Merge pull request #3565 from monopole/pinToCmdConfig

Pin to cmd/config v0.9.1

Makefile

@@ -4,7 +4,7 @@
 # Makefile for kustomize CLI and API.
 
 MYGOBIN := $(shell go env GOPATH)/bin
-SHELL := /bin/bash
+SHELL := /usr/bin/env bash
 export PATH := $(MYGOBIN):$(PATH)
 MODULES := '"cmd/config" "api/" "kustomize/" "kyaml/"'
 
@@ -26,22 +26,21 @@ verify-kustomize: \
 	lint-kustomize \
 	test-unit-kustomize-all \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.8.6
+	test-examples-kustomize-against-3.9 \
+	test-examples-kustomize-against-3.8
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
 .PHONY: prow-presubmit-check
 prow-presubmit-check: \
 	lint-kustomize \
+	test-multi-module \
 	test-unit-kustomize-all \
 	test-unit-cmd-all \
 	test-go-mod \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.8.6
-
-# test-multi-module \
-# Temporarily removed from prow-presubmit-check
-# See https://github.com/kubernetes-sigs/kustomize/issues/3191
+	test-examples-kustomize-against-3.9 \
+	test-examples-kustomize-against-3.8
 
 .PHONY: verify-kustomize-e2e
 verify-kustomize-e2e: test-examples-e2e-kustomize
@@ -80,6 +79,11 @@ $(MYGOBIN)/gorepomod:
 	cd cmd/gorepomod; \
 	go install .
 
+# Build from local source.
+$(MYGOBIN)/k8scopy:
+	cd cmd/k8scopy; \
+	go install .
+
 # Build from local source.
 $(MYGOBIN)/pluginator:
 	cd cmd/pluginator; \
@@ -99,13 +103,13 @@ $(MYGOBIN)/kustomize:
 install-tools: \
 	$(MYGOBIN)/goimports \
 	$(MYGOBIN)/golangci-lint-kustomize \
-	$(MYGOBIN)/gh \
 	$(MYGOBIN)/gorepomod \
+	$(MYGOBIN)/helm \
+	$(MYGOBIN)/k8scopy \
 	$(MYGOBIN)/mdrip \
 	$(MYGOBIN)/pluginator \
 	$(MYGOBIN)/prchecker \
-	$(MYGOBIN)/stringer \
-	$(MYGOBIN)/helm
+	$(MYGOBIN)/stringer
 
 ### Begin kustomize plugin rules.
 #
@@ -193,24 +197,27 @@ $(pGen)/%.go: $(MYGOBIN)/pluginator
 .PHONY: generate-kustomize-builtin-plugins
 generate-kustomize-builtin-plugins: $(builtinplugins)
 
-.PHONY: kustomize-external-go-plugin-build
-kustomize-external-go-plugin-build:
+.PHONY: build-kustomize-external-go-plugin
+build-kustomize-external-go-plugin:
 	./hack/buildExternalGoPlugins.sh ./plugin
 
-.PHONY: kustomize-external-go-plugin-clean
-kustomize-external-go-plugin-clean:
+.PHONY: clean-kustomize-external-go-plugin
+clean-kustomize-external-go-plugin:
 	./hack/buildExternalGoPlugins.sh ./plugin clean
 
 ### End kustomize plugin rules.
 
 .PHONY: lint-kustomize
 lint-kustomize: install-tools $(builtinplugins)
-	cd api; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../.golangci-kustomize.yml run ./...
-	cd kustomize; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../.golangci-kustomize.yml run ./...
-	cd cmd/pluginator; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../../.golangci-kustomize.yml run ./...
+	cd api; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../.golangci-kustomize.yml \
+	  run ./...
+	cd kustomize; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../.golangci-kustomize.yml \
+	  run ./...
+	cd cmd/pluginator; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../../.golangci-kustomize.yml \
+	  run ./...
 
 # Used to add non-default compilation flags when experimenting with
 # plugin-to-api compatibility checks.
@@ -218,6 +225,10 @@ lint-kustomize: install-tools $(builtinplugins)
 build-kustomize-api: $(builtinplugins)
 	cd api; go build ./...
 
+.PHONY: generate-kustomize-api
+generate-kustomize-api: $(MYGOBIN)/k8scopy
+	cd api; go generate ./...
+
 .PHONY: test-unit-kustomize-api
 test-unit-kustomize-api: build-kustomize-api
 	cd api; go test ./...  -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
@@ -270,17 +281,12 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-3.8.6: $(MYGOBIN)/mdrip
-	( \
-		set -e; \
-		tag=v3.8.6; \
-		/bin/rm -f $(MYGOBIN)/kustomize; \
-		echo "Installing kustomize $$tag."; \
-		GO111MODULE=on go get sigs.k8s.io/kustomize/kustomize/v3@$${tag}; \
-		./hack/testExamplesAgainstKustomize.sh $$tag; \
-		echo "Reinstalling kustomize from HEAD."; \
-		cd kustomize; go install .; \
-	)
+test-examples-kustomize-against-3.9: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.9.3
+
+.PHONY:
+test-examples-kustomize-against-3.8: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.8.10
 
 # linux only.
 # This is for testing an example plugin that
@@ -354,13 +360,15 @@ $(MYGOBIN)/gh:
 	)
 
 .PHONY: clean
-clean: kustomize-external-go-plugin-clean
+clean: clean-kustomize-external-go-plugin
 	go clean --cache
 	rm -f $(builtinplugins)
-	rm -f $(MYGOBIN)/pluginator
 	rm -f $(MYGOBIN)/kustomize
 	rm -f $(MYGOBIN)/golangci-lint-kustomize
 
+# Handle pluginator manually.
+# rm -f $(MYGOBIN)/pluginator
+
 # Nuke the site from orbit.  It's the only way to be sure.
 .PHONY: nuke
 nuke: clean

README.md

@@ -20,15 +20,20 @@ This tool is sponsored by [sig-cli] ([KEP]).
 
 ## kubectl integration
 
-Since [v1.14][kubectl announcement] the kustomize build system has been included in kubectl.
+The kustomize build flow at [v2.0.3] was added
+to [kubectl v1.14][kubectl announcement].  The kustomize
+flow in kubectl has remained frozen at v2.0.3 while work
+to extract kubectl from the k/k repo, and work to remove
+kustomize's dependence on core k/k code ([#2506]) has proceeded.
+The reintegration effort is tracked in [#1500] (and its blocking
+issues).
 
-| kubectl version | kustomize version |
-|---------|--------|
-| v1.16.0 | [v2.0.3](/../../tree/v2.0.3) |
-| v1.15.x | [v2.0.3](/../../tree/v2.0.3) |
-| v1.14.x | [v2.0.3](/../../tree/v2.0.3) |
+[v2.0.3]: /../../tree/v2.0.3
+[#2506]: https://github.com/kubernetes-sigs/kustomize/issues/2506
+[#1500]: https://github.com/kubernetes-sigs/kustomize/issues/1500
 
-For examples and guides for using the kubectl integration please see the [kubectl book] or the [kubernetes documentation].
+For examples and guides for using the kubectl integration please
+see the [kubectl book] or the [kubernetes documentation].
 
 ## Usage
 
@@ -148,7 +153,7 @@ is governed by the [Kubernetes Code of Conduct].
 [imageBase]: docs/images/base.jpg
 [imageOverlay]: docs/images/overlay.jpg
 [kubectl announcement]: https://kubernetes.io/blog/2019/03/25/kubernetes-1-14-release-announcement
-[kubectl book]: https://kubectl.docs.kubernetes.io/pages/app_customization/introduction.html
+[kubectl book]: https://kubectl.docs.kubernetes.io/guides/introduction/kustomize/
 [kubernetes documentation]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
 [kubernetes style]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#kubernetes-style-object
 [kustomization]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#kustomization

api/builtins/AnnotationsTransformer.go

@@ -7,7 +7,6 @@ import (
 	"sigs.k8s.io/kustomize/api/filters/annotations"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -25,11 +24,14 @@ func (p *AnnotationsTransformerPlugin) Config(
 }
 
 func (p *AnnotationsTransformerPlugin) Transform(m resmap.ResMap) error {
+	if len(p.Annotations) == 0 {
+		return nil
+	}
 	for _, r := range m.Resources() {
-		err := filtersutil.ApplyToJSON(annotations.Filter{
+		err := r.ApplyFilter(annotations.Filter{
 			Annotations: p.Annotations,
 			FsSlice:     p.FieldSpecs,
-		}, r)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/HashTransformer.go

@@ -28,6 +28,7 @@ func (p *HashTransformerPlugin) Transform(m resmap.ResMap) error {
 			if err != nil {
 				return err
 			}
+			res.StorePreviousId()
 			res.SetName(fmt.Sprintf("%s-%s", res.GetName(), h))
 		}
 	}

api/builtins/HelmChartInflationGenerator.go

@@ -6,12 +6,15 @@ package builtins
 import (
 	"bytes"
 	"fmt"
+	"io"
+	"io/ioutil"
 	"os"
 	"os/exec"
-	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 
+	"github.com/imdario/mergo"
 	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -48,7 +51,7 @@ func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, conf
 		return fmt.Errorf("chartName cannot be empty")
 	}
 	if p.ChartHome == "" {
-		p.ChartHome = path.Join(p.tmpDir, "chart")
+		p.ChartHome = filepath.Join(p.tmpDir, "chart")
 	}
 	if p.ChartRepoName == "" {
 		p.ChartRepoName = "stable"
@@ -57,10 +60,13 @@ func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, conf
 		p.HelmBin = "helm"
 	}
 	if p.HelmHome == "" {
-		p.HelmHome = path.Join(p.tmpDir, ".helm")
+		p.HelmHome = filepath.Join(p.tmpDir, ".helm")
 	}
 	if p.Values == "" {
-		p.Values = path.Join(p.ChartHome, p.ChartName, "values.yaml")
+		p.Values = filepath.Join(p.ChartHome, p.ChartName, "values.yaml")
+	}
+	if p.ValuesMerge == "" {
+		p.ValuesMerge = "override"
 	}
 	// runHelmCommand will run `helm` command with args provided. Return stdout
 	// and error if there is any.
@@ -88,6 +94,94 @@ func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, conf
 	return nil
 }
 
+// EncodeValues for writing
+func (p *HelmChartInflationGeneratorPlugin) EncodeValues(w io.Writer) error {
+	d, err := yaml.Marshal(p.ValuesLocal)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(d)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// useValuesLocal process (merge) inflator config provided values with chart default values.yaml
+func (p *HelmChartInflationGeneratorPlugin) useValuesLocal() error {
+	// not override, merge, none
+	if !(p.ValuesMerge == "none" || p.ValuesMerge == "no" || p.ValuesMerge == "false") {
+		var pValues []byte
+		var err error
+
+		if filepath.IsAbs(p.Values) {
+			pValues, err = ioutil.ReadFile(p.Values)
+		} else {
+			pValues, err = p.h.Loader().Load(p.Values)
+		}
+		if err != nil {
+			return err
+		}
+		chValues := make(map[string]interface{})
+		err = yaml.Unmarshal(pValues, &chValues)
+		if err != nil {
+			return err
+		}
+		if p.ValuesMerge == "override" {
+			err = mergo.Merge(&chValues, p.ValuesLocal, mergo.WithOverride)
+			if err != nil {
+				return err
+			}
+		}
+		if p.ValuesMerge == "merge" {
+			err = mergo.Merge(&chValues, p.ValuesLocal)
+			if err != nil {
+				return err
+			}
+		}
+		p.ValuesLocal = chValues
+	}
+	b, err := yaml.Marshal(p.ValuesLocal)
+	if err != nil {
+		return err
+	}
+	path, err := p.writeValuesBytes(b)
+	if err != nil {
+		return err
+	}
+	p.Values = path
+	return nil
+}
+
+// copyValues will copy the relative values file into the temp directory
+// to avoid messing up with CWD.
+func (p *HelmChartInflationGeneratorPlugin) copyValues() error {
+	// only copy when the values path is not absolute
+	if filepath.IsAbs(p.Values) {
+		return nil
+	}
+	// we must use use loader to read values file
+	b, err := p.h.Loader().Load(p.Values)
+	if err != nil {
+		return err
+	}
+	path, err := p.writeValuesBytes(b)
+	if err != nil {
+		return err
+	}
+	p.Values = path
+	return nil
+}
+
+func (p *HelmChartInflationGeneratorPlugin) writeValuesBytes(b []byte) (string, error) {
+	path := filepath.Join(p.ChartHome, p.ChartName, "kustomize-values.yaml")
+	err := ioutil.WriteFile(path, b, 0644)
+	if err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
 // Generate implements generator
 func (p *HelmChartInflationGeneratorPlugin) Generate() (resmap.ResMap, error) {
 	// cleanup
@@ -104,6 +198,20 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (resmap.ResMap, error) {
 			return nil, err
 		}
 	}
+
+	// inflator config valuesLocal
+	if len(p.ValuesLocal) > 0 {
+		err := p.useValuesLocal()
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		err := p.copyValues()
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// render the charts
 	stdout, err := p.runHelmCommand(p.getTemplateCommandArgs())
 	if err != nil {
@@ -118,13 +226,14 @@ func (p *HelmChartInflationGeneratorPlugin) getTemplateCommandArgs() []string {
 	if p.ReleaseName != "" {
 		args = append(args, p.ReleaseName)
 	}
-	args = append(args, path.Join(p.ChartHome, p.ChartName))
+	args = append(args, filepath.Join(p.ChartHome, p.ChartName))
 	if p.ReleaseNamespace != "" {
 		args = append(args, "--namespace", p.ReleaseNamespace)
 	}
 	if p.Values != "" {
 		args = append(args, "--values", p.Values)
 	}
+	args = append(args, p.ExtraArgs...)
 	return args
 }
 
@@ -147,7 +256,7 @@ func (p *HelmChartInflationGeneratorPlugin) getPullCommandArgs() []string {
 // checkLocalChart will return true if the chart does exist in
 // local chart home.
 func (p *HelmChartInflationGeneratorPlugin) checkLocalChart() bool {
-	path := path.Join(p.ChartHome, p.ChartName)
+	path := filepath.Join(p.ChartHome, p.ChartName)
 	s, err := os.Stat(path)
 	if err != nil {
 		return false

api/builtins/ImageTagTransformer.go

@@ -11,7 +11,6 @@ import (
 	"sigs.k8s.io/kustomize/api/filters/imagetag"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -32,17 +31,17 @@ func (p *ImageTagTransformerPlugin) Config(
 func (p *ImageTagTransformerPlugin) Transform(m resmap.ResMap) error {
 	for _, r := range m.Resources() {
 		// traverse all fields at first
-		err := filtersutil.ApplyToJSON(imagetag.LegacyFilter{
+		err := r.ApplyFilter(imagetag.LegacyFilter{
 			ImageTag: p.ImageTag,
-		}, r)
+		})
 		if err != nil {
 			return err
 		}
 		// then use user specified field specs
-		err = filtersutil.ApplyToJSON(imagetag.Filter{
+		err = r.ApplyFilter(imagetag.Filter{
 			ImageTag: p.ImageTag,
 			FsSlice:  p.FieldSpecs,
-		}, r)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/LabelTransformer.go

@@ -7,7 +7,6 @@ import (
 	"sigs.k8s.io/kustomize/api/filters/labels"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -25,11 +24,14 @@ func (p *LabelTransformerPlugin) Config(
 }
 
 func (p *LabelTransformerPlugin) Transform(m resmap.ResMap) error {
+	if len(p.Labels) == 0 {
+		return nil
+	}
 	for _, r := range m.Resources() {
-		err := filtersutil.ApplyToJSON(labels.Filter{
+		err := r.ApplyFilter(labels.Filter{
 			Labels:  p.Labels,
 			FsSlice: p.FieldSpecs,
-		}, r)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/NamespaceTransformer.go

@@ -9,7 +9,6 @@ import (
 	"sigs.k8s.io/kustomize/api/filters/namespace"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -35,10 +34,11 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 			// Don't mutate empty objects?
 			continue
 		}
-		err := filtersutil.ApplyToJSON(namespace.Filter{
+		r.StorePreviousId()
+		err := r.ApplyFilter(namespace.Filter{
 			Namespace: p.Namespace,
 			FsSlice:   p.FieldSpecs,
-		}, r)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/PatchJson6902Transformer.go

@@ -12,7 +12,6 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -79,9 +78,9 @@ func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
 		return err
 	}
 	for _, res := range resources {
-		err = filtersutil.ApplyToJSON(patchjson6902.Filter{
+		err = res.ApplyFilter(patchjson6902.Filter{
 			Patch: p.JsonOp,
-		}, res)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/PatchStrategicMergeTransformer.go

@@ -5,19 +5,14 @@ package builtins
 
 import (
 	"fmt"
-	"strings"
 
-	"github.com/pkg/errors"
-	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
 type PatchStrategicMergeTransformerPlugin struct {
-	h             *resmap.PluginHelpers
 	loadedPatches []*resource.Resource
 	Paths         []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 	Patches       string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
@@ -25,7 +20,6 @@ type PatchStrategicMergeTransformerPlugin struct {
 
 func (p *PatchStrategicMergeTransformerPlugin) Config(
 	h *resmap.PluginHelpers, c []byte) (err error) {
-	p.h = h
 	err = yaml.Unmarshal(c, p)
 	if err != nil {
 		return err
@@ -35,13 +29,18 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 	}
 	if len(p.Paths) != 0 {
 		for _, onePath := range p.Paths {
-			res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(onePath))
+			// The following oddly attempts to interpret a path string as an
+			// actual patch (instead of as a path to a file containing a patch).
+			// All tests pass if this code is commented out.  This code should
+			// be deleted; the user should use the Patches field which
+			// exists for this purpose (inline patch declaration).
+			res, err := h.ResmapFactory().RF().SliceFromBytes([]byte(onePath))
 			if err == nil {
 				p.loadedPatches = append(p.loadedPatches, res...)
 				continue
 			}
-			res, err = p.h.ResmapFactory().RF().SliceFromPatches(
-				p.h.Loader(), []types.PatchStrategicMerge{onePath})
+			res, err = h.ResmapFactory().RF().SliceFromPatches(
+				h.Loader(), []types.PatchStrategicMerge{onePath})
 			if err != nil {
 				return err
 			}
@@ -49,7 +48,7 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 		}
 	}
 	if p.Patches != "" {
-		res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(p.Patches))
+		res, err := h.ResmapFactory().RF().SliceFromBytes([]byte(p.Patches))
 		if err != nil {
 			return err
 		}
@@ -60,57 +59,24 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 		return fmt.Errorf(
 			"patch appears to be empty; files=%v, Patch=%s", p.Paths, p.Patches)
 	}
-	return err
-}
-
-func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error {
-	patches, err := p.h.ResmapFactory().Merge(p.loadedPatches)
+	// Merge the patches, looking for conflicts.
+	_, err = h.ResmapFactory().ConflatePatches(p.loadedPatches)
 	if err != nil {
 		return err
 	}
-	for _, patch := range patches.Resources() {
+	return nil
+}
+
+func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, patch := range p.loadedPatches {
 		target, err := m.GetById(patch.OrgId())
 		if err != nil {
 			return err
 		}
-		patchCopy := patch.DeepCopy()
-		patchCopy.SetName(target.GetName())
-		patchCopy.SetNamespace(target.GetNamespace())
-		patchCopy.SetGvk(target.GetGvk())
-		node, err := filtersutil.GetRNode(patchCopy)
-		if err != nil {
+		if err = m.ApplySmPatch(
+			resource.MakeIdSet([]*resource.Resource{target}), patch); err != nil {
 			return err
 		}
-		err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-			Patch: node,
-		}, target)
-		if err != nil {
-			// Check for an error string from UnmarshalJSON that's indicative
-			// of an object that's missing basic KRM fields, and thus may have been
-			// entirely deleted (an acceptable outcome).  This error handling should
-			// be deleted along with use of ResMap and apimachinery functions like
-			// UnmarshalJSON.
-			if !strings.Contains(err.Error(), "Object 'Kind' is missing") {
-				// Some unknown error, let it through.
-				return err
-			}
-			if !target.IsEmpty() {
-				return errors.Wrapf(
-					err, "with unexpectedly non-empty object map of size %d",
-					len(target.Map()))
-			}
-			// Fall through to handle deleted object.
-		}
-		if target.IsEmpty() {
-			// This means all fields have been removed from the object.
-			// This can happen if a patch required deletion of the
-			// entire resource (not just a part of it).  This means
-			// the overall resmap must shrink by one.
-			err = m.Remove(target.CurId())
-			if err != nil {
-				return err
-			}
-		}
 	}
 	return nil
 }

api/builtins/PatchTransformer.go

@@ -8,13 +8,10 @@ import (
 	"strings"
 
 	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
-	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -41,7 +38,6 @@ func (p *PatchTransformerPlugin) Config(
 		return fmt.Errorf(
 			"patch and path can't be set at the same time\n%s", string(c))
 	}
-
 	if p.Path != "" {
 		loaded, loadErr := h.Loader().Load(p.Path)
 		if loadErr != nil {
@@ -88,66 +84,13 @@ func (p *PatchTransformerPlugin) transformStrategicMerge(m resmap.ResMap, patch
 		if err != nil {
 			return err
 		}
-		return p.applySMPatch(target, patch)
+		return target.ApplySmPatch(patch)
 	}
-
-	resources, err := m.Select(*p.Target)
+	selected, err := m.Select(*p.Target)
 	if err != nil {
 		return err
 	}
-	for _, res := range resources {
-		patchCopy := patch.DeepCopy()
-		patchCopy.SetName(res.GetName())
-		patchCopy.SetNamespace(res.GetNamespace())
-		patchCopy.SetGvk(res.GetGvk())
-		err := p.applySMPatch(res, patchCopy)
-		if err != nil {
-			// Check for an error string from UnmarshalJSON that's indicative
-			// of an object that's missing basic KRM fields, and thus may have been
-			// entirely deleted (an acceptable outcome).  This error handling should
-			// be deleted along with use of ResMap and apimachinery functions like
-			// UnmarshalJSON.
-			if !strings.Contains(err.Error(), "Object 'Kind' is missing") {
-				// Some unknown error, let it through.
-				return err
-			}
-			if !res.IsEmpty() {
-				return errors.Wrapf(
-					err, "with unexpectedly non-empty object map of size %d",
-					len(res.Map()))
-			}
-			// Fall through to handle deleted object.
-		}
-		if res.IsEmpty() {
-			// This means all fields have been removed from the object.
-			// This can happen if a patch required deletion of the
-			// entire resource (not just a part of it).  This means
-			// the overall resmap must shrink by one.
-			err = m.Remove(res.CurId())
-			if err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// applySMPatch applies the provided strategic merge patch to the
-// given resource.
-func (p *PatchTransformerPlugin) applySMPatch(resource, patch *resource.Resource) error {
-	node, err := filtersutil.GetRNode(patch)
-	if err != nil {
-		return err
-	}
-	n, ns := resource.GetName(), resource.GetNamespace()
-	err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-		Patch: node,
-	}, resource)
-	if !resource.IsEmpty() {
-		resource.SetName(n)
-		resource.SetNamespace(ns)
-	}
-	return err
+	return m.ApplySmPatch(resource.MakeIdSet(selected), patch)
 }
 
 // transformJson6902 applies the provided json6902 patch
@@ -161,9 +104,10 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 		return err
 	}
 	for _, res := range resources {
-		err = filtersutil.ApplyToJSON(patchjson6902.Filter{
+		res.StorePreviousId()
+		err = res.ApplyFilter(patchjson6902.Filter{
 			Patch: p.Patch,
-		}, res)
+		})
 		if err != nil {
 			return err
 		}

api/builtins/PrefixSuffixTransformer.go

@@ -10,7 +10,6 @@ import (
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -67,14 +66,18 @@ func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
 				// this will add a prefix and a suffix
 				// to the resource even if those are
 				// empty
+
 				r.AddNamePrefix(p.Prefix)
 				r.AddNameSuffix(p.Suffix)
+				if p.Prefix != "" || p.Suffix != "" {
+					r.StorePreviousId()
+				}
 			}
-			err := filtersutil.ApplyToJSON(prefixsuffix.Filter{
+			err := r.ApplyFilter(prefixsuffix.Filter{
 				Prefix:    p.Prefix,
 				Suffix:    p.Suffix,
 				FieldSpec: fs,
-			}, r)
+			})
 			if err != nil {
 				return err
 			}

api/builtins/ReplicaCountTransformer.go

@@ -7,8 +7,6 @@ import (
 	"fmt"
 
 	"sigs.k8s.io/kustomize/api/filters/replicacount"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
-
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
@@ -33,19 +31,17 @@ func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 	found := false
 	for _, fs := range p.FieldSpecs {
 		matcher := p.createMatcher(fs)
-		matchOriginal := m.GetMatchingResourcesByOriginalId(matcher)
-		resList := append(
-			matchOriginal, m.GetMatchingResourcesByCurrentId(matcher)...)
+		resList := m.GetMatchingResourcesByAnyId(matcher)
 		if len(resList) > 0 {
 			found = true
 			for _, r := range resList {
 				// There are redundant checks in the filter
 				// that we'll live with until resolution of
 				// https://github.com/kubernetes-sigs/kustomize/issues/2506
-				err := filtersutil.ApplyToJSON(replicacount.Filter{
+				err := r.ApplyFilter(replicacount.Filter{
 					Replica:   p.Replica,
 					FieldSpec: fs,
-				}, r)
+				})
 				if err != nil {
 					return err
 				}

api/builtins/ValueAddTransformer.go

@@ -13,7 +13,6 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -119,15 +118,15 @@ func (p *ValueAddTransformerPlugin) Transform(m resmap.ResMap) (err error) {
 		// TODO: consider t.NotSelector if implemented
 		for _, res := range resources {
 			if t.FieldPath == types.MetadataNamespacePath {
-				err = filtersutil.ApplyToJSON(namespace.Filter{
+				err = res.ApplyFilter(namespace.Filter{
 					Namespace: p.Value,
-				}, res)
+				})
 			} else {
-				err = filtersutil.ApplyToJSON(valueadd.Filter{
+				err = res.ApplyFilter(valueadd.Filter{
 					Value:            p.Value,
 					FieldPath:        t.FieldPath,
 					FilePathPosition: t.FilePathPosition,
-				}, res)
+				})
 			}
 			if err != nil {
 				return err

api/filesys/confirmeddir_test.go

@@ -4,6 +4,7 @@
 package filesys_test
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -98,6 +99,7 @@ func TestNewTempConfirmDir(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
+	defer os.RemoveAll(string(tmp))
 
 	delinked, err := filepath.EvalSymlinks(string(tmp))
 	if err != nil {

api/filters/annotations/annotations.go

@@ -24,7 +24,7 @@ type Filter struct {
 var _ kio.Filter = Filter{}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
-	keys := filtersutil.SortedMapKeys(f.Annotations)
+	keys := yaml.SortedMapKeys(f.Annotations)
 	_, err := kio.FilterAll(yaml.FilterFunc(
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {

api/filters/annotations/example_test.go

@@ -28,7 +28,9 @@ metadata:
 `)}},
 		Filters: []kio.Filter{Filter{
 			Annotations: map[string]string{
-				"foo": "bar",
+				"foo":          "bar",
+				"booleanValue": "true",
+				"numberValue":  "42",
 			},
 			FsSlice: fss,
 		}},
@@ -44,12 +46,16 @@ metadata:
 	// metadata:
 	//   name: instance
 	//   annotations:
+	//     booleanValue: "true"
 	//     foo: bar
+	//     numberValue: "42"
 	// ---
 	// apiVersion: example.com/v1
 	// kind: Bar
 	// metadata:
 	//   name: instance
 	//   annotations:
+	//     booleanValue: "true"
 	//     foo: bar
+	//     numberValue: "42"
 }

api/filters/fieldspec/fieldspec.go

@@ -4,9 +4,11 @@
 package fieldspec
 
 import (
+	"fmt"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -14,7 +16,16 @@ import (
 
 var _ yaml.Filter = Filter{}
 
-// Filter applies a single fieldSpec to a single object
+// Filter possibly mutates its object argument using a FieldSpec.
+// If the object matches the FieldSpec, and the node found
+// by following the fieldSpec's path is non-null, this filter calls
+// the setValue function on the node at the end of the path.
+// If any part of the path doesn't exist, the filter returns
+// without doing anything and without error, unless it was set
+// to create the path. If set to create, it creates a tree of maps
+// along the path, and the leaf node gets the setValue called on it.
+// Error on GVK mismatch, empty or poorly formed path.
+// Filter expect kustomize style paths, not JSON paths.
 // Filter stores internal state and should not be reused
 type Filter struct {
 	// FieldSpec contains the path to the value to set.
@@ -37,15 +48,17 @@ func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 	if match, err := isMatchGVK(fltr.FieldSpec, obj); !match || err != nil {
 		return obj, errors.Wrap(err)
 	}
-	fltr.path = splitPath(fltr.FieldSpec.Path)
-	if err := fltr.filter(obj); err != nil {
+	fltr.path = utils.PathSplitter(fltr.FieldSpec.Path)
+	err := fltr.filter(obj)
+	if err != nil {
 		s, _ := obj.String()
 		return nil, errors.WrapPrefixf(err,
-			"obj '%s' at path '%v'", s, fltr.FieldSpec.Path)
+			"considering field '%s' of object\n%v", fltr.FieldSpec.Path, s)
 	}
 	return obj, nil
 }
 
+// Recursively called.
 func (fltr Filter) filter(obj *yaml.RNode) error {
 	if len(fltr.path) == 0 {
 		// found the field -- set its value
@@ -56,25 +69,30 @@ func (fltr Filter) filter(obj *yaml.RNode) error {
 	}
 	switch obj.YNode().Kind {
 	case yaml.SequenceNode:
-		return fltr.seq(obj)
+		return fltr.handleSequence(obj)
 	case yaml.MappingNode:
-		return fltr.field(obj)
+		return fltr.handleMap(obj)
+	case yaml.AliasNode:
+		return fltr.filter(yaml.NewRNode(obj.YNode().Alias))
 	default:
 		return errors.Errorf("expected sequence or mapping node")
 	}
 }
 
-// field calls filter on the field matching the next path element
-func (fltr Filter) field(obj *yaml.RNode) error {
+// handleMap calls filter on the map field matching the next path element
+func (fltr Filter) handleMap(obj *yaml.RNode) error {
 	fieldName, isSeq := isSequenceField(fltr.path[0])
+	if fieldName == "" {
+		return fmt.Errorf("cannot set or create an empty field name")
+	}
 	// lookup the field matching the next path element
-	var lookupField yaml.Filter
+	var operation yaml.Filter
 	var kind yaml.Kind
 	tag := yaml.NodeTagEmpty
 	switch {
 	case !fltr.FieldSpec.CreateIfNotPresent || fltr.CreateKind == 0 || isSeq:
-		// dont' create the field if we don't find it
-		lookupField = yaml.Lookup(fieldName)
+		// don't create the field if we don't find it
+		operation = yaml.Lookup(fieldName)
 		if isSeq {
 			// The query path thinks this field should be a sequence;
 			// accept this hint for use later if the tag is NodeTagNull.
@@ -82,21 +100,25 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 		}
 	case len(fltr.path) <= 1:
 		// create the field if it is missing: use the provided node kind
-		lookupField = yaml.LookupCreate(fltr.CreateKind, fieldName)
+		operation = yaml.LookupCreate(fltr.CreateKind, fieldName)
 		kind = fltr.CreateKind
 		tag = fltr.CreateTag
 	default:
 		// create the field if it is missing: must be a mapping node
-		lookupField = yaml.LookupCreate(yaml.MappingNode, fieldName)
+		operation = yaml.LookupCreate(yaml.MappingNode, fieldName)
 		kind = yaml.MappingNode
 		tag = yaml.NodeTagMap
 	}
 
 	// locate (or maybe create) the field
-	field, err := obj.Pipe(lookupField)
-	if err != nil || field == nil {
+	field, err := obj.Pipe(operation)
+	if err != nil {
 		return errors.WrapPrefixf(err, "fieldName: %s", fieldName)
 	}
+	if field == nil {
+		// No error if field not found.
+		return nil
+	}
 
 	// if the value exists, but is null and kind is set,
 	// then change it to the creation type
@@ -114,7 +136,7 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 }
 
 // seq calls filter on all sequence elements
-func (fltr Filter) seq(obj *yaml.RNode) error {
+func (fltr Filter) handleSequence(obj *yaml.RNode) error {
 	if err := obj.VisitElements(func(node *yaml.RNode) error {
 		// recurse on each element -- re-allocating a Filter is
 		// not strictly required, but is more consistent with field
@@ -125,16 +147,14 @@ func (fltr Filter) seq(obj *yaml.RNode) error {
 		return errors.WrapPrefixf(err,
 			"visit traversal on path: %v", fltr.path)
 	}
-
 	return nil
 }
 
 // isSequenceField returns true if the path element is for a sequence field.
 // isSequence also returns the path element with the '[]' suffix trimmed
 func isSequenceField(name string) (string, bool) {
-	isSeq := strings.HasSuffix(name, "[]")
-	name = strings.TrimSuffix(name, "[]")
-	return name, isSeq
+	shorter := strings.TrimSuffix(name, "[]")
+	return shorter, shorter != name
 }
 
 // isMatchGVK returns true if the fs.GVK matches the obj GVK.
@@ -163,18 +183,3 @@ func isMatchGVK(fs types.FieldSpec, obj *yaml.RNode) (bool, error) {
 
 	return true, nil
 }
-
-func splitPath(path string) []string {
-	ps := strings.Split(path, "/")
-	var res []string
-	res = append(res, ps[0])
-	for i := 1; i < len(ps); i++ {
-		lastIndex := len(res) - 1
-		if strings.HasSuffix(res[lastIndex], "\\") {
-			res[lastIndex] = strings.TrimSuffix(res[lastIndex], "\\") + "/" + ps[i]
-		} else {
-			res = append(res, ps[i])
-		}
-	}
-	return res
-}

api/filters/fieldspec/fieldspec_test.go

@@ -15,206 +15,243 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-type TestCase struct {
-	name      string
-	input     string
-	expected  string
-	filter    fieldspec.Filter
-	fieldSpec string
-	error     string
-}
-
-var tests = []TestCase{
-	{
-		name: "update",
-		fieldSpec: `
+func TestFilter_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input     string
+		expected  string
+		filter    fieldspec.Filter
+		fieldSpec string
+		error     string
+	}{
+		"path not found": {
+			fieldSpec: `
 path: a/b
 group: foo
 kind: Bar
 `,
-		input: `
+			input: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			expected: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+		},
+		"empty path": {
+			fieldSpec: `
+group: foo
+kind: Bar
+`,
+			input: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			expected: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			error: `considering field '' of object
+apiVersion: foo
+kind: Bar
+xxx:
+: cannot set or create an empty field name`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+		},
+
+		"update": {
+			fieldSpec: `
+path: a/b
+group: foo
+kind: Bar
+`,
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b: e
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-kind-not-match",
-		fieldSpec: `
+		"update-kind-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo
 kind: Bar1
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar2
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar2
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-group-not-match",
-		fieldSpec: `
+		"update-group-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo2/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo2/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-version-not-match",
-		fieldSpec: `
+		"update-version-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta2
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta2
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "bad-version",
-		fieldSpec: `
+		"bad-version": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta2/something
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta2/something
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "bad-meta",
-		fieldSpec: `
+		"bad-meta": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+			error: "missing Resource metadata",
 		},
-		error: "missing Resource metadata",
-	},
 
-	{
-		name: "miss-match-type",
-		fieldSpec: `
+		"miss-match-type": {
+			fieldSpec: `
 path: a/b/c
 kind: Bar
 `,
-		input: `
+			input: `
 kind: Bar
 a:
   b: a
 `,
-		error: "obj 'kind: Bar\na:\n  b: a\n' at path 'a/b/c': " +
-			"expected sequence or mapping node",
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			error: `considering field 'a/b/c' of object
+kind: Bar
+a:
+  b: a
+: expected sequence or mapping node`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "add",
-		fieldSpec: `
+		"add": {
+			fieldSpec: `
 path: a/b/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {b: {c: {d: e}}}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "update-in-sequence",
-		fieldSpec: `
+		"update-in-sequence": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
@@ -222,7 +259,7 @@ a:
   - c:
       d: a
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
@@ -230,244 +267,237 @@ a:
   - c:
       d: e
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	// Don't create a sequence
-	{
-		name: "empty-sequence-no-create",
-		fieldSpec: `
+		// Don't create a sequence
+		"empty-sequence-no-create": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	// Create a new field for an element in a sequence
-	{
-		name: "empty-sequence-create",
-		fieldSpec: `
+		// Create a new field for an element in a sequence
+		"empty-sequence-create": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b:
   - c: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b:
   - c: {d: e}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "group v1",
-		fieldSpec: `
+		"group v1": {
+			fieldSpec: `
 path: a/b
 group: v1
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "version v1",
-		fieldSpec: `
+		"version v1": {
+			fieldSpec: `
 path: a/b
 version: v1
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
   b: e
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "successfully set field on array entry no sequence hint",
-		fieldSpec: `
+
+		"successfully set field on array entry no sequence hint": {
+			fieldSpec: `
 path: spec/containers/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "successfully set field on array entry with sequence hint",
-		fieldSpec: `
+
+		"successfully set field on array entry with sequence hint": {
+			fieldSpec: `
 path: spec/containers[]/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "failure to set field on array entry with sequence hint in path",
-		fieldSpec: `
+		"failure to set field on array entry with sequence hint in path": {
+			fieldSpec: `
 path: spec/containers[]/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers: []
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "failure to set field on array entry, no sequence hint in path",
-		fieldSpec: `
+
+		"failure to set field on array entry, no sequence hint in path": {
+			fieldSpec: `
 path: spec/containers/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "filedname with slash '/'",
-		fieldSpec: `
+		"fieldname with slash '/'": {
+			fieldSpec: `
 path: a/b\/c/d
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 a:
   b/c:
     d: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
   b/c:
     d: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "filedname with multiple '/'",
-		fieldSpec: `
+		"fieldname with multiple '/'": {
+			fieldSpec: `
 path: a/b\/c/d\/e/f
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 a:
@@ -475,7 +505,7 @@ a:
     d/e:
       f: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
@@ -483,25 +513,24 @@ a:
     d/e:
       f: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-}
+	}
 
-func TestFilter_Filter(t *testing.T) {
-	for i := range tests {
-		test := tests[i]
-		t.Run(test.name, func(t *testing.T) {
-			err := yaml.Unmarshal([]byte(test.fieldSpec), &test.filter.FieldSpec)
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			err := yaml.Unmarshal([]byte(tc.fieldSpec), &tc.filter.FieldSpec)
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}
 
 			out := &bytes.Buffer{}
 			rw := &kio.ByteReadWriter{
-				Reader:                bytes.NewBufferString(test.input),
+				Reader:                bytes.NewBufferString(tc.input),
 				Writer:                out,
 				OmitReaderAnnotations: true,
 			}
@@ -509,11 +538,11 @@ func TestFilter_Filter(t *testing.T) {
 			// run the filter
 			err = kio.Pipeline{
 				Inputs:  []kio.Reader{rw},
-				Filters: []kio.Filter{kio.FilterAll(test.filter)},
+				Filters: []kio.Filter{kio.FilterAll(tc.filter)},
 				Outputs: []kio.Writer{rw},
 			}.Execute()
-			if test.error != "" {
-				if !assert.EqualError(t, err, test.error) {
+			if tc.error != "" {
+				if !assert.EqualError(t, err, tc.error) {
 					t.FailNow()
 				}
 				// stop rest of test
@@ -526,7 +555,7 @@ func TestFilter_Filter(t *testing.T) {
 
 			// check results
 			if !assert.Equal(t,
-				strings.TrimSpace(test.expected),
+				strings.TrimSpace(tc.expected),
 				strings.TrimSpace(out.String())) {
 				t.FailNow()
 			}

api/filters/filtersutil/filtersutil.go

@@ -1,21 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package filtersutil
-
-import (
-	"sort"
-)
-
-// SortedMapKeys returns a sorted slice of keys to the given map.
-// Writing this function never gets old.
-func SortedMapKeys(m map[string]string) []string {
-	keys := make([]string, len(m))
-	i := 0
-	for k := range m {
-		keys[i] = k
-		i++
-	}
-	sort.Strings(keys)
-	return keys
-}

api/filters/imagetag/imagetag_test.go

@@ -21,7 +21,7 @@ func TestImageTagUpdater_Filter(t *testing.T) {
 	}{
 		"ignore CustomResourceDefinition": {
 			input: `
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: whatever
@@ -30,7 +30,7 @@ spec:
   - image: whatever
 `,
 			expectedOutput: `
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: whatever

api/filters/labels/labels.go

@@ -25,7 +25,7 @@ type Filter struct {
 var _ kio.Filter = Filter{}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
-	keys := filtersutil.SortedMapKeys(f.Labels)
+	keys := yaml.SortedMapKeys(f.Labels)
 	_, err := kio.FilterAll(yaml.FilterFunc(
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {

api/filters/nameref/nameref.go

@@ -5,100 +5,189 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/fieldspec"
-	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	kyaml_filtersutil "sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// Filter will update the name reference
+// Filter updates a name references.
 type Filter struct {
-	FieldSpec          types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
-	Referrer           *resource.Resource
-	Target             resid.Gvk
+	// Referrer refers to another resource X by X's name.
+	// E.g. A Deployment can refer to a ConfigMap.
+	// The Deployment is the Referrer,
+	// the ConfigMap is the ReferralTarget.
+	// This filter seeks to repair the reference in Deployment, given
+	// that the ConfigMap's name may have changed.
+	Referrer *resource.Resource
+
+	// NameFieldToUpdate is the field in the Referrer
+	// that holds the name requiring an update.
+	// This is the field to write.
+	NameFieldToUpdate types.FieldSpec
+
+	// ReferralTarget is the source of the new value for
+	// the name, always in the 'metadata/name' field.
+	// This is the field to read.
+	ReferralTarget resid.Gvk
+
+	// Set of resources to scan to find the ReferralTarget.
 	ReferralCandidates resmap.ResMap
-	isRoleRef          bool
 }
 
+// At time of writing, in practice this is called with a slice with only
+// one entry, the node also referred to be the resource in the Referrer field.
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
 }
 
+// The node passed in here is the same node as held in Referrer;
+// that's how the referrer's name field is updated.
+// Currently, however, this filter still needs the extra methods on Referrer
+// to consult things like the resource Id, its namespace, etc.
+// TODO(3455): No filter should use the Resource api; all information
+// about names should come from annotations, with helper methods
+// on the RNode object.  Resource should get stupider, RNode smarter.
 func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	err := node.PipeE(fieldspec.Filter{
-		FieldSpec: f.FieldSpec,
+	if err := f.confirmNodeMatchesReferrer(node); err != nil {
+		// sanity check.
+		return nil, err
+	}
+	if err := node.PipeE(fieldspec.Filter{
+		FieldSpec: f.NameFieldToUpdate,
 		SetValue:  f.set,
-	})
-	return node, err
+	}); err != nil {
+		return nil, errors.Wrapf(
+			err, "updating name reference in '%s' field of '%s'",
+			f.NameFieldToUpdate.Path, f.Referrer.CurId().String())
+	}
+	return node, nil
 }
 
+// This function is called on the node found at FieldSpec.Path.
+// It's some node in the Referrer.
 func (f Filter) set(node *yaml.RNode) error {
 	if yaml.IsMissingOrNull(node) {
 		return nil
 	}
-	if strings.HasSuffix(f.FieldSpec.Path, "roleRef/name") {
-		f.isRoleRef = true
-	}
 	switch node.YNode().Kind {
 	case yaml.ScalarNode:
 		return f.setScalar(node)
 	case yaml.MappingNode:
-		// Kind: ValidatingWebhookConfiguration
-		// FieldSpec is webhooks/clientConfig/service
 		return f.setMapping(node)
 	case yaml.SequenceNode:
-		return f.setSequence(node)
+		return applyFilterToSeq(seqFilter{
+			setScalarFn:  f.setScalar,
+			setMappingFn: f.setMapping,
+		}, node)
 	default:
-		return fmt.Errorf(
-			"node is expected to be either a string or a slice of string or a map of string")
+		return fmt.Errorf("node must be a scalar, sequence or map")
 	}
 }
 
-func (f Filter) setSequence(node *yaml.RNode) error {
-	return applyFilterToSeq(seqFilter{
-		setScalarFn:  f.setScalar,
-		setMappingFn: f.setMapping,
-	}, node)
+// This method used when NameFieldToUpdate doesn't lead to
+// one scalar field (typically called 'name'), but rather
+// leads to a map field (called anything). In this case we
+// must complete the field path, looking for both  a 'name'
+// and a 'namespace' field to help select the proper
+// ReferralTarget to read the name and namespace from.
+func (f Filter) setMapping(node *yaml.RNode) error {
+	if node.YNode().Kind != yaml.MappingNode {
+		return fmt.Errorf("expect a mapping node")
+	}
+	nameNode, err := node.Pipe(yaml.FieldMatcher{Name: "name"})
+	if err != nil {
+		return errors.Wrap(err, "trying to match 'name' field")
+	}
+	if nameNode == nil {
+		// This is a _configuration_ error; the field path
+		// specified in NameFieldToUpdate.Path doesn't resolve
+		// to a map with a 'name' field, so we have no idea what
+		// field to update with a new name.
+		return fmt.Errorf("path config error; no 'name' field in node")
+	}
+	candidates, err := f.filterMapCandidatesByNamespace(node)
+	if err != nil {
+		return err
+	}
+	oldName := nameNode.YNode().Value
+	referral, err := f.selectReferral(oldName, candidates)
+	if err != nil || referral == nil {
+		// Nil referral means nothing to do.
+		return err
+	}
+	f.recordTheReferral(referral)
+	if referral.GetName() == oldName && referral.GetNamespace() == "" {
+		// The name has not changed, nothing to do.
+		return nil
+	}
+	if err = node.PipeE(yaml.FieldSetter{
+		Name:        "name",
+		StringValue: referral.GetName(),
+	}); err != nil {
+		return err
+	}
+	if referral.GetNamespace() == "" {
+		// Don't write an empty string into the namespace field, as
+		// it should not replace the value "default".  The empty
+		// string is handled as a wild card here, not as an implicit
+		// specification of the "default" k8s namespace.
+		return nil
+	}
+	return node.PipeE(yaml.FieldSetter{
+		Name:        "namespace",
+		StringValue: referral.GetNamespace(),
+	})
 }
 
-func (f Filter) setMapping(node *yaml.RNode) error {
-	return setNameAndNs(
-		node,
-		f.Referrer,
-		f.Target,
-		f.ReferralCandidates,
-		f.isRoleRef,
-	)
+func (f Filter) filterMapCandidatesByNamespace(
+	node *yaml.RNode) ([]*resource.Resource, error) {
+	namespaceNode, err := node.Pipe(yaml.FieldMatcher{Name: "namespace"})
+	if err != nil {
+		return nil, errors.Wrap(err, "trying to match 'namespace' field")
+	}
+	if namespaceNode == nil {
+		return f.ReferralCandidates.Resources(), nil
+	}
+	namespace := namespaceNode.YNode().Value
+	nsMap := f.ReferralCandidates.GroupedByOriginalNamespace()
+	if candidates, ok := nsMap[namespace]; ok {
+		return candidates, nil
+	}
+	nsMap = f.ReferralCandidates.GroupedByCurrentNamespace()
+	// This could be nil, or an empty list.
+	return nsMap[namespace], nil
 }
 
 func (f Filter) setScalar(node *yaml.RNode) error {
-	newValue, err := getSimpleNameField(
-		node.YNode().Value,
-		f.Referrer,
-		f.Target,
-		f.ReferralCandidates,
-		f.ReferralCandidates.Resources(),
-		f.isRoleRef,
-	)
-	if err != nil {
+	referral, err := f.selectReferral(
+		node.YNode().Value, f.ReferralCandidates.Resources())
+	if err != nil || referral == nil {
+		// Nil referral means nothing to do.
 		return err
 	}
-	err = filtersutil.SetScalar(newValue)(node)
-	if err != nil {
-		return err
+	f.recordTheReferral(referral)
+	if referral.GetName() == node.YNode().Value {
+		// The name has not changed, nothing to do.
+		return nil
 	}
-	return nil
+	return node.PipeE(yaml.FieldSetter{StringValue: referral.GetName()})
+}
+
+// In the resource, make a note that it is referred to by the Referrer.
+func (f Filter) recordTheReferral(referral *resource.Resource) {
+	referral.AppendRefBy(f.Referrer.CurId())
 }
 
 // getRoleRefGvk returns a Gvk in the roleRef field. Return error
 // if the roleRef, roleRef/apiGroup or roleRef/kind is missing.
 func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
-	n, err := kyaml_filtersutil.GetRNode(res)
+	n, err := filtersutil.GetRNode(res)
 	if err != nil {
 		return nil, err
 	}
@@ -114,14 +203,16 @@ func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
 		return nil, err
 	}
 	if apiGroup.IsNil() {
-		return nil, fmt.Errorf("apiGroup cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf(
+			"apiGroup cannot be found in roleRef %s", roleRef.MustString())
 	}
 	kind, err := roleRef.Pipe(yaml.Lookup("kind"))
 	if err != nil {
 		return nil, err
 	}
 	if kind.IsNil() {
-		return nil, fmt.Errorf("kind cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf(
+			"kind cannot be found in roleRef %s", roleRef.MustString())
 	}
 	return &resid.Gvk{
 		Group: apiGroup.YNode().Value,
@@ -129,169 +220,183 @@ func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
 	}, nil
 }
 
-func filterReferralCandidates(
-	referrer *resource.Resource,
-	matches []*resource.Resource,
-	target resid.Gvk,
-) []*resource.Resource {
-	var ret []*resource.Resource
-	for _, m := range matches {
-		// If target kind is not ServiceAccount, we shouldn't consider condidates which
-		// doesn't have same namespace.
-		if target.Kind != "ServiceAccount" && m.GetNamespace() != referrer.GetNamespace() {
-			continue
+// sieveFunc returns true if the resource argument satisfies some criteria.
+type sieveFunc func(*resource.Resource) bool
+
+// doSieve uses a function to accept or ignore resources from a list.
+// If list is nil, returns immediately.
+// It's a filter obviously, but that term is overloaded here.
+func doSieve(list []*resource.Resource, fn sieveFunc) (s []*resource.Resource) {
+	for _, r := range list {
+		if fn(r) {
+			s = append(s, r)
 		}
-		if !referrer.PrefixesSuffixesEquals(m) {
-			continue
-		}
-		ret = append(ret, m)
 	}
-	return ret
+	return
 }
 
-// selectReferral picks the referral among a subset of candidates.
-// It returns the current name and namespace of the selected candidate.
-// Note that the content of the referricalCandidateSubset slice is most of the time
-// identical to the referralCandidates resmap. Still in some cases, such
-// as ClusterRoleBinding, the subset only contains the resources of a specific
-// namespace.
-func selectReferral(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource,
-	isRoleRef bool) (string, string, error) {
-	var roleRefGvk *resid.Gvk
-	if isRoleRef {
-		var err error
-		roleRefGvk, err = getRoleRefGvk(referrer)
-		if err != nil {
-			return "", "", err
-		}
-	}
-	for _, res := range referralCandidateSubset {
-		id := res.OrgId()
-		// If the we are processing a roleRef, the apiGroup and Kind in the
-		// roleRef are needed to be considered.
-		if (!isRoleRef || id.IsSelected(roleRefGvk)) &&
-			id.IsSelected(&target) && res.GetOriginalName() == oldName {
-			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
-			// If there's more than one match,
-			// filter the matches by prefix and suffix
-			if len(matches) > 1 {
-				filteredMatches := filterReferralCandidates(referrer, matches, target)
-				if len(filteredMatches) > 1 {
-					return "", "", fmt.Errorf(
-						"multiple matches for %s:\n  %v",
-						id, getIds(filteredMatches))
-				}
-				// Check is the match the resource we are working on
-				if len(filteredMatches) == 0 || res != filteredMatches[0] {
-					continue
-				}
+func acceptAll(r *resource.Resource) bool {
+	return true
+}
+
+func previousNameMatches(name string) sieveFunc {
+	return func(r *resource.Resource) bool {
+		for _, id := range r.PrevIds() {
+			if id.Name == name {
+				return true
 			}
-			// In the resource, note that it is referenced
-			// by the referrer.
-			res.AppendRefBy(referrer.CurId())
-			// Return transformed name of the object,
-			// complete with prefixes, hashes, etc.
-			return res.GetName(), res.GetNamespace(), nil
+		}
+		return false
+	}
+}
+
+func previousIdSelectedByGvk(gvk *resid.Gvk) sieveFunc {
+	return func(r *resource.Resource) bool {
+		for _, id := range r.PrevIds() {
+			if id.IsSelected(gvk) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+// If the we are updating a 'roleRef/name' field, the 'apiGroup' and 'kind'
+// fields in the same 'roleRef' map must be considered.
+// If either object is cluster-scoped (!IsNamespaceableKind), there
+// can be a referral.
+// E.g. a RoleBinding (which exists in a namespace) can refer
+// to a ClusterRole (cluster-scoped) object.
+// https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
+// Likewise, a ClusterRole can refer to a Secret (in a namespace).
+// Objects in different namespaces generally cannot refer to other
+// with some exceptions (e.g. RoleBinding and ServiceAccount are both
+// namespaceable, but the former can refer to accounts in other namespaces).
+func (f Filter) roleRefFilter() sieveFunc {
+	if !strings.HasSuffix(f.NameFieldToUpdate.Path, "roleRef/name") {
+		return acceptAll
+	}
+	roleRefGvk, err := getRoleRefGvk(f.Referrer)
+	if err != nil {
+		return acceptAll
+	}
+	return previousIdSelectedByGvk(roleRefGvk)
+}
+
+func prefixSuffixEquals(other resource.ResCtx) sieveFunc {
+	return func(r *resource.Resource) bool {
+		return r.PrefixesSuffixesEquals(other)
+	}
+}
+
+func (f Filter) sameCurrentNamespaceAsReferrer() sieveFunc {
+	referrerCurId := f.Referrer.CurId()
+	if !referrerCurId.IsNamespaceableKind() {
+		// If the referrer is cluster-scoped, let anything through.
+		return acceptAll
+	}
+	return func(r *resource.Resource) bool {
+		if !r.CurId().IsNamespaceableKind() {
+			// Allow cluster-scoped through.
+			return true
+		}
+		if r.GetKind() == "ServiceAccount" {
+			// Allow service accounts through, even though they
+			// are in a namespace.  A RoleBinding in another namespace
+			// can reference them.
+			return true
+		}
+		return referrerCurId.IsNsEquals(r.CurId())
+	}
+}
+
+// selectReferral picks the best referral from a list of candidates.
+func (f Filter) selectReferral(
+	// The name referral that may need to be updated.
+	oldName string,
+	candidates []*resource.Resource) (*resource.Resource, error) {
+	candidates = doSieve(candidates, previousNameMatches(oldName))
+	candidates = doSieve(candidates, previousIdSelectedByGvk(&f.ReferralTarget))
+	candidates = doSieve(candidates, f.roleRefFilter())
+	candidates = doSieve(candidates, f.sameCurrentNamespaceAsReferrer())
+	if len(candidates) == 1 {
+		return candidates[0], nil
+	}
+	candidates = doSieve(candidates, prefixSuffixEquals(f.Referrer))
+	if len(candidates) == 1 {
+		return candidates[0], nil
+	}
+	if len(candidates) == 0 {
+		return nil, nil
+	}
+	if allNamesAreTheSame(candidates) {
+		// Just take the first one.
+		return candidates[0], nil
+	}
+	ids := getIds(candidates)
+	f.failureDetails(candidates)
+	return nil, fmt.Errorf(" found multiple possible referrals: %s", ids)
+}
+
+func (f Filter) failureDetails(resources []*resource.Resource) {
+	fmt.Printf(
+		"\n**** Too many possible referral targets to referrer:\n%s\n",
+		f.Referrer.MustYaml())
+	for i, r := range resources {
+		fmt.Printf(
+			"--- possible referral %d:\n%s", i, r.MustYaml())
+		fmt.Println("------")
+	}
+}
+
+func allNamesAreTheSame(resources []*resource.Resource) bool {
+	name := resources[0].GetName()
+	for i := 1; i < len(resources); i++ {
+		if name != resources[i].GetName() {
+			return false
 		}
 	}
-
-	return oldName, "", nil
+	return true
 }
 
-// utility function to replace a simple string by the new name
-func getSimpleNameField(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource,
-	isRoleRef bool) (string, error) {
-
-	newName, _, err := selectReferral(oldName, referrer, target,
-		referralCandidates, referralCandidateSubset, isRoleRef)
-
-	return newName, err
-}
-
-func getIds(rs []*resource.Resource) []string {
+func getIds(rs []*resource.Resource) string {
 	var result []string
 	for _, r := range rs {
-		result = append(result, r.CurId().String()+"\n")
+		result = append(result, r.CurId().String())
 	}
-	return result
+	return strings.Join(result, ", ")
 }
 
-// utility function to replace name field within a map RNode
-// and leverage the namespace field.
-func setNameAndNs(
-	in *yaml.RNode,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	isRoleRef bool) error {
-
-	if in.YNode().Kind != yaml.MappingNode {
-		return fmt.Errorf("expect a mapping node")
-	}
-
-	// Get name field
-	nameNode, err := in.Pipe(yaml.FieldMatcher{
-		Name: "name",
-	})
-	if err != nil || nameNode == nil {
-		return fmt.Errorf("cannot find field 'name' in node")
-	}
-
-	// Get namespace field
-	namespaceNode, err := in.Pipe(yaml.FieldMatcher{
-		Name: "namespace",
-	})
-	if err != nil {
-		return fmt.Errorf("error when find field 'namespace'")
-	}
-
-	// check is namespace matched
-	// name will bot be updated if the namespace doesn't match
-	subset := referralCandidates.Resources()
-	if namespaceNode != nil {
-		namespace := namespaceNode.YNode().Value
-		bynamespace := referralCandidates.GroupedByOriginalNamespace()
-		if _, ok := bynamespace[namespace]; !ok {
-			return nil
-		}
-		subset = bynamespace[namespace]
-	}
-
-	oldName := nameNode.YNode().Value
-	newname, newnamespace, err := selectReferral(oldName, referrer, target,
-		referralCandidates, subset, isRoleRef)
-	if err != nil {
-		return err
-	}
-
-	if (newname == oldName) && (newnamespace == "") {
-		// no candidate found.
-		return nil
-	}
-
-	// set name
-	in.Pipe(yaml.FieldSetter{
-		Name:        "name",
-		StringValue: newname,
-	})
-	if newnamespace != "" {
-		// We don't want value "" to replace value "default" since
-		// the empty string is handled as a wild card here not default namespace
-		// by kubernetes.
-		in.Pipe(yaml.FieldSetter{
-			Name:        "namespace",
-			StringValue: newnamespace,
-		})
+func checkEqual(k, a, b string) error {
+	if a != b {
+		return fmt.Errorf(
+			"node-referrerOriginal '%s' mismatch '%s' != '%s'",
+			k, a, b)
+	}
+	return nil
+}
+
+func (f Filter) confirmNodeMatchesReferrer(node *yaml.RNode) error {
+	meta, err := node.GetMeta()
+	if err != nil {
+		return err
+	}
+	gvk := f.Referrer.GetGvk()
+	if err = checkEqual(
+		"APIVersion", meta.APIVersion, gvk.ApiVersion()); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Kind", meta.Kind, gvk.Kind); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Name", meta.Name, f.Referrer.GetName()); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Namespace", meta.Namespace, f.Referrer.GetNamespace()); err != nil {
+		return err
 	}
 	return nil
 }

api/filters/nameref/nameref_test.go

@@ -5,24 +5,23 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
 func TestNamerefFilter(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
 	}{
 		"simple scalar": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -41,8 +40,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -51,8 +50,8 @@ ref:
   name: newName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -60,7 +59,7 @@ ref:
 			},
 		},
 		"sequence": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -80,8 +79,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName1", ""},
-			expected: `
+			originalNames: []string{"oldName1", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -91,8 +90,8 @@ seq:
 - oldName2
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "seq"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "seq"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -100,7 +99,7 @@ seq:
 			},
 		},
 		"mapping": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -119,8 +118,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -129,8 +128,8 @@ map:
   name: newName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "map"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "map"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -138,40 +137,47 @@ map:
 			},
 		},
 		"mapping with namespace": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
+  namespace: someNs
 map:
   name: oldName
-  namespace: oldNs
+  namespace: someNs
 `,
 			candidates: `
 apiVersion: apps/v1
 kind: Secret
 metadata:
   name: newName
-  namespace: oldNs
+  namespace: someNs
 ---
 apiVersion: apps/v1
 kind: NotSecret
 metadata:
   name: newName2
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: thirdName
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "oldName", "oldName"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
+  namespace: someNs
 map:
   name: newName
-  namespace: oldNs
+  namespace: someNs
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "map"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "map"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -179,7 +185,7 @@ map:
 			},
 		},
 		"null value": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -198,8 +204,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -208,8 +214,8 @@ map:
   name: null
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "map"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "map"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -220,8 +226,8 @@ map:
 
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			factory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -237,10 +243,10 @@ map:
 			candidates := resMapFactory.FromResourceSlice(candidatesRes)
 			tc.filter.ReferralCandidates = candidates
 
+			result := filtertest_test.RunFilter(t, tc.referrerOriginal, tc.filter)
 			if !assert.Equal(t,
-				strings.TrimSpace(tc.expected),
-				strings.TrimSpace(
-					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				strings.TrimSpace(tc.referrerFinal),
+				strings.TrimSpace(result)) {
 				t.FailNow()
 			}
 		})
@@ -249,14 +255,14 @@ map:
 
 func TestNamerefFilterUnhappy(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
 	}{
 		"multiple match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -276,10 +282,10 @@ metadata:
   name: newName2
 `,
 			originalNames: []string{"oldName", "oldName"},
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -287,7 +293,7 @@ metadata:
 			},
 		},
 		"no name": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -307,10 +313,10 @@ metadata:
   name: newName2
 `,
 			originalNames: []string{"oldName", "oldName"},
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -321,8 +327,8 @@ metadata:
 
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			factory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -338,11 +344,11 @@ metadata:
 			candidates := resMapFactory.FromResourceSlice(candidatesRes)
 			tc.filter.ReferralCandidates = candidates
 
-			_, err = filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			_, err = filtertest_test.RunFilterE(t, tc.referrerOriginal, tc.filter)
 			if err == nil {
 				t.Fatalf("expect an error")
 			}
-			if tc.expected != "" && !assert.EqualError(t, err, tc.expected) {
+			if tc.referrerFinal != "" && !assert.EqualError(t, err, tc.referrerFinal) {
 				t.FailNow()
 			}
 		})
@@ -351,19 +357,19 @@ metadata:
 
 func TestCandidatesWithDifferentPrefixSuffix(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
-		prefix        []string
-		suffix        []string
-		inputPrefix   string
-		inputSuffix   string
-		err           bool
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
+		prefix           []string
+		suffix           []string
+		inputPrefix      string
+		inputSuffix      string
+		err              bool
 	}{
 		"prefix match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -387,7 +393,7 @@ metadata:
 			suffix:        []string{"", "suffix2"},
 			inputPrefix:   "prefix1",
 			inputSuffix:   "",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -396,8 +402,8 @@ ref:
   name: newName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -406,7 +412,7 @@ ref:
 			err: false,
 		},
 		"suffix match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -430,7 +436,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "",
 			inputSuffix:   "suffix1",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -439,8 +445,8 @@ ref:
   name: newName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -449,7 +455,7 @@ ref:
 			err: false,
 		},
 		"prefix suffix both match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -473,7 +479,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix1",
 			inputSuffix:   "suffix1",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -482,8 +488,8 @@ ref:
   name: newName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -492,7 +498,7 @@ ref:
 			err: false,
 		},
 		"multiple match: both": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -516,10 +522,10 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -528,7 +534,7 @@ metadata:
 			err: true,
 		},
 		"multiple match: only prefix": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -552,10 +558,10 @@ metadata:
 			suffix:        []string{"", ""},
 			inputPrefix:   "prefix",
 			inputSuffix:   "",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -564,7 +570,7 @@ metadata:
 			err: true,
 		},
 		"multiple match: only suffix": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -588,10 +594,10 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "",
 			inputSuffix:   "suffix",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -600,7 +606,7 @@ metadata:
 			err: true,
 		},
 		"no match: neither match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -624,7 +630,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -633,8 +639,8 @@ ref:
   name: oldName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -643,7 +649,7 @@ ref:
 			err: false,
 		},
 		"no match: prefix doesn't match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -667,7 +673,7 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -676,8 +682,8 @@ ref:
   name: oldName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -686,7 +692,7 @@ ref:
 			err: false,
 		},
 		"no match: suffix doesn't match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -710,7 +716,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -719,8 +725,8 @@ ref:
   name: oldName
 `,
 			filter: Filter{
-				FieldSpec: types.FieldSpec{Path: "ref/name"},
-				Target: resid.Gvk{
+				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
+				ReferralTarget: resid.Gvk{
 					Group:   "apps",
 					Version: "v1",
 					Kind:    "Secret",
@@ -732,8 +738,8 @@ ref:
 
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			factory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -765,13 +771,15 @@ ref:
 
 			if !tc.err {
 				if !assert.Equal(t,
-					strings.TrimSpace(tc.expected),
+					strings.TrimSpace(tc.referrerFinal),
 					strings.TrimSpace(
-						filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+						filtertest_test.RunFilter(
+							t, tc.referrerOriginal, tc.filter))) {
 					t.FailNow()
 				}
 			} else {
-				_, err := filtertest_test.RunFilterE(t, tc.input, tc.filter)
+				_, err := filtertest_test.RunFilterE(
+					t, tc.referrerOriginal, tc.filter)
 				if err == nil {
 					t.Fatalf("an error is expected")
 				}

api/filters/patchstrategicmerge/patchstrategicmerge.go

@@ -4,6 +4,7 @@
 package patchstrategicmerge
 
 import (
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 	"sigs.k8s.io/kustomize/kyaml/yaml/merge2"
@@ -15,6 +16,7 @@ type Filter struct {
 
 var _ kio.Filter = Filter{}
 
+// Filter does a strategic merge patch, which can delete nodes.
 func (pf Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	var result []*yaml.RNode
 	for i := range nodes {
@@ -27,7 +29,9 @@ func (pf Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 		if err != nil {
 			return nil, err
 		}
-		result = append(result, r)
+		if !konfig.FlagEnableKyamlDefaultValue || r != nil {
+			result = append(result, r)
+		}
 	}
 	return result, nil
 }

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -15,6 +15,101 @@ func TestFilter(t *testing.T) {
 		patch    *yaml.RNode
 		expected string
 	}{
+		"simple": {
+			input: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 1
+`,
+			patch: yaml.MustParse(`apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 999
+`),
+			expected: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 999
+`,
+		},
+		"nullMapEntry1": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    B:
+    C: Z
+`,
+			patch: yaml.MustParse(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`),
+			expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+		},
+		"nullMapEntry2": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+			patch: yaml.MustParse(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    B:
+    C: Z
+`),
+			expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+		},
 		"simple patch": {
 			input: `
 apiVersion: apps/v1
@@ -577,6 +672,63 @@ spec:
         ports:
         - containerPort: 80
         - containerPort: 8080
+`,
+		},
+
+		// Test for issue #3513
+		// Currently broken; when one port has only containerPort, the output
+		// should not merge containerPort 8301 together
+		// This occurs because when protocol is missing on the first port,
+		// the merge code uses [containerPort] as the merge key rather than
+		// [containerPort, protocol]
+		"list map keys - protocol only present on some ports": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: consul
+        image: "hashicorp/consul:1.9.1"
+        ports:
+        - containerPort: 8500
+          name: http
+        - containerPort: 8301
+          protocol: "TCP"
+        - containerPort: 8301
+          protocol: "UDP"
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  labels:
+    test: label
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  labels:
+    test: label
+spec:
+  template:
+    spec:
+      containers:
+      - name: consul
+        image: "hashicorp/consul:1.9.1"
+        ports:
+        - containerPort: 8301
+          protocol: "TCP"
+        - containerPort: 8301
+          protocol: "UDP"
+        - containerPort: 8500
+          name: http
 `,
 		},
 	}

api/filters/refvar/doc.go

@@ -1,3 +1,3 @@
 // Package refvar contains a kio.Filter implementation of the kustomize
-// refvar transformer.
+// refvar transformer (find and replace $(FOO) style variables in strings).
 package refvar

api/filters/refvar/expand.go

@@ -1,12 +1,12 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-// Package expansion provides functions find and replace $(FOO) style variables in strings.
-package expansion
+package refvar
 
 import (
-	"bytes"
 	"fmt"
+	"log"
+	"strings"
 )
 
 const (
@@ -17,38 +17,64 @@ const (
 
 // syntaxWrap returns the input string wrapped by the expansion syntax.
 func syntaxWrap(input string) string {
-	return string(operator) + string(referenceOpener) + input + string(referenceCloser)
+	var sb strings.Builder
+	sb.WriteByte(operator)
+	sb.WriteByte(referenceOpener)
+	sb.WriteString(input)
+	sb.WriteByte(referenceCloser)
+	return sb.String()
 }
 
-// MappingFuncFor returns a mapping function for use with Expand that
-// implements the expansion semantics defined in the expansion spec; it
-// returns the input string wrapped in the expansion syntax if no mapping
-// for the input is found.
-func MappingFuncFor(
-	counts map[string]int,
-	context ...map[string]interface{}) func(string) interface{} {
-	return func(input string) interface{} {
-		for _, vars := range context {
-			val, ok := vars[input]
-			if ok {
-				counts[input]++
-				switch typedV := val.(type) {
-				case string, int64, float64, bool:
-					return typedV
-				default:
-					return syntaxWrap(input)
-				}
+// MappingFunc maps a string to anything.
+type MappingFunc func(string) interface{}
+
+// MakePrimitiveReplacer returns a MappingFunc that uses a map to do
+// replacements, and a histogram to count map hits.
+//
+// Func behavior:
+//
+// If the input key is NOT found in the map, the key is wrapped up as
+// as a variable declaration string and returned, e.g. key FOO becomes $(FOO).
+// This string is presumably put back where it was found, and might get replaced
+// later.
+//
+// If the key is found in the map, the value is returned if it is a primitive
+// type (string, bool, number), and the hit is counted.
+//
+// If it's not a primitive type (e.g. a map, struct, func, etc.) then this
+// function doesn't know what to do with it and it returns the key wrapped up
+// again as if it had not been replaced.  This should probably be an error.
+func MakePrimitiveReplacer(
+	counts map[string]int, someMap map[string]interface{}) MappingFunc {
+	return func(key string) interface{} {
+		if value, ok := someMap[key]; ok {
+			switch typedV := value.(type) {
+			case string, int, int32, int64, float32, float64, bool:
+				counts[key]++
+				return typedV
+			default:
+				// If the value is some complicated type (e.g. a map or struct),
+				// this function doesn't know how to jam it into a string,
+				// so just pretend it was a cache miss.
+				// Likely this should be an error instead of a silent failure,
+				// since the programmer passed an impossible value.
+				log.Printf(
+					"MakePrimitiveReplacer: bad replacement type=%T val=%v",
+					typedV, typedV)
+				return syntaxWrap(key)
 			}
 		}
-		return syntaxWrap(input)
+		// If unable to return the mapped variable, return it
+		// as it was found, and a later mapping might be able to
+		// replace it.
+		return syntaxWrap(key)
 	}
 }
 
-// Expand replaces variable references in the input string according to
-// the expansion spec using the given mapping function to resolve the
-// values of variables.
-func Expand(input string, mapping func(string) interface{}) interface{} {
-	var buf bytes.Buffer
+// DoReplacements replaces variable references in the input string
+// using the mapping function.
+func DoReplacements(input string, mapping MappingFunc) interface{} {
+	var buf strings.Builder
 	checkpoint := 0
 	for cursor := 0; cursor < len(input); cursor++ {
 		if input[cursor] == operator && cursor+1 < len(input) {

api/filters/refvar/expand_test.go

@@ -1,13 +1,14 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package expansion_test
+package refvar_test
 
 import (
 	"fmt"
 	"testing"
 
-	. "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/filters/refvar"
 )
 
 type expected struct {
@@ -15,6 +16,48 @@ type expected struct {
 	edited string
 }
 
+func TestPrimitiveReplacer(t *testing.T) {
+	varCounts := make(map[string]int)
+	f := MakePrimitiveReplacer(
+		varCounts,
+		map[string]interface{}{
+			"FOO":        "bar",
+			"ZOO":        "$(FOO)-1",
+			"BLU":        "$(ZOO)-2",
+			"EIGHT":      8,
+			"PI":         3.14159,
+			"ZINT":       "$(INT)",
+			"BOOL":       "true",
+			"HUGENUMBER": int64(9223372036854775807),
+			"CRAZYMAP":   map[string]int{"crazy": 200},
+			"ZBOOL":      "$(BOOL)",
+		})
+	assert.Equal(t, "$()", f(""))
+	assert.Equal(t, "$(      )", f("      "))
+	assert.Equal(t, "$(florida)", f("florida"))
+	assert.Equal(t, "$(0)", f("0"))
+	assert.Equal(t, "bar", f("FOO"))
+	assert.Equal(t, "bar", f("FOO"))
+	assert.Equal(t, "bar", f("FOO"))
+	assert.Equal(t, 8, f("EIGHT"))
+	assert.Equal(t, 8, f("EIGHT"))
+	assert.Equal(t, 3.14159, f("PI"))
+	assert.Equal(t, "true", f("BOOL"))
+	assert.Equal(t, int64(9223372036854775807), f("HUGENUMBER"))
+	assert.Equal(t, "$(FOO)-1", f("ZOO"))
+	assert.Equal(t, "$(CRAZYMAP)", f("CRAZYMAP"))
+	assert.Equal(t,
+		map[string]int{
+			"FOO":        3,
+			"EIGHT":      2,
+			"BOOL":       1,
+			"PI":         1,
+			"ZOO":        1,
+			"HUGENUMBER": 1,
+		},
+		varCounts)
+}
+
 func TestMapReference(t *testing.T) {
 	type env struct {
 		Name  string
@@ -51,7 +94,7 @@ func TestMapReference(t *testing.T) {
 		},
 	}
 
-	declaredEnv := map[string]interface{}{
+	varMap := map[string]interface{}{
 		"FOO":   "bar",
 		"ZOO":   "$(FOO)-1",
 		"BLU":   "$(ZOO)-2",
@@ -61,11 +104,11 @@ func TestMapReference(t *testing.T) {
 		"ZBOOL": "$(BOOL)",
 	}
 
-	counts := make(map[string]int)
-	mapping := MappingFuncFor(counts, declaredEnv)
-
+	varCounts := make(map[string]int)
 	for _, env := range envs {
-		declaredEnv[env.Name] = Expand(fmt.Sprintf("%v", env.Value), mapping)
+		varMap[env.Name] = DoReplacements(
+			fmt.Sprintf("%v", env.Value),
+			MakePrimitiveReplacer(varCounts, varMap))
 	}
 
 	expectedEnv := map[string]expected{
@@ -79,45 +122,20 @@ func TestMapReference(t *testing.T) {
 	}
 
 	for k, v := range expectedEnv {
-		if e, a := v, declaredEnv[k]; e.edited != a || e.count != counts[k] {
+		if e, a := v, varMap[k]; e.edited != a || e.count != varCounts[k] {
 			t.Errorf("Expected %v count=%d, got %v count=%d",
-				e.edited, e.count, a, counts[k])
+				e.edited, e.count, a, varCounts[k])
 		} else {
-			delete(declaredEnv, k)
+			delete(varMap, k)
 		}
 	}
 
-	if len(declaredEnv) != 0 {
-		t.Errorf("Unexpected keys in declared env: %v", declaredEnv)
+	if len(varMap) != 0 {
+		t.Errorf("Unexpected keys in declared env: %v", varMap)
 	}
 }
 
 func TestMapping(t *testing.T) {
-	context := map[string]interface{}{
-		"VAR_A":     "A",
-		"VAR_B":     "B",
-		"VAR_C":     "C",
-		"VAR_REF":   "$(VAR_A)",
-		"VAR_EMPTY": "",
-	}
-	doExpansionTest(t, context)
-}
-
-func TestMappingDual(t *testing.T) {
-	context := map[string]interface{}{
-		"VAR_A":     "A",
-		"VAR_EMPTY": "",
-	}
-	context2 := map[string]interface{}{
-		"VAR_B":   "B",
-		"VAR_C":   "C",
-		"VAR_REF": "$(VAR_A)",
-	}
-
-	doExpansionTest(t, context, context2)
-}
-
-func doExpansionTest(t *testing.T, context ...map[string]interface{}) {
 	cases := []struct {
 		name     string
 		input    string
@@ -333,11 +351,17 @@ func doExpansionTest(t *testing.T, context ...map[string]interface{}) {
 			expected: "\n",
 		},
 	}
-
 	for _, tc := range cases {
 		counts := make(map[string]int)
-		mapping := MappingFuncFor(counts, context...)
-		expanded := Expand(fmt.Sprintf("%v", tc.input), mapping)
+		expanded := DoReplacements(
+			fmt.Sprintf("%v", tc.input),
+			MakePrimitiveReplacer(counts, map[string]interface{}{
+				"VAR_A":     "A",
+				"VAR_B":     "B",
+				"VAR_C":     "C",
+				"VAR_REF":   "$(VAR_A)",
+				"VAR_EMPTY": "",
+			}))
 		if e, a := tc.expected, expanded; e != a {
 			t.Errorf("%v: expected %q, got %q", tc.name, e, a)
 		}
@@ -347,8 +371,7 @@ func doExpansionTest(t *testing.T, context ...map[string]interface{}) {
 		}
 		if len(tc.counts) > 0 {
 			for k, expectedCount := range tc.counts {
-				c, ok := counts[k]
-				if ok {
+				if c, ok := counts[k]; ok {
 					if c != expectedCount {
 						t.Errorf(
 							"%v: k=%s, expected count %d, got %d",

api/filters/refvar/refvar.go

@@ -8,15 +8,13 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
-
-	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
 )
 
 // Filter updates $(VAR) style variables with values.
 // The fieldSpecs are the places to look for occurrences of $(VAR).
 type Filter struct {
-	MappingFunc func(string) interface{} `json:"mappingFunc,omitempty" yaml:"mappingFunc,omitempty"`
-	FieldSpec   types.FieldSpec          `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+	MappingFunc MappingFunc     `json:"mappingFunc,omitempty" yaml:"mappingFunc,omitempty"`
+	FieldSpec   types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
 }
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
@@ -49,12 +47,21 @@ func (f Filter) set(node *yaml.RNode) error {
 
 func updateNodeValue(node *yaml.Node, newValue interface{}) {
 	switch newValue := newValue.(type) {
+	case int:
+		node.Value = strconv.FormatInt(int64(newValue), 10)
+		node.Tag = yaml.NodeTagInt
+	case int32:
+		node.Value = strconv.FormatInt(int64(newValue), 10)
+		node.Tag = yaml.NodeTagInt
 	case int64:
 		node.Value = strconv.FormatInt(newValue, 10)
 		node.Tag = yaml.NodeTagInt
 	case bool:
 		node.SetString(strconv.FormatBool(newValue))
 		node.Tag = yaml.NodeTagBool
+	case float32:
+		node.SetString(strconv.FormatFloat(float64(newValue), 'f', -1, 32))
+		node.Tag = yaml.NodeTagFloat
 	case float64:
 		node.SetString(strconv.FormatFloat(newValue, 'f', -1, 64))
 		node.Tag = yaml.NodeTagFloat
@@ -69,7 +76,7 @@ func (f Filter) setScalar(node *yaml.RNode) error {
 	if !yaml.IsYNodeString(node.YNode()) {
 		return nil
 	}
-	v := expansion2.Expand(node.YNode().Value, f.MappingFunc)
+	v := DoReplacements(node.YNode().Value, f.MappingFunc)
 	updateNodeValue(node.YNode(), v)
 	return nil
 }
@@ -78,12 +85,14 @@ func (f Filter) setMap(node *yaml.RNode) error {
 	contents := node.YNode().Content
 	for i := 0; i < len(contents); i += 2 {
 		if !yaml.IsYNodeString(contents[i]) {
-			return fmt.Errorf("invalid map key: %s, type: %s", contents[i].Value, contents[i].Tag)
+			return fmt.Errorf(
+				"invalid map key: value='%s', tag='%s'",
+				contents[i].Value, contents[i].Tag)
 		}
 		if !yaml.IsYNodeString(contents[i+1]) {
 			continue
 		}
-		newValue := expansion2.Expand(contents[i+1].Value, f.MappingFunc)
+		newValue := DoReplacements(contents[i+1].Value, f.MappingFunc)
 		updateNodeValue(contents[i+1], newValue)
 	}
 	return nil
@@ -94,7 +103,7 @@ func (f Filter) setSeq(node *yaml.RNode) error {
 		if !yaml.IsYNodeString(item) {
 			return fmt.Errorf("invalid value type expect a string")
 		}
-		newValue := expansion2.Expand(item.Value, f.MappingFunc)
+		newValue := DoReplacements(item.Value, f.MappingFunc)
 		updateNodeValue(item, newValue)
 	}
 	return nil

api/filters/refvar/refvar_test.go

@@ -1,18 +1,22 @@
-package refvar
+package refvar_test
 
 import (
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+	. "sigs.k8s.io/kustomize/api/filters/refvar"
 	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
+var makeMf = func(theMap map[string]interface{}) MappingFunc {
+	ignored := make(map[string]int)
+	return MakePrimitiveReplacer(ignored, theMap)
+}
+
 func TestFilter(t *testing.T) {
-	replacementCounts := make(map[string]int)
 
 	testCases := map[string]struct {
 		input    string
@@ -35,7 +39,7 @@ metadata:
 spec:
   replicas: 5`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
 				}),
 				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
@@ -57,7 +61,7 @@ metadata:
 spec:
   replicas: 1`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
 				}),
 				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
@@ -79,7 +83,7 @@ metadata:
 spec:
   replicas: 1`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
 				}),
 				FieldSpec: types.FieldSpec{Path: "a/b/c"},
@@ -111,7 +115,7 @@ data:
 - false
 - 1.23`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"FOO":   "foo",
 					"BAR":   "bar",
 					"BOOL":  false,
@@ -142,7 +146,7 @@ data:
   BAZ: $(BAZ)
   PLUS: foo+bar`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"FOO": "foo",
 					"BAR": "bar",
 				}),
@@ -181,7 +185,7 @@ data:
     SLICE:
     - $(FOO)`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"FOO": "foo",
 					"BAR": "bar",
 				}),
@@ -204,8 +208,10 @@ metadata:
 data:
   FOO: null`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{}),
-				FieldSpec:   types.FieldSpec{Path: "data/FOO"},
+				MappingFunc: makeMf(map[string]interface{}{
+					// no replacements!
+				}),
+				FieldSpec: types.FieldSpec{Path: "data/FOO"},
 			},
 		},
 	}
@@ -223,8 +229,6 @@ data:
 }
 
 func TestFilterUnhappy(t *testing.T) {
-	replacementCounts := make(map[string]int)
-
 	testCases := map[string]struct {
 		input         string
 		expectedError string
@@ -239,7 +243,8 @@ metadata:
 data:
   slice:
   - false`,
-			expectedError: `obj 'apiVersion: apps/v1
+			expectedError: `considering field 'data/slice' of object
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
@@ -248,9 +253,9 @@ metadata:
 data:
   slice:
   - false
-' at path 'data/slice': invalid value type expect a string`,
+: invalid value type expect a string`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
 				}),
 				FieldSpec: types.FieldSpec{Path: "data/slice"},
@@ -264,7 +269,8 @@ metadata:
   name: dep
 data:
   1: str`,
-			expectedError: `obj 'apiVersion: apps/v1
+			expectedError: `considering field 'data' of object
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
@@ -272,9 +278,9 @@ metadata:
     config.kubernetes.io/index: '0'
 data:
   1: str
-' at path 'data': invalid map key: 1, type: ` + yaml.NodeTagInt,
+: invalid map key: value='1', tag='` + yaml.NodeTagInt + `'`,
 			filter: Filter{
-				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
 				}),
 				FieldSpec: types.FieldSpec{Path: "data"},

api/filters/valueadd/valueadd.go

@@ -98,7 +98,17 @@ var _ kio.Filter = Filter{}
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	_, err := kio.FilterAll(yaml.FilterFunc(
 		func(node *yaml.RNode) (*yaml.RNode, error) {
-			fields := strings.Split(f.FieldPath, "/")
+			var fields []string
+			// if there is forward slash '/' in the field name, a back slash '\'
+			// will be used to escape it.
+			for _, f := range strings.Split(f.FieldPath, "/") {
+				if len(fields) > 0 && strings.HasSuffix(fields[len(fields)-1], "\\") {
+					concatField := strings.TrimSuffix(fields[len(fields)-1], "\\") + "/" + f
+					fields = append(fields[:len(fields)-1], concatField)
+				} else {
+					fields = append(fields, f)
+				}
+			}
 			// TODO: support SequenceNode.
 			// Presumably here one could look for array indices (digits) at
 			// the end of the field path (as described in IETF RFC 6902 JSON),

api/filters/valueadd/valueadd_test.go

@@ -94,6 +94,20 @@ spec:
 				FilePathPosition: 2,
 			},
 		},
+		"backSlash": {
+			input: `
+kind: SomeKind
+`,
+			expectedOutput: `
+kind: SomeKind
+spec:
+  resourceRef/external: valueAdded
+`,
+			filter: Filter{
+				Value:     "valueAdded",
+				FieldPath: "spec/resourceRef\\/external",
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/go.mod

@@ -1,24 +1,25 @@
 module sigs.k8s.io/kustomize/api
 
-go 1.14
+go 1.15
 
 require (
 	github.com/evanphx/json-patch v4.5.0+incompatible
+	github.com/go-errors/errors v1.0.1
 	github.com/go-openapi/spec v0.19.5
 	github.com/golangci/golangci-lint v1.21.0
 	github.com/google/go-cmp v0.3.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/hashicorp/go-multierror v1.1.0
+	github.com/imdario/mergo v0.3.5
 	github.com/pkg/errors v0.8.1
 	github.com/stretchr/testify v1.4.0
-	github.com/yujunz/go-getter v1.4.1-lite
+	github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf
 	golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e
 	gopkg.in/yaml.v2 v2.3.0
-	gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c
 	k8s.io/api v0.17.0
 	k8s.io/apimachinery v0.17.0
 	k8s.io/client-go v0.17.0
-	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
-	sigs.k8s.io/kustomize/kyaml v0.9.4
+	sigs.k8s.io/kustomize/kyaml v0.10.9
 	sigs.k8s.io/yaml v1.2.0
 )

api/go.sum

@@ -158,6 +158,7 @@ github.com/go-toolsmith/strparse v1.0.0 h1:Vcw78DnpCAKlM20kSbAyO4mPfJn/lyYA4BJUD
 github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
 github.com/go-toolsmith/typep v1.0.0 h1:zKymWyA1TRYvqYrYDrfEMZULyrhcnGY3x7LDKU2XQaA=
 github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
+github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gofrs/flock v0.0.0-20190320160742-5135e617513b h1:ekuhfTjngPhisSjOJ0QWKpPQE8/rbknHaes6WVJj5Hw=
@@ -166,6 +167,7 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -225,6 +227,7 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d h1:7XGaL1e6bYS1yIonGp9761ExpPPV1ui0SAC59Yube9k=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3 h1:JVnpOZS+qxli+rgVl98ILOXVNbW+kb5wcxeGx8ShUIw=
 github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=
@@ -249,6 +252,7 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
@@ -287,6 +291,7 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb h1:RHba4YImhrUVQDHUCe2BNSOz4tVy2yGyXhvYDvxGgeE=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA=
@@ -365,6 +370,7 @@ github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e h1:MZM7FHLqUHYI0Y/mQAt
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041 h1:llrF3Fs4018ePo4+G/HV/uQUqEI1HMDjCeOf2V6puPc=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
@@ -406,8 +412,8 @@ github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiff
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
-github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
+github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ultraware/funlen v0.0.2 h1:Av96YVBwwNSe4MLR7iI/BIa3VyI7/djnto/pK3Uxbdo=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4 h1:If7Va4cM03mpgrNH9k49/VOicWpGoG70XPBFFODYDsg=
@@ -423,8 +429,8 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
-github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf h1:gvEmqF83GB8R5XtrMseJb6A6R0OCtNAS8f4TmZg2dGc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf/go.mod h1:bL0Pr07HEdsMZ1WBqZIxXj96r5LnFsY4LgPaPEGkw1k=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@@ -561,12 +567,13 @@ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bl
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71 h1:Xe2gvTZUJpsvOWUnvmL/tmhVBZUmHSvLbMjRj6NUUKo=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
@@ -592,8 +599,8 @@ mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b h1:DxJ5nJdkhDlLok9K6qO+5290kphD
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f h1:Cq7MalBHYACRd6EesksG1Q8EoIAKOsiZviGKbOLIej4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.9.4 h1:DDuzZtjIzFqp2IPy4DTyCI69Cl3bDgcJODjI6sjF9NY=
-sigs.k8s.io/kustomize/kyaml v0.9.4/go.mod h1:UTm64bSWVdBUA8EQoYCxVOaBQxUdIOr5LKWxA4GNbkw=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=

api/ifc/ifc.go

@@ -43,12 +43,12 @@ type Kunstructured interface {
 	// Several uses.
 	Copy() Kunstructured
 
-	// Used by Resource.Replace, which in turn is used in many places, e.g.
-	//  - resource.Resource.Merge
-	//  - resWrangler.appendReplaceOrMerge (AbsorbAll)
-	//  - api.internal.k8sdeps.transformer.patch.conflictdetector
+	// GetAnnotations returns the k8s annotations.
 	GetAnnotations() map[string]string
 
+	// GetData returns a top-level "data" field, as in a ConfigMap.
+	GetDataMap() map[string]string
+
 	// Used by ResAccumulator and ReplacementTransformer.
 	GetFieldValue(string) (interface{}, error)
 
@@ -58,7 +58,7 @@ type Kunstructured interface {
 	// Used by resource.Factory.SliceFromBytes
 	GetKind() string
 
-	// Used by Resource.Replace
+	// GetLabels returns the k8s labels.
 	GetLabels() map[string]string
 
 	// Used by Resource.CurId and resource factory.
@@ -84,19 +84,22 @@ type Kunstructured interface {
 	// Used by resWrangler.Select
 	MatchesLabelSelector(selector string) (bool, error)
 
-	// Used by Resource.Replace.
+	// SetAnnotations replaces the k8s annotations.
 	SetAnnotations(map[string]string)
 
+	// SetDataMap sets a top-level "data" field, as in a ConfigMap.
+	SetDataMap(map[string]string)
+
 	// Used by PatchStrategicMergeTransformer.
 	SetGvk(resid.Gvk)
 
-	// Used by Resource.Replace and used to remove "validated by" labels.
+	// SetLabels replaces the k8s labels.
 	SetLabels(map[string]string)
 
-	// Used by Resource.Replace.
+	// SetName changes the name.
 	SetName(string)
 
-	// Used by Resource.Replace.
+	// SetNamespace changes the namespace.
 	SetNamespace(string)
 
 	// Needed, for now, by kyaml/filtersutil.ApplyToJSON.

api/internal/accumulator/loadconfigfromcrds.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/go-openapi/spec"
 	"github.com/pkg/errors"
-	"k8s.io/kube-openapi/pkg/common"
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
@@ -18,8 +17,16 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
+// OpenAPIDefinition describes single type.
+// Normally these definitions are auto-generated using gen-openapi.
+// Same as in k8s.io / kube-openapi / pkg / common.
+type OpenAPIDefinition struct {
+	Schema       spec.Schema
+	Dependencies []string
+}
+
 type myProperties map[string]spec.Schema
-type nameToApiMap map[string]common.OpenAPIDefinition
+type nameToApiMap map[string]OpenAPIDefinition
 
 // LoadConfigFromCRDs parse CRD schemas from paths into a TransformerConfig
 func LoadConfigFromCRDs(
@@ -162,7 +169,7 @@ func loadCrdIntoConfig(
 				err = theConfig.AddNamereferenceFieldSpec(
 					builtinconfig.NameBackReferences{
 						Gvk: resid.Gvk{Kind: kind, Version: version},
-						FieldSpecs: []types.FieldSpec{
+						Referrers: []types.FieldSpec{
 							makeFs(theGvk, append(path, propName, nameKey))},
 					})
 				if err != nil {

api/internal/accumulator/loadconfigfromcrds_test.go

@@ -8,10 +8,9 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/loader"
-
 	. "sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/types"
 )
@@ -140,21 +139,19 @@ func TestLoadCRDs(t *testing.T) {
 	nbrs := []builtinconfig.NameBackReferences{
 		{
 			Gvk: resid.Gvk{Kind: "Secret", Version: "v1"},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
-					CreateIfNotPresent: false,
-					Gvk:                resid.Gvk{Kind: "MyKind"},
-					Path:               "spec/secretRef/name",
+					Gvk:  resid.Gvk{Kind: "MyKind"},
+					Path: "spec/secretRef/name",
 				},
 			},
 		},
 		{
 			Gvk: resid.Gvk{Kind: "Bee", Version: "v1beta1"},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
-					CreateIfNotPresent: false,
-					Gvk:                resid.Gvk{Kind: "MyKind"},
-					Path:               "spec/beeRef/name",
+					Gvk:  resid.Gvk{Kind: "MyKind"},
+					Path: "spec/beeRef/name",
 				},
 			},
 		},

api/internal/accumulator/namereferencetransformer.go

@@ -4,23 +4,29 @@
 package accumulator
 
 import (
+	"fmt"
 	"log"
 
 	"sigs.k8s.io/kustomize/api/filters/nameref"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/api/resource"
 )
 
 type nameReferenceTransformer struct {
 	backRefs []builtinconfig.NameBackReferences
 }
 
+const doDebug = false
+
 var _ resmap.Transformer = &nameReferenceTransformer{}
 
+type filterMap map[*resource.Resource][]nameref.Filter
+
 // newNameReferenceTransformer constructs a nameReferenceTransformer
 // with a given slice of NameBackReferences.
-func newNameReferenceTransformer(br []builtinconfig.NameBackReferences) resmap.Transformer {
+func newNameReferenceTransformer(
+	br []builtinconfig.NameBackReferences) resmap.Transformer {
 	if br == nil {
 		log.Fatal("backrefs not expected to be nil")
 	}
@@ -33,13 +39,61 @@ func newNameReferenceTransformer(br []builtinconfig.NameBackReferences) resmap.T
 //
 // For example, a HorizontalPodAutoscaler (HPA)
 // necessarily refers to a Deployment, the thing that
-// the HPA scales. The Deployment name might change
-// (e.g. prefix added), and the reference in the HPA
-// has to be fixed.
+// an HPA scales. In this case:
 //
-// In the outer loop over the ResMap below, say we
-// encounter a specific HPA. Then, in scanning backrefs,
-// we encounter an entry like
+//   - the HPA instance is the Referrer,
+//   - the Deployment instance is the ReferralTarget.
+//
+// If the Deployment's name changes, e.g. a prefix is added,
+// then the HPA's reference to the Deployment must be fixed.
+//
+func (t *nameReferenceTransformer) Transform(m resmap.ResMap) error {
+	fMap := t.determineFilters(m.Resources())
+	debug(fMap)
+	for r, fList := range fMap {
+		c := m.SubsetThatCouldBeReferencedByResource(r)
+		for _, f := range fList {
+			f.Referrer = r
+			f.ReferralCandidates = c
+			if err := f.Referrer.ApplyFilter(f); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func debug(fMap filterMap) {
+	if !doDebug {
+		return
+	}
+	fmt.Printf("filterMap has %d entries:\n", len(fMap))
+	rCount := 0
+	for r, fList := range fMap {
+		yml, _ := r.AsYAML()
+		rCount++
+		fmt.Printf(`
+---- %3d. possible referrer -------------
+%s
+---------`, rCount, string(yml),
+		)
+		for i, f := range fList {
+			fmt.Printf(`
+%3d/%3d update: %s
+          from: %s
+`, rCount, i+1, f.NameFieldToUpdate.Path, f.ReferralTarget,
+			)
+		}
+	}
+}
+
+// Produce a map from referrer resources that might need to be fixed
+// to filters that might fix them.  The keys to this map are potential
+// referrers, so won't include resources like ConfigMap or Secret.
+//
+// In the inner loop over the resources below, say we
+// encounter an HPA instance. Then, in scanning the set
+// of all known backrefs, we encounter an entry like
 //
 //   - kind: Deployment
 //     fieldSpecs:
@@ -48,54 +102,53 @@ func newNameReferenceTransformer(br []builtinconfig.NameBackReferences) resmap.T
 //
 // This entry says that an HPA, via its
 // 'spec/scaleTargetRef/name' field, may refer to a
-// Deployment.  This match to HPA means we may need to
-// modify the value in its 'spec/scaleTargetRef/name'
-// field, by searching for the thing it refers to,
-// and getting its new name.
+// Deployment.
 //
-// As a filter, and search optimization, we compute a
-// subset of all resources that the HPA could refer to,
-// by excluding objects from other namespaces, and
-// excluding objects that don't have the same prefix-
-// suffix mods as the HPA.
-//
-// We look in this subset for all Deployment objects
-// with a resId that has a Name matching the field value
-// present in the HPA.  If no match do nothing; if more
-// than one match, it's an error.
-//
-// We overwrite the HPA name field with the value found
-// in the Deployment's name field (the name in the raw
-// object - the modified name - not the unmodified name
-// in the Deployment's resId).
-//
-// This process assumes that the name stored in a ResId
-// (the ResMap key) isn't modified by name transformers.
-// Name transformers should only modify the name in the
-// body of the resource object (the value in the ResMap).
-//
-func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
-	// TODO: Too much looping, here and in transitive calls.
-	for _, referrer := range m.Resources() {
-		var candidates resmap.ResMap
-		for _, target := range o.backRefs {
-			for _, fSpec := range target.FieldSpecs {
-				if referrer.OrgId().IsSelected(&fSpec.Gvk) {
-					if candidates == nil {
-						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
-					}
-					err := filtersutil.ApplyToJSON(nameref.Filter{
-						FieldSpec:          fSpec,
-						Referrer:           referrer,
-						Target:             target.Gvk,
-						ReferralCandidates: candidates,
-					}, referrer)
-					if err != nil {
-						return err
+// This means that a filter will need to hunt for the right Deployment,
+// obtain it's new name, and write that name into the HPA's
+// 'spec/scaleTargetRef/name' field. Return a filter that can do that.
+func (t *nameReferenceTransformer) determineFilters(
+	resources []*resource.Resource) (fMap filterMap) {
+	fMap = make(filterMap)
+	for _, backReference := range t.backRefs {
+		for _, referrerSpec := range backReference.Referrers {
+			for _, res := range resources {
+				if res.OrgId().IsSelected(&referrerSpec.Gvk) {
+					// If this is true, the res might be a referrer, and if
+					// so, the name reference it holds might need an update.
+					if resHasField(res, referrerSpec.Path) {
+						// Optimization - the referrer has the field
+						// that might need updating.
+						fMap[res] = append(fMap[res], nameref.Filter{
+							// Name field to write in the Referrer.
+							// If the path specified here isn't found in
+							// the Referrer, nothing happens (no error,
+							// no field creation).
+							NameFieldToUpdate: referrerSpec,
+							// Specification of object class to read from.
+							// Always read from metadata/name field.
+							ReferralTarget: backReference.Gvk,
+						})
 					}
 				}
 			}
 		}
 	}
-	return nil
+	return fMap
+}
+
+// TODO: check res for field existence here to avoid extra work.
+// res.GetFieldValue, which uses yaml.Lookup under the hood, doesn't know
+// how to parse fieldspec-style paths that make no distinction
+// between maps and sequences.  This means it cannot lookup commonly
+// used "indeterminate" paths like
+//    spec/containers/env/valueFrom/configMapKeyRef/name
+// ('containers' is a list, not a map).
+// However, the fieldspec filter does know how to handle this;
+// extract that code and call it here?
+func resHasField(res *resource.Resource, path string) bool {
+	return true
+	// fld := strings.Join(utils.PathSplitter(path), ".")
+	// _, e := res.GetFieldValue(fld)
+	// return e == nil
 }

api/internal/accumulator/namereferencetransformer_test.go

@@ -8,17 +8,17 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 )
 
+const notEqualErrFmt = "expected (self) doesn't match actual (other): %v"
+
 func TestNameReferenceHappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).AddWithName(
+	m := resmaptest_test.NewRmBuilderDefault(t).AddWithName(
 		"cm1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -220,6 +220,7 @@ func TestNameReferenceHappyRun(t *testing.T) {
 						"secret1",
 						"secret1",
 						"secret2",
+						"cm1",
 					},
 				},
 			},
@@ -261,7 +262,8 @@ func TestNameReferenceHappyRun(t *testing.T) {
 			},
 		}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).ReplaceResource(
+	expected := resmaptest_test.NewSeededRmBuilderDefault(
+		t, m.ShallowCopy()).ReplaceResource(
 		map[string]interface{}{
 			"group":      "apps",
 			"apiVersion": "v1",
@@ -422,6 +424,7 @@ func TestNameReferenceHappyRun(t *testing.T) {
 						"someprefix-secret1-somehash",
 						"someprefix-secret1-somehash",
 						"secret2",
+						"someprefix-cm1-somehash",
 					},
 				},
 			},
@@ -470,19 +473,17 @@ func TestNameReferenceHappyRun(t *testing.T) {
 	}
 
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
 func TestNameReferenceUnhappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
 	tests := []struct {
 		resMap      resmap.ResMap
 		expectedErr string
 	}{
 		{
-			resMap: resmaptest_test.NewRmBuilder(t, rf).Add(
+			resMap: resmaptest_test.NewRmBuilderDefault(t).Add(
 				map[string]interface{}{
 					"apiVersion": "rbac.authorization.k8s.io/v1",
 					"kind":       "ClusterRole",
@@ -502,7 +503,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 				}).ResMap(),
 			expectedErr: "is expected to be"},
 		{
-			resMap: resmaptest_test.NewRmBuilder(t, rf).Add(
+			resMap: resmaptest_test.NewRmBuilderDefault(t).Add(
 				map[string]interface{}{
 					"apiVersion": "rbac.authorization.k8s.io/v1",
 					"kind":       "ClusterRole",
@@ -520,7 +521,27 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 						},
 					},
 				}).ResMap(),
-			expectedErr: "cannot find field 'name' in node"},
+			// TODO(#3304): DECISION - kyaml better; not a bug.
+			expectedErr: konfig.IfApiMachineryElseKyaml(
+				`updating name reference in 'rules/resourceNames' field of `+
+					`'rbac.authorization.k8s.io_v1_ClusterRole|~X|cr'`+
+					`: considering field 'rules/resourceNames' of object
+{"apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRole", "metadata": {
+    "name": "cr"}, "rules": [{"resourceNames": {"foo": "bar"}, "resources": ["secrets"]}]}
+: visit traversal on path: [resourceNames]: path config error; no 'name' field in node`,
+				`updating name reference in 'rules/resourceNames' field of `+
+					`'rbac.authorization.k8s.io_v1_ClusterRole|~X|cr'`+
+					`: considering field 'rules/resourceNames' of object
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cr
+rules:
+- resourceNames:
+    foo: bar
+  resources:
+  - secrets
+: visit traversal on path: [resourceNames]: path config error; no 'name' field in node`)},
 	}
 
 	nrt := newNameReferenceTransformer(builtinconfig.MakeDefaultConfig().NameReference)
@@ -531,15 +552,14 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 		}
 
 		if !strings.Contains(err.Error(), test.expectedErr) {
-			t.Fatalf("Incorrect error.\nExpected: %s, but got %v",
+			t.Fatalf("Incorrect error.\nExpected:\n %s\nGot:\n%v",
 				test.expectedErr, err)
 		}
 	}
 }
 
 func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 
 	v1 := rf.FromMapWithName(
 		"volume1",
@@ -590,7 +610,7 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 	v2.AppendRefBy(c2.CurId())
 
 	if err := m1.ErrorIfNotEqualLists(m2); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -664,9 +684,7 @@ const (
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceNamespace(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		// Add ConfigMap with the same org name in noNs, "ns1" and "ns2" namespaces
 		AddWithName(orgname, map[string]interface{}{
 			"apiVersion": "v1",
@@ -715,7 +733,7 @@ func TestNameReferenceNamespace(t *testing.T) {
 		AddWithNsAndName(ns1, orgname, deploymentMap(ns1, prefixedname, orgname, orgname)).
 		AddWithNsAndName(ns2, orgname, deploymentMap(ns2, suffixedname, orgname, orgname)).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(deploymentMap(defaultNs, modifiedname, modifiedname, modifiedname)).
 		ReplaceResource(deploymentMap(ns1, prefixedname, prefixedname, prefixedname)).
 		ReplaceResource(deploymentMap(ns2, suffixedname, suffixedname, suffixedname)).ResMap()
@@ -726,8 +744,9 @@ func TestNameReferenceNamespace(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -735,9 +754,7 @@ func TestNameReferenceNamespace(t *testing.T) {
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceClusterWide(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		// Add ServiceAccount with the same org name in noNs, "ns1" and "ns2" namespaces
 		AddWithName(orgname, map[string]interface{}{
 			"apiVersion": "v1",
@@ -816,7 +833,7 @@ func TestNameReferenceClusterWide(t *testing.T) {
 				},
 			}}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(
 			map[string]interface{}{
 				"apiVersion": "rbac.authorization.k8s.io/v1",
@@ -889,8 +906,9 @@ func TestNameReferenceClusterWide(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -898,9 +916,7 @@ func TestNameReferenceClusterWide(t *testing.T) {
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceNamespaceTransformation(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		AddWithNsAndName(ns4, orgname, map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Secret",
@@ -964,7 +980,7 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 				},
 			}}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(
 			map[string]interface{}{
 				"apiVersion": "rbac.authorization.k8s.io/v1",
@@ -1017,8 +1033,9 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -1026,9 +1043,7 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 // It validates the change done is IsSameFuzzyNamespace which
 // uses the IsNsEquals method instead of the simple == operator.
 func TestNameReferenceCandidateSelection(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		AddWithName("cm1", map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -1045,7 +1060,7 @@ func TestNameReferenceCandidateSelection(t *testing.T) {
 		AddWithName("deploy1", deploymentMap("", "p1-deploy1", "cm1", "secret1")).
 		ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(deploymentMap("", "p1-deploy1", "p1-cm1-hash", "p1-secret1-hash")).
 		ResMap()
 
@@ -1055,7 +1070,8 @@ func TestNameReferenceCandidateSelection(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }

api/internal/accumulator/refvartransformer.go

@@ -4,19 +4,15 @@
 package accumulator
 
 import (
-	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
-
 	"sigs.k8s.io/kustomize/api/filters/refvar"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 type refVarTransformer struct {
 	varMap            map[string]interface{}
 	replacementCounts map[string]int
 	fieldSpecs        []types.FieldSpec
-	mappingFunc       func(string) interface{}
 }
 
 // newRefVarTransformer returns a new refVarTransformer
@@ -35,8 +31,7 @@ func newRefVarTransformer(
 func (rv *refVarTransformer) UnusedVars() []string {
 	var unused []string
 	for k := range rv.varMap {
-		_, ok := rv.replacementCounts[k]
-		if !ok {
+		if _, ok := rv.replacementCounts[k]; !ok {
 			unused = append(unused, k)
 		}
 	}
@@ -46,14 +41,13 @@ func (rv *refVarTransformer) UnusedVars() []string {
 // Transform replaces $(VAR) style variables with values.
 func (rv *refVarTransformer) Transform(m resmap.ResMap) error {
 	rv.replacementCounts = make(map[string]int)
-	rv.mappingFunc = expansion2.MappingFuncFor(
-		rv.replacementCounts, rv.varMap)
+	mf := refvar.MakePrimitiveReplacer(rv.replacementCounts, rv.varMap)
 	for _, res := range m.Resources() {
 		for _, fieldSpec := range rv.fieldSpecs {
-			err := filtersutil.ApplyToJSON(refvar.Filter{
-				MappingFunc: rv.mappingFunc,
+			err := res.ApplyFilter(refvar.Filter{
+				MappingFunc: mf,
 				FieldSpec:   fieldSpec,
-			}, res)
+			})
 			if err != nil {
 				return err
 			}

api/internal/accumulator/refvartransformer_test.go

@@ -7,10 +7,9 @@ import (
 	"reflect"
 	"testing"
 
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 	"sigs.k8s.io/kustomize/api/types"
 )
@@ -25,14 +24,12 @@ func TestRefVarTransformer(t *testing.T) {
 		res    resmap.ResMap
 		unused []string
 	}
-	testCases := []struct {
-		description string
-		given       given
-		expected    expected
-		errMessage  string
+	testCases := map[string]struct {
+		given      given
+		expected   expected
+		errMessage string
 	}{
-		{
-			description: "var replacement in map[string]",
+		"var replacement in map[string]": {
 			given: given{
 				varMap: map[string]interface{}{
 					"FOO": "replacementForFoo",
@@ -46,8 +43,7 @@ func TestRefVarTransformer(t *testing.T) {
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/interface"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/num"},
 				},
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -77,8 +73,7 @@ func TestRefVarTransformer(t *testing.T) {
 						}}).ResMap(),
 			},
 			expected: expected{
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -109,15 +104,13 @@ func TestRefVarTransformer(t *testing.T) {
 				unused: []string{"BAR"},
 			},
 		},
-		{
-			description: "var replacement panic in map[string]",
+		"var replacement panic in map[string]": {
 			given: given{
 				varMap: map[string]interface{}{},
 				fs: []types.FieldSpec{
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
 				},
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -128,18 +121,29 @@ func TestRefVarTransformer(t *testing.T) {
 							"slice": []interface{}{5}, // noticeably *not* a []string
 						}}).ResMap(),
 			},
-			errMessage: `obj '{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
-' at path 'data/slice': invalid value type expect a string`,
+			// TODO(#3304): DECISION - kyaml better; not a bug.
+			errMessage: konfig.IfApiMachineryElseKyaml(
+				`considering field 'data/slice' of object
+{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
+: invalid value type expect a string`,
+				`considering field 'data/slice' of object
+apiVersion: v1
+data:
+  slice:
+  - 5
+kind: ConfigMap
+metadata:
+  name: cm1
+: invalid value type expect a string`,
+			),
 		},
-		{
-			description: "var replacement in nil",
+		"var replacement in nil": {
 			given: given{
 				varMap: map[string]interface{}{},
 				fs: []types.FieldSpec{
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
 				},
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -151,8 +155,7 @@ func TestRefVarTransformer(t *testing.T) {
 						}}).ResMap(),
 			},
 			expected: expected{
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -166,20 +169,18 @@ func TestRefVarTransformer(t *testing.T) {
 		},
 	}
 
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			// arrange
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
 			tr := newRefVarTransformer(tc.given.varMap, tc.given.fs)
-
-			// act
 			err := tr.Transform(tc.given.res)
-
-			// assert
 			if tc.errMessage != "" {
 				if err == nil {
 					t.Fatalf("missing expected error %v", tc.errMessage)
 				} else if err.Error() != tc.errMessage {
-					t.Fatalf("actual error doesn't match expected error: \nACTUAL: %v\nEXPECTED: %v", err.Error(), tc.errMessage)
+					t.Fatalf(`actual error doesn't match expected error:
+ACTUAL: %v
+EXPECTED: %v`,
+						err.Error(), tc.errMessage)
 				}
 			} else {
 				if err != nil {
@@ -189,7 +190,13 @@ func TestRefVarTransformer(t *testing.T) {
 				a, e := tc.given.res, tc.expected.res
 				if !reflect.DeepEqual(a, e) {
 					err = e.ErrorIfNotEqualLists(a)
-					t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+					t.Fatalf(`actual doesn't match expected:
+ACTUAL:
+%v
+EXPECTED:
+%v
+ERR: %v`,
+						a, e, err)
 				}
 			}
 		})

api/internal/accumulator/resaccumulator.go

@@ -41,13 +41,11 @@ func (ra *ResAccumulator) Vars() []types.Var {
 	return ra.varSet.AsSlice()
 }
 
-func (ra *ResAccumulator) AppendAll(
-	resources resmap.ResMap) error {
+func (ra *ResAccumulator) AppendAll(resources resmap.ResMap) error {
 	return ra.resMap.AppendAll(resources)
 }
 
-func (ra *ResAccumulator) AbsorbAll(
-	resources resmap.ResMap) error {
+func (ra *ResAccumulator) AbsorbAll(resources resmap.ResMap) error {
 	return ra.resMap.AbsorbAll(resources)
 }
 
@@ -61,6 +59,15 @@ func (ra *ResAccumulator) GetTransformerConfig() *builtinconfig.TransformerConfi
 	return ra.tConfig
 }
 
+// MergeVars accumulates vars into ResAccumulator.
+// A Var is a tuple of name, object reference and field reference.
+// This func takes a list of vars from the current kustomization file and
+// annotates the accumulated resources with the names of the vars that match
+// those resources.  E.g. if there's a var named "sam" that wants to get
+// its data from a ConfigMap named "james", and the resource list contains a
+// ConfigMap named "james", then that ConfigMap will be annotated with the
+// var name "sam".  Later this annotation is used to find the data for "sam"
+// by digging into a particular fieldpath of "james".
 func (ra *ResAccumulator) MergeVars(incoming []types.Var) error {
 	for _, v := range incoming {
 		targetId := resid.NewResIdWithNamespace(v.ObjRef.GVK(), v.ObjRef.Name, v.ObjRef.Namespace)
@@ -70,7 +77,7 @@ func (ra *ResAccumulator) MergeVars(incoming []types.Var) error {
 			// wildcard search on the namespace hence we still use GvknEquals
 			idMatcher = targetId.Equals
 		}
-		matched := ra.resMap.GetMatchingResourcesByOriginalId(idMatcher)
+		matched := ra.resMap.GetMatchingResourcesByAnyId(idMatcher)
 		if len(matched) > 1 {
 			return fmt.Errorf(
 				"found %d resId matches for var %s "+
@@ -106,12 +113,10 @@ func (ra *ResAccumulator) findVarValueFromResources(v types.Var) (interface{}, e
 						"field specified in var '%v' "+
 							"not found in corresponding resource", v)
 				}
-
 				return s, nil
 			}
 		}
 	}
-
 	return "", fmt.Errorf(
 		"var '%v' cannot be mapped to a field "+
 			"in the set of known resources", v)
@@ -127,10 +132,8 @@ func (ra *ResAccumulator) makeVarReplacementMap() (map[string]interface{}, error
 		if err != nil {
 			return nil, err
 		}
-
 		result[v.Name] = s
 	}
-
 	return result, nil
 }
 
@@ -161,6 +164,6 @@ func (ra *ResAccumulator) FixBackReferences() (err error) {
 	if ra.tConfig.NameReference == nil {
 		return nil
 	}
-	return ra.Transform(newNameReferenceTransformer(
-		ra.tConfig.NameReference))
+	return ra.Transform(
+		newNameReferenceTransformer(ra.tConfig.NameReference))
 }

api/internal/accumulator/resaccumulator_test.go

@@ -12,7 +12,7 @@ import (
 
 	. "sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
@@ -20,16 +20,14 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
+func makeResAccumulator(t *testing.T) *ResAccumulator {
 	ra := MakeEmptyAccumulator()
 	err := ra.MergeConfig(builtinconfig.MakeDefaultConfig())
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
 	err = ra.AppendAll(
-		resmaptest_test.NewRmBuilder(t, rf).
+		resmaptest_test.NewRmBuilderDefault(t).
 			Add(map[string]interface{}{
 				"apiVersion": "apps/v1",
 				"kind":       "Deployment",
@@ -66,11 +64,11 @@ func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	return ra, rf
+	return ra
 }
 
 func TestResolveVarsHappy(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -99,7 +97,7 @@ func TestResolveVarsHappy(t *testing.T) {
 }
 
 func TestResolveVarsOneUnused(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -140,11 +138,10 @@ func expectLog(t *testing.T, log bytes.Buffer, expect string) {
 }
 
 func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
-	ra, rf := makeResAccumulator(t)
-
+	ra := makeResAccumulator(t)
 	rm0 := resmap.New()
 	err := rm0.Append(
-		rf.FromMap(
+		provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
 			map[string]interface{}{
 				"apiVersion": "v1",
 				"kind":       "Service",
@@ -213,8 +210,7 @@ func makeVarToNamepaceAndPath(
 }
 
 func TestResolveVarConflicts(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
-
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	// create configmaps in foo and bar namespaces with `data.provider` values.
 	fooAws := makeNamespacedConfigMapWithDataProviderValue("foo", "aws")
 	barAws := makeNamespacedConfigMapWithDataProviderValue("bar", "aws")
@@ -261,7 +257,7 @@ func TestResolveVarConflicts(t *testing.T) {
 }
 
 func TestResolveVarsGoodResIdBadField(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -286,7 +282,7 @@ func TestResolveVarsGoodResIdBadField(t *testing.T) {
 }
 
 func TestResolveVarsUnmappableVar(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_THREE",
@@ -310,7 +306,7 @@ func TestResolveVarsUnmappableVar(t *testing.T) {
 }
 
 func TestResolveVarsWithNoambiguation(t *testing.T) {
-	ra1, rf := makeResAccumulator(t)
+	ra1 := makeResAccumulator(t)
 	err := ra1.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -327,7 +323,7 @@ func TestResolveVarsWithNoambiguation(t *testing.T) {
 	// Create another accumulator having a resource with different prefix
 	ra2 := MakeEmptyAccumulator()
 
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		Add(map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",
@@ -348,19 +344,20 @@ func TestResolveVarsWithNoambiguation(t *testing.T) {
 					},
 				},
 			}}).
+		// Make it seem like this resource
+		// went through a prefix transformer.
 		Add(map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Service",
 			"metadata": map[string]interface{}{
-				"name": "backendOne",
+				"name": "sub-backendOne",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "backendOne",
+					"config.kubernetes.io/previousNamespaces": "default",
+					"config.kubernetes.io/prefixes":           "sub-",
+				},
 			}}).ResMap()
 
-	// Make it seem like this resource
-	// went through a prefix transformer.
-	r := m.GetByIndex(1)
-	r.AddNamePrefix("sub-")
-	r.SetName("sub-backendOne") // original name remains "backendOne"
-
 	err = ra2.AppendAll(m)
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)

api/internal/conflict/factory.go

@@ -0,0 +1,23 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+type cdFactory struct{}
+
+var _ resource.ConflictDetectorFactory = &cdFactory{}
+
+// NewFactory returns a new conflict detector factory.
+func NewFactory() resource.ConflictDetectorFactory {
+	return &cdFactory{}
+}
+
+// New returns an instance of smPatchMergeOnlyDetector.
+func (c cdFactory) New(_ resid.Gvk) (resource.ConflictDetector, error) {
+	return &smPatchMergeOnlyDetector{}, nil
+}

api/internal/conflict/smpatchmergeonlydetector.go

@@ -0,0 +1,33 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// smPatchMergeOnlyDetector ignores conflicts,
+// but does real strategic merge patching.
+// This is part of an effort to eliminate dependence on
+// apimachinery package to allow kustomize integration
+// into kubectl (#2506 and #1500)
+type smPatchMergeOnlyDetector struct{}
+
+var _ resource.ConflictDetector = &smPatchMergeOnlyDetector{}
+
+func (c *smPatchMergeOnlyDetector) HasConflict(
+	_, _ *resource.Resource) (bool, error) {
+	return false, nil
+}
+
+// There's at least one case that doesn't work.  Suppose one has a
+// Deployment with a volume with the bizarre "emptyDir: {}" entry.
+// If you want to get rid of this entry via a patch containing
+// the entry "emptyDir: null", then the following won't work,
+// because null entries are eliminated.
+func (c *smPatchMergeOnlyDetector) MergePatches(
+	r, patch *resource.Resource) (*resource.Resource, error) {
+	err := r.ApplySmPatch(patch)
+	return r, err
+}

api/internal/crawl/doc/doc.go

@@ -7,14 +7,13 @@ import (
 	"sort"
 	"strings"
 
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/provider"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 )
 
-var fileReader = kunstruct.NewKunstructuredFactoryImpl()
-
 // This document is meant to be used at the elasticsearch document type.
 // Fields are serialized as-is to elasticsearch, where indices are built
 // to facilitate text search queries. Identifiers, Values, FilePath,
@@ -42,6 +41,7 @@ type KustomizationDocument struct {
 	Kinds       []string `json:"kinds,omitempty"`
 	Identifiers []string `json:"identifiers,omitempty"`
 	Values      []string `json:"values,omitempty"`
+	resFactory  *resource.Factory
 }
 
 type set map[string]struct{}
@@ -52,6 +52,7 @@ func (doc *KustomizationDocument) Copy() *KustomizationDocument {
 		Kinds:       doc.Kinds,
 		Identifiers: doc.Identifiers,
 		Values:      doc.Values,
+		resFactory:  provider.NewDefaultDepProvider().GetResourceFactory(),
 	}
 }
 
@@ -150,7 +151,7 @@ func (doc *KustomizationDocument) readBytes() ([]map[string]interface{}, error)
 	}
 
 	configs := make([]map[string]interface{}, 0)
-	ks, err := fileReader.SliceFromBytes(data)
+	ks, err := doc.resFactory.SliceFromBytes(data)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse resource: %v", err)
 	}

api/internal/crawl/go.mod

@@ -1,6 +1,6 @@
 module sigs.k8s.io/kustomize/api/internal/crawl
 
-go 1.14
+go 1.15
 
 require (
 	github.com/elastic/go-elasticsearch/v6 v6.8.5

api/internal/crawl/go.sum

@@ -145,6 +145,7 @@ github.com/go-toolsmith/pkgload v0.0.0-20181119091011-e9e65178eee8/go.mod h1:WoM
 github.com/go-toolsmith/pkgload v1.0.0/go.mod h1:5eFArkbO80v7Z0kdngIxsRXRMTaX4Ilcwuh3clNrQJc=
 github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
 github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
+github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gofrs/flock v0.0.0-20190320160742-5135e617513b/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -219,6 +220,7 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
@@ -253,6 +255,7 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
@@ -317,6 +320,7 @@ github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/securego/gosec v0.0.0-20191002120514-e680875ea14d/go.mod h1:w5+eXa0mYznDkHaMCXA4XYffjlH+cy1oyKbfzJXa2Do=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shirou/gopsutil v0.0.0-20190901111213-e4ec7b275ada/go.mod h1:WWnYX4lzhCH5h/3YBfyVA3VbLYjlMZZAQcW9ojMexNc=
 github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
@@ -355,8 +359,8 @@ github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiff
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
-github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
+github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4/go.mod h1:aVMh/gQve5Maj9hQ/hg+F75lr/X5A89uZnzAmWSineA=
 github.com/uudashr/gocognit v0.0.0-20190926065955-1655d0de0517/go.mod h1:j44Ayx2KW4+oB6SWMv8KsmHzZrOInQav7D3cQMJ5JUM=
@@ -369,8 +373,8 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
-github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf h1:gvEmqF83GB8R5XtrMseJb6A6R0OCtNAS8f4TmZg2dGc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf/go.mod h1:bL0Pr07HEdsMZ1WBqZIxXj96r5LnFsY4LgPaPEGkw1k=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@@ -503,12 +507,13 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71 h1:Xe2gvTZUJpsvOWUnvmL/tmhVBZUmHSvLbMjRj6NUUKo=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
@@ -529,8 +534,8 @@ k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.9.4 h1:DDuzZtjIzFqp2IPy4DTyCI69Cl3bDgcJODjI6sjF9NY=
-sigs.k8s.io/kustomize/kyaml v0.9.4/go.mod h1:UTm64bSWVdBUA8EQoYCxVOaBQxUdIOr5LKWxA4GNbkw=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

api/internal/generators/configmap.go

@@ -0,0 +1,45 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// MakeConfigMap makes a configmap.
+//
+// ConfigMap: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#configmap-v1-core
+//
+// ConfigMaps and Secrets are similar.
+//
+// Both objects have a `data` field, which contains a map from keys to
+// values that must be UTF-8 valid strings.  Such data might be simple text,
+// or whoever made the data may have done so by performing a base64 encoding
+// on binary data. Regardless, k8s has no means to know this, so it treats
+// the data field as a string.
+//
+// The ConfigMap has an additional field `binaryData`, also a map, but its
+// values are _intended_ to be interpreted as a base64 encoding of []byte,
+// by whatever makes use of the ConfigMap.
+//
+// In a ConfigMap, any key used in `data` cannot also be used in `binaryData`
+// and vice-versa.  A key must be unique across both maps.
+func MakeConfigMap(
+	ldr ifc.KvLoader, args *types.ConfigMapArgs) (rn *yaml.RNode, err error) {
+	rn, err = makeBaseNode("ConfigMap", args.Name, args.Namespace)
+	if err != nil {
+		return nil, err
+	}
+	m, err := makeValidatedDataMap(ldr, args.Name, args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	if err = rn.LoadMapIntoConfigMapData(m); err != nil {
+		return nil, err
+	}
+	copyLabelsAndAnnotations(rn, args.Options)
+	return rn, nil
+}

api/internal/generators/configmap_test.go

@@ -0,0 +1,223 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filesys"
+	. "sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var binaryHello = []byte{
+	0xff, // non-utf8
+	0x68, // h
+	0x65, // e
+	0x6c, // l
+	0x6c, // l
+	0x6f, // o
+}
+
+func manyHellos(count int) (result []byte) {
+	for i := 0; i < count; i++ {
+		result = append(result, binaryHello...)
+	}
+	return
+}
+
+func TestMakeConfigMap(t *testing.T) {
+	type expected struct {
+		out    string
+		errMsg string
+	}
+
+	testCases := map[string]struct {
+		args types.ConfigMapArgs
+		exp  expected
+	}{
+		"construct config map from env": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envConfigMap",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("configmap", "app.env"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envConfigMap
+data:
+  DB_PASSWORD: qwerty
+  DB_USERNAME: admin
+`,
+			},
+		},
+		"construct config map from text file": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileConfigMap1",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fileConfigMap1
+data:
+  app-init.ini: |
+    FOO=bar
+    BAR=baz
+`,
+			},
+		},
+		"construct config map from text and binary file": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileConfigMap2",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+							filepath.Join("configmap", "app.bin"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fileConfigMap2
+data:
+  app-init.ini: |
+    FOO=bar
+    BAR=baz
+binaryData:
+  app.bin: |
+    /2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbG
+    xv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hl
+    bGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2
+    hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv
+`,
+			},
+		},
+		"construct config map from literal": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalConfigMap1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: literalConfigMap1
+  labels:
+    foo: 'bar'
+data:
+  a: x
+  b: y
+  c: Hello World
+  d: "true"
+`,
+			},
+		},
+		"construct config map from literal with GeneratorOptions in ConfigMapArgs": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalConfigMap2",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"veggie": "celery",
+							"dog":    "beagle",
+							"cat":    "annoying",
+						},
+						Annotations: map[string]string{
+							"river": "Missouri",
+							"city":  "Iowa City",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: literalConfigMap2
+  labels:
+    cat: 'annoying'
+    dog: 'beagle'
+    veggie: 'celery'
+  annotations:
+    city: 'Iowa City'
+    river: 'Missouri'
+data:
+  a: x
+  b: y
+  c: Hello World
+  d: "true"
+`,
+			},
+		},
+	}
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=qwerty\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.bin"),
+		manyHellos(30))
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rn, err := MakeConfigMap(kvLdr, &tc.args)
+			if err != nil {
+				if !assert.EqualError(t, err, tc.exp.errMsg) {
+					t.FailNow()
+				}
+				return
+			}
+			if tc.exp.errMsg != "" {
+				t.Fatalf("%s: should return error '%s'", n, tc.exp.errMsg)
+			}
+			output := rn.MustString()
+			if !assert.Equal(t, tc.exp.out, output) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/internal/generators/secret.go

@@ -0,0 +1,58 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// MakeSecret makes a kubernetes Secret.
+//
+// Secret: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#secret-v1-core
+//
+// ConfigMaps and Secrets are similar.
+//
+// Like a ConfigMap, a Secret has a `data` field, but unlike a ConfigMap it has
+// no `binaryData` field.
+//
+// All of a Secret's data is assumed to be opaque in nature, and assumed to be
+// base64 encoded from its original representation, regardless of whether the
+// original data was UTF-8 text or binary.
+//
+// This encoding provides no secrecy. It's just a neutral, common means to
+// represent opaque text and binary data.  Beneath the base64 encoding
+// is presumably further encoding under control of the Secret's consumer.
+//
+// A Secret has string field `type` which holds an identifier, used by the
+// client, to choose the algorithm to interpret the `data` field.  Kubernetes
+// cannot make use of this data; it's up to a controller or some pod's service
+// to interpret the value, using `type` as a clue as to how to do this.
+func MakeSecret(
+	ldr ifc.KvLoader, args *types.SecretArgs) (rn *yaml.RNode, err error) {
+	rn, err = makeBaseNode("Secret", args.Name, args.Namespace)
+	if err != nil {
+		return nil, err
+	}
+	t := "Opaque"
+	if args.Type != "" {
+		t = args.Type
+	}
+	if _, err := rn.Pipe(
+		yaml.FieldSetter{
+			Name:  "type",
+			Value: yaml.NewStringRNode(t)}); err != nil {
+		return nil, err
+	}
+	m, err := makeValidatedDataMap(ldr, args.Name, args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	if err = rn.LoadMapIntoSecretData(m); err != nil {
+		return nil, err
+	}
+	copyLabelsAndAnnotations(rn, args.Options)
+	return rn, nil
+}

api/internal/generators/secret_test.go

@@ -0,0 +1,231 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filesys"
+	. "sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestMakeSecret(t *testing.T) {
+	type expected struct {
+		out    string
+		errMsg string
+	}
+
+	testCases := map[string]struct {
+		args types.SecretArgs
+		exp  expected
+	}{
+		"construct secret from env": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envSecret",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("secret", "app.env"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: envSecret
+type: Opaque
+data:
+  DB_PASSWORD: cXdlcnR5
+  DB_USERNAME: YWRtaW4=
+`,
+			},
+		},
+		"construct secret from text file": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileSecret1",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("secret", "app-init.ini"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: fileSecret1
+type: Opaque
+data:
+  app-init.ini: Rk9PPWJhcgpCQVI9YmF6Cg==
+`,
+			},
+		},
+		"construct secret from text and binary file": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileSecret2",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("secret", "app-init.ini"),
+							filepath.Join("secret", "app.bin"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: fileSecret2
+type: Opaque
+data:
+  app-init.ini: Rk9PPWJhcgpCQVI9YmF6Cg==
+  app.bin: //0=
+`,
+			},
+		},
+		"construct secret from literal": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret1
+  labels:
+    foo: 'bar'
+type: Opaque
+data:
+  a: eA==
+  b: eQ==
+  c: SGVsbG8gV29ybGQ=
+  d: dHJ1ZQ==
+`,
+			},
+		},
+		"construct secret with type": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+				Type: "foobar",
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret1
+  labels:
+    foo: 'bar'
+type: foobar
+data:
+  a: eA==
+`,
+			},
+		},
+		"construct secret from literal with GeneratorOptions in SecretArgs": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret2",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"veggie": "celery",
+							"dog":    "beagle",
+							"cat":    "annoying",
+						},
+						Annotations: map[string]string{
+							"river": "Missouri",
+							"city":  "Iowa City",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret2
+  labels:
+    cat: 'annoying'
+    dog: 'beagle'
+    veggie: 'celery'
+  annotations:
+    city: 'Iowa City'
+    river: 'Missouri'
+type: Opaque
+data:
+  a: eA==
+  b: eQ==
+  c: SGVsbG8gV29ybGQ=
+  d: dHJ1ZQ==
+`,
+			},
+		},
+	}
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=qwerty\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app.bin"),
+		[]byte{0xff, 0xfd})
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rn, err := MakeSecret(kvLdr, &tc.args)
+			if err != nil {
+				if !assert.EqualError(t, err, tc.exp.errMsg) {
+					t.FailNow()
+				}
+				return
+			}
+			if tc.exp.errMsg != "" {
+				t.Fatalf("%s: should return error '%s'", n, tc.exp.errMsg)
+			}
+			output := rn.MustString()
+			if !assert.Equal(t, tc.exp.out, output) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/internal/generators/utils.go

@@ -0,0 +1,78 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"fmt"
+
+	"github.com/go-errors/errors"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func makeBaseNode(kind, name, namespace string) (*yaml.RNode, error) {
+	rn, err := yaml.Parse(fmt.Sprintf(`
+apiVersion: v1
+kind: %s
+`, kind))
+	if err != nil {
+		return nil, err
+	}
+	if name == "" {
+		return nil, errors.Errorf("a configmap must have a name")
+	}
+	if _, err := rn.Pipe(yaml.SetK8sName(name)); err != nil {
+		return nil, err
+	}
+	if namespace != "" {
+		if _, err := rn.Pipe(yaml.SetK8sNamespace(namespace)); err != nil {
+			return nil, err
+		}
+	}
+	return rn, nil
+}
+
+func makeValidatedDataMap(
+	ldr ifc.KvLoader, name string, sources types.KvPairSources) (map[string]string, error) {
+	pairs, err := ldr.Load(sources)
+	if err != nil {
+		return nil, errors.WrapPrefix(err, "loading KV pairs", 0)
+	}
+	knownKeys := make(map[string]string)
+	for _, p := range pairs {
+		// legal key: alphanumeric characters, '-', '_' or '.'
+		if err := ldr.Validator().ErrIfInvalidKey(p.Key); err != nil {
+			return nil, err
+		}
+		if _, ok := knownKeys[p.Key]; ok {
+			return nil, errors.Errorf(
+				"configmap %s illegally repeats the key `%s`", name, p.Key)
+		}
+		knownKeys[p.Key] = p.Value
+	}
+	return knownKeys, nil
+}
+
+// copyLabelsAndAnnotations copies labels and annotations from
+// GeneratorOptions into the given object.
+func copyLabelsAndAnnotations(
+	rn *yaml.RNode, opts *types.GeneratorOptions) error {
+	if opts == nil {
+		return nil
+	}
+	for _, k := range yaml.SortedMapKeys(opts.Labels) {
+		v := opts.Labels[k]
+		if _, err := rn.Pipe(yaml.SetLabel(k, v)); err != nil {
+			return err
+		}
+	}
+	for _, k := range yaml.SortedMapKeys(opts.Annotations) {
+		v := opts.Annotations[k]
+		if _, err := rn.Pipe(yaml.SetAnnotation(k, v)); err != nil {
+			return err
+		}
+	}
+	return nil
+}

api/internal/git/cloner.go

@@ -4,10 +4,6 @@
 package git
 
 import (
-	"log"
-	"os/exec"
-
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filesys"
 )
 
@@ -18,70 +14,29 @@ type Cloner func(repoSpec *RepoSpec) error
 // to say, some remote API, to obtain a local clone of
 // a remote repo.
 func ClonerUsingGitExec(repoSpec *RepoSpec) error {
-	gitProgram, err := exec.LookPath("git")
-	if err != nil {
-		return errors.Wrap(err, "no 'git' program on path")
-	}
-	repoSpec.Dir, err = filesys.NewTmpConfirmedDir()
+	r, err := newCmdRunner()
 	if err != nil {
 		return err
 	}
-
-	cmd := exec.Command(
-		gitProgram,
-		"clone",
-		"--depth=1",
-		repoSpec.CloneSpec(),
-		repoSpec.Dir.String())
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error cloning git repo: %s", out)
-		return errors.Wrapf(
-			err,
-			"trouble cloning git repo %v in %s",
-			repoSpec.CloneSpec(), repoSpec.Dir.String())
+	repoSpec.Dir = r.dir
+	if err = r.run("init"); err != nil {
+		return err
 	}
-
+	if err = r.run(
+		"remote", "add", "origin", repoSpec.CloneSpec()); err != nil {
+		return err
+	}
+	ref := "HEAD"
 	if repoSpec.Ref != "" {
-		cmd = exec.Command(
-			gitProgram,
-			"fetch",
-			"--depth=1",
-			"origin",
-			repoSpec.Ref)
-		cmd.Dir = repoSpec.Dir.String()
-		out, err = cmd.CombinedOutput()
-		if err != nil {
-			log.Printf("Error fetching ref: %s", out)
-			return errors.Wrapf(err, "trouble fetching %s", repoSpec.Ref)
-		}
-
-		cmd = exec.Command(
-			gitProgram,
-			"checkout",
-			"FETCH_HEAD")
-		cmd.Dir = repoSpec.Dir.String()
-		out, err = cmd.CombinedOutput()
-		if err != nil {
-			log.Printf("Error checking out ref: %s", out)
-			return errors.Wrapf(err, "trouble checking out %s", repoSpec.Ref)
-		}
+		ref = repoSpec.Ref
 	}
-
-	cmd = exec.Command(
-		gitProgram,
-		"submodule",
-		"update",
-		"--init",
-		"--recursive")
-	cmd.Dir = repoSpec.Dir.String()
-	out, err = cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error fetching submodules: %s", out)
-		return errors.Wrapf(err, "trouble fetching submodules for %s", repoSpec.CloneSpec())
+	if err = r.run("fetch", "--depth=1", "origin", ref); err != nil {
+		return err
 	}
-
-	return nil
+	if err = r.run("checkout", "FETCH_HEAD"); err != nil {
+		return err
+	}
+	return r.run("submodule", "update", "--init", "--recursive")
 }
 
 // DoNothingCloner returns a cloner that only sets

api/internal/git/gitrunner.go

@@ -0,0 +1,58 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"os/exec"
+	"time"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+// Arbitrary, but non-infinite, timeout for running commands.
+const defaultDuration = 27 * time.Second
+
+// gitRunner runs the external git binary.
+type gitRunner struct {
+	gitProgram string
+	duration   time.Duration
+	dir        filesys.ConfirmedDir
+}
+
+// newCmdRunner returns a gitRunner if it can find the binary.
+// It also creats a temp directory for cloning repos.
+func newCmdRunner() (*gitRunner, error) {
+	gitProgram, err := exec.LookPath("git")
+	if err != nil {
+		return nil, errors.Wrap(err, "no 'git' program on path")
+	}
+	dir, err := filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return nil, err
+	}
+	return &gitRunner{
+		gitProgram: gitProgram,
+		duration:   defaultDuration,
+		dir:        dir,
+	}, nil
+}
+
+// run a command with a timeout.
+func (r gitRunner) run(args ...string) error {
+	//nolint: gosec
+	cmd := exec.Command(r.gitProgram, args...)
+	cmd.Dir = r.dir.String()
+	return utils.TimedCall(
+		cmd.String(),
+		r.duration,
+		func() error {
+			_, err := cmd.CombinedOutput()
+			if err != nil {
+				return errors.Wrapf(err, "git cmd = '%s'", cmd.String())
+			}
+			return err
+		})
+}

api/internal/k8sdeps/conflict/conflictdetectorjson.go

@@ -0,0 +1,43 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"encoding/json"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// conflictDetectorJson detects conflicts in a list of JSON patches.
+type conflictDetectorJson struct {
+	resourceFactory *resource.Factory
+}
+
+var _ resource.ConflictDetector = &conflictDetectorJson{}
+
+func (cd *conflictDetectorJson) HasConflict(
+	p1, p2 *resource.Resource) (bool, error) {
+	return mergepatch.HasConflicts(p1.Map(), p2.Map())
+}
+
+func (cd *conflictDetectorJson) MergePatches(
+	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	baseBytes, err := json.Marshal(patch1.Map())
+	if err != nil {
+		return nil, err
+	}
+	patchBytes, err := json.Marshal(patch2.Map())
+	if err != nil {
+		return nil, err
+	}
+	mergedBytes, err := jsonpatch.MergeMergePatches(baseBytes, patchBytes)
+	if err != nil {
+		return nil, err
+	}
+	mergedMap := make(map[string]interface{})
+	err = json.Unmarshal(mergedBytes, &mergedMap)
+	return cd.resourceFactory.FromMap(mergedMap), err
+}

api/internal/k8sdeps/conflict/conflictdetectorsm.go

@@ -0,0 +1,65 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// conflictDetectorSm detects conflicts in a list of strategic merge patches.
+type conflictDetectorSm struct {
+	lookupPatchMeta strategicpatch.LookupPatchMeta
+	resourceFactory *resource.Factory
+}
+
+var _ resource.ConflictDetector = &conflictDetectorSm{}
+
+func (cd *conflictDetectorSm) HasConflict(
+	p1, p2 *resource.Resource) (bool, error) {
+	return strategicpatch.MergingMapsHaveConflicts(
+		p1.Map(), p2.Map(), cd.lookupPatchMeta)
+}
+
+func (cd *conflictDetectorSm) MergePatches(
+	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	if cd.hasDeleteDirectiveMarker(patch2.Map()) {
+		if cd.hasDeleteDirectiveMarker(patch1.Map()) {
+			return nil, fmt.Errorf(
+				"cannot merge patches both containing '$patch: delete' directives")
+		}
+		patch1, patch2 = patch2, patch1
+	}
+	mergedMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
+		cd.lookupPatchMeta, patch1.Map(), patch2.Map())
+	return cd.resourceFactory.FromMap(mergedMap), err
+}
+
+func (cd *conflictDetectorSm) hasDeleteDirectiveMarker(
+	patch map[string]interface{}) bool {
+	if v, ok := patch["$patch"]; ok && v == "delete" {
+		return true
+	}
+	for _, v := range patch {
+		switch typedV := v.(type) {
+		case map[string]interface{}:
+			if cd.hasDeleteDirectiveMarker(typedV) {
+				return true
+			}
+		case []interface{}:
+			for _, sv := range typedV {
+				typedE, ok := sv.(map[string]interface{})
+				if !ok {
+					break
+				}
+				if cd.hasDeleteDirectiveMarker(typedE) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}

api/internal/k8sdeps/conflict/factory.go

@@ -0,0 +1,45 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	sp "k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+type cdFactory struct {
+	rf *resource.Factory
+}
+
+var _ resource.ConflictDetectorFactory = &cdFactory{}
+
+// NewFactory returns a conflict detector factory.
+// The detector uses a resource factory to convert resources to/from
+// json/yaml/maps representations.
+func NewFactory(rf *resource.Factory) resource.ConflictDetectorFactory {
+	return &cdFactory{rf: rf}
+}
+
+// New returns a conflict detector that's aware of the GVK type.
+func (f *cdFactory) New(gvk resid.Gvk) (resource.ConflictDetector, error) {
+	// Convert to apimachinery representation of object
+	obj, err := scheme.Scheme.New(schema.GroupVersionKind{
+		Group:   gvk.Group,
+		Version: gvk.Version,
+		Kind:    gvk.Kind,
+	})
+	if err == nil {
+		meta, err := sp.NewPatchMetaFromStruct(obj)
+		return &conflictDetectorSm{
+			lookupPatchMeta: meta, resourceFactory: f.rf}, err
+	}
+	if runtime.IsNotRegisteredError(err) {
+		return &conflictDetectorJson{resourceFactory: f.rf}, nil
+	}
+	return nil, err
+}

api/internal/k8sdeps/merge/merginator.go

@@ -1,239 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package merge
-
-import (
-	"encoding/json"
-	"fmt"
-
-	jsonpatch "github.com/evanphx/json-patch"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/util/mergepatch"
-	"k8s.io/apimachinery/pkg/util/strategicpatch"
-	"k8s.io/client-go/kubernetes/scheme"
-	"sigs.k8s.io/kustomize/api/resid"
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-type conflictDetector interface {
-	hasConflict(patch1, patch2 *resource.Resource) (bool, error)
-	findConflict(
-		conflictingPatchIdx int,
-		patches []*resource.Resource) (*resource.Resource, error)
-	mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error)
-}
-
-type jsonMergePatch struct {
-	resourceFactory *resource.Factory
-}
-
-var _ conflictDetector = &jsonMergePatch{}
-
-func newJMPConflictDetector(rf *resource.Factory) conflictDetector {
-	return &jsonMergePatch{resourceFactory: rf}
-}
-
-func (jmp *jsonMergePatch) hasConflict(
-	patch1, patch2 *resource.Resource) (bool, error) {
-	return mergepatch.HasConflicts(patch1.Map(), patch2.Map())
-}
-
-func (jmp *jsonMergePatch) findConflict(
-	conflictingPatchIdx int,
-	patches []*resource.Resource) (*resource.Resource, error) {
-	for i, patch := range patches {
-		if i == conflictingPatchIdx {
-			continue
-		}
-		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
-			continue
-		}
-		conflict, err := mergepatch.HasConflicts(
-			patch.Map(),
-			patches[conflictingPatchIdx].Map())
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			return patch, nil
-		}
-	}
-	return nil, nil
-}
-
-func (jmp *jsonMergePatch) mergePatches(
-	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
-	baseBytes, err := json.Marshal(patch1.Map())
-	if err != nil {
-		return nil, err
-	}
-	patchBytes, err := json.Marshal(patch2.Map())
-	if err != nil {
-		return nil, err
-	}
-	mergedBytes, err := jsonpatch.MergeMergePatches(baseBytes, patchBytes)
-	if err != nil {
-		return nil, err
-	}
-	mergedMap := make(map[string]interface{})
-	err = json.Unmarshal(mergedBytes, &mergedMap)
-	return jmp.resourceFactory.FromMap(mergedMap), err
-}
-
-type strategicMergePatch struct {
-	lookupPatchMeta strategicpatch.LookupPatchMeta
-	rf              *resource.Factory
-}
-
-var _ conflictDetector = &strategicMergePatch{}
-
-func newSMPConflictDetector(
-	versionedObj runtime.Object,
-	rf *resource.Factory) (conflictDetector, error) {
-	lookupPatchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObj)
-	return &strategicMergePatch{lookupPatchMeta: lookupPatchMeta, rf: rf}, err
-}
-
-func (smp *strategicMergePatch) hasConflict(
-	p1, p2 *resource.Resource) (bool, error) {
-	return strategicpatch.MergingMapsHaveConflicts(
-		p1.Map(), p2.Map(), smp.lookupPatchMeta)
-}
-
-func (smp *strategicMergePatch) findConflict(
-	conflictingPatchIdx int,
-	patches []*resource.Resource) (*resource.Resource, error) {
-	for i, patch := range patches {
-		if i == conflictingPatchIdx {
-			continue
-		}
-		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
-			continue
-		}
-		conflict, err := strategicpatch.MergingMapsHaveConflicts(
-			patch.Map(),
-			patches[conflictingPatchIdx].Map(),
-			smp.lookupPatchMeta)
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			return patch, nil
-		}
-	}
-	return nil, nil
-}
-
-func (smp *strategicMergePatch) mergePatches(
-	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
-	if hasDeleteDirectiveMarker(patch2.Map()) {
-		if hasDeleteDirectiveMarker(patch1.Map()) {
-			return nil, fmt.Errorf(
-				"cannot merge patches both containing '$patch: delete' directives")
-		}
-		patch1, patch2 = patch2, patch1
-	}
-	mergeJSONMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
-		smp.lookupPatchMeta, patch1.Map(), patch2.Map())
-	return smp.rf.FromMap(mergeJSONMap), err
-}
-
-type merginatorImpl struct {
-	rf *resource.Factory
-}
-
-// NewMerginator returns a new implementation of resmap.Merginator.
-func NewMerginator(rf *resource.Factory) resmap.Merginator {
-	return &merginatorImpl{rf: rf}
-}
-
-var _ resmap.Merginator = (*merginatorImpl)(nil)
-
-// Merge merges the incoming resources into a new resmap.ResMap.
-// Returns an error on conflict.
-func (m *merginatorImpl) Merge(
-	patches []*resource.Resource) (resmap.ResMap, error) {
-	rc := resmap.New()
-	for ix, patch := range patches {
-		id := patch.OrgId()
-		existing := rc.GetMatchingResourcesByOriginalId(id.Equals)
-		if len(existing) == 0 {
-			rc.Append(patch)
-			continue
-		}
-		if len(existing) > 1 {
-			return nil, fmt.Errorf("self conflict in patches")
-		}
-
-		versionedObj, err := scheme.Scheme.New(toSchemaGvk(id.Gvk))
-		if err != nil && !runtime.IsNotRegisteredError(err) {
-			return nil, err
-		}
-		var cd conflictDetector
-		if err != nil {
-			cd = newJMPConflictDetector(m.rf)
-		} else {
-			cd, err = newSMPConflictDetector(versionedObj, m.rf)
-			if err != nil {
-				return nil, err
-			}
-		}
-
-		conflict, err := cd.hasConflict(existing[0], patch)
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			conflictingPatch, err := cd.findConflict(ix, patches)
-			if err != nil {
-				return nil, err
-			}
-			return nil, fmt.Errorf(
-				"conflict between %#v and %#v",
-				conflictingPatch.Map(), patch.Map())
-		}
-		merged, err := cd.mergePatches(existing[0], patch)
-		if err != nil {
-			return nil, err
-		}
-		rc.Replace(merged)
-	}
-	return rc, nil
-}
-
-// toSchemaGvk converts to a schema.GroupVersionKind.
-func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
-	return schema.GroupVersionKind{
-		Group:   x.Group,
-		Version: x.Version,
-		Kind:    x.Kind,
-	}
-}
-
-func hasDeleteDirectiveMarker(patch map[string]interface{}) bool {
-	if v, ok := patch["$patch"]; ok && v == "delete" {
-		return true
-	}
-	for _, v := range patch {
-		switch typedV := v.(type) {
-		case map[string]interface{}:
-			if hasDeleteDirectiveMarker(typedV) {
-				return true
-			}
-		case []interface{}:
-			for _, sv := range typedV {
-				typedE, ok := sv.(map[string]interface{})
-				if !ok {
-					break
-				}
-				if hasDeleteDirectiveMarker(typedE) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}

api/internal/merge/merginator.go

@@ -1,25 +0,0 @@
-// Copyright 2020 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package merge
-
-import (
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-// Merginator implements resmap.Merginator using kyaml libs.
-type Merginator struct {
-}
-
-var _ resmap.Merginator = (*Merginator)(nil)
-
-func NewMerginator(_ *resource.Factory) *Merginator {
-	return &Merginator{}
-}
-
-// Merge implements resmap.Merginator
-func (m Merginator) Merge(
-	resources []*resource.Resource) (resmap.ResMap, error) {
-	panic("TODO(#Merginator): implement Merge")
-}

api/internal/merge/merginator_test.go

@@ -1,4 +0,0 @@
-// Copyright 2020 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package merge_test

api/internal/plugins/builtinconfig/namebackreferences.go

@@ -10,8 +10,8 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-// NameBackReferences is an association between a gvk.GVK and a list
-// of FieldSpec instances that could refer to it.
+// NameBackReferences is an association between a gvk.GVK (a ReferralTarget)
+// and a list of Referrers that could refer to it.
 //
 // It is used to handle name changes, and can be thought of as a
 // a contact list.  If you change your own contact info (name,
@@ -19,16 +19,20 @@ import (
 // know about the change.
 //
 // For example, ConfigMaps can be used by Pods and everything that
-// contains a Pod; Deployment, Job, StatefulSet, etc.  To change
-// the name of a ConfigMap instance from 'alice' to 'bob', one
-// must visit all objects that could refer to the ConfigMap, see if
-// they mention 'alice', and if so, change the reference to 'bob'.
+// contains a Pod; Deployment, Job, StatefulSet, etc.
+// The ConfigMap is the ReferralTarget, the others are Referrers.
+//
+// If the the name of a ConfigMap instance changed from 'alice' to 'bob',
+// one must
+//  - visit all objects that could refer to the ConfigMap (the Referrers)
+//  - see if they mention 'alice',
+//  - if so, change the Referrer's name reference to 'bob'.
 //
 // The NameBackReferences instance to aid in this could look like
 //   {
 //     kind: ConfigMap
 //     version: v1
-//     FieldSpecs:
+//     fieldSpecs:
 //     - kind: Pod
 //       version: v1
 //       path: spec/volumes/configMap/name
@@ -39,13 +43,15 @@ import (
 //       (etc.)
 //   }
 type NameBackReferences struct {
-	resid.Gvk  `json:",inline,omitempty" yaml:",inline,omitempty"`
-	FieldSpecs types.FsSlice `json:"FieldSpecs,omitempty" yaml:"FieldSpecs,omitempty"`
+	resid.Gvk `json:",inline,omitempty" yaml:",inline,omitempty"`
+	// TODO: rename json 'fieldSpecs' to 'referrers' for clarity.
+	// This will, however, break anyone using a custom config.
+	Referrers types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
 func (n NameBackReferences) String() string {
 	var r []string
-	for _, f := range n.FieldSpecs {
+	for _, f := range n.Referrers {
 		r = append(r, f.String())
 	}
 	return n.Gvk.String() + ":  (\n" +
@@ -77,7 +83,7 @@ func (s nbrSlice) mergeOne(other NameBackReferences) (nbrSlice, error) {
 	found := false
 	for _, c := range s {
 		if c.Gvk.Equals(other.Gvk) {
-			c.FieldSpecs, err = c.FieldSpecs.MergeAll(other.FieldSpecs)
+			c.Referrers, err = c.Referrers.MergeAll(other.Referrers)
 			if err != nil {
 				return nil, err
 			}

api/internal/plugins/builtinconfig/namebackreferences_test.go

@@ -50,13 +50,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	nbrsSlice2 := nbrSlice{
@@ -64,13 +64,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	expected := nbrSlice{
@@ -78,13 +78,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	actual, err := nbrsSlice1.mergeAll(nbrsSlice2)

api/internal/plugins/builtinconfig/transformerconfig_test.go

@@ -24,7 +24,7 @@ func TestAddNamereferenceFieldSpec(t *testing.T) {
 		Gvk: resid.Gvk{
 			Kind: "KindA",
 		},
-		FieldSpecs: []types.FieldSpec{
+		Referrers: []types.FieldSpec{
 			{
 				Gvk: resid.Gvk{
 					Kind: "KindB",
@@ -89,7 +89,7 @@ func TestMerge(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
 					Gvk: resid.Gvk{
 						Kind: "KindB",
@@ -103,7 +103,7 @@ func TestMerge(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
 					Gvk: resid.Gvk{
 						Kind: "KindC",

api/internal/plugins/execplugin/execplugin_test.go

@@ -13,12 +13,10 @@ import (
 	. "sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 )
 
 func TestExecPluginConfig(t *testing.T) {
@@ -33,10 +31,9 @@ s/$BAR/bar baz/g
 	if err != nil {
 		t.Fatal(err)
 	}
+	pvd := provider.NewDefaultDepProvider()
 	rf := resmap.NewFactory(
-		resource.NewFactory(
-			kunstruct.NewKunstructuredFactoryImpl()), nil)
-	v := valtest_test.MakeFakeValidator()
+		pvd.GetResourceFactory(), pvd.GetConflictDetectorFactory())
 	pluginConfig := rf.RF().FromMap(
 		map[string]interface{}{
 			"apiVersion": "someteam.example.com/v1",
@@ -48,6 +45,7 @@ s/$BAR/bar baz/g
 			"argsFromFile": "sed-input.txt",
 		})
 
+	pluginConfig.RemoveBuildAnnotations()
 	p := NewExecPlugin(
 		pLdr.AbsolutePluginPath(
 			konfig.DisabledPluginConfig(),
@@ -62,7 +60,7 @@ s/$BAR/bar baz/g
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	p.Config(resmap.NewPluginHelpers(ldr, v, rf), yaml)
+	p.Config(resmap.NewPluginHelpers(ldr, pvd.GetFieldValidator(), rf), yaml)
 
 	expected := "someteam.example.com/v1/sedtransformer/SedTransformer"
 	if !strings.HasSuffix(p.Path(), expected) {

api/internal/plugins/loader/loader_test.go

@@ -8,11 +8,10 @@ import (
 
 	"sigs.k8s.io/kustomize/api/filesys"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/loader"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
@@ -51,8 +50,9 @@ func TestLoader(t *testing.T) {
 		BuildGoPlugin("builtin", "", "SecretGenerator").
 		BuildGoPlugin("someteam.example.com", "v1", "SomeServiceGenerator")
 	defer th.Reset()
-	rmF := resmap.NewFactory(resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl()), nil)
+	p := provider.NewDefaultDepProvider()
+	rmF := resmap.NewFactory(
+		p.GetResourceFactory(), p.GetConflictDetectorFactory())
 	fLdr, err := loader.NewLoader(
 		loader.RestrictionRootOnly,
 		filesys.Separator, filesys.MakeFsInMemory())

api/internal/plugins/utils/utils.go

@@ -4,6 +4,7 @@
 package utils
 
 import (
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,8 +14,8 @@ import (
 
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/konfig"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 )
@@ -135,9 +136,6 @@ func GetResMapWithIDAnnotation(rm resmap.ResMap) (resmap.ResMap, error) {
 			return nil, err
 		}
 		annotations := r.GetAnnotations()
-		if annotations == nil {
-			annotations = make(map[string]string)
-		}
 		annotations[idAnnotation] = string(idString)
 		r.SetAnnotations(annotations)
 	}
@@ -147,41 +145,65 @@ func GetResMapWithIDAnnotation(rm resmap.ResMap) (resmap.ResMap, error) {
 // UpdateResMapValues updates the Resource value in the given ResMap
 // with the emitted Resource values in output.
 func UpdateResMapValues(pluginName string, h *resmap.PluginHelpers, output []byte, rm resmap.ResMap) error {
-	outputRM, err := h.ResmapFactory().NewResMapFromBytes(output)
+	mapFactory := h.ResmapFactory()
+	resFactory := mapFactory.RF()
+	resources, err := resFactory.SliceFromBytes(output)
 	if err != nil {
 		return err
 	}
-	for _, r := range outputRM.Resources() {
-		// for each emitted Resource, find the matching Resource in the original ResMap
-		// using its id
-		annotations := r.GetAnnotations()
-		idString, ok := annotations[idAnnotation]
-		if !ok {
-			return fmt.Errorf("the transformer %s should not remove annotation %s",
-				pluginName, idAnnotation)
+	// Don't use resources here, or error message will be unfriendly to plugin builders
+	newMap, err := mapFactory.NewResMapFromBytes([]byte{})
+	if err != nil {
+		return err
+	}
+
+	for _, r := range resources {
+		removeIDAnnotation(r) // stale--not manipulated by plugin transformers
+
+		// Add to the new map, checking for duplicates
+		if err := newMap.Append(r); err != nil {
+			prettyID, err := json.Marshal(r.CurId())
+			if err != nil {
+				prettyID = []byte(r.CurId().String())
+			}
+			return fmt.Errorf("plugin %s generated duplicate resource: %s", pluginName, prettyID)
 		}
-		id := resid.ResId{}
-		err := yaml.Unmarshal([]byte(idString), &id)
+
+		// Add to or update the old map
+		oldIdx, err := rm.GetIndexOfCurrentId(r.CurId())
 		if err != nil {
 			return err
 		}
-		res, err := rm.GetByCurrentId(id)
-		if err != nil {
-			return fmt.Errorf("unable to find unique match to %s", id.String())
+		if oldIdx != -1 {
+			rm.GetByIndex(oldIdx).ResetPrimaryData(r)
+		} else {
+			if err := rm.Append(r); err != nil {
+				return err
+			}
 		}
-		// remove the annotation set by Kustomize to track the resource
-		delete(annotations, idAnnotation)
-		if len(annotations) == 0 {
-			annotations = nil
-		}
-		r.SetAnnotations(annotations)
-
-		// update the resource value with the transformed object
-		res.ResetPrimaryData(r)
 	}
+
+	// Remove items the transformer deleted from the old map
+	for _, id := range rm.AllIds() {
+		newIdx, _ := newMap.GetIndexOfCurrentId(id)
+		if newIdx == -1 {
+			rm.Remove(id)
+		}
+	}
+
 	return nil
 }
 
+func removeIDAnnotation(r *resource.Resource) {
+	// remove the annotation set by Kustomize to track the resource
+	annotations := r.GetAnnotations()
+	delete(annotations, idAnnotation)
+	if len(annotations) == 0 {
+		annotations = nil
+	}
+	r.SetAnnotations(annotations)
+}
+
 // UpdateResourceOptions updates the generator options for each resource in the
 // given ResMap based on plugin provided annotations.
 func UpdateResourceOptions(rm resmap.ResMap) (resmap.ResMap, error) {

api/internal/plugins/utils/utils_test.go

@@ -9,9 +9,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
@@ -64,7 +65,7 @@ func strptr(s string) *string {
 }
 
 func TestUpdateResourceOptions(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	in := resmap.New()
 	expected := resmap.New()
 	cases := []struct {
@@ -87,28 +88,12 @@ func TestUpdateResourceOptions(t *testing.T) {
 		expected.Append(makeConfigMapOptions(rf, name, c.behavior, !c.needsHash))
 	}
 	actual, err := UpdateResourceOptions(in)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err.Error())
-	}
-	for i, a := range expected.Resources() {
-		b := actual.GetByIndex(i)
-		if b == nil {
-			t.Fatalf("resource %d missing from processed map", i)
-		}
-		if !a.Equals(b) {
-			t.Errorf("expected %v got %v", a, b)
-		}
-		if a.NeedHashSuffix() != b.NeedHashSuffix() {
-			t.Errorf("")
-		}
-		if a.Behavior() != b.Behavior() {
-			t.Errorf("expected %v got %v", a.Behavior(), b.Behavior())
-		}
-	}
+	assert.NoError(t, err)
+	assert.NoError(t, expected.ErrorIfNotEqualLists(actual))
 }
 
 func TestUpdateResourceOptionsWithInvalidHashAnnotationValues(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	cases := []string{
 		"",
 		"FaLsE",

api/internal/target/kusttarget.go

@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/yaml"
 )
 
@@ -235,7 +236,18 @@ func (kt *KustTarget) runGenerators(
 
 func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error) {
 	ra := accumulator.MakeEmptyAccumulator()
-	ra, err := kt.accumulateResources(ra, kt.kustomization.Generators)
+	var generatorPaths []string
+	for _, p := range kt.kustomization.Generators {
+		// handle inline generators
+		rm, err := kt.rFactory.NewResMapFromBytes([]byte(p))
+		if err != nil {
+			// not an inline config
+			generatorPaths = append(generatorPaths, p)
+			continue
+		}
+		ra.AppendAll(rm)
+	}
+	ra, err := kt.accumulateResources(ra, generatorPaths)
 	if err != nil {
 		return nil, err
 	}
@@ -260,7 +272,18 @@ func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
 
 func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]resmap.Transformer, error) {
 	ra := accumulator.MakeEmptyAccumulator()
-	ra, err := kt.accumulateResources(ra, transformers)
+	var transformerPaths []string
+	for _, p := range transformers {
+		// handle inline transformers
+		rm, err := kt.rFactory.NewResMapFromBytes([]byte(p))
+		if err != nil {
+			// not an inline config
+			transformerPaths = append(transformerPaths, p)
+			continue
+		}
+		ra.AppendAll(rm)
+	}
+	ra, err := kt.accumulateResources(ra, transformerPaths)
 
 	if err != nil {
 		return nil, err
@@ -360,6 +383,11 @@ func (kt *KustTarget) accumulateDirectory(
 		return nil, errors.Wrapf(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
+	err = openapi.SetSchemaVersion(subKt.Kustomization().OpenAPI, false)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "couldn't set openapi version for path '%s'", ldr.Root())
+	}
 	if isComponent && subKt.kustomization.Kind != types.ComponentKind {
 		return nil, fmt.Errorf(
 			"expected kind '%s' for path '%s' but got '%s'", types.ComponentKind, ldr.Root(), subKt.kustomization.Kind)

api/internal/target/kusttarget_configplugin.go

@@ -183,8 +183,7 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			return
 		}
 		var c struct {
-			Paths   []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
-			Patches string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
+			Paths []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 		}
 		c.Paths = kt.kustomization.PatchesStrategicMerge
 		p := f()

api/internal/target/kusttarget_test.go

@@ -8,9 +8,10 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/ifc"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -76,8 +77,7 @@ commonLabels:
 	}
 
 	kt := makeKustTargetWithRf(
-		t, th.GetFSys(), "/",
-		resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl()))
+		t, th.GetFSys(), "/", provider.NewDefaultDepProvider())
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
 			th.WriteK("/", tc.content)
@@ -148,7 +148,8 @@ metadata:
     {"op": "add", "path": "/spec/replica", "value": "3"}
 ]`)
 
-	resFactory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	pvd := provider.NewDefaultDepProvider()
+	resFactory := pvd.GetResourceFactory()
 
 	resources := []*resource.Resource{
 		resFactory.FromMapWithName("dply1", map[string]interface{}{
@@ -243,19 +244,16 @@ metadata:
 			t.Fatalf("unexpected error %v", err)
 		}
 	}
+	expected.RemoveBuildAnnotations()
+	expYaml, err := expected.AsYaml()
+	assert.NoError(t, err)
 
-	kt := makeKustTargetWithRf(
-		t, th.GetFSys(), "/whatever", resFactory)
-	err := kt.Load()
-	if err != nil {
-		t.Fatalf("unexpected Resources error %v", err)
-	}
+	kt := makeKustTargetWithRf(t, th.GetFSys(), "/whatever", pvd)
+	assert.NoError(t, kt.Load())
 	actual, err := kt.MakeCustomizedResMap()
-	if err != nil {
-		t.Fatalf("unexpected Resources error %v", err)
-	}
-
-	if err = expected.ErrorIfNotEqualLists(actual); err != nil {
-		t.Fatalf("unexpected inequality: %v", err)
-	}
+	assert.NoError(t, err)
+	actual.RemoveBuildAnnotations()
+	actYaml, err := actual.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, expYaml, actYaml)
 }

api/internal/target/maker_test.go

@@ -7,14 +7,12 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/internal/k8sdeps/merge"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 )
 
@@ -22,9 +20,7 @@ func makeAndLoadKustTarget(
 	t *testing.T,
 	fSys filesys.FileSystem,
 	root string) *target.KustTarget {
-	kt := makeKustTargetWithRf(
-		t, fSys, root,
-		resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl()))
+	kt := makeKustTargetWithRf(t, fSys, root, provider.NewDefaultDepProvider())
 	if err := kt.Load(); err != nil {
 		t.Fatalf("Unexpected load error %v", err)
 	}
@@ -35,13 +31,13 @@ func makeKustTargetWithRf(
 	t *testing.T,
 	fSys filesys.FileSystem,
 	root string,
-	resourceFactory *resource.Factory) *target.KustTarget {
+	pvd *provider.DepProvider) *target.KustTarget {
 	ldr, err := fLdr.NewLoader(fLdr.RestrictionRootOnly, root, fSys)
 	if err != nil {
 		t.Fatal(err)
 	}
 	rf := resmap.NewFactory(
-		resourceFactory, merge.NewMerginator(resourceFactory))
+		pvd.GetResourceFactory(), pvd.GetConflictDetectorFactory())
 	pc := konfig.DisabledPluginConfig()
 	return target.NewKustTarget(
 		ldr,

api/internal/utils/errtimeout.go

@@ -0,0 +1,36 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+type errTimeOut struct {
+	duration time.Duration
+	cmd      string
+}
+
+func NewErrTimeOut(d time.Duration, c string) errTimeOut {
+	return errTimeOut{duration: d, cmd: c}
+}
+
+func (e errTimeOut) Error() string {
+	return fmt.Sprintf("hit %s timeout running '%s'", e.duration, e.cmd)
+}
+
+func IsErrTimeout(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(errTimeOut)
+	if ok {
+		return true
+	}
+	_, ok = errors.Cause(err).(errTimeOut)
+	return ok
+}

api/internal/utils/pathsplitter.go

@@ -0,0 +1,22 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import "strings"
+
+// PathSplitter splits a slash delimited string, permitting escaped slashes.
+func PathSplitter(path string) []string {
+	ps := strings.Split(path, "/")
+	var res []string
+	res = append(res, ps[0])
+	for i := 1; i < len(ps); i++ {
+		last := len(res) - 1
+		if strings.HasSuffix(res[last], `\`) {
+			res[last] = strings.TrimSuffix(res[last], `\`) + "/" + ps[i]
+		} else {
+			res = append(res, ps[i])
+		}
+	}
+	return res
+}

api/internal/utils/pathsplitter_test.go

@@ -0,0 +1,49 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+func TestPathSplitter(t *testing.T) {
+	for _, tc := range []struct {
+		exp  []string
+		path string
+	}{
+		{
+			path: "",
+			exp:  []string{""},
+		},
+		{
+			path: "s",
+			exp:  []string{"s"},
+		},
+		{
+			path: "a/b/c",
+			exp:  []string{"a", "b", "c"},
+		},
+		{
+			path: `a/b[]/c`,
+			exp:  []string{"a", "b[]", "c"},
+		},
+		{
+			path: `a/b\/c/d\/e/f`,
+			exp:  []string{"a", "b/c", "d/e", "f"},
+		},
+		{
+			// The actual reason for this.
+			path: `metadata/annotations/nginx.ingress.kubernetes.io\/auth-secret`,
+			exp: []string{
+				"metadata",
+				"annotations",
+				"nginx.ingress.kubernetes.io/auth-secret"},
+		},
+	} {
+		assert.Equal(t, tc.exp, PathSplitter(tc.path))
+	}
+}

api/internal/utils/timedcall.go

@@ -0,0 +1,23 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"time"
+)
+
+// TimedCall runs fn, failing if it doesn't complete in the given duration.
+// The description is used in the timeout error message.
+func TimedCall(description string, d time.Duration, fn func() error) error {
+	done := make(chan error)
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	go func() { done <- fn() }()
+	select {
+	case err := <-done:
+		return err
+	case <-timer.C:
+		return NewErrTimeOut(d, description)
+	}
+}

api/internal/utils/timedcall_test.go

@@ -0,0 +1,64 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+const (
+	timeToWait = 10 * time.Millisecond
+	tooSlow    = 2 * timeToWait
+)
+
+func errMsg(msg string) string {
+	return fmt.Sprintf("hit %s timeout running '%s'", timeToWait, msg)
+}
+
+func TestTimedCallFastNoError(t *testing.T) {
+	err := TimedCall(
+		"fast no error", timeToWait,
+		func() error { return nil })
+	if !assert.NoError(t, err) {
+		t.Fatal(err)
+	}
+}
+
+func TestTimedCallFastWithError(t *testing.T) {
+	err := TimedCall(
+		"fast with error", timeToWait,
+		func() error { return assert.AnError })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, assert.AnError.Error())
+	} else {
+		t.Fail()
+	}
+}
+
+func TestTimedCallSlowNoError(t *testing.T) {
+	err := TimedCall(
+		"slow no error", timeToWait,
+		func() error { time.Sleep(tooSlow); return nil })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("slow no error"))
+	} else {
+		t.Fail()
+	}
+}
+
+func TestTimedCallSlowWithError(t *testing.T) {
+	err := TimedCall(
+		"slow with error", timeToWait,
+		func() error { time.Sleep(tooSlow); return assert.AnError })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("slow with error"))
+	} else {
+		t.Fail()
+	}
+}

api/internal/validate/fieldvalidator.go

@@ -10,6 +10,10 @@ import (
 // FieldValidator implements ifc.Validator to check
 // the values of various KRM string fields,
 // e.g. labels, annotations, names, namespaces.
+//
+// TODO: Have this use kyaml/yaml/internal/k8sgen/pkg/labels
+//  which has label and annotation validation code, but is internal
+//  so this impl would need to move to kyaml (a fine idea).
 type FieldValidator struct {
 }
 

api/internal/wrappy/factory.go

@@ -4,38 +4,105 @@
 package wrappy
 
 import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/hasher"
 	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // WNodeFactory makes instances of WNode.
+//
 // These instances in turn adapt
 //   sigs.k8s.io/kustomize/kyaml/yaml.RNode
 // to implement ifc.Unstructured.
 // This factory is meant to implement ifc.KunstructuredFactory.
+//
+// This implementation should be thin, as both WNode and WNodeFactory must be
+// factored away (deleted) along with ifc.Kunstructured in favor of direct use
+// of RNode methods upon completion of
+// https://github.com/kubernetes-sigs/kustomize/issues/2506.
+//
+// See also api/krusty/internal/provider/depprovider.go
 type WNodeFactory struct {
 }
 
 var _ ifc.KunstructuredFactory = (*WNodeFactory)(nil)
 
 func (k *WNodeFactory) SliceFromBytes(bs []byte) ([]ifc.Kunstructured, error) {
-	panic("TODO(#WNodeFactory): implement SliceFromBytes")
+	yamlRNodes, err := kio.FromBytes(bs)
+	if err != nil {
+		return nil, err
+	}
+	var result []ifc.Kunstructured
+	for i := range yamlRNodes {
+		rn := yamlRNodes[i]
+		meta, err := rn.GetValidatedMetadata()
+		if err != nil {
+			return nil, err
+		}
+		if !shouldDropObject(meta) {
+			if foundNil, path := rn.HasNilEntryInList(); foundNil {
+				return nil, fmt.Errorf("empty item at %v in object %v", path, rn)
+			}
+			result = append(result, FromRNode(rn))
+		}
+	}
+	return result, nil
+}
+
+// shouldDropObject returns true if the resource should not be accumulated.
+func shouldDropObject(m yaml.ResourceMeta) bool {
+	_, y := m.ObjectMeta.Annotations[konfig.IgnoredByKustomizeAnnotation]
+	return y
 }
 
 func (k *WNodeFactory) FromMap(m map[string]interface{}) ifc.Kunstructured {
-	panic("TODO(#WNodeFactory): implement FromMap")
+	rn, err := FromMap(m)
+	if err != nil {
+		// TODO(#WNodeFactory): handle or bubble error"
+		panic(err)
+	}
+	return rn
+}
+
+// kustHash computes a hash of an unstructured object.
+type kustHash struct{}
+
+// Hash returns a hash of the given object
+func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
+	node, err := filtersutil.GetRNode(m)
+	if err != nil {
+		return "", err
+	}
+	return hasher.HashRNode(node)
 }
 
 func (k *WNodeFactory) Hasher() ifc.KunstructuredHasher {
-	panic("TODO(#WNodeFactory): implement Hasher")
+	return &kustHash{}
 }
 
+// MakeConfigMap makes a wrapped configmap.
 func (k *WNodeFactory) MakeConfigMap(
-	kvLdr ifc.KvLoader, args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
-	panic("TODO(#WNodeFactory): implement MakeConfigMap")
+	ldr ifc.KvLoader, args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
+	rn, err := generators.MakeConfigMap(ldr, args)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(rn), nil
 }
 
+// MakeSecret makes a wrapped secret.
 func (k *WNodeFactory) MakeSecret(
-	kvLdr ifc.KvLoader, args *types.SecretArgs) (ifc.Kunstructured, error) {
-	panic("TODO(#WNodeFactory): implement MakeSecret")
+	ldr ifc.KvLoader, args *types.SecretArgs) (ifc.Kunstructured, error) {
+	rn, err := generators.MakeSecret(ldr, args)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(rn), nil
 }

api/internal/wrappy/factory_test.go

@@ -1,4 +1,321 @@
 // Copyright 2020 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package wrappy
+package wrappy_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/wrappy"
+)
+
+func TestHasher(t *testing.T) {
+	input := `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+data:
+  one: ""
+binaryData:
+  two: ""
+`
+	expect := "698h7c7t9m"
+
+	factory := &WNodeFactory{}
+	k, err := factory.SliceFromBytes([]byte(input))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	hasher := factory.Hasher()
+	result, err := hasher.Hash(k[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result != expect {
+		t.Fatalf("expect %s but got %s", expect, result)
+	}
+}
+
+func TestSliceFromBytes(t *testing.T) {
+	factory := &WNodeFactory{}
+	testConfigMap :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "winnie",
+			},
+		}
+	testConfigMapList :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMapList",
+			"items": []interface{}{
+				testConfigMap,
+				testConfigMap,
+			},
+		}
+	testDeploymentSpec := map[string]interface{}{
+		"template": map[string]interface{}{
+			"spec": map[string]interface{}{
+				"hostAliases": []interface{}{
+					map[string]interface{}{
+						"hostnames": []interface{}{
+							"a.example.com",
+						},
+						"ip": "8.8.8.8",
+					},
+				},
+			},
+		},
+	}
+	testDeploymentA := map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name": "deployment-a",
+		},
+		"spec": testDeploymentSpec,
+	}
+	testDeploymentB := map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name": "deployment-b",
+		},
+		"spec": testDeploymentSpec,
+	}
+	testDeploymentList :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "DeploymentList",
+			"items": []interface{}{
+				testDeploymentA,
+				testDeploymentB,
+			},
+		}
+
+	type expected struct {
+		out   []map[string]interface{}
+		isErr bool
+	}
+
+	testCases := map[string]struct {
+		input []byte
+		exp   expected
+	}{
+		"garbage": {
+			input: []byte("garbageIn: garbageOut"),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"noBytes": {
+			input: []byte{},
+			exp: expected{
+				out: []map[string]interface{}{},
+			},
+		},
+		"goodJson": {
+			input: []byte(`
+{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie"}}
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"goodYaml1": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"goodYaml2": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap, testConfigMap},
+			},
+		},
+		"localConfigYaml": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie-skip
+  annotations:
+    # this annotation causes the Resource to be ignored by kustomize
+    config.kubernetes.io/local-config: ""
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"garbageInOneOfTwoObjects": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+WOOOOOOOOOOOOOOOOOOOOOOOOT:  woot
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"emptyObjects": {
+			input: []byte(`
+---
+#a comment
+
+---
+
+`),
+			exp: expected{
+				out: []map[string]interface{}{},
+			},
+		},
+		"Missing .metadata.name in object": {
+			input: []byte(`
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    foo: bar
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"nil value in list": {
+			input: []byte(`
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: kube100-site
+	labels:
+	  app: web
+testList:
+- testA
+-
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"List": {
+			input: []byte(`
+apiVersion: v1
+kind: List
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{
+					testConfigMap,
+					testConfigMap},
+			},
+		},
+		"ConfigMapList": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMapList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMapList},
+			},
+		},
+		"listWithAnchors": {
+			input: []byte(`
+apiVersion: v1
+kind: DeploymentList
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: deployment-a
+  spec: &hostAliases
+    template:
+      spec:
+        hostAliases:
+        - hostnames:
+          - a.example.com
+          ip: 8.8.8.8
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: deployment-b
+  spec:
+    <<: *hostAliases
+`),
+			exp: expected{
+				out: []map[string]interface{}{testDeploymentList},
+			},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rs, err := factory.SliceFromBytes(tc.input)
+			if err != nil {
+				assert.True(t, tc.exp.isErr)
+				return
+			}
+			assert.False(t, tc.exp.isErr)
+			assert.Equal(t, len(tc.exp.out), len(rs))
+			for i := range rs {
+				assert.Equal(
+					t, fmt.Sprintf("%v", tc.exp.out[i]), fmt.Sprintf("%v", rs[i].Map()))
+				if n != "listWithAnchors" {
+					// https://github.com/kubernetes-sigs/kustomize/issues/3271
+					if !reflect.DeepEqual(tc.exp.out[i], rs[i].Map()) {
+						t.Fatalf("%s:\nexpected: %v\n  actual: %v",
+							n, tc.exp.out[i], rs[i].Map())
+					}
+				}
+			}
+		})
+	}
+}

api/internal/wrappy/wnode.go

@@ -6,6 +6,8 @@ package wrappy
 import (
 	"fmt"
 	"log"
+	"regexp"
+	"strconv"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/ifc"
@@ -31,10 +33,22 @@ func NewWNode() *WNode {
 	return FromRNode(yaml.NewRNode(nil))
 }
 
+func FromMap(m map[string]interface{}) (*WNode, error) {
+	n, err := yaml.FromMap(m)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(n), nil
+}
+
 func FromRNode(node *yaml.RNode) *WNode {
 	return &WNode{node: node}
 }
 
+func (wn *WNode) AsRNode() *yaml.RNode {
+	return wn.node
+}
+
 func (wn *WNode) demandMetaData(label string) yaml.ResourceMeta {
 	meta, err := wn.node.GetMeta()
 	if err != nil {
@@ -54,9 +68,35 @@ func (wn *WNode) GetAnnotations() map[string]string {
 	return wn.demandMetaData("GetAnnotations").Annotations
 }
 
+// convertSliceIndex traverses the items in `fields` and find
+// if there is a slice index in the item and change it to a
+// valid Lookup field path. For example, 'ports[0]' will be
+// converted to 'ports' and '0'.
+func convertSliceIndex(fields []string) []string {
+	var res []string
+	for _, s := range fields {
+		if !strings.HasSuffix(s, "]") {
+			res = append(res, s)
+			continue
+		}
+		re := regexp.MustCompile(`^(.*)\[(\d+)\]$`)
+		groups := re.FindStringSubmatch(s)
+		if len(groups) == 0 {
+			// no match, add to result
+			res = append(res, s)
+			continue
+		}
+		if groups[1] != "" {
+			res = append(res, groups[1])
+		}
+		res = append(res, groups[2])
+	}
+	return res
+}
+
 // GetFieldValue implements ifc.Kunstructured.
 func (wn *WNode) GetFieldValue(path string) (interface{}, error) {
-	fields := strings.Split(path, ".")
+	fields := convertSliceIndex(strings.Split(path, "."))
 	rn, err := wn.node.Pipe(yaml.Lookup(fields...))
 	if err != nil {
 		return nil, err
@@ -83,14 +123,34 @@ func (wn *WNode) GetFieldValue(path string) (interface{}, error) {
 	// Return value as slice for SequenceNode kind
 	if yn.Kind == yaml.SequenceNode {
 		var result []interface{}
-		for _, node := range yn.Content {
-			result = append(result, node.Value)
+		if err := yn.Decode(&result); err != nil {
+			return nil, err
 		}
 		return result, nil
 	}
+	if yn.Kind != yaml.ScalarNode {
+		return nil, fmt.Errorf("expected ScalarNode, got Kind=%d", yn.Kind)
+	}
 
-	// Return value value directly for all other (ScalarNode) kinds
-	return yn.Value, nil
+	// TODO: When doing kustomize var replacement, which is likely a
+	// a primary use of this function and the reason it returns interface{}
+	// rather than string, we do conversion from Nodes to Go types and back
+	// to nodes.  We should figure out how to do replacement using raw nodes,
+	// assuming we keep the var feature in kustomize.
+	// The other end of this is: refvar.go:updateNodeValue.
+	switch yn.Tag {
+	case yaml.NodeTagString:
+		return yn.Value, nil
+	case yaml.NodeTagInt:
+		return strconv.Atoi(yn.Value)
+	case yaml.NodeTagFloat:
+		return strconv.ParseFloat(yn.Value, 64)
+	case yaml.NodeTagBool:
+		return strconv.ParseBool(yn.Value)
+	default:
+		// Possibly this should be an error or log.
+		return yn.Value, nil
+	}
 }
 
 // GetGvk implements ifc.Kunstructured.
@@ -100,6 +160,16 @@ func (wn *WNode) GetGvk() resid.Gvk {
 	return resid.Gvk{Group: g, Version: v, Kind: meta.Kind}
 }
 
+// GetDataMap implements ifc.Kunstructured.
+func (wn *WNode) GetDataMap() map[string]string {
+	return wn.node.GetDataMap()
+}
+
+// SetDataMap implements ifc.Kunstructured.
+func (wn *WNode) SetDataMap(m map[string]string) {
+	wn.node.SetDataMap(m)
+}
+
 // GetKind implements ifc.Kunstructured.
 func (wn *WNode) GetKind() string {
 	return wn.demandMetaData("GetKind").Kind
@@ -141,12 +211,7 @@ func (wn *WNode) GetString(path string) (string, error) {
 
 // Map implements ifc.Kunstructured.
 func (wn *WNode) Map() map[string]interface{} {
-	var result map[string]interface{}
-	if err := wn.node.YNode().Decode(&result); err != nil {
-		// Log and die since interface doesn't allow error.
-		log.Fatalf("failed to decode ynode: %v", err)
-	}
-	return result
+	return wn.node.Map()
 }
 
 // MarshalJSON implements ifc.Kunstructured.
@@ -155,47 +220,49 @@ func (wn *WNode) MarshalJSON() ([]byte, error) {
 }
 
 // MatchesAnnotationSelector implements ifc.Kunstructured.
-func (wn *WNode) MatchesAnnotationSelector(string) (bool, error) {
-	panic("TODO(#WNode) MatchesAnnotationSelector; implement or drop from API")
+func (wn *WNode) MatchesAnnotationSelector(selector string) (bool, error) {
+	return wn.node.MatchesAnnotationSelector(selector)
 }
 
 // MatchesLabelSelector implements ifc.Kunstructured.
-func (wn *WNode) MatchesLabelSelector(string) (bool, error) {
-	panic("TODO(#WNode) MatchesLabelSelector; implement or drop from API")
+func (wn *WNode) MatchesLabelSelector(selector string) (bool, error) {
+	return wn.node.MatchesLabelSelector(selector)
 }
 
 // SetAnnotations implements ifc.Kunstructured.
 func (wn *WNode) SetAnnotations(annotations map[string]string) {
-	wn.setField(yaml.NewMapRNode(&annotations), yaml.MetadataField, yaml.AnnotationsField)
+	if err := wn.node.SetAnnotations(annotations); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
 }
 
 // SetGvk implements ifc.Kunstructured.
 func (wn *WNode) SetGvk(gvk resid.Gvk) {
-	wn.setField(yaml.NewScalarRNode(gvk.Kind), yaml.KindField)
-	wn.setField(yaml.NewScalarRNode(fmt.Sprintf("%s/%s", gvk.Group, gvk.Version)), yaml.APIVersionField)
+	wn.setMapField(yaml.NewScalarRNode(gvk.Kind), yaml.KindField)
+	wn.setMapField(yaml.NewScalarRNode(gvk.ApiVersion()), yaml.APIVersionField)
 }
 
 // SetLabels implements ifc.Kunstructured.
 func (wn *WNode) SetLabels(labels map[string]string) {
-	wn.setField(yaml.NewMapRNode(&labels), yaml.MetadataField, yaml.LabelsField)
+	if err := wn.node.SetLabels(labels); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
 }
 
 // SetName implements ifc.Kunstructured.
 func (wn *WNode) SetName(name string) {
-	wn.setField(yaml.NewScalarRNode(name), yaml.MetadataField, yaml.NameField)
+	wn.setMapField(yaml.NewScalarRNode(name), yaml.MetadataField, yaml.NameField)
 }
 
 // SetNamespace implements ifc.Kunstructured.
 func (wn *WNode) SetNamespace(ns string) {
-	wn.setField(yaml.NewScalarRNode(ns), yaml.MetadataField, yaml.NamespaceField)
+	if err := wn.node.SetNamespace(ns); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
 }
 
-func (wn *WNode) setField(value *yaml.RNode, path ...string) {
-	err := wn.node.PipeE(
-		yaml.LookupCreate(yaml.MappingNode, path[0:len(path)-1]...),
-		yaml.SetField(path[len(path)-1], value),
-	)
-	if err != nil {
+func (wn *WNode) setMapField(value *yaml.RNode, path ...string) {
+	if err := wn.node.SetMapField(value, path...); err != nil {
 		// Log and die since interface doesn't allow error.
 		log.Fatalf("failed to set field %v: %v", path, err)
 	}

api/internal/wrappy/wnode_test.go

@@ -8,9 +8,9 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"sigs.k8s.io/kustomize/api/resid"
-
+	"github.com/stretchr/testify/assert"
 	"gopkg.in/yaml.v3"
+	"sigs.k8s.io/kustomize/api/resid"
 	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -33,6 +33,38 @@ const (
       "area": "51",
       "greeting": "Take me to your leader."
     }
+  },
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "CM_FOO",
+                "valueFrom": {
+                  "configMapKeyRef": {
+                    "key": "somekey",
+                    "name": "myCm"
+                  }
+                }
+              },
+              {
+                "name": "SECRET_FOO",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "someKey",
+                    "name": "mySecret"
+                  }
+                }
+              }
+            ],
+            "image": "nginx:1.7.9",
+            "name": "nginx"
+          }
+        ]
+      }
+    }
   }
 }
 `
@@ -358,6 +390,51 @@ func TestGetFieldValueReturnsMap(t *testing.T) {
 	}
 }
 
+func TestGetFieldValueReturnsStuff(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	expected := []interface{}{
+		map[string]interface{}{
+			"env": []interface{}{
+				map[string]interface{}{
+					"name": "CM_FOO",
+					"valueFrom": map[string]interface{}{
+						"configMapKeyRef": map[string]interface{}{
+							"key":  "somekey",
+							"name": "myCm",
+						},
+					},
+				},
+				map[string]interface{}{
+					"name": "SECRET_FOO",
+					"valueFrom": map[string]interface{}{
+						"secretKeyRef": map[string]interface{}{
+							"key":  "someKey",
+							"name": "mySecret",
+						},
+					},
+				},
+			},
+			"image": string("nginx:1.7.9"),
+			"name":  string("nginx"),
+		},
+	}
+	actual, err := wn.GetFieldValue("spec.template.spec.containers")
+	if err != nil {
+		t.Fatalf("error getting field value: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual map does not deep equal expected map:\n%v", diff)
+	}
+	// Cannot go deeper yet.
+	_, err = wn.GetFieldValue("spec.template.spec.containers.env")
+	if err == nil {
+		t.Fatalf("expected err %v", err)
+	}
+}
+
 func TestGetFieldValueReturnsSlice(t *testing.T) {
 	bytes, err := yaml.Marshal(makeBigMap())
 	if err != nil {
@@ -378,6 +455,39 @@ func TestGetFieldValueReturnsSlice(t *testing.T) {
 	}
 }
 
+func TestGetFieldValueReturnsSliceOfMappings(t *testing.T) {
+	bytes, err := yaml.Marshal(makeBigMap())
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	rNode, err := kyaml.Parse(string(bytes))
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	wn := FromRNode(rNode)
+	expected := []interface{}{
+		map[string]interface{}{
+			"field1": "idx0foo",
+			"field2": "idx0bar",
+		},
+		map[string]interface{}{
+			"field1": "idx1foo",
+			"field2": "idx1bar",
+		},
+		map[string]interface{}{
+			"field1": "idx2foo",
+			"field2": "idx2bar",
+		},
+	}
+	actual, err := wn.GetFieldValue("those")
+	if err != nil {
+		t.Fatalf("error getting slice: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual slice does not deep equal expected slice:\n%v", diff)
+	}
+}
+
 func TestGetFieldValueReturnsString(t *testing.T) {
 	wn := NewWNode()
 	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
@@ -448,6 +558,10 @@ func TestGetSlice(t *testing.T) {
 	}
 }
 
+func TestMapEmpty(t *testing.T) {
+	assert.Equal(t, 0, len(NewWNode().Map()))
+}
+
 func TestMap(t *testing.T) {
 	wn := NewWNode()
 	if err := wn.UnmarshalJSON([]byte(deploymentLittleJson)); err != nil {

api/k8sdeps/kunstruct/factory.go

@@ -14,6 +14,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/k8sdeps/configmapandsecret"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
@@ -116,10 +117,6 @@ func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error
 	return nil
 }
 
-// nonKustomizableResourceAnnotation if set on a Resource will cause Kustomize to
-// ignore the Resource rather than Kustomize it.
-const ignoredByKustomizeResourceAnnotation = "config.kubernetes.io/local-config"
-
 // skipResource returns true if the Resource should not be accumulated
 func (kf *KunstructuredFactoryImpl) skipResource(u unstructured.Unstructured) bool {
 	an := u.GetAnnotations()
@@ -128,7 +125,7 @@ func (kf *KunstructuredFactoryImpl) skipResource(u unstructured.Unstructured) bo
 		return false
 	}
 	// check if the Resource has opt-ed out of kustomize
-	_, found := an[ignoredByKustomizeResourceAnnotation]
+	_, found := an[konfig.IgnoredByKustomizeAnnotation]
 	return found
 }
 

api/k8sdeps/kunstruct/unstructadapter.go

@@ -7,6 +7,7 @@ package kunstruct
 import (
 	"encoding/json"
 	"fmt"
+	"log"
 
 	jsonpatch "github.com/evanphx/json-patch"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -249,6 +250,29 @@ func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error)
 	return nil, NoFieldError{Field: path}
 }
 
+func (fs *UnstructAdapter) GetDataMap() map[string]string {
+	m, err := fs.GetStringMap("data")
+	if err != nil {
+		return map[string]string{}
+	}
+	return m
+}
+
+func (fs *UnstructAdapter) SetDataMap(m map[string]string) {
+	if m == nil {
+		unstructured.RemoveNestedField(fs.Object, "data")
+		return
+	}
+	s := make(map[string]interface{}, len(m))
+	for i, v := range m {
+		s[i] = v
+	}
+	err := unstructured.SetNestedMap(fs.Object, s, "data")
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
 // GetMap returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
 	content, fields, found, err := fs.selectSubtree(path)

api/k8sdeps/kunstruct/unstructadapter_test.go

@@ -6,6 +6,8 @@ package kunstruct
 import (
 	"reflect"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 var kunstructured = NewKunstructuredFactoryImpl().FromMap(map[string]interface{}{
@@ -557,3 +559,139 @@ func compareValues(t *testing.T, name string, pathToField string, expectedValue
 		t.Logf("%T value at `%s`", typedV, pathToField)
 	}
 }
+
+func TestKunstGetDataMap(t *testing.T) {
+	emptyMap := map[string]string{}
+	testCases := map[string]struct {
+		theMap   map[string]interface{}
+		expected map[string]string
+	}{
+		"actuallyNil": {
+			theMap:   nil,
+			expected: emptyMap,
+		},
+		"empty": {
+			theMap:   map[string]interface{}{},
+			expected: emptyMap,
+		},
+		"mostlyEmpty": {
+			theMap: map[string]interface{}{
+				"hey": "there",
+			},
+			expected: emptyMap,
+		},
+		"noNameConfigMap": {
+			theMap: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "ConfigMap",
+			},
+			expected: emptyMap,
+		},
+		"configMap": {
+			theMap: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "ConfigMap",
+				"metadata": map[string]interface{}{
+					"name": "winnie",
+				},
+				"data": map[string]interface{}{
+					"wine":   "cabernet",
+					"truck":  "ford",
+					"rocket": "falcon9",
+					"planet": "mars",
+					"city":   "brownsville",
+				},
+			},
+			// order irrelevant, because assert.Equals is smart about maps.
+			expected: map[string]string{
+				"city":   "brownsville",
+				"wine":   "cabernet",
+				"planet": "mars",
+				"rocket": "falcon9",
+				"truck":  "ford",
+			},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			kunstr := NewKunstructuredFactoryImpl().FromMap(tc.theMap)
+			m := kunstr.GetDataMap()
+			if !assert.Equal(t, tc.expected, m) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestKunstSetDataMap(t *testing.T) {
+	testCases := map[string]struct {
+		theMap   map[string]interface{}
+		input    map[string]string
+		expected map[string]string
+	}{
+		"empty": {
+			theMap: map[string]interface{}{},
+			input: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+			expected: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+		},
+		"replace": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+			expected: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+		},
+		"clear1": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input:    map[string]string{},
+			expected: map[string]string{},
+		},
+		"clear2": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input:    nil,
+			expected: map[string]string{},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			kunstr := NewKunstructuredFactoryImpl().FromMap(tc.theMap)
+			kunstr.SetDataMap(tc.input)
+			m := kunstr.GetDataMap()
+			if !assert.Equal(t, tc.expected, m) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/konfig/builtinpluginconsts/commonlabels.go

@@ -51,6 +51,11 @@ commonLabels:
   group: apps
   kind: Deployment
 
+- path: spec/template/spec/topologySpreadConstraints/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
 - path: spec/selector/matchLabels
   create: true
   kind: ReplicaSet
@@ -97,6 +102,11 @@ commonLabels:
   group: apps
   kind: StatefulSet
 
+- path: spec/template/spec/topologySpreadConstraints/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
 - path: spec/volumeClaimTemplates[]/metadata/labels
   create: true
   group: apps

api/konfig/builtinpluginconsts/namereference.go

@@ -3,6 +3,9 @@
 
 package builtinpluginconsts
 
+// TODO: rename 'fieldSpecs' to 'referrers' for clarity.
+// This will, however, break anyone using a custom config.
+
 const (
 	nameReferenceFieldSpecs = `
 nameReference:
@@ -121,6 +124,10 @@ nameReference:
     kind: CronJob
   - path: spec/configSource/configMap
     kind: Node
+  - path: rules/resourceNames
+    kind: Role
+  - path: rules/resourceNames
+    kind: ClusterRole
 
 - kind: Secret
   version: v1
@@ -258,6 +265,8 @@ nameReference:
     kind: Service
     group: serving.knative.dev
     version: v1
+  - path: spec/azureFile/secretName
+    kind: PersistentVolume
 
 - kind: Service
   version: v1

api/konfig/general.go

@@ -19,7 +19,32 @@ func DefaultKustomizationFileName() string {
 	return RecognizedKustomizationFileNames()[0]
 }
 
+// IfApiMachineryElseKyaml returns true if executing the apimachinery code
+// path, else we're executing the kyaml code paths.
+func IfApiMachineryElseKyaml(s1, s2 string) string {
+	if !FlagEnableKyamlDefaultValue {
+		return s1
+	}
+	return s2
+}
+
 const (
+	// FlagEnableKyamlDefaultValue is the default value for the --enable_kyaml
+	// flag.  This value is also used in unit tests.  See provider.DepProvider.
+	//
+	// TODO(#3304): eliminate branching on this constant.
+	// Details: https://github.com/kubernetes-sigs/kustomize/issues/3304
+	//
+	// All tests should pass for either true or false values
+	// of this constant, without having to check its value.
+	// In the cases where there's a different outcome, either decide
+	// that the difference is acceptable, or make the difference go away.
+	//
+	// Historically, tests passed for enable_kyaml == false, i.e. using
+	// apimachinery libs.  This doesn't mean the code was better, it just
+	// means regression tests preserved those outcomes.
+	FlagEnableKyamlDefaultValue = true
+
 	// An environment variable to consult for kustomization
 	// configuration data.  See:
 	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
@@ -31,6 +56,12 @@ const (
 	// A program name, for use in help, finding the XDG_CONFIG_DIR, etc.
 	ProgramName = "kustomize"
 
+	// ConfigAnnoDomain is configuration-related annotation namespace.
+	ConfigAnnoDomain = "config.kubernetes.io"
+
+	// If a resource has this annotation, kustomize will drop it.
+	IgnoredByKustomizeAnnotation = ConfigAnnoDomain + "/local-config"
+
 	// Label key that indicates the resources are built from Kustomize
 	ManagedbyLabelKey = "app.kubernetes.io/managed-by"
 

api/krusty/accumulation_test.go

@@ -93,3 +93,70 @@ resources:
 		t.Fatalf("unexpected error: %q", err)
 	}
 }
+
+func TestResourceHasAnchor(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+resources:
+- ingress.yaml
+`)
+	th.WriteF("/app/ingress.yaml", `
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+spec:
+  tls:
+  - hosts:
+    - xyz.me
+    - www.xyz.me
+    secretName: cert-tls
+  rules:
+  - host: xyz.me
+    http: &xxx_rules
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service
+            port:
+              number: 80
+  - host: www.xyz.me
+    http: *xxx_rules
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+spec:
+  rules:
+  - host: xyz.me
+    http:
+      paths:
+      - backend:
+          service:
+            name: service
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  - host: www.xyz.me
+    http:
+      paths:
+      - backend:
+          service:
+            name: service
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - xyz.me
+    - www.xyz.me
+    secretName: cert-tls
+`)
+}

api/krusty/basic_io_test.go

@@ -0,0 +1,102 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestBasicIO_1(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	opts := th.MakeDefaultOptions()
+	if !opts.UseKyaml {
+		// This test won't pass under apimachinery, because in the bowels of
+		// that code (see GetAnnotations in v0.17.0 of
+		// k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go)
+		// an error returned from NestedStringMap is discarded, and an
+		// empty annotation map is silently returned, making this test fail
+		// The swallowed error arises from code like:
+		//   var v interface{}
+		//   v = true
+		//   if str, ok := v.(string); ok {
+		//     save the value in a map (doesn't happen)
+		//   } else {
+		//     return an error (that is then ignored by GetAnnotations)
+		//   }
+		// The error happens when any annotation value can be interpreted as
+		// a boolean or number.  Such annotations cannot be successfully applied
+		// to an object in a cluster unless they are quoted.
+		t.SkipNow()
+	}
+	th.WriteK(".", `
+resources:
+- service.yaml
+`)
+	th.WriteF("service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    port: 8080
+    happy: true
+    color: green
+  name: demo
+spec:
+  clusterIP: None
+`)
+	m := th.Run(".", opts)
+	// The annotations are sorted by key, hence the order change.
+	// Quotes are added intentionally.
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    color: green
+    happy: "true"
+    port: "8080"
+  name: demo
+spec:
+  clusterIP: None
+`)
+}
+
+func TestBasicIO_2(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	opts := th.MakeDefaultOptions()
+	th.WriteK(".", `
+resources:
+- service.yaml
+`)
+	// All the annotation values are quoted in the input.
+	th.WriteF("service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    port: "8080"
+    happy: "true"
+    color: green
+  name: demo
+spec:
+  clusterIP: None
+`)
+	m := th.Run(".", opts)
+	// The annotations are sorted by key, hence the order change.
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    color: green
+    happy: "true"
+    port: "8080"
+  name: demo
+spec:
+  clusterIP: None
+`)
+}

api/krusty/component_test.go

@@ -39,8 +39,8 @@ resources:
 configMapGenerator:
 - name: my-configmap
   literals:	
-  - testValue=1
-  - otherValue=10
+  - testValue=purple
+  - otherValue=green
 `)
 	th.WriteF("/app/base/deploy.yaml", `
 apiVersion: v1
@@ -64,8 +64,8 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-  - testValue=2
-  - compValue=5
+  - testValue=blue
+  - compValue=red
 `)
 	th.WriteF("/app/comp/stub.yaml", `
 apiVersion: v1
@@ -125,14 +125,12 @@ spec:
 ---
 apiVersion: v1
 data:
-  compValue: "5"
-  otherValue: "10"
-  testValue: "2"
+  compValue: red
+  otherValue: green
+  testValue: blue
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: comp-my-configmap-kc6k2kmkh9
+  name: comp-my-configmap-97647ckcmg
 ---
 apiVersion: v1
 kind: Deployment
@@ -156,7 +154,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-  - otherValue=9
+  - otherValue=orange
 `),
 				writeK("/app/prod", `
 resources:
@@ -179,14 +177,12 @@ spec:
 ---
 apiVersion: v1
 data:
-  compValue: "5"
-  otherValue: "9"
-  testValue: "2"
+  compValue: red
+  otherValue: orange
+  testValue: blue
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: comp-my-configmap-55249mf5kb
+  name: comp-my-configmap-g486mb229k
 ---
 apiVersion: v1
 kind: Deployment
@@ -212,7 +208,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:
-  - otherValue=9
+  - otherValue=orange
 `),
 				writeK("/app/prod", `
 resources:
@@ -234,14 +230,12 @@ spec:
 ---
 apiVersion: v1
 data:
-  compValue: "5"
-  otherValue: "9"
-  testValue: "2"
+  compValue: red
+  otherValue: orange
+  testValue: blue
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: comp-my-configmap-55249mf5kb
+  name: comp-my-configmap-g486mb229k
 ---
 apiVersion: v1
 kind: Deployment
@@ -279,11 +273,11 @@ spec:
 ---
 apiVersion: v1
 data:
-  otherValue: "10"
-  testValue: "1"
+  otherValue: green
+  testValue: purple
 kind: ConfigMap
 metadata:
-  name: my-configmap-2g9c94mhb8
+  name: my-configmap-9cd648hm8f
 ---
 apiVersion: v1
 kind: Deployment
@@ -294,14 +288,12 @@ spec:
 ---
 apiVersion: v1
 data:
-  compValue: "5"
-  otherValue: "10"
-  testValue: "2"
+  compValue: red
+  otherValue: green
+  testValue: blue
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: comp-my-configmap-kc6k2kmkh9
+  name: comp-my-configmap-97647ckcmg
 ---
 apiVersion: v1
 kind: Deployment
@@ -327,8 +319,8 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-  - compValue=5
-  - testValue=2
+  - compValue=red
+  - testValue=blue
 `),
 			},
 			runPath: "/app/direct-component",
@@ -342,14 +334,12 @@ spec:
 ---
 apiVersion: v1
 data:
-  compValue: "5"
-  otherValue: "10"
-  testValue: "2"
+  compValue: red
+  otherValue: green
+  testValue: blue
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: my-configmap-kc6k2kmkh9
+  name: my-configmap-97647ckcmg
 `,
 		},
 		"missing-optional-component-api-version": {
@@ -360,7 +350,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-  - otherValue=9
+  - otherValue=orange
 `),
 			},
 			runPath: "/app/prod",
@@ -374,13 +364,11 @@ spec:
 ---
 apiVersion: v1
 data:
-  otherValue: "9"
-  testValue: "1"
+  otherValue: orange
+  testValue: purple
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
-  name: my-configmap-5g7gh5mgt5
+  name: my-configmap-6hhdg8gkdg
 ---
 apiVersion: v1
 kind: Deployment
@@ -423,11 +411,11 @@ spec:
 ---
 apiVersion: v1
 data:
-  otherValue: "10"
-  testValue: "1"
+  otherValue: green
+  testValue: purple
 kind: ConfigMap
 metadata:
-  name: my-configmap-a-b-2g9c94mhb8
+  name: my-configmap-a-b-9cd648hm8f
 ---
 apiVersion: v1
 kind: Deployment
@@ -438,11 +426,11 @@ spec:
 ---
 apiVersion: v1
 data:
-  otherValue: "10"
-  testValue: "1"
+  otherValue: green
+  testValue: purple
 kind: ConfigMap
 metadata:
-  name: my-configmap-b-2g9c94mhb8
+  name: my-configmap-b-9cd648hm8f
 `,
 		},
 
@@ -574,7 +562,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-  - otherValue=9
+  - otherValue=orange
 `),
 			},
 			runPath:       "/app/prod",

api/krusty/configmaps_test.go

@@ -4,11 +4,121 @@
 package krusty_test
 
 import (
+	"fmt"
 	"testing"
 
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
+// Numbers and booleans are quoted
+func TestGeneratorIntVsStringNoMerge(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- service.yaml
+configMapGenerator:
+- name: bob
+  literals:
+  - fruit=Indian Gooseberry
+  - year=2020
+  - crisis=true
+`)
+	th.WriteF("service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo
+spec:
+  clusterIP: None
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo
+spec:
+  clusterIP: None
+---
+apiVersion: v1
+data:
+  crisis: "true"
+  fruit: Indian Gooseberry
+  year: "2020"
+kind: ConfigMap
+metadata:
+  name: bob-79t79mt227
+`)
+}
+
+func TestGeneratorIntVsStringWithMerge(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+configMapGenerator:
+- name: bob
+  literals:
+  - fruit=Indian Gooseberry
+  - year=2020
+  - crisis=true
+`)
+	th.WriteK("overlay", `
+resources:
+- ../base
+configMapGenerator:
+- name: bob
+  behavior: merge
+  literals:
+  - month=12
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+data:
+  crisis: "true"
+  fruit: Indian Gooseberry
+  month: "12"
+  year: "2020"
+kind: ConfigMap
+metadata:
+  name: bob-bk46gm59c6
+`)
+}
+
+func TestGeneratorFromProperties(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+configMapGenerator:
+  - name: test-configmap
+    behavior: create
+    envs:
+    - properties
+`)
+	th.WriteF("base/properties", `
+VAR1=100
+`)
+	th.WriteK("overlay", `
+resources:
+- ../base
+configMapGenerator:
+- name: test-configmap
+  behavior: "merge"
+  envs:
+  - properties
+`)
+	th.WriteF("overlay/properties", `
+VAR2=200
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+data:
+  VAR1: "100"
+  VAR2: "200"
+kind: ConfigMap
+metadata:
+  name: test-configmap-hdghb5ddkg
+`)
+}
+
 // Generate a Secret and a ConfigMap from the same data
 // to compare the result.
 func TestGeneratorBasics(t *testing.T) {
@@ -59,10 +169,9 @@ electromagnetic
 strong nuclear
 weak nuclear
 `)
-
-	m := th.Run("/app", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: v1
+	opts := th.MakeDefaultOptions()
+	m := th.Run("/app", opts)
+	expFmt := `apiVersion: v1
 data:
   MOUNTAIN: everest
   OCEAN: pacific
@@ -95,15 +204,30 @@ apiVersion: v1
 data:
   MOUNTAIN: ZXZlcmVzdA==
   OCEAN: cGFjaWZpYw==
-  forces.txt: CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbnVjbGVhcgo=
+  forces.txt: %s
   fruit: YXBwbGU=
-  passphrase: CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aGUgZXZpbCBkYXlzIGNvbWUgbm90Lgo=
+  passphrase: %s
   vegetable: YnJvY2NvbGk=
 kind: Secret
 metadata:
-  name: blah-bob-ftht6hfgmb
+  name: blah-bob-%s
 type: Opaque
-`)
+`
+	th.AssertActualEqualsExpected(
+		m,
+		// TODO(#3304): DECISION - kyaml better; not a bug.
+		opts.IfApiMachineryElseKyaml(
+			fmt.Sprintf(
+				expFmt,
+				`CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbnVjbGVhcgo=`,
+				`CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aGUgZXZpbCBkYXlzIGNvbWUgbm90Lgo=`,
+				`ftht6hfgmb`),
+			fmt.Sprintf(
+				expFmt, `|
+    CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbn
+    VjbGVhcgo=`, `|
+    CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aG
+    UgZXZpbCBkYXlzIGNvbWUgbm90Lgo=`, `9t25t44gg4`)))
 }
 
 // TODO: These should be errors instead.
@@ -159,6 +283,68 @@ metadata:
 `)
 }
 
+func TestIssue3393(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- cm.yaml
+configMapGenerator:
+  - name: project
+    behavior: merge
+    literals:
+    - ANOTHER_ENV_VARIABLE="bar"
+`)
+	th.WriteF("cm.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: project
+data:
+  A_FIRST_ENV_VARIABLE: "foo"
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  A_FIRST_ENV_VARIABLE: foo
+  ANOTHER_ENV_VARIABLE: bar
+kind: ConfigMap
+metadata:
+  name: project
+`)
+}
+
+func TestGeneratorSimpleOverlay(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+namePrefix: p-
+configMapGenerator:
+- name: cm
+  behavior: create
+  literals:
+  - fruit=apple
+`)
+	th.WriteK("overlay", `
+resources:
+- ../base
+configMapGenerator:
+- name: cm
+  behavior: merge
+  literals:
+  - veggie=broccoli
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  fruit: apple
+  veggie: broccoli
+kind: ConfigMap
+metadata:
+  name: p-cm-877mt5hc89
+`)
+}
+
 func TestGeneratorOverlays(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteK("/app/base1", `
@@ -215,8 +401,6 @@ data:
   from: overlay
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
   name: p1-com1-8tc62428t2
 ---
 apiVersion: v1
@@ -224,8 +408,6 @@ data:
   from: overlay
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
   name: p2-com2-87mcggf7d7
 `)
 }
@@ -272,8 +454,6 @@ data:
   foo: bar
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
   name: o1-cm-ft9mmdc8c6
 ---
 apiVersion: v1
@@ -282,8 +462,43 @@ data:
   foo: bar
 kind: ConfigMap
 metadata:
-  annotations: {}
-  labels: {}
   name: cm-o2-5k95kd76ft
 `)
 }
+
+func TestConfigMapGeneratorLiteralNewline(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+generators:
+- configmaps.yaml
+`)
+	th.WriteF("/app/configmaps.yaml", `
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: testing
+literals:
+  - |
+    initial.txt=greetings
+    everyone
+  - |
+    final.txt=different
+    behavior
+---
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: v1
+data:
+  final.txt: |
+    different
+    behavior
+  initial.txt: |
+    greetings
+    everyone
+kind: ConfigMap
+metadata:
+  name: testing-tt4769fb52
+`)
+}

api/krusty/crd_test.go

@@ -32,7 +32,7 @@ spec:
   action: fly
 `)
 	th.WriteF("/app/base/mykind.yaml", `
-apiVersion: jingfang.example.com/v1beta1
+apiVersion: jingfang.example.com/v1
 kind: MyKind
 metadata:
   name: mykind
@@ -236,7 +236,7 @@ kind: Secret
 metadata:
   name: x-crdsecret
 ---
-apiVersion: jingfang.example.com/v1beta1
+apiVersion: jingfang.example.com/v1
 kind: MyKind
 metadata:
   name: x-mykind
@@ -285,7 +285,7 @@ kind: Secret
 metadata:
   name: prod-x-crdsecret
 ---
-apiVersion: jingfang.example.com/v1beta1
+apiVersion: jingfang.example.com/v1
 kind: MyKind
 metadata:
   name: prod-x-mykind

api/krusty/diamondpatchref_test.go

@@ -0,0 +1,227 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+// In the following structure `top` patches `left-deploy` and `right-deploy` to reference the
+// configMap in `bottom`. This test verifies `configMapRef.name` in `left-deploy` and
+// `right-deploy` is modified correctly.
+//
+//                       top
+//                 /            \
+//           left                   right
+//          /   \                  /    \
+// left-service  bottom        bottom right-service
+//         |          \       /          |
+// left-deploy          bottom        right-deploy
+//                        |
+//                     configMap
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestConfMapNameResolutionInDiamondWithPatches(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK("bottom", `
+configMapGenerator:
+- name: bottom
+  literals:
+  - KEY=value
+`)
+
+	th.WriteK("left-service", `
+resources:
+- deployment.yaml
+`)
+
+	th.WriteF("left-service/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: left-deploy
+  labels:
+    app.kubernetes.io/name: left-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: left-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: left-pod
+    spec:
+      containers:
+      - image: left-image:v1.0
+        name: service
+`)
+
+	th.WriteK("right-service", `
+resources:
+- deployment.yaml
+`)
+
+	th.WriteF("right-service/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: right-deploy
+  labels:
+    app.kubernetes.io/name: right-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: right-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: right-pod
+    spec:
+      containers:
+      - image: right-image:v1.0
+        name: service
+`)
+
+	th.WriteK("top", `
+resources:
+- ./left
+- ./right
+`)
+
+	th.WriteK("top/left", `
+resources:
+- ../../left-service
+- ./bottom
+
+patches:
+- target:
+    kind: Deployment
+    name: left-deploy
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: ignored-by-kustomize
+    spec:
+      template:
+        spec:
+          containers:
+          - name: service
+            env:
+            - name: MAPPED_CONFIG_ITEM
+              valueFrom:
+                configMapKeyRef:
+                  name: left-bottom
+                  key: KEY
+`)
+
+	th.WriteK("top/left/bottom", `
+namePrefix: left-
+
+resources:
+- ../../../bottom
+`)
+
+	th.WriteK("top/right", `
+resources:
+- ../../right-service
+- ./bottom
+
+patches:
+- target:
+    kind: Deployment
+    name: right-deploy
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: ignored-by-kustomize
+    spec:
+      template:
+        spec:
+          containers:
+          - name: service
+            env:
+            - name: MAPPED_CONFIG_ITEM
+              valueFrom:
+                configMapKeyRef:
+                  name: right-bottom
+                  key: KEY
+`)
+
+	th.WriteK("top/right/bottom", `
+namePrefix: right-
+
+resources:
+- ../../../bottom
+`)
+
+	m := th.Run("top", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: left-deploy
+  name: left-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: left-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: left-pod
+    spec:
+      containers:
+      - env:
+        - name: MAPPED_CONFIG_ITEM
+          valueFrom:
+            configMapKeyRef:
+              key: KEY
+              name: left-bottom-9f2t6f5h6d
+        image: left-image:v1.0
+        name: service
+---
+apiVersion: v1
+data:
+  KEY: value
+kind: ConfigMap
+metadata:
+  name: left-bottom-9f2t6f5h6d
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: right-deploy
+  name: right-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: right-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: right-pod
+    spec:
+      containers:
+      - env:
+        - name: MAPPED_CONFIG_ITEM
+          valueFrom:
+            configMapKeyRef:
+              key: KEY
+              name: right-bottom-9f2t6f5h6d
+        image: right-image:v1.0
+        name: service
+---
+apiVersion: v1
+data:
+  KEY: value
+kind: ConfigMap
+metadata:
+  name: right-bottom-9f2t6f5h6d
+`)
+}

api/krusty/gvknpatch_test.go

@@ -0,0 +1,622 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/3280
+// GVKN shouldn't change with default options
+func TestKeepOriginalGVKN(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("apps/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+
+	th.WriteF("apps/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+`)
+
+	th.WriteK("apps", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	m := th.Run("apps", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+// https://github.com/kubernetes-sigs/kustomize/issues/3280
+// These tests document behavior that will change
+func TestChangeName(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("apps/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+
+	th.WriteF("apps/patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: new-name
+`)
+
+	th.WriteK("apps", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// name should become `new-name`
+	m := th.Run("apps", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+func TestChangeKind(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("apps/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+
+	th.WriteF("apps/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: old-name
+`)
+
+	th.WriteK("apps", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// kind should become `StatefulSet`
+	m := th.Run("apps", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+func TestChangeNameAndKind(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("apps/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+
+	th.WriteF("apps/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+`)
+
+	th.WriteK("apps", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// kind should become `StatefulSet`
+	// name should become `new-name`
+	m := th.Run("apps", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+// https://github.com/kubernetes-sigs/kustomize/issues/3280
+// Should be able to refer to a resource with either its
+// original GVKN or its current one
+func TestPatchOriginalName(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+	th.WriteF("base/patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: new-name
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	th.WriteK("overlay", `
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  replicas: 999
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// name should become `new-name`
+	m := th.Run("overlay", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+func TestPatchNewName(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+	th.WriteF("base/patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: new-name
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	th.WriteK("overlay", `
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: new-name
+spec:
+  replicas: 999
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// depPatch cannot find target with the name `new-name`
+	// because base/patch.yaml can't yet edit the name
+	assert.Error(t, th.RunWithErr("overlay", options))
+}
+
+func TestPatchOriginalNameAndKind(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+	th.WriteF("base/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	th.WriteK("overlay", `
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  replicas: 999
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// kind should become `StatefulSet`
+	// name should become `new-name`
+	m := th.Run("overlay", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+func TestPatchNewNameAndKind(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+	th.WriteF("base/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	th.WriteK("overlay", `
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+spec:
+  replicas: 999
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// depPatch cannot find target with kind `StatefulSet` and name `new-name`
+	// because base/patch.yaml can't yet edit the kind or name
+	assert.Error(t, th.RunWithErr("overlay", options))
+}
+
+// Use original name, but new kind
+// Should fail, even after #3280 is done, because this ID is invalid
+func TestPatchOriginalNameAndNewKind(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: old-name
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+	th.WriteF("base/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: new-name
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+`)
+
+	th.WriteK("overlay", `
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: new-name
+spec:
+  replicas: 999
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// depPatch cannot find target with kind `Deployment` and name `new-name`
+	// because the resource never had this GVKN
+	assert.Error(t, th.RunWithErr("overlay", options))
+}
+
+// Here is a structure of a kustomization of two components, component1
+// and component2, that both use a shared deployment definition, which
+// component2 adjusts by changing the kind via a patch. This test case
+// checks that it does not have a conflicting definition.
+// Currently documents broken behavior.
+//
+//                   root
+//              /            \
+//  component1/overlay  component2/overlay
+//             |              |
+//    component1/base    component2/base
+//              \            /
+//                   base
+//
+// This is the directory layout:
+//
+// ├── component1
+// │   ├── base
+// │   │   └── kustomization.yaml
+// │   └── overlay
+// │       └── kustomization.yaml
+// ├── component2
+// │   ├── base
+// │   │   └── kustomization.yaml
+// │   └── overlay
+// │       └── kustomization.yaml
+// ├── shared
+// │   ├── kustomization.yaml
+// │   └── deployment.yaml
+// ├── kustomization.yaml
+
+func TestBaseReuseNameAndKindConflict(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK("/app/shared", `
+resources:
+  - deployment.yaml
+`)
+	th.WriteF("/app/shared/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deploy
+spec:
+  template:
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+`)
+
+	th.WriteK("/app/component1/base", `
+resources:
+  - ../../shared
+`)
+	th.WriteK("/app/component1/overlay", `
+resources:
+  - ../base
+
+namePrefix: overlay-
+`)
+
+	th.WriteK("/app/component2/base", `
+resources:
+  - ../../shared
+
+patches:
+- path: patch.yaml
+  target:
+    kind: Deployment
+    name: my-deploy
+`)
+	th.WriteF("/app/component2/base/patch.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: my-stateful-set
+`)
+	th.WriteK("/app/component2/overlay", `
+resources:
+  - ../base
+
+namePrefix: overlay-
+`)
+
+	th.WriteK("/app", `
+resources:
+  - component1/overlay
+  - component2/overlay
+`)
+
+	options := th.MakeDefaultOptions()
+	options.AllowResourceIdChanges = true
+
+	// Error occurs when app/component2/base tries to load the shared resources
+	// because the kind is not (yet) allowed to change yet
+	// so it loads a second Deployment with the name my-deploy
+	// instead of a StatefulSet as specified by the patch.
+	// Will be fixed by #3280.
+	assert.Error(t, th.RunWithErr("overlay", options))
+}

api/krusty/inlinetransformer_test.go

@@ -0,0 +1,79 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestInlineTransformer(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("/app/resource.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: whatever
+data: {}
+`)
+	th.WriteK("/app", `
+resources:
+- resource.yaml
+transformers:
+- |-
+  apiVersion: builtin
+  kind: NamespaceTransformer
+  metadata:
+    name: not-important-to-example
+    namespace: test
+  fieldSpecs:
+  - path: metadata/namespace
+    create: true
+`)
+
+	expected := `
+apiVersion: apps/v1
+data: {}
+kind: ConfigMap
+metadata:
+  name: whatever
+  namespace: test
+`
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, expected)
+}
+
+func TestInlineGenerator(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK("/app", `
+generators:
+- |-
+  apiVersion: builtin
+  kind: ConfigMapGenerator
+  metadata:
+    name: mymap
+  literals:
+  - FRUIT=apple
+  - VEGETABLE=carrot
+`)
+
+	expected := `
+apiVersion: v1
+data:
+  FRUIT: apple
+  VEGETABLE: carrot
+kind: ConfigMap
+metadata:
+  name: mymap-kfd8tf729k
+`
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, expected)
+}

api/krusty/intermediateresourceid_test.go

@@ -0,0 +1,387 @@
+package krusty_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Checks that a patch at the top of the stack can refer to resources
+// by an intermediate name after it has gone through multiple name
+// transformations.
+// Ref: Issue #3455
+func TestIntermediateName(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prod-foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	m := th.Run("/app/gcp", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-prod-foo
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+}
+
+// Tests that if resources in different layers (containing name
+// transformations) have the same name, there is no conflict
+func TestIntermediateNameSameNameDifferentLayer(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prod-foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+- deployment.yaml
+`)
+	th.WriteF("/app/emea/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	m := th.Run("/app/gcp", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-prod-foo
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+}
+
+// Same as above test but tries to refer to the name foo
+// instead of prod-foo
+func TestIntermediateNameAmbiguous(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+- deployment.yaml
+`)
+	th.WriteF("/app/emea/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	err := th.RunWithErr("/app/gcp", th.MakeDefaultOptions())
+	assert.Error(t, err)
+}
+
+// Test for issue #3228
+// References to resources by their intermediate names after multiple
+// name transformations should be supported
+func TestIntermediateNameSecretKeyRefDiamond(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK(".", `
+namePrefix: project-
+resources:
+- app`)
+
+	th.WriteK("/app", `
+resources:
+- resources/deployment.yaml
+- resources/xql
+`)
+
+	th.WriteK("/app/resources/xql", `
+resources:
+- xql-zero
+- xql-one
+configurations:
+- ./kustomizeconfig.yaml
+`)
+
+	th.WriteF("/app/resources/xql/kustomizeconfig.yaml", `
+varReference:
+- path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+`)
+
+	th.WriteK("/app/resources/xql/xql-one", `
+namePrefix: xql-one-
+resources:
+- ../../../../bases/xql
+secretGenerator:
+- name: xql-secret
+  behavior: merge
+  envs:
+  - config/xql-one-secret.env
+vars:
+- name: PROJECT_XQL_ONE_SECRET_NAME
+  objref:
+    kind: Secret
+    name: xql-secret
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+`)
+
+	th.WriteF("/app/resources/xql/xql-one/config/xql-one-secret.env", `
+arg=1
+`)
+
+	th.WriteK("/app/resources/xql/xql-zero", `
+namePrefix: xql-zero-
+resources:
+- ../../../../bases/xql
+secretGenerator:
+- name: xql-secret
+  behavior: merge
+  envs:
+  - config/xql-zero-secret.env
+vars:
+- name: PROJECT_XQL_ZERO_SECRET_NAME
+  objref:
+    kind: Secret
+    name: xql-secret
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+`)
+
+	th.WriteF("/app/resources/xql/xql-zero/config/xql-zero-secret.env", `
+arg=0
+`)
+
+	th.WriteF("app/resources/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        image: example.com/app:latest
+        imagePullPolicy: Always
+        env:
+        - name: XQL_ZERO_ARG
+          valueFrom:
+            secretKeyRef:
+              name: $(PROJECT_XQL_ZERO_SECRET_NAME)
+              key: arg
+        - name: XQL_ZERO_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: xql-zero-xql-secret
+              key: password
+        - name: XQL_ONE_ARG
+          valueFrom:
+            secretKeyRef:
+              name: $(PROJECT_XQL_ONE_SECRET_NAME)
+              key: arg
+        - name: XQL_ONE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: xql-one-xql-secret
+              key: password
+`)
+
+	th.WriteK("/bases/xql", `
+secretGenerator:
+- name: xql-secret
+  envs:
+  - config/xql-secret.env
+`)
+
+	th.WriteF("bases/xql/config/xql-secret.env", `
+password=SUPER_SECRET_PASSWORD
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: project-app
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: XQL_ZERO_ARG
+          valueFrom:
+            secretKeyRef:
+              key: arg
+              name: project-xql-zero-xql-secret-6khmtc56hm
+        - name: XQL_ZERO_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: project-xql-zero-xql-secret-6khmtc56hm
+        - name: XQL_ONE_ARG
+          valueFrom:
+            secretKeyRef:
+              key: arg
+              name: project-xql-one-xql-secret-79mhmf5dgt
+        - name: XQL_ONE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: project-xql-one-xql-secret-79mhmf5dgt
+        image: example.com/app:latest
+        imagePullPolicy: Always
+        name: app
+---
+apiVersion: v1
+data:
+  arg: MA==
+  password: U1VQRVJfU0VDUkVUX1BBU1NXT1JE
+kind: Secret
+metadata:
+  name: project-xql-zero-xql-secret-6khmtc56hm
+type: Opaque
+---
+apiVersion: v1
+data:
+  arg: MQ==
+  password: U1VQRVJfU0VDUkVUX1BBU1NXT1JE
+kind: Secret
+metadata:
+  name: project-xql-one-xql-secret-79mhmf5dgt
+type: Opaque
+`)
+}

api/krusty/issue3377_test.go

@@ -0,0 +1,283 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestIssue3377(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	opts := th.MakeDefaultOptions()
+	th.WriteK(".", `
+resources:
+- service-a.yaml
+- service-b.yaml
+
+patchesJson6902:
+- path: service-a-patch.yaml
+  target:
+    version: v1
+    group: networking.k8s.io
+    kind: Ingress
+    name: service-a
+- path: service-b-patch.yaml
+  target:
+    version: v1
+    group: networking.k8s.io
+    kind: Ingress
+    name: service-b
+vars:
+- name: SERVICE_A_DNS_NAME
+  objref:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: service-a
+  fieldref:
+    fieldpath: spec.rules[0].host
+- name: SERVICE_B_DNS_NAME
+  objref:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: service-b
+  fieldref:
+    fieldpath: spec.rules[0].host
+`)
+
+	th.WriteF("service-a.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-a
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-a
+    spec:
+      containers:
+      - image: repository/service-a:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+        env:
+        - name: REDIRECT_URI
+          value: "http://$(SERVICE_B_DNS_NAME):80/oauth_redir"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-a
+  labels:
+    app.kubernetes.io/component: service-a
+spec:
+  type: LoadBalancer
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-a
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-a
+spec:
+  rules:
+  - host: service-a.k8s.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service-a
+            port:
+              number: 8080
+`)
+
+	th.WriteF("service-a-patch.yaml", `
+- op: replace
+  path: /spec/rules/0/host
+  value: new-service-a.k8s.com
+`)
+
+	th.WriteF("service-b.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-b
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-b
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-b
+    spec:
+      containers:
+      - image: repository/service-b:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+        env:
+        - name: REDIRECT_URI
+          value: "http://$(SERVICE_A_DNS_NAME):80/oauth_redir"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-b
+  labels:
+    app.kubernetes.io/component: service-b
+spec:
+  type: LoadBalancer
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-b
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-b
+spec:
+  rules:
+  - host: service-b.k8s.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service-b
+            port:
+              number: 8080
+`)
+	th.WriteF("service-b-patch.yaml", `
+- op: replace
+  path: /spec/rules/0/host
+  value: new-service-b.k8s.com
+`)
+	m := th.Run(".", opts)
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-a
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-a
+    spec:
+      containers:
+      - env:
+        - name: REDIRECT_URI
+          value: http://new-service-b.k8s.com:80/oauth_redir
+        image: repository/service-a:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: service-a
+  name: service-a
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-a
+  type: LoadBalancer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-a
+spec:
+  rules:
+  - host: new-service-a.k8s.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: service-a
+            port:
+              number: 8080
+        path: /
+        pathType: Prefix
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-b
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-b
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-b
+    spec:
+      containers:
+      - env:
+        - name: REDIRECT_URI
+          value: http://new-service-a.k8s.com:80/oauth_redir
+        image: repository/service-b:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: service-b
+  name: service-b
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-b
+  type: LoadBalancer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-b
+spec:
+  rules:
+  - host: new-service-b.k8s.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: service-b
+            port:
+              number: 8080
+        path: /
+        pathType: Prefix
+`)
+}

api/krusty/kustomizer.go

@@ -11,11 +11,12 @@ import (
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
 	"sigs.k8s.io/kustomize/api/konfig"
-	"sigs.k8s.io/kustomize/api/krusty/internal/provider"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provenance"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 )
 
 // Kustomizer performs kustomizations.  It's meant to behave
@@ -53,7 +54,7 @@ func MakeKustomizer(fSys filesys.FileSystem, o *Options) *Kustomizer {
 func (b *Kustomizer) Run(path string) (resmap.ResMap, error) {
 	resmapFactory := resmap.NewFactory(
 		b.depProvider.GetResourceFactory(),
-		b.depProvider.GetMerginator())
+		b.depProvider.GetConflictDetectorFactory())
 	lr := fLdr.RestrictionNone
 	if b.options.LoadRestrictions == types.LoadRestrictionsRootOnly {
 		lr = fLdr.RestrictionRootOnly
@@ -73,6 +74,10 @@ func (b *Kustomizer) Run(path string) (resmap.ResMap, error) {
 	if err != nil {
 		return nil, err
 	}
+	err = openapi.SetSchemaVersion(kt.Kustomization().OpenAPI, true)
+	if err != nil {
+		return nil, err
+	}
 	var m resmap.ResMap
 	m, err = kt.MakeCustomizedResMap()
 	if err != nil {
@@ -85,7 +90,7 @@ func (b *Kustomizer) Run(path string) (resmap.ResMap, error) {
 		t := builtins.LabelTransformerPlugin{
 			Labels: map[string]string{
 				konfig.ManagedbyLabelKey: fmt.Sprintf(
-					"kustomize-%s", provenance.GetProvenance().Version)},
+					"kustomize-%s", provenance.GetProvenance().Semver())},
 			FieldSpecs: []types.FieldSpec{{
 				Path:               "metadata/labels",
 				CreateIfNotPresent: true,
@@ -93,5 +98,6 @@ func (b *Kustomizer) Run(path string) (resmap.ResMap, error) {
 		}
 		t.Transform(m)
 	}
+	m.RemoveBuildAnnotations()
 	return m, nil
 }