From d54bc674f2c46be632b6755560a3a704a4f23813 Mon Sep 17 00:00:00 2001
From: Natasha Sarkar <natashasarkar@google.com>
Date: Mon, 11 Jan 2021 18:08:52 -0800
Subject: [PATCH] Update name references by checking both the original and
 current namespaces

---
 api/filters/nameref/nameref.go |  5 ++-
 api/krusty/namespaces_test.go  | 59 ++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/api/filters/nameref/nameref.go b/api/filters/nameref/nameref.go
index 543a7bed7..ef279498d 100644
--- a/api/filters/nameref/nameref.go
+++ b/api/filters/nameref/nameref.go
@@ -90,7 +90,10 @@ func (f Filter) setMapping(node *yaml.RNode) error {
 		namespace := namespaceNode.YNode().Value
 		bynamespace := f.ReferralCandidates.GroupedByOriginalNamespace()
 		if _, ok := bynamespace[namespace]; !ok {
-			return nil
+			bynamespace = f.ReferralCandidates.GroupedByCurrentNamespace()
+			if _, ok := bynamespace[namespace]; !ok {
+				return nil
+			}
 		}
 		subset = bynamespace[namespace]
 	}
diff --git a/api/krusty/namespaces_test.go b/api/krusty/namespaces_test.go
index e78514ba3..110d800c2 100644
--- a/api/krusty/namespaces_test.go
+++ b/api/krusty/namespaces_test.go
@@ -601,3 +601,62 @@ func TestVariablesDisambiguatedWithNamespace(t *testing.T) {
 	m := th.Run(".", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
 }
+
+// TestAddNamePrefixWithNamespace tests that adding a name prefix works within
+// namespaces other than the default namespace.
+// Test for issue #3430
+func TestAddNamePrefixWithNamespace(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("/app/serviceaccount.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prometheus
+`)
+
+	th.WriteF("/app/clusterrolebinding.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: prometheus
+  namespace: iter8-monitoring
+`)
+
+	th.WriteK("/app", `
+namePrefix: iter8-
+namespace: iter8-monitoring
+resources:
+- clusterrolebinding.yaml
+- serviceaccount.yaml
+`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: iter8-prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: iter8-prometheus
+  namespace: iter8-monitoring
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: iter8-prometheus
+  namespace: iter8-monitoring
+`)
+}