Merge pull request #5735 from koba1t/pinToCmdConfig

Update cmd/config to v0.14.2

CONTRIBUTING.md

@@ -75,14 +75,39 @@ cd kustomize
 git push origin myfeature
 ```
 
+### Pull Request Rules
+
+We are using [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) as the main guideline of making PR. This guideline serves to help contributor and maintainer to classify their changes, thus providing better insight on type of release will be covered on each Kustomize release cycle.
+
+1. Please add these keywords on your PR titles accordingly
+
+| Keyword  | Description | Example |
+| ------------- | ------------- | ------------- |
+| fix  | Patching or fixing bugs or improvements introduction from previous release. This type of change will mark a `PATCH` release.  | fix: fix null value when generating yaml |
+| feat  | New features. This change will mark a `MINOR` release. | feat: new transformer and generator for ACME API CRD. |
+| chore  | Minor improvement outside main code base  | chore: add exclusion for transformer test. |
+| ci | CI/CD related changes (e.g. github workflow, scripts, CI steps). | ci: remove blocking tests |
+| docs  | Changes related to documentation. | docs: add rules documentation for PR. |
+
+
+2. Add `BREAKING CHANGE:` on your commit message as footer to signify breaking changes. This will help maintainers identify `MAJOR` releases.
+  
+Example:
+
+```
+feat: change YAML parser from `yaml/v1` to `yaml/v2`
+
+BREAKING CHANGE: parse() function now works with 2 arguments.
+```
+
 ### Create a Pull Request
+
 1. Visit your fork at `https://github.com/<user>/kustomize`
 2. Click the **Compare & Pull Request** button next to your `myfeature` branch.
 3. Check out the pull request [process](https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md) for more details and advice.
 
 If you ran `git push` in the previous step, GitHub will return a useful link to create a Pull Request.
 
-
 ### Build Kustomize
 The [Kustomize Architecture] document describes the respository organization and the kustomize build process.
 ```bash

Makefile

@@ -3,7 +3,7 @@
 #
 # Makefile for kustomize CLI and API.
 
-LATEST_RELEASE=v5.3.0
+LATEST_RELEASE=v5.4.2
 
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)

api/Makefile

@@ -11,3 +11,18 @@ build:
 
 generate: $(MYGOBIN)/k8scopy $(MYGOBIN)/stringer
 	go generate ./...
+
+lint: lint-api-static
+
+## lint-api-static runs the linter on the API module
+## with build-tag kustomize_disable_go_plugin_support
+## this aims to catch any issues with the API module
+## that would prevent the API module from being used
+## when the go plugin support is disabled.
+lint-api-static:
+	$(MYGOBIN)/golangci-lint cache clean # Workaround for https://github.com/golangci/golangci-lint/issues/3228
+	$(MYGOBIN)/golangci-lint \
+	  -c $$KUSTOMIZE_ROOT/.golangci.yml \
+	  --build-tags kustomize_disable_go_plugin_support \
+	  --path-prefix api \
+	  run ./...

api/go.mod

@@ -10,7 +10,7 @@ require (
 	go.uber.org/goleak v1.3.0
 	gopkg.in/evanphx/json-patch.v4 v4.12.0
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00
-	sigs.k8s.io/kustomize/kyaml v0.17.0
+	sigs.k8s.io/kustomize/kyaml v0.17.2
 	sigs.k8s.io/yaml v1.4.0
 )
 
@@ -29,7 +29,7 @@ require (
 	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

api/go.sum

@@ -71,8 +71,8 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0H
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -93,7 +93,7 @@ k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/A
 k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/kyaml v0.17.0 h1:G2bWs03V9Ur2PinHLzTUJ8Ded+30SzXZKiO92SRDs3c=
-sigs.k8s.io/kustomize/kyaml v0.17.0/go.mod h1:6lxkYF1Cv9Ic8g/N7I86cvxNc5iinUo/P2vKsHNmpyE=
+sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
+sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

api/internal/accumulator/loadconfigfromcrds.go

@@ -144,7 +144,7 @@ func loadCrdIntoConfig(
 		}
 		_, label := property.Extensions.GetString(xLabelSelector)
 		if label {
-			err = theConfig.AddLabelFieldSpec(
+			err = theConfig.AddCommonLabelsFieldSpec(
 				makeFs(theGvk, append(path, propName)))
 			if err != nil {
 				return

api/internal/accumulator/namereferencetransformer_test.go

@@ -590,7 +590,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 
-	v1 := rf.FromMapWithName(
+	v1, err := rf.FromMapWithName(
 		"volume1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -599,7 +599,10 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"name": "someprefix-volume1",
 			},
 		})
-	c1 := rf.FromMapWithName(
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
+	c1, err := rf.FromMapWithName(
 		"claim1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -612,9 +615,11 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"volumeName": "volume1",
 			},
 		})
-
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
 	v2 := v1.DeepCopy()
-	c2 := rf.FromMapWithName(
+	c2, err := rf.FromMapWithName(
 		"claim1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -627,6 +632,9 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"volumeName": "someprefix-volume1",
 			},
 		})
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
 
 	m1 := resmaptest_test.NewRmBuilder(t, rf).AddR(v1).AddR(c1).ResMap()
 

api/internal/accumulator/resaccumulator_test.go

@@ -64,7 +64,7 @@ func makeResAccumulator(t *testing.T) *ResAccumulator {
 					"name": "backendTwo",
 				}}).ResMap())
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to append resources: %v", err)
 	}
 	return ra
 }
@@ -143,22 +143,26 @@ func expectLog(t *testing.T, log bytes.Buffer, expect string) {
 func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
 	ra := makeResAccumulator(t)
 	rm0 := resmap.New()
-	err := rm0.Append(
-		provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "Service",
-				"metadata": map[string]interface{}{
-					"name":      "backendOne",
-					"namespace": "fooNamespace",
-				},
-			}))
+
+	r, err := provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]interface{}{
+				"name":      "backendOne",
+				"namespace": "fooNamespace",
+			},
+		})
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to get instance of resources: %v", err)
+	}
+	err = rm0.Append(r)
+	if err != nil {
+		t.Fatalf("failed to append a resource to ResMap: %v", err)
 	}
 	err = ra.AppendAll(rm0)
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to append a resource to ResAccumulator: %v", err)
 	}
 
 	err = ra.MergeVars([]types.Var{
@@ -227,7 +231,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	// create accumulators holding apparently conflicting vars that are not
 	// actually in conflict because they point to the same concrete value.
 	rm0 := resmap.New()
-	err := rm0.Append(rf.FromMap(fooAws))
+	r0, err0 := rf.FromMap(fooAws)
+	if err0 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err0)
+	}
+	err := rm0.Append(r0)
 	require.NoError(t, err)
 	ac0 := MakeEmptyAccumulator()
 	err = ac0.AppendAll(rm0)
@@ -236,7 +244,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	require.NoError(t, err)
 
 	rm1 := resmap.New()
-	err = rm1.Append(rf.FromMap(barAws))
+	r1, err1 := rf.FromMap(barAws)
+	if err1 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err1)
+	}
+	err = rm1.Append(r1)
 	require.NoError(t, err)
 	ac1 := MakeEmptyAccumulator()
 	err = ac1.AppendAll(rm1)
@@ -255,7 +267,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	// two above (because it contains a variable whose name is used in the other
 	// accumulators AND whose concrete values are different).
 	rm2 := resmap.New()
-	err = rm2.Append(rf.FromMap(barGcp))
+	r2, err2 := rf.FromMap(barGcp)
+	if err2 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err2)
+	}
+	err = rm2.Append(r2)
 	require.NoError(t, err)
 	ac2 := MakeEmptyAccumulator()
 	err = ac2.AppendAll(rm2)

api/internal/builtins/SortOrderTransformer.go

@@ -74,34 +74,16 @@ func (p *SortOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
 
 	// Sort
 	if p.SortOptions.Order == types.LegacySortOrder {
-		s := newLegacyIDSorter(m.AllIds(), p.SortOptions.LegacySortOptions)
+		s := newLegacyIDSorter(m.Resources(), p.SortOptions.LegacySortOptions)
 		sort.Sort(s)
-		err = applyOrdering(m, s.resids)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
 
-// applyOrdering takes resources (given in ResMap) and a desired ordering given
-// as a sequence of ResIds, and updates the ResMap's resources to match the
-// ordering.
-func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
-	var err error
-	resources := make([]*resource.Resource, m.Size())
-	// Clear and refill with the correct order
-	for i, id := range ordering {
-		resources[i], err = m.GetByCurrentId(id)
-		if err != nil {
-			return errors.WrapPrefixf(err, "expected match for sorting")
-		}
-	}
-	m.Clear()
-	for _, r := range resources {
-		err = m.Append(r)
-		if err != nil {
-			return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+		// Clear the map and re-add the resources in the sorted order.
+		m.Clear()
+		for _, r := range s.resources {
+			err := m.Append(r)
+			if err != nil {
+				return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+			}
 		}
 	}
 	return nil
@@ -117,12 +99,17 @@ func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
 type legacyIDSorter struct {
 	// resids only stores the metadata of the object. This is an optimization as
 	// it's expensive to compute these again and again during ordering.
-	resids     []resid.ResId
+	resids []resid.ResId
+	// Initially, we sorted the metadata (ResId) of each object and then called GetByCurrentId on each to construct the final list.
+	// The problem is that GetByCurrentId is inefficient and does a linear scan in a list every time we do that.
+	// So instead, we sort resources alongside the ResIds.
+	resources []*resource.Resource
+
 	typeOrders map[string]int
 }
 
 func newLegacyIDSorter(
-	resids []resid.ResId,
+	resources []*resource.Resource,
 	options *types.LegacySortOptions) *legacyIDSorter {
 	// Precalculate a resource ranking based on the priority lists.
 	var typeOrders = func() map[string]int {
@@ -135,10 +122,13 @@ func newLegacyIDSorter(
 		}
 		return m
 	}()
-	return &legacyIDSorter{
-		resids:     resids,
-		typeOrders: typeOrders,
+
+	ret := &legacyIDSorter{typeOrders: typeOrders}
+	for _, res := range resources {
+		ret.resids = append(ret.resids, res.CurId())
+		ret.resources = append(ret.resources, res)
 	}
+	return ret
 }
 
 var _ sort.Interface = legacyIDSorter{}
@@ -146,6 +136,7 @@ var _ sort.Interface = legacyIDSorter{}
 func (a legacyIDSorter) Len() int { return len(a.resids) }
 func (a legacyIDSorter) Swap(i, j int) {
 	a.resids[i], a.resids[j] = a.resids[j], a.resids[i]
+	a.resources[i], a.resources[j] = a.resources[j], a.resources[i]
 }
 func (a legacyIDSorter) Less(i, j int) bool {
 	if !a.resids[i].Gvk.Equals(a.resids[j].Gvk) {

api/internal/konfig/builtinpluginconsts/namereference.go

@@ -421,6 +421,13 @@ nameReference:
   fieldSpecs:
   - path: spec/ingressClassName
     kind: Ingress
+
+- kind: ValidatingAdmissionPolicy
+  group: admissionregistration.k8s.io
+  fieldSpecs:
+  - path: spec/policyName
+    kind: ValidatingAdmissionPolicyBinding
+    group: admissionregistration.k8s.io
 `
 )
 

api/internal/localizer/localizer.go

@@ -381,7 +381,7 @@ func (lc *localizer) localizeFileWithContent(path string, content []byte) (strin
 		// 2. avoid paths that temporarily traverse outside the current root,
 		//    i.e. ../../../scope/target/current-root. The localized file will be surrounded by
 		//    different directories than its source, and so an uncleaned path may no longer be valid.
-		locPath = cleanFilePath(lc.fSys, lc.root, path)
+		locPath = cleanedRelativePath(lc.fSys, lc.root, path)
 	}
 	absPath := filepath.Join(lc.dst, locPath)
 	if err := lc.fSys.MkdirAll(filepath.Dir(absPath)); err != nil {

api/internal/localizer/localizer_test.go

@@ -296,8 +296,10 @@ func TestLocalizeFileCleaned(t *testing.T) {
 kind: Kustomization
 patches:
 - path: ../gamma/../../../alpha/beta/./gamma/patch.yaml
+- path: /alpha/beta/../beta/./gamma/patch2.yaml
 `,
-		"patch.yaml": podConfiguration,
+		"patch.yaml":  podConfiguration,
+		"patch2.yaml": podConfiguration,
 	}
 	expected, actual := makeFileSystems(t, "/alpha/beta/gamma", kustAndPatch)
 
@@ -307,8 +309,10 @@ patches:
 kind: Kustomization
 patches:
 - path: patch.yaml
+- path: patch2.yaml
 `,
-		"patch.yaml": podConfiguration,
+		"patch.yaml":  podConfiguration,
+		"patch2.yaml": podConfiguration,
 	})
 	checkFSys(t, expected, actual)
 }
@@ -1194,19 +1198,40 @@ func TestLocalizeResources(t *testing.T) {
 kind: Kustomization
 resources:
 - pod.yaml
+- /a/b/pod2.yaml
 - ../../alpha
 `,
-		"pod.yaml": podConfiguration,
+		"pod.yaml":  podConfiguration,
+		"pod2.yaml": podConfiguration,
 		"../../alpha/kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namePrefix: my-
 `,
 	}
-	expected, actual := makeFileSystems(t, "/a/b", kustAndResources)
 
-	checkRun(t, actual, "/a/b", "/", "/localized-b")
-	addFiles(t, expected, "/localized-b/a/b", kustAndResources)
-	checkFSys(t, expected, actual)
+	// Absolute path of `/a/b/pod2.yaml` is expected to be converted to a path
+	// relative to the kustomization root.
+	expectedKustAndResources := map[string]string{
+		"kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- pod.yaml
+- pod2.yaml
+- ../../alpha
+`,
+		"pod.yaml":  podConfiguration,
+		"pod2.yaml": podConfiguration,
+		"../../alpha/kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: my-
+`,
+	}
+
+	expectedFs, actualFs := makeFileSystems(t, "/a/b", kustAndResources)
+
+	checkRun(t, actualFs, "/a/b", "/", "/localized-b")
+	addFiles(t, expectedFs, "/localized-b/a/b", expectedKustAndResources)
+	checkFSys(t, expectedFs, actualFs)
 }
 
 func TestLocalizePathError(t *testing.T) {

api/internal/localizer/locloader.go

@@ -89,11 +89,8 @@ func (ll *Loader) Load(path string) ([]byte, error) {
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "invalid file reference")
 	}
-	if filepath.IsAbs(path) {
-		return nil, errors.Errorf("absolute paths not yet supported in alpha: file path %q is absolute", path)
-	}
 	if !loader.IsRemoteFile(path) && ll.local {
-		cleanPath := cleanFilePath(ll.fSys, filesys.ConfirmedDir(ll.Root()), path)
+		cleanPath := cleanedRelativePath(ll.fSys, filesys.ConfirmedDir(ll.Root()), path)
 		cleanAbs := filepath.Join(ll.Root(), cleanPath)
 		dir := filesys.ConfirmedDir(filepath.Dir(cleanAbs))
 		// target cannot reference newDir, as this load would've failed prior to localize;

api/internal/localizer/locloader_test.go

@@ -276,11 +276,11 @@ func TestLoadFails(t *testing.T) {
 	checkNewLoader(req, ldr, &args, "/a", "/a", "/a/newDir", fSys)
 
 	cases := map[string]string{
-		"absolute path":     "/a/pod.yaml",
-		"directory":         "b",
-		"non-existent file": "kubectl.yaml",
-		"file outside root": "../alpha/beta/gamma/delta/deployment.yaml",
-		"inside dst":        "newDir/pod.yaml",
+		"directory":          "b",
+		"non-existent file":  "kubectl.yaml",
+		"file outside root":  "../alpha/beta/gamma/delta/deployment.yaml",
+		"inside dst":         "newDir/pod.yaml",
+		"winding inside dst": "/a/test/../newDir/pod.yaml",
 	}
 	for name, file := range cases {
 		file := file
@@ -291,8 +291,6 @@ func TestLoadFails(t *testing.T) {
 			ldr, _, err := NewLoader("./a/../a", "/a/../a", "/a/newDir", fSys)
 			req.NoError(err)
 
-			req.NoError(fSys.WriteFile("/a/newDir/pod.yaml", []byte(podConfiguration)))
-
 			_, err = ldr.Load(file)
 			req.Error(err)
 		})

api/internal/localizer/util.go

@@ -112,9 +112,13 @@ func hasRef(repoURL string) bool {
 	return repoSpec.Ref != ""
 }
 
-// cleanFilePath returns file cleaned, where file is a relative path to root on fSys
-func cleanFilePath(fSys filesys.FileSystem, root filesys.ConfirmedDir, file string) string {
-	abs := root.Join(file)
+// cleanedRelativePath returns a cleaned relative path of file to root on fSys
+func cleanedRelativePath(fSys filesys.FileSystem, root filesys.ConfirmedDir, file string) string {
+	abs := file
+	if !filepath.IsAbs(file) {
+		abs = root.Join(file)
+	}
+
 	dir, f, err := fSys.CleanedAbs(abs)
 	if err != nil {
 		log.Fatalf("cannot clean validated file path %q: %s", abs, err)

api/internal/localizer/util_test.go

@@ -301,3 +301,26 @@ func TestLocRootPath_SymlinkPath(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, expected, actual)
 }
+
+func TestCleanedRelativePath(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	require.NoError(t, fSys.MkdirAll("/root/test"))
+	require.NoError(t, fSys.WriteFile("/root/test/file.yaml", []byte("")))
+	require.NoError(t, fSys.WriteFile("/root/filetwo.yaml", []byte("")))
+
+	// Absolute path is cleaned to relative path
+	cleanedPath := cleanedRelativePath(fSys, "/root/", "/root/test/file.yaml")
+	require.Equal(t, "test/file.yaml", cleanedPath)
+
+	// Winding absolute path is cleaned to relative path
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "/root/test/../filetwo.yaml")
+	require.Equal(t, "filetwo.yaml", cleanedPath)
+
+	// Already clean relative path stays the same
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/file.yaml")
+	require.Equal(t, "test/file.yaml", cleanedPath)
+
+	// Winding relative path is cleaned
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/../filetwo.yaml")
+	require.Equal(t, "filetwo.yaml", cleanedPath)
+}

api/internal/plugins/builtinconfig/loaddefaultconfig_test.go

@@ -70,30 +70,3 @@ namoPrefix:
 		t.Fatalf("expected error %s, but got %s", errMsg, err)
 	}
 }
-
-// please remove this failing test after implements the labels support
-func TestLoadDefaultConfigsFromFilesWithMissingFieldsLabels(t *testing.T) {
-	fSys := filesys.MakeFsInMemory()
-	filePathContainsTypo := "config_contains_typo.yaml"
-	if err := fSys.WriteFile(filePathContainsTypo, []byte(`
-labels:
-  - path: spec/podTemplate/metadata/labels
-    create: true
-    kind: FlinkDeployment
-`)); err != nil {
-		t.Fatal(err)
-	}
-	ldr, err := loader.NewLoader(
-		loader.RestrictionRootOnly, filesys.Separator, fSys)
-	if err != nil {
-		t.Fatal(err)
-	}
-	errMsg := "error unmarshaling JSON: while decoding JSON: json: unknown field"
-	_, err = loadDefaultConfig(ldr, []string{filePathContainsTypo})
-	if err == nil {
-		t.Fatalf("expected to fail unmarshal yaml, but got nil %s", filePathContainsTypo)
-	}
-	if !strings.Contains(err.Error(), errMsg) {
-		t.Fatalf("expected error %s, but got %s", errMsg, err)
-	}
-}

api/internal/plugins/builtinconfig/transformerconfig.go

@@ -21,6 +21,7 @@ type TransformerConfig struct {
 	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
 	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	Labels            types.FsSlice `json:"labels,omitempty" yaml:"labels,omitempty"`
 	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
 	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
@@ -41,6 +42,7 @@ func (t *TransformerConfig) DeepCopy() *TransformerConfig {
 		NameSuffix:        t.NameSuffix.DeepCopy(),
 		NameSpace:         t.NameSpace.DeepCopy(),
 		CommonLabels:      t.CommonLabels.DeepCopy(),
+		Labels:            t.Labels.DeepCopy(),
 		TemplateLabels:    t.TemplateLabels.DeepCopy(),
 		CommonAnnotations: t.CommonAnnotations.DeepCopy(),
 		NameReference:     t.NameReference.DeepCopy(),
@@ -94,6 +96,7 @@ func (t *TransformerConfig) sortFields() {
 	sort.Sort(t.NameSuffix)
 	sort.Sort(t.NameSpace)
 	sort.Sort(t.CommonLabels)
+	sort.Sort(t.Labels)
 	sort.Sort(t.TemplateLabels)
 	sort.Sort(t.CommonAnnotations)
 	sort.Sort(t.NameReference)
@@ -114,12 +117,18 @@ func (t *TransformerConfig) AddSuffixFieldSpec(fs types.FieldSpec) (err error) {
 	return err
 }
 
-// AddLabelFieldSpec adds a FieldSpec to CommonLabels
-func (t *TransformerConfig) AddLabelFieldSpec(fs types.FieldSpec) (err error) {
+// AddCommonLabelsFieldSpec adds a FieldSpec to CommonLabels
+func (t *TransformerConfig) AddCommonLabelsFieldSpec(fs types.FieldSpec) (err error) {
 	t.CommonLabels, err = t.CommonLabels.MergeOne(fs)
 	return err
 }
 
+// AddLabelsFieldSpec adds a FieldSpec to Labels
+func (t *TransformerConfig) AddLabelsFieldSpec(fs types.FieldSpec) (err error) {
+	t.Labels, err = t.Labels.MergeOne(fs)
+	return err //nolint:wrapcheck
+}
+
 // AddAnnotationFieldSpec adds a FieldSpec to CommonAnnotations
 func (t *TransformerConfig) AddAnnotationFieldSpec(fs types.FieldSpec) (err error) {
 	t.CommonAnnotations, err = t.CommonAnnotations.MergeOne(fs)
@@ -162,6 +171,10 @@ func (t *TransformerConfig) Merge(input *TransformerConfig) (
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge CommonLabels fieldSpec")
 	}
+	merged.Labels, err = t.Labels.MergeAll(input.Labels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge Labels fieldSpec")
+	}
 	merged.TemplateLabels, err = t.TemplateLabels.MergeAll(input.TemplateLabels)
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")

api/internal/plugins/builtinconfig/transformerconfig_test.go

@@ -4,9 +4,10 @@
 package builtinconfig_test
 
 import (
-	"reflect"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
@@ -35,13 +36,8 @@ func TestAddNamereferenceFieldSpec(t *testing.T) {
 		},
 	}
 
-	err := cfg.AddNamereferenceFieldSpec(nbrs)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NameReference) != 1 {
-		t.Fatal("failed to add namereference FieldSpec")
-	}
+	require.NoError(t, cfg.AddNamereferenceFieldSpec(nbrs))
+	require.Len(t, cfg.NameReference, 1, "failed to add namereference FieldSpec")
 }
 
 func TestAddFieldSpecs(t *testing.T) {
@@ -53,34 +49,14 @@ func TestAddFieldSpecs(t *testing.T) {
 		CreateIfNotPresent: true,
 	}
 
-	err := cfg.AddPrefixFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NamePrefix) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
-	err = cfg.AddSuffixFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NameSuffix) != 1 {
-		t.Fatalf("failed to add namesuffix FieldSpec")
-	}
-	err = cfg.AddLabelFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.CommonLabels) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
-	err = cfg.AddAnnotationFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.CommonAnnotations) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
+	require.NoError(t, cfg.AddPrefixFieldSpec(fieldSpec))
+	require.Len(t, cfg.NamePrefix, 1, "failed to add nameprefix FieldSpec")
+	require.NoError(t, cfg.AddSuffixFieldSpec(fieldSpec))
+	require.Len(t, cfg.NameSuffix, 1, "failed to add namesuffix FieldSpec")
+	require.NoError(t, cfg.AddCommonLabelsFieldSpec(fieldSpec))
+	require.Len(t, cfg.CommonLabels, 1, "failed to add labels FieldSpec")
+	require.NoError(t, cfg.AddAnnotationFieldSpec(fieldSpec))
+	require.Len(t, cfg.CommonAnnotations, 1, "failed to add nameprefix FieldSpec")
 }
 
 func TestMerge(t *testing.T) {
@@ -127,51 +103,43 @@ func TestMerge(t *testing.T) {
 		},
 	}
 	cfga := &TransformerConfig{}
-	cfga.AddNamereferenceFieldSpec(nameReference[0])
-	cfga.AddPrefixFieldSpec(fieldSpecs[0])
-	cfga.AddSuffixFieldSpec(fieldSpecs[0])
+	require.NoError(t, cfga.AddNamereferenceFieldSpec(nameReference[0]))
+	require.NoError(t, cfga.AddPrefixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddSuffixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddCommonLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddLabelsFieldSpec(fieldSpecs[0]))
 
 	cfgb := &TransformerConfig{}
-	cfgb.AddNamereferenceFieldSpec(nameReference[1])
-	cfgb.AddPrefixFieldSpec(fieldSpecs[1])
-	cfga.AddSuffixFieldSpec(fieldSpecs[1])
+	require.NoError(t, cfgb.AddNamereferenceFieldSpec(nameReference[1]))
+	require.NoError(t, cfgb.AddPrefixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddSuffixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddCommonLabelsFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddLabelsFieldSpec(fieldSpecs[1]))
 
 	actual, err := cfga.Merge(cfgb)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-
-	if len(actual.NamePrefix) != 2 {
-		t.Fatal("merge failed for namePrefix FieldSpec")
-	}
-
-	if len(actual.NameSuffix) != 2 {
-		t.Fatal("merge failed for nameSuffix FieldSpec")
-	}
-
-	if len(actual.NameReference) != 1 {
-		t.Fatal("merge failed for namereference FieldSpec")
-	}
+	require.NoError(t, err)
+	require.Len(t, actual.NamePrefix, 2, "merge failed for namePrefix FieldSpec")
+	require.Len(t, actual.NameSuffix, 2, "merge failed for nameSuffix FieldSpec")
+	require.Len(t, actual.NameReference, 1, "merge failed for nameReference FieldSpec")
+	require.Len(t, actual.Labels, 2, "merge failed for labels FieldSpec")
+	require.Len(t, actual.CommonLabels, 2, "merge failed for commonLabels FieldSpec")
 
 	expected := &TransformerConfig{}
-	expected.AddNamereferenceFieldSpec(nameReference[0])
-	expected.AddNamereferenceFieldSpec(nameReference[1])
-	expected.AddPrefixFieldSpec(fieldSpecs[0])
-	expected.AddPrefixFieldSpec(fieldSpecs[1])
-	expected.AddSuffixFieldSpec(fieldSpecs[0])
-	expected.AddSuffixFieldSpec(fieldSpecs[1])
-
-	if !reflect.DeepEqual(actual, expected) {
-		t.Fatalf("expected: %v\n but got: %v\n", expected, actual)
-	}
+	require.NoError(t, expected.AddNamereferenceFieldSpec(nameReference[0]))
+	require.NoError(t, expected.AddNamereferenceFieldSpec(nameReference[1]))
+	require.NoError(t, expected.AddPrefixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddPrefixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddSuffixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddSuffixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddCommonLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddCommonLabelsFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddLabelsFieldSpec(fieldSpecs[1]))
+	require.Equal(t, expected, actual)
 
 	actual, err = cfga.Merge(nil)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if !reflect.DeepEqual(actual, cfga) {
-		t.Fatalf("expected: %v\n but got: %v\n", cfga, actual)
-	}
+	require.NoError(t, err)
+	require.Equal(t, cfga, actual)
 }
 
 func TestMakeDefaultConfig_mutation(t *testing.T) {
@@ -182,9 +150,7 @@ func TestMakeDefaultConfig_mutation(t *testing.T) {
 	a.NameReference = a.NameReference[:1]
 
 	clean := MakeDefaultConfig()
-	if clean.NameReference[0].Kind == "mutated" {
-		t.Errorf("MakeDefaultConfig() did not return a clean copy: %+v", clean.NameReference)
-	}
+	assert.NotEqualf(t, "mutated", clean.NameReference[0].Kind, "MakeDefaultConfig() did not return a clean copy: %+v", clean.NameReference)
 }
 
 func BenchmarkMakeDefaultConfig(b *testing.B) {

api/internal/plugins/execplugin/execplugin_test.go

@@ -41,7 +41,7 @@ s/$BAR/bar baz/g
 	}
 	pvd := provider.NewDefaultDepProvider()
 	rf := resmap.NewFactory(pvd.GetResourceFactory())
-	pluginConfig := rf.RF().FromMap(
+	pluginConfig, err := rf.RF().FromMap(
 		map[string]interface{}{
 			"apiVersion": "someteam.example.com/v1",
 			"kind":       "SedTransformer",
@@ -51,6 +51,9 @@ s/$BAR/bar baz/g
 			"argsOneLiner": "one two 'foo bar'",
 			"argsFromFile": "sed-input.txt",
 		})
+	if err != nil {
+		t.Fatalf("failed to writes the data to a file: %v", err)
+	}
 
 	pluginConfig.RemoveBuildAnnotations()
 	pc := types.DisabledPluginConfig()

api/internal/plugins/loader/load_go_plugin_disabled.go

@@ -14,11 +14,12 @@
 package loader
 
 import (
+	"fmt"
+
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 )
 
 func (l *Loader) loadGoPlugin(_ resid.ResId, _ string) (resmap.Configurable, error) {
-	return nil, errors.New("plugin load is disabled")
+	return nil, fmt.Errorf("plugin load is disabled")
 }

api/internal/plugins/utils/utils_test.go

@@ -32,11 +32,14 @@ func TestDeterminePluginSrcRoot(t *testing.T) {
 }
 
 func makeConfigMap(rf *resource.Factory, name, behavior string, hashValue *string) *resource.Resource {
-	r := rf.FromMap(map[string]interface{}{
+	r, err := rf.FromMap(map[string]interface{}{
 		"apiVersion": "v1",
 		"kind":       "ConfigMap",
 		"metadata":   map[string]interface{}{"name": name},
 	})
+	if err != nil {
+		panic(err)
+	}
 	annotations := map[string]string{}
 	if behavior != "" {
 		annotations[BehaviorAnnotation] = behavior

api/internal/target/kusttarget.go

@@ -449,9 +449,6 @@ func (kt *KustTarget) accumulateResources(
 				ra, err = kt.accumulateDirectory(ra, ldr, false)
 			}
 			if err != nil {
-				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
-					return nil, errF
-				}
 				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
@@ -460,7 +457,7 @@ func (kt *KustTarget) accumulateResources(
 	return ra, nil
 }
 
-// accumulateResources fills the given resourceAccumulator
+// accumulateComponents fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateComponents(
 	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {

api/internal/target/kusttarget_configplugin.go

@@ -275,13 +275,25 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		if len(kt.kustomization.Labels) == 0 && len(kt.kustomization.CommonLabels) == 0 {
 			return
 		}
+
+		type labelStruct struct {
+			Labels     map[string]string
+			FieldSpecs []types.FieldSpec
+		}
+
 		for _, label := range kt.kustomization.Labels {
-			var c struct {
-				Labels     map[string]string
-				FieldSpecs []types.FieldSpec
-			}
+			var c labelStruct
+
 			c.Labels = label.Pairs
 			fss := types.FsSlice(label.FieldSpecs)
+
+			// merge labels specified in the label section of transformer configs
+			// these apply to selectors and templates
+			fss, err := fss.MergeAll(tc.Labels)
+			if err != nil {
+				return nil, fmt.Errorf("failed to merge labels: %w", err)
+			}
+
 			// merge the custom fieldSpecs with the default
 			if label.IncludeSelectors {
 				fss, err = fss.MergeAll(tc.CommonLabels)
@@ -297,7 +309,7 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 				fss, err = fss.MergeOne(types.FieldSpec{Path: "metadata/labels", CreateIfNotPresent: true})
 			}
 			if err != nil {
-				return nil, err
+				return nil, fmt.Errorf("failed to merge labels: %w", err)
 			}
 			c.FieldSpecs = fss
 			p := f()
@@ -307,10 +319,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			}
 			result = append(result, p)
 		}
-		var c struct {
-			Labels     map[string]string
-			FieldSpecs []types.FieldSpec
-		}
+
+		var c labelStruct
+
 		c.Labels = kt.kustomization.CommonLabels
 		c.FieldSpecs = tc.CommonLabels
 		p := f()

api/internal/target/kusttarget_test.go

@@ -6,6 +6,8 @@ package target_test
 import (
 	"encoding/base64"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"testing"
 	"time"
@@ -191,13 +193,67 @@ metadata:
 
 	pvd := provider.NewDefaultDepProvider()
 	resFactory := pvd.GetResourceFactory()
+	name0 := "dply1"
 
-	resources := []*resource.Resource{
-		resFactory.FromMapWithName("dply1", map[string]interface{}{
-			"apiVersion": "apps/v1",
-			"kind":       "Deployment",
+	r0, err := resFactory.FromMapWithName(name0, map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":      "foo-dply1-bar",
+			"namespace": "ns1",
+			"labels": map[string]interface{}{
+				"app": "nginx",
+			},
+			"annotations": map[string]interface{}{
+				"note": "This is a test annotation",
+			},
+		},
+		"spec": map[string]interface{}{
+			"replica": "3",
+			"selector": map[string]interface{}{
+				"matchLabels": map[string]interface{}{
+					"app": "nginx",
+				},
+			},
+			"template": map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"annotations": map[string]interface{}{
+						"note": "This is a test annotation",
+					},
+					"labels": map[string]interface{}{
+						"app": "nginx",
+					},
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name0, err)
+	}
+	name1 := "ns1"
+	r1, err := resFactory.FromMapWithName(name1, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "Namespace",
+		"metadata": map[string]interface{}{
+			"name": "ns1",
+			"labels": map[string]interface{}{
+				"app": "nginx",
+			},
+			"annotations": map[string]interface{}{
+				"note": "This is a test annotation",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name1, err)
+	}
+
+	r2, _ := resFactory.FromMapWithName("literalConfigMap",
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
 			"metadata": map[string]interface{}{
-				"name":      "foo-dply1-bar",
+				"name":      "foo-literalConfigMap-bar-g5f6t456f5",
 				"namespace": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
@@ -206,30 +262,20 @@ metadata:
 					"note": "This is a test annotation",
 				},
 			},
-			"spec": map[string]interface{}{
-				"replica": "3",
-				"selector": map[string]interface{}{
-					"matchLabels": map[string]interface{}{
-						"app": "nginx",
-					},
-				},
-				"template": map[string]interface{}{
-					"metadata": map[string]interface{}{
-						"annotations": map[string]interface{}{
-							"note": "This is a test annotation",
-						},
-						"labels": map[string]interface{}{
-							"app": "nginx",
-						},
-					},
-				},
+			"data": map[string]interface{}{
+				"DB_USERNAME": "admin",
+				"DB_PASSWORD": "somepw",
 			},
-		}),
-		resFactory.FromMapWithName("ns1", map[string]interface{}{
+		})
+
+	name2 := "secret"
+	r3, err := resFactory.FromMapWithName(name2,
+		map[string]interface{}{
 			"apiVersion": "v1",
-			"kind":       "Namespace",
+			"kind":       "Secret",
 			"metadata": map[string]interface{}{
-				"name": "ns1",
+				"name":      "foo-secret-bar-82c2g5f8f6",
+				"namespace": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
 				},
@@ -237,53 +283,21 @@ metadata:
 					"note": "This is a test annotation",
 				},
 			},
-		}),
-		resFactory.FromMapWithName("literalConfigMap",
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "ConfigMap",
-				"metadata": map[string]interface{}{
-					"name":      "foo-literalConfigMap-bar-g5f6t456f5",
-					"namespace": "ns1",
-					"labels": map[string]interface{}{
-						"app": "nginx",
-					},
-					"annotations": map[string]interface{}{
-						"note": "This is a test annotation",
-					},
-				},
-				"data": map[string]interface{}{
-					"DB_USERNAME": "admin",
-					"DB_PASSWORD": "somepw",
-				},
-			}),
-		resFactory.FromMapWithName("secret",
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "Secret",
-				"metadata": map[string]interface{}{
-					"name":      "foo-secret-bar-82c2g5f8f6",
-					"namespace": "ns1",
-					"labels": map[string]interface{}{
-						"app": "nginx",
-					},
-					"annotations": map[string]interface{}{
-						"note": "This is a test annotation",
-					},
-				},
-				"type": ifc.SecretTypeOpaque,
-				"data": map[string]interface{}{
-					"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
-					"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
-				},
-			}),
+			"type": ifc.SecretTypeOpaque,
+			"data": map[string]interface{}{
+				"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
+				"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
+			},
+		})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name2, err)
 	}
 
+	resources := []*resource.Resource{r0, r1, r2, r3}
+
 	expected := resmap.New()
 	for _, r := range resources {
-		if err := expected.Append(r); err != nil {
-			t.Fatalf("unexpected error %v", err)
-		}
+		require.NoError(t, expected.Append(r), "failed to append resource: %v")
 	}
 	expected.RemoveBuildAnnotations()
 	expYaml, err := expected.AsYaml()
@@ -354,31 +368,43 @@ metadata:
 	pvd := provider.NewDefaultDepProvider()
 	resFactory := pvd.GetResourceFactory()
 
-	resources := []*resource.Resource{
-		resFactory.FromMapWithName("deployment1", map[string]interface{}{
-			"apiVersion": "apps/v1",
-			"kind":       "Deployment",
-			"metadata": map[string]interface{}{
-				"name":      "foo-deployment1-bar",
-				"namespace": "ns1",
-			},
-		}), resFactory.FromMapWithName("config", map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "ConfigMap",
-			"metadata": map[string]interface{}{
-				"name":      "config-bar",
-				"namespace": "ns1",
-			},
-		}), resFactory.FromMapWithName("secret", map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "Secret",
-			"metadata": map[string]interface{}{
-				"name":      "foo-secret",
-				"namespace": "ns1",
-			},
-		}),
+	name0 := "deployment1"
+	r0, err0 := resFactory.FromMapWithName(name0, map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":      "foo-deployment1-bar",
+			"namespace": "ns1",
+		},
+	})
+	if err0 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name0, err0)
 	}
-
+	name1 := "config"
+	r1, err1 := resFactory.FromMapWithName(name1, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "ConfigMap",
+		"metadata": map[string]interface{}{
+			"name":      "config-bar",
+			"namespace": "ns1",
+		},
+	})
+	if err1 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name1, err1)
+	}
+	name2 := "secret"
+	r2, err2 := resFactory.FromMapWithName(name2, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "Secret",
+		"metadata": map[string]interface{}{
+			"name":      "foo-secret",
+			"namespace": "ns1",
+		},
+	})
+	if err2 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name2, err2)
+	}
+	var resources = []*resource.Resource{r0, r1, r2}
 	expected := resmap.New()
 	for _, r := range resources {
 		err := expected.Append(r)
@@ -536,3 +562,71 @@ func (l loaderNewThrowsError) Load(location string) ([]byte, error) {
 func (l loaderNewThrowsError) Cleanup() error {
 	return l.baseLoader.Cleanup() //nolint:wrapcheck // baseLoader's error is sufficient
 }
+
+func TestErrorMessageForMalformedYAMLAndInvalidBase(t *testing.T) {
+	// These testcases verify behavior for the scenario described in
+	// https://github.com/kubernetes-sigs/kustomize/issues/5692 .
+
+	// Use a test server to fake the remote file response
+	handler := http.NewServeMux()
+	handler.HandleFunc("/", func(out http.ResponseWriter, req *http.Request) {
+		// Per issue #5692, the server should return a 200 status code with a response body that fails to parse as YAML
+		out.WriteHeader(http.StatusOK)
+		_, _ = out.Write([]byte(`<!DOCTYPE html>
+<html class="html-devise-layout ui-light-gray" lang="en">
+<head prefix="og: http://ogp.me/ns#">`))
+	})
+	svr := httptest.NewServer(handler)
+	defer svr.Close()
+
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("/should-fail/kustomization.yml", "resources:\n- "+svr.URL)
+	th.WriteF("/should-fail/remote-repo/kustomization.yml", "this: is not a kustomization file!")
+
+	ldrWrapper := func(baseLoader ifc.Loader) ifc.Loader {
+		return &loaderWithRenamedRoots{
+			baseLoader: baseLoader,
+			fakeRootMap: map[string]string{
+				// Use the "remote-repo" subdir instead of the remote git repo
+				svr.URL: "remote-repo",
+			},
+		}
+	}
+
+	_, err := makeAndLoadKustTargetWithLoaderOverride(t, th.GetFSys(), "/should-fail", ldrWrapper).AccumulateTarget()
+	require.Error(t, err)
+	errString := err.Error()
+	assert.Contains(t, errString, "accumulating resources from '"+svr.URL+"'")
+	assert.Contains(t, errString, "MalformedYAMLError: yaml: line 3: mapping values are not allowed in this context")
+	assert.Contains(t, errString, `invalid Kustomization: json: unknown field "this"`)
+}
+
+// loaderWithRenamedRoots is a loader that can map New() roots to some other name
+type loaderWithRenamedRoots struct {
+	baseLoader  ifc.Loader
+	fakeRootMap map[string]string
+}
+
+func (l loaderWithRenamedRoots) Repo() string {
+	return l.baseLoader.Repo()
+}
+
+func (l loaderWithRenamedRoots) Root() string {
+	return l.baseLoader.Root()
+}
+
+func (l loaderWithRenamedRoots) New(newRoot string) (ifc.Loader, error) {
+	if otherRoot, ok := l.fakeRootMap[newRoot]; ok {
+		return l.baseLoader.New(otherRoot) //nolint:wrapcheck // baseLoader's error is sufficient
+	}
+
+	return l.baseLoader.New(newRoot) //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func (l loaderWithRenamedRoots) Load(path string) ([]byte, error) {
+	return l.baseLoader.Load(path) //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func (l loaderWithRenamedRoots) Cleanup() error {
+	return l.baseLoader.Cleanup() //nolint:wrapcheck // baseLoader's error is sufficient
+}

api/krusty/accumulation_test.go

@@ -31,6 +31,20 @@ spec:
     - port: 7002
 `
 
+const invalidResource = `apiVersion: v1
+kind: Service
+metadata:
+  name: kapacitor
+  labels:
+    app.kubernetes.io/name: tick-kapacitor
+spec:
+  selector:
+    app.kubernetes.io/name: tick-kapacitor
+    - name: http
+      port: 9092
+      protocol: TCP
+  type: ClusterIP`
+
 func TestTargetMustHaveKustomizationFile(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteF("service.yaml", `
@@ -302,6 +316,14 @@ resources:
 			// know resource is file.
 			errDir: `new root '%s' cannot be absolute`,
 		},
+		{
+			name:     "malformed yaml yields an error",
+			resource: "service.yaml",
+			files: map[string]string{
+				"service.yaml": invalidResource,
+			},
+			errFile: "MalformedYAMLError",
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			if test.resourceFunc != nil {
@@ -338,5 +360,4 @@ resources:
 	// TODO(annasong): add tests that check accumulateResources errors for
 	// - repos
 	// - local directories
-	// - files that yield malformed yaml errors
 }

api/krusty/customconfig_test.go

@@ -335,3 +335,400 @@ spec:
   location: Arizona
 `)
 }
+
+func TestLabelTransformerConfig(t *testing.T) {
+	testCases := []struct {
+		name              string
+		kustomization     string
+		transformerConfig string
+		expectedResult    string
+	}{
+		{
+			name: "includeSelectors=false, includeTemplates=false, include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: Deployment
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=true, includeTemplates=false, include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: true
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: Deployment
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+      environment: dev
+      location: planet-earth
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=false, includeTemplates=true, no transformerConfig",
+			kustomization: `labels:
+  - includeSelectors: false
+    includeTemplates: true
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=false, includeTemplates=false, no transformerConfig",
+			kustomization: `labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			th := kusttest_test.MakeHarness(t)
+			th.WriteK(".", tc.kustomization)
+			th.WriteF("resources/deployment.yaml",
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`)
+			if tc.transformerConfig != "" {
+				th.WriteF("config/configurations.yaml", tc.transformerConfig)
+			}
+
+			output := th.Run(".", th.MakeDefaultOptions())
+
+			th.AssertActualEqualsExpected(output, tc.expectedResult)
+		})
+	}
+}
+
+func TestLabelTransformerConfigWithCustomResources(t *testing.T) {
+	testCases := []struct {
+		name              string
+		kustomization     string
+		transformerConfig string
+		expectedResult    string
+	}{
+		{
+			name: "include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  template:
+    metadata:
+      labels:
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+		{
+			name: "include selector via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/selectors/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  selectors:
+    labels:
+      environment: dev
+      location: planet-earth
+  template:
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+		{
+			name: "include selectors and labels via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `
+labels:
+  - path: spec/selectors/labels
+    create: true
+    kind: SampleResource
+  - path: spec/template/metadata/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  selectors:
+    labels:
+      environment: dev
+      location: planet-earth
+  template:
+    metadata:
+      labels:
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			th := kusttest_test.MakeHarness(t)
+			th.WriteK(".", tc.kustomization)
+			th.WriteF("resources/custom-resource.yaml",
+				`apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  template:
+    spec:
+      containers:
+      - image: index.docker.io/library/hello-world
+        env:
+        - name: VARIABLE
+          value: value
+`)
+
+			th.WriteF("config/configurations.yaml", tc.transformerConfig)
+
+			output := th.Run(".", th.MakeDefaultOptions())
+
+			th.AssertActualEqualsExpected(output, tc.expectedResult)
+		})
+	}
+}

api/krusty/namereference_test.go

@@ -786,3 +786,85 @@ spec:
         name: tester
 `)
 }
+
+func TestBackReferenceAdmissionPolicy(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- admission.yaml
+
+namePrefix: a-prefix-
+`)
+	th.WriteF("admission.yaml", `---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: sample-policy
+spec:
+  failurePolicy: Fail
+  paramKind:
+    apiVersion: apps/v1
+    kind: Deployment
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - apps
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - deployments
+  validations:
+    - expression: "!object.metadata.name.startsWith('test-')"
+      message: prefix 'test-' is not allowed
+      reason: Invalid
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: sample-policy-binding
+spec:
+  policyName: sample-policy
+  validationActions:
+  - Deny
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: a-prefix-sample-policy
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - apps
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - deployments
+  paramKind:
+    apiVersion: apps/v1
+    kind: Deployment
+  validations:
+  - expression: '!object.metadata.name.startsWith(''test-'')'
+    message: prefix 'test-' is not allowed
+    reason: Invalid
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: a-prefix-sample-policy-binding
+spec:
+  policyName: a-prefix-sample-policy
+  validationActions:
+  - Deny
+`)
+}

api/provenance/provenance.go

@@ -67,14 +67,22 @@ func GetProvenance() Provenance {
 
 	for _, dep := range info.Deps {
 		if dep != nil && dep.Path == "sigs.k8s.io/kustomize/kustomize/v5" {
-			p.Version = GetMostRecentTag(*dep)
+			if dep.Version != "devel" {
+				continue
+			}
+			v, err := GetMostRecentTag(*dep)
+			if err != nil {
+				fmt.Printf("failed to get most recent tag for %s: %v\n", dep.Path, err)
+				continue
+			}
+			p.Version = v
 		}
 	}
 
 	return p
 }
 
-func GetMostRecentTag(m debug.Module) string {
+func GetMostRecentTag(m debug.Module) (string, error) {
 	for m.Replace != nil {
 		m = *m.Replace
 	}
@@ -83,13 +91,13 @@ func GetMostRecentTag(m debug.Module) string {
 	sv, err := semver.Parse(strings.TrimPrefix(split[0], "v"))
 
 	if err != nil {
-		return "unknown"
+		return "", fmt.Errorf("failed to parse version %s: %w", m.Version, err)
 	}
 
 	if len(split) > 1 && sv.Patch > 0 {
 		sv.Patch -= 1
 	}
-	return fmt.Sprintf("v%s", sv.FinalizeVersion())
+	return fmt.Sprintf("v%s", sv.FinalizeVersion()), nil
 }
 
 // Short returns the shortened provenance stamp.

api/provenance/provenance_test.go

@@ -59,6 +59,7 @@ func TestGetMostRecentTag(t *testing.T) {
 	tests := []struct {
 		name        string
 		module      debug.Module
+		isError     bool
 		expectedTag string
 	}{
 		{
@@ -72,9 +73,9 @@ func TestGetMostRecentTag(t *testing.T) {
 			expectedTag: "v0.0.0",
 		},
 		{
-			name:        "Invalid semver string",
-			module:      mockModule("invalid-version"),
-			expectedTag: "unknown",
+			name:    "Invalid semver string",
+			module:  mockModule("invalid-version"),
+			isError: true,
 		},
 		{
 			name:        "Valid semver with patch increment and pre-release info",
@@ -90,8 +91,14 @@ func TestGetMostRecentTag(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			tag := provenance.GetMostRecentTag(tt.module)
-			assert.Equal(t, tt.expectedTag, tag)
+			tag, err := provenance.GetMostRecentTag(tt.module)
+			if err != nil {
+				if !tt.isError {
+					assert.NoError(t, err)
+				}
+			} else {
+				assert.Equal(t, tt.expectedTag, tag)
+			}
 		})
 	}
 }

api/resmap/reswrangler_test.go

@@ -73,7 +73,7 @@ func doRemove(t *testing.T, w ResMap, id resid.ResId) {
 
 // Make a resource with a predictable name.
 func makeCm(i int) *resource.Resource {
-	return rf.FromMap(
+	r, err := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -81,6 +81,10 @@ func makeCm(i int) *resource.Resource {
 				"name": fmt.Sprintf("cm%03d", i),
 			},
 		})
+	if err != nil {
+		panic(err)
+	}
+	return r
 }
 
 // Maintain the class invariant that no two
@@ -229,7 +233,7 @@ metadata:
 func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 	cmap := resid.NewGvk("", "v1", "ConfigMap")
 
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -237,7 +241,10 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 				"name": "alice",
 			},
 		})
-	r2 := rf.FromMap(
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -245,7 +252,10 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 				"name": "bob",
 			},
 		})
-	r3 := rf.FromMap(
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
+	r3, err3 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -254,7 +264,10 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
-	r4 := rf.FromMap(
+	if err3 != nil {
+		t.Fatalf("failed to get new instance: %v", err3)
+	}
+	r4, err4 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -263,7 +276,10 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
-	r5 := rf.FromMap(
+	if err4 != nil {
+		t.Fatalf("failed to get new instance: %v", err4)
+	}
+	r5, err5 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Deployment",
@@ -272,6 +288,9 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
+	if err5 != nil {
+		t.Fatalf("failed to get new instance: %v", err5)
+	}
 
 	m := resmaptest_test.NewRmBuilder(t, rf).
 		AddR(r1).AddR(r2).AddR(r3).AddR(r4).AddR(r5).ResMap()
@@ -367,7 +386,7 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 }
 
 func TestGetMatchingResourcesByAnyId(t *testing.T) {
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -380,7 +399,10 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				},
 			},
 		})
-	r2 := rf.FromMap(
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -393,7 +415,10 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				},
 			},
 		})
-	r3 := rf.FromMap(
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
+	r3, err3 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -407,7 +432,10 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				},
 			},
 		})
-	r4 := rf.FromMap(
+	if err3 != nil {
+		t.Fatalf("failed to get new instance: %v", err3)
+	}
+	r4, err4 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -421,7 +449,10 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				},
 			},
 		})
-	r5 := rf.FromMap(
+	if err4 != nil {
+		t.Fatalf("failed to get new instance: %v", err4)
+	}
+	r5, err5 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Deployment",
@@ -430,6 +461,9 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
+	if err5 != nil {
+		t.Fatalf("failed to get new instance: %v", err5)
+	}
 
 	m := resmaptest_test.NewRmBuilder(t, rf).
 		AddR(r1).AddR(r2).AddR(r3).AddR(r4).AddR(r5).ResMap()
@@ -498,7 +532,7 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 }
 
 func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -506,7 +540,10 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"name": "alice",
 			},
 		})
-	r2 := rf.FromMap(
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -514,7 +551,10 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"name": "bob",
 			},
 		})
-	r3 := rf.FromMap(
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
+	r3, err3 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -523,7 +563,10 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
-	r4 := rf.FromMap(
+	if err3 != nil {
+		t.Fatalf("failed to get new instance: %v", err3)
+	}
+	r4, err4 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
@@ -532,7 +575,10 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
-	r5 := rf.FromMap(
+	if err4 != nil {
+		t.Fatalf("failed to get new instance: %v", err4)
+	}
+	r5, err5 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -541,8 +587,11 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
+	if err5 != nil {
+		t.Fatalf("failed to get new instance: %v", err5)
+	}
 	r5.AddNamePrefix("little-")
-	r6 := rf.FromMap(
+	r6, err6 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
@@ -551,8 +600,11 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"namespace": "happy",
 			},
 		})
+	if err6 != nil {
+		t.Fatalf("failed to get new instance: %v", err6)
+	}
 	r6.AddNamePrefix("little-")
-	r7 := rf.FromMap(
+	r7, err7 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "rbac.authorization.k8s.io/v1",
 			"kind":       "ClusterRoleBinding",
@@ -560,6 +612,9 @@ func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 				"name": "meh",
 			},
 		})
+	if err7 != nil {
+		t.Fatalf("failed to get new instance: %v", err7)
+	}
 
 	tests := map[string]struct {
 		filter   *resource.Resource
@@ -639,7 +694,7 @@ func TestDeepCopy(t *testing.T) {
 }
 
 func TestErrorIfNotEqualSets(t *testing.T) {
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -647,7 +702,10 @@ func TestErrorIfNotEqualSets(t *testing.T) {
 				"name": "cm1",
 			},
 		})
-	r2 := rf.FromMap(
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -655,7 +713,10 @@ func TestErrorIfNotEqualSets(t *testing.T) {
 				"name": "cm2",
 			},
 		})
-	r3 := rf.FromMap(
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
+	r3, err3 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -664,6 +725,9 @@ func TestErrorIfNotEqualSets(t *testing.T) {
 				"namespace": "system",
 			},
 		})
+	if err3 != nil {
+		t.Fatalf("failed to get new instance: %v", err3)
+	}
 
 	m1 := resmaptest_test.NewRmBuilder(t, rf).AddR(r1).AddR(r2).AddR(r3).ResMap()
 	if err := m1.ErrorIfNotEqualSets(m1); err != nil {
@@ -712,7 +776,7 @@ func TestErrorIfNotEqualSets(t *testing.T) {
 }
 
 func TestErrorIfNotEqualLists(t *testing.T) {
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -720,7 +784,10 @@ func TestErrorIfNotEqualLists(t *testing.T) {
 				"name": "cm1",
 			},
 		})
-	r2 := rf.FromMap(
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -728,7 +795,10 @@ func TestErrorIfNotEqualLists(t *testing.T) {
 				"name": "cm2",
 			},
 		})
-	r3 := rf.FromMap(
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
+	r3, err3 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -737,6 +807,9 @@ func TestErrorIfNotEqualLists(t *testing.T) {
 				"namespace": "system",
 			},
 		})
+	if err3 != nil {
+		t.Fatalf("failed to get new instance: %v", err3)
+	}
 
 	m1 := resmaptest_test.NewRmBuilder(t, rf).AddR(r1).AddR(r2).AddR(r3).ResMap()
 	if err := m1.ErrorIfNotEqualLists(m1); err != nil {
@@ -780,7 +853,7 @@ func TestErrorIfNotEqualLists(t *testing.T) {
 }
 
 func TestAppendAll(t *testing.T) {
-	r1 := rf.FromMap(
+	r1, err1 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
@@ -788,8 +861,11 @@ func TestAppendAll(t *testing.T) {
 				"name": "foo-deploy1",
 			},
 		})
+	if err1 != nil {
+		t.Fatalf("failed to get new instance: %v", err1)
+	}
 	input1 := rmF.FromResource(r1)
-	r2 := rf.FromMap(
+	r2, err2 := rf.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "StatefulSet",
@@ -797,6 +873,9 @@ func TestAppendAll(t *testing.T) {
 				"name": "bar-stateful",
 			},
 		})
+	if err2 != nil {
+		t.Fatalf("failed to get new instance: %v", err2)
+	}
 	input2 := rmF.FromResource(r2)
 
 	expected := New()

api/resource/factory.go

@@ -41,28 +41,26 @@ func (rf *Factory) Hasher() ifc.KustHasher {
 }
 
 // FromMap returns a new instance of Resource.
-func (rf *Factory) FromMap(m map[string]interface{}) *Resource {
+func (rf *Factory) FromMap(m map[string]interface{}) (*Resource, error) {
 	res, err := rf.FromMapAndOption(m, nil)
 	if err != nil {
-		// TODO: return err instead of log.
-		log.Fatalf("failed to create resource from map: %v", err)
+		return nil, fmt.Errorf("failed to create resource from map: %w", err)
 	}
-	return res
+	return res, nil
 }
 
 // FromMapWithName returns a new instance with the given "original" name.
-func (rf *Factory) FromMapWithName(n string, m map[string]interface{}) *Resource {
+func (rf *Factory) FromMapWithName(n string, m map[string]interface{}) (*Resource, error) {
 	return rf.FromMapWithNamespaceAndName(resid.DefaultNamespace, n, m)
 }
 
 // FromMapWithNamespaceAndName returns a new instance with the given "original" namespace.
-func (rf *Factory) FromMapWithNamespaceAndName(ns string, n string, m map[string]interface{}) *Resource {
+func (rf *Factory) FromMapWithNamespaceAndName(ns string, n string, m map[string]interface{}) (*Resource, error) {
 	r, err := rf.FromMapAndOption(m, nil)
 	if err != nil {
-		// TODO: return err instead of log.
-		log.Fatalf("failed to create resource from map: %v", err)
+		return nil, fmt.Errorf("failed to create resource from map: %w", err)
 	}
-	return r.setPreviousId(ns, n, r.GetKind())
+	return r.setPreviousId(ns, n, r.GetKind()), nil
 }
 
 // FromMapAndOption returns a new instance of Resource with given options.

api/resource/factory_test.go

@@ -274,24 +274,32 @@ kind: List
 			},
 		},
 	}
-	testDeploymentA := factory.FromMap(
+	deploymentA := "deployment-a"
+	testDeploymentA, errA := factory.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
 			"metadata": map[string]interface{}{
-				"name": "deployment-a",
+				"name": deploymentA,
 			},
 			"spec": testDeploymentSpec,
 		})
-	testDeploymentB := factory.FromMap(
+	if errA != nil {
+		t.Fatalf("failed to create new instance with %v: %v", deploymentA, errA)
+	}
+	deploymentB := "deployment-b"
+	testDeploymentB, errB := factory.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
 			"metadata": map[string]interface{}{
-				"name": "deployment-b",
+				"name": deploymentB,
 			},
 			"spec": testDeploymentSpec,
 		})
+	if errB != nil {
+		t.Fatalf("failed to create new instance with %v: %v", deploymentB, errB)
+	}
 
 	fSys := filesys.MakeFsInMemory()
 	fSys.WriteFile(string(patchGood1), []byte(patch1))
@@ -308,6 +316,16 @@ kind: List
 		t.Fatal(err)
 	}
 
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("failed to create test deployment: %v", err)
+	}
+
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("failed to create test config: %v", err)
+	}
+
 	tests := map[string]struct {
 		input       []types.PatchStrategicMerge
 		expectedOut []*Resource
@@ -315,7 +333,7 @@ kind: List
 	}{
 		"happy": {
 			input:       []types.PatchStrategicMerge{patchGood1, patchGood2},
-			expectedOut: []*Resource{testDeployment, testConfigMap},
+			expectedOut: []*Resource{td, tc},
 			expectedErr: false,
 		},
 		"badFileName": {
@@ -330,7 +348,7 @@ kind: List
 		},
 		"listOfPatches": {
 			input:       []types.PatchStrategicMerge{patchList},
-			expectedOut: []*Resource{testDeployment, testConfigMap},
+			expectedOut: []*Resource{td, tc},
 			expectedErr: false,
 		},
 		"listWithAnchorReference": {

api/resource/idset_test.go

@@ -12,21 +12,45 @@ import (
 
 func TestIdSet_Empty(t *testing.T) {
 	s := MakeIdSet([]*Resource{})
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("Failed to create test deployment: %v", err)
+	}
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("Failed to create test config: %v", err)
+	}
 	assert.Equal(t, 0, s.Size())
-	assert.False(t, s.Contains(testDeployment.CurId()))
-	assert.False(t, s.Contains(testConfigMap.CurId()))
+	assert.False(t, s.Contains(td.CurId()))
+	assert.False(t, s.Contains(tc.CurId()))
 }
 
 func TestIdSet_One(t *testing.T) {
-	s := MakeIdSet([]*Resource{testDeployment})
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("failed to create test deployment: %v", err)
+	}
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("failed to create test config: %v", err)
+	}
+	s := MakeIdSet([]*Resource{td})
 	assert.Equal(t, 1, s.Size())
-	assert.True(t, s.Contains(testDeployment.CurId()))
-	assert.False(t, s.Contains(testConfigMap.CurId()))
+	assert.True(t, s.Contains(td.CurId()))
+	assert.False(t, s.Contains(tc.CurId()))
 }
 
 func TestIdSet_Two(t *testing.T) {
-	s := MakeIdSet([]*Resource{testDeployment, testConfigMap})
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("failed to create test Deployment: %v", err)
+	}
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("failed to create test Config: %v", err)
+	}
+	s := MakeIdSet([]*Resource{td, tc})
 	assert.Equal(t, 2, s.Size())
-	assert.True(t, s.Contains(testDeployment.CurId()))
-	assert.True(t, s.Contains(testConfigMap.CurId()))
+	assert.True(t, s.Contains(td.CurId()))
+	assert.True(t, s.Contains(tc.CurId()))
 }

api/resource/resource_test.go

@@ -20,27 +20,39 @@ import (
 
 var factory = provider.NewDefaultDepProvider().GetResourceFactory()
 
-var testConfigMap = factory.FromMap(
-	map[string]interface{}{
-		"apiVersion": "v1",
-		"kind":       "ConfigMap",
-		"metadata": map[string]interface{}{
-			"name":      "winnie",
-			"namespace": "hundred-acre-wood",
-		},
-	})
+func createTestConfigMap() (*Resource, error) {
+	res, err := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name":      "winnie",
+				"namespace": "hundred-acre-wood",
+			},
+		})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create test config: %w", err)
+	}
+	return res, nil
+}
 
 //nolint:gosec
 const configMapAsString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
 
-var testDeployment = factory.FromMap(
-	map[string]interface{}{
-		"apiVersion": "apps/v1",
-		"kind":       "Deployment",
-		"metadata": map[string]interface{}{
-			"name": "pooh",
-		},
-	})
+func createTestDeployment() (*Resource, error) {
+	res, err := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name": "pooh",
+			},
+		})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Deployment: %w", err)
+	}
+	return res, nil
+}
 
 const deploymentAsString = `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"pooh"}}`
 
@@ -50,9 +62,13 @@ kind: Deployment
 metadata:
   name: pooh
 `
-	yaml, err := testDeployment.AsYAML()
+	td, err := createTestDeployment()
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("failed to create test deployment: %s", err)
+	}
+	yaml, err := td.AsYAML()
+	if err != nil {
+		t.Fatalf("failed to get yaml: %s", err)
 	}
 	if string(yaml) != expected {
 		t.Fatalf("--- expected\n%s\n--- got\n%s\n", expected, string(yaml))
@@ -60,16 +76,24 @@ metadata:
 }
 
 func TestResourceString(t *testing.T) {
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("failed to create test deployment: %v", err)
+	}
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("failed to create test config: %v", err)
+	}
 	tests := []struct {
 		in *Resource
 		s  string
 	}{
 		{
-			in: testConfigMap,
+			in: tc,
 			s:  configMapAsString,
 		},
 		{
-			in: testDeployment,
+			in: td,
 			s:  deploymentAsString,
 		},
 	}
@@ -79,18 +103,26 @@ func TestResourceString(t *testing.T) {
 }
 
 func TestResourceId(t *testing.T) {
+	td, err := createTestDeployment()
+	if err != nil {
+		t.Fatalf("failed to create test deployment: %v", err)
+	}
+	tc, err := createTestConfigMap()
+	if err != nil {
+		t.Fatalf("failed to create test config: %v", err)
+	}
 	tests := []struct {
 		in *Resource
 		id resid.ResId
 	}{
 		{
-			in: testConfigMap,
+			in: tc,
 			id: resid.NewResIdWithNamespace(
 				resid.NewGvk("", "v1", "ConfigMap"),
 				"winnie", "hundred-acre-wood"),
 		},
 		{
-			in: testDeployment,
+			in: td,
 			id: resid.NewResId(
 				resid.NewGvk("apps", "v1", "Deployment"), "pooh"),
 		},
@@ -103,7 +135,7 @@ func TestResourceId(t *testing.T) {
 }
 
 func TestDeepCopy(t *testing.T) {
-	r := factory.FromMap(
+	r, err := factory.FromMap(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
@@ -111,6 +143,9 @@ func TestDeepCopy(t *testing.T) {
 				"name": "pooh",
 			},
 		})
+	if err != nil {
+		t.Fatalf("failed to create test config: %v", err)
+	}
 	r.AppendRefBy(resid.NewResId(resid.Gvk{Group: "somegroup", Kind: "MyKind"}, "random"))
 
 	var1 := types.Var{

api/testutils/resmaptest/rmbuilder.go

@@ -41,7 +41,11 @@ func NewSeededRmBuilderDefault(t *testing.T, m resmap.ResMap) *rmBuilder {
 }
 
 func (rm *rmBuilder) Add(m map[string]interface{}) *rmBuilder {
-	return rm.AddR(rm.rf.FromMap(m))
+	r, err := rm.rf.FromMap(m)
+	if err != nil {
+		rm.t.Fatalf("test setup failure: %v", err)
+	}
+	return rm.AddR(r)
 }
 
 func (rm *rmBuilder) AddR(r *resource.Resource) *rmBuilder {
@@ -53,7 +57,11 @@ func (rm *rmBuilder) AddR(r *resource.Resource) *rmBuilder {
 }
 
 func (rm *rmBuilder) AddWithName(n string, m map[string]interface{}) *rmBuilder {
-	err := rm.m.Append(rm.rf.FromMapWithNamespaceAndName(resid.DefaultNamespace, n, m))
+	r, err := rm.rf.FromMapWithNamespaceAndName(resid.DefaultNamespace, n, m)
+	if err != nil {
+		rm.t.Fatalf("test setup failure: %v", err)
+	}
+	err = rm.m.Append(r)
 	if err != nil {
 		rm.t.Fatalf("test setup failure: %v", err)
 	}
@@ -61,7 +69,11 @@ func (rm *rmBuilder) AddWithName(n string, m map[string]interface{}) *rmBuilder
 }
 
 func (rm *rmBuilder) AddWithNsAndName(ns string, n string, m map[string]interface{}) *rmBuilder {
-	err := rm.m.Append(rm.rf.FromMapWithNamespaceAndName(ns, n, m))
+	r, err := rm.rf.FromMapWithNamespaceAndName(ns, n, m)
+	if err != nil {
+		rm.t.Fatalf("test setup failure: %v", err)
+	}
+	err = rm.m.Append(r)
 	if err != nil {
 		rm.t.Fatalf("test setup failure: %v", err)
 	}
@@ -69,7 +81,7 @@ func (rm *rmBuilder) AddWithNsAndName(ns string, n string, m map[string]interfac
 }
 
 func (rm *rmBuilder) ReplaceResource(m map[string]interface{}) *rmBuilder {
-	r := rm.rf.FromMap(m)
+	r, _ := rm.rf.FromMap(m)
 	_, err := rm.m.Replace(r)
 	if err != nil {
 		rm.t.Fatalf("test setup failure: %v", err)

api/types/kustomization.go

@@ -55,6 +55,7 @@ type Kustomization struct {
 	// Namespace to add to all objects.
 	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 
+	// Deprecated: Use the Labels field instead, which provides a superset of the functionality of CommonLabels.
 	// CommonLabels to add to all objects and selectors.
 	CommonLabels map[string]string `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
 

api/types/labels.go

@@ -6,12 +6,12 @@ package types
 type Label struct {
 	// Pairs contains the key-value pairs for labels to add
 	Pairs map[string]string `json:"pairs,omitempty" yaml:"pairs,omitempty"`
-	// IncludeSelectors inidicates should transformer include the
+	// IncludeSelectors indicates whether the transformer should include the
 	// fieldSpecs for selectors. Custom fieldSpecs specified by
 	// FieldSpecs will be merged with builtin fieldSpecs if this
 	// is true.
 	IncludeSelectors bool `json:"includeSelectors,omitempty" yaml:"includeSelectors,omitempty"`
-	// IncludeTemplates inidicates should transformer include the
+	// IncludeTemplates indicates whether the transformer should include the
 	// spec/template/metadata fieldSpec. Custom fieldSpecs specified by
 	// FieldSpecs will be merged with spec/template/metadata fieldSpec if this
 	// is true. If IncludeSelectors is true, IncludeTemplates is not needed.

cmd/config/go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.8.4
 	gopkg.in/inf.v0 v0.9.1
-	sigs.k8s.io/kustomize/kyaml v0.17.0
+	sigs.k8s.io/kustomize/kyaml v0.17.2
 )
 
 require (
@@ -26,7 +26,7 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/config/go.sum

@@ -71,8 +71,8 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -93,7 +93,7 @@ k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/A
 k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/kyaml v0.17.0 h1:G2bWs03V9Ur2PinHLzTUJ8Ded+30SzXZKiO92SRDs3c=
-sigs.k8s.io/kustomize/kyaml v0.17.0/go.mod h1:6lxkYF1Cv9Ic8g/N7I86cvxNc5iinUo/P2vKsHNmpyE=
+sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
+sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

cmd/config/internal/commands/e2e/e2econtainerconfig/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -20,7 +20,7 @@ require (
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/config/internal/commands/e2e/e2econtainerconfig/go.sum

@@ -1,5 +1,5 @@
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -67,8 +67,8 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -20,7 +20,7 @@ require (
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.sum

@@ -1,5 +1,5 @@
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -67,8 +67,8 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=

cmd/config/internal/commands/e2e/e2econtainermountbind/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -20,7 +20,7 @@ require (
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/config/internal/commands/e2e/e2econtainermountbind/go.sum

@@ -1,5 +1,5 @@
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -67,8 +67,8 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -20,7 +20,7 @@ require (
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/go.sum

@@ -1,5 +1,5 @@
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -67,8 +67,8 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=

cmd/config/internal/commands/grep.go

@@ -54,6 +54,9 @@ type GrepRunner struct {
 }
 
 func (r *GrepRunner) preRunE(c *cobra.Command, args []string) error {
+	if len(args) == 0 {
+		return fmt.Errorf("missing required argument: QUERY")
+	}
 	r.GrepFilter.Compare = func(a, b string) (int, error) {
 		qa, err := resource.ParseQuantity(a)
 		if err != nil {

cmd/config/internal/commands/grep_test.go

@@ -421,3 +421,17 @@ spec:
 		})
 	}
 }
+
+// TestGrepCmd_noQuery verifies the grep command errors when QUERY argument is missing
+func TestGrepCmd_noQuery(t *testing.T) {
+	b := &bytes.Buffer{}
+	r := commands.GetGrepRunner("")
+	// No QUERY argument
+	r.Command.SetArgs([]string{})
+	r.Command.SetOut(b)
+
+	err := r.Command.Execute()
+	if assert.Error(t, err) {
+		assert.Contains(t, err.Error(), "missing required argument: QUERY")
+	}
+}

cmd/config/internal/commands/run-fns.go

@@ -20,7 +20,7 @@ import (
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 )
 
-// GetCatRunner returns a RunFnRunner.
+// GetRunFnRunner returns a RunFnRunner.
 func GetRunFnRunner(name string) *RunFnRunner {
 	r := &RunFnRunner{}
 	c := &cobra.Command{

cmd/config/internal/inpututil/inpututil.go

@@ -24,7 +24,7 @@ func MapInputsE(inputs []*yaml.RNode, fn MapInputsEFn) error {
 
 type MapInputsFn func(*yaml.RNode, yaml.ResourceMeta) ([]*yaml.RNode, error)
 
-//  runs the function against each input Resource, providing the parsed metadata
+// runs the function against each input Resource, providing the parsed metadata
 func MapInputs(inputs []*yaml.RNode, fn MapInputsFn) ([]*yaml.RNode, error) {
 	var outputs []*yaml.RNode
 	for i := range inputs {

cmd/depprobcheck/go.mod

@@ -44,10 +44,10 @@ require (
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.18.0 // indirect

cmd/depprobcheck/go.sum

@@ -432,8 +432,8 @@ golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -477,10 +477,10 @@ golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

cmd/gorepomod/go.mod

@@ -28,7 +28,7 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect

cmd/gorepomod/go.sum

@@ -324,8 +324,8 @@ golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

cmd/pluginator/go.mod

@@ -5,12 +5,12 @@ go 1.21
 require (
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.8.4
-	sigs.k8s.io/kustomize/api v0.16.0
-	sigs.k8s.io/kustomize/kyaml v0.17.0
+	sigs.k8s.io/kustomize/api v0.17.2
+	sigs.k8s.io/kustomize/kyaml v0.17.2
 )
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
@@ -26,7 +26,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect

cmd/pluginator/go.sum

@@ -1,5 +1,5 @@
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -77,8 +77,8 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee33
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -98,7 +98,7 @@ k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSn
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/kyaml v0.17.0 h1:G2bWs03V9Ur2PinHLzTUJ8Ded+30SzXZKiO92SRDs3c=
-sigs.k8s.io/kustomize/kyaml v0.17.0/go.mod h1:6lxkYF1Cv9Ic8g/N7I86cvxNc5iinUo/P2vKsHNmpyE=
+sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
+sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

functions/examples/application-cr/image/go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/oauth2 v0.12.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect

functions/examples/application-cr/image/go.sum

@@ -662,8 +662,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -748,11 +748,11 @@ golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

functions/examples/fn-framework-application/go.mod

@@ -10,7 +10,7 @@ require (
 )
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.3.0 // indirect
@@ -36,8 +36,8 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stretchr/testify v1.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/net v0.21.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

functions/examples/fn-framework-application/go.sum

@@ -1,7 +1,7 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -131,8 +131,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -143,8 +143,8 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=

functions/examples/injection-tshirt-sizes/image/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.13.7
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect

functions/examples/injection-tshirt-sizes/image/go.sum

@@ -46,9 +46,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=

functions/examples/template-go-nginx/image/go.mod

@@ -5,7 +5,7 @@ go 1.21
 require sigs.k8s.io/kustomize/kyaml v0.13.7
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect

functions/examples/template-go-nginx/image/go.sum

@@ -46,9 +46,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=

functions/examples/template-heredoc-cockroachdb/Makefile

@@ -1,11 +1,27 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-.PHONY: image
+# This example uses a pinned version of the kustomize image, as an example of
+# what users should do downstream, to ensure supply chain security.
+#
+# Whenever KUSTOMIZE_IMAGE_TAG & KUSTOMIZE_IMAGE_SHA are updated,
+# EXAMPLE_IMAGE_TAG should also be updated to a new patch version.
+# For reference, see
+# https://github.com/kubernetes/k8s.io/blob/main/registry.k8s.io/images/k8s-staging-kustomize/images.yaml
+EXAMPLE_IMAGE_TAG=v0.1.1
+KUSTOMIZE_IMAGE_TAG=v5.4.1
+KUSTOMIZE_IMAGE_SHA=sha256:7492c35d6fbe64e05100009915167a37b285ca7391067fa0c7bec9a7d1856882
 
 all:
 	true
 
-image:
-	docker build image -t gcr.io/kustomize-functions/example-cockroachdb:v0.1.0
-	docker push gcr.io/kustomize-functions/example-cockroachdb:v0.1.0
+.PHONY: image-build
+image-build:
+	docker build image \
+		--build-arg "KUSTOMIZE_IMAGE_TAG=$(KUSTOMIZE_IMAGE_TAG)" \
+		--build-arg "KUSTOMIZE_IMAGE_SHA=$(KUSTOMIZE_IMAGE_SHA)" \
+		-t gcr.io/kustomize-functions/example-cockroachdb:$(EXAMPLE_IMAGE_TAG)
+
+.PHONY: image
+image: image-build
+	docker push gcr.io/kustomize-functions/example-cockroachdb:$(EXAMPLE_IMAGE_TAG)

functions/examples/template-heredoc-cockroachdb/image/Dockerfile

@@ -1,12 +1,10 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
-ENV CGO_ENABLED=0
-RUN go get -v sigs.k8s.io/kustomize/kustomize
+ARG KUSTOMIZE_IMAGE_TAG
+ARG KUSTOMIZE_IMAGE_SHA
 
-FROM alpine:latest
+FROM registry.k8s.io/kustomize/kustomize:${KUSTOMIZE_IMAGE_TAG}@${KUSTOMIZE_IMAGE_SHA}
 RUN apk add --no-cache bash
-COPY --from=0 /go/bin/kustomize /usr/local/bin
 COPY cockroachdb-template.sh /usr/local/bin/config-function
 CMD ["config-function"]

functions/examples/validator-kubeval/image/go.mod

@@ -37,7 +37,7 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

functions/examples/validator-kubeval/image/go.sum

@@ -559,8 +559,8 @@ golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

go.work.sum

@@ -161,6 +161,8 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46 h1:lsxEuwrXEAo
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
+github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ=
+github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agnivade/levenshtein v1.0.1 h1:3oJU7J3FGFmyhn8KHjmVaZCN5hxTr7GxgRue+sxIXdQ=
 github.com/alecthomas/kingpin/v2 v2.3.2/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
@@ -169,6 +171,7 @@ github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8V
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
 github.com/apache/arrow/go/v12 v12.0.0/go.mod h1:d+tV/eHZZ7Dz7RPrFKtPK02tpr+c9/PEd/zm8mDS9Vg=
@@ -224,6 +227,7 @@ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f h1:lBNOc5arjvs8E5mO2tbp
 github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/creack/pty v1.1.9 h1:uDmaGzcdjhF4i/plgjmEsriH11Y0o7RKapEf/LDaM3w=
+github.com/cristalhq/acmd v0.8.1/go.mod h1:LG5oa43pE/BbxtfMoImHCQN++0Su7dzipdgBjMCBVDQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954 h1:RMLoZVzv4GliuWafOuPuQDKSm1SJph7uCRnnS61JAn4=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
@@ -245,6 +249,7 @@ github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCv
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/flowstack/go-jsonschema v0.1.1 h1:dCrjGJRXIlbDsLAgTJZTjhwUJnnxVWl1OgNyYh5nyDc=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 h1:DujepqpGd1hyOd7aW59XpK7Qymp8iy83xq74fLr21is=
@@ -288,6 +293,7 @@ github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5
 github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
+github.com/gookit/color v1.5.2/go.mod h1:w8h4bGiHeeBpvQVePTutdbERIUf3oJE5lZ8HM0UgXyg=
 github.com/gophercloud/gophercloud v0.1.0 h1:P/nh25+rzXouhytV2pUHBb65fnds26Ghl8/391+sT5o=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
@@ -351,6 +357,7 @@ github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/lyft/protoc-gen-star/v2 v2.0.3/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
 github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
+github.com/matryer/try v0.0.0-20161228173917-9ac251b645a2/go.mod h1:0KeJpeMD6o+O4hW7qJOT7vyQPKrWmj26uf5wMc/IiIs=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
@@ -371,6 +378,7 @@ github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdI
 github.com/mitchellh/gox v0.4.0 h1:lfGJxY7ToLJQjHHwi0EX6uYBdK78egf954SQl13PQJc=
 github.com/mitchellh/iochan v1.0.0 h1:C+X3KsSTLFVBr/tK1eYN/vs4rJcvsiLU338UhYPJWeY=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+github.com/mmcloughlin/avo v0.5.0/go.mod h1:ChHFdoV7ql95Wi7vuq2YT1bwCJqiWdZrQ1im3VujLYM=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
@@ -392,6 +400,7 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c h1:Lgl0gzECD8GnQ5
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
+github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/posener/complete v1.1.1 h1:ccV59UEOTzVDnDUEFdT95ZzHVZ+5+158q8+SJb2QV5w=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
@@ -414,13 +423,18 @@ github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0
 github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/prometheus/prometheus v0.46.0/go.mod h1:10L5IJE5CEsjee1FnOcVswYXlPIscDWWt3IJ2UDYrz4=
 github.com/prometheus/tsdb v0.7.1 h1:YZcsG11NqnK4czYLrWd9mpEuAJIHVQLwdrleYfszMAA=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/quasilyte/go-ruleguard/rules v0.0.0-20211022131956-028d6511ab71/go.mod h1:4cgAphtvu7Ftv7vOT2ZOYhC6CvBxZixcasr8qIOTA50=
 github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446 h1:/NRJ5vAYoqz+7sG51ubIDHXeWO8DlTSrToPu6q11ziA=
+github.com/remyoudompheng/go-dbus v0.0.0-20121104212943-b7232d34b1d5/go.mod h1:+u151txRmLpwxBmpYn9z3d1sdJdjRPQpsXuYeY9jNls=
+github.com/remyoudompheng/go-liblzma v0.0.0-20190506200333-81bf2d431b96/go.mod h1:90HvCY7+oHHUKkbeMCiHt1WuFR2/hPJ9QrljDG+v6ls=
+github.com/remyoudompheng/go-misc v0.0.0-20190427085024-2d6ac652a50e/go.mod h1:80FQABjoFzZ2M5uEa6FUaJYEmqU2UOKojlFVak1UAwI=
 github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
 github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f h1:UFr9zpz4xgTnIE5yIMtWAMngCdZ9p/+q6lTbgelo80M=
 github.com/sagikazarmark/crypt v0.15.0/go.mod h1:5rwNNax6Mlk9sZ40AcyVtiEw24Z4J04cfSioF2COKmc=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
+github.com/shirou/gopsutil/v3 v3.23.1/go.mod h1:NN6mnm5/0k8jw4cBfCnJtr5L7ErOTg18tMNpgFkn0hA=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
@@ -438,6 +452,8 @@ github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
 github.com/tdewolff/argp v0.0.0-20231030173501-fa6c54897951/go.mod h1:fF+gnKbmf3iMG+ErLiF+orMU/InyZIEnKVVigUjfriw=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
+github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI=
+github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5 h1:LnC5Kc/wtumK+WB441p7ynQJzVuNRJiqddSIE3IlSEQ=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
@@ -446,6 +462,7 @@ github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0
 github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
 github.com/ulikunitz/xz v0.5.7/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v1.20.0 h1:fDqGv3UG/4jbVl/QkFwEdddtEDjh/5Ov6X+0B/3bPaw=
+github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/quicktemplate v1.7.0/go.mod h1:sqKJnoaOF88V07vkO+9FL8fb9uZg/VPSJnLYn+LmLk8=
 github.com/vektah/gqlparser v1.1.2 h1:ZsyLGn7/7jDNI+y4SEhI4yAxRChlv15pUHMjijT+e68=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
@@ -500,18 +517,17 @@ golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqR
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b h1:+qEpEAPhDZ1o0x3tHzZTQDArnOixOzGD9HUJfcg0mb4=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b h1:Wh+f8QHJXR411sJR8/vRBTZ7YapZaRvUcLFFJhusH0k=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
@@ -522,28 +538,25 @@ golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20190130150945-aca44879d564/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
 golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
@@ -571,7 +584,12 @@ google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBt
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+k8s.io/apiserver v0.29.0/go.mod h1:31n78PsRKPmfpee7/l9NYEv67u6hOL6AfcE761HapDM=
+k8s.io/code-generator v0.29.0/go.mod h1:5bqIZoCxs2zTRKMWNYqyQWW/bajc+ah4rh0tMY8zdGA=
+k8s.io/component-base v0.29.0/go.mod h1:sADonFTQ9Zc9yFLghpDpmNXEdHyQmFIGbiuZbqAXQ1M=
 k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/kms v0.29.0/go.mod h1:mB0f9HLxRXeXUfHfn1A7rpwOlzXI1gIWu86z6buNoYA=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0/go.mod h1:VHVDI/KrK4fjnV61bE2g3sA7tiETLn8sooImelsCx3Y=
 sigs.k8s.io/structured-merge-diff v1.0.1-0.20191108220359-b1b620dd3f06 h1:zD2IemQ4LmOcAumeiyDWXKUI2SO0NYDe3H6QGvPOVgU=

hack/go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/instrumenta/kubeval v0.16.1
 	github.com/joelanford/go-apidiff v0.6.0
 	github.com/monopole/mdrip v1.0.3
-	golang.org/x/tools v0.18.0
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
 	sigs.k8s.io/controller-tools v0.14.0
 	sigs.k8s.io/kind v0.21.0
 	sigs.k8s.io/kustomize/cmd/mdtogo v0.0.0-20240208073625-b154361c0042
@@ -31,13 +31,13 @@ require (
 	github.com/AlecAivazis/survey/v2 v2.2.2 // indirect
 	github.com/Antonboom/errname v0.1.7 // indirect
 	github.com/Antonboom/nilnil v0.1.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
 	github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 // indirect
 	github.com/BurntSushi/toml v1.2.1 // indirect
 	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
@@ -154,7 +154,7 @@ require (
 	github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e // indirect
 	github.com/gohugoio/locales v0.14.0 // indirect
 	github.com/gohugoio/localescompressed v1.0.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/glog v1.2.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
@@ -172,7 +172,7 @@ require (
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.3.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
@@ -260,7 +260,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
-	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/polyfloyd/go-errorlint v1.1.0 // indirect
@@ -273,7 +273,7 @@ require (
 	github.com/quasilyte/regex/syntax v0.0.0-20200407221936-30656e2c4a95 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
 	github.com/rivo/uniseg v0.1.0 // indirect
-	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/ryancurrah/gomodguard v1.3.0 // indirect
@@ -305,8 +305,8 @@ require (
 	github.com/spf13/viper v1.17.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.1.1 // indirect
-	github.com/stretchr/objx v0.5.0 // indirect
-	github.com/stretchr/testify v1.8.4 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/testify v1.9.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect
 	github.com/tdakkota/asciicheck v0.1.1 // indirect
@@ -337,18 +337,18 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
 	gocloud.dev v0.34.0 // indirect
-	golang.org/x/crypto v0.19.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9 // indirect
-	golang.org/x/image v0.13.0 // indirect
+	golang.org/x/image v0.18.0 // indirect
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
-	golang.org/x/mod v0.15.0 // indirect
-	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
 	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/api v0.143.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect

hack/go.sum

@@ -61,12 +61,12 @@ github.com/Antonboom/errname v0.1.7 h1:mBBDKvEYwPl4WFFNwec1CZO096G6vzK9vvDQzAwka
 github.com/Antonboom/errname v0.1.7/go.mod h1:g0ONh16msHIPgJSGsecu1G/dcF2hlYR/0SddnIAGavU=
 github.com/Antonboom/nilnil v0.1.1 h1:PHhrh5ANKFWRBh7TdYmyyq2gyT2lotnvFvvFbylF81Q=
 github.com/Antonboom/nilnil v0.1.1/go.mod h1:L1jBqoWM7AOeTD+tSquifKSesRHs4ZdaxvZR+xdJEaI=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 h1:8q4SaHjFsClSvuVne0ID/5Ka8u3fcIHyqkLjcFpNRHQ=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 h1:E+OJmp2tPvt1W+amx48v1eqbjDYsgN+RzP4q16yV5eM=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1/go.mod h1:a6xsAQUZg+VsS3TJ05SRp524Hs4pZ/AeFSr5ENf0Yjo=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 h1:U2rTu3Ef+7w9FHKIAXM6ZyqF3UOWJZ12zIm8zECAFfg=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 h1:jBQA3cKT4L2rWMpgE7Yt3Hwh2aUj8KXjIGLxjHeYNNo=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0/go.mod h1:4OG6tQ9EOP/MT0NMjDlRzWoVFxfu9rN9B2X+tlSVktg=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0 h1:Ma67P/GGprNwsslzEH6+Kb8nybI8jpDTm4Wmzu2ReK8=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0/go.mod h1:c+Lifp3EDEamAkPVzMooRNOK6CZjNSdEnf1A7jsI9u4=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0 h1:nVocQV40OQne5613EeLayJiRAJuKlBGy+m22qWG+WRg=
@@ -75,8 +75,8 @@ github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
 github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 h1:+tu3HOoMXB7RXEINRVIpxJCT+KdYiI7LAEAUrOw3dIU=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -306,8 +306,6 @@ github.com/disintegration/gift v1.2.1/go.mod h1:Jh2i7f7Q2BM7Ezno3PhfezbR1xpUg9dU
 github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.10.0 h1:+/GIL799phkJqYW+3YbOd8LCcbHzT0Pbo8zl70MHsq0=
 github.com/dlclark/regexp2 v1.10.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
-github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
@@ -431,8 +429,8 @@ github.com/gohugoio/localescompressed v1.0.1 h1:KTYMi8fCWYLswFyJAeOtuk/EkXR/KPTH
 github.com/gohugoio/localescompressed v1.0.1/go.mod h1:jBF6q8D7a0vaEmcWPNcAjUZLJaIVNiwvM3WlmTvooB0=
 github.com/gohugoio/testmodBuilder/mods v0.0.0-20190520184928-c56af20f2e95 h1:sgew0XCnZwnzpWxTt3V8LLiCO7OQi3C6dycaE67wfkU=
 github.com/gohugoio/testmodBuilder/mods v0.0.0-20190520184928-c56af20f2e95/go.mod h1:bOlVlCa1/RajcHpXkrUXPSHB/Re1UnlXxD1Qp8SKOd8=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
 github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
@@ -542,8 +540,8 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.5.0 h1:I7ELFeVBr3yfPIcc8+MWvrjk+3VjbcSzoXm3JVa+jD8=
 github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/enterprise-certificate-proxy v0.3.1 h1:SBWmZhjUDRorQxrN0nwzf+AHBxnbFjViHQS4P0yVpmQ=
@@ -844,8 +842,8 @@ github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -906,8 +904,8 @@ github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6So
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -998,8 +996,9 @@ github.com/stbenjam/no-sprintf-host-port v0.1.1/go.mod h1:TLhvtIvONRzdmkFiio4O8L
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.1.4/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -1012,8 +1011,9 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
@@ -1120,8 +1120,8 @@ golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1140,8 +1140,8 @@ golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20210220032944-ac19c3e999fb/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.13.0 h1:3cge/F/QTkNLauhf2QoE9zp+7sr+ZcL4HnoZmdwg9sg=
-golang.org/x/image v0.13.0/go.mod h1:6mmbMOeV28HuMTgA6OSRkdXKYw/t5W9Uwn2Yv1r3Yxk=
+golang.org/x/image v0.18.0 h1:jGzIakQa/ZXI1I0Fxvaa9W7yP25TqT6cHIHn+6CqvSQ=
+golang.org/x/image v0.18.0/go.mod h1:4yyo5vMFQjVjUcVk4jEQcU9MGy/rulF5WvUILseCM2E=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1172,8 +1172,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1222,8 +1222,8 @@ golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1249,8 +1249,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1304,7 +1304,6 @@ golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1320,8 +1319,8 @@ golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1330,8 +1329,8 @@ golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1345,8 +1344,8 @@ golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1433,8 +1432,8 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
-golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

kustomize/commands/create/create.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -113,7 +114,7 @@ func runCreate(opts createFlags, fSys filesys.FileSystem, rf *resource.Factory)
 			return err
 		}
 		for _, resource := range detected {
-			if kustfile.StringInSlice(resource, resources) {
+			if slices.Contains(resources, resource) {
 				continue
 			}
 			resources = append(resources, resource)

kustomize/commands/edit/add/addbase.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"strings"
 
+	"slices"
+
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
@@ -64,7 +66,7 @@ func (o *addBaseOptions) RunAddBase(fSys filesys.FileSystem) error {
 		if !fSys.Exists(path) {
 			return errors.New(path + " does not exist")
 		}
-		if kustfile.StringInSlice(path, m.Resources) {
+		if slices.Contains(m.Resources, path) {
 			return fmt.Errorf("base %s already in kustomization file", path)
 		}
 		m.Resources = append(m.Resources, path)

kustomize/commands/edit/add/addbase_test.go

@@ -4,12 +4,12 @@
 package add
 
 import (
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
 	testutils_test "sigs.k8s.io/kustomize/kustomize/v5/commands/internal/testutils"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
@@ -57,7 +57,7 @@ func TestAddBaseAlreadyThere(t *testing.T) {
 	for _, base := range bases {
 		msg := "base " + base + " already in kustomization file"
 		expectedErrors = append(expectedErrors, msg)
-		assert.True(t, kustfile.StringInSlice(msg, expectedErrors))
+		assert.True(t, slices.Contains(expectedErrors, msg))
 	}
 }
 

kustomize/commands/edit/add/addbuildmetadata.go

@@ -5,6 +5,7 @@ package add
 
 import (
 	"fmt"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
@@ -60,7 +61,7 @@ func (o *addBuildMetadataOptions) RunAddBuildMetadata(fSys filesys.FileSystem) e
 		return err
 	}
 	for _, opt := range o.buildMetadataOptions {
-		if kustfile.StringInSlice(opt, m.BuildMetadata) {
+		if slices.Contains(m.BuildMetadata, opt) {
 			return fmt.Errorf("buildMetadata option %s already in kustomization file", opt)
 		}
 		m.BuildMetadata = append(m.BuildMetadata, opt)

kustomize/commands/edit/add/addcomponent.go

@@ -6,6 +6,7 @@ package add
 import (
 	"errors"
 	"log"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/api/pkg/loader"
@@ -69,7 +70,7 @@ func (o *addComponentOptions) RunAddComponent(fSys filesys.FileSystem) error {
 
 	for _, component := range components {
 		if mf.GetPath() != component {
-			if kustfile.StringInSlice(component, m.Components) {
+			if slices.Contains(m.Components, component) {
 				log.Printf("component %s already in kustomization file", component)
 				continue
 			}

kustomize/commands/edit/add/addgenerator.go

@@ -6,6 +6,7 @@ package add
 import (
 	"errors"
 	"log"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
@@ -62,7 +63,7 @@ func (o *addGeneratorOptions) RunAddGenerator(fSys filesys.FileSystem) error {
 		return err
 	}
 	for _, t := range o.generatorFilePaths {
-		if kustfile.StringInSlice(t, m.Generators) {
+		if slices.Contains(m.Generators, t) {
 			log.Printf("generator %s already in kustomization file", t)
 			continue
 		}

kustomize/commands/edit/add/addmetadata.go

@@ -39,6 +39,7 @@ type addMetadataOptions struct {
 	mapValidator          func(map[string]string) error
 	kind                  kindOfAdd
 	labelsWithoutSelector bool
+	includeTemplates      bool
 }
 
 // newCmdAddAnnotation adds one or more commonAnnotations to the kustomization file.
@@ -83,6 +84,9 @@ func newCmdAddLabel(fSys filesys.FileSystem, v func(map[string]string) error) *c
 	cmd.Flags().BoolVar(&o.labelsWithoutSelector, "without-selector", false,
 		"using add labels without selector option",
 	)
+	cmd.Flags().BoolVar(&o.includeTemplates, "include-templates", false,
+		"include labels in templates (requires --without-selector)",
+	)
 	return cmd
 }
 
@@ -112,6 +116,9 @@ func (o *addMetadataOptions) validateAndParse(args []string) error {
 	if len(args) < 1 {
 		return fmt.Errorf("must specify %s", o.kind)
 	}
+	if !o.labelsWithoutSelector && o.includeTemplates {
+		return fmt.Errorf("--without-selector flag must be specified for --include-templates to work")
+	}
 	m, err := util.ConvertSliceToMap(args, o.kind.String())
 	if err != nil {
 		return err
@@ -132,7 +139,11 @@ func (o *addMetadataOptions) addAnnotations(m *types.Kustomization) error {
 
 func (o *addMetadataOptions) addLabels(m *types.Kustomization) error {
 	if o.labelsWithoutSelector {
-		m.Labels = append(m.Labels, types.Label{Pairs: make(map[string]string), IncludeSelectors: false})
+		m.Labels = append(m.Labels, types.Label{
+			Pairs:            make(map[string]string),
+			IncludeSelectors: false,
+			IncludeTemplates: o.includeTemplates,
+		})
 		return o.writeToMap(m.Labels[len(m.Labels)-1].Pairs, label)
 	}
 	if m.CommonLabels == nil {

kustomize/commands/edit/add/addmetadata_test.go

@@ -284,6 +284,29 @@ func TestAddLabelWithoutSelector(t *testing.T) {
 	assert.Equal(t, m.Labels[0], types.Label{Pairs: map[string]string{"new": "label"}})
 }
 
+func TestAddLabelWithoutSelectorIncludeTemplates(t *testing.T) {
+	var o addMetadataOptions
+	o.labelsWithoutSelector = true
+	m := makeKustomization(t)
+	o.metadata = map[string]string{"new": "label"}
+	o.includeTemplates = true
+	require.NoError(t, o.addLabels(m))
+	assert.Equal(t, m.Labels[0], types.Label{Pairs: map[string]string{"new": "label"}, IncludeTemplates: true})
+}
+
+func TestAddLabelIncludeTemplatesWithoutRequiredFlag(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	v := valtest_test.MakeHappyMapValidator(t)
+	cmd := newCmdAddLabel(fSys, v.Validator)
+	args := []string{"new:label"}
+	_ = cmd.Flag("include-templates").Value.Set("true")
+	_ = cmd.Flag("without-selector").Value.Set("false")
+	err := cmd.RunE(cmd, args)
+	v.VerifyNoCall()
+	require.Error(t, err)
+	require.Containsf(t, err.Error(), "--without-selector flag must be specified for --include-templates to work", "incorrect error: %s", err.Error())
+}
+
 func TestAddLabelWithoutSelectorAddLabel(t *testing.T) {
 	var o addMetadataOptions
 	o.metadata = map[string]string{"owls": "cute", "otters": "adorable"}

kustomize/commands/edit/add/addresource.go

@@ -6,6 +6,7 @@ package add
 import (
 	"errors"
 	"log"
+	"slices"
 
 	"github.com/spf13/cobra"
 	ldrhelper "sigs.k8s.io/kustomize/api/pkg/loader"
@@ -73,7 +74,7 @@ func (o *addResourceOptions) RunAddResource(fSys filesys.FileSystem) error {
 
 	for _, resource := range resources {
 		if mf.GetPath() != resource {
-			if kustfile.StringInSlice(resource, m.Resources) {
+			if slices.Contains(m.Resources, resource) {
 				log.Printf("resource %s already in kustomization file", resource)
 				continue
 			}

kustomize/commands/edit/add/addtransformer.go

@@ -6,6 +6,7 @@ package add
 import (
 	"errors"
 	"log"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
@@ -62,7 +63,7 @@ func (o *addTransformerOptions) RunAddTransformer(fSys filesys.FileSystem) error
 		return err
 	}
 	for _, t := range o.transformerFilePaths {
-		if kustfile.StringInSlice(t, m.Transformers) {
+		if slices.Contains(m.Transformers, t) {
 			log.Printf("transformer %s already in kustomization file", t)
 			continue
 		}

kustomize/commands/edit/fix/convert.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"fmt"
 	"path"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -55,11 +56,11 @@ func filesTouchedByKustomize(k *types.Kustomization, filepath string, fSys files
 		files, err := fSys.ReadDir(r)
 		if err == nil && len(files) > 0 {
 			for _, file := range files {
-				if !stringInSlice(file, []string{
+				if !slices.Contains([]string{
 					"kustomization.yaml",
 					"kustomization.yml",
 					"Kustomization",
-				}) {
+				}, file) {
 					continue
 				}
 
@@ -223,7 +224,7 @@ func constructFieldOptions(value string, varString string) ([]*types.FieldOption
 			return nil, fmt.Errorf("cannot convert all vars to replacements; %s is not delimited", varString)
 		}
 		delimiter = pre
-		index = indexOf(varString, strings.Split(value, delimiter))
+		index = slices.Index(strings.Split(value, delimiter), varString)
 		if index == -1 {
 			// this should never happen
 			return nil, fmt.Errorf("internal error: could not get index of var %s", varString)
@@ -327,21 +328,3 @@ func setPlaceholderValue(varName string, files []string, fSys filesys.FileSystem
 	}
 	return nil
 }
-
-func stringInSlice(elem string, slice []string) bool {
-	for i := range slice {
-		if slice[i] == elem {
-			return true
-		}
-	}
-	return false
-}
-
-func indexOf(varName string, slice []string) int {
-	for i := range slice {
-		if slice[i] == varName {
-			return i
-		}
-	}
-	return -1
-}

kustomize/commands/edit/remove/removebuildmetadata.go

@@ -4,6 +4,8 @@
 package remove
 
 import (
+	"slices"
+
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
 	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/util"
@@ -59,7 +61,7 @@ func (o *removeBuildMetadataOptions) RunRemoveBuildMetadata(fSys filesys.FileSys
 	}
 	var newOptions []string
 	for _, opt := range m.BuildMetadata {
-		if !kustfile.StringInSlice(opt, o.buildMetadataOptions) {
+		if !slices.Contains(o.buildMetadataOptions, opt) {
 			newOptions = append(newOptions, opt)
 		}
 	}

kustomize/commands/edit/remove/removeconfigmap.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"slices"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -88,7 +89,7 @@ func (o *removeConfigMapOptions) RunRemoveConfigMap(fSys filesys.FileSystem) err
 	remainingConfigMaps := make([]types.ConfigMapArgs, 0, len(m.ConfigMapGenerator))
 
 	for _, currentConfigMap := range m.ConfigMapGenerator {
-		if kustfile.StringInSlice(currentConfigMap.Name, o.configMapNamesToRemove) &&
+		if slices.Contains(o.configMapNamesToRemove, currentConfigMap.Name) &&
 			util.NamespaceEqual(currentConfigMap.Namespace, o.namespace) {
 			foundConfigMaps[currentConfigMap.Name] = struct{}{}
 			continue

kustomize/commands/edit/remove/removemetadata.go

@@ -40,7 +40,7 @@ type removeMetadataOptions struct {
 	kind           kindOfAdd
 }
 
-// newCmdRemoveLabel removes one or more commonAnnotations from the kustomization file.
+// newCmdRemoveAnnotation removes one or more commonAnnotations from the kustomization file.
 func newCmdRemoveAnnotation(fSys filesys.FileSystem, v func([]string) error) *cobra.Command {
 	var o removeMetadataOptions
 	o.kind = label

kustomize/commands/edit/remove/removeresource.go

@@ -6,6 +6,7 @@ package remove
 import (
 	"errors"
 	"path/filepath"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/api/konfig"
@@ -73,7 +74,7 @@ func (o *removeResourceOptions) RunRemoveResource(fSys filesys.FileSystem) error
 
 	newResources := make([]string, 0, len(m.Resources))
 	for _, resource := range m.Resources {
-		if kustfile.StringInSlice(resource, resources) {
+		if slices.Contains(resources, resource) {
 			continue
 		}
 		newResources = append(newResources, resource)

kustomize/commands/edit/remove/removesecret.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"slices"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -89,7 +90,7 @@ func (o *removeSecretOptions) RunRemoveSecret(fSys filesys.FileSystem) error {
 	remainingSecrets := make([]types.SecretArgs, 0, len(m.SecretGenerator))
 
 	for _, currentSecret := range m.SecretGenerator {
-		if kustfile.StringInSlice(currentSecret.Name, o.secretNamesToRemove) &&
+		if slices.Contains(o.secretNamesToRemove, currentSecret.Name) &&
 			util.NamespaceEqual(currentSecret.Namespace, o.namespace) {
 			foundSecrets[currentSecret.Name] = struct{}{}
 			continue

kustomize/commands/edit/remove/removetransformer.go

@@ -5,6 +5,7 @@ package remove
 
 import (
 	"errors"
+	"slices"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/api/konfig"
@@ -72,7 +73,7 @@ func (o *removeTransformerOptions) RunRemoveTransformer(fSys filesys.FileSystem)
 
 	newTransformers := make([]string, 0, len(m.Transformers))
 	for _, transformer := range m.Transformers {
-		if kustfile.StringInSlice(transformer, transformers) {
+		if slices.Contains(transformers, transformer) {
 			continue
 		}
 		newTransformers = append(newTransformers, transformer)

kustomize/commands/internal/kustfile/kustomizationfile.go

@@ -40,6 +40,7 @@ func determineFieldOrder() []string {
 
 	ordered := []string{
 		"MetaData",
+		"SortOptions",
 		"Resources",
 		"Bases",
 		"NamePrefix",
@@ -65,6 +66,7 @@ func determineFieldOrder() []string {
 		"Configurations",
 		"Generators",
 		"Transformers",
+		"Validators",
 		"Components",
 		"OpenAPI",
 		"BuildMetadata",
@@ -189,16 +191,6 @@ func (mf *kustomizationFile) Write(kustomization *types.Kustomization) error {
 	return mf.fSys.WriteFile(mf.path, data)
 }
 
-// StringInSlice returns true if the string is in the slice.
-func StringInSlice(str string, list []string) bool {
-	for _, v := range list {
-		if v == str {
-			return true
-		}
-	}
-	return false
-}
-
 func (mf *kustomizationFile) parseCommentedFields(content []byte) error {
 	buffer := bytes.NewBuffer(content)
 	var comments [][]byte

kustomize/commands/internal/kustfile/kustomizationfile_test.go

@@ -5,6 +5,7 @@ package kustfile
 
 import (
 	"reflect"
+	"slices"
 	"strings"
 	"testing"
 
@@ -21,6 +22,7 @@ func TestFieldOrder(t *testing.T) {
 		"APIVersion",
 		"Kind",
 		"MetaData",
+		"SortOptions",
 		"Resources",
 		"Bases",
 		"NamePrefix",
@@ -46,6 +48,7 @@ func TestFieldOrder(t *testing.T) {
 		"Configurations",
 		"Generators",
 		"Transformers",
+		"Validators",
 		"Components",
 		"OpenAPI",
 		"BuildMetadata",
@@ -87,6 +90,155 @@ func TestWriteAndRead(t *testing.T) {
 	}
 }
 
+func TestReadAndWrite(t *testing.T) {
+	kWrite := []byte(completeKustfileInOrder)
+
+	fSys := filesys.MakeFsInMemory()
+	testutils_test.WriteTestKustomizationWith(fSys, kWrite)
+	mf, err := NewKustomizationFile(fSys)
+	if err != nil {
+		t.Fatalf("Unexpected Error: %v", err)
+	}
+
+	kustomization, err := mf.Read()
+	if err != nil {
+		t.Fatalf("Unexpected Error: %v", err)
+	}
+
+	if err := mf.Write(kustomization); err != nil {
+		t.Fatalf("Couldn't write kustomization file: %v\n", err)
+	}
+
+	kRead, err := testutils_test.ReadTestKustomization(fSys)
+	if err != nil {
+		t.Fatalf("Unexpected Error: %v", err)
+	}
+
+	if !reflect.DeepEqual(kWrite, kRead) {
+		t.Fatal("Written kustomization is different from read kustomization")
+	}
+}
+
+func TestReadAndWriteDummy(t *testing.T) {
+	kWrite := &types.Kustomization{
+		TypeMeta: types.TypeMeta{
+			APIVersion: "kustomize.config.k8s.io/v1beta1",
+			Kind:       "Kustomization",
+		},
+		MetaData: &types.ObjectMeta{
+			Name:        "name",
+			Namespace:   "namespace",
+			Labels:      map[string]string{"label": "label"},
+			Annotations: map[string]string{"annotation": "annotation"},
+		},
+		OpenAPI:      map[string]string{"path": "schema.json"},
+		NamePrefix:   "prefix",
+		NameSuffix:   "suffix",
+		Namespace:    "namespace",
+		CommonLabels: map[string]string{"commonLabel": "commonLabel"},
+		Labels: []types.Label{{
+			Pairs:            map[string]string{"label": "label"},
+			IncludeSelectors: true,
+			IncludeTemplates: true,
+			FieldSpecs: []types.FieldSpec{{
+				Path: "metadata.labels.label",
+			}},
+		}},
+		CommonAnnotations: map[string]string{"commonAnnotation": "commonAnnotation"},
+		Patches: []types.Patch{{
+			Path: "path",
+		}},
+		Images: []types.Image{{
+			Name:      "name",
+			NewName:   "newName",
+			TagSuffix: "tagSuffix",
+			NewTag:    "newTag",
+			Digest:    "digest",
+		}},
+		Replacements: []types.ReplacementField{{
+			Path: "path",
+		}},
+		Replicas: []types.Replica{{
+			Name:  "name",
+			Count: 1,
+		}},
+		SortOptions: &types.SortOptions{
+			Order: types.LegacySortOrder,
+			LegacySortOptions: &types.LegacySortOptions{
+				OrderFirst: []string{"orderFirst"},
+				OrderLast:  []string{"orderLast"},
+			},
+		},
+		Resources:  []string{"resource"},
+		Components: []string{"component"},
+		Crds:       []string{"crd"},
+		ConfigMapGenerator: []types.ConfigMapArgs{{
+			GeneratorArgs: types.GeneratorArgs{
+				Namespace: "namespace",
+				Name:      "name",
+			},
+		}},
+		SecretGenerator: []types.SecretArgs{{
+			GeneratorArgs: types.GeneratorArgs{
+				Namespace: "namespace",
+				Name:      "name",
+			},
+		}},
+		HelmGlobals: &types.HelmGlobals{
+			ChartHome:  "chartHome",
+			ConfigHome: "configHome",
+		},
+		HelmCharts: []types.HelmChart{{
+			Name: "name",
+		}},
+		GeneratorOptions: &types.GeneratorOptions{
+			Labels: map[string]string{"label": "label"},
+		},
+		Configurations: []string{"configuration"},
+		Generators:     []string{"generator"},
+		Transformers:   []string{"transformer"},
+		Validators:     []string{"validator"},
+		BuildMetadata:  []string{"buildMetadata"},
+	}
+
+	// this check is for forward compatibility: if this fails, add a dummy value to the Kustomization above
+	assertAllNonZeroExcept(t, kWrite, []string{"PatchesStrategicMerge", "PatchesJson6902", "ImageTags", "Vars", "Bases", "HelmChartInflationGenerator"})
+
+	fSys := filesys.MakeFsInMemory()
+	testutils_test.WriteTestKustomization(fSys)
+	mf, err := NewKustomizationFile(fSys)
+	if err != nil {
+		t.Fatalf("Unexpected Error: %v", err)
+	}
+
+	if err := mf.Write(kWrite); err != nil {
+		t.Fatalf("Couldn't write kustomization file: %v\n", err)
+	}
+
+	kRead, err := mf.Read()
+	if err != nil {
+		t.Fatalf("Unexpected Error: %v", err)
+	}
+
+	if !reflect.DeepEqual(kWrite, kRead) {
+		t.Fatal("Written kustomization is different from read kustomization.")
+	}
+}
+
+func assertAllNonZeroExcept(t *testing.T, val *types.Kustomization, except []string) {
+	t.Helper()
+	fFor := reflect.ValueOf(val).Elem()
+	n := fFor.NumField()
+	for i := 0; i < n; i++ {
+		key := fFor.Type().Field(i).Name
+		val := fFor.Field(i)
+		if val.IsZero() && !slices.Contains(except, key) {
+			t.Helper()
+			t.Fatalf("Key %s should not be empty", key)
+		}
+	}
+}
+
 func TestGetPath(t *testing.T) {
 	fSys := filesys.MakeEmptyDirInMemory()
 	testutils_test.WriteTestKustomization(fSys)
@@ -386,3 +538,80 @@ foo:
 		t.Fatalf("Expect an unknown field error but got: %v", err)
 	}
 }
+
+const completeKustfileInOrder = `
+kind: Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+metadata:
+  annotations:
+    annotation: annotation
+  labels:
+    label: label
+  name: name
+  namespace: namespace
+openapi:
+  path: schema.json
+namePrefix: prefix
+nameSuffix: suffix
+namespace: namespace
+commonLabels:
+  commonLabel: commonLabel
+labels:
+- fields:
+  - path: metadata.labels.label
+  includeSelectors: true
+  includeTemplates: true
+  pairs:
+    label: label
+commonAnnotations:
+  commonAnnotation: commonAnnotation
+patches:
+- path: path
+images:
+- digest: digest
+  name: name
+  newName: newName
+  newTag: newTag
+  tagSuffix: tagSuffix
+replacements:
+- path: path
+replicas:
+- count: 1
+  name: name
+sortOptions:
+  legacySortOptions:
+    orderFirst:
+    - orderFirst
+    orderLast:
+    - orderLast
+  order: legacy
+resources:
+- resource
+components:
+- component
+crds:
+- crd
+configMapGenerator:
+- name: name
+  namespace: namespace
+secretGenerator:
+- name: name
+  namespace: namespace
+helmGlobals:
+  chartHome: chartHome
+  configHome: configHome
+helmCharts:
+- name: name
+- name: chartName
+generatorOptions:
+  labels:
+    label: label
+configurations:
+- configuration
+generators:
+- generator
+transformers:
+- transformer
+buildMetadata:
+- buildMetadata
+`

kustomize/commands/internal/util/validate.go

@@ -6,10 +6,10 @@ package util
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kustomize/v5/commands/internal/kustfile"
 )
 
 type BuildMetadataValidator struct{}
@@ -23,7 +23,7 @@ func (b *BuildMetadataValidator) Validate(args []string) ([]string, error) {
 	}
 	opts := strings.Split(args[0], ",")
 	for _, opt := range opts {
-		if !kustfile.StringInSlice(opt, types.BuildMetadataOptions) {
+		if !slices.Contains(types.BuildMetadataOptions, opt) {
 			return nil, fmt.Errorf("invalid buildMetadata option: %s", opt)
 		}
 	}

kustomize/commands/localize/localize.go

@@ -4,10 +4,14 @@
 package localize
 
 import (
+	"bytes"
 	"log"
+	"path/filepath"
 
 	"github.com/spf13/cobra"
 	lclzr "sigs.k8s.io/kustomize/api/krusty/localizer"
+	"sigs.k8s.io/kustomize/kustomize/v5/commands/build"
+	"sigs.k8s.io/kustomize/kyaml/copyutil"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
@@ -20,23 +24,26 @@ type arguments struct {
 }
 
 type flags struct {
-	scope string
+	scope    string
+	noVerify bool
 }
 
 // NewCmdLocalize returns a new localize command.
 func NewCmdLocalize(fs filesys.FileSystem) *cobra.Command {
 	var f flags
+	var buildBuffer bytes.Buffer
+	buildCmd := build.NewCmdBuild(fs, &build.Help{}, &buildBuffer)
 	cmd := &cobra.Command{
 		Use:   "localize [target [destination]]",
 		Short: "[Alpha] Creates localized copy of target kustomization root at destination",
-		Long: `[Alpha] Creates copy of target kustomization directory or 
-versioned URL at destination, where remote references in the original 
+		Long: `[Alpha] Creates copy of target kustomization directory or
+versioned URL at destination, where remote references in the original
 are replaced by local references to the downloaded remote content.
 
-If target is not specified, the current working directory will be used. 
-Destination is a path to a new directory in an existing directory. If 
-destination is not specified, a new directory will be created in the current 
-working directory. 
+If target is not specified, the current working directory will be used.
+Destination is a path to a new directory in an existing directory. If
+destination is not specified, a new directory will be created in the current
+working directory.
 
 For details, see: https://kubectl.docs.kubernetes.io/references/kustomize/cmd/
 
@@ -46,7 +53,7 @@ alphabetizes kustomization fields in the localized copy.
 `,
 		Example: `
 # Localize the current working directory, with default scope and destination
-kustomize localize 
+kustomize localize
 
 # Localize some local directory, with scope and default destination
 kustomize localize /home/path/scope/target --scope /home/path/scope
@@ -62,6 +69,30 @@ kustomize localize https://github.com/kubernetes-sigs/kustomize//api/krusty/test
 			if err != nil {
 				return errors.Wrap(err)
 			}
+
+			if !f.noVerify {
+				originalBuild, err := runBuildCmd(buildBuffer, buildCmd, args.target)
+				if err != nil {
+					return errors.Wrap(err)
+				}
+
+				buildDst := dst
+				if f.scope != "" && f.scope != args.target {
+					buildDst = filepath.Join(dst, filepath.Base(args.target))
+				}
+
+				localizedBuild, err := runBuildCmd(buildBuffer, buildCmd, buildDst)
+				if err != nil {
+					return errors.Wrap(err)
+				}
+
+				if localizedBuild != originalBuild {
+					copyutil.PrettyFileDiff(originalBuild, localizedBuild)
+					log.Fatalf("VERIFICATION FAILED: `kustomize build` for %s and %s are different after localization.\n", args.target, dst)
+				}
+				log.Printf("VERIFICATION SUCCESS: `kustomize build` for %s and %s are the same after localization.\n", args.target, dst)
+			}
+
 			log.Printf("SUCCESS: localized %q to directory %s\n", args.target, dst)
 			return nil
 		},
@@ -74,6 +105,12 @@ kustomize localize https://github.com/kubernetes-sigs/kustomize//api/krusty/test
 Cannot specify for remote targets, as scope is by default the containing repo.
 If not specified for local target, scope defaults to target.
 `)
+	cmd.Flags().BoolVar(&f.noVerify,
+		"no-verify",
+		false,
+		`Does not verify that the outputs of kustomize build for target and newDir are the same after localization.
+		If not specified, this flag defaults to false and will run kustomize build.
+	`)
 	return cmd
 }
 
@@ -92,3 +129,16 @@ func matchArgs(rawArgs []string) arguments {
 	}
 	return args
 }
+
+func runBuildCmd(buffer bytes.Buffer, cmd *cobra.Command, folder string) (buildOutput string, err error) {
+	buffer.Reset()
+	buildErr := cmd.RunE(cmd, []string{folder})
+	if buildErr != nil {
+		log.Printf("If your target directory requires flags to build: \n"+
+			"1. Add executable permissions for the downloaded exec binaries in '%s'. \n"+
+			"2. Run kustomize build with the necessary flags and self-verify the outputs.", folder)
+		return "", errors.Wrap(buildErr)
+	}
+
+	return buffer.String(), nil
+}

kustomize/commands/localize/localize_test.go

@@ -39,6 +39,24 @@ spec:
         - containerPort: 80
 `
 
+const helmKustomization = `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+- name: external-dns
+  repo: oci://registry-1.docker.io/bitnamicharts
+  version: 6.19.2
+  releaseName: test
+  valuesInline:
+    crd:
+      create: false
+    rbac:
+      create: false
+    serviceAccount:
+      create: false
+    service:
+      enabled: false
+`
+
 func TestScopeFlag(t *testing.T) {
 	kustomizations := map[string]string{
 		filepath.Join("target", "kustomization.yaml"): fmt.Sprintf(`resources:
@@ -66,6 +84,60 @@ func TestScopeFlag(t *testing.T) {
 	loctest.CheckFs(t, testDir.String(), expected, actual)
 }
 
+func TestNoVerifyFlag(t *testing.T) {
+	kustomization := map[string]string{
+		"kustomization.yaml": `resources:
+- deployment.yaml
+`,
+		"deployment.yaml": deployment,
+	}
+	expected, actual, target := loctest.PrepareFs(t, nil, kustomization)
+
+	buffy := new(bytes.Buffer)
+	log.SetOutput(buffy)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	cmd := localize.NewCmdLocalize(actual)
+	require.NoError(t, cmd.Flags().Set("no-verify", "true"))
+	err := cmd.RunE(cmd, []string{
+		target.String(),
+		target.Join("dst"),
+	})
+	require.NoError(t, err)
+
+	loctest.SetupDir(t, expected, target.Join("dst"), kustomization)
+	loctest.CheckFs(t, target.String(), expected, actual)
+
+	successMsg := fmt.Sprintf(`SUCCESS: localized "%s" to directory %s
+`, target.String(), target.Join("dst"))
+	verifyMsg := "VERIFICATION"
+	require.NotContains(t, buffy.String(), verifyMsg)
+	require.Contains(t, buffy.String(), successMsg)
+}
+
+func TestFailingBuildCmd(t *testing.T) {
+	kustomization := map[string]string{
+		"kustomization.yaml": helmKustomization,
+	}
+	_, actual, target := loctest.PrepareFs(t, nil, kustomization)
+
+	buffy := new(bytes.Buffer)
+	log.SetOutput(buffy)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	cmd := localize.NewCmdLocalize(actual)
+	err := cmd.RunE(cmd, []string{
+		target.String(),
+		target.Join("dst"),
+	})
+	require.Error(t, err)
+
+	verifyMsg := "If your target directory requires flags to build"
+	require.Contains(t, buffy.String(), verifyMsg)
+}
+
 func TestOptionalArgs(t *testing.T) {
 	for name, args := range map[string][]string{
 		"no_target": {},
@@ -99,6 +171,8 @@ func TestOptionalArgs(t *testing.T) {
 			loctest.SetupDir(t, expected, dst, kust)
 			loctest.CheckFs(t, testDir.String(), expected, actual)
 
+			verifyMsg := "VERIFICATION SUCCESS"
+			require.Contains(t, buffy.String(), verifyMsg)
 			successMsg := fmt.Sprintf(`SUCCESS: localized "." to directory %s
 `, dst)
 			require.Contains(t, buffy.String(), successMsg)
@@ -128,6 +202,8 @@ func TestOutput(t *testing.T) {
 	loctest.SetupDir(t, expected, target.Join("dst"), kustomization)
 	loctest.CheckFs(t, target.String(), expected, actual)
 
+	verifyMsg := "VERIFICATION SUCCESS"
+	require.Contains(t, buffy.String(), verifyMsg)
 	successMsg := fmt.Sprintf(`SUCCESS: localized "%s" to directory %s
 `, target.String(), target.Join("dst"))
 	require.Contains(t, buffy.String(), successMsg)

kustomize/go.mod

@@ -8,9 +8,9 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.8.4
 	golang.org/x/text v0.14.0
-	sigs.k8s.io/kustomize/api v0.16.0
-	sigs.k8s.io/kustomize/cmd/config v0.14.0
-	sigs.k8s.io/kustomize/kyaml v0.17.0
+	sigs.k8s.io/kustomize/api v0.17.2
+	sigs.k8s.io/kustomize/cmd/config v0.14.2
+	sigs.k8s.io/kustomize/kyaml v0.17.2
 	sigs.k8s.io/yaml v1.4.0
 )
 
@@ -30,9 +30,10 @@ require (
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

kustomize/go.sum

@@ -35,6 +35,7 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -64,6 +65,7 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -77,8 +79,8 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0H
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -87,12 +89,15 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -100,9 +105,9 @@ k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/A
 k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/cmd/config v0.14.0 h1:TMKWBtk0Ox1EUwafT9hncg7EFrvrBlqDDHXmBHm51U8=
-sigs.k8s.io/kustomize/cmd/config v0.14.0/go.mod h1:J+ukok4u7k8esCzEhRTygTW7dzDKYbC0kCDkpBK3VfI=
-sigs.k8s.io/kustomize/kyaml v0.17.0 h1:G2bWs03V9Ur2PinHLzTUJ8Ded+30SzXZKiO92SRDs3c=
-sigs.k8s.io/kustomize/kyaml v0.17.0/go.mod h1:6lxkYF1Cv9Ic8g/N7I86cvxNc5iinUo/P2vKsHNmpyE=
+sigs.k8s.io/kustomize/cmd/config v0.14.2 h1:YOCu0BnVPm2Iq6PR4fJgO6+rivg5LbR3+o/4ZUeXAvM=
+sigs.k8s.io/kustomize/cmd/config v0.14.2/go.mod h1:w30rR4oCUm5wEi0tSuBCmuBMS9Z/Cq6oDdfg8fL/qls=
+sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
+sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

kyaml/fn/framework/processors.go

@@ -176,6 +176,9 @@ func LoadFunctionConfig(src *yaml.RNode, api interface{}) error {
 	return schemaValidationError
 }
 
+// combineErrors produces a CompositeValidationError for the given schemaErr and givenErr.
+// If either is already a CompsiteError, its constituent errors become part of the new
+// composite error. If both given errors are nil, this function returns nil.
 func combineErrors(schemaErr, customErr error) error {
 	combined := validationErrors.CompositeValidationError()
 	if compositeSchemaErr, ok := schemaErr.(*validationErrors.CompositeError); ok {
@@ -227,7 +230,7 @@ type TemplateProcessor struct {
 	PatchTemplates []PatchTemplate
 
 	// MergeResources, if set to true, will cause the resources in ResourceList.items to be
-	// will be applied as patches on any matching resources generated by ResourceTemplates.
+	// applied as patches on any matching resources generated by ResourceTemplates.
 	MergeResources bool
 
 	// PreProcessFilters provides a hook to manipulate the ResourceList's items or config after

kyaml/fn/framework/selector.go

@@ -156,7 +156,7 @@ func initMatcherTemplates(matchers []ResourceMatcher, data interface{}) error {
 
 var _ ResourceTemplateMatcher = &OrSelector{}
 
-// OrSelector is a kio.Filter that selects resources when that match all of its embedded
+// AndSelector is a kio.Filter that selects resources when that match all of its embedded
 // matchers.
 type AndSelector struct {
 	// Matchers is the list of ResourceMatchers to try on the input resources.

kyaml/fn/runtime/container/container.go

@@ -167,7 +167,7 @@ func (c *Filter) setupExec() error {
 	return nil
 }
 
-// getArgs returns the command + args to run to spawn the container
+// getCommand returns the command + args to run to spawn the container
 func (c *Filter) getCommand() (string, []string) {
 	network := runtimeutil.NetworkNameNone
 	if c.ContainerSpec.Network {