Merge pull request #6044 from koba1t/fix/namespace_propagation_problem_at_v5.8.0

Fix namespace propagation problem at v5.8.0

.dockerignore

@@ -1,7 +1,5 @@
 .github
 docs
 examples
-hack
-site
 travis
 *.md

.github/dependabot.yml

@@ -4,3 +4,11 @@ updates:
   directory: "/"
   schedule:
       interval: "weekly"
+
+- package-ecosystem: gomod
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 10
+  vulnerability-alerts:
+    enabled: true

.github/workflows/apidiff.yml

@@ -13,15 +13,15 @@ jobs:
     if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - name: Clone the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.work
       - name: Execute go-apidiff
-        uses: joelanford/go-apidiff@v0.6.0
+        uses: joelanford/go-apidiff@v0.8.3
         with:
           compare-imports: true
           print-compatible: true

.github/workflows/go.yml

@@ -2,86 +2,157 @@ name: Go
 
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 permissions:
   contents: read
 
 jobs:
-  lint:
-    name: Lint
+  ## TODO: conditional-changes checker is not working
+  conditional-changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      doc: ${{ steps.filter.outputs.doc }}
+    steps:
+    - uses: actions/checkout@v6
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: |
+          doc:
+            - 'site/**'
+
+  check-modules:
+    name: check-synced-go-modules
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
+      id: go
+    - name: sync go modules
+      run: make workspace-sync
+    - name: check for changes with 'make workspace-sync'
+      run: git diff --exit-code
+
+  lint:
+    name: Lint
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
+    runs-on: [ubuntu-latest]
+    steps:
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
     - name: Lint
       run: make lint
     - name: Verify boilerplate
       run: make check-license
 
-  test-linux:
+  ## Test all modules without plugins and released modules
+  test-non-released-modules:
     name: Test Linux
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
-    - name: Test all modules
-      run: make test-unit-non-plugin
+    - name: Test all modules without plugins and released modules
+      run: make test-unit-non-plugin-and-non-released
       env:
         KUSTOMIZE_DOCKER_E2E: true
 
-  test-macos:
-    name: Test MacOS
-    runs-on: [macos-latest]
+  test-modules:
+    name: Test ${{ matrix.os }} - ${{ matrix.module }}
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        module:
+        - kyaml
+        - cmd/config
+        - api
+        - kustomize
+        include:
+        - module: kyaml
+          test-cmd: go test -race -v -cover ./...
+        - module: cmd/config
+          test-cmd: go test -v -cover ./...
+        - module: api
+          test-cmd: go test -v -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.buildDate=2023-01-31T23:38:41Z -X sigs.k8s.io/kustomize/api/provenance.version=(test)"
+        - module: kustomize
+          test-cmd: go test -v -cover ./...
+        - os: ubuntu-latest
+          docker-e2e: true
+        - os: macos-latest
+          docker-e2e: false
+        - os: windows-latest
+          docker-e2e: false
+    env:
+      KUSTOMIZE_DOCKER_E2E: ${{ matrix.docker-e2e }}
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
-    - name: Test all modules
-      run: make test-unit-non-plugin
-      env:
-        KUSTOMIZE_DOCKER_E2E: false # docker not installed on mac
+    - name: Test ${{ matrix.module }}
+      run: ${{ matrix.test-cmd }}
+      # TODO (#4001): replace specific modules above with this once Windows tests are passing.
+      if: ${{ !(matrix.os == 'windows-latest' && (matrix.module == 'api' || matrix.module == 'kustomize')) }}
+      working-directory: ./${{ matrix.module }}
 
-  test-windows:
-    name: Test Windows
-    runs-on: [windows-latest]
+  # Aggregation matrix tests from test-modules for branch protection rules
+  test-modules-summary:
+    name: Test Summary
+    runs-on: ubuntu-latest
+    needs: test-modules
+    if: always()
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v3
-      with:
-        go-version-file: go.work
-      id: go
-    - name: Test kyaml
-      run: go test -cover ./...
-      working-directory: ./kyaml
-    - name: Test cmd/config
-      run: go test -cover ./...
-      working-directory: ./cmd/config
-      env:
-        KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet
-
-    # TODO (#4001): replace specific modules above with this once Windows tests are passing.
-    #- name: Test all modules
-    #  run: make test-unit-non-plugin
-    #  env:
-    #    KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet
+    - name: Check test results
+      run: |
+        if [[ "${{ needs.test-modules.result }}" != "success" ]]; then
+          echo "Some tests failed or were cancelled"
+          exit 1
+        fi
+        echo "All tests passed successfully"

.github/workflows/release.yaml

@@ -1,5 +1,8 @@
 name: release
 
+permissions:
+  contents: write # Allow actions to update dependabot PRs
+
 on:
   push:
     tags:
@@ -13,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version-file: go.work
       id: go

.gitignore

@@ -31,3 +31,4 @@ site/.hugo_build.lock
 
 # goreleaser artifacts
 **/dist/
+/output/

.golangci.yml

@@ -3,12 +3,13 @@
 
 run:
   deadline: 5m
-  go: '1.20'
+  go: "1.24"
 
 linters:
   enable-all: true
   disable:
     - cyclop
+    - depguard
     - exhaustivestruct
     - forbidigo
     - funlen
@@ -24,7 +25,9 @@ linters:
     - nlreturn
     - noctx
     - paralleltest
+    - perfsprint
     - stylecheck
+    - testifylint
     - varnamelen
     - wsl
     - exhaustruct
@@ -34,6 +37,16 @@ linters:
     - golint
     - maintidx
     - nosnakecase
+    - testpackage # it's better to keep tests in the same package for now because kustomize does open box testing
+    - structcheck # abandoned by author
+    - varcheck # abandoned by author
+    - maligned # abandoned by author
+    - interfacer # archived by author
+    # TODO(koba1t): temporarily disabled, will be addressed after upgrading to Go 1.24
+    - usetesting
+    - mnd
+    - copyloopvar
+    - intrange
 
 linters-settings:
   dupl:
@@ -44,14 +57,14 @@ linters-settings:
     min-complexity: 30
   revive:
     rules:
-    - name: var-naming
-      arguments:
-      - [ "ID", "API", "JSON" ] # AllowList
-      - [ ] # DenyList
+      - name: var-naming
+        arguments:
+          - ["ID", "API", "JSON"] # AllowList
+          - [] # DenyList
   gomnd:
     ignored-functions:
-    - os.WriteFile
-    - make
+      - os.WriteFile
+      - make
   gomoddirectives:
     replace-local: true
   gosec:

CONTRIBUTING.md

@@ -13,6 +13,7 @@
 [CNCF Code of Conduct]: https://github.com/cncf/foundation/blob/master/code-of-conduct.md
 [Kubernetes Community Membership]: https://github.com/kubernetes/community/blob/master/community-membership.md
 
+[Kustomize Architecture]: ARCHITECTURE.md
 [Contribution Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/
 [MacOS Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/mac/
 [Windows Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/windows/
@@ -25,13 +26,113 @@ _As contributors and maintainers of this project, and in the interest of fosteri
 
 ## Getting Started
 
-Dev guides:
+### Forking Kustomize and Working Locally
+The Kustomize project uses a "Fork and Pull" workflow that is standard to GitHub. In git terms, your personal fork is referred to as the "origin" and the actual project's git repository is called "upstream". To keep your personal branch (origin) up to date with the project (upstream), it must be configured within your local working copy.
 
-- [Contribution Guide]
-- [MacOS Dev Guide]
-- [Windows Dev Guide]
+### Create a fork in GitHub
+1. Visit https://github.com/kubernetes-sigs/kustomize
+2. Click the `Fork` button on the top right
 
-General resources for contributors:
+### Clone the repository
+```bash
+# Clone your repository fork from the previous step
+git clone --recurse-submodules git@github.com:<your github username>/kustomize.git
+cd kustomize
+
+# Configure upstream
+git remote add upstream https://github.com/kubernetes-sigs/kustomize
+git remote set-url --push upstream no_push
+
+# Review git configuration
+git remote -v
+```
+
+### Create a working branch
+```bash
+# Fetch changes from upstream master
+cd kustomize
+git fetch upstream
+git checkout master
+git rebase upstream/master
+
+# Create your working branch
+git checkout -b myfeature
+```
+
+### Sync your working branch
+You will need to periodically fetch changes from the `upstream` repository to keep your working branch in sync.
+```bash
+cd kustomize
+git fetch upstream
+git checkout myfeature
+git rebase upstream/master
+```
+
+### Push to GitHub
+When your changes are ready for review, push your working branch to your fork on GitHub.
+```bash
+cd kustomize
+git push origin myfeature
+```
+
+### Pull Request Rules
+
+We are using [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) as the main guideline of making PR. This guideline serves to help contributor and maintainer to classify their changes, thus providing better insight on type of release will be covered on each Kustomize release cycle.
+
+1. Please add these keywords on your PR titles accordingly
+
+| Keyword  | Description | Example |
+| ------------- | ------------- | ------------- |
+| fix  | Patching or fixing bugs or improvements introduction from previous release. This type of change will mark a `PATCH` release.  | fix: fix null value when generating yaml |
+| feat  | New features. This change will mark a `MINOR` release. | feat: new transformer and generator for ACME API CRD. |
+| chore  | Minor improvement outside main code base  | chore: add exclusion for transformer test. |
+| ci | CI/CD related changes (e.g. github workflow, scripts, CI steps). | ci: remove blocking tests |
+| docs  | Changes related to documentation. | docs: add rules documentation for PR. |
+
+
+2. Add `BREAKING CHANGE:` on your commit message as footer to signify breaking changes. This will help maintainers identify `MAJOR` releases.
+  
+Example:
+
+```
+feat: change YAML parser from `yaml/v1` to `yaml/v2`
+
+BREAKING CHANGE: parse() function now works with 2 arguments.
+```
+
+### Create a Pull Request
+
+1. Visit your fork at `https://github.com/<user>/kustomize`
+2. Click the **Compare & Pull Request** button next to your `myfeature` branch.
+3. Check out the pull request [process](https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md) for more details and advice.
+
+If you ran `git push` in the previous step, GitHub will return a useful link to create a Pull Request.
+
+### Build Kustomize
+The [Kustomize Architecture] document describes the respository organization and the kustomize build process.
+```bash
+# For go version >= 1.13
+unset GOPATH
+unset GO111MODULES
+
+# Build kustomize binary and install in go bin path
+cd kustomize
+make kustomize
+
+# Run unit tests
+make test-unit-all
+
+# Run linter
+make lint
+
+# Test examples against HEAD
+make test-examples-kustomize-against-HEAD
+
+# Run your development version
+~/go/bin/kustomize version
+```
+
+### General resources for contributors
 
 - [Contributor License Agreement] - Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests.
 - [Kubernetes Contributor Guide] - Main contributor documentation.
@@ -166,10 +267,8 @@ behavior, do your best to explain to the user why this is the case.
 - If it seems to be a genuine bug, you can /triage accept the issue. In addition, investigate if there are workarounds or
 alternative solutions for the user that they can try until the issue gets resolved.
 
-Administrative notes:
-
-- The [OWNERS file spec] is a useful resources in making changes.
-- Maintainers and admins must be added to the appropriate lists in both [Kustomize OWNERS_ALIASES] and [SIG-CLI Teams]. If this isn't done, the individual in question will lack either PR approval rights (Kustomize list) or the appropriate Github repository permissions (community list).
+The triage party for kustomize is here https://cli.triage.k8s.io/s/kustomize and can be a easy way to
+find issues that have not been triaged yet.
 
 ## Project/Product Managers
 
@@ -194,6 +293,11 @@ You will also be asked to help with roadmap planning, deprecation communication,
 and doing research on kustomize usage when appropriate, though these responsibilities will occur less
 frequently.
 
+## Administrative notes:
+
+- The [OWNERS file spec] is a useful resources in making changes.
+- Maintainers and admins must be added to the appropriate lists in both [Kustomize OWNERS_ALIASES] and [SIG-CLI Teams]. If this isn't done, the individual in question will lack either PR approval rights (Kustomize list) or the appropriate Github repository permissions (community list).
+
 ## Contact Information
 
 - [Slack channel]

Makefile

@@ -3,7 +3,7 @@
 #
 # Makefile for kustomize CLI and API.
 
-LATEST_RELEASE=v5.1.1
+LATEST_RELEASE=v5.8.0
 
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)
@@ -56,26 +56,24 @@ uninstall-local-tools:
 
 # Build from local source.
 $(MYGOBIN)/gorepomod:
-	cd cmd/gorepomod; \
-	go install .
+	cd cmd/gorepomod && go install .
 
 # Build from local source.
 $(MYGOBIN)/k8scopy:
-	cd cmd/k8scopy; \
-	go install .
+	cd cmd/k8scopy && go install .
 
 # Build from local source.
 $(MYGOBIN)/pluginator:
-	cd cmd/pluginator; \
-	go install .
+	cd cmd/pluginator && go install .
 
 
 # --- Build targets ---
 
 # Build from local source.
 $(MYGOBIN)/kustomize: build-kustomize-api
-	cd kustomize; \
-	go install -ldflags "-X sigs.k8s.io/kustomize/api/provenance.buildDate=$(shell date -u +'%Y-%m-%dT%H:%M:%SZ')" \
+	cd kustomize && go install -ldflags \
+	"-X sigs.k8s.io/kustomize/api/provenance.buildDate=$(shell date -u +'%Y-%m-%dT%H:%M:%SZ') \
+	 -X sigs.k8s.io/kustomize/api/provenance.version=$(shell git describe --tags --always --dirty)" \
 	.
 
 kustomize: $(MYGOBIN)/kustomize
@@ -84,11 +82,11 @@ kustomize: $(MYGOBIN)/kustomize
 # plugin-to-api compatibility checks.
 .PHONY: build-kustomize-api
 build-kustomize-api: $(MYGOBIN)/goimports $(builtinplugins)
-	cd api; $(MAKE) build
+	cd api && $(MAKE) build
 
 .PHONY: generate-kustomize-api
 generate-kustomize-api:
-	cd api; $(MAKE) generate
+	cd api && $(MAKE) generate
 
 
 # --- Verification targets ---
@@ -130,29 +128,29 @@ lint: $(MYGOBIN)/golangci-lint $(MYGOBIN)/goimports $(builtinplugins)
 	./hack/for-each-module.sh "make lint"
 
 .PHONY: apidiff
-apidiff: go-apidiff ## Run the go-apidiff to verify any API differences compared with origin/master
-	$(GOBIN)/go-apidiff master --compare-imports --print-compatible --repo-path=.
-
-.PHONY: go-apidiff
-go-apidiff:
-	go install github.com/joelanford/go-apidiff@v0.6.0
+apidiff: $(MYGOBIN)/go-apidiff ## Run the go-apidiff to verify any API differences compared with origin/master
+	go-apidiff master --compare-imports --print-compatible --repo-path=.
 
 .PHONY: test-unit-all
 test-unit-all: \
 	test-unit-non-plugin \
 	test-unit-kustomize-plugins
 
-# This target is used by our Github Actions CI to run unit tests for all non-plugin modules in multiple GOOS environments.
 .PHONY: test-unit-non-plugin
 test-unit-non-plugin:
-	./hack/for-each-module.sh "make test" "./plugin/*" 16
+	./hack/for-each-module.sh "make test" "./plugin/*" 20
+
+# This target is used by our Github Actions CI to run unit tests for all non-plugin and non-released modules in multiple GOOS environments.
+.PHONY: test-unit-non-plugin-and-non-released
+test-unit-non-plugin-and-non-released:
+	./hack/for-each-module.sh "make test" "./plugin/*|./kyaml/go.mod|./cmd/config/go.mod|./api/go.mod|./kustomize/go.mod" 16
 
 .PHONY: build-non-plugin-all
 build-non-plugin-all:
-	./hack/for-each-module.sh "make build" "./plugin/*" 16
+	./hack/for-each-module.sh "make build" "./plugin/*" 20
 
 .PHONY: test-unit-kustomize-plugins
-test-unit-kustomize-plugins:
+test-unit-kustomize-plugins: build-kustomize-external-go-plugin
 	./hack/testUnitKustomizePlugins.sh
 
 .PHONY: functions-examples-all
@@ -189,7 +187,7 @@ test-examples-kustomize-against-latest-release: $(MYGOBIN)/mdrip
 workspace-sync:
 	go work sync
 	./hack/doGoMod.sh tidy
-	
+
 # --- Cleanup targets ---
 .PHONY: clean
 clean: clean-kustomize-external-go-plugin uninstall-tools

Makefile-plugins.mk

@@ -96,10 +96,10 @@ generate-kustomize-builtin-plugins: $(builtplugins)
 		echo "generating $${plugin} ..."; \
 		set -e; \
 		cd $${plugin}; \
-		go generate pluginator .; \
+		go generate .; \
 	done
 
-# Check for diff by comparing current revision of generated plugins on HEAD and newly generated plugins on local branch, 
+# Check for diff by comparing current revision of generated plugins on HEAD and newly generated plugins on local branch,
 # If diff is found, throw error code 1
 .PHONY: builtin-plugins-diff
 builtin-plugins-diff: $(builtplugins)
@@ -107,7 +107,9 @@ builtin-plugins-diff: $(builtplugins)
 		echo "Checking for diff... $${file}" ; \
 		set -e ; \
 		if [ "`git diff $${file} | wc -c`" -gt 0 ]; then\
-			echo "Error(1): diff found on $${file}"; exit 1; \
+			echo "Error(1): diff found on $${file}"; \
+			git diff $${file};\
+			exit 1;\
 		fi \
 	done
 

Makefile-tools.mk

@@ -1,14 +1,16 @@
 # Copyright 2022 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-GOLANGCI_LINT_VERSION=v1.51.2
-
+GOOS = $(shell go env GOOS)
+GOARCH = $(shell go env GOARCH)
 MYGOBIN = $(shell go env GOBIN)
 ifeq ($(MYGOBIN),)
 MYGOBIN = $(shell go env GOPATH)/bin
 endif
 export PATH := $(MYGOBIN):$(PATH)
 
+REPO_ROOT=$(shell git rev-parse --show-toplevel)
+
 # determines whether to run tests that only behave locally; can be overridden by override variable
 export IS_LOCAL = false
 
@@ -18,8 +20,7 @@ install-out-of-tree-tools: \
 	$(MYGOBIN)/golangci-lint \
 	$(MYGOBIN)/helmV3 \
 	$(MYGOBIN)/mdrip \
-	$(MYGOBIN)/stringer \
-	$(MYGOBIN)/goimports
+	$(MYGOBIN)/stringer
 
 .PHONY: uninstall-out-of-tree-tools
 uninstall-out-of-tree-tools:
@@ -29,67 +30,61 @@ uninstall-out-of-tree-tools:
 	rm -f $(MYGOBIN)/mdrip
 	rm -f $(MYGOBIN)/stringer
 
+.PHONY: $(MYGOBIN)/golangci-lint
 $(MYGOBIN)/golangci-lint:
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
+	cd $(REPO_ROOT)/hack && go install github.com/golangci/golangci-lint/cmd/golangci-lint
 
+.PHONY: $(MYGOBIN)/mdrip
 $(MYGOBIN)/mdrip:
-	go install github.com/monopole/mdrip@v1.0.2
+	cd $(REPO_ROOT)/hack && go install github.com/monopole/mdrip
 
+.PHONY: $(MYGOBIN)/stringer
 $(MYGOBIN)/stringer:
-	go install golang.org/x/tools/cmd/stringer@latest
+	cd $(REPO_ROOT)/hack && go install golang.org/x/tools/cmd/stringer
 
+.PHONY: $(MYGOBIN)/goimports
 $(MYGOBIN)/goimports:
-	go install golang.org/x/tools/cmd/goimports@latest
+	cd $(REPO_ROOT)/hack && go install golang.org/x/tools/cmd/goimports
 
+.PHONY: $(MYGOBIN)/mdtogo
 $(MYGOBIN)/mdtogo:
-	go install sigs.k8s.io/kustomize/cmd/mdtogo@latest
+	cd $(REPO_ROOT)/hack && go install sigs.k8s.io/kustomize/cmd/mdtogo
 
+.PHONY: $(MYGOBIN)/addlicense
 $(MYGOBIN)/addlicense:
-	go install github.com/google/addlicense@latest
-
-$(MYGOBIN)/goreleaser:
-	go install github.com/goreleaser/goreleaser@v0.179.0 # https://github.com/kubernetes-sigs/kustomize/issues/4542
+	cd $(REPO_ROOT)/hack && go install github.com/google/addlicense
 
+.PHONY: $(MYGOBIN)/kind
 $(MYGOBIN)/kind:
-	( \
-        set -e; \
-        d=$(shell mktemp -d); cd $$d; \
-        wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-$(GOOS)-$(GOARCH); \
-        chmod +x ./kind; \
-        mv ./kind $(MYGOBIN); \
-        rm -rf $$d; \
-	)
+	cd $(REPO_ROOT)/hack && go install sigs.k8s.io/kind
 
-# linux only.
+.PHONY: $(MYGOBIN)/controller-gen
+$(MYGOBIN)/controller-gen:
+	cd $(REPO_ROOT)/hack && go install sigs.k8s.io/controller-tools/cmd/controller-gen
+
+.PHONY: $(MYGOBIN)/embedmd
+$(MYGOBIN)/embedmd:
+	cd $(REPO_ROOT)/hack && go install github.com/campoy/embedmd
+
+.PHONY: $(MYGOBIN)/go-bindata
+$(MYGOBIN)/go-bindata:
+	cd $(REPO_ROOT)/hack && go install github.com/go-bindata/go-bindata/v3/go-bindata
+
+.PHONY: $(MYGOBIN)/go-apidiff
+$(MYGOBIN)/go-apidiff:
+	cd $(REPO_ROOT)/hack && go install github.com/joelanford/go-apidiff
+
+.PHONY: $(MYGOBIN)/gh
 $(MYGOBIN)/gh:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=gh_1.0.0_$(GOOS)_$(GOARCH).tar.gz; \
-		wget https://github.com/cli/cli/releases/download/v1.0.0/$$tgzFile; \
-		tar -xvzf $$tgzFile; \
-		mv gh_1.0.0_$(GOOS)_$(GOARCH)/bin/gh  $(MYGOBIN)/gh; \
-		rm -rf $$d \
-	)
+	cd $(REPO_ROOT)/hack && go install github.com/cli/cli/cmd/gh
 
-# linux only.
-# This is for testing an example plugin that
-# uses kubeval for validation.
-# Don't want to add a hard dependence in go.mod file
-# to github.com/instrumenta/kubeval.
-# Instead, download the binary.
+.PHONY: $(MYGOBIN)/kubeval
 $(MYGOBIN)/kubeval:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		wget https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-$(GOOS)-$(GOARCH).tar.gz; \
-		tar xf kubeval-$(GOOS)-$(GOARCH).tar.gz; \
-		mv kubeval $(MYGOBIN); \
-		rm -rf $$d; \
-	)
+	cd $(REPO_ROOT)/hack && go install github.com/instrumenta/kubeval
 
 # Helm V3 differs from helm V2; downloading it to provide coverage for the
 # chart inflator plugin under helm v3.
+.PHONY: $(MYGOBIN)/helmV3
 $(MYGOBIN)/helmV3:
 	( \
 		set -e; \

OWNERS_ALIASES

@@ -3,18 +3,25 @@
 aliases:
   kustomize-owners:
     - knverey
-    - natasha41575
+    - koba1t
   kustomize-approvers:
     - knverey
-    - natasha41575
-    - annasong20
     - koba1t
+    - varshaprasad96
   kustomize-reviewers:
     - knverey
-    - natasha41575
-    - yuwenma
-    - annasong20
     - koba1t
+    - varshaprasad96
+    - ncapps
+
+  docs-approvers:
+    - ncapps
+  docs-reviewers:
+    - ncapps
+
+  commands-approvers: []
+  commands-reviewers: []
+
   #  emeritus:
   #    - liujingfang1
   #    - Shell32-Natsu
@@ -24,3 +31,6 @@ aliases:
   #    - mengqiy
   #    - mortent
   #    - phanimarupaka
+  #    - natasha41575
+  #    - annasong20
+  #    - yuwenma

README.md

@@ -23,9 +23,9 @@ This tool is sponsored by [sig-cli] ([KEP]).
 To find the kustomize version embedded in recent versions of kubectl, run `kubectl version`:
 
 ```sh
-> kubectl version --short --client
-Client Version: v1.26.0
-Kustomize Version: v4.5.7
+> kubectl version --client
+Client Version: v1.31.0
+Kustomize Version: v5.4.2
 ```
 
 The kustomize build flow at [v2.0.3] was added
@@ -76,18 +76,18 @@ kustomization.yaml                                      deployment.yaml
 +---------------------------------------------+         +-------------------------------------------------------+       +-----------------------------------+
 | apiVersion: kustomize.config.k8s.io/v1beta1 |         | apiVersion: apps/v1                                   |       | apiVersion: v1                    |
 | kind: Kustomization                         |         | kind: Deployment                                      |       | kind: Service                     |
-|.commonLabels:                               |         | metadata:                                             |       | metadata:                         |
-|   app: myapp                                |         |   name: myapp                                         |       |   name: myapp                     |
-| resources:                                  |         | spec:                                                 |       | spec:                             |
-|   - deployment.yaml                         |         |   selector:                                           |       |   selector:                       |
-|   - service.yaml                            |         |     matchLabels:                                      |       |     app: myapp                    |
-| configMapGenerator:                         |         |       app: myapp                                      |       |   ports:                          |
-|   - name: myapp-map                         |         |   template:                                           |       |     - port: 6060                  |
-|     literals:                               |         |     metadata:                                         |       |       targetPort: 6060            |
-|       - KEY=value                           |         |       labels:                                         |       +-----------------------------------+
-+---------------------------------------------+         |         app: myapp                                    |
-                                                        |     spec:                                             |
-                                                        |       containers:                                     |
+| labels:                                     |         | metadata:                                             |       | metadata:                         |
+| - includeSelectors: true                    |         |   name: myapp                                         |       |   name: myapp                     |
+|   pairs:                                    |         | spec:                                                 |       | spec:                             |
+|     app: myapp                              |         |   selector:                                           |       |   selector:                       |
+| resources:                                  |         |     matchLabels:                                      |       |     app: myapp                    |
+|   - deployment.yaml                         |         |       app: myapp                                      |       |   ports:                          |
+|   - service.yaml                            |         |   template:                                           |       |     - port: 6060                  |
+| configMapGenerator:                         |         |     metadata:                                         |       |       targetPort: 6060            |
+|   - name: myapp-map                         |         |       labels:                                         |       +-----------------------------------+
+|     literals:                               |         |         app: myapp                                    |
+|       - KEY=value                           |         |     spec:                                             |
++---------------------------------------------+         |       containers:                                     |
                                                         |         - name: myapp                                 |
                                                         |           image: myapp                                |
                                                         |           resources:                                  |
@@ -142,16 +142,16 @@ kustomization.yaml                                      replica_count.yaml
 +-----------------------------------------------+       +-------------------------------+       +------------------------------------------+
 | apiVersion: kustomize.config.k8s.io/v1beta1   |       | apiVersion: apps/v1           |       | apiVersion: apps/v1                      |
 | kind: Kustomization                           |       | kind: Deployment              |       | kind: Deployment                         |
-| commonLabels:                                 |       | metadata:                     |       | metadata:                                |  
-|   variant: prod                               |       |   name: myapp                 |       |   name: myapp                            |
-| resources:                                    |       | spec:                         |       | spec:                                    |
-|   - ../../base                                |       |   replicas: 80                |       |  template:                               |
-| patches:                                      |       +-------------------------------+       |     spec:                                |
-|   - path: replica_count.yaml                  |                                               |       containers:                        |
-|   - path: cpu_count.yaml                      |                                               |         - name: myapp                    |  
-+-----------------------------------------------+                                               |           resources:                     |
-                                                                                                |             limits:                      |
-                                                                                                |               memory: "128Mi"            |
+| labels:                                       |       | metadata:                     |       | metadata:                                |
+|  - includeSelectors: true                     |       |   name: myapp                 |       |   name: myapp                            |
+|    pairs:                                     |       | spec:                         |       | spec:                                    |
+|      variant: prod                            |       |   replicas: 80                |       |  template:                               |
+| resources:                                    |       +-------------------------------+       |     spec:                                |
+|   - ../../base                                |                                               |       containers:                        |
+| patches:                                      |                                               |         - name: myapp                    |
+|   - path: replica_count.yaml                  |                                               |           resources:                     |
+|   - path: cpu_count.yaml                      |                                               |             limits:                      |
++-----------------------------------------------+                                               |               memory: "128Mi"            |
                                                                                                 |               cpu: "7000m"               |
                                                                                                 +------------------------------------------+
 ```

ROADMAP.md

@@ -1,112 +1,185 @@
-# Kustomize roadmap 2022
+# Kustomize roadmap 2023-2024
 
-Presented at the [January 26, 2022, SIG-CLI meeting](https://youtu.be/l2plzJ9MRlk?t=1321)
+This document describes the items that we hope to make progress on over the next
+1 year (H2 2023 and H1 2024). Take this roadmap as more of what we hope to achieve
+rather than what we promise to achieve, as some items in this doc are highly dependent
+on the success that we have on-ramping new contributors to the project, and other
+items will depend on external contributions, which can vary.
 
-kustomize maintainers: @knverey, @natasha41575
+If you are interested in contributing to a particular area, you can look through
+the project board for that area and assign yourself to one of the issues. It is
+recommended to start with smaller issues to ramp up on the project before starting
+to tackle larger issues.
 
-[Objective: Improve contributor community](#objective-improve-contributor-community)
+Project boards:
+https://github.com/orgs/kubernetes-sigs/projects/50
+https://github.com/orgs/kubernetes-sigs/projects/51
+https://github.com/orgs/kubernetes-sigs/projects/52
+https://github.com/orgs/kubernetes-sigs/projects/53
+https://github.com/orgs/kubernetes-sigs/projects/54
 
-[Objective: Improve end-user experience](#objective-improve-end-user-experience)
+## Kustomize contributors (at time of writing):
 
-[Objective: Improve extension experience](#objective-improve-extension-experience)
+kustomize owner: @natasha41575
 
-## Objective: Improve contributor community
+kustomize maintainers: @annasong20, @koba1t
 
-**_WHO: End user who also contributes source code._**
-
-Top priority:
-
-- Kustomization v1 (also end-user impact) ([PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/12))
-  - Remove the following fields:
-    - [vars](https://github.com/kubernetes-sigs/kustomize/issues/2052)
-    - [patchesJson6902, patchesStrategicMerge (consolidate on \`patches)](https://github.com/kubernetes-sigs/kustomize/issues/4376)
-    - [helmChartInflationGenerator, helmCharts, helmGlobals](https://github.com/kubernetes-sigs/kustomize/issues/4401)
-    - all long-deprecated fields in Kustomization v1 such as \`bases\` and those being accommodate by kustomize edit \[[see code snippet](https://github.com/kubernetes-sigs/kustomize/blob/ee4b7847f0beb6c0d2070673b10f23f7b3e92e82/api/types/fix.go#L15)\]
-  - Ensure that \`kustomize edit fix\` handles migrations for all those, and that anything it changes is not still present in v1.
-  - [Add reorder field](https://github.com/kubernetes-sigs/kustomize/issues/3913). Default should be FIFO and legacy should also be supported (could add alphabetic and custom sort support eventually). Replaces -reorder flag.
-  - [Reconcile openapi and crds field](https://github.com/kubernetes-sigs/kustomize/issues/3944)
-  - [Consider deprecating configurations field](https://github.com/kubernetes-sigs/kustomize/issues/3945) (old, pre-plugin, pre-openapi global configuration)
-  - [Add a field to enable the managedby label](https://github.com/kubernetes-sigs/kustomize/issues/4047)
-
-Second priority:
-
-- Improve contributor documentation
-  - [Instructions to upgrade kustomize-in-kubectl](https://github.com/kubernetes-sigs/kustomize/issues/3951)
-
-Also very valuable to the project:
-
-- [Improve the release process](https://github.com/kubernetes-sigs/kustomize/issues/3952) to support regular biweekly releases [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/7)
-- Release sigs.k8s.io/kustomize/api v1.0.0 [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/5)
-  - [Reduce the public surface of the API module](https://github.com/kubernetes-sigs/kustomize/issues/3942)
-  - [Vendor all transitive deps](https://github.com/kubernetes-sigs/kustomize/issues/3706). Since kustomize is in kubectl, we must do as kubectl does to manage deps, exposing new transitive deps in code review.
-- Project administration
-  - [Rename master branch to main](https://github.com/kubernetes-sigs/kustomize/issues/3954)
+kustomize contributors: @varshaprasad96
 
 
+# H2 2023
 
-## Objective: Improve end-user experience
+## Goal: Create kustomize leadership and contributor playbooks
 
-**_WHO: End user that wants kustomize build artifacts (binaries, containers)._**
+Contributors: natasha41575, annasong20
 
-Top priorities:
+Priority: High
 
-- Bug fixes:
-  - Fix bugs in basic anchor support: [issue query](https://github.com/kubernetes-sigs/kustomize/issues?q=is%3Aopen+is%3Aissue+label%3Aarea%2Fanchors)
-  - integer keys support: [#3446](https://github.com/kubernetes-sigs/kustomize/issues/3446)
-  - kyaml not respecting \`$patch replace|retainKeys\`: [#2037](https://github.com/kubernetes-sigs/kustomize/issues/2037)
-  - kustomize removing quotes from namespace field values: [#4146](https://github.com/kubernetes-sigs/kustomize/issues/4146)
-  - Kustomize doesn’t support metadata.generateName: [#641](https://github.com/kubernetes-sigs/kustomize/issues/641)
-- Send kustomize CLI version number into kubectl ([kubectl issue](https://github.com/kubernetes/kubectl/issues/797) / [kustomize issue](https://github.com/kubernetes-sigs/kustomize/issues/1424))
-- Kustomize performance investigations/improvements [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/13)
-- [Support generic resource references in name reference tracking](https://github.com/kubernetes-sigs/kustomize/issues/3418)
-- [KEP 4267: retain the resource origin and transformer data in annotations](https://github.com/kubernetes-sigs/kustomize/pull/4267)
+Effort: Medium
 
-Secondary priorities:
+In the past, when the leads stopped contributing (for various reasons, not covered here)
+in various kubernetes projects, it left a wide hole that few could easily fill,
+leaving the remaining leads in a bad position and the project understaffed. We should assume
+that we will need to onboard new maintainers in the future, and should have playbooks
+for doing so. As we grow the contributor base in kustomize, we will build these playbooks for
+those who are contributing and those who are looking to grow into kustomize leaders.
+To ensure the long term health and stability of the project, we should have:
 
-- kustomize cli v5 ([PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/14))
-  - [Drop the --reorder flag](https://github.com/kubernetes-sigs/kustomize/issues/3947)
-  - [Graduate cfg read-only commands out of alpha](https://github.com/kubernetes-sigs/kustomize/issues/4090).
-  - [Drop the –enable-managedby-label](https://github.com/kubernetes-sigs/kustomize/issues/4047)
-  - Drop old plugin-related fields in favor of [the Catalog-style fields](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2906-kustomize-function-catalog).
-  - [Drop the helm flags](https://github.com/kubernetes-sigs/kustomize/issues/4401)
-- [Confusion around namespace replacement](https://github.com/kubernetes-sigs/kustomize/issues/880).
+- On-boarding guides for new contributors
+- Clear guidelines for how to climb the kustomize ladder from contributor to approver to owner
+- A plan (maybe a schedule) for future kustomize cohorts
+- A succession plan, in case the current kustomize leads ever decide to step down
 
-Also very valuable to the project:
+## Goal: Onboard 2-5 new contributors to kustomize
 
-- [Overinclusion of root directory error in error messages](https://github.com/kubernetes-sigs/kustomize/issues/4348)
-- [Add kustomize localize command](https://github.com/kubernetes-sigs/kustomize/issues/3980)
-- [Fix Windows support in test suite](https://github.com/kubernetes-sigs/kustomize/issues/4001)
-- Improve end-user documentation [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/9)
+Contributors: natasha41575, annasong20, koba1t
 
+Priority: High
 
-## Objective: Improve extension experience
+Effort: High
 
-**_WHO: Plugin developers: end users who extend kustomize, but don’t think about internals._**
+In order to make progress on kustomize goals in the future, we need to increase the
+level of staffing on kustomize. We should leverage community contributions to keep kustomize
+healthy and making progress.
 
-This objective is described in detail in the [Kustomize Plugin Graduation KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2953-kustomize-plugin-graduation) / [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/15) .
+The primary means in which we will try to find new kustomize contributors is through the new kustomize
+maintainer training cohort. We will lead a group of ~20 kubernetes community members through a 3-6 month
+training program, involving talk sessions, bug scrubs, issue triage, PR reviews, and coding projects for
+each member.
 
-Top priorities:
+See [our call for help](https://groups.google.com/a/kubernetes.io/g/dev/c/M5OphEVsv5o/m/zc6G4H15AAAJ) for more
+specific details about the program.
 
-- Fix core usability issues with KRM Function extensions:
-  - [Better errors for function config failures](https://github.com/kubernetes-sigs/kustomize/issues/4398)
-  - [Container KRM Mounts are not mounting via function parameters](https://github.com/kubernetes-sigs/kustomize/issues/4290)
-  - [Resolution of local file references in extensions transformer configuration](https://github.com/kubernetes-sigs/kustomize/issues/4154)
-  - [Do not silently ignore plugins when config has typo](https://github.com/kubernetes-sigs/kustomize/issues/4399)
-  - [KRM Exec Function can't locate executable when referencing a base](https://github.com/kubernetes-sigs/kustomize/issues/4347)
-- Once core usability issues are fixed, [deprecate legacy exec and Go plugin support](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2953-kustomize-plugin-graduation)
-- [Catalog KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2906-kustomize-function-catalog)
+The effort from existing kustomize maintainers here will be to:
+- Organize the cohort, so that each cohort member feels productive and understands what they should work on
+- Align motivation of the cohort members with the work that we assign to them.
+- Review PRs from cohort members in a timely manner.
+- Be the point(s) of contact for questions/escalations
+- Lead weekly stand-ups and monthly bug scrubs
 
-Secondary priorities:
+At the end of all this, if we have a small team of contributors to kustomize, who understand its founding
+philosophy and intentions, we should be able to keep the project up to date.
 
-- [Remove Starlark support](https://github.com/kubernetes-sigs/kustomize/issues/4349)
-- [Composition KEP](https://github.com/kubernetes/enhancements/pull/2300). The implementation is complete in [#4223](https://github.com/kubernetes-sigs/kustomize/pull/4323), but depends on:
-  - [Convert resources and components to be backed by a reusable generator](https://github.com/kubernetes-sigs/kustomize/issues/4402)
-  - [Enable explicitly invoked transformers to use default fieldSpecs](https://github.com/kubernetes-sigs/kustomize/issues/4404)
-  - [Enable built-in generators to be used in the transformers field ](https://github.com/kubernetes-sigs/kustomize/issues/4403)
+## Goal: Improve kustomize extensibility through KRM functions and CRD support
 
+Contributors: koba1t, varshaprasad96, external contributors
 
-Also very valuable to the project:
+Priority: High
 
-- [Improve docs for kyaml libraries](https://github.com/kubernetes-sigs/kustomize/issues/3950), especially by adding examples.
-- [Create a reserved field for plugin runtime information](https://github.com/kubernetes-sigs/kustomize/issues/4405)
-- [Develop new standard process for implementing builtin transformers](https://github.com/kubernetes-sigs/kustomize/issues/4400)
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/53/views/1
+
+For a long time, we have supported KRM functions as the proper way to implement custom generators and transformers.
+However, due to limited staffing, we have been unable to drive this feature out of alpha in kustomize. The two
+main features which we hope to make progress on are Composition and Catalog, two long-standing proposals for which
+numerous users have been waiting for a long time. There are several open issues
+regarding KRM functions where our long-term answer has been these two features, but users have been hearing about them
+for over a year without seeing any progress. If we can implement them, they will vastly improve usability and security
+of KRM functions.
+
+One item that falls under this category that does not currently have a contributor is improving CRD support.
+Currently, it is difficult to use CRDs properly, as there are three different fields (configurations, openapi, and crds)
+where users have to input their CRD configuration. We need to consolidate these fields into one easy to use feature to
+support CRDs. If you are interested in putting together a design proposal for how to tackle this task, please reach
+out to the kustomize maintainers.
+
+# H1 2024
+
+## Goal: Improve the kustomize documentation
+
+Contributors: annasong20, external contributions
+
+Priority: High
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/50
+
+The kustomize documentation is currently fragmented, out of date, and lacks examples to fully understand its value.
+We have had a "docs project" for a long time; we need to prioritize implementing it so that the documentation is in
+one place, easy to find, and helps new users get started more easily. Some outcomes from this project should be:
+
+- A single, unified website hosted on kustomize.io
+- Updated information architecture, and a plan to keep it up to date
+- End to end examples of using kustomize, including complex use cases
+
+## Goal: Fix core usability bugs in kustomize
+
+Contributors: external contributions
+
+Priority: High
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/51
+
+There are several core usability issues that block some users from adopting kustomize features or in
+some base block users from using kustomize entirely. These issues range from small bugs with workable but
+inconvenient workarounds, to enormous feature gaps.
+
+As part of this goal, we should work toward reducing the number of such issues that we have, making
+kustomize work more smoothly and predictably, and be usable for a larger range of users.
+
+There are a lot of important issues in this project, but the biggest and highest priority one is that
+kustomize doesn't currently support metadata.GenerateName. Unfortunately, we don't currently have anyone
+actively working on this issue, we would need an external contributor to reach out to the kustomize
+maintainers to pick it up.
+
+## Goal: Improve kustomize CI, release, & security patch processes
+
+Contributors: external contributions
+
+Priority: Medium
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/54
+
+The kustomize release process is currently done on-demand and is strictly linear. This means that if we find a CVE,
+we are forced to release the next version of kustomize ASAP, and we are required to release every PR that has merged
+since the last release. This can put us in a sticky situation if we have a breaking change that we are
+not ready to release yet, but we need a patch quickly.
+
+We should try to improve the kustomize release process so that we can release frequently, reliably, and with some
+flexibility. The outcome of this effort should be:
+
+- kustomize is released on a regular cadence (biweekly or monthly)
+- kustomize is able to separate patch and feature releases, so that we can fix CVEs without needing to release
+everything that we have in flight
+- We can detect and fix CVEs early
+
+## Goal: Take long-standing alpha commands out of alpha
+
+Contributors: external contributions
+
+Priority: Medium
+
+Effort: Medium
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/52
+
+There are several commands in kustomize that have been alpha for a long time, including the cfg command group and
+localize. Moving them forward can indicate good health of a project and these commands are useful to many users.
+Some of these projects can be good starter issues for new contributors to have an easier onramp while others will
+require more effort and thought.

SECURITY_CONTACTS

@@ -9,7 +9,7 @@
 #
 # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
 # INSTRUCTIONS AT https://kubernetes.io/security/
-
-monopole
-Liujingfang1
-pwittrock
+eddiezane
+KnVerey
+natasha41575
+soltysh

api/Makefile

@@ -11,3 +11,18 @@ build:
 
 generate: $(MYGOBIN)/k8scopy $(MYGOBIN)/stringer
 	go generate ./...
+
+lint: lint-api-static
+
+## lint-api-static runs the linter on the API module
+## with build-tag kustomize_disable_go_plugin_support
+## this aims to catch any issues with the API module
+## that would prevent the API module from being used
+## when the go plugin support is disabled.
+lint-api-static:
+	$(MYGOBIN)/golangci-lint cache clean # Workaround for https://github.com/golangci/golangci-lint/issues/3228
+	$(MYGOBIN)/golangci-lint \
+	  -c $$KUSTOMIZE_ROOT/.golangci.yml \
+	  --build-tags kustomize_disable_go_plugin_support \
+	  --path-prefix api \
+	  run ./...

api/filters/fieldspec/fieldspec_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/filters/fieldspec"
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/kyaml/kio"
@@ -621,7 +622,7 @@ kind: Pod
 
 		t.Run(name, func(t *testing.T) {
 			err := yaml.Unmarshal([]byte(tc.fieldSpec), &filter.FieldSpec)
-			assert.NoError(t, err)
+			require.NoError(t, err)
 			rw := &kio.ByteReadWriter{
 				Reader:                bytes.NewBufferString(tc.input),
 				Writer:                &bytes.Buffer{},
@@ -635,7 +636,7 @@ kind: Pod
 				Outputs: []kio.Writer{rw},
 			}.Execute()
 
-			assert.NoError(t, err)
+			require.NoError(t, err)
 			assert.Equal(t, tc.expected, fieldPaths)
 		})
 	}

api/filters/imagetag/imagetag_test.go

@@ -879,6 +879,84 @@ spec:
 				},
 			},
 		},
+		"update image volume in pod template": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: imagevolume
+spec:
+  template:
+    spec:
+      volumes:
+      - name: volume
+        image:
+          reference: nginx
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: imagevolume
+spec:
+  template:
+    spec:
+      volumes:
+      - name: volume
+        image:
+          reference: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/volumes[]/image/reference",
+				},
+			},
+		},
+		"update image volume in pod spec": {
+			input: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: imagevolume
+spec:
+  volumes:
+  - name: volume
+    image:
+      reference: nginx
+`,
+			expectedOutput: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: imagevolume
+spec:
+  volumes:
+  - name: volume
+    image:
+      reference: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/volumes[]/image/reference",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/filters/nameref/nameref.go

@@ -205,16 +205,14 @@ func getRoleRefGvk(n *resource.Resource) (*resid.Gvk, error) {
 		return nil, err
 	}
 	if apiGroup.IsNil() {
-		return nil, fmt.Errorf(
-			"apiGroup cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf("apiGroup cannot be found in roleRef %s", roleRef.MustString())
 	}
 	kind, err := roleRef.Pipe(yaml.Lookup("kind"))
 	if err != nil {
 		return nil, err
 	}
 	if kind.IsNil() {
-		return nil, fmt.Errorf(
-			"kind cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf("kind cannot be found in roleRef %s", roleRef.MustString())
 	}
 	return &resid.Gvk{
 		Group: apiGroup.YNode().Value,
@@ -284,9 +282,9 @@ func (f Filter) roleRefFilter() sieveFunc {
 	return previousIdSelectedByGvk(roleRefGvk)
 }
 
-func prefixSuffixEquals(other resource.ResCtx) sieveFunc {
+func prefixSuffixEquals(other resource.ResCtx, allowEmpty bool) sieveFunc {
 	return func(r *resource.Resource) bool {
-		return r.PrefixesSuffixesEquals(other)
+		return r.PrefixesSuffixesEquals(other, allowEmpty)
 	}
 }
 
@@ -325,7 +323,10 @@ func (f Filter) selectReferral(
 	if len(candidates) == 1 {
 		return candidates[0], nil
 	}
-	candidates = doSieve(candidates, prefixSuffixEquals(f.Referrer))
+	candidates = doSieve(candidates, prefixSuffixEquals(f.Referrer, true))
+	if len(candidates) > 1 {
+		candidates = doSieve(candidates, prefixSuffixEquals(f.Referrer, false))
+	}
 	if len(candidates) == 1 {
 		return candidates[0], nil
 	}

api/filters/patchjson6902/patchjson6902.go

@@ -6,7 +6,7 @@ package patchjson6902
 import (
 	"strings"
 
-	jsonpatch "gopkg.in/evanphx/json-patch.v5"
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 	k8syaml "sigs.k8s.io/yaml"

api/filters/replacement/replacement.go

@@ -4,6 +4,7 @@
 package replacement
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 
@@ -11,7 +12,6 @@ import (
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml_utils "sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -23,7 +23,7 @@ type Filter struct {
 // Filter replaces values of targets with values from sources
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	for i, r := range f.Replacements {
-		if r.Source == nil || r.Targets == nil {
+		if (r.SourceValue == nil && r.Source == nil) || r.Targets == nil {
 			return nil, fmt.Errorf("replacements must specify a source and at least one target")
 		}
 		value, err := getReplacement(nodes, &f.Replacements[i])
@@ -39,6 +39,13 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 }
 
 func getReplacement(nodes []*yaml.RNode, r *types.Replacement) (*yaml.RNode, error) {
+	if r.SourceValue != nil && r.Source != nil {
+		return nil, fmt.Errorf("value and resource selectors are mutually exclusive")
+	}
+	if r.SourceValue != nil {
+		return yaml.NewScalarRNode(*r.SourceValue), nil
+	}
+
 	source, err := selectSourceNode(nodes, r.Source)
 	if err != nil {
 		return nil, err
@@ -110,6 +117,10 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 		if len(selector.FieldPaths) == 0 {
 			selector.FieldPaths = []string{types.DefaultReplacementFieldPath}
 		}
+		tsr, err := types.NewTargetSelectorRegex(selector)
+		if err != nil {
+			return nil, fmt.Errorf("error creating target selector: %w", err)
+		}
 		for _, possibleTarget := range nodes {
 			ids, err := utils.MakeResIds(possibleTarget)
 			if err != nil {
@@ -125,9 +136,13 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 				continue
 			}
 
+			if tsr.RejectsAny(ids) {
+				continue
+			}
+
 			// filter targets by matching resource IDs
 			for _, id := range ids {
-				if id.IsSelectedBy(selector.Select.ResId) && !containsRejectId(selector.Reject, ids) {
+				if tsr.Selects(id) {
 					err := copyValueToTarget(possibleTarget, value, selector)
 					if err != nil {
 						return nil, err
@@ -168,43 +183,37 @@ func matchesAnnoAndLabelSelector(n *yaml.RNode, selector *types.Selector) (bool,
 	return annoMatch && labelMatch, nil
 }
 
-func containsRejectId(rejects []*types.Selector, ids []resid.ResId) bool {
-	for _, r := range rejects {
-		if r.ResId.IsEmpty() {
-			continue
-		}
-		for _, id := range ids {
-			if id.IsSelectedBy(r.ResId) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.TargetSelector) error {
 	for _, fp := range selector.FieldPaths {
 		createKind := yaml.Kind(0) // do not create
 		if selector.Options != nil && selector.Options.Create {
 			createKind = value.YNode().Kind
 		}
+
+		// Check if this fieldPath contains structured data access
+		if err := setValueInStructuredData(target, value, fp, createKind); err == nil {
+			// Successfully handled as structured data
+			continue
+		}
+
+		// Fall back to normal path handling
 		targetFieldList, err := target.Pipe(&yaml.PathMatcher{
 			Path:   kyaml_utils.SmarterPathSplitter(fp, "."),
 			Create: createKind})
 		if err != nil {
-			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+			return errors.WrapPrefixf(err, "%s", fieldRetrievalError(fp, createKind != 0))
 		}
 		targetFields, err := targetFieldList.Elements()
 		if err != nil {
-			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+			return errors.WrapPrefixf(err, "%s", fieldRetrievalError(fp, createKind != 0))
 		}
 		if len(targetFields) == 0 {
-			return errors.Errorf(fieldRetrievalError(fp, createKind != 0))
+			return errors.Errorf("%s", fieldRetrievalError(fp, createKind != 0))
 		}
 
 		for _, t := range targetFields {
 			if err := setFieldValue(selector.Options, t, value); err != nil {
-				return err
+				return fmt.Errorf("%w", err)
 			}
 		}
 	}
@@ -247,3 +256,146 @@ func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *
 
 	return nil
 }
+
+// setValueInStructuredData handles setting values within structured data (JSON/YAML) in scalar fields
+func setValueInStructuredData(target *yaml.RNode, value *yaml.RNode, fieldPath string, createKind yaml.Kind) error {
+	pathParts := kyaml_utils.SmarterPathSplitter(fieldPath, ".")
+	if len(pathParts) < 2 {
+		return fmt.Errorf("not a structured data path")
+	}
+
+	// Find the potential scalar field that might contain structured data
+	var scalarFieldPath []string
+	var structuredDataPath []string
+	var foundScalar = false
+
+	// Try to find where the scalar field ends and structured data begins
+	for i := 1; i <= len(pathParts); i++ {
+		potentialScalarPath := pathParts[:i]
+		scalarField, err := target.Pipe(yaml.Lookup(potentialScalarPath...))
+		if err != nil {
+			continue
+		}
+		if scalarField != nil && scalarField.YNode().Kind == yaml.ScalarNode && i < len(pathParts) {
+			// Try to parse the scalar value as structured data
+			scalarValue := scalarField.YNode().Value
+			var parsedNode yaml.Node
+			if err := yaml.Unmarshal([]byte(scalarValue), &parsedNode); err == nil {
+				// Successfully parsed - this is structured data
+				scalarFieldPath = potentialScalarPath
+				structuredDataPath = pathParts[i:]
+				foundScalar = true
+				break
+			}
+		}
+	}
+
+	if !foundScalar {
+		return fmt.Errorf("no structured data found in path")
+	}
+
+	// Get the scalar field containing structured data
+	scalarField, err := target.Pipe(yaml.Lookup(scalarFieldPath...))
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	// Parse the structured data
+	scalarValue := scalarField.YNode().Value
+	var parsedNode yaml.Node
+	if err := yaml.Unmarshal([]byte(scalarValue), &parsedNode); err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	structuredData := yaml.NewRNode(&parsedNode)
+
+	// Navigate to the target location within the structured data
+	targetInStructured, err := structuredData.Pipe(&yaml.PathMatcher{
+		Path:   structuredDataPath,
+		Create: createKind,
+	})
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	targetFields, err := targetInStructured.Elements()
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	if len(targetFields) == 0 {
+		return fmt.Errorf("unable to find field in structured data")
+	}
+
+	// Set the value in the structured data
+	for _, t := range targetFields {
+		if t.YNode().Kind == yaml.ScalarNode {
+			t.YNode().Value = value.YNode().Value
+		} else {
+			t.SetYNode(value.YNode())
+		}
+	}
+
+	// Serialize the modified structured data back to the scalar field
+	// Try to detect if original was JSON or YAML and preserve formatting
+	serializedData, err := serializeStructuredData(structuredData, scalarValue)
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	// Update the original scalar field
+	scalarField.YNode().Value = serializedData
+
+	return nil
+}
+
+// serializeStructuredData handles the serialization of structured data back to string format
+// preserving the original format (JSON vs YAML) and style (pretty vs compact)
+func serializeStructuredData(structuredData *yaml.RNode, originalValue string) (string, error) {
+	firstChar := rune(strings.TrimSpace(originalValue)[0])
+	if firstChar == '{' || firstChar == '[' {
+		return serializeAsJSON(structuredData, originalValue)
+	}
+
+	// Fallback to YAML format
+	return serializeAsYAML(structuredData)
+}
+
+// serializeAsJSON converts structured data back to JSON format
+func serializeAsJSON(structuredData *yaml.RNode, originalValue string) (string, error) {
+	modifiedData, err := structuredData.String()
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize structured data: %w", err)
+	}
+
+	// Parse the YAML output as JSON
+	var jsonData interface{}
+	if err := yaml.Unmarshal([]byte(modifiedData), &jsonData); err != nil {
+		return "", fmt.Errorf("failed to unmarshal YAML data: %w", err)
+	}
+
+	// Check if original was pretty-printed by looking for newlines and indentation
+	if strings.Contains(originalValue, "\n") && strings.Contains(originalValue, "  ") {
+		// Pretty-print the JSON to match original formatting
+		if prettyJSON, err := json.MarshalIndent(jsonData, "", "  "); err == nil {
+			return string(prettyJSON), nil
+		}
+	}
+
+	// Compact JSON
+	if compactJSON, err := json.Marshal(jsonData); err == nil {
+		return string(compactJSON), nil
+	}
+
+	return "", fmt.Errorf("failed to marshal JSON data")
+}
+
+// serializeAsYAML converts structured data back to YAML format
+func serializeAsYAML(structuredData *yaml.RNode) (string, error) {
+	modifiedData, err := structuredData.String()
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize YAML data: %w", err)
+	}
+
+	return strings.TrimSpace(modifiedData), nil
+}

api/go.mod

@@ -1,37 +1,35 @@
 module sigs.k8s.io/kustomize/api
 
-go 1.20
+go 1.24.0
 
 require (
+	github.com/blang/semver/v4 v4.0.0
 	github.com/go-errors/errors v1.4.2
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
-	github.com/imdario/mergo v0.3.13
-	github.com/stretchr/testify v1.8.1
-	gopkg.in/evanphx/json-patch.v5 v5.6.0
-	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961
-	sigs.k8s.io/kustomize/kyaml v0.15.0
-	sigs.k8s.io/yaml v1.3.0
+	github.com/stretchr/testify v1.10.0
+	go.uber.org/goleak v1.3.0
+	go.yaml.in/yaml/v2 v2.4.2
+	gopkg.in/evanphx/json-patch.v4 v4.13.0
+	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7
+	sigs.k8s.io/kustomize/kyaml v0.21.0
+	sigs.k8s.io/yaml v1.5.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.12.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace sigs.k8s.io/kustomize/kyaml => ../kyaml

api/go.sum

@@ -1,37 +1,31 @@
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -40,53 +34,50 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
-golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v5 v5.6.0 h1:BMT6KIwBD9CaU91PJCZIe46bDmBWa9ynTQgJIOpfQBk=
-gopkg.in/evanphx/json-patch.v5 v5.6.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 h1:pqRVJGQJz6oeZby8qmPKXYIBjyrcv7EHCe/33UkZMYA=
-k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961/go.mod h1:l8HTwL5fqnlns4jOveW1L75eo7R9KFHxiE0bsPGy428=
+k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 h1:hcha5B1kVACrLujCKLbr8XWMxCxzQx42DY8QKYJrDLg=
+k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7/go.mod h1:GewRfANuJ70iYzvn+i4lezLDAFzvjxZYK1gn1lWcfas=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/kustomize/kyaml v0.15.0 h1:ynlLMAxDhrY9otSg5GYE2TcIz31XkGZ2Pkj7SdolD84=
-sigs.k8s.io/kustomize/kyaml v0.15.0/go.mod h1:+uMkBahdU1KNOj78Uta4rrXH+iH7wvg+nW7+GULvREA=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

api/internal/accumulator/loadconfigfromcrds.go

@@ -144,7 +144,7 @@ func loadCrdIntoConfig(
 		}
 		_, label := property.Extensions.GetString(xLabelSelector)
 		if label {
-			err = theConfig.AddLabelFieldSpec(
+			err = theConfig.AddCommonLabelsFieldSpec(
 				makeFs(theGvk, append(path, propName)))
 			if err != nil {
 				return

api/internal/accumulator/namereferencetransformer_test.go

@@ -590,7 +590,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 
-	v1 := rf.FromMapWithName(
+	v1, err := rf.FromMapWithName(
 		"volume1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -599,7 +599,10 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"name": "someprefix-volume1",
 			},
 		})
-	c1 := rf.FromMapWithName(
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
+	c1, err := rf.FromMapWithName(
 		"claim1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -612,9 +615,11 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"volumeName": "volume1",
 			},
 		})
-
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
 	v2 := v1.DeepCopy()
-	c2 := rf.FromMapWithName(
+	c2, err := rf.FromMapWithName(
 		"claim1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -627,6 +632,9 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 				"volumeName": "someprefix-volume1",
 			},
 		})
+	if err != nil {
+		t.Fatalf("failed to get new instance with given name: %v", err)
+	}
 
 	m1 := resmaptest_test.NewRmBuilder(t, rf).AddR(v1).AddR(c1).ResMap()
 

api/internal/accumulator/resaccumulator.go

@@ -170,7 +170,7 @@ func (ra *ResAccumulator) FixBackReferences() (err error) {
 
 // Intersection drops the resources which "other" does not have.
 func (ra *ResAccumulator) Intersection(other resmap.ResMap) error {
-	otherIds := other.AllIds()
+	otherIds := other.AllIds() //nolint:revive
 	for _, curId := range ra.resMap.AllIds() {
 		toDelete := true
 		for _, otherId := range otherIds {

api/internal/accumulator/resaccumulator_test.go

@@ -64,7 +64,7 @@ func makeResAccumulator(t *testing.T) *ResAccumulator {
 					"name": "backendTwo",
 				}}).ResMap())
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to append resources: %v", err)
 	}
 	return ra
 }
@@ -143,22 +143,26 @@ func expectLog(t *testing.T, log bytes.Buffer, expect string) {
 func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
 	ra := makeResAccumulator(t)
 	rm0 := resmap.New()
-	err := rm0.Append(
-		provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "Service",
-				"metadata": map[string]interface{}{
-					"name":      "backendOne",
-					"namespace": "fooNamespace",
-				},
-			}))
+
+	r, err := provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]interface{}{
+				"name":      "backendOne",
+				"namespace": "fooNamespace",
+			},
+		})
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to get instance of resources: %v", err)
+	}
+	err = rm0.Append(r)
+	if err != nil {
+		t.Fatalf("failed to append a resource to ResMap: %v", err)
 	}
 	err = ra.AppendAll(rm0)
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		t.Fatalf("failed to append a resource to ResAccumulator: %v", err)
 	}
 
 	err = ra.MergeVars([]types.Var{
@@ -227,7 +231,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	// create accumulators holding apparently conflicting vars that are not
 	// actually in conflict because they point to the same concrete value.
 	rm0 := resmap.New()
-	err := rm0.Append(rf.FromMap(fooAws))
+	r0, err0 := rf.FromMap(fooAws)
+	if err0 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err0)
+	}
+	err := rm0.Append(r0)
 	require.NoError(t, err)
 	ac0 := MakeEmptyAccumulator()
 	err = ac0.AppendAll(rm0)
@@ -236,7 +244,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	require.NoError(t, err)
 
 	rm1 := resmap.New()
-	err = rm1.Append(rf.FromMap(barAws))
+	r1, err1 := rf.FromMap(barAws)
+	if err1 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err1)
+	}
+	err = rm1.Append(r1)
 	require.NoError(t, err)
 	ac1 := MakeEmptyAccumulator()
 	err = ac1.AppendAll(rm1)
@@ -255,7 +267,11 @@ func TestResolveVarConflicts(t *testing.T) {
 	// two above (because it contains a variable whose name is used in the other
 	// accumulators AND whose concrete values are different).
 	rm2 := resmap.New()
-	err = rm2.Append(rf.FromMap(barGcp))
+	r2, err2 := rf.FromMap(barGcp)
+	if err2 != nil {
+		t.Fatalf("failed to get instance of resources: %v", err2)
+	}
+	err = rm2.Append(r2)
 	require.NoError(t, err)
 	ac2 := MakeEmptyAccumulator()
 	err = ac2.AppendAll(rm2)

api/internal/builtins/AnnotationsTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ConfigMapGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/HashTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on HashTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/HelmChartInflationGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on HelmChartInflationGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -10,13 +8,16 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 
-	"github.com/imdario/mergo"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
+	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
+	"sigs.k8s.io/kustomize/kyaml/yaml/merge2"
 	"sigs.k8s.io/yaml"
 )
 
@@ -53,6 +54,18 @@ func (p *HelmChartInflationGeneratorPlugin) Config(
 	if h.GeneralConfig().HelmConfig.Command == "" {
 		return fmt.Errorf("must specify --helm-command")
 	}
+
+	// CLI args takes precedence
+	if h.GeneralConfig().HelmConfig.KubeVersion != "" {
+		p.HelmChart.KubeVersion = h.GeneralConfig().HelmConfig.KubeVersion
+	}
+	if len(h.GeneralConfig().HelmConfig.ApiVersions) != 0 {
+		p.HelmChart.ApiVersions = h.GeneralConfig().HelmConfig.ApiVersions
+	}
+	if h.GeneralConfig().HelmConfig.Debug {
+		p.HelmChart.Debug = h.GeneralConfig().HelmConfig.Debug
+	}
+
 	p.h = h
 	if err = yaml.Unmarshal(config, p); err != nil {
 		return
@@ -91,7 +104,7 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// be under the loader root (unless root restrictions are
 	// disabled).
 	if p.ValuesFile == "" {
-		p.ValuesFile = filepath.Join(p.ChartHome, p.Name, "values.yaml")
+		p.ValuesFile = filepath.Join(p.absChartHome(), p.Name, "values.yaml")
 	}
 	for i, file := range p.AdditionalValuesFiles {
 		// use Load() to enforce root restrictions
@@ -132,10 +145,17 @@ func (p *HelmChartInflationGeneratorPlugin) errIfIllegalValuesMerge() error {
 }
 
 func (p *HelmChartInflationGeneratorPlugin) absChartHome() string {
+	var chartHome string
 	if filepath.IsAbs(p.ChartHome) {
-		return p.ChartHome
+		chartHome = p.ChartHome
+	} else {
+		chartHome = filepath.Join(p.h.Loader().Root(), p.ChartHome)
 	}
-	return filepath.Join(p.h.Loader().Root(), p.ChartHome)
+
+	if p.Version != "" && p.Repo != "" {
+		return filepath.Join(chartHome, fmt.Sprintf("%s-%s", p.Name, p.Version))
+	}
+	return chartHome
 }
 
 func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
@@ -151,13 +171,17 @@ func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
 		fmt.Sprintf("HELM_DATA_HOME=%s/.data", p.ConfigHome)}
 	cmd.Env = append(os.Environ(), env...)
 	err := cmd.Run()
+	errorOutput := stderr.String()
+	if slices.Contains(args, "--debug") {
+		errorOutput = " Helm stack trace:\n" + errorOutput + "\nHelm template:\n" + stdout.String() + "\n"
+	}
 	if err != nil {
 		helm := p.h.GeneralConfig().HelmConfig.Command
 		err = errors.WrapPrefixf(
 			fmt.Errorf(
 				"unable to run: '%s %s' with env=%s (is '%s' installed?): %w",
 				helm, strings.Join(args, " "), env, helm, err),
-			stderr.String(),
+			"%s", errorOutput,
 		)
 	}
 	return stdout.Bytes(), err
@@ -185,18 +209,33 @@ func (p *HelmChartInflationGeneratorPlugin) replaceValuesInline() error {
 	if err != nil {
 		return err
 	}
-	chValues := make(map[string]interface{})
-	if err = yaml.Unmarshal(pValues, &chValues); err != nil {
-		return err
+	chValues, err := kyaml.Parse(string(pValues))
+	if err != nil {
+		return errors.WrapPrefixf(err, "could not parse values file into rnode")
 	}
+	inlineValues, err := kyaml.FromMap(p.ValuesInline)
+	if err != nil {
+		return errors.WrapPrefixf(err, "could not parse values inline into rnode")
+	}
+	var outValues *kyaml.RNode
 	switch p.ValuesMerge {
+	// Function `merge2.Merge` overrides values in dest with values from src.
+	// To achieve override or merge behavior, we pass parameters in different order.
+	// Object passed as dest will be modified, so we copy it just in case someone
+	// decides to use it after this is called.
 	case valuesMergeOptionOverride:
-		err = mergo.Merge(
-			&chValues, p.ValuesInline, mergo.WithOverride)
+		outValues, err = merge2.Merge(inlineValues, chValues.Copy(), kyaml.MergeOptions{})
 	case valuesMergeOptionMerge:
-		err = mergo.Merge(&chValues, p.ValuesInline)
+		outValues, err = merge2.Merge(chValues, inlineValues.Copy(), kyaml.MergeOptions{})
 	}
-	p.ValuesInline = chValues
+	if err != nil {
+		return errors.WrapPrefixf(err, "could not merge values")
+	}
+	mapValues, err := outValues.Map()
+	if err != nil {
+		return errors.WrapPrefixf(err, "could not parse merged values into map")
+	}
+	p.ValuesInline = mapValues
 	return err
 }
 
@@ -256,11 +295,14 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 
 	rm, resMapErr := p.h.ResmapFactory().NewResMapFromBytes(stdout)
 	if resMapErr == nil {
+		if err := p.markHelmGeneratedResources(rm); err != nil {
+			return nil, err
+		}
 		return rm, nil
 	}
 	// try to remove the contents before first "---" because
 	// helm may produce messages to stdout before it
-	r := &kio.ByteReader{Reader: bytes.NewBufferString(string(stdout)), OmitReaderAnnotations: true}
+	r := &kio.ByteReader{Reader: bytes.NewBuffer(stdout), OmitReaderAnnotations: true}
 	nodes, err := r.Read()
 	if err != nil {
 		return nil, fmt.Errorf("error reading helm output: %w", err)
@@ -271,6 +313,9 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 		if err != nil {
 			return nil, fmt.Errorf("could not parse rnode slice into resource map: %w", err)
 		}
+		if err := p.markHelmGeneratedResources(rm); err != nil {
+			return nil, err
+		}
 		return rm, nil
 	}
 	return nil, fmt.Errorf("could not parse bytes into resource map: %w", resMapErr)
@@ -296,6 +341,9 @@ func (p *HelmChartInflationGeneratorPlugin) pullCommand() []string {
 	if p.Version != "" {
 		args = append(args, "--version", p.Version)
 	}
+	if p.Devel {
+		args = append(args, "--devel")
+	}
 	return args
 }
 
@@ -310,9 +358,18 @@ func (p *HelmChartInflationGeneratorPlugin) chartExistsLocally() (string, bool)
 	return path, s.IsDir()
 }
 
-// checkHelmVersion will return an error if the helm version is not V3
+func (p *HelmChartInflationGeneratorPlugin) markHelmGeneratedResources(rm resmap.ResMap) error {
+	for _, r := range rm.Resources() {
+		if err := r.RNode.PipeE(kyaml.SetAnnotation(konfig.HelmGeneratedAnnotation, "true")); err != nil {
+			return fmt.Errorf("failed to set helm annotation: %w", err)
+		}
+	}
+	return nil
+}
+
+// checkHelmVersion will return an error if the helm version is not V3 or V4
 func (p *HelmChartInflationGeneratorPlugin) checkHelmVersion() error {
-	stdout, err := p.runHelmCommand([]string{"version", "-c", "--short"})
+	stdout, err := p.runHelmCommand([]string{"version", "--short"})
 	if err != nil {
 		return err
 	}
@@ -328,8 +385,8 @@ func (p *HelmChartInflationGeneratorPlugin) checkHelmVersion() error {
 		v = v[1:]
 	}
 	majorVersion := strings.Split(v, ".")[0]
-	if majorVersion != "3" {
-		return fmt.Errorf("this plugin requires helm V3 but got v%s", v)
+	if majorVersion != "3" && majorVersion != "4" {
+		return fmt.Errorf("this plugin requires helm V3 or V4 but got v%s", v)
 	}
 	return nil
 }

api/internal/builtins/IAMPolicyGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on IAMPolicyGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ImageTagTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/LabelTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on LabelTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/NamespaceTransformer.go

@@ -1,12 +1,11 @@
 // Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
 	"fmt"
 
 	"sigs.k8s.io/kustomize/api/filters/namespace"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -14,6 +13,8 @@ import (
 )
 
 // Change or set the namespace of non-cluster level resources.
+//
+//nolint:tagalign
 type NamespaceTransformerPlugin struct {
 	types.ObjectMeta       `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	FieldSpecs             []types.FieldSpec                `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
@@ -51,6 +52,10 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 			// Don't mutate empty objects?
 			continue
 		}
+		if annotations := r.GetAnnotations(konfig.HelmGeneratedAnnotation); annotations[konfig.HelmGeneratedAnnotation] == "true" {
+			// Don't apply namespace on Helm generated manifest. Helm should take care of it.
+			continue
+		}
 		r.StorePreviousId()
 		if err := r.ApplyFilter(namespace.Filter{
 			Namespace:              p.Namespace,

api/internal/builtins/PatchJson6902Transformer.go

@@ -1,12 +1,10 @@
 // Code generated by pluginator on PatchJson6902Transformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
 	"fmt"
 
-	jsonpatch "gopkg.in/evanphx/json-patch.v5"
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"

api/internal/builtins/PatchStrategicMergeTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PatchStrategicMergeTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/PatchTransformer.go

@@ -1,13 +1,11 @@
 // Code generated by pluginator on PatchTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
 	"fmt"
 	"strings"
 
-	jsonpatch "gopkg.in/evanphx/json-patch.v5"
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
@@ -24,10 +22,10 @@ type PatchTransformerPlugin struct {
 	patchText string
 	// patchSource is patch source message
 	patchSource string
-	Path        string          `json:"path,omitempty"    yaml:"path,omitempty"`
-	Patch       string          `json:"patch,omitempty"   yaml:"patch,omitempty"`
-	Target      *types.Selector `json:"target,omitempty"  yaml:"target,omitempty"`
-	Options     map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+	Path        string           `json:"path,omitempty"    yaml:"path,omitempty"`
+	Patch       string           `json:"patch,omitempty"   yaml:"patch,omitempty"`
+	Target      *types.Selector  `json:"target,omitempty"  yaml:"target,omitempty"`
+	Options     *types.PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
 }
 
 func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error {
@@ -56,8 +54,9 @@ func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error
 	patchesSM, errSM := h.ResmapFactory().RF().SliceFromBytes([]byte(p.patchText))
 	patchesJson, errJson := jsonPatchFromBytes([]byte(p.patchText))
 
-	if (errSM == nil && errJson == nil) ||
-		(patchesSM != nil && patchesJson != nil) {
+	if ((errSM == nil && errJson == nil) ||
+		(patchesSM != nil && patchesJson != nil)) &&
+		(len(patchesSM) > 0 && len(patchesJson) > 0) {
 		return fmt.Errorf(
 			"illegally qualifies as both an SM and JSON patch: %s",
 			p.patchSource)
@@ -69,10 +68,14 @@ func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error
 	if errSM == nil {
 		p.smPatches = patchesSM
 		for _, loadedPatch := range p.smPatches {
-			if p.Options["allowNameChange"] {
+			if p.Options == nil {
+				continue
+			}
+
+			if p.Options.AllowNameChange {
 				loadedPatch.AllowNameChange()
 			}
-			if p.Options["allowKindChange"] {
+			if p.Options.AllowKindChange {
 				loadedPatch.AllowKindChange()
 			}
 		}
@@ -86,7 +89,10 @@ func (p *PatchTransformerPlugin) Transform(m resmap.ResMap) error {
 	if p.smPatches != nil {
 		return p.transformStrategicMerge(m)
 	}
-	return p.transformJson6902(m)
+	if p.jsonPatches != nil {
+		return p.transformJson6902(m)
+	}
+	return nil
 }
 
 // transformStrategicMerge applies each loaded strategic merge patch

api/internal/builtins/PrefixTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PrefixTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ReplacementTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ReplacementTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -16,7 +14,7 @@ import (
 // Replace values in targets with values from a source
 type ReplacementTransformerPlugin struct {
 	ReplacementList []types.ReplacementField `json:"replacements,omitempty" yaml:"replacements,omitempty"`
-	Replacements    []types.Replacement      `json:"omitempty" yaml:"omitempty"`
+	replacements    []types.Replacement
 }
 
 func (p *ReplacementTransformerPlugin) Config(
@@ -49,19 +47,19 @@ func (p *ReplacementTransformerPlugin) Config(
 				if err := yaml.Unmarshal(content, &repl); err != nil {
 					return err
 				}
-				p.Replacements = append(p.Replacements, repl...)
+				p.replacements = append(p.replacements, repl...)
 			case reflect.Map:
 				repl := types.Replacement{}
 				if err := yaml.Unmarshal(content, &repl); err != nil {
 					return err
 				}
-				p.Replacements = append(p.Replacements, repl)
+				p.replacements = append(p.replacements, repl)
 			default:
 				return fmt.Errorf("unsupported replacement type encountered within replacement path: %v", items.Kind())
 			}
 		} else {
 			// replacement information is already loaded
-			p.Replacements = append(p.Replacements, r.Replacement)
+			p.replacements = append(p.replacements, r.Replacement)
 		}
 	}
 	return nil
@@ -69,7 +67,7 @@ func (p *ReplacementTransformerPlugin) Config(
 
 func (p *ReplacementTransformerPlugin) Transform(m resmap.ResMap) (err error) {
 	return m.ApplyFilter(replacement.Filter{
-		Replacements: p.Replacements,
+		Replacements: p.replacements,
 	})
 }
 

api/internal/builtins/ReplicaCountTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ReplicaCountTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/SecretGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SecretGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/SortOrderTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SortOrderTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -74,34 +72,16 @@ func (p *SortOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
 
 	// Sort
 	if p.SortOptions.Order == types.LegacySortOrder {
-		s := newLegacyIDSorter(m.AllIds(), p.SortOptions.LegacySortOptions)
+		s := newLegacyIDSorter(m.Resources(), p.SortOptions.LegacySortOptions)
 		sort.Sort(s)
-		err = applyOrdering(m, s.resids)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
 
-// applyOrdering takes resources (given in ResMap) and a desired ordering given
-// as a sequence of ResIds, and updates the ResMap's resources to match the
-// ordering.
-func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
-	var err error
-	resources := make([]*resource.Resource, m.Size())
-	// Clear and refill with the correct order
-	for i, id := range ordering {
-		resources[i], err = m.GetByCurrentId(id)
-		if err != nil {
-			return errors.WrapPrefixf(err, "expected match for sorting")
-		}
-	}
-	m.Clear()
-	for _, r := range resources {
-		err = m.Append(r)
-		if err != nil {
-			return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+		// Clear the map and re-add the resources in the sorted order.
+		m.Clear()
+		for _, r := range s.resources {
+			err := m.Append(r)
+			if err != nil {
+				return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+			}
 		}
 	}
 	return nil
@@ -117,12 +97,17 @@ func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
 type legacyIDSorter struct {
 	// resids only stores the metadata of the object. This is an optimization as
 	// it's expensive to compute these again and again during ordering.
-	resids     []resid.ResId
+	resids []resid.ResId
+	// Initially, we sorted the metadata (ResId) of each object and then called GetByCurrentId on each to construct the final list.
+	// The problem is that GetByCurrentId is inefficient and does a linear scan in a list every time we do that.
+	// So instead, we sort resources alongside the ResIds.
+	resources []*resource.Resource
+
 	typeOrders map[string]int
 }
 
 func newLegacyIDSorter(
-	resids []resid.ResId,
+	resources []*resource.Resource,
 	options *types.LegacySortOptions) *legacyIDSorter {
 	// Precalculate a resource ranking based on the priority lists.
 	var typeOrders = func() map[string]int {
@@ -135,10 +120,13 @@ func newLegacyIDSorter(
 		}
 		return m
 	}()
-	return &legacyIDSorter{
-		resids:     resids,
-		typeOrders: typeOrders,
+
+	ret := &legacyIDSorter{typeOrders: typeOrders}
+	for _, res := range resources {
+		ret.resids = append(ret.resids, res.CurId())
+		ret.resources = append(ret.resources, res)
 	}
+	return ret
 }
 
 var _ sort.Interface = legacyIDSorter{}
@@ -146,6 +134,7 @@ var _ sort.Interface = legacyIDSorter{}
 func (a legacyIDSorter) Len() int { return len(a.resids) }
 func (a legacyIDSorter) Swap(i, j int) {
 	a.resids[i], a.resids[j] = a.resids[j], a.resids[i]
+	a.resources[i], a.resources[j] = a.resources[j], a.resources[i]
 }
 func (a legacyIDSorter) Less(i, j int) bool {
 	if !a.resids[i].Gvk.Equals(a.resids[j].Gvk) {
@@ -160,6 +149,9 @@ func gvkLessThan(gvk1, gvk2 resid.Gvk, typeOrders map[string]int) bool {
 	if index1 != index2 {
 		return index1 < index2
 	}
+	if (gvk1.Kind == types.NamespaceKind && gvk2.Kind == types.NamespaceKind) && (gvk1.Group == "" || gvk2.Group == "") {
+		return legacyGVKSortString(gvk1) > legacyGVKSortString(gvk2)
+	}
 	return legacyGVKSortString(gvk1) < legacyGVKSortString(gvk2)
 }
 

api/internal/builtins/SuffixTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SuffixTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ValueAddTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ValueAddTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/konfig/builtinpluginconsts/images.go

@@ -10,9 +10,13 @@ images:
   create: true
 - path: spec/initContainers[]/image
   create: true
+- path: spec/volumes[]/image/reference
+  create: true
 - path: spec/template/spec/containers[]/image
   create: true
 - path: spec/template/spec/initContainers[]/image
   create: true
+- path: spec/template/spec/volumes[]/image/reference
+  create: true
 `
 )

api/internal/konfig/builtinpluginconsts/namereference.go

@@ -421,6 +421,13 @@ nameReference:
   fieldSpecs:
   - path: spec/ingressClassName
     kind: Ingress
+
+- kind: ValidatingAdmissionPolicy
+  group: admissionregistration.k8s.io
+  fieldSpecs:
+  - path: spec/policyName
+    kind: ValidatingAdmissionPolicyBinding
+    group: admissionregistration.k8s.io
 `
 )
 

api/internal/loader/fileloader.go

@@ -169,7 +169,7 @@ func (fl *FileLoader) New(path string) (ifc.Loader, error) {
 	}
 	root, err := filesys.ConfirmDir(fl.fSys, fl.root.Join(path))
 	if err != nil {
-		return nil, errors.WrapPrefixf(err, ErrRtNotDir.Error())
+		return nil, errors.WrapPrefixf(err, "%s", ErrRtNotDir.Error())
 	}
 	if err = fl.errIfGitContainmentViolation(root); err != nil {
 		return nil, err
@@ -311,7 +311,11 @@ func (fl *FileLoader) httpClientGetContent(path string) ([]byte, error) {
 	} else {
 		hc = &http.Client{}
 	}
-	resp, err := hc.Get(path)
+	parsedURL, err := url.ParseRequestURI(path)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	resp, err := hc.Get(parsedURL.String())
 	if err != nil {
 		return nil, errors.Wrap(err)
 	}

api/internal/loader/fileloader_test.go

@@ -676,3 +676,15 @@ func setupOnDisk(t *testing.T) (filesys.FileSystem, filesys.ConfirmedDir) {
 	})
 	return fSys, dir
 }
+
+// TestLoaderHTTPMalformedURL tests that malformed URLs are properly handled
+// to prevent infinite loops in http.Client.Get
+func TestLoaderHTTPMalformedURL(t *testing.T) {
+	require := require.New(t)
+	malformedURL := "https://example.com/example?ref=main - ../../example/example.yaml"
+	l1 := NewLoaderOrDie(
+		RestrictionRootOnly, MakeFakeFs([]testData{}), filesys.Separator)
+	_, err := l1.Load(malformedURL)
+	require.Error(err)
+	require.Equal("HTTP Error: status code 400 (Bad Request)", err.Error())
+}

api/internal/loader/loader.go

@@ -28,7 +28,7 @@ func NewLoader(
 	}
 	root, err := filesys.ConfirmDir(fSys, target)
 	if err != nil {
-		return nil, errors.WrapPrefixf(err, ErrRtNotDir.Error())
+		return nil, errors.WrapPrefixf(err, "%s", ErrRtNotDir.Error())
 	}
 	return newLoaderAtConfirmedDir(
 		lr, root, fSys, nil, git.ClonerUsingGitExec), nil

api/internal/localizer/localizer.go

@@ -381,7 +381,7 @@ func (lc *localizer) localizeFileWithContent(path string, content []byte) (strin
 		// 2. avoid paths that temporarily traverse outside the current root,
 		//    i.e. ../../../scope/target/current-root. The localized file will be surrounded by
 		//    different directories than its source, and so an uncleaned path may no longer be valid.
-		locPath = cleanFilePath(lc.fSys, lc.root, path)
+		locPath = cleanedRelativePath(lc.fSys, lc.root, path)
 	}
 	absPath := filepath.Join(lc.dst, locPath)
 	if err := lc.fSys.MkdirAll(filepath.Dir(absPath)); err != nil {

api/internal/localizer/localizer_test.go

@@ -144,7 +144,7 @@ func reportFSysDiff(t *testing.T, fSysExpected filesys.FileSystem, fSysActual fi
 			actualContent, readErr := fSysActual.ReadFile(path)
 			require.NoError(t, readErr)
 			expectedContent, findErr := fSysExpected.ReadFile(path)
-			assert.NoErrorf(t, findErr, "unexpected file %q", path)
+			require.NoErrorf(t, findErr, "unexpected file %q", path)
 			if findErr == nil {
 				assert.Equal(t, string(expectedContent), string(actualContent))
 			}
@@ -296,8 +296,10 @@ func TestLocalizeFileCleaned(t *testing.T) {
 kind: Kustomization
 patches:
 - path: ../gamma/../../../alpha/beta/./gamma/patch.yaml
+- path: /alpha/beta/../beta/./gamma/patch2.yaml
 `,
-		"patch.yaml": podConfiguration,
+		"patch.yaml":  podConfiguration,
+		"patch2.yaml": podConfiguration,
 	}
 	expected, actual := makeFileSystems(t, "/alpha/beta/gamma", kustAndPatch)
 
@@ -307,8 +309,10 @@ patches:
 kind: Kustomization
 patches:
 - path: patch.yaml
+- path: patch2.yaml
 `,
-		"patch.yaml": podConfiguration,
+		"patch.yaml":  podConfiguration,
+		"patch2.yaml": podConfiguration,
 	})
 	checkFSys(t, expected, actual)
 }
@@ -1194,19 +1198,40 @@ func TestLocalizeResources(t *testing.T) {
 kind: Kustomization
 resources:
 - pod.yaml
+- /a/b/pod2.yaml
 - ../../alpha
 `,
-		"pod.yaml": podConfiguration,
+		"pod.yaml":  podConfiguration,
+		"pod2.yaml": podConfiguration,
 		"../../alpha/kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namePrefix: my-
 `,
 	}
-	expected, actual := makeFileSystems(t, "/a/b", kustAndResources)
 
-	checkRun(t, actual, "/a/b", "/", "/localized-b")
-	addFiles(t, expected, "/localized-b/a/b", kustAndResources)
-	checkFSys(t, expected, actual)
+	// Absolute path of `/a/b/pod2.yaml` is expected to be converted to a path
+	// relative to the kustomization root.
+	expectedKustAndResources := map[string]string{
+		"kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- pod.yaml
+- pod2.yaml
+- ../../alpha
+`,
+		"pod.yaml":  podConfiguration,
+		"pod2.yaml": podConfiguration,
+		"../../alpha/kustomization.yaml": `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: my-
+`,
+	}
+
+	expectedFs, actualFs := makeFileSystems(t, "/a/b", kustAndResources)
+
+	checkRun(t, actualFs, "/a/b", "/", "/localized-b")
+	addFiles(t, expectedFs, "/localized-b/a/b", expectedKustAndResources)
+	checkFSys(t, expectedFs, actualFs)
 }
 
 func TestLocalizePathError(t *testing.T) {

api/internal/localizer/locloader.go

@@ -89,11 +89,8 @@ func (ll *Loader) Load(path string) ([]byte, error) {
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "invalid file reference")
 	}
-	if filepath.IsAbs(path) {
-		return nil, errors.Errorf("absolute paths not yet supported in alpha: file path %q is absolute", path)
-	}
 	if !loader.IsRemoteFile(path) && ll.local {
-		cleanPath := cleanFilePath(ll.fSys, filesys.ConfirmedDir(ll.Root()), path)
+		cleanPath := cleanedRelativePath(ll.fSys, filesys.ConfirmedDir(ll.Root()), path)
 		cleanAbs := filepath.Join(ll.Root(), cleanPath)
 		dir := filesys.ConfirmedDir(filepath.Dir(cleanAbs))
 		// target cannot reference newDir, as this load would've failed prior to localize;

api/internal/localizer/locloader_test.go

@@ -276,11 +276,11 @@ func TestLoadFails(t *testing.T) {
 	checkNewLoader(req, ldr, &args, "/a", "/a", "/a/newDir", fSys)
 
 	cases := map[string]string{
-		"absolute path":     "/a/pod.yaml",
-		"directory":         "b",
-		"non-existent file": "kubectl.yaml",
-		"file outside root": "../alpha/beta/gamma/delta/deployment.yaml",
-		"inside dst":        "newDir/pod.yaml",
+		"directory":          "b",
+		"non-existent file":  "kubectl.yaml",
+		"file outside root":  "../alpha/beta/gamma/delta/deployment.yaml",
+		"inside dst":         "newDir/pod.yaml",
+		"winding inside dst": "/a/test/../newDir/pod.yaml",
 	}
 	for name, file := range cases {
 		file := file
@@ -291,8 +291,6 @@ func TestLoadFails(t *testing.T) {
 			ldr, _, err := NewLoader("./a/../a", "/a/../a", "/a/newDir", fSys)
 			req.NoError(err)
 
-			req.NoError(fSys.WriteFile("/a/newDir/pod.yaml", []byte(podConfiguration)))
-
 			_, err = ldr.Load(file)
 			req.Error(err)
 		})

api/internal/localizer/util.go

@@ -112,9 +112,13 @@ func hasRef(repoURL string) bool {
 	return repoSpec.Ref != ""
 }
 
-// cleanFilePath returns file cleaned, where file is a relative path to root on fSys
-func cleanFilePath(fSys filesys.FileSystem, root filesys.ConfirmedDir, file string) string {
-	abs := root.Join(file)
+// cleanedRelativePath returns a cleaned relative path of file to root on fSys
+func cleanedRelativePath(fSys filesys.FileSystem, root filesys.ConfirmedDir, file string) string {
+	abs := file
+	if !filepath.IsAbs(file) {
+		abs = root.Join(file)
+	}
+
 	dir, f, err := fSys.CleanedAbs(abs)
 	if err != nil {
 		log.Fatalf("cannot clean validated file path %q: %s", abs, err)

api/internal/localizer/util_test.go

@@ -301,3 +301,26 @@ func TestLocRootPath_SymlinkPath(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, expected, actual)
 }
+
+func TestCleanedRelativePath(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	require.NoError(t, fSys.MkdirAll("/root/test"))
+	require.NoError(t, fSys.WriteFile("/root/test/file.yaml", []byte("")))
+	require.NoError(t, fSys.WriteFile("/root/filetwo.yaml", []byte("")))
+
+	// Absolute path is cleaned to relative path
+	cleanedPath := cleanedRelativePath(fSys, "/root/", "/root/test/file.yaml")
+	require.Equal(t, "test/file.yaml", cleanedPath)
+
+	// Winding absolute path is cleaned to relative path
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "/root/test/../filetwo.yaml")
+	require.Equal(t, "filetwo.yaml", cleanedPath)
+
+	// Already clean relative path stays the same
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/file.yaml")
+	require.Equal(t, "test/file.yaml", cleanedPath)
+
+	// Winding relative path is cleaned
+	cleanedPath = cleanedRelativePath(fSys, "/root/", "test/../filetwo.yaml")
+	require.Equal(t, "filetwo.yaml", cleanedPath)
+}

api/internal/plugins/builtinconfig/loaddefaultconfig.go

@@ -33,7 +33,7 @@ func loadDefaultConfig(
 // makeTransformerConfigFromBytes returns a TransformerConfig object from bytes
 func makeTransformerConfigFromBytes(data []byte) (*TransformerConfig, error) {
 	var t TransformerConfig
-	err := yaml.Unmarshal(data, &t)
+	err := yaml.UnmarshalStrict(data, &t)
 	if err != nil {
 		return nil, err
 	}

api/internal/plugins/builtinconfig/loaddefaultconfig_test.go

@@ -5,6 +5,7 @@ package builtinconfig
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/internal/loader"
@@ -44,3 +45,28 @@ namePrefix:
 		t.Fatalf("expected %v\n but go6t %v\n", expected, tCfg)
 	}
 }
+
+func TestLoadDefaultConfigsFromFilesWithMissingFields(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	filePathContainsTypo := "config_contains_typo.yaml"
+	if err := fSys.WriteFile(filePathContainsTypo, []byte(`
+namoPrefix:
+- path: nameprefix/path
+  kind: SomeKind
+`)); err != nil {
+		t.Fatal(err)
+	}
+	ldr, err := loader.NewLoader(
+		loader.RestrictionRootOnly, filesys.Separator, fSys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	errMsg := "error unmarshaling JSON: while decoding JSON: json: unknown field"
+	_, err = loadDefaultConfig(ldr, []string{filePathContainsTypo})
+	if err == nil {
+		t.Fatalf("expected to fail unmarshal yaml, but got nil %s", filePathContainsTypo)
+	}
+	if !strings.Contains(err.Error(), errMsg) {
+		t.Fatalf("expected error %s, but got %s", errMsg, err)
+	}
+}

api/internal/plugins/builtinconfig/namebackreferences.go

@@ -47,6 +47,8 @@ type NameBackReferences struct {
 	// TODO: rename json 'fieldSpecs' to 'referrers' for clarity.
 	// This will, however, break anyone using a custom config.
 	Referrers types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	// Note: If any new pointer based members are added, DeepCopy needs to be updated
 }
 
 func (n NameBackReferences) String() string {
@@ -66,6 +68,17 @@ func (s nbrSlice) Less(i, j int) bool {
 	return s[i].Gvk.IsLessThan(s[j].Gvk)
 }
 
+// DeepCopy returns a new copy of nbrSlice
+func (s nbrSlice) DeepCopy() nbrSlice {
+	ret := make(nbrSlice, len(s))
+	copy(ret, s)
+	for i, slice := range ret {
+		ret[i].Referrers = slice.Referrers.DeepCopy()
+	}
+
+	return ret
+}
+
 func (s nbrSlice) mergeAll(o nbrSlice) (result nbrSlice, err error) {
 	result = s
 	for _, r := range o {

api/internal/plugins/builtinconfig/namebackreferences_test.go

@@ -95,3 +95,29 @@ func TestMergeAll(t *testing.T) {
 		t.Fatalf("expected\n %v\n but got\n %v\n", expected, actual)
 	}
 }
+
+func TestNbrSlice_DeepCopy(t *testing.T) {
+	original := make(nbrSlice, 2, 4)
+	original[0] = NameBackReferences{Gvk: resid.FromKind("A"), Referrers: types.FsSlice{{Path: "a"}}}
+	original[1] = NameBackReferences{Gvk: resid.FromKind("B"), Referrers: types.FsSlice{{Path: "b"}}}
+
+	copied := original.DeepCopy()
+
+	original, _ = original.mergeOne(NameBackReferences{Gvk: resid.FromKind("C"), Referrers: types.FsSlice{{Path: "c"}}})
+
+	// perform mutations which should not affect original
+	copied.Swap(0, 1)
+	copied[0].Referrers[0].Path = "very b" // ensure Referrers are not shared
+	_, _ = copied.mergeOne(NameBackReferences{Gvk: resid.FromKind("D"), Referrers: types.FsSlice{{Path: "d"}}})
+
+	// if DeepCopy does not work, original would be {very b,a,d} instead of {a,b,c}
+	expected := nbrSlice{
+		{Gvk: resid.FromKind("A"), Referrers: types.FsSlice{{Path: "a"}}},
+		{Gvk: resid.FromKind("B"), Referrers: types.FsSlice{{Path: "b"}}},
+		{Gvk: resid.FromKind("C"), Referrers: types.FsSlice{{Path: "c"}}},
+	}
+
+	if !reflect.DeepEqual(original, expected) {
+		t.Fatalf("original affected by mutations to copied object:\ngot\t%+v,\nexpected: %+v", original, expected)
+	}
+}

api/internal/plugins/builtinconfig/transformerconfig.go

@@ -6,6 +6,7 @@ package builtinconfig
 import (
 	"log"
 	"sort"
+	"sync"
 
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/konfig/builtinpluginconsts"
@@ -14,11 +15,15 @@ import (
 )
 
 // TransformerConfig holds the data needed to perform transformations.
+//
+//nolint:tagalign
 type TransformerConfig struct {
+	// if any fields are added, update the DeepCopy implementation
 	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
 	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
 	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	Labels            types.FsSlice `json:"labels,omitempty" yaml:"labels,omitempty"`
 	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
 	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
@@ -32,14 +37,44 @@ func MakeEmptyConfig() *TransformerConfig {
 	return &TransformerConfig{}
 }
 
+// DeepCopy returns a new copy of TransformerConfig
+func (t *TransformerConfig) DeepCopy() *TransformerConfig {
+	return &TransformerConfig{
+		NamePrefix:        t.NamePrefix.DeepCopy(),
+		NameSuffix:        t.NameSuffix.DeepCopy(),
+		NameSpace:         t.NameSpace.DeepCopy(),
+		CommonLabels:      t.CommonLabels.DeepCopy(),
+		Labels:            t.Labels.DeepCopy(),
+		TemplateLabels:    t.TemplateLabels.DeepCopy(),
+		CommonAnnotations: t.CommonAnnotations.DeepCopy(),
+		NameReference:     t.NameReference.DeepCopy(),
+		VarReference:      t.VarReference.DeepCopy(),
+		Images:            t.Images.DeepCopy(),
+		Replicas:          t.Replicas.DeepCopy(),
+	}
+}
+
+// the default transformer config is initialized by MakeDefaultConfig,
+// and must only be accessed via that function.
+var (
+	initDefaultConfig sync.Once          //nolint:gochecknoglobals
+	defaultConfig     *TransformerConfig //nolint:gochecknoglobals
+)
+
 // MakeDefaultConfig returns a default TransformerConfig.
 func MakeDefaultConfig() *TransformerConfig {
-	c, err := makeTransformerConfigFromBytes(
-		builtinpluginconsts.GetDefaultFieldSpecs())
-	if err != nil {
-		log.Fatalf("Unable to make default transformconfig: %v", err)
-	}
-	return c
+	// parsing is expensive when having a large tree with many kustomization modules, so only do it once
+	initDefaultConfig.Do(func() {
+		var err error
+		defaultConfig, err = makeTransformerConfigFromBytes(
+			builtinpluginconsts.GetDefaultFieldSpecs())
+		if err != nil {
+			log.Fatalf("Unable to make default transformconfig: %v", err)
+		}
+	})
+
+	// return a copy to avoid any mutations to protect the reference copy
+	return defaultConfig.DeepCopy()
 }
 
 // MakeTransformerConfig returns a merger of custom config,
@@ -63,6 +98,7 @@ func (t *TransformerConfig) sortFields() {
 	sort.Sort(t.NameSuffix)
 	sort.Sort(t.NameSpace)
 	sort.Sort(t.CommonLabels)
+	sort.Sort(t.Labels)
 	sort.Sort(t.TemplateLabels)
 	sort.Sort(t.CommonAnnotations)
 	sort.Sort(t.NameReference)
@@ -83,12 +119,18 @@ func (t *TransformerConfig) AddSuffixFieldSpec(fs types.FieldSpec) (err error) {
 	return err
 }
 
-// AddLabelFieldSpec adds a FieldSpec to CommonLabels
-func (t *TransformerConfig) AddLabelFieldSpec(fs types.FieldSpec) (err error) {
+// AddCommonLabelsFieldSpec adds a FieldSpec to CommonLabels
+func (t *TransformerConfig) AddCommonLabelsFieldSpec(fs types.FieldSpec) (err error) {
 	t.CommonLabels, err = t.CommonLabels.MergeOne(fs)
 	return err
 }
 
+// AddLabelsFieldSpec adds a FieldSpec to Labels
+func (t *TransformerConfig) AddLabelsFieldSpec(fs types.FieldSpec) (err error) {
+	t.Labels, err = t.Labels.MergeOne(fs)
+	return err //nolint:wrapcheck
+}
+
 // AddAnnotationFieldSpec adds a FieldSpec to CommonAnnotations
 func (t *TransformerConfig) AddAnnotationFieldSpec(fs types.FieldSpec) (err error) {
 	t.CommonAnnotations, err = t.CommonAnnotations.MergeOne(fs)
@@ -131,6 +173,10 @@ func (t *TransformerConfig) Merge(input *TransformerConfig) (
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge CommonLabels fieldSpec")
 	}
+	merged.Labels, err = t.Labels.MergeAll(input.Labels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge Labels fieldSpec")
+	}
 	merged.TemplateLabels, err = t.TemplateLabels.MergeAll(input.TemplateLabels)
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")

api/internal/plugins/builtinconfig/transformerconfig_test.go

@@ -4,9 +4,10 @@
 package builtinconfig_test
 
 import (
-	"reflect"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
@@ -35,13 +36,8 @@ func TestAddNamereferenceFieldSpec(t *testing.T) {
 		},
 	}
 
-	err := cfg.AddNamereferenceFieldSpec(nbrs)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NameReference) != 1 {
-		t.Fatal("failed to add namereference FieldSpec")
-	}
+	require.NoError(t, cfg.AddNamereferenceFieldSpec(nbrs))
+	require.Len(t, cfg.NameReference, 1, "failed to add namereference FieldSpec")
 }
 
 func TestAddFieldSpecs(t *testing.T) {
@@ -53,34 +49,14 @@ func TestAddFieldSpecs(t *testing.T) {
 		CreateIfNotPresent: true,
 	}
 
-	err := cfg.AddPrefixFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NamePrefix) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
-	err = cfg.AddSuffixFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.NameSuffix) != 1 {
-		t.Fatalf("failed to add namesuffix FieldSpec")
-	}
-	err = cfg.AddLabelFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.CommonLabels) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
-	err = cfg.AddAnnotationFieldSpec(fieldSpec)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if len(cfg.CommonAnnotations) != 1 {
-		t.Fatalf("failed to add nameprefix FieldSpec")
-	}
+	require.NoError(t, cfg.AddPrefixFieldSpec(fieldSpec))
+	require.Len(t, cfg.NamePrefix, 1, "failed to add nameprefix FieldSpec")
+	require.NoError(t, cfg.AddSuffixFieldSpec(fieldSpec))
+	require.Len(t, cfg.NameSuffix, 1, "failed to add namesuffix FieldSpec")
+	require.NoError(t, cfg.AddCommonLabelsFieldSpec(fieldSpec))
+	require.Len(t, cfg.CommonLabels, 1, "failed to add labels FieldSpec")
+	require.NoError(t, cfg.AddAnnotationFieldSpec(fieldSpec))
+	require.Len(t, cfg.CommonAnnotations, 1, "failed to add nameprefix FieldSpec")
 }
 
 func TestMerge(t *testing.T) {
@@ -127,49 +103,58 @@ func TestMerge(t *testing.T) {
 		},
 	}
 	cfga := &TransformerConfig{}
-	cfga.AddNamereferenceFieldSpec(nameReference[0])
-	cfga.AddPrefixFieldSpec(fieldSpecs[0])
-	cfga.AddSuffixFieldSpec(fieldSpecs[0])
+	require.NoError(t, cfga.AddNamereferenceFieldSpec(nameReference[0]))
+	require.NoError(t, cfga.AddPrefixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddSuffixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddCommonLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, cfga.AddLabelsFieldSpec(fieldSpecs[0]))
 
 	cfgb := &TransformerConfig{}
-	cfgb.AddNamereferenceFieldSpec(nameReference[1])
-	cfgb.AddPrefixFieldSpec(fieldSpecs[1])
-	cfga.AddSuffixFieldSpec(fieldSpecs[1])
+	require.NoError(t, cfgb.AddNamereferenceFieldSpec(nameReference[1]))
+	require.NoError(t, cfgb.AddPrefixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddSuffixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddCommonLabelsFieldSpec(fieldSpecs[1]))
+	require.NoError(t, cfgb.AddLabelsFieldSpec(fieldSpecs[1]))
 
 	actual, err := cfga.Merge(cfgb)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-
-	if len(actual.NamePrefix) != 2 {
-		t.Fatal("merge failed for namePrefix FieldSpec")
-	}
-
-	if len(actual.NameSuffix) != 2 {
-		t.Fatal("merge failed for nameSuffix FieldSpec")
-	}
-
-	if len(actual.NameReference) != 1 {
-		t.Fatal("merge failed for namereference FieldSpec")
-	}
+	require.NoError(t, err)
+	require.Len(t, actual.NamePrefix, 2, "merge failed for namePrefix FieldSpec")
+	require.Len(t, actual.NameSuffix, 2, "merge failed for nameSuffix FieldSpec")
+	require.Len(t, actual.NameReference, 1, "merge failed for nameReference FieldSpec")
+	require.Len(t, actual.Labels, 2, "merge failed for labels FieldSpec")
+	require.Len(t, actual.CommonLabels, 2, "merge failed for commonLabels FieldSpec")
 
 	expected := &TransformerConfig{}
-	expected.AddNamereferenceFieldSpec(nameReference[0])
-	expected.AddNamereferenceFieldSpec(nameReference[1])
-	expected.AddPrefixFieldSpec(fieldSpecs[0])
-	expected.AddPrefixFieldSpec(fieldSpecs[1])
-	expected.AddSuffixFieldSpec(fieldSpecs[0])
-	expected.AddSuffixFieldSpec(fieldSpecs[1])
-
-	if !reflect.DeepEqual(actual, expected) {
-		t.Fatalf("expected: %v\n but got: %v\n", expected, actual)
-	}
+	require.NoError(t, expected.AddNamereferenceFieldSpec(nameReference[0]))
+	require.NoError(t, expected.AddNamereferenceFieldSpec(nameReference[1]))
+	require.NoError(t, expected.AddPrefixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddPrefixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddSuffixFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddSuffixFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddCommonLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddCommonLabelsFieldSpec(fieldSpecs[1]))
+	require.NoError(t, expected.AddLabelsFieldSpec(fieldSpecs[0]))
+	require.NoError(t, expected.AddLabelsFieldSpec(fieldSpecs[1]))
+	require.Equal(t, expected, actual)
 
 	actual, err = cfga.Merge(nil)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if !reflect.DeepEqual(actual, cfga) {
-		t.Fatalf("expected: %v\n but got: %v\n", cfga, actual)
+	require.NoError(t, err)
+	require.Equal(t, cfga, actual)
+}
+
+func TestMakeDefaultConfig_mutation(t *testing.T) {
+	a := MakeDefaultConfig()
+
+	// mutate
+	a.NameReference[0].Kind = "mutated"
+	a.NameReference = a.NameReference[:1]
+
+	clean := MakeDefaultConfig()
+	assert.NotEqualf(t, "mutated", clean.NameReference[0].Kind, "MakeDefaultConfig() did not return a clean copy: %+v", clean.NameReference)
+}
+
+func BenchmarkMakeDefaultConfig(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		_ = MakeDefaultConfig()
 	}
 }

api/internal/plugins/execplugin/execplugin.go

@@ -6,13 +6,12 @@ package execplugin
 import (
 	"bytes"
 	"fmt"
+	"log"
 	"os"
 	"os/exec"
 	"runtime"
 	"strings"
 
-	"github.com/google/shlex"
-
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -21,6 +20,7 @@ import (
 
 const (
 	tmpConfigFilePrefix = "kust-plugin-config-"
+	maxArgStringLength  = 131071
 )
 
 // ExecPlugin record the name and args of an executable
@@ -93,7 +93,11 @@ func (p *ExecPlugin) processOptionalArgsFields() error {
 		return err
 	}
 	if c.ArgsOneLiner != "" {
-		p.args, _ = shlex.Split(c.ArgsOneLiner)
+		argsTolenSlice, err := ShlexSplit(c.ArgsOneLiner)
+		if err != nil {
+			return fmt.Errorf("failed to parse argsOneLiner: %w", err)
+		}
+		p.args = argsTolenSlice
 	}
 	if c.ArgsFromFile != "" {
 		content, err := p.h.Loader().Load(c.ArgsFromFile)
@@ -157,35 +161,46 @@ func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
 	_, err = f.Write(p.cfg)
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			err, "writing plugin config to "+f.Name())
+			err, "writing plugin config to %s", f.Name())
 	}
 	err = f.Close()
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			err, "closing plugin config file "+f.Name())
+			err, "closing plugin config file %s", f.Name())
 	}
-	//nolint:gosec
 	cmd := exec.Command(
 		p.path, append([]string{f.Name()}, p.args...)...)
 	cmd.Env = p.getEnv()
 	cmd.Stdin = bytes.NewReader(input)
-	cmd.Stderr = os.Stderr
+	var stdErr bytes.Buffer
+	cmd.Stderr = &stdErr
 	if _, err := os.Stat(p.h.Loader().Root()); err == nil {
 		cmd.Dir = p.h.Loader().Root()
 	}
 	result, err := cmd.Output()
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			err, "failure in plugin configured via %s; %v",
-			f.Name(), err.Error())
+			fmt.Errorf("failure in plugin configured via %s; %w", f.Name(), err),
+			"%s", stdErr.String())
 	}
 	return result, os.Remove(f.Name())
 }
 
 func (p *ExecPlugin) getEnv() []string {
 	env := os.Environ()
-	env = append(env,
-		"KUSTOMIZE_PLUGIN_CONFIG_STRING="+string(p.cfg),
-		"KUSTOMIZE_PLUGIN_CONFIG_ROOT="+p.h.Loader().Root())
+	pluginConfigString := "KUSTOMIZE_PLUGIN_CONFIG_STRING=" + string(p.cfg)
+	if len(pluginConfigString) <= maxArgStringLength {
+		env = append(env, pluginConfigString)
+	} else {
+		log.Printf("KUSTOMIZE_PLUGIN_CONFIG_STRING exceeds hard limit of %d characters, the environment variable "+
+			"will be omitted", maxArgStringLength)
+	}
+	pluginConfigRoot := "KUSTOMIZE_PLUGIN_CONFIG_ROOT=" + p.h.Loader().Root()
+	if len(pluginConfigRoot) <= maxArgStringLength {
+		env = append(env, pluginConfigRoot)
+	} else {
+		log.Printf("KUSTOMIZE_PLUGIN_CONFIG_ROOT exceeds hard limit of %d characters, the environment variable "+
+			"will be omitted", maxArgStringLength)
+	}
 	return env
 }

api/internal/plugins/execplugin/execplugin_test.go

@@ -20,6 +20,12 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+const (
+	expectedLargeConfigMap = `{"apiVersion":"v1","data":{"password":"password","username":"user"},"kind":"ConfigMap",` +
+		`"metadata":{"annotations":{"internal.config.kubernetes.io/generatorBehavior":"unspecified",` +
+		`"internal.config.kubernetes.io/needsHashSuffix":"enabled"},"name":"example-configmap-test"}}`
+)
+
 func TestExecPluginConfig(t *testing.T) {
 	fSys := filesys.MakeFsInMemory()
 	err := fSys.WriteFile("sed-input.txt", []byte(`
@@ -35,7 +41,7 @@ s/$BAR/bar baz/g
 	}
 	pvd := provider.NewDefaultDepProvider()
 	rf := resmap.NewFactory(pvd.GetResourceFactory())
-	pluginConfig := rf.RF().FromMap(
+	pluginConfig, err := rf.RF().FromMap(
 		map[string]interface{}{
 			"apiVersion": "someteam.example.com/v1",
 			"kind":       "SedTransformer",
@@ -45,6 +51,9 @@ s/$BAR/bar baz/g
 			"argsOneLiner": "one two 'foo bar'",
 			"argsFromFile": "sed-input.txt",
 		})
+	if err != nil {
+		t.Fatalf("failed to writes the data to a file: %v", err)
+	}
 
 	pluginConfig.RemoveBuildAnnotations()
 	pc := types.DisabledPluginConfig()
@@ -125,3 +134,104 @@ func TestExecPlugin_ErrIfNotExecutable(t *testing.T) {
 		t.Fatalf("unexpected err: %v", err)
 	}
 }
+
+// TestExecPluginLarge loads PluginConfigs of various (large) sizes. It tests if the env variable is kept below the
+// maximum of 131072 bytes.
+func TestExecPluginLarge(t *testing.T) {
+	// Skip this test on windows.
+	if runtime.GOOS == "windows" {
+		t.Skipf("always returns nil on Windows")
+	}
+
+	// Add executable plugin.
+	srcRoot, err := utils.DeterminePluginSrcRoot(filesys.MakeFsOnDisk())
+	if err != nil {
+		t.Error(err)
+	}
+	executablePlugin := filepath.Join(
+		srcRoot, "someteam.example.com", "v1", "bashedconfigmap", "BashedConfigMap")
+	p := NewExecPlugin(executablePlugin)
+	err = p.ErrIfNotExecutable()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	// Create a fake filesystem.
+	fSys := filesys.MakeFsInMemory()
+
+	// Load plugin config.
+	ldr, err := fLdr.NewLoader(
+		fLdr.RestrictionRootOnly, filesys.Separator, fSys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pvd := provider.NewDefaultDepProvider()
+	rf := resmap.NewFactory(pvd.GetResourceFactory())
+	pc := types.DisabledPluginConfig()
+
+	// Test for various lengths. 131071 is the max length that we can have for any given env var in Bytes.
+	tcs := []struct {
+		length int
+		char   rune
+	}{
+		{1000, 'a'},
+		{131071, 'a'},
+		{131072, 'a'},
+		{200000, 'a'},
+		{131071, '安'},
+		{131074, '安'},
+	}
+	for _, tc := range tcs {
+		t.Logf("Testing with an env var length of %d and character %c", tc.length, tc.char)
+		pluginConfig, err := rf.RF().FromBytes(buildLargePluginConfig(tc.length, tc.char))
+		if err != nil {
+			t.Fatalf("unexpected err: %v", err)
+		}
+		yaml, err := pluginConfig.AsYAML()
+		if err != nil {
+			t.Fatalf("unexpected err: %v", err)
+		}
+		err = p.Config(resmap.NewPluginHelpers(ldr, pvd.GetFieldValidator(), rf, pc), yaml)
+		if err != nil {
+			t.Fatalf("unexpected err: %v", err)
+		}
+		resMap, err := p.Generate()
+		if err != nil {
+			t.Fatalf("unexpected err: %v", err)
+		}
+		rNodeSlices := resMap.ToRNodeSlice()
+		for _, rNodeSlice := range rNodeSlices {
+			json, err := rNodeSlice.MarshalJSON()
+			if err != nil {
+				t.Fatalf("unexpected err: %v", err)
+			}
+			if string(json) != expectedLargeConfigMap {
+				t.Fatalf("expected generated JSON to match %q, but got %q instead",
+					expectedLargeConfigMap, string(json))
+			}
+		}
+	}
+}
+
+// buildLargePluginConfig builds a plugin configuration of length: length - len("KUSTOMIZE_PLUGIN_CONFIG_STRING=")
+// This allows us to create an environment variable KUSTOMIZE_PLUGIN_CONFIG_STRING=<plugin content> with the exact
+// length that's provided in the length parameter. Used as a helper for TestExecPluginLarge.
+func buildLargePluginConfig(length int, char rune) []byte {
+	length -= len("KUSTOMIZE_PLUGIN_CONFIG_STRING=")
+
+	var sb strings.Builder
+	sb.WriteString("apiVersion: someteam.example.com/v1\n")
+	sb.WriteString("kind: BashedConfigMap\n")
+	sb.WriteString("metadata:\n")
+	sb.WriteString("  name: some-random-name\n")
+	sb.WriteString("argsOneLiner: \"user password\"\n")
+	sb.WriteString("customArg: ")
+
+	// Now, fill up parameter customArg: until we reach the desired length. Account for the fact that runes can be
+	// 1 to 4 Bytes each.
+	upperBound := length - sb.Len()
+	for i := 0; i < upperBound-len(string(char)); i += len(string(char)) {
+		sb.WriteRune(char)
+	}
+	return []byte(sb.String())
+}

api/internal/plugins/execplugin/shlex.go

@@ -0,0 +1,62 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// ShlexSplit splits a string into a slice of strings using shell-style rules for quoting and commenting
+// Similar to Python's shlex.split with comments enabled
+func ShlexSplit(s string) ([]string, error) {
+	return shlexSplit(s)
+}
+
+func shlexSplit(s string) ([]string, error) {
+	result := []string{}
+
+	// noQuote is used to track if we are not in a quoted
+	const noQuote = 0
+
+	var current strings.Builder
+	var quote rune = noQuote
+	var escaped bool
+
+	for _, r := range s {
+		switch {
+		case escaped:
+			current.WriteRune(r)
+			escaped = false
+		case r == '\\' && quote != '\'':
+			escaped = true
+		case (r == '\'' || r == '"') && quote == noQuote:
+			quote = r
+		case r == quote:
+			quote = noQuote
+		case r == '#' && quote == noQuote:
+			// Comment starts, ignore the rest of the line
+			if current.Len() > 0 {
+				result = append(result, current.String())
+			}
+			return result, nil
+		case unicode.IsSpace(r) && quote == noQuote:
+			if current.Len() > 0 {
+				result = append(result, current.String())
+				current.Reset()
+			}
+		default:
+			current.WriteRune(r)
+		}
+	}
+
+	if quote != noQuote {
+		return nil, fmt.Errorf("unclosed quote in string")
+	}
+	if current.Len() > 0 {
+		result = append(result, current.String())
+	}
+	return result, nil
+}

api/internal/plugins/execplugin/shlex_test.go

@@ -0,0 +1,183 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestShlexSplit(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected []string
+		wantErr  bool
+	}{
+		{
+			name:     "basic space separation",
+			input:    `hello world`,
+			expected: []string{"hello", "world"},
+			wantErr:  false,
+		},
+		{
+			name:     "double quoted string",
+			input:    `"hello world"`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "single quoted string",
+			input:    `'hello world'`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "mixed quotes and words",
+			input:    `hello "world test"`,
+			expected: []string{"hello", "world test"},
+			wantErr:  false,
+		},
+		{
+			name:     "single quotes with spaces",
+			input:    `hello 'world test'`,
+			expected: []string{"hello", "world test"},
+			wantErr:  false,
+		},
+		{
+			name:     "nested quotes - single in double",
+			input:    `"hello 'nested' world"`,
+			expected: []string{"hello 'nested' world"},
+			wantErr:  false,
+		},
+		{
+			name:     "nested quotes - double in single",
+			input:    `'hello "nested" world'`,
+			expected: []string{"hello \"nested\" world"},
+			wantErr:  false,
+		},
+		{
+			name:     "escaped space",
+			input:    `hello\ world`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "escaped quotes in double quotes",
+			input:    `"hello \"world\""`,
+			expected: []string{"hello \"world\""},
+			wantErr:  false,
+		},
+		{
+			name:     "single quote in single quotes",
+			input:    `'can'\''t'`,
+			expected: []string{"can't"},
+			wantErr:  false,
+		},
+		{
+			name:     "complex argument list",
+			input:    `arg1 "arg 2" 'arg 3' arg4`,
+			expected: []string{"arg1", "arg 2", "arg 3", "arg4"},
+			wantErr:  false,
+		},
+		{
+			name:     "echo command with escaped quotes",
+			input:    `echo "Hello, \"World!\""`,
+			expected: []string{"echo", "Hello, \"World!\""},
+			wantErr:  false,
+		},
+		{
+			name:     "grep command with quoted search term",
+			input:    `grep -r "search term" /path/to/dir`,
+			expected: []string{"grep", "-r", "search term", "/path/to/dir"},
+			wantErr:  false,
+		},
+		{
+			name:     "ls command with quoted filename",
+			input:    `ls -la "file with spaces.txt"`,
+			expected: []string{"ls", "-la", "file with spaces.txt"},
+			wantErr:  false,
+		},
+		{
+			name:     "empty string",
+			input:    ``,
+			expected: []string{},
+			wantErr:  false,
+		},
+		{
+			name:     "multiple spaces",
+			input:    `   multiple	spaces   `,
+			expected: []string{"multiple", "spaces"},
+			wantErr:  false,
+		},
+		{
+			name:     "with comment string",
+			input:    `echo "Hello, W#orld!" ${USER} # This is a comment`,
+			expected: []string{"echo", "Hello, W#orld!", "${USER}"},
+			wantErr:  false,
+		},
+		{
+			name:     "comment only",
+			input:    `# this line is just a comment`,
+			expected: []string{},
+			wantErr:  false,
+		},
+		// may cause an error in shlex at python3
+		{
+			name:     "unclosed double quote",
+			input:    `"unclosed quote`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "unclosed single quote",
+			input:    `'unclosed quote`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "mixed unclosed quotes",
+			input:    `"mixed 'quotes`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "single quote closed with double quote",
+			input:    `"hello world'`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "double quote closed with single quote",
+			input:    `'hello world"`,
+			expected: nil,
+			wantErr:  true,
+		},
+	}
+
+	// execute each test case
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// call the ShlexSplit function
+			result, err := ShlexSplit(tc.input)
+
+			// check for expected error
+			if tc.wantErr {
+				if err == nil {
+					t.Errorf("FAIL: Expected error but got none, Expected: %q\n", tc.expected)
+				}
+				return
+			}
+
+			if assert.NoError(t, err, "FAIL: Unexpected error %q for input %q", err, tc.input) {
+				// check if the result matches the expected output
+				assert.Equal(t, tc.expected, result,
+					"FAIL: Result mismatch,Input %q, Expected %q, Got: %q\n",
+					tc.input, tc.expected, result,
+				)
+			}
+		})
+	}
+}

api/internal/plugins/fnplugin/fnplugin.go

@@ -77,7 +77,6 @@ func NewFnPlugin(o *types.FnPluginLoadingOptions) *FnPlugin {
 		runFns: runfn.RunFns{
 			Functions:      []*yaml.RNode{},
 			Network:        o.Network,
-			EnableStarlark: o.EnableStar,
 			EnableExec:     o.EnableExec,
 			StorageMounts:  toStorageMounts(o.Mounts),
 			Env:            o.Env,

api/internal/plugins/loader/load_go_plugin.go

@@ -0,0 +1,62 @@
+// Copyright 2024 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+//go:build !kustomize_disable_go_plugin_support
+
+package loader
+
+import (
+	"fmt"
+	"log"
+	"plugin"
+	"reflect"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+// registry is a means to avoid trying to load the same .so file
+// into memory more than once, which results in an error.
+// Each test makes its own loader, and tries to load its own plugins,
+// but the loaded .so files are in shared memory, so one will get
+// "this plugin already loaded" errors if the registry is maintained
+// as a Loader instance variable.  So make it a package variable.
+var registry = make(map[string]resmap.Configurable) //nolint:gochecknoglobals
+
+func copyPlugin(c resmap.Configurable) resmap.Configurable {
+	indirect := reflect.Indirect(reflect.ValueOf(c))
+	newIndirect := reflect.New(indirect.Type())
+	newIndirect.Elem().Set(reflect.ValueOf(indirect.Interface()))
+	newNamed := newIndirect.Interface()
+	return newNamed.(resmap.Configurable) //nolint:forcetypeassert
+}
+
+func (l *Loader) loadGoPlugin(id resid.ResId, absPath string) (resmap.Configurable, error) {
+	regId := relativePluginPath(id)
+	if c, ok := registry[regId]; ok {
+		return copyPlugin(c), nil
+	}
+	if !utils.FileExists(absPath) {
+		return nil, fmt.Errorf(
+			"expected file with Go object code at: %s", absPath)
+	}
+	log.Printf("Attempting plugin load from %q", absPath)
+	p, err := plugin.Open(absPath)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "plugin %s fails to load", absPath)
+	}
+	symbol, err := p.Lookup(konfig.PluginSymbol)
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "plugin %s doesn't have symbol %s",
+			regId, konfig.PluginSymbol)
+	}
+	c, ok := symbol.(resmap.Configurable)
+	if !ok {
+		return nil, fmt.Errorf("plugin %q not configurable", regId)
+	}
+	registry[regId] = c
+	return copyPlugin(c), nil
+}

api/internal/plugins/loader/load_go_plugin_disabled.go

@@ -0,0 +1,25 @@
+// Copyright 2024 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// The build tag "kustomize_disable_go_plugin_support" is used to deactivate the
+// kustomize API's dependency on the "plugins" package. This is beneficial for
+// applications that need to embed it but do not have requirements for dynamic
+// Go plugins.
+// Including plugins as a dependency can lead to an increase in binary size due
+// to the population of ELF's sections such as .dynsym and .dynstr.
+// By utilizing this flag, applications have the flexibility to exclude the
+// import if they do not require support for dynamic Go plugins.
+//go:build kustomize_disable_go_plugin_support
+
+package loader
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+func (l *Loader) loadGoPlugin(_ resid.ResId, _ string) (resmap.Configurable, error) {
+	return nil, fmt.Errorf("plugin load is disabled")
+}

api/internal/plugins/loader/loader.go

@@ -5,18 +5,14 @@ package loader
 
 import (
 	"fmt"
-	"log"
 	"os"
 	"path/filepath"
-	"plugin"
-	"reflect"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
 	"sigs.k8s.io/kustomize/api/internal/plugins/fnplugin"
-	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
@@ -38,7 +34,8 @@ type Loader struct {
 }
 
 func NewLoader(
-	pc *types.PluginConfig, rf *resmap.Factory, fs filesys.FileSystem) *Loader {
+	pc *types.PluginConfig, rf *resmap.Factory, fs filesys.FileSystem,
+) *Loader {
 	return &Loader{pc: pc, rf: rf, fs: fs}
 }
 
@@ -62,7 +59,8 @@ func (l *Loader) Config() *types.PluginConfig {
 
 func (l *Loader) LoadGenerators(
 	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
-	result []*resmap.GeneratorWithProperties, err error) {
+	result []*resmap.GeneratorWithProperties, err error,
+) {
 	for _, res := range rm.Resources() {
 		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
@@ -78,7 +76,8 @@ func (l *Loader) LoadGenerators(
 }
 
 func (l *Loader) LoadGenerator(
-	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (resmap.Generator, error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (resmap.Generator, error) {
 	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
@@ -91,7 +90,8 @@ func (l *Loader) LoadGenerator(
 }
 
 func (l *Loader) LoadTransformers(
-	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]*resmap.TransformerWithProperties, error) {
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap,
+) ([]*resmap.TransformerWithProperties, error) {
 	var result []*resmap.TransformerWithProperties
 	for _, res := range rm.Resources() {
 		t, err := l.LoadTransformer(ldr, v, res)
@@ -108,7 +108,8 @@ func (l *Loader) LoadTransformers(
 }
 
 func (l *Loader) LoadTransformer(
-	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (*resmap.TransformerWithProperties, error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (*resmap.TransformerWithProperties, error) {
 	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
@@ -183,7 +184,8 @@ func isBuiltinPlugin(res *resource.Resource) bool {
 func (l *Loader) loadAndConfigurePlugin(
 	ldr ifc.Loader,
 	v ifc.Validator,
-	res *resource.Resource) (c resmap.Configurable, err error) {
+	res *resource.Resource,
+) (c resmap.Configurable, err error) {
 	if isBuiltinPlugin(res) {
 		switch l.pc.BpLoadingOptions {
 		case types.BploLoadFromFileSys:
@@ -196,7 +198,7 @@ func (l *Loader) loadAndConfigurePlugin(
 			c, err = l.makeBuiltinPlugin(res.GetGvk())
 		default:
 			err = fmt.Errorf(
-				"unknown plugin loader behavior specified: %v",
+				"unknown plugin loader behavior specified: %s %v", res.GetGvk().String(),
 				l.pc.BpLoadingOptions)
 		}
 	} else {
@@ -249,7 +251,7 @@ func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error)
 				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
 					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src)
 			}
-			if strings.HasPrefix(filepath.Clean(mount.Src), "../") {
+			if strings.HasPrefix(filepath.Clean(mount.Src), "..") {
 				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
 					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src)
 			}
@@ -286,47 +288,3 @@ func (l *Loader) loadExecOrGoPlugin(resId resid.ResId) (resmap.Configurable, err
 	}
 	return c, nil
 }
-
-// registry is a means to avoid trying to load the same .so file
-// into memory more than once, which results in an error.
-// Each test makes its own loader, and tries to load its own plugins,
-// but the loaded .so files are in shared memory, so one will get
-// "this plugin already loaded" errors if the registry is maintained
-// as a Loader instance variable.  So make it a package variable.
-var registry = make(map[string]resmap.Configurable)
-
-func (l *Loader) loadGoPlugin(id resid.ResId, absPath string) (resmap.Configurable, error) {
-	regId := relativePluginPath(id)
-	if c, ok := registry[regId]; ok {
-		return copyPlugin(c), nil
-	}
-	if !utils.FileExists(absPath) {
-		return nil, fmt.Errorf(
-			"expected file with Go object code at: %s", absPath)
-	}
-	log.Printf("Attempting plugin load from '%s'", absPath)
-	p, err := plugin.Open(absPath)
-	if err != nil {
-		return nil, errors.WrapPrefixf(err, "plugin %s fails to load", absPath)
-	}
-	symbol, err := p.Lookup(konfig.PluginSymbol)
-	if err != nil {
-		return nil, errors.WrapPrefixf(
-			err, "plugin %s doesn't have symbol %s",
-			regId, konfig.PluginSymbol)
-	}
-	c, ok := symbol.(resmap.Configurable)
-	if !ok {
-		return nil, fmt.Errorf("plugin '%s' not configurable", regId)
-	}
-	registry[regId] = c
-	return copyPlugin(c), nil
-}
-
-func copyPlugin(c resmap.Configurable) resmap.Configurable {
-	indirect := reflect.Indirect(reflect.ValueOf(c))
-	newIndirect := reflect.New(indirect.Type())
-	newIndirect.Elem().Set(reflect.ValueOf(indirect.Interface()))
-	newNamed := newIndirect.Interface()
-	return newNamed.(resmap.Configurable)
-}

api/internal/plugins/loader/loader_test.go

@@ -18,7 +18,6 @@ import (
 )
 
 const (
-	//nolint:gosec
 	secretGenerator = `
 apiVersion: builtin
 kind: SecretGenerator
@@ -96,3 +95,43 @@ func TestLoaderWithWorkingDir(t *testing.T) {
 		npLdr.Config().FnpLoadingOptions.WorkingDir,
 		"the plugin working dir is not updated")
 }
+
+func TestLoaderWithStorageMounts(t *testing.T) {
+	const storageMountTransformer = `
+apiVersion: com.example.kustomize/v1
+kind: Test
+metadata:
+  name: test-transformer
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: test
+        mounts:
+          - type: bind
+            src: ../
+            dst: /mount
+`
+	p := provider.NewDefaultDepProvider()
+	rmF := resmap.NewFactory(p.GetResourceFactory())
+	fsys := filesys.MakeFsInMemory()
+	fLdr, err := loader.NewLoader(
+		loader.RestrictionRootOnly,
+		filesys.Separator, fsys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configs, err := rmF.NewResMapFromBytes([]byte(storageMountTransformer))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := types.EnabledPluginConfig(types.BploLoadFromFileSys)
+	pLdr := NewLoader(c, rmF, fsys)
+	if pLdr == nil {
+		t.Fatal("expect non-nil loader")
+	}
+	_, err = pLdr.LoadTransformers(
+		fLdr, valtest_test.MakeFakeValidator(), configs)
+	if err == nil { // should fail because src specified is outside root
+		t.Fatal("the loader allowed a mount outside root")
+	}
+}

api/internal/plugins/utils/utils_test.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/provider"
@@ -33,11 +32,14 @@ func TestDeterminePluginSrcRoot(t *testing.T) {
 }
 
 func makeConfigMap(rf *resource.Factory, name, behavior string, hashValue *string) *resource.Resource {
-	r := rf.FromMap(map[string]interface{}{
+	r, err := rf.FromMap(map[string]interface{}{
 		"apiVersion": "v1",
 		"kind":       "ConfigMap",
 		"metadata":   map[string]interface{}{"name": name},
 	})
+	if err != nil {
+		panic(err)
+	}
 	annotations := map[string]string{}
 	if behavior != "" {
 		annotations[BehaviorAnnotation] = behavior
@@ -53,7 +55,7 @@ func makeConfigMap(rf *resource.Factory, name, behavior string, hashValue *strin
 	return r
 }
 
-func makeConfigMapOptions(rf *resource.Factory, name, behavior string, disableHash bool) *resource.Resource {
+func makeConfigMapOptions(rf *resource.Factory, name, behavior string, disableHash bool) (*resource.Resource, error) {
 	return rf.FromMapAndOption(map[string]interface{}{
 		"apiVersion": "v1",
 		"kind":       "ConfigMap",
@@ -89,12 +91,16 @@ func TestUpdateResourceOptions(t *testing.T) {
 		name := fmt.Sprintf("test%d", i)
 		err := in.Append(makeConfigMap(rf, name, c.behavior, c.hashValue))
 		require.NoError(t, err)
-		err = expected.Append(makeConfigMapOptions(rf, name, c.behavior, !c.needsHash))
+		config, err := makeConfigMapOptions(rf, name, c.behavior, !c.needsHash)
+		if err != nil {
+			t.Errorf("expected new instance with an options but got error: %v", err)
+		}
+		err = expected.Append(config)
 		require.NoError(t, err)
 	}
 	actual, err := UpdateResourceOptions(in)
-	assert.NoError(t, err)
-	assert.NoError(t, expected.ErrorIfNotEqualLists(actual))
+	require.NoError(t, err)
+	require.NoError(t, expected.ErrorIfNotEqualLists(actual))
 }
 
 func TestUpdateResourceOptionsWithInvalidHashAnnotationValues(t *testing.T) {

api/internal/target/kusttarget.go

@@ -29,13 +29,14 @@ import (
 
 // KustTarget encapsulates the entirety of a kustomization build.
 type KustTarget struct {
-	kustomization *types.Kustomization
-	kustFileName  string
-	ldr           ifc.Loader
-	validator     ifc.Validator
-	rFactory      *resmap.Factory
-	pLdr          *loader.Loader
-	origin        *resource.Origin
+	kustomization     *types.Kustomization
+	kustFileName      string
+	ldr               ifc.Loader
+	validator         ifc.Validator
+	rFactory          *resmap.Factory
+	pLdr              *loader.Loader
+	origin            *resource.Origin
+	helmRootNamespace string // namespace inherited from parent kustomization for HelmCharts
 }
 
 // NewKustTarget returns a new instance of KustTarget.
@@ -425,7 +426,14 @@ func (kt *KustTarget) accumulateResources(
 			}
 			ldr, err := kt.ldr.New(path)
 			if err != nil {
-				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
+				// If accumulateFile found malformed YAML and there was a failure
+				// loading the resource as a base, then the resource is likely a
+				// file. The loader failure message is unnecessary, and could be
+				// confusing. Report only the file load error.
+				//
+				// However, a loader timeout implies there is a git repo at the
+				// path. In that case, both errors could be important.
+				if kusterr.IsMalformedYAMLError(errF) && !utils.IsErrTimeout(err) {
 					return nil, errF
 				}
 				return nil, errors.WrapPrefixf(
@@ -442,9 +450,6 @@ func (kt *KustTarget) accumulateResources(
 				ra, err = kt.accumulateDirectory(ra, ldr, false)
 			}
 			if err != nil {
-				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
-					return nil, errF
-				}
 				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
@@ -453,7 +458,7 @@ func (kt *KustTarget) accumulateResources(
 	return ra, nil
 }
 
-// accumulateResources fills the given resourceAccumulator
+// accumulateComponents fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateComponents(
 	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {
@@ -492,6 +497,16 @@ func (kt *KustTarget) accumulateDirectory(
 	}
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
 	subKt.origin = kt.origin
+	// Propagate namespace to child kustomization's helmRootNamespace for HelmCharts
+	// This ensures Helm charts in base kustomizations inherit namespace from overlays
+	// without affecting other transformers like patches
+	// Fixes https://github.com/kubernetes-sigs/kustomize/issues/6031
+	// Fixes https://github.com/kubernetes-sigs/kustomize/issues/6027
+	if kt.kustomization.Namespace != "" {
+		subKt.helmRootNamespace = kt.kustomization.Namespace
+	} else if kt.helmRootNamespace != "" {
+		subKt.helmRootNamespace = kt.helmRootNamespace
+	}
 	var bytes []byte
 	if openApiPath, exists := subKt.Kustomization().OpenAPI["path"]; exists {
 		bytes, err = ldr.Load(openApiPath)

api/internal/target/kusttarget_configplugin.go

@@ -166,6 +166,16 @@ var generatorConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		for _, chart := range kt.kustomization.HelmCharts {
 			c.HelmGlobals = globals
 			c.HelmChart = chart
+			// Pass kustomize namespace to helm
+			// Fixes https://github.com/kubernetes-sigs/kustomize/issues/5566
+			// Also propagate parent namespace for multi-level kustomization hierarchies
+			if c.HelmChart.Namespace == "" {
+				if kt.kustomization.Namespace != "" {
+					c.HelmChart.Namespace = kt.kustomization.Namespace
+				} else if kt.helmRootNamespace != "" {
+					c.HelmChart.Namespace = kt.helmRootNamespace
+				}
+			}
 			p := f()
 			if err = kt.configureBuiltinPlugin(p, c, bpt); err != nil {
 				return nil, err
@@ -250,10 +260,10 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			return
 		}
 		var c struct {
-			Path    string          `json:"path,omitempty" yaml:"path,omitempty"`
-			Patch   string          `json:"patch,omitempty" yaml:"patch,omitempty"`
-			Target  *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
-			Options map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+			Path    string           `json:"path,omitempty"    yaml:"path,omitempty"`
+			Patch   string           `json:"patch,omitempty"   yaml:"patch,omitempty"`
+			Target  *types.Selector  `json:"target,omitempty"  yaml:"target,omitempty"`
+			Options *types.PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
 		}
 		for _, pc := range kt.kustomization.Patches {
 			c.Target = pc.Target
@@ -275,13 +285,25 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		if len(kt.kustomization.Labels) == 0 && len(kt.kustomization.CommonLabels) == 0 {
 			return
 		}
+
+		type labelStruct struct {
+			Labels     map[string]string
+			FieldSpecs []types.FieldSpec
+		}
+
 		for _, label := range kt.kustomization.Labels {
-			var c struct {
-				Labels     map[string]string
-				FieldSpecs []types.FieldSpec
-			}
+			var c labelStruct
+
 			c.Labels = label.Pairs
 			fss := types.FsSlice(label.FieldSpecs)
+
+			// merge labels specified in the label section of transformer configs
+			// these apply to selectors and templates
+			fss, err := fss.MergeAll(tc.Labels)
+			if err != nil {
+				return nil, fmt.Errorf("failed to merge labels: %w", err)
+			}
+
 			// merge the custom fieldSpecs with the default
 			if label.IncludeSelectors {
 				fss, err = fss.MergeAll(tc.CommonLabels)
@@ -297,7 +319,7 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 				fss, err = fss.MergeOne(types.FieldSpec{Path: "metadata/labels", CreateIfNotPresent: true})
 			}
 			if err != nil {
-				return nil, err
+				return nil, fmt.Errorf("failed to merge labels: %w", err)
 			}
 			c.FieldSpecs = fss
 			p := f()
@@ -307,10 +329,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			}
 			result = append(result, p)
 		}
-		var c struct {
-			Labels     map[string]string
-			FieldSpecs []types.FieldSpec
-		}
+
+		var c labelStruct
+
 		c.Labels = kt.kustomization.CommonLabels
 		c.FieldSpecs = tc.CommonLabels
 		p := f()

api/internal/target/kusttarget_test.go

@@ -6,13 +6,17 @@ package target_test
 import (
 	"encoding/base64"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/ifc"
 	. "sigs.k8s.io/kustomize/api/internal/target"
+	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/pkg/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -189,13 +193,67 @@ metadata:
 
 	pvd := provider.NewDefaultDepProvider()
 	resFactory := pvd.GetResourceFactory()
+	name0 := "dply1"
 
-	resources := []*resource.Resource{
-		resFactory.FromMapWithName("dply1", map[string]interface{}{
-			"apiVersion": "apps/v1",
-			"kind":       "Deployment",
+	r0, err := resFactory.FromMapWithName(name0, map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":      "foo-dply1-bar",
+			"namespace": "ns1",
+			"labels": map[string]interface{}{
+				"app": "nginx",
+			},
+			"annotations": map[string]interface{}{
+				"note": "This is a test annotation",
+			},
+		},
+		"spec": map[string]interface{}{
+			"replica": "3",
+			"selector": map[string]interface{}{
+				"matchLabels": map[string]interface{}{
+					"app": "nginx",
+				},
+			},
+			"template": map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"annotations": map[string]interface{}{
+						"note": "This is a test annotation",
+					},
+					"labels": map[string]interface{}{
+						"app": "nginx",
+					},
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name0, err)
+	}
+	name1 := "ns1"
+	r1, err := resFactory.FromMapWithName(name1, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "Namespace",
+		"metadata": map[string]interface{}{
+			"name": "ns1",
+			"labels": map[string]interface{}{
+				"app": "nginx",
+			},
+			"annotations": map[string]interface{}{
+				"note": "This is a test annotation",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name1, err)
+	}
+
+	r2, _ := resFactory.FromMapWithName("literalConfigMap",
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
 			"metadata": map[string]interface{}{
-				"name":      "foo-dply1-bar",
+				"name":      "foo-literalConfigMap-bar-g5f6t456f5",
 				"namespace": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
@@ -204,30 +262,20 @@ metadata:
 					"note": "This is a test annotation",
 				},
 			},
-			"spec": map[string]interface{}{
-				"replica": "3",
-				"selector": map[string]interface{}{
-					"matchLabels": map[string]interface{}{
-						"app": "nginx",
-					},
-				},
-				"template": map[string]interface{}{
-					"metadata": map[string]interface{}{
-						"annotations": map[string]interface{}{
-							"note": "This is a test annotation",
-						},
-						"labels": map[string]interface{}{
-							"app": "nginx",
-						},
-					},
-				},
+			"data": map[string]interface{}{
+				"DB_USERNAME": "admin",
+				"DB_PASSWORD": "somepw",
 			},
-		}),
-		resFactory.FromMapWithName("ns1", map[string]interface{}{
+		})
+
+	name2 := "secret"
+	r3, err := resFactory.FromMapWithName(name2,
+		map[string]interface{}{
 			"apiVersion": "v1",
-			"kind":       "Namespace",
+			"kind":       "Secret",
 			"metadata": map[string]interface{}{
-				"name": "ns1",
+				"name":      "foo-secret-bar-82c2g5f8f6",
+				"namespace": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
 				},
@@ -235,65 +283,37 @@ metadata:
 					"note": "This is a test annotation",
 				},
 			},
-		}),
-		resFactory.FromMapWithName("literalConfigMap",
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "ConfigMap",
-				"metadata": map[string]interface{}{
-					"name":      "foo-literalConfigMap-bar-g5f6t456f5",
-					"namespace": "ns1",
-					"labels": map[string]interface{}{
-						"app": "nginx",
-					},
-					"annotations": map[string]interface{}{
-						"note": "This is a test annotation",
-					},
-				},
-				"data": map[string]interface{}{
-					"DB_USERNAME": "admin",
-					"DB_PASSWORD": "somepw",
-				},
-			}),
-		resFactory.FromMapWithName("secret",
-			map[string]interface{}{
-				"apiVersion": "v1",
-				"kind":       "Secret",
-				"metadata": map[string]interface{}{
-					"name":      "foo-secret-bar-82c2g5f8f6",
-					"namespace": "ns1",
-					"labels": map[string]interface{}{
-						"app": "nginx",
-					},
-					"annotations": map[string]interface{}{
-						"note": "This is a test annotation",
-					},
-				},
-				"type": ifc.SecretTypeOpaque,
-				"data": map[string]interface{}{
-					"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
-					"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
-				},
-			}),
+			"type": ifc.SecretTypeOpaque,
+			"data": map[string]interface{}{
+				"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
+				"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
+			},
+		})
+	if err != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name2, err)
 	}
 
+	resources := []*resource.Resource{r0, r1, r2, r3}
+
 	expected := resmap.New()
 	for _, r := range resources {
-		if err := expected.Append(r); err != nil {
-			t.Fatalf("unexpected error %v", err)
-		}
+		require.NoError(t, expected.Append(r), "failed to append resource: %v")
 	}
 	expected.RemoveBuildAnnotations()
+	require.NoError(t, expected.RemoveTransformerAnnotations())
+	require.NoError(t, expected.RemoveOriginAnnotations())
 	expYaml, err := expected.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	kt := makeKustTargetWithRf(t, th.GetFSys(), "/whatever", pvd)
-	assert.NoError(t, kt.Load())
+	require.NoError(t, kt.Load())
 	actual, err := kt.MakeCustomizedResMap()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	actual.RemoveBuildAnnotations()
+	require.NoError(t, actual.RemoveTransformerAnnotations())
+	require.NoError(t, actual.RemoveOriginAnnotations())
 	actYaml, err := actual.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, string(expYaml), string(actYaml))
 }
 
@@ -313,19 +333,21 @@ configurations:
 	th.WriteF("/merge-config/name-prefix-rules.yaml", `
 namePrefix:
 - path: metadata/name
-  apiVersion: v1
+  group: apps
+  version: v1
   kind: Deployment
 - path: metadata/name
-  apiVersion: v1
+  version: v1
   kind: Secret
 `)
 	th.WriteF("/merge-config/name-suffix-rules.yaml", `
 nameSuffix:
 - path: metadata/name
-  apiVersion: v1
+  version: v1
   kind: ConfigMap
 - path: metadata/name
-  apiVersion: v1
+  group: apps
+  version: v1
   kind: Deployment
 `)
 	th.WriteF("/merge-config/deployment.yaml", `
@@ -350,37 +372,51 @@ metadata:
 	pvd := provider.NewDefaultDepProvider()
 	resFactory := pvd.GetResourceFactory()
 
-	resources := []*resource.Resource{
-		resFactory.FromMapWithName("deployment1", map[string]interface{}{
-			"apiVersion": "apps/v1",
-			"kind":       "Deployment",
-			"metadata": map[string]interface{}{
-				"name":      "foo-deployment1-bar",
-				"namespace": "ns1",
-			},
-		}), resFactory.FromMapWithName("config", map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "ConfigMap",
-			"metadata": map[string]interface{}{
-				"name":      "config-bar",
-				"namespace": "ns1",
-			},
-		}), resFactory.FromMapWithName("secret", map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "Secret",
-			"metadata": map[string]interface{}{
-				"name":      "foo-secret",
-				"namespace": "ns1",
-			},
-		}),
+	name0 := "deployment1"
+	r0, err0 := resFactory.FromMapWithName(name0, map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":      "foo-deployment1-bar",
+			"namespace": "ns1",
+		},
+	})
+	if err0 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name0, err0)
 	}
-
+	name1 := "config"
+	r1, err1 := resFactory.FromMapWithName(name1, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "ConfigMap",
+		"metadata": map[string]interface{}{
+			"name":      "config-bar",
+			"namespace": "ns1",
+		},
+	})
+	if err1 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name1, err1)
+	}
+	name2 := "secret"
+	r2, err2 := resFactory.FromMapWithName(name2, map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "Secret",
+		"metadata": map[string]interface{}{
+			"name":      "foo-secret",
+			"namespace": "ns1",
+		},
+	})
+	if err2 != nil {
+		t.Fatalf("failed to get instance with given name %v: %v", name2, err2)
+	}
+	var resources = []*resource.Resource{r0, r1, r2}
 	expected := resmap.New()
 	for _, r := range resources {
 		err := expected.Append(r)
 		require.NoError(t, err)
 	}
 	expected.RemoveBuildAnnotations()
+	require.NoError(t, expected.RemoveTransformerAnnotations())
+	require.NoError(t, expected.RemoveOriginAnnotations())
 	expYaml, err := expected.AsYaml()
 	require.NoError(t, err)
 
@@ -389,6 +425,8 @@ metadata:
 	actual, err := kt.MakeCustomizedResMap()
 	require.NoError(t, err)
 	actual.RemoveBuildAnnotations()
+	require.NoError(t, actual.RemoveTransformerAnnotations())
+	require.NoError(t, actual.RemoveOriginAnnotations())
 	actYaml, err := actual.AsYaml()
 	require.NoError(t, err)
 	require.Equal(t, string(expYaml), string(actYaml))
@@ -423,7 +461,7 @@ func TestDuplicateExternalGeneratorsForbidden(t *testing.T) {
     configPath: another_config.json
 `)
 	_, err := makeAndLoadKustTarget(t, th.GetFSys(), "/generator").AccumulateTarget()
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "may not add resource with an already registered id: ManifestGenerator.v1.generators.example/ManifestGenerator")
 }
 
@@ -452,6 +490,151 @@ func TestDuplicateExternalTransformersForbidden(t *testing.T) {
   value: 'fail'
 `)
 	_, err := makeAndLoadKustTarget(t, th.GetFSys(), "/transformer").AccumulateTarget()
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "may not add resource with an already registered id: ValueAnnotator.v1.transformers.example.co/notImportantHere")
 }
+
+func TestErrorMessageForMalformedYAML(t *testing.T) {
+	// These testcases verify behavior for the scenario described in
+	// https://github.com/kubernetes-sigs/kustomize/issues/5540 .
+
+	testcases := map[string]struct {
+		loaderNewReturnsError error
+		shouldShowLoadError   bool
+	}{
+		"shouldShowLoadError": {
+			loaderNewReturnsError: utils.NewErrTimeOut(time.Second, "git init"),
+			shouldShowLoadError:   true,
+		},
+		"shouldNotShowLoadError": {
+			loaderNewReturnsError: NewErrMissingKustomization("/should-fail/resources.yaml"),
+			shouldShowLoadError:   false,
+		},
+	}
+
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("/should-fail/kustomization.yaml", `resources:
+- resources.yaml
+`)
+	th.WriteF("/should-fail/resources.yaml", `<!DOCTYPE html>
+<html class="html-devise-layout ui-light-gray" lang="en">
+<head prefix="og: http://ogp.me/ns#">
+<meta charset="utf-8">
+`)
+
+	for name, tc := range testcases {
+		t.Run(name, func(subT *testing.T) {
+			ldrWrapper := func(baseLoader ifc.Loader) ifc.Loader {
+				return loaderNewThrowsError{
+					baseLoader:      baseLoader,
+					newReturnsError: tc.loaderNewReturnsError,
+				}
+			}
+			_, err := makeAndLoadKustTargetWithLoaderOverride(t, th.GetFSys(), "/should-fail", ldrWrapper).AccumulateTarget()
+			require.Error(t, err)
+			errString := err.Error()
+			assert.Contains(t, errString, "accumulating resources from 'resources.yaml'")
+			assert.Contains(t, errString, "MalformedYAMLError: yaml: line 3: mapping values are not allowed in this context")
+			if tc.shouldShowLoadError {
+				assert.Regexp(t, `hit \w+ timeout running '`, errString)
+			} else {
+				assert.NotRegexp(t, `hit \w+ timeout running '`, errString)
+			}
+		})
+	}
+}
+
+// loaderNewReturnsError duplicates baseLoader's behavior except
+// that New() returns the specified error.
+type loaderNewThrowsError struct {
+	baseLoader      ifc.Loader
+	newReturnsError error
+}
+
+func (l loaderNewThrowsError) Repo() string {
+	return l.baseLoader.Repo()
+}
+
+func (l loaderNewThrowsError) Root() string {
+	return l.baseLoader.Root()
+}
+
+func (l loaderNewThrowsError) New(_ string) (ifc.Loader, error) {
+	return nil, l.newReturnsError
+}
+
+func (l loaderNewThrowsError) Load(location string) ([]byte, error) {
+	return l.baseLoader.Load(location) //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func (l loaderNewThrowsError) Cleanup() error {
+	return l.baseLoader.Cleanup() //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func TestErrorMessageForMalformedYAMLAndInvalidBase(t *testing.T) {
+	// These testcases verify behavior for the scenario described in
+	// https://github.com/kubernetes-sigs/kustomize/issues/5692 .
+
+	// Use a test server to fake the remote file response
+	handler := http.NewServeMux()
+	handler.HandleFunc("/", func(out http.ResponseWriter, req *http.Request) {
+		// Per issue #5692, the server should return a 200 status code with a response body that fails to parse as YAML
+		out.WriteHeader(http.StatusOK)
+		_, _ = out.Write([]byte(`<!DOCTYPE html>
+<html class="html-devise-layout ui-light-gray" lang="en">
+<head prefix="og: http://ogp.me/ns#">`))
+	})
+	svr := httptest.NewServer(handler)
+	defer svr.Close()
+
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("/should-fail/kustomization.yml", "resources:\n- "+svr.URL)
+	th.WriteF("/should-fail/remote-repo/kustomization.yml", "this: is not a kustomization file!")
+
+	ldrWrapper := func(baseLoader ifc.Loader) ifc.Loader {
+		return &loaderWithRenamedRoots{
+			baseLoader: baseLoader,
+			fakeRootMap: map[string]string{
+				// Use the "remote-repo" subdir instead of the remote git repo
+				svr.URL: "remote-repo",
+			},
+		}
+	}
+
+	_, err := makeAndLoadKustTargetWithLoaderOverride(t, th.GetFSys(), "/should-fail", ldrWrapper).AccumulateTarget()
+	require.Error(t, err)
+	errString := err.Error()
+	assert.Contains(t, errString, "accumulating resources from '"+svr.URL+"'")
+	assert.Contains(t, errString, "MalformedYAMLError: yaml: line 3: mapping values are not allowed in this context")
+	assert.Contains(t, errString, `invalid Kustomization: json: unknown field "this"`)
+}
+
+// loaderWithRenamedRoots is a loader that can map New() roots to some other name
+type loaderWithRenamedRoots struct {
+	baseLoader  ifc.Loader
+	fakeRootMap map[string]string
+}
+
+func (l loaderWithRenamedRoots) Repo() string {
+	return l.baseLoader.Repo()
+}
+
+func (l loaderWithRenamedRoots) Root() string {
+	return l.baseLoader.Root()
+}
+
+func (l loaderWithRenamedRoots) New(newRoot string) (ifc.Loader, error) {
+	if otherRoot, ok := l.fakeRootMap[newRoot]; ok {
+		return l.baseLoader.New(otherRoot) //nolint:wrapcheck // baseLoader's error is sufficient
+	}
+
+	return l.baseLoader.New(newRoot) //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func (l loaderWithRenamedRoots) Load(path string) ([]byte, error) {
+	return l.baseLoader.Load(path) //nolint:wrapcheck // baseLoader's error is sufficient
+}
+
+func (l loaderWithRenamedRoots) Cleanup() error {
+	return l.baseLoader.Cleanup() //nolint:wrapcheck // baseLoader's error is sufficient
+}

api/internal/target/maker_test.go

@@ -6,6 +6,7 @@ package target_test
 import (
 	"testing"
 
+	"sigs.k8s.io/kustomize/api/ifc"
 	fLdr "sigs.k8s.io/kustomize/api/internal/loader"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
@@ -21,11 +22,7 @@ func makeAndLoadKustTarget(
 	fSys filesys.FileSystem,
 	root string) *target.KustTarget {
 	t.Helper()
-	kt := makeKustTargetWithRf(t, fSys, root, provider.NewDefaultDepProvider())
-	if err := kt.Load(); err != nil {
-		t.Fatalf("Unexpected load error %v", err)
-	}
-	return kt
+	return makeAndLoadKustTargetWithLoaderOverride(t, fSys, root, nil)
 }
 
 func makeKustTargetWithRf(
@@ -34,10 +31,37 @@ func makeKustTargetWithRf(
 	root string,
 	pvd *provider.DepProvider) *target.KustTarget {
 	t.Helper()
-	ldr, err := fLdr.NewLoader(fLdr.RestrictionRootOnly, root, fSys)
+	return makeKustTargetWithRfAndLoaderOverride(t, fSys, root, pvd, nil)
+}
+
+func makeAndLoadKustTargetWithLoaderOverride(
+	t *testing.T,
+	fSys filesys.FileSystem,
+	root string,
+	ldrWrapperFn func(ifc.Loader) ifc.Loader) *target.KustTarget {
+	t.Helper()
+	kt := makeKustTargetWithRfAndLoaderOverride(t, fSys, root, provider.NewDefaultDepProvider(), ldrWrapperFn)
+	if err := kt.Load(); err != nil {
+		t.Fatalf("Unexpected load error %v", err)
+	}
+	return kt
+}
+
+func makeKustTargetWithRfAndLoaderOverride(
+	t *testing.T,
+	fSys filesys.FileSystem,
+	root string,
+	pvd *provider.DepProvider,
+	ldrWrapperFn func(ifc.Loader) ifc.Loader) *target.KustTarget {
+	t.Helper()
+	baseLoader, err := fLdr.NewLoader(fLdr.RestrictionRootOnly, root, fSys)
 	if err != nil {
 		t.Fatal(err)
 	}
+	ldr := baseLoader
+	if ldrWrapperFn != nil {
+		ldr = ldrWrapperFn(baseLoader)
+	}
 	rf := resmap.NewFactory(pvd.GetResourceFactory())
 	pc := types.DisabledPluginConfig()
 	return target.NewKustTarget(

api/internal/utils/errtimeout.go

@@ -15,11 +15,11 @@ type errTimeOut struct {
 	cmd      string
 }
 
-func NewErrTimeOut(d time.Duration, c string) errTimeOut {
-	return errTimeOut{duration: d, cmd: c}
+func NewErrTimeOut(d time.Duration, c string) *errTimeOut {
+	return &errTimeOut{duration: d, cmd: c}
 }
 
-func (e errTimeOut) Error() string {
+func (e *errTimeOut) Error() string {
 	return fmt.Sprintf("hit %s timeout running '%s'", e.duration, e.cmd)
 }
 

api/internal/utils/timedcall.go

@@ -10,7 +10,7 @@ import (
 // TimedCall runs fn, failing if it doesn't complete in the given duration.
 // The description is used in the timeout error message.
 func TimedCall(description string, d time.Duration, fn func() error) error {
-	done := make(chan error)
+	done := make(chan error, 1)
 	timer := time.NewTimer(d)
 	defer timer.Stop()
 	go func() { done <- fn() }()

api/internal/utils/timedcall_test.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/goleak"
 	. "sigs.k8s.io/kustomize/api/internal/utils"
 )
 
@@ -62,3 +63,20 @@ func TestTimedCallSlowWithError(t *testing.T) {
 		t.Fail()
 	}
 }
+
+func TestTimedCallGoroutineLeak(t *testing.T) {
+	defer goleak.VerifyNone(t)
+	err := TimedCall("function done, no goroutine leaks", timeToWait, func() error {
+		time.Sleep(tooSlow)
+		return fmt.Errorf("function done")
+	})
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("function done, no goroutine leaks"))
+	} else {
+		t.Fail()
+	}
+
+	// The code introduces a 2-second sleep to allow the goroutine to complete its execution.
+	// Subsequently, it verifies if the goroutine created by the function exits as expected.
+	time.Sleep(tooSlow)
+}

api/konfig/general.go

@@ -46,4 +46,7 @@ const (
 
 	// Label key that indicates the resources are validated by a validator
 	ValidatedByLabelKey = "validated-by"
+
+	// Annotation key for marking helm-generated resources to skip namespace transformation
+	HelmGeneratedAnnotation = ConfigAnnoDomain + "/helm-generated"
 )

api/krusty/accumulation_test.go

@@ -5,6 +5,8 @@ package krusty_test
 
 import (
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -29,6 +31,20 @@ spec:
     - port: 7002
 `
 
+const invalidResource = `apiVersion: v1
+kind: Service
+metadata:
+  name: kapacitor
+  labels:
+    app.kubernetes.io/name: tick-kapacitor
+spec:
+  selector:
+    app.kubernetes.io/name: tick-kapacitor
+    - name: http
+      port: 9092
+      protocol: TCP
+  type: ClusterIP`
+
 func TestTargetMustHaveKustomizationFile(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteF("service.yaml", `
@@ -169,10 +185,15 @@ spec:
 
 func TestAccumulateResourcesErrors(t *testing.T) {
 	type testcase struct {
-		name       string
-		resource   string
-		isAbsolute bool
-		files      map[string]string
+		name     string
+		resource string
+		// resourceFunc generates a resource string using the URL to the local
+		// test server (optional).
+		resourceFunc func(string) string
+		// resourceServerSetup configures the local test server (optional).
+		resourceServerSetup func(*http.ServeMux)
+		isAbsolute          bool
+		files               map[string]string
 		// errFile, errDir are regex for the expected error message output
 		// when kustomize tries to accumulate resource as file and dir,
 		// respectively. The test substitutes occurrences of "%s" in the
@@ -221,9 +242,14 @@ resources:
 	for _, test := range []testcase{
 		{
 			name: "remote file not considered repo",
-			// The example.com second-level domain is reserved and
-			// safe to access, see RFC 2606.
-			resource: "https://example.com/segments-too-few-to-be-repo",
+			resourceFunc: func(url string) string {
+				return fmt.Sprintf("%s/segments-too-few-to-be-repo", url)
+			},
+			resourceServerSetup: func(server *http.ServeMux) {
+				server.HandleFunc("/", func(out http.ResponseWriter, req *http.Request) {
+					out.WriteHeader(http.StatusNotFound)
+				})
+			},
 			// It's acceptable for the error output of a remote file-like
 			// resource to not indicate the resource's status as a
 			// local directory. Though it is possible for a remote file-like
@@ -231,8 +257,15 @@ resources:
 			errFile: `HTTP Error: status code 404 \(Not Found\)\z`,
 		},
 		{
-			name:     "remote file qualifies as repo",
-			resource: "https://example.com/long/enough/to/have/org/and/repo",
+			name: "remote file qualifies as repo",
+			resourceFunc: func(url string) string {
+				return fmt.Sprintf("%s/long/enough/to/have/org/and/repo", url)
+			},
+			resourceServerSetup: func(server *http.ServeMux) {
+				server.HandleFunc("/", func(out http.ResponseWriter, req *http.Request) {
+					out.WriteHeader(http.StatusInternalServerError)
+				})
+			},
 			// TODO(4788): This error message is technically wrong. Just
 			// because we fail to GET a resource does not mean the resource is
 			// not a remote file. We should return the GET status code as well.
@@ -283,8 +316,29 @@ resources:
 			// know resource is file.
 			errDir: `new root '%s' cannot be absolute`,
 		},
+		{
+			name:     "malformed yaml yields an error",
+			resource: "service.yaml",
+			files: map[string]string{
+				"service.yaml": invalidResource,
+			},
+			errFile: "MalformedYAMLError",
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
+			if test.resourceFunc != nil {
+				// Configure test server handler
+				handler := http.NewServeMux()
+				if test.resourceServerSetup != nil {
+					test.resourceServerSetup(handler)
+				}
+				// Start test server
+				svr := httptest.NewServer(handler)
+				defer svr.Close()
+				// Generate resource with test server address
+				test.resource = test.resourceFunc(svr.URL)
+			}
+
 			// Should use real file system to indicate that we are creating
 			// new temporary directories on disk when we attempt to fetch repos.
 			fs, tmpDir := kusttest_test.Setup(t)
@@ -306,5 +360,4 @@ resources:
 	// TODO(annasong): add tests that check accumulateResources errors for
 	// - repos
 	// - local directories
-	// - files that yield malformed yaml errors
 }

api/krusty/configmaps_test.go

@@ -591,3 +591,184 @@ metadata:
   name: test-m8t7bmb6g2
 `)
 }
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/5047
+func TestPrefixSuffix(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("kustomization.yaml", `
+resources:
+- a
+- b
+`)
+
+	th.WriteF("a/kustomization.yaml", `
+resources:
+- ../common
+
+namePrefix: a
+`)
+
+	th.WriteF("b/kustomization.yaml", `
+resources:
+- ../common
+
+namePrefix: b
+`)
+
+	th.WriteF("common/kustomization.yaml", `
+resources:
+- service
+
+configMapGenerator:
+- name: "-example-configmap"
+`)
+
+	th.WriteF("common/service/deployment.yaml", `
+kind: Deployment
+apiVersion: apps/v1
+
+metadata:
+  name: "-"
+
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        envFrom:
+        - configMapRef:
+            name: "-example-configmap"
+`)
+
+	th.WriteF("common/service/kustomization.yaml", `
+resources:
+- deployment.yaml
+
+nameSuffix: api
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: a-api
+spec:
+  template:
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: a-example-configmap-6ct58987ht
+        name: app
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: a-example-configmap-6ct58987ht
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: b-api
+spec:
+  template:
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: b-example-configmap-6ct58987ht
+        name: app
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: b-example-configmap-6ct58987ht
+`)
+}
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/5047
+func TestPrefixSuffix2(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("kustomization.yaml", `
+resources:
+- a
+- b
+`)
+
+	th.WriteF("a/kustomization.yaml", `
+resources:
+- ../common
+
+namePrefix: a
+`)
+
+	th.WriteF("b/kustomization.yaml", `
+resources:
+- ../common
+
+namePrefix: b
+`)
+
+	th.WriteF("common/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "-example"
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        envFrom:
+        - configMapRef:
+            name: "-example-configmap"
+`)
+
+	th.WriteF("common/kustomization.yaml", `
+resources:
+- deployment.yaml
+
+configMapGenerator:
+- name: "-example-configmap"
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: a-example
+spec:
+  template:
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: a-example-configmap-6ct58987ht
+        name: app
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: a-example-configmap-6ct58987ht
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: b-example
+spec:
+  template:
+    spec:
+      containers:
+      - envFrom:
+        - configMapRef:
+            name: b-example-configmap-6ct58987ht
+        name: app
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: b-example-configmap-6ct58987ht
+`)
+}

api/krusty/customconfig_test.go

@@ -17,12 +17,16 @@ commonLabels:
 vars:
 - name: APRIL_DIET
   objref:
+    group: foo
+    version: v1
     kind: Giraffe
     name: april
   fieldref:
     fieldpath: spec.diet
 - name: KOKO_DIET
   objref:
+    group: foo
+    version: v1
     kind: Gorilla
     name: koko
   fieldref:
@@ -36,6 +40,7 @@ configurations:
 - config/custom.yaml
 `)
 	th.WriteF("base/giraffes.yaml", `
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   name: april
@@ -43,6 +48,7 @@ spec:
   diet: mimosa
   location: NE
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   name: may
@@ -51,6 +57,7 @@ spec:
   location: SE
 `)
 	th.WriteF("base/gorilla.yaml", `
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   name: koko
@@ -59,7 +66,7 @@ spec:
   location: SW
 `)
 	th.WriteF("base/animalPark.yaml", `
-apiVersion: foo
+apiVersion: foo/v1
 kind: AnimalPark
 metadata:
   name: sandiego
@@ -94,7 +101,7 @@ varReference:
 `)
 	m := th.Run("base", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, `
-apiVersion: foo
+apiVersion: foo/v1
 kind: AnimalPark
 metadata:
   labels:
@@ -109,6 +116,7 @@ spec:
   gorillaRef:
     name: x-koko
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -118,6 +126,7 @@ spec:
   diet: mimosa
   location: NE
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -127,6 +136,7 @@ spec:
   diet: acacia
   location: SE
 ---
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   labels:
@@ -163,7 +173,7 @@ varReference:
 `)
 	m := th.Run("base", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, `
-apiVersion: foo
+apiVersion: foo/v1
 kind: AnimalPark
 metadata:
   labels:
@@ -178,6 +188,7 @@ spec:
   gorillaRef:
     name: x-koko
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -187,6 +198,7 @@ spec:
   diet: mimosa
   location: NE
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -196,6 +208,7 @@ spec:
   diet: acacia
   location: SE
 ---
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   labels:
@@ -215,17 +228,20 @@ func TestFixedBug605_BaseCustomizationAvailableInOverlay(t *testing.T) {
 nameReference:
 - kind: Gorilla
   fieldSpecs:
-  - apiVersion: foo
+  - group: foo
+    version: v1
     kind: AnimalPark
     path: spec/gorillaRef/name
 - kind: Giraffe
   fieldSpecs:
-  - apiVersion: foo
+  - group: foo
+    version: v1
     kind: AnimalPark
     path: spec/giraffeRef/name
 varReference:
 - path: spec/food
-  apiVersion: foo
+  group: foo
+  version: v1
   kind: AnimalPark
 `)
 	th.WriteK("overlay", `
@@ -239,6 +255,7 @@ resources:
 - ursus.yaml
 `)
 	th.WriteF("overlay/ursus.yaml", `
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   name: ursus
@@ -248,7 +265,7 @@ spec:
 `)
 	// The following replaces the gorillaRef in the AnimalPark.
 	th.WriteF("overlay/animalPark.yaml", `
-apiVersion: foo
+apiVersion: foo/v1
 kind: AnimalPark
 metadata:
   name: sandiego
@@ -258,7 +275,7 @@ spec:
 `)
 	m := th.Run("overlay", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, `
-apiVersion: foo
+apiVersion: foo/v1
 kind: AnimalPark
 metadata:
   labels:
@@ -274,6 +291,7 @@ spec:
   gorillaRef:
     name: o-ursus
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -284,6 +302,7 @@ spec:
   diet: mimosa
   location: NE
 ---
+apiVersion: foo/v1
 kind: Giraffe
 metadata:
   labels:
@@ -294,6 +313,7 @@ spec:
   diet: acacia
   location: SE
 ---
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   labels:
@@ -304,6 +324,7 @@ spec:
   diet: bambooshoots
   location: SW
 ---
+apiVersion: foo/v1
 kind: Gorilla
 metadata:
   labels:
@@ -314,3 +335,400 @@ spec:
   location: Arizona
 `)
 }
+
+func TestLabelTransformerConfig(t *testing.T) {
+	testCases := []struct {
+		name              string
+		kustomization     string
+		transformerConfig string
+		expectedResult    string
+	}{
+		{
+			name: "includeSelectors=false, includeTemplates=false, include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: Deployment
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=true, includeTemplates=false, include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: true
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: Deployment
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+      environment: dev
+      location: planet-earth
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=false, includeTemplates=true, no transformerConfig",
+			kustomization: `labels:
+  - includeSelectors: false
+    includeTemplates: true
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+		{
+			name: "includeSelectors=false, includeTemplates=false, no transformerConfig",
+			kustomization: `labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/deployment.yaml
+`,
+			expectedResult: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+    environment: dev
+    location: planet-earth
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			th := kusttest_test.MakeHarness(t)
+			th.WriteK(".", tc.kustomization)
+			th.WriteF("resources/deployment.yaml",
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: sample-deploy
+  name: sample-deploy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample-deploy
+
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: sample-deploy
+    spec:
+      containers:
+      - image: hello-world:latest
+        name: hello-world
+`)
+			if tc.transformerConfig != "" {
+				th.WriteF("config/configurations.yaml", tc.transformerConfig)
+			}
+
+			output := th.Run(".", th.MakeDefaultOptions())
+
+			th.AssertActualEqualsExpected(output, tc.expectedResult)
+		})
+	}
+}
+
+func TestLabelTransformerConfigWithCustomResources(t *testing.T) {
+	testCases := []struct {
+		name              string
+		kustomization     string
+		transformerConfig string
+		expectedResult    string
+	}{
+		{
+			name: "include template via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/template/metadata/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  template:
+    metadata:
+      labels:
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+		{
+			name: "include selector via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `labels:
+  - path: spec/selectors/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  selectors:
+    labels:
+      environment: dev
+      location: planet-earth
+  template:
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+		{
+			name: "include selectors and labels via transformerConfig",
+			kustomization: `configurations:
+  - config/configurations.yaml
+
+labels:
+  - includeSelectors: false
+    includeTemplates: false
+    pairs:
+      location: planet-earth
+      environment: dev
+
+resources:
+  - resources/custom-resource.yaml
+`,
+			transformerConfig: `
+labels:
+  - path: spec/selectors/labels
+    create: true
+    kind: SampleResource
+  - path: spec/template/metadata/labels
+    create: true
+    kind: SampleResource
+`,
+			expectedResult: `apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  labels:
+    environment: dev
+    location: planet-earth
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  selectors:
+    labels:
+      environment: dev
+      location: planet-earth
+  template:
+    metadata:
+      labels:
+        environment: dev
+        location: planet-earth
+    spec:
+      containers:
+      - env:
+        - name: VARIABLE
+          value: value
+        image: index.docker.io/library/hello-world
+`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			th := kusttest_test.MakeHarness(t)
+			th.WriteK(".", tc.kustomization)
+			th.WriteF("resources/custom-resource.yaml",
+				`apiVersion: custom.example.org/v1
+kind: SampleResource
+metadata:
+  name: sample-resource
+  namespace: sample-namespace
+spec:
+  template:
+    spec:
+      containers:
+      - image: index.docker.io/library/hello-world
+        env:
+        - name: VARIABLE
+          value: value
+`)
+
+			th.WriteF("config/configurations.yaml", tc.transformerConfig)
+
+			output := th.Run(".", th.MakeDefaultOptions())
+
+			th.AssertActualEqualsExpected(output, tc.expectedResult)
+		})
+	}
+}

api/krusty/duplicatekeys_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
@@ -41,6 +42,6 @@ spec:
 `)
 	m := th.Run(".", th.MakeDefaultOptions())
 	_, err := m.AsYaml()
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "mapping key \"env\" already defined")
 }

api/krusty/fnplugin_test.go

@@ -4,17 +4,23 @@
 package krusty_test
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	. "sigs.k8s.io/kustomize/api/krusty"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+const (
+	repoRootDir = "../../"
+)
+
 const generateDeploymentDotSh = `#!/bin/sh
 
 cat <<EOF
@@ -61,7 +67,7 @@ func TestFnExecGeneratorInBase(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 resources:
 - short_secret.yaml
@@ -86,7 +92,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(tmpDir.String(), "gener.yaml"), `
 kind: executable
 metadata:
@@ -100,7 +106,7 @@ spec:
 
 	m := th.Run(tmpDir.String(), o)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -134,7 +140,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestFnExecGeneratorInBaseWithOverlay(t *testing.T) {
@@ -145,11 +151,11 @@ func TestFnExecGeneratorInBaseWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - short_secret.yaml
@@ -176,7 +182,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(base, "gener.yaml"), `
 kind: executable
 metadata:
@@ -189,9 +195,9 @@ spec:
 `)
 
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -225,7 +231,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestFnExecGeneratorInOverlay(t *testing.T) {
@@ -236,11 +242,11 @@ func TestFnExecGeneratorInOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - short_secret.yaml
@@ -267,7 +273,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(prod, "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(prod, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(prod, "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(prod, "gener.yaml"), `
 kind: executable
 metadata:
@@ -280,9 +286,9 @@ spec:
 `)
 
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -316,7 +322,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestFnExecTransformerInBase(t *testing.T) {
@@ -327,9 +333,9 @@ func TestFnExecTransformerInBase(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
-	assert.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(base))
 	th.WriteK(base, `
 resources:
 - secret.yaml
@@ -348,7 +354,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(base, "krmTransformer.sh"), krmTransformerDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(base, "krmTransformer.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "krmTransformer.sh"), 0777))
 	th.WriteF(filepath.Join(base, "krm-transformer.yaml"), `
 apiVersion: examples.config.kubernetes.io/v1beta1
 kind: MyPlugin
@@ -362,7 +368,7 @@ metadata:
 
 	m := th.Run(base, o)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -371,7 +377,7 @@ stringData:
   foo: bar
 type: Opaque
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestFnExecTransformerInBaseWithOverlay(t *testing.T) {
@@ -382,11 +388,11 @@ func TestFnExecTransformerInBaseWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - secret.yaml
@@ -409,7 +415,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(base, "krmTransformer.sh"), krmTransformerDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(base, "krmTransformer.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "krmTransformer.sh"), 0777))
 	th.WriteF(filepath.Join(base, "krm-transformer.yaml"), `
 apiVersion: examples.config.kubernetes.io/v1beta1
 kind: MyPlugin
@@ -423,7 +429,7 @@ metadata:
 
 	m := th.Run(prod, o)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -432,7 +438,7 @@ stringData:
   foo: bar
 type: Opaque
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestFnExecTransformerInOverlay(t *testing.T) {
@@ -443,11 +449,11 @@ func TestFnExecTransformerInOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - secret.yaml
@@ -470,7 +476,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(prod, "krmTransformer.sh"), krmTransformerDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(prod, "krmTransformer.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(prod, "krmTransformer.sh"), 0777))
 	th.WriteF(filepath.Join(prod, "krm-transformer.yaml"), `
 apiVersion: examples.config.kubernetes.io/v1beta1
 kind: MyPlugin
@@ -484,7 +490,7 @@ metadata:
 
 	m := th.Run(prod, o)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -493,7 +499,7 @@ stringData:
   foo: bar
 type: Opaque
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func skipIfNoDocker(t *testing.T) {
@@ -508,56 +514,63 @@ func TestFnContainerGenerator(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	o := th.MakeOptionsPluginsEnabled()
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 resources:
 - deployment.yaml
 generators:
-- project-service-set.yaml
+- service-set.yaml
 `)
 	// Create generator config
-	th.WriteF(filepath.Join(tmpDir.String(), "project-service-set.yaml"), `
-apiVersion: blueprints.cloud.google.com/v1alpha1
-kind: ProjectServiceSet
+	th.WriteF(filepath.Join(tmpDir.String(), "service-set.yaml"), `
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
+kind: ServiceGenerator
 metadata:
-  name: demo
+  name: simplegenerator
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: gcr.io/kpt-fn/enable-gcp-services:v0.1.0
+        image: gcr.io/kustomize-functions/e2econtainersimplegenerator
 spec:
-  services:
-    - compute.googleapis.com
-  projectID: foo
+  port: 8081
 `)
 	// Create another resource just to make sure everything is added
 	th.WriteF(filepath.Join(tmpDir.String(), "deployment.yaml"), `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: foo
+  name: simplegenerator
 `)
+
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainersimplegenerator/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainersimplegenerator",
+	)
+	build.Dir = repoRootDir
+	require.NoError(t, run(build))
+
 	m := th.Run(tmpDir.String(), o)
 	actual, err := m.AsYaml()
-	assert.NoError(t, err)
-	assert.Equal(t, `apiVersion: apps/v1
+	require.NoError(t, err)
+	require.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: foo
+  name: simplegenerator
 ---
-apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
+apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    blueprints.cloud.google.com/ownerReference: blueprints.cloud.google.com/ProjectServiceSet/demo
-    config.kubernetes.io/function: |
-      container:
-        image: gcr.io/kpt-fn/enable-gcp-services:v0.1.0
-  name: demo-compute
+  labels:
+    app: simplegenerator
+  name: simplegenerator-svc
 spec:
-  projectRef:
-    external: foo
-  resourceID: compute.googleapis.com
+  ports:
+  - name: http
+    port: 8081
+    protocol: TCP
+    targetPort: 8081
+  selector:
+    app: simplegenerator
 `, string(actual))
 }
 
@@ -566,7 +579,7 @@ func TestFnContainerTransformer(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	o := th.MakeOptionsPluginsEnabled()
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 resources:
 - deployment.yaml
@@ -593,11 +606,11 @@ metadata:
 		"-f", "./cmd/config/internal/commands/e2e/e2econtainerconfig/Dockerfile",
 		"-t", "gcr.io/kustomize-functions/e2econtainerconfig",
 	)
-	build.Dir = "../../" // Repo root
-	assert.NoError(t, build.Run())
+	build.Dir = repoRootDir
+	require.NoError(t, run(build))
 	m := th.Run(tmpDir.String(), o)
 	actual, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -611,32 +624,38 @@ metadata:
 
 func TestFnContainerTransformerWithConfig(t *testing.T) {
 	skipIfNoDocker(t)
+	//https://docs.docker.com/engine/reference/commandline/build/#git-repositories
+	build := exec.Command("docker", "build", "https://github.com/GoogleContainerTools/kpt-functions-sdk.git#go-sdk-v0.0.1:ts/hello-world",
+		"-f", "build/label_namespace.Dockerfile",
+		"-t", "gcr.io/kpt-functions/label-namespace:go-sdk-v0.0.1",
+	)
+	require.NoError(t, run(build))
 	th := kusttest_test.MakeHarness(t)
 	o := th.MakeOptionsPluginsEnabled()
 	fSys := filesys.MakeFsOnDisk()
 	b := MakeKustomizer(&o)
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 resources:
 - data1.yaml
 - data2.yaml
 transformers:
 - label_namespace.yaml
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data1.yaml"), []byte(`
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data1.yaml"), []byte(`
 apiVersion: v1
 kind: Namespace
 metadata:
   name: my-namespace
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data2.yaml"), []byte(`
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "data2.yaml"), []byte(`
 apiVersion: v1
 kind: Namespace
 metadata:
   name: another-namespace
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "label_namespace.yaml"), []byte(`
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "label_namespace.yaml"), []byte(`
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -644,7 +663,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: gcr.io/kpt-functions/label-namespace@sha256:4f030738d6d25a207641ca517916431517578bd0eb8d98a8bde04e3bb9315dcd
+        image: gcr.io/kpt-functions/label-namespace:go-sdk-v0.0.1
 data:
   label_name: my-ns-name
   label_value: function-test
@@ -652,9 +671,9 @@ data:
 	m, err := b.Run(
 		fSys,
 		tmpDir.String())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	actual, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Namespace
 metadata:
@@ -678,37 +697,43 @@ func TestFnContainerEnvVars(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := MakeKustomizer(&o)
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 generators:
 - gener.yaml
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
-apiVersion: v1
-kind: ConfigMap
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
+kind: EnvTemplateGenerator
 metadata:
-  name: demo
+  name: e2econtainerenvgenerator
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/aodinokov/kpt-templater:0.0.1
+        image: gcr.io/kustomize-functions/e2econtainerenvgenerator
         envs:
         - TESTTEMPLATE=value
-data:
-  template: |
-    apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: env
-    data:
-      value: '{{ env "TESTTEMPLATE" }}'
+template: |
+  apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: env
+  data:
+    value: %q
 `)))
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainerenvgenerator",
+	)
+	build.Dir = repoRootDir
+	require.NoError(t, run(build))
+
 	m, err := b.Run(
 		fSys,
 		tmpDir.String())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	actual, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 data:
   value: value
@@ -725,62 +750,54 @@ func TestFnContainerFnMounts(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := MakeKustomizer(&o)
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 generators:
 - gener.yaml
 `)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
-apiVersion: v1alpha1
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
 kind: RenderHelmChart
 metadata:
   name: demo
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+        image: gcr.io/kustomize-functions/e2econtainermountbind
         mounts:
         - type: "bind"
-          src: "./charts"
-          dst: "/tmp/charts"
-helmCharts:
-- name: helloworld-chart
-  releaseName: test
-  valuesFile: /tmp/charts/helloworld-values/values.yaml
+          src: "./yaml"
+          dst: "/tmp/yaml"
+path: /tmp/yaml/resources.yaml
 `)))
-	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates")))
-	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-values")))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "Chart.yaml"), []byte(`
-apiVersion: v2
-name: helloworld-chart
-description: A Helm chart for Kubernetes
-type: application
-version: 0.1.0
-appVersion: 1.16.0
-`)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates", "deployment.yaml"), []byte(`
+	require.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "yaml", "tmp")))
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "yaml", "resources.yaml"), []byte(`
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: name
 spec:
-  replicas: {{ .Values.replicaCount }}
-`)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-values", "values.yaml"), []byte(`
-replicaCount: 5
+  replicas: 3
 `)))
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainermountbind/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainermountbind",
+	)
+	build.Dir = repoRootDir
+	require.NoError(t, run(build))
+
 	m, err := b.Run(
 		fSys,
 		tmpDir.String())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	actual, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: name
 spec:
-  replicas: 5
+  replicas: 3
 `, string(actual))
 }
 
@@ -791,8 +808,8 @@ func TestFnContainerMountsLoadRestrictions_absolute(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := MakeKustomizer(&o)
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 generators:
   - |-
     apiVersion: v1alpha1
@@ -811,7 +828,7 @@ generators:
 	_, err = b.Run(
 		fSys,
 		tmpDir.String())
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "loading generator plugins: failed to load generator: plugin RenderHelmChart."+
 		"v1alpha1.[noGrp]/demo.[noNs] with mount path '/tmp/dir' is not permitted; mount paths must"+
 		" be relative to the current kustomization directory")
@@ -824,8 +841,8 @@ func TestFnContainerMountsLoadRestrictions_outsideCurrentDir(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := MakeKustomizer(&o)
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 generators:
   - |-
     apiVersion: v1alpha1
@@ -844,7 +861,7 @@ generators:
 	_, err = b.Run(
 		fSys,
 		tmpDir.String())
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "loading generator plugins: failed to load generator: plugin RenderHelmChart."+
 		"v1alpha1.[noGrp]/demo.[noNs] with mount path './tmp/../../dir' is not permitted; mount paths must "+
 		"be under the current kustomization directory")
@@ -872,6 +889,15 @@ spec:
   replicas: 3
 `)
 	err := th.RunWithErr(".", th.MakeOptionsPluginsEnabled())
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.EqualError(t, err, "couldn't execute function: root working directory '/' not allowed")
 }
+
+// run calls Cmd.Run and wraps the error to include the output to make debugging
+// easier. Not safe for real code, but fine for tests.
+func run(cmd *exec.Cmd) error {
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("%w\n--- COMMAND OUTPUT ---\n%s", err, string(out))
+	}
+	return nil
+}

api/krusty/gvknpatch_test.go

@@ -6,7 +6,7 @@ package krusty_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
@@ -496,7 +496,7 @@ spec:
 	options := th.MakeDefaultOptions()
 	// depPatch cannot find target with kind `Deployment` and name `new-name`
 	// because the resource never had this GVKN
-	assert.Error(t, th.RunWithErr("overlay", options))
+	require.Error(t, th.RunWithErr("overlay", options))
 }
 
 // Here is a structure of a kustomization of two components, component1

api/krusty/helmchartinflationgenerator_test.go

@@ -21,10 +21,31 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: test-minecraft
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
 type: Opaque
 ---
 apiVersion: v1
@@ -32,10 +53,14 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft
+  namespace: default
 spec:
   ports:
   - name: minecraft
@@ -150,7 +175,7 @@ func TestHelmChartInflationGeneratorOld(t *testing.T) {
 helmChartInflationGenerator:
 - chartName: minecraft
   chartRepoUrl: https://itzg.github.io/minecraft-server-charts
-  chartVersion: 3.1.3
+  chartVersion: 4.26.4
   releaseName: test
 `)
 
@@ -158,6 +183,54 @@ helmChartInflationGenerator:
 	th.AssertActualEqualsExpected(m, expectedHelm)
 }
 
+func TestHelmChartNamespacePropagation(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: the-bug
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    this-service-is-deployed-in-namespace: {{ .Release.Namespace }}
+`)
+	th.WriteF(filepath.Join(th.GetRoot(), "values.yaml"), ``)
+
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: the-actual-namespace
+helmCharts:
+  - name: service
+    releaseName: service
+    valuesFile: values.yaml
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    this-service-is-deployed-in-namespace: the-actual-namespace
+  name: the-bug
+  namespace: the-actual-namespace
+`)
+}
+
 func TestHelmChartInflationGenerator(t *testing.T) {
 	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
 	defer th.Reset()
@@ -169,7 +242,7 @@ func TestHelmChartInflationGenerator(t *testing.T) {
 helmCharts:
 - name: minecraft
   repo: https://itzg.github.io/minecraft-server-charts
-  version: 3.1.3
+  version: 4.26.4
   releaseName: test
 `)
 
@@ -252,7 +325,7 @@ func TestHelmChartProdVsDev(t *testing.T) {
 helmCharts:
 - name: minecraft
   repo: https://itzg.github.io/minecraft-server-charts
-  version: 3.1.3
+  version: 4.26.4
   releaseName: test
 `)
 	th.WriteK(dirProd, `
@@ -287,10 +360,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myProd-test-minecraft
+  name: myProd-test-minecraft-rcon
+  namespace: prod
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myProd-test-minecraft-curseforge
   namespace: prod
 type: Opaque
 ---
@@ -299,7 +392,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myProd-test-minecraft
@@ -325,10 +421,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myDev-test-minecraft
+  name: myDev-test-minecraft-rcon
+  namespace: dev
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myDev-test-minecraft-curseforge
   namespace: dev
 type: Opaque
 ---
@@ -337,7 +453,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myDev-test-minecraft
@@ -359,10 +478,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myProd-test-minecraft
+  name: myProd-test-minecraft-rcon
+  namespace: prod
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myProd-test-minecraft-curseforge
   namespace: prod
 type: Opaque
 ---
@@ -371,7 +510,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myProd-test-minecraft
@@ -567,6 +709,594 @@ metadata:
 `)
 }
 
+// Reference: https://github.com/kubernetes-sigs/kustomize/issues/5163
+func TestHelmChartInflationGeneratorForMultipleChartsDifferentVersion(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	copyValuesFilesTestChartsIntoHarness(t, th)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: test-chart
+    releaseName: test
+    version: 1.0.0
+    skipTests: true
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.26.4
+    releaseName: test-1
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.26.4
+    releaseName: test-2
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    chart: test-1.0.0
+  name: my-deploy
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+  template:
+    spec:
+      containers:
+      - image: test-image:v1.0.0
+        imagePullPolicy: Always
+---
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-1-minecraft
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-1-minecraft
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-1-minecraft
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-1-minecraft
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-2-minecraft
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-2-minecraft
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-2-minecraft
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-2-minecraft
+  type: ClusterIP
+`)
+}
+
+func TestHelmChartInflationGeneratorForMultipleKubeVersions(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	copyValuesFilesTestChartsIntoHarness(t, th)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.26.4
+    releaseName: test
+    kubeVersion: "1.16"
+    valuesInline:
+      minecraftServer:
+        extraPorts:
+          - name: map
+            containerPort: 8123
+            protocol: TCP
+            service:
+              enabled: false
+            ingress:
+              enabled: true
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-minecraft
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  labels:
+    app: test-minecraft-map
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-map
+  namespace: default
+spec:
+  rules: null
+`)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.26.4
+    releaseName: test
+    kubeVersion: "1.27"
+    valuesInline:
+      minecraftServer:
+        extraPorts:
+          - name: map
+            containerPort: 8123
+            protocol: TCP
+            service:
+              enabled: false
+            ingress:
+              enabled: true
+`)
+
+	m = th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-minecraft
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  labels:
+    app: test-minecraft-map
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-map
+  namespace: default
+spec:
+  rules: null
+`)
+}
+
+func TestHelmChartNamespacePropagationViaResources(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	// Create base directory with helm chart
+	baseDir := th.MkDir("base")
+	chartDir := filepath.Join(baseDir, "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    deployed-in-namespace: {{ .Release.Namespace }}
+`)
+
+	// Base kustomization with helmCharts
+	th.WriteK(baseDir, `
+helmGlobals:
+  chartHome: ./charts
+helmCharts:
+  - name: service
+    releaseName: service
+`)
+
+	// Overlay that references base via resources and sets namespace
+	overlayDir := th.MkDir("overlay")
+	th.WriteK(overlayDir, `
+namespace: production
+resources:
+  - ../base
+`)
+
+	m := th.Run(overlayDir, th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    deployed-in-namespace: production
+  name: test-service
+  namespace: production
+`)
+}
+
+func TestHelmChartDifferentNamespaces(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm-namespace: {{ .Release.Namespace }}
+`)
+
+	// Test with different namespaces in transformer vs helmCharts.namespace
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: transformer-ns
+helmCharts:
+  - name: service
+    releaseName: service
+    namespace: helm-ns
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	// helmCharts.namespace should take precedence
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    helm-namespace: helm-ns
+  name: test-service
+  namespace: helm-ns
+`)
+}
+
+func TestHelmChartSameNamespace(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    deployed-namespace: {{ .Release.Namespace }}
+`)
+
+	// Test with same namespace in both places
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: shared-namespace
+helmCharts:
+  - name: service
+    releaseName: service
+    namespace: shared-namespace
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    deployed-namespace: shared-namespace
+  name: test-service
+  namespace: shared-namespace
+`)
+}
+
+// Regression test: verify that HelmCharts in base kustomizations
+// still receive namespace from overlay after fixing namespace propagation issues.
+// This test ensures the fix for https://github.com/kubernetes-sigs/kustomize/issues/6031
+// and https://github.com/kubernetes-sigs/kustomize/issues/6027
+// does not break the HelmChart namespace propagation feature from
+// https://github.com/kubernetes-sigs/kustomize/issues/5566
+func TestHelmChartNamespacePropagationViaResourcesThreeLevels(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	// Create base directory with helm chart (Level 1)
+	baseDir := th.MkDir("base")
+	chartDir := filepath.Join(baseDir, "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm-namespace: {{ .Release.Namespace }}
+`)
+
+	// Base kustomization with helmCharts (no namespace)
+	th.WriteK(baseDir, `
+helmGlobals:
+  chartHome: ./charts
+helmCharts:
+  - name: service
+    releaseName: service
+`)
+
+	// Mid-layer that references base via resources (no namespace) (Level 2)
+	midDir := th.MkDir("mid")
+	th.WriteK(midDir, `
+namePrefix: mid-
+resources:
+  - ../base
+`)
+
+	// Top overlay that references mid-layer and sets namespace (Level 3)
+	overlayDir := th.MkDir("overlay")
+	th.WriteK(overlayDir, `
+namespace: production
+resources:
+  - ../mid
+`)
+
+	m := th.Run(overlayDir, th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    helm-namespace: production
+  name: mid-test-service
+  namespace: production
+`)
+}
+
 func copyValuesFilesTestChartsIntoHarness(t *testing.T, th *kusttest_test.HarnessEnhanced) {
 	t.Helper()
 

api/krusty/intermediateresourceid_test.go

@@ -6,7 +6,7 @@ package krusty_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
@@ -209,7 +209,7 @@ spec:
       - image: whatever
 `)
 	err := th.RunWithErr("gcp", th.MakeDefaultOptions())
-	assert.Error(t, err)
+	require.Error(t, err)
 }
 
 // Test for issue #3228

api/krusty/multiplepatch_test.go

@@ -4,6 +4,7 @@
 package krusty_test
 
 import (
+	"strings"
 	"testing"
 
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -1282,6 +1283,72 @@ metadata:
 	}
 }
 
+func TestSinglePatchWithMultiplePatchDeleteDirectives(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	makeCommonFilesForMultiplePatchTests(th)
+	th.WriteF("overlay/staging/deployment-patch1.yaml", `
+$patch: delete
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+---
+$patch: delete
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+`)
+	th.WriteF("overlay/staging/deployment-patch2.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configmap-in-base
+data:
+  foo2: bar2
+`)
+	th.WriteK("overlay/staging", `
+namePrefix: staging-
+commonLabels:
+  env: staging
+patches:
+  - path: deployment-patch1.yaml
+  - path: deployment-patch2.yaml
+resources:
+  - ../../base
+configMapGenerator:
+- name: configmap-in-overlay
+  literals:
+  - hello=world
+`)
+	m := th.Run("overlay/staging", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  foo: bar
+  foo2: bar2
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-configmap-in-base-8cmgkm9f44
+---
+apiVersion: v1
+data:
+  hello: world
+kind: ConfigMap
+metadata:
+  labels:
+    env: staging
+  name: staging-configmap-in-overlay-dc6fm46dhm
+`)
+}
+
 func TestMultiplePatchesBothWithPatchDeleteDirective(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	makeCommonFilesForMultiplePatchTests(th)
@@ -1700,3 +1767,108 @@ metadata:
   name: fluentd-sa-abc
 `)
 }
+
+// TestEmptyPatchFilesShouldBeIgnored verifies that empty patch files are ignored.
+// Tests three cases:
+// 1. Completely empty file
+// 2. File with only comments
+// 3. File with whitespace and comments
+func TestEmptyPatchFilesShouldBeIgnored(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Write a basic resource
+	th.WriteF("deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+`)
+
+	// Create empty patch files of different types
+	th.WriteF("empty.yaml", ``)
+	th.WriteF("comments-only.yaml", `
+# This is a comment
+# Another comment
+`)
+	th.WriteF("whitespace.yaml", `
+
+# Comments with whitespace
+
+  # Indented comment
+
+`)
+
+	// Reference empty patches in kustomization
+	th.WriteK(".", `
+resources:
+- deployment.yaml
+patches:
+- path: empty.yaml
+- path: comments-only.yaml
+- path: whitespace.yaml
+`)
+
+	// Empty patches should be ignored, output should be unchanged
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+// TestEmptyPatchesStrategicMergeFails verifies that empty patch files are
+// handled correctly with the deprecated patchesStrategicMerge field
+func TestEmptyPatchesStrategicMergeFails(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Create a basic resource
+	th.WriteF("resource.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dummy
+data:
+  dummy: value
+`)
+
+	// Create an empty patch file
+	th.WriteF("empty-patch.yaml", ``)
+
+	// Create a patch file with only comments
+	th.WriteF("comments-patch.yaml", `
+# This is just a comment
+# Another comment
+`)
+
+	// Create kustomization using patchesStrategicMerge
+	th.WriteK(".", `
+resources:
+- resource.yaml
+patchesStrategicMerge:
+- empty-patch.yaml
+- comments-patch.yaml
+`)
+
+	// This fails with message
+	err := th.RunWithErr(".", th.MakeDefaultOptions())
+	if err == nil {
+		t.Fatalf("expected error for empty patchesStrategicMerge files but got none")
+	}
+	if !strings.Contains(err.Error(), "patch appears to be empty") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

api/krusty/namereference_test.go

@@ -786,3 +786,85 @@ spec:
         name: tester
 `)
 }
+
+func TestBackReferenceAdmissionPolicy(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- admission.yaml
+
+namePrefix: a-prefix-
+`)
+	th.WriteF("admission.yaml", `---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: sample-policy
+spec:
+  failurePolicy: Fail
+  paramKind:
+    apiVersion: apps/v1
+    kind: Deployment
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - apps
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - deployments
+  validations:
+    - expression: "!object.metadata.name.startsWith('test-')"
+      message: prefix 'test-' is not allowed
+      reason: Invalid
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: sample-policy-binding
+spec:
+  policyName: sample-policy
+  validationActions:
+  - Deny
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: a-prefix-sample-policy
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - apps
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - deployments
+  paramKind:
+    apiVersion: apps/v1
+    kind: Deployment
+  validations:
+  - expression: '!object.metadata.name.startsWith(''test-'')'
+    message: prefix 'test-' is not allowed
+    reason: Invalid
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: a-prefix-sample-policy-binding
+spec:
+  policyName: a-prefix-sample-policy
+  validationActions:
+  - Deny
+`)
+}

api/krusty/namespacepropagation_test.go

@@ -0,0 +1,343 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/6031
+// This test verifies that namespace propagation from overlay to base does not
+// break strategic merge patches when combined with nameSuffix.
+//
+// The issue: In v5.8.0, namespace was propagated to child kustomization early,
+// causing patches to fail because they couldn't find resources with the
+// propagated namespace.
+func TestNamespacePropagationDoesNotBreakPatchWithNameSuffix(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base kustomization with nameSuffix
+	th.WriteK("base", `
+resources:
+  - configmap.yaml
+
+nameSuffix: -schedule_job_1
+`)
+
+	th.WriteF("base/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hoge
+data:
+  configs.yaml: TO_BE_SPECIFIED
+`)
+
+	// Overlay with namespace and patch
+	// The patch targets the original name (before nameSuffix is applied)
+	// This is the expected behavior per kustomize documentation
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+patches:
+  - path: schedule_job_1.yaml
+
+namespace: hoge-dev
+`)
+
+	th.WriteF("overlay/schedule_job_1.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hoge-schedule_job_1
+data:
+  configs.yaml: |
+    case_configs:
+      - id: 1
+        name: dummy1
+        client: client1
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  configs.yaml: |
+    case_configs:
+      - id: 1
+        name: dummy1
+        client: client1
+kind: ConfigMap
+metadata:
+  name: hoge-schedule_job_1
+  namespace: hoge-dev
+`)
+}
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/6027
+// This test verifies that namespace propagation does not break
+// configMapGenerator merge behavior when the generator is in a base
+// and the namespace is set in an overlay.
+//
+// The issue: In v5.8.0, namespace was propagated to child kustomization early,
+// causing generator merge to fail because resources in the base didn't have
+// namespace yet, but the overlay's generator had namespace from propagation.
+func TestNamespacePropagationDoesNotBreakGeneratorMerge(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Generator config resource
+	th.WriteK("cm-generator", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- resources/general.yaml
+`)
+
+	th.WriteF("cm-generator/resources/general.yaml", `
+apiVersion: builtin
+kind: ConfigMapGenerator
+
+metadata:
+  name: general-environment
+
+behavior: merge
+
+envs:
+- configuration/general
+`)
+
+	th.WriteF("cm-generator/configuration/general", `
+COMMON_ENV=common
+`)
+
+	// Base kustomization with generator
+	th.WriteK("base", `
+generators:
+- ../cm-generator
+
+configMapGenerator:
+- name: general-environment
+  behavior: create
+`)
+
+	th.WriteF("base/configuration/general", `
+BASE_LAYER_ENV=base
+`)
+
+	// Overlay with namespace and same generator reference
+	th.WriteK("overlay", `
+namespace: abc
+
+generators:
+- ../cm-generator
+
+resources:
+- ../base
+`)
+
+	th.WriteF("overlay/configuration/general", `
+OVERLAY_ENV=overlay
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  BASE_LAYER_ENV: base
+  OVERLAY_ENV: overlay
+kind: ConfigMap
+metadata:
+  name: general-environment-826bch2dh9
+  namespace: abc
+`)
+}
+
+// Test to verify namespace propagation still works correctly for
+// simple overlay/base scenarios without patches or generators.
+func TestNamespaceTransformerInOverlayAppliedToBase(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base kustomization without namespace
+	th.WriteK("base", `
+resources:
+  - deployment.yaml
+`)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: app
+        image: my-image:latest
+`)
+
+	// Overlay with namespace
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+namespace: production
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  namespace: production
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - image: my-image:latest
+        name: app
+`)
+}
+
+// Test for three-level kustomization hierarchy with namespace in top overlay
+// This verifies namespace transformer is applied correctly across multiple levels.
+func TestNamespaceTransformerWithThreeLevelHierarchy(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Level 1: Base
+	th.WriteK("base", `
+resources:
+  - configmap.yaml
+`)
+
+	th.WriteF("base/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: base-config
+data:
+  key: value
+`)
+
+	// Level 2: Mid-layer (no namespace)
+	th.WriteK("mid", `
+resources:
+  - ../base
+
+namePrefix: mid-
+`)
+
+	// Level 3: Overlay with namespace
+	th.WriteK("overlay", `
+resources:
+  - ../mid
+
+namespace: top-ns
+namePrefix: top-
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  key: value
+kind: ConfigMap
+metadata:
+  name: top-mid-base-config
+  namespace: top-ns
+`)
+}
+
+// Test that patches in overlay can target resources from base
+// when base has nameSuffix and overlay has namespace.
+// This is a more complex version of TestNamespacePropagationDoesNotBreakPatchWithNameSuffix
+func TestPatchTargetingWithNameSuffixAndNamespace(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base with nameSuffix
+	th.WriteK("base", `
+resources:
+  - deployment.yaml
+
+nameSuffix: -v2
+`)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+      - name: app
+        image: myimage:v1
+`)
+
+	// Overlay with namespace and patch
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+namespace: production
+
+patches:
+  - target:
+      kind: Deployment
+      name: myapp-v2
+    patch: |
+      - op: replace
+        path: /spec/replicas
+        value: 3
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp-v2
+  namespace: production
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+      - image: myimage:v1
+        name: app
+`)
+}

api/krusty/namespaces_test.go

@@ -692,7 +692,6 @@ resources:
 	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
 }
 
-//nolint:gosec
 const namespaceNeedInVarMyAppWithNamespace string = `
 resources:
 - elasticsearch-dev-service.yaml

api/krusty/no_list_items_test.go

@@ -0,0 +1,228 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// test for https://github.com/kubernetes-sigs/kustomize/issues/4240
+func TestSuffix5042(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+`)
+
+	th.WriteF("resource.yaml", `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceTwo
+metadata:
+  name: test
+rules: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceTwo
+metadata:
+  name: test
+rules: []
+`)
+}
+
+func TestListSuffix5042(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+`)
+
+	th.WriteF("resource.yaml", `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceList
+metadata:
+  name: test
+rules: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceList
+metadata:
+  name: test
+rules: []
+`)
+}
+
+func TestListSuffix5485(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+  `)
+
+	th.WriteF("resource.yaml", `
+apiVersion: infra.protonbase.io/v1alpha1
+kind: AccessWhiteList
+metadata:
+  name: wlmls5769f
+  namespace: dc7i4hyxzw
+spec:
+  rules:
+  - sourceIps: 0.0.0.0/16
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: infra.protonbase.io/v1alpha1
+kind: AccessWhiteList
+metadata:
+  name: wlmls5769f
+  namespace: dc7i4hyxzw
+spec:
+  rules:
+  - sourceIps: 0.0.0.0/16
+`)
+}
+
+func TestListToIndividualResources(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- list.yaml
+`)
+
+	th.WriteF("list.yaml", `
+apiVersion: v1
+kind: PodList
+items:
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-1
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-2
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-3
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-1
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-2
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-3
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+`)
+}
+
+// Empty list should result in no resources
+func TestEmptyList(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- emptyList.yaml
+`)
+	th.WriteF("emptyList.yaml", `
+apiVersion: v1
+kind: PodList
+items: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, "")
+}

api/krusty/openapicustomschema_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
@@ -264,7 +265,7 @@ openapi:
 		writeCustomResource(th, "mycrd.yaml")
 		writeTestSchema(th, "./")
 		err := th.RunWithErr(".", th.MakeDefaultOptions())
-		assert.Error(t, err)
+		require.Error(t, err)
 		assert.Equal(t,
 			"builtin version and custom schema provided, cannot use both",
 			err.Error())
@@ -284,7 +285,7 @@ openapi:
 `+customSchemaPatch)
 		writeCustomResource(th, "mycrd.yaml")
 		err := th.RunWithErr(".", th.MakeDefaultOptions())
-		assert.Error(t, err)
+		require.Error(t, err)
 		assert.Equal(t,
 			"'/mycrd_schema.json' doesn't exist",
 			err.Error())

api/krusty/originannotation_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/krusty"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -417,7 +418,7 @@ func TestAnnoOriginCustomExecGenerator(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 resources:
 - short_secret.yaml
@@ -443,7 +444,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(tmpDir.String(), "gener.yaml"), `
 kind: executable
 metadata:
@@ -456,9 +457,9 @@ spec:
 `)
 
 	m := th.Run(tmpDir.String(), o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -500,7 +501,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginCustomInlineExecGenerator(t *testing.T) {
@@ -511,7 +512,7 @@ func TestAnnoOriginCustomInlineExecGenerator(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 resources:
 - short_secret.yaml
@@ -544,11 +545,11 @@ stringData:
     - mkdir /mnt/vda
 `)
 	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentDotSh)
-	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
 	m := th.Run(tmpDir.String(), o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -590,7 +591,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginCustomExecGeneratorWithOverlay(t *testing.T) {
@@ -601,11 +602,11 @@ func TestAnnoOriginCustomExecGeneratorWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - short_secret.yaml
@@ -633,7 +634,7 @@ stringData:
 `)
 	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(base, "gener.yaml"), `
 kind: executable
 metadata:
@@ -646,9 +647,9 @@ spec:
 `)
 
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -690,7 +691,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginCustomInlineExecGeneratorWithOverlay(t *testing.T) {
@@ -701,11 +702,11 @@ func TestAnnoOriginCustomInlineExecGeneratorWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 resources:
 - short_secret.yaml
@@ -740,11 +741,11 @@ stringData:
     - mkdir /mnt/vda
 `)
 	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentDotSh)
-	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
@@ -786,15 +787,15 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginRemoteBuiltinGenerator(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 resources:
 - github.com/kubernetes-sigs/kustomize/examples/ldap/base/?ref=v1.0.6
 buildMetadata: [originAnnotations]
@@ -810,7 +811,7 @@ buildMetadata: [originAnnotations]
 		t.FailNow()
 	}
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Contains(t, string(yml), `kind: ConfigMap
 metadata:
   annotations:
@@ -822,7 +823,7 @@ metadata:
         apiVersion: builtin
         kind: ConfigMapGenerator
   name: ldap-configmap-4d7m6k5b42`)
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginInlineBuiltinGenerator(t *testing.T) {
@@ -1011,7 +1012,7 @@ func TestAnnoOriginGeneratorInTransformersField(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 transformers:
 - gener.yaml
@@ -1020,7 +1021,7 @@ buildMetadata: [originAnnotations]
 
 	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(tmpDir.String(), "gener.yaml"), `
 kind: executable
 metadata:
@@ -1033,9 +1034,9 @@ spec:
 `)
 
 	m := th.Run(tmpDir.String(), o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -1062,7 +1063,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginGeneratorInTransformersFieldWithOverlay(t *testing.T) {
@@ -1073,11 +1074,11 @@ func TestAnnoOriginGeneratorInTransformersFieldWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 
 	th.WriteK(base, `
 transformers:
@@ -1086,7 +1087,7 @@ transformers:
 
 	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(base, "gener.yaml"), `
 kind: executable
 metadata:
@@ -1105,9 +1106,9 @@ buildMetadata: [originAnnotations, transformerAnnotations]
 `)
 
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -1139,5 +1140,5 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }

api/krusty/remoteloader_test.go

@@ -282,6 +282,8 @@ resources:
 		},
 	}
 
+	t.Setenv("LC_ALL", "C")
+
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			if test.skip {
@@ -404,7 +406,7 @@ resources:
 				require.Error(t, err)
 				assert.Contains(t, err.Error(), test.err)
 				if test.errT != nil {
-					assert.ErrorIs(t, err, test.errT)
+					require.ErrorIs(t, err, test.errT)
 				}
 			} else {
 				require.NoError(t, err)
@@ -453,6 +455,6 @@ func checkYaml(t *testing.T, actual resmap.ResMap, expected string) {
 	t.Helper()
 
 	yml, err := actual.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, expected, string(yml))
 }

api/krusty/replacementtransformer_test.go

@@ -614,3 +614,391 @@ metadata:
   name: app-config-dev-97544dk6t8
 `)
 }
+
+// regex selector: append in annotation by visitor name
+func TestReplacementTransformerAppendToAnnotationUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app1.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteF("base/app2.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+        - image: app2:1.0
+          name: app
+`)
+	th.WriteF("base/cm1.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm1
+`)
+	th.WriteF("base/cm2.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm2
+`)
+	th.WriteF("base/pg1.yaml", `
+apiVersion: apps/v1
+kind: postgresql
+metadata:
+  name: pg1
+`)
+	th.WriteK("base", `
+resources:
+- app1.yaml
+- app2.yaml
+- cm1.yaml
+- cm2.yaml
+- pg1.yaml
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: cm1
+    targets:
+      - reject:
+          - kind: ConfigMap
+            name: c.1
+        select:
+          kind: Deployment|ConfigMap|postgresql
+        fieldPaths:
+          - metadata.annotations.visitedby
+        options:
+          index: -1
+          delimiter: ","
+          create: true
+  - source:
+      kind: ConfigMap
+      name: cm2
+    targets:
+      - reject:
+          - kind: ConfigMap
+            name: .*2
+        select:
+          kind: Deployment|ConfigMap|postgresql
+        fieldPaths:
+          - metadata.annotations.visitedby
+        options:
+          index: -1
+          delimiter: ","
+          create: true
+`)
+	m := th.Run("base", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+      - image: app2:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  annotations:
+    visitedby: cm2,
+  name: cm1
+---
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  annotations:
+    visitedby: cm1,
+  name: cm2
+---
+apiVersion: apps/v1
+kind: postgresql
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: pg1
+`)
+}
+
+// selector regex: construct service url
+func TestReplacementTransformerServiceNamespaceUrlUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/d1.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "d1.app1"
+`)
+	th.WriteF("base/d2.yaml", `
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "d2.app1"
+`)
+	th.WriteF("base/sts1.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sts1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "app1"
+`)
+	th.WriteF("base/cm1.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm1
+data:
+  APP1_SERVICE_PORT: "8080"
+`)
+	th.WriteF("base/svc1.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: svc1-namespace
+spec:
+  selector:
+    app.kubernetes.io/name: app1
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9376
+
+`)
+	th.WriteK("base", `
+resources:
+- d1.yaml
+- d2.yaml
+- sts1.yaml
+- cm1.yaml
+- svc1.yaml
+
+replacements:
+  - source:
+      kind: Service
+      name: svc1
+      fieldPath: metadata.namespace
+    targets:
+      - select:
+          kind: Deployment|.*Set
+        fieldPaths:
+          - spec.template.spec.containers.*.env.[name=APP1_SERVICE].value
+        options:
+          index: 99
+          delimiter: "."
+  - source:
+      kind: ConfigMap
+      name: cm1
+      fieldPath: data.APP1_SERVICE_PORT
+    targets:
+      - select:
+          kind: Deployment|.*Set
+        fieldPaths:
+          - spec.template.spec.containers.*.env.[name=APP1_SERVICE].value
+        options:
+          index: 99
+          delimiter: ":"
+`)
+	m := th.Run("base", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: d1.app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: d2.app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sts1
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+data:
+  APP1_SERVICE_PORT: "8080"
+kind: ConfigMap
+metadata:
+  name: cm1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: svc1-namespace
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 9376
+  selector:
+    app.kubernetes.io/name: app1
+`)
+}
+
+func TestReplacementTransformerWithSuffixTransformerAndRejectUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteK("base", `
+resources:
+  - app.yaml
+`)
+	th.WriteK("overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+nameSuffix: -dev
+namePrefix: pre-
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: app-config
+    literals:
+      - name=something-else
+
+replacements:
+- source:
+    kind: ConfigMap
+    name: app-config
+    fieldPath: data.name
+  targets:
+    - reject:
+        - name: .*original.*
+      select:
+        kind: Deployment
+      fieldPaths:
+        - spec.template.spec.containers.0.name
+    - select:
+        kind: ConfigMap
+        name: app-config
+      fieldPaths:
+        - data.name-copy
+      options:
+        create: true
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pre-original-name-dev
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: app
+---
+apiVersion: v1
+data:
+  name: something-else
+  name-copy: something-else
+kind: ConfigMap
+metadata:
+  name: pre-app-config-dev-7266b7f2m9
+`)
+}

api/krusty/transformerannotation_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/krusty"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -261,8 +262,8 @@ func TestAnnoOriginRemoteBuiltinTransformer(t *testing.T) {
 	fSys := filesys.MakeFsOnDisk()
 	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+	require.NoError(t, err)
+	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
 resources:
 - github.com/kubernetes-sigs/kustomize/examples/multibases/production/?ref=v1.0.6
 buildMetadata: [transformerAnnotations]
@@ -278,7 +279,7 @@ buildMetadata: [transformerAnnotations]
 		t.FailNow()
 	}
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: v1
 kind: Pod
 metadata:
@@ -298,7 +299,7 @@ spec:
   - image: nginx:1.7.9
     name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoTransformerBuiltinInline(t *testing.T) {
@@ -356,7 +357,7 @@ func TestAnnoOriginCustomInlineTransformer(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	th.WriteK(tmpDir.String(), `
 transformers:
 - |-
@@ -375,7 +376,7 @@ buildMetadata: [transformerAnnotations]
 	// which will cause kustomize to record the plugin origin data as a transformation
 	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentWithOriginDotSh)
 
-	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
 	th.WriteF(filepath.Join(tmpDir.String(), "gener.yaml"), `
 kind: executable
 metadata:
@@ -388,9 +389,9 @@ spec:
 `)
 
 	m := th.Run(tmpDir.String(), o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -417,7 +418,7 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func TestAnnoOriginCustomExecTransformerWithOverlay(t *testing.T) {
@@ -428,11 +429,11 @@ func TestAnnoOriginCustomExecTransformerWithOverlay(t *testing.T) {
 	o.PluginConfig.FnpLoadingOptions.EnableExec = true
 
 	tmpDir, err := filesys.NewTmpConfirmedDir()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	base := filepath.Join(tmpDir.String(), "base")
 	prod := filepath.Join(tmpDir.String(), "prod")
-	assert.NoError(t, fSys.Mkdir(base))
-	assert.NoError(t, fSys.Mkdir(prod))
+	require.NoError(t, fSys.Mkdir(base))
+	require.NoError(t, fSys.Mkdir(prod))
 	th.WriteK(base, `
 transformers:
 - gener.yaml
@@ -455,12 +456,12 @@ spec:
 	// generateDeploymentWithOriginDotSh creates a resource that already has an origin annotation,
 	// which will cause kustomize to record the plugin origin data as a transformation
 	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentWithOriginDotSh)
-	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	require.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
 
 	m := th.Run(prod, o)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	yml, err := m.AsYaml()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -487,5 +488,5 @@ spec:
       - image: nginx
         name: nginx
 `, string(yml))
-	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+	require.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }

api/krusty/transformersimage_test.go

@@ -377,7 +377,8 @@ spec:
 	th.WriteF("base/config/knative.yaml", `
 images:
 - path: spec/runLatest/configuration/revisionTemplate/spec/container/image
-  apiVersion: serving.knative.dev/v1alpha1
+  group: serving.knative.dev
+  version: v1alpha1
   kind: Service
 `)
 }