update go.mod for release

UX improvements to kyaml/fn/framework

.github/workflows/go.yml

@@ -0,0 +1,28 @@
+name: Go
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v2
+      with:
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
+
+    - name: Build
+      run: ./travis/kyaml-pre-commit.sh
+      env:
+        KUSTOMIZE_DOCKER_E2E: true

api/krusty/baseandoverlaymedium_test.go

@@ -154,9 +154,8 @@ LEGUME=chickpea
 `)
 	th.WriteF("/app/overlay/configmap/dummy.txt",
 		`Lorem ipsum dolor sit amet, consectetur
- 		 
-adipiscing elit, sed do eiusmod tempor		
-incididunt ut labore et dolore magna aliqua.   
+adipiscing elit, sed do eiusmod tempor
+incididunt ut labore et dolore magna aliqua. 
 `)
 	th.WriteF("/app/overlay/deployment/deployment.yaml", `
 apiVersion: apps/v1
@@ -293,11 +292,8 @@ metadata:
 ---
 apiVersion: v1
 data:
-  nonsense: |
-    Lorem ipsum dolor sit amet, consectetur
-
-    adipiscing elit, sed do eiusmod tempor
-    incididunt ut labore et dolore magna aliqua.
+  nonsense: "Lorem ipsum dolor sit amet, consectetur\nadipiscing elit, sed do eiusmod
+    tempor\nincididunt ut labore et dolore magna aliqua. \n"
 kind: ConfigMap
 metadata:
   annotations:
@@ -306,6 +302,6 @@ metadata:
     app: mungebot
     org: kubernetes
     repo: test-infra
-  name: test-infra-app-config-hh272bg5d4
+  name: test-infra-app-config-f462h769f9
 `)
 }

api/kv/kv.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"os"
 	"path"
-	"regexp"
 	"strings"
 	"unicode"
 	"unicode/utf8"
@@ -86,17 +85,11 @@ func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, err
 		if err != nil {
 			return nil, err
 		}
-		kvs = append(kvs, types.Pair{Key: k, Value: trimTrailingSpacesInLines(string(content))})
+		kvs = append(kvs, types.Pair{Key: k, Value: string(content)})
 	}
 	return kvs, nil
 }
 
-// trimTrailingSpacesInLines takes string with multiple lines and trims the trailing white spaces and tabs from each line.
-func trimTrailingSpacesInLines(str string) string {
-	re := regexp.MustCompile(`[ \t]*\n`)
-	return re.ReplaceAllString(str, "\n")
-}
-
 func (kvl *loader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error) {
 	var kvs []types.Pair
 	for _, p := range paths {

api/kv/kv_test.go

@@ -95,12 +95,3 @@ func TestKeyValuesFromFileSources(t *testing.T) {
 		}
 	}
 }
-
-func TestTrimTrailingSpacesInLines(t *testing.T) {
-	input := "\"fooKey\": \"fooValue\"   \t\n \t\t  \n\t\"barKey\": \"barValue\""
-	expected := "\"fooKey\": \"fooValue\"\n\n\t\"barKey\": \"barValue\""
-	res := trimTrailingSpacesInLines(input)
-	if !reflect.DeepEqual(res, expected) {
-		t.Errorf("Trim trailing spaces in lines should succeed, got: %s exptected: %s", res, expected)
-	}
-}

cmd/config/.golangci.yml

@@ -19,7 +19,7 @@ linters:
 #    - gochecknoinits
 #    - goconst
 #    - gocritic
-    - gocyclo
+#    - gocyclo
     - gofmt
     - goimports
 #    - golint

cmd/config/Makefile

@@ -32,7 +32,7 @@ lint:
 	$(GOBIN)/golangci-lint run ./...
 
 test:
-	go test -cover ./...
+	go test -v -timeout 45m -cover ./...
 
 vet:
 	go vet ./...

cmd/config/go.mod

@@ -4,11 +4,12 @@ go 1.13
 
 require (
 	github.com/go-errors/errors v1.0.1
+	github.com/go-openapi/spec v0.19.5
 	github.com/olekukonko/tablewriter v0.0.4
 	github.com/posener/complete/v2 v2.0.1-alpha.12
-	github.com/spf13/cobra v0.0.5
+	github.com/spf13/cobra v1.0.0
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.4.0
 	k8s.io/apimachinery v0.17.0
-	sigs.k8s.io/kustomize/kyaml v0.1.8
+	sigs.k8s.io/kustomize/kyaml v0.1.10
 )

cmd/config/go.sum

@@ -1,6 +1,8 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
@@ -8,19 +10,29 @@ github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbt
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
@@ -28,8 +40,12 @@ github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb
 github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
@@ -45,18 +61,31 @@ github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dp
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
@@ -66,10 +95,15 @@ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -82,6 +116,7 @@ github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e h1:hB2xlXdHp/pmPZq
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
 github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -91,7 +126,9 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=
 github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -101,6 +138,7 @@ github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGV
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -109,50 +147,84 @@ github.com/posener/complete/v2 v2.0.1-alpha.12 h1:0wvkuDfHb5vSZlNBYgpEH4XQHpF46M
 github.com/posener/complete/v2 v2.0.1-alpha.12/go.mod h1://JlL91cS2JV7rOl6LVHrRqBXoBUecJu3ILQPgbJiMQ=
 github.com/posener/script v1.0.4 h1:nSuXW5ZdmFnQIueLB2s0qvs4oNsUloM1Zydzh75v42w=
 github.com/posener/script v1.0.4/go.mod h1:Rg3ijooqulo05aGLyGsHoLmIOUzHUVK19WVgrYBPU/E=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d h1:K6eOUihrFLdZjZnA4XlRp864fmWXv9YTIk7VPLhRacA=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
-github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s=
-github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
+github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
+github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -160,9 +232,18 @@ golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fq
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
@@ -170,7 +251,9 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
@@ -179,13 +262,14 @@ gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/apimachinery v0.17.0 h1:xRBnuie9rXcPxUkDizUsGvPf1cnlZCFu210op7J7LJo=
 k8s.io/apimachinery v0.17.0/go.mod h1:b9qmWdKlLuU9EBh+06BtLcSf/Mu89rWL33naRxs1uZg=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
-sigs.k8s.io/kustomize/kyaml v0.1.8 h1:s8OZ9Ds5ALjnEldFMEPoOuUxhEPhhdbIg/ExwikxtoM=
-sigs.k8s.io/kustomize/kyaml v0.1.8/go.mod h1:461i94nj0h0ylJ6w83jLkR4SqqVhn1iY6fjD0JSTQeE=
+sigs.k8s.io/kustomize/kyaml v0.1.10 h1:ZZfBnA/kYa9ZxUFIgI9oq3pWKzzA1gGOKgU0Hv/NhVg=
+sigs.k8s.io/kustomize/kyaml v0.1.10/go.mod h1:mPmeBSRy0LTMv6fSrYSoi2yIFNZVouGKDsTekE5kdhs=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

cmd/config/internal/commands/cmdcreatesetter.go

@@ -4,11 +4,15 @@
 package commands
 
 import (
+	"github.com/go-openapi/spec"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/ext"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/kustomize/kyaml/setters"
+	"sigs.k8s.io/kustomize/kyaml/setters2"
 	"sigs.k8s.io/kustomize/kyaml/setters2/settersutil"
 )
 
@@ -86,12 +90,30 @@ func (r *CreateSetterRunner) preRunE(c *cobra.Command, args []string) error {
 	if setterVersion == "v2" {
 		var err error
 		r.OpenAPIFile, err = ext.GetOpenAPIFile(args)
-		r.CreateSetter.Description = r.Set.SetPartialField.Description
-		r.CreateSetter.SetBy = r.Set.SetPartialField.SetBy
-		r.CreateSetter.Type = r.Set.SetPartialField.Type
 		if err != nil {
 			return err
 		}
+
+		if err := openapi.AddSchemaFromFile(r.OpenAPIFile); err != nil {
+			return err
+		}
+
+		// check if substitution with same name exists and throw error
+		ref, err := spec.NewRef(setters2.DefinitionsPrefix + setters2.SubstitutionDefinitionPrefix + r.CreateSetter.Name)
+		if err != nil {
+			return err
+		}
+
+		subst, _ := openapi.Resolve(&ref)
+		// if substitution already exists with the input setter name, throw error
+		if subst != nil {
+			return errors.Errorf("substitution with name %s already exists, "+
+				"substitution and setter can't have same name", r.CreateSetter.Name)
+		}
+
+		r.CreateSetter.Description = r.Set.SetPartialField.Description
+		r.CreateSetter.SetBy = r.Set.SetPartialField.SetBy
+		r.CreateSetter.Type = r.Set.SetPartialField.Type
 	}
 	return nil
 }

cmd/config/internal/commands/cmdcreatesetter_test.go

@@ -22,8 +22,10 @@ func TestCreateSetterCommand(t *testing.T) {
 		input             string
 		args              []string
 		out               string
+		inputOpenAPI      string
 		expectedOpenAPI   string
 		expectedResources string
+		err               string
 	}{
 		{
 			name: "add replicas",
@@ -36,6 +38,10 @@ metadata:
 spec:
   replicas: 3
  `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
 			expectedOpenAPI: `
 apiVersion: v1alpha1
 kind: Example
@@ -58,6 +64,27 @@ spec:
   replicas: 3 # {"$ref":"#/definitions/io.k8s.cli.setters.replicas"}
  `,
 		},
+		{
+			name: "error if substitution with same name exists",
+			args: []string{"my-image", "3", "--description", "hello world", "--set-by", "me"},
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.substitutions.my-image:
+      x-k8s-cli:
+        substitution:
+          name: my-image
+          pattern: something/${my-image-setter}::${my-tag-setter}/nginxotherthing
+          values:
+          - marker: ${my-image-setter}
+            ref: '#/definitions/io.k8s.cli.setters.my-image-setter'
+          - marker: ${my-tag-setter}
+            ref: '#/definitions/io.k8s.cli.setters.my-tag-setter'
+ `,
+			err: "substitution with name my-image already exists, substitution and setter can't have same name",
+		},
 	}
 	for i := range tests {
 		test := tests[i]
@@ -71,10 +98,7 @@ spec:
 				t.FailNow()
 			}
 			defer os.Remove(f.Name())
-			err = ioutil.WriteFile(f.Name(), []byte(`
-apiVersion: v1alpha1
-kind: Example
-`), 0600)
+			err = ioutil.WriteFile(f.Name(), []byte(test.inputOpenAPI), 0600)
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}
@@ -99,6 +123,14 @@ kind: Example
 			runner.Command.SetOut(out)
 			runner.Command.SetArgs(append([]string{r.Name()}, test.args...))
 			err = runner.Command.Execute()
+			if test.err != "" {
+				if !assert.NotNil(t, err) {
+					t.FailNow()
+				} else {
+					assert.Equal(t, err.Error(), test.err)
+					return
+				}
+			}
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}

cmd/config/internal/commands/cmdcreatesubstitution.go

@@ -4,12 +4,15 @@
 package commands
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
+	"github.com/go-openapi/spec"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/ext"
 	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/kustomize/kyaml/setters2"
 	"sigs.k8s.io/kustomize/kyaml/setters2/settersutil"
 )
@@ -63,6 +66,23 @@ func (r *CreateSubstitutionRunner) preRunE(c *cobra.Command, args []string) erro
 		return err
 	}
 
+	if err := openapi.AddSchemaFromFile(r.OpenAPIFile); err != nil {
+		return err
+	}
+
+	// check if setter with same name exists and throw error
+	ref, err := spec.NewRef(setters2.DefinitionsPrefix + setters2.SetterDefinitionPrefix + r.CreateSubstitution.Name)
+	if err != nil {
+		return err
+	}
+
+	setter, _ := openapi.Resolve(&ref)
+	// if setter already exists with input substitution name, throw error
+	if setter != nil {
+		return errors.Errorf(fmt.Sprintf("setter with name %s already exists, "+
+			"substitution and setter can't have same name", r.CreateSubstitution.Name))
+	}
+
 	// extract setter name tokens from pattern enclosed in ${}
 	re := regexp.MustCompile(`\$\{([^}]*)\}`)
 	markers := re.FindAll([]byte(r.CreateSubstitution.Pattern), -1)

cmd/config/internal/commands/cmdcreatesubstitution_test.go

@@ -25,6 +25,7 @@ func TestCreateSubstitutionCommand(t *testing.T) {
 		out               string
 		expectedOpenAPI   string
 		expectedResources string
+		err               string
 	}{
 		{
 			name: "substitution replicas",
@@ -103,6 +104,23 @@ spec:
         image: sidecar:1.7.9
  `,
 		},
+		{
+			name: "error if setter with same name exists",
+			args: []string{
+				"my-image", "--field-value", "nginx:1.7.9", "--pattern", "${my-image-setter}:${my-tag-setter}"},
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.setters.my-image:
+      x-k8s-cli:
+        setter:
+          name: my-image
+          value: "nginx"
+ `,
+			err: "setter with name my-image already exists, substitution and setter can't have same name",
+		},
 		{
 			name: "substitution and create setters 1",
 			args: []string{
@@ -206,6 +224,14 @@ spec:
 			runner.Command.SetOut(out)
 			runner.Command.SetArgs(append([]string{r.Name()}, test.args...))
 			err = runner.Command.Execute()
+
+			if test.err != "" {
+				if !assert.NotNil(t, err) {
+					t.FailNow()
+				}
+				assert.Equal(t, err.Error(), test.err)
+				return
+			}
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}

cmd/config/internal/commands/cmdlistsetters.go

@@ -59,42 +59,83 @@ func (r *ListSettersRunner) preRunE(c *cobra.Command, args []string) error {
 
 func (r *ListSettersRunner) runE(c *cobra.Command, args []string) error {
 	if setterVersion == "v2" {
-		// use setters v2
-		path, err := ext.GetOpenAPIFile(args)
-		if err != nil {
+		if err := r.ListSetters(c, args); err != nil {
 			return err
 		}
-		if err := r.List.List(path, args[0]); err != nil {
-			return err
-		}
-		table := newTable(c.OutOrStdout(), r.Markdown)
-		table.SetHeader([]string{"NAME", "VALUE", "SET BY", "DESCRIPTION", "COUNT"})
-		for i := range r.List.Setters {
-			s := r.List.Setters[i]
-			v := s.Value
-
-			// if the setter is for a list, populate the values
-			if len(s.ListValues) > 0 {
-				v = strings.Join(s.ListValues, ",")
-				v = fmt.Sprintf("[%s]", v)
-			}
-			table.Append([]string{
-				s.Name, v, s.SetBy, s.Description, fmt.Sprintf("%d", s.Count)})
-		}
-		table.Render()
-
-		if len(r.List.Setters) == 0 {
-			// exit non-0 if no matching setters are found
-			if ExitOnError {
-				os.Exit(1)
-			}
-		}
-		return nil
+		return r.ListSubstitutions(c, args)
 	}
 
 	return handleError(c, lookup(r.Lookup, c, args))
 }
 
+func (r *ListSettersRunner) ListSetters(c *cobra.Command, args []string) error {
+	// use setters v2
+	path, err := ext.GetOpenAPIFile(args)
+	if err != nil {
+		return err
+	}
+	if err := r.List.ListSetters(path, args[0]); err != nil {
+		return err
+	}
+	table := newTable(c.OutOrStdout(), r.Markdown)
+	table.SetHeader([]string{"NAME", "VALUE", "SET BY", "DESCRIPTION", "COUNT"})
+	for i := range r.List.Setters {
+		s := r.List.Setters[i]
+		v := s.Value
+
+		// if the setter is for a list, populate the values
+		if len(s.ListValues) > 0 {
+			v = strings.Join(s.ListValues, ",")
+			v = fmt.Sprintf("[%s]", v)
+		}
+		table.Append([]string{
+			s.Name, v, s.SetBy, s.Description, fmt.Sprintf("%d", s.Count)})
+	}
+	table.Render()
+
+	if len(r.List.Setters) == 0 {
+		// exit non-0 if no matching setters are found
+		if ExitOnError {
+			os.Exit(1)
+		}
+	}
+	return nil
+}
+
+func (r *ListSettersRunner) ListSubstitutions(c *cobra.Command, args []string) error {
+	// use setters v2
+	path, err := ext.GetOpenAPIFile(args)
+	if err != nil {
+		return err
+	}
+	if err := r.List.ListSubst(path); err != nil {
+		return err
+	}
+	table := newTable(c.OutOrStdout(), r.Markdown)
+	table.SetHeader([]string{"SUBSTITUTION", "PATTERN", "SETTERS"})
+	for i := range r.List.Substitutions {
+		s := r.List.Substitutions[i]
+		setters := ""
+		for _, value := range s.Values {
+			setter := strings.TrimPrefix(value.Ref, setters2.DefinitionsPrefix+setters2.SetterDefinitionPrefix)
+			setters = setters + "," + setter
+		}
+		setters = fmt.Sprintf("[%s]", strings.TrimPrefix(setters, ","))
+		table.Append([]string{
+			s.Name, s.Pattern, setters})
+	}
+	if len(r.List.Substitutions) == 0 {
+		// exit non-0 if no matching substitutions are found
+		if ExitOnError {
+			os.Exit(1)
+		}
+	} else {
+		table.Render()
+	}
+
+	return nil
+}
+
 func newTable(o io.Writer, m bool) *tablewriter.Table {
 	table := tablewriter.NewWriter(o)
 	table.SetRowLine(false)

cmd/config/internal/commands/cmdlistsetters_test.go

@@ -104,6 +104,8 @@ spec:
   image      nginx   me2      hello world 2   2      
   replicas   3       me1      hello world 1   1      
   tag        1.7.9   me3      hello world 3   1      
+  SUBSTITUTION    PATTERN      SETTERS    
+  image          IMAGE:TAG   [image,tag]  
 `,
 		},
 		{
@@ -176,6 +178,8 @@ spec:
   image      nginx   me2      hello world 2   3      
   replicas   3       me1      hello world 1   2      
   tag        1.7.9   me3      hello world 3   2      
+  SUBSTITUTION    PATTERN      SETTERS    
+  image          IMAGE:TAG   [image,tag]  
 `,
 		},
 		{
@@ -247,6 +251,8 @@ spec:
 `,
 			expected: `  NAME    VALUE   SET BY    DESCRIPTION    COUNT  
   image   nginx   me2      hello world 2   3      
+  SUBSTITUTION    PATTERN      SETTERS    
+  image          IMAGE:TAG   [image,tag]  
 `,
 		},
 	}

cmd/config/internal/commands/e2e/e2e_test.go

@@ -0,0 +1,661 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRunE2e(t *testing.T) {
+	binDir, err := ioutil.TempDir("", "kustomize-test-")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	//defer os.RemoveAll(binDir)
+	build(t, binDir)
+
+	tests := []struct {
+		name           string
+		args           func(string) []string
+		files          func(string) map[string]string
+		expectedFiles  func(string) map[string]string
+		expectedErr    string
+		skipIfFalseEnv string
+	}{
+		{
+			name: "exec_function_no_args",
+			args: func(d string) []string {
+				return []string{
+					"--enable-exec", "--exec-path", filepath.Join(d, "e2econtainerconfig"),
+				}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: ''
+    a-int-value: '0'
+    a-bool-value: 'false'
+`,
+				}
+			},
+		},
+
+		{
+			name: "exec_function_args",
+			args: func(d string) []string {
+				return []string{
+					"--enable-exec", "--exec-path", filepath.Join(d, "e2econtainerconfig"),
+					"--", "stringValue=a", "intValue=1", "boolValue=true",
+				}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: 'a'
+    a-int-value: '1'
+    a-bool-value: 'true'
+`,
+				}
+			},
+		},
+
+		{
+			name: "exec_function_config",
+			args: func(d string) []string {
+				return []string{"--enable-exec"}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": fmt.Sprintf(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+`, filepath.Join(d, "e2econtainerconfig")),
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": fmt.Sprintf(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+    a-string-value: ''
+    a-int-value: '0'
+    a-bool-value: 'false'
+`, filepath.Join(d, "e2econtainerconfig"))}
+			},
+		},
+
+		//
+		// Starklark function tests
+		//
+		{
+			name: "exec_function_config",
+			args: func(d string) []string {
+				return []string{"--enable-exec"}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": fmt.Sprintf(`
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`, filepath.Join(d, "e2econtainerconfig")),
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": fmt.Sprintf(`
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+    a-string-value: 'a'
+    a-int-value: '2'
+    a-bool-value: 'true'
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`, filepath.Join(d, "e2econtainerconfig")),
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: 'a'
+    a-int-value: '2'
+    a-bool-value: 'true'
+`,
+				}
+			},
+		},
+
+		{
+			//
+			// NOTE: Do not change the expected value of this test.  It is to ensure that
+			// exec functions are off by default when run from the CLI.
+			// exec functions execute arbitrary code outside of a sandbox environment.
+			//
+			name: "exec_function_config_disabled",
+			args: func(d string) []string { return []string{} },
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": fmt.Sprintf(`
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`, filepath.Join(d, "e2econtainerconfig")),
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": fmt.Sprintf(`
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: "%s"
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`, filepath.Join(d, "e2econtainerconfig")),
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+		},
+
+		{
+			name:        "exec_function_no_enable",
+			expectedErr: "must specify --enable-exec with --exec-path",
+			args: func(d string) []string {
+				return []string{"--exec-path", filepath.Join(d, "e2econtainerconfig")}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: ''
+    a-int-value: '0'
+    a-bool-value: 'false'
+`,
+				}
+			},
+		},
+
+		//
+		// Container
+		//
+		{
+			name:           "container_function_no_args",
+			skipIfFalseEnv: "KUSTOMIZE_DOCKER_E2E",
+			args: func(d string) []string {
+				return []string{"--image", "gcr.io/kustomize-functions/e2econtainerconfig"}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: ''
+    a-int-value: '0'
+    a-bool-value: 'false'
+`,
+				}
+			},
+		},
+
+		{
+			name:           "container_function_args",
+			skipIfFalseEnv: "KUSTOMIZE_DOCKER_E2E",
+			args: func(d string) []string {
+				return []string{
+					"--image", "gcr.io/kustomize-functions/e2econtainerconfig",
+					"--", "stringValue=a", "intValue=1", "boolValue=true",
+				}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: 'a'
+    a-int-value: '1'
+    a-bool-value: 'true'
+`,
+				}
+			},
+		},
+
+		{
+			name:           "container_function_config",
+			skipIfFalseEnv: "KUSTOMIZE_DOCKER_E2E",
+			args:           func(d string) []string { return []string{} },
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: "gcr.io/kustomize-functions/e2econtainerconfig"
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: "gcr.io/kustomize-functions/e2econtainerconfig"
+    a-string-value: ''
+    a-int-value: '0'
+    a-bool-value: 'false'
+`}
+			},
+		},
+
+		{
+			name:           "container_function_config",
+			skipIfFalseEnv: "KUSTOMIZE_DOCKER_E2E",
+			args:           func(d string) []string { return []string{} },
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": `
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: "gcr.io/kustomize-functions/e2econtainerconfig"
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`,
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": `
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: "gcr.io/kustomize-functions/e2econtainerconfig"
+    a-string-value: 'a'
+    a-int-value: '2'
+    a-bool-value: 'true'
+data:
+  stringValue: a
+  intValue: 2
+  boolValue: true
+`,
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-string-value: 'a'
+    a-int-value: '2'
+    a-bool-value: 'true'
+`,
+				}
+			},
+		},
+
+		{
+			name: "starlark_function_config",
+			args: func(d string) []string { return []string{"--enable-star"} },
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"script.star": `
+# set the foo annotation on each resource
+def run(r, fc):
+  for resource in r:
+    resource["metadata"]["annotations"]["a-string-value"] = fc["data"]["stringValue"]
+    resource["metadata"]["annotations"]["a-int-value"] = fc["data"]["intValue"]
+    resource["metadata"]["annotations"]["a-bool-value"] = fc["data"]["boolValue"]
+
+run(ctx.resource_list["items"], ctx.resource_list["functionConfig"])
+`,
+					"config.yaml": `
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    config.kubernetes.io/function: |
+      starlark:
+        path: script.star
+        name: fn
+data:
+  boolValue: true
+  intValue: 2
+  stringValue: a
+`,
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"config.yaml": `
+apiVersion: example.com/v1alpha1
+kind: Input
+metadata:
+  name: foo
+  annotations:
+    a-bool-value: true
+    a-int-value: 2
+    a-string-value: a
+    config.kubernetes.io/function: |
+      starlark:
+        path: script.star
+        name: fn
+data:
+  boolValue: true
+  intValue: 2
+  stringValue: a
+`,
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-bool-value: true
+    a-int-value: 2
+    a-string-value: a
+`,
+				}
+			},
+		},
+
+		{
+			name: "starlark_function_path",
+			args: func(d string) []string {
+				return []string{
+					"--enable-star", "--star-path", "script.star",
+					"--", "stringValue=a", "intValue=2", "boolValue=true",
+				}
+			},
+			files: func(d string) map[string]string {
+				return map[string]string{
+					"script.star": `
+# set the foo annotation on each resource
+def run(r, fc):
+  for resource in r:
+    resource["metadata"]["annotations"]["a-string-value"] = fc["data"]["stringValue"]
+    resource["metadata"]["annotations"]["a-int-value"] = fc["data"]["intValue"]
+    resource["metadata"]["annotations"]["a-bool-value"] = fc["data"]["boolValue"]
+
+run(ctx.resource_list["items"], ctx.resource_list["functionConfig"])
+`,
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+				}
+			},
+			expectedFiles: func(d string) map[string]string {
+				return map[string]string{
+					"deployment.yaml": `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+  annotations:
+    a-bool-value: true
+    a-int-value: 2
+    a-string-value: a
+`,
+				}
+			},
+		},
+	}
+
+	for i := range tests {
+		tt := tests[i]
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.skipIfFalseEnv != "" && os.Getenv(tt.skipIfFalseEnv) == "false" {
+				t.Skip()
+			}
+
+			dir, err := ioutil.TempDir("", "kustomize-test-data-")
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+			defer os.RemoveAll(dir)
+			os.Chdir(dir)
+
+			// write the input
+			for path, data := range tt.files(binDir) {
+				err := ioutil.WriteFile(path, []byte(data), 0600)
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+			}
+
+			args := append([]string{"run", "."}, tt.args(binDir)...)
+			cmd := exec.Command(filepath.Join(binDir, "kyaml"), args...)
+			cmd.Dir = dir
+			var stdErr, stdOut bytes.Buffer
+			cmd.Stdout = &stdOut
+			cmd.Stderr = &stdErr
+			cmd.Env = os.Environ()
+
+			err = cmd.Run()
+			if tt.expectedErr != "" {
+				if !assert.Contains(t, stdErr.String(), tt.expectedErr) {
+					t.FailNow()
+				}
+				return
+			}
+			if !assert.NoError(t, err, stdErr.String()) {
+				t.FailNow()
+			}
+
+			for path, data := range tt.expectedFiles(binDir) {
+				b, err := ioutil.ReadFile(path)
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+				if !assert.Equal(t, strings.TrimSpace(data), strings.TrimSpace(string(b))) {
+					t.FailNow()
+				}
+			}
+		})
+	}
+}
+
+func build(t *testing.T, binDir string) {
+	build := exec.Command("go", "build", "-o",
+		filepath.Join(binDir, "e2econtainerconfig"))
+	build.Dir = "e2econtainerconfig"
+	build.Stdout = os.Stdout
+	build.Stderr = os.Stderr
+	if !assert.NoError(t, build.Run()) {
+		t.FailNow()
+	}
+
+	build = exec.Command("go", "build", "-o", filepath.Join(binDir, "kyaml"))
+	build.Dir = filepath.Join("..", "..", "..")
+	build.Stdout = os.Stdout
+	build.Stderr = os.Stderr
+	if !assert.NoError(t, build.Run()) {
+		t.FailNow()
+	}
+
+	if os.Getenv("KUSTOMIZE_DOCKER_E2E") == "false" {
+		return
+	}
+	build = exec.Command(
+		"docker", "build", ".", "-t", "gcr.io/kustomize-functions/e2econtainerconfig")
+	build.Dir = "e2econtainerconfig"
+	build.Stdout = os.Stdout
+	build.Stderr = os.Stderr
+	if !assert.NoError(t, build.Run()) {
+		t.FailNow()
+	}
+}

cmd/config/internal/commands/e2e/e2econtainerconfig/Dockerfile

@@ -0,0 +1,12 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.13-stretch
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]

cmd/config/internal/commands/e2e/e2econtainerconfig/Makefile

@@ -0,0 +1,13 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+.PHONY: generate license fix vet fmt test build tidy
+
+GOBIN := $(shell go env GOPATH)/bin
+
+test:
+	go test
+
+image:
+	docker build . -t gcr.io/kustomize-functions/e2econtainerconfig
+	docker push gcr.io/kustomize-functions/e2econtainerconfig

cmd/config/internal/commands/e2e/e2econtainerconfig/doc.go

@@ -0,0 +1,9 @@
+// Package main contains a function to be used for e2e testing.
+//
+// The function is written using the framework, and parses the ResourceList.functionConfig
+// into a go struct.
+//
+// The function will set 3 annotations on each resource.
+//
+// See https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md
+package main

cmd/config/internal/commands/e2e/e2econtainerconfig/go.mod

@@ -0,0 +1,6 @@
+module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainerconfig
+
+go 1.14
+
+require sigs.k8s.io/kustomize/kyaml v0.1.9-0.20200501190629-f7909fad7167
+

cmd/config/internal/commands/e2e/e2econtainerconfig/go.sum

@@ -0,0 +1,183 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.19.2 h1:o20suLFB4Ri0tuzpWtyHlh7E7HnkqTNLq6aR6WVNS1w=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/spec v0.19.5 h1:Xm0Ao53uqnk9QE/LlYV5DEU09UAgpliA85QoT9LzqPw=
+github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e h1:hB2xlXdHp/pmPZq0y3QnmWAArdw9PqbmotexnWx/FU8=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
+github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
+github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
+github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
+go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
+gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+sigs.k8s.io/kustomize/kyaml v0.1.9-0.20200501190629-f7909fad7167 h1:138Q3rZVU5mLBF6dFekNuP6D4ZeF4mndI54RBJ8kK8c=
+sigs.k8s.io/kustomize/kyaml v0.1.9-0.20200501190629-f7909fad7167/go.mod h1:I4OFZ1vTPdteiqqCBwW3DI0swPzxBpd99y9CHN5IMUU=

cmd/config/internal/commands/e2e/e2econtainerconfig/main.go

@@ -0,0 +1,57 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Data contains the items
+type Data struct {
+	StringValue string `yaml:"stringValue,omitempty"`
+
+	IntValue int `yaml:"intValue,omitempty"`
+
+	BoolValue bool `yaml:"boolValue,omitempty"`
+}
+
+// Example defines the ResourceList.functionConfig schema.
+type Example struct {
+	// Data contains configuration data for the Example
+	// Nest values under Data so that the function can accept a ConfigMap as its
+	// functionConfig (`run` generates a ConfigMap for the functionConfig when run with --)
+	Data Data `yaml:"data,omitempty"`
+}
+
+func main() {
+	functionConfig := &Example{}
+
+	cmd := framework.Command(functionConfig, func(items []*yaml.RNode) ([]*yaml.RNode, error) {
+		for i := range items {
+			if err := items[i].PipeE(yaml.SetAnnotation("a-string-value",
+				functionConfig.Data.StringValue)); err != nil {
+				return nil, err
+			}
+
+			if err := items[i].PipeE(yaml.SetAnnotation("a-int-value",
+				fmt.Sprintf("%v", functionConfig.Data.IntValue))); err != nil {
+				return nil, err
+			}
+
+			if err := items[i].PipeE(yaml.SetAnnotation("a-bool-value",
+				fmt.Sprintf("%v", functionConfig.Data.BoolValue))); err != nil {
+				return nil, err
+			}
+		}
+		return items, nil
+	})
+
+	if err := cmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

cmd/config/internal/commands/run-fns.go

@@ -11,7 +11,7 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/kio/filters"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
 	"sigs.k8s.io/kustomize/kyaml/runfn"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -41,15 +41,17 @@ func GetRunFnRunner(name string) *RunFnRunner {
 	r.Command.Flags().StringVar(
 		&r.Image, "image", "",
 		"run this image as a function instead of discovering them.")
+	// NOTE: exec plugins execute arbitrary code -- never change the default value of this flag!!!
 	r.Command.Flags().BoolVar(
-		&r.EnableStar, "enable-star", false, "enable support for starlark functions.")
-	r.Command.Flags().MarkHidden("enable-star")
+		&r.EnableExec, "enable-exec", false /*do not change!*/, "enable support for exec functions -- note: exec functions run arbitrary code -- do not use for untrusted configs!!! (Alpha)")
 	r.Command.Flags().StringVar(
-		&r.StarPath, "star-path", "", "run a starlark script as a function.")
-	r.Command.Flags().MarkHidden("star-path")
+		&r.ExecPath, "exec-path", "", "run an executable as a function. (Alpha)")
+	r.Command.Flags().BoolVar(
+		&r.EnableStar, "enable-star", false, "enable support for starlark functions. (Alpha)")
 	r.Command.Flags().StringVar(
-		&r.StarName, "star-name", "", "name of starlark program.")
-	r.Command.Flags().MarkHidden("star-name")
+		&r.StarPath, "star-path", "", "run a starlark script as a function. (Alpha)")
+	r.Command.Flags().StringVar(
+		&r.StarName, "star-name", "", "name of starlark program. (Alpha)")
 
 	r.Command.Flags().StringVar(
 		&r.ResultsDir, "results-dir", "", "write function results to this dir")
@@ -79,6 +81,8 @@ type RunFnRunner struct {
 	EnableStar         bool
 	StarPath           string
 	StarName           string
+	EnableExec         bool
+	ExecPath           string
 	RunFns             runfn.RunFns
 	ResultsDir         string
 	Network            bool
@@ -94,14 +98,13 @@ func (r *RunFnRunner) runE(c *cobra.Command, args []string) error {
 // Functions to run.
 func (r *RunFnRunner) getContainerFunctions(c *cobra.Command, args, dataItems []string) (
 	[]*yaml.RNode, error) {
-	if r.Image == "" && r.StarPath == "" {
+	if r.Image == "" && r.StarPath == "" && r.ExecPath == "" {
 		return nil, nil
 	}
 
 	var fn *yaml.RNode
 	var err error
 
-	// if image isn't specified, then Functions is empty
 	if r.Image != "" {
 		// create the function spec to set as an annotation
 		fn, err = yaml.Parse(`container: {}`)
@@ -143,8 +146,19 @@ func (r *RunFnRunner) getContainerFunctions(c *cobra.Command, args, dataItems []
 		if err != nil {
 			return nil, err
 		}
-	} else {
-		return nil, nil
+	} else if r.EnableExec && r.ExecPath != "" {
+		// create the function spec to set as an annotation
+		fn, err = yaml.Parse(`exec: {}`)
+		if err != nil {
+			return nil, err
+		}
+
+		err = fn.PipeE(
+			yaml.Lookup("exec"),
+			yaml.SetField("path", yaml.NewScalarRNode(r.ExecPath)))
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	// create the function config
@@ -208,10 +222,10 @@ data: {}
 	return []*yaml.RNode{rc}, nil
 }
 
-func toStorageMounts(mounts []string) []filters.StorageMount {
-	var sms []filters.StorageMount
+func toStorageMounts(mounts []string) []runtimeutil.StorageMount {
+	var sms []runtimeutil.StorageMount
 	for _, mount := range mounts {
-		sms = append(sms, filters.StringToStorageMount(mount))
+		sms = append(sms, runtimeutil.StringToStorageMount(mount))
 	}
 	return sms
 }
@@ -221,8 +235,12 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		return errors.Errorf("must specify --enable-star with --star-path")
 	}
 
+	if !r.EnableExec && r.ExecPath != "" {
+		return errors.Errorf("must specify --enable-exec with --exec-path")
+	}
+
 	if c.ArgsLenAtDash() >= 0 && r.Image == "" &&
-		!(r.EnableStar && r.StarPath != "") {
+		!(r.EnableStar && r.StarPath != "") && !(r.EnableExec && r.ExecPath != "") {
 		return errors.Errorf("must specify --image")
 	}
 
@@ -270,6 +288,7 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		Network:        r.Network,
 		NetworkName:    r.NetworkName,
 		EnableStarlark: r.EnableStar,
+		EnableExec:     r.EnableExec,
 		StorageMounts:  storageMounts,
 		ResultsDir:     r.ResultsDir,
 	}

docs/zh/README.md

@@ -19,6 +19,16 @@
 
 ## 发行说明
 
+* [kustomize/3.2.2](/../../releases/tag/kustomize%2Fv3.2.2) - 基于 kustomize Go API [3.3.0](../v3.3.0.md) 的 `kustomize` CLI。
+
+ * [API 3.3.0](../v3.3.0.md) - kustomize Go API 的首个 release，该 release 不包含  `kustomize` CLI，且之后 CLI 和 API 将独立发布。
+ 
+ * [kustomize/3.2.1](/../../releases/tag/kustomize%2Fv3.2.1) - `kustomize` CLI 基于 kustomize Go API release [3.2.0](../v3.2.0.md) 发布的补丁。
+
+ * [3.2.0](../v3.2.0.md)
+
+ * [3.1.1](../v3.1.0.md)
+
  * [3.1](../v3.1.0.md) - 2019年7月下旬，扩展 patches 和改进的资源匹配。
 
  * [3.0](../v3.0.0.md) - 2019年6月下旬，插件开发者发布。

docs/zh/fields.md

@@ -1,6 +1,18 @@
 # Kustomization 文件字段
 
-介绍 [kustomization](../glossary.md#kustomization) 文件中各字段的含义。
+[field-name-namespace]: ../plugins/builtins.md#field-name-namespace
+[field-name-images]: ../plugins/builtins.md#field-name-images
+[field-names-namePrefix-nameSuffix]: ../plugins/builtins.md#field-names-namePrefix-nameSuffix
+[field-name-patches]: ../plugins/builtins.md#field-name-patches
+[field-name-patchesStrategicMerge]: ../plugins/builtins.md#field-name-patchesStrategicMerge
+[field-name-patchesJson6902]: ../plugins/builtins.md#field-name-patchesJson6902
+[field-name-replicas]: ../plugins/builtins.md#field-name-replicas
+[field-name-secretGenerator]: ../plugins/builtins.md#field-name-secretGenerator
+[field-name-commonLabels]: ../plugins/builtins.md#field-name-commonLabels
+[field-name-commonAnnotations]: ../plugins/builtins.md#field-name-commonAnnotations
+[field-name-configMapGenerator]: ../plugins/builtins.md#field-name-configMapGenerator
+
+介绍 [kustomization.yaml](../glossary.md#kustomization) 配置文件中各字段的含义。
 
 ## Resources
 
@@ -8,36 +20,36 @@
 
 | 字段 | 类型 | 说明 |
 | --- | --- | --- |
-|[resources](#resources) | list | 包含 k8s API 对象的文件，或其他包含 kustomizations 文件的目录。 |
-|[CRDs](#crds)| list | CDR 文件，以允许在资源列表中指定自定义资源。 |
+|[resources](#resources) | list | 包含 k8s API 对象的文件，或其他包含 `kustomization.yaml` 文件的目录。 |
+|[CRDs](#crds)| list | CDR 文件，允许在资源列表中指定自定义资源。 |
 
 ## Generators
 
-生成可定制的对象。
+资源生成器。
 
 | 字段 | 类型 | 说明 |
 | --- | --- | --- |
-|[configMapGenerator](#configmapgenerator)| list  | 列表中的每个条目都将创建一个 ConfigMap （它是n个 ConfigMap 的生成器）。 |
-|[secretGenerator](#secretgenerator)| list  | 此列表中的每个条目都将创建一个 Secret 资源（它是n个 secrets 的生成器）。 |
+|[configMapGenerator](#configmapgenerator)| list  | 列表中的每个条目都将生成一个 ConfigMap （合计可以生成 n 个 ConfigMap）。 |
+|[secretGenerator](#secretgenerator)| list  | 列表中的每个条目都将生成一个 Secret（合计可以生成 n 个 Secrets）。 |
 |[generatorOptions](#generatoroptions)| string | generatorOptions 可以修改所有 ConfigMapGenerator 和 SecretGenerator 的行为。 |
 |[generators](#generators)| list | [插件](../plugins)配置文件。 |
 
 ## Transformers
 
-可用的转换。
+资源字段转换项。
 
 | 字段 | 类型 | 说明 |
 | --- | --- | --- |
 | [commonLabels](#commonlabels) | string | 为所有资源和 selectors 增加 Labels 。 |
 | [commonAnnotations](#commonannotations) | string | 为所有资源增加 Annotations 。 |
-| [images](#images) | list | 修改镜像的名称、tag 或 image digest ，而无需使用 patches 。 |
+| [images](#images) | list | 无需使用 patches，即可修改镜像的名称、tag 或 image digest。 |
 | [inventory](#inventory) | struct | 用于生成一个包含清单信息的对象。 |
 | [namespace](#namespace)   | string | 为所有 resources 添加 namespace 。 |
-| [namePrefix](#nameprefix) | string | 该字段的值将添加在所有资源的名称之前。 |
-| [nameSuffix](#namesuffix) | string | 该字段的值将添加在所有资源的名称后面。 |
+| [namePrefix](#nameprefix) | string | 为所有资源的名称添加前缀。 |
+| [nameSuffix](#namesuffix) | string | 为所有资源的名称添加后缀。 |
 | [replicas](#replicas) | list | 修改资源的副本数。 |
 | [patchesStrategicMerge](#patchesstrategicmerge) | list | 此列表中的每个条目都应可以解析为部分或完整的资源定义文件。 |
-| [patchesJson6902](#patchesjson6902) | list | 列表中的每个条目都应可以解析为 kubernetes 对象和将应用于该对象的 JSON patch 。 |
+| [patchesJson6902](#patchesjson6902) | list | 列表中的每个条目都应可以解析为 Kubernetes 对象和将应用于该对象的 JSON patch 。 |
 | [transformers](#transformers) | list | [插件](../plugins)配置文件。 |
 
 ## Meta
@@ -46,7 +58,7 @@
 
 | 字段 | 类型 | 说明 |
 | --- | --- | --- |
-| [vars](#vars) | string | 获取一个对象中的字段并插入到另外的对象中。 |
+| [vars](#vars) | string | 将一个对象中的字段值插入另一个对象中。 |
 | [apiVersion](#apiversion) | string | [k8s metadata] 字段。 |
 | [kind](#kind) | string | [k8s metadata] 字段。 |
 
@@ -67,59 +79,26 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 
 ### commonLabels
 
-为所有资源和 selectors 增加 Labels
-
-```
-commonLabels:
-  someName: someValue
-  owner: alice
-  app: bingo
-```
+详见 [field-name-commonLabels]。
 
 ### commonAnnotations
 
-为所有资源增加 Annotations ，和 labels 一样是 key:value 的键值对。
-
-```
-commonAnnotations:
-  oncallPager: 800-555-1212
-```
+详见 [field-name-commonAnnotations].
 
 ### configMapGenerator
 
-列表中的每个条目都将创建一个 ConfigMap （它是n个 ConfigMap 的生成器）。
-
-下面的示例创建了两个 ConfigMaps：
-
-- 一个具有给定文件的名称和内容
-- 另一个包含 key/value 键值对数据
-
-每个 configMapGenerator 项都可以使用 `behavior: [create|replace|merge]` 参数。
-
-允许 overlay 从父级修改或替换现有的 configMap。
-
-```
-configMapGenerator:
-- name: myJavaServerProps
-  files:
-  - application.properties
-  - more.properties
-- name: myJavaServerEnvVars
-  literals:	
-  - JAVA_HOME=/opt/java/jdk
-  - JAVA_TOOL_OPTIONS=-agentlib:hprof
-```
+详见 [field-name-configMapGenerator].
 
 ### crds
 
 此列表中的每个条目都应该是自定义资源定义（CRD）文件的相对路径。
 
-该字段的存在是为了让 kustomize 知道用户自定义的 CRD ，并对这些类型中的对象应用适当的转换。
+该字段的存在是为了让 kustomize 识别用户自定义的 CRD ，并对这些类型中的对象应用适当的转换。
 
 典型用例：CRD 引用 ConfigMap 对象
 
-在 kustomization 中，ConfigMap 对象名称可能会通过 namePrefix 、nameSuffix 或 hashing 来更改 CRD 对象中此 ConfigMap 对象的名称，
-引用时需要以相同的方式使用 namePrefix 、 nameSuffix 或 hashing 来进行更新。
+在 kustomization 中，ConfigMap 对象名称可能会通过 `namePrefix` 、`nameSuffix` 或 `hashing` 来更改 CRD 对象中该 ConfigMap 对象的名称，
+引用时需要以相同的方式使用 `namePrefix` 、 `nameSuffix` 或 `hashing` 来进行更新。
 
 Annotations 可以放入 openAPI 的定义中：
 
@@ -140,7 +119,7 @@ crds:
 
 ### generatorOptions
 
-generatorOptions 修改所有 [ConfigMapGenerator](#configmapgenerator) 和 [SecretGenerator](#secretgenerator) 的行为。
+generatorOptions 可以修改所有 [ConfigMapGenerator](#configmapgenerator) 和 [SecretGenerator](#secretgenerator) 的行为。
 
 ```
 generatorOptions:
@@ -166,41 +145,7 @@ generators:
 
 ### images
 
-修改镜像的名称、tag 或 image digest ，而无需使用 patches 。例如，对于这种 kubernetes Deployment 片段：
-
-```
-containers:
- - name: mypostgresdb
-   image: postgres:8
- - name: nginxapp
-   image: nginx:1.7.9
- - name: myapp
-   image: my-demo-app:latest
- - name: alpine-app
-   image: alpine:3.7
-```
-
-可以通过以下方式更改 `image` ：
- 
- - `postgres:8` to `my-registry/my-postgres:v1`,
- - nginx tag `1.7.9` to `1.8.0`,
- - image name `my-demo-app` to `my-app`,
- - alpine's tag `3.7` to a digest value
-
-可以在 *kustomization* 中添加以下内容：
-
-```
-images:
-- name: postgres
-  newName: my-registry/my-postgres
-  newTag: v1
-- name: nginx
-  newTag: 1.8.0
-- name: my-demo-app
-  newName: my-app
-- name: alpine
-  digest: sha256:24a0c4b4a4c0eb97a1aabb8e29f18e917d05abfe1b7a7c07857230879ce7d3d3
-```
+详见 [field-name-images]。
 
 ### inventory
 
@@ -217,120 +162,31 @@ kind: Kustomization
 
 ### namespace
 
-为所有 resources 添加 namespace 。
-
-```
-namespace: my-namespace
-```
+详见 [field-name-namespace]。
 
 ### namePrefix
 
-该字段的值将添加在所有资源的名称之前，例如 将资源名称 `wordpress` 变为 `alices-wordpress` 。
-
-```
-namePrefix: alices-
-```
+详见 [field-names-namePrefix-nameSuffix]。
 
 ### nameSuffix
 
-该字段的值将添加在所有资源的名称后面，例如 将资源名称 `wordpress` 变为 `wordpress-v2` 。
+详见 [field-names-namePrefix-nameSuffix]。
 
-如果资源类型为 ConfigMap 或 Secret ，则在哈希值之前附加后缀。
+### patches
 
-```
-nameSuffix: -v2
-```
+详见 [field-name-patches]。
 
 ### patchesStrategicMerge
 
-此列表中的每个条目都应可以解析为部分或完整的资源定义文件。
-
-这些（也可能是部分的）资源文件中的 name 必须与已经通过 `resources` 加载的 name 字段匹配，或者通过 `bases` 中的 name 字段匹配。这些条目将用于 _patch_（修改）已知资源。
-
-推荐使用小的 patches，例如：修改内存的 request/limit，更改 ConfigMap 中的 env 变量等小的 patches 易于维护和查看，并且易于在 overlays 中混合使用。
-
-```
-patchesStrategicMerge:
-- service_port_8888.yaml
-- deployment_increase_replicas.yaml
-- deployment_increase_memory.yaml
-```
+详见 [field-name-patchesStrategicMerge]。
 
 ### patchesJson6902
 
-patchesJson6902 列表中的每个条目都应可以解析为 kubernetes 对象和将应用于该对象的 JSON patch
-
-JSON patch 的文档地址：https://tools.ietf.org/html/rfc6902
-
-目标字段指向的 kubernetes 对象的 group、 version、 kind、 name 和 namespace 在同一 kustomization 内 path 字段内容是 JSON patch 文件的相对路径。
-
-patch 文件中的内容可以如下这种 JSON 格式：
-
-```
- [
-   {"op": "add", "path": "/some/new/path", "value": "value"},
-   {"op": "replace", "path": "/some/existing/path", "value": "new value"}
- ]
- ```
-
-也可以使用 YAML 格式表示：
-
-```
-- op: add
-  path: /some/new/path
-  value: value
-- op: replace
-  path: /some/existing/path
-  value: new value
-```
-
-```
-patchesJson6902:
-- target:
-    version: v1
-    kind: Deployment
-    name: my-deployment
-  path: add_init_container.yaml
-- target:
-    version: v1
-    kind: Service
-    name: my-service
-  path: add_service_annotation.yaml
-```
+详见 [field-name-patchesJson6902]。
 
 ### replicas
 
-修改资源的副本数。
-
-例如：对于如下 kubernetes Deployment 片段：
-
-```
-kind: Deployment
-metadata:
-  name: deployment-name
-spec:
-  replicas: 3
-```
-
-在 kustomization 中添加以下内容，将副本数更改为5：
-
-```
-replicas:
-- name: deployment-name
-  count: 5
-```
-
-该字段内容为列表，所以可以同时修改许多资源。
-
-#### Limitation
-
-由于这个声明无法设置 `kind:` 或 `group:` 它将匹配任何可以匹配名称的 `group` 和 `kind` ，并且它是以下之一：
-- `Deployment`
-- `ReplicationController`
-- `ReplicaSet`
-- `StatefulSet`
-
-对于更复杂的用例，请使用 patch 。
+详见 [field-name-replicas]。
 
 ### resources
 
@@ -348,8 +204,7 @@ resource:
 
 将以深度优先的顺序读取和处理资源。
 
-
-文件应包含 YAML 格式的 k8s 资源。一个资源描述文件可以含有多个由（“---”）分隔的资源。
+文件应包含 YAML 格式的 k8s 资源。一个资源描述文件可以含有多个由（`---`）分隔的资源。
 应该包含 `resources` 字段的 kustomization 文件的指定文件目录的相对路径。
 
 [hashicorp URL]: https://github.com/hashicorp/go-getter#url-format
@@ -358,31 +213,11 @@ resource:
 
 ### secretGenerator
 
-此列表中的每个条目都将创建一个 Secret 资源（它是n个 secrets 的生成器）。
-
-```
-secretGenerator:
-- name: app-tls
-  files:
-  - secret/tls.cert
-  - secret/tls.key
-  type: "kubernetes.io/tls"
-- name: app-tls-namespaced
-  # you can define a namespace to generate secret in, defaults to: "default"
-  namespace: apps
-  files:
-  - tls.crt=catsecret/tls.cert
-  - tls.key=secret/tls.key
-  type: "kubernetes.io/tls"
-- name: env_file_secret
-  envs:
-  - env.txt
-  type: Opaque
-```
+详见 [field-name-secretGenerator]。
 
 ### vars
 
-Vars 用于从一个 resource 字段中获取文本，并将该文本插入指定位置 - 反射功能。
+Vars 用于从一个 resource 字段中获取值，并将该值插入指定位置 - 反射功能。
 
 例如，假设需要在容器的 command 中指定了 Service 对象的名称，并在容器的 env 中指定了 Secret 对象的名称来确保以下内容可以正常工作：
 

kyaml/fn/framework/doc.go

@@ -0,0 +1,124 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package framework contains a framework for writing functions in go.  The function spec
+// is defined at: https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md
+//
+// Examples
+//
+// Example function implementation using framework.Command with flag input
+//
+//      var value string
+//      resourceList := &framework.ResourceList{}
+//      cmd := framework.Command(resourceList, func() error {
+//        for i := range resourceList.Items {
+//          // modify the items...
+//        }
+//        return nil
+//      })
+//      cmd.Flags().StringVar(&value, "value", "", "annotation value")
+//      if err := cmd.Execute(); err != nil { return err }
+//
+// Example function implementation using framework.ResourceList with a struct input
+//
+//    type Spec struct {
+//      Value string `yaml:"value,omitempty"`
+//    }
+//    type Example struct {
+//      Spec Spec `yaml:"spec,omitempty"`
+//    }
+//    functionConfig := &Example{}
+//
+//    rl := framework.ResourceList{FunctionConfig: functionConfig}
+//    if err := rl.Read(); err != nil { return err	}
+//
+//    for i := range rl.Items {
+//      // modify the items...
+//    }
+//    if err := rl.Write(); err != nil { return err }
+//
+// Architecture
+//
+// Functions modify a slice of resources (ResourceList.Items) which are read as input and written
+// as output.  The function itself may be configured through a functionConfig
+// (ResourceList.FunctionConfig).
+//
+// Example Function Input:
+//
+//    kind: ResourceList
+//    items:
+//    - kind: Deployment
+//      ...
+//    - kind: Service
+//      ....
+//    functionConfig:
+//      kind: Example
+//      spec:
+//        value: foo
+//
+// The functionConfig may be specified declaratively and run with
+//
+//  config run DIR/
+//
+// Declarative function declaration:
+//
+//    kind: Example
+//    metadata:
+//      annotations:
+//        # run the function by creating this container and providing this
+//        # Example as the functionConfig
+//        config.kubernetes.io/function: |
+//          image: image/containing/function:impl
+//    spec:
+//      value: foo
+//
+// The framework takes care of serializing and deserializing the ResourceList.
+//
+// Generated ResourceList.functionConfig -- ConfigMaps
+//
+// Functions may also be specified imperatively and run using:
+//
+//   config run DIR/ --image image/containing/function:impl -- value=foo
+//
+// When run imperatively, a ConfigMap is generated for the functionConfig, and the command
+// arguments are set as ConfigMap data entries.
+//
+//    kind: ConfigMap
+//    data:
+//      value: foo
+//
+// To write a function that can be run imperatively on the commandline, have it take a
+// ConfigMap as its functionConfig.
+//
+// Mutator and Generator Functions
+//
+// Functions may add, delete or modify resources by modifying the ResourceList.Items slice.
+//
+// Validator Functions
+//
+// A function may emit validation results by setting the ResourceList.Result
+//
+// Configuring Functions
+//
+// Functions may be configured through a functionConfig (i.e. a client side custom resource),
+// or through flags (which the framework parses from a ConfigMap provided as input).
+//
+// When using framework.Command, any flags registered on the cobra.Command will be parsed
+// from the functionConfig input if they are defined as functionConfig.data entries.
+//
+// When using framework.ResourceList, any flags set on the ResourceList.Flags will be
+// parsed from the functionConfig input if they are defined as functionConfig.data entries.
+//
+// Functions may also access environment variables set by the caller.
+//
+// Building a container image for the function
+//
+// The go program must be built into a container to be run as a function.  The framework
+// can be used to generate a Dockerfile to build the function container.
+//
+//   # create the ./Dockerfile for the container
+//   $ go run ./main.go gen ./
+//
+//   # build the function's container
+//   $ docker build . -t gcr.io/my-project/my-image:my-version
+package framework

kyaml/fn/framework/example/Dockerfile

@@ -0,0 +1,12 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.13-stretch
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]

kyaml/fn/framework/example/doc.go

@@ -0,0 +1,9 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains an example using the the framework.
+//
+// To generate the Dockerfile for the function image run:
+//
+//   $ go run ./main.go .
+package main

kyaml/fn/framework/example/main.go

@@ -0,0 +1,31 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"os"
+
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func main() {
+	var value string
+	resourceList := framework.ResourceList{}
+	cmd := framework.Command(&resourceList, func() error {
+		for i := range resourceList.Items {
+			// set the annotation on each resource item
+			err := resourceList.Items[i].PipeE(yaml.SetAnnotation("value", value))
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	cmd.Flags().StringVar(&value, "value", "", "annotation value")
+
+	if err := cmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

kyaml/fn/framework/example_test.go

@@ -0,0 +1,539 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package framework_test
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/spf13/pflag"
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+const service = "Service"
+
+// ExampleResourceList_modify implements a function that sets an annotation on each resource.
+// The annotation value is configured via a flag value parsed from ResourceList.functionConfig.data
+func ExampleResourceList_modify() {
+	// for testing purposes only -- normally read from stdin when Executing
+	input := bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: foo
+# functionConfig is parsed into flags by framework.Command
+functionConfig:
+  apiVersion: v1
+  kind: ConfigMap
+  data:
+    value: baz
+`)
+
+	// configure the annotation value using a flag parsed from
+	// ResourceList.functionConfig.data.value
+	fs := pflag.NewFlagSet("tests", pflag.ContinueOnError)
+	value := fs.String("value", "", "annotation value")
+	rl := framework.ResourceList{
+		Flags:  fs,
+		Reader: input, // for testing only
+	}
+	if err := rl.Read(); err != nil {
+		panic(err)
+	}
+	for i := range rl.Items {
+		// set the annotation on each resource item
+		if err := rl.Items[i].PipeE(yaml.SetAnnotation("value", *value)); err != nil {
+			panic(err)
+		}
+	}
+	if err := rl.Write(); err != nil {
+		panic(err)
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	//     annotations:
+	//       value: 'baz'
+	// - apiVersion: v1
+	//   kind: Service
+	//   metadata:
+	//     name: foo
+	//     annotations:
+	//       value: 'baz'
+	// functionConfig:
+	//   apiVersion: v1
+	//   kind: ConfigMap
+	//   data:
+	//     value: baz
+}
+
+// ExampleCommand_modify implements a function that sets an annotation on each resource.
+// The annotation value is configured via a flag value parsed from
+// ResourceList.functionConfig.data
+func ExampleCommand_modify() {
+	// configure the annotation value using a flag parsed from
+	// ResourceList.functionConfig.data.value
+	resourceList := framework.ResourceList{}
+	var value string
+	cmd := framework.Command(&resourceList, func() error {
+		for i := range resourceList.Items {
+			// set the annotation on each resource item
+			err := resourceList.Items[i].PipeE(yaml.SetAnnotation("value", value))
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	cmd.Flags().StringVar(&value, "value", "", "annotation value")
+
+	// for testing purposes only -- normally read from stdin when Executing
+	cmd.SetIn(bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: foo
+# functionConfig is parsed into flags by framework.Command
+functionConfig:
+  apiVersion: v1
+  kind: ConfigMap
+  data:
+    value: baz
+`))
+	// run the command
+	if err := cmd.Execute(); err != nil {
+		panic(err)
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	//     annotations:
+	//       value: 'baz'
+	// - apiVersion: v1
+	//   kind: Service
+	//   metadata:
+	//     name: foo
+	//     annotations:
+	//       value: 'baz'
+	// functionConfig:
+	//   apiVersion: v1
+	//   kind: ConfigMap
+	//   data:
+	//     value: baz
+}
+
+// ExampleCommand_generateReplace generates a resource from a functionConfig.
+// If the resource already exist s, it replaces the resource with a new copy.
+func ExampleCommand_generateReplace() {
+	// function API definition which will be parsed from the ResourceList.functionConfig
+	// read from stdin
+	type Spec struct {
+		Name string `yaml:"name,omitempty"`
+	}
+	type ExampleServiceGenerator struct {
+		Spec Spec `yaml:"spec,omitempty"`
+	}
+	functionConfig := &ExampleServiceGenerator{}
+
+	// function implementation -- generate a Service resource
+	resourceList := &framework.ResourceList{FunctionConfig: functionConfig}
+	cmd := framework.Command(resourceList, func() error {
+		var newNodes []*yaml.RNode
+		for i := range resourceList.Items {
+			meta, err := resourceList.Items[i].GetMeta()
+			if err != nil {
+				return err
+			}
+
+			// something we already generated, remove it from the list so we regenerate it
+			if meta.Name == functionConfig.Spec.Name &&
+				meta.Kind == service &&
+				meta.APIVersion == "v1" {
+				continue
+			}
+			newNodes = append(newNodes, resourceList.Items[i])
+		}
+
+		// generate the resource
+		n, err := yaml.Parse(fmt.Sprintf(`apiVersion: v1
+kind: Service
+metadata:
+  name: %s
+`, functionConfig.Spec.Name))
+		if err != nil {
+			return err
+		}
+		newNodes = append(newNodes, n)
+		resourceList.Items = newNodes
+		return nil
+	})
+
+	// for testing purposes only -- normally read from stdin when Executing
+	cmd.SetIn(bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+# functionConfig is parsed into flags by framework.Command
+functionConfig:
+  apiVersion: example.com/v1alpha1
+  kind: ExampleServiceGenerator
+  spec:
+    name: bar
+`))
+
+	// run the command
+	if err := cmd.Execute(); err != nil {
+		panic(err)
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	// - apiVersion: v1
+	//   kind: Service
+	//   metadata:
+	//     name: bar
+	// functionConfig:
+	//   apiVersion: example.com/v1alpha1
+	//   kind: ExampleServiceGenerator
+	//   spec:
+	//     name: bar
+}
+
+// ExampleResourceList_generateReplace generates a resource from a functionConfig.
+// If the resource already exist s, it replaces the resource with a new copy.
+func ExampleResourceList_generateReplace() {
+	input := bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+# functionConfig is parsed into flags by framework.Command
+functionConfig:
+  apiVersion: example.com/v1alpha1
+  kind: ExampleServiceGenerator
+  spec:
+    name: bar
+`)
+
+	// function API definition which will be parsed from the ResourceList.functionConfig
+	// read from stdin
+	type Spec struct {
+		Name string `yaml:"name,omitempty"`
+	}
+	type ExampleServiceGenerator struct {
+		Spec Spec `yaml:"spec,omitempty"`
+	}
+	functionConfig := &ExampleServiceGenerator{}
+
+	rl := framework.ResourceList{
+		FunctionConfig: functionConfig,
+		Reader:         input, // for testing only
+	}
+	if err := rl.Read(); err != nil {
+		panic(err)
+	}
+
+	// remove the last generated resource
+	var newNodes []*yaml.RNode
+	for i := range rl.Items {
+		meta, err := rl.Items[i].GetMeta()
+		if err != nil {
+			panic(err)
+		}
+		// something we already generated, remove it from the list so we regenerate it
+		if meta.Name == functionConfig.Spec.Name &&
+			meta.Kind == service &&
+			meta.APIVersion == "v1" {
+			continue
+		}
+		newNodes = append(newNodes, rl.Items[i])
+	}
+	rl.Items = newNodes
+
+	// generate the resource again
+	n, err := yaml.Parse(fmt.Sprintf(`apiVersion: v1
+kind: Service
+metadata:
+  name: %s
+`, functionConfig.Spec.Name))
+	if err != nil {
+		panic(err)
+	}
+	rl.Items = append(rl.Items, n)
+
+	if err := rl.Write(); err != nil {
+		panic(err)
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	// - apiVersion: v1
+	//   kind: Service
+	//   metadata:
+	//     name: bar
+	// functionConfig:
+	//   apiVersion: example.com/v1alpha1
+	//   kind: ExampleServiceGenerator
+	//   spec:
+	//     name: bar
+}
+
+// ExampleCommand_generateUpdate generates a resource, updating the previously generated
+// copy rather than replacing it.
+//
+// Note: This will keep manual edits to the previously generated copy.
+func ExampleCommand_generateUpdate() {
+	// function API definition which will be parsed from the ResourceList.functionConfig
+	// read from stdin
+	type Spec struct {
+		Name        string            `yaml:"name,omitempty"`
+		Annotations map[string]string `yaml:"annotations,omitempty"`
+	}
+	type ExampleServiceGenerator struct {
+		Spec Spec `yaml:"spec,omitempty"`
+	}
+	functionConfig := &ExampleServiceGenerator{}
+
+	// function implementation -- generate or update a Service resource
+	resourceList := &framework.ResourceList{FunctionConfig: functionConfig}
+	cmd := framework.Command(resourceList, func() error {
+		var found bool
+		for i := range resourceList.Items {
+			meta, err := resourceList.Items[i].GetMeta()
+			if err != nil {
+				return err
+			}
+
+			// something we already generated, reconcile it to make sure it matches what
+			// is specified by the functionConfig
+			if meta.Name == functionConfig.Spec.Name &&
+				meta.Kind == service &&
+				meta.APIVersion == "v1" {
+				// set some values
+				for k, v := range functionConfig.Spec.Annotations {
+					err := resourceList.Items[i].PipeE(yaml.SetAnnotation(k, v))
+					if err != nil {
+						return err
+					}
+				}
+				found = true
+				break
+			}
+		}
+		if found {
+			return nil
+		}
+
+		// generate the resource if not found
+		n, err := yaml.Parse(fmt.Sprintf(`apiVersion: v1
+kind: Service
+metadata:
+  name: %s
+`, functionConfig.Spec.Name))
+		if err != nil {
+			return err
+		}
+		for k, v := range functionConfig.Spec.Annotations {
+			err := n.PipeE(yaml.SetAnnotation(k, v))
+			if err != nil {
+				return err
+			}
+		}
+		resourceList.Items = append(resourceList.Items, n)
+
+		return nil
+	})
+
+	// for testing purposes only -- normally read from stdin when Executing
+	cmd.SetIn(bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: bar
+# functionConfig is parsed into flags by framework.Command
+functionConfig:
+  apiVersion: example.com/v1alpha1
+  kind: ExampleServiceGenerator
+  spec:
+    name: bar
+    annotations:
+      a: b
+`))
+
+	// run the command
+	if err := cmd.Execute(); err != nil {
+		panic(err)
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	// - apiVersion: v1
+	//   kind: Service
+	//   metadata:
+	//     name: bar
+	//     annotations:
+	//       a: 'b'
+	// functionConfig:
+	//   apiVersion: example.com/v1alpha1
+	//   kind: ExampleServiceGenerator
+	//   spec:
+	//     name: bar
+	//     annotations:
+	//       a: b
+}
+
+// ExampleCommand_validate validates that all Deployment resources have the replicas field set.
+// If any Deployments do not contain spec.replicas, then the function will return results
+// which will be set on ResourceList.results
+func ExampleCommand_validate() {
+	resourceList := &framework.ResourceList{}
+	cmd := framework.Command(resourceList, func() error {
+		// validation results
+		var validationResults []framework.Item
+
+		// validate that each Deployment resource has spec.replicas set
+		for i := range resourceList.Items {
+			// only check Deployment resources
+			meta, err := resourceList.Items[i].GetMeta()
+			if err != nil {
+				return err
+			}
+			if meta.Kind != "Deployment" {
+				continue
+			}
+
+			// lookup replicas field
+			r, err := resourceList.Items[i].Pipe(yaml.Lookup("spec", "replicas"))
+			if err != nil {
+				return err
+			}
+
+			// check replicas not specified
+			if r != nil {
+				continue
+			}
+			validationResults = append(validationResults, framework.Item{
+				Severity:    framework.Error,
+				Message:     "missing replicas",
+				ResourceRef: meta,
+				Field: framework.Field{
+					Path:           "spec.field",
+					SuggestedValue: "1",
+				},
+			})
+		}
+
+		if len(validationResults) > 0 {
+			resourceList.Result = &framework.Result{
+				Name:  "replicas-validator",
+				Items: validationResults,
+			}
+		}
+
+		return resourceList.Result
+	})
+
+	// for testing purposes only -- normally read from stdin when Executing
+	cmd.SetIn(bytes.NewBufferString(`
+apiVersion: config.kubernetes.io/v1alpha1
+kind: ResourceList
+# items are provided as nodes
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: foo
+`))
+
+	// run the command
+	if err := cmd.Execute(); err != nil {
+		// normally exit 1 here
+	}
+
+	// Output:
+	// apiVersion: config.kubernetes.io/v1alpha1
+	// kind: ResourceList
+	// items:
+	// - apiVersion: apps/v1
+	//   kind: Deployment
+	//   metadata:
+	//     name: foo
+	// results:
+	//   name: replicas-validator
+	//   items:
+	//   - message: missing replicas
+	//     severity: error
+	//     resourceRef:
+	//       apiVersion: apps/v1
+	//       kind: Deployment
+	//       metadata:
+	//         name: foo
+	//     field:
+	//       path: spec.field
+	//       suggestedValue: "1"
+}

kyaml/fn/framework/framework.go

@@ -0,0 +1,226 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package framework
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// ResourceList reads the function input and writes the function output.
+//
+// Adheres to the spec: https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md
+type ResourceList struct {
+	// FunctionConfig is the ResourceList.functionConfig input value.  If FunctionConfig
+	// is set to a value such as a struct or map[string]interface{} before ResourceList.Read()
+	// is called, then the functionConfig will be parsed into that value.
+	// If it is nil, the functionConfig will be set to a map[string]interface{}
+	// before it is parsed.
+	//
+	// e.g. given the function input:
+	//
+	//    kind: ResourceList
+	//    functionConfig:
+	//      kind: Example
+	//      spec:
+	//        foo: var
+	//
+	// FunctionConfig will contain the Example unmarshalled into its value.
+	FunctionConfig interface{}
+
+	// Items is the ResourceList.items input and output value.  Items will be set by
+	// ResourceList.Read() and written by ResourceList.Write().
+	//
+	// e.g. given the function input:
+	//
+	//    kind: ResourceList
+	//    items:
+	//    - kind: Deployment
+	//      ...
+	//    - kind: Service
+	//      ...
+	//
+	// Items will be a slice containing the Deployment and Service resources
+	Items []*yaml.RNode
+
+	// Result is ResourceList.result output value.  Result will be written by
+	// ResourceList.Write()
+	Result *Result
+
+	// Flags are an optional set of flags to parse the ResourceList.functionConfig.data.
+	// If non-nil, ResourceList.Read() will set the flag value for each flag name matching
+	// a ResourceList.functionConfig.data map entry.
+	//
+	// e.g. given the function input:
+	//
+	//    kind: ResourceList
+	//    functionConfig:
+	//      data:
+	//        foo: bar
+	//        a: b
+	//
+	// The flags --a=b and --foo=bar will be set in Flags.
+	Flags *pflag.FlagSet
+
+	// Reader is used to read the function input (ResourceList).
+	// Defaults to os.Stdin.
+	Reader io.Reader
+
+	// Writer is used to write the function output (ResourceList)
+	// Defaults to os.Stdout.
+	Writer io.Writer
+
+	// rw reads function input and writes function output
+	rw *kio.ByteReadWriter
+}
+
+// Read reads the ResourceList
+func (r *ResourceList) Read() error {
+	if r.Reader == nil {
+		r.Reader = os.Stdin
+	}
+	if r.Writer == nil {
+		r.Writer = os.Stdout
+	}
+	r.rw = &kio.ByteReadWriter{
+		Reader:                r.Reader,
+		Writer:                r.Writer,
+		KeepReaderAnnotations: true,
+	}
+
+	var err error
+	r.Items, err = r.rw.Read()
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	// parse the functionConfig
+	return func() error {
+		if r.rw.FunctionConfig == nil {
+			// no function config exists
+			return nil
+		}
+		if r.FunctionConfig == nil {
+			// set directly from r.rw
+			r.FunctionConfig = r.rw.FunctionConfig
+		} else {
+			// unmarshal the functionConfig into the provided value
+			err := yaml.Unmarshal([]byte(r.rw.FunctionConfig.MustString()), r.FunctionConfig)
+			if err != nil {
+				return errors.Wrap(err)
+			}
+		}
+
+		// set the functionConfig values as flags so they are easy to access
+		if r.Flags == nil || !r.Flags.HasFlags() {
+			return nil
+		}
+		// flags are always set from the "data" field
+		data, err := r.rw.FunctionConfig.Pipe(yaml.Lookup("data"))
+		if err != nil || data == nil {
+			return err
+		}
+		return data.VisitFields(func(node *yaml.MapNode) error {
+			f := r.Flags.Lookup(node.Key.YNode().Value)
+			if f == nil {
+				return nil
+			}
+			return f.Value.Set(node.Value.YNode().Value)
+		})
+	}()
+}
+
+// Write writes the ResourceList
+func (r *ResourceList) Write() error {
+	// set the ResourceList.results for validating functions
+	if r.Result != nil {
+		if len(r.Result.Items) > 0 {
+			b, err := yaml.Marshal(r.Result)
+			if err != nil {
+				return errors.Wrap(err)
+			}
+			y, err := yaml.Parse(string(b))
+			if err != nil {
+				return errors.Wrap(err)
+			}
+			r.rw.Results = y
+		}
+	}
+
+	// write the results
+	return r.rw.Write(r.Items)
+}
+
+// Command returns a cobra.Command to run a function.
+//
+// The cobra.Command will use the provided ResourceList to Read() the input,
+// run the provided function, and then Write() the output.
+//
+// The returned cobra.Command will have a "gen" subcommand which can be used to generate
+// a Dockerfile to build the function into a container image
+//
+//		go run main.go gen DIR/
+func Command(resourceList *ResourceList, function Function) cobra.Command {
+	cmd := cobra.Command{}
+	AddGenerateDockerfile(&cmd)
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		err := execute(resourceList, function, cmd)
+		if err != nil {
+			fmt.Fprintf(cmd.ErrOrStderr(), "%v", err)
+		}
+		return err
+	}
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+	return cmd
+}
+
+// AddGenerateDockerfile adds a "gen" subcommand to create a Dockerfile for building
+// the function as a container.
+func AddGenerateDockerfile(cmd *cobra.Command) {
+	gen := &cobra.Command{
+		Use:  "gen",
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return ioutil.WriteFile(filepath.Join(args[0], "Dockerfile"), []byte(`FROM golang:1.13-stretch
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]
+`), 0600)
+		},
+	}
+	cmd.AddCommand(gen)
+}
+
+func execute(rl *ResourceList, function Function, cmd *cobra.Command) error {
+	rl.Reader = cmd.InOrStdin()
+	rl.Writer = cmd.OutOrStdout()
+	rl.Flags = cmd.Flags()
+
+	if err := rl.Read(); err != nil {
+		return err
+	}
+
+	retErr := function()
+
+	if err := rl.Write(); err != nil {
+		return err
+	}
+
+	return retErr
+}

kyaml/fn/framework/framework_test.go

@@ -0,0 +1,52 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package framework_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+)
+
+func TestCommand_dockerfile(t *testing.T) {
+	d, err := ioutil.TempDir("", "kustomize")
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	defer os.RemoveAll(d)
+
+	// create a function
+
+	resourceList := &framework.ResourceList{}
+	cmd := framework.Command(resourceList, func() error { return nil })
+
+	// generate the Dockerfile
+	cmd.SetArgs([]string{"gen", d})
+	if !assert.NoError(t, cmd.Execute()) {
+		t.FailNow()
+	}
+
+	b, err := ioutil.ReadFile(filepath.Join(d, "Dockerfile"))
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	expected := `FROM golang:1.13-stretch
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]
+`
+	if !assert.Equal(t, expected, string(b)) {
+		t.FailNow()
+	}
+}

kyaml/fn/framework/types.go

@@ -0,0 +1,92 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package framework
+
+import (
+	"strings"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Function defines a function which mutates or validates a collection of configuration
+// To create a structured validation result, return a Result as the error.
+type Function func() error
+
+// Result defines a function result which will be set on the emitted ResourceList
+type Result struct {
+	// Name is the name of the function creating the result
+	Name string `yaml:"name,omitempty"`
+
+	// Items are the individual results
+	Items []Item `yaml:"items,omitempty"`
+}
+
+// Severity indicates the severity of the result
+type Severity string
+
+const (
+	// Error indicates the result is an error.  Will cause the function to exit non-0.
+	Error Severity = "error"
+	// Warning indicates the result is a warning
+	Warning Severity = "warning"
+	// Info indicates the result is an informative message
+	Info Severity = "info"
+)
+
+// Item defines a validation result
+type Item struct {
+	// Message is a human readable message
+	Message string `yaml:"message,omitempty"`
+
+	// Severity is the severity of the
+	Severity Severity `yaml:"severity,omitempty"`
+
+	// ResourceRef is a reference to a resource
+	ResourceRef yaml.ResourceMeta `yaml:"resourceRef,omitempty"`
+
+	Field Field `yaml:"field,omitempty"`
+
+	File File `yaml:"file,omitempty"`
+}
+
+// File references a file containing a resource
+type File struct {
+	// Path is relative path to the file containing the resource
+	Path string `yaml:"path,omitempty"`
+
+	// Index is the index into the file containing the resource
+	// (i.e. if there are multiple resources in a single file)
+	Index int `yaml:"index,omitempty"`
+}
+
+// Field references a field in a resource
+type Field struct {
+	// Path is the field path
+	Path string `yaml:"path,omitempty"`
+
+	// CurrentValue is the current field value
+	CurrentValue string `yaml:"currentValue,omitempty"`
+
+	// SuggestedValue is the suggested field value
+	SuggestedValue string `yaml:"suggestedValue,omitempty"`
+}
+
+// Error implement error
+func (e Result) Error() string {
+	var msgs []string
+	for _, i := range e.Items {
+		msgs = append(msgs, i.Message)
+	}
+	return strings.Join(msgs, "\n\n")
+}
+
+// ExitCode provides the exit code based on the result
+func (e Result) ExitCode() int {
+	for _, i := range e.Items {
+		if i.Severity == Error {
+			return 1
+		}
+	}
+	return 0
+}

kyaml/fn/runtime/container/container.go

@@ -0,0 +1,202 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package container
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	runtimeexec "sigs.k8s.io/kustomize/kyaml/fn/runtime/exec"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter filters Resources using a container image.
+// The container must start a process that reads the list of
+// input Resources from stdin, reads the Configuration from the env
+// API_CONFIG, and writes the filtered Resources to stdout.
+// If there is a error or validation failure, the process must exit
+// non-zero.
+// The full set of environment variables from the parent process
+// are passed to the container.
+//
+// Function Scoping:
+// Filter applies the function only to Resources to which it is scoped.
+//
+// Resources are scoped to a function if any of the following are true:
+// - the Resource were read from the same directory as the function config
+// - the Resource were read from a subdirectory of the function config directory
+// - the function config is in a directory named "functions" and
+//   they were read from a subdirectory of "functions" parent
+// - the function config doesn't have a path annotation (considered globally scoped)
+// - the Filter has GlobalScope == true
+//
+// In Scope Examples:
+//
+// Example 1: deployment.yaml and service.yaml in function.yaml scope
+//            same directory as the function config directory
+//     .
+//     ├── function.yaml
+//     ├── deployment.yaml
+//     └── service.yaml
+//
+// Example 2: apps/deployment.yaml and apps/service.yaml in function.yaml scope
+//            subdirectory of the function config directory
+//     .
+//     ├── function.yaml
+//     └── apps
+//         ├── deployment.yaml
+//         └── service.yaml
+//
+// Example 3: apps/deployment.yaml and apps/service.yaml in functions/function.yaml scope
+//            function config is in a directory named "functions"
+//     .
+//     ├── functions
+//     │   └── function.yaml
+//     └── apps
+//         ├── deployment.yaml
+//         └── service.yaml
+//
+// Out of Scope Examples:
+//
+// Example 1: apps/deployment.yaml and apps/service.yaml NOT in stuff/function.yaml scope
+//     .
+//     ├── stuff
+//     │   └── function.yaml
+//     └── apps
+//         ├── deployment.yaml
+//         └── service.yaml
+//
+// Example 2: apps/deployment.yaml and apps/service.yaml NOT in stuff/functions/function.yaml scope
+//     .
+//     ├── stuff
+//     │   └── functions
+//     │       └── function.yaml
+//     └── apps
+//         ├── deployment.yaml
+//         └── service.yaml
+//
+// Default Paths:
+// Resources emitted by functions will have default path applied as annotations
+// if none is present.
+// The default path will be the function-dir/ (or parent directory in the case of "functions")
+// + function-file-name/ + namespace/ + kind_name.yaml
+//
+// Example 1: Given a function in fn.yaml that produces a Deployment name foo and a Service named bar
+//     dir
+//     └── fn.yaml
+//
+// Would default newly generated Resources to:
+//
+//     dir
+//     ├── fn.yaml
+//     └── fn
+//         ├── deployment_foo.yaml
+//         └── service_bar.yaml
+//
+// Example 2: Given a function in functions/fn.yaml that produces a Deployment name foo and a Service named bar
+//     dir
+//     └── fn.yaml
+//
+// Would default newly generated Resources to:
+//
+//     dir
+//     ├── functions
+//     │   └── fn.yaml
+//     └── fn
+//         ├── deployment_foo.yaml
+//         └── service_bar.yaml
+//
+// Example 3: Given a function in fn.yaml that produces a Deployment name foo, namespace baz and a Service named bar namespace baz
+//     dir
+//     └── fn.yaml
+//
+// Would default newly generated Resources to:
+//
+//     dir
+//     ├── fn.yaml
+//     └── fn
+//         └── baz
+//             ├── deployment_foo.yaml
+//             └── service_bar.yaml
+type Filter struct {
+
+	// Image is the container image to use to create a container.
+	Image string `yaml:"image,omitempty"`
+
+	// Network is the container network to use.
+	Network string `yaml:"network,omitempty"`
+
+	// StorageMounts is a list of storage options that the container will have mounted.
+	StorageMounts []runtimeutil.StorageMount `yaml:"mounts,omitempty"`
+
+	Exec runtimeexec.Filter
+}
+
+func (c Filter) String() string {
+	if c.Exec.DeferFailure {
+		return fmt.Sprintf("%s deferFailure: %v", c.Image, c.Exec.DeferFailure)
+	}
+	return c.Image
+}
+func (c Filter) GetExit() error {
+	return c.Exec.GetExit()
+}
+
+func (c *Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	c.setupExec()
+	return c.Exec.Filter(nodes)
+}
+
+func (c *Filter) setupExec() {
+	// don't init 2x
+	if c.Exec.Path != "" {
+		return
+	}
+
+	path, args := c.getCommand()
+	c.Exec.Path = path
+	c.Exec.Args = args
+}
+
+// getArgs returns the command + args to run to spawn the container
+func (c *Filter) getCommand() (string, []string) {
+	// run the container using docker.  this is simpler than using the docker
+	// libraries, and ensures things like auth work the same as if the container
+	// was run from the cli.
+
+	network := "none"
+	if c.Network != "" {
+		network = c.Network
+	}
+
+	args := []string{"run",
+		"--rm",                                              // delete the container afterward
+		"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR", // attach stdin, stdout, stderr
+		"--network", network,
+
+		// added security options
+		"--user", "nobody", // run as nobody
+		"--security-opt=no-new-privileges", // don't allow the user to escalate privileges
+		// note: don't make fs readonly because things like heredoc rely on writing tmp files
+	}
+
+	// TODO(joncwong): Allow StorageMount fields to have default values.
+	for _, storageMount := range c.StorageMounts {
+		args = append(args, "--mount", storageMount.String())
+	}
+
+	os.Setenv("LOG_TO_STDERR", "true")
+	os.Setenv("STRUCTURED_RESULTS", "true")
+
+	// export the local environment vars to the container
+	for _, pair := range os.Environ() {
+		args = append(args, "-e", strings.Split(pair, "=")[0])
+	}
+	a := append(args, c.Image)
+
+	return "docker", a
+}

kyaml/fn/runtime/container/container_test.go

@@ -0,0 +1,203 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package container
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestFilter_setupExec(t *testing.T) {
+	var tests = []struct {
+		name           string
+		functionConfig string
+		expectedArgs   []string
+		instance       Filter
+	}{
+		{
+			name: "command",
+			functionConfig: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+			expectedArgs: []string{
+				"run",
+				"--rm",
+				"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR",
+				"--network", "none",
+				"--user", "nobody",
+				"--security-opt=no-new-privileges",
+			},
+			instance: Filter{Image: "example.com:version"},
+		},
+
+		{
+			name: "network",
+			functionConfig: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+			expectedArgs: []string{
+				"run",
+				"--rm",
+				"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR",
+				"--network", "test-1",
+				"--user", "nobody",
+				"--security-opt=no-new-privileges",
+			},
+			instance: Filter{Image: "example.com:version", Network: "test-1"},
+		},
+
+		{
+			name: "storage_mounts",
+			functionConfig: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`,
+			expectedArgs: []string{
+				"run",
+				"--rm",
+				"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR",
+				"--network", "none",
+				"--user", "nobody",
+				"--security-opt=no-new-privileges",
+				"--mount", fmt.Sprintf("type=%s,src=%s,dst=%s:ro", "bind", "/mount/path", "/local/"),
+				"--mount", fmt.Sprintf("type=%s,src=%s,dst=%s:ro", "volume", "myvol", "/local/"),
+				"--mount", fmt.Sprintf("type=%s,src=%s,dst=%s:ro", "tmpfs", "", "/local/"),
+			},
+			instance: Filter{
+				Image: "example.com:version",
+				StorageMounts: []runtimeutil.StorageMount{
+					{MountType: "bind", Src: "/mount/path", DstPath: "/local/"},
+					{MountType: "volume", Src: "myvol", DstPath: "/local/"},
+					{MountType: "tmpfs", Src: "", DstPath: "/local/"},
+				},
+			},
+		},
+	}
+
+	for i := range tests {
+		tt := tests[i]
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := yaml.Parse(tt.functionConfig)
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+			tt.instance.Exec.FunctionConfig = cfg
+
+			os.Setenv("KYAML_TEST", "FOO")
+			tt.instance.setupExec()
+
+			// configure expected env
+			for _, e := range os.Environ() {
+				// the process env
+				tt.expectedArgs = append(tt.expectedArgs, "-e", strings.Split(e, "=")[0])
+			}
+			tt.expectedArgs = append(tt.expectedArgs, tt.instance.Image)
+
+			if !assert.Equal(t, "docker", tt.instance.Exec.Path) {
+				t.FailNow()
+			}
+			if !assert.Equal(t, tt.expectedArgs, tt.instance.Exec.Args) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestFilter_Filter(t *testing.T) {
+	cfg, err := yaml.Parse(`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+`)
+	if !assert.NoError(t, err) {
+		return
+	}
+
+	input, err := (&kio.ByteReader{Reader: bytes.NewBufferString(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment-foo
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-foo
+`)}).Read()
+	if !assert.NoError(t, err) {
+		return
+	}
+
+	instance := Filter{}
+	instance.Exec.FunctionConfig = cfg
+	instance.Exec.Path = "sed"
+	instance.Exec.Args = []string{"s/Deployment/StatefulSet/g"}
+	output, err := instance.Filter(input)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	b := &bytes.Buffer{}
+	err = kio.ByteWriter{Writer: b, KeepReaderAnnotations: true}.Write(output)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	if !assert.Equal(t, `apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: deployment-foo
+  annotations:
+    config.kubernetes.io/index: '0'
+    config.kubernetes.io/path: 'statefulset_deployment-foo.yaml'
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-foo
+  annotations:
+    config.kubernetes.io/index: '1'
+    config.kubernetes.io/path: 'service_service-foo.yaml'
+`, b.String()) {
+		t.FailNow()
+	}
+}
+func TestFilter_String(t *testing.T) {
+	instance := Filter{Image: "foo"}
+	if !assert.Equal(t, "foo", instance.String()) {
+		t.FailNow()
+	}
+
+	instance.Exec.DeferFailure = true
+	if !assert.Equal(t, "foo deferFailure: true", instance.String()) {
+		t.FailNow()
+	}
+}
+
+func TestFilter_ExitCode(t *testing.T) {
+	instance := Filter{}
+	instance.Exec.Path = "/not/real/command"
+	instance.Exec.DeferFailure = true
+	_, err := instance.Filter(nil)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	if !assert.EqualError(t, instance.GetExit(), "fork/exec /not/real/command: no such file or directory") {
+		t.FailNow()
+	}
+}

kyaml/fn/runtime/exec/doc.go

@@ -0,0 +1,5 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package exec contains the exec function implementation.
+package exec

kyaml/fn/runtime/exec/exec.go

@@ -0,0 +1,34 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package exec
+
+import (
+	"io"
+	"os/exec"
+
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type Filter struct {
+	// Path is the path to the executable to run
+	Path string `yaml:"path,omitempty"`
+
+	// Args are the arguments to the executable
+	Args []string `yaml:"args,omitempty"`
+
+	runtimeutil.FunctionFilter
+}
+
+func (c *Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	c.FunctionFilter.Run = c.Run
+	return c.FunctionFilter.Filter(nodes)
+}
+
+func (c *Filter) Run(reader io.Reader, writer io.Writer) error {
+	cmd := exec.Command(c.Path, c.Args...)
+	cmd.Stdin = reader
+	cmd.Stdout = writer
+	return cmd.Run()
+}

kyaml/fn/runtime/exec/exec_test.go

@@ -0,0 +1,112 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package exec_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/exec"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestFunctionFilter_Filter(t *testing.T) {
+	var tests = []struct {
+		name           string
+		input          []string
+		functionConfig string
+		expectedOutput []string
+		expectedError  string
+		instance       exec.Filter
+	}{
+		{
+			name: "exec_sed",
+			input: []string{
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment-foo`,
+				`apiVersion: v1
+kind: Service
+metadata:
+  name: service-foo`,
+			},
+			expectedOutput: []string{
+				`apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: deployment-foo
+  annotations:
+    config.kubernetes.io/path: 'statefulset_deployment-foo.yaml'
+`,
+				`apiVersion: v1
+kind: Service
+metadata:
+  name: service-foo
+  annotations:
+    config.kubernetes.io/path: 'service_service-foo.yaml'
+`,
+			},
+			expectedError: "",
+			instance: exec.Filter{
+				Path: "sed",
+				Args: []string{"s/Deployment/StatefulSet/g"},
+			},
+		},
+	}
+
+	for i := range tests {
+		tt := tests[i]
+		t.Run(tt.name, func(t *testing.T) {
+			// initialize the inputs for the FunctionFilter
+			var inputs []*yaml.RNode
+			for i := range tt.input {
+				node, err := yaml.Parse(tt.input[i])
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+				inputs = append(inputs, node)
+			}
+			if tt.functionConfig != "" {
+				fc, err := yaml.Parse(tt.functionConfig)
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+				tt.instance.FunctionConfig = fc
+			}
+
+			// run the function
+			output, err := tt.instance.Filter(inputs)
+
+			// check for errors
+			if tt.expectedError != "" {
+				if !assert.EqualError(t, err, tt.expectedError) {
+					t.FailNow()
+				}
+				return
+			}
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+
+			// verify the output
+			var actual []string
+			for i := range output {
+				s, err := output[i].String()
+				if !assert.NoError(t, err) {
+					t.FailNow()
+				}
+				actual = append(actual, strings.TrimSpace(s))
+			}
+			var expected []string
+			for i := range tt.expectedOutput {
+				expected = append(expected, strings.TrimSpace(tt.expectedOutput[i]))
+			}
+			if !assert.Equal(t, expected, actual) {
+				t.FailNow()
+			}
+		})
+	}
+}

kyaml/fn/runtime/runtimeutil/doc.go

@@ -0,0 +1,5 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package runtimeutil contains libraries for implementing function runtimes.
+package runtimeutil

kyaml/fn/runtime/runtimeutil/functiontypes.go

@@ -1,9 +1,12 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package filters
+package runtimeutil
 
 import (
+	"fmt"
+	"strings"
+
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -27,10 +30,17 @@ type FunctionSpec struct {
 	// Starlark is the spec for running a function as a starlark script
 	Starlark StarlarkSpec `json:"starlark,omitempty" yaml:"starlark,omitempty"`
 
+	// ExecSpec is the spec for running a function as an executable
+	Exec ExecSpec `json:"exec,omitempty" yaml:"exec,omitempty"`
+
 	// Mounts are the storage or directories to mount into the container
 	StorageMounts []StorageMount `json:"mounts,omitempty" yaml:"mounts,omitempty"`
 }
 
+type ExecSpec struct {
+	Path string `json:"path,omitempty" yaml:"path,omitempty"`
+}
+
 // ContainerSpec defines a spec for running a function as a container
 type ContainerSpec struct {
 	// Image is the container image to run
@@ -72,6 +82,10 @@ type StorageMount struct {
 	DstPath string `json:"dst,omitempty" yaml:"dst,omitempty"`
 }
 
+func (s *StorageMount) String() string {
+	return fmt.Sprintf("type=%s,src=%s,dst=%s:ro", s.MountType, s.Src, s.DstPath)
+}
+
 // GetFunctionSpec returns the FunctionSpec for a resource.  Returns
 // nil if the resource does not have a FunctionSpec.
 //
@@ -119,3 +133,52 @@ func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) *Funct
 	_ = yaml.Unmarshal([]byte(s), &fs)
 	return &fs
 }
+
+func StringToStorageMount(s string) StorageMount {
+	m := make(map[string]string)
+	options := strings.Split(s, ",")
+	for _, option := range options {
+		keyVal := strings.SplitN(option, "=", 2)
+		m[keyVal[0]] = keyVal[1]
+	}
+	var sm StorageMount
+	for key, value := range m {
+		switch {
+		case key == "type":
+			sm.MountType = value
+		case key == "src":
+			sm.Src = value
+		case key == "dst":
+			sm.DstPath = value
+		}
+	}
+	return sm
+}
+
+// IsReconcilerFilter filters Resources based on whether or not they are Reconciler Resource.
+// Resources with an apiVersion starting with '*.gcr.io', 'gcr.io' or 'docker.io' are considered
+// Reconciler Resources.
+type IsReconcilerFilter struct {
+	// ExcludeReconcilers if set to true, then Reconcilers will be excluded -- e.g.
+	// Resources with a reconcile container through the apiVersion (gcr.io prefix) or
+	// through the annotations
+	ExcludeReconcilers bool `yaml:"excludeReconcilers,omitempty"`
+
+	// IncludeNonReconcilers if set to true, the NonReconciler will be included.
+	IncludeNonReconcilers bool `yaml:"includeNonReconcilers,omitempty"`
+}
+
+// Filter implements kio.Filter
+func (c *IsReconcilerFilter) Filter(inputs []*yaml.RNode) ([]*yaml.RNode, error) {
+	var out []*yaml.RNode
+	for i := range inputs {
+		isFnResource := GetFunctionSpec(inputs[i]) != nil
+		if isFnResource && !c.ExcludeReconcilers {
+			out = append(out, inputs[i])
+		}
+		if !isFnResource && c.IncludeNonReconcilers {
+			out = append(out, inputs[i])
+		}
+	}
+	return out, nil
+}

kyaml/fn/runtime/runtimeutil/runtimeutil.go

@@ -0,0 +1,198 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package runtimeutil
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+	"path"
+	"strings"
+
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// FunctionFilter wraps another filter to be invoked in the context of a function.
+// FunctionFilter manages scoping the function, deferring failures, and saving results
+// to files.
+type FunctionFilter struct {
+	// Run implements the function.
+	Run func(reader io.Reader, writer io.Writer) error
+
+	// FunctionConfig is passed to the function through ResourceList.functionConfig.
+	FunctionConfig *yaml.RNode `yaml:"functionConfig,omitempty"`
+
+	// GlobalScope explicitly scopes the function to all input resources rather than only those
+	// resources scoped to it by path.
+	GlobalScope bool
+
+	// ResultsFile is the file to write function ResourceList.results to.
+	// If unset, results will not be written.
+	ResultsFile string
+
+	// DeferFailure will cause the Filter to return a nil error even if Run returns an error.
+	// The Run error will be available through GetExit().
+	DeferFailure bool
+
+	// results saves the results emitted from Run
+	results *yaml.RNode
+
+	// exit saves the error returned from Run
+	exit error
+}
+
+// GetExit returns the error from Run
+func (c FunctionFilter) GetExit() error {
+	return c.exit
+}
+
+// functionsDirectoryName is keyword directory name for functions scoped 1 directory higher
+const functionsDirectoryName = "functions"
+
+// getFunctionScope returns the path of the directory containing the function config,
+// or its parent directory if the base directory is named "functions"
+func (c *FunctionFilter) getFunctionScope() (string, error) {
+	m, err := c.FunctionConfig.GetMeta()
+	if err != nil {
+		return "", errors.Wrap(err)
+	}
+	p, found := m.Annotations[kioutil.PathAnnotation]
+	if !found {
+		return "", nil
+	}
+
+	functionDir := path.Clean(path.Dir(p))
+
+	if path.Base(functionDir) == functionsDirectoryName {
+		// the scope of functions in a directory called "functions" is 1 level higher
+		// this is similar to how the golang "internal" directory scoping works
+		functionDir = path.Dir(functionDir)
+	}
+	return functionDir, nil
+}
+
+// scope partitions the input nodes into 2 slices.  The first slice contains only Resources
+// which are scoped under dir, and the second slice contains the Resources which are not.
+func (c *FunctionFilter) scope(dir string, nodes []*yaml.RNode) ([]*yaml.RNode, []*yaml.RNode, error) {
+	// scope container filtered Resources to Resources under that directory
+	var input, saved []*yaml.RNode
+	if c.GlobalScope {
+		return nodes, nil, nil
+	}
+
+	// global function
+	if dir == "" || dir == "." {
+		return nodes, nil, nil
+	}
+
+	// identify Resources read from directories under the function configuration
+	for i := range nodes {
+		m, err := nodes[i].GetMeta()
+		if err != nil {
+			return nil, nil, err
+		}
+		p, found := m.Annotations[kioutil.PathAnnotation]
+		if !found {
+			// this Resource isn't scoped under the function -- don't know where it came from
+			// consider it out of scope
+			saved = append(saved, nodes[i])
+			continue
+		}
+
+		resourceDir := path.Clean(path.Dir(p))
+		if path.Base(resourceDir) == functionsDirectoryName {
+			// Functions in the `functions` directory are scoped to
+			// themselves, and should see themselves as input
+			resourceDir = path.Dir(resourceDir)
+		}
+		if !strings.HasPrefix(resourceDir, dir) {
+			// this Resource doesn't fall under the function scope if it
+			// isn't in a subdirectory of where the function lives
+			saved = append(saved, nodes[i])
+			continue
+		}
+
+		// this input is scoped under the function
+		input = append(input, nodes[i])
+	}
+
+	return input, saved, nil
+}
+
+func (c *FunctionFilter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	in := &bytes.Buffer{}
+	out := &bytes.Buffer{}
+
+	// only process Resources scoped to this function, save the others
+	functionDir, err := c.getFunctionScope()
+	if err != nil {
+		return nil, err
+	}
+	input, saved, err := c.scope(functionDir, nodes)
+	if err != nil {
+		return nil, err
+	}
+
+	// write the input
+	err = kio.ByteWriter{
+		WrappingAPIVersion:    kio.ResourceListAPIVersion,
+		WrappingKind:          kio.ResourceListKind,
+		Writer:                in,
+		KeepReaderAnnotations: true,
+		FunctionConfig:        c.FunctionConfig}.Write(input)
+	if err != nil {
+		return nil, err
+	}
+
+	// capture the command stdout for the return value
+	r := &kio.ByteReader{Reader: out}
+
+	// don't exit immediately if the function fails -- write out the validation
+	c.exit = c.Run(in, out)
+
+	output, err := r.Read()
+	if err != nil {
+		return nil, err
+	}
+
+	if err := c.doResults(r); err != nil {
+		return nil, err
+	}
+
+	if c.exit != nil && !c.DeferFailure {
+		return append(output, saved...), c.exit
+	}
+
+	// annotate any generated Resources with a path and index if they don't already have one
+	if err := kioutil.DefaultPathAnnotation(functionDir, output); err != nil {
+		return nil, err
+	}
+
+	// emit both the Resources output from the function, and the out-of-scope Resources
+	// which were not provided to the function
+	return append(output, saved...), nil
+}
+
+func (c *FunctionFilter) doResults(r *kio.ByteReader) error {
+	// Write the results to a file if configured to do so
+	if c.ResultsFile != "" && r.Results != nil {
+		results, err := r.Results.String()
+		if err != nil {
+			return err
+		}
+		err = ioutil.WriteFile(c.ResultsFile, []byte(results), 0600)
+		if err != nil {
+			return err
+		}
+	}
+
+	if r.Results != nil {
+		c.results = r.Results
+	}
+	return nil
+}

kyaml/fn/runtime/runtimeutil/types.go

@@ -0,0 +1,8 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package runtimeutil
+
+type DeferFailureFunction interface {
+	GetExit() error
+}

kyaml/fn/runtime/starlark/context.go

@@ -60,22 +60,6 @@ func env() (starlark.Value, error) {
 	return value, nil
 }
 
-func nodeToValue(node *yaml.RNode) (starlark.Value, error) {
-	s, err := node.String()
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-	var in map[string]interface{}
-	if err := yaml.Unmarshal([]byte(s), &in); err != nil {
-		return nil, errors.Wrap(err)
-	}
-	value, err := util.Marshal(in)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-	return value, nil
-}
-
 func interfaceToValue(i interface{}) (starlark.Value, error) {
 	b, err := json.Marshal(i)
 	if err != nil {

kyaml/fn/runtime/starlark/example_test.go

@@ -11,8 +11,9 @@ import (
 	"os"
 	"path/filepath"
 
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark"
 	"sigs.k8s.io/kustomize/kyaml/kio"
-	"sigs.k8s.io/kustomize/kyaml/starlark"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -75,6 +76,7 @@ run(ctx.resource_list["items"])
 	//   name: deployment-1
 	//   annotations:
 	//     foo: bar
+	//     config.kubernetes.io/path: 'deployment_deployment-1.yaml'
 	// spec:
 	//   template:
 	//     spec:
@@ -88,6 +90,7 @@ run(ctx.resource_list["items"])
 	//   name: deployment-2
 	//   annotations:
 	//     foo: bar
+	//     config.kubernetes.io/path: 'deployment_deployment-2.yaml'
 	// spec:
 	//   template:
 	//     spec:
@@ -141,7 +144,7 @@ def run(items, value):
 
 run(ctx.resource_list["items"], ctx.resource_list["functionConfig"]["spec"]["value"])
 `,
-		FunctionConfig: fc,
+		FunctionFilter: runtimeutil.FunctionFilter{FunctionConfig: fc},
 	}
 
 	// output contains the transformed resources
@@ -165,6 +168,7 @@ run(ctx.resource_list["items"], ctx.resource_list["functionConfig"]["spec"]["val
 	//   name: deployment-1
 	//   annotations:
 	//     foo: hello world
+	//     config.kubernetes.io/path: 'deployment_deployment-1.yaml'
 	// spec:
 	//   template:
 	//     spec:
@@ -178,6 +182,7 @@ run(ctx.resource_list["items"], ctx.resource_list["functionConfig"]["spec"]["val
 	//   name: deployment-2
 	//   annotations:
 	//     foo: hello world
+	//     config.kubernetes.io/path: 'deployment_deployment-2.yaml'
 	// spec:
 	//   template:
 	//     spec:

kyaml/fn/runtime/starlark/starlark.go

@@ -0,0 +1,224 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package starlark
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+
+	"github.com/qri-io/starlib/util"
+	"go.starlark.net/starlark"
+	"sigs.k8s.io/kustomize/kyaml/comments"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/kio/filters"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter transforms a set of resources through the provided program
+type Filter struct {
+	Name string
+
+	// Program is a starlark script which will be run against the resources
+	Program string
+
+	// URL is the url of a starlark program to fetch and run
+	URL string
+
+	// Path is the path to a starlark program to read and run
+	Path string
+
+	runtimeutil.FunctionFilter
+
+	ids map[string]*yaml.RNode
+}
+
+func (sf *Filter) String() string {
+	return fmt.Sprintf(
+		"name: %v path: %v url: %v program: %v", sf.Name, sf.Path, sf.URL, sf.Program)
+}
+
+func (sf *Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	err := sf.setup()
+	if err != nil {
+		return nil, err
+	}
+	sf.FunctionFilter.Run = sf.Run
+
+	return sf.FunctionFilter.Filter(nodes)
+}
+
+func (sf *Filter) setup() error {
+	if sf.URL != "" && sf.Path != "" ||
+		sf.URL != "" && sf.Program != "" ||
+		sf.Path != "" && sf.Program != "" {
+		return errors.Errorf("Filter Path, Program and URL are mutually exclusive")
+	}
+
+	// read the program from a file
+	if sf.Path != "" {
+		b, err := ioutil.ReadFile(sf.Path)
+		if err != nil {
+			return err
+		}
+		sf.Program = string(b)
+	}
+
+	// read the program from a URL
+	if sf.URL != "" {
+		err := func() error {
+			resp, err := http.Get(sf.URL)
+			if err != nil {
+				return err
+			}
+			defer resp.Body.Close()
+			b, err := ioutil.ReadAll(resp.Body)
+			if err != nil {
+				return err
+			}
+			sf.Program = string(b)
+			return nil
+		}()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (sf *Filter) Run(reader io.Reader, writer io.Writer) error {
+	// retain map of inputs to outputs by id so if the name is changed by the
+	// starlark program, we are able to match the same resources
+	value, err := sf.readResourceList(reader)
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	// run the starlark as program as transformation function
+	thread := &starlark.Thread{Name: sf.Name}
+
+	ctx := &Context{resourceList: value}
+	pd, err := ctx.predeclared()
+	if err != nil {
+		return errors.Wrap(err)
+	}
+	_, err = starlark.ExecFile(thread, sf.Name, sf.Program, pd)
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	return sf.writeResourceList(value, writer)
+}
+
+// inputToResourceList transforms input into a starlark.Value
+func (sf *Filter) readResourceList(reader io.Reader) (starlark.Value, error) {
+	// read and parse the inputs
+	rl := bytes.Buffer{}
+	_, err := rl.ReadFrom(reader)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	rn, err := yaml.Parse(rl.String())
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	// set the id on each node to map inputs to outputs
+	var id int
+	sf.ids = map[string]*yaml.RNode{}
+	items, err := rn.Pipe(yaml.Lookup("items"))
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	err = items.VisitElements(func(node *yaml.RNode) error {
+		id++
+		idStr := fmt.Sprintf("%v", id)
+		sf.ids[idStr] = node
+		return node.PipeE(yaml.SetAnnotation("config.k8s.io/id", idStr))
+	})
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	// convert to a starlark value
+	b, err := yaml.Marshal(rn.Document()) // convert to bytes
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	var in map[string]interface{}
+	err = yaml.Unmarshal(b, &in) // convert to map[string]interface{}
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	return util.Marshal(in) // convert to starlark value
+}
+
+// resourceListToOutput converts the output of the starlark program to the filter output
+func (sf *Filter) writeResourceList(value starlark.Value, writer io.Writer) error {
+	// convert the modified resourceList back into a slice of RNodes
+	// by first converting to a map[string]interface{}
+	out, err := util.Unmarshal(value)
+	if err != nil {
+		return errors.Wrap(err)
+	}
+	b, err := yaml.Marshal(out)
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	rl, err := yaml.Parse(string(b))
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	// preserve the comments from the input
+	items, err := rl.Pipe(yaml.Lookup("items"))
+	if err != nil {
+		return errors.Wrap(err)
+	}
+	err = items.VisitElements(func(node *yaml.RNode) error {
+		anID, err := node.Pipe(yaml.GetAnnotation("config.k8s.io/id"))
+		if err != nil {
+			return errors.Wrap(err)
+		}
+		if anID == nil {
+			return nil
+		}
+
+		var in *yaml.RNode
+		var found bool
+		if in, found = sf.ids[anID.YNode().Value]; !found {
+			return nil
+		}
+		if err := node.PipeE(yaml.ClearAnnotation("config.k8s.io/id")); err != nil {
+			return errors.Wrap(err)
+		}
+		if err := comments.CopyComments(in, node); err != nil {
+			return errors.Wrap(err)
+		}
+
+		// starlark will serialize the resources sorting the fields alphabetically,
+		// format them to have a better ordering
+		fmtFltr := filters.FormatFilter{}
+		if _, err := fmtFltr.Filter([]*yaml.RNode{node}); err != nil {
+			return errors.Wrap(err)
+		}
+		return nil
+	})
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	s, err := rl.String()
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
+	_, err = writer.Write([]byte(s))
+	return err
+}

kyaml/fn/runtime/starlark/starlark_test.go

@@ -56,6 +56,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: bar
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -95,6 +96,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: annotation-value
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -133,6 +135,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: Deployment enables declarative updates for Pods and ReplicaSets.
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -174,6 +177,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: bar
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -213,6 +217,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nginx-deployment
+  annotations:
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -266,6 +272,7 @@ metadata:
   name: nginx-deployment-1
   annotations:
     foo: bar
+    config.kubernetes.io/path: 'deployment_nginx-deployment-1.yaml'
 spec:
   template:
     spec:
@@ -280,6 +287,7 @@ metadata:
   name: nginx-deployment-2
   annotations:
     foo: bar
+    config.kubernetes.io/path: 'deployment_nginx-deployment-2.yaml'
 spec:
   template:
     spec:
@@ -318,13 +326,10 @@ run(ctx.resource_list["items"])
 			expected: `
 apiVersion: apps/v1
 kind: Deployment
-metadata:
-  name: nginx-deployment-2
----
-apiVersion: apps/v1
-kind: Deployment
 metadata:
   name: nginx-deployment-1
+  annotations:
+    config.kubernetes.io/path: 'deployment_nginx-deployment-1.yaml'
 spec:
   template:
     spec:
@@ -332,6 +337,13 @@ spec:
       - name: nginx
         # head comment
         image: nginx:1.8.1 # {"$ref": "#/definitions/io.k8s.cli.substitutions.image"}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment-2
+  annotations:
+    config.kubernetes.io/path: 'deployment_nginx-deployment-2.yaml'
 `,
 		},
 		{
@@ -357,6 +369,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nginx-deployment-1
+  annotations:
+    config.kubernetes.io/path: 'deployment_nginx-deployment-1.yaml'
 `,
 		},
 		{
@@ -395,6 +409,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: hello world
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -406,7 +421,7 @@ spec:
 			expectedFunctionConfig: `
 kind: Script
 spec:
-  value: hello world
+  value: "hello world"
 `,
 		},
 
@@ -447,6 +462,7 @@ metadata:
   name: nginx-deployment
   annotations:
     foo: hello world
+    config.kubernetes.io/path: 'deployment_nginx-deployment.yaml'
 spec:
   template:
     spec:
@@ -458,7 +474,7 @@ spec:
 			expectedFunctionConfig: `
 kind: Script
 spec:
-  value: updated
+  value: "hello world"
 `,
 		},
 	}

kyaml/go.mod

@@ -8,10 +8,12 @@ require (
 	github.com/go-openapi/spec v0.19.5
 	github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d
 	github.com/sergi/go-diff v1.1.0
+	github.com/spf13/cobra v1.0.0
+	github.com/spf13/pflag v1.0.3
 	github.com/stretchr/testify v1.4.0
 	github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5
-	golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 // indirect
+	golang.org/x/net v0.0.0-20200226121028-0de0cce0169b // indirect
 	gopkg.in/yaml.v2 v2.2.7
 	gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2
 )

kyaml/go.sum

@@ -1,23 +1,46 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1 h1:l55mJb6rkkaUzOpSsgEeKYtS6/0gHwBYyfo5Jcjv/Ks=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PuerkitoBio/goquery v1.5.0 h1:uGvmFXOA73IKluu/F84Xd1tt/z07GYm8X49XKHP7EJk=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/andybalholm/cascadia v1.0.0 h1:hOCXnnZ5A+3eVDX8pvgl4kofXv2ELss0bKcqRySc45o=
 github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e h1:44fmjqDtdCiUNlSjJVp+w1AOs6na3Y6Ai0aIeseFjkI=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
 github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
@@ -28,56 +51,148 @@ github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHK
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e h1:hB2xlXdHp/pmPZq0y3QnmWAArdw9PqbmotexnWx/FU8=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/paulmach/orb v0.1.3 h1:Wa1nzU269Zv7V9paVEY1COWW8FCqv4PC/KJRbJSimpM=
 github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
+github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d h1:K6eOUihrFLdZjZnA4XlRp864fmWXv9YTIk7VPLhRacA=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
+github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
+github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297 h1:k7pJ2yAPLPgbskkFdhRCsA77k2fySZ1zf2zCjvQCiIM=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd h1:/e+gpKk9r3dJobndpTytxS2gOy6m5uvpg+ISQoEcusQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

kyaml/kio/filters/container.go

@@ -1,450 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package filters
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path"
-	"strings"
-
-	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/kio"
-	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
-
-	"sigs.k8s.io/kustomize/kyaml/yaml"
-)
-
-// ContainerFilter filters Resources using a container image.
-// The container must start a process that reads the list of
-// input Resources from stdin, reads the Configuration from the env
-// API_CONFIG, and writes the filtered Resources to stdout.
-// If there is a error or validation failure, the process must exit
-// non-zero.
-// The full set of environment variables from the parent process
-// are passed to the container.
-//
-// Function Scoping:
-// ContainerFilter applies the function only to Resources to which it is scoped.
-//
-// Resources are scoped to a function if any of the following are true:
-// - the Resource were read from the same directory as the function config
-// - the Resource were read from a subdirectory of the function config directory
-// - the function config is in a directory named "functions" and
-//   they were read from a subdirectory of "functions" parent
-// - the function config doesn't have a path annotation (considered globally scoped)
-// - the ContainerFilter has GlobalScope == true
-//
-// In Scope Examples:
-//
-// Example 1: deployment.yaml and service.yaml in function.yaml scope
-//            same directory as the function config directory
-//     .
-//     ├── function.yaml
-//     ├── deployment.yaml
-//     └── service.yaml
-//
-// Example 2: apps/deployment.yaml and apps/service.yaml in function.yaml scope
-//            subdirectory of the function config directory
-//     .
-//     ├── function.yaml
-//     └── apps
-//         ├── deployment.yaml
-//         └── service.yaml
-//
-// Example 3: apps/deployment.yaml and apps/service.yaml in functions/function.yaml scope
-//            function config is in a directory named "functions"
-//     .
-//     ├── functions
-//     │   └── function.yaml
-//     └── apps
-//         ├── deployment.yaml
-//         └── service.yaml
-//
-// Out of Scope Examples:
-//
-// Example 1: apps/deployment.yaml and apps/service.yaml NOT in stuff/function.yaml scope
-//     .
-//     ├── stuff
-//     │   └── function.yaml
-//     └── apps
-//         ├── deployment.yaml
-//         └── service.yaml
-//
-// Example 2: apps/deployment.yaml and apps/service.yaml NOT in stuff/functions/function.yaml scope
-//     .
-//     ├── stuff
-//     │   └── functions
-//     │       └── function.yaml
-//     └── apps
-//         ├── deployment.yaml
-//         └── service.yaml
-//
-// Default Paths:
-// Resources emitted by functions will have default path applied as annotations
-// if none is present.
-// The default path will be the function-dir/ (or parent directory in the case of "functions")
-// + function-file-name/ + namespace/ + kind_name.yaml
-//
-// Example 1: Given a function in fn.yaml that produces a Deployment name foo and a Service named bar
-//     dir
-//     └── fn.yaml
-//
-// Would default newly generated Resources to:
-//
-//     dir
-//     ├── fn.yaml
-//     └── fn
-//         ├── deployment_foo.yaml
-//         └── service_bar.yaml
-//
-// Example 2: Given a function in functions/fn.yaml that produces a Deployment name foo and a Service named bar
-//     dir
-//     └── fn.yaml
-//
-// Would default newly generated Resources to:
-//
-//     dir
-//     ├── functions
-//     │   └── fn.yaml
-//     └── fn
-//         ├── deployment_foo.yaml
-//         └── service_bar.yaml
-//
-// Example 3: Given a function in fn.yaml that produces a Deployment name foo, namespace baz and a Service named bar namespace baz
-//     dir
-//     └── fn.yaml
-//
-// Would default newly generated Resources to:
-//
-//     dir
-//     ├── fn.yaml
-//     └── fn
-//         └── baz
-//             ├── deployment_foo.yaml
-//             └── service_bar.yaml
-type ContainerFilter struct {
-
-	// Image is the container image to use to create a container.
-	Image string `yaml:"image,omitempty"`
-
-	// Network is the container network to use.
-	Network string `yaml:"network,omitempty"`
-
-	// StorageMounts is a list of storage options that the container will have mounted.
-	StorageMounts []StorageMount `yaml:"mounts,omitempty"`
-
-	// Config is the API configuration for the container and passed through the
-	// API_CONFIG env var to the container.
-	// Typically a Kubernetes style Resource Config.
-	Config *yaml.RNode `yaml:"config,omitempty"`
-
-	// GlobalScope will cause the function to be run against all input
-	// nodes instead of only nodes scoped under the function.
-	GlobalScope bool
-
-	ResultsFile string
-
-	Results *yaml.RNode
-
-	DeferFailure bool
-
-	Exit error
-
-	// SetFlowStyleForConfig sets the style for config to Flow when serializing it
-	SetFlowStyleForConfig bool
-
-	// args may be specified by tests to override how a container is spawned
-	args []string
-
-	checkInput func(string)
-}
-
-func (c ContainerFilter) GetExit() error {
-	return c.Exit
-}
-
-type DeferFailureFunction interface {
-	GetExit() error
-}
-
-func (c ContainerFilter) String() string {
-	if c.DeferFailure {
-		return fmt.Sprintf("%s deferFailure: %v", c.Image, c.DeferFailure)
-	}
-	return c.Image
-}
-
-func (s *StorageMount) String() string {
-	return fmt.Sprintf("type=%s,src=%s,dst=%s:ro", s.MountType, s.Src, s.DstPath)
-}
-
-func StringToStorageMount(s string) StorageMount {
-	m := make(map[string]string)
-	options := strings.Split(s, ",")
-	for _, option := range options {
-		keyVal := strings.SplitN(option, "=", 2)
-		m[keyVal[0]] = keyVal[1]
-	}
-	var sm StorageMount
-	for key, value := range m {
-		switch {
-		case key == "type":
-			sm.MountType = value
-		case key == "src":
-			sm.Src = value
-		case key == "dst":
-			sm.DstPath = value
-		}
-	}
-	return sm
-}
-
-// functionsDirectoryName is keyword directory name for functions scoped 1 directory higher
-const functionsDirectoryName = "functions"
-
-// getFunctionScope returns the path of the directory containing the function config,
-// or its parent directory if the base directory is named "functions"
-func (c *ContainerFilter) getFunctionScope() (string, error) {
-	m, err := c.Config.GetMeta()
-	if err != nil {
-		return "", errors.Wrap(err)
-	}
-	p, found := m.Annotations[kioutil.PathAnnotation]
-	if !found {
-		return "", nil
-	}
-
-	functionDir := path.Clean(path.Dir(p))
-
-	if path.Base(functionDir) == functionsDirectoryName {
-		// the scope of functions in a directory called "functions" is 1 level higher
-		// this is similar to how the golang "internal" directory scoping works
-		functionDir = path.Dir(functionDir)
-	}
-	return functionDir, nil
-}
-
-// scope partitions the input nodes into 2 slices.  The first slice contains only Resources
-// which are scoped under dir, and the second slice contains the Resources which are not.
-func (c *ContainerFilter) scope(dir string, nodes []*yaml.RNode) ([]*yaml.RNode, []*yaml.RNode, error) {
-	// scope container filtered Resources to Resources under that directory
-	var input, saved []*yaml.RNode
-	if c.GlobalScope {
-		return nodes, nil, nil
-	}
-
-	// global function
-	if dir == "" || dir == "." {
-		return nodes, nil, nil
-	}
-
-	// identify Resources read from directories under the function configuration
-	for i := range nodes {
-		m, err := nodes[i].GetMeta()
-		if err != nil {
-			return nil, nil, err
-		}
-		p, found := m.Annotations[kioutil.PathAnnotation]
-		if !found {
-			// this Resource isn't scoped under the function -- don't know where it came from
-			// consider it out of scope
-			saved = append(saved, nodes[i])
-			continue
-		}
-
-		resourceDir := path.Clean(path.Dir(p))
-		if path.Base(resourceDir) == functionsDirectoryName {
-			// Functions in the `functions` directory are scoped to
-			// themselves, and should see themselves as input
-			resourceDir = path.Dir(resourceDir)
-		}
-		if !strings.HasPrefix(resourceDir, dir) {
-			// this Resource doesn't fall under the function scope if it
-			// isn't in a subdirectory of where the function lives
-			saved = append(saved, nodes[i])
-			continue
-		}
-
-		// this input is scoped under the function
-		input = append(input, nodes[i])
-	}
-
-	return input, saved, nil
-}
-
-// GrepFilter implements kio.GrepFilter
-func (c *ContainerFilter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
-	// get the command to filter the Resources
-	cmd := c.getCommand()
-
-	in := &bytes.Buffer{}
-	out := &bytes.Buffer{}
-
-	// only process Resources scoped to this function, save the others
-	functionDir, err := c.getFunctionScope()
-	if err != nil {
-		return nil, err
-	}
-	input, saved, err := c.scope(functionDir, nodes)
-	if err != nil {
-		return nil, err
-	}
-
-	// write the input
-	err = kio.ByteWriter{
-		WrappingAPIVersion:    kio.ResourceListAPIVersion,
-		WrappingKind:          kio.ResourceListKind,
-		Writer:                in,
-		KeepReaderAnnotations: true,
-		FunctionConfig:        c.Config}.Write(input)
-	if err != nil {
-		return nil, err
-	}
-
-	// capture the command stdout for the return value
-	r := &kio.ByteReader{Reader: out}
-
-	// do the filtering
-	if c.checkInput != nil {
-		c.checkInput(in.String())
-	}
-	cmd.Stdin = in
-	cmd.Stdout = out
-
-	// don't exit immediately if the function fails -- write out the validation
-	c.Exit = cmd.Run()
-
-	output, err := r.Read()
-	if err != nil {
-		return nil, err
-	}
-
-	if err := c.doResults(r); err != nil {
-		return nil, err
-	}
-
-	if c.Exit != nil && !c.DeferFailure {
-		return append(output, saved...), c.Exit
-	}
-
-	// annotate any generated Resources with a path and index if they don't already have one
-	if err := kioutil.DefaultPathAnnotation(functionDir, output); err != nil {
-		return nil, err
-	}
-
-	// emit both the Resources output from the function, and the out-of-scope Resources
-	// which were not provided to the function
-	return append(output, saved...), nil
-}
-
-func (c *ContainerFilter) doResults(r *kio.ByteReader) error {
-	// Write the results to a file if configured to do so
-	if c.ResultsFile != "" && r.Results != nil {
-		results, err := r.Results.String()
-		if err != nil {
-			return err
-		}
-		err = ioutil.WriteFile(c.ResultsFile, []byte(results), 0600)
-		if err != nil {
-			return err
-		}
-	}
-
-	if r.Results != nil {
-		c.Results = r.Results
-	}
-	return nil
-}
-
-// getArgs returns the command + args to run to spawn the container
-func (c *ContainerFilter) getArgs() []string {
-	// run the container using docker.  this is simpler than using the docker
-	// libraries, and ensures things like auth work the same as if the container
-	// was run from the cli.
-
-	network := "none"
-	if c.Network != "" {
-		network = c.Network
-	}
-
-	args := []string{"docker", "run",
-		"--rm",                                              // delete the container afterward
-		"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR", // attach stdin, stdout, stderr
-
-		// added security options
-		"--network", network,
-		"--user", "nobody", // run as nobody
-		// don't make fs readonly because things like heredoc rely on writing tmp files
-		"--security-opt=no-new-privileges", // don't allow the user to escalate privileges
-	}
-
-	// TODO(joncwong): Allow StorageMount fields to have default values.
-	for _, storageMount := range c.StorageMounts {
-		args = append(args, "--mount", storageMount.String())
-	}
-
-	// tell functions to write error messages to stderr as well as results
-	os.Setenv("LOG_TO_STDERR", "true")
-	os.Setenv("STRUCTURED_RESULTS", "true")
-
-	// export the local environment vars to the container
-	for _, pair := range os.Environ() {
-		tokens := strings.Split(pair, "=")
-		if tokens[0] == "" {
-			continue
-		}
-		args = append(args, "-e", tokens[0])
-	}
-	return append(args, c.Image)
-}
-
-// getCommand returns a command which will apply the Filter using the container image
-func (c *ContainerFilter) getCommand() *exec.Cmd {
-	if c.SetFlowStyleForConfig {
-		c.Config.YNode().Style = yaml.FlowStyle
-	}
-
-	if len(c.args) == 0 {
-		c.args = c.getArgs()
-	}
-
-	cmd := exec.Command(c.args[0], c.args[1:]...)
-	cmd.Stderr = os.Stderr
-	cmd.Env = os.Environ()
-
-	// set stderr for err messaging
-	return cmd
-}
-
-// IsReconcilerFilter filters Resources based on whether or not they are Reconciler Resource.
-// Resources with an apiVersion starting with '*.gcr.io', 'gcr.io' or 'docker.io' are considered
-// Reconciler Resources.
-type IsReconcilerFilter struct {
-	// ExcludeReconcilers if set to true, then Reconcilers will be excluded -- e.g.
-	// Resources with a reconcile container through the apiVersion (gcr.io prefix) or
-	// through the annotations
-	ExcludeReconcilers bool `yaml:"excludeReconcilers,omitempty"`
-
-	// IncludeNonReconcilers if set to true, the NonReconciler will be included.
-	IncludeNonReconcilers bool `yaml:"includeNonReconcilers,omitempty"`
-}
-
-// Filter implements kio.Filter
-func (c *IsReconcilerFilter) Filter(inputs []*yaml.RNode) ([]*yaml.RNode, error) {
-	var out []*yaml.RNode
-	for i := range inputs {
-		isFnResource := GetFunctionSpec(inputs[i]) != nil
-		if isFnResource && !c.ExcludeReconcilers {
-			out = append(out, inputs[i])
-		}
-		if !isFnResource && c.IncludeNonReconcilers {
-			out = append(out, inputs[i])
-		}
-	}
-	return out, nil
-}

kyaml/runfn/runfn.go

@@ -14,17 +14,19 @@ import (
 	"sync/atomic"
 
 	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/container"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/exec"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark"
 	"sigs.k8s.io/kustomize/kyaml/kio"
-	"sigs.k8s.io/kustomize/kyaml/kio/filters"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
-	"sigs.k8s.io/kustomize/kyaml/starlark"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // RunFns runs the set of configuration functions in a local directory against
 // the Resources in that directory
 type RunFns struct {
-	StorageMounts []filters.StorageMount
+	StorageMounts []runtimeutil.StorageMount
 
 	// Path is the path to the directory containing functions
 	Path string
@@ -63,6 +65,9 @@ type RunFns struct {
 	// EnableStarlark will enable functions run as starlark scripts
 	EnableStarlark bool
 
+	// EnableExec will enable exec functions
+	EnableExec bool
+
 	// DisableContainers will disable functions run as containers
 	DisableContainers bool
 
@@ -75,7 +80,7 @@ type RunFns struct {
 	// functionFilterProvider provides a filter to perform the function.
 	// this is a variable so it can be mocked in tests
 	functionFilterProvider func(
-		filter filters.FunctionSpec, api *yaml.RNode) (kio.Filter, error)
+		filter runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter, error)
 }
 
 // Execute runs the command
@@ -173,7 +178,7 @@ func (r RunFns) runFunctions(
 	// check for deferred function errors
 	var errs []string
 	for i := range fltrs {
-		cf, ok := fltrs[i].(filters.DeferFailureFunction)
+		cf, ok := fltrs[i].(runtimeutil.DeferFailureFunction)
 		if !ok {
 			continue
 		}
@@ -196,7 +201,7 @@ func (r RunFns) getFunctionsFromInput(nodes []*yaml.RNode) ([]kio.Filter, error)
 	buff := &kio.PackageBuffer{}
 	err := kio.Pipeline{
 		Inputs:  []kio.Reader{&kio.PackageBuffer{Nodes: nodes}},
-		Filters: []kio.Filter{&filters.IsReconcilerFilter{}},
+		Filters: []kio.Filter{&runtimeutil.IsReconcilerFilter{}},
 		Outputs: []kio.Writer{buff},
 	}.Execute()
 	if err != nil {
@@ -235,7 +240,7 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
 	var fltrs []kio.Filter
 	for i := range fns {
 		api := fns[i]
-		spec := filters.GetFunctionSpec(api)
+		spec := runtimeutil.GetFunctionSpec(api)
 		if spec.Container.Network.Required {
 			if !r.Network {
 				// TODO(eddiezane): Provide error info about which function needs the network
@@ -251,9 +256,9 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
 		if c == nil {
 			continue
 		}
-		cf, ok := c.(*filters.ContainerFilter)
+		cf, ok := c.(*container.Filter)
 		if global && ok {
-			cf.GlobalScope = true
+			cf.Exec.GlobalScope = true
 		}
 		fltrs = append(fltrs, c)
 	}
@@ -331,25 +336,25 @@ func (r *RunFns) init() {
 }
 
 // ffp provides function filters
-func (r *RunFns) ffp(spec filters.FunctionSpec, api *yaml.RNode) (kio.Filter, error) {
+func (r *RunFns) ffp(spec runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter, error) {
+	var resultsFile string
+	if r.ResultsDir != "" {
+		resultsFile = filepath.Join(r.ResultsDir, fmt.Sprintf(
+			"results-%v.yaml", r.resultsCount))
+		atomic.AddUint32(&r.resultsCount, 1)
+	}
 	if !r.DisableContainers && spec.Container.Image != "" {
-		var resultsFile string
 		// TODO: Add a test for this behavior
-
-		if r.ResultsDir != "" {
-			resultsFile = filepath.Join(r.ResultsDir, fmt.Sprintf(
-				"results-%v.yaml", r.resultsCount))
-			atomic.AddUint32(&r.resultsCount, 1)
-		}
-		return &filters.ContainerFilter{
+		cf := &container.Filter{
 			Image:         spec.Container.Image,
-			Config:        api,
 			Network:       spec.Network,
 			StorageMounts: r.StorageMounts,
-			GlobalScope:   r.GlobalScope,
-			ResultsFile:   resultsFile,
-			DeferFailure:  spec.DeferFailure,
-		}, nil
+		}
+		cf.Exec.FunctionConfig = api
+		cf.Exec.GlobalScope = r.GlobalScope
+		cf.Exec.ResultsFile = resultsFile
+		cf.Exec.DeferFailure = spec.DeferFailure
+		return cf, nil
 	}
 	if r.EnableStarlark && spec.Starlark.Path != "" {
 		// the script path is relative to the function config file
@@ -369,11 +374,24 @@ func (r *RunFns) ffp(spec filters.FunctionSpec, api *yaml.RNode) (kio.Filter, er
 		}
 		p = path.Join(r.Path, path.Dir(p), spec.Starlark.Path)
 
-		return &starlark.Filter{
-			Name:           spec.Starlark.Name,
-			Path:           p,
-			FunctionConfig: api,
-		}, nil
+		sf := &starlark.Filter{Name: spec.Starlark.Name, Path: p}
+
+		sf.FunctionConfig = api
+		sf.GlobalScope = r.GlobalScope
+		sf.ResultsFile = resultsFile
+		sf.DeferFailure = spec.DeferFailure
+		return sf, nil
 	}
+
+	if r.EnableExec && spec.Exec.Path != "" {
+		ef := &exec.Filter{Path: spec.Exec.Path}
+
+		ef.FunctionConfig = api
+		ef.GlobalScope = r.GlobalScope
+		ef.ResultsFile = resultsFile
+		ef.DeferFailure = spec.DeferFailure
+		return ef, nil
+	}
+
 	return nil, nil
 }

kyaml/runfn/runfn_test.go

@@ -16,6 +16,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"sigs.k8s.io/kustomize/kyaml/copyutil"
 	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/container"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/kio/filters"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -48,8 +50,8 @@ func TestRunFns_init(t *testing.T) {
 	api, err := yaml.Parse(`apiVersion: apps/v1
 kind: 
 `)
-	spec := filters.FunctionSpec{
-		Container: filters.ContainerSpec{
+	spec := runtimeutil.FunctionSpec{
+		Container: runtimeutil.ContainerSpec{
 			Image: "example.com:version",
 		},
 	}
@@ -57,7 +59,9 @@ kind:
 		return
 	}
 	filter, _ := instance.functionFilterProvider(spec, api)
-	assert.Equal(t, &filters.ContainerFilter{Image: "example.com:version", Config: api}, filter)
+	cf := &container.Filter{Image: "example.com:version"}
+	cf.Exec.FunctionConfig = api
+	assert.Equal(t, cf, filter)
 }
 
 func TestRunFns_Execute__initGlobalScope(t *testing.T) {
@@ -76,8 +80,8 @@ kind:
 		return
 	}
 
-	spec := filters.FunctionSpec{
-		Container: filters.ContainerSpec{
+	spec := runtimeutil.FunctionSpec{
+		Container: runtimeutil.ContainerSpec{
 			Image: "example.com:version",
 		},
 	}
@@ -85,8 +89,10 @@ kind:
 		return
 	}
 	filter, _ := instance.functionFilterProvider(spec, api)
-	assert.Equal(t, &filters.ContainerFilter{
-		Image: "example.com:version", Config: api, GlobalScope: true}, filter)
+	cf := &container.Filter{Image: "example.com:version"}
+	cf.Exec.FunctionConfig = api
+	cf.Exec.GlobalScope = true
+	assert.Equal(t, cf, filter)
 }
 
 func TestRunFns_Execute__initDefault(t *testing.T) {
@@ -143,12 +149,12 @@ func TestRunFns_Execute__initDefault(t *testing.T) {
 		},
 		{
 			name:     "explicit directories in mounts",
-			instance: RunFns{StorageMounts: []filters.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}}},
+			instance: RunFns{StorageMounts: []runtimeutil.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}}},
 			expected: RunFns{
 				Output:               os.Stdout,
 				Input:                os.Stdin,
 				NoFunctionsFromInput: getFalse(),
-				StorageMounts:        []filters.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}},
+				StorageMounts:        []runtimeutil.StorageMount{{MountType: "volume", Src: "myvol", DstPath: "/local/"}},
 			},
 		},
 	}
@@ -751,7 +757,7 @@ replace: StatefulSet
 	var fltrs []*TestFilter
 	instance := RunFns{
 		Path: dir,
-		functionFilterProvider: func(f filters.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
+		functionFilterProvider: func(f runtimeutil.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
 			tf := &TestFilter{
 				Exit: errors.Errorf("message: %s", f.Container.Image),
 			}
@@ -927,8 +933,8 @@ func setupTest(t *testing.T) string {
 // getFilterProvider fakes the creation of a filter, replacing the ContainerFiler with
 // a filter to s/kind: Deployment/kind: StatefulSet/g.
 // this can be used to simulate running a filter.
-func getFilterProvider(t *testing.T) func(filters.FunctionSpec, *yaml.RNode) (kio.Filter, error) {
-	return func(f filters.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
+func getFilterProvider(t *testing.T) func(runtimeutil.FunctionSpec, *yaml.RNode) (kio.Filter, error) {
+	return func(f runtimeutil.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
 		// parse the filter from the input
 		filter := yaml.YFilter{}
 		b := &bytes.Buffer{}

kyaml/setters2/list.go

@@ -18,10 +18,12 @@ type List struct {
 	Name string
 
 	Setters []SetterDefinition
+
+	Substitutions []SubstitutionDefinition
 }
 
-// List initializes l.Setters with the setters from the OpenAPI definitions in the file
-func (l *List) List(openAPIPath, resourcePath string) error {
+// ListSetters initializes l.Setters with the setters from the OpenAPI definitions in the file
+func (l *List) ListSetters(openAPIPath, resourcePath string) error {
 	if err := openapi.AddSchemaFromFile(openAPIPath); err != nil {
 		return err
 	}
@@ -29,10 +31,22 @@ func (l *List) List(openAPIPath, resourcePath string) error {
 	if err != nil {
 		return err
 	}
-	return l.list(y, resourcePath)
+	return l.listSetters(y, resourcePath)
 }
 
-func (l *List) list(object *yaml.RNode, resourcePath string) error {
+// ListSubst initializes l.Substitutions with the substitutions from the OpenAPI definitions in the file
+func (l *List) ListSubst(openAPIPath string) error {
+	if err := openapi.AddSchemaFromFile(openAPIPath); err != nil {
+		return err
+	}
+	y, err := yaml.ReadFile(openAPIPath)
+	if err != nil {
+		return err
+	}
+	return l.listSubst(y)
+}
+
+func (l *List) listSetters(object *yaml.RNode, resourcePath string) error {
 	// read the OpenAPI definitions
 	def, err := object.Pipe(yaml.LookupCreate(yaml.MappingNode, "openAPI", "definitions"))
 	if err != nil {
@@ -105,6 +119,66 @@ func (l *List) list(object *yaml.RNode, resourcePath string) error {
 	return nil
 }
 
+func (l *List) listSubst(object *yaml.RNode) error {
+	// read the OpenAPI definitions
+	def, err := object.Pipe(yaml.LookupCreate(yaml.MappingNode, "openAPI", "definitions"))
+	if err != nil {
+		return err
+	}
+	if yaml.IsEmpty(def) {
+		return nil
+	}
+
+	// iterate over definitions -- find those that are substitutions
+	err = def.VisitFields(func(node *yaml.MapNode) error {
+		subst := SubstitutionDefinition{}
+
+		// the definition key -- contains the substitution name
+		key := node.Key.YNode().Value
+
+		if !strings.HasPrefix(key, SubstitutionDefinitionPrefix) {
+			// not a substitution -- doesn't have the right prefix
+			return nil
+		}
+
+		substNode, err := node.Value.Pipe(yaml.Lookup(K8sCliExtensionKey, "substitution"))
+		if err != nil {
+			return err
+		}
+		if yaml.IsEmpty(substNode) {
+			// has the substitution prefix, but missing the setter extension
+			return errors.Errorf("missing x-k8s-cli.substitution for %s", key)
+		}
+
+		// unmarshal the yaml for the substitution extension into the definition struct
+		b, err := substNode.String()
+		if err != nil {
+			return err
+		}
+		if err := yaml.Unmarshal([]byte(b), &subst); err != nil {
+			return err
+		}
+
+		if l.Name != "" && l.Name != subst.Name {
+			// not the substitution that was requested by list
+			return nil
+		}
+
+		l.Substitutions = append(l.Substitutions, subst)
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	// sort the substitutions by their name
+	sort.Slice(l.Substitutions, func(i, j int) bool {
+		return l.Substitutions[i].Name < l.Substitutions[j].Name
+	})
+
+	return nil
+}
+
 // count returns the number of fields set by the setter with name
 func (l *List) count(path, name string) (int, error) {
 	s := &Set{Name: name}

kyaml/setters2/list_test.go

@@ -276,7 +276,7 @@ spec:
 
 			// invoke the setter
 			instance := &List{Name: test.setter}
-			err = instance.List(f.Name(), r.Name())
+			err = instance.ListSetters(f.Name(), r.Name())
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}

kyaml/starlark/starlark.go

@@ -1,251 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package starlark
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"strconv"
-
-	"github.com/qri-io/starlib/util"
-	"go.starlark.net/starlark"
-	"sigs.k8s.io/kustomize/kyaml/comments"
-	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/kio/filters"
-	"sigs.k8s.io/kustomize/kyaml/yaml"
-)
-
-// Filter transforms a set of resources through the provided program
-type Filter struct {
-	Name string
-
-	// Program is a starlark script which will be run against the resources
-	Program string
-
-	// URL is the url of a starlark program to fetch and run
-	URL string
-
-	// Path is the path to a starlark program to read and run
-	Path string
-
-	// FunctionConfig is the value to be provided for resourceList.functionConfig as specified by
-	// https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md.
-	FunctionConfig *yaml.RNode
-}
-
-func (sf *Filter) String() string {
-	return fmt.Sprintf("name: %v path: %v url: %v program: %v", sf.Name, sf.Path, sf.URL, sf.Program)
-}
-
-func (sf *Filter) Filter(input []*yaml.RNode) ([]*yaml.RNode, error) {
-	if sf.URL != "" && sf.Path != "" ||
-		sf.URL != "" && sf.Program != "" ||
-		sf.Path != "" && sf.Program != "" {
-		return nil, errors.Errorf("Filter Path, Program and URL are mutually exclusive")
-	}
-
-	// read the program from a file
-	if sf.Path != "" {
-		b, err := ioutil.ReadFile(sf.Path)
-		if err != nil {
-			return nil, err
-		}
-		sf.Program = string(b)
-	}
-
-	// read the program from a URL
-	if sf.URL != "" {
-		err := func() error {
-			resp, err := http.Get(sf.URL)
-			if err != nil {
-				return err
-			}
-			defer resp.Body.Close()
-			b, err := ioutil.ReadAll(resp.Body)
-			if err != nil {
-				return err
-			}
-			sf.Program = string(b)
-			return nil
-		}()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// retain map of inputs to outputs by id so if the name is changed by the
-	// starlark program, we are able to match the same resources
-	value, ids, err := sf.inputToResourceList(input)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	// run the starlark as program as transformation function
-	thread := &starlark.Thread{Name: sf.Name}
-
-	ctx := &Context{
-		resourceList: value,
-	}
-	pd, err := ctx.predeclared()
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-	_, err = starlark.ExecFile(thread, sf.Name, sf.Program, pd)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	results, err := sf.resourceListToOutput(value, ids)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	// starlark will serialize the resources sorting the fields alphabetically,
-	// format them to have a better ordering
-	return filters.FormatFilter{}.Filter(results)
-}
-
-// tuple maps an input resource to the output resource
-type tuple struct {
-	// in is the RNode provided to the starlark program
-	in *yaml.RNode
-	// out is the RNode emitted by the starlark program with the id matching in
-	out *yaml.RNode
-}
-
-// inputToResourceList transforms input into a starlark.Value
-func (sf *Filter) inputToResourceList(
-	input []*yaml.RNode) (starlark.Value, map[int]*tuple, error) {
-	var id int
-	ids := map[int]*tuple{}
-
-	// convert into a ResourceList which will be converted to a starlark dictionary
-	// create the ResourceList
-	resourceList, err := yaml.Parse(`kind: ResourceList`)
-	if err != nil {
-		return nil, nil, errors.Wrap(err)
-	}
-
-	// set the functionConfig
-	if sf.FunctionConfig != nil {
-		if err := resourceList.PipeE(
-			yaml.FieldSetter{Name: "functionConfig", Value: sf.FunctionConfig}); err != nil {
-			return nil, nil, err
-		}
-	}
-
-	// the inputs should be provided as the list "items"
-	items, err := resourceList.Pipe(yaml.LookupCreate(yaml.SequenceNode, "items"))
-	if err != nil {
-		return nil, nil, errors.Wrap(err)
-	}
-	// add the input as items, give each resource an id
-	for i := range input {
-		item := input[i]
-
-		// create an id for tracking the resource through the program
-		err := item.PipeE(yaml.SetAnnotation("config.k8s.io/id", fmt.Sprintf("%d", id)))
-		if err != nil {
-			return nil, nil, errors.Wrap(err)
-		}
-		ids[id] = &tuple{in: item}
-		id++
-
-		items.YNode().Content = append(items.YNode().Content, item.YNode())
-	}
-
-	// convert the ResourceList into a starlark dictionary by
-	// first converting it into a map[string]interface{}
-	value, err := nodeToValue(resourceList)
-	return value, ids, err
-}
-
-// resourceListToOutput converts the output of the starlark program to the filter output
-func (sf *Filter) resourceListToOutput(
-	value starlark.Value, ids map[int]*tuple) ([]*yaml.RNode, error) {
-	// convert the modified resourceList back into a slice of RNodes
-	// by first converting to a map[string]interface{}
-	out, err := util.Unmarshal(value)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-	o := out.(map[string]interface{})
-
-	// parse the function config
-	if _, found := o["functionConfig"]; found {
-		fc := (o["functionConfig"].(map[string]interface{}))
-		b, err := yaml.Marshal(fc)
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-		sf.FunctionConfig, err = yaml.Parse(string(b))
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-	}
-
-	// parse the items
-	// copy the items out of the ResourceList, and into the Filter output
-	var results []*yaml.RNode
-	it := (o["items"].([]interface{}))
-	for i := range it {
-		// convert the resource back to the native yaml form
-		b, err := yaml.Marshal(it[i])
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-		node, err := yaml.Parse(string(b))
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-
-		// match it to an input
-		idS, err := node.Pipe(yaml.GetAnnotation("config.k8s.io/id"))
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-		if idS == nil {
-			// no matching input -- new resource
-			results = append(results, node)
-			continue
-		}
-
-		id, err := strconv.Atoi(idS.YNode().Value)
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-		if match, found := ids[id]; found {
-			// matching resources
-			match.out = node
-		} else {
-			// no matching input with the same id -- new resource
-			// this may be an error case, the outputs probably shouldn't have ids
-			// assigned by the starlark program
-			results = append(results, node)
-		}
-	}
-
-	// retain the comments instead of dropping them by copying them from the original inputs
-	for i := 0; i < len(ids); i++ {
-		v := ids[i]
-		if v.out == nil {
-			continue
-		}
-		if err := comments.CopyComments(v.in, v.out); err != nil {
-			return nil, errors.Wrap(err)
-		}
-		results = append(results, v.out)
-	}
-
-	// delete the ids from resources, these were only to track through the starlark program
-	// and that is finished.
-	for i := range results {
-		err := results[i].PipeE(yaml.ClearAnnotation("config.k8s.io/id"))
-		if err != nil {
-			return nil, err
-		}
-	}
-	return results, nil
-}

plugin/someteam.example.com/v1/chartinflator/ChartInflator

@@ -17,7 +17,7 @@
 #  chartVersion: 9.0.1
 #  helmHome: /abs/path/to/helm/config
 #  helmBin: /abs/path/to/helmBin
-#  releaseNam: nameOfHelmRelease
+#  releaseName: nameOfHelmRelease
 #  releaseNamespace: namespaceWhereHelmWouldApply
 #
 # fetches the given chart from stable/$chartName,

travis/kyaml-pre-commit.sh

@@ -18,6 +18,9 @@ functions/examples/validator-resource-requests
 functions/examples/application-cr
 "
 
+# don't run e2e tests in CI by default
+export KUSTOMIZE_DOCKER_E2E=${KUSTOMIZE_DOCKER_E2E:-"false"}
+
 for target in $targets; do
   echo "----- Making $target -----"
   pushd .