Merge pull request #6138 from dims/update-kube-openapi

bump k8s.io/kube-openapi, drop github.com/mailru/easyjson

.github/workflows/apidiff.yml

@@ -13,20 +13,20 @@ jobs:
     if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - name: Clone the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
           go-version-file: go.work
       - name: Execute go-apidiff
-        uses: joelanford/go-apidiff@v0.8.2
+        uses: joelanford/go-apidiff@60c4206be8f84348ebda2a3e0c3ac9cb54b8f685
         with:
           compare-imports: true
           print-compatible: true
       - name: Report failure
-        uses: nashmaniac/create-issue-action@v1.2
+        uses: nashmaniac/create-issue-action@6814b79f58a9e25070c226b0c847e67b0c06efdd
         # Only report failures of pushes (PRs have are visible through the Checks section) to the default branch
         if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/master'
         with:

.github/workflows/go.yml

@@ -2,14 +2,15 @@ name: Go
 
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 permissions:
   contents: read
 
 jobs:
+  ## TODO: conditional-changes checker is not working
   conditional-changes:
     runs-on: ubuntu-latest
     permissions:
@@ -17,94 +18,141 @@ jobs:
     outputs:
       doc: ${{ steps.filter.outputs.doc }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
       id: filter
       with:
         filters: |
           doc:
             - 'site/**'
 
-  lint:
-    name: Lint
-    needs: conditional-changes
-    if: needs.conditional-changes.outputs.doc == 'false'
+  check-modules:
+    name: check-synced-go-modules
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       with:
         fetch-depth: 0
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
+      id: go
+    - name: sync go modules
+      run: make workspace-sync
+    - name: check for changes with 'make workspace-sync'
+      run: git diff --exit-code
+
+  lint:
+    name: Lint
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
+    runs-on: [ubuntu-latest]
+    steps:
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        fetch-depth: 0
+    - name: Set up Go 1.x
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+      with:
+        go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
     - name: Lint
       run: make lint
     - name: Verify boilerplate
       run: make check-license
 
-  test-linux:
+  ## Test all modules without plugins and released modules
+  test-non-released-modules:
     name: Test Linux
-    needs: conditional-changes
-    if: needs.conditional-changes.outputs.doc == 'false'
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
-    - name: Test all modules
-      run: make test-unit-non-plugin
+    - name: Test all modules without plugins and released modules
+      run: make test-unit-non-plugin-and-non-released
       env:
         KUSTOMIZE_DOCKER_E2E: true
 
-  test-macos:
-    name: Test MacOS
-    needs: conditional-changes
-    if: needs.conditional-changes.outputs.doc == 'false'
-    runs-on: [macos-latest]
+  test-modules:
+    name: Test ${{ matrix.os }} - ${{ matrix.module }}
+    # needs: conditional-changes
+    # if: needs.conditional-changes.outputs.doc == 'false'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        module:
+        - kyaml
+        - cmd/config
+        - api
+        - kustomize
+        include:
+        - module: kyaml
+          test-cmd: go test -race -v -cover ./...
+        - module: cmd/config
+          test-cmd: go test -v -cover ./...
+        - module: api
+          test-cmd: go test -v -cover ./... -ldflags "-X sigs.k8s.io/kustomize/api/provenance.buildDate=2023-01-31T23:38:41Z -X sigs.k8s.io/kustomize/api/provenance.version=(test)"
+        - module: kustomize
+          test-cmd: go test -v -cover ./...
+        - os: ubuntu-latest
+          docker-e2e: true
+        - os: macos-latest
+          docker-e2e: false
+        - os: windows-latest
+          docker-e2e: false
+    env:
+      KUSTOMIZE_DOCKER_E2E: ${{ matrix.docker-e2e }}
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
         go-version-file: go.work
+        cache: true
+        cache-dependency-path: |
+          **/go.sum
       id: go
-    - name: Test all modules
-      run: make test-unit-non-plugin
-      env:
-        KUSTOMIZE_DOCKER_E2E: false # docker not installed on mac
+    - name: Test ${{ matrix.module }}
+      run: ${{ matrix.test-cmd }}
+      # TODO (#4001): replace specific modules above with this once Windows tests are passing.
+      if: ${{ !(matrix.os == 'windows-latest' && (matrix.module == 'api' || matrix.module == 'kustomize')) }}
+      working-directory: ./${{ matrix.module }}
 
-  test-windows:
-    name: Test Windows
-    needs: conditional-changes
-    if: needs.conditional-changes.outputs.doc == 'false'
-    runs-on: [windows-latest]
+  # Aggregation matrix tests from test-modules for branch protection rules
+  test-modules-summary:
+    name: Test Summary
+    runs-on: ubuntu-latest
+    needs: test-modules
+    if: always()
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.work
-      id: go
-    - name: Test kyaml
-      run: go test -cover ./...
-      working-directory: ./kyaml
-    - name: Test cmd/config
-      run: go test -cover ./...
-      working-directory: ./cmd/config
-      env:
-        KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet
-
-    # TODO (#4001): replace specific modules above with this once Windows tests are passing.
-    #- name: Test all modules
-    #  run: make test-unit-non-plugin
-    #  env:
-    #    KUSTOMIZE_DOCKER_E2E: false # docker on windows not working well yet
+    - name: Check test results
+      run: |
+        if [[ "${{ needs.test-modules.result }}" != "success" ]]; then
+          echo "Some tests failed or were cancelled"
+          exit 1
+        fi
+        echo "All tests passed successfully"

.github/workflows/release.yaml

@@ -1,5 +1,8 @@
 name: release
 
+permissions:
+  contents: write # Allow actions to update dependabot PRs
+
 on:
   push:
     tags:
@@ -13,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       with:
         fetch-depth: 0
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
         go-version-file: go.work
       id: go

.gitignore

@@ -31,3 +31,4 @@ site/.hugo_build.lock
 
 # goreleaser artifacts
 **/dist/
+/output/

.golangci.yml

@@ -3,12 +3,13 @@
 
 run:
   deadline: 5m
-  go: '1.21'
+  go: "1.25"
 
 linters:
   enable-all: true
   disable:
     - cyclop
+    - depguard
     - exhaustivestruct
     - forbidigo
     - funlen
@@ -24,7 +25,9 @@ linters:
     - nlreturn
     - noctx
     - paralleltest
+    - perfsprint
     - stylecheck
+    - testifylint
     - varnamelen
     - wsl
     - exhaustruct
@@ -39,6 +42,11 @@ linters:
     - varcheck # abandoned by author
     - maligned # abandoned by author
     - interfacer # archived by author
+    # TODO(koba1t): temporarily disabled, will be addressed after upgrading to Go 1.24
+    - usetesting
+    - mnd
+    - copyloopvar
+    - intrange
 
 linters-settings:
   dupl:
@@ -49,14 +57,14 @@ linters-settings:
     min-complexity: 30
   revive:
     rules:
-    - name: var-naming
-      arguments:
-      - [ "ID", "API", "JSON" ] # AllowList
-      - [ ] # DenyList
+      - name: var-naming
+        arguments:
+          - ["ID", "API", "JSON"] # AllowList
+          - [] # DenyList
   gomnd:
     ignored-functions:
-    - os.WriteFile
-    - make
+      - os.WriteFile
+      - make
   gomoddirectives:
     replace-local: true
   gosec:

Makefile

@@ -3,7 +3,7 @@
 #
 # Makefile for kustomize CLI and API.
 
-LATEST_RELEASE=v5.4.2
+LATEST_RELEASE=v5.8.1
 
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)
@@ -136,11 +136,15 @@ test-unit-all: \
 	test-unit-non-plugin \
 	test-unit-kustomize-plugins
 
-# This target is used by our Github Actions CI to run unit tests for all non-plugin modules in multiple GOOS environments.
 .PHONY: test-unit-non-plugin
 test-unit-non-plugin:
 	./hack/for-each-module.sh "make test" "./plugin/*" 20
 
+# This target is used by our Github Actions CI to run unit tests for all non-plugin and non-released modules in multiple GOOS environments.
+.PHONY: test-unit-non-plugin-and-non-released
+test-unit-non-plugin-and-non-released:
+	./hack/for-each-module.sh "make test" "./plugin/*|./kyaml/go.mod|./cmd/config/go.mod|./api/go.mod|./kustomize/go.mod" 16
+
 .PHONY: build-non-plugin-all
 build-non-plugin-all:
 	./hack/for-each-module.sh "make build" "./plugin/*" 20
@@ -183,7 +187,7 @@ test-examples-kustomize-against-latest-release: $(MYGOBIN)/mdrip
 workspace-sync:
 	go work sync
 	./hack/doGoMod.sh tidy
-	
+
 # --- Cleanup targets ---
 .PHONY: clean
 clean: clean-kustomize-external-go-plugin uninstall-tools

Makefile-plugins.mk

@@ -99,7 +99,7 @@ generate-kustomize-builtin-plugins: $(builtplugins)
 		go generate .; \
 	done
 
-# Check for diff by comparing current revision of generated plugins on HEAD and newly generated plugins on local branch, 
+# Check for diff by comparing current revision of generated plugins on HEAD and newly generated plugins on local branch,
 # If diff is found, throw error code 1
 .PHONY: builtin-plugins-diff
 builtin-plugins-diff: $(builtplugins)
@@ -107,7 +107,9 @@ builtin-plugins-diff: $(builtplugins)
 		echo "Checking for diff... $${file}" ; \
 		set -e ; \
 		if [ "`git diff $${file} | wc -c`" -gt 0 ]; then\
-			echo "Error(1): diff found on $${file}"; exit 1; \
+			echo "Error(1): diff found on $${file}"; \
+			git diff $${file};\
+			exit 1;\
 		fi \
 	done
 

Makefile-tools.mk

@@ -10,6 +10,7 @@ endif
 export PATH := $(MYGOBIN):$(PATH)
 
 REPO_ROOT=$(shell git rev-parse --show-toplevel)
+GOLANGCI_LINT_VERSION ?= $(shell cd $(REPO_ROOT)/hack && go list -m -f '{{.Version}}' github.com/golangci/golangci-lint)
 
 # determines whether to run tests that only behave locally; can be overridden by override variable
 export IS_LOCAL = false
@@ -30,9 +31,11 @@ uninstall-out-of-tree-tools:
 	rm -f $(MYGOBIN)/mdrip
 	rm -f $(MYGOBIN)/stringer
 
+# golangci-lint is not guaranteed to use from tool directive, so we install it directly.
+# https://golangci-lint.run/docs/welcome/install/local/#install-from-sources
 .PHONY: $(MYGOBIN)/golangci-lint
 $(MYGOBIN)/golangci-lint:
-	cd $(REPO_ROOT)/hack && go install github.com/golangci/golangci-lint/cmd/golangci-lint
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
 
 .PHONY: $(MYGOBIN)/mdrip
 $(MYGOBIN)/mdrip:

OWNERS_ALIASES

@@ -11,19 +11,17 @@ aliases:
   kustomize-reviewers:
     - knverey
     - koba1t
-    - stormqueen1990
     - varshaprasad96
     - ncapps
+    - sarab97
 
   docs-approvers:
     - ncapps
   docs-reviewers:
     - ncapps
 
-  commands-approvers:
-    - stormqueen1990
-  commands-reviewers:
-    - stormqueen1990
+  commands-approvers: []
+  commands-reviewers: []
 
   #  emeritus:
   #    - liujingfang1

README.md

@@ -23,9 +23,9 @@ This tool is sponsored by [sig-cli] ([KEP]).
 To find the kustomize version embedded in recent versions of kubectl, run `kubectl version`:
 
 ```sh
-> kubectl version --short --client
-Client Version: v1.26.0
-Kustomize Version: v4.5.7
+> kubectl version --client
+Client Version: v1.31.0
+Kustomize Version: v5.4.2
 ```
 
 The kustomize build flow at [v2.0.3] was added
@@ -76,18 +76,18 @@ kustomization.yaml                                      deployment.yaml
 +---------------------------------------------+         +-------------------------------------------------------+       +-----------------------------------+
 | apiVersion: kustomize.config.k8s.io/v1beta1 |         | apiVersion: apps/v1                                   |       | apiVersion: v1                    |
 | kind: Kustomization                         |         | kind: Deployment                                      |       | kind: Service                     |
-| commonLabels:                               |         | metadata:                                             |       | metadata:                         |
-|   app: myapp                                |         |   name: myapp                                         |       |   name: myapp                     |
-| resources:                                  |         | spec:                                                 |       | spec:                             |
-|   - deployment.yaml                         |         |   selector:                                           |       |   selector:                       |
-|   - service.yaml                            |         |     matchLabels:                                      |       |     app: myapp                    |
-| configMapGenerator:                         |         |       app: myapp                                      |       |   ports:                          |
-|   - name: myapp-map                         |         |   template:                                           |       |     - port: 6060                  |
-|     literals:                               |         |     metadata:                                         |       |       targetPort: 6060            |
-|       - KEY=value                           |         |       labels:                                         |       +-----------------------------------+
-+---------------------------------------------+         |         app: myapp                                    |
-                                                        |     spec:                                             |
-                                                        |       containers:                                     |
+| labels:                                     |         | metadata:                                             |       | metadata:                         |
+| - includeSelectors: true                    |         |   name: myapp                                         |       |   name: myapp                     |
+|   pairs:                                    |         | spec:                                                 |       | spec:                             |
+|     app: myapp                              |         |   selector:                                           |       |   selector:                       |
+| resources:                                  |         |     matchLabels:                                      |       |     app: myapp                    |
+|   - deployment.yaml                         |         |       app: myapp                                      |       |   ports:                          |
+|   - service.yaml                            |         |   template:                                           |       |     - port: 6060                  |
+| configMapGenerator:                         |         |     metadata:                                         |       |       targetPort: 6060            |
+|   - name: myapp-map                         |         |       labels:                                         |       +-----------------------------------+
+|     literals:                               |         |         app: myapp                                    |
+|       - KEY=value                           |         |     spec:                                             |
++---------------------------------------------+         |       containers:                                     |
                                                         |         - name: myapp                                 |
                                                         |           image: myapp                                |
                                                         |           resources:                                  |
@@ -142,16 +142,16 @@ kustomization.yaml                                      replica_count.yaml
 +-----------------------------------------------+       +-------------------------------+       +------------------------------------------+
 | apiVersion: kustomize.config.k8s.io/v1beta1   |       | apiVersion: apps/v1           |       | apiVersion: apps/v1                      |
 | kind: Kustomization                           |       | kind: Deployment              |       | kind: Deployment                         |
-| commonLabels:                                 |       | metadata:                     |       | metadata:                                |  
-|   variant: prod                               |       |   name: myapp                 |       |   name: myapp                            |
-| resources:                                    |       | spec:                         |       | spec:                                    |
-|   - ../../base                                |       |   replicas: 80                |       |  template:                               |
-| patches:                                      |       +-------------------------------+       |     spec:                                |
-|   - path: replica_count.yaml                  |                                               |       containers:                        |
-|   - path: cpu_count.yaml                      |                                               |         - name: myapp                    |  
-+-----------------------------------------------+                                               |           resources:                     |
-                                                                                                |             limits:                      |
-                                                                                                |               memory: "128Mi"            |
+| labels:                                       |       | metadata:                     |       | metadata:                                |
+|  - includeSelectors: true                     |       |   name: myapp                 |       |   name: myapp                            |
+|    pairs:                                     |       | spec:                         |       | spec:                                    |
+|      variant: prod                            |       |   replicas: 80                |       |  template:                               |
+| resources:                                    |       +-------------------------------+       |     spec:                                |
+|   - ../../base                                |                                               |       containers:                        |
+| patches:                                      |                                               |         - name: myapp                    |
+|   - path: replica_count.yaml                  |                                               |           resources:                     |
+|   - path: cpu_count.yaml                      |                                               |             limits:                      |
++-----------------------------------------------+                                               |               memory: "128Mi"            |
                                                                                                 |               cpu: "7000m"               |
                                                                                                 +------------------------------------------+
 ```

api/filters/imagetag/imagetag_test.go

@@ -879,6 +879,84 @@ spec:
 				},
 			},
 		},
+		"update image volume in pod template": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: imagevolume
+spec:
+  template:
+    spec:
+      volumes:
+      - name: volume
+        image:
+          reference: nginx
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: imagevolume
+spec:
+  template:
+    spec:
+      volumes:
+      - name: volume
+        image:
+          reference: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/volumes[]/image/reference",
+				},
+			},
+		},
+		"update image volume in pod spec": {
+			input: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: imagevolume
+spec:
+  volumes:
+  - name: volume
+    image:
+      reference: nginx
+`,
+			expectedOutput: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: imagevolume
+spec:
+  volumes:
+  - name: volume
+    image:
+      reference: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/volumes[]/image/reference",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/filters/nameref/nameref.go

@@ -205,16 +205,14 @@ func getRoleRefGvk(n *resource.Resource) (*resid.Gvk, error) {
 		return nil, err
 	}
 	if apiGroup.IsNil() {
-		return nil, fmt.Errorf(
-			"apiGroup cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf("apiGroup cannot be found in roleRef %s", roleRef.MustString())
 	}
 	kind, err := roleRef.Pipe(yaml.Lookup("kind"))
 	if err != nil {
 		return nil, err
 	}
 	if kind.IsNil() {
-		return nil, fmt.Errorf(
-			"kind cannot be found in roleRef %s", roleRef.MustString())
+		return nil, fmt.Errorf("kind cannot be found in roleRef %s", roleRef.MustString())
 	}
 	return &resid.Gvk{
 		Group: apiGroup.YNode().Value,

api/filters/replacement/replacement.go

@@ -4,6 +4,7 @@
 package replacement
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 
@@ -11,7 +12,6 @@ import (
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml_utils "sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -23,7 +23,7 @@ type Filter struct {
 // Filter replaces values of targets with values from sources
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	for i, r := range f.Replacements {
-		if r.Source == nil || r.Targets == nil {
+		if (r.SourceValue == nil && r.Source == nil) || r.Targets == nil {
 			return nil, fmt.Errorf("replacements must specify a source and at least one target")
 		}
 		value, err := getReplacement(nodes, &f.Replacements[i])
@@ -39,6 +39,13 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 }
 
 func getReplacement(nodes []*yaml.RNode, r *types.Replacement) (*yaml.RNode, error) {
+	if r.SourceValue != nil && r.Source != nil {
+		return nil, fmt.Errorf("value and resource selectors are mutually exclusive")
+	}
+	if r.SourceValue != nil {
+		return yaml.NewScalarRNode(*r.SourceValue), nil
+	}
+
 	source, err := selectSourceNode(nodes, r.Source)
 	if err != nil {
 		return nil, err
@@ -110,6 +117,10 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 		if len(selector.FieldPaths) == 0 {
 			selector.FieldPaths = []string{types.DefaultReplacementFieldPath}
 		}
+		tsr, err := types.NewTargetSelectorRegex(selector)
+		if err != nil {
+			return nil, fmt.Errorf("error creating target selector: %w", err)
+		}
 		for _, possibleTarget := range nodes {
 			ids, err := utils.MakeResIds(possibleTarget)
 			if err != nil {
@@ -125,9 +136,13 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 				continue
 			}
 
+			if tsr.RejectsAny(ids) {
+				continue
+			}
+
 			// filter targets by matching resource IDs
 			for _, id := range ids {
-				if id.IsSelectedBy(selector.Select.ResId) && !containsRejectId(selector.Reject, ids) {
+				if tsr.Selects(id) {
 					err := copyValueToTarget(possibleTarget, value, selector)
 					if err != nil {
 						return nil, err
@@ -168,43 +183,37 @@ func matchesAnnoAndLabelSelector(n *yaml.RNode, selector *types.Selector) (bool,
 	return annoMatch && labelMatch, nil
 }
 
-func containsRejectId(rejects []*types.Selector, ids []resid.ResId) bool {
-	for _, r := range rejects {
-		if r.ResId.IsEmpty() {
-			continue
-		}
-		for _, id := range ids {
-			if id.IsSelectedBy(r.ResId) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.TargetSelector) error {
 	for _, fp := range selector.FieldPaths {
 		createKind := yaml.Kind(0) // do not create
 		if selector.Options != nil && selector.Options.Create {
 			createKind = value.YNode().Kind
 		}
+
+		// Check if this fieldPath contains structured data access
+		if err := setValueInStructuredData(target, value, fp, selector.Options); err == nil {
+			// Successfully handled as structured data
+			continue
+		}
+
+		// Fall back to normal path handling
 		targetFieldList, err := target.Pipe(&yaml.PathMatcher{
 			Path:   kyaml_utils.SmarterPathSplitter(fp, "."),
 			Create: createKind})
 		if err != nil {
-			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+			return errors.WrapPrefixf(err, "%s", fieldRetrievalError(fp, createKind != 0))
 		}
 		targetFields, err := targetFieldList.Elements()
 		if err != nil {
-			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+			return errors.WrapPrefixf(err, "%s", fieldRetrievalError(fp, createKind != 0))
 		}
 		if len(targetFields) == 0 {
-			return errors.Errorf(fieldRetrievalError(fp, createKind != 0))
+			return errors.Errorf("%s", fieldRetrievalError(fp, createKind != 0))
 		}
 
 		for _, t := range targetFields {
 			if err := setFieldValue(selector.Options, t, value); err != nil {
-				return err
+				return fmt.Errorf("%w", err)
 			}
 		}
 	}
@@ -247,3 +256,150 @@ func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *
 
 	return nil
 }
+
+// setValueInStructuredData handles setting values within structured data (JSON/YAML) in scalar fields
+func setValueInStructuredData(target *yaml.RNode, value *yaml.RNode, fieldPath string, options *types.FieldOptions) error {
+	pathParts := kyaml_utils.SmarterPathSplitter(fieldPath, ".")
+	if len(pathParts) < 2 {
+		return fmt.Errorf("not a structured data path")
+	}
+
+	// Find the potential scalar field that might contain structured data
+	var scalarFieldPath []string
+	var structuredDataPath []string
+	var foundScalar = false
+
+	// Try to find where the scalar field ends and structured data begins
+	for i := 1; i <= len(pathParts); i++ {
+		potentialScalarPath := pathParts[:i]
+		scalarField, err := target.Pipe(yaml.Lookup(potentialScalarPath...))
+		if err != nil {
+			continue
+		}
+		if scalarField != nil && scalarField.YNode().Kind == yaml.ScalarNode && i < len(pathParts) {
+			// Try to parse the scalar value as structured data
+			scalarValue := scalarField.YNode().Value
+			var parsedNode yaml.Node
+			if err := yaml.Unmarshal([]byte(scalarValue), &parsedNode); err == nil {
+				// Successfully parsed - this is structured data
+				scalarFieldPath = potentialScalarPath
+				structuredDataPath = pathParts[i:]
+				foundScalar = true
+				break
+			}
+		}
+	}
+
+	if !foundScalar {
+		return fmt.Errorf("no structured data found in path")
+	}
+
+	// Get the scalar field containing structured data
+	scalarField, err := target.Pipe(yaml.Lookup(scalarFieldPath...))
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	// Parse the structured data
+	scalarValue := scalarField.YNode().Value
+	var parsedNode yaml.Node
+	if err := yaml.Unmarshal([]byte(scalarValue), &parsedNode); err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	structuredData := yaml.NewRNode(&parsedNode)
+
+	createKind := yaml.Kind(0) // do not create
+	if options != nil && options.Create {
+		createKind = value.YNode().Kind
+	}
+
+	// Navigate to the target location within the structured data
+	targetInStructured, err := structuredData.Pipe(&yaml.PathMatcher{
+		Path:   structuredDataPath,
+		Create: createKind,
+	})
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	targetFields, err := targetInStructured.Elements()
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	if len(targetFields) == 0 {
+		return fmt.Errorf("unable to find field in structured data")
+	}
+
+	// Set the value in the structured data
+	for _, t := range targetFields {
+		err = setFieldValue(options, t, value)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Serialize the modified structured data back to the scalar field
+	// Try to detect if original was JSON or YAML and preserve formatting
+	serializedData, err := serializeStructuredData(structuredData, scalarValue)
+	if err != nil {
+		return fmt.Errorf("%w", err)
+	}
+
+	// Update the original scalar field
+	scalarField.YNode().Value = serializedData
+
+	return nil
+}
+
+// serializeStructuredData handles the serialization of structured data back to string format
+// preserving the original format (JSON vs YAML) and style (pretty vs compact)
+func serializeStructuredData(structuredData *yaml.RNode, originalValue string) (string, error) {
+	firstChar := rune(strings.TrimSpace(originalValue)[0])
+	if firstChar == '{' || firstChar == '[' {
+		return serializeAsJSON(structuredData, originalValue)
+	}
+
+	// Fallback to YAML format
+	return serializeAsYAML(structuredData)
+}
+
+// serializeAsJSON converts structured data back to JSON format
+func serializeAsJSON(structuredData *yaml.RNode, originalValue string) (string, error) {
+	modifiedData, err := structuredData.String()
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize structured data: %w", err)
+	}
+
+	// Parse the YAML output as JSON
+	var jsonData interface{}
+	if err := yaml.Unmarshal([]byte(modifiedData), &jsonData); err != nil {
+		return "", fmt.Errorf("failed to unmarshal YAML data: %w", err)
+	}
+
+	// Check if original was pretty-printed by looking for newlines and indentation
+	if strings.Contains(originalValue, "\n") && strings.Contains(originalValue, "  ") {
+		// Pretty-print the JSON to match original formatting
+		if prettyJSON, err := json.MarshalIndent(jsonData, "", "  "); err == nil {
+			return string(prettyJSON), nil
+		}
+	}
+
+	// Compact JSON
+	if compactJSON, err := json.Marshal(jsonData); err == nil {
+		return string(compactJSON), nil
+	}
+
+	return "", fmt.Errorf("failed to marshal JSON data")
+}
+
+// serializeAsYAML converts structured data back to YAML format
+func serializeAsYAML(structuredData *yaml.RNode) (string, error) {
+	modifiedData, err := structuredData.String()
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize YAML data: %w", err)
+	}
+
+	return strings.TrimSpace(modifiedData), nil
+}

api/go.mod

@@ -1,35 +1,44 @@
 module sigs.k8s.io/kustomize/api
 
-go 1.21
+go 1.25.0
 
 require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/go-errors/errors v1.4.2
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/goleak v1.3.0
-	gopkg.in/evanphx/json-patch.v4 v4.12.0
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00
-	sigs.k8s.io/kustomize/kyaml v0.17.2
-	sigs.k8s.io/yaml v1.4.0
+	go.yaml.in/yaml/v2 v2.4.2
+	gopkg.in/evanphx/json-patch.v4 v4.13.0
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787
+	sigs.k8s.io/kustomize/kyaml v0.21.1
+	sigs.k8s.io/yaml v1.5.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/sergi/go-diff v1.2.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace sigs.k8s.io/kustomize/kyaml => ../kyaml

api/go.sum

@@ -1,8 +1,5 @@
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -10,27 +7,46 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -40,60 +56,56 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
-sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

api/internal/accumulator/resaccumulator.go

@@ -170,7 +170,7 @@ func (ra *ResAccumulator) FixBackReferences() (err error) {
 
 // Intersection drops the resources which "other" does not have.
 func (ra *ResAccumulator) Intersection(other resmap.ResMap) error {
-	otherIds := other.AllIds()
+	otherIds := other.AllIds() //nolint:revive
 	for _, curId := range ra.resMap.AllIds() {
 		toDelete := true
 		for _, otherId := range otherIds {

api/internal/builtins/AnnotationsTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ConfigMapGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/HashTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on HashTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/HelmChartInflationGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on HelmChartInflationGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -10,8 +8,10 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -62,6 +62,9 @@ func (p *HelmChartInflationGeneratorPlugin) Config(
 	if len(h.GeneralConfig().HelmConfig.ApiVersions) != 0 {
 		p.HelmChart.ApiVersions = h.GeneralConfig().HelmConfig.ApiVersions
 	}
+	if h.GeneralConfig().HelmConfig.Debug {
+		p.HelmChart.Debug = h.GeneralConfig().HelmConfig.Debug
+	}
 
 	p.h = h
 	if err = yaml.Unmarshal(config, p); err != nil {
@@ -168,13 +171,17 @@ func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
 		fmt.Sprintf("HELM_DATA_HOME=%s/.data", p.ConfigHome)}
 	cmd.Env = append(os.Environ(), env...)
 	err := cmd.Run()
+	errorOutput := stderr.String()
+	if slices.Contains(args, "--debug") {
+		errorOutput = " Helm stack trace:\n" + errorOutput + "\nHelm template:\n" + stdout.String() + "\n"
+	}
 	if err != nil {
 		helm := p.h.GeneralConfig().HelmConfig.Command
 		err = errors.WrapPrefixf(
 			fmt.Errorf(
 				"unable to run: '%s %s' with env=%s (is '%s' installed?): %w",
 				helm, strings.Join(args, " "), env, helm, err),
-			stderr.String(),
+			"%s", errorOutput,
 		)
 	}
 	return stdout.Bytes(), err
@@ -288,11 +295,14 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 
 	rm, resMapErr := p.h.ResmapFactory().NewResMapFromBytes(stdout)
 	if resMapErr == nil {
+		if err := p.markHelmGeneratedResources(rm); err != nil {
+			return nil, err
+		}
 		return rm, nil
 	}
 	// try to remove the contents before first "---" because
 	// helm may produce messages to stdout before it
-	r := &kio.ByteReader{Reader: bytes.NewBufferString(string(stdout)), OmitReaderAnnotations: true}
+	r := &kio.ByteReader{Reader: bytes.NewBuffer(stdout), OmitReaderAnnotations: true}
 	nodes, err := r.Read()
 	if err != nil {
 		return nil, fmt.Errorf("error reading helm output: %w", err)
@@ -303,6 +313,9 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 		if err != nil {
 			return nil, fmt.Errorf("could not parse rnode slice into resource map: %w", err)
 		}
+		if err := p.markHelmGeneratedResources(rm); err != nil {
+			return nil, err
+		}
 		return rm, nil
 	}
 	return nil, fmt.Errorf("could not parse bytes into resource map: %w", resMapErr)
@@ -328,6 +341,9 @@ func (p *HelmChartInflationGeneratorPlugin) pullCommand() []string {
 	if p.Version != "" {
 		args = append(args, "--version", p.Version)
 	}
+	if p.Devel {
+		args = append(args, "--devel")
+	}
 	return args
 }
 
@@ -342,9 +358,18 @@ func (p *HelmChartInflationGeneratorPlugin) chartExistsLocally() (string, bool)
 	return path, s.IsDir()
 }
 
-// checkHelmVersion will return an error if the helm version is not V3
+func (p *HelmChartInflationGeneratorPlugin) markHelmGeneratedResources(rm resmap.ResMap) error {
+	for _, r := range rm.Resources() {
+		if err := r.RNode.PipeE(kyaml.SetAnnotation(konfig.HelmGeneratedAnnotation, "true")); err != nil {
+			return fmt.Errorf("failed to set helm annotation: %w", err)
+		}
+	}
+	return nil
+}
+
+// checkHelmVersion will return an error if the helm version is not V3 or V4
 func (p *HelmChartInflationGeneratorPlugin) checkHelmVersion() error {
-	stdout, err := p.runHelmCommand([]string{"version", "-c", "--short"})
+	stdout, err := p.runHelmCommand([]string{"version", "--short"})
 	if err != nil {
 		return err
 	}
@@ -360,8 +385,8 @@ func (p *HelmChartInflationGeneratorPlugin) checkHelmVersion() error {
 		v = v[1:]
 	}
 	majorVersion := strings.Split(v, ".")[0]
-	if majorVersion != "3" {
-		return fmt.Errorf("this plugin requires helm V3 but got v%s", v)
+	if majorVersion != "3" && majorVersion != "4" {
+		return fmt.Errorf("this plugin requires helm V3 or V4 but got v%s", v)
 	}
 	return nil
 }

api/internal/builtins/IAMPolicyGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on IAMPolicyGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ImageTagTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/LabelTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on LabelTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/NamespaceTransformer.go

@@ -1,12 +1,11 @@
 // Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
 	"fmt"
 
 	"sigs.k8s.io/kustomize/api/filters/namespace"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -14,6 +13,8 @@ import (
 )
 
 // Change or set the namespace of non-cluster level resources.
+//
+//nolint:tagalign
 type NamespaceTransformerPlugin struct {
 	types.ObjectMeta       `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	FieldSpecs             []types.FieldSpec                `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
@@ -51,6 +52,10 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 			// Don't mutate empty objects?
 			continue
 		}
+		if annotations := r.GetAnnotations(konfig.HelmGeneratedAnnotation); annotations[konfig.HelmGeneratedAnnotation] == "true" {
+			// Don't apply namespace on Helm generated manifest. Helm should take care of it.
+			continue
+		}
 		r.StorePreviousId()
 		if err := r.ApplyFilter(namespace.Filter{
 			Namespace:              p.Namespace,

api/internal/builtins/PatchJson6902Transformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PatchJson6902Transformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/PatchStrategicMergeTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PatchStrategicMergeTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/PatchTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PatchTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -24,10 +22,10 @@ type PatchTransformerPlugin struct {
 	patchText string
 	// patchSource is patch source message
 	patchSource string
-	Path        string          `json:"path,omitempty"    yaml:"path,omitempty"`
-	Patch       string          `json:"patch,omitempty"   yaml:"patch,omitempty"`
-	Target      *types.Selector `json:"target,omitempty"  yaml:"target,omitempty"`
-	Options     map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+	Path        string           `json:"path,omitempty"    yaml:"path,omitempty"`
+	Patch       string           `json:"patch,omitempty"   yaml:"patch,omitempty"`
+	Target      *types.Selector  `json:"target,omitempty"  yaml:"target,omitempty"`
+	Options     *types.PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
 }
 
 func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error {
@@ -56,8 +54,9 @@ func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error
 	patchesSM, errSM := h.ResmapFactory().RF().SliceFromBytes([]byte(p.patchText))
 	patchesJson, errJson := jsonPatchFromBytes([]byte(p.patchText))
 
-	if (errSM == nil && errJson == nil) ||
-		(patchesSM != nil && patchesJson != nil) {
+	if ((errSM == nil && errJson == nil) ||
+		(patchesSM != nil && patchesJson != nil)) &&
+		(len(patchesSM) > 0 && len(patchesJson) > 0) {
 		return fmt.Errorf(
 			"illegally qualifies as both an SM and JSON patch: %s",
 			p.patchSource)
@@ -69,10 +68,14 @@ func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error
 	if errSM == nil {
 		p.smPatches = patchesSM
 		for _, loadedPatch := range p.smPatches {
-			if p.Options["allowNameChange"] {
+			if p.Options == nil {
+				continue
+			}
+
+			if p.Options.AllowNameChange {
 				loadedPatch.AllowNameChange()
 			}
-			if p.Options["allowKindChange"] {
+			if p.Options.AllowKindChange {
 				loadedPatch.AllowKindChange()
 			}
 		}
@@ -86,7 +89,10 @@ func (p *PatchTransformerPlugin) Transform(m resmap.ResMap) error {
 	if p.smPatches != nil {
 		return p.transformStrategicMerge(m)
 	}
-	return p.transformJson6902(m)
+	if p.jsonPatches != nil {
+		return p.transformJson6902(m)
+	}
+	return nil
 }
 
 // transformStrategicMerge applies each loaded strategic merge patch

api/internal/builtins/PrefixTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on PrefixTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ReplacementTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ReplacementTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -16,7 +14,7 @@ import (
 // Replace values in targets with values from a source
 type ReplacementTransformerPlugin struct {
 	ReplacementList []types.ReplacementField `json:"replacements,omitempty" yaml:"replacements,omitempty"`
-	Replacements    []types.Replacement      `json:"omitempty" yaml:"omitempty"`
+	replacements    []types.Replacement
 }
 
 func (p *ReplacementTransformerPlugin) Config(
@@ -49,19 +47,19 @@ func (p *ReplacementTransformerPlugin) Config(
 				if err := yaml.Unmarshal(content, &repl); err != nil {
 					return err
 				}
-				p.Replacements = append(p.Replacements, repl...)
+				p.replacements = append(p.replacements, repl...)
 			case reflect.Map:
 				repl := types.Replacement{}
 				if err := yaml.Unmarshal(content, &repl); err != nil {
 					return err
 				}
-				p.Replacements = append(p.Replacements, repl)
+				p.replacements = append(p.replacements, repl)
 			default:
 				return fmt.Errorf("unsupported replacement type encountered within replacement path: %v", items.Kind())
 			}
 		} else {
 			// replacement information is already loaded
-			p.Replacements = append(p.Replacements, r.Replacement)
+			p.replacements = append(p.replacements, r.Replacement)
 		}
 	}
 	return nil
@@ -69,7 +67,7 @@ func (p *ReplacementTransformerPlugin) Config(
 
 func (p *ReplacementTransformerPlugin) Transform(m resmap.ResMap) (err error) {
 	return m.ApplyFilter(replacement.Filter{
-		Replacements: p.Replacements,
+		Replacements: p.replacements,
 	})
 }
 

api/internal/builtins/ReplicaCountTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ReplicaCountTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/SecretGenerator.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SecretGenerator; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/SortOrderTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SortOrderTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (
@@ -151,6 +149,9 @@ func gvkLessThan(gvk1, gvk2 resid.Gvk, typeOrders map[string]int) bool {
 	if index1 != index2 {
 		return index1 < index2
 	}
+	if (gvk1.Kind == types.NamespaceKind && gvk2.Kind == types.NamespaceKind) && (gvk1.Group == "" || gvk2.Group == "") {
+		return legacyGVKSortString(gvk1) > legacyGVKSortString(gvk2)
+	}
 	return legacyGVKSortString(gvk1) < legacyGVKSortString(gvk2)
 }
 

api/internal/builtins/SuffixTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on SuffixTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/builtins/ValueAddTransformer.go

@@ -1,6 +1,4 @@
 // Code generated by pluginator on ValueAddTransformer; DO NOT EDIT.
-// pluginator {(devel)  unknown   }
-
 package builtins
 
 import (

api/internal/konfig/builtinpluginconsts/commonlabels.go

@@ -110,4 +110,4 @@ commonLabels:
   create: false
   group: networking.k8s.io
   kind: NetworkPolicy
-` + metadataLabelsFieldSpecs
+` + metadataLabelsFieldSpecs + volumeClaimTemplatesMetadataLabels

api/internal/konfig/builtinpluginconsts/defaultconfig.go

@@ -14,6 +14,7 @@ func GetDefaultFieldSpecs() []byte {
 		[]byte(nameSuffixFieldSpecs),
 		[]byte(commonLabelFieldSpecs),
 		[]byte(templateLabelFieldSpecs),
+		[]byte(volumeClaimTemplateLabelFieldSpecs),
 		[]byte(commonAnnotationFieldSpecs),
 		[]byte(namespaceFieldSpecs),
 		[]byte(varReferenceFieldSpecs),
@@ -32,6 +33,7 @@ func GetDefaultFieldSpecsAsMap() map[string]string {
 	result["namesuffix"] = nameSuffixFieldSpecs
 	result["commonlabels"] = commonLabelFieldSpecs
 	result["templatelabels"] = templateLabelFieldSpecs
+	result["volumeclaimtemplatelabels"] = volumeClaimTemplateLabelFieldSpecs
 	result["commonannotations"] = commonAnnotationFieldSpecs
 	result["namespace"] = namespaceFieldSpecs
 	result["varreference"] = varReferenceFieldSpecs

api/internal/konfig/builtinpluginconsts/images.go

@@ -10,9 +10,13 @@ images:
   create: true
 - path: spec/initContainers[]/image
   create: true
+- path: spec/volumes[]/image/reference
+  create: true
 - path: spec/template/spec/containers[]/image
   create: true
 - path: spec/template/spec/initContainers[]/image
   create: true
+- path: spec/template/spec/volumes[]/image/reference
+  create: true
 `
 )

api/internal/konfig/builtinpluginconsts/metadatalabels.go

@@ -29,11 +29,6 @@ const metadataLabelsFieldSpecs = `
   group: apps
   kind: StatefulSet
 
-- path: spec/volumeClaimTemplates[]/metadata/labels
-  create: true
-  group: apps
-  kind: StatefulSet
-
 - path: spec/template/metadata/labels
   create: true
   group: batch

api/internal/konfig/builtinpluginconsts/volumeclaimmetadatalabels.go

@@ -0,0 +1,15 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const volumeClaimTemplateLabelFieldSpecs = `
+volumeClaimTemplateLabels:
+` + volumeClaimTemplatesMetadataLabels
+
+const volumeClaimTemplatesMetadataLabels = `
+- path: spec/volumeClaimTemplates[]/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+`

api/internal/loader/fileloader.go

@@ -147,6 +147,26 @@ func newLoaderAtConfirmedDir(
 	}
 }
 
+// hasAmbiguousPathSegment reports whether path contains a segment with ".."
+// embedded in it (not ".." itself). This pattern results from YAML indentation
+// errors where two list entries merge into one scalar, e.g.:
+//
+//	resources:
+//	- ../../base
+//	 - ../../shared/prod
+//
+// YAML parses this as "../../base - ../../shared/prod", producing segment
+// "base - .." which filepath.Clean absorbs, silently resolving to an
+// unintended directory.
+func hasAmbiguousPathSegment(path string) bool {
+	for _, part := range strings.Split(filepath.ToSlash(path), "/") {
+		if part != "" && part != "." && part != ".." && strings.Contains(part, "..") {
+			return true
+		}
+	}
+	return false
+}
+
 // New returns a new Loader, rooted relative to current loader,
 // or rooted in a temp directory holding a git repo clone.
 func (fl *FileLoader) New(path string) (ifc.Loader, error) {
@@ -167,9 +187,16 @@ func (fl *FileLoader) New(path string) (ifc.Loader, error) {
 	if filepath.IsAbs(path) {
 		return nil, fmt.Errorf("new root '%s' cannot be absolute", path)
 	}
+	if hasAmbiguousPathSegment(path) {
+		return nil, fmt.Errorf(
+			"path %q is ambiguous: resolves to %q after normalization, "+
+				"which is likely not the intended target; check for YAML "+
+				"indentation errors in your kustomization file",
+			path, filepath.Clean(path))
+	}
 	root, err := filesys.ConfirmDir(fl.fSys, fl.root.Join(path))
 	if err != nil {
-		return nil, errors.WrapPrefixf(err, ErrRtNotDir.Error())
+		return nil, errors.WrapPrefixf(err, "%s", ErrRtNotDir.Error())
 	}
 	if err = fl.errIfGitContainmentViolation(root); err != nil {
 		return nil, err
@@ -311,7 +338,11 @@ func (fl *FileLoader) httpClientGetContent(path string) ([]byte, error) {
 	} else {
 		hc = &http.Client{}
 	}
-	resp, err := hc.Get(path)
+	parsedURL, err := url.ParseRequestURI(path)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	resp, err := hc.Get(parsedURL.String())
 	if err != nil {
 		return nil, errors.Wrap(err)
 	}

api/internal/loader/fileloader_test.go

@@ -66,7 +66,7 @@ type testData struct {
 	expectedContent string
 }
 
-var testCases = []testData{
+var testCases = []testData{ //nolint:gochecknoglobals
 	{
 		path:            "foo/project/fileA.yaml",
 		expectedContent: "fileA content",
@@ -88,7 +88,7 @@ var testCases = []testData{
 func MakeFakeFs(td []testData) filesys.FileSystem {
 	fSys := filesys.MakeFsInMemory()
 	for _, x := range td {
-		fSys.WriteFile(x.path, []byte(x.expectedContent))
+		_ = fSys.WriteFile(x.path, []byte(x.expectedContent))
 	}
 	return fSys
 }
@@ -161,31 +161,31 @@ func TestLoaderBadRelative(t *testing.T) {
 	require.Equal("/foo/project/subdir1", l1.Root())
 
 	// Cannot cd into a file.
-	l2, err := l1.New("fileB.yaml")
+	_, err = l1.New("fileB.yaml")
 	require.Error(err)
 
 	// It's not okay to stay at the same place.
-	l2, err = l1.New(filesys.SelfDir)
+	_, err = l1.New(filesys.SelfDir)
 	require.Error(err)
 
 	// It's not okay to go up and back down into same place.
-	l2, err = l1.New("../subdir1")
+	_, err = l1.New("../subdir1")
 	require.Error(err)
 
 	// It's not okay to go up via a relative path.
-	l2, err = l1.New("..")
+	_, err = l1.New("..")
 	require.Error(err)
 
 	// It's not okay to go up via an absolute path.
-	l2, err = l1.New("/foo/project")
+	_, err = l1.New("/foo/project")
 	require.Error(err)
 
 	// It's not okay to go to the root.
-	l2, err = l1.New("/")
+	_, err = l1.New("/")
 	require.Error(err)
 
 	// It's okay to go up and down to a sibling.
-	l2, err = l1.New("../subdir2")
+	l2, err := l1.New("../subdir2")
 	require.NoError(err)
 	require.Equal("/foo/project/subdir2", l2.Root())
 
@@ -198,7 +198,7 @@ func TestLoaderBadRelative(t *testing.T) {
 
 	// It's not OK to go over to a previously visited directory.
 	// Must disallow going back and forth in a cycle.
-	l1, err = l2.New("../subdir1")
+	_, err = l2.New("../subdir1")
 	require.Error(err)
 }
 
@@ -207,6 +207,60 @@ func TestNewEmptyLoader(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestLoaderRejectsMalformedPath(t *testing.T) {
+	// A YAML indentation error can collapse two resource entries into one:
+	//   resources:
+	//   - ../../base
+	//    - ../../shared/prod
+	// becomes the single string: "../../base - ../../shared/prod"
+	//
+	// filepath.Clean normalizes this to "../../shared/prod", silently
+	// dropping the "../../base" reference. The loader must reject paths
+	// with inner ".." components that cause this silent absorption.
+	// See https://github.com/kubernetes-sigs/kustomize/issues/5979
+	fSys := filesys.MakeFsInMemory()
+	require.NoError(t, fSys.MkdirAll("/base"))
+	require.NoError(t, fSys.MkdirAll("/shared/prod"))
+	require.NoError(t, fSys.MkdirAll("/overlays/prod1"))
+
+	l1 := NewLoaderOrDie(RestrictionNone, fSys, "/overlays/prod1")
+
+	// The exact bug from issue #5979.
+	_, err := l1.New("../../base - ../../shared/prod")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "ambiguous")
+}
+
+func TestHasAmbiguousPathSegment(t *testing.T) {
+	cases := map[string]bool{
+		// Safe: ".." only as standalone segments
+		"../base":           false,
+		"../../shared/prod": false,
+		"..":                false,
+		"foo/bar":           false,
+		"foo/bar/":          false,
+		"foo//bar":          false,
+		"./foo/bar":         false,
+		"https://root":      false,
+		"foo/../bar":        false,
+		"a/b/../../c":       false,
+		"a/..":              false,
+		// Winding paths are legitimate (used by localizer)
+		"delta/../../../../a/b/../../alpha/beta/sibling": false,
+		// Dangerous: segment contains embedded ".." from YAML merge errors
+		"../../base - ../../shared/prod":  true,
+		"../../base ../../shared/prod":    true,
+		"foo/bar..baz/qux":                true,
+		"a/b/c..d/e":                      true,
+		"../../base\t- ../../shared/prod": true,
+	}
+	for path, want := range cases {
+		t.Run(path, func(t *testing.T) {
+			require.Equal(t, want, hasAmbiguousPathSegment(path), "hasAmbiguousPathSegment(%q)", path)
+		})
+	}
+}
+
 func TestNewRemoteLoaderDoesNotExist(t *testing.T) {
 	_, err := makeLoader().New("https://example.com/org/repo")
 	require.ErrorContains(t, err, "fetch")
@@ -265,23 +319,24 @@ const (
 //	└── exteriorData
 func commonSetupForLoaderRestrictionTest(t *testing.T) (string, filesys.FileSystem) {
 	t.Helper()
+	require := require.New(t)
 	fSys, tmpDir := setupOnDisk(t)
 	dir := tmpDir.String()
 
-	fSys.Mkdir(filepath.Join(dir, "base"))
+	require.NoError(fSys.Mkdir(filepath.Join(dir, "base")))
 
-	fSys.WriteFile(
-		filepath.Join(dir, "base", "okayData"), []byte(contentOk))
+	require.NoError(fSys.WriteFile(
+		filepath.Join(dir, "base", "okayData"), []byte(contentOk)))
 
-	fSys.WriteFile(
-		filepath.Join(dir, "exteriorData"), []byte(contentExteriorData))
+	require.NoError(fSys.WriteFile(
+		filepath.Join(dir, "exteriorData"), []byte(contentExteriorData)))
 
-	os.Symlink(
+	require.NoError(os.Symlink(
 		filepath.Join(dir, "base", "okayData"),
-		filepath.Join(dir, "base", "symLinkToOkayData"))
-	os.Symlink(
+		filepath.Join(dir, "base", "symLinkToOkayData")))
+	require.NoError(os.Symlink(
 		filepath.Join(dir, "exteriorData"),
-		filepath.Join(dir, "base", "symLinkToExteriorData"))
+		filepath.Join(dir, "base", "symLinkToExteriorData")))
 	return dir, fSys
 }
 
@@ -391,14 +446,14 @@ func TestNewLoaderAtGitClone(t *testing.T) {
 	url := rootURL + "/" + pathInRepo
 	coRoot := "/tmp"
 	fSys := filesys.MakeFsInMemory()
-	fSys.MkdirAll(coRoot)
-	fSys.MkdirAll(coRoot + "/" + pathInRepo)
-	fSys.WriteFile(
+	require.NoError(fSys.MkdirAll(coRoot))
+	require.NoError(fSys.MkdirAll(coRoot + "/" + pathInRepo))
+	require.NoError(fSys.WriteFile(
 		coRoot+"/"+pathInRepo+"/"+
 			konfig.DefaultKustomizationFileName(),
 		[]byte(`
 whatever
-`))
+`)))
 
 	repoSpec, err := git.NewRepoSpecFromURL(url)
 	require.NoError(err)
@@ -418,7 +473,7 @@ whatever
 	require.Error(err)
 
 	pathInRepo = "foo/overlay"
-	fSys.MkdirAll(coRoot + "/" + pathInRepo)
+	require.NoError(fSys.MkdirAll(coRoot + "/" + pathInRepo))
 	url = rootURL + "/" + pathInRepo
 	l2, err := l.New(url)
 	require.NoError(err)
@@ -435,9 +490,9 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
-	fSys.MkdirAll(topDir + "/highBase")
-	fSys.MkdirAll(cloneRoot + "/foo/base")
-	fSys.MkdirAll(cloneRoot + "/foo/overlay")
+	require.NoError(fSys.MkdirAll(topDir + "/highBase"))
+	require.NoError(fSys.MkdirAll(cloneRoot + "/foo/base"))
+	require.NoError(fSys.MkdirAll(cloneRoot + "/foo/overlay"))
 
 	var l1 ifc.Loader
 
@@ -448,7 +503,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	require.Equal(cloneRoot+"/foo/overlay", l1.Root())
 
 	l2, err := l1.New("../base")
-	require.NoError(nil)
+	require.NoError(err)
 	require.Equal(cloneRoot+"/foo/base", l2.Root())
 
 	l3, err := l2.New("../../../highBase")
@@ -513,8 +568,8 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
-	fSys.MkdirAll(topDir)
-	fSys.MkdirAll(cloneRoot + "/foo/base")
+	require.NoError(fSys.MkdirAll(topDir))
+	require.NoError(fSys.MkdirAll(cloneRoot + "/foo/base"))
 
 	l1 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, filesys.ConfirmedDir(topDir), fSys, nil,
@@ -534,8 +589,8 @@ func TestRepoDirectCycleDetection(t *testing.T) {
 	topDir := "/cycles"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
-	fSys.MkdirAll(topDir)
-	fSys.MkdirAll(cloneRoot)
+	require.NoError(fSys.MkdirAll(topDir))
+	require.NoError(fSys.MkdirAll(cloneRoot))
 
 	l1 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, filesys.ConfirmedDir(topDir), fSys, nil,
@@ -556,8 +611,8 @@ func TestRepoIndirectCycleDetection(t *testing.T) {
 	topDir := "/cycles"
 	cloneRoot := topDir + "/someClone"
 	fSys := filesys.MakeFsInMemory()
-	fSys.MkdirAll(topDir)
-	fSys.MkdirAll(cloneRoot)
+	require.NoError(fSys.MkdirAll(topDir))
+	require.NoError(fSys.MkdirAll(cloneRoot))
 
 	l0 := newLoaderAtConfirmedDir(
 		RestrictionRootOnly, filesys.ConfirmedDir(topDir), fSys, nil,
@@ -629,7 +684,7 @@ func TestLoaderHTTP(t *testing.T) {
 			u := req.URL.String()
 			require.Equal(x.path, u)
 			return &http.Response{
-				StatusCode: 200,
+				StatusCode: http.StatusOK,
 				Body:       io.NopCloser(bytes.NewBufferString(x.expectedContent)),
 				Header:     make(http.Header),
 			}
@@ -676,3 +731,15 @@ func setupOnDisk(t *testing.T) (filesys.FileSystem, filesys.ConfirmedDir) {
 	})
 	return fSys, dir
 }
+
+// TestLoaderHTTPMalformedURL tests that malformed URLs are properly handled
+// to prevent infinite loops in http.Client.Get
+func TestLoaderHTTPMalformedURL(t *testing.T) {
+	require := require.New(t)
+	malformedURL := "https://example.com/example?ref=main - ../../example/example.yaml"
+	l1 := NewLoaderOrDie(
+		RestrictionRootOnly, MakeFakeFs([]testData{}), filesys.Separator)
+	_, err := l1.Load(malformedURL)
+	require.Error(err)
+	require.Equal("HTTP Error: status code 400 (Bad Request)", err.Error())
+}

api/internal/loader/loader.go

@@ -28,7 +28,7 @@ func NewLoader(
 	}
 	root, err := filesys.ConfirmDir(fSys, target)
 	if err != nil {
-		return nil, errors.WrapPrefixf(err, ErrRtNotDir.Error())
+		return nil, errors.WrapPrefixf(err, "%s", ErrRtNotDir.Error())
 	}
 	return newLoaderAtConfirmedDir(
 		lr, root, fSys, nil, git.ClonerUsingGitExec), nil

api/internal/plugins/builtinconfig/transformerconfig.go

@@ -15,19 +15,22 @@ import (
 )
 
 // TransformerConfig holds the data needed to perform transformations.
+//
+//nolint:tagalign
 type TransformerConfig struct {
 	// if any fields are added, update the DeepCopy implementation
-	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
-	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
-	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
-	Labels            types.FsSlice `json:"labels,omitempty" yaml:"labels,omitempty"`
-	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
-	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
-	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
-	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
-	Images            types.FsSlice `json:"images,omitempty" yaml:"images,omitempty"`
-	Replicas          types.FsSlice `json:"replicas,omitempty" yaml:"replicas,omitempty"`
+	NamePrefix                types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
+	NameSuffix                types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
+	NameSpace                 types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+	CommonLabels              types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	Labels                    types.FsSlice `json:"labels,omitempty" yaml:"labels,omitempty"`
+	TemplateLabels            types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
+	VolumeClaimTemplateLabels types.FsSlice `json:"volumeClaimTemplateLabels,omitempty" yaml:"volumeClaimTemplateLabels,omitempty"`
+	CommonAnnotations         types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
+	NameReference             nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
+	VarReference              types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
+	Images                    types.FsSlice `json:"images,omitempty" yaml:"images,omitempty"`
+	Replicas                  types.FsSlice `json:"replicas,omitempty" yaml:"replicas,omitempty"`
 }
 
 // MakeEmptyConfig returns an empty TransformerConfig object
@@ -38,17 +41,18 @@ func MakeEmptyConfig() *TransformerConfig {
 // DeepCopy returns a new copy of TransformerConfig
 func (t *TransformerConfig) DeepCopy() *TransformerConfig {
 	return &TransformerConfig{
-		NamePrefix:        t.NamePrefix.DeepCopy(),
-		NameSuffix:        t.NameSuffix.DeepCopy(),
-		NameSpace:         t.NameSpace.DeepCopy(),
-		CommonLabels:      t.CommonLabels.DeepCopy(),
-		Labels:            t.Labels.DeepCopy(),
-		TemplateLabels:    t.TemplateLabels.DeepCopy(),
-		CommonAnnotations: t.CommonAnnotations.DeepCopy(),
-		NameReference:     t.NameReference.DeepCopy(),
-		VarReference:      t.VarReference.DeepCopy(),
-		Images:            t.Images.DeepCopy(),
-		Replicas:          t.Replicas.DeepCopy(),
+		NamePrefix:                t.NamePrefix.DeepCopy(),
+		NameSuffix:                t.NameSuffix.DeepCopy(),
+		NameSpace:                 t.NameSpace.DeepCopy(),
+		CommonLabels:              t.CommonLabels.DeepCopy(),
+		Labels:                    t.Labels.DeepCopy(),
+		TemplateLabels:            t.TemplateLabels.DeepCopy(),
+		VolumeClaimTemplateLabels: t.VolumeClaimTemplateLabels.DeepCopy(),
+		CommonAnnotations:         t.CommonAnnotations.DeepCopy(),
+		NameReference:             t.NameReference.DeepCopy(),
+		VarReference:              t.VarReference.DeepCopy(),
+		Images:                    t.Images.DeepCopy(),
+		Replicas:                  t.Replicas.DeepCopy(),
 	}
 }
 
@@ -98,6 +102,7 @@ func (t *TransformerConfig) sortFields() {
 	sort.Sort(t.CommonLabels)
 	sort.Sort(t.Labels)
 	sort.Sort(t.TemplateLabels)
+	sort.Sort(t.VolumeClaimTemplateLabels)
 	sort.Sort(t.CommonAnnotations)
 	sort.Sort(t.NameReference)
 	sort.Sort(t.VarReference)
@@ -179,6 +184,10 @@ func (t *TransformerConfig) Merge(input *TransformerConfig) (
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")
 	}
+	merged.VolumeClaimTemplateLabels, err = t.VolumeClaimTemplateLabels.MergeAll(input.VolumeClaimTemplateLabels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge VolumeClaimTemplateLabels fieldSpec")
+	}
 	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
 	if err != nil {
 		return nil, errors.WrapPrefixf(err, "failed to merge VarReference fieldSpec")

api/internal/plugins/execplugin/execplugin.go

@@ -12,8 +12,6 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/google/shlex"
-
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -95,7 +93,11 @@ func (p *ExecPlugin) processOptionalArgsFields() error {
 		return err
 	}
 	if c.ArgsOneLiner != "" {
-		p.args, _ = shlex.Split(c.ArgsOneLiner)
+		argsTolenSlice, err := ShlexSplit(c.ArgsOneLiner)
+		if err != nil {
+			return fmt.Errorf("failed to parse argsOneLiner: %w", err)
+		}
+		p.args = argsTolenSlice
 	}
 	if c.ArgsFromFile != "" {
 		content, err := p.h.Loader().Load(c.ArgsFromFile)
@@ -159,14 +161,13 @@ func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
 	_, err = f.Write(p.cfg)
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			err, "writing plugin config to "+f.Name())
+			err, "writing plugin config to %s", f.Name())
 	}
 	err = f.Close()
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			err, "closing plugin config file "+f.Name())
+			err, "closing plugin config file %s", f.Name())
 	}
-	//nolint:gosec
 	cmd := exec.Command(
 		p.path, append([]string{f.Name()}, p.args...)...)
 	cmd.Env = p.getEnv()
@@ -179,8 +180,8 @@ func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
 	result, err := cmd.Output()
 	if err != nil {
 		return nil, errors.WrapPrefixf(
-			fmt.Errorf("failure in plugin configured via %s; %w",
-				f.Name(), err), stdErr.String())
+			fmt.Errorf("failure in plugin configured via %s; %w", f.Name(), err),
+			"%s", stdErr.String())
 	}
 	return result, os.Remove(f.Name())
 }

api/internal/plugins/execplugin/shlex.go

@@ -0,0 +1,62 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// ShlexSplit splits a string into a slice of strings using shell-style rules for quoting and commenting
+// Similar to Python's shlex.split with comments enabled
+func ShlexSplit(s string) ([]string, error) {
+	return shlexSplit(s)
+}
+
+func shlexSplit(s string) ([]string, error) {
+	result := []string{}
+
+	// noQuote is used to track if we are not in a quoted
+	const noQuote = 0
+
+	var current strings.Builder
+	var quote rune = noQuote
+	var escaped bool
+
+	for _, r := range s {
+		switch {
+		case escaped:
+			current.WriteRune(r)
+			escaped = false
+		case r == '\\' && quote != '\'':
+			escaped = true
+		case (r == '\'' || r == '"') && quote == noQuote:
+			quote = r
+		case r == quote:
+			quote = noQuote
+		case r == '#' && quote == noQuote:
+			// Comment starts, ignore the rest of the line
+			if current.Len() > 0 {
+				result = append(result, current.String())
+			}
+			return result, nil
+		case unicode.IsSpace(r) && quote == noQuote:
+			if current.Len() > 0 {
+				result = append(result, current.String())
+				current.Reset()
+			}
+		default:
+			current.WriteRune(r)
+		}
+	}
+
+	if quote != noQuote {
+		return nil, fmt.Errorf("unclosed quote in string")
+	}
+	if current.Len() > 0 {
+		result = append(result, current.String())
+	}
+	return result, nil
+}

api/internal/plugins/execplugin/shlex_test.go

@@ -0,0 +1,183 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestShlexSplit(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected []string
+		wantErr  bool
+	}{
+		{
+			name:     "basic space separation",
+			input:    `hello world`,
+			expected: []string{"hello", "world"},
+			wantErr:  false,
+		},
+		{
+			name:     "double quoted string",
+			input:    `"hello world"`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "single quoted string",
+			input:    `'hello world'`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "mixed quotes and words",
+			input:    `hello "world test"`,
+			expected: []string{"hello", "world test"},
+			wantErr:  false,
+		},
+		{
+			name:     "single quotes with spaces",
+			input:    `hello 'world test'`,
+			expected: []string{"hello", "world test"},
+			wantErr:  false,
+		},
+		{
+			name:     "nested quotes - single in double",
+			input:    `"hello 'nested' world"`,
+			expected: []string{"hello 'nested' world"},
+			wantErr:  false,
+		},
+		{
+			name:     "nested quotes - double in single",
+			input:    `'hello "nested" world'`,
+			expected: []string{"hello \"nested\" world"},
+			wantErr:  false,
+		},
+		{
+			name:     "escaped space",
+			input:    `hello\ world`,
+			expected: []string{"hello world"},
+			wantErr:  false,
+		},
+		{
+			name:     "escaped quotes in double quotes",
+			input:    `"hello \"world\""`,
+			expected: []string{"hello \"world\""},
+			wantErr:  false,
+		},
+		{
+			name:     "single quote in single quotes",
+			input:    `'can'\''t'`,
+			expected: []string{"can't"},
+			wantErr:  false,
+		},
+		{
+			name:     "complex argument list",
+			input:    `arg1 "arg 2" 'arg 3' arg4`,
+			expected: []string{"arg1", "arg 2", "arg 3", "arg4"},
+			wantErr:  false,
+		},
+		{
+			name:     "echo command with escaped quotes",
+			input:    `echo "Hello, \"World!\""`,
+			expected: []string{"echo", "Hello, \"World!\""},
+			wantErr:  false,
+		},
+		{
+			name:     "grep command with quoted search term",
+			input:    `grep -r "search term" /path/to/dir`,
+			expected: []string{"grep", "-r", "search term", "/path/to/dir"},
+			wantErr:  false,
+		},
+		{
+			name:     "ls command with quoted filename",
+			input:    `ls -la "file with spaces.txt"`,
+			expected: []string{"ls", "-la", "file with spaces.txt"},
+			wantErr:  false,
+		},
+		{
+			name:     "empty string",
+			input:    ``,
+			expected: []string{},
+			wantErr:  false,
+		},
+		{
+			name:     "multiple spaces",
+			input:    `   multiple	spaces   `,
+			expected: []string{"multiple", "spaces"},
+			wantErr:  false,
+		},
+		{
+			name:     "with comment string",
+			input:    `echo "Hello, W#orld!" ${USER} # This is a comment`,
+			expected: []string{"echo", "Hello, W#orld!", "${USER}"},
+			wantErr:  false,
+		},
+		{
+			name:     "comment only",
+			input:    `# this line is just a comment`,
+			expected: []string{},
+			wantErr:  false,
+		},
+		// may cause an error in shlex at python3
+		{
+			name:     "unclosed double quote",
+			input:    `"unclosed quote`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "unclosed single quote",
+			input:    `'unclosed quote`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "mixed unclosed quotes",
+			input:    `"mixed 'quotes`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "single quote closed with double quote",
+			input:    `"hello world'`,
+			expected: nil,
+			wantErr:  true,
+		},
+		{
+			name:     "double quote closed with single quote",
+			input:    `'hello world"`,
+			expected: nil,
+			wantErr:  true,
+		},
+	}
+
+	// execute each test case
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// call the ShlexSplit function
+			result, err := ShlexSplit(tc.input)
+
+			// check for expected error
+			if tc.wantErr {
+				if err == nil {
+					t.Errorf("FAIL: Expected error but got none, Expected: %q\n", tc.expected)
+				}
+				return
+			}
+
+			if assert.NoError(t, err, "FAIL: Unexpected error %q for input %q", err, tc.input) {
+				// check if the result matches the expected output
+				assert.Equal(t, tc.expected, result,
+					"FAIL: Result mismatch,Input %q, Expected %q, Got: %q\n",
+					tc.input, tc.expected, result,
+				)
+			}
+		})
+	}
+}

api/internal/plugins/fnplugin/fnplugin.go

@@ -77,7 +77,6 @@ func NewFnPlugin(o *types.FnPluginLoadingOptions) *FnPlugin {
 		runFns: runfn.RunFns{
 			Functions:      []*yaml.RNode{},
 			Network:        o.Network,
-			EnableStarlark: o.EnableStar,
 			EnableExec:     o.EnableExec,
 			StorageMounts:  toStorageMounts(o.Mounts),
 			Env:            o.Env,

api/internal/plugins/loader/loader.go

@@ -34,7 +34,8 @@ type Loader struct {
 }
 
 func NewLoader(
-	pc *types.PluginConfig, rf *resmap.Factory, fs filesys.FileSystem) *Loader {
+	pc *types.PluginConfig, rf *resmap.Factory, fs filesys.FileSystem,
+) *Loader {
 	return &Loader{pc: pc, rf: rf, fs: fs}
 }
 
@@ -58,7 +59,8 @@ func (l *Loader) Config() *types.PluginConfig {
 
 func (l *Loader) LoadGenerators(
 	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
-	result []*resmap.GeneratorWithProperties, err error) {
+	result []*resmap.GeneratorWithProperties, err error,
+) {
 	for _, res := range rm.Resources() {
 		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
@@ -74,7 +76,8 @@ func (l *Loader) LoadGenerators(
 }
 
 func (l *Loader) LoadGenerator(
-	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (resmap.Generator, error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (resmap.Generator, error) {
 	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
@@ -87,7 +90,8 @@ func (l *Loader) LoadGenerator(
 }
 
 func (l *Loader) LoadTransformers(
-	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]*resmap.TransformerWithProperties, error) {
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap,
+) ([]*resmap.TransformerWithProperties, error) {
 	var result []*resmap.TransformerWithProperties
 	for _, res := range rm.Resources() {
 		t, err := l.LoadTransformer(ldr, v, res)
@@ -104,7 +108,8 @@ func (l *Loader) LoadTransformers(
 }
 
 func (l *Loader) LoadTransformer(
-	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (*resmap.TransformerWithProperties, error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (*resmap.TransformerWithProperties, error) {
 	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
@@ -179,7 +184,8 @@ func isBuiltinPlugin(res *resource.Resource) bool {
 func (l *Loader) loadAndConfigurePlugin(
 	ldr ifc.Loader,
 	v ifc.Validator,
-	res *resource.Resource) (c resmap.Configurable, err error) {
+	res *resource.Resource,
+) (c resmap.Configurable, err error) {
 	if isBuiltinPlugin(res) {
 		switch l.pc.BpLoadingOptions {
 		case types.BploLoadFromFileSys:
@@ -192,7 +198,7 @@ func (l *Loader) loadAndConfigurePlugin(
 			c, err = l.makeBuiltinPlugin(res.GetGvk())
 		default:
 			err = fmt.Errorf(
-				"unknown plugin loader behavior specified: %v",
+				"unknown plugin loader behavior specified: %s %v", res.GetGvk().String(),
 				l.pc.BpLoadingOptions)
 		}
 	} else {
@@ -245,7 +251,7 @@ func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error)
 				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
 					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src)
 			}
-			if strings.HasPrefix(filepath.Clean(mount.Src), "../") {
+			if strings.HasPrefix(filepath.Clean(mount.Src), "..") {
 				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
 					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src)
 			}
@@ -282,4 +288,3 @@ func (l *Loader) loadExecOrGoPlugin(resId resid.ResId) (resmap.Configurable, err
 	}
 	return c, nil
 }
-

api/internal/plugins/loader/loader_test.go

@@ -18,7 +18,6 @@ import (
 )
 
 const (
-	//nolint:gosec
 	secretGenerator = `
 apiVersion: builtin
 kind: SecretGenerator
@@ -96,3 +95,43 @@ func TestLoaderWithWorkingDir(t *testing.T) {
 		npLdr.Config().FnpLoadingOptions.WorkingDir,
 		"the plugin working dir is not updated")
 }
+
+func TestLoaderWithStorageMounts(t *testing.T) {
+	const storageMountTransformer = `
+apiVersion: com.example.kustomize/v1
+kind: Test
+metadata:
+  name: test-transformer
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: test
+        mounts:
+          - type: bind
+            src: ../
+            dst: /mount
+`
+	p := provider.NewDefaultDepProvider()
+	rmF := resmap.NewFactory(p.GetResourceFactory())
+	fsys := filesys.MakeFsInMemory()
+	fLdr, err := loader.NewLoader(
+		loader.RestrictionRootOnly,
+		filesys.Separator, fsys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configs, err := rmF.NewResMapFromBytes([]byte(storageMountTransformer))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := types.EnabledPluginConfig(types.BploLoadFromFileSys)
+	pLdr := NewLoader(c, rmF, fsys)
+	if pLdr == nil {
+		t.Fatal("expect non-nil loader")
+	}
+	_, err = pLdr.LoadTransformers(
+		fLdr, valtest_test.MakeFakeValidator(), configs)
+	if err == nil { // should fail because src specified is outside root
+		t.Fatal("the loader allowed a mount outside root")
+	}
+}

api/internal/target/kusttarget.go

@@ -29,13 +29,14 @@ import (
 
 // KustTarget encapsulates the entirety of a kustomization build.
 type KustTarget struct {
-	kustomization *types.Kustomization
-	kustFileName  string
-	ldr           ifc.Loader
-	validator     ifc.Validator
-	rFactory      *resmap.Factory
-	pLdr          *loader.Loader
-	origin        *resource.Origin
+	kustomization     *types.Kustomization
+	kustFileName      string
+	ldr               ifc.Loader
+	validator         ifc.Validator
+	rFactory          *resmap.Factory
+	pLdr              *loader.Loader
+	origin            *resource.Origin
+	helmRootNamespace string // namespace inherited from parent kustomization for HelmCharts
 }
 
 // NewKustTarget returns a new instance of KustTarget.
@@ -496,6 +497,16 @@ func (kt *KustTarget) accumulateDirectory(
 	}
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
 	subKt.origin = kt.origin
+	// Propagate namespace to child kustomization's helmRootNamespace for HelmCharts
+	// This ensures Helm charts in base kustomizations inherit namespace from overlays
+	// without affecting other transformers like patches
+	// Fixes https://github.com/kubernetes-sigs/kustomize/issues/6031
+	// Fixes https://github.com/kubernetes-sigs/kustomize/issues/6027
+	if kt.kustomization.Namespace != "" {
+		subKt.helmRootNamespace = kt.kustomization.Namespace
+	} else if kt.helmRootNamespace != "" {
+		subKt.helmRootNamespace = kt.helmRootNamespace
+	}
 	var bytes []byte
 	if openApiPath, exists := subKt.Kustomization().OpenAPI["path"]; exists {
 		bytes, err = ldr.Load(openApiPath)

api/internal/target/kusttarget_configplugin.go

@@ -166,6 +166,16 @@ var generatorConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		for _, chart := range kt.kustomization.HelmCharts {
 			c.HelmGlobals = globals
 			c.HelmChart = chart
+			// Pass kustomize namespace to helm
+			// Fixes https://github.com/kubernetes-sigs/kustomize/issues/5566
+			// Also propagate parent namespace for multi-level kustomization hierarchies
+			if c.HelmChart.Namespace == "" {
+				if kt.kustomization.Namespace != "" {
+					c.HelmChart.Namespace = kt.kustomization.Namespace
+				} else if kt.helmRootNamespace != "" {
+					c.HelmChart.Namespace = kt.helmRootNamespace
+				}
+			}
 			p := f()
 			if err = kt.configureBuiltinPlugin(p, c, bpt); err != nil {
 				return nil, err
@@ -250,10 +260,10 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			return
 		}
 		var c struct {
-			Path    string          `json:"path,omitempty" yaml:"path,omitempty"`
-			Patch   string          `json:"patch,omitempty" yaml:"patch,omitempty"`
-			Target  *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
-			Options map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+			Path    string           `json:"path,omitempty"    yaml:"path,omitempty"`
+			Patch   string           `json:"patch,omitempty"   yaml:"patch,omitempty"`
+			Target  *types.Selector  `json:"target,omitempty"  yaml:"target,omitempty"`
+			Options *types.PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
 		}
 		for _, pc := range kt.kustomization.Patches {
 			c.Target = pc.Target
@@ -305,6 +315,13 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 						return nil, errors.WrapPrefixf(err, "failed to merge template fieldSpec")
 					}
 				}
+				// merge spec/volumeClaimTemplates[]/metadata fieldSpecs if includeVolumeClaimTemplates flag is true
+				if label.IncludeVolumeClaimTemplates {
+					fss, err = fss.MergeAll(tc.VolumeClaimTemplateLabels)
+					if err != nil {
+						return nil, errors.WrapPrefixf(err, "failed to merge volumeClaimTemplate fieldSpec")
+					}
+				}
 				// only add to metadata by default
 				fss, err = fss.MergeOne(types.FieldSpec{Path: "metadata/labels", CreateIfNotPresent: true})
 			}

api/internal/target/kusttarget_test.go

@@ -300,6 +300,8 @@ metadata:
 		require.NoError(t, expected.Append(r), "failed to append resource: %v")
 	}
 	expected.RemoveBuildAnnotations()
+	require.NoError(t, expected.RemoveTransformerAnnotations())
+	require.NoError(t, expected.RemoveOriginAnnotations())
 	expYaml, err := expected.AsYaml()
 	require.NoError(t, err)
 
@@ -308,6 +310,8 @@ metadata:
 	actual, err := kt.MakeCustomizedResMap()
 	require.NoError(t, err)
 	actual.RemoveBuildAnnotations()
+	require.NoError(t, actual.RemoveTransformerAnnotations())
+	require.NoError(t, actual.RemoveOriginAnnotations())
 	actYaml, err := actual.AsYaml()
 	require.NoError(t, err)
 	assert.Equal(t, string(expYaml), string(actYaml))
@@ -411,6 +415,8 @@ metadata:
 		require.NoError(t, err)
 	}
 	expected.RemoveBuildAnnotations()
+	require.NoError(t, expected.RemoveTransformerAnnotations())
+	require.NoError(t, expected.RemoveOriginAnnotations())
 	expYaml, err := expected.AsYaml()
 	require.NoError(t, err)
 
@@ -419,6 +425,8 @@ metadata:
 	actual, err := kt.MakeCustomizedResMap()
 	require.NoError(t, err)
 	actual.RemoveBuildAnnotations()
+	require.NoError(t, actual.RemoveTransformerAnnotations())
+	require.NoError(t, actual.RemoveOriginAnnotations())
 	actYaml, err := actual.AsYaml()
 	require.NoError(t, err)
 	require.Equal(t, string(expYaml), string(actYaml))

api/konfig/general.go

@@ -46,4 +46,7 @@ const (
 
 	// Label key that indicates the resources are validated by a validator
 	ValidatedByLabelKey = "validated-by"
+
+	// Annotation key for marking helm-generated resources to skip namespace transformation
+	HelmGeneratedAnnotation = ConfigAnnoDomain + "/helm-generated"
 )

api/krusty/helmchartinflationgenerator_test.go

@@ -21,10 +21,31 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: test-minecraft
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
 type: Opaque
 ---
 apiVersion: v1
@@ -32,10 +53,14 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft
+  namespace: default
 spec:
   ports:
   - name: minecraft
@@ -150,7 +175,7 @@ func TestHelmChartInflationGeneratorOld(t *testing.T) {
 helmChartInflationGenerator:
 - chartName: minecraft
   chartRepoUrl: https://itzg.github.io/minecraft-server-charts
-  chartVersion: 3.1.3
+  chartVersion: 4.26.4
   releaseName: test
 `)
 
@@ -158,6 +183,54 @@ helmChartInflationGenerator:
 	th.AssertActualEqualsExpected(m, expectedHelm)
 }
 
+func TestHelmChartNamespacePropagation(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: the-bug
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    this-service-is-deployed-in-namespace: {{ .Release.Namespace }}
+`)
+	th.WriteF(filepath.Join(th.GetRoot(), "values.yaml"), ``)
+
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: the-actual-namespace
+helmCharts:
+  - name: service
+    releaseName: service
+    valuesFile: values.yaml
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    this-service-is-deployed-in-namespace: the-actual-namespace
+  name: the-bug
+  namespace: the-actual-namespace
+`)
+}
+
 func TestHelmChartInflationGenerator(t *testing.T) {
 	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
 	defer th.Reset()
@@ -169,7 +242,7 @@ func TestHelmChartInflationGenerator(t *testing.T) {
 helmCharts:
 - name: minecraft
   repo: https://itzg.github.io/minecraft-server-charts
-  version: 3.1.3
+  version: 4.26.4
   releaseName: test
 `)
 
@@ -252,7 +325,7 @@ func TestHelmChartProdVsDev(t *testing.T) {
 helmCharts:
 - name: minecraft
   repo: https://itzg.github.io/minecraft-server-charts
-  version: 3.1.3
+  version: 4.26.4
   releaseName: test
 `)
 	th.WriteK(dirProd, `
@@ -287,10 +360,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myProd-test-minecraft
+  name: myProd-test-minecraft-rcon
+  namespace: prod
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myProd-test-minecraft-curseforge
   namespace: prod
 type: Opaque
 ---
@@ -299,7 +392,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myProd-test-minecraft
@@ -325,10 +421,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myDev-test-minecraft
+  name: myDev-test-minecraft-rcon
+  namespace: dev
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myDev-test-minecraft-curseforge
   namespace: dev
 type: Opaque
 ---
@@ -337,7 +453,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myDev-test-minecraft
@@ -359,10 +478,30 @@ kind: Secret
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
-  name: myProd-test-minecraft
+  name: myProd-test-minecraft-rcon
+  namespace: prod
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test
+  name: myProd-test-minecraft-curseforge
   namespace: prod
 type: Opaque
 ---
@@ -371,7 +510,10 @@ kind: Service
 metadata:
   labels:
     app: test-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: myProd-test-minecraft
@@ -586,11 +728,11 @@ helmCharts:
     skipTests: true
   - name: minecraft
     repo: https://itzg.github.io/minecraft-server-charts
-    version: 3.1.3
+    version: 4.26.4
     releaseName: test-1
   - name: minecraft
     repo: https://itzg.github.io/minecraft-server-charts
-    version: 3.1.4
+    version: 4.26.4
     releaseName: test-2
 `)
 
@@ -621,10 +763,30 @@ kind: Secret
 metadata:
   labels:
     app: test-1-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test-1
-  name: test-1-minecraft
+  name: test-1-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-1-minecraft
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft-curseforge
   namespace: default
 type: Opaque
 ---
@@ -633,7 +795,10 @@ kind: Service
 metadata:
   labels:
     app: test-1-minecraft
-    chart: minecraft-3.1.3
+    app.kubernetes.io/instance: test-1-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test-1
   name: test-1-minecraft
@@ -655,10 +820,30 @@ kind: Secret
 metadata:
   labels:
     app: test-2-minecraft
-    chart: minecraft-3.1.4
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test-2
-  name: test-2-minecraft
+  name: test-2-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-2-minecraft
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft-curseforge
   namespace: default
 type: Opaque
 ---
@@ -667,7 +852,10 @@ kind: Service
 metadata:
   labels:
     app: test-2-minecraft
-    chart: minecraft-3.1.4
+    app.kubernetes.io/instance: test-2-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test-2
   name: test-2-minecraft
@@ -698,7 +886,7 @@ namespace: default
 helmCharts:
   - name: minecraft
     repo: https://itzg.github.io/minecraft-server-charts
-    version: 4.11.0
+    version: 4.26.4
     releaseName: test
     kubeVersion: "1.16"
     valuesInline:
@@ -724,8 +912,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-rcon
@@ -741,8 +929,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-curseforge
@@ -756,8 +944,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft
@@ -779,8 +967,8 @@ metadata:
     app: test-minecraft-map
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-map
@@ -794,7 +982,7 @@ namespace: default
 helmCharts:
   - name: minecraft
     repo: https://itzg.github.io/minecraft-server-charts
-    version: 4.11.0
+    version: 4.26.4
     releaseName: test
     kubeVersion: "1.27"
     valuesInline:
@@ -820,8 +1008,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-rcon
@@ -837,8 +1025,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-curseforge
@@ -852,8 +1040,8 @@ metadata:
     app: test-minecraft
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft
@@ -875,8 +1063,8 @@ metadata:
     app: test-minecraft-map
     app.kubernetes.io/instance: test-minecraft
     app.kubernetes.io/name: minecraft
-    app.kubernetes.io/version: 4.11.0
-    chart: minecraft-4.11.0
+    app.kubernetes.io/version: 4.26.4
+    chart: minecraft-4.26.4
     heritage: Helm
     release: test
   name: test-minecraft-map
@@ -886,6 +1074,229 @@ spec:
 `)
 }
 
+func TestHelmChartNamespacePropagationViaResources(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	// Create base directory with helm chart
+	baseDir := th.MkDir("base")
+	chartDir := filepath.Join(baseDir, "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    deployed-in-namespace: {{ .Release.Namespace }}
+`)
+
+	// Base kustomization with helmCharts
+	th.WriteK(baseDir, `
+helmGlobals:
+  chartHome: ./charts
+helmCharts:
+  - name: service
+    releaseName: service
+`)
+
+	// Overlay that references base via resources and sets namespace
+	overlayDir := th.MkDir("overlay")
+	th.WriteK(overlayDir, `
+namespace: production
+resources:
+  - ../base
+`)
+
+	m := th.Run(overlayDir, th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    deployed-in-namespace: production
+  name: test-service
+  namespace: production
+`)
+}
+
+func TestHelmChartDifferentNamespaces(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm-namespace: {{ .Release.Namespace }}
+`)
+
+	// Test with different namespaces in transformer vs helmCharts.namespace
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: transformer-ns
+helmCharts:
+  - name: service
+    releaseName: service
+    namespace: helm-ns
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	// helmCharts.namespace should take precedence
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    helm-namespace: helm-ns
+  name: test-service
+  namespace: helm-ns
+`)
+}
+
+func TestHelmChartSameNamespace(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	chartDir := filepath.Join(th.GetRoot(), "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    deployed-namespace: {{ .Release.Namespace }}
+`)
+
+	// Test with same namespace in both places
+	th.WriteK(th.GetRoot(), `
+helmGlobals:
+  chartHome: ./charts
+namespace: shared-namespace
+helmCharts:
+  - name: service
+    releaseName: service
+    namespace: shared-namespace
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    deployed-namespace: shared-namespace
+  name: test-service
+  namespace: shared-namespace
+`)
+}
+
+// Regression test: verify that HelmCharts in base kustomizations
+// still receive namespace from overlay after fixing namespace propagation issues.
+// This test ensures the fix for https://github.com/kubernetes-sigs/kustomize/issues/6031
+// and https://github.com/kubernetes-sigs/kustomize/issues/6027
+// does not break the HelmChart namespace propagation feature from
+// https://github.com/kubernetes-sigs/kustomize/issues/5566
+func TestHelmChartNamespacePropagationViaResourcesThreeLevels(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	// Create base directory with helm chart (Level 1)
+	baseDir := th.MkDir("base")
+	chartDir := filepath.Join(baseDir, "charts", "service")
+	require.NoError(t, th.GetFSys().MkdirAll(filepath.Join(chartDir, "templates")))
+	th.WriteF(filepath.Join(chartDir, "Chart.yaml"), `
+apiVersion: v2
+name: service
+type: application
+version: 1.0.0
+`)
+	th.WriteF(filepath.Join(chartDir, "values.yaml"), ``)
+	th.WriteF(filepath.Join(chartDir, "templates", "service.yaml"), `
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm-namespace: {{ .Release.Namespace }}
+`)
+
+	// Base kustomization with helmCharts (no namespace)
+	th.WriteK(baseDir, `
+helmGlobals:
+  chartHome: ./charts
+helmCharts:
+  - name: service
+    releaseName: service
+`)
+
+	// Mid-layer that references base via resources (no namespace) (Level 2)
+	midDir := th.MkDir("mid")
+	th.WriteK(midDir, `
+namePrefix: mid-
+resources:
+  - ../base
+`)
+
+	// Top overlay that references mid-layer and sets namespace (Level 3)
+	overlayDir := th.MkDir("overlay")
+	th.WriteK(overlayDir, `
+namespace: production
+resources:
+  - ../mid
+`)
+
+	m := th.Run(overlayDir, th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    helm-namespace: production
+  name: mid-test-service
+  namespace: production
+`)
+}
+
 func copyValuesFilesTestChartsIntoHarness(t *testing.T, th *kusttest_test.HarnessEnhanced) {
 	t.Helper()
 

api/krusty/inlinelabels_test.go

@@ -419,6 +419,389 @@ spec:
 `)
 }
 
+func TestKustomizationLabelsInStatefulSetTemplateWithClaimTemplateAndIncludeVolumeClaimTemplatesFalse(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/sts.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+	th.WriteK("/app", `
+resources:
+- sts.yaml
+
+labels:
+- pairs:
+    foo: bar
+  includeSelectors: false
+  includeTemplates: true
+  includeVolumeClaimTemplates: false
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+    foo: bar
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+        foo: bar
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+}
+
+func TestKustomizationLabelsInStatefulSetTemplateWithClaimTemplateIncludeTemplateFalseAndIncludeVolumeClaimTemplatesTrue(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/sts.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+	th.WriteK("/app", `
+resources:
+- sts.yaml
+
+labels:
+- pairs:
+    foo: bar
+  includeSelectors: false
+  includeTemplates: false
+  includeVolumeClaimTemplates: true
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+    foo: bar
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        foo: bar
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+}
+
+func TestKustomizationLabelsInStatefulSetTemplateWithClaimTemplateAndIncludeVolumeClaimTemplatesTrue(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/sts.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+	th.WriteK("/app", `
+resources:
+- sts.yaml
+
+labels:
+- pairs:
+    foo: bar
+  includeSelectors: false
+  includeTemplates: true
+  includeVolumeClaimTemplates: true
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+    foo: bar
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+        foo: bar
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        foo: bar
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+}
+
+func TestKustomizationLabelsInStatefulSetTemplateWithIncludeSelectorsTrue(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/sts.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+	th.WriteK("/app", `
+resources:
+- sts.yaml
+
+labels:
+- pairs:
+    foo: bar
+  includeSelectors: true
+  includeTemplates: false
+  includeVolumeClaimTemplates: false
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: set
+    foo: bar
+  name: set
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: set
+      foo: bar
+  serviceName: set
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: set
+        foo: bar
+    volumeMounts:
+    - mountPath: /usr/src/app/data
+      name: usrdata
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        foo: bar
+      name: usrdata
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+`)
+}
+
+func TestKustomizationLabelsInDeploymentWithoutClaimTemplateAndIncludeVolumeClaimTemplatesTrue(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  labels:
+    app: test-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test-server
+  template:
+    metadata:
+      labels:
+        app: test-server
+    spec:
+      containers:
+      - name: test-server
+        image: test-server
+`)
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+
+labels:
+- pairs:
+    app.kubernetes.io/component: a
+    app.kubernetes.io/instance: b
+    app.kubernetes.io/name: c
+    app.kubernetes.io/part-of: d
+  includeSelectors: false
+  includeTemplates: false
+  includeVolumeClaimTemplates: true
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: test-server
+    app.kubernetes.io/component: a
+    app.kubernetes.io/instance: b
+    app.kubernetes.io/name: c
+    app.kubernetes.io/part-of: d
+  name: deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test-server
+  template:
+    metadata:
+      labels:
+        app: test-server
+    spec:
+      containers:
+      - image: test-server
+        name: test-server
+`)
+}
+
 func TestKustomizationLabelsInCronJobTemplate(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteF("app/cjob.yaml", `

api/krusty/multiplepatch_test.go

@@ -4,6 +4,7 @@
 package krusty_test
 
 import (
+	"strings"
 	"testing"
 
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -1282,6 +1283,72 @@ metadata:
 	}
 }
 
+func TestSinglePatchWithMultiplePatchDeleteDirectives(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	makeCommonFilesForMultiplePatchTests(th)
+	th.WriteF("overlay/staging/deployment-patch1.yaml", `
+$patch: delete
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+---
+$patch: delete
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+`)
+	th.WriteF("overlay/staging/deployment-patch2.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configmap-in-base
+data:
+  foo2: bar2
+`)
+	th.WriteK("overlay/staging", `
+namePrefix: staging-
+commonLabels:
+  env: staging
+patches:
+  - path: deployment-patch1.yaml
+  - path: deployment-patch2.yaml
+resources:
+  - ../../base
+configMapGenerator:
+- name: configmap-in-overlay
+  literals:
+  - hello=world
+`)
+	m := th.Run("overlay/staging", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  foo: bar
+  foo2: bar2
+kind: ConfigMap
+metadata:
+  annotations:
+    note: This is a test annotation
+  labels:
+    app: mynginx
+    env: staging
+    org: example.com
+    team: foo
+  name: staging-team-foo-configmap-in-base-8cmgkm9f44
+---
+apiVersion: v1
+data:
+  hello: world
+kind: ConfigMap
+metadata:
+  labels:
+    env: staging
+  name: staging-configmap-in-overlay-dc6fm46dhm
+`)
+}
+
 func TestMultiplePatchesBothWithPatchDeleteDirective(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	makeCommonFilesForMultiplePatchTests(th)
@@ -1700,3 +1767,108 @@ metadata:
   name: fluentd-sa-abc
 `)
 }
+
+// TestEmptyPatchFilesShouldBeIgnored verifies that empty patch files are ignored.
+// Tests three cases:
+// 1. Completely empty file
+// 2. File with only comments
+// 3. File with whitespace and comments
+func TestEmptyPatchFilesShouldBeIgnored(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Write a basic resource
+	th.WriteF("deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+`)
+
+	// Create empty patch files of different types
+	th.WriteF("empty.yaml", ``)
+	th.WriteF("comments-only.yaml", `
+# This is a comment
+# Another comment
+`)
+	th.WriteF("whitespace.yaml", `
+
+# Comments with whitespace
+
+  # Indented comment
+
+`)
+
+	// Reference empty patches in kustomization
+	th.WriteK(".", `
+resources:
+- deployment.yaml
+patches:
+- path: empty.yaml
+- path: comments-only.yaml
+- path: whitespace.yaml
+`)
+
+	// Empty patches should be ignored, output should be unchanged
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`)
+}
+
+// TestEmptyPatchesStrategicMergeFails verifies that empty patch files are
+// handled correctly with the deprecated patchesStrategicMerge field
+func TestEmptyPatchesStrategicMergeFails(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Create a basic resource
+	th.WriteF("resource.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dummy
+data:
+  dummy: value
+`)
+
+	// Create an empty patch file
+	th.WriteF("empty-patch.yaml", ``)
+
+	// Create a patch file with only comments
+	th.WriteF("comments-patch.yaml", `
+# This is just a comment
+# Another comment
+`)
+
+	// Create kustomization using patchesStrategicMerge
+	th.WriteK(".", `
+resources:
+- resource.yaml
+patchesStrategicMerge:
+- empty-patch.yaml
+- comments-patch.yaml
+`)
+
+	// This fails with message
+	err := th.RunWithErr(".", th.MakeDefaultOptions())
+	if err == nil {
+		t.Fatalf("expected error for empty patchesStrategicMerge files but got none")
+	}
+	if !strings.Contains(err.Error(), "patch appears to be empty") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

api/krusty/namespacepropagation_test.go

@@ -0,0 +1,343 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/6031
+// This test verifies that namespace propagation from overlay to base does not
+// break strategic merge patches when combined with nameSuffix.
+//
+// The issue: In v5.8.0, namespace was propagated to child kustomization early,
+// causing patches to fail because they couldn't find resources with the
+// propagated namespace.
+func TestNamespacePropagationDoesNotBreakPatchWithNameSuffix(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base kustomization with nameSuffix
+	th.WriteK("base", `
+resources:
+  - configmap.yaml
+
+nameSuffix: -schedule_job_1
+`)
+
+	th.WriteF("base/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hoge
+data:
+  configs.yaml: TO_BE_SPECIFIED
+`)
+
+	// Overlay with namespace and patch
+	// The patch targets the original name (before nameSuffix is applied)
+	// This is the expected behavior per kustomize documentation
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+patches:
+  - path: schedule_job_1.yaml
+
+namespace: hoge-dev
+`)
+
+	th.WriteF("overlay/schedule_job_1.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hoge-schedule_job_1
+data:
+  configs.yaml: |
+    case_configs:
+      - id: 1
+        name: dummy1
+        client: client1
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  configs.yaml: |
+    case_configs:
+      - id: 1
+        name: dummy1
+        client: client1
+kind: ConfigMap
+metadata:
+  name: hoge-schedule_job_1
+  namespace: hoge-dev
+`)
+}
+
+// Regression test for https://github.com/kubernetes-sigs/kustomize/issues/6027
+// This test verifies that namespace propagation does not break
+// configMapGenerator merge behavior when the generator is in a base
+// and the namespace is set in an overlay.
+//
+// The issue: In v5.8.0, namespace was propagated to child kustomization early,
+// causing generator merge to fail because resources in the base didn't have
+// namespace yet, but the overlay's generator had namespace from propagation.
+func TestNamespacePropagationDoesNotBreakGeneratorMerge(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Generator config resource
+	th.WriteK("cm-generator", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- resources/general.yaml
+`)
+
+	th.WriteF("cm-generator/resources/general.yaml", `
+apiVersion: builtin
+kind: ConfigMapGenerator
+
+metadata:
+  name: general-environment
+
+behavior: merge
+
+envs:
+- configuration/general
+`)
+
+	th.WriteF("cm-generator/configuration/general", `
+COMMON_ENV=common
+`)
+
+	// Base kustomization with generator
+	th.WriteK("base", `
+generators:
+- ../cm-generator
+
+configMapGenerator:
+- name: general-environment
+  behavior: create
+`)
+
+	th.WriteF("base/configuration/general", `
+BASE_LAYER_ENV=base
+`)
+
+	// Overlay with namespace and same generator reference
+	th.WriteK("overlay", `
+namespace: abc
+
+generators:
+- ../cm-generator
+
+resources:
+- ../base
+`)
+
+	th.WriteF("overlay/configuration/general", `
+OVERLAY_ENV=overlay
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  BASE_LAYER_ENV: base
+  OVERLAY_ENV: overlay
+kind: ConfigMap
+metadata:
+  name: general-environment-826bch2dh9
+  namespace: abc
+`)
+}
+
+// Test to verify namespace propagation still works correctly for
+// simple overlay/base scenarios without patches or generators.
+func TestNamespaceTransformerInOverlayAppliedToBase(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base kustomization without namespace
+	th.WriteK("base", `
+resources:
+  - deployment.yaml
+`)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: app
+        image: my-image:latest
+`)
+
+	// Overlay with namespace
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+namespace: production
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  namespace: production
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - image: my-image:latest
+        name: app
+`)
+}
+
+// Test for three-level kustomization hierarchy with namespace in top overlay
+// This verifies namespace transformer is applied correctly across multiple levels.
+func TestNamespaceTransformerWithThreeLevelHierarchy(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Level 1: Base
+	th.WriteK("base", `
+resources:
+  - configmap.yaml
+`)
+
+	th.WriteF("base/configmap.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: base-config
+data:
+  key: value
+`)
+
+	// Level 2: Mid-layer (no namespace)
+	th.WriteK("mid", `
+resources:
+  - ../base
+
+namePrefix: mid-
+`)
+
+	// Level 3: Overlay with namespace
+	th.WriteK("overlay", `
+resources:
+  - ../mid
+
+namespace: top-ns
+namePrefix: top-
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  key: value
+kind: ConfigMap
+metadata:
+  name: top-mid-base-config
+  namespace: top-ns
+`)
+}
+
+// Test that patches in overlay can target resources from base
+// when base has nameSuffix and overlay has namespace.
+// This is a more complex version of TestNamespacePropagationDoesNotBreakPatchWithNameSuffix
+func TestPatchTargetingWithNameSuffixAndNamespace(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	// Base with nameSuffix
+	th.WriteK("base", `
+resources:
+  - deployment.yaml
+
+nameSuffix: -v2
+`)
+
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+      - name: app
+        image: myimage:v1
+`)
+
+	// Overlay with namespace and patch
+	th.WriteK("overlay", `
+resources:
+  - ../base
+
+namespace: production
+
+patches:
+  - target:
+      kind: Deployment
+      name: myapp-v2
+    patch: |
+      - op: replace
+        path: /spec/replicas
+        value: 3
+`)
+
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp-v2
+  namespace: production
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+      - image: myimage:v1
+        name: app
+`)
+}

api/krusty/namespaces_test.go

@@ -692,7 +692,6 @@ resources:
 	th.AssertActualEqualsExpected(m, namespaceNeedInVarExpectedOutput)
 }
 
-//nolint:gosec
 const namespaceNeedInVarMyAppWithNamespace string = `
 resources:
 - elasticsearch-dev-service.yaml

api/krusty/no_list_items_test.go

@@ -0,0 +1,228 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// test for https://github.com/kubernetes-sigs/kustomize/issues/4240
+func TestSuffix5042(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+`)
+
+	th.WriteF("resource.yaml", `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceTwo
+metadata:
+  name: test
+rules: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceTwo
+metadata:
+  name: test
+rules: []
+`)
+}
+
+func TestListSuffix5042(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+`)
+
+	th.WriteF("resource.yaml", `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceList
+metadata:
+  name: test
+rules: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: example.com/v1alpha1
+kind: MyResource
+metadata:
+  name: service
+---
+apiVersion: example.com/v1alpha1
+kind: MyResourceList
+metadata:
+  name: test
+rules: []
+`)
+}
+
+func TestListSuffix5485(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- resource.yaml
+  `)
+
+	th.WriteF("resource.yaml", `
+apiVersion: infra.protonbase.io/v1alpha1
+kind: AccessWhiteList
+metadata:
+  name: wlmls5769f
+  namespace: dc7i4hyxzw
+spec:
+  rules:
+  - sourceIps: 0.0.0.0/16
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: infra.protonbase.io/v1alpha1
+kind: AccessWhiteList
+metadata:
+  name: wlmls5769f
+  namespace: dc7i4hyxzw
+spec:
+  rules:
+  - sourceIps: 0.0.0.0/16
+`)
+}
+
+func TestListToIndividualResources(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- list.yaml
+`)
+
+	th.WriteF("list.yaml", `
+apiVersion: v1
+kind: PodList
+items:
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-1
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-2
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+  - apiVersion: v1
+    kind: Pod
+    metadata:
+      name: my-pod-3
+      namespace: default
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:1.19.10
+          ports:
+            - containerPort: 80
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-1
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-2
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: my-app
+  name: my-pod-3
+  namespace: default
+spec:
+  containers:
+  - image: nginx:1.19.10
+    name: my-container
+    ports:
+    - containerPort: 80
+`)
+}
+
+// Empty list should result in no resources
+func TestEmptyList(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- emptyList.yaml
+`)
+	th.WriteF("emptyList.yaml", `
+apiVersion: v1
+kind: PodList
+items: []
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, "")
+}

api/krusty/remoteloader_test.go

@@ -282,6 +282,8 @@ resources:
 		},
 	}
 
+	t.Setenv("LC_ALL", "C")
+
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			if test.skip {

api/krusty/replacementtransformer_test.go

@@ -614,3 +614,391 @@ metadata:
   name: app-config-dev-97544dk6t8
 `)
 }
+
+// regex selector: append in annotation by visitor name
+func TestReplacementTransformerAppendToAnnotationUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app1.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteF("base/app2.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+        - image: app2:1.0
+          name: app
+`)
+	th.WriteF("base/cm1.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm1
+`)
+	th.WriteF("base/cm2.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm2
+`)
+	th.WriteF("base/pg1.yaml", `
+apiVersion: apps/v1
+kind: postgresql
+metadata:
+  name: pg1
+`)
+	th.WriteK("base", `
+resources:
+- app1.yaml
+- app2.yaml
+- cm1.yaml
+- cm2.yaml
+- pg1.yaml
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: cm1
+    targets:
+      - reject:
+          - kind: ConfigMap
+            name: c.1
+        select:
+          kind: Deployment|ConfigMap|postgresql
+        fieldPaths:
+          - metadata.annotations.visitedby
+        options:
+          index: -1
+          delimiter: ","
+          create: true
+  - source:
+      kind: ConfigMap
+      name: cm2
+    targets:
+      - reject:
+          - kind: ConfigMap
+            name: .*2
+        select:
+          kind: Deployment|ConfigMap|postgresql
+        fieldPaths:
+          - metadata.annotations.visitedby
+        options:
+          index: -1
+          delimiter: ","
+          create: true
+`)
+	m := th.Run("base", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+      - image: app2:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  annotations:
+    visitedby: cm2,
+  name: cm1
+---
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  annotations:
+    visitedby: cm1,
+  name: cm2
+---
+apiVersion: apps/v1
+kind: postgresql
+metadata:
+  annotations:
+    visitedby: cm2,cm1,
+  name: pg1
+`)
+}
+
+// selector regex: construct service url
+func TestReplacementTransformerServiceNamespaceUrlUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/d1.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "d1.app1"
+`)
+	th.WriteF("base/d2.yaml", `
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "d2.app1"
+`)
+	th.WriteF("base/sts1.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sts1
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+          env:
+            - name: APP1_SERVICE
+              value: "app1"
+`)
+	th.WriteF("base/cm1.yaml", `
+apiVersion: apps/v1
+kind: ConfigMap
+metadata:
+  name: cm1
+data:
+  APP1_SERVICE_PORT: "8080"
+`)
+	th.WriteF("base/svc1.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: svc1-namespace
+spec:
+  selector:
+    app.kubernetes.io/name: app1
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9376
+
+`)
+	th.WriteK("base", `
+resources:
+- d1.yaml
+- d2.yaml
+- sts1.yaml
+- cm1.yaml
+- svc1.yaml
+
+replacements:
+  - source:
+      kind: Service
+      name: svc1
+      fieldPath: metadata.namespace
+    targets:
+      - select:
+          kind: Deployment|.*Set
+        fieldPaths:
+          - spec.template.spec.containers.*.env.[name=APP1_SERVICE].value
+        options:
+          index: 99
+          delimiter: "."
+  - source:
+      kind: ConfigMap
+      name: cm1
+      fieldPath: data.APP1_SERVICE_PORT
+    targets:
+      - select:
+          kind: Deployment|.*Set
+        fieldPaths:
+          - spec.template.spec.containers.*.env.[name=APP1_SERVICE].value
+        options:
+          index: 99
+          delimiter: ":"
+`)
+	m := th.Run("base", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d1
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: d1.app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: d2
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: d2.app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sts1
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: APP1_SERVICE
+          value: app1.svc1-namespace:8080
+        image: app1:1.0
+        name: app
+---
+apiVersion: apps/v1
+data:
+  APP1_SERVICE_PORT: "8080"
+kind: ConfigMap
+metadata:
+  name: cm1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: svc1-namespace
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 9376
+  selector:
+    app.kubernetes.io/name: app1
+`)
+}
+
+func TestReplacementTransformerWithSuffixTransformerAndRejectUsingRegex(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteK("base", `
+resources:
+  - app.yaml
+`)
+	th.WriteK("overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+nameSuffix: -dev
+namePrefix: pre-
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: app-config
+    literals:
+      - name=something-else
+
+replacements:
+- source:
+    kind: ConfigMap
+    name: app-config
+    fieldPath: data.name
+  targets:
+    - reject:
+        - name: .*original.*
+      select:
+        kind: Deployment
+      fieldPaths:
+        - spec.template.spec.containers.0.name
+    - select:
+        kind: ConfigMap
+        name: app-config
+      fieldPaths:
+        - data.name-copy
+      options:
+        create: true
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pre-original-name-dev
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: app
+---
+apiVersion: v1
+data:
+  name: something-else
+  name-copy: something-else
+kind: ConfigMap
+metadata:
+  name: pre-app-config-dev-7266b7f2m9
+`)
+}

api/provenance/provenance.go

@@ -19,12 +19,21 @@ var (
 	// During a release, this will be set to the release tag, e.g. "kustomize/v4.5.7"
 	version = developmentVersion
 	// build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')
-	buildDate = "unknown"
+	buildDate = unknown
 )
 
-// This default value, (devel), matches
-// the value debug.BuildInfo uses for an unset main module version.
-const developmentVersion = "(devel)"
+const (
+	// This default value, (devel), matches
+	// the value debug.BuildInfo uses for an unset main module version.
+	developmentVersion = "(devel)"
+
+	// ModulePath is kustomize module path, defined in kustomize/go.mod
+	ModulePath = "sigs.k8s.io/kustomize/kustomize/v5"
+
+	// This is default value, unknown, substituted when
+	// the value can't be determined from debug.BuildInfo.
+	unknown = "unknown"
+)
 
 // Provenance holds information about the build of an executable.
 type Provenance struct {
@@ -47,7 +56,7 @@ func GetProvenance() Provenance {
 	p := Provenance{
 		BuildDate: buildDate,
 		Version:   version,
-		GitCommit: "unknown",
+		GitCommit: unknown,
 		GoOs:      runtime.GOOS,
 		GoArch:    runtime.GOARCH,
 		GoVersion: runtime.Version(),
@@ -62,12 +71,20 @@ func GetProvenance() Provenance {
 		// We could consider adding other info such as the commit date in the future.
 		if setting.Key == "vcs.revision" {
 			p.GitCommit = setting.Value
+			break
 		}
 	}
+	p.Version = FindVersion(info, p.Version)
 
+	return p
+}
+
+// FindVersion searches for a version in the depth of dependencies including replacements,
+// otherwise, it tries to get version from debug.BuildInfo Main.
+func FindVersion(info *debug.BuildInfo, version string) string {
 	for _, dep := range info.Deps {
-		if dep != nil && dep.Path == "sigs.k8s.io/kustomize/kustomize/v5" {
-			if dep.Version != "devel" {
+		if dep != nil && dep.Path == ModulePath {
+			if dep.Version == developmentVersion {
 				continue
 			}
 			v, err := GetMostRecentTag(*dep)
@@ -75,11 +92,16 @@ func GetProvenance() Provenance {
 				fmt.Printf("failed to get most recent tag for %s: %v\n", dep.Path, err)
 				continue
 			}
-			p.Version = v
+
+			return v
 		}
 	}
 
-	return p
+	if version == developmentVersion && info.Main.Version != "" {
+		return info.Main.Version
+	}
+
+	return version
 }
 
 func GetMostRecentTag(m debug.Module) (string, error) {

api/provenance/provenance_test.go

@@ -49,12 +49,60 @@ func TestProvenance_Semver(t *testing.T) {
 
 func mockModule(version string) debug.Module {
 	return debug.Module{
-		Path:    "sigs.k8s.io/kustomize/kustomize/v5",
+		Path:    provenance.ModulePath,
 		Version: version,
 		Replace: nil,
 	}
 }
 
+func mockBuildInfo(mainVersion, depsVersion string) *debug.BuildInfo {
+	module := mockModule(depsVersion)
+
+	return &debug.BuildInfo{
+		Main: debug.Module{
+			Version: mainVersion,
+		},
+		Deps: []*debug.Module{
+			&module,
+		},
+	}
+}
+
+func TestFindVersion(t *testing.T) {
+	tests := []struct {
+		name            string
+		version         string
+		buildInfo       *debug.BuildInfo
+		expectedVersion string
+	}{
+		{
+			name:            "The version from LD_FLAGS is not overridden by main and dependencies versions",
+			version:         "v2.3.4",
+			buildInfo:       mockBuildInfo("v1.2.3", "(devel)"),
+			expectedVersion: "v2.3.4",
+		},
+		{
+			name:            "The version from LD_FLAGS is overridden by the main version",
+			version:         "(devel)",
+			buildInfo:       mockBuildInfo("v1.2.3", "(devel)"),
+			expectedVersion: "v1.2.3",
+		},
+		{
+			name:            "The version from LD_FLAGS is overridden by the version from dependencies",
+			version:         "(devel)",
+			buildInfo:       mockBuildInfo("v1.2.3", "v1.2.3-0.20210101010101-abcdefabcdef"),
+			expectedVersion: "v1.2.2",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			version := provenance.FindVersion(tt.buildInfo, tt.version)
+			assert.Equal(t, tt.expectedVersion, version)
+		})
+	}
+}
+
 func TestGetMostRecentTag(t *testing.T) {
 	tests := []struct {
 		name        string

api/resmap/reswrangler.go

@@ -181,6 +181,10 @@ func (m *resWrangler) GetMatchingResourcesByAnyId(
 	matches IdMatcher) []*resource.Resource {
 	var result []*resource.Resource
 	for _, r := range m.rList {
+		if r.RNode.IsNilOrEmpty() {
+			continue
+		}
+
 		for _, id := range append(r.PrevIds(), r.CurId()) {
 			if matches(id) {
 				result = append(result, r)
@@ -593,7 +597,7 @@ func (m *resWrangler) appendReplaceOrMerge(res *resource.Resource) error {
 
 		default:
 			return fmt.Errorf(
-				"id %#v exists; behavior must be merge or replace", id)
+				"id %#v exists; can not use behavior: '%s', behavior must be merge or replace", id, res.Behavior())
 		}
 		i, err := m.Replace(res)
 		if err != nil {

api/resource/factory.go

@@ -202,7 +202,10 @@ func (rf *Factory) inlineAnyEmbeddedLists(
 		}
 		items, ok := m["items"]
 		if !ok {
-			// treat as an empty list
+			// Items field is not present.
+			// This is not a collections resource.
+			// read more https://kubernetes.io/docs/reference/using-api/api-concepts/#collections
+			result = append(result, n0)
 			continue
 		}
 		slice, ok := items.([]interface{})

api/resource/factory_test.go

@@ -301,6 +301,17 @@ kind: List
 		t.Fatalf("failed to create new instance with %v: %v", deploymentB, errB)
 	}
 
+	deploymentNoItems := "deployment-no-items"
+	testDeploymentNoItems, errNoItems := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "List",
+		},
+	)
+	if errNoItems != nil {
+		t.Fatalf("failed to create new instance with %v: %v", deploymentNoItems, testDeploymentNoItems)
+	}
+
 	fSys := filesys.MakeFsInMemory()
 	fSys.WriteFile(string(patchGood1), []byte(patch1))
 	fSys.WriteFile(string(patchGood2), []byte(patch2))
@@ -363,7 +374,7 @@ kind: List
 		},
 		"listWithNoItems": {
 			input:       []types.PatchStrategicMerge{patchList4},
-			expectedOut: []*Resource{},
+			expectedOut: []*Resource{testDeploymentNoItems},
 			expectedErr: false,
 		},
 	}

api/resource/resource.go

@@ -11,6 +11,7 @@ import (
 	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/utils"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
@@ -47,6 +48,8 @@ var BuildAnnotations = []string{
 	kioutil.LegacyPathAnnotation,
 	kioutil.LegacyIndexAnnotation,
 	kioutil.LegacyIdAnnotation,
+
+	konfig.HelmGeneratedAnnotation,
 }
 
 func (r *Resource) ResetRNode(incoming *Resource) {

api/resource/resource_test.go

@@ -36,7 +36,6 @@ func createTestConfigMap() (*Resource, error) {
 	return res, nil
 }
 
-//nolint:gosec
 const configMapAsString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
 
 func createTestDeployment() (*Resource, error) {

api/types/helmchartargs.go

@@ -96,6 +96,12 @@ type HelmChart struct {
 
 	// SkipTests skips tests from templated output.
 	SkipTests bool `json:"skipTests,omitempty" yaml:"skipTests,omitempty"`
+
+	// debug enables debug output from the Helm chart inflator generator.
+	Debug bool `json:"debug,omitempty" yaml:"debug,omitempty"`
+
+	// allow for devel release to be used.
+	Devel bool `json:"devel,omitempty" yaml:"devel,omitempty"`
 }
 
 // HelmChartArgs contains arguments to helm.
@@ -188,5 +194,11 @@ func (h HelmChart) AsHelmArgs(absChartHome string) []string {
 	if h.SkipHooks {
 		args = append(args, "--no-hooks")
 	}
+	if h.Debug {
+		args = append(args, "--debug")
+	}
+	if h.Devel {
+		args = append(args, "--devel")
+	}
 	return args
 }

api/types/helmchartargs_test.go

@@ -60,4 +60,45 @@ func TestAsHelmArgs(t *testing.T) {
 				"-f", "values1", "-f", "values2",
 				"--api-versions", "foo", "--api-versions", "bar"})
 	})
+
+	t.Run("use helm-debug", func(t *testing.T) {
+		p := types.HelmChart{
+			Name:                  "chart-name",
+			Version:               "1.0.0",
+			Repo:                  "https://helm.releases.hashicorp.com",
+			ValuesFile:            "values",
+			AdditionalValuesFiles: []string{"values1", "values2"},
+			Debug:                 true,
+		}
+		require.Equal(t, p.AsHelmArgs("/home/charts"),
+			[]string{"template", "--generate-name", "/home/charts/chart-name",
+				"-f", "values",
+				"-f", "values1",
+				"-f", "values2",
+				"--debug"})
+	})
+
+	t.Run("use helm-devel", func(t *testing.T) {
+		// We first test that the devel flag is only appended when specified
+		p := types.HelmChart{
+			Name:                  "chart-name",
+			Version:               "1.0.0",
+			Repo:                  "https://helm.releases.hashicorp.com",
+			ValuesFile:            "values",
+			AdditionalValuesFiles: []string{"values1", "values2"},
+		}
+		require.Equal(t, p.AsHelmArgs("/home/charts"),
+			[]string{"template", "--generate-name", "/home/charts/chart-name",
+				"-f", "values",
+				"-f", "values1",
+				"-f", "values2"})
+
+		p.Devel = true
+		require.Equal(t, p.AsHelmArgs("/home/charts"),
+			[]string{"template", "--generate-name", "/home/charts/chart-name",
+				"-f", "values",
+				"-f", "values1",
+				"-f", "values2",
+				"--devel"})
+	})
 }

api/types/kustomization.go

@@ -22,6 +22,7 @@ const (
 	MetadataNamespacePath       = "metadata/namespace"
 	MetadataNamespaceApiVersion = "v1"
 	MetadataNamePath            = "metadata/name"
+	NamespaceKind               = "Namespace"
 
 	OriginAnnotations      = "originAnnotations"
 	TransformerAnnotations = "transformerAnnotations"

api/types/labels.go

@@ -15,8 +15,13 @@ type Label struct {
 	// spec/template/metadata fieldSpec. Custom fieldSpecs specified by
 	// FieldSpecs will be merged with spec/template/metadata fieldSpec if this
 	// is true. If IncludeSelectors is true, IncludeTemplates is not needed.
-	IncludeTemplates bool        `json:"includeTemplates,omitempty" yaml:"includeTemplates,omitempty"`
-	FieldSpecs       []FieldSpec `json:"fields,omitempty" yaml:"fields,omitempty"`
+	IncludeTemplates bool `json:"includeTemplates,omitempty" yaml:"includeTemplates,omitempty"`
+	// IncludeVolumeClaimTemplates indicates whether the transformer should include the
+	// spec/volumeClaimTemplates[]/metadata fieldSpec. Custom fieldSpecs specified by
+	// FieldSpecs will be merged with spec/volumeClaimTemplates[]/metadata fieldSpec if this
+	// is true. If IncludeSelectors is true, IncludeVolumeClaimTemplates is not needed.
+	IncludeVolumeClaimTemplates bool        `json:"includeVolumeClaimTemplates,omitempty" yaml:"includeVolumeClaimTemplates,omitempty"`
+	FieldSpecs                  []FieldSpec `json:"fields,omitempty"                      yaml:"fields,omitempty"`
 }
 
 func labelFromCommonLabels(commonLabels map[string]string) *Label {

api/types/patch.go

@@ -3,8 +3,6 @@
 
 package types
 
-import "reflect"
-
 // Patch represent either a Strategic Merge Patch or a JSON patch
 // and its targets.
 // The content of the patch can either be from a file
@@ -20,15 +18,17 @@ type Patch struct {
 	Target *Selector `json:"target,omitempty" yaml:"target,omitempty"`
 
 	// Options is a list of options for the patch
-	Options map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+	Options *PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
 }
 
 // Equals return true if p equals o.
 func (p *Patch) Equals(o Patch) bool {
 	targetEqual := (p.Target == o.Target) ||
 		(p.Target != nil && o.Target != nil && *p.Target == *o.Target)
+	optionsEqual := (p.Options == o.Options) ||
+		(p.Options != nil && o.Options != nil && *p.Options == *o.Options)
 	return p.Path == o.Path &&
 		p.Patch == o.Patch &&
 		targetEqual &&
-		reflect.DeepEqual(p.Options, o.Options)
+		optionsEqual
 }

api/types/patch_test.go

@@ -101,6 +101,28 @@ func TestPatchEquals(t *testing.T) {
 			},
 			expect: true,
 		},
+		{
+			name: "same options",
+			patch1: Patch{
+				Path:   "foo",
+				Patch:  "bar",
+				Target: &selector,
+				Options: &PatchArgs{
+					AllowNameChange: true,
+					AllowKindChange: true,
+				},
+			},
+			patch2: Patch{
+				Path:   "foo",
+				Patch:  "bar",
+				Target: &selector,
+				Options: &PatchArgs{
+					AllowNameChange: true,
+					AllowKindChange: true,
+				},
+			},
+			expect: true,
+		},
 		{
 			name: "one nil target",
 			patch1: Patch{
@@ -124,6 +146,28 @@ func TestPatchEquals(t *testing.T) {
 			},
 			expect: false,
 		},
+		{
+			name: "different options",
+			patch1: Patch{
+				Path:   "foo",
+				Patch:  "bar",
+				Target: &selector,
+				Options: &PatchArgs{
+					AllowNameChange: false,
+					AllowKindChange: true,
+				},
+			},
+			patch2: Patch{
+				Path:   "foo",
+				Patch:  "bar",
+				Target: &selector,
+				Options: &PatchArgs{
+					AllowNameChange: true,
+					AllowKindChange: true,
+				},
+			},
+			expect: false,
+		},
 	}
 
 	for _, tc := range testcases {

api/types/patchargs.go

@@ -0,0 +1,13 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package types
+
+// PatchArgs represent set of options on resources of a patch.
+type PatchArgs struct {
+	// AllowNameChange allows name changes to the resource.
+	AllowNameChange bool `json:"allowNameChange,omitempty" yaml:"allowNameChange,omitempty"`
+
+	// AllowKindChange allows kind changes to the resource.
+	AllowKindChange bool `json:"allowKindChange,omitempty" yaml:"allowKindChange,omitempty"`
+}

api/types/pluginconfig.go

@@ -8,6 +8,7 @@ type HelmConfig struct {
 	Command     string
 	ApiVersions []string
 	KubeVersion string
+	Debug       bool
 }
 
 // PluginConfig holds plugin configuration.
@@ -27,7 +28,6 @@ type PluginConfig struct {
 
 func EnabledPluginConfig(b BuiltinPluginLoadingOptions) (pc *PluginConfig) {
 	pc = MakePluginConfig(PluginRestrictionsNone, b)
-	pc.FnpLoadingOptions.EnableStar = true
 	pc.HelmConfig.Enabled = true
 	// If this command is not on PATH, tests needing it should skip.
 	pc.HelmConfig.Command = "helmV3"

api/types/pluginrestrictions.go

@@ -46,8 +46,6 @@ const (
 type FnPluginLoadingOptions struct {
 	// Allow to run executables
 	EnableExec bool
-	// Allow to run starlark
-	EnableStar bool
 	// Allow container access to network
 	Network     bool
 	NetworkName string

api/types/replacement.go

@@ -20,6 +20,9 @@ type Replacement struct {
 
 	// The N fields to write the value to.
 	Targets []*TargetSelector `json:"targets,omitempty" yaml:"targets,omitempty"`
+
+	// Used to define an static value
+	SourceValue *string `json:"sourceValue,omitempty" yaml:"sourceValue,omitempty"`
 }
 
 // SourceSelector is the source of the replacement transformer.
@@ -63,6 +66,53 @@ type TargetSelector struct {
 	Options *FieldOptions `json:"options,omitempty" yaml:"options,omitempty"`
 }
 
+type TargetSelectorRegex struct {
+	targetSelector *TargetSelector
+	selectRegex    *SelectorRegex
+	rejectRegex    []*SelectorRegex
+}
+
+func NewTargetSelectorRegex(ts *TargetSelector) (*TargetSelectorRegex, error) {
+	tsr := new(TargetSelectorRegex)
+	tsr.targetSelector = ts
+	var err error
+
+	tsr.selectRegex, err = NewSelectorRegex(ts.Select)
+	if err != nil {
+		return nil, err
+	}
+
+	rej := []*SelectorRegex{}
+	for _, r := range ts.Reject {
+		rr, err := NewSelectorRegex(r)
+		if err != nil {
+			return nil, err
+		}
+		rej = append(rej, rr)
+	}
+	tsr.rejectRegex = rej
+
+	return tsr, nil
+}
+
+func (tsr *TargetSelectorRegex) Selects(id resid.ResId) bool {
+	return tsr.selectRegex.MatchGvk(id.Gvk) && tsr.selectRegex.MatchName(id.Name) && tsr.selectRegex.MatchNamespace(id.Namespace)
+}
+
+func (tsr *TargetSelectorRegex) RejectsAny(ids []resid.ResId) bool {
+	for _, r := range tsr.rejectRegex {
+		if r.selector.ResId.IsEmpty() {
+			continue
+		}
+		for _, id := range ids {
+			if r.MatchGvk(id.Gvk) && r.MatchName(id.Name) && r.MatchNamespace(id.Namespace) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // FieldOptions refine the interpretation of FieldPaths.
 type FieldOptions struct {
 	// Used to split/join the field.

api/types/var_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	yaml "go.yaml.in/yaml/v2"
 	"sigs.k8s.io/kustomize/kyaml/resid"
-	yaml "sigs.k8s.io/yaml/goyaml.v2"
 )
 
 func TestGVK(t *testing.T) {

cmd/config/docs/api-conventions/functions-impl.md

@@ -1,29 +1,33 @@
 # Running Configuration Functions using kustomize CLI
 
-Configuration functions can be implemented using any toolchain and invoked using any
-container workflow orchestrator including Tekton, Cloud Build, or run directly using `docker run`.
+Configuration functions can be implemented using any toolchain and invoked using
+any container workflow orchestrator including Tekton, Cloud Build, or run
+directly using `docker run`.
 
 Run `config help docs-fn-spec` to see the Configuration Functions Specification.
 
-`kustomize fn run` is an example orchestrator for invoking Configuration Functions. This
-document describes how to implement and invoke an example function.
+`kustomize fn run` is an example orchestrator for invoking Configuration
+Functions. This document describes how to implement and invoke an example
+function.
 
 ## Example Function Implementation
 
-Following is an example for implementing an nginx abstraction using a configuration
-function.
+Following is an example for implementing an nginx abstraction using a
+configuration function.
 
 ### `nginx-template.sh`
 
-`nginx-template.sh` is a simple bash script which uses a _heredoc_ as a templating solution
-for generating Resources from the functionConfig input fields.
+`nginx-template.sh` is a simple bash script which uses a _heredoc_ as a
+templating solution for generating Resources from the functionConfig input
+fields.
 
 The script wraps itself using `config run wrap -- $0` which will:
 
-1. Parse the `ResourceList.functionConfig` (provided to the container stdin) into env vars
+1. Parse the `ResourceList.functionConfig` (provided to the container stdin)
+   into env vars
 2. Merge the stdout into the original list of Resources
-3. Defaults filenames for newly generated Resources (if they are not set as annotations)
-   to `config/NAME_KIND.yaml`
+3. Defaults filenames for newly generated Resources (if they are not set as
+   annotations) to `config/NAME_KIND.yaml`
 4. Format the output
 
 ```bash
@@ -82,10 +86,11 @@ End-of-message
 
 ### Dockerfile
 
-`Dockerfile` installs `kustomize fn` and copies the script into the container image.
+`Dockerfile` installs `kustomize fn` and copies the script into the container
+image.
 
 ```
-FROM golang:1.21-bullseye
+FROM public.ecr.aws/docker/library/golang:1.25.7
 RUN go get sigs.k8s.io/kustomize/cmd/config
 RUN mv /go/bin/config /usr/bin/config
 COPY nginx-template.sh /usr/bin/nginx-template.sh
@@ -94,7 +99,8 @@ CMD ["nginx-template.sh]
 
 ## Example Function Usage
 
-Following is an example of running the `kustomize fn run` using the preceding API.
+Following is an example of running the `kustomize fn run` using the preceding
+API.
 
 When run by `kustomize fn run`, functions are run in containers with the
 following environment:
@@ -102,12 +108,14 @@ following environment:
 - Network: `none`
 - User: `nobody`
 - Security Options: `no-new-privileges`
-- Volumes: the volume containing the `functionConfig` yaml is mounted under `/local` as `ro`
+- Volumes: the volume containing the `functionConfig` yaml is mounted under
+  `/local` as `ro`
 
 ### Input
 
-`dir/nginx.yaml` contains a reference to the Function. The contents of `nginx.yaml`
-are passed to the Function through the `ResourceList.functionConfig` field.
+`dir/nginx.yaml` contains a reference to the Function. The contents of
+`nginx.yaml` are passed to the Function through the
+`ResourceList.functionConfig` field.
 
 ```yaml
 apiVersion: example.com/v1beta1
@@ -123,9 +131,10 @@ spec:
   replicas: 5
 ```
 
-- `annotations[config.kubernetes.io/function].container.image`: the image to use for this API
-- `annotations[config.kubernetes.io/local-config]`: mark this as not a Resource that should
-  be applied
+- `annotations[config.kubernetes.io/function].container.image`: the image to use
+  for this API
+- `annotations[config.kubernetes.io/local-config]`: mark this as not a Resource
+  that should be applied
 
 ### Output
 

cmd/config/go.mod

@@ -1,34 +1,45 @@
 module sigs.k8s.io/kustomize/cmd/config
 
-go 1.21
+go 1.25.0
 
 require (
 	github.com/go-errors/errors v1.4.2
-	github.com/spf13/cobra v1.8.0
-	github.com/stretchr/testify v1.8.4
+	github.com/spf13/cobra v1.10.2
+	github.com/stretchr/testify v1.11.1
 	gopkg.in/inf.v0 v0.9.1
-	sigs.k8s.io/kustomize/kyaml v0.17.2
+	sigs.k8s.io/kustomize/kyaml v0.21.1
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/sergi/go-diff v1.2.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )
+
+replace sigs.k8s.io/kustomize/kyaml => ../../kyaml

cmd/config/go.sum

@@ -1,7 +1,4 @@
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -9,27 +6,48 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -39,45 +57,44 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
-go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
-golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -85,15 +102,15 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/kyaml v0.17.2 h1:+AzvoJUY0kq4QAhH/ydPHHMRLijtUKiyVyh7fOSshr0=
-sigs.k8s.io/kustomize/kyaml v0.17.2/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

cmd/config/internal/commands/e2e/e2e_test.go

@@ -493,204 +493,6 @@ metadata:
     a-string-value: 'a'
     a-int-value: '2'
     a-bool-value: 'true'
-`,
-				}
-			},
-		},
-
-		{
-			name: "starlark_function_config",
-			args: func(d string) []string { return []string{"--enable-star"} },
-			files: func(d string) map[string]string {
-				return map[string]string{
-					"script.star": `
-# set the foo annotation on each resource
-def run(r, fc):
-  for resource in r:
-    resource["metadata"]["annotations"]["a-string-value"] = fc["data"]["stringValue"]
-    resource["metadata"]["annotations"]["a-int-value"] = fc["data"]["intValue"]
-    resource["metadata"]["annotations"]["a-bool-value"] = fc["data"]["boolValue"]
-run(ctx.resource_list["items"], ctx.resource_list["functionConfig"])
-`,
-					"config.yaml": `
-apiVersion: example.com/v1alpha1
-kind: Input
-metadata:
-  name: foo
-  annotations:
-    config.kubernetes.io/function: |
-      starlark:
-        path: script.star
-        name: fn
-data:
-  boolValue: true
-  intValue: 2
-  stringValue: a
-`,
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-`,
-				}
-			},
-			expectedFiles: func(d string) map[string]string {
-				return map[string]string{
-					"config.yaml": `
-apiVersion: example.com/v1alpha1
-kind: Input
-metadata:
-  name: foo
-  annotations:
-    config.kubernetes.io/function: |
-      starlark:
-        path: script.star
-        name: fn
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
-data:
-  boolValue: true
-  intValue: 2
-  stringValue: a
-`,
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-  annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
-`,
-				}
-			},
-		},
-
-		{
-			name: "starlark_function_path",
-			args: func(d string) []string {
-				return []string{
-					"--enable-star", "--star-path", "script.star",
-					"--", "stringValue=a", "intValue=2", "boolValue=true",
-				}
-			},
-			files: func(d string) map[string]string {
-				return map[string]string{
-					"script.star": `
-# set the foo annotation on each resource
-def run(r, fc):
-  for resource in r:
-    resource["metadata"]["annotations"]["a-string-value"] = fc["data"]["stringValue"]
-    resource["metadata"]["annotations"]["a-int-value"] = fc["data"]["intValue"]
-    resource["metadata"]["annotations"]["a-bool-value"] = fc["data"]["boolValue"]
-run(ctx.resource_list["items"], ctx.resource_list["functionConfig"])
-`,
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-`,
-				}
-			},
-			expectedFiles: func(d string) map[string]string {
-				return map[string]string{
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-  annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
-`,
-				}
-			},
-		},
-
-		{
-			name: "starlark_function_url",
-			args: func(d string) []string {
-				return []string{
-					"--enable-star", "--star-url", "https://storage.googleapis.com/kustomize-starlark-functions/annotate.star",
-					"--star-name", "annotate",
-					"--", "stringValue=a", "intValue=2", "boolValue=true",
-				}
-			},
-			files: func(d string) map[string]string {
-				return map[string]string{
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-`,
-				}
-			},
-			expectedFiles: func(d string) map[string]string {
-				return map[string]string{
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-  annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
-`,
-				}
-			},
-		},
-
-		{
-			name: "starlark_function_url_config",
-			args: func(d string) []string {
-				return []string{"--enable-star"}
-			},
-			files: func(d string) map[string]string {
-				return map[string]string{
-					"config.yaml": `
-apiVersion: example.com/v1alpha1
-kind: Input
-metadata:
-  name: foo
-  annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
-    config.kubernetes.io/function: |
-      starlark:
-        url: https://storage.googleapis.com/kustomize-starlark-functions/annotate.star
-        name: fn
-data:
-  boolValue: true
-  intValue: 2
-  stringValue: a
-`,
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-`,
-				}
-			},
-			expectedFiles: func(d string) map[string]string {
-				return map[string]string{
-					"deployment.yaml": `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foo
-  annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
 `,
 				}
 			},

cmd/config/internal/commands/e2e/e2econtainerconfig/Dockerfile

@@ -1,7 +1,7 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
+FROM public.ecr.aws/docker/library/golang:1.25.7
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
 

cmd/config/internal/commands/e2e/e2econtainerconfig/go.mod

@@ -1,31 +1,38 @@
 module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainerconfig
 
-go 1.21
+go 1.25.0
 
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/spf13/cobra v1.8.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
 replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainerconfig/go.sum

@@ -1,6 +1,4 @@
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -8,29 +6,50 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -39,52 +58,56 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Dockerfile

@@ -1,7 +1,7 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
+FROM public.ecr.aws/docker/library/golang:1.25.7
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
 

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.mod

@@ -1,31 +1,38 @@
 module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainerenvgenerator
 
-go 1.21
+go 1.25.0
 
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/spf13/cobra v1.8.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
 replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.sum

@@ -1,6 +1,4 @@
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -8,29 +6,50 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -39,52 +58,56 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

cmd/config/internal/commands/e2e/e2econtainermountbind/Dockerfile

@@ -1,7 +1,7 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
+FROM public.ecr.aws/docker/library/golang:1.25.7
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
 

cmd/config/internal/commands/e2e/e2econtainermountbind/go.mod

@@ -1,31 +1,38 @@
 module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainer-render-helm-chart
 
-go 1.21
+go 1.25.0
 
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/spf13/cobra v1.8.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
 replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainermountbind/go.sum

@@ -1,6 +1,4 @@
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -8,29 +6,50 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -39,52 +58,56 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/Dockerfile

@@ -1,7 +1,7 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
+FROM public.ecr.aws/docker/library/golang:1.25.7
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
 

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/go.mod

@@ -1,31 +1,38 @@
 module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainersimplegenerator
 
-go 1.21
+go 1.25.0
 
 require sigs.k8s.io/kustomize/kyaml v0.14.2
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/spf13/cobra v1.8.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
 replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/go.sum

@@ -1,6 +1,4 @@
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -8,29 +6,50 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -39,52 +58,56 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

cmd/config/internal/commands/e2e/e2econtainersimplegenerator/main.go

@@ -18,7 +18,7 @@ type App struct {
 		Name string `yaml:"name"`
 	} `yaml:"metadata"`
 	Spec struct {
-		Port int `yaml:"port" json:"port"`
+		Port int `yaml:"port" json:"port"` //nolint:tagalign
 	} `yaml:"spec" json:"spec"`
 }
 

cmd/config/internal/commands/run-fns.go

@@ -51,14 +51,6 @@ func GetRunFnRunner(name string) *RunFnRunner {
 		"enable support for exec functions -- note: exec functions run arbitrary code -- do not use for untrusted configs!!! (Alpha)")
 	r.Command.Flags().StringVar(
 		&r.ExecPath, "exec-path", "", "run an executable as a function. (Alpha)")
-	r.Command.Flags().BoolVar(
-		&r.EnableStar, "enable-star", false, "enable support for starlark functions. (Alpha)")
-	r.Command.Flags().StringVar(
-		&r.StarPath, "star-path", "", "run a starlark script as a function. (Alpha)")
-	r.Command.Flags().StringVar(
-		&r.StarURL, "star-url", "", "run a starlark script as a function. (Alpha)")
-	r.Command.Flags().StringVar(
-		&r.StarName, "star-name", "", "name of starlark program. (Alpha)")
 
 	r.Command.Flags().StringVar(
 		&r.ResultsDir, "results-dir", "", "write function results to this dir")
@@ -91,7 +83,6 @@ type RunFnRunner struct {
 	GlobalScope        bool
 	FnPaths            []string
 	Image              string
-	EnableStar         bool
 	StarPath           string
 	StarURL            string
 	StarName           string
@@ -128,8 +119,6 @@ func (r *RunFnRunner) getContainerFunctions(dataItems []string) (
 	switch {
 	case r.Image != "":
 		fnAnnotation, err = fnAnnotationForImage(r.Image, r.Network)
-	case r.EnableStar && (r.StarPath != "" || r.StarURL != ""):
-		fnAnnotation, err = fnAnnotationForStar(r.StarPath, r.StarURL, r.StarName)
 	case r.EnableExec && r.ExecPath != "":
 		fnAnnotation, err = fnAnnotationForExec(r.ExecPath)
 	}
@@ -218,37 +207,6 @@ func fnAnnotationForExec(path string) (*yaml.RNode, error) {
 	return fn, nil
 }
 
-func fnAnnotationForStar(path string, url string, name string) (*yaml.RNode, error) {
-	fn, err := yaml.Parse(`starlark: {}`)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	if path != "" {
-		err = fn.PipeE(
-			yaml.Lookup("starlark"),
-			yaml.SetField("path", yaml.NewScalarRNode(path)))
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-	}
-	if url != "" {
-		err = fn.PipeE(
-			yaml.Lookup("starlark"),
-			yaml.SetField("url", yaml.NewScalarRNode(url)))
-		if err != nil {
-			return nil, errors.Wrap(err)
-		}
-	}
-	err = fn.PipeE(
-		yaml.Lookup("starlark"),
-		yaml.SetField("name", yaml.NewScalarRNode(name)))
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-	return fn, nil
-}
-
 func fnAnnotationForImage(image string, enableNetwork bool) (*yaml.RNode, error) {
 	fn, err := yaml.Parse(`container: {}`)
 	if err != nil {
@@ -286,16 +244,11 @@ func toStorageMounts(mounts []string) []runtimeutil.StorageMount {
 }
 
 func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
-	if !r.EnableStar && (r.StarPath != "" || r.StarURL != "") {
-		return errors.Errorf("must specify --enable-star with --star-path and --star-url")
-	}
-
 	if !r.EnableExec && r.ExecPath != "" {
 		return errors.Errorf("must specify --enable-exec with --exec-path")
 	}
 
-	if c.ArgsLenAtDash() >= 0 && r.Image == "" &&
-		!(r.EnableStar && (r.StarPath != "" || r.StarURL != "")) && !(r.EnableExec && r.ExecPath != "") {
+	if c.ArgsLenAtDash() >= 0 && r.Image == "" && !(r.EnableExec && r.ExecPath != "") {
 		return errors.Errorf("must specify --image")
 	}
 
@@ -346,7 +299,6 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		Input:          input,
 		Path:           path,
 		Network:        r.Network,
-		EnableStarlark: r.EnableStar,
 		EnableExec:     r.EnableExec,
 		StorageMounts:  storageMounts,
 		ResultsDir:     r.ResultsDir,

cmd/config/internal/commands/run_test.go

@@ -157,55 +157,6 @@ kind: Foo
 apiVersion: v1
 `,
 		},
-		{
-			name: "star",
-			args: []string{"run", "dir",
-				"--enable-star",
-				"--star-path", "a/b/c",
-				"--star-name", "foo",
-				"--", "Foo", "g=h"},
-			path: "dir",
-			expected: `
-metadata:
-  name: function-input
-  annotations:
-    config.kubernetes.io/function: |
-      starlark: {path: a/b/c, name: foo}
-data: {g: h}
-kind: Foo
-apiVersion: v1
-`,
-		},
-		{
-			name: "star-not-enabled",
-			args: []string{"run", "dir",
-				"--star-path", "a/b/c",
-				"--star-name", "foo",
-				"--", "Foo", "g=h"},
-			path: "dir",
-			err:  "must specify --enable-star with --star-path",
-		},
-		{
-			name: "image-star-not-enabled",
-			args: []string{"run", "dir",
-				"--image", "some_image",
-				"--star-path", "a/b/c",
-				"--star-name", "foo",
-				"--", "Foo", "g=h"},
-			path: "dir",
-			err:  "must specify --enable-star with --star-path",
-		},
-		{
-			name: "star-enabled",
-			args: []string{"run", "dir", "--enable-star"},
-			path: "dir",
-			expectedStruct: &runfn.RunFns{
-				Path:           "dir",
-				EnableStarlark: true,
-				Env:            []string{},
-				WorkingDir:     wd,
-			},
-		},
 		{
 			name:          "function paths",
 			args:          []string{"run", "dir", "--fn-path", "path1", "--fn-path", "path2"},

cmd/config/internal/generateddocs/api/docs.go

@@ -144,7 +144,7 @@ The script wraps itself using ` + "`" + `config run wrap -- $0` + "`" + ` which
 
 ` + "`" + `Dockerfile` + "`" + ` installs ` + "`" + `kustomize fn` + "`" + ` and copies the script into the container image.
 
-	FROM golang:1.21-bullseye
+	FROM public.ecr.aws/docker/library/golang:1.25.7
 	RUN go get sigs.k8s.io/kustomize/cmd/config
 	RUN mv /go/bin/config /usr/bin/config
 	COPY nginx-template.sh /usr/bin/nginx-template.sh