IsImageMatched interpolates the image name from kustomization images[].name
straight into a regexp and discarded the compile error. When the name is not
a valid regexp (for example "["), regexp.Compile returns a nil *Regexp and
the following MatchString call dereferences it, so kustomize build crashes with
a SIGSEGV.
Capture the compile error and return false when it is set. A name that can't
compile matches no image, which leaves the resource untouched (the same result
you get for any name that doesn't match). Adds a unit test for the invalid name
and a krusty end-to-end case that builds without panicking.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
* fix: match image digests with any algorithm, not only sha256
IsImageMatched hard-coded '@sha256:' in its regex, while Split accepts any
digest algorithm. An image pinned with a non-sha256 digest (e.g.
nginx@sha512:...) was not matched, so the ImageTagTransformer silently left
it unchanged and the user's images: override was ignored. Generalize the
digest algorithm in the regex to match what Split accepts.
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
* Address review: match OCI digest grammar and test spec example algorithms
Broaden the digest-algorithm match to the OCI grammar (algorithm components
separated by +._-), so multihash+base58 and other registered/unregistered
algorithms match, not just [a-zA-Z][a-zA-Z0-9]*. Add test cases using the
descriptor example algorithms: a full-length sha512 digest and
multihash+base58.
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
---------
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
Updates k8s.io/kube-openapi from v0.0.0-20241212222426-2c72e554b1e7 to
v0.0.0-20260502001324-b7f5293f4787 across api, kyaml, and kustomize modules,
then propagates the change across all workspace modules via make workspace-sync.
The new kube-openapi release switched from the monolithic go-openapi/swag
(v0.23.0) to the refactored split sub-modules (go-openapi/swag/* v0.25.4).
The old swag carried github.com/mailru/easyjson as a dependency; the new
sub-modules do not. After go mod tidy, easyjson and josharian/intern are
fully removed from all three module graphs.
Also upgraded: github.com/google/gnostic-models v0.6.9 → v0.7.0 (pulled
in by the same kube-openapi update).
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
* docs: document config.kubernetes.io/local-config annotation
Adds a Concepts page covering the three documented use cases:
Replacement data source, name-reference anchor across objects, and
KRM Function shared configuration. Cross-references the existing
manifest-annotations.md and the Kubernetes well-known annotations
page.
Signed-off-by: jawwad-ali <33836051+jawwad-ali@users.noreply.github.com>
* docs: drop implementation details and deprecated kustomize cfg note
Per koba1t review feedback on the local-config Concepts page:
implementation details (IsLocalConfig filter, DropLocalNodes helper,
source-file references) belong in the code rather than user docs, and
`kustomize cfg` is deprecated and should not be promoted to new users.
Removes the "How kustomize processes local-config resources" section.
Signed-off-by: jawwad-ali <33836051+jawwad-ali@users.noreply.github.com>
---------
Signed-off-by: jawwad-ali <33836051+jawwad-ali@users.noreply.github.com>
Add a new subcommand 'kustomize edit add configuration' to programmatically
add configuration file references to kustomization.yaml files.
This brings configurations support in line with other 'kustomize edit add'
subcommands (generators, transformers, validators).
Features:
- Support for single and multiple configuration file paths
- Glob pattern expansion (e.g., ./configs/*.yaml)
- Duplicate detection with user logging
- Idempotent operation
Related to https://github.com/kubernetes-sigs/kustomize/issues/5987
* Reject paths with inner '..' in FileLoader.New to prevent silent misresolution
* Refactor hasInnerDotDot to two-phase loop eliminating mutable state
* Narrow check to embedded '..' segments to allow legitimate winding paths
* Fix gofmt alignment and trailing whitespace in new test functions
* Fix pre-existing lint errors in fileloader_test.go
Delimiter options were ignored for replacements targeting
structured data. Reuse the same value setting function
as replacements targeting regular values.
