:
+- ../patches/patchAddProbe.yaml
+- ../patches/patchDnsPolicy.yaml
+`)
+
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"security; file '/app/patches/patchAddProbe.yaml' is not in or below '/app/prod'") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+const prodDevMergeResult1 = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: my-image
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+        name: my-deployment
+      dnsPolicy: ClusterFirst
+`
+
+const prodDevMergeResult2 = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: my-image
+        name: my-deployment
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+`
+
+// This test does what
+//    TestIssue1251_Patches_ProdVsDev_Failure
+// failed to do, because this test does the equivalent
+// os specifying `--load_restrictor none` on the build.
+//
+// This allows the use patch files located outside the
+// kustomization root, and not in a kustomization
+// themselves.
+//
+// Doing so means the kustomization using them is no
+// longer relocatable, not addressible via a git URL,
+// and not git clonable. It's no longer self-contained.
+//
+// Likewise suppressing load restrictions happens for
+// the entire build (i.e. everything can reach outside
+// the kustomization root), opening the user to whatever
+// threat the load restrictor was meant to address.
+func TestIssue1251_Patches_ProdVsDev(t *testing.T) {
+	th := kusttest_test.NewKustTestHarnessNoLoadRestrictor(t, "/app/prod")
+	definePatchDirStructure(th)
+
+	th.WriteK("/app/prod", `
+resources:
+- ../base
+patchesStrategicMerge:
+- ../patches/patchAddProbe.yaml
+- ../patches/patchDnsPolicy.yaml
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDevMergeResult1)
+
+	th = kusttest_test.NewKustTestHarnessNoLoadRestrictor(t, "/app/dev")
+	definePatchDirStructure(th)
+
+	th.WriteK("/app/dev", `
+resources:
+- ../base
+patchesStrategicMerge:
+- ../patches/patchDnsPolicy.yaml
+- ../patches/patchRestartPolicy.yaml
+`)
+
+	m, err = th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDevMergeResult2)
+}
+
+func TestIssue1251_Plugins_ProdVsDev(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"builtin", "", "PatchJson6902Transformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/prod")
+	defineTransformerDirStructure(th)
+	th.WriteK("/app/prod", `
+resources:
+- ../base
+transformers:
+- ../patches/addProbe
+- ../patches/addDnsPolicy
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDevMergeResult1)
+
+	th = kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/dev")
+	defineTransformerDirStructure(th)
+	th.WriteK("/app/dev", `
+resources:
+- ../base
+transformers:
+- ../patches/addRestartPolicy
+- ../patches/addDnsPolicy
+`)
+
+	m, err = th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, prodDevMergeResult2)
+}
+
+func TestIssue1251_Plugins_Local(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"builtin", "", "PatchJson6902Transformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/composite")
+	writeDeploymentBase(th)
+
+	writeJsonTransformerPluginConfig(
+		th, "/app/composite", "addDnsPolicy", patchJsonDnsPolicy)
+	writeJsonTransformerPluginConfig(
+		th, "/app/composite", "addRestartPolicy", patchJsonRestartPolicy)
+	writeJsonTransformerPluginConfig(
+		th, "/app/composite", "addProbe", patchJsonAddProbe)
+
+	th.WriteK("/app/composite", `
+resources:
+- ../base
+transformers:
+- addDnsPolicyConfig.yaml
+- addRestartPolicyConfig.yaml
+- addProbeConfig.yaml
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, expectedPatchedDeployment)
+}
+
+func writeJsonTransformerPluginConfig(
+	th *kusttest_test.KustTestHarness, path, name, patch string) {
+	th.WriteF(filepath.Join(path, name+"Config.yaml"),
+		fmt.Sprintf(`
+apiVersion: builtin
+kind: PatchJson6902Transformer
+metadata:
+  name: %s
+target:
+  group: apps
+  version: v1
+  kind: Deployment
+  name: my-deployment
+jsonOp: '%s'
+`, name, patch))
+}
+
+// Remote in the sense that they are bundled in a different kustomization.
+func TestIssue1251_Plugins_Bundled(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"builtin", "", "PatchJson6902Transformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/composite")
+	writeDeploymentBase(th)
+
+	th.WriteK("/app/patches", `
+resources:
+- addDnsPolicyConfig.yaml
+- addRestartPolicyConfig.yaml
+- addProbeConfig.yaml
+`)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches", "addDnsPolicy", patchJsonDnsPolicy)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches", "addRestartPolicy", patchJsonRestartPolicy)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches", "addProbe", patchJsonAddProbe)
+
+	th.WriteK("/app/composite", `
+resources:
+- ../base
+transformers:
+- ../patches
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, expectedPatchedDeployment)
+}
+
+func defineTransformerDirStructure(th *kusttest_test.KustTestHarness) {
+	writeDeploymentBase(th)
+
+	th.WriteK("/app/patches/addDnsPolicy", `
+resources:
+- addDnsPolicyConfig.yaml
+`)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches/addDnsPolicy", "addDnsPolicy", patchJsonDnsPolicy)
+
+	th.WriteK("/app/patches/addRestartPolicy", `
+resources:
+- addRestartPolicyConfig.yaml
+`)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches/addRestartPolicy", "addRestartPolicy", patchJsonRestartPolicy)
+
+	th.WriteK("/app/patches/addProbe", `
+resources:
+- addProbeConfig.yaml
+`)
+	writeJsonTransformerPluginConfig(
+		th, "/app/patches/addProbe", "addProbe", patchJsonAddProbe)
+}

api/internal/target/diamonds_test.go

@@ -0,0 +1,225 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Here's a structure of two kustomizations,
+// `dev` and `prod`, individually deployable,
+// that depend on a diamond that combines
+// multiple tenants (kirk, spock and bones),
+// each sharing a common base.
+//
+// The objects used are contrived to avoid
+// clouding the example with authentic
+// but verbose Deployment boilerplate.
+//
+// Patches are applied at various levels,
+// requiring more specificity as needed.
+//
+//         dev      prod
+//             \   /
+//            tenants
+//          /    |    \
+//      kirk   spock  bones
+//          \    |    /
+//             base
+//
+func writeDiamondBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- deploy.yaml
+`)
+	th.WriteF("/app/base/deploy.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: storefront
+spec:
+  numReplicas: 1
+`)
+}
+
+func writeKirk(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/kirk", `
+namePrefix: kirk-
+resources:
+- ../base
+- configmap.yaml
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/kirk/dep-patch.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: storefront
+spec:
+  type: Confident
+`)
+	th.WriteF("/app/kirk/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: settings
+data:
+  phaser: caress
+`)
+}
+
+func writeSpock(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/spock", `
+namePrefix: spock-
+resources:
+- ../base
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/spock/dep-patch.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: storefront
+spec:
+  type: Logical
+`)
+}
+
+func writeBones(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/bones", `
+namePrefix: bones-
+resources:
+- ../base
+patchesStrategicMerge:
+- dep-patch.yaml
+`)
+	th.WriteF("/app/bones/dep-patch.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: storefront
+spec:
+  type: Concerned
+`)
+}
+
+func writeTenants(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/tenants", `
+namePrefix: t-
+resources:
+- ../kirk
+- ../spock
+- ../bones
+- configMap.yaml
+patchesStrategicMerge:
+- bones-patch.yaml
+`)
+	th.WriteF("/app/tenants/bones-patch.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: bones-storefront
+spec:
+  mood: Cantankerous
+`)
+	th.WriteF("/app/tenants/configMap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: federation
+data:
+  zone: neutral
+  guardian: forever
+`)
+}
+
+func TestBasicDiamond(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/prod")
+	writeDiamondBase(th)
+	writeKirk(th)
+	writeSpock(th)
+	writeBones(th)
+	writeTenants(th)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../tenants
+patchesStrategicMerge:
+- patches.yaml
+`)
+	// The patch only has to be specific enough
+	// to match the item.
+	th.WriteF("/app/prod/patches.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: t-kirk-storefront
+spec:
+  numReplicas: 10000
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: federation
+data:
+  guardian: ofTheGalaxy
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: t-federation
+data:
+  zone: twilight
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: prod-t-kirk-storefront
+spec:
+  numReplicas: 10000
+  type: Confident
+---
+apiVersion: v1
+data:
+  phaser: caress
+kind: ConfigMap
+metadata:
+  name: prod-t-kirk-settings
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: prod-t-spock-storefront
+spec:
+  numReplicas: 1
+  type: Logical
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: prod-t-bones-storefront
+spec:
+  mood: Cantankerous
+  numReplicas: 1
+  type: Concerned
+---
+apiVersion: v1
+data:
+  guardian: ofTheGalaxy
+  zone: twilight
+kind: ConfigMap
+metadata:
+  name: prod-t-federation
+`)
+}

api/internal/target/generatormergeandreplace_test.go

@@ -0,0 +1,597 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestSimpleBase(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	th.WriteK("/app/base", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: team-foo-
+commonLabels:
+  app: mynginx
+  org: example.com
+  team: foo
+commonAnnotations:
+  note: This is a test annotation
+resources:
+  - service.yaml
+  - deployment.yaml
+  - networkpolicy.yaml
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nginx
+`)
+	th.WriteF("/app/base/networkpolicy.yaml", `
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: nginx
+spec:
+  podSelector:
+    matchExpressions:
+      - {key: app, operator: In, values: [test]}
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: nginx
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-nginx
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: mynginx
+    org: example.com
+    team: foo
+---
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-nginx
+spec:
+  selector:
+    matchLabels:
+      app: mynginx
+      org: example.com
+      team: foo
+  template:
+    metadata:
+      annotations:
+        note: This is a test annotation
+      labels:
+        app: mynginx
+        org: example.com
+        team: foo
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-nginx
+spec:
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: mynginx
+          org: example.com
+          team: foo
+  podSelector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - test
+`)
+}
+
+func makeBaseWithGenerators(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: team-foo-
+commonLabels:
+  app: mynginx
+  org: example.com
+  team: foo
+commonAnnotations:
+  note: This is a test annotation
+resources:
+  - deployment.yaml
+  - service.yaml
+configMapGenerator:
+- name: configmap-in-base
+  literals:
+  - foo=bar
+secretGenerator:
+- name: secret-in-base
+  literals:
+  - username=admin
+  - password=somepw
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+        volumeMounts:
+        - name: nginx-persistent-storage
+          mountPath: /tmp/ps
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: {}
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+	th.WriteF("/app/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nginx
+`)
+}
+
+func TestBaseWithGeneratorsAlone(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	makeBaseWithGenerators(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-nginx
+spec:
+  selector:
+    matchLabels:
+      app: mynginx
+      org: example.com
+      team: foo
+  template:
+    metadata:
+      annotations:
+        note: This is a test annotation
+      labels:
+        app: mynginx
+        org: example.com
+        team: foo
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: team-foo-configmap-in-base-bbdmdh7m8t
+        name: configmap-in-base
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-nginx
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: mynginx
+    org: example.com
+    team: foo
+---
+apiVersion: v1
+data:
+  foo: bar
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-configmap-in-base-bbdmdh7m8t
+---
+apiVersion: v1
+data:
+  password: c29tZXB3
+  username: YWRtaW4=
+kind: Secret
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    org: example.com
+    team: foo
+  name: team-foo-secret-in-base-tkm7hhtf8d
+type: Opaque
+`)
+}
+
+func TestMergeAndReplaceGenerators(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/overlay")
+	makeBaseWithGenerators(th)
+	th.WriteF("/overlay/deployment.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: null
+        gcePersistentDisk:
+          pdName: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-overlay
+        name: configmap-in-overlay
+`)
+	th.WriteK("/overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: staging-
+commonLabels:
+  env: staging
+  team: override-foo
+patchesStrategicMerge:
+- deployment.yaml
+resources:
+- ../app
+configMapGenerator:
+- name: configmap-in-overlay
+  literals:
+  - hello=world
+- name: configmap-in-base
+  behavior: replace
+  literals:
+  - foo=override-bar
+secretGenerator:
+- name: secret-in-base
+  behavior: merge
+  literals:
+  - proxy=haproxy
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: override-foo
+  name: staging-team-foo-nginx
+spec:
+  selector:
+    matchLabels:
+      app: mynginx
+      env: staging
+      org: example.com
+      team: override-foo
+  template:
+    metadata:
+      annotations:
+        note: This is a test annotation
+      labels:
+        app: mynginx
+        env: staging
+        org: example.com
+        team: override-foo
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - gcePersistentDisk:
+          pdName: nginx-persistent-storage
+        name: nginx-persistent-storage
+      - configMap:
+          name: staging-configmap-in-overlay-k7cbc75tg8
+        name: configmap-in-overlay
+      - configMap:
+          name: staging-team-foo-configmap-in-base-gh9d7t85gb
+        name: configmap-in-base
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: override-foo
+  name: staging-team-foo-nginx
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: override-foo
+---
+apiVersion: v1
+data:
+  foo: override-bar
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: override-foo
+  name: staging-team-foo-configmap-in-base-gh9d7t85gb
+---
+apiVersion: v1
+data:
+  password: c29tZXB3
+  proxy: aGFwcm94eQ==
+  username: YWRtaW4=
+kind: Secret
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: override-foo
+  name: staging-team-foo-secret-in-base-c8db7gk2m2
+type: Opaque
+---
+apiVersion: v1
+data:
+  hello: world
+kind: ConfigMap
+metadata:
+  labels:
+    env: staging
+    team: override-foo
+  name: staging-configmap-in-overlay-k7cbc75tg8
+`)
+}
+
+func TestGeneratingIntoNamespaces(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+configMapGenerator:
+- name: test
+  namespace: default
+  literals:
+    - key=value
+- name: test
+  namespace: kube-system
+  literals:
+    - key=value
+secretGenerator:
+- name: test
+  namespace: default
+  literals:
+  - username=admin
+  - password=somepw
+- name: test
+  namespace: kube-system
+  literals:
+  - username=admin
+  - password=somepw
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  key: value
+kind: ConfigMap
+metadata:
+  name: test-t5t4md8fdm
+  namespace: default
+---
+apiVersion: v1
+data:
+  key: value
+kind: ConfigMap
+metadata:
+  name: test-t5t4md8fdm
+  namespace: kube-system
+---
+apiVersion: v1
+data:
+  password: c29tZXB3
+  username: YWRtaW4=
+kind: Secret
+metadata:
+  name: test-h65t9hg6kc
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  password: c29tZXB3
+  username: YWRtaW4=
+kind: Secret
+metadata:
+  name: test-h65t9hg6kc
+  namespace: kube-system
+type: Opaque
+`)
+}
+
+// Valid that conflict is detected is the name are identical
+// and namespace left to default
+func TestConfigMapGeneratingIntoSameNamespace(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+configMapGenerator:
+- name: test
+  namespace: default
+  literals:
+  - key=value
+- name: test
+  literals:
+  - key=value
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "must merge or replace") {
+		t.Fatalf("unexpected error %v", err)
+	}
+}
+
+// Valid that conflict is detected is the name are identical
+// and namespace left to default
+func TestSecretGeneratingIntoSameNamespace(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+secretGenerator:
+- name: test
+  namespace: default
+  literals:
+  - username=admin
+  - password=somepw
+- name: test
+  literals:
+  - username=admin
+  - password=somepw
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "must merge or replace") {
+		t.Fatalf("unexpected error %v", err)
+	}
+}

api/internal/target/generatoroptions_test.go

@@ -0,0 +1,115 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestSecretGenerator(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+secretGenerator:
+- name: bob
+  literals:
+  - FRUIT=apple
+  - VEGETABLE=carrot
+  files:
+  - foo.env
+  - passphrase=phrase.dat
+  envs:
+  - foo.env
+`)
+	th.WriteF("/app/foo.env", `
+MOUNTAIN=everest
+OCEAN=pacific
+`)
+	th.WriteF("/app/phrase.dat", "dat phrase")
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  FRUIT: YXBwbGU=
+  MOUNTAIN: ZXZlcmVzdA==
+  OCEAN: cGFjaWZpYw==
+  VEGETABLE: Y2Fycm90
+  foo.env: Ck1PVU5UQUlOPWV2ZXJlc3QKT0NFQU49cGFjaWZpYwo=
+  passphrase: ZGF0IHBocmFzZQ==
+kind: Secret
+metadata:
+  name: bob-kf5c9fccbt
+type: Opaque
+`)
+}
+
+func TestGeneratorOptionsWithBases(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	th.WriteK("/app/base", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    foo: bar
+configMapGenerator:
+- name: shouldNotHaveHash
+  literals:
+  - foo=bar
+`)
+	th.WriteK("/app/overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../base
+generatorOptions:
+  disableNameSuffixHash: false
+  labels:
+    fruit: apple
+configMapGenerator:
+- name: shouldHaveHash
+  literals:
+  - fruit=apple
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  foo: bar
+kind: ConfigMap
+metadata:
+  labels:
+    foo: bar
+  name: shouldNotHaveHash
+---
+apiVersion: v1
+data:
+  fruit: apple
+kind: ConfigMap
+metadata:
+  labels:
+    fruit: apple
+  name: shouldHaveHash-2k9hc848ff
+`)
+}

api/internal/target/inlinepatch_test.go

@@ -0,0 +1,244 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func makeResourcesForPatchTest(th *kusttest_test.KustTestHarness) {
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+        volumeMounts:
+        - name: nginx-persistent-storage
+          mountPath: /tmp/ps
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: {}
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+}
+
+func TestStrategicMergePatchInline(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeResourcesForPatchTest(th)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+
+patchesStrategicMerge:
+- |-
+  apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: nginx
+  spec:
+    template:
+      spec:
+        containers:
+          - name: nginx
+            image: image1
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: image1
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+}
+
+func TestJSONPatchInline(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeResourcesForPatchTest(th)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+
+patchesJson6902:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: nginx
+  patch: |-
+    - op: replace
+      path: /spec/template/spec/containers/0/image
+      value: image1
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: image1
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+}
+
+func TestExtendedPatchInlineJSON(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeResourcesForPatchTest(th)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+
+patches:
+- target:
+    kind: Deployment
+    name: nginx
+  patch: |-
+    - op: replace
+      path: /spec/template/spec/containers/0/image
+      value: image1
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: image1
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+}
+
+func TestExtendedPatchInlineYAML(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeResourcesForPatchTest(th)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+
+patches:
+- target:
+    kind: Deployment
+    name: nginx
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: nginx
+    spec:
+      template:
+        spec:
+          containers:
+            - name: nginx
+              image: image1
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: image1
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+}

api/internal/target/kusttarget.go

@@ -0,0 +1,411 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package target implements state for the set of all
+// resources to customize.
+package target
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/plugins/builtinhelpers"
+	"sigs.k8s.io/kustomize/api/plugins/builtins"
+	"sigs.k8s.io/kustomize/api/plugins/loader"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// KustTarget encapsulates the entirety of a kustomization build.
+type KustTarget struct {
+	kustomization *types.Kustomization
+	ldr           ifc.Loader
+	validator     ifc.Validator
+	rFactory      *resmap.Factory
+	tFactory      resmap.PatchFactory
+	pLdr          *loader.Loader
+}
+
+// NewKustTarget returns a new instance of KustTarget primed with a Loader.
+func NewKustTarget(
+	ldr ifc.Loader,
+	validator ifc.Validator,
+	rFactory *resmap.Factory,
+	tFactory resmap.PatchFactory,
+	pLdr *loader.Loader) (*KustTarget, error) {
+	content, err := loadKustFile(ldr)
+	if err != nil {
+		return nil, err
+	}
+	content = types.FixKustomizationPreUnmarshalling(content)
+	var k types.Kustomization
+	err = unmarshal(content, &k)
+	if err != nil {
+		return nil, err
+	}
+	k.FixKustomizationPostUnmarshalling()
+	errs := k.EnforceFields()
+	if len(errs) > 0 {
+		return nil, fmt.Errorf(
+			"Failed to read kustomization file under %s:\n"+
+				strings.Join(errs, "\n"), ldr.Root())
+	}
+	return &KustTarget{
+		kustomization: &k,
+		ldr:           ldr,
+		validator:     validator,
+		rFactory:      rFactory,
+		tFactory:      tFactory,
+		pLdr:          pLdr,
+	}, nil
+}
+
+func quoted(l []string) []string {
+	r := make([]string, len(l))
+	for i, v := range l {
+		r[i] = "'" + v + "'"
+	}
+	return r
+}
+
+func commaOr(q []string) string {
+	return strings.Join(q[:len(q)-1], ", ") + " or " + q[len(q)-1]
+}
+
+func loadKustFile(ldr ifc.Loader) ([]byte, error) {
+	var content []byte
+	match := 0
+	for _, kf := range konfig.RecognizedKustomizationFileNames() {
+		c, err := ldr.Load(kf)
+		if err == nil {
+			match += 1
+			content = c
+		}
+	}
+	switch match {
+	case 0:
+		return nil, NewErrMissingKustomization(ldr.Root())
+	case 1:
+		return content, nil
+	default:
+		return nil, fmt.Errorf(
+			"Found multiple kustomization files under: %s\n", ldr.Root())
+	}
+}
+
+type errMissingKustomization struct {
+	path string
+}
+
+func (e *errMissingKustomization) Error() string {
+	return fmt.Sprintf(
+		"unable to find one of %v in directory '%s'",
+		commaOr(quoted(konfig.RecognizedKustomizationFileNames())),
+		e.path)
+}
+
+func NewErrMissingKustomization(p string) *errMissingKustomization {
+	return &errMissingKustomization{path: p}
+}
+
+func IsMissingKustomizationFileError(err error) bool {
+	_, ok := err.(*errMissingKustomization)
+	if ok {
+		return true
+	}
+	_, ok = errors.Cause(err).(*errMissingKustomization)
+	return ok
+}
+
+func unmarshal(y []byte, o interface{}) error {
+	j, err := yaml.YAMLToJSON(y)
+	if err != nil {
+		return err
+	}
+	dec := json.NewDecoder(bytes.NewReader(j))
+	dec.DisallowUnknownFields()
+	return dec.Decode(o)
+}
+
+// MakeCustomizedResMap creates a ResMap per kustomization instructions.
+// The Resources in the returned ResMap are fully customized.
+func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
+	return kt.makeCustomizedResMap(types.GarbageIgnore)
+}
+
+func (kt *KustTarget) MakePruneConfigMap() (resmap.ResMap, error) {
+	return kt.makeCustomizedResMap(types.GarbageCollect)
+}
+
+func (kt *KustTarget) makeCustomizedResMap(
+	garbagePolicy types.GarbagePolicy) (resmap.ResMap, error) {
+	ra, err := kt.AccumulateTarget()
+	if err != nil {
+		return nil, err
+	}
+
+	// The following steps must be done last, not as part of
+	// the recursion implicit in AccumulateTarget.
+
+	err = kt.addHashesToNames(ra)
+	if err != nil {
+		return nil, err
+	}
+
+	// Given that names have changed (prefixs/suffixes added),
+	// fix all the back references to those names.
+	err = ra.FixBackReferences()
+	if err != nil {
+		return nil, err
+	}
+
+	// With all the back references fixed, it's OK to resolve Vars.
+	err = ra.ResolveVars()
+	if err != nil {
+		return nil, err
+	}
+
+	err = kt.computeInventory(ra, garbagePolicy)
+	if err != nil {
+		return nil, err
+	}
+
+	return ra.ResMap(), nil
+}
+
+func (kt *KustTarget) addHashesToNames(
+	ra *accumulator.ResAccumulator) error {
+	p := builtins.NewHashTransformerPlugin()
+	err := kt.configureBuiltinPlugin(p, nil, builtinhelpers.HashTransformer)
+	if err != nil {
+		return err
+	}
+	return ra.Transform(p)
+}
+
+func (kt *KustTarget) computeInventory(
+	ra *accumulator.ResAccumulator, garbagePolicy types.GarbagePolicy) error {
+	inv := kt.kustomization.Inventory
+	if inv == nil {
+		return nil
+	}
+	if inv.Type != "ConfigMap" {
+		return fmt.Errorf("don't know how to do that")
+	}
+
+	if inv.ConfigMap.Namespace != kt.kustomization.Namespace {
+		return fmt.Errorf("namespace mismatch")
+	}
+
+	var c struct {
+		Policy           string
+		types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	}
+	c.Name = inv.ConfigMap.Name
+	c.Namespace = inv.ConfigMap.Namespace
+	c.Policy = garbagePolicy.String()
+	p := builtins.NewInventoryTransformerPlugin()
+	err := kt.configureBuiltinPlugin(p, c, builtinhelpers.InventoryTransformer)
+	if err != nil {
+		return err
+	}
+	return ra.Transform(p)
+}
+
+func (kt *KustTarget) shouldAddHashSuffixesToGeneratedResources() bool {
+	return kt.kustomization.GeneratorOptions == nil ||
+		!kt.kustomization.GeneratorOptions.DisableNameSuffixHash
+}
+
+// AccumulateTarget returns a new ResAccumulator,
+// holding customized resources and the data/rules used
+// to do so.  The name back references and vars are
+// not yet fixed.
+func (kt *KustTarget) AccumulateTarget() (
+	ra *accumulator.ResAccumulator, err error) {
+	ra = accumulator.MakeEmptyAccumulator()
+	err = kt.accumulateResources(ra, kt.kustomization.Resources)
+	if err != nil {
+		return nil, errors.Wrap(err, "accumulating resources")
+	}
+	tConfig, err := builtinconfig.MakeTransformerConfig(
+		kt.ldr, kt.kustomization.Configurations)
+	if err != nil {
+		return nil, err
+	}
+	err = ra.MergeConfig(tConfig)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "merging config %v", tConfig)
+	}
+	crdTc, err := accumulator.LoadConfigFromCRDs(kt.ldr, kt.kustomization.Crds)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "loading CRDs %v", kt.kustomization.Crds)
+	}
+	err = ra.MergeConfig(crdTc)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "merging CRDs %v", crdTc)
+	}
+	err = kt.runGenerators(ra)
+	if err != nil {
+		return nil, err
+	}
+	err = kt.runTransformers(ra)
+	if err != nil {
+		return nil, err
+	}
+	err = ra.MergeVars(kt.kustomization.Vars)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "merging vars %v", kt.kustomization.Vars)
+	}
+	return ra, nil
+}
+
+func (kt *KustTarget) runGenerators(
+	ra *accumulator.ResAccumulator) error {
+	var generators []resmap.Generator
+	gs, err := kt.configureBuiltinGenerators()
+	if err != nil {
+		return err
+	}
+	generators = append(generators, gs...)
+	gs, err = kt.configureExternalGenerators()
+	if err != nil {
+		return errors.Wrap(err, "loading generator plugins")
+	}
+	generators = append(generators, gs...)
+	for _, g := range generators {
+		resMap, err := g.Generate()
+		if err != nil {
+			return err
+		}
+		err = ra.AbsorbAll(resMap)
+		if err != nil {
+			return errors.Wrapf(err, "merging from generator %v", g)
+		}
+	}
+	return nil
+}
+
+func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error) {
+	ra := accumulator.MakeEmptyAccumulator()
+	err := kt.accumulateResources(ra, kt.kustomization.Generators)
+	if err != nil {
+		return nil, err
+	}
+	return kt.pLdr.LoadGenerators(kt.ldr, kt.validator, ra.ResMap())
+}
+
+func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
+	var r []resmap.Transformer
+	tConfig := ra.GetTransformerConfig()
+	lts, err := kt.configureBuiltinTransformers(tConfig)
+	if err != nil {
+		return err
+	}
+	r = append(r, lts...)
+	lts, err = kt.configureExternalTransformers()
+	if err != nil {
+		return err
+	}
+	r = append(r, lts...)
+	t := transform.NewMultiTransformer(r)
+	return ra.Transform(t)
+}
+
+func (kt *KustTarget) configureExternalTransformers() ([]resmap.Transformer, error) {
+	ra := accumulator.MakeEmptyAccumulator()
+	err := kt.accumulateResources(ra, kt.kustomization.Transformers)
+	if err != nil {
+		return nil, err
+	}
+	return kt.pLdr.LoadTransformers(kt.ldr, kt.validator, ra.ResMap())
+}
+
+// accumulateResources fills the given resourceAccumulator
+// with resources read from the given list of paths.
+func (kt *KustTarget) accumulateResources(
+	ra *accumulator.ResAccumulator, paths []string) error {
+	for _, path := range paths {
+		ldr, err := kt.ldr.New(path)
+		if err == nil {
+			err = kt.accumulateDirectory(ra, ldr)
+			if err != nil {
+				return err
+			}
+		} else {
+			err2 := kt.accumulateFile(ra, path)
+			if err2 != nil {
+				// Log ldr.New() error to highlight git failures.
+				log.Print(err.Error())
+				return err2
+			}
+		}
+	}
+	return nil
+}
+
+func (kt *KustTarget) accumulateDirectory(
+	ra *accumulator.ResAccumulator, ldr ifc.Loader) error {
+	defer ldr.Cleanup()
+	subKt, err := NewKustTarget(
+		ldr, kt.validator, kt.rFactory, kt.tFactory, kt.pLdr)
+	if err != nil {
+		return errors.Wrapf(
+			err, "couldn't make target for path '%s'", ldr.Root())
+	}
+	subRa, err := subKt.AccumulateTarget()
+	if err != nil {
+		return errors.Wrapf(
+			err, "recursed accumulation of path '%s'", ldr.Root())
+	}
+	err = ra.MergeAccumulator(subRa)
+	if err != nil {
+		return errors.Wrapf(
+			err, "recursed merging from path '%s'", ldr.Root())
+	}
+	return nil
+}
+
+func (kt *KustTarget) accumulateFile(
+	ra *accumulator.ResAccumulator, path string) error {
+	resources, err := kt.rFactory.FromFile(kt.ldr, path)
+	if err != nil {
+		return errors.Wrapf(err, "accumulating resources from '%s'", path)
+	}
+	err = ra.AppendAll(resources)
+	if err != nil {
+		return errors.Wrapf(err, "merging resources from '%s'", path)
+	}
+	return nil
+}
+
+func (kt *KustTarget) configureBuiltinPlugin(
+	p resmap.Configurable, c interface{}, bpt builtinhelpers.BuiltinPluginType) (err error) {
+	var y []byte
+	if c != nil {
+		y, err = yaml.Marshal(c)
+		if err != nil {
+			return errors.Wrapf(
+				err, "builtin %s marshal", bpt)
+		}
+	}
+	err = p.Config(resmap.NewPluginHelpers(kt.ldr, kt.validator, kt.rFactory), y)
+	if err != nil {
+		return errors.Wrapf(err, "builtin %s config: %v", bpt, y)
+	}
+	return nil
+}

api/internal/target/kusttarget_configplugin.go

@@ -0,0 +1,297 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target
+
+import (
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/plugins/builtinhelpers"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// Functions dedicated to configuring the builtin
+// transformer and generator plugins using config data
+// read from a kustomization file and from the
+// config.TransformerConfig, whose data may be a
+// mix of hardcoded values and data read from file.
+//
+// Non-builtin plugins will get their configuration
+// from their own dedicated structs and YAML files.
+//
+// There are some loops in the functions below because
+// the kustomization file would, say, allow someone to
+// request multiple secrets be made, or run multiple
+// image tag transforms.  In these cases, we'll need
+// N plugin instances with differing configurations.
+
+func (kt *KustTarget) configureBuiltinGenerators() (
+	result []resmap.Generator, err error) {
+	for _, bpt := range []builtinhelpers.BuiltinPluginType{
+		builtinhelpers.ConfigMapGenerator,
+		builtinhelpers.SecretGenerator,
+	} {
+		r, err := generatorConfigurators[bpt](
+			kt, bpt, builtinhelpers.GeneratorFactories[bpt])
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, r...)
+	}
+	return result, nil
+}
+
+func (kt *KustTarget) configureBuiltinTransformers(
+	tc *builtinconfig.TransformerConfig) (
+	result []resmap.Transformer, err error) {
+	for _, bpt := range []builtinhelpers.BuiltinPluginType{
+		builtinhelpers.PatchStrategicMergeTransformer,
+		builtinhelpers.PatchTransformer,
+		builtinhelpers.NamespaceTransformer,
+		builtinhelpers.PrefixSuffixTransformer,
+		builtinhelpers.LabelTransformer,
+		builtinhelpers.AnnotationsTransformer,
+		builtinhelpers.PatchJson6902Transformer,
+		builtinhelpers.ReplicaCountTransformer,
+		builtinhelpers.ImageTagTransformer,
+	} {
+		r, err := transformerConfigurators[bpt](
+			kt, bpt, builtinhelpers.TransformerFactories[bpt], tc)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, r...)
+	}
+	return result, nil
+}
+
+type gFactory func() resmap.GeneratorPlugin
+
+var generatorConfigurators = map[builtinhelpers.BuiltinPluginType]func(
+	kt *KustTarget,
+	bpt builtinhelpers.BuiltinPluginType,
+	factory gFactory) (result []resmap.Generator, err error){
+	builtinhelpers.SecretGenerator: func(kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f gFactory) (
+		result []resmap.Generator, err error) {
+		var c struct {
+			types.GeneratorOptions
+			types.SecretArgs
+		}
+		if kt.kustomization.GeneratorOptions != nil {
+			c.GeneratorOptions = *kt.kustomization.GeneratorOptions
+		}
+		for _, args := range kt.kustomization.SecretGenerator {
+			c.SecretArgs = args
+			p := f()
+			err := kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+
+	builtinhelpers.ConfigMapGenerator: func(kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f gFactory) (
+		result []resmap.Generator, err error) {
+		var c struct {
+			types.GeneratorOptions
+			types.ConfigMapArgs
+		}
+		if kt.kustomization.GeneratorOptions != nil {
+			c.GeneratorOptions = *kt.kustomization.GeneratorOptions
+		}
+		for _, args := range kt.kustomization.ConfigMapGenerator {
+			c.ConfigMapArgs = args
+			p := f()
+			err := kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+}
+
+type tFactory func() resmap.TransformerPlugin
+
+var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
+	kt *KustTarget,
+	bpt builtinhelpers.BuiltinPluginType,
+	f tFactory,
+	tc *builtinconfig.TransformerConfig) (result []resmap.Transformer, err error){
+	builtinhelpers.NamespaceTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+			FieldSpecs       []types.FieldSpec
+		}
+		c.Namespace = kt.kustomization.Namespace
+		c.FieldSpecs = tc.NameSpace
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
+
+	builtinhelpers.PatchJson6902Transformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, _ *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			Target types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
+			Path   string            `json:"path,omitempty" yaml:"path,omitempty"`
+			JsonOp string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
+		}
+		for _, args := range kt.kustomization.PatchesJson6902 {
+			c.Target = *args.Target
+			c.Path = args.Path
+			c.JsonOp = args.Patch
+			p := f()
+			err = kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+	builtinhelpers.PatchStrategicMergeTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, _ *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		if len(kt.kustomization.PatchesStrategicMerge) == 0 {
+			return
+		}
+		var c struct {
+			Paths   []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
+			Patches string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
+		}
+		c.Paths = kt.kustomization.PatchesStrategicMerge
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
+	builtinhelpers.PatchTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, _ *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		if len(kt.kustomization.Patches) == 0 {
+			return
+		}
+		var c struct {
+			Path   string          `json:"path,omitempty" yaml:"path,omitempty"`
+			Patch  string          `json:"patch,omitempty" yaml:"patch,omitempty"`
+			Target *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
+		}
+		for _, pc := range kt.kustomization.Patches {
+			c.Target = pc.Target
+			c.Patch = pc.Patch
+			c.Path = pc.Path
+			p := f()
+			err = kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+	builtinhelpers.LabelTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			Labels     map[string]string
+			FieldSpecs []types.FieldSpec
+		}
+		c.Labels = kt.kustomization.CommonLabels
+		c.FieldSpecs = tc.CommonLabels
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
+	builtinhelpers.AnnotationsTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			Annotations map[string]string
+			FieldSpecs  []types.FieldSpec
+		}
+		c.Annotations = kt.kustomization.CommonAnnotations
+		c.FieldSpecs = tc.CommonAnnotations
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
+	builtinhelpers.PrefixSuffixTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			Prefix     string
+			Suffix     string
+			FieldSpecs []types.FieldSpec
+		}
+		c.Prefix = kt.kustomization.NamePrefix
+		c.Suffix = kt.kustomization.NameSuffix
+		c.FieldSpecs = tc.NamePrefix
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
+	builtinhelpers.ImageTagTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			ImageTag   types.Image
+			FieldSpecs []types.FieldSpec
+		}
+		for _, args := range kt.kustomization.Images {
+			c.ImageTag = args
+			c.FieldSpecs = tc.Images
+			p := f()
+			err = kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+	builtinhelpers.ReplicaCountTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		var c struct {
+			Replica    types.Replica
+			FieldSpecs []types.FieldSpec
+		}
+		for _, args := range kt.kustomization.Replicas {
+			c.Replica = args
+			c.FieldSpecs = tc.Replicas
+			p := f()
+			err = kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
+}

api/internal/target/kusttarget_test.go

@@ -0,0 +1,446 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/loadertest"
+	. "sigs.k8s.io/kustomize/api/internal/target"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+const (
+	kustomizationContent = `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: foo-
+nameSuffix: -bar
+namespace: ns1
+commonLabels:
+  app: nginx
+commonAnnotations:
+  note: This is a test annotation
+resources:
+  - deployment.yaml
+  - namespace.yaml
+generatorOptions:
+  disableNameSuffixHash: false
+configMapGenerator:
+- name: literalConfigMap
+  literals:
+  - DB_USERNAME=admin
+  - DB_PASSWORD=somepw
+secretGenerator:
+- name: secret
+  literals:
+    - DB_USERNAME=admin
+    - DB_PASSWORD=somepw
+  type: Opaque
+patchesJson6902:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: dply1
+  path: jsonpatch.json
+`
+	deploymentContent = `
+apiVersion: apps/v1
+metadata:
+  name: dply1
+kind: Deployment
+`
+	namespaceContent = `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ns1
+`
+	jsonpatchContent = `[
+    {"op": "add", "path": "/spec/replica", "value": "3"}
+]`
+)
+
+func TestResources(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/whatever")
+	th.WriteK("/whatever/", kustomizationContent)
+	th.WriteF("/whatever/deployment.yaml", deploymentContent)
+	th.WriteF("/whatever/namespace.yaml", namespaceContent)
+	th.WriteF("/whatever/jsonpatch.json", jsonpatchContent)
+
+	resources := []*resource.Resource{
+		th.RF().FromMapWithName("dply1", map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name":      "foo-dply1-bar",
+				"namespace": "ns1",
+				"labels": map[string]interface{}{
+					"app": "nginx",
+				},
+				"annotations": map[string]interface{}{
+					"note": "This is a test annotation",
+				},
+			},
+			"spec": map[string]interface{}{
+				"replica": "3",
+				"selector": map[string]interface{}{
+					"matchLabels": map[string]interface{}{
+						"app": "nginx",
+					},
+				},
+				"template": map[string]interface{}{
+					"metadata": map[string]interface{}{
+						"annotations": map[string]interface{}{
+							"note": "This is a test annotation",
+						},
+						"labels": map[string]interface{}{
+							"app": "nginx",
+						},
+					},
+				},
+			},
+		}),
+		th.RF().FromMapWithName("ns1", map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Namespace",
+			"metadata": map[string]interface{}{
+				"name": "foo-ns1-bar",
+				"labels": map[string]interface{}{
+					"app": "nginx",
+				},
+				"annotations": map[string]interface{}{
+					"note": "This is a test annotation",
+				},
+			},
+		}),
+		th.RF().FromMapWithName("literalConfigMap",
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "ConfigMap",
+				"metadata": map[string]interface{}{
+					"name":      "foo-literalConfigMap-bar-8d2dkb8k24",
+					"namespace": "ns1",
+					"labels": map[string]interface{}{
+						"app": "nginx",
+					},
+					"annotations": map[string]interface{}{
+						"note": "This is a test annotation",
+					},
+				},
+				"data": map[string]interface{}{
+					"DB_USERNAME": "admin",
+					"DB_PASSWORD": "somepw",
+				},
+			}),
+		th.RF().FromMapWithName("secret",
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Secret",
+				"metadata": map[string]interface{}{
+					"name":      "foo-secret-bar-9btc7bt4kb",
+					"namespace": "ns1",
+					"labels": map[string]interface{}{
+						"app": "nginx",
+					},
+					"annotations": map[string]interface{}{
+						"note": "This is a test annotation",
+					},
+				},
+				"type": ifc.SecretTypeOpaque,
+				"data": map[string]interface{}{
+					"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
+					"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
+				},
+			}),
+	}
+
+	expected := resmap.New()
+	for _, r := range resources {
+		if err := expected.Append(r); err != nil {
+			t.Fatalf("unexpected error %v", err)
+		}
+	}
+
+	actual, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("unexpected Resources error %v", err)
+	}
+
+	if err = expected.ErrorIfNotEqualLists(actual); err != nil {
+		t.Fatalf("unexpected inequality: %v", err)
+	}
+}
+
+func TestKustomizationNotFound(t *testing.T) {
+	_, err := NewKustTarget(
+		loadertest.NewFakeLoader("/foo"),
+		valtest_test.MakeFakeValidator(), nil, nil, nil)
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+	if err.Error() !=
+		`unable to find one of 'kustomization.yaml', 'kustomization.yml' or 'Kustomization' in directory '/foo'` {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}
+
+func TestResourceNotFound(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/whatever")
+	th.WriteK("/whatever", kustomizationContent)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("Didn't get the expected error for an unknown resource")
+	}
+	if !strings.Contains(err.Error(), `cannot read file`) {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}
+
+func findSecret(m resmap.ResMap) *resource.Resource {
+	for _, r := range m.Resources() {
+		if r.OrgId().Kind == "Secret" {
+			return r
+		}
+	}
+	return nil
+}
+
+func TestDisableNameSuffixHash(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/whatever")
+	th.WriteK("/whatever/", kustomizationContent)
+	th.WriteF("/whatever/deployment.yaml", deploymentContent)
+	th.WriteF("/whatever/namespace.yaml", namespaceContent)
+	th.WriteF("/whatever/jsonpatch.json", jsonpatchContent)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("unexpected Resources error %v", err)
+	}
+	secret := findSecret(m)
+	if secret == nil {
+		t.Errorf("Expected to find a Secret")
+	}
+	if secret.GetName() != "foo-secret-bar-9btc7bt4kb" {
+		t.Errorf("unexpected secret resource name: %s", secret.GetName())
+	}
+
+	th.WriteK("/whatever/",
+		strings.Replace(kustomizationContent,
+			"disableNameSuffixHash: false",
+			"disableNameSuffixHash: true", -1))
+	m, err = th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("unexpected Resources error %v", err)
+	}
+	secret = findSecret(m)
+	if secret == nil {
+		t.Errorf("Expected to find a Secret")
+	}
+	if secret.GetName() != "foo-secret-bar" { // No hash at end.
+		t.Errorf("unexpected secret resource name: %s", secret.GetName())
+	}
+}
+
+func TestIssue596AllowDirectoriesThatAreSubstringsOfEachOther(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlays/aws-sandbox2.us-east-1")
+	th.WriteK("/app/base", "")
+	th.WriteK("/app/overlays/aws", `
+resources:
+- ../../base
+`)
+	th.WriteK("/app/overlays/aws-nonprod", `
+resources:
+- ../aws
+`)
+	th.WriteK("/app/overlays/aws-sandbox2.us-east-1", `
+resources:
+- ../aws-nonprod
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, "")
+}
+
+// To simplify tests, these vars specified in alphabetical order.
+var someVars = []types.Var{
+	{
+		Name: "AWARD",
+		ObjRef: types.Target{
+			APIVersion: "v7",
+			Gvk:        resid.Gvk{Kind: "Service"},
+			Name:       "nobelPrize"},
+		FieldRef: types.FieldSelector{FieldPath: "some.arbitrary.path"},
+	},
+	{
+		Name: "BIRD",
+		ObjRef: types.Target{
+			APIVersion: "v300",
+			Gvk:        resid.Gvk{Kind: "Service"},
+			Name:       "heron"},
+		FieldRef: types.FieldSelector{FieldPath: "metadata.name"},
+	},
+	{
+		Name: "FRUIT",
+		ObjRef: types.Target{
+			Gvk:  resid.Gvk{Kind: "Service"},
+			Name: "apple"},
+		FieldRef: types.FieldSelector{FieldPath: "metadata.name"},
+	},
+	{
+		Name: "VEGETABLE",
+		ObjRef: types.Target{
+			Gvk:  resid.Gvk{Kind: "Leafy"},
+			Name: "kale"},
+		FieldRef: types.FieldSelector{FieldPath: "metadata.name"},
+	},
+}
+
+func TestGetAllVarsSimple(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+vars:
+  - name: AWARD
+    objref:
+      kind: Service
+      name: nobelPrize
+      apiVersion: v7
+    fieldref:
+      fieldpath: some.arbitrary.path
+  - name: BIRD
+    objref:
+      kind: Service
+      name: heron
+      apiVersion: v300
+`)
+	ra, err := th.MakeKustTarget().AccumulateTarget()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	vars := ra.Vars()
+	if len(vars) != 2 {
+		t.Fatalf("unexpected size %d", len(vars))
+	}
+	for i := range vars[:2] {
+		// By using Var.DeepEqual, we are protecting the code
+		// from a potential invocation of vars[i].ObjRef.GVK()
+		// during AccumulateTarget
+		if !vars[i].DeepEqual(someVars[i]) {
+			t.Fatalf("unexpected var[%d]:\n  %v\n  %v", i, vars[i], someVars[i])
+		}
+	}
+}
+
+func TestGetAllVarsNested(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlays/o2")
+	th.WriteK("/app/base", `
+vars:
+  - name: AWARD
+    objref:
+      kind: Service
+      name: nobelPrize
+      apiVersion: v7
+    fieldref:
+      fieldpath: some.arbitrary.path
+  - name: BIRD
+    objref:
+      kind: Service
+      name: heron
+      apiVersion: v300
+`)
+	th.WriteK("/app/overlays/o1", `
+vars:
+  - name: FRUIT
+    objref:
+      kind: Service
+      name: apple
+resources:
+- ../../base
+`)
+	th.WriteK("/app/overlays/o2", `
+vars:
+  - name: VEGETABLE
+    objref:
+      kind: Leafy
+      name: kale
+resources:
+- ../o1
+`)
+	ra, err := th.MakeKustTarget().AccumulateTarget()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	vars := ra.Vars()
+	if len(vars) != 4 {
+		for i, v := range vars {
+			fmt.Printf("%v: %v\n", i, v)
+		}
+		t.Fatalf("expected 4 vars, got %d", len(vars))
+	}
+	for i := range vars {
+		// By using Var.DeepEqual, we are protecting the code
+		// from a potential invocation of vars[i].ObjRef.GVK()
+		// during AccumulateTarget
+		if !vars[i].DeepEqual(someVars[i]) {
+			t.Fatalf("unexpected var[%d]:\n  %v\n  %v", i, vars[i], someVars[i])
+		}
+	}
+}
+
+func TestVarCollisionsForbidden(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlays/o2")
+	th.WriteK("/app/base", `
+vars:
+  - name: AWARD
+    objref:
+      kind: Service
+      name: nobelPrize
+      apiVersion: v7
+    fieldref:
+      fieldpath: some.arbitrary.path
+  - name: BIRD
+    objref:
+      kind: Service
+      name: heron
+      apiVersion: v300
+`)
+	th.WriteK("/app/overlays/o1", `
+vars:
+  - name: AWARD
+    objref:
+      kind: Service
+      name: academy
+resources:
+- ../../base
+`)
+	th.WriteK("/app/overlays/o2", `
+vars:
+  - name: VEGETABLE
+    objref:
+      kind: Leafy
+      name: kale
+resources:
+- ../o1
+`)
+	_, err := th.MakeKustTarget().AccumulateTarget()
+	if err == nil {
+		t.Fatalf("expected var collision")
+	}
+	if !strings.Contains(err.Error(),
+		"var 'AWARD' already encountered") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

api/internal/target/multiplepatch_test.go

@@ -0,0 +1,477 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func makeCommonFileForMultiplePatchTest(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: team-foo-
+commonLabels:
+  app: mynginx
+  org: example.com
+  team: foo
+commonAnnotations:
+  note: This is a test annotation
+resources:
+  - deployment.yaml
+  - service.yaml
+configMapGenerator:
+- name: configmap-in-base
+  literals:
+  - foo=bar
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+        volumeMounts:
+        - name: nginx-persistent-storage
+          mountPath: /tmp/ps
+      - name: sidecar
+        image: sidecar:latest
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: {}
+      - configMap:
+          name: configmap-in-base
+        name: configmap-in-base
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nginx
+`)
+	th.WriteK("/app/overlay/staging", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: staging-
+commonLabels:
+  env: staging
+patchesStrategicMerge:
+  - deployment-patch1.yaml
+  - deployment-patch2.yaml
+resources:
+  - ../../base
+configMapGenerator:
+- name: configmap-in-overlay
+  literals:
+  - hello=world
+`)
+}
+
+func TestMultiplePatchesNoConflict(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay/staging")
+	makeCommonFileForMultiplePatchTest(th)
+	th.WriteF("/app/overlay/staging/deployment-patch1.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:latest
+        env:
+        - name: ENVKEY
+          value: ENVVALUE
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: null
+        gcePersistentDisk:
+          pdName: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-overlay
+        name: configmap-in-overlay
+`)
+	th.WriteF("/app/overlay/staging/deployment-patch2.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        env:
+        - name: ANOTHERENV
+          value: FOO
+      volumes:
+      - name: nginx-persistent-storage
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-nginx
+spec:
+  selector:
+    matchLabels:
+      app: mynginx
+      env: staging
+      org: example.com
+      team: foo
+  template:
+    metadata:
+      annotations:
+        note: This is a test annotation
+      labels:
+        app: mynginx
+        env: staging
+        org: example.com
+        team: foo
+    spec:
+      containers:
+      - env:
+        - name: ANOTHERENV
+          value: FOO
+        - name: ENVKEY
+          value: ENVVALUE
+        image: nginx:latest
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      - image: sidecar:latest
+        name: sidecar
+      volumes:
+      - gcePersistentDisk:
+          pdName: nginx-persistent-storage
+        name: nginx-persistent-storage
+      - configMap:
+          name: staging-configmap-in-overlay-k7cbc75tg8
+        name: configmap-in-overlay
+      - configMap:
+          name: staging-team-foo-configmap-in-base-g7k6gt2889
+        name: configmap-in-base
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-nginx
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+---
+apiVersion: v1
+data:
+  foo: bar
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-configmap-in-base-g7k6gt2889
+---
+apiVersion: v1
+data:
+  hello: world
+kind: ConfigMap
+metadata:
+  labels:
+    env: staging
+  name: staging-configmap-in-overlay-k7cbc75tg8
+`)
+}
+
+func TestMultiplePatchesWithConflict(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay/staging")
+	makeCommonFileForMultiplePatchTest(th)
+	th.WriteF("/app/overlay/staging/deployment-patch1.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        env:
+        - name: ENABLE_FEATURE_FOO
+          value: TRUE
+      volumes:
+      - name: nginx-persistent-storage
+        emptyDir: null
+        gcePersistentDisk:
+          pdName: nginx-persistent-storage
+      - configMap:
+          name: configmap-in-overlay
+        name: configmap-in-overlay
+`)
+	th.WriteF("/app/overlay/staging/deployment-patch2.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        env:
+        - name: ENABLE_FEATURE_FOO
+          value: FALSE
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected conflict")
+	}
+	if !strings.Contains(
+		err.Error(), "conflict between ") {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+}
+
+func TestMultiplePatchesWithOnePatchDeleteDirective(t *testing.T) {
+	additivePatch := `apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        env:
+        - name: SOME_NAME
+          value: somevalue
+`
+	deletePatch := `apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - $patch: delete
+        name: sidecar
+`
+	cases := []struct {
+		name        string
+		patch1      string
+		patch2      string
+		expectError bool
+	}{
+		{
+			name:   "Patch with delete directive first",
+			patch1: deletePatch,
+			patch2: additivePatch,
+		},
+		{
+			name:   "Patch with delete directive second",
+			patch1: additivePatch,
+			patch2: deletePatch,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			th := kusttest_test.NewKustTestHarness(t, "/app/overlay/staging")
+
+			makeCommonFileForMultiplePatchTest(th)
+			th.WriteF("/app/overlay/staging/deployment-patch1.yaml", c.patch1)
+			th.WriteF("/app/overlay/staging/deployment-patch2.yaml", c.patch2)
+			m, err := th.MakeKustTarget().MakeCustomizedResMap()
+			if err != nil {
+				t.Fatalf("Err: %v", err)
+			}
+			th.AssertActualEqualsExpected(m, `apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-nginx
+spec:
+  selector:
+    matchLabels:
+      app: mynginx
+      env: staging
+      org: example.com
+      team: foo
+  template:
+    metadata:
+      annotations:
+        note: This is a test annotation
+      labels:
+        app: mynginx
+        env: staging
+        org: example.com
+        team: foo
+    spec:
+      containers:
+      - env:
+        - name: SOME_NAME
+          value: somevalue
+        image: nginx
+        name: nginx
+        volumeMounts:
+        - mountPath: /tmp/ps
+          name: nginx-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: nginx-persistent-storage
+      - configMap:
+          name: staging-team-foo-configmap-in-base-g7k6gt2889
+        name: configmap-in-base
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-nginx
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+---
+apiVersion: v1
+data:
+  foo: bar
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-configmap-in-base-g7k6gt2889
+---
+apiVersion: v1
+data:
+  hello: world
+kind: ConfigMap
+metadata:
+  labels:
+    env: staging
+  name: staging-configmap-in-overlay-k7cbc75tg8
+`)
+		})
+	}
+}
+
+func TestMultiplePatchesBothWithPatchDeleteDirective(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay/staging")
+	makeCommonFileForMultiplePatchTest(th)
+	th.WriteF("/app/overlay/staging/deployment-patch1.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - $patch: delete
+        name: sidecar
+`)
+	th.WriteF("/app/overlay/staging/deployment-patch2.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - $patch: delete
+        name: nginx
+`)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("Expected error")
+	}
+	if !strings.Contains(
+		err.Error(), "both containing ") {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	return
+}

api/internal/target/namespacedgenerators_test.go

@@ -0,0 +1,129 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestNamespacedGenerator(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+configMapGenerator:
+- name: the-non-default-namespace-map
+  namespace: non-default
+  literals:
+  - altGreeting=Good Morning from non-default namespace!
+  - enableRisky="false"
+- name: the-map
+  literals:
+  - altGreeting=Good Morning from default namespace!
+  - enableRisky="false"
+
+secretGenerator:
+- name: the-non-default-namespace-secret
+  namespace: non-default
+  literals:
+  - password.txt=verySecret
+- name: the-secret
+  literals:
+  - password.txt=anotherSecret
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  altGreeting: Good Morning from non-default namespace!
+  enableRisky: "false"
+kind: ConfigMap
+metadata:
+  name: the-non-default-namespace-map-b6h49k7mt8
+  namespace: non-default
+---
+apiVersion: v1
+data:
+  altGreeting: Good Morning from default namespace!
+  enableRisky: "false"
+kind: ConfigMap
+metadata:
+  name: the-map-4959m5tm6c
+---
+apiVersion: v1
+data:
+  password.txt: dmVyeVNlY3JldA==
+kind: Secret
+metadata:
+  name: the-non-default-namespace-secret-h8d9hkgtb9
+  namespace: non-default
+type: Opaque
+---
+apiVersion: v1
+data:
+  password.txt: YW5vdGhlclNlY3JldA==
+kind: Secret
+metadata:
+  name: the-secret-fgb45h45bh
+type: Opaque
+`)
+}
+
+func TestNamespacedGeneratorWithOverlays(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlay")
+	th.WriteK("/app/base", `
+namespace: base
+
+configMapGenerator:
+- name: testCase
+  literals:
+    - base=true
+`)
+	th.WriteK("/app/overlay", `
+resources:
+  - ../base
+
+namespace: overlay
+
+configMapGenerator:
+  - name: testCase
+    behavior: merge
+    literals:
+      - overlay=true
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  base: "true"
+  overlay: "true"
+kind: ConfigMap
+metadata:
+  annotations: {}
+  labels: {}
+  name: testCase-4g75kbk6gm
+  namespace: overlay
+`)
+}

api/internal/target/namespaces_test.go

@@ -0,0 +1,602 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestNamespacedSecrets(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+
+	th.WriteF("/app/secrets.yaml", `
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dummy
+  namespace: default
+type: Opaque
+data:
+  dummy: ""
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dummy
+  namespace: kube-system
+type: Opaque
+data:
+  dummy: ""
+`)
+
+	// This should find the proper secret.
+	th.WriteF("/app/role.yaml", `
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: dummy
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["dummy"]
+  verbs: ["get"]
+`)
+
+	th.WriteK("/app", `
+resources:
+- secrets.yaml
+- role.yaml
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	// This validates Fix #1444. This should not be an error anymore -
+	// the secrets have the same name but are in different namespaces.
+	// The ClusterRole (by def) is not in a namespace,
+	// an in this case applies to *any* Secret resource
+	// named "dummy"
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  dummy: ""
+kind: Secret
+metadata:
+  name: dummy
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  dummy: ""
+kind: Secret
+metadata:
+  name: dummy
+  namespace: kube-system
+type: Opaque
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dummy
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - dummy
+  resources:
+  - secrets
+  verbs:
+  - get
+`)
+}
+
+// TestNameAndNsTransformation validates that NamespaceTransformer,
+// PrefixSuffixTransformer and namereference transformers are
+// able to deal with simultaneous change of namespace and name.
+func TestNameAndNsTransformation(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/nameandns")
+
+	th.WriteK("/nameandns", `
+namePrefix: p1-
+nameSuffix: -s1
+namespace: newnamespace
+resources:
+- resources.yaml
+`)
+
+	th.WriteF("/nameandns/resources.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm2
+  namespace: ns1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: ns1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc2
+  namespace: ns1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sa1
+  namespace: ns1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sa2
+  namespace: ns1
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-rolebinding
+subjects:
+- kind: ServiceAccount
+  name: sa1
+  namespace: ns1
+- kind: ServiceAccount
+  name: sa2
+  namespace: ns1
+- kind: ServiceAccount
+  name: sa3
+  namespace: random
+- kind: ServiceAccount
+  name: default
+  namespace: irrelevant
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: example
+webhooks:
+  - name: example1
+    clientConfig:
+      service:
+        name: svc1
+        namespace: ns1
+  - name: example2
+    clientConfig:
+      service:
+        name: svc2
+        namespace: ns1
+  - name: example3
+    clientConfig:
+      service:
+        name: svc3
+        namespace: random
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: crds.my.org
+---
+kind: ClusterRole
+metadata:
+  name: cr1
+---
+kind: ClusterRoleBinding
+metadata:
+  name: crb1
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: irrelevant
+---
+kind: PersistentVolume
+metadata:
+  name: pv1
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: p1-cm1-s1
+  namespace: newnamespace
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: p1-cm2-s1
+  namespace: newnamespace
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: p1-svc1-s1
+  namespace: newnamespace
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: p1-svc2-s1
+  namespace: newnamespace
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: p1-sa1-s1
+  namespace: newnamespace
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: p1-sa2-s1
+  namespace: newnamespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: p1-manager-rolebinding-s1
+subjects:
+- kind: ServiceAccount
+  name: p1-sa1-s1
+  namespace: newnamespace
+- kind: ServiceAccount
+  name: p1-sa2-s1
+  namespace: newnamespace
+- kind: ServiceAccount
+  name: sa3
+  namespace: random
+- kind: ServiceAccount
+  name: default
+  namespace: newnamespace
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: p1-example-s1
+webhooks:
+- clientConfig:
+    service:
+      name: p1-svc1-s1
+      namespace: newnamespace
+  name: example1
+- clientConfig:
+    service:
+      name: p1-svc2-s1
+      namespace: newnamespace
+  name: example2
+- clientConfig:
+    service:
+      name: svc3
+      namespace: random
+  name: example3
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: crds.my.org
+---
+kind: ClusterRole
+metadata:
+  name: p1-cr1-s1
+---
+kind: ClusterRoleBinding
+metadata:
+  name: p1-crb1-s1
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: newnamespace
+---
+kind: PersistentVolume
+metadata:
+  name: p1-pv1-s1
+`)
+}
+
+// This serie of constants is used to prove the need of
+// the namespace field in the objref field of the var declaration.
+// The following tests demonstrate that it creates umbiguous variable
+// declaration if two entities of the kind with the same name
+// but in different namespaces are declared.
+// This is tracking the following issue:
+// https://github.com/kubernetes-sigs/kustomize/issues/1298
+const namespaceNeedInVarMyApp string = `
+resources:
+- elasticsearch-dev-service.yaml
+- elasticsearch-test-service.yaml
+vars:
+- name: elasticsearch-test-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-test-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+- name: elasticsearch-dev-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-dev-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+`
+
+const namespaceNeedInVarDevResources string = `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: elasticsearch
+  namespace: dev
+spec:
+  template:
+    spec:
+      containers:
+        - name: elasticsearch
+          env:
+            - name: DISCOVERY_SERVICE
+              value: "$(elasticsearch-dev-service-name).monitoring.svc.cluster.local"
+            - name: DISCOVERY_PROTOCOL
+              value: "$(elasticsearch-dev-protocol)"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: elasticsearch
+  namespace: dev
+spec:
+  ports:
+    - name: transport
+      port: 9300
+      protocol: TCP
+  clusterIP: None
+`
+
+const namespaceNeedInVarTestResources string = `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: elasticsearch
+  namespace: test
+spec:
+  template:
+    spec:
+      containers:
+        - name: elasticsearch
+          env:
+            - name: DISCOVERY_SERVICE
+              value: "$(elasticsearch-test-service-name).monitoring.svc.cluster.local"
+            - name: DISCOVERY_PROTOCOL
+              value: "$(elasticsearch-test-protocol)"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: elasticsearch
+  namespace: test
+spec:
+  ports:
+    - name: transport
+      port: 9300
+      protocol: UDP
+  clusterIP: None
+`
+
+const namespaceNeedInVarExpectedOutput string = `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: elasticsearch
+  namespace: dev
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: DISCOVERY_SERVICE
+          value: elasticsearch.monitoring.svc.cluster.local
+        - name: DISCOVERY_PROTOCOL
+          value: TCP
+        name: elasticsearch
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: elasticsearch
+  namespace: dev
+spec:
+  clusterIP: None
+  ports:
+  - name: transport
+    port: 9300
+    protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: elasticsearch
+  namespace: test
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: DISCOVERY_SERVICE
+          value: elasticsearch.monitoring.svc.cluster.local
+        - name: DISCOVERY_PROTOCOL
+          value: UDP
+        name: elasticsearch
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: elasticsearch
+  namespace: test
+spec:
+  clusterIP: None
+  ports:
+  - name: transport
+    port: 9300
+    protocol: UDP
+`
+
+// TestVariablesAmbiguous demonstrates how two variables pointing at two different resources
+// using the same name in different namespaces are treated as ambiguous if the namespace is
+// not specified
+func TestVariablesAmbiguous(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/namespaceNeedInVar/myapp")
+	th.WriteK("/namespaceNeedInVar/myapp", namespaceNeedInVarMyApp)
+	th.WriteF("/namespaceNeedInVar/myapp/elasticsearch-dev-service.yaml", namespaceNeedInVarDevResources)
+	th.WriteF("/namespaceNeedInVar/myapp/elasticsearch-test-service.yaml", namespaceNeedInVarTestResources)
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "unable to disambiguate") {
+		t.Fatalf("unexpected error %v", err)
+	}
+}
+
+const namespaceNeedInVarDevFolder string = `
+resources:
+- elasticsearch-dev-service.yaml
+vars:
+- name: elasticsearch-dev-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-dev-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+`
+
+const namespaceNeedInVarTestFolder string = `
+resources:
+- elasticsearch-test-service.yaml
+vars:
+- name: elasticsearch-test-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-test-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+`
+
+// TestVariablesAmbiguousWorkaround demonstrates a possible workaround
+// to TestVariablesAmbiguous problem. It requires to separate the variables
+// and resources into multiple kustomization context/folders instead of one.
+func TestVariablesAmbiguousWorkaround(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/namespaceNeedInVar/workaround")
+	th.WriteK("/namespaceNeedInVar/dev", namespaceNeedInVarDevFolder)
+	th.WriteF("/namespaceNeedInVar/dev/elasticsearch-dev-service.yaml", namespaceNeedInVarDevResources)
+	th.WriteK("/namespaceNeedInVar/test", namespaceNeedInVarTestFolder)
+	th.WriteF("/namespaceNeedInVar/test/elasticsearch-test-service.yaml", namespaceNeedInVarTestResources)
+	th.WriteK("/namespaceNeedInVar/workaround", `
+resources:
+- ../dev
+- ../test
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
+}
+
+const namespaceNeedInVarMyAppWithNamespace string = `
+resources:
+- elasticsearch-dev-service.yaml
+- elasticsearch-test-service.yaml
+vars:
+- name: elasticsearch-test-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    namespace: test
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-test-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    namespace: test
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+- name: elasticsearch-dev-service-name
+  objref:
+    kind: Service
+    name: elasticsearch
+    namespace: dev
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+- name: elasticsearch-dev-protocol
+  objref:
+    kind: Service
+    name: elasticsearch
+    namespace: dev
+    apiVersion: v1
+  fieldref:
+    fieldpath: spec.ports[0].protocol
+`
+
+// TestVariablesDisambiguatedWithNamespace demonstrates that adding the namespace
+// to the variable declarations allows to disambiguate the variables.
+func TestVariablesDisambiguatedWithNamespace(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/namespaceNeedInVar/myapp")
+	th.WriteK("/namespaceNeedInVar/myapp", namespaceNeedInVarMyAppWithNamespace)
+	th.WriteF("/namespaceNeedInVar/myapp/elasticsearch-dev-service.yaml", namespaceNeedInVarDevResources)
+	th.WriteF("/namespaceNeedInVar/myapp/elasticsearch-test-service.yaml", namespaceNeedInVarTestResources)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
+}

api/internal/target/nullvalues_test.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestNullValues(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: example
+  name: example
+spec:
+  selector:
+    matchLabels:
+      app: example
+  template:
+    metadata:
+      labels:
+        app: example
+    spec:
+      containers:
+      - args: null
+        image: image
+        name: example
+`)
+	th.WriteF("/app/kustomization.yaml", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- deployment.yaml
+`)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: example
+  name: example
+spec:
+  selector:
+    matchLabels:
+      app: example
+  template:
+    metadata:
+      labels:
+        app: example
+    spec:
+      containers:
+      - args: null
+        image: image
+        name: example
+`)
+}

api/internal/target/plugindir_test.go

@@ -0,0 +1,93 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	. "sigs.k8s.io/kustomize/api/internal/target"
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/k8sdeps/transformer"
+	"sigs.k8s.io/kustomize/api/konfig"
+	fLdr "sigs.k8s.io/kustomize/api/loader"
+	pLdr "sigs.k8s.io/kustomize/api/plugins/loader"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+)
+
+func TestPluginDir(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildExecPlugin(
+		"someteam.example.com", "v1", "PrintWorkDir")
+
+	base, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("err %v", err)
+	}
+	dir, err := ioutil.TempDir(base, "kustomize-")
+	if err != nil {
+		t.Fatalf("err %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	fSys := filesys.MakeFsOnDisk()
+	err = fSys.WriteFile(filepath.Join(dir, "kustomization.yaml"), []byte(`
+generators:
+- config.yaml
+`))
+	if err != nil {
+		t.Fatalf("err %v", err)
+	}
+	err = fSys.WriteFile(filepath.Join(dir, "config.yaml"), []byte(`
+apiVersion: someteam.example.com/v1
+kind: PrintWorkDir
+metadata:
+  name: some-random-name
+`))
+	if err != nil {
+		t.Fatalf("err %v", err)
+	}
+
+	ldr, err := fLdr.NewLoader(
+		fLdr.RestrictionRootOnly, dir, fSys)
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	rf := resmap.NewFactory(resource.NewFactory(
+		kunstruct.NewKunstructuredFactoryImpl()), nil)
+
+	c, err := konfig.EnabledPluginConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	pl := pLdr.NewLoader(c, rf)
+	tg, err := NewKustTarget(
+		ldr, valtest_test.MakeFakeValidator(), rf, transformer.NewFactoryImpl(), pl)
+	if err != nil {
+		t.Fatalf("err %v", err)
+	}
+
+	m, err := tg.MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+
+	th := kusttest_test.NewKustTestHarness(t, ".")
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: WorkDir
+metadata:
+  name: `+dir+`
+spec:
+  path: `+dir+`
+`)
+}

api/internal/target/pruneconfigmap_test.go

@@ -0,0 +1,179 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestPruneConfigMap(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+- service.yaml
+- secret.yaml
+
+inventory:
+  type: ConfigMap
+  configMap:
+    name: haha
+    namespace: default
+
+namePrefix: my-
+namespace: default
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: mysql
+  labels:
+    app: mysql
+spec:
+  selector:
+    matchLabels:
+      app: mysql
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: mysql
+    spec:
+      containers:
+      - image: mysql:5.6
+        name: mysql
+        env:
+        - name: MYSQL_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: pass
+              key: password
+        ports:
+        - containerPort: 3306
+          name: mysql
+        volumeMounts:
+        - name: mysql-persistent-storage
+          mountPath: /var/lib/mysql
+      volumes:
+      - name: mysql-persistent-storage
+        emptyDir: {}
+`)
+	th.WriteF("/app/base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: mmmysql
+  labels:
+    app: mysql
+spec:
+  ports:
+    - port: 3306
+  selector:
+    app: mysql
+`)
+	th.WriteF("/app/base/secret.yaml", `
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pass
+type: Opaque
+data:
+  # Default password is "admin".
+  password: YWRtaW4=
+  username: jingfang
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	//nolint
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  labels:
+    app: mysql
+  name: my-mysql
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: mysql
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: mysql
+    spec:
+      containers:
+      - env:
+        - name: MYSQL_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: my-pass
+        image: mysql:5.6
+        name: mysql
+        ports:
+        - containerPort: 3306
+          name: mysql
+        volumeMounts:
+        - mountPath: /var/lib/mysql
+          name: mysql-persistent-storage
+      volumes:
+      - emptyDir: {}
+        name: mysql-persistent-storage
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: mysql
+  name: my-mmmysql
+  namespace: default
+spec:
+  ports:
+  - port: 3306
+  selector:
+    app: mysql
+---
+apiVersion: v1
+data:
+  password: YWRtaW4=
+  username: jingfang
+kind: Secret
+metadata:
+  name: my-pass
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    kustomize.config.k8s.io/Inventory: '{"current":{"apps_v1beta2_Deployment|default|my-mysql":null,"~G_v1_Secret|default|my-pass":[{"group":"apps","version":"v1beta2","kind":"Deployment","name":"my-mysql","namespace":"default"}],"~G_v1_Service|default|my-mmmysql":null}}'
+    kustomize.config.k8s.io/InventoryHash: kd67f7ht8t
+  name: haha
+  namespace: default
+`)
+}

api/internal/target/resourceconflict_test.go

@@ -0,0 +1,380 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func writeBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- serviceaccount.yaml
+- rolebinding.yaml
+- clusterrolebinding.yaml
+- clusterrole.yaml
+namePrefix: pfx-
+nameSuffix: -sfx
+`)
+	th.WriteF("/app/base/serviceaccount.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: serviceaccount
+`)
+	th.WriteF("/app/base/rolebinding.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: role
+subjects:
+- kind: ServiceAccount
+  name: serviceaccount
+`)
+	th.WriteF("/app/base/clusterrolebinding.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: role
+subjects:
+- kind: ServiceAccount
+  name: serviceaccount
+`)
+	th.WriteF("/app/base/clusterrole.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: role
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list"]
+`)
+}
+
+func writeMidOverlays(th *kusttest_test.KustTestHarness) {
+	// Mid-level overlays
+	th.WriteK("/app/overlays/a", `
+resources:
+- ../../base
+namePrefix: a-
+nameSuffix: -suffixA
+`)
+	th.WriteK("/app/overlays/b", `
+resources:
+- ../../base
+namePrefix: b-
+nameSuffix: -suffixB
+`)
+}
+
+func writeTopOverlay(th *kusttest_test.KustTestHarness) {
+	// Top overlay, combining the mid-level overlays
+	th.WriteK("/app/combined", `
+resources:
+- ../overlays/a
+- ../overlays/b
+`)
+}
+
+func TestBase(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	writeBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pfx-serviceaccount-sfx
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: pfx-rolebinding-sfx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pfx-role-sfx
+subjects:
+- kind: ServiceAccount
+  name: pfx-serviceaccount-sfx
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: pfx-rolebinding-sfx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pfx-role-sfx
+subjects:
+- kind: ServiceAccount
+  name: pfx-serviceaccount-sfx
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pfx-role-sfx
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
+`)
+}
+
+func TestMidLevelA(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlays/a")
+	writeBase(th)
+	writeMidOverlays(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: a-pfx-rolebinding-sfx-suffixA
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: a-pfx-role-sfx-suffixA
+subjects:
+- kind: ServiceAccount
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: a-pfx-rolebinding-sfx-suffixA
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: a-pfx-role-sfx-suffixA
+subjects:
+- kind: ServiceAccount
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: a-pfx-role-sfx-suffixA
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
+`)
+}
+
+func TestMidLevelB(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/overlays/b")
+	writeBase(th)
+	writeMidOverlays(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: b-pfx-rolebinding-sfx-suffixB
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: b-pfx-role-sfx-suffixB
+subjects:
+- kind: ServiceAccount
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: b-pfx-rolebinding-sfx-suffixB
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: b-pfx-role-sfx-suffixB
+subjects:
+- kind: ServiceAccount
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: b-pfx-role-sfx-suffixB
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
+`)
+}
+
+func TestMultibasesNoConflict(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/combined")
+	writeBase(th)
+	writeMidOverlays(th)
+	writeTopOverlay(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Unexpected err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: a-pfx-rolebinding-sfx-suffixA
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: a-pfx-role-sfx-suffixA
+subjects:
+- kind: ServiceAccount
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: a-pfx-rolebinding-sfx-suffixA
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: a-pfx-role-sfx-suffixA
+subjects:
+- kind: ServiceAccount
+  name: a-pfx-serviceaccount-sfx-suffixA
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: a-pfx-role-sfx-suffixA
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: b-pfx-rolebinding-sfx-suffixB
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: b-pfx-role-sfx-suffixB
+subjects:
+- kind: ServiceAccount
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: b-pfx-rolebinding-sfx-suffixB
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: b-pfx-role-sfx-suffixB
+subjects:
+- kind: ServiceAccount
+  name: b-pfx-serviceaccount-sfx-suffixB
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: b-pfx-role-sfx-suffixB
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
+`)
+}
+
+func TestMultibasesWithConflict(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/combined")
+	writeBase(th)
+	writeMidOverlays(th)
+	writeTopOverlay(th)
+
+	th.WriteK("/app/overlays/a", `
+namePrefix: a-
+nameSuffix: -suffixA
+resources:
+- serviceaccount.yaml
+- ../../base
+`)
+	// Expect an error because this resource in the overlay
+	// matches a resource in the base.
+	th.WriteF("/app/overlays/a/serviceaccount.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: serviceaccount
+`)
+
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "multiple matches for ~G_v1_ServiceAccount|~X|serviceaccount") {
+		t.Fatalf("unexpected error %v", err)
+	}
+}

api/internal/target/transformerplugin_test.go

@@ -0,0 +1,236 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func writeDeployment(th *kusttest_test.KustTestHarness, path string) {
+	th.WriteF(path, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - name: whatever
+        image: whatever
+`)
+}
+
+func writeStringPrefixer(
+	th *kusttest_test.KustTestHarness, path, name string) {
+	th.WriteF(path, `
+apiVersion: someteam.example.com/v1
+kind: StringPrefixer
+metadata:
+  name: `+name+`
+`)
+}
+
+func writeDatePrefixer(
+	th *kusttest_test.KustTestHarness, path, name string) {
+	th.WriteF(path, `
+apiVersion: someteam.example.com/v1
+kind: DatePrefixer
+metadata:
+  name: `+name+`
+`)
+}
+
+func TestOrderedTransformers(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"someteam.example.com", "v1", "StringPrefixer")
+
+	tc.BuildGoPlugin(
+		"someteam.example.com", "v1", "DatePrefixer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app")
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+transformers:
+- peachPrefixer.yaml
+- date1Prefixer.yaml
+- applePrefixer.yaml
+- date2Prefixer.yaml
+`)
+	writeDeployment(th, "/app/deployment.yaml")
+	writeStringPrefixer(th, "/app/applePrefixer.yaml", "apple")
+	writeStringPrefixer(th, "/app/peachPrefixer.yaml", "peach")
+	writeDatePrefixer(th, "/app/date1Prefixer.yaml", "date1")
+	writeDatePrefixer(th, "/app/date2Prefixer.yaml", "date2")
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: 2018-05-11-apple-2018-05-11-peach-myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+`)
+}
+
+func TestPluginsNotEnabled(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"someteam.example.com", "v1", "StringPrefixer")
+
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	th.WriteK("/app", `
+transformers:
+- stringPrefixer.yaml
+`)
+	writeStringPrefixer(th, "/app/stringPrefixer.yaml", "apple")
+
+	_, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !types.IsErrOnlyBuiltinPluginsAllowed(err) {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestSedTransformer(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildExecPlugin(
+		"someteam.example.com", "v1", "SedTransformer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app")
+	th.WriteK("/app", `
+resources:
+- configmap.yaml
+
+transformers:
+- sed-transformer.yaml
+
+configMapGenerator:
+- name: test
+  literals:
+  - FOO=$FOO
+  - BAR=$BAR
+`)
+	th.WriteF("/app/sed-transformer.yaml", `
+apiVersion: someteam.example.com/v1
+kind: SedTransformer
+metadata:
+  name: some-random-name
+argsFromFile: sed-input.txt
+`)
+	th.WriteF("/app/sed-input.txt", `
+s/$FOO/foo/g
+s/$BAR/bar/g
+`)
+
+	th.WriteF("/app/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configmap-a
+  annotations:
+    kustomize.k8s.io/Generated: "false"
+data:
+  foo: $FOO
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  foo: foo
+kind: ConfigMap
+metadata:
+  annotations:
+    kustomize.k8s.io/Generated: "false"
+  name: configmap-a
+---
+apiVersion: v1
+data:
+  BAR: bar
+  FOO: foo
+kind: ConfigMap
+metadata:
+  name: test-k4bkhftttd
+`)
+}
+
+func TestTransformedTransformers(t *testing.T) {
+	tc := kusttest_test.NewPluginTestEnv(t).Set()
+	defer tc.Reset()
+
+	tc.BuildGoPlugin(
+		"someteam.example.com", "v1", "StringPrefixer")
+
+	tc.BuildGoPlugin(
+		"someteam.example.com", "v1", "DatePrefixer")
+
+	th := kusttest_test.NewKustTestHarnessAllowPlugins(t, "/app/overlay")
+
+	th.WriteK("/app/base", `
+resources:
+- stringPrefixer.yaml
+transformers:
+- datePrefixer.yaml
+`)
+	writeStringPrefixer(th, "/app/base/stringPrefixer.yaml", "apple")
+	writeDatePrefixer(th, "/app/base/datePrefixer.yaml", "date")
+
+	th.WriteK("/app/overlay", `
+resources:
+- deployment.yaml
+transformers:
+- ../base
+`)
+	writeDeployment(th, "/app/overlay/deployment.yaml")
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: 2018-05-11-apple-myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
+`)
+}

api/internal/target/transformersarrays_test.go

@@ -0,0 +1,182 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func makeStatefulSetKustomization(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app", `
+commonLabels:
+  notIn: arrays
+resources:
+- statefulset.yaml
+- statefulset-with-template.yaml
+`)
+	th.WriteF("/app/statefulset.yaml", `
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: test
+  labels:
+    notIn: arrays
+spec:
+  serviceName: test
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      containers:
+      - name: nginx
+        image: k8s.gcr.io/nginx-slim:0.8
+        ports:
+        - containerPort: 80
+          name: web
+`)
+	th.WriteF("/app/statefulset-with-template.yaml", `
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: persisted-test
+  labels:
+    notIn: arrays
+spec:
+  serviceName: test
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      containers:
+      - name: nginx
+        image: k8s.gcr.io/nginx-slim:0.8
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - name: www
+          mountPath: /usr/share/nginx/html
+        - name: data
+          mountPath: /usr/share/nginx/data
+  volumeClaimTemplates:
+  - metadata:
+      name: www
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: my-storage-class
+      resources:
+        requests:
+          storage: 1Gi
+  - metadata:
+      name: data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: my-storage-class
+      resources:
+        requests:
+          storage: 100Gi
+`)
+}
+
+func TestTransformersNoCreateArrays(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+	makeStatefulSetKustomization(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    notIn: arrays
+  name: test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+      notIn: arrays
+  serviceName: test
+  template:
+    metadata:
+      labels:
+        app: test
+        notIn: arrays
+    spec:
+      containers:
+      - image: k8s.gcr.io/nginx-slim:0.8
+        name: nginx
+        ports:
+        - containerPort: 80
+          name: web
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    notIn: arrays
+  name: persisted-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+      notIn: arrays
+  serviceName: test
+  template:
+    metadata:
+      labels:
+        app: test
+        notIn: arrays
+    spec:
+      containers:
+      - image: k8s.gcr.io/nginx-slim:0.8
+        name: nginx
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - mountPath: /usr/share/nginx/html
+          name: www
+        - mountPath: /usr/share/nginx/data
+          name: data
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        notIn: arrays
+      name: www
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 1Gi
+      storageClassName: my-storage-class
+  - metadata:
+      labels:
+        notIn: arrays
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 100Gi
+      storageClassName: my-storage-class
+`)
+}

api/internal/target/transformersimage_test.go

@@ -0,0 +1,424 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package target_test
+
+import (
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func makeTransfomersImageBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- deploy1.yaml
+- random.yaml
+images:
+- name: nginx
+  newTag: v2
+- name: my-nginx
+  newTag: previous
+- name: myprivaterepohostname:1234/my/image
+  newTag: v1.0.1
+- name: foobar
+  digest: sha256:24a0c4b4
+- name: alpine
+  newName: myprivaterepohostname:1234/my/cool-alpine
+- name: gcr.io:8080/my-project/my-cool-app
+  newName: my-cool-app
+- name: postgres
+  newName: my-postgres
+  newTag: v3
+- name: docker
+  newName: my-docker
+  digest: sha256:25a0d4b4
+`)
+	th.WriteF("/app/base/deploy1.yaml", `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: nginx2
+        image: my-nginx:1.8.0
+      - name: init-alpine
+        image: alpine:1.8.0
+      containers:
+      - name: ngnix
+        image: nginx:1.7.9
+      - name: repliaced-with-digest
+        image: foobar:1
+      - name: postgresdb
+        image: postgres:1.8.0
+`)
+	th.WriteF("/app/base/random.yaml", `
+kind: randomKind
+metadata:
+  name: random
+spec:
+  template:
+    spec:
+      containers:
+      - name: ngnix1
+        image: nginx
+spec2:
+  template:
+    spec:
+      containers:
+      - name: nginx3
+        image: nginx:v1
+      - name: nginx4
+        image: my-nginx:latest
+spec3:
+  template:
+    spec:
+      initContainers:
+      - name: postgresdb
+        image: postgres:alpine-9
+      - name: init-docker
+        image: docker:17-git
+      - name: myImage
+        image: myprivaterepohostname:1234/my/image:latest
+      - name: myImage2
+        image: myprivaterepohostname:1234/my/image
+      - name: my-app
+        image: my-app-image:v1
+      - name: my-cool-app
+        image: gcr.io:8080/my-project/my-cool-app:latest
+`)
+}
+
+func TestIssue1281_JsonPatchAndImageTag(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app")
+
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+
+images:
+- name: abbott
+  newTag: v2
+- name: costello
+  newTag: v8
+
+patchesJson6902:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: ben
+  path: patch.json
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ben
+spec:
+  template:
+    spec:
+      dnsPolicy: "None"
+      containers:
+      - name: awesome
+        image: abbott
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alice
+spec:
+  template:
+    spec:
+      containers:
+      - name: tomato
+        image: abbott
+`)
+
+	th.WriteF("/app/patch.json", `
+[ {"op": "add",
+   "path": "/spec/replica", "value": "3"},
+  {"op": "replace",
+   "path": "/spec/template/spec/containers/0",
+   "value": { "image": "costello" } } ]
+`)
+
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ben
+spec:
+  replica: "3"
+  template:
+    spec:
+      containers:
+      - image: costello:v8
+      dnsPolicy: None
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alice
+spec:
+  template:
+    spec:
+      containers:
+      - image: abbott:v2
+        name: tomato
+`)
+}
+
+func TestTransfomersImageDefaultConfig(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeTransfomersImageBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+group: apps
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:v2
+        name: ngnix
+      - image: foobar@sha256:24a0c4b4
+        name: repliaced-with-digest
+      - image: my-postgres:v3
+        name: postgresdb
+      initContainers:
+      - image: my-nginx:previous
+        name: nginx2
+      - image: myprivaterepohostname:1234/my/cool-alpine:1.8.0
+        name: init-alpine
+---
+kind: randomKind
+metadata:
+  name: random
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:v2
+        name: ngnix1
+spec2:
+  template:
+    spec:
+      containers:
+      - image: nginx:v2
+        name: nginx3
+      - image: my-nginx:previous
+        name: nginx4
+spec3:
+  template:
+    spec:
+      initContainers:
+      - image: my-postgres:v3
+        name: postgresdb
+      - image: my-docker@sha256:25a0d4b4
+        name: init-docker
+      - image: myprivaterepohostname:1234/my/image:v1.0.1
+        name: myImage
+      - image: myprivaterepohostname:1234/my/image:v1.0.1
+        name: myImage2
+      - image: my-app-image:v1
+        name: my-app
+      - image: my-cool-app:latest
+        name: my-cool-app
+`)
+}
+
+func makeTransfomersImageCustomBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- custom.yaml
+configurations:
+- config/custom.yaml
+images:
+- name: nginx
+  newTag: v2
+- name: my-nginx
+  newTag: previous
+- name: myprivaterepohostname:1234/my/image
+  newTag: v1.0.1
+- name: foobar
+  digest: sha256:24a0c4b4
+- name: alpine
+  newName: myprivaterepohostname:1234/my/cool-alpine
+- name: gcr.io:8080/my-project/my-cool-app
+  newName: my-cool-app
+- name: postgres
+  newName: my-postgres
+  newTag: v3
+- name: docker
+  newName: my-docker
+  digest: sha256:25a0d4b4
+`)
+	th.WriteF("/app/base/custom.yaml", `
+kind: customKind
+metadata:
+  name: custom
+spec:
+  template:
+    spec:
+      myContainers:
+      - name: ngnix1
+        image: nginx
+spec2:
+  template:
+    spec:
+      myContainers:
+      - name: nginx3
+        image: nginx:v1
+      - name: nginx4
+        image: my-nginx:latest
+spec3:
+  template:
+    spec:
+      myInitContainers:
+      - name: postgresdb
+        image: postgres:alpine-9
+      - name: init-docker
+        image: docker:17-git
+      - name: myImage
+        image: myprivaterepohostname:1234/my/image:latest
+      - name: myImage2
+        image: myprivaterepohostname:1234/my/image
+      - name: my-app
+        image: my-app-image:v1
+      - name: my-cool-app
+        image: gcr.io:8080/my-project/my-cool-app:latest
+`)
+	th.WriteF("/app/base/config/custom.yaml", `
+images:
+- kind: Custom
+  path: spec/template/spec/myContainers/image
+- kind: Custom
+  path: spec2/template/spec/myContainers/image
+- kind: Custom
+  path: spec3/template/spec/myInitContainers/image
+`)
+}
+func TestTransfomersImageCustomConfig(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeTransfomersImageCustomBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+kind: customKind
+metadata:
+  name: custom
+spec:
+  template:
+    spec:
+      myContainers:
+      - image: nginx
+        name: ngnix1
+spec2:
+  template:
+    spec:
+      myContainers:
+      - image: nginx:v1
+        name: nginx3
+      - image: my-nginx:latest
+        name: nginx4
+spec3:
+  template:
+    spec:
+      myInitContainers:
+      - image: postgres:alpine-9
+        name: postgresdb
+      - image: docker:17-git
+        name: init-docker
+      - image: myprivaterepohostname:1234/my/image:latest
+        name: myImage
+      - image: myprivaterepohostname:1234/my/image
+        name: myImage2
+      - image: my-app-image:v1
+        name: my-app
+      - image: gcr.io:8080/my-project/my-cool-app:latest
+        name: my-cool-app
+`)
+}
+
+func makeTransfomersImageKnativeBase(th *kusttest_test.KustTestHarness) {
+	th.WriteK("/app/base", `
+resources:
+- knative.yaml
+configurations:
+- config/knative.yaml
+images:
+- name: solsa-echo
+  newTag: foo
+`)
+	th.WriteF("/app/base/knative.yaml", `
+apiVersion: serving.knative.dev/v1alpha1
+kind: Service
+metadata:
+  name: echo
+spec:
+  runLatest:
+    configuration:
+      revisionTemplate:
+        spec:
+          container:
+            image: solsa-echo
+`)
+	th.WriteF("/app/base/config/knative.yaml", `
+images:
+- path: spec/runLatest/configuration/revisionTemplate/spec/container/image
+  apiVersion: serving.knative.dev/v1alpha1
+  kind: Service
+`)
+}
+
+func TestTransfomersImageKnativeConfig(t *testing.T) {
+	th := kusttest_test.NewKustTestHarness(t, "/app/base")
+	makeTransfomersImageKnativeBase(th)
+	m, err := th.MakeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.AssertActualEqualsExpected(m, `
+apiVersion: serving.knative.dev/v1alpha1
+kind: Service
+metadata:
+  name: echo
+spec:
+  runLatest:
+    configuration:
+      revisionTemplate:
+        spec:
+          container:
+            image: solsa-echo:foo
+`)
+}