Show prow build instead of deprecated travis

Add json6902 patch filter based on kyaml libraries

OWNERS_ALIASES

@@ -9,3 +9,4 @@ aliases:
     - mengqiy
     - monopole
     - pwittrock
+    - mortent

README.md

@@ -12,8 +12,7 @@ and it's like [`sed`], in that it emits edited text.
 This tool is sponsored by [sig-cli] ([KEP]), and
 inspired by [DAM].
 
-
-[![Build Status](https://travis-ci.org/kubernetes-sigs/kustomize.svg?branch=master)](https://travis-ci.org/kubernetes-sigs/kustomize)
+[![Build Status](https://prow.k8s.io/badge.svg?jobs=kustomize-presubmit-master)](https://prow.k8s.io/job-history/kubernetes-jenkins/pr-logs/directory/kustomize-presubmit-master)
 [![Go Report Card](https://goreportcard.com/badge/github.com/kubernetes-sigs/kustomize)](https://goreportcard.com/report/github.com/kubernetes-sigs/kustomize)
 
 Download a binary from the [release page], or see

api/builtins/AnnotationsTransformer.go

@@ -4,9 +4,11 @@
 package builtins
 
 import (
+	"sigs.k8s.io/kustomize/api/filters/annotations"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -14,6 +16,10 @@ import (
 type AnnotationsTransformerPlugin struct {
 	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
 	FieldSpecs  []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	// YAMLSupport can be set to true to use the kyaml filter instead of the
+	// kunstruct transformer
+	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *AnnotationsTransformerPlugin) Config(
@@ -24,14 +30,27 @@ func (p *AnnotationsTransformerPlugin) Config(
 }
 
 func (p *AnnotationsTransformerPlugin) Transform(m resmap.ResMap) error {
-	t, err := transform.NewMapTransformer(
-		p.FieldSpecs,
-		p.Annotations,
-	)
-	if err != nil {
-		return err
+	if p.YAMLSupport {
+		for _, r := range m.Resources() {
+			err := filtersutil.ApplyToJSON(annotations.Filter{
+				Annotations: p.Annotations,
+				FsSlice:     p.FieldSpecs,
+			}, r.Kunstructured)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	} else {
+		t, err := transform.NewMapTransformer(
+			p.FieldSpecs,
+			p.Annotations,
+		)
+		if err != nil {
+			return err
+		}
+		return t.Transform(m)
 	}
-	return t.Transform(m)
 }
 
 func NewAnnotationsTransformerPlugin() resmap.TransformerPlugin {

api/builtins/NamespaceTransformer.go

@@ -6,12 +6,13 @@ package builtins
 import (
 	"fmt"
 
-	"sigs.k8s.io/kustomize/api/transform"
-
+	"sigs.k8s.io/kustomize/api/filters/namespace"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -19,6 +20,11 @@ import (
 type NamespaceTransformerPlugin struct {
 	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	FieldSpecs       []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	// YAMLSupport can be set to true to use the kyaml filter instead of the
+	// kunstruct transformer.
+	// TODO: change the default to use kyaml when it is stable
+	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *NamespaceTransformerPlugin) Config(
@@ -39,12 +45,25 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 		}
 
 		id := r.OrgId()
-		applicableFs := p.applicableFieldSpecs(id)
 
-		for _, fs := range applicableFs {
-			err := transform.MutateField(
-				r.Map(), fs.PathSlice(), fs.CreateIfNotPresent,
-				p.changeNamespace(r))
+		if !p.YAMLSupport {
+			// use the old style transform
+			applicableFs := p.applicableFieldSpecs(id)
+
+			for _, fs := range applicableFs {
+				err := transform.MutateField(
+					r.Map(), fs.PathSlice(), fs.CreateIfNotPresent,
+					p.changeNamespace(r))
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			// use the new style transform
+			err := filtersutil.ApplyToJSON(namespace.Filter{
+				Namespace: p.Namespace,
+				FsSlice:   p.FieldSpecs,
+			}, r.Kunstructured)
 			if err != nil {
 				return err
 			}

api/builtins/PatchJson6902Transformer.go

@@ -8,10 +8,12 @@ import (
 
 	jsonpatch "github.com/evanphx/json-patch"
 	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -21,6 +23,8 @@ type PatchJson6902TransformerPlugin struct {
 	Target       types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
 	Path         string            `json:"path,omitempty" yaml:"path,omitempty"`
 	JsonOp       string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
+
+	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *PatchJson6902TransformerPlugin) Config(
@@ -83,16 +87,22 @@ func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
 	if err != nil {
 		return err
 	}
-	rawObj, err := obj.MarshalJSON()
-	if err != nil {
-		return err
+	if !p.YAMLSupport {
+		rawObj, err := obj.MarshalJSON()
+		if err != nil {
+			return err
+		}
+		modifiedObj, err := p.decodedPatch.Apply(rawObj)
+		if err != nil {
+			return errors.Wrapf(
+				err, "failed to apply json patch '%s'", p.JsonOp)
+		}
+		return obj.UnmarshalJSON(modifiedObj)
+	} else {
+		return filtersutil.ApplyToJSON(patchjson6902.Filter{
+			Patch: p.JsonOp,
+		}, obj.Kunstructured)
 	}
-	modifiedObj, err := p.decodedPatch.Apply(rawObj)
-	if err != nil {
-		return errors.Wrapf(
-			err, "failed to apply json patch '%s'", p.JsonOp)
-	}
-	return obj.UnmarshalJSON(modifiedObj)
 }
 
 func NewPatchJson6902TransformerPlugin() resmap.TransformerPlugin {

api/builtins/PatchStrategicMergeTransformer.go

@@ -4,11 +4,16 @@
 package builtins
 
 import (
+	"encoding/json"
 	"fmt"
 
+	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
+
+	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -17,6 +22,8 @@ type PatchStrategicMergeTransformerPlugin struct {
 	loadedPatches []*resource.Resource
 	Paths         []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 	Patches       string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
+
+	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *PatchStrategicMergeTransformerPlugin) Config(
@@ -69,22 +76,42 @@ func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error
 		if err != nil {
 			return err
 		}
-		err = target.Patch(patch.Kunstructured)
-		if err != nil {
-			return err
-		}
-		// remove the resource from resmap
-		// when the patch is to $patch: delete that target
-		if len(target.Map()) == 0 {
-			err = m.Remove(target.CurId())
+		if !p.YAMLSupport {
+			err = target.Patch(patch.Kunstructured)
 			if err != nil {
 				return err
 			}
+			// remove the resource from resmap
+			// when the patch is to $patch: delete that target
+			if len(target.Map()) == 0 {
+				err = m.Remove(target.CurId())
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			node, err := getRNode(patch)
+			if err != nil {
+				return err
+			}
+			err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
+				Patch: node,
+			}, target.Kunstructured)
 		}
 	}
 	return nil
 }
 
+//TODO: Remove this once the next version of kyaml is released which
+// exposes GetRNode from the filutersutil package.
+func getRNode(k json.Marshaler) (*kyaml.RNode, error) {
+	j, err := k.MarshalJSON()
+	if err != nil {
+		return nil, err
+	}
+	return kyaml.Parse(string(j))
+}
+
 func NewPatchStrategicMergeTransformerPlugin() resmap.TransformerPlugin {
 	return &PatchStrategicMergeTransformerPlugin{}
 }

api/filters/annotations/annotations.go

@@ -0,0 +1,42 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package annotations
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type annoMap map[string]string
+
+type Filter struct {
+	// Annotations is the set of annotations to apply to the inputs
+	Annotations annoMap `yaml:"annotations,omitempty"`
+
+	// FsSlice contains the FieldSpecs to locate the namespace field
+	FsSlice types.FsSlice
+}
+
+var _ kio.Filter = Filter{}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	keys := filtersutil.SortedMapKeys(f.Annotations)
+	_, err := kio.FilterAll(yaml.FilterFunc(
+		func(node *yaml.RNode) (*yaml.RNode, error) {
+			for _, k := range keys {
+				if err := node.PipeE(fsslice.Filter{
+					FsSlice:    f.FsSlice,
+					SetValue:   fsslice.SetEntry(k, f.Annotations[k]),
+					CreateKind: yaml.MappingNode, // Annotations are MappingNodes.
+				}); err != nil {
+					return nil, err
+				}
+			}
+			return node, nil
+		})).Filter(nodes)
+	return nodes, err
+}

api/filters/annotations/annotations_test.go

@@ -0,0 +1,139 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package annotations
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var annosFs = builtinconfig.MakeDefaultConfig().CommonAnnotations
+
+func TestAnnotations_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input          string
+		expectedOutput string
+		filter         Filter
+		fsslice        types.FsSlice
+	}{
+		"add": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  annotations:
+    hero: batman
+    fiend: riddler
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  annotations:
+    hero: batman
+    fiend: riddler
+    auto: ford
+    bean: cannellini
+    clown: emmett kelley
+    dragon: smaug
+`,
+			filter: Filter{Annotations: annoMap{
+				"clown":  "emmett kelley",
+				"auto":   "ford",
+				"dragon": "smaug",
+				"bean":   "cannellini",
+			}},
+		},
+		"update": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  annotations:
+    hero: batman
+    fiend: riddler
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  annotations:
+    hero: superman
+    fiend: luthor
+    bean: cannellini
+    clown: emmett kelley
+`,
+			filter: Filter{Annotations: annoMap{
+				"clown": "emmett kelley",
+				"hero":  "superman",
+				"fiend": "luthor",
+				"bean":  "cannellini",
+			}},
+		},
+		"data-fieldspecs": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  annotations:
+    sleater: kinney
+a:
+  b:
+    sleater: kinney
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  annotations:
+    sleater: kinney
+a:
+  b:
+    sleater: kinney
+`,
+			filter: Filter{Annotations: annoMap{
+				"sleater": "kinney",
+			}},
+			fsslice: []types.FieldSpec{
+				{
+					Path:               "a/b",
+					CreateIfNotPresent: true,
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			filter := tc.filter
+			filter.FsSlice = append(annosFs, tc.fsslice...)
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expectedOutput),
+				strings.TrimSpace(filtertest_test.RunFilter(t, tc.input, filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/annotations/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package annotations contains a kio.Filter implementation of the kustomize
+// annotations transformer.
+package annotations

api/filters/annotations/example_test.go

@@ -0,0 +1,55 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package annotations
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	fss := builtinconfig.MakeDefaultConfig().CommonAnnotations
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`)}},
+		Filters: []kio.Filter{Filter{
+			Annotations: map[string]string{
+				"foo": "bar",
+			},
+			FsSlice: fss,
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	//   annotations:
+	//     foo: bar
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	//   annotations:
+	//     foo: bar
+}

api/filters/filtersutil/filtersutil.go

@@ -0,0 +1,21 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filtersutil
+
+import (
+	"sort"
+)
+
+// SortedMapKeys returns a sorted slice of keys to the given map.
+// Writing this function never gets old.
+func SortedMapKeys(m map[string]string) []string {
+	keys := make([]string, len(m))
+	i := 0
+	for k := range m {
+		keys[i] = k
+		i++
+	}
+	sort.Strings(keys)
+	return keys
+}

api/filters/filtersutil/filtersutil_test.go

@@ -0,0 +1,34 @@
+package filtersutil_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+)
+
+func TestSortedKeys(t *testing.T) {
+	testCases := map[string]struct {
+		input    map[string]string
+		expected []string
+	}{
+		"empty": {
+			input:    map[string]string{},
+			expected: []string{}},
+		"one": {
+			input:    map[string]string{"a": "aaa"},
+			expected: []string{"a"}},
+		"three": {
+			input:    map[string]string{"c": "ccc", "b": "bbb", "a": "aaa"},
+			expected: []string{"a", "b", "c"}},
+	}
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			if !assert.Equal(t,
+				filtersutil.SortedMapKeys(tc.input),
+				tc.expected) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/fsslice/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package fsslice contains a yaml.Filter to modify a resource using an
+// FsSlice to identify fields to be updated within the resource.
+package fsslice

api/filters/fsslice/example_test.go

@@ -0,0 +1,62 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fsslice_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func ExampleFilter() {
+	in := &kio.ByteReader{
+		Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`),
+	}
+	fltr := fsslice.Filter{
+		CreateKind: yaml.ScalarNode,
+		SetValue:   fsslice.SetScalar("green"),
+		FsSlice: []types.FieldSpec{
+			{Path: "a/b", CreateIfNotPresent: true},
+		},
+	}
+
+	err := kio.Pipeline{
+		Inputs:  []kio.Reader{in},
+		Filters: []kio.Filter{kio.FilterAll(fltr)},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// a:
+	//   b: green
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	// a:
+	//   b: green
+}

api/filters/fsslice/fieldspec_filter.go

@@ -0,0 +1,145 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fsslice
+
+import (
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// fieldSpecFilter applies a single fieldSpec to a single object
+// fieldSpecFilter stores internal state and should not be reused
+type fieldSpecFilter struct {
+	// FieldSpec contains the path to the value to set.
+	FieldSpec types.FieldSpec `yaml:"fieldSpec"`
+
+	// Set the field using this function
+	SetValue SetFn
+
+	// CreateKind defines the type of node to create if the field is not found
+	CreateKind yaml.Kind
+
+	// path keeps internal state about the current path
+	path []string
+}
+
+func (fltr fieldSpecFilter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
+	// check if the FieldSpec applies to the object
+	if match, err := isMatchGVK(fltr.FieldSpec, obj); !match || err != nil {
+		return obj, errors.Wrap(err)
+	}
+	fltr.path = strings.Split(fltr.FieldSpec.Path, "/")
+	if err := fltr.filter(obj); err != nil {
+		s, _ := obj.String()
+		return nil, errors.WrapPrefixf(err,
+			"obj %v at path %v", s, fltr.FieldSpec.Path)
+	}
+	return obj, nil
+}
+
+func (fltr fieldSpecFilter) filter(obj *yaml.RNode) error {
+	if len(fltr.path) == 0 {
+		// found the field -- set its value
+		return fltr.SetValue(obj)
+	}
+	switch obj.YNode().Kind {
+	case yaml.SequenceNode:
+		return fltr.seq(obj)
+	case yaml.MappingNode:
+		return fltr.field(obj)
+	}
+	// not found -- this might be an error since the type doesn't match
+
+	return errors.Errorf("unsupported yaml node")
+}
+
+// field calls filter on the field matching the next path element
+func (fltr fieldSpecFilter) field(obj *yaml.RNode) error {
+	fieldName, isSeq := isSequenceField(fltr.path[0])
+
+	// lookup the field matching the next path element
+	var lookupField yaml.Filter
+	switch {
+	case !fltr.FieldSpec.CreateIfNotPresent || fltr.CreateKind == 0 || isSeq:
+		// dont' create the field if we don't find it
+		lookupField = yaml.Lookup(fieldName)
+	case len(fltr.path) <= 1:
+		// create the field if it is missing: use the provided node kind
+		lookupField = yaml.LookupCreate(fltr.CreateKind, fieldName)
+	default:
+		// create the field if it is missing: must be a mapping node
+		lookupField = yaml.LookupCreate(yaml.MappingNode, fieldName)
+	}
+
+	// locate (or maybe create) the field
+	field, err := obj.Pipe(lookupField)
+	if err != nil || field == nil {
+		return errors.WrapPrefixf(err, "fieldName: %s", fieldName)
+	}
+
+	// copy the current fltr and change the path on the copy
+	var next = fltr
+	// call filter for the next path element on the matching field
+	next.path = fltr.path[1:]
+	return next.filter(field)
+}
+
+// seq calls filter on all sequence elements
+func (fltr fieldSpecFilter) seq(obj *yaml.RNode) error {
+	if err := obj.VisitElements(func(node *yaml.RNode) error {
+		// recurse on each element -- re-allocating a fieldSpecFilter is
+		// not strictly required, but is more consistent with field
+		// and less likely to have side effects
+		// keep the entire path -- it does not contain parts for sequences
+		return fltr.filter(node)
+	}); err != nil {
+		return errors.WrapPrefixf(err,
+			"visit traversal on path: %v", fltr.path)
+	}
+
+	return nil
+}
+
+// isSequenceField returns true if the path element is for a sequence field.
+// isSequence also returns the path element with the '[]' suffix trimmed
+func isSequenceField(name string) (string, bool) {
+	isSeq := strings.HasSuffix(name, "[]")
+	name = strings.TrimSuffix(name, "[]")
+	return name, isSeq
+}
+
+// isMatchGVK returns true if the fs.GVK matches the obj GVK.
+func isMatchGVK(fs types.FieldSpec, obj *yaml.RNode) (bool, error) {
+	meta, err := obj.GetMeta()
+	if err != nil {
+		return false, err
+	}
+	if fs.Kind != "" && fs.Kind != meta.Kind {
+		// kind doesn't match
+		return false, err
+	}
+
+	// parse the group and version from the apiVersion field
+	var group, version string
+	parts := strings.SplitN(meta.APIVersion, "/", 2)
+	group = parts[0]
+	if len(parts) > 1 {
+		version = parts[1]
+	}
+
+	if fs.Group != "" && fs.Group != group {
+		// group doesn't match
+		return false, nil
+	}
+
+	if fs.Version != "" && fs.Version != version {
+		// version doesn't match
+		return false, nil
+	}
+
+	return true, nil
+}

api/filters/fsslice/fsslice.go

@@ -0,0 +1,78 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fsslice
+
+import (
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// SetFn sets a value
+type SetFn func(*yaml.RNode) error
+
+// SetScalar returns a SetFn to set a scalar value
+func SetScalar(value string) SetFn {
+	return func(node *yaml.RNode) error {
+		return node.PipeE(yaml.FieldSetter{StringValue: value})
+	}
+}
+
+// SetEntry returns a SetFn to set an entry in a map
+func SetEntry(key, value string) SetFn {
+	return func(node *yaml.RNode) error {
+		return node.PipeE(yaml.FieldSetter{
+			Name: key, StringValue: value})
+	}
+}
+
+var _ yaml.Filter = Filter{}
+
+// Filter uses an FsSlice to modify fields on a single object
+type Filter struct {
+	// FieldSpecList list of FieldSpecs to set
+	FsSlice types.FsSlice `yaml:"fsSlice"`
+
+	// SetValue is called on each field that matches one of the FieldSpecs
+	SetValue SetFn
+
+	// CreateKind is used to create fields that do not exist
+	CreateKind yaml.Kind
+}
+
+func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
+	for i := range fltr.FsSlice {
+		// apply this FieldSpec
+		// create a new filter for each iteration because they
+		// store internal state about the field paths
+		_, err := (&fieldSpecFilter{
+			FieldSpec:  fltr.FsSlice[i],
+			SetValue:   fltr.SetValue,
+			CreateKind: fltr.CreateKind,
+		}).Filter(obj)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return obj, nil
+}
+
+// GetGVK parses the metadata into a GVK
+func GetGVK(meta yaml.ResourceMeta) resid.Gvk {
+	// parse the group and version from the apiVersion field
+	var group, version string
+	parts := strings.SplitN(meta.APIVersion, "/", 2)
+	group = parts[0]
+	if len(parts) > 1 {
+		version = parts[1]
+	}
+
+	return resid.Gvk{
+		Group:   group,
+		Version: version,
+		Kind:    meta.Kind,
+	}
+}

api/filters/fsslice/fsslice_test.go

@@ -0,0 +1,354 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fsslice_test
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type TestCase struct {
+	name     string
+	input    string
+	expected string
+	filter   fsslice.Filter
+	fsSlice  string
+	error    string
+}
+
+var tests = []TestCase{
+	{
+		name: "update",
+		fsSlice: `
+- path: a/b
+  group: foo
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b: e
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-kind-not-match",
+		fsSlice: `
+- path: a/b
+  group: foo
+  kind: Bar1
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar2
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar2
+a:
+  b: c
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-group-not-match",
+		fsSlice: `
+- path: a/b
+  group: foo1
+  kind: Bar
+`,
+		input: `
+apiVersion: foo2/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo2/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-version-not-match",
+		fsSlice: `
+- path: a/b
+  group: foo
+  version: v1beta1
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta2
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta2
+kind: Bar
+a:
+  b: c
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "bad-version",
+		fsSlice: `
+- path: a/b
+  group: foo
+  version: v1beta1
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta2/something
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta2/something
+kind: Bar
+a:
+  b: c
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "bad-meta",
+		fsSlice: `
+- path: a/b
+  group: foo
+  version: v1beta1
+  kind: Bar
+`,
+		input: `
+a:
+  b: c
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+		error: "missing Resource metadata",
+	},
+
+	{
+		name: "miss-match-type",
+		fsSlice: `
+- path: a/b/c
+  kind: Bar
+`,
+		input: `
+kind: Bar
+a:
+  b: a
+`,
+		error: "obj kind: Bar\na:\n  b: a\n at path a/b/c: unsupported yaml node",
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "add",
+		fsSlice: `
+- path: a/b/c/d
+  group: foo
+  create: true
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {b: {c: {d: e}}}
+`,
+		filter: fsslice.Filter{
+			SetValue:   fsslice.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	{
+		name: "update-in-sequence",
+		fsSlice: `
+- path: a/b[]/c/d
+  group: foo
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c:
+      d: a
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c:
+      d: e
+`,
+		filter: fsslice.Filter{
+			SetValue: fsslice.SetScalar("e"),
+		},
+	},
+
+	// Don't create a sequence
+	{
+		name: "empty-sequence-no-create",
+		fsSlice: `
+- path: a/b[]/c/d
+  group: foo
+  create: true
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		filter: fsslice.Filter{
+			SetValue:   fsslice.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	// Create a new field for an element in a sequence
+	{
+		name: "empty-sequence-create",
+		fsSlice: `
+- path: a/b[]/c/d
+  group: foo
+  create: true
+  kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c: {d: e}
+`,
+		filter: fsslice.Filter{
+			SetValue:   fsslice.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+}
+
+func TestFilter_Filter(t *testing.T) {
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			err := yaml.Unmarshal([]byte(test.fsSlice), &test.filter.FsSlice)
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+
+			out := &bytes.Buffer{}
+			rw := &kio.ByteReadWriter{
+				Reader:                bytes.NewBufferString(test.input),
+				Writer:                out,
+				OmitReaderAnnotations: true,
+			}
+
+			// run the filter
+			err = kio.Pipeline{
+				Inputs:  []kio.Reader{rw},
+				Filters: []kio.Filter{kio.FilterAll(test.filter)},
+				Outputs: []kio.Writer{rw},
+			}.Execute()
+			if test.error != "" {
+				if !assert.EqualError(t, err, test.error) {
+					t.FailNow()
+				}
+				// stop rest of test
+				return
+			}
+
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+
+			// check results
+			if !assert.Equal(t,
+				strings.TrimSpace(test.expected),
+				strings.TrimSpace(out.String())) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestGetGVK(t *testing.T) {
+	obj, err := yaml.Parse(`
+apiVersion: apps/v1
+kind: Deployment
+`)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	meta, err := obj.GetMeta()
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	gvk := fsslice.GetGVK(meta)
+	expected := resid.Gvk{Group: "apps", Version: "v1", Kind: "Deployment"}
+	if !assert.Equal(t, expected, gvk) {
+		t.FailNow()
+	}
+}

api/filters/imagetag/doc.go

@@ -0,0 +1,12 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package imagetag contains two kio.Filter implementations to cover the
+// functionality of the kustomize imagetag transformer.
+//
+// Filter updates fields based on a FieldSpec and an ImageTag.
+//
+// LegacyFilter doesn't use a FieldSpec, and instead only updates image
+// references if the field is name image and it is underneath a field called
+// either containers or initContainers.
+package imagetag

api/filters/imagetag/example_test.go

@@ -0,0 +1,126 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - name: FooBar
+    image: nginx
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+spec:
+  containers:
+  - name: BarFoo
+    image: nginx:1.2.1
+`)}},
+		Filters: []kio.Filter{Filter{
+			ImageTag: types.Image{
+				Name:    "nginx",
+				NewName: "apache",
+				Digest:  "12345",
+			},
+			FsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers[]/image",
+				},
+			},
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// spec:
+	//   containers:
+	//   - name: FooBar
+	//     image: apache@12345
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	// spec:
+	//   containers:
+	//   - name: BarFoo
+	//     image: apache@12345
+}
+
+func ExampleLegacyFilter() {
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - name: FooBar
+    image: nginx
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+spec:
+  containers:
+  - name: BarFoo
+    image: nginx:1.2.1
+`)}},
+		Filters: []kio.Filter{LegacyFilter{
+			ImageTag: types.Image{
+				Name:    "nginx",
+				NewName: "apache",
+				Digest:  "12345",
+			},
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// spec:
+	//   containers:
+	//   - name: FooBar
+	//     image: apache@12345
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	// spec:
+	//   containers:
+	//   - name: BarFoo
+	//     image: apache@12345
+}

api/filters/imagetag/imagetag.go

@@ -0,0 +1,44 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type Filter struct {
+	// imageTag is the tag we want to apply to the inputs
+	ImageTag types.Image `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
+
+	// FsSlice contains the FieldSpecs to locate the namespace field
+	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+var _ kio.Filter = Filter{}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	_, err := kio.FilterAll(yaml.FilterFunc(f.filter)).Filter(nodes)
+	return nodes, err
+}
+
+func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
+	if err := node.PipeE(fsslice.Filter{
+		FsSlice:  f.FsSlice,
+		SetValue: updateImageTagFn(f.ImageTag),
+	}); err != nil {
+		return nil, err
+	}
+	return node, nil
+}
+
+func updateImageTagFn(imageTag types.Image) fsslice.SetFn {
+	return func(node *yaml.RNode) error {
+		return node.PipeE(imageTagUpdater{
+			ImageTag: imageTag,
+		})
+	}
+}

api/filters/imagetag/imagetag_test.go

@@ -0,0 +1,101 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	filtertest "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestImageTagUpdater_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input          string
+		expectedOutput string
+		filter         Filter
+		fsSlice        types.FsSlice
+	}{
+		"update with digest": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  image: nginx:1.2.1
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  image: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/image",
+				},
+			},
+		},
+		"multiple matches in sequence": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: not_nginx@54321
+  - image: nginx:1.2.1
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: not_nginx@54321
+  - image: apache:3.2.1
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			filter := tc.filter
+			filter.FsSlice = tc.fsSlice
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expectedOutput),
+				strings.TrimSpace(filtertest.RunFilter(t, tc.input, filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/imagetag/legacy.go

@@ -0,0 +1,113 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// LegacyFilter is an implementation of the kio.Filter interface
+// that scans through the provided kyaml data structure and updates
+// any values of any image fields that is inside a sequence under
+// a field called either containers or initContainers. The field is only
+// update if it has a value that matches and image reference and the name
+// of the image is a match with the provided ImageTag.
+type LegacyFilter struct {
+	ImageTag types.Image `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
+}
+
+var _ kio.Filter = LegacyFilter{}
+
+func (lf LegacyFilter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(lf.filter)).Filter(nodes)
+}
+
+func (lf LegacyFilter) filter(node *yaml.RNode) (*yaml.RNode, error) {
+	meta, err := node.GetMeta()
+	if err != nil {
+		return nil, err
+	}
+
+	// We do not make any changes if the type of the resource
+	// is CustomResourceDefinition.
+	if meta.Kind == `CustomResourceDefinition` {
+		return node, nil
+	}
+
+	fff := findFieldsFilter{
+		fields:        []string{"containers", "initContainers"},
+		fieldCallback: checkImageTagsFn(lf.ImageTag),
+	}
+	if err := node.PipeE(fff); err != nil {
+		return nil, err
+	}
+	return node, nil
+}
+
+type fieldCallback func(node *yaml.RNode) error
+
+// findFieldsFilter is an implementation of the kio.Filter
+// interface. It will walk the data structure and look for fields
+// that matches the provided list of field names. For each match,
+// the value of the field will be passed in as a parameter to the
+// provided fieldCallback.
+// TODO: move this to kyaml/filterutils
+type findFieldsFilter struct {
+	fields []string
+
+	fieldCallback fieldCallback
+}
+
+func (f findFieldsFilter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
+	return obj, f.walk(obj)
+}
+
+func (f findFieldsFilter) walk(node *yaml.RNode) error {
+	switch node.YNode().Kind {
+	case yaml.MappingNode:
+		return node.VisitFields(func(n *yaml.MapNode) error {
+			err := f.walk(n.Value)
+			if err != nil {
+				return err
+			}
+			key := n.Key.YNode().Value
+			if contains(f.fields, key) {
+				return f.fieldCallback(n.Value)
+			}
+			return nil
+		})
+	case yaml.SequenceNode:
+		return node.VisitElements(func(n *yaml.RNode) error {
+			return f.walk(n)
+		})
+	}
+	return nil
+}
+
+func contains(slice []string, str string) bool {
+	for _, s := range slice {
+		if s == str {
+			return true
+		}
+	}
+	return false
+}
+
+func checkImageTagsFn(imageTag types.Image) fieldCallback {
+	return func(node *yaml.RNode) error {
+		if node.YNode().Kind != yaml.SequenceNode {
+			return nil
+		}
+
+		return node.VisitElements(func(n *yaml.RNode) error {
+			// Look up any fields on the provided node that is named
+			// image.
+			return n.PipeE(yaml.Get("image"), imageTagUpdater{
+				ImageTag: imageTag,
+			})
+		})
+	}
+}

api/filters/imagetag/legacy_test.go

@@ -0,0 +1,136 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	filtertest "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestLegacyImageTag_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input          string
+		expectedOutput string
+		filter         LegacyFilter
+	}{
+		"updates multiple images inside containers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: nginx:2.1.2
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache@12345
+  - image: apache@12345
+`,
+			filter: LegacyFilter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+		},
+		"updates inside both containers and initContainers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: nginx:1.2.1
+  - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: apache:3.2.1
+  - image: apache:1.2.3
+`,
+			filter: LegacyFilter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+		},
+		"updates on multiple depths": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec: 
+      initContainers:
+      - image: nginx:1.2.1
+      - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec:
+      initContainers:
+      - image: apache:3.2.1
+      - image: apache:1.2.3
+`,
+			filter: LegacyFilter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			filter := tc.filter
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expectedOutput),
+				strings.TrimSpace(filtertest.RunFilter(t, tc.input, filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/imagetag/updater.go

@@ -0,0 +1,43 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package imagetag
+
+import (
+	"sigs.k8s.io/kustomize/api/image"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// imageTagUpdater is an implementation of the kio.Filter interface
+// that will update the value of the yaml node based on the provided
+// ImageTag if the current value matches the format of an image reference.
+type imageTagUpdater struct {
+	Kind     string      `yaml:"kind,omitempty"`
+	ImageTag types.Image `yaml:"imageTag,omitempty"`
+}
+
+func (u imageTagUpdater) Filter(rn *yaml.RNode) (*yaml.RNode, error) {
+	if err := yaml.ErrorIfInvalid(rn, yaml.ScalarNode); err != nil {
+		return nil, err
+	}
+
+	value := rn.YNode().Value
+
+	if !image.IsImageMatched(value, u.ImageTag.Name) {
+		return rn, nil
+	}
+
+	name, tag := image.Split(value)
+	if u.ImageTag.NewName != "" {
+		name = u.ImageTag.NewName
+	}
+	if u.ImageTag.NewTag != "" {
+		tag = ":" + u.ImageTag.NewTag
+	}
+	if u.ImageTag.Digest != "" {
+		tag = "@" + u.ImageTag.Digest
+	}
+
+	return rn.Pipe(yaml.FieldSetter{StringValue: name + tag})
+}

api/filters/labels/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package labels contains a kio.Filter implementation of the kustomize
+// labels transformer.
+package labels

api/filters/labels/example_test.go

@@ -0,0 +1,55 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package labels
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	fss := builtinconfig.MakeDefaultConfig().CommonLabels
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`)}},
+		Filters: []kio.Filter{Filter{
+			Labels: map[string]string{
+				"foo": "bar",
+			},
+			FsSlice: fss,
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	//   labels:
+	//     foo: bar
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	//   labels:
+	//     foo: bar
+}

api/filters/labels/labels.go

@@ -0,0 +1,43 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package labels
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type labelMap map[string]string
+
+// Filter sets labels.
+type Filter struct {
+	// Labels is the set of labels to apply to the inputs
+	Labels labelMap `yaml:"labels,omitempty"`
+
+	// FsSlice identifies the label fields.
+	FsSlice types.FsSlice
+}
+
+var _ kio.Filter = Filter{}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	keys := filtersutil.SortedMapKeys(f.Labels)
+	_, err := kio.FilterAll(yaml.FilterFunc(
+		func(node *yaml.RNode) (*yaml.RNode, error) {
+			for _, k := range keys {
+				if err := node.PipeE(fsslice.Filter{
+					FsSlice:    f.FsSlice,
+					SetValue:   fsslice.SetEntry(k, f.Labels[k]),
+					CreateKind: yaml.MappingNode, // Labels are MappingNodes.
+				}); err != nil {
+					return nil, err
+				}
+			}
+			return node, nil
+		})).Filter(nodes)
+	return nodes, err
+}

api/filters/labels/labels_test.go

@@ -0,0 +1,139 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package labels
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var labelsFs = builtinconfig.MakeDefaultConfig().CommonLabels
+
+func TestLabels_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input          string
+		expectedOutput string
+		filter         Filter
+		fsSlice        types.FsSlice
+	}{
+		"add": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  labels:
+    hero: batman
+    fiend: riddler
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  labels:
+    hero: batman
+    fiend: riddler
+    auto: ford
+    bean: cannellini
+    clown: emmett kelley
+    dragon: smaug
+`,
+			filter: Filter{Labels: labelMap{
+				"clown":  "emmett kelley",
+				"auto":   "ford",
+				"dragon": "smaug",
+				"bean":   "cannellini",
+			}},
+		},
+		"update": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  labels:
+    hero: batman
+    fiend: riddler
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  labels:
+    hero: superman
+    fiend: luthor
+    bean: cannellini
+    clown: emmett kelley
+`,
+			filter: Filter{Labels: labelMap{
+				"clown": "emmett kelley",
+				"hero":  "superman",
+				"fiend": "luthor",
+				"bean":  "cannellini",
+			}},
+		},
+		"data-fieldspecs": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  labels:
+    sleater: kinney
+a:
+  b:
+    sleater: kinney
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  labels:
+    sleater: kinney
+a:
+  b:
+    sleater: kinney
+`,
+			filter: Filter{Labels: labelMap{
+				"sleater": "kinney",
+			}},
+			fsSlice: []types.FieldSpec{
+				{
+					Path:               "a/b",
+					CreateIfNotPresent: true,
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			filter := tc.filter
+			filter.FsSlice = append(labelsFs, tc.fsSlice...)
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expectedOutput),
+				strings.TrimSpace(filtertest_test.RunFilter(t, tc.input, filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/namespace/doc.go

@@ -0,0 +1,9 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package namespace contains a kio.Filter implementation of the kustomize
+// namespace transformer.
+//
+// Special cases for known Kubernetes resources have been hardcoded in addition
+// to those defined by the FsSlice.
+package namespace

api/filters/namespace/example_test.go

@@ -0,0 +1,50 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/filters/namespace"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	fss := builtinconfig.MakeDefaultConfig().NameSpace
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: bar
+`)}},
+		Filters: []kio.Filter{namespace.Filter{Namespace: "app", FsSlice: fss}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	//   namespace: app
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	//   namespace: app
+}

api/filters/namespace/namespace.go

@@ -0,0 +1,167 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type Filter struct {
+	// Namespace is the namespace to apply to the inputs
+	Namespace string `yaml:"namespace,omitempty"`
+
+	// FsSlice contains the FieldSpecs to locate the namespace field
+	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+var _ kio.Filter = Filter{}
+
+func (ns Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(ns.run)).Filter(nodes)
+}
+
+// Run runs the filter on a single node rather than a slice
+func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	// hacks for hardcoded types -- :(
+	if err := ns.hacks(node); err != nil {
+		return nil, err
+	}
+
+	// Remove the fieldspecs that are for hardcoded fields.  The fieldspecs
+	// exist for backwards compatibility with other implementations
+	// of this transformation.
+	// This implementation of the namespace transformation
+	// Does not use the fieldspecs for implementing cases which
+	// require hardcoded logic.
+	ns.FsSlice = ns.removeFieldSpecsForHacks(ns.FsSlice)
+
+	// transformations based on data -- :)
+	err := node.PipeE(fsslice.Filter{
+		FsSlice:    ns.FsSlice,
+		SetValue:   fsslice.SetScalar(ns.Namespace),
+		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
+	})
+	return node, err
+}
+
+// hacks applies the namespace transforms that are hardcoded rather
+// than specified through FieldSpecs.
+func (ns Filter) hacks(obj *yaml.RNode) error {
+	meta, err := obj.GetMeta()
+	if err != nil {
+		return err
+	}
+
+	if err := ns.metaNamespaceHack(obj, meta); err != nil {
+		return err
+	}
+
+	return ns.roleBindingHack(obj, meta)
+}
+
+// metaNamespaceHack is a hack for implementing the namespace transform
+// for the metadata.namespace field on namespace scoped resources.
+// namespace scoped resources are determined by NOT being present
+// in a blacklist of cluster-scoped resource types (by apiVersion and kind).
+//
+// This hack should be updated to allow individual resources to specify
+// if they are cluster scoped through either an annotation on the resources,
+// or through inlined OpenAPI on the resource as a YAML comment.
+func (ns Filter) metaNamespaceHack(obj *yaml.RNode, meta yaml.ResourceMeta) error {
+	gvk := fsslice.GetGVK(meta)
+	if !gvk.IsNamespaceableKind() {
+		return nil
+	}
+	f := fsslice.Filter{
+		FsSlice: []types.FieldSpec{
+			{Path: metaNamespaceField, CreateIfNotPresent: true},
+		},
+		SetValue:   fsslice.SetScalar(ns.Namespace),
+		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
+	}
+	_, err := f.Filter(obj)
+	return err
+}
+
+// roleBindingHack is a hack for implementing the namespace transform
+// for RoleBinding and ClusterRoleBinding resource types.
+// RoleBinding and ClusterRoleBinding have namespace set on
+// elements of the "subjects" field if and only if the subject elements
+// "name" is "default".  Otherwise the namespace is not set.
+//
+// Example:
+//
+// kind: RoleBinding
+// subjects:
+// - name: "default" # this will have the namespace set
+//   ...
+// - name: "something-else" # this will not have the namespace set
+//   ...
+func (ns Filter) roleBindingHack(obj *yaml.RNode, meta yaml.ResourceMeta) error {
+	if meta.Kind != roleBindingKind && meta.Kind != clusterRoleBindingKind {
+		return nil
+	}
+
+	// Lookup the namespace field on all elements.
+	// We should change the fieldspec so this isn't necessary.
+	obj, err := obj.Pipe(yaml.Lookup(subjectsField))
+	if err != nil || yaml.IsEmpty(obj) {
+		return err
+	}
+
+	// add the namespace to each "subject" with name: default
+	err = obj.VisitElements(func(o *yaml.RNode) error {
+		// copied from kunstruct based kustomize NamespaceTransformer plugin
+		// The only case we need to force the namespace
+		// if for the "service account". "default" is
+		// kind of hardcoded here for right now.
+		name, err := o.Pipe(
+			yaml.Lookup("name"), yaml.Match("default"),
+		)
+		if err != nil || yaml.IsEmpty(name) {
+			return err
+		}
+
+		// set the namespace for the default account
+		v := yaml.NewScalarRNode(ns.Namespace)
+		return o.PipeE(
+			yaml.LookupCreate(yaml.ScalarNode, "namespace"),
+			yaml.FieldSetter{Value: v},
+		)
+	})
+
+	return err
+}
+
+// removeFieldSpecsForHacks removes from the list fieldspecs that
+// have hardcoded implementations
+func (ns Filter) removeFieldSpecsForHacks(fs types.FsSlice) types.FsSlice {
+	var val types.FsSlice
+	for i := range fs {
+		// implemented by metaNamespaceHack
+		if fs[i].Path == metaNamespaceField {
+			continue
+		}
+		// implemented by roleBindingHack
+		if fs[i].Kind == roleBindingKind && fs[i].Path == subjectsField {
+			continue
+		}
+		// implemented by roleBindingHack
+		if fs[i].Kind == clusterRoleBindingKind && fs[i].Path == subjectsField {
+			continue
+		}
+		val = append(val, fs[i])
+	}
+	return val
+}
+
+const (
+	metaNamespaceField     = "metadata/namespace"
+	subjectsField          = "subjects"
+	roleBindingKind        = "RoleBinding"
+	clusterRoleBindingKind = "ClusterRoleBinding"
+)

api/filters/namespace/namespace_test.go

@@ -0,0 +1,280 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filters/namespace"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var tests = []TestCase{
+	{
+		name: "add",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  namespace: foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: foo
+`,
+		filter: namespace.Filter{Namespace: "foo"},
+	},
+
+	{
+		name: "add-recurse",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+---
+apiVersion: example.com/v1
+kind: Bar
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  namespace: foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  namespace: foo
+`,
+		filter: namespace.Filter{Namespace: "foo"},
+	},
+
+	{
+		name: "update",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  # update this namespace
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: bar
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  # update this namespace
+  namespace: foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: foo
+`,
+		filter: namespace.Filter{Namespace: "foo"},
+	},
+
+	{
+		name: "update-rolebinding",
+		input: `
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: default
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: default
+  namespace: foo
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: something
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: something
+  namespace: foo
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: default
+  namespace: bar
+metadata:
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: default
+  namespace: bar
+metadata:
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: something
+metadata:
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: RoleBinding
+subjects:
+- name: something
+  namespace: foo
+metadata:
+  namespace: bar
+`,
+		filter: namespace.Filter{Namespace: "bar"},
+	},
+
+	{
+		name: "update-clusterrolebinding",
+		input: `
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: default
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: default
+  namespace: foo
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: something
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: something
+  namespace: foo
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: default
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: default
+  namespace: bar
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: something
+---
+apiVersion: example.com/v1
+kind: ClusterRoleBinding
+subjects:
+- name: something
+  namespace: foo
+`,
+		filter: namespace.Filter{Namespace: "bar"},
+	},
+
+	{
+		name: "data-fieldspecs",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+  namespace: foo
+a:
+  b:
+    c: foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: foo
+a:
+  b:
+    c: foo
+`,
+		filter: namespace.Filter{Namespace: "foo"},
+		fsslice: []types.FieldSpec{
+			{
+				Path:               "a/b/c",
+				CreateIfNotPresent: true,
+			},
+		},
+	},
+}
+
+type TestCase struct {
+	name     string
+	input    string
+	expected string
+	filter   namespace.Filter
+	fsslice  types.FsSlice
+}
+
+var config = builtinconfig.MakeDefaultConfig()
+
+func TestNamespace_Filter(t *testing.T) {
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			test.filter.FsSlice = append(config.NameSpace, test.fsslice...)
+			if !assert.Equal(t,
+				strings.TrimSpace(test.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, test.input, test.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/patchjson6902/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package namespace contains a kio.Filter implementation of the kustomize
+// patchjson6902 transformer
+package patchjson6902

api/filters/patchjson6902/example_test.go

@@ -0,0 +1,55 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package patchjson6902
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+  namespace: bar
+`)}},
+		Filters: []kio.Filter{
+			Filter{
+				Patch: `
+- op: replace
+  path: /metadata/namespace
+  value: "ns"
+`,
+			},
+		},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	//   namespace: ns
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	//   namespace: ns
+}

api/filters/patchjson6902/patchjson6902.go

@@ -0,0 +1,65 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package patchjson6902
+
+import (
+	"strings"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+	k8syaml "sigs.k8s.io/yaml"
+)
+
+type Filter struct {
+	Patch string
+
+	decodedPatch jsonpatch.Patch
+}
+
+var _ kio.Filter = Filter{}
+
+func (pf Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	decodedPatch, err := pf.decodePatch()
+	if err != nil {
+		return nil, err
+	}
+	pf.decodedPatch = decodedPatch
+	return kio.FilterAll(yaml.FilterFunc(pf.run)).Filter(nodes)
+}
+
+func (pf Filter) decodePatch() (jsonpatch.Patch, error) {
+	patch := pf.Patch
+	// If the patch doesn't look like a JSON6902 patch, we
+	// try to parse it to json.
+	if !strings.HasPrefix(pf.Patch, "[") {
+		p, err := k8syaml.YAMLToJSON([]byte(patch))
+		if err != nil {
+			return nil, err
+		}
+		patch = string(p)
+	}
+	decodedPatch, err := jsonpatch.DecodePatch([]byte(patch))
+	if err != nil {
+		return nil, err
+	}
+	return decodedPatch, nil
+}
+
+func (pf Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	// We don't actually use the kyaml library for manipulating the
+	// yaml here. We just marshal it to json and rely on the
+	// jsonpatch library to take care of applying the patch.
+	// This means ordering might not be preserved with this filter.
+	b, err := node.MarshalJSON()
+	if err != nil {
+		return nil, err
+	}
+	res, err := pf.decodedPatch.Apply(b)
+	if err != nil {
+		return nil, err
+	}
+	err = node.UnmarshalJSON(res)
+	return node, err
+}

api/filters/patchjson6902/patchjson6902_test.go

@@ -0,0 +1,173 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package patchjson6902
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	filtertest "sigs.k8s.io/kustomize/api/testutils/filtertest"
+)
+
+const input = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  replica: 2
+  template:
+    metadata:
+      labels:
+        old-label: old-value
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`
+
+func TestSomething(t *testing.T) {
+	testCases := []struct {
+		testName       string
+		input          string
+		filter         Filter
+		expectedOutput string
+	}{
+		{
+			testName: "single operation, json",
+			input:    input,
+			filter: Filter{
+				Patch: `[
+{"op": "replace", "path": "/spec/replica", "value": 5}
+]`,
+			},
+			expectedOutput: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  replica: 5
+  template:
+    metadata:
+      labels:
+        old-label: old-value
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`,
+		},
+		{
+			testName: "multiple operations, json",
+			input:    input,
+			filter: Filter{
+				Patch: `[
+{"op": "replace", "path": "/spec/template/spec/containers/0/name", "value": "my-nginx"},
+{"op": "add", "path": "/spec/replica", "value": 999},
+{"op": "add", "path": "/spec/template/spec/containers/0/command", "value": ["arg1", "arg2", "arg3"]}
+]`,
+			},
+			expectedOutput: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  replica: 999
+  template:
+    metadata:
+      labels:
+        old-label: old-value
+    spec:
+      containers:
+      - command:
+        - arg1
+        - arg2
+        - arg3
+        image: nginx
+        name: my-nginx
+`,
+		},
+		{
+			testName: "single operation, yaml",
+			input:    input,
+			filter: Filter{
+				Patch: `
+- op: replace
+  path: /spec/replica
+  value: 5
+`,
+			},
+			expectedOutput: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  replica: 5
+  template:
+    metadata:
+      labels:
+        old-label: old-value
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`,
+		},
+		{
+			testName: "multiple operations, yaml",
+			input:    input,
+			filter: Filter{
+				Patch: `
+- op: replace
+  path: /spec/template/spec/containers/0/name
+  value: my-nginx
+- op: add
+  path: /spec/replica
+  value: 999
+- op: add
+  path: /spec/template/spec/containers/0/command
+  value:
+  - arg1
+  - arg2
+  - arg3
+`,
+			},
+			expectedOutput: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  replica: 999
+  template:
+    metadata:
+      labels:
+        old-label: old-value
+    spec:
+      containers:
+      - command:
+        - arg1
+        - arg2
+        - arg3
+        image: nginx
+        name: my-nginx
+`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.testName, func(t *testing.T) {
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expectedOutput),
+				strings.TrimSpace(
+					filtertest.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/patchstrategicmerge/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package patchstrategicmerge contains a kio.Filter implementation of the
+// kustomize strategic merge patch transformer.
+package patchstrategicmerge

api/filters/patchstrategicmerge/example_test.go

@@ -0,0 +1,49 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package patchstrategicmerge
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func ExampleFilter() {
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  replicas: 3
+`)}},
+		Filters: []kio.Filter{Filter{
+			Patch: yaml.MustParse(`
+spec:
+  template:
+    containers:
+    - image: nginx
+`),
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// spec:
+	//   replicas: 3
+	//   template:
+	//     containers:
+	//     - image: nginx
+}

api/filters/patchstrategicmerge/patchstrategicmerge.go

@@ -0,0 +1,21 @@
+package patchstrategicmerge
+
+import (
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+	"sigs.k8s.io/kustomize/kyaml/yaml/merge2"
+)
+
+type Filter struct {
+	Patch *yaml.RNode
+}
+
+var _ kio.Filter = Filter{}
+
+func (pf Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(pf.run)).Filter(nodes)
+}
+
+func (pf Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	return merge2.Merge(pf.Patch, node)
+}

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -0,0 +1,82 @@
+package patchstrategicmerge
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	filtertest "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestFilter(t *testing.T) {
+	testCases := map[string]struct {
+		input    string
+		patch    *yaml.RNode
+		expected string
+	}{
+		"simple patch": {
+			input: `
+apiVersion: apps/v1
+metadata:
+  name: myDeploy
+kind: Deployment
+`,
+			patch: yaml.MustParse(`
+metadata:
+  name: yourDeploy
+`),
+			expected: `
+apiVersion: apps/v1
+metadata:
+  name: yourDeploy
+kind: Deployment
+`,
+		},
+		"nested patch": {
+			input: `
+apiVersion: apps/v1
+metadata:
+  name: myDeploy
+kind: Deployment
+spec:
+  containers:
+  - name: nginx
+    args:
+    - abc
+`,
+			patch: yaml.MustParse(`
+spec:
+  containers:
+  - name: nginx
+    args:
+    - def
+`),
+			expected: `
+apiVersion: apps/v1
+metadata:
+  name: myDeploy
+kind: Deployment
+spec:
+  containers:
+  - name: nginx
+    args:
+    - def
+`,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			f := Filter{
+				Patch: tc.patch,
+			}
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest.RunFilter(t, tc.input, f))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/prefixsuffix/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package prefixsuffix contains a kio.Filter implementation of the kustomize
+// PrefixSuffixTransformer.
+package prefixsuffix

api/filters/prefixsuffix/example_test.go

@@ -0,0 +1,47 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package prefixsuffix_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	fss := builtinconfig.MakeDefaultConfig().NamePrefix
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`)}},
+		Filters: []kio.Filter{prefixsuffix.Filter{Prefix: "baz-", FsSlice: fss}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: baz-instance
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: baz-instance
+}

api/filters/prefixsuffix/prefixsuffix.go

@@ -0,0 +1,43 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package prefixsuffix
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter applies resource name prefix's and suffix's using the fieldSpecs
+type Filter struct {
+	Prefix string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+	Suffix string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+
+	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+var _ kio.Filter = Filter{}
+
+func (ns Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(ns.run)).Filter(nodes)
+}
+
+// Run runs the filter on a single node rather than a slice
+func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	// transformations based on data -- :)
+	err := node.PipeE(fsslice.Filter{
+		FsSlice:    ns.FsSlice,
+		SetValue:   ns.set,
+		CreateKind: yaml.ScalarNode, // Name is a ScalarNode
+	})
+	return node, err
+}
+
+func (ns Filter) set(node *yaml.RNode) error {
+	return fsslice.SetScalar(fmt.Sprintf(
+		"%s%s%s", ns.Prefix, node.YNode().Value, ns.Suffix))(node)
+}

api/filters/prefixsuffix/prefixsuffix_test.go

@@ -0,0 +1,167 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package prefixsuffix_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var tests = []TestCase{
+	{
+		name: "prefix",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: foo-instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: foo-instance
+`,
+		filter: prefixsuffix.Filter{Prefix: "foo-"},
+	},
+
+	{
+		name: "suffix",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance-foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance-foo
+`,
+		filter: prefixsuffix.Filter{Suffix: "-foo"},
+	},
+
+	{
+		name: "prefix-suffix",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: bar-instance-foo
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: bar-instance-foo
+`,
+		filter: prefixsuffix.Filter{Prefix: "bar-", Suffix: "-foo"},
+	},
+
+	{
+		name: "data-fieldspecs",
+		input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+a:
+  b:
+    c: d
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+a:
+  b:
+    c: d
+`,
+		expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: foo-instance
+a:
+  b:
+    c: foo-d
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: foo-instance
+a:
+  b:
+    c: foo-d
+`,
+		filter: prefixsuffix.Filter{Prefix: "foo-"},
+		fsslice: []types.FieldSpec{
+			{
+				Path: "a/b/c",
+			},
+		},
+	},
+}
+
+type TestCase struct {
+	name     string
+	input    string
+	expected string
+	filter   prefixsuffix.Filter
+	fsslice  types.FsSlice
+}
+
+var config = builtinconfig.MakeDefaultConfig()
+
+func TestFilter(t *testing.T) {
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			test.filter.FsSlice = append(config.NamePrefix, test.fsslice...)
+			if !assert.Equal(t,
+				strings.TrimSpace(test.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, test.input, test.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/replicacount/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package replicacount contains a kio.Filter implementation of the kustomize
+// ReplicaCountTransformer.
+package replicacount

api/filters/replicacount/example_test.go

@@ -0,0 +1,64 @@
+package replicacount
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func ExampleFilter() {
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  template:
+    replicas: 5
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+spec:
+  template:
+    replicas: 5
+`)}},
+		Filters: []kio.Filter{Filter{
+			Replica: types.Replica{
+				Count: 42,
+				Name:  "instance",
+			},
+			FsSlice: types.FsSlice{
+				{
+					Path: "spec/template/replicas",
+				},
+			},
+		}},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// spec:
+	//   template:
+	//     replicas: 42
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	// spec:
+	//   template:
+	//     replicas: 42
+}

api/filters/replicacount/replicacount.go

@@ -0,0 +1,48 @@
+package replicacount
+
+import (
+	"strconv"
+
+	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter updates/sets replicas fields using the fieldSpecs
+type Filter struct {
+	Replica types.Replica `json:"replica,omitempty" yaml:"replica,omitempty"`
+
+	// FsSlice contains the FieldSpecs to locate the namespace field
+	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+var _ kio.Filter = Filter{}
+
+func (rc Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(rc.run)).Filter(nodes)
+}
+
+// run processes each node individually.
+func (rc Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	meta, err := node.GetMeta()
+	if err != nil {
+		return nil, err
+	}
+
+	// only update resources where the name matches the Replica name.
+	if meta.Name != rc.Replica.Name {
+		return node, nil
+	}
+
+	err = node.PipeE(fsslice.Filter{
+		FsSlice:    rc.FsSlice,
+		SetValue:   rc.set,
+		CreateKind: yaml.ScalarNode, // replicas is a ScalarNode
+	})
+	return node, err
+}
+
+func (rc Filter) set(node *yaml.RNode) error {
+	return fsslice.SetScalar(strconv.FormatInt(rc.Replica.Count, 10))(node)
+}

api/filters/replicacount/replicacount_test.go

@@ -0,0 +1,164 @@
+package replicacount
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestFilter(t *testing.T) {
+	var config = builtinconfig.MakeDefaultConfig()
+
+	testCases := map[string]struct {
+		input    string
+		expected string
+		filter   Filter
+		fsslice  types.FsSlice
+	}{
+		"update field": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 5
+`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 42
+`,
+			filter: Filter{
+				Replica: types.Replica{
+					Name:  "dep",
+					Count: 42,
+				},
+			},
+			fsslice: types.FsSlice{
+				{
+					Path: "spec/replicas",
+				},
+			},
+		},
+		"add field": {
+			input: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  template:
+    other: something
+`,
+			expected: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  template:
+    other: something
+    replicas: 42
+`,
+			filter: Filter{
+				Replica: types.Replica{
+					Name:  "cus",
+					Count: 42,
+				},
+			},
+			fsslice: types.FsSlice{
+				{
+					Path:               "spec/template/replicas",
+					CreateIfNotPresent: true,
+				},
+			},
+		},
+		"no update if CreateIfNotPresent is false": {
+			input: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  template:
+    other: something
+`,
+			expected: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  template:
+    other: something
+`,
+			filter: Filter{
+				Replica: types.Replica{
+					Name:  "cus",
+					Count: 42,
+				},
+			},
+			fsslice: types.FsSlice{
+				{
+					Path: "spec/template/replicas",
+				},
+			},
+		},
+		"update multiple fields": {
+			input: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  replicas: 5
+  template:
+    replicas: 5
+`,
+			expected: `
+apiVersion: custom/v1
+kind: Custom
+metadata:
+  name: cus
+spec:
+  replicas: 42
+  template:
+    replicas: 42
+`,
+			filter: Filter{
+				Replica: types.Replica{
+					Name:  "cus",
+					Count: 42,
+				},
+			},
+			fsslice: types.FsSlice{
+				{
+					Path: "spec/template/replicas",
+				},
+				{
+					Path: "spec/replicas",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			tc.filter.FsSlice = append(config.Replicas, tc.fsslice...)
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/go.mod

@@ -4,15 +4,18 @@ go 1.13
 
 require (
 	github.com/evanphx/json-patch v4.5.0+incompatible
-	github.com/go-openapi/spec v0.19.4
+	github.com/go-openapi/spec v0.19.5
 	github.com/golangci/golangci-lint v1.21.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/pkg/errors v0.8.1
+	github.com/stretchr/testify v1.4.0
+	github.com/yujunz/go-getter v1.4.1-lite
 	golang.org/x/tools v0.0.0-20191010075000-0337d82405ff
-	gopkg.in/yaml.v2 v2.2.4
+	gopkg.in/yaml.v2 v2.2.7
 	k8s.io/api v0.17.0
 	k8s.io/apimachinery v0.17.0
 	k8s.io/client-go v0.17.0
 	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
+	sigs.k8s.io/kustomize/kyaml v0.1.5
 	sigs.k8s.io/yaml v1.1.0
 )

api/go.sum

@@ -1,6 +1,7 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
 github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
 github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
@@ -14,6 +15,7 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OpenPeeDeeP/depguard v1.0.1 h1:VlW4R6jmBIv3/u1JNlawEvJMM4J+dPORPaZasQee8Us=
 github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmUx/1V+TNhjQvM=
+github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
@@ -23,12 +25,18 @@ github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdko
 github.com/StackExchange/wmi v0.0.0-20180116203802-5d049714c4a6/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/bombsimon/wsl v1.2.5 h1:9gTOkIwVtoDZywvX802SDHokeX4kW1cKnV8ZTVAPkRs=
 github.com/bombsimon/wsl v1.2.5/go.mod h1:43lEF/i0kpXbLCeDXL9LMT8c92HyBywXb0AsgMHYngM=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -45,6 +53,7 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633 h1:H2pdYOb3KQ1/YsqVWoWNLQO+fusocsw354rqGTZtAgw=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
@@ -59,6 +68,8 @@ github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2H
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-critic/go-critic v0.3.5-0.20190904082202-d79a9f0c64db h1:GYXWx7Vr3+zv833u+8IoXbNnQY0AdXsxAgI0kX7xcwA=
 github.com/go-critic/go-critic v0.3.5-0.20190904082202-d79a9f0c64db/go.mod h1:+sE8vrLDS2M0pZkBk0wy6+nLdKexVDrl/jBqQOTDThA=
+github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-lintpack/lintpack v0.5.2 h1:DI5mA3+eKdWeJ40nU4d6Wc26qmdG8RCi/btYq0TuRN0=
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
@@ -74,8 +85,8 @@ github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1
 github.com/go-openapi/jsonreference v0.19.2 h1:o20suLFB4Ri0tuzpWtyHlh7E7HnkqTNLq6aR6WVNS1w=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
-github.com/go-openapi/spec v0.19.4 h1:ixzUSnHTd6hCemgtAJgluaTSGYpLNpJY4mA2DIkdOAo=
-github.com/go-openapi/spec v0.19.4/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/spec v0.19.5 h1:Xm0Ao53uqnk9QE/LlYV5DEU09UAgpliA85QoT9LzqPw=
+github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
 github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
@@ -176,6 +187,12 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
+github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
+github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -205,7 +222,6 @@ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFB
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -225,9 +241,12 @@ github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -237,6 +256,7 @@ github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/mozilla/tls-observatory v0.0.0-20190404164649-a3c1b6cfecfd/go.mod h1:SrKMQvPiws7F7iqYp8/TX+IhxCYhzr6N/1yb8cwHsGk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -251,6 +271,7 @@ github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
@@ -269,12 +290,14 @@ github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
 github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:5STLWrekHfjyYwxBRVRXNOSewLJ3PWfDJd1VyTS21fI=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/securego/gosec v0.0.0-20191002120514-e680875ea14d h1:BzRvVq1EHuIjxpijCEKpAxzKUUMurOQ4sknehIATRh8=
 github.com/securego/gosec v0.0.0-20191002120514-e680875ea14d/go.mod h1:w5+eXa0mYznDkHaMCXA4XYffjlH+cy1oyKbfzJXa2Do=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shirou/gopsutil v0.0.0-20190901111213-e4ec7b275ada/go.mod h1:WWnYX4lzhCH5h/3YBfyVA3VbLYjlMZZAQcW9ojMexNc=
 github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e h1:MZM7FHLqUHYI0Y/mQAt3d2aYa0SiNms/hFqC9qJYolM=
@@ -310,6 +333,7 @@ github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -318,6 +342,8 @@ github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiff
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
+github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
 github.com/ultraware/funlen v0.0.2 h1:Av96YVBwwNSe4MLR7iI/BIa3VyI7/djnto/pK3Uxbdo=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4 h1:If7Va4cM03mpgrNH9k49/VOicWpGoG70XPBFFODYDsg=
@@ -329,9 +355,15 @@ github.com/valyala/fasthttp v1.2.0/go.mod h1:4vX61m6KN+xDduDNwXrhIAVZaZaZiQ1luJk
 github.com/valyala/quicktemplate v1.2.0/go.mod h1:EH+4AkTd43SvgIbQHYu59/cJyxDoOVRUAfrukLPuGJ4=
 github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
+github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
+go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
@@ -340,7 +372,6 @@ golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -350,6 +381,7 @@ golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTk
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -387,10 +419,10 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -412,8 +444,6 @@ golang.org/x/tools v0.0.0-20190311215038-5c2858a9cfe5/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190322203728-c1a832b0ad89/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190521203540-521d6ed310dd/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59 h1:QjA/9ArTfVTLfEhClDCG7SGrZkZixxWpwNCDiwJfh88=
-golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190719005602-e377ae9d6386/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -448,6 +478,10 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
@@ -472,6 +506,15 @@ mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b h1:DxJ5nJdkhDlLok9K6qO+5290kphD
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f h1:Cq7MalBHYACRd6EesksG1Q8EoIAKOsiZviGKbOLIej4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
+sigs.k8s.io/kustomize v1.0.11 h1:Yb+6DDt9+aR2AvQApvUaKS/ugteeG4MPyoFeUHiPOjk=
+sigs.k8s.io/kustomize v2.0.3+incompatible h1:JUufWFNlI44MdtnjUqVnvh29rR37PQFzPbLXqhyOyX0=
+sigs.k8s.io/kustomize/kyaml v0.1.1 h1:nGUNYINljZNmlAS8uoobUv/wx/s3Pg8dNxYo+W7uYh0=
+sigs.k8s.io/kustomize/kyaml v0.1.1/go.mod h1:/NdPPfrperSCGjm55cwEro1loBVtbtVIXSb7FguK6uk=
+sigs.k8s.io/kustomize/kyaml v0.1.2 h1:l12+QGl+ETUHhP8/bZAi6TknU7H194fXL/9b2gUxZFY=
+sigs.k8s.io/kustomize/kyaml v0.1.3 h1:zbeHVTMCQPtWgjIH/YYJZC45mm7coTdw2TblyJ79BrY=
+sigs.k8s.io/kustomize/kyaml v0.1.3/go.mod h1:461i94nj0h0ylJ6w83jLkR4SqqVhn1iY6fjD0JSTQeE=
+sigs.k8s.io/kustomize/kyaml v0.1.5 h1:NicBWYTwkuOfVyZDbNkfSBSCwSgin4uirkedtyZltIc=
+sigs.k8s.io/kustomize/kyaml v0.1.5/go.mod h1:461i94nj0h0ylJ6w83jLkR4SqqVhn1iY6fjD0JSTQeE=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

api/image/image.go

@@ -0,0 +1,50 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package image
+
+import (
+	"regexp"
+	"strings"
+)
+
+// IsImageMatched returns true if the value of t is identical to the
+// image name in the full image name and tag as given by s.
+func IsImageMatched(s, t string) bool {
+	// Tag values are limited to [a-zA-Z0-9_.{}-].
+	// Some tools like Bazel rules_k8s allow tag patterns with {} characters.
+	// More info: https://github.com/bazelbuild/rules_k8s/pull/423
+	pattern, _ := regexp.Compile("^" + t + "(@sha256)?(:[a-zA-Z0-9_.{}-]*)?$")
+	return pattern.MatchString(s)
+}
+
+// Split separates and returns the name and tag parts
+// from the image string using either colon `:` or at `@` separators.
+// Note that the returned tag keeps its separator.
+func Split(imageName string) (name string, tag string) {
+	// check if image name contains a domain
+	// if domain is present, ignore domain and check for `:`
+	ic := -1
+	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
+		ic = strings.LastIndex(imageName, ":")
+	} else {
+		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
+		// set ic only if `:` is present
+		if lastIc > 0 {
+			ic = slashIndex + lastIc
+		}
+	}
+	ia := strings.LastIndex(imageName, "@")
+	if ic < 0 && ia < 0 {
+		return imageName, ""
+	}
+
+	i := ic
+	if ia > 0 {
+		i = ia
+	}
+
+	name = imageName[:i]
+	tag = imageName[i:]
+	return
+}

api/image/image_test.go

@@ -0,0 +1,80 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package image
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsImageMatched(t *testing.T) {
+	testCases := []struct {
+		testName  string
+		value     string
+		name      string
+		isMatched bool
+	}{
+		{
+			testName:  "identical",
+			value:     "nginx",
+			name:      "nginx",
+			isMatched: true,
+		},
+		{
+			testName:  "name is match",
+			value:     "nginx:12345",
+			name:      "nginx",
+			isMatched: true,
+		},
+		{
+			testName:  "name is not a match",
+			value:     "apache:12345",
+			name:      "nginx",
+			isMatched: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.testName, func(t *testing.T) {
+			assert.Equal(t, tc.isMatched, IsImageMatched(tc.value, tc.name))
+		})
+	}
+}
+
+func TestSplit(t *testing.T) {
+	testCases := []struct {
+		testName string
+		value    string
+		name     string
+		tag      string
+	}{
+		{
+			testName: "no tag",
+			value:    "nginx",
+			name:     "nginx",
+			tag:      "",
+		},
+		{
+			testName: "with tag",
+			value:    "nginx:1.2.3",
+			name:     "nginx",
+			tag:      ":1.2.3",
+		},
+		{
+			testName: "with digest",
+			value:    "nginx@12345",
+			name:     "nginx",
+			tag:      "@12345",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.testName, func(t *testing.T) {
+			name, tag := Split(tc.value)
+			assert.Equal(t, tc.name, name)
+			assert.Equal(t, tc.tag, tag)
+		})
+	}
+}

api/k8sdeps/kunstruct/unstructadapter.go

@@ -133,7 +133,7 @@ func (fs *UnstructAdapter) selectSubtree(path string) (map[string]interface{}, [
 func (fs *UnstructAdapter) GetFieldValue(path string) (interface{}, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return nil, noFieldError{Field: path}
+		return nil, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedFieldNoCopy(
@@ -141,14 +141,14 @@ func (fs *UnstructAdapter) GetFieldValue(path string) (interface{}, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return nil, noFieldError{Field: path}
+	return nil, NoFieldError{Field: path}
 }
 
 // GetString returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetString(path string) (string, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return "", noFieldError{Field: path}
+		return "", NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedString(
@@ -156,14 +156,14 @@ func (fs *UnstructAdapter) GetString(path string) (string, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return "", noFieldError{Field: path}
+	return "", NoFieldError{Field: path}
 }
 
 // GetStringSlice returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetStringSlice(path string) ([]string, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return []string{}, noFieldError{Field: path}
+		return []string{}, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedStringSlice(
@@ -171,14 +171,14 @@ func (fs *UnstructAdapter) GetStringSlice(path string) ([]string, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return []string{}, noFieldError{Field: path}
+	return []string{}, NoFieldError{Field: path}
 }
 
 // GetBool returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetBool(path string) (bool, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return false, noFieldError{Field: path}
+		return false, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedBool(
@@ -186,7 +186,7 @@ func (fs *UnstructAdapter) GetBool(path string) (bool, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return false, noFieldError{Field: path}
+	return false, NoFieldError{Field: path}
 }
 
 // GetFloat64 returns value at the given fieldpath.
@@ -201,14 +201,14 @@ func (fs *UnstructAdapter) GetFloat64(path string) (float64, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return 0, noFieldError{Field: path}
+	return 0, NoFieldError{Field: path}
 }
 
 // GetInt64 returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetInt64(path string) (int64, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return 0, noFieldError{Field: path}
+		return 0, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedInt64(
@@ -216,14 +216,14 @@ func (fs *UnstructAdapter) GetInt64(path string) (int64, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return 0, noFieldError{Field: path}
+	return 0, NoFieldError{Field: path}
 }
 
 // GetSlice returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetSlice(path string) ([]interface{}, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return nil, noFieldError{Field: path}
+		return nil, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedSlice(
@@ -231,14 +231,14 @@ func (fs *UnstructAdapter) GetSlice(path string) ([]interface{}, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return nil, noFieldError{Field: path}
+	return nil, NoFieldError{Field: path}
 }
 
 // GetStringMap returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return nil, noFieldError{Field: path}
+		return nil, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedStringMap(
@@ -246,14 +246,14 @@ func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error)
 	if found || err != nil {
 		return s, err
 	}
-	return nil, noFieldError{Field: path}
+	return nil, NoFieldError{Field: path}
 }
 
 // GetMap returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
 	content, fields, found, err := fs.selectSubtree(path)
 	if !found || err != nil {
-		return nil, noFieldError{Field: path}
+		return nil, NoFieldError{Field: path}
 	}
 
 	s, found, err := unstructured.NestedMap(
@@ -261,7 +261,7 @@ func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
 	if found || err != nil {
 		return s, err
 	}
-	return nil, noFieldError{Field: path}
+	return nil, NoFieldError{Field: path}
 }
 
 func (fs *UnstructAdapter) MatchesLabelSelector(selector string) (bool, error) {
@@ -340,11 +340,11 @@ func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
 	}
 }
 
-// noFieldError is returned when a field is expected, but missing.
-type noFieldError struct {
+// NoFieldError is returned when a field is expected, but missing.
+type NoFieldError struct {
 	Field string
 }
 
-func (e noFieldError) Error() string {
+func (e NoFieldError) Error() string {
 	return fmt.Sprintf("no field named '%s'", e.Field)
 }

api/konfig/builtinpluginconsts/namereference.go

@@ -345,5 +345,24 @@ nameReference:
     kind: PersistentVolumeClaim
   - path: spec/volumeClaimTemplates/spec/storageClassName
     kind: StatefulSet
+
+- kind: PriorityClass
+  version: v1
+  group: scheduling.k8s.io
+  fieldSpecs:
+  - path: spec/priorityClassName
+    kind: Pod
+  - path: spec/template/spec/priorityClassName
+    kind: StatefulSet
+  - path: spec/template/spec/priorityClassName
+    kind: Deployment
+  - path: spec/template/spec/priorityClassName
+    kind: ReplicationController
+  - path: spec/jobTemplate/spec/template/spec/priorityClassName
+    kind: CronJob
+  - path: spec/template/spec/priorityClassName
+    kind: Job
+  - path: spec/template/spec/priorityClassName
+    kind: DaemonSet
 `
 )

api/krusty/kustomizer_test.go

@@ -4,6 +4,7 @@
 package krusty_test
 
 import (
+	"strings"
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
@@ -21,7 +22,7 @@ func TestEmptyFileSystem(t *testing.T) {
 	if err == nil {
 		t.Fatalf("expected error")
 	}
-	if err.Error() != "'noSuchThing' doesn't exist" {
+	if !strings.Contains(err.Error(), "'noSuchThing' doesn't exist") {
 		t.Fatalf("unexpected error: %v", err)
 	}
 }

api/loader/fileloader.go

@@ -95,6 +95,13 @@ type fileLoader struct {
 	// Used to clone repositories.
 	cloner git.Cloner
 
+	// If this is non-nil, the files were
+	// obtained from the given resource
+	rscSpec *remoteTargetSpec
+
+	// Used to get resources
+	getter remoteTargetGetter
+
 	// Used to clean up, as needed.
 	cleaner func() error
 }
@@ -127,20 +134,21 @@ func newLoaderOrDie(
 		log.Fatalf("unable to make loader at '%s'; %v", path, err)
 	}
 	return newLoaderAtConfirmedDir(
-		lr, root, fSys, nil, git.ClonerUsingGitExec)
+		lr, root, fSys, nil, git.ClonerUsingGitExec, getRemoteTarget)
 }
 
 // newLoaderAtConfirmedDir returns a new fileLoader with given root.
 func newLoaderAtConfirmedDir(
 	lr LoadRestrictorFunc,
 	root filesys.ConfirmedDir, fSys filesys.FileSystem,
-	referrer *fileLoader, cloner git.Cloner) *fileLoader {
+	referrer *fileLoader, cloner git.Cloner, getter remoteTargetGetter) *fileLoader {
 	return &fileLoader{
 		loadRestrictor: lr,
 		root:           root,
 		referrer:       referrer,
 		fSys:           fSys,
 		cloner:         cloner,
+		getter:         getter,
 		cleaner:        func() error { return nil },
 	}
 }
@@ -170,37 +178,44 @@ func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 	if path == "" {
 		return nil, fmt.Errorf("new root cannot be empty")
 	}
-	repoSpec, err := git.NewRepoSpecFromUrl(path)
-	if err == nil {
+
+	ldr, errGet := newLoaderAtGetter(path, fl.fSys, nil, fl.cloner, fl.getter)
+	if errGet == nil {
+		return ldr, nil
+	}
+
+	repoSpec, errGit := git.NewRepoSpecFromUrl(path)
+	if errGit == nil {
 		// Treat this as git repo clone request.
-		if err := fl.errIfRepoCycle(repoSpec); err != nil {
-			return nil, err
+		if errGit := fl.errIfRepoCycle(repoSpec); errGit != nil {
+			return nil, errGit
 		}
 		return newLoaderAtGitClone(
-			repoSpec, fl.fSys, fl, fl.cloner)
+			repoSpec, fl.fSys, fl, fl.cloner, fl.getter)
 	}
+
 	if filepath.IsAbs(path) {
 		return nil, fmt.Errorf("new root '%s' cannot be absolute", path)
 	}
-	root, err := demandDirectoryRoot(fl.fSys, fl.root.Join(path))
-	if err != nil {
-		return nil, err
+	root, errDir := demandDirectoryRoot(fl.fSys, fl.root.Join(path))
+	if errDir != nil {
+		return nil, fmt.Errorf("Error loading %s with git: %v, dir: %v, get: %v", path, errGit, errDir, errGet)
 	}
-	if err := fl.errIfGitContainmentViolation(root); err != nil {
-		return nil, err
+	if errDir := fl.errIfGitContainmentViolation(root); errDir != nil {
+		return nil, errDir
 	}
-	if err := fl.errIfArgEqualOrHigher(root); err != nil {
-		return nil, err
+	if errDir := fl.errIfArgEqualOrHigher(root); errDir != nil {
+		return nil, errDir
 	}
 	return newLoaderAtConfirmedDir(
-		fl.loadRestrictor, root, fl.fSys, fl, fl.cloner), nil
+		fl.loadRestrictor, root, fl.fSys, fl, fl.cloner, fl.getter), nil
 }
 
 // newLoaderAtGitClone returns a new Loader pinned to a temporary
 // directory holding a cloned git repo.
 func newLoaderAtGitClone(
 	repoSpec *git.RepoSpec, fSys filesys.FileSystem,
-	referrer *fileLoader, cloner git.Cloner) (ifc.Loader, error) {
+	referrer *fileLoader, cloner git.Cloner, getter remoteTargetGetter) (ifc.Loader, error) {
 	cleaner := repoSpec.Cleaner(fSys)
 	err := cloner(repoSpec)
 	if err != nil {
@@ -230,6 +245,7 @@ func newLoaderAtGitClone(
 		repoSpec:       repoSpec,
 		fSys:           fSys,
 		cloner:         cloner,
+		getter:         getter,
 		cleaner:        cleaner,
 	}, nil
 }

api/loader/fileloader_test.go

@@ -388,7 +388,7 @@ whatever
 	}
 	l, err := newLoaderAtGitClone(
 		repoSpec, fSys, nil,
-		git.DoNothingCloner(filesys.ConfirmedDir(coRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(coRoot)), getNothing)
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -467,7 +467,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	}
 	l1, err = newLoaderAtGitClone(
 		repoSpec, fSys, nil,
-		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)), getNothing)
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -506,7 +506,7 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 	}
 	l1 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, root, fSys, nil,
-		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)), getNothing)
 	if l1.Root() != topDir {
 		t.Fatalf("unexpected root %s", l1.Root())
 	}
@@ -532,7 +532,7 @@ func TestRepoDirectCycleDetection(t *testing.T) {
 	}
 	l1 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, root, fSys, nil,
-		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)), getNothing)
 	p1 := "github.com/someOrg/someRepo/foo"
 	rs1, err := git.NewRepoSpecFromUrl(p1)
 	if err != nil {
@@ -561,7 +561,7 @@ func TestRepoIndirectCycleDetection(t *testing.T) {
 	}
 	l0 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, root, fSys, nil,
-		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)), getNothing)
 
 	p1 := "github.com/someOrg/someRepo1"
 	p2 := "github.com/someOrg/someRepo2"

api/loader/getter.go

@@ -0,0 +1,101 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"context"
+	"log"
+	"os"
+
+	"github.com/yujunz/go-getter"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/git"
+)
+
+type remoteTargetSpec struct {
+	// Raw is the original resource in kustomization.yaml
+	Raw string
+
+	// Dir is where the resource is saved
+	Dir filesys.ConfirmedDir
+}
+
+// Getter is a function that can gets resource
+type remoteTargetGetter func(rs *remoteTargetSpec) error
+
+func newLoaderAtGetter(raw string, fSys filesys.FileSystem, referrer *fileLoader, cloner git.Cloner, getter remoteTargetGetter) (ifc.Loader, error) {
+	rs := &remoteTargetSpec{
+		Raw: raw,
+	}
+
+	cleaner := func() error {
+		return fSys.RemoveAll(rs.Dir.String())
+	}
+
+	if err := getter(rs); err != nil {
+		cleaner()
+		return nil, err
+	}
+
+	return &fileLoader{
+		loadRestrictor: RestrictionRootOnly,
+		// TODO(yujunz): limit to getter root
+		root:     rs.Dir,
+		referrer: referrer,
+		fSys:     fSys,
+		cloner:   cloner,
+		rscSpec:  rs,
+		getter:   getter,
+		cleaner:  cleaner,
+	}, nil
+}
+
+func getRemoteTarget(rs *remoteTargetSpec) error {
+	var err error
+
+	rs.Dir, err = filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return err
+	}
+
+	// Get the pwd
+	pwd, err := os.Getwd()
+	if err != nil {
+		log.Fatalf("Error getting wd: %s", err)
+	}
+
+	opts := []getter.ClientOption{}
+	client := &getter.Client{
+		Ctx:  context.TODO(),
+		Src:  rs.Raw,
+		Dst:  rs.Dir.String(),
+		Pwd:  pwd,
+		Mode: getter.ClientModeAny,
+		Detectors: []getter.Detector{
+			new(getter.GitHubDetector),
+			new(getter.GitDetector),
+			new(getter.BitBucketDetector),
+		},
+		Options: opts,
+	}
+	return client.Get()
+}
+
+func getNothing(rs *remoteTargetSpec) error {
+	var err error
+	rs.Dir, err = filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return err
+	}
+
+	// Get the pwd
+	pwd, err := os.Getwd()
+	if err != nil {
+		log.Fatalf("Error getting wd: %s", err)
+	}
+
+	_, err = getter.Detect(rs.Raw, pwd, []getter.Detector{})
+	return err
+}

api/loader/loader.go

@@ -5,6 +5,8 @@
 package loader
 
 import (
+	"fmt"
+
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/git"
@@ -19,16 +21,23 @@ import (
 func NewLoader(
 	lr LoadRestrictorFunc,
 	target string, fSys filesys.FileSystem) (ifc.Loader, error) {
-	repoSpec, err := git.NewRepoSpecFromUrl(target)
-	if err == nil {
+
+	ldr, errGet := newLoaderAtGetter(target, fSys, nil, git.ClonerUsingGitExec, getRemoteTarget)
+	if errGet == nil {
+		return ldr, nil
+	}
+
+	repoSpec, errGit := git.NewRepoSpecFromUrl(target)
+	if errGit == nil {
 		// The target qualifies as a remote git target.
 		return newLoaderAtGitClone(
-			repoSpec, fSys, nil, git.ClonerUsingGitExec)
+			repoSpec, fSys, nil, git.ClonerUsingGitExec, getRemoteTarget)
 	}
-	root, err := demandDirectoryRoot(fSys, target)
-	if err != nil {
-		return nil, err
+
+	root, errDir := demandDirectoryRoot(fSys, target)
+	if errDir == nil {
+		return newLoaderAtConfirmedDir(lr, root, fSys, nil, git.ClonerUsingGitExec, getRemoteTarget), nil
 	}
-	return newLoaderAtConfirmedDir(
-		lr, root, fSys, nil, git.ClonerUsingGitExec), nil
+
+	return nil, fmt.Errorf("Error creating new loader with git: %v, dir: %v, get: %v", errGit, errDir, errGet)
 }

api/testutils/filtertest/runfilter.go

@@ -0,0 +1,30 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filtertest_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+)
+
+func RunFilter(t *testing.T, input string, f kio.Filter) string {
+	var out bytes.Buffer
+	rw := kio.ByteReadWriter{
+		Reader: bytes.NewBufferString(input),
+		Writer: &out,
+	}
+
+	err := kio.Pipeline{
+		Inputs:  []kio.Reader{&rw},
+		Filters: []kio.Filter{f},
+		Outputs: []kio.Writer{&rw},
+	}.Execute()
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	return out.String()
+}

api/testutils/kusttest/harnessenhanced.go

@@ -4,6 +4,9 @@
 package kusttest_test
 
 import (
+	"bytes"
+	"fmt"
+	"strconv"
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
@@ -16,6 +19,8 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // HarnessEnhanced manages a full plugin environment for tests.
@@ -109,12 +114,69 @@ func (th *HarnessEnhanced) LoadAndRunTransformer(
 	return resMap
 }
 
+func (th *HarnessEnhanced) RunTransformerAndCheckResult(
+	config, input, expected string) {
+	for _, b := range []bool{true, false} {
+		th.t.Run(fmt.Sprintf("yaml-%v", b), func(t *testing.T) {
+			c, err := toggleYamlSupportField(config, b)
+			if err != nil {
+				th.t.Fatalf("Err: %v", err)
+			}
+			resMap, err := th.RunTransformer(c, input)
+			if err != nil {
+				th.t.Fatalf("Err: %v", err)
+			}
+			th.AssertActualEqualsExpected(resMap, expected)
+		})
+	}
+}
+
+func toggleYamlSupportField(config string, yamlSupport bool) (string, error) {
+	var out bytes.Buffer
+	rw := kio.ByteReadWriter{
+		Reader: bytes.NewBufferString(config),
+		Writer: &out,
+	}
+
+	err := kio.Pipeline{
+		Inputs: []kio.Reader{&rw},
+		Filters: []kio.Filter{
+			kio.FilterAll(yaml.FilterFunc(
+				func(node *yaml.RNode) (*yaml.RNode, error) {
+					return node.Pipe(yaml.FieldSetter{
+						Name:        "yamlSupport",
+						StringValue: strconv.FormatBool(yamlSupport),
+					})
+				}),
+			),
+		},
+		Outputs: []kio.Writer{&rw},
+	}.Execute()
+	return out.String(), err
+}
+
 func (th *HarnessEnhanced) ErrorFromLoadAndRunTransformer(
 	config, input string) error {
 	_, err := th.RunTransformer(config, input)
 	return err
 }
 
+type AssertFunc func(t *testing.T, err error)
+
+func (th *HarnessEnhanced) RunTransformerAndCheckError(
+	config, input string, assertFn AssertFunc) {
+	for _, b := range []bool{true, false} {
+		th.t.Run(fmt.Sprintf("yaml-%v", b), func(t *testing.T) {
+			c, err := toggleYamlSupportField(config, b)
+			if err != nil {
+				th.t.Fatalf("Err: %v", err)
+			}
+			_, err = th.RunTransformer(c, input)
+			assertFn(t, err)
+		})
+	}
+}
+
 func (th *HarnessEnhanced) RunTransformer(
 	config, input string) (resmap.ResMap, error) {
 	resMap, err := th.rf.NewResMapFromBytes([]byte(input))

cmd/config/docs/commands/list-setters.md

@@ -18,6 +18,6 @@ List setters for Resources.
 
   Show setters:
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION   VALUE     TYPE     COUNT   SETBY  
     name-prefix   ''            PREFIX    string   2

cmd/config/docs/commands/set.md

@@ -28,8 +28,8 @@ the configuration as comments.
     Optional.  The value to set on the field.
 
 
-To print the possible setters for the Resources in a directory, run `set` on
-a directory -- e.g. `kustomize config set DIR/`.
+To print the possible setters for the Resources in a directory, run
+`list-setters` on a directory -- e.g. `kustomize config list-setters DIR/`.
 
 #### Tips
 
@@ -58,7 +58,7 @@ To create a custom setter for a field see: `kustomize help config create-setter`
 
   List setters: Show the possible setters
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION   VALUE     TYPE     COUNT   SETBY  
     name-prefix   ''            PREFIX    string   2
 
@@ -69,7 +69,7 @@ To create a custom setter for a field see: `kustomize help config create-setter`
 
   List setters: Show the new values
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION         VALUE     TYPE     COUNT     SETBY 
     name-prefix   'test environment'   test     string   2          dev
 

cmd/config/go.sum

@@ -109,6 +109,7 @@ github.com/posener/complete/v2 v2.0.1-alpha.12 h1:0wvkuDfHb5vSZlNBYgpEH4XQHpF46M
 github.com/posener/complete/v2 v2.0.1-alpha.12/go.mod h1://JlL91cS2JV7rOl6LVHrRqBXoBUecJu3ILQPgbJiMQ=
 github.com/posener/script v1.0.4 h1:nSuXW5ZdmFnQIueLB2s0qvs4oNsUloM1Zydzh75v42w=
 github.com/posener/script v1.0.4/go.mod h1:Rg3ijooqulo05aGLyGsHoLmIOUzHUVK19WVgrYBPU/E=
+github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d h1:K6eOUihrFLdZjZnA4XlRp864fmWXv9YTIk7VPLhRacA=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
@@ -135,6 +136,7 @@ github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mB
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
+go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

cmd/config/internal/commands/cmdlistsetters.go

@@ -29,6 +29,8 @@ func NewListSettersRunner(parent string) *ListSettersRunner {
 		PreRunE: r.preRunE,
 		RunE:    r.runE,
 	}
+	c.Flags().BoolVar(&r.Markdown, "markdown", false,
+		"output as github markdown")
 	fixDocs(parent, c)
 	r.Command = c
 	return r
@@ -39,9 +41,10 @@ func ListSettersCommand(parent string) *cobra.Command {
 }
 
 type ListSettersRunner struct {
-	Command *cobra.Command
-	Lookup  setters.LookupSetters
-	List    setters2.List
+	Command  *cobra.Command
+	Lookup   setters.LookupSetters
+	List     setters2.List
+	Markdown bool
 }
 
 func (r *ListSettersRunner) preRunE(c *cobra.Command, args []string) error {
@@ -64,7 +67,7 @@ func (r *ListSettersRunner) runE(c *cobra.Command, args []string) error {
 		if err := r.List.List(path, args[0]); err != nil {
 			return err
 		}
-		table := newTable(c.OutOrStdout())
+		table := newTable(c.OutOrStdout(), r.Markdown)
 		table.SetHeader([]string{"NAME", "VALUE", "SET BY", "DESCRIPTION", "COUNT"})
 		for i := range r.List.Setters {
 			s := r.List.Setters[i]
@@ -92,13 +95,19 @@ func (r *ListSettersRunner) runE(c *cobra.Command, args []string) error {
 	return handleError(c, lookup(r.Lookup, c, args))
 }
 
-func newTable(o io.Writer) *tablewriter.Table {
+func newTable(o io.Writer, m bool) *tablewriter.Table {
 	table := tablewriter.NewWriter(o)
 	table.SetRowLine(false)
-	table.SetBorder(false)
-	table.SetHeaderLine(false)
-	table.SetColumnSeparator(" ")
-	table.SetCenterSeparator(" ")
+	if m {
+		// markdown format
+		table.SetBorders(tablewriter.Border{Left: true, Top: false, Right: true, Bottom: false})
+		table.SetCenterSeparator("|")
+	} else {
+		table.SetBorder(false)
+		table.SetHeaderLine(false)
+		table.SetColumnSeparator(" ")
+		table.SetCenterSeparator(" ")
+	}
 	table.SetAlignment(tablewriter.ALIGN_LEFT)
 	return table
 }

cmd/config/internal/commands/run-fns.go

@@ -11,6 +11,7 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio/filters"
 	"sigs.k8s.io/kustomize/kyaml/runfn"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -40,10 +41,23 @@ func GetRunFnRunner(name string) *RunFnRunner {
 	r.Command.Flags().StringVar(
 		&r.Image, "image", "",
 		"run this image as a function instead of discovering them.")
+	r.Command.Flags().BoolVar(
+		&r.EnableStar, "enable-star", false, "enable support for starlark functions.")
+	r.Command.Flags().MarkHidden("enable-star")
+	r.Command.Flags().StringVar(
+		&r.StarPath, "star-path", "", "run a starlark script as a function.")
+	r.Command.Flags().MarkHidden("star-path")
+	r.Command.Flags().StringVar(
+		&r.StarName, "star-name", "", "name of starlark program.")
+	r.Command.Flags().MarkHidden("star-name")
+
 	r.Command.Flags().BoolVar(
 		&r.Network, "network", false, "enable network access for functions that declare it")
 	r.Command.Flags().StringVar(
 		&r.NetworkName, "network-name", "bridge", "the docker network to run the container in")
+	r.Command.Flags().StringArrayVar(
+		&r.Mounts, "mount", []string{},
+		"a list of storage options read from the filesystem")
 	return r
 }
 
@@ -59,43 +73,74 @@ type RunFnRunner struct {
 	GlobalScope        bool
 	FnPaths            []string
 	Image              string
+	EnableStar         bool
+	StarPath           string
+	StarName           string
 	RunFns             runfn.RunFns
 	Network            bool
 	NetworkName        string
+	Mounts             []string
 }
 
 func (r *RunFnRunner) runE(c *cobra.Command, args []string) error {
 	return handleError(c, r.RunFns.Execute())
 }
 
-// getFunctions parses the commandline flags and arguments into explicit
+// getContainerFunctions parses the commandline flags and arguments into explicit
 // Functions to run.
-func (r *RunFnRunner) getFunctions(c *cobra.Command, args, dataItems []string) (
+func (r *RunFnRunner) getContainerFunctions(c *cobra.Command, args, dataItems []string) (
 	[]*yaml.RNode, error) {
-	// if image isn't specified, then Functions is empty
-	if r.Image == "" {
+	if r.Image == "" && r.StarPath == "" {
 		return nil, nil
 	}
 
-	// create the function spec to set as an annotation
-	fn, err := yaml.Parse(`container: {}`)
-	if err != nil {
-		return nil, err
-	}
-	// TODO: add support network, volumes, etc based on flag values
-	err = fn.PipeE(
-		yaml.Lookup("container"),
-		yaml.SetField("image", yaml.NewScalarRNode(r.Image)))
-	if err != nil {
-		return nil, err
-	}
-	if r.Network {
-		err = fn.PipeE(
-			yaml.LookupCreate(yaml.MappingNode, "container", "network"),
-			yaml.SetField("required", yaml.NewScalarRNode("true")))
+	var fn *yaml.RNode
+	var err error
+
+	// if image isn't specified, then Functions is empty
+	if r.Image != "" {
+		// create the function spec to set as an annotation
+		fn, err = yaml.Parse(`container: {}`)
 		if err != nil {
 			return nil, err
 		}
+		// TODO: add support network, volumes, etc based on flag values
+		err = fn.PipeE(
+			yaml.Lookup("container"),
+			yaml.SetField("image", yaml.NewScalarRNode(r.Image)))
+		if err != nil {
+			return nil, err
+		}
+		if r.Network {
+			err = fn.PipeE(
+				yaml.LookupCreate(yaml.MappingNode, "container", "network"),
+				yaml.SetField("required", yaml.NewScalarRNode("true")))
+			if err != nil {
+				return nil, err
+			}
+		}
+	} else if r.EnableStar && r.StarPath != "" {
+		// create the function spec to set as an annotation
+		fn, err = yaml.Parse(`starlark: {}`)
+		if err != nil {
+			return nil, err
+		}
+
+		err = fn.PipeE(
+			yaml.Lookup("starlark"),
+			yaml.SetField("path", yaml.NewScalarRNode(r.StarPath)))
+		if err != nil {
+			return nil, err
+		}
+
+		err = fn.PipeE(
+			yaml.Lookup("starlark"),
+			yaml.SetField("name", yaml.NewScalarRNode(r.StarName)))
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		return nil, nil
 	}
 
 	// create the function config
@@ -159,8 +204,21 @@ data: {}
 	return []*yaml.RNode{rc}, nil
 }
 
+func toStorageMounts(mounts []string) []filters.StorageMount {
+	var sms []filters.StorageMount
+	for _, mount := range mounts {
+		sms = append(sms, filters.StringToStorageMount(mount))
+	}
+	return sms
+}
+
 func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
-	if c.ArgsLenAtDash() >= 0 && r.Image == "" {
+	if r.EnableStar != (r.StarPath != "") {
+		return errors.Errorf("must specify --star-path with --enable-star")
+	}
+
+	if c.ArgsLenAtDash() >= 0 && r.Image == "" &&
+		!(r.EnableStar && r.StarPath != "") {
 		return errors.Errorf("must specify --image")
 	}
 
@@ -173,7 +231,7 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		return errors.Errorf("0 or 1 arguments supported, function arguments go after '--'")
 	}
 
-	fns, err := r.getFunctions(c, args, dataItems)
+	fns, err := r.getContainerFunctions(c, args, dataItems)
 	if err != nil {
 		return err
 	}
@@ -195,15 +253,20 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		path = args[0]
 	}
 
+	// parse mounts to set storageMounts
+	storageMounts := toStorageMounts(r.Mounts)
+
 	r.RunFns = runfn.RunFns{
-		FunctionPaths: r.FnPaths,
-		GlobalScope:   r.GlobalScope,
-		Functions:     fns,
-		Output:        output,
-		Input:         input,
-		Path:          path,
-		Network:       r.Network,
-		NetworkName:   r.NetworkName,
+		FunctionPaths:  r.FnPaths,
+		GlobalScope:    r.GlobalScope,
+		Functions:      fns,
+		Output:         output,
+		Input:          input,
+		Path:           path,
+		Network:        r.Network,
+		NetworkName:    r.NetworkName,
+		EnableStarlark: r.EnableStar,
+		StorageMounts:  storageMounts,
 	}
 
 	// don't consider args for the function

cmd/config/internal/commands/run_test.go

@@ -27,6 +27,7 @@ func TestRunFnCommand_preRunE(t *testing.T) {
 		functionPaths []string
 		network       bool
 		networkName   string
+		mount         []string
 	}{
 		{
 			name: "config map",
@@ -154,6 +155,44 @@ kind: Foo
 apiVersion: v1
 `,
 		},
+		{
+			name: "star",
+			args: []string{"run", "dir",
+				"--enable-star",
+				"--star-path", "a/b/c",
+				"--star-name", "foo",
+				"--", "Foo", "g=h"},
+			path: "dir",
+			expected: `
+metadata:
+  name: function-input
+  annotations:
+    config.kubernetes.io/function: |
+      starlark: {path: a/b/c, name: foo}
+data: {g: h}
+kind: Foo
+apiVersion: v1
+`,
+		},
+		{
+			name: "star-not-enabled",
+			args: []string{"run", "dir",
+				"--star-path", "a/b/c",
+				"--star-name", "foo",
+				"--", "Foo", "g=h"},
+			path: "dir",
+			err:  "must specify --star-path with --enable-star",
+		},
+		{
+			name: "image-star-not-enabled",
+			args: []string{"run", "dir",
+				"--image", "some_image",
+				"--star-path", "a/b/c",
+				"--star-name", "foo",
+				"--", "Foo", "g=h"},
+			path: "dir",
+			err:  "must specify --star-path with --enable-star",
+		},
 		{
 			name:          "function paths",
 			args:          []string{"run", "dir", "--fn-path", "path1", "--fn-path", "path2"},
@@ -175,6 +214,26 @@ metadata:
 data: {g: h, i: j=k}
 kind: Foo
 apiVersion: v1
+`,
+		},
+		{
+			name: "custom kind with storage mounts",
+			args: []string{
+				"run", "dir", "--mount", "type=bind,src=/mount/path,dst=/local/",
+				"--mount", "type=volume,src=myvol,dst=/local/",
+				"--mount", "type=tmpfs,dst=/local/",
+				"--image", "foo:bar", "--", "Foo", "g=h", "i=j=k"},
+			path:  "dir",
+			mount: []string{"type=bind,src=/mount/path,dst=/local/", "type=volume,src=myvol,dst=/local/", "type=tmpfs,dst=/local/"},
+			expected: `
+metadata:
+  name: function-input
+  annotations:
+    config.kubernetes.io/function: |
+      container: {image: 'foo:bar'}
+data: {g: h, i: j=k}
+kind: Foo
+apiVersion: v1
 `,
 		},
 		{
@@ -265,6 +324,10 @@ apiVersion: v1
 				t.FailNow()
 			}
 
+			if !assert.Equal(t, toStorageMounts(tt.mount), r.RunFns.StorageMounts) {
+				t.FailNow()
+			}
+
 			// check if Functions were set
 			if tt.expected != "" {
 				if !assert.Len(t, r.RunFns.Functions, 1) {

cmd/config/internal/generateddocs/commands/docs.go

@@ -171,7 +171,7 @@ List setters for Resources.
 var ListSettersExamples = `
   Show setters:
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION   VALUE     TYPE     COUNT   SETBY  
     name-prefix   ''            PREFIX    string   2`
 
@@ -289,8 +289,8 @@ the configuration as comments.
     Optional.  The value to set on the field.
 
 
-To print the possible setters for the Resources in a directory, run ` + "`" + `set` + "`" + ` on
-a directory -- e.g. ` + "`" + `kustomize config set DIR/` + "`" + `.
+To print the possible setters for the Resources in a directory, run
+` + "`" + `list-setters` + "`" + ` on a directory -- e.g. ` + "`" + `kustomize config list-setters DIR/` + "`" + `.
 
 #### Tips
 
@@ -318,7 +318,7 @@ var SetExamples = `
 
   List setters: Show the possible setters
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION   VALUE     TYPE     COUNT   SETBY  
     name-prefix   ''            PREFIX    string   2
 
@@ -329,7 +329,7 @@ var SetExamples = `
 
   List setters: Show the new values
 
-    $ config set DIR/
+    $ config list-setters DIR/
         NAME      DESCRIPTION         VALUE     TYPE     COUNT     SETBY 
     name-prefix   'test environment'   test     string   2          dev
 

docs/inventory_object.md

@@ -56,7 +56,7 @@ The _inventory_ ConfigMap contains two special annotations:
   The value of this annotation is a hash that is
   computed from the list of items in the Inventory
 
-Basically, this inventory object acts a record of objects that are applied as a group.
+Basically, this inventory object acts as a record of objects that are applied as a group.
 This object can be consumed by a client such as
 [cli-experimental](https://github.com/kubernetes-sigs/cli-experimental).
 The client can recognize the inventory annotations and take proper actions

examples/helloWorld/README.md

@@ -148,7 +148,7 @@ commonLabels:
   org: acmeCorporation
 commonAnnotations:
   note: Hello, I am staging!
-resources:
+bases:
 - ../../base
 patchesStrategicMerge:
 - map.yaml
@@ -189,7 +189,7 @@ commonLabels:
   org: acmeCorporation
 commonAnnotations:
   note: Hello, I am production!
-resources:
+bases:
 - ../../base
 patchesStrategicMerge:
 - deployment.yaml

examples/jsonpatch.md

@@ -1,20 +1,22 @@
-# Demo: applying a json patch
+# JSON Patching
 
-A kustomization file supports customizing resources via [JSON patches](https://tools.ietf.org/html/rfc6902).
+[JSON patches]: https://tools.ietf.org/html/rfc6902
+[JSON patch]: https://tools.ietf.org/html/rfc6902
 
-The example below modifies an `Ingress` object with such a patch.
+A kustomization file supports customizing
+resources via [JSON patches].
 
-Make a `kustomization` containing an ingress resource.
+Make a place to work:
 
-<!-- @createIngress @testAgainstLatestRelease -->
+<!-- @placeToWork @testAgainstLatestRelease -->
 ```
 DEMO_HOME=$(mktemp -d)
+```
 
-cat <<EOF >$DEMO_HOME/kustomization.yaml
-resources:
-- ingress.yaml
-EOF
+We'll be editting an `Ingress` object:
 
+<!-- @ingress @testAgainstLatestRelease -->
+```
 cat <<EOF >$DEMO_HOME/ingress.yaml
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
@@ -25,94 +27,175 @@ spec:
   - host: foo.bar.com
     http:
       paths:
-      - backend:
+      - path: /
+        backend:
+          serviceName: homepage
+          servicePort: 8888
+      - path: /api
+        backend:
           serviceName: my-api
-          servicePort: 80
+          servicePort: 7701
+      - path: /test
+        backend:
+          serviceName: hello
+          servicePort: 7702
 EOF
 ```
 
-Declare a JSON patch file to update two fields of the Ingress object:
+The edits we want to make are:
 
-- change host from `foo.bar.com` to `foo.bar.io`
-- change servicePort from `80` to `8080`
+ - change the value of `host` to _foo.bar.io_
+ - change the port for `'/'` from _8888_ to _80_
+ - insert an entirely new serving path `/healthz`
+   at a particular point in the `paths` list,
+   rather than at the end or the beginning.
+
+Here's the patch file to do that:
 
 <!-- @addJsonPatch @testAgainstLatestRelease -->
 ```
 cat <<EOF >$DEMO_HOME/ingress_patch.json
 [
-  {"op": "replace", "path": "/spec/rules/0/host", "value": "foo.bar.io"},
-  {"op": "replace", "path": "/spec/rules/0/http/paths/0/backend/servicePort", "value": 8080}
+  {"op": "replace",
+   "path": "/spec/rules/0/host",
+   "value": "foo.bar.io"},
+
+  {"op": "replace",
+   "path": "/spec/rules/0/http/paths/0/backend/servicePort",
+   "value": 80},
+
+  {"op": "add",
+   "path": "/spec/rules/0/http/paths/1",
+   "value": { "path": "/healthz", "backend": {"servicePort":7700} }}
 ]
 EOF
 ```
 
-You can also write the patch in YAML format. This example also shows the "add" operation:
+We'll of course need a `kustomization` file
+referring to the `Ingress`:
 
-<!-- @addYamlPatch @testAgainstLatestRelease -->
+<!-- @kustomization @testAgainstLatestRelease -->
 ```
-cat <<EOF >$DEMO_HOME/ingress_patch.yaml
-- op: replace
-  path: /spec/rules/0/host
-  value: foo.bar.io
-
-- op: add
-  path: /spec/rules/0/http/paths/-
-  value:
-    path: '/test'
-    backend:
-      serviceName: my-test
-      servicePort: 8081
+cat <<EOF >$DEMO_HOME/kustomization.yaml
+resources:
+- ingress.yaml
 EOF
 ```
 
-Apply the patch by adding _patchesJson6902_ field in kustomization.yaml
+To this same `kustomization` file, add a
+`patches` field refering to
+the patch file we just made and
+target it to the `Ingress` object:
 
 <!-- @applyJsonPatch @testAgainstLatestRelease -->
 ```
 cat <<EOF >>$DEMO_HOME/kustomization.yaml
-patchesJson6902:
-- target:
+patches:
+- path: ingress_patch.json
+  target:
     group: networking.k8s.io
     version: v1beta1
     kind: Ingress
     name: my-ingress
-  path: ingress_patch.json
 EOF
 ```
 
-Running `kustomize build $DEMO_HOME`, in the output confirm that host has been updated correctly.
-<!-- @confirmHost @testAgainstLatestRelease -->
+Define the expected output:
+<!-- @expected @testAgainstLatestRelease -->
 ```
-test 1 == \
-  $(kustomize build $DEMO_HOME | grep "host: foo.bar.io" | wc -l); \
-  echo $?
-```
-Running `kustomize build $DEMO_HOME`, in the output confirm that the servicePort has been updated correctly.
-<!-- @confirmServicePort @testAgainstLatestRelease -->
-```
-test 1 == \
-  $(kustomize build $DEMO_HOME | grep "servicePort: 8080" | wc -l); \
-  echo $?
+cat <<EOF >$DEMO_HOME/out_expected.yaml
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: my-ingress
+spec:
+  rules:
+  - host: foo.bar.io
+    http:
+      paths:
+      - backend:
+          serviceName: homepage
+          servicePort: 80
+        path: /
+      - backend:
+          servicePort: 7700
+        path: /healthz
+      - backend:
+          serviceName: my-api
+          servicePort: 7701
+        path: /api
+      - backend:
+          serviceName: hello
+          servicePort: 7702
+        path: /test
+EOF
 ```
 
-If the patch is YAML-formatted, it will be parsed correctly:
+Run the build:
+<!-- @runIt @testAgainstLatestRelease -->
+```
+kustomize build $DEMO_HOME >$DEMO_HOME/out_actual.yaml
+```
 
-<!-- @applyYamlPatch @testAgainstLatestRelease -->
+Confirm they match:
+
+<!-- @diffShouldExitZero @testAgainstLatestRelease -->
+```
+diff $DEMO_HOME/out_actual.yaml $DEMO_HOME/out_expected.yaml
+```
+
+If you prefer YAML to JSON, the patch can be expressed
+in YAML format (neverthless following [JSON patch] rules):
+
+<!-- @writeYamlPatch @testAgainstLatestRelease -->
+```
+cat <<EOF >$DEMO_HOME/ingress_patch.yaml
+- op: add
+  path: /spec/rules/0/http/paths/-
+  value:
+    path: '/canada'
+    backend:
+      serviceName: hoser
+      servicePort: 7703
+EOF
+```
+
+Now add this to the list of patches in the `kustomization` file:
+
+<!-- @addYamlPatch @testAgainstLatestRelease -->
 ```
 cat <<EOF >>$DEMO_HOME/kustomization.yaml
-patchesJson6902:
-- target:
+- path: ingress_patch.yaml
+  target:
     group: networking.k8s.io
     version: v1beta1
     kind: Ingress
     name: my-ingress
-  path: ingress_patch.yaml
 EOF
 ```
 
-<!-- @confirmYamlPatch @testAgainstLatestRelease -->
+We expect the following at the end of the output:
+<!-- @expected @testAgainstLatestRelease -->
 ```
-test 1 == \
-  $(kustomize build $DEMO_HOME | grep "path: /test" | wc -l); \
-  echo $?
+cat <<EOF >$DEMO_HOME/out_expected.yaml
+      - backend:
+          serviceName: hello
+          servicePort: 7702
+        path: /test
+      - backend:
+          serviceName: hoser
+          servicePort: 7703
+        path: /canada
+EOF
 ```
+
+Try it:
+
+<!-- @runIt @testAgainstLatestRelease -->
+```
+kustomize build $DEMO_HOME | tail -n 8 |\
+    diff  $DEMO_HOME/out_expected.yaml -
+```
+
+To see how to apply one JSON patch to many resources,
+see the [multi-patch](patchMultipleObjects.md) demo.

examples/patchMultipleObjects.md

@@ -1,43 +1,78 @@
-[Strategic Merge Patch]: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md
-[JSON patches]: https://tools.ietf.org/html/rfc6902
-[label selector]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+# Patching multiple resources at once.
+
+kustomize supports patching via either a
+[strategic merge patch] (wherein you
+partially re-specify the thing you want to
+modify, with in-place changes) or a
+[JSON patch] (wherein you specify specific
+operation/target/value tuples in a particular
+syntax).
+
+A kustomize file lets one specify many
+patches.  Each patch must be associated with
+a _target selector_:
+
+[strategic merge patch]: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md
+[JSON patch]: jsonpatch.md
+
+> ```yaml
+> patches:
+> - path: <relative path to file containing patch>
+>   target:
+>     group: <optional group>
+>     version: <optional version>
+>     kind: <optional kind>
+>     name: <optional name>
+>     namespace: <optional namespace>
+>     labelSelector: <optional label selector>
+>     annotationSelector: <optional annotation selector>
+> ```
+
+E.g. select resources with _name_ matching `foo*`:
+
+> ```yaml
+> target:
+>   name: foo*
+> ```
+
+Select all resources of _kind_ `Deployment`:
+
+> ```yaml
+> target:
+>   kind: Deployment
+> ```
+
+[label/annotation selector rules]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+
+Using multiple fields just makes the target
+more specific. The following selects only
+Deployments that also have the _label_ `app=hello`
+(full [label/annotation selector rules]):
+
+> ```yaml
+> target:
+>   kind: Deployment
+>   labelSelector: app=hello
+> ```
+
+### Demo
+
+The example below shows how to inject a
+sidecar container for multiple Deployment
+resources.
 
 
-# Demo: applying a patch to multiple resources
+Make a place to work:
 
-A kustomization file supports customizing resources via both
-[Strategic Merge Patch] and [JSON patches]. Now one patch can be
-applied to multiple resources.
-
-This can be done by specifying a patch and a target selector as follows:
-```
-patches:
-- path: <PatchFile>
-  target:
-    group: <Group>
-    version: <Version>
-    kind: <Kind>
-    name: <Name>
-    namespace: <Namespace>
-    labelSelector: <LabelSelector>
-    annotationSelector: <AnnotationSelector>
-```
-Both `labelSelector` and `annotationSelector` should follow the convention in [label selector].
-Kustomize selects the targets which match all the fields in `target` to apply the patch.
-
-The example below shows how to inject a sidecar container for all deployment resources.
-
-Make a `kustomization` containing a Deployment resource.
-
-<!-- @createDeployment @testAgainstLatestRelease -->
+<!-- @demoHome @testAgainstLatestRelease -->
 ```
 DEMO_HOME=$(mktemp -d)
+```
 
-cat <<EOF >$DEMO_HOME/kustomization.yaml
-resources:
-- deployments.yaml
-EOF
+Make a file describing two Deployments:
 
+<!-- @createDeployments @testAgainstLatestRelease -->
+```
 cat <<EOF >$DEMO_HOME/deployments.yaml
 apiVersion: apps/v1
 kind: Deployment
@@ -72,9 +107,10 @@ spec:
 EOF
 ```
 
-Declare a Strategic Merge Patch file to inject a sidecar container:
+Declare a [strategic merge patch] file
+to inject a sidecar container:
 
-<!-- @addPatch @testAgainstLatestRelease -->
+<!-- @definePatch @testAgainstLatestRelease -->
 ```
 cat <<EOF >$DEMO_HOME/patch.yaml
 apiVersion: apps/v1
@@ -93,11 +129,16 @@ spec:
 EOF
 ```
 
-Apply the patch by adding _patches_ field in kustomization.yaml
+Finally, define a kustomization file
+that specifies both a `patches` and `resources`
+entry:
 
-<!-- @applyPatch @testAgainstLatestRelease -->
+<!-- @createKustomization @testAgainstLatestRelease -->
 ```
-cat <<EOF >>$DEMO_HOME/kustomization.yaml
+cat <<EOF >$DEMO_HOME/kustomization.yaml
+resources:
+- deployments.yaml
+
 patches:
 - path: patch.yaml
   target:
@@ -105,18 +146,11 @@ patches:
 EOF
 ```
 
-Running `kustomize build $DEMO_HOME`, in the output confirm that both Deployment resources are patched correctly.
+The expected result is:
 
-<!-- @confirmPatch @testAgainstLatestRelease -->
+<!-- @definedExpectedOutput @testAgainstLatestRelease -->
 ```
-test 2 == \
-  $(kustomize build $DEMO_HOME | grep "image: docker.io/istio/proxyv2" | wc -l); \
-  echo $?
-```
-
-The output is as follows:
-
-```yaml
+cat <<EOF >$DEMO_HOME/out_expected.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -157,32 +191,21 @@ spec:
         name: istio-proxy
       - image: busybox
         name: busybox
+EOF
 ```
 
-## Target selector
-- Select resources with name matching `name*`
-  ```yaml
-  target:
-    name: name*
-  ```
-- Select all Deployment resources
-  ```yaml
-  target:
-    kind: Deployment
-  ```
-- Select resources matching label `app=hello`
-  ```yaml
-  target:
-    labelSelector: app=hello
-  ```
-- Select resources matching annotation `app=hello`
-  ```yaml
-  target:
-    annotationSelector: app=hello
-  ```
-- Select all Deployment resources matching label `app=hello`
-  ```yaml
-  target:
-    kind: Deployment
-    labelSelector: app=hello
-  ```
+Run the build:
+<!-- @runIt @testAgainstLatestRelease -->
+```
+kustomize build $DEMO_HOME >$DEMO_HOME/out_actual.yaml
+```
+
+Confirm expectations:
+
+<!-- @diffShouldExitZero @testAgainstLatestRelease -->
+```
+diff $DEMO_HOME/out_actual.yaml $DEMO_HOME/out_expected.yaml
+```
+
+To see how to do this with JSON patches,
+try the [JSON patch] demo.

examples/remoteBuild.md

@@ -2,10 +2,9 @@
 
 `kustomize build` can be run on a URL.
 
-The effect is the same as cloning the repo, checking out a particular
-_ref_ (commit hash, branch name, release tag, etc.),
-then running `kustomize build` against the desired
-directory in the local copy.
+A [lite version of go-getter module](https://github.com/yujunz/go-getter) is
+leveraged to get remote content, then running `kustomize build` against the
+desired directory in the local copy.
 
 To try this immediately, run a build against the kustomization
 in the [multibases](multibases/README.md) example.  There's
@@ -32,6 +31,18 @@ test 3 == \
   echo $?
 ```
 
+The URL can be an archive
+
+<!-- @remoteBuild -->
+```
+target="https://github.com/kustless/kustomize-examples/archive/master.zip//kustomize-examples-master"
+test 1 == \
+  $(kustomize build $target | grep remote-cm | wc -l); \
+  echo $?
+```
+
+Note the kustomize root path inside archive must be appended after `//`.
+
 A base can be a URL:
 
 <!-- @createOverlay @testAgainstLatestRelease -->
@@ -59,20 +70,32 @@ test 3 == \
 
 The url should follow
 [hashicorp/go-getter URL format](https://github.com/hashicorp/go-getter#url-format).
-Here are some example urls pointing to Github repos following this convention.
 
-- a repo with a root level kustomization.yaml
+Note that S3 and GCS are NOT supported to avoid introducing massive dependency.
 
-  `github.com/Liujingfang1/mysql`
-- a repo with a root level kustomization.yaml on branch test
+Here are some example urls
 
-  `github.com/Liujingfang1/mysql?ref=test`
-- a subdirectory in a repo on version v1.0.6
+<!-- @createOverlay @testAgainstLatestRelease -->
+```
+DEMO_HOME=$(mktemp -d)
 
-  `github.com/kubernetes-sigs/kustomize/examples/multibases?ref=v1.0.6`
-- a subdirectory in a repo on branch repoUrl2
+cat <<EOF >$DEMO_HOME/kustomization.yaml
+resources:
 
-  `github.com/Liujingfang1/kustomize/examples/helloWorld?ref=repoUrl2`
-- a subdirectory in a repo on commit `7050a45134e9848fca214ad7e7007e96e5042c03`
+# a repo with a root level kustomization.yaml
+- github.com/Liujingfang1/mysql
 
-  `github.com/Liujingfang1/kustomize/examples/helloWorld?ref=7050a45134e9848fca214ad7e7007e96e5042c03`
+# a repo with a root level kustomization.yaml on branch test
+- github.com/Liujingfang1/mysql?ref=test
+
+# a subdirectory in a repo on branch repoUrl2
+- github.com/Liujingfang1/kustomize/examples/helloWorld?ref=repoUrl2
+
+# a subdirectory in a repo on commit `7050a45134e9848fca214ad7e7007e96e5042c03`
+- github.com/Liujingfang1/kustomize/examples/helloWorld?ref=7050a45134e9848fca214ad7e7007e96e5042c03
+
+# a subdirectory in a remote archive
+- https://github.com/kustless/kustomize-examples/archive/master.zip//kustomize-examples-master
+
+EOF
+```

functions/examples/injection-tshirt-sizes/image/main.go

@@ -20,6 +20,7 @@ func main() {
 		Filters: []kio.Filter{filter{}}, // run the inject into the inputs
 		Outputs: []kio.Writer{rw}}       // copy the inputs to the output
 	if err := p.Execute(); err != nil {
+		fmt.Fprint(os.Stderr, err)
 		os.Exit(1)
 	}
 }

functions/examples/validator-kubeval/local-resource/example-use.yaml

@@ -12,8 +12,7 @@ spec:
   strict: true
   ignoreMissingSchemas: true
 
-  # TODO: Remove these once function container network/volumes features are
-  # stabilized.
+  # TODO: Update this to use network/volumes features.
   # Relevant issues:
   #   - https://github.com/kubernetes-sigs/kustomize/issues/1901
   #   - https://github.com/kubernetes-sigs/kustomize/issues/1902

kustomize/go.mod

@@ -16,7 +16,7 @@ require (
 	sigs.k8s.io/kustomize/cmd/config v0.0.5
 	sigs.k8s.io/kustomize/cmd/kubectl v0.0.3
 	sigs.k8s.io/kustomize/kstatus v0.0.1
-	sigs.k8s.io/kustomize/kyaml v0.0.6
+	sigs.k8s.io/kustomize/kyaml v0.1.5
 	sigs.k8s.io/yaml v1.1.0
 )
 

kustomize/go.sum

@@ -2,6 +2,7 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-autorest/autorest v0.9.0 h1:MRvx8gncNaXJqOoLmhNjUAKh33JJF8LyxPhomEtOsjs=
@@ -26,6 +27,7 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OpenPeeDeeP/depguard v1.0.1 h1:VlW4R6jmBIv3/u1JNlawEvJMM4J+dPORPaZasQee8Us=
 github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmUx/1V+TNhjQvM=
+github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
@@ -38,18 +40,24 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpH
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/bombsimon/wsl v1.2.5 h1:9gTOkIwVtoDZywvX802SDHokeX4kW1cKnV8ZTVAPkRs=
 github.com/bombsimon/wsl v1.2.5/go.mod h1:43lEF/i0kpXbLCeDXL9LMT8c92HyBywXb0AsgMHYngM=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chai2010/gettext-go v0.0.0-20160711120539-c6fed771bfd5 h1:7aWHqerlJ41y6FOsEUvknqgXnGmJyJSbjhAWq5pO4F8=
 github.com/chai2010/gettext-go v0.0.0-20160711120539-c6fed771bfd5/go.mod h1:/iP1qXHoty45bqomnu2LM+VVyAEdWN+vtSHGlQgyxbw=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.1-coreos.6/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
@@ -80,6 +88,7 @@ github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96 h1:cenwrSVm+Z7QLSV/BsnenAOcDXdX4cMv4wP0B/5QbPg=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e h1:p1yVGRW3nmb85p1Sh1ZJSDm4A4iKLS5QNbvUHMgGu/M=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
@@ -278,8 +287,14 @@ github.com/grpc-ecosystem/grpc-gateway v1.3.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpg
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
+github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
+github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
@@ -345,9 +360,12 @@ github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
@@ -359,6 +377,7 @@ github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/mozilla/tls-observatory v0.0.0-20190404164649-a3c1b6cfecfd/go.mod h1:SrKMQvPiws7F7iqYp8/TX+IhxCYhzr6N/1yb8cwHsGk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -380,6 +399,7 @@ github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1Cpa
 github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -415,6 +435,8 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z
 github.com/prometheus/procfs v0.0.2 h1:6LJUbpNm42llc4HRCuvApCSWB/WfhuNo9K98Q9sNGfs=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d h1:K6eOUihrFLdZjZnA4XlRp864fmWXv9YTIk7VPLhRacA=
+github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
 github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:5STLWrekHfjyYwxBRVRXNOSewLJ3PWfDJd1VyTS21fI=
 github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uYEyJGbgTkfkS4+E/PavXkNJcbFIpEtjt2B0KDQ5+9M=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
@@ -461,6 +483,7 @@ github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -470,6 +493,8 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
+github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
 github.com/ultraware/funlen v0.0.2 h1:Av96YVBwwNSe4MLR7iI/BIa3VyI7/djnto/pK3Uxbdo=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4 h1:If7Va4cM03mpgrNH9k49/VOicWpGoG70XPBFFODYDsg=
@@ -486,8 +511,13 @@ github.com/xlab/handysort v0.0.0-20150421192137-fb3537ed64a1/go.mod h1:QcJo0QPSf
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
+github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
+go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
+go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/atomic v0.0.0-20181018215023-8dc6146f7569/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
@@ -522,6 +552,7 @@ golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180112015858-5ccada7d0a7b/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -573,6 +604,8 @@ golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190911201528-7ad0cfa0b7b5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c h1:Vco5b+cuG5NNfORVxZy6bYZQ7rsigisU1WQFkvQ0L5E=
+golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20171227012246-e19ae1496984/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -650,8 +683,12 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d h1:LCPbGQ34PMrwad11aMZ+dbz5SAsq/0ySjRwQ8I9Qwd8=
 gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -722,6 +759,12 @@ sigs.k8s.io/kustomize/kyaml v0.0.2/go.mod h1:rywm/rcR5LmCBghz9956tE45OdUPChFoXVV
 sigs.k8s.io/kustomize/kyaml v0.0.5/go.mod h1:waxTrzQRK9i6/5fR5HNo8xa4YwvWn8t85vMnOGFEZik=
 sigs.k8s.io/kustomize/kyaml v0.0.6 h1:KhQr7JwpCseFTSWCwqp4CJ4mY6Kx+i34tF4e0eNkcXw=
 sigs.k8s.io/kustomize/kyaml v0.0.6/go.mod h1:tDOfJjL6slQVBLHJ76XfXAFgAOEdfm04AW2HehYOp8k=
+sigs.k8s.io/kustomize/kyaml v0.1.1 h1:nGUNYINljZNmlAS8uoobUv/wx/s3Pg8dNxYo+W7uYh0=
+sigs.k8s.io/kustomize/kyaml v0.1.1/go.mod h1:/NdPPfrperSCGjm55cwEro1loBVtbtVIXSb7FguK6uk=
+sigs.k8s.io/kustomize/kyaml v0.1.3 h1:zbeHVTMCQPtWgjIH/YYJZC45mm7coTdw2TblyJ79BrY=
+sigs.k8s.io/kustomize/kyaml v0.1.3/go.mod h1:461i94nj0h0ylJ6w83jLkR4SqqVhn1iY6fjD0JSTQeE=
+sigs.k8s.io/kustomize/kyaml v0.1.5 h1:NicBWYTwkuOfVyZDbNkfSBSCwSgin4uirkedtyZltIc=
+sigs.k8s.io/kustomize/kyaml v0.1.5/go.mod h1:461i94nj0h0ylJ6w83jLkR4SqqVhn1iY6fjD0JSTQeE=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190817042607-6149e4549fca/go.mod h1:IIgPezJWb76P0hotTxzDbWsMYB8APh18qZnxkomBpxA=
 sigs.k8s.io/testing_frameworks v0.1.2 h1:vK0+tvjF0BZ/RYFeZ1E6BYBwHJJXhjuZ3TdsEKH+UQM=

kustomize/internal/commands/edit/set/setimage.go

@@ -28,7 +28,7 @@ var (
 	errImageNoArgs      = errors.New("no image specified")
 	errImageInvalidArgs = errors.New(`invalid format of image, use one of the following options:
 - <image>=<newimage>:<newtag>
-- <image>=<newimage>@<newtag>
+- <image>=<newimage>@<digest>
 - <image>=<newimage>
 - <image>:<newtag>
 - <image>@<digest>`)

kyaml/comments/comments.go

@@ -11,6 +11,7 @@ import (
 
 // CopyComments recursively copies the comments on fields in from to fields in to
 func CopyComments(from, to *yaml.RNode) error {
+	copy(from, to)
 	// walk the fields copying comments
 	_, err := walk.Walker{
 		Sources:            []*yaml.RNode{from, to},
@@ -44,13 +45,13 @@ func copy(from, to *yaml.RNode) {
 	if from == nil || to == nil {
 		return
 	}
-	if from.YNode().LineComment != "" {
-		to.YNode().LineComment = from.YNode().LineComment
+	if from.Document().LineComment != "" {
+		to.Document().LineComment = from.Document().LineComment
 	}
-	if from.YNode().HeadComment != "" {
-		to.YNode().HeadComment = from.YNode().HeadComment
+	if from.Document().HeadComment != "" {
+		to.Document().HeadComment = from.Document().HeadComment
 	}
-	if from.YNode().FootComment != "" {
-		to.YNode().FootComment = from.YNode().FootComment
+	if from.Document().FootComment != "" {
+		to.Document().FootComment = from.Document().FootComment
 	}
 }

kyaml/comments/comments_test.go

@@ -0,0 +1,65 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package comments
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestCopyComments(t *testing.T) {
+	from, err := yaml.Parse(`# A
+#
+# B
+
+# C
+apiVersion: apps/v1
+kind: Deployment
+spec: # comment 1
+  # comment 2
+  replicas: 3 # comment 3
+  # comment 4
+`)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	to, err := yaml.Parse(`apiVersion: apps/v1
+kind: Deployment
+spec:
+  replicas: 4
+`)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	err = CopyComments(from, to)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	actual, err := to.String()
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	expected := `# A
+#
+# B
+
+# C
+apiVersion: apps/v1
+kind: Deployment
+spec: # comment 1
+  # comment 2
+  replicas: 4 # comment 3
+  # comment 4
+`
+
+	if !assert.Equal(t, expected, actual) {
+		t.FailNow()
+	}
+}

kyaml/copyutil/copyutil.go

@@ -131,3 +131,49 @@ func Diff(sourceDir, destDir string) (sets.String, error) {
 	// return the differing files
 	return diff, nil
 }
+
+// SyncFile copies file from src file path to a dst file path by replacement
+// deletes dst file if src file doesn't exist
+func SyncFile(src, dst string) error {
+	srcFileInfo, err := os.Stat(src)
+	if err != nil {
+		// delete dst if source doesn't exist
+		if err = deleteFile(dst); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	input, err := ioutil.ReadFile(src)
+	if err != nil {
+		return err
+	}
+
+	var filePerm os.FileMode
+
+	// get the destination file perm if file exists
+	dstFileInfo, err := os.Stat(dst)
+	if err != nil {
+		// get source file perm if destination file doesn't exist
+		filePerm = srcFileInfo.Mode().Perm()
+	} else {
+		filePerm = dstFileInfo.Mode().Perm()
+	}
+
+	err = ioutil.WriteFile(dst, input, filePerm)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// deleteFile deletes file from path, returns no error if file doesn't exist
+func deleteFile(path string) error {
+	_, err := os.Stat(path)
+	if err != nil {
+		// return nil if file doesn't exist
+		return nil
+	}
+	return os.Remove(path)
+}

kyaml/copyutil/copyutil_test.go

@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -203,3 +204,60 @@ func TestDiff_skipGitDest(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Empty(t, diff.List())
 }
+
+// TestSyncFile tests if destination file is replaced by source file content
+func TestSyncFile(t *testing.T) {
+	d1, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	d2, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	f1Name := d1 + "/temp.txt"
+	f2Name := d2 + "/temp.txt"
+	err = ioutil.WriteFile(f1Name, []byte("abc"), 0600)
+	assert.NoError(t, err)
+	err = ioutil.WriteFile(f2Name, []byte("def"), 0644)
+	assert.NoError(t, err)
+	err = SyncFile(f1Name, f2Name)
+	assert.NoError(t, err)
+	actual, err := ioutil.ReadFile(f2Name)
+	assert.NoError(t, err)
+	assert.Equal(t, "abc", string(actual))
+	dstFileInfo, _ := os.Stat(f2Name)
+	assert.Equal(t, "-rw-r--r--", dstFileInfo.Mode().String())
+}
+
+// TestSyncFileNoDestFile tests if new file is created at destination with source file content
+func TestSyncFileNoDestFile(t *testing.T) {
+	d1, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	d2, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	f1Name := d1 + "/temp.txt"
+	f2Name := d2 + "/temp.txt"
+	err = ioutil.WriteFile(f1Name, []byte("abc"), 0644)
+	assert.NoError(t, err)
+	err = SyncFile(f1Name, f2Name)
+	assert.NoError(t, err)
+	actual, err := ioutil.ReadFile(f2Name)
+	assert.NoError(t, err)
+	assert.Equal(t, "abc", string(actual))
+	dstFileInfo, _ := os.Stat(f2Name)
+	assert.Equal(t, "-rw-r--r--", dstFileInfo.Mode().String())
+}
+
+// TestSyncFileNoSrcFile tests if destination file is deleted if source file doesn't exist
+func TestSyncFileNoSrcFile(t *testing.T) {
+	d1, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	d2, err := ioutil.TempDir("", "")
+	assert.NoError(t, err)
+	f1Name := d1 + "/temp.txt"
+	f2Name := d2 + "/temp.txt"
+	err = ioutil.WriteFile(f2Name, []byte("abc"), 0644)
+	assert.NoError(t, err)
+	err = SyncFile(f1Name, f2Name)
+	assert.NoError(t, err)
+	_, err = ioutil.ReadFile(f2Name)
+	assert.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "no such file or directory"))
+}

kyaml/filtersutil/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package filtersutil provides utilities for working with yaml.Filter and
+// kio.Filter interfaces.
+package filtersutil

kyaml/filtersutil/example_test.go

@@ -0,0 +1,58 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filtersutil_test
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestApplyToJSON(t *testing.T) {
+	// testFilter sets `foo: bar` on each resource
+	testFilter := kio.FilterAll(yaml.FilterFunc(
+		func(node *yaml.RNode) (*yaml.RNode, error) {
+			set := yaml.SetField(
+				"foo", yaml.NewScalarRNode("bar"))
+			err := node.PipeE(set)
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+			return node, nil
+		}))
+
+	obj1 := buffer{Buffer: bytes.NewBufferString(`{"kind": "Foo"}`)}
+	obj2 := buffer{Buffer: bytes.NewBufferString(`{"kind": "Bar"}`)}
+	err := filtersutil.ApplyToJSON(testFilter, obj1, obj2)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Println(obj1.String())
+	fmt.Println(obj2.String())
+
+	// Output:
+	// {"foo":"bar","kind":"Foo"}
+	// {"foo":"bar","kind":"Bar"}
+}
+
+type buffer struct {
+	*bytes.Buffer
+}
+
+func (buff buffer) UnmarshalJSON(b []byte) error {
+	buff.Reset()
+	buff.Write(b)
+	return nil
+}
+
+func (buff buffer) MarshalJSON() ([]byte, error) {
+	return buff.Bytes(), nil
+}

kyaml/filtersutil/filtersutil.go

@@ -0,0 +1,83 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filtersutil
+
+import (
+	"encoding/json"
+
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// ApplyToJSON applies the filter to the json objects.
+//
+// ApplyToJSON marshals the objects into a slice of yaml.RNodes, runs
+// the filter on the slice, and then unmarshals the values back.
+//
+// The filter must not create or delete objects because the objects
+// are updated in place.
+func ApplyToJSON(filter kio.Filter, objs ...marshalerUnmarshaler) error {
+	var nodes []*yaml.RNode
+
+	// convert the json objects to rnodes
+	for i := range objs {
+		node, err := GetRNode(objs[i])
+		if err != nil {
+			return err
+		}
+		nodes = append(nodes, node)
+	}
+
+	// apply the filter
+	nodes, err := filter.Filter(nodes)
+	if err != nil {
+		return err
+	}
+	if len(nodes) != len(objs) {
+		return errors.Errorf("filter cannot create or delete objects")
+	}
+
+	// convert the rnodes to json objects
+	for i := range nodes {
+		err = setRNode(objs[i], nodes[0])
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+type marshalerUnmarshaler interface {
+	json.Unmarshaler
+	json.Marshaler
+}
+
+// GetRNode converts k into an RNode
+func GetRNode(k json.Marshaler) (*yaml.RNode, error) {
+	j, err := k.MarshalJSON()
+	if err != nil {
+		return nil, err
+	}
+	return yaml.Parse(string(j))
+}
+
+// setRNode marshals node into k
+func setRNode(k json.Unmarshaler, node *yaml.RNode) error {
+	s, err := node.String()
+	if err != nil {
+		return err
+	}
+	m := map[string]interface{}{}
+	if err := yaml.Unmarshal([]byte(s), &m); err != nil {
+		return err
+	}
+
+	b, err := json.Marshal(m)
+	if err != nil {
+		return err
+	}
+	return k.UnmarshalJSON(b)
+}

kyaml/kio/byteio_writer.go

@@ -45,6 +45,7 @@ type ByteWriter struct {
 var _ Writer = ByteWriter{}
 
 func (w ByteWriter) Write(nodes []*yaml.RNode) error {
+	yaml.DoSerializationHacksOnNodes(nodes)
 	if w.Sort {
 		if err := kioutil.SortNodes(nodes); err != nil {
 			return errors.Wrap(err)
@@ -117,5 +118,7 @@ func (w ByteWriter) Write(nodes []*yaml.RNode) error {
 	for i := range nodes {
 		items.Content = append(items.Content, nodes[i].YNode())
 	}
-	return errors.Wrap(encoder.Encode(doc))
+	err := errors.Wrap(encoder.Encode(doc))
+	yaml.UndoSerializationHacksOnNodes(nodes)
+	return err
 }

kyaml/kio/byteio_writer_test.go

@@ -75,8 +75,10 @@ func TestByteWriter_Write_withoutAnnotations(t *testing.T) {
 	node3, err := yaml.Parse(`e: f
 g:
   h:
-  - i # has a list
-  - j
+  # has a list
+  - i : [i1, i2] # line comment
+  # has a list 2
+  - j : j1
 `)
 	if !assert.NoError(t, err) {
 		return
@@ -93,8 +95,10 @@ g:
 e: f
 g:
   h:
-  - i # has a list
-  - j
+  # has a list
+  - i: [i1, i2] # line comment
+  # has a list 2
+  - j: j1
 ---
 a: b #first
 `, buff.String())

kyaml/kio/filters/container.go

@@ -135,7 +135,7 @@ type ContainerFilter struct {
 	Network string `yaml:"network,omitempty"`
 
 	// StorageMounts is a list of storage options that the container will have mounted.
-	StorageMounts []StorageMount
+	StorageMounts []StorageMount `yaml:"mounts,omitempty"`
 
 	// Config is the API configuration for the container and passed through the
 	// API_CONFIG env var to the container.
@@ -156,25 +156,31 @@ func (c ContainerFilter) String() string {
 	return c.Image
 }
 
-// StorageMount represents a container's mounted storage option(s)
-type StorageMount struct {
-	// Type of mount e.g. bind mount, local volume, etc.
-	MountType string
-
-	// Source for the storage to be mounted.
-	// For named volumes, this is the name of the volume.
-	// For anonymous volumes, this field is omitted (empty string).
-	// For bind mounts, this is the path to the file or directory on the host.
-	Src string
-
-	// The path where the file or directory is mounted in the container.
-	DstPath string
-}
-
 func (s *StorageMount) String() string {
 	return fmt.Sprintf("type=%s,src=%s,dst=%s:ro", s.MountType, s.Src, s.DstPath)
 }
 
+func StringToStorageMount(s string) StorageMount {
+	m := make(map[string]string)
+	options := strings.Split(s, ",")
+	for _, option := range options {
+		keyVal := strings.SplitN(option, "=", 2)
+		m[keyVal[0]] = keyVal[1]
+	}
+	var sm StorageMount
+	for key, value := range m {
+		switch {
+		case key == "type":
+			sm.MountType = value
+		case key == "src":
+			sm.Src = value
+		case key == "dst":
+			sm.DstPath = value
+		}
+	}
+	return sm
+}
+
 // functionsDirectoryName is keyword directory name for functions scoped 1 directory higher
 const functionsDirectoryName = "functions"
 
@@ -389,71 +395,13 @@ type IsReconcilerFilter struct {
 func (c *IsReconcilerFilter) Filter(inputs []*yaml.RNode) ([]*yaml.RNode, error) {
 	var out []*yaml.RNode
 	for i := range inputs {
-		img, _ := GetContainerName(inputs[i])
-		isContainerResource := img != ""
-		if isContainerResource && !c.ExcludeReconcilers {
+		isFnResource := GetFunctionSpec(inputs[i]) != nil
+		if isFnResource && !c.ExcludeReconcilers {
 			out = append(out, inputs[i])
 		}
-		if !isContainerResource && c.IncludeNonReconcilers {
+		if !isFnResource && c.IncludeNonReconcilers {
 			out = append(out, inputs[i])
 		}
 	}
 	return out, nil
 }
-
-const (
-	FunctionAnnotationKey    = "config.kubernetes.io/function"
-	oldFunctionAnnotationKey = "config.k8s.io/function"
-)
-
-var functionAnnotationKeys = []string{FunctionAnnotationKey, oldFunctionAnnotationKey}
-
-// GetFunction parses the config function from the object if it is found
-func GetFunction(n *yaml.RNode, meta yaml.ResourceMeta) (*yaml.RNode, error) {
-	for _, s := range functionAnnotationKeys {
-		fn := meta.Annotations[s]
-		if fn != "" {
-			return yaml.Parse(fn)
-		}
-	}
-	return n.Pipe(yaml.Lookup("metadata", "configFn"))
-}
-
-// GetContainerName returns the container image for an API if one exists
-func GetContainerName(n *yaml.RNode) (string, string) {
-	meta, _ := n.GetMeta()
-
-	// path to the function, this will be mounted into the container
-	path := meta.Annotations[kioutil.PathAnnotation]
-
-	fn, _ := GetFunction(n, meta)
-	if fn != nil {
-		image, _ := fn.Pipe(yaml.Lookup("container", "image"))
-		return yaml.GetValue(image), path
-	}
-
-	container := meta.Annotations["config.kubernetes.io/container"]
-	if container != "" {
-		return container, path
-	}
-
-	image, err := n.Pipe(yaml.Lookup("metadata", "configFn", "container", "image"))
-	if err != nil || yaml.IsMissingOrNull(image) {
-		return "", path
-	}
-	return yaml.GetValue(image), path
-}
-
-// GetContainerNetworkRequired returns whether or not networking is required for the container
-func GetContainerNetworkRequired(n *yaml.RNode) (bool, error) {
-	meta, err := n.GetMeta()
-	if err != nil {
-		return false, err
-	}
-	f, err := GetFunction(n, meta)
-	if err != nil {
-		return false, err
-	}
-	networkRequired, _ := f.Pipe(yaml.Lookup("container", "network", "required"))
-	return yaml.GetValue(networkRequired) == "true", nil
-}

kyaml/kio/filters/container_test.go

@@ -326,9 +326,133 @@ kind: Example
 metadata:
   annotations:
     config.kubernetes.io/function: |-
-      container: foo:v1.0.0
+      container:
+        image: foo:v1.0.0
+`,
+			expectedFn: `
+container:
+    image: foo:v1.0.0`,
+		},
+
+		{
+			name: "storage mounts json style",
+			resource: `
+apiVersion: v1beta1
+kind: Example
+metadata:
+  annotations:
+    config.kubernetes.io/function: |-
+      container:
+        image: foo:v1.0.0
+        mounts: [ {type: bind, src: /mount/path, dst: /local/}, {src: myvol, dst: /local/, type: volume}, {dst: /local/, type: tmpfs} ]
+`,
+			expectedFn: `
+container:
+    image: foo:v1.0.0
+    mounts:
+      - type: bind
+        src: /mount/path
+        dst: /local/
+      - type: volume
+        src: myvol
+        dst: /local/
+      - type: tmpfs
+        dst: /local/
+`,
+		},
+
+		{
+			name: "storage mounts yaml style",
+			resource: `
+apiVersion: v1beta1
+kind: Example
+metadata:
+  annotations:
+    config.kubernetes.io/function: |-
+      container:
+        image: foo:v1.0.0
+        mounts:
+        - src: /mount/path
+          type: bind
+          dst: /local/
+        - dst: /local/
+          src: myvol
+          type: volume
+        - type: tmpfs
+          dst: /local/
+`,
+			expectedFn: `
+container:
+    image: foo:v1.0.0
+    mounts:
+      - type: bind
+        src: /mount/path
+        dst: /local/
+      - type: volume
+        src: myvol
+        dst: /local/
+      - type: tmpfs
+        dst: /local/
+`,
+		},
+
+		{
+			name: "network",
+			resource: `
+apiVersion: v1beta1
+kind: Example
+metadata:
+  annotations:
+    config.kubernetes.io/function: |-
+      container:
+        image: foo:v1.0.0
+        network:
+          required: true
+`,
+			expectedFn: `
+container:
+    image: foo:v1.0.0
+    network:
+        required: true
+`,
+		},
+
+		{
+			name: "path",
+			resource: `
+apiVersion: v1beta1
+kind: Example
+metadata:
+  annotations:
+    config.kubernetes.io/function: |-
+      path: foo
+      container:
+        image: foo:v1.0.0
+`,
+			// path should be erased
+			expectedFn: `
+container:
+    image: foo:v1.0.0
+`,
+		},
+
+		{
+			name: "network",
+			resource: `
+apiVersion: v1beta1
+kind: Example
+metadata:
+  annotations:
+    config.kubernetes.io/function: |-
+      network: foo
+      container:
+        image: foo:v1.0.0
+`,
+			// network should be erased
+			expectedFn: `
+container:
+    image: foo:v1.0.0
 `,
-			expectedFn: `container: foo:v1.0.0`,
 		},
 
 		// legacy fn style
@@ -338,9 +462,13 @@ apiVersion: v1beta1
 kind: Example
 metadata:
   configFn:
-      container: foo:v1.0.0
+      container:
+        image: foo:v1.0.0
+`,
+			expectedFn: `
+container:
+    image: foo:v1.0.0
 `,
-			expectedFn: `container: foo:v1.0.0`,
 		},
 
 		// no fn
@@ -361,20 +489,19 @@ metadata:
 		tt := tests[i]
 		t.Run(tt.name, func(t *testing.T) {
 			resource := yaml.MustParse(tt.resource)
-			meta, err := resource.GetMeta()
-			if !assert.NoError(t, err) {
-				t.FailNow()
-			}
-			fn, err := GetFunction(resource, meta)
-			if !assert.NoError(t, err) {
-				t.FailNow()
-			}
+			fn := GetFunctionSpec(resource)
 			if tt.missingFn {
 				if !assert.Nil(t, fn) {
 					t.FailNow()
 				}
 			} else {
-				if !assert.Equal(t, strings.TrimSpace(fn.MustString()), strings.TrimSpace(tt.expectedFn)) {
+				b, err := yaml.Marshal(fn)
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+				if !assert.Equal(t,
+					strings.TrimSpace(tt.expectedFn),
+					strings.TrimSpace(string(b))) {
 					t.FailNow()
 				}
 			}
@@ -382,61 +509,6 @@ metadata:
 	}
 }
 
-func Test_GetContainerName(t *testing.T) {
-	// make sure gcr.io works
-	n, err := yaml.Parse(`apiVersion: v1beta1
-kind: MyThing
-metadata:
-  configFn:
-    container:
-      image: gcr.io/foo/bar:something
-`)
-	if !assert.NoError(t, err) {
-		return
-	}
-	c, _ := GetContainerName(n)
-	assert.Equal(t, "gcr.io/foo/bar:something", c)
-
-	// container from config.kubernetes.io/container annotation
-	n, err = yaml.Parse(`apiVersion: v1
-kind: MyThing
-metadata:
-  annotations:
-    config.kubernetes.io/container: gcr.io/foo/bar:something
-`)
-	if !assert.NoError(t, err) {
-		return
-	}
-	c, _ = GetContainerName(n)
-	assert.Equal(t, "gcr.io/foo/bar:something", c)
-
-	// container from config.kubernetes.io/function annotation
-	n, err = yaml.Parse(`apiVersion: v1
-kind: MyThing
-metadata:
-  annotations:
-    config.kubernetes.io/function: |
-      container:
-        image: gcr.io/foo/bar:something
-`)
-	if !assert.NoError(t, err) {
-		return
-	}
-	c, _ = GetContainerName(n)
-	assert.Equal(t, "gcr.io/foo/bar:something", c)
-
-	// doesn't have a container
-	n, err = yaml.Parse(`apiVersion: v1
-kind: MyThing
-metadata:
-`)
-	if !assert.NoError(t, err) {
-		return
-	}
-	c, _ = GetContainerName(n)
-	assert.Equal(t, "", c)
-}
-
 func Test_GetContainerNetworkRequired(t *testing.T) {
 	tests := []struct {
 		input    string
@@ -501,9 +573,8 @@ metadata:
 		if !assert.NoError(t, err) {
 			return
 		}
-		required, err := GetContainerNetworkRequired(cfg)
-		assert.NoError(t, err)
-		assert.Equal(t, tc.required, required)
+		fn := GetFunctionSpec(cfg)
+		assert.Equal(t, tc.required, fn.Container.Network.Required)
 	}
 }
 

kyaml/kio/filters/fmtr_test.go

@@ -411,8 +411,8 @@ spec:
         app: nginx
     spec:
       containers:
-      - # this is another container
-        name: a-nginx
+      # this is another container
+      - name: a-nginx
         image: nginx:1.7.9
         ports:
         - containerPort: 80

kyaml/kio/filters/functiontypes.go

@@ -0,0 +1,119 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filters
+
+import (
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+const (
+	FunctionAnnotationKey    = "config.kubernetes.io/function"
+	oldFunctionAnnotationKey = "config.k8s.io/function"
+)
+
+var functionAnnotationKeys = []string{FunctionAnnotationKey, oldFunctionAnnotationKey}
+
+// FunctionSpec defines a spec for running a function
+type FunctionSpec struct {
+	// Network is the name of the network to use from a container
+	Network string `json:"network,omitempty" yaml:"network,omitempty"`
+
+	// Container is the spec for running a function as a container
+	Container ContainerSpec `json:"container,omitempty" yaml:"container,omitempty"`
+
+	// Starlark is the spec for running a function as a starlark script
+	Starlark StarlarkSpec `json:"starlark,omitempty" yaml:"starlark,omitempty"`
+
+	// Mounts are the storage or directories to mount into the container
+	StorageMounts []StorageMount `json:"mounts,omitempty" yaml:"mounts,omitempty"`
+}
+
+// ContainerSpec defines a spec for running a function as a container
+type ContainerSpec struct {
+	// Image is the container image to run
+	Image string `json:"image,omitempty" yaml:"image,omitempty"`
+
+	// Network defines network specific configuration
+	Network ContainerNetwork `json:"network,omitempty" yaml:"network,omitempty"`
+
+	// Mounts are the storage or directories to mount into the container
+	StorageMounts []StorageMount `json:"mounts,omitempty" yaml:"mounts,omitempty"`
+}
+
+// ContainerNetwork
+type ContainerNetwork struct {
+	// Required specifies that function requires a network
+	Required bool `json:"required,omitempty" yaml:"required,omitempty"`
+}
+
+// StarlarkSpec defines how to run a function as a starlark program
+type StarlarkSpec struct {
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+
+	// Path specifies a path to a starlark script
+	Path string `json:"path,omitempty" yaml:"path,omitempty"`
+}
+
+// StorageMount represents a container's mounted storage option(s)
+type StorageMount struct {
+	// Type of mount e.g. bind mount, local volume, etc.
+	MountType string `json:"type,omitempty" yaml:"type,omitempty"`
+
+	// Source for the storage to be mounted.
+	// For named volumes, this is the name of the volume.
+	// For anonymous volumes, this field is omitted (empty string).
+	// For bind mounts, this is the path to the file or directory on the host.
+	Src string `json:"src,omitempty" yaml:"src,omitempty"`
+
+	// The path where the file or directory is mounted in the container.
+	DstPath string `json:"dst,omitempty" yaml:"dst,omitempty"`
+}
+
+// GetFunctionSpec returns the FunctionSpec for a resource.  Returns
+// nil if the resource does not have a FunctionSpec.
+//
+// The FunctionSpec is read from the resource metadata.annotation
+// "config.kubernetes.io/function"
+func GetFunctionSpec(n *yaml.RNode) *FunctionSpec {
+	meta, err := n.GetMeta()
+	if err != nil {
+		return nil
+	}
+
+	if fn := getFunctionSpecFromAnnotation(n, meta); fn != nil {
+		fn.Network = ""
+		fn.StorageMounts = []StorageMount{}
+		return fn
+	}
+
+	// legacy function specification for backwards compatibility
+	container := meta.Annotations["config.kubernetes.io/container"]
+	if container != "" {
+		return &FunctionSpec{Container: ContainerSpec{Image: container}}
+	}
+	return nil
+}
+
+// getFunctionSpecFromAnnotation parses the config function from an annotation
+// if it is found
+func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) *FunctionSpec {
+	var fs FunctionSpec
+	for _, s := range functionAnnotationKeys {
+		fn := meta.Annotations[s]
+		if fn != "" {
+			_ = yaml.Unmarshal([]byte(fn), &fs)
+			return &fs
+		}
+	}
+	n, err := n.Pipe(yaml.Lookup("metadata", "configFn"))
+	if err != nil || yaml.IsEmpty(n) {
+		return nil
+	}
+	s, err := n.String()
+	if err != nil {
+		return nil
+	}
+	_ = yaml.Unmarshal([]byte(s), &fs)
+	return &fs
+}

kyaml/kio/filters/merge3.go

@@ -59,7 +59,7 @@ func (m Merge3) Merge() error {
 
 	return kio.Pipeline{
 		Inputs:  inputs,
-		Filters: []kio.Filter{m, FormatFilter{}}, // format the merged output
+		Filters: []kio.Filter{m},
 		Outputs: []kio.Writer{dest},
 	}.Execute()
 }

kyaml/kio/pkgio_reader.go

@@ -166,7 +166,7 @@ type LocalPackageReader struct {
 
 var _ Reader = LocalPackageReader{}
 
-var defaultMatch = []string{"*.yaml", "*.yml"}
+var DefaultMatch = []string{"*.yaml", "*.yml"}
 
 // Read reads the Resources.
 func (r LocalPackageReader) Read() ([]*yaml.RNode, error) {
@@ -174,7 +174,7 @@ func (r LocalPackageReader) Read() ([]*yaml.RNode, error) {
 		return nil, fmt.Errorf("must specify package path")
 	}
 	if len(r.MatchFilesGlob) == 0 {
-		r.MatchFilesGlob = defaultMatch
+		r.MatchFilesGlob = DefaultMatch
 	}
 
 	var operand ResourceNodeSlice
@@ -201,9 +201,9 @@ func (r LocalPackageReader) Read() ([]*yaml.RNode, error) {
 
 		// check if we should skip the directory or file
 		if info.IsDir() {
-			return r.shouldSkipDir(path)
+			return r.ShouldSkipDir(path)
 		}
-		if match, err := r.shouldSkipFile(info); err != nil {
+		if match, err := r.ShouldSkipFile(info); err != nil {
 			return err
 		} else if !match {
 			// skip this file
@@ -244,8 +244,8 @@ func (r *LocalPackageReader) readFile(path string, _ os.FileInfo) ([]*yaml.RNode
 	return rr.Read()
 }
 
-// shouldSkipFile returns true if the file should be skipped
-func (r *LocalPackageReader) shouldSkipFile(info os.FileInfo) (bool, error) {
+// ShouldSkipFile returns true if the file should be skipped
+func (r *LocalPackageReader) ShouldSkipFile(info os.FileInfo) (bool, error) {
 	// check if the files are in scope
 	for _, g := range r.MatchFilesGlob {
 		if match, err := filepath.Match(g, info.Name()); err != nil {
@@ -267,8 +267,8 @@ func (r *LocalPackageReader) initReaderAnnotations(path string, _ os.FileInfo) {
 	}
 }
 
-// shouldSkipDir returns a filepath.SkipDir if the directory should be skipped
-func (r *LocalPackageReader) shouldSkipDir(path string) error {
+// ShouldSkipDir returns a filepath.SkipDir if the directory should be skipped
+func (r *LocalPackageReader) ShouldSkipDir(path string) error {
 	if r.PackageFileName == "" {
 		return nil
 	}

kyaml/runfn/runfn.go

@@ -15,6 +15,7 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/kio/filters"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
+	"sigs.k8s.io/kustomize/kyaml/starlark"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -57,8 +58,16 @@ type RunFns struct {
 	// and only use explicit sources
 	NoFunctionsFromInput *bool
 
-	// for testing purposes only
-	containerFilterProvider func(string, string, string, *yaml.RNode) kio.Filter
+	// EnableStarlark will enable functions run as starlark scripts
+	EnableStarlark bool
+
+	// DisableContainers will disable functions run as containers
+	DisableContainers bool
+
+	// functionFilterProvider provides a filter to perform the function.
+	// this is a variable so it can be mocked in tests
+	functionFilterProvider func(
+		filter filters.FunctionSpec, api *yaml.RNode) (kio.Filter, error)
 }
 
 // Execute runs the command
@@ -110,21 +119,21 @@ func (r RunFns) getNodesAndFilters() (
 func (r RunFns) getFilters(nodes []*yaml.RNode) ([]kio.Filter, error) {
 	var fltrs []kio.Filter
 
-	// implicit filters from the input Resources
+	// fns from annotations on the input resources
 	f, err := r.getFunctionsFromInput(nodes)
 	if err != nil {
 		return nil, err
 	}
 	fltrs = append(fltrs, f...)
 
-	// explicit filters from a list of directories
+	// fns from directories specified on the struct
 	f, err = r.getFunctionsFromFunctionPaths()
 	if err != nil {
 		return nil, err
 	}
 	fltrs = append(fltrs, f...)
 
-	// explicit filters from a list of directories
+	// explicit fns specified on the struct
 	f, err = r.getFunctionsFromFunctions()
 	if err != nil {
 		return nil, err
@@ -156,7 +165,6 @@ func (r RunFns) getFunctionsFromInput(nodes []*yaml.RNode) ([]kio.Filter, error)
 		return nil, nil
 	}
 
-	var fltrs []kio.Filter
 	buff := &kio.PackageBuffer{}
 	err := kio.Pipeline{
 		Inputs:  []kio.Reader{&kio.PackageBuffer{Nodes: nodes}},
@@ -167,95 +175,55 @@ func (r RunFns) getFunctionsFromInput(nodes []*yaml.RNode) ([]kio.Filter, error)
 		return nil, err
 	}
 	sortFns(buff)
-	for i := range buff.Nodes {
-		api := buff.Nodes[i]
-		network := ""
-		img, path := filters.GetContainerName(api)
-
-		required, err := filters.GetContainerNetworkRequired(api)
-		if err != nil {
-			return nil, err
-		}
-		if required {
-			if !r.Network {
-				// TODO(eddizane): Provide error info about which function needs the network
-				return fltrs, errors.Errorf("network required but not enabled with --network")
-			}
-			network = r.NetworkName
-		}
-
-		fltrs = append(fltrs, r.containerFilterProvider(img, path, network, api))
-	}
-	return fltrs, nil
+	return r.getFunctionFilters(false, buff.Nodes...)
 }
 
 // getFunctionsFromFunctionPaths returns the set of functions read from r.FunctionPaths
 // as a slice of Filters
 func (r RunFns) getFunctionsFromFunctionPaths() ([]kio.Filter, error) {
-	var fltrs []kio.Filter
 	buff := &kio.PackageBuffer{}
 	for i := range r.FunctionPaths {
 		err := kio.Pipeline{
-			Inputs:  []kio.Reader{kio.LocalPackageReader{PackagePath: r.FunctionPaths[i]}},
+			Inputs: []kio.Reader{
+				kio.LocalPackageReader{PackagePath: r.FunctionPaths[i]},
+			},
 			Outputs: []kio.Writer{buff},
 		}.Execute()
 		if err != nil {
 			return nil, err
 		}
 	}
-	for i := range buff.Nodes {
-		api := buff.Nodes[i]
-		network := ""
-		img, path := filters.GetContainerName(api)
-
-		required, err := filters.GetContainerNetworkRequired(api)
-		if err != nil {
-			return nil, err
-		}
-		if required {
-			if !r.Network {
-				// TODO(eddiezane): Provide error info about which function needs the network
-				return fltrs, errors.Errorf("network required but not enabled with --network")
-			}
-			network = r.NetworkName
-		}
-
-		c := r.containerFilterProvider(img, path, network, api)
-		cf, ok := c.(*filters.ContainerFilter)
-		if ok {
-			// functions provided by FunctionPaths are globally scoped
-			cf.GlobalScope = true
-		}
-		fltrs = append(fltrs, c)
-	}
-	return fltrs, nil
+	return r.getFunctionFilters(true, buff.Nodes...)
 }
 
 // getFunctionsFromFunctions returns the set of explicitly provided functions as
 // Filters
 func (r RunFns) getFunctionsFromFunctions() ([]kio.Filter, error) {
-	var fltrs []kio.Filter
-	for i := range r.Functions {
-		api := r.Functions[i]
-		network := ""
-		img, path := filters.GetContainerName(api)
+	return r.getFunctionFilters(true, r.Functions...)
+}
 
-		required, err := filters.GetContainerNetworkRequired(api)
+func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
+	[]kio.Filter, error) {
+	var fltrs []kio.Filter
+	for i := range fns {
+		api := fns[i]
+		spec := filters.GetFunctionSpec(api)
+		if spec.Container.Network.Required {
+			if !r.Network {
+				// TODO(eddiezane): Provide error info about which function needs the network
+				return fltrs, errors.Errorf("network required but not enabled with --network")
+			}
+			spec.Network = r.NetworkName
+		}
+		c, err := r.functionFilterProvider(*spec, api)
 		if err != nil {
 			return nil, err
 		}
-		if required {
-			if !r.Network {
-				// TODO(eddizane): Provide error info about which function needs the network
-				return fltrs, errors.Errorf("network required but not enabled with --network")
-			}
-			network = r.NetworkName
+		if c == nil {
+			continue
 		}
-
-		c := r.containerFilterProvider(img, path, network, api)
 		cf, ok := c.(*filters.ContainerFilter)
-		if ok {
-			// functions provided by Functions are globally scoped
+		if global && ok {
 			cf.GlobalScope = true
 		}
 		fltrs = append(fltrs, c)
@@ -327,17 +295,46 @@ func (r *RunFns) init() {
 		}
 	}
 
-	// if containerFilterProvider hasn't been set, use the default
-	if r.containerFilterProvider == nil {
-		r.containerFilterProvider = func(image, path, network string, api *yaml.RNode) kio.Filter {
-			cf := &filters.ContainerFilter{
-				Image:         image,
-				Config:        api,
-				Network:       network,
-				StorageMounts: r.StorageMounts,
-				GlobalScope:   r.GlobalScope,
-			}
-			return cf
-		}
+	// functionFilterProvider set the filter provider
+	if r.functionFilterProvider == nil {
+		r.functionFilterProvider = r.ffp
 	}
 }
+
+// ffp provides function filters
+func (r *RunFns) ffp(spec filters.FunctionSpec, api *yaml.RNode) (kio.Filter, error) {
+	if !r.DisableContainers && spec.Container.Image != "" {
+		return &filters.ContainerFilter{
+			Image:         spec.Container.Image,
+			Config:        api,
+			Network:       spec.Network,
+			StorageMounts: r.StorageMounts,
+			GlobalScope:   r.GlobalScope,
+		}, nil
+	}
+	if r.EnableStarlark && spec.Starlark.Path != "" {
+		// the script path is relative to the function config file
+		m, err := api.GetMeta()
+		if err != nil {
+			return nil, errors.Wrap(err)
+		}
+		p := m.Annotations[kioutil.PathAnnotation]
+		spec.Starlark.Path = path.Clean(spec.Starlark.Path)
+		if path.IsAbs(spec.Starlark.Path) {
+			return nil, errors.Errorf(
+				"absolute function path %s not allowed", spec.Starlark.Path)
+		}
+		if strings.HasPrefix(spec.Starlark.Path, "..") {
+			return nil, errors.Errorf(
+				"function path %s not allowed to start with ../", spec.Starlark.Path)
+		}
+		p = path.Join(r.Path, path.Dir(p), spec.Starlark.Path)
+
+		return &starlark.Filter{
+			Name:           spec.Starlark.Name,
+			Path:           p,
+			FunctionConfig: api,
+		}, nil
+	}
+	return nil, nil
+}

kyaml/runfn/runfn_test.go

@@ -47,10 +47,15 @@ func TestRunFns_init(t *testing.T) {
 	api, err := yaml.Parse(`apiVersion: apps/v1
 kind: 
 `)
+	spec := filters.FunctionSpec{
+		Container: filters.ContainerSpec{
+			Image: "example.com:version",
+		},
+	}
 	if !assert.NoError(t, err) {
 		return
 	}
-	filter := instance.containerFilterProvider("example.com:version", "", "", api)
+	filter, _ := instance.functionFilterProvider(spec, api)
 	assert.Equal(t, &filters.ContainerFilter{Image: "example.com:version", Config: api}, filter)
 }
 
@@ -69,7 +74,16 @@ kind:
 	if !assert.NoError(t, err) {
 		return
 	}
-	filter := instance.containerFilterProvider("example.com:version", "", "", api)
+
+	spec := filters.FunctionSpec{
+		Container: filters.ContainerSpec{
+			Image: "example.com:version",
+		},
+	}
+	if !assert.NoError(t, err) {
+		return
+	}
+	filter, _ := instance.functionFilterProvider(spec, api)
 	assert.Equal(t, &filters.ContainerFilter{
 		Image: "example.com:version", Config: api, GlobalScope: true}, filter)
 }
@@ -126,12 +140,22 @@ func TestRunFns_Execute__initDefault(t *testing.T) {
 				FunctionPaths:        []string{"foo"},
 			},
 		},
+		{
+			name:     "explicit directories in mounts",
+			instance: RunFns{StorageMounts: []filters.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}}},
+			expected: RunFns{
+				Output:               os.Stdout,
+				Input:                os.Stdin,
+				NoFunctionsFromInput: getFalse(),
+				StorageMounts:        []filters.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}},
+			},
+		},
 	}
 	for i := range tests {
 		tt := tests[i]
 		t.Run(tt.name, func(t *testing.T) {
 			(&tt.instance).init()
-			(&tt.instance).containerFilterProvider = nil
+			(&tt.instance).functionFilterProvider = nil
 			if !assert.Equal(t, tt.expected, tt.instance) {
 				t.FailNow()
 			}
@@ -172,10 +196,21 @@ func TestRunFns_getFilters(t *testing.T) {
 		in []f
 		// images to be run in a specific order
 		out []string
+
+		// images to be run in a specific order -- computed from directory path
+		outFn func(string) []string
+
+		// expected Error
+		error string
+
 		// name of the test
 		name string
 		// value to set for NoFunctionsFromInput
 		noFunctionsFromInput *bool
+
+		enableStarlark bool
+
+		disableContainers bool
 	}{
 		// Test
 		//
@@ -199,6 +234,26 @@ metadata:
 			out: []string{"gcr.io/example.com/image:v1.0.0"},
 		},
 
+		{name: "disable containers",
+			in: []f{
+				{
+					path: filepath.Join("foo", "bar.yaml"),
+					value: `
+apiVersion: example.com/v1alpha1
+kind: ExampleFunction
+metadata:
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: gcr.io/example.com/image:v1.0.0
+    config.kubernetes.io/local-config: "true"
+`,
+				},
+			},
+			out:               nil,
+			disableContainers: true,
+		},
+
 		// Test
 		//
 		//
@@ -418,6 +473,92 @@ metadata:
 			},
 			out: []string{"b", "a", "c"},
 		},
+
+		// Test
+		//
+		//
+		{name: "starlark-function",
+			in: []f{
+				{
+					path: filepath.Join("foo", "bar.yaml"),
+					value: `
+apiVersion: example.com/v1alpha1
+kind: ExampleFunction
+metadata:
+  annotations:
+    config.kubernetes.io/function: |
+      starlark:
+        path: a/b/c
+`,
+				},
+			},
+			enableStarlark: true,
+			outFn: func(path string) []string {
+				return []string{
+					fmt.Sprintf("name:  path: %s/foo/a/b/c url:  program:", path)}
+			},
+		},
+
+		// Test
+		//
+		//
+		{name: "starlark-function-absolute",
+			in: []f{
+				{
+					path: filepath.Join("foo", "bar.yaml"),
+					value: `
+apiVersion: example.com/v1alpha1
+kind: ExampleFunction
+metadata:
+  annotations:
+    config.kubernetes.io/function: |
+      starlark:
+        path: /a/b/c
+`,
+				},
+			},
+			enableStarlark: true,
+			error:          "absolute function path /a/b/c not allowed",
+		},
+
+		// Test
+		//
+		//
+		{name: "starlark-function-escape-parent",
+			in: []f{
+				{
+					path: filepath.Join("foo", "bar.yaml"),
+					value: `
+apiVersion: example.com/v1alpha1
+kind: ExampleFunction
+metadata:
+  annotations:
+    config.kubernetes.io/function: |
+      starlark:
+        path: ../a/b/c
+`,
+				},
+			},
+			enableStarlark: true,
+			error:          "function path ../a/b/c not allowed to start with ../",
+		},
+
+		{name: "starlark-function-disabled",
+			in: []f{
+				{
+					path: filepath.Join("foo", "bar.yaml"),
+					value: `
+apiVersion: example.com/v1alpha1
+kind: ExampleFunction
+metadata:
+  annotations:
+    config.kubernetes.io/function: |
+      starlark:
+        path: a/b/c
+`,
+				},
+			},
+		},
 	}
 
 	for i := range tests {
@@ -470,6 +611,8 @@ metadata:
 
 			// init the instance
 			r := &RunFns{
+				EnableStarlark:       tt.enableStarlark,
+				DisableContainers:    tt.disableContainers,
 				FunctionPaths:        fnPaths,
 				Functions:            parsedFns,
 				Path:                 d,
@@ -480,6 +623,14 @@ metadata:
 			// get the filters which would be run
 			var results []string
 			_, fltrs, _, err := r.getNodesAndFilters()
+
+			if tt.error != "" {
+				if !assert.EqualError(t, err, tt.error) {
+					t.FailNow()
+				}
+				return
+			}
+
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}
@@ -488,8 +639,14 @@ metadata:
 			}
 
 			// compare the actual ordering to the expected ordering
-			if !assert.Equal(t, tt.out, results) {
-				t.FailNow()
+			if tt.outFn != nil {
+				if !assert.Equal(t, tt.outFn(d), results) {
+					t.FailNow()
+				}
+			} else {
+				if !assert.Equal(t, tt.out, results) {
+					t.FailNow()
+				}
 			}
 		})
 	}
@@ -505,7 +662,7 @@ func TestCmd_Execute(t *testing.T) {
 		return
 	}
 
-	instance := RunFns{Path: dir, containerFilterProvider: getFilterProvider(t)}
+	instance := RunFns{Path: dir, functionFilterProvider: getFilterProvider(t)}
 	if !assert.NoError(t, instance.Execute()) {
 		t.FailNow()
 	}
@@ -534,9 +691,9 @@ func TestCmd_Execute_setFunctionPaths(t *testing.T) {
 
 	// run the functions, providing the path to the directory of filters
 	instance := RunFns{
-		FunctionPaths:           []string{tmpF.Name()},
-		Path:                    dir,
-		containerFilterProvider: getFilterProvider(t),
+		FunctionPaths:          []string{tmpF.Name()},
+		Path:                   dir,
+		functionFilterProvider: getFilterProvider(t),
 	}
 	// initialize the defaults
 	instance.init()
@@ -566,9 +723,9 @@ func TestCmd_Execute_setOutput(t *testing.T) {
 
 	out := &bytes.Buffer{}
 	instance := RunFns{
-		Output:                  out, // write to out
-		Path:                    dir,
-		containerFilterProvider: getFilterProvider(t),
+		Output:                 out, // write to out
+		Path:                   dir,
+		functionFilterProvider: getFilterProvider(t),
 	}
 	// initialize the defaults
 	instance.init()
@@ -614,9 +771,9 @@ func TestCmd_Execute_setInput(t *testing.T) {
 	}
 
 	instance := RunFns{
-		Input:                   input, // read from input
-		Path:                    outDir,
-		containerFilterProvider: getFilterProvider(t),
+		Input:                  input, // read from input
+		Path:                   outDir,
+		functionFilterProvider: getFilterProvider(t),
 	}
 	// initialize the defaults
 	instance.init()
@@ -659,8 +816,8 @@ func setupTest(t *testing.T) string {
 // getFilterProvider fakes the creation of a filter, replacing the ContainerFiler with
 // a filter to s/kind: Deployment/kind: StatefulSet/g.
 // this can be used to simulate running a filter.
-func getFilterProvider(t *testing.T) func(string, string, string, *yaml.RNode) kio.Filter {
-	return func(s, _, _ string, node *yaml.RNode) kio.Filter {
+func getFilterProvider(t *testing.T) func(filters.FunctionSpec, *yaml.RNode) (kio.Filter, error) {
+	return func(f filters.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
 		// parse the filter from the input
 		filter := yaml.YFilter{}
 		b := &bytes.Buffer{}
@@ -676,6 +833,6 @@ func getFilterProvider(t *testing.T) func(string, string, string, *yaml.RNode) k
 
 		return filters.Modifier{
 			Filters: []yaml.YFilter{{Filter: yaml.Lookup("kind")}, filter},
-		}
+		}, nil
 	}
 }

kyaml/setters2/set.go

@@ -23,6 +23,9 @@ type Set struct {
 
 	// Count is the number of fields that were updated by calling Filter
 	Count int
+
+	// SetAll if set to true will set all setters regardless of name
+	SetAll bool
 }
 
 // Filter implements Set as a yaml.Filter
@@ -30,13 +33,19 @@ func (s *Set) Filter(object *yaml.RNode) (*yaml.RNode, error) {
 	return object, accept(s, object)
 }
 
+// isMatch returns true if the setter with name should have the field
+// value set
+func (s *Set) isMatch(name string) bool {
+	return s.SetAll || s.Name == name
+}
+
 // visitSequence will perform setters for sequences
 func (s *Set) visitSequence(object *yaml.RNode, p string, schema *openapi.ResourceSchema) error {
 	ext, err := getExtFromComment(schema)
 	if err != nil {
 		return err
 	}
-	if ext == nil || ext.Setter == nil || ext.Setter.Name != s.Name ||
+	if ext == nil || ext.Setter == nil || !s.isMatch(ext.Setter.Name) ||
 		len(ext.Setter.ListValues) == 0 {
 		// setter was not invoked for this sequence
 		return nil
@@ -125,7 +134,7 @@ func (s *Set) substitute(field *yaml.RNode, ext *cliExtension, _ *spec.Schema) (
 			p = strings.ReplaceAll(p, v.Marker, subSetter.Setter.Value)
 		}
 
-		if subSetter.Setter.Name == s.Name {
+		if s.isMatch(subSetter.Setter.Name) {
 			// the substitution depends on the specified setter
 			nameMatch = true
 		}
@@ -148,7 +157,7 @@ func (s *Set) substitute(field *yaml.RNode, ext *cliExtension, _ *spec.Schema) (
 // set applies the value from ext to field if its name matches s.Name
 func (s *Set) set(field *yaml.RNode, ext *cliExtension, sch *spec.Schema) bool {
 	// check full setter
-	if ext.Setter == nil || ext.Setter.Name != s.Name {
+	if ext.Setter == nil || !s.isMatch(ext.Setter.Name) {
 		return false
 	}
 

kyaml/setters2/settersutil/fieldsetter.go

@@ -68,3 +68,32 @@ func (fs FieldSetter) Set(openAPIPath, resourcesPath string) (int, error) {
 	}.Execute()
 	return s.Count, err
 }
+
+// SetAllSetterDefinitions reads all the Setter Definitions from the OpenAPI
+// file and sets all values in the provided directories.
+func SetAllSetterDefinitions(openAPIPath string, dirs ...string) error {
+	if err := openapi.AddSchemaFromFile(openAPIPath); err != nil {
+		return err
+	}
+
+	for _, dir := range dirs {
+		rw := &kio.LocalPackageReadWriter{
+			PackagePath: dir,
+			// set output won't include resources from files which
+			//weren't modified.  make sure we don't delete them.
+			NoDeleteFiles: true,
+		}
+
+		// apply all of the setters to the directory
+		err := kio.Pipeline{
+			Inputs: []kio.Reader{rw},
+			// Set all of the setters
+			Filters: []kio.Filter{setters2.SetAll(&setters2.Set{SetAll: true})},
+			Outputs: []kio.Writer{rw},
+		}.Execute()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}

kyaml/setters2/settersutil/fieldsetter_test.go

@@ -0,0 +1,106 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package settersutil
+
+import (
+	"io/ioutil"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSetAllSetterDefinitions(t *testing.T) {
+	srcOpenAPIFile := `openAPI:
+  definitions:
+    io.k8s.cli.setters.namespace:
+      x-k8s-cli:
+        setter:
+          name: namespace
+          value: "project-namespace"
+    io.k8s.cli.setters.replicas:
+      x-k8s-cli:
+        setter:
+          name: replicas
+          value: "4"`
+
+	destFile1 := `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  namespace: some-other-namespace # {"$ref": "#/definitions/io.k8s.cli.setters.namespace"}
+spec:
+  replicas: 3 # {"$ref": "#/definitions/io.k8s.cli.setters.replicas"}`
+
+	destFile2 := `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  namespace: some-other-namespace2 # {"$ref": "#/definitions/io.k8s.cli.setters.namespace"}
+spec:
+  replicas: 2 # {"$ref": "#/definitions/io.k8s.cli.setters.replicas"}`
+
+	expectedDestFile := `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  namespace: project-namespace # {"$ref": "#/definitions/io.k8s.cli.setters.namespace"}
+spec:
+  replicas: 4 # {"$ref": "#/definitions/io.k8s.cli.setters.replicas"}`
+
+	srcDir, err := ioutil.TempDir("", "")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	destDir1, err := ioutil.TempDir("", "")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	destDir2, err := ioutil.TempDir("", "")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	defer os.RemoveAll(srcDir)
+	defer os.RemoveAll(destDir1)
+	defer os.RemoveAll(destDir2)
+
+	err = ioutil.WriteFile(srcDir+"/OpenAPIFile", []byte(srcOpenAPIFile), 0600)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	err = ioutil.WriteFile(destDir1+"/destFile.yaml", []byte(destFile1), 0600)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	err = ioutil.WriteFile(destDir2+"/destFile.yaml", []byte(destFile2), 0600)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	err = SetAllSetterDefinitions(srcDir+"/OpenAPIFile", destDir1, destDir2)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	actualdestFile1, err := ioutil.ReadFile(destDir1 + "/destFile.yaml")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	if !assert.Equal(t, strings.Trim(string(actualdestFile1), "\n"), expectedDestFile) {
+		t.FailNow()
+	}
+
+	actualdestFile2, err := ioutil.ReadFile(destDir2 + "/destFile.yaml")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	if !assert.Equal(t, strings.Trim(string(actualdestFile2), "\n"), expectedDestFile) {
+		t.FailNow()
+	}
+}

kyaml/starlark/context.go

@@ -0,0 +1,95 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package starlark
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+
+	"github.com/qri-io/starlib/util"
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type Context struct {
+	resourceList starlark.Value
+}
+
+func (c *Context) predeclared() (starlark.StringDict, error) {
+	e, err := env()
+	if err != nil {
+		return nil, err
+	}
+	oa, err := oa()
+	if err != nil {
+		return nil, err
+	}
+	dict := starlark.StringDict{
+		"resource_list": c.resourceList,
+		"open_api":      oa,
+		"environment":   e,
+	}
+
+	return starlark.StringDict{
+		"ctx": starlarkstruct.FromStringDict(starlarkstruct.Default, dict),
+	}, nil
+}
+
+func oa() (starlark.Value, error) {
+	return interfaceToValue(openapi.Schema())
+}
+
+func env() (starlark.Value, error) {
+	env := map[string]interface{}{}
+	for _, e := range os.Environ() {
+		pair := strings.SplitN(e, "=", 2)
+		if len(pair) < 2 {
+			continue
+		}
+		env[pair[0]] = pair[1]
+	}
+	value, err := util.Marshal(env)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	return value, nil
+}
+
+func nodeToValue(node *yaml.RNode) (starlark.Value, error) {
+	s, err := node.String()
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	var in map[string]interface{}
+	if err := yaml.Unmarshal([]byte(s), &in); err != nil {
+		return nil, errors.Wrap(err)
+	}
+	value, err := util.Marshal(in)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	return value, nil
+}
+
+func interfaceToValue(i interface{}) (starlark.Value, error) {
+	b, err := json.Marshal(i)
+	if err != nil {
+		return nil, err
+	}
+
+	var in map[string]interface{}
+	if err := yaml.Unmarshal(b, &in); err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	value, err := util.Marshal(in)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	return value, nil
+}

kyaml/starlark/example_test.go

@@ -50,7 +50,7 @@ def run(items):
   for item in items:
     item["metadata"]["annotations"]["foo"] = "bar"
 
-run(resourceList["items"])
+run(ctx.resource_list["items"])
 `,
 	}
 
@@ -139,7 +139,7 @@ def run(items, value):
   for item in items:
     item["metadata"]["annotations"]["foo"] = value
 
-run(resourceList["items"], resourceList["functionConfig"]["spec"]["value"])
+run(ctx.resource_list["items"], ctx.resource_list["functionConfig"]["spec"]["value"])
 `,
 		FunctionConfig: fc,
 	}
@@ -233,7 +233,7 @@ def run(items):
   for item in items:
     item["metadata"]["annotations"]["foo"] = "bar"
 
-run(resourceList["items"])
+run(ctx.resource_list["items"])
 `), 0600)
 	if err != nil {
 		log.Fatal(err)