Merge pull request #4645 from natasha41575/pinToCmdConfig

Update cmd/config to v0.10.7

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+      interval: "weekly"

.github/workflows/go.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
 
   lint:
@@ -14,18 +17,21 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v3
       with:
         go-version: ^1.16
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
 
     - name: Lint
-      run: ./hack/kyaml-pre-commit.sh
-      env:
-        KUSTOMIZE_DOCKER_E2E: false # don't need to do e2e tests for linting
+      run: make lint
+
+    - name: Verify boilerplate
+      run: make check-license
 
   test-linux:
     name: Test Linux
@@ -33,7 +39,7 @@ jobs:
     steps:
 
       - name: Set up Go 1.x
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ^1.16
         id: go
@@ -41,17 +47,8 @@ jobs:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
 
-      - name: Test kyaml
-        run: go test -cover ./...
-        working-directory: ./kyaml
-
-      - name: Test api
-        run: go test -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
-        working-directory: ./api
-
-      - name: Test cmd/config
-        run: go test -cover ./...
-        working-directory: ./cmd/config
+      - name: Test all modules
+        run: make test-unit-non-plugin
         env:
           KUSTOMIZE_DOCKER_E2E: true
 
@@ -61,7 +58,7 @@ jobs:
     steps:
 
       - name: Set up Go 1.x
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ^1.16
         id: go
@@ -69,17 +66,8 @@ jobs:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
 
-      - name: Test kyaml
-        run: go test -cover ./...
-        working-directory: ./kyaml
-
-      - name: Test api
-        run: go test -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
-        working-directory: ./api
-
-      - name: Test cmd/config
-        run: go test -cover ./...
-        working-directory: ./cmd/config
+      - name: Test all modules
+        run: make test-unit-non-plugin
         env:
           KUSTOMIZE_DOCKER_E2E: false # docker not installed on mac
 
@@ -89,7 +77,7 @@ jobs:
     steps:
 
       - name: Set up Go 1.x
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ^1.16
         id: go
@@ -101,13 +89,14 @@ jobs:
         run: go test -cover ./...
         working-directory: ./kyaml
 
-      # TODO: uncomment once Windows tests are passing.
-      # - name: Test api
-      #   run: go test -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
-      #   working-directory: ./api
-
       - name: Test cmd/config
         run: go test -cover ./...
         working-directory: ./cmd/config
         env:
           KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet
+
+      # TODO (#4001): replace specific modules above with this once Windows tests are passing.
+      #- name: Test all modules
+      #  run: make test-unit-non-plugin
+      #  env:
+      #    KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet

.gitignore

@@ -23,6 +23,7 @@
 .bin
 
 # Hugo site
+publishedSite/
 site/public/
 site/resources/
 site/.hugo_build.lock

.golangci-kustomize.yml

@@ -1,50 +0,0 @@
-run:
-  deadline: 5m
-
-linters:
-  disable-all: true
-  enable:
-    - bodyclose
-    - deadcode
-    - depguard
-    # - dogsled
-    - dupl
-    # - errcheck
-    # - funlen
-    # - gochecknoinits
-    - goconst
-    # - gocritic
-    - gocyclo
-    - gofmt
-    - goimports
-    - golint
-    - gosec
-    - gosimple
-    - govet
-    - ineffassign
-    - interfacer
-    - lll
-    - misspell
-    - nakedret
-    # - scopelint
-    - staticcheck
-    - structcheck
-    # stylecheck demands that acronyms not be treated as words
-    # in camelCase, so JsonOp become JSONOp, etc.  Yuck.
-    # - stylecheck
-    - typecheck
-    - unconvert
-    - unparam
-    - unused
-    - varcheck
-    # - whitespace
-
-linters-settings:
-  dupl:
-    threshold: 400
-  lll:
-    line-length: 170
-  gocyclo:
-    min-complexity: 15
-  golint:
-    min-confidence: 0.85

.golangci.yml

@@ -0,0 +1,136 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+run:
+  deadline: 5m
+
+linters:
+  # please, do not use `enable-all`: it's deprecated and will be removed soon.
+  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
+  disable-all: true
+  enable:
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - contextcheck
+#    - cyclop
+    - deadcode
+    - depguard
+    - dogsled
+    - dupl
+    - durationcheck
+    - errcheck
+    - errname
+    - errorlint
+    - exhaustive
+#    - exhaustivestruct
+    - exportloopref
+#    - forbidigo
+    - forcetypeassert
+#    - funlen
+#    - gci
+    - gochecknoglobals
+    - gochecknoinits
+#    - gocognit
+    - goconst
+    - gocritic
+    - gocyclo
+#    - godot
+#    - godox
+    - goerr113
+    - gofmt
+#    - gofumpt
+    - goheader
+    - goimports
+    - gomnd
+    - gomoddirectives
+    - gomodguard
+    - goprintffuncname
+    - gosec
+    - gosimple
+    - govet
+#    - ifshort # too many false positives
+    - importas
+    - ineffassign
+#    - ireturn
+    - lll
+    - makezero
+    - misspell
+    - nakedret
+    - nestif
+    - nilerr
+#    - nilnil
+#    - nlreturn
+#    - noctx
+    - nolintlint
+#    - paralleltest
+    - prealloc
+    - predeclared
+    - promlinter
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - staticcheck
+    - structcheck
+#    - stylecheck
+    - tagliatelle
+    - tenv
+    - testpackage
+    - thelper
+    - tparallel
+    - typecheck
+    - unconvert
+    - unparam
+    - unused
+    - varcheck
+#    - varnamelen
+    - wastedassign
+    - whitespace
+    - wrapcheck
+#    - wsl
+
+linters-settings:
+  dupl:
+    threshold: 400
+  lll:
+    line-length: 170
+  gocyclo:
+    min-complexity: 30
+  revive:
+    rules:
+    - name: var-naming
+      arguments:
+      - [ "ID", "API", "JSON" ] # AllowList
+      - [ ] # DenyList
+  gomoddirectives:
+    replace-local: true
+  gosec:
+    config:
+      G306: "0644"
+  gomnd:
+     ignored-functions:
+     - ioutil.WriteFile
+  wrapcheck:
+    ignoreSigs:
+      # defaults
+      - .Errorf(
+      - errors.New(
+      - errors.Unwrap(
+      - .Wrap(
+      - .Wrapf(
+      - .WithMessage(
+      - .WithMessagef(
+      - .WithStack(
+      # from kyaml's errors package
+      - .WrapPrefixf(
+
+issues:
+  new-from-rev: c94b5d8f2 # enables us to enforce a larger set of linters for new code than pass on existing code
+  max-same-issues: 0
+  exclude-rules:
+    - linters:
+        - revive
+      text: "don't use leading"
+    - linters:
+        - staticcheck
+      text: "SA1019: kioutil.Legacy"

Makefile

@@ -3,6 +3,8 @@
 #
 # Makefile for kustomize CLI and API.
 
+LATEST_V4_RELEASE=v4.5.4
+
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)
 GOARCH = $(shell go env GOARCH)
@@ -11,8 +13,6 @@ ifeq ($(MYGOBIN),)
 MYGOBIN = $(shell go env GOPATH)/bin
 endif
 export PATH := $(MYGOBIN):$(PATH)
-MODULES := '"cmd/config" "api/" "kustomize/" "kyaml/"'
-LATEST_V4_RELEASE=v4.5.3
 
 # Provide defaults for REPO_OWNER and REPO_NAME if not present.
 # Typically these values would be provided by Prow.
@@ -24,48 +24,35 @@ ifndef REPO_NAME
 REPO_NAME := "kustomize"
 endif
 
-.PHONY: all
-all: install-tools verify-kustomize
 
-.PHONY: verify-kustomize
-verify-kustomize: \
-	lint-kustomize \
-	test-unit-kustomize-all \
-	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-v4-release
+# --- Plugins ---
+include Makefile-plugins.mk
 
-# The following target referenced by a file in
-# https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
-.PHONY: prow-presubmit-check
-prow-presubmit-check: \
-	install-tools \
-	lint-kustomize \
-	test-unit-kustomize-all \
-	test-unit-cmd-all \
-	test-go-mod \
-	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-v4-release
 
-.PHONY: verify-kustomize-e2e
-verify-kustomize-e2e: test-examples-e2e-kustomize
+# --- Tool management ---
+include Makefile-tools.mk
 
-# Other builds in this repo might want a different linter version.
-# Without one Makefile to rule them all, the different makes
-# cannot assume that golanci-lint is at the version they want.
-# This installs what kustomize wants to use.
-$(MYGOBIN)/golangci-lint-kustomize:
-	rm -f $(CURDIR)/hack/golangci-lint
-	GOBIN=$(CURDIR)/hack go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.23.8
-	mv $(CURDIR)/hack/golangci-lint $(MYGOBIN)/golangci-lint-kustomize
+.PHONY: install-tools
+install-tools: \
+	install-local-tools \
+	install-out-of-tree-tools
 
-$(MYGOBIN)/mdrip:
-	go install github.com/monopole/mdrip@v1.0.2
+.PHONY: uninstall-tools
+uninstall-tools: \
+	uninstall-local-tools \
+	uninstall-out-of-tree-tools
 
-$(MYGOBIN)/stringer:
-	go get golang.org/x/tools/cmd/stringer
+.PHONY: install-local-tools
+install-local-tools: \
+	$(MYGOBIN)/gorepomod \
+	$(MYGOBIN)/k8scopy \
+	$(MYGOBIN)/pluginator
 
-$(MYGOBIN)/goimports:
-	go get golang.org/x/tools/cmd/goimports
+.PHONY: uninstall-local-tools
+uninstall-local-tools:
+	rm -f $(MYGOBIN)/gorepomod
+	rm -f $(MYGOBIN)/k8scopy
+	rm -f $(MYGOBIN)/pluginator
 
 # Build from local source.
 $(MYGOBIN)/gorepomod:
@@ -82,173 +69,93 @@ $(MYGOBIN)/pluginator:
 	cd cmd/pluginator; \
 	go install .
 
+
+# --- Build targets ---
+
 # Build from local source.
 $(MYGOBIN)/kustomize: build-kustomize-api
 	cd kustomize; \
 	go install .
 
-.PHONY: install-tools
-install-tools: \
-	$(MYGOBIN)/goimports \
-	$(MYGOBIN)/golangci-lint-kustomize \
-	$(MYGOBIN)/gorepomod \
-	$(MYGOBIN)/helmV3 \
-	$(MYGOBIN)/k8scopy \
-	$(MYGOBIN)/mdrip \
-	$(MYGOBIN)/pluginator \
-	$(MYGOBIN)/stringer
-
-### Begin kustomize plugin rules.
-#
-# The rules to deal with builtin plugins are a bit
-# complicated because
-#
-# - Every builtin plugin is a Go plugin -
-#   meaning it gets its own module directory
-#   (outside of the api module) with Go
-#   code in a 'main' package per Go plugin rules.
-# - kustomize locates plugins using the
-#   'apiVersion' and 'kind' fields from the
-#   plugin config file.
-# - k8s wants CamelCase in 'kind' fields.
-# - The module name (the last name in the path)
-#   must be the lowercased 'kind' of the
-#   plugin because Go and related tools
-#   demand lowercase in import paths, but
-#   allow CamelCase in file names.
-# - the generated code must live in the api
-#   module (it's linked into the api).
-
-# Where all generated builtin plugin code should go.
-pGen=api/internal/builtins
-# Where the builtin Go plugin modules live.
-pSrc=plugin/builtin
-
-_builtinplugins = \
-	AnnotationsTransformer.go \
-	ConfigMapGenerator.go \
-	IAMPolicyGenerator.go \
-	HashTransformer.go \
-	ImageTagTransformer.go \
-	LabelTransformer.go \
-	LegacyOrderTransformer.go \
-	NamespaceTransformer.go \
-	PatchJson6902Transformer.go \
-	PatchStrategicMergeTransformer.go \
-	PatchTransformer.go \
-	PrefixTransformer.go \
-	SuffixTransformer.go \
-	ReplacementTransformer.go \
-	ReplicaCountTransformer.go \
-	SecretGenerator.go \
-	ValueAddTransformer.go \
-	HelmChartInflationGenerator.go
-
-# Maintaining this explicit list of generated files, and
-# adding it as a dependency to a few targets, to assure
-# they get recreated if deleted.  The rules below on how
-# to make them don't, by themselves, assure they will be
-# recreated if deleted.
-builtinplugins = $(patsubst %,$(pGen)/%,$(_builtinplugins))
-
-# These rules are verbose, but assure that if a source file
-# is modified, the corresponding generated file, and only
-# that file, will be recreated.
-$(pGen)/AnnotationsTransformer.go: $(pSrc)/annotationstransformer/AnnotationsTransformer.go
-$(pGen)/ConfigMapGenerator.go: $(pSrc)/configmapgenerator/ConfigMapGenerator.go
-$(pGen)/GkeSaGenerator.go: $(pSrc)/gkesagenerator/GkeSaGenerator.go
-$(pGen)/HashTransformer.go: $(pSrc)/hashtransformer/HashTransformer.go
-$(pGen)/ImageTagTransformer.go: $(pSrc)/imagetagtransformer/ImageTagTransformer.go
-$(pGen)/LabelTransformer.go: $(pSrc)/labeltransformer/LabelTransformer.go
-$(pGen)/LegacyOrderTransformer.go: $(pSrc)/legacyordertransformer/LegacyOrderTransformer.go
-$(pGen)/NamespaceTransformer.go: $(pSrc)/namespacetransformer/NamespaceTransformer.go
-$(pGen)/PatchJson6902Transformer.go: $(pSrc)/patchjson6902transformer/PatchJson6902Transformer.go
-$(pGen)/PatchStrategicMergeTransformer.go: $(pSrc)/patchstrategicmergetransformer/PatchStrategicMergeTransformer.go
-$(pGen)/PatchTransformer.go: $(pSrc)/patchtransformer/PatchTransformer.go
-$(pGen)/PrefixTransformer.go: $(pSrc)/prefixtransformer/PrefixTransformer.go
-$(pGen)/SuffixTransformer.go: $(pSrc)/suffixtransformer/SuffixTransformer.go
-$(pGen)/ReplacementTransformer.go: $(pSrc)/replacementtransformer/ReplacementTransformer.go
-$(pGen)/ReplicaCountTransformer.go: $(pSrc)/replicacounttransformer/ReplicaCountTransformer.go
-$(pGen)/SecretGenerator.go: $(pSrc)/secretgenerator/SecretGenerator.go
-$(pGen)/ValueAddTransformer.go: $(pSrc)/valueaddtransformer/ValueAddTransformer.go
-$(pGen)/HelmChartInflationGenerator.go: $(pSrc)/helmchartinflationgenerator/HelmChartInflationGenerator.go
-
-# The (verbose but portable) Makefile way to convert to lowercase.
-toLowerCase = $(subst A,a,$(subst B,b,$(subst C,c,$(subst D,d,$(subst E,e,$(subst F,f,$(subst G,g,$(subst H,h,$(subst I,i,$(subst J,j,$(subst K,k,$(subst L,l,$(subst M,m,$(subst N,n,$(subst O,o,$(subst P,p,$(subst Q,q,$(subst R,r,$(subst S,s,$(subst T,t,$(subst U,u,$(subst V,v,$(subst W,w,$(subst X,x,$(subst Y,y,$(subst Z,z,$1))))))))))))))))))))))))))
-
-$(pGen)/%.go: $(MYGOBIN)/pluginator
-	@echo "generating $*"
-	( \
-		set -e; \
-		cd $(pSrc)/$(call toLowerCase,$*); \
-		go generate .; \
-		cd ../../../$(pGen); \
-		$(MYGOBIN)/goimports -w $*.go \
-	)
-
-# Target is for debugging.
-.PHONY: generate-kustomize-builtin-plugins
-generate-kustomize-builtin-plugins: $(builtinplugins)
-
-.PHONY: build-kustomize-external-go-plugin
-build-kustomize-external-go-plugin:
-	./hack/buildExternalGoPlugins.sh ./plugin
-
-.PHONY: clean-kustomize-external-go-plugin
-clean-kustomize-external-go-plugin:
-	./hack/buildExternalGoPlugins.sh ./plugin clean
-
-### End kustomize plugin rules.
-
-.PHONY: lint-kustomize
-lint-kustomize: $(MYGOBIN)/golangci-lint-kustomize $(builtinplugins)
-	cd api; $(MYGOBIN)/golangci-lint-kustomize \
-	  -c ../.golangci-kustomize.yml \
-	  run ./...
-	cd kustomize; $(MYGOBIN)/golangci-lint-kustomize \
-	  -c ../.golangci-kustomize.yml \
-	  run ./...
-	cd cmd/pluginator; $(MYGOBIN)/golangci-lint-kustomize \
-	  -c ../../.golangci-kustomize.yml \
-	  run ./...
+kustomize: $(MYGOBIN)/kustomize
 
 # Used to add non-default compilation flags when experimenting with
 # plugin-to-api compatibility checks.
 .PHONY: build-kustomize-api
-build-kustomize-api: $(builtinplugins)
-	cd api; go build ./...
+build-kustomize-api: $(MYGOBIN)/goimports $(builtinplugins)
+	cd api; $(MAKE) build
 
 .PHONY: generate-kustomize-api
-generate-kustomize-api: $(MYGOBIN)/k8scopy
-	cd api; go generate ./...
+generate-kustomize-api:
+	cd api; $(MAKE) generate
 
-.PHONY: test-unit-kustomize-api
-test-unit-kustomize-api: build-kustomize-api
-	cd api; go test ./...  -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
-	cd api/krusty; OPENAPI_TEST=true go test -run TestCustomOpenAPIFieldFromComponentWithOverlays
+
+# --- Verification targets ---
+.PHONY: verify-kustomize-repo
+verify-kustomize-repo: \
+	install-tools \
+	lint \
+	check-license \
+	test-unit-all \
+	build-non-plugin-all \
+	test-go-mod \
+	test-examples-kustomize-against-HEAD \
+	test-examples-kustomize-against-v4-release
+
+# The following target referenced by a file in
+# https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
+.PHONY: prow-presubmit-check
+prow-presubmit-check: \
+	install-tools \
+	test-unit-kustomize-plugins \
+	test-go-mod \
+	build-non-plugin-all \
+	test-examples-kustomize-against-HEAD \
+	test-examples-kustomize-against-v4-release
+
+.PHONY: license
+license: $(MYGOBIN)/addlicense
+	./hack/add-license.sh run
+
+.PHONY: check-license
+check-license: $(MYGOBIN)/addlicense
+	./hack/add-license.sh check
+
+.PHONY: lint
+lint: $(MYGOBIN)/golangci-lint $(MYGOBIN)/goimports $(builtinplugins)
+	./hack/for-each-module.sh "make lint"
+
+.PHONY: test-unit-all
+test-unit-all: \
+	test-unit-non-plugin \
+	test-unit-kustomize-plugins
+
+# This target is used by our Github Actions CI to run unit tests for all non-plugin modules in multiple GOOS environments.
+.PHONY: test-unit-non-plugin
+test-unit-non-plugin:
+	./hack/for-each-module.sh "make test" "./plugin/*" 15
+
+.PHONY: build-non-plugin-all
+build-non-plugin-all:
+	./hack/for-each-module.sh "make build" "./plugin/*" 15
 
 .PHONY: test-unit-kustomize-plugins
 test-unit-kustomize-plugins:
 	./hack/testUnitKustomizePlugins.sh
 
-.PHONY: test-unit-kustomize-cli
-test-unit-kustomize-cli:
-	cd kustomize; go test ./...
-
-.PHONY: test-unit-kustomize-all
-test-unit-kustomize-all: \
-	test-unit-kustomize-api \
-	test-unit-kustomize-cli \
-	test-unit-kustomize-plugins
-
-test-unit-cmd-all:
-	./hack/kyaml-pre-commit.sh
+.PHONY: functions-examples-all
+functions-examples-all:
+	for dir in $(abspath $(wildcard functions/examples/*/.)); do \
+		echo -e "\n---Running make tasks for function $$dir---"; \
+		set -e; \
+		cd $$dir; $(MAKE) all; \
+	done
 
 test-go-mod:
-	./hack/check-go-mod.sh
+	./hack/for-each-module.sh "go list -m -json all > /dev/null && go mod tidy -v"
 
 .PHONY:
-test-examples-e2e-kustomize: $(MYGOBIN)/mdrip $(MYGOBIN)/kind
+verify-kustomize-e2e: $(MYGOBIN)/mdrip $(MYGOBIN)/kind
 	( \
 		set -e; \
 		/bin/rm -f $(MYGOBIN)/kustomize; \
@@ -265,85 +172,13 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 test-examples-kustomize-against-v4-release: $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh v4@$(LATEST_V4_RELEASE)
 
-# linux only.
-# This is for testing an example plugin that
-# uses kubeval for validation.
-# Don't want to add a hard dependence in go.mod file
-# to github.com/instrumenta/kubeval.
-# Instead, download the binary.
-$(MYGOBIN)/kubeval:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		wget https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-$(GOOS)-$(GOARCH).tar.gz; \
-		tar xf kubeval-$(GOOS)-$(GOARCH).tar.gz; \
-		mv kubeval $(MYGOBIN); \
-		rm -rf $$d; \
-	)
-
-# linux only.
-# This is for testing an example plugin that uses helm to inflate a chart
-# for subsequent kustomization.
-# Don't want to add a hard dependence in go.mod file to helm.
-# Instead, download the binaries.
-$(MYGOBIN)/helmV2:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=helm-v2.13.1-$(GOOS)-$(GOARCH).tar.gz; \
-		wget https://storage.googleapis.com/kubernetes-helm/$$tgzFile; \
-		tar -xvzf $$tgzFile; \
-		mv $(GOOS)-$(GOARCH)/helm $(MYGOBIN)/helmV2; \
-		rm -rf $$d \
-	)
-
-# Helm V3 differs from helm V2; downloading it to provide coverage for the
-# chart inflator plugin under helm v3.
-$(MYGOBIN)/helmV3:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=helm-v3.6.3-$(GOOS)-$(GOARCH).tar.gz; \
-		wget https://get.helm.sh/$$tgzFile; \
-		tar -xvzf $$tgzFile; \
-		mv $(GOOS)-$(GOARCH)/helm $(MYGOBIN)/helmV3; \
-		rm -rf $$d \
-	)
-
-$(MYGOBIN)/kind:
-	( \
-        set -e; \
-        d=$(shell mktemp -d); cd $$d; \
-        wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-$(GOOS)-$(GOARCH); \
-        chmod +x ./kind; \
-        mv ./kind $(MYGOBIN); \
-        rm -rf $$d; \
-	)
-
-# linux only.
-$(MYGOBIN)/gh:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=gh_1.0.0_$(GOOS)_$(GOARCH).tar.gz; \
-		wget https://github.com/cli/cli/releases/download/v1.0.0/$$tgzFile; \
-		tar -xvzf $$tgzFile; \
-		mv gh_1.0.0_$(GOOS)_$(GOARCH)/bin/gh  $(MYGOBIN)/gh; \
-		rm -rf $$d \
-	)
 
+# --- Cleanup targets ---
 .PHONY: clean
-clean: clean-kustomize-external-go-plugin
+clean: clean-kustomize-external-go-plugin uninstall-tools
 	go clean --cache
 	rm -f $(builtinplugins)
-	rm -f $(MYGOBIN)/goimports
-	rm -f $(MYGOBIN)/golangci-lint-kustomize
 	rm -f $(MYGOBIN)/kustomize
-	rm -f $(MYGOBIN)/mdrip
-	rm -f $(MYGOBIN)/stringer
-
-# Handle pluginator manually.
-# rm -f $(MYGOBIN)/pluginator
 
 # Nuke the site from orbit.  It's the only way to be sure.
 .PHONY: nuke

Makefile-modules.mk

@@ -0,0 +1,38 @@
+# Copyright 2022 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+MYGOBIN = $(shell go env GOBIN)
+ifeq ($(MYGOBIN),)
+MYGOBIN = $(shell go env GOPATH)/bin
+endif
+export PATH := $(MYGOBIN):$(PATH)
+
+# only set this if not already set, so importing makefiles can override it
+export KUSTOMIZE_ROOT ?= $(shell pwd | sed -E 's|(.*\/kustomize)/(.*)|\1|')
+include $(KUSTOMIZE_ROOT)/Makefile-tools.mk
+
+.PHONY: lint test fix fmt tidy vet build
+
+lint: $(MYGOBIN)/golangci-lint
+	$(MYGOBIN)/golangci-lint \
+	  -c $$KUSTOMIZE_ROOT/.golangci.yml \
+	  --path-prefix $(shell pwd | sed -E 's|(.*\/kustomize)/(.*)|\2|') \
+	  run ./...
+
+test:
+	go test -v -timeout 45m -cover ./...
+
+fix:
+	go fix ./...
+
+fmt:
+	go fmt ./...
+
+tidy:
+	go mod tidy
+
+vet:
+	go vet ./...
+
+build:
+	go build -v -o $(MYGOBIN) ./...

Makefile-plugins.mk

@@ -0,0 +1,102 @@
+# Copyright 2022 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+### Kustomize plugin rules.
+#
+# The rules to deal with builtin plugins are a bit
+# complicated because
+#
+# - Every builtin plugin is a Go plugin -
+#   meaning it gets its own module directory
+#   (outside of the api module) with Go
+#   code in a 'main' package per Go plugin rules.
+# - kustomize locates plugins using the
+#   'apiVersion' and 'kind' fields from the
+#   plugin config file.
+# - k8s wants CamelCase in 'kind' fields.
+# - The module name (the last name in the path)
+#   must be the lowercased 'kind' of the
+#   plugin because Go and related tools
+#   demand lowercase in import paths, but
+#   allow CamelCase in file names.
+# - the generated code must live in the api
+#   module (it's linked into the api).
+
+# Where all generated builtin plugin code should go.
+pGen=api/internal/builtins
+# Where the builtin Go plugin modules live.
+pSrc=plugin/builtin
+
+_builtinplugins = \
+	AnnotationsTransformer.go \
+	ConfigMapGenerator.go \
+	IAMPolicyGenerator.go \
+	HashTransformer.go \
+	ImageTagTransformer.go \
+	LabelTransformer.go \
+	LegacyOrderTransformer.go \
+	NamespaceTransformer.go \
+	PatchJson6902Transformer.go \
+	PatchStrategicMergeTransformer.go \
+	PatchTransformer.go \
+	PrefixTransformer.go \
+	SuffixTransformer.go \
+	ReplacementTransformer.go \
+	ReplicaCountTransformer.go \
+	SecretGenerator.go \
+	ValueAddTransformer.go \
+	HelmChartInflationGenerator.go
+
+# Maintaining this explicit list of generated files, and
+# adding it as a dependency to a few targets, to assure
+# they get recreated if deleted.  The rules below on how
+# to make them don't, by themselves, assure they will be
+# recreated if deleted.
+builtinplugins = $(patsubst %,$(pGen)/%,$(_builtinplugins))
+
+# These rules are verbose, but assure that if a source file
+# is modified, the corresponding generated file, and only
+# that file, will be recreated.
+$(pGen)/AnnotationsTransformer.go: $(pSrc)/annotationstransformer/AnnotationsTransformer.go
+$(pGen)/ConfigMapGenerator.go: $(pSrc)/configmapgenerator/ConfigMapGenerator.go
+$(pGen)/GkeSaGenerator.go: $(pSrc)/gkesagenerator/GkeSaGenerator.go
+$(pGen)/HashTransformer.go: $(pSrc)/hashtransformer/HashTransformer.go
+$(pGen)/ImageTagTransformer.go: $(pSrc)/imagetagtransformer/ImageTagTransformer.go
+$(pGen)/LabelTransformer.go: $(pSrc)/labeltransformer/LabelTransformer.go
+$(pGen)/LegacyOrderTransformer.go: $(pSrc)/legacyordertransformer/LegacyOrderTransformer.go
+$(pGen)/NamespaceTransformer.go: $(pSrc)/namespacetransformer/NamespaceTransformer.go
+$(pGen)/PatchJson6902Transformer.go: $(pSrc)/patchjson6902transformer/PatchJson6902Transformer.go
+$(pGen)/PatchStrategicMergeTransformer.go: $(pSrc)/patchstrategicmergetransformer/PatchStrategicMergeTransformer.go
+$(pGen)/PatchTransformer.go: $(pSrc)/patchtransformer/PatchTransformer.go
+$(pGen)/PrefixTransformer.go: $(pSrc)/prefixtransformer/PrefixTransformer.go
+$(pGen)/SuffixTransformer.go: $(pSrc)/suffixtransformer/SuffixTransformer.go
+$(pGen)/ReplacementTransformer.go: $(pSrc)/replacementtransformer/ReplacementTransformer.go
+$(pGen)/ReplicaCountTransformer.go: $(pSrc)/replicacounttransformer/ReplicaCountTransformer.go
+$(pGen)/SecretGenerator.go: $(pSrc)/secretgenerator/SecretGenerator.go
+$(pGen)/ValueAddTransformer.go: $(pSrc)/valueaddtransformer/ValueAddTransformer.go
+$(pGen)/HelmChartInflationGenerator.go: $(pSrc)/helmchartinflationgenerator/HelmChartInflationGenerator.go
+
+# The (verbose but portable) Makefile way to convert to lowercase.
+toLowerCase = $(subst A,a,$(subst B,b,$(subst C,c,$(subst D,d,$(subst E,e,$(subst F,f,$(subst G,g,$(subst H,h,$(subst I,i,$(subst J,j,$(subst K,k,$(subst L,l,$(subst M,m,$(subst N,n,$(subst O,o,$(subst P,p,$(subst Q,q,$(subst R,r,$(subst S,s,$(subst T,t,$(subst U,u,$(subst V,v,$(subst W,w,$(subst X,x,$(subst Y,y,$(subst Z,z,$1))))))))))))))))))))))))))
+
+$(pGen)/%.go: $(MYGOBIN)/pluginator
+	@echo "generating $*"
+	( \
+		set -e; \
+		cd $(pSrc)/$(call toLowerCase,$*); \
+		go generate .; \
+		cd ../../../$(pGen); \
+		$(MYGOBIN)/goimports -w $*.go \
+	)
+
+# Target is for debugging.
+.PHONY: generate-kustomize-builtin-plugins
+generate-kustomize-builtin-plugins: $(builtinplugins)
+
+.PHONY: build-kustomize-external-go-plugin
+build-kustomize-external-go-plugin:
+	./hack/buildExternalGoPlugins.sh ./plugin
+
+.PHONY: clean-kustomize-external-go-plugin
+clean-kustomize-external-go-plugin:
+	./hack/buildExternalGoPlugins.sh ./plugin clean

Makefile-tools.mk

@@ -0,0 +1,100 @@
+# Copyright 2022 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+MYGOBIN = $(shell go env GOBIN)
+ifeq ($(MYGOBIN),)
+MYGOBIN = $(shell go env GOPATH)/bin
+endif
+export PATH := $(MYGOBIN):$(PATH)
+
+.PHONY: install-out-of-tree-tools
+install-out-of-tree-tools: \
+	$(MYGOBIN)/goimports \
+	$(MYGOBIN)/golangci-lint \
+	$(MYGOBIN)/helmV3 \
+	$(MYGOBIN)/mdrip \
+	$(MYGOBIN)/stringer \
+	$(MYGOBIN)/goimports
+
+.PHONY: uninstall-out-of-tree-tools
+uninstall-out-of-tree-tools:
+	rm -f $(MYGOBIN)/goimports
+	rm -f $(MYGOBIN)/golangci-lint
+	rm -f $(MYGOBIN)/helmV3
+	rm -f $(MYGOBIN)/mdrip
+	rm -f $(MYGOBIN)/stringer
+
+$(MYGOBIN)/golangci-lint:
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.45.2
+
+$(MYGOBIN)/mdrip:
+	go install github.com/monopole/mdrip@v1.0.2
+
+$(MYGOBIN)/stringer:
+	go install golang.org/x/tools/cmd/stringer@latest
+
+$(MYGOBIN)/goimports:
+	go install golang.org/x/tools/cmd/goimports@latest
+
+$(MYGOBIN)/mdtogo:
+	go install sigs.k8s.io/kustomize/cmd/mdtogo@latest
+
+$(MYGOBIN)/addlicense:
+	go install github.com/google/addlicense@latest
+
+$(MYGOBIN)/statik:
+	go install github.com/rakyll/statik@latest
+
+$(MYGOBIN)/goreleaser:
+	go install github.com/goreleaser/goreleaser@v0.179.0 # https://github.com/kubernetes-sigs/kustomize/issues/4542
+
+$(MYGOBIN)/kind:
+	( \
+        set -e; \
+        d=$(shell mktemp -d); cd $$d; \
+        wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-$(GOOS)-$(GOARCH); \
+        chmod +x ./kind; \
+        mv ./kind $(MYGOBIN); \
+        rm -rf $$d; \
+	)
+
+# linux only.
+$(MYGOBIN)/gh:
+	( \
+		set -e; \
+		d=$(shell mktemp -d); cd $$d; \
+		tgzFile=gh_1.0.0_$(GOOS)_$(GOARCH).tar.gz; \
+		wget https://github.com/cli/cli/releases/download/v1.0.0/$$tgzFile; \
+		tar -xvzf $$tgzFile; \
+		mv gh_1.0.0_$(GOOS)_$(GOARCH)/bin/gh  $(MYGOBIN)/gh; \
+		rm -rf $$d \
+	)
+
+# linux only.
+# This is for testing an example plugin that
+# uses kubeval for validation.
+# Don't want to add a hard dependence in go.mod file
+# to github.com/instrumenta/kubeval.
+# Instead, download the binary.
+$(MYGOBIN)/kubeval:
+	( \
+		set -e; \
+		d=$(shell mktemp -d); cd $$d; \
+		wget https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-$(GOOS)-$(GOARCH).tar.gz; \
+		tar xf kubeval-$(GOOS)-$(GOARCH).tar.gz; \
+		mv kubeval $(MYGOBIN); \
+		rm -rf $$d; \
+	)
+
+# Helm V3 differs from helm V2; downloading it to provide coverage for the
+# chart inflator plugin under helm v3.
+$(MYGOBIN)/helmV3:
+	( \
+		set -e; \
+		d=$(shell mktemp -d); cd $$d; \
+		tgzFile=helm-v3.6.3-$(GOOS)-$(GOARCH).tar.gz; \
+		wget https://get.helm.sh/$$tgzFile; \
+		tar -xvzf $$tgzFile; \
+		mv $(GOOS)-$(GOARCH)/helm $(MYGOBIN)/helmV3; \
+		rm -rf $$d \
+	)

api/Makefile

@@ -0,0 +1,14 @@
+# Copyright 2022 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+include ../Makefile-modules.mk
+
+test:
+	go test -v -timeout 45m -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
+	cd krusty/openapitests; OPENAPI_TEST=true go test -v -timeout 45m -p 1 -cover ./...
+
+build:
+	go build -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222" ./...
+
+generate: $(MYGOBIN)/k8scopy $(MYGOBIN)/stringer
+	go generate ./...

api/filters/annotations/annotations_test.go

@@ -285,7 +285,7 @@ spec:
 		t.Run(tn, func(t *testing.T) {
 			filter := tc.filter
 			filter.WithMutationTracker(tc.setEntryCallback)
-			filter.FsSlice = append(annosFs, tc.fsslice...)
+			filter.FsSlice = append(annosFs, tc.fsslice...) //nolint:gocritic
 			if !assert.Equal(t,
 				strings.TrimSpace(tc.expectedOutput),
 				strings.TrimSpace(filtertest_test.RunFilter(t, tc.input, filter))) {

api/filters/doc.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package filters
 
 // Package filters collects various implementations

api/filters/fieldspec/fieldspec.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
-	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/resid"
+	"sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 

api/filters/filtersutil/setters.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package filtersutil
 
 import (

api/filters/iampolicygenerator/doc.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 // Package gkesagenerator contains a kio.Filter that that generates a
 // iampolicy-related resources for a given cloud provider
 package iampolicygenerator

api/filters/iampolicygenerator/iampolicygenerator.go

@@ -43,7 +43,7 @@ metadata:
 		f.IAMPolicyGenerator.KubernetesService.Name)
 
 	if f.IAMPolicyGenerator.Namespace != "" {
-		input = input + fmt.Sprintf("\n  namespace: %s", f.IAMPolicyGenerator.Namespace)
+		input += fmt.Sprintf("\n  namespace: %s", f.IAMPolicyGenerator.Namespace)
 	}
 
 	sa, err := yaml.Parse(input)

api/filters/imagetag/imagetag_test.go

@@ -840,6 +840,45 @@ spec:
 				},
 			},
 		},
+		"updateimagesuffix": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploysuffix
+spec:
+  template:
+    spec:
+      containers:
+      - image: redis:6.2.6
+        name: redis
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploysuffix
+spec:
+  template:
+    spec:
+      containers:
+      - image: redis:6.2.6-alpine
+        name: redis
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:      "redis",
+					TagSuffix: "-alpine",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/filters/imagetag/legacy.go

@@ -6,6 +6,7 @@ package imagetag
 import (
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -81,9 +82,7 @@ func (f findFieldsFilter) walk(node *yaml.RNode) error {
 			return nil
 		})
 	case yaml.SequenceNode:
-		return node.VisitElements(func(n *yaml.RNode) error {
-			return f.walk(n)
-		})
+		return errors.Wrap(node.VisitElements(f.walk))
 	}
 	return nil
 }

api/filters/imagetag/updater.go

@@ -5,6 +5,7 @@ package imagetag
 
 import (
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+
 	"sigs.k8s.io/kustomize/api/image"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -36,15 +37,19 @@ func (u imageTagUpdater) SetImageValue(rn *yaml.RNode) error {
 	}
 
 	// overriding tag or digest will replace both original tag and digest values
-	if u.ImageTag.NewTag != "" && u.ImageTag.Digest != "" {
+	switch {
+	case u.ImageTag.NewTag != "" && u.ImageTag.Digest != "":
 		tag = u.ImageTag.NewTag
 		digest = u.ImageTag.Digest
-	} else if u.ImageTag.NewTag != "" {
+	case u.ImageTag.NewTag != "":
 		tag = u.ImageTag.NewTag
 		digest = ""
-	} else if u.ImageTag.Digest != "" {
+	case u.ImageTag.Digest != "":
 		tag = ""
 		digest = u.ImageTag.Digest
+	case u.ImageTag.TagSuffix != "":
+		tag += u.ImageTag.TagSuffix
+		digest = ""
 	}
 
 	// build final image name

api/filters/nameref/doc.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 // Package nameref contains a kio.Filter implementation of the kustomize
 // name reference transformer.
 package nameref

api/filters/nameref/nameref.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package nameref
 
 import (

api/filters/nameref/nameref_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package nameref
 
 import (

api/filters/nameref/seqfilter.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package nameref
 
 import (

api/filters/nameref/seqfilter_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package nameref
 
 import (

api/filters/namespace/namespace.go

@@ -139,7 +139,6 @@ func (ns Filter) roleBindingHack(obj *yaml.RNode, gvk resid.Gvk) error {
 		}
 
 		return ns.trackableSetter.SetEntry("", ns.Namespace, yaml.NodeTagString)(node)
-
 	})
 
 	return err

api/filters/namespace/namespace_test.go

@@ -406,7 +406,7 @@ func TestNamespace_Filter(t *testing.T) {
 		test := tests[i]
 		test.filter.WithMutationTracker(test.mutationTracker)
 		t.Run(test.name, func(t *testing.T) {
-			test.filter.FsSlice = append(config.NameSpace, test.fsslice...)
+			test.filter.FsSlice = append(config.NameSpace, test.fsslice...) //nolint:gocritic
 			if !assert.Equal(t,
 				strings.TrimSpace(test.expected),
 				strings.TrimSpace(

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package patchstrategicmerge
 
 import (

api/filters/refvar/doc.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 // Package refvar contains a kio.Filter implementation of the kustomize
 // refvar transformer (find and replace $(FOO) style variables in strings).
 package refvar

api/filters/refvar/refvar.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package refvar
 
 import (

api/filters/refvar/refvar_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package refvar_test
 
 import (
@@ -17,7 +20,6 @@ var makeMf = func(theMap map[string]interface{}) MappingFunc {
 }
 
 func TestFilter(t *testing.T) {
-
 	testCases := map[string]struct {
 		input    string
 		expected string

api/filters/replacement/doc.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 // Package replacement contains a kio.Filter implementation of the kustomize
 // replacement transformer (accepts sources and looks for targets to replace
 // their values with values from the sources).

api/filters/replacement/replacement.go

@@ -4,6 +4,7 @@
 package replacement
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 
@@ -11,6 +12,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
+	kyaml_utils "sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -20,11 +22,11 @@ type Filter struct {
 
 // Filter replaces values of targets with values from sources
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
-	for _, r := range f.Replacements {
+	for i, r := range f.Replacements {
 		if r.Source == nil || r.Targets == nil {
 			return nil, fmt.Errorf("replacements must specify a source and at least one target")
 		}
-		value, err := getReplacement(nodes, &r)
+		value, err := getReplacement(nodes, &f.Replacements[i])
 		if err != nil {
 			return nil, err
 		}
@@ -60,8 +62,8 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targets []*types.T
 			}
 
 			// filter targets by matching resource IDs
-			for _, id := range ids {
-				if id.IsSelectedBy(t.Select.ResId) && !rejectId(t.Reject, &id) {
+			for i, id := range ids {
+				if id.IsSelectedBy(t.Select.ResId) && !rejectId(t.Reject, &ids[i]) {
 					err := applyToNode(n, value, t)
 					if err != nil {
 						return nil, err
@@ -113,10 +115,18 @@ func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
 
 func applyToNode(node *yaml.RNode, value *yaml.RNode, target *types.TargetSelector) error {
 	for _, fp := range target.FieldPaths {
-		fieldPath := utils.SmarterPathSplitter(fp, ".")
+		fieldPath := kyaml_utils.SmarterPathSplitter(fp, ".")
 		var t *yaml.RNode
 		var err error
 		if target.Options != nil && target.Options.Create {
+			// create option is not supported in a wildcard matching.
+			// Because, PathMatcher is not supported create option.
+			// So, if create option is set, we fallback to PathGetter.
+			for _, f := range fieldPath {
+				if f == "*" {
+					return errors.New("cannot support create option in a multi-value target") //nolint:goerr113
+				}
+			}
 			t, err = node.Pipe(yaml.LookupCreate(value.YNode().Kind, fieldPath...))
 		} else {
 			t, err = node.Pipe(&yaml.PathMatcher{Path: fieldPath})
@@ -142,9 +152,6 @@ func applyToOneNode(options *types.FieldOptions, t *yaml.RNode, value *yaml.RNod
 	}
 
 	for _, scalarNode := range t.YNode().Content {
-		if options != nil && options.Create {
-			return fmt.Errorf("cannot use create option in a multi-value target")
-		}
 		rn := yaml.NewRNode(scalarNode)
 		if err := setTargetValue(options, rn, value); err != nil {
 			return err
@@ -193,7 +200,7 @@ func getReplacement(nodes []*yaml.RNode, r *types.Replacement) (*yaml.RNode, err
 	if r.Source.FieldPath == "" {
 		r.Source.FieldPath = types.DefaultReplacementFieldPath
 	}
-	fieldPath := utils.SmarterPathSplitter(r.Source.FieldPath, ".")
+	fieldPath := kyaml_utils.SmarterPathSplitter(r.Source.FieldPath, ".")
 
 	rn, err := source.Pipe(yaml.Lookup(fieldPath...))
 	if err != nil {

api/filters/replacement/replacement_test.go

@@ -1634,6 +1634,45 @@ spec:
         - name: deployment-name
           value: sample-deploy`,
 		},
+		"index contains '*' character and create options": {
+			input: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: sample-deploy
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  template:
+    metadata:
+      labels:
+        app: sample-deploy
+    spec:
+      containers:
+      - image: nginx
+        name: main
+        env:
+        - name: other-env
+          value: YYYYY
+`,
+			replacements: `replacements:
+- source:
+    kind: Deployment
+    name: sample-deploy
+    fieldPath: metadata.name
+  targets:
+  - select:
+      kind: Deployment
+    fieldPaths:
+    - spec.template.spec.containers.*.env.[name=deployment-name].value
+    options:
+      create: true
+`,
+			expectedErr: "cannot support create option in a multi-value target",
+		},
 		"multiple field paths in target": {
 			input: `apiVersion: v1
 kind: ConfigMap

api/filters/replicacount/example_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package replicacount
 
 import (

api/filters/replicacount/replicacount.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package replicacount
 
 import (

api/filters/replicacount/replicacount_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package replicacount
 
 import (

api/go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.7.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e
-	sigs.k8s.io/kustomize/kyaml v0.13.6
+	k8s.io/kube-openapi v0.0.0-20220401212409-b28bf2818661
+	sigs.k8s.io/kustomize/kyaml v0.13.7
 	sigs.k8s.io/yaml v1.2.0
 )

api/go.sum

@@ -78,6 +78,7 @@ github.com/evanphx/json-patch v4.11.0+incompatible h1:glyUF9yIYtMHzn8xaKw5rMhdWc
 github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
@@ -85,8 +86,10 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
+github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonreference v0.19.3 h1:5cxNfTy0UVC3X8JL5ymxzyoUZmo8iZb+jeTWn7tUa8o=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
 github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
@@ -140,6 +143,8 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -157,12 +162,11 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
@@ -248,11 +252,11 @@ github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNX
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
@@ -483,6 +487,7 @@ golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjs
 golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
 golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -498,9 +503,11 @@ golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -604,8 +611,10 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
@@ -617,6 +626,7 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -630,15 +640,17 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e h1:KLHHjkdQFomZy8+06csTWZ0m1343QqxZhR2LJ1OxCYM=
-k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
+k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
+k8s.io/kube-openapi v0.0.0-20220401212409-b28bf2818661 h1:nqYOUleKLC/0P1zbU29F5q6aoezM6MOAVz+iyfQbZ5M=
+k8s.io/kube-openapi v0.0.0-20220401212409-b28bf2818661/go.mod h1:daOouuuwd9JXpv1L7Y34iV3yf6nxzipkKMWWlqlvK9M=
+k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/kustomize/kyaml v0.13.6 h1:eF+wsn4J7GOAXlvajv6OknSunxpcOBQQqsnPxObtkGs=
-sigs.k8s.io/kustomize/kyaml v0.13.6/go.mod h1:yHP031rn1QX1lr/Xd934Ri/xdVNG8BE2ECa78Ht/kEg=
+sigs.k8s.io/kustomize/kyaml v0.13.7 h1:/EZ/nPaLUzeJKF/BuJ4QCuMVJWiEVoI8iftOHY3g3tk=
+sigs.k8s.io/kustomize/kyaml v0.13.7/go.mod h1:6K+IUOuir3Y7nucPRAjw9yth04KSWBnP5pqUTGwj/qU=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

api/hasher/hasher_test.go

@@ -341,6 +341,7 @@ data:
 // The return value indicates whether we should skip the rest of the test case
 // due to the error result.
 func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	t.Helper()
 	if err != nil {
 		if len(contains) == 0 {
 			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())

api/internal/accumulator/namereferencetransformer.go

@@ -113,7 +113,6 @@ func debug(fMap filterMap) {
 // 'spec/scaleTargetRef/name' field. Return a filter that can do that.
 func (t *nameReferenceTransformer) determineFilters(
 	resources []*resource.Resource) (fMap filterMap) {
-
 	// We cache the resource OrgId values because they don't change and otherwise are very visible in a memory pprof
 	resourceOrgIds := make([]resid.ResId, len(resources))
 	for i, resource := range resources {

api/internal/accumulator/resaccumulator.go

@@ -107,7 +107,6 @@ func (ra *ResAccumulator) findVarValueFromResources(v types.Var) (interface{}, e
 	for _, res := range ra.resMap.Resources() {
 		for _, varName := range res.GetRefVarNames() {
 			if varName == v.Name {
-				//nolint: staticcheck
 				s, err := res.GetFieldValue(v.FieldRef.FieldPath)
 				if err != nil {
 					return "", fmt.Errorf(

api/internal/accumulator/resaccumulator_test.go

@@ -22,6 +22,7 @@ import (
 )
 
 func makeResAccumulator(t *testing.T) *ResAccumulator {
+	t.Helper()
 	ra := MakeEmptyAccumulator()
 	err := ra.MergeConfig(builtinconfig.MakeDefaultConfig())
 	if err != nil {
@@ -133,6 +134,7 @@ func TestResolveVarsOneUnused(t *testing.T) {
 }
 
 func expectLog(t *testing.T, log bytes.Buffer, expect string) {
+	t.Helper()
 	if !strings.Contains(log.String(), expect) {
 		t.Fatalf("expected log containing '%s', got '%s'", expect, log.String())
 	}

api/internal/git/repospec.go

@@ -78,15 +78,15 @@ func (x *RepoSpec) Cleaner(fSys filesys.FileSystem) func() error {
 	return func() error { return fSys.RemoveAll(x.Dir.String()) }
 }
 
-// NewRepoSpecFromUrl parses git-like urls.
+// NewRepoSpecFromURL parses git-like urls.
 // From strings like git@github.com:someOrg/someRepo.git or
 // https://github.com/someOrg/someRepo?ref=someHash, extract
 // the parts.
-func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
+func NewRepoSpecFromURL(n string) (*RepoSpec, error) {
 	if filepath.IsAbs(n) {
 		return nil, fmt.Errorf("uri looks like abs path: %s", n)
 	}
-	host, orgRepo, path, gitRef, gitSubmodules, suffix, gitTimeout := parseGitUrl(n)
+	host, orgRepo, path, gitRef, gitSubmodules, suffix, gitTimeout := parseGitURL(n)
 	if orgRepo == "" {
 		return nil, fmt.Errorf("url lacks orgRepo: %s", n)
 	}
@@ -108,9 +108,8 @@ const (
 // From strings like git@github.com:someOrg/someRepo.git or
 // https://github.com/someOrg/someRepo?ref=someHash, extract
 // the parts.
-func parseGitUrl(n string) (
+func parseGitURL(n string) (
 	host string, orgRepo string, path string, gitRef string, gitSubmodules bool, gitSuff string, gitTimeout time.Duration) {
-
 	if strings.Contains(n, gitDelimiter) {
 		index := strings.Index(n, gitDelimiter)
 		// Adding _git/ to host
@@ -229,7 +228,7 @@ func parseHostSpec(n string) (string, string) {
 		if strings.HasSuffix(host, p) {
 			i := strings.Index(n, "/")
 			if i > -1 {
-				host = host + n[0:i+1]
+				host += n[0 : i+1]
 				n = n[i+1:]
 			}
 			break

api/internal/git/repospec_test.go

@@ -37,7 +37,7 @@ var hostNamesRawAndNormalized = [][]string{
 	{"git@github.com/", "git@github.com:"},
 }
 
-func makeUrl(hostFmt, orgRepo, path, href string) string {
+func makeURL(hostFmt, orgRepo, path, href string) string {
 	if len(path) > 0 {
 		orgRepo = filepath.Join(orgRepo, path)
 	}
@@ -56,8 +56,8 @@ func TestNewRepoSpecFromUrl(t *testing.T) {
 		for _, orgRepo := range orgRepos {
 			for _, pathName := range pathNames {
 				for _, hrefArg := range hrefArgs {
-					uri := makeUrl(hostRaw, orgRepo, pathName, hrefArg)
-					rs, err := NewRepoSpecFromUrl(uri)
+					uri := makeURL(hostRaw, orgRepo, pathName, hrefArg)
+					rs, err := NewRepoSpecFromURL(uri)
 					if err != nil {
 						t.Errorf("problem %v", err)
 					}
@@ -99,7 +99,7 @@ var badData = [][]string{
 
 func TestNewRepoSpecFromUrlErrors(t *testing.T) {
 	for _, tuple := range badData {
-		_, err := NewRepoSpecFromUrl(tuple[0])
+		_, err := NewRepoSpecFromURL(tuple[0])
 		if err == nil {
 			t.Error("expected error")
 		}
@@ -191,7 +191,7 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 	}
 	for tn, tc := range testcases {
 		t.Run(tn, func(t *testing.T) {
-			rs, err := NewRepoSpecFromUrl(tc.input)
+			rs, err := NewRepoSpecFromURL(tc.input)
 			assert.NoError(t, err)
 			assert.Equal(t, tc.cloneSpec, rs.CloneSpec(), "cloneSpec mismatch")
 			assert.Equal(t, tc.absPath, rs.AbsPath(), "absPath mismatch")

api/internal/plugins/builtinhelpers/builtins.go

@@ -36,7 +36,7 @@ const (
 
 var stringToBuiltinPluginTypeMap map[string]BuiltinPluginType
 
-func init() {
+func init() { //nolint:gochecknoinits
 	stringToBuiltinPluginTypeMap = makeStringToBuiltinPluginTypeMap()
 }
 

api/internal/plugins/execplugin/execplugin_test.go

@@ -83,7 +83,6 @@ metadata:
 `
 	if expected != string(p.Cfg()) {
 		t.Fatalf("expected cfg '%s', got '%s'", expected, string(p.Cfg()))
-
 	}
 	if len(p.Args()) != 6 {
 		t.Fatalf("unexpected arg len %d, %#v", len(p.Args()), p.Args())

api/internal/plugins/loader/loader.go

@@ -228,6 +228,17 @@ func (l *Loader) makeBuiltinPlugin(r resid.Gvk) (resmap.Configurable, error) {
 func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error) {
 	spec := fnplugin.GetFunctionSpec(res)
 	if spec != nil {
+		// validation check that function mounts are under the current kustomization directory
+		for _, mount := range spec.Container.StorageMounts {
+			if filepath.IsAbs(mount.Src) {
+				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src))
+			}
+			if strings.HasPrefix(filepath.Clean(mount.Src), "../") {
+				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src))
+			}
+		}
 		return fnplugin.NewFnPlugin(&l.pc.FnpLoadingOptions), nil
 	}
 	return l.loadExecOrGoPlugin(res.OrgId())

api/internal/plugins/utils/utils_test.go

@@ -105,10 +105,10 @@ func TestUpdateResourceOptionsWithInvalidHashAnnotationValues(t *testing.T) {
 		"TrUe",
 		"potato",
 	}
-	for i, c := range cases {
+	for i := range cases {
 		name := fmt.Sprintf("test%d", i)
 		in := resmap.New()
-		err := in.Append(makeConfigMap(rf, name, "", &c))
+		err := in.Append(makeConfigMap(rf, name, "", &cases[i]))
 		require.NoError(t, err)
 		_, err = UpdateResourceOptions(in)
 		require.Error(t, err)

api/internal/target/kusttarget.go

@@ -6,7 +6,6 @@ package target
 import (
 	"encoding/json"
 	"fmt"
-	"path/filepath"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -304,7 +303,9 @@ func (kt *KustTarget) configureExternalGenerators() (
 				rm.Replace(r)
 			}
 		}
-		ra.AppendAll(rm)
+		if err = ra.AppendAll(rm); err != nil {
+			return nil, errors.Wrapf(err, "configuring external generator")
+		}
 	}
 	ra, err := kt.accumulateResources(ra, generatorPaths)
 	if err != nil {
@@ -348,7 +349,10 @@ func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]*r
 				rm.Replace(r)
 			}
 		}
-		ra.AppendAll(rm)
+
+		if err = ra.AppendAll(rm); err != nil {
+			return nil, errors.Wrapf(err, "configuring external transformer")
+		}
 	}
 	ra, err := kt.accumulateResources(ra, transformerPaths)
 	if err != nil {
@@ -406,11 +410,11 @@ func (kt *KustTarget) accumulateResources(
 			if errors.Is(errF, load.ErrorHTTP) {
 				return nil, errF
 			}
-			if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
-				return nil, errF
-			}
 			ldr, err := kt.ldr.New(path)
 			if err != nil {
+				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
+					return nil, errF
+				}
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
 			}
@@ -425,6 +429,9 @@ func (kt *KustTarget) accumulateResources(
 				ra, err = kt.accumulateDirectory(ra, ldr, false)
 			}
 			if err != nil {
+				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
+					return nil, errF
+				}
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
 			}
@@ -473,9 +480,8 @@ func (kt *KustTarget) accumulateDirectory(
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
 	subKt.origin = kt.origin
 	var bytes []byte
-	path := ldr.Root()
 	if openApiPath, exists := subKt.Kustomization().OpenAPI["path"]; exists {
-		bytes, err = ldr.Load(filepath.Join(path, openApiPath))
+		bytes, err = ldr.Load(openApiPath)
 		if err != nil {
 			return nil, err
 		}

api/internal/target/kusttarget_configplugin.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"path/filepath"
 
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -285,6 +286,13 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			if label.IncludeSelectors {
 				fss, err = fss.MergeAll(tc.CommonLabels)
 			} else {
+				// merge spec/template/metadata fieldSpec if includeTemplate flag is true
+				if label.IncludeTemplates {
+					fss, err = fss.MergeOne(types.FieldSpec{Path: "spec/template/metadata/labels", CreateIfNotPresent: false})
+					if err != nil {
+						return nil, errors.Wrap(err, "failed to merge template fieldSpec")
+					}
+				}
 				// only add to metadata by default
 				fss, err = fss.MergeOne(types.FieldSpec{Path: "metadata/labels", CreateIfNotPresent: true})
 			}

api/internal/target/kusttarget_test.go

@@ -257,3 +257,71 @@ metadata:
 	assert.NoError(t, err)
 	assert.Equal(t, string(expYaml), string(actYaml))
 }
+
+func TestDuplicateExternalGeneratorsForbidden(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/generator", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generators:
+- |-
+  apiVersion: generators.example/v1
+  kind: ManifestGenerator
+  metadata:
+    name: ManifestGenerator
+    annotations:
+      config.kubernetes.io/function: |
+        container:
+          image: ManifestGenerator:latest
+  spec:
+    image: 'someimage:12345'
+    configPath: config.json
+- |-
+  apiVersion: generators.example/v1
+  kind: ManifestGenerator
+  metadata:
+    name: ManifestGenerator
+    annotations:
+      config.kubernetes.io/function: |
+        container:
+          image: ManifestGenerator:latest
+  spec:
+    image: 'someimage:12345'
+    configPath: another_config.json
+`)
+	_, err := makeAndLoadKustTarget(t, th.GetFSys(), "/generator").AccumulateTarget()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "may not add resource with an already registered id: ManifestGenerator.v1.generators.example/ManifestGenerator")
+}
+
+func TestDuplicateExternalTransformersForbidden(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/transformer", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+transformers:
+- |-
+  apiVersion: transformers.example.co/v1
+  kind: ValueAnnotator
+  metadata:
+    name: notImportantHere
+    annotations:
+      config.kubernetes.io/function: |
+        container:
+          image: example.docker.com/my-functions/valueannotator:1.0.0
+  value: 'pass'
+- |-
+  apiVersion: transformers.example.co/v1
+  kind: ValueAnnotator
+  metadata:
+    name: notImportantHere
+    annotations:
+      config.kubernetes.io/function: |
+        container:
+          image: example.docker.com/my-functions/valueannotator:1.0.0
+  value: 'fail'
+`)
+	_, err := makeAndLoadKustTarget(t, th.GetFSys(), "/transformer").AccumulateTarget()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "may not add resource with an already registered id: ValueAnnotator.v1.transformers.example.co/notImportantHere")
+}

api/internal/target/maker_test.go

@@ -20,6 +20,7 @@ func makeAndLoadKustTarget(
 	t *testing.T,
 	fSys filesys.FileSystem,
 	root string) *target.KustTarget {
+	t.Helper()
 	kt := makeKustTargetWithRf(t, fSys, root, provider.NewDefaultDepProvider())
 	if err := kt.Load(); err != nil {
 		t.Fatalf("Unexpected load error %v", err)
@@ -32,6 +33,7 @@ func makeKustTargetWithRf(
 	fSys filesys.FileSystem,
 	root string,
 	pvd *provider.DepProvider) *target.KustTarget {
+	t.Helper()
 	ldr, err := fLdr.NewLoader(fLdr.RestrictionRootOnly, root, fSys)
 	if err != nil {
 		t.Fatal(err)

api/internal/utils/annotations.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package utils
 
 import "sigs.k8s.io/kustomize/api/konfig"

api/internal/utils/makeResIds.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package utils
 
 import (

api/konfig/plugins_test.go

@@ -179,9 +179,11 @@ func TestDefaultAbsPluginHomeNoXdgJustHomeDir(t *testing.T) {
 }
 
 func setenv(t *testing.T, key, value string) {
+	t.Helper()
 	require.NoError(t, os.Setenv(key, value))
 }
 
 func unsetenv(t *testing.T, key string) {
+	t.Helper()
 	require.NoError(t, os.Unsetenv(key))
 }

api/krusty/basic_io_test.go

@@ -82,7 +82,7 @@ spec:
 `)
 }
 
-//test for https://github.com/kubernetes-sigs/kustomize/issues/3812#issuecomment-862339267
+// test for https://github.com/kubernetes-sigs/kustomize/issues/3812#issuecomment-862339267
 func TestBasicIO3812(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteK(".", `

api/krusty/blankvalues_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/configmaps_test.go

@@ -460,7 +460,6 @@ metadata:
 }
 
 func TestConfigMapGeneratorMergeNamePrefix(t *testing.T) {
-
 	th := kusttest_test.MakeHarness(t)
 	th.WriteK("base", `
 configMapGenerator:

api/krusty/diamondcomposition_test.go

@@ -34,7 +34,7 @@ const container = `{ "image": "my-image", "livenessProbe": { "httpGet" : {"path"
 const patchJsonAddProbe = `[{"op": "replace", "path": "/spec/template/spec/containers/0", "value": ` +
 	container + `}]`
 
-const patchDnsPolicy = `
+const patchDNSPolicy = `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -44,7 +44,7 @@ spec:
     spec:
       dnsPolicy: ClusterFirst
 `
-const patchJsonDnsPolicy = `[{"op": "add", "path": "/spec/template/spec/dnsPolicy", "value": "ClusterFirst"}]`
+const patchJsonDNSPolicy = `[{"op": "add", "path": "/spec/template/spec/dnsPolicy", "value": "ClusterFirst"}]`
 
 const patchRestartPolicy = `
 apiVersion: apps/v1
@@ -96,7 +96,7 @@ resources:
 patchesStrategicMerge:
 - dep-patch.yaml
 `)
-	th.WriteF("dns/dep-patch.yaml", patchDnsPolicy)
+	th.WriteF("dns/dep-patch.yaml", patchDNSPolicy)
 }
 
 func writeRestartOverlay(th kusttest_test.Harness) {
@@ -209,7 +209,7 @@ patchesStrategicMerge:
 - patchRestartPolicy.yaml
 `)
 	th.WriteF("composite/patchRestartPolicy.yaml", patchRestartPolicy)
-	th.WriteF("composite/patchDnsPolicy.yaml", patchDnsPolicy)
+	th.WriteF("composite/patchDnsPolicy.yaml", patchDNSPolicy)
 	th.WriteF("composite/patchAddProbe.yaml", patchAddProbe)
 
 	m := th.Run("composite", th.MakeDefaultOptions())
@@ -220,7 +220,7 @@ func definePatchDirStructure(th kusttest_test.Harness) {
 	writeDeploymentBase(th)
 
 	th.WriteF("patches/patchRestartPolicy.yaml", patchRestartPolicy)
-	th.WriteF("patches/patchDnsPolicy.yaml", patchDnsPolicy)
+	th.WriteF("patches/patchDnsPolicy.yaml", patchDNSPolicy)
 	th.WriteF("patches/patchAddProbe.yaml", patchAddProbe)
 }
 
@@ -368,7 +368,7 @@ func TestIssue1251_Plugins_Local(t *testing.T) {
 	writeDeploymentBase(th.Harness)
 
 	writeJsonTransformerPluginConfig(
-		th, "composite", "addDnsPolicy", patchJsonDnsPolicy)
+		th, "composite", "addDnsPolicy", patchJsonDNSPolicy)
 	writeJsonTransformerPluginConfig(
 		th, "composite", "addRestartPolicy", patchJsonRestartPolicy)
 	writeJsonTransformerPluginConfig(
@@ -417,7 +417,7 @@ resources:
 - addProbeConfig.yaml
 `)
 	writeJsonTransformerPluginConfig(
-		th, "patches", "addDnsPolicy", patchJsonDnsPolicy)
+		th, "patches", "addDnsPolicy", patchJsonDNSPolicy)
 	writeJsonTransformerPluginConfig(
 		th, "patches", "addRestartPolicy", patchJsonRestartPolicy)
 	writeJsonTransformerPluginConfig(
@@ -441,7 +441,7 @@ resources:
 - addDnsPolicyConfig.yaml
 `)
 	writeJsonTransformerPluginConfig(
-		th, "patches/addDnsPolicy", "addDnsPolicy", patchJsonDnsPolicy)
+		th, "patches/addDnsPolicy", "addDnsPolicy", patchJsonDNSPolicy)
 
 	th.WriteK("patches/addRestartPolicy", `
 resources:

api/krusty/disablenamesuffix_test.go

@@ -82,21 +82,19 @@ metadata:
 	secret := findSecret(m, "")
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
-	}
-	if secret.GetName() != "foo-secret-bar-82c2g5f8f6" {
+	} else if secret.GetName() != "foo-secret-bar-82c2g5f8f6" {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 
 	th.WriteK("/whatever",
-		strings.Replace(kustomizationContent,
+		strings.ReplaceAll(kustomizationContent,
 			"disableNameSuffixHash: false",
-			"disableNameSuffixHash: true", -1))
+			"disableNameSuffixHash: true"))
 	m = th.Run("/whatever", th.MakeDefaultOptions())
 	secret = findSecret(m, "")
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
-	}
-	if secret.GetName() != "foo-secret-bar" { // No hash at end.
+	} else if secret.GetName() != "foo-secret-bar" { // No hash at end.
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 }
@@ -131,16 +129,14 @@ secretGenerator:
 	secret := findSecret(m, "nohash")
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
-	}
-	if secret.GetName() != "nohash" {
+	} else if secret.GetName() != "nohash" {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 
 	secret = findSecret(m, "yeshash")
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
-	}
-	if secret.GetName() != "yeshash-82c2g5f8f6" {
+	} else if secret.GetName() != "yeshash-82c2g5f8f6" {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 }

api/krusty/duplicatekeys_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/fnplugin_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/krusty"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
@@ -214,6 +218,7 @@ spec:
 }
 
 func skipIfNoDocker(t *testing.T) {
+	t.Helper()
 	if _, err := exec.LookPath("docker"); err != nil {
 		t.Skip("skipping because docker binary wasn't found in PATH")
 	}
@@ -531,30 +536,33 @@ spec:
 
 func TestFnContainerTransformerWithConfig(t *testing.T) {
 	skipIfNoDocker(t)
-
-	// Function plugins should not need the env setup done by MakeEnhancedHarness
 	th := kusttest_test.MakeHarness(t)
-
-	th.WriteK(".", `
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 resources:
 - data1.yaml
 - data2.yaml
 transformers:
 - label_namespace.yaml
-`)
-
-	th.WriteF("data1.yaml", `apiVersion: v1
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data1.yaml"), []byte(`
+apiVersion: v1
 kind: Namespace
 metadata:
   name: my-namespace
-`)
-	th.WriteF("data2.yaml", `apiVersion: v1
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data2.yaml"), []byte(`
+apiVersion: v1
 kind: Namespace
 metadata:
   name: another-namespace
-`)
-
-	th.WriteF("label_namespace.yaml", `apiVersion: v1
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "label_namespace.yaml"), []byte(`
+apiVersion: v1
 kind: ConfigMap
 metadata:
   name: label_namespace
@@ -565,11 +573,14 @@ metadata:
 data:
   label_name: my-ns-name
   label_value: function-test
-`)
-
-	m := th.Run(".", th.MakeOptionsPluginsEnabled())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: v1
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	assert.NoError(t, err)
+	actual, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
 kind: Namespace
 metadata:
   labels:
@@ -582,24 +593,22 @@ metadata:
   labels:
     my-ns-name: function-test
   name: another-namespace
-`)
+`, string(actual))
 }
 
 func TestFnContainerEnvVars(t *testing.T) {
 	skipIfNoDocker(t)
-
-	// Function plugins should not need the env setup done by MakeEnhancedHarness
 	th := kusttest_test.MakeHarness(t)
-
-	th.WriteK(".", `
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 generators:
 - gener.yaml
-`)
-
-	// TODO: cheange image to gcr.io/kpt-functions/templater:stable
-	// when https://github.com/GoogleContainerTools/kpt-functions-catalog/pull/103
-	// is merged
-	th.WriteF("gener.yaml", `
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -618,14 +627,176 @@ data:
       name: env
     data:
       value: '{{ env "TESTTEMPLATE" }}'
-`)
-	m := th.Run(".", th.MakeOptionsPluginsEnabled())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: v1
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	assert.NoError(t, err)
+	actual, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
 data:
   value: value
 kind: ConfigMap
 metadata:
   name: env
-`)
+`, string(actual))
+}
+
+func TestFnContainerFnMounts(t *testing.T) {
+	skipIfNoDocker(t)
+	th := kusttest_test.MakeHarness(t)
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+generators:
+- gener.yaml
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
+apiVersion: v1alpha1
+kind: RenderHelmChart
+metadata:
+  name: demo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+        mounts:
+        - type: "bind"
+          src: "./charts"
+          dst: "/tmp/charts"
+helmCharts:
+- name: helloworld-chart
+  releaseName: test
+  valuesFile: /tmp/charts/helloworld-values/values.yaml
+`)))
+	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates")))
+	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-values")))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "Chart.yaml"), []byte(`
+apiVersion: v2
+name: helloworld-chart
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+appVersion: 1.16.0
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates", "deployment.yaml"), []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: name
+spec:
+  replicas: {{ .Values.replicaCount }}
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-values", "values.yaml"), []byte(`
+replicaCount: 5
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	assert.NoError(t, err)
+	actual, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: name
+spec:
+  replicas: 5
+`, string(actual))
+}
+
+func TestFnContainerMountsLoadRestrictions_absolute(t *testing.T) {
+	skipIfNoDocker(t)
+	th := kusttest_test.MakeHarness(t)
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+generators:
+  - |-
+    apiVersion: v1alpha1
+    kind: RenderHelmChart
+    metadata:
+      name: demo
+      annotations:
+        config.kubernetes.io/function: |
+          container:
+            image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+            mounts:
+            - type: "bind"
+              src: "/tmp/dir"
+              dst: "/tmp/charts"
+`)))
+	_, err = b.Run(
+		fSys,
+		tmpDir.String())
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "loading generator plugins: plugin RenderHelmChart."+
+		"v1alpha1.[noGrp]/demo.[noNs] with mount path '/tmp/dir' is not permitted; mount paths must"+
+		" be relative to the current kustomization directory")
+}
+
+func TestFnContainerMountsLoadRestrictions_outsideCurrentDir(t *testing.T) {
+	skipIfNoDocker(t)
+	th := kusttest_test.MakeHarness(t)
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+generators:
+  - |-
+    apiVersion: v1alpha1
+    kind: RenderHelmChart
+    metadata:
+      name: demo
+      annotations:
+        config.kubernetes.io/function: |
+          container:
+            image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+            mounts:
+            - type: "bind"
+              src: "./tmp/../../dir"
+              dst: "/tmp/charts"
+`)))
+	_, err = b.Run(
+		fSys,
+		tmpDir.String())
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "loading generator plugins: plugin RenderHelmChart."+
+		"v1alpha1.[noGrp]/demo.[noNs] with mount path './tmp/../../dir' is not permitted; mount paths must "+
+		"be under the current kustomization directory")
+}
+
+func TestFnContainerMountsLoadRestrictions_root(t *testing.T) {
+	skipIfNoDocker(t)
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK(".", `
+generators:
+- gener.yaml
+`)
+	// Create generator config
+	th.WriteF("gener.yaml", `
+apiVersion: examples.config.kubernetes.io/v1beta1
+kind: CockroachDB
+metadata:
+  name: demo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: gcr.io/kustomize-functions/example-cockroachdb:v0.1.0
+spec:
+  replicas: 3
+`)
+	err := th.RunWithErr(".", th.MakeOptionsPluginsEnabled())
+	assert.Error(t, err)
+	assert.EqualError(t, err, "couldn't execute function: root working directory '/' not allowed")
 }

api/krusty/iampolicygenerator_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/inlinelabels_test.go

@@ -91,3 +91,72 @@ spec:
     c: d
 `)
 }
+
+func TestKustomizationLabelsInTemplate(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: a
+    app.kubernetes.io/instance: b
+    app.kubernetes.io/name: c
+    app.kubernetes.io/part-of: d
+  name: deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: a
+      app.kubernetes.io/instance: b
+      app.kubernetes.io/name: c
+      app.kubernetes.io/part-of: d
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: a
+        app.kubernetes.io/instance: b
+        app.kubernetes.io/name: c
+        app.kubernetes.io/part-of: d
+`)
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+
+labels:
+- pairs:
+    foo: bar
+  includeSelectors: false
+  includeTemplates: true
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: a
+    app.kubernetes.io/instance: b
+    app.kubernetes.io/name: c
+    app.kubernetes.io/part-of: d
+    foo: bar
+  name: deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: a
+      app.kubernetes.io/instance: b
+      app.kubernetes.io/name: c
+      app.kubernetes.io/part-of: d
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: a
+        app.kubernetes.io/instance: b
+        app.kubernetes.io/name: c
+        app.kubernetes.io/part-of: d
+        foo: bar
+`)
+}

api/krusty/intermediateresourceid_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/keepemptyarray_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/kustomizationmetadata_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/kustomizer.go

@@ -5,7 +5,6 @@ package krusty
 
 import (
 	"fmt"
-	"path/filepath"
 
 	"sigs.k8s.io/kustomize/api/internal/builtins"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
@@ -76,7 +75,7 @@ func (b *Kustomizer) Run(
 	}
 	var bytes []byte
 	if openApiPath, exists := kt.Kustomization().OpenAPI["path"]; exists {
-		bytes, err = ldr.Load(filepath.Join(ldr.Root(), openApiPath))
+		bytes, err = ldr.Load(openApiPath)
 		if err != nil {
 			return nil, err
 		}

api/krusty/legacy_order_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/multibytecharacter_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/namereference_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/namespaces_test.go

@@ -692,6 +692,7 @@ resources:
 	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
 }
 
+// nolint:gosec
 const namespaceNeedInVarMyAppWithNamespace string = `
 resources:
 - elasticsearch-dev-service.yaml

api/krusty/nameupdateinroleref_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/openapicustomschema_test.go

@@ -1,455 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package krusty_test
-
-import (
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
-	"sigs.k8s.io/kustomize/kyaml/openapi"
-)
-
-func writeTestSchema(th kusttest_test.Harness, filepath string) {
-	bytes, _ := ioutil.ReadFile("testdata/customschema.json")
-	th.WriteF(filepath+"mycrd_schema.json", string(bytes))
-}
-
-func writeTestSchemaYaml(th kusttest_test.Harness, filepath string) {
-	bytes, _ := ioutil.ReadFile("testdata/customschema.yaml")
-	th.WriteF(filepath+"mycrd_schema.yaml", string(bytes))
-}
-
-func writeCustomResource(th kusttest_test.Harness, filepath string) {
-	th.WriteF(filepath, `
-apiVersion: example.com/v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - name: server
-        image: server
-        command: example
-        ports:
-        - name: grpc
-          protocol: TCP
-          containerPort: 8080
-`)
-}
-
-func writeOtherCustomResource(th kusttest_test.Harness, filepath string) {
-	th.WriteF(filepath, `
-apiVersion: v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - name: server
-        image: server
-        command: example
-        ports:
-        - name: grpc
-          protocol: TCP
-          containerPort: 8080
-`)
-}
-
-func writeTestComponentWithCustomSchema(th kusttest_test.Harness) {
-	writeTestSchema(th, "comp/")
-	openapi.ResetOpenAPI()
-	th.WriteC("comp", `
-openapi:
-  path: mycrd_schema.json
-`)
-	th.WriteF("comp/stub.yaml", `
-apiVersion: v1
-kind: Deployment
-metadata:
-  name: stub
-spec:
-  replicas: 1
-`)
-}
-
-const customSchemaPatch = `
-patchesStrategicMerge:
-- |-
-  apiVersion: example.com/v1alpha1
-  kind: MyCRD
-  metadata:
-    name: service
-  spec:
-    template:
-      spec:
-        containers:
-        - name: server
-          image: nginx
-`
-
-const customSchemaPatchMultipleGvks = `
-patchesStrategicMerge:
-- |-
-  apiVersion: example.com/v1alpha1
-  kind: MyCRD
-  metadata:
-    name: service
-  spec:
-    template:
-      spec:
-        containers:
-        - name: server
-          image: nginx
-- |-
-  apiVersion: v1alpha1
-  kind: MyCRD
-  metadata:
-    name: service
-  spec:
-    template:
-      spec:
-        containers:
-        - name: server
-          image: nginx
-`
-
-const patchedCustomResource = `
-apiVersion: example.com/v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - command: example
-        image: nginx
-        name: server
-        ports:
-        - containerPort: 8080
-          name: grpc
-          protocol: TCP
-`
-
-// Test for issue #2825
-func TestCustomOpenApiFieldBasicUsage(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- mycrd.yaml
-openapi:
-  path: mycrd_schema.json
-`+customSchemaPatch)
-	writeCustomResource(th, "mycrd.yaml")
-	writeTestSchema(th, "./")
-	openapi.ResetOpenAPI()
-	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, patchedCustomResource)
-}
-
-func TestCustomOpenApiFieldWithTwoGvks(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- mycrd.yaml
-- myothercrd.yaml
-openapi:
-  path: mycrd_schema.json
-`+customSchemaPatchMultipleGvks)
-	writeCustomResource(th, "mycrd.yaml")
-	writeOtherCustomResource(th, "myothercrd.yaml")
-	writeTestSchema(th, "./")
-	openapi.ResetOpenAPI()
-	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `apiVersion: example.com/v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - command: example
-        image: nginx
-        name: server
-        ports:
-        - containerPort: 8080
-          name: grpc
-          protocol: TCP
----
-apiVersion: v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - command: example
-        image: nginx
-        name: server
-        ports:
-        - containerPort: 8080
-          name: grpc
-          protocol: TCP
-`)
-}
-
-func TestCustomOpenApiFieldYaml(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- mycrd.yaml
-openapi:
-  path: mycrd_schema.yaml
-`+customSchemaPatch)
-	writeCustomResource(th, "mycrd.yaml")
-	writeTestSchemaYaml(th, "./")
-	openapi.ResetOpenAPI()
-	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, patchedCustomResource)
-}
-
-// Error if user tries to specify both builtin version
-// and custom schema
-func TestCustomOpenApiFieldBothPathAndVersion(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- mycrd.yaml
-openapi:
-  version: v1.21.2
-  path: mycrd_schema.json
-`+customSchemaPatch)
-	writeCustomResource(th, "mycrd.yaml")
-	writeTestSchema(th, "./")
-	openapi.ResetOpenAPI()
-	err := th.RunWithErr(".", th.MakeDefaultOptions())
-	assert.Error(t, err)
-	assert.Equal(t,
-		"builtin version and custom schema provided, cannot use both",
-		err.Error())
-}
-
-// Test for if the filepath specified is not found
-func TestCustomOpenApiFieldFileNotFound(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- mycrd.yaml
-openapi:
-  path: mycrd_schema.json
-`+customSchemaPatch)
-	writeCustomResource(th, "mycrd.yaml")
-	openapi.ResetOpenAPI()
-	err := th.RunWithErr(".", th.MakeDefaultOptions())
-	assert.Error(t, err)
-	assert.Equal(t,
-		"'/mycrd_schema.json' doesn't exist",
-		err.Error())
-}
-
-func TestCustomOpenApiFieldFromBase(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK("base", `
-resources:
-- mycrd.yaml
-openapi:
-  path: mycrd_schema.json
-`)
-	th.WriteK("overlay", `
-resources:
-- ../base
-`+customSchemaPatch)
-	writeCustomResource(th, "base/mycrd.yaml")
-	writeTestSchema(th, "base/")
-	openapi.ResetOpenAPI()
-	m := th.Run("overlay", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, patchedCustomResource)
-	assert.Equal(t, "using custom schema from file provided",
-		openapi.GetSchemaVersion())
-}
-
-func TestCustomOpenApiFieldFromOverlay(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK("base", `
-resources:
-- mycrd.yaml
-`)
-	th.WriteK("overlay", `
-resources:
-- ../base
-openapi:
-  path: mycrd_schema.json
-`+customSchemaPatch)
-	writeCustomResource(th, "base/mycrd.yaml")
-	writeTestSchema(th, "overlay/")
-	openapi.ResetOpenAPI()
-	m := th.Run("overlay", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, patchedCustomResource)
-	assert.Equal(t, "using custom schema from file provided",
-		openapi.GetSchemaVersion())
-}
-
-func TestCustomOpenApiFieldOverlayTakesPrecedence(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	openapi.ResetOpenAPI()
-	th.WriteK("base", `
-resources:
-- mycrd.yaml
-openapi:
-  path: mycrd_schema.json
-`)
-	th.WriteK("overlay", `
-resources:
-- ../base
-openapi:
-  version: v1.21.2
-`+customSchemaPatch)
-	writeCustomResource(th, "base/mycrd.yaml")
-	writeTestSchema(th, "base/")
-	openapi.ResetOpenAPI()
-	m := th.Run("overlay", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: example.com/v1alpha1
-kind: MyCRD
-metadata:
-  name: service
-spec:
-  template:
-    spec:
-      containers:
-      - image: nginx
-        name: server
-`)
-	assert.Equal(t, "v1212", openapi.GetSchemaVersion())
-}
-
-func TestCustomOpenAPIFieldFromComponent(t *testing.T) {
-	input := []FileGen{
-		writeTestBase,
-		writeTestComponentWithCustomSchema,
-		writeOverlayProd}
-
-	th := kusttest_test.MakeHarness(t)
-	for _, f := range input {
-		f(th)
-	}
-	openapi.ResetOpenAPI()
-	th.Run("prod", th.MakeDefaultOptions())
-	assert.Equal(t, "using custom schema from file provided", openapi.GetSchemaVersion())
-}
-
-// test for https://github.com/kubernetes-sigs/kustomize/issues/4179
-// kustomize is not seeing the openapi field from the component defined in the overlay
-func TestCustomOpenAPIFieldFromComponentWithOverlays(t *testing.T) {
-	if val, ok := os.LookupEnv("OPENAPI_TEST"); !ok || val != "true" {
-		t.SkipNow()
-	}
-
-	th := kusttest_test.MakeHarness(t)
-
-	// overlay declaring the component
-	th.WriteK("overlays/overlay-component-openapi", `resources:
-- ../base/
-components:
-- ../../components/dc-openapi
-`)
-
-	// base kustomization
-	th.WriteK("overlays/base", `resources:
-- dc.yml
-`)
-
-	// resource declared in the base kustomization
-	th.WriteF("overlays/base/dc.yml", `apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: my-dc
-spec:
-  template:
-    spec:
-      initContainers:
-        - name: init
-      containers:
-        - name: container
-          env:
-            - name: foo
-              value: bar
-          volumeMounts:
-            - name: cm
-              mountPath: /opt/cm
-      volumes:
-        - name: cm
-          configMap:
-            name: cm
-`)
-
-	// openapi schema referred to by the component
-	bytes, _ := ioutil.ReadFile("testdata/openshiftschema.json")
-	th.WriteF("components/dc-openapi/openapi.json", string(bytes))
-
-	// patch referred to by the component
-	th.WriteF("components/dc-openapi/patch.yml", `apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: my-dc
-spec:
-  template:
-    spec:
-      containers:
-        - name: container
-          volumeMounts:
-            - name: additional-cm
-              mountPath: /mnt
-      volumes:
-        - name: additional-cm
-          configMap:
-             name: additional-cm
-`)
-
-	// component declared in overlay with custom schema and patch
-	th.WriteC("components/dc-openapi", `patches:
-  - patch.yml
-openapi:
-  path: openapi.json
-`)
-
-	openapi.ResetOpenAPI()
-	m := th.Run("overlays/overlay-component-openapi", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: my-dc
-spec:
-  template:
-    spec:
-      containers:
-      - env:
-        - name: foo
-          value: bar
-        name: container
-        volumeMounts:
-        - mountPath: /mnt
-          name: additional-cm
-        - mountPath: /opt/cm
-          name: cm
-      initContainers:
-      - name: init
-      volumes:
-      - configMap:
-          name: additional-cm
-        name: additional-cm
-      - configMap:
-          name: cm
-        name: cm
-`)
-}

api/krusty/openapitests/openapicustomschema_test.go

@@ -0,0 +1,707 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// The openapi field tests are separated due to the global OpenAPI variable causing
+// race conditions. As a result, these tests can't be run in parallel with the other tests.
+package openapitests //nolint
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
+	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
+)
+
+func writeTestSchema(th kusttest_test.Harness, filepath string) {
+	bytes, _ := ioutil.ReadFile("../testdata/customschema.json")
+	th.WriteF(filepath+"mycrd_schema.json", string(bytes))
+}
+
+func writeTestSchemaYaml(th kusttest_test.Harness, filepath string) {
+	bytes, _ := ioutil.ReadFile("../testdata/customschema.yaml")
+	th.WriteF(filepath+"mycrd_schema.yaml", string(bytes))
+}
+
+func writeCustomResource(th kusttest_test.Harness, filepath string) {
+	th.WriteF(filepath, `
+apiVersion: example.com/v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - name: server
+        image: server
+        command: example
+        ports:
+        - name: grpc
+          protocol: TCP
+          containerPort: 8080
+`)
+}
+
+func writeOtherCustomResource(th kusttest_test.Harness, filepath string) {
+	th.WriteF(filepath, `
+apiVersion: v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - name: server
+        image: server
+        command: example
+        ports:
+        - name: grpc
+          protocol: TCP
+          containerPort: 8080
+`)
+}
+
+func writeTestComponentWithCustomSchema(th kusttest_test.Harness) {
+	writeTestSchema(th, "comp/")
+	openapi.ResetOpenAPI()
+	th.WriteC("comp", `
+openapi:
+  path: mycrd_schema.json
+`)
+	th.WriteF("comp/stub.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: stub
+spec:
+  replicas: 1
+`)
+}
+
+const customSchemaPatch = `
+patchesStrategicMerge:
+- |-
+  apiVersion: example.com/v1alpha1
+  kind: MyCRD
+  metadata:
+    name: service
+  spec:
+    template:
+      spec:
+        containers:
+        - name: server
+          image: nginx
+`
+
+const customSchemaPatchMultipleGvks = `
+patchesStrategicMerge:
+- |-
+  apiVersion: example.com/v1alpha1
+  kind: MyCRD
+  metadata:
+    name: service
+  spec:
+    template:
+      spec:
+        containers:
+        - name: server
+          image: nginx
+- |-
+  apiVersion: v1alpha1
+  kind: MyCRD
+  metadata:
+    name: service
+  spec:
+    template:
+      spec:
+        containers:
+        - name: server
+          image: nginx
+`
+
+const patchedCustomResource = `
+apiVersion: example.com/v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - command: example
+        image: nginx
+        name: server
+        ports:
+        - containerPort: 8080
+          name: grpc
+          protocol: TCP
+`
+
+func runOpenApiTest(t *testing.T, test func(t *testing.T)) {
+	t.Helper()
+	if val, ok := os.LookupEnv("OPENAPI_TEST"); !ok || val != "true" {
+		t.SkipNow()
+	}
+	test(t)
+	openapi.ResetOpenAPI()
+}
+
+// Test for issue #2825
+func TestCustomOpenApiFieldBasicUsage(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "mycrd.yaml")
+		writeTestSchema(th, "./")
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+	})
+}
+
+func TestCustomOpenApiFieldBasicUsageWithRemoteSchema(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  path: https://github.com/kubernetes-sigs/kustomize/raw/master/api/krusty/testdata/customschema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "mycrd.yaml")
+		writeTestSchema(th, "./")
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+	})
+}
+
+func TestCustomOpenApiFieldWithTwoGvks(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+- myothercrd.yaml
+openapi:
+  path: mycrd_schema.json
+`+customSchemaPatchMultipleGvks)
+		writeCustomResource(th, "mycrd.yaml")
+		writeOtherCustomResource(th, "myothercrd.yaml")
+		writeTestSchema(th, "./")
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, `apiVersion: example.com/v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - command: example
+        image: nginx
+        name: server
+        ports:
+        - containerPort: 8080
+          name: grpc
+          protocol: TCP
+---
+apiVersion: v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - command: example
+        image: nginx
+        name: server
+        ports:
+        - containerPort: 8080
+          name: grpc
+          protocol: TCP
+`)
+	})
+}
+
+func TestCustomOpenApiFieldYaml(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.yaml
+`+customSchemaPatch)
+		writeCustomResource(th, "mycrd.yaml")
+		writeTestSchemaYaml(th, "./")
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+	})
+}
+
+// Error if user tries to specify both builtin version
+// and custom schema
+func TestCustomOpenApiFieldBothPathAndVersion(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  version: v1.21.2
+  path: mycrd_schema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "mycrd.yaml")
+		writeTestSchema(th, "./")
+		err := th.RunWithErr(".", th.MakeDefaultOptions())
+		assert.Error(t, err)
+		assert.Equal(t,
+			"builtin version and custom schema provided, cannot use both",
+			err.Error())
+	})
+}
+
+// Test for if the filepath specified is not found
+func TestCustomOpenApiFieldFileNotFound(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "mycrd.yaml")
+		err := th.RunWithErr(".", th.MakeDefaultOptions())
+		assert.Error(t, err)
+		assert.Equal(t,
+			"'/mycrd_schema.json' doesn't exist",
+			err.Error())
+	})
+}
+
+func TestCustomOpenApiFieldFromBase(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK("base", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.json
+`)
+		th.WriteK("overlay", `
+resources:
+- ../base
+`+customSchemaPatch)
+		writeCustomResource(th, "base/mycrd.yaml")
+		writeTestSchema(th, "base/")
+		m := th.Run("overlay", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+		assert.Equal(t, "using custom schema from file provided",
+			openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldFromBaseWithRemoteSchema(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK("base", `
+resources:
+- mycrd.yaml
+openapi:
+  path: https://github.com/kubernetes-sigs/kustomize/raw/master/api/krusty/testdata/customschema.json
+`)
+		th.WriteK("overlay", `
+resources:
+- ../base
+`+customSchemaPatch)
+		writeCustomResource(th, "base/mycrd.yaml")
+		writeTestSchema(th, "base/")
+		m := th.Run("overlay", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+		assert.Equal(t, "using custom schema from file provided",
+			openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldFromOverlay(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK("base", `
+resources:
+- mycrd.yaml
+`)
+		th.WriteK("overlay", `
+resources:
+- ../base
+openapi:
+  path: mycrd_schema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "base/mycrd.yaml")
+		writeTestSchema(th, "overlay/")
+		m := th.Run("overlay", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+		assert.Equal(t, "using custom schema from file provided",
+			openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldFromOverlayWithRemoteSchema(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK("base", `
+resources:
+- mycrd.yaml
+`)
+		th.WriteK("overlay", `
+resources:
+- ../base
+openapi:
+  path: https://github.com/kubernetes-sigs/kustomize/raw/master/api/krusty/testdata/customschema.json
+`+customSchemaPatch)
+		writeCustomResource(th, "base/mycrd.yaml")
+		writeTestSchema(th, "overlay/")
+		m := th.Run("overlay", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, patchedCustomResource)
+		assert.Equal(t, "using custom schema from file provided",
+			openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldOverlayTakesPrecedence(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		openapi.ResetOpenAPI()
+		th.WriteK("base", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.json
+`)
+		th.WriteK("overlay", `
+resources:
+- ../base
+openapi:
+  version: v1.21.2
+`+customSchemaPatch)
+		writeCustomResource(th, "base/mycrd.yaml")
+		writeTestSchema(th, "base/")
+		m := th.Run("overlay", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, `
+apiVersion: example.com/v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: server
+`)
+		assert.Equal(t, "v1212", openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldFromComponent(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		input := []FileGen{
+			writeTestBase,
+			writeTestComponentWithCustomSchema,
+			writeOverlayProd}
+
+		th := kusttest_test.MakeHarness(t)
+		for _, f := range input {
+			f(th)
+		}
+		th.Run("prod", th.MakeDefaultOptions())
+		assert.Equal(t, "using custom schema from file provided", openapi.GetSchemaVersion())
+	})
+}
+
+// test for https://github.com/kubernetes-sigs/kustomize/issues/4179
+// kustomize is not seeing the openapi field from the component defined in the overlay
+func TestCustomOpenApiFieldFromComponentWithOverlays(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+
+		// overlay declaring the component
+		th.WriteK("overlays/overlay-component-openapi", `resources:
+- ../base/
+components:
+- ../../components/dc-openapi
+`)
+
+		// base kustomization
+		th.WriteK("overlays/base", `resources:
+- dc.yml
+`)
+
+		// resource declared in the base kustomization
+		th.WriteF("overlays/base/dc.yml", `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      initContainers:
+        - name: init
+      containers:
+        - name: container
+          env:
+            - name: foo
+              value: bar
+          volumeMounts:
+            - name: cm
+              mountPath: /opt/cm
+      volumes:
+        - name: cm
+          configMap:
+            name: cm
+`)
+
+		// openapi schema referred to by the component
+		bytes, _ := ioutil.ReadFile("../testdata/openshiftschema.json")
+		th.WriteF("components/dc-openapi/openapi.json", string(bytes))
+
+		// patch referred to by the component
+		th.WriteF("components/dc-openapi/patch.yml", `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      containers:
+        - name: container
+          volumeMounts:
+            - name: additional-cm
+              mountPath: /mnt
+      volumes:
+        - name: additional-cm
+          configMap:
+             name: additional-cm
+`)
+
+		// component declared in overlay with custom schema and patch
+		th.WriteC("components/dc-openapi", `patches:
+  - patch.yml
+openapi:
+  path: openapi.json
+`)
+
+		m := th.Run("overlays/overlay-component-openapi", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: foo
+          value: bar
+        name: container
+        volumeMounts:
+        - mountPath: /mnt
+          name: additional-cm
+        - mountPath: /opt/cm
+          name: cm
+      initContainers:
+      - name: init
+      volumes:
+      - configMap:
+          name: additional-cm
+        name: additional-cm
+      - configMap:
+          name: cm
+        name: cm
+`)
+	})
+}
+
+func TestCustomOpenApiFieldVersion(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+openapi:
+  version: v1.21.2
+resources:
+- deployment.yaml
+`)
+		th.WriteF("deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+		assert.Equal(t, "v1212", openapi.GetSchemaVersion())
+	})
+}
+
+func TestCustomOpenApiFieldNotBuiltin(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+openapi:
+  version: v1.14.1
+resources:
+- deployment.yaml
+`)
+		th.WriteF("deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+		err := th.RunWithErr(".", th.MakeDefaultOptions())
+		if err == nil {
+			t.Fatalf("expected an error")
+		}
+	})
+}
+
+func TestCustomOpenApiFieldDefaultVersion(t *testing.T) {
+	runOpenApiTest(t, func(t *testing.T) {
+		t.Helper()
+		th := kusttest_test.MakeHarness(t)
+		th.WriteK(".", `
+resources:
+- deployment.yaml
+`)
+		th.WriteF("deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+		m := th.Run(".", th.MakeDefaultOptions())
+		th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+		assert.Equal(t, kubernetesapi.DefaultOpenAPI, openapi.GetSchemaVersion())
+	})
+}
+
+// The following definitions are copied from the krusty package.
+
+type FileGen func(kusttest_test.Harness)
+
+func writeTestBase(th kusttest_test.Harness) {
+	th.WriteK("base", `
+resources:
+- deploy.yaml
+configMapGenerator:
+- name: my-configmap
+  literals:	
+  - testValue=purple
+  - otherValue=green
+`)
+	th.WriteF("base/deploy.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: storefront
+spec:
+  replicas: 1
+`)
+}
+
+func writeOverlayProd(th kusttest_test.Harness) {
+	th.WriteK("prod", `
+resources:
+- ../base
+- db
+
+components:
+- ../comp
+`)
+	writeDB(th)
+}
+
+func writeDB(th kusttest_test.Harness) {
+	deployment("db", "prod/db")(th)
+}
+
+func deployment(name string, path string) FileGen {
+	return writeF(path, fmt.Sprintf(`
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: %s
+spec:
+  type: Logical
+`, name))
+}
+
+func writeF(path string, content string) FileGen {
+	return func(th kusttest_test.Harness) {
+		th.WriteF(path, content)
+	}
+}

api/krusty/openapiversion_test.go

@@ -1,110 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package krusty_test
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
-	"sigs.k8s.io/kustomize/kyaml/openapi"
-	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
-)
-
-func TestOpenApiFieldBasicUsage(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-openapi:
-  version: v1.21.2
-resources:
-- deployment.yaml
-`)
-	th.WriteF("deployment.yaml", `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    spec:
-      containers:
-      - image: whatever
-`)
-
-	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    spec:
-      containers:
-      - image: whatever
-`)
-	assert.Equal(t, "v1212", openapi.GetSchemaVersion())
-	openapi.ResetOpenAPI()
-}
-
-func TestOpenApiFieldNotBuiltin(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-openapi:
-  version: v1.14.1
-resources:
-- deployment.yaml
-`)
-	th.WriteF("deployment.yaml", `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    spec:
-      containers:
-      - image: whatever
-`)
-
-	err := th.RunWithErr(".", th.MakeDefaultOptions())
-	if err == nil {
-		t.Fatalf("expected an error")
-	}
-	openapi.ResetOpenAPI()
-}
-
-func TestOpenApiFieldDefaultVersion(t *testing.T) {
-	th := kusttest_test.MakeHarness(t)
-	th.WriteK(".", `
-resources:
-- deployment.yaml
-`)
-	th.WriteF("deployment.yaml", `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    spec:
-      containers:
-      - image: whatever
-`)
-
-	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    spec:
-      containers:
-      - image: whatever
-`)
-	assert.Equal(t, kubernetesapi.DefaultOpenAPI, openapi.GetSchemaVersion())
-	openapi.ResetOpenAPI()
-}

api/krusty/patchdelete_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/pluginenv_test.go

@@ -4,7 +4,6 @@
 package krusty_test
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -27,8 +26,13 @@ func TestPluginEnvironment(t *testing.T) {
 		kusttest_test.MakeHarnessWithFs(t, filesys.MakeFsInMemory()),
 		filesys.Separator)
 
-	dir := makeTmpDir(t)
-	defer os.RemoveAll(dir)
+	// On MacOS, $TMPDIR is by default set to /var/folders/…, with /var a
+	// symlink to /private/var , which does not match our expectations
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
 	confirmBehavior(
 		kusttest_test.MakeHarnessWithFs(t, filesys.MakeFsOnDisk()),
 		dir)
@@ -65,15 +69,3 @@ metadata:
   name: hello
 `)
 }
-
-func makeTmpDir(t *testing.T) string {
-	base, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("err %v", err)
-	}
-	dir, err := ioutil.TempDir(base, "kustomize-tmp-test-")
-	if err != nil {
-		t.Fatalf("err %v", err)
-	}
-	return dir
-}

api/krusty/remoteload_test.go

@@ -9,76 +9,20 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/internal/utils"
+	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/krusty"
 	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
-func TestRemoteLoad(t *testing.T) {
-	fSys := filesys.MakeFsOnDisk()
-	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-	m, err := b.Run(
-		fSys,
-		"github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6")
-	if utils.IsErrTimeout(err) {
-		// Don't fail on timeouts.
-		t.SkipNow()
-	}
-	if !assert.NoError(t, err) {
-		t.FailNow()
-	}
-	yml, err := m.AsYaml()
-	assert.NoError(t, err)
-	assert.Equal(t, `apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    app: myapp
-  name: dev-myapp-pod
-spec:
-  containers:
-  - image: nginx:1.7.9
-    name: nginx
-`, string(yml))
-}
+const resourcesField = `resources:
+- %s`
+const resourceErrorFormat = "accumulating resources: accumulation err='accumulating resources from '%s': "
+const fileError = "evalsymlink failure"
+const repoFindError = "URL is a git repository"
 
-func TestRemoteResource(t *testing.T) {
-	fSys := filesys.MakeFsOnDisk()
-	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
-resources:
-- github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
-`)))
-	m, err := b.Run(
-		fSys,
-		tmpDir.String())
-	if utils.IsErrTimeout(err) {
-		// Don't fail on timeouts.
-		t.SkipNow()
-	}
-	assert.NoError(t, err)
-	yml, err := m.AsYaml()
-	assert.NoError(t, err)
-	assert.Equal(t, `apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    app: myapp
-  name: dev-myapp-pod
-spec:
-  containers:
-  - image: nginx:1.7.9
-    name: nginx
-`, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
-}
-
-func TestRemoteResourceGitHTTP(t *testing.T) {
-	output := `apiVersion: v1
+const multibaseDevExampleBuild = `apiVersion: v1
 kind: Pod
 metadata:
   labels:
@@ -89,100 +33,331 @@ spec:
   - image: nginx:1.7.9
     name: nginx
 `
-	tests := []struct {
-		input []byte
-	}{
-		{
-			input: []byte(`
+
+type remoteResourceCase struct {
+	skip          bool
+	kustomization string
+	error         bool
+	expected      string // if error, expected is error string
+}
+
+func createKustDir(content string, require *require.Assertions) (filesys.FileSystem, filesys.ConfirmedDir) {
+	fSys := filesys.MakeFsOnDisk()
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	require.NoError(err)
+	require.NoError(fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(content)))
+	return fSys, tmpDir
+}
+
+func checkYaml(actual resmap.ResMap, expected string, require *require.Assertions) {
+	yml, err := actual.AsYaml()
+	require.NoError(err)
+	require.Equal(expected, string(yml))
+}
+
+func testRemoteResource(require *require.Assertions, test *remoteResourceCase) {
+	fSys, tmpDir := createKustDir(test.kustomization, require)
+
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+
+	if test.error {
+		require.Error(err)
+		require.Contains(err.Error(), test.expected)
+	} else {
+		require.NoError(err)
+		checkYaml(m, test.expected, require)
+	}
+
+	require.NoError(fSys.RemoveAll(tmpDir.String()))
+}
+
+func TestRemoteLoad(t *testing.T) {
+	require := require.New(t)
+
+	fSys := filesys.MakeFsOnDisk()
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
+
+	m, err := b.Run(
+		fSys,
+		"github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6")
+	require.NoError(err)
+	checkYaml(m, multibaseDevExampleBuild, require)
+}
+
+func TestRemoteResourceHttps(t *testing.T) {
+	tests := map[string]remoteResourceCase{
+		"basic": {
+			kustomization: `
 resources:
-- https://github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
-`),
+- https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
 		},
-		{
-			input: []byte(`
+		".git repo suffix, no slash suffix": {
+			kustomization: `
 resources:
-- https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6
-`),
+- https://github.com/kubernetes-sigs/kustomize.git//examples/multibases/dev?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
 		},
-		{
-			input: []byte(`
+		"repo": {
+			kustomization: `
 resources:
-- git::https://github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
-`),
+- https://github.com/annasong20/kustomize-test.git?ref=main`,
+			expected: multibaseDevExampleBuild,
 		},
-		{
-			input: []byte(`
+		"raw remote file": {
+			kustomization: `
 resources:
-- git::https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6
-`),
+- https://raw.githubusercontent.com/kubernetes-sigs/kustomize/v3.1.0/examples/multibases/base/pod.yaml
+namePrefix: dev-`,
+			expected: multibaseDevExampleBuild,
 		},
 	}
 
-	for _, test := range tests {
-		fSys := filesys.MakeFsOnDisk()
-		b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-		tmpDir, err := filesys.NewTmpConfirmedDir()
-		assert.NoError(t, err)
-		assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), test.input))
-		m, err := b.Run(fSys, tmpDir.String())
-		if utils.IsErrTimeout(err) {
-			// Don't fail on timeouts.
-			t.SkipNow()
-		}
-		assert.NoError(t, err)
-		yml, err := m.AsYaml()
-		assert.NoError(t, err)
-		assert.Equal(t, output, string(yml))
-		assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
 	}
 }
 
-func TestRemoteResourceWithHTTPError(t *testing.T) {
-	fSys := filesys.MakeFsOnDisk()
-	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+func TestRemoteResourceSsh(t *testing.T) {
+	// TODO: add ssh keys to server to run these tests
+	tests := map[string]remoteResourceCase{
+		"scp shorthand": {
+			skip: true,
+			kustomization: `
+resources:
+- git@github.com:kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+		"full ssh, no ending slash": {
+			skip: true,
+			kustomization: `
+resources:
+- ssh://git@github.com/kubernetes-sigs/kustomize//examples/multibases/dev?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+		"repo": {
+			skip: true,
+			kustomization: `
+resources:
+- ssh://git@github.com/annasong20/kustomize-test.git?ref=main`,
+			expected: multibaseDevExampleBuild,
+		},
+	}
+
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
+	}
+}
+
+func TestRemoteResourcePort(t *testing.T) {
+	sshURL := "ssh://git@github.com:22/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6"
+	httpsURL := "https://github.com:443/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6"
+
+	// TODO: ports not currently supported; implement in future
+	tests := map[string]remoteResourceCase{
+		"ssh": {
+			skip:          true,
+			kustomization: fmt.Sprintf(resourcesField, sshURL),
+			error:         true,
+			expected:      fmt.Sprintf(resourceErrorFormat+fileError, sshURL),
+		},
+		"https": {
+			kustomization: fmt.Sprintf(resourcesField, httpsURL),
+			error:         true,
+			expected:      fmt.Sprintf(resourceErrorFormat+repoFindError, httpsURL),
+		},
+	}
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
+	}
+}
+
+func TestRemoteResourceRepo(t *testing.T) {
+	tests := map[string]remoteResourceCase{
+		"https, no ref": {
+			// TODO: fix flaky test that sporadically throws errors on server
+			skip: true,
+			kustomization: `
+resources:
+- https://github.com/annasong20/kustomize-test.git`,
+			expected: multibaseDevExampleBuild,
+		},
+		"ssh, no ref": {
+			skip: true,
+			kustomization: `
+resources:
+- git@github.com:annasong20/kustomize-test.git`,
+			expected: multibaseDevExampleBuild,
+		},
+	}
+
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
+	}
+}
+
+func TestRemoteResourceParameters(t *testing.T) {
+	httpsNoParam := "https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev/"
+	httpsMasterBranch := "https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev?ref=master"
+	sshNoParams := "git@github.com:kubernetes-sigs/kustomize//examples/multibases/dev"
+
+	// TODO: cases with expected errors are query parameter combinations that aren't supported yet; implement in future
+	// TODO: fix flaky tests (non-ssh tests that we skip) that sporadically fail on server
+	tests := map[string]remoteResourceCase{
+		"https no params": {
+			skip:          true,
+			kustomization: fmt.Sprintf(resourcesField, httpsNoParam),
+			error:         true,
+			expected:      fmt.Sprintf(resourceErrorFormat+repoFindError, httpsNoParam),
+		},
+		"https master": {
+			skip:          true,
+			kustomization: fmt.Sprintf(resourcesField, httpsMasterBranch),
+			error:         true,
+			expected:      fmt.Sprintf(resourceErrorFormat+repoFindError, httpsMasterBranch),
+		},
+		"https master and no submodules": {
+			skip: true,
+			kustomization: `
+resources:
+- https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev?ref=master&submodules=false`,
+			expected: multibaseDevExampleBuild,
+		},
+		"https all params": {
+			skip: true,
+			kustomization: `
+resources:
+- https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev?ref=v1.0.6&timeout=10&submodules=true`,
+			expected: multibaseDevExampleBuild,
+		},
+		"ssh no params": {
+			skip:          true,
+			kustomization: fmt.Sprintf(resourcesField, sshNoParams),
+			error:         true,
+			expected:      fmt.Sprintf(resourceErrorFormat+fileError, sshNoParams),
+		},
+		"ssh all params": {
+			skip: true,
+			kustomization: `
+resources:
+- ssh://git@github.com/annasong20/kustomize-test.git?ref=main&timeout=10&submodules=true`,
+			expected: multibaseDevExampleBuild,
+		},
+	}
+
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
+	}
+}
+
+func TestRemoteResourceGoGetter(t *testing.T) {
+	// TODO: fix flaky tests (the ones that we skip) that fail sporadically on server
+	tests := map[string]remoteResourceCase{
+		"git detector with / subdirectory separator": {
+			skip: true,
+			kustomization: `
+resources:
+- github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+		"git detector for repo": {
+			skip: true,
+			kustomization: `
+resources:
+- github.com/annasong20/kustomize-test`,
+			expected: multibaseDevExampleBuild,
+		},
+		"https with / subdirectory separator": {
+			skip: true,
+			kustomization: `
+resources:
+- https://github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+		"git forced protocol": {
+			kustomization: `
+resources:
+- git::https://github.com/kubernetes-sigs/kustomize//examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+		"git forced protocol with / subdirectory separator": {
+			skip: true,
+			kustomization: `
+resources:
+- git::https://github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6`,
+			expected: multibaseDevExampleBuild,
+		},
+	}
+
+	for name, test := range tests {
+		test := test
+		t.Run(name, func(t *testing.T) {
+			if test.skip {
+				t.SkipNow()
+			}
+			testRemoteResource(require.New(t), &test)
+		})
+	}
+}
+
+func TestRemoteResourceWithHttpError(t *testing.T) {
+	require := require.New(t)
 
 	url404 := "https://github.com/thisisa404.yaml"
-	kusto := filepath.Join(tmpDir.String(), "kustomization.yaml")
-	assert.NoError(t, fSys.WriteFile(kusto, []byte(fmt.Sprintf(`
-resources:
-- %s
-`, url404))))
+	fSys, tmpDir := createKustDir(fmt.Sprintf(resourcesField, url404), require)
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
 
-	_, err = b.Run(fSys, tmpDir.String())
-	if utils.IsErrTimeout(err) {
-		// Don't fail on timeouts.
-		t.SkipNow()
-	}
+	_, err := b.Run(fSys, tmpDir.String())
 
 	httpErr := fmt.Errorf("%w: status code %d (%s)", loader.ErrorHTTP, 404, http.StatusText(404))
 	accuFromErr := fmt.Errorf("accumulating resources from '%s': %w", url404, httpErr)
 	expectedErr := fmt.Errorf("accumulating resources: %w", accuFromErr)
-	assert.EqualErrorf(t, err, expectedErr.Error(), url404)
+	require.EqualErrorf(err, expectedErr.Error(), url404)
+
+	require.NoError(fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestRemoteResourceAnnoOrigin(t *testing.T) {
-	fSys := filesys.MakeFsOnDisk()
-	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	test := remoteResourceCase{
+		kustomization: `
 resources:
 - github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
 buildMetadata: [originAnnotations]
-`)))
-	m, err := b.Run(
-		fSys,
-		tmpDir.String())
-	if utils.IsErrTimeout(err) {
-		// Don't fail on timeouts.
-		t.SkipNow()
-	}
-	assert.NoError(t, err)
-	yml, err := m.AsYaml()
-	assert.NoError(t, err)
-	assert.Equal(t, `apiVersion: v1
+`,
+		expected: `apiVersion: v1
 kind: Pod
 metadata:
   annotations:
@@ -197,24 +372,28 @@ spec:
   containers:
   - image: nginx:1.7.9
     name: nginx
-`, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+`,
+	}
+
+	testRemoteResource(require.New(t), &test)
 }
 
 func TestRemoteResourceAsBaseWithAnnoOrigin(t *testing.T) {
+	require := require.New(t)
+
 	fSys := filesys.MakeFsOnDisk()
 	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(base, "kustomization.yaml"), []byte(`
+	require.NoError(fSys.Mkdir(base))
+	require.NoError(fSys.Mkdir(prod))
+	require.NoError(fSys.WriteFile(filepath.Join(base, "kustomization.yaml"), []byte(`
 resources:
 - github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(prod, "kustomization.yaml"), []byte(`
+	require.NoError(fSys.WriteFile(filepath.Join(prod, "kustomization.yaml"), []byte(`
 resources:
 - ../base
 namePrefix: prefix-
@@ -224,14 +403,9 @@ buildMetadata: [originAnnotations]
 	m, err := b.Run(
 		fSys,
 		prod)
-	if utils.IsErrTimeout(err) {
-		// Don't fail on timeouts.
-		t.SkipNow()
-	}
-	assert.NoError(t, err)
-	yml, err := m.AsYaml()
-	assert.NoError(t, err)
-	assert.Equal(t, `apiVersion: v1
+	require.NoError(err)
+
+	expected := `apiVersion: v1
 kind: Pod
 metadata:
   annotations:
@@ -246,6 +420,8 @@ spec:
   containers:
   - image: nginx:1.7.9
     name: nginx
-`, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+`
+	checkYaml(m, expected, require)
+
+	require.NoError(fSys.RemoveAll(tmpDir.String()))
 }

api/krusty/repeatbase_test.go

@@ -172,6 +172,5 @@ spec:
 	//      containers:
 	//      - image: image-canary-a
 	//        name: container-a
-	//`)
-
+	// `)
 }

api/krusty/replacementtransformer_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/rolebindingacrossnamespace_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/stringquoteblank_test.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package krusty_test
 
 import (

api/krusty/testdata/localize/simple/deployment.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment-simple
+  labels:
+    app: deployment-simple
+spec:
+  selector:
+    matchLabels:
+      app: simple
+  template:
+    metadata:
+      labels:
+        app: simple
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.16
+        ports:
+        - containerPort: 8080

api/krusty/testdata/localize/simple/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./deployment.yaml
+- ./service.yaml
+
+namePrefix: localize-

api/krusty/testdata/localize/simple/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service-simple
+spec:
+  selector:
+    app: deployment-simple
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080 

api/loader/errors.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
 package loader
 
 import "fmt"

api/loader/fileloader.go

@@ -172,7 +172,7 @@ func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 		return nil, fmt.Errorf("new root cannot be empty")
 	}
 
-	repoSpec, err := git.NewRepoSpecFromUrl(path)
+	repoSpec, err := git.NewRepoSpecFromURL(path)
 	if err == nil {
 		// Treat this as git repo clone request.
 		if err = fl.errIfRepoCycle(repoSpec); err != nil {
@@ -315,7 +315,7 @@ func (fl *fileLoader) Load(path string) ([]byte, error) {
 		}
 		defer resp.Body.Close()
 		if resp.StatusCode < 200 || resp.StatusCode > 299 {
-			_, err := git.NewRepoSpecFromUrl(path)
+			_, err := git.NewRepoSpecFromURL(path)
 			if err == nil {
 				return nil, errors.New("URL is a git repository")
 			}

api/loader/fileloader_test.go

@@ -213,11 +213,9 @@ const (
 //   │   └── symLinkToExteriorData -> ../exteriorData
 //   └── exteriorData
 //
-func commonSetupForLoaderRestrictionTest() (string, filesys.FileSystem, error) {
-	dir, err := ioutil.TempDir("", "kustomize-test-")
-	if err != nil {
-		return "", nil, err
-	}
+func commonSetupForLoaderRestrictionTest(t *testing.T) (string, filesys.FileSystem) {
+	t.Helper()
+	dir := t.TempDir()
 	fSys := filesys.MakeFsOnDisk()
 	fSys.Mkdir(filepath.Join(dir, "base"))
 
@@ -233,13 +231,14 @@ func commonSetupForLoaderRestrictionTest() (string, filesys.FileSystem, error) {
 	os.Symlink(
 		filepath.Join(dir, "exteriorData"),
 		filepath.Join(dir, "base", "symLinkToExteriorData"))
-	return dir, fSys, nil
+	return dir, fSys
 }
 
 // Make sure everything works when loading files
 // in or below the loader root.
 func doSanityChecksAndDropIntoBase(
 	t *testing.T, l ifc.Loader) ifc.Loader {
+	t.Helper()
 	data, err := l.Load(path.Join("base", "okayData"))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -282,11 +281,7 @@ func doSanityChecksAndDropIntoBase(
 }
 
 func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
-	dir, fSys, err := commonSetupForLoaderRestrictionTest()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	defer os.RemoveAll(dir)
+	dir, fSys := commonSetupForLoaderRestrictionTest(t)
 
 	var l ifc.Loader
 
@@ -295,7 +290,7 @@ func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
 	l = doSanityChecksAndDropIntoBase(t, l)
 
 	// Reading symlink to exteriorData fails.
-	_, err = l.Load("symLinkToExteriorData")
+	_, err := l.Load("symLinkToExteriorData")
 	if err == nil {
 		t.Fatalf("expected error")
 	}
@@ -315,11 +310,7 @@ func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
 }
 
 func TestRestrictionNoneInRealLoader(t *testing.T) {
-	dir, fSys, err := commonSetupForLoaderRestrictionTest()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	defer os.RemoveAll(dir)
+	dir, fSys := commonSetupForLoaderRestrictionTest(t)
 
 	var l ifc.Loader
 
@@ -328,7 +319,7 @@ func TestRestrictionNoneInRealLoader(t *testing.T) {
 	l = doSanityChecksAndDropIntoBase(t, l)
 
 	// Reading symlink to exteriorData works.
-	_, err = l.Load("symLinkToExteriorData")
+	_, err := l.Load("symLinkToExteriorData")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -347,7 +338,7 @@ func splitOnNthSlash(v string, n int) (string, string) {
 		if k < 0 {
 			break
 		}
-		left = left + v[:k+1]
+		left += v[:k+1]
 		v = v[k+1:]
 	}
 	return left[:len(left)-1], v
@@ -367,9 +358,9 @@ func TestSplit(t *testing.T) {
 }
 
 func TestNewLoaderAtGitClone(t *testing.T) {
-	rootUrl := "github.com/someOrg/someRepo"
+	rootURL := "github.com/someOrg/someRepo"
 	pathInRepo := "foo/base"
-	url := rootUrl + "/" + pathInRepo
+	url := rootURL + "/" + pathInRepo
 	coRoot := "/tmp"
 	fSys := filesys.MakeFsInMemory()
 	fSys.MkdirAll(coRoot)
@@ -381,7 +372,7 @@ func TestNewLoaderAtGitClone(t *testing.T) {
 whatever
 `))
 
-	repoSpec, err := git.NewRepoSpecFromUrl(url)
+	repoSpec, err := git.NewRepoSpecFromURL(url)
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -398,13 +389,13 @@ whatever
 	if _, err = l.New(url); err == nil {
 		t.Fatalf("expected cycle error 1")
 	}
-	if _, err = l.New(rootUrl + "/" + "foo"); err == nil {
+	if _, err = l.New(rootURL + "/" + "foo"); err == nil {
 		t.Fatalf("expected cycle error 2")
 	}
 
 	pathInRepo = "foo/overlay"
 	fSys.MkdirAll(coRoot + "/" + pathInRepo)
-	url = rootUrl + "/" + pathInRepo
+	url = rootURL + "/" + pathInRepo
 	l2, err := l.New(url)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -459,7 +450,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	// exist in its own repository, so presumably the
 	// remote K would be deliberately designed to phish
 	// for local K's.
-	repoSpec, err := git.NewRepoSpecFromUrl(
+	repoSpec, err := git.NewRepoSpecFromURL(
 		"github.com/someOrg/someRepo/foo/overlay")
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
@@ -533,7 +524,7 @@ func TestRepoDirectCycleDetection(t *testing.T) {
 		RestrictionRootOnly, root, fSys, nil,
 		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	p1 := "github.com/someOrg/someRepo/foo"
-	rs1, err := git.NewRepoSpecFromUrl(p1)
+	rs1, err := git.NewRepoSpecFromURL(p1)
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}

api/loader/loader.go

@@ -19,7 +19,7 @@ import (
 func NewLoader(
 	lr LoadRestrictorFunc,
 	target string, fSys filesys.FileSystem) (ifc.Loader, error) {
-	repoSpec, err := git.NewRepoSpecFromUrl(target)
+	repoSpec, err := git.NewRepoSpecFromURL(target)
 	if err == nil {
 		// The target qualifies as a remote git target.
 		return newLoaderAtGitClone(

api/resmap/factory.go

@@ -78,8 +78,8 @@ func (rmF *Factory) NewResMapFromBytes(b []byte) (ResMap, error) {
 func (rmF *Factory) NewResMapFromConfigMapArgs(
 	kvLdr ifc.KvLoader, argList []types.ConfigMapArgs) (ResMap, error) {
 	var resources []*resource.Resource
-	for _, args := range argList {
-		res, err := rmF.resF.MakeConfigMap(kvLdr, &args)
+	for i := range argList {
+		res, err := rmF.resF.MakeConfigMap(kvLdr, &argList[i])
 		if err != nil {
 			return nil, errors.Wrap(err, "NewResMapFromConfigMapArgs")
 		}
@@ -103,8 +103,8 @@ func (rmF *Factory) FromConfigMapArgs(
 func (rmF *Factory) NewResMapFromSecretArgs(
 	kvLdr ifc.KvLoader, argsList []types.SecretArgs) (ResMap, error) {
 	var resources []*resource.Resource
-	for _, args := range argsList {
-		res, err := rmF.resF.MakeSecret(kvLdr, &args)
+	for i := range argsList {
+		res, err := rmF.resF.MakeSecret(kvLdr, &argsList[i])
 		if err != nil {
 			return nil, errors.Wrap(err, "NewResMapFromSecretArgs")
 		}

api/resmap/reswrangler.go

@@ -429,7 +429,6 @@ func getNamespacesForRoleBinding(r *resource.Resource) (map[string]bool, error)
 	if r.GetKind() != "RoleBinding" {
 		return result, nil
 	}
-	//nolint staticcheck
 	subjects, err := r.GetSlice("subjects")
 	if err != nil || subjects == nil {
 		return result, nil
@@ -442,7 +441,7 @@ func getNamespacesForRoleBinding(r *resource.Resource) (map[string]bool, error)
 					if n, ok3 := ns.(string); ok3 {
 						result[n] = true
 					} else {
-						return nil, errors.New(fmt.Sprintf("Invalid Input: namespace is blank for resource %q\n", r.CurId()))
+						return nil, errors.Errorf("Invalid Input: namespace is blank for resource %q\n", r.CurId())
 					}
 				}
 			}

api/resmap/reswrangler_test.go

@@ -56,12 +56,14 @@ var origin2 = &resource.Origin{
 }
 
 func doAppend(t *testing.T, w ResMap, r *resource.Resource) {
+	t.Helper()
 	err := w.Append(r)
 	if err != nil {
 		t.Fatalf("append error: %v", err)
 	}
 }
 func doRemove(t *testing.T, w ResMap, id resid.ResId) {
+	t.Helper()
 	err := w.Remove(id)
 	if err != nil {
 		t.Fatalf("remove error: %v", err)
@@ -116,7 +118,7 @@ func TestAppendRemove(t *testing.T) {
 	doAppend(t, w2, makeCm(2))
 	doAppend(t, w2, makeCm(4))
 	doAppend(t, w2, makeCm(6))
-	if !reflect.DeepEqual(w1, w1) {
+	if !reflect.DeepEqual(w1, w2) {
 		w1.Debug("w1")
 		w2.Debug("w2")
 		t.Fatalf("mismatch")
@@ -431,7 +433,6 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 	m := resmaptest_test.NewRmBuilder(t, rf).
 		AddR(r1).AddR(r2).AddR(r3).AddR(r4).AddR(r5).ResMap()
 
-	// nolint:goconst
 	tests := []struct {
 		name    string
 		matcher IdMatcher

api/resmap/selector_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func setupRMForPatchTargets(t *testing.T) ResMap {
+	t.Helper()
 	result, err := rmF.NewResMapFromBytes([]byte(`
 apiVersion: group1/v1
 kind: Kind1

api/resource/origin.go

@@ -50,7 +50,7 @@ func (origin *Origin) Copy() Origin {
 // Append returns a copy of origin with a path appended to it
 func (origin *Origin) Append(path string) *Origin {
 	originCopy := origin.Copy()
-	repoSpec, err := git.NewRepoSpecFromUrl(path)
+	repoSpec, err := git.NewRepoSpecFromURL(path)
 	if err == nil {
 		originCopy.Repo = repoSpec.Host + repoSpec.OrgRepo
 		absPath := repoSpec.AbsPath()

api/resource/resource.go

@@ -26,7 +26,6 @@ type Resource struct {
 	refVarNames []string
 }
 
-// nolint
 var BuildAnnotations = []string{
 	utils.BuildAnnotationPreviousKinds,
 	utils.BuildAnnotationPreviousNames,

api/testutils/filtertest/runfilter.go

@@ -32,6 +32,7 @@ func run(input string, f kio.Filter) (string, error) {
 
 // RunFilter runs filter and panic if there is error
 func RunFilter(t *testing.T, input string, f kio.Filter) string {
+	t.Helper()
 	output, err := run(input, f)
 	if !assert.NoError(t, err) {
 		t.FailNow()
@@ -41,6 +42,7 @@ func RunFilter(t *testing.T, input string, f kio.Filter) string {
 
 // RunFilterE runs filter and return error if there is
 func RunFilterE(t *testing.T, input string, f kio.Filter) (string, error) {
+	t.Helper()
 	output, err := run(input, f)
 	if err != nil {
 		return "", err

api/testutils/kusttest/harness.go

@@ -22,11 +22,13 @@ type Harness struct {
 }
 
 func MakeHarness(t *testing.T) Harness {
+	t.Helper()
 	return MakeHarnessWithFs(t, filesys.MakeFsInMemory())
 }
 
 func MakeHarnessWithFs(
 	t *testing.T, fSys filesys.FileSystem) Harness {
+	t.Helper()
 	return Harness{
 		t:    t,
 		fSys: fSys,

api/testutils/kusttest/harnessenhanced.go

@@ -47,6 +47,7 @@ type HarnessEnhanced struct {
 }
 
 func MakeEnhancedHarness(t *testing.T) *HarnessEnhanced {
+	t.Helper()
 	r := makeBaseEnhancedHarness(t)
 	r.Harness = MakeHarnessWithFs(t, filesys.MakeFsInMemory())
 	// Point the Harness's file loader to the root ('/')
@@ -56,6 +57,7 @@ func MakeEnhancedHarness(t *testing.T) *HarnessEnhanced {
 }
 
 func MakeEnhancedHarnessWithTmpRoot(t *testing.T) *HarnessEnhanced {
+	t.Helper()
 	r := makeBaseEnhancedHarness(t)
 	fSys := filesys.MakeFsOnDisk()
 	r.Harness = MakeHarnessWithFs(t, fSys)
@@ -72,6 +74,7 @@ func MakeEnhancedHarnessWithTmpRoot(t *testing.T) *HarnessEnhanced {
 }
 
 func makeBaseEnhancedHarness(t *testing.T) *HarnessEnhanced {
+	t.Helper()
 	rf := resmap.NewFactory(
 		provider.NewDefaultDepProvider().GetResourceFactory())
 	return &HarnessEnhanced{