Merge pull request #2816 from monopole/moveToKyamlv0_5_0

Move to kyaml v0.5.0

Makefile

@@ -14,8 +14,8 @@ all: verify-kustomize
 verify-kustomize: \
 	lint-kustomize \
 	test-unit-kustomize-all \
-	test-examples-kustomize-against-HEAD
-#	test-examples-kustomize-against-3.7.0
+	test-examples-kustomize-against-HEAD \
+	test-examples-kustomize-against-3.8.0
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
@@ -23,10 +23,10 @@ verify-kustomize: \
 prow-presubmit-check: \
 	lint-kustomize \
 	test-unit-kustomize-all \
-	test-examples-kustomize-against-HEAD \
 	test-unit-cmd-all \
-	test-go-mod
-#	test-examples-kustomize-against-3.7.0 \
+	test-go-mod \
+	test-examples-kustomize-against-HEAD \
+	test-examples-kustomize-against-3.8.0
 
 .PHONY: verify-kustomize-e2e
 verify-kustomize-e2e: test-examples-e2e-kustomize
@@ -233,10 +233,10 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-3.7.0: $(MYGOBIN)/mdrip
+test-examples-kustomize-against-3.8.0: $(MYGOBIN)/mdrip
 	( \
 		set -e; \
-		tag=v3.7.0; \
+		tag=v3.8.0; \
 		/bin/rm -f $(MYGOBIN)/kustomize; \
 		echo "Installing kustomize $$tag."; \
 		GO111MODULE=on go get sigs.k8s.io/kustomize/kustomize/v3@$${tag}; \

api/builtins/ImageTagTransformer.go

@@ -8,10 +8,10 @@ import (
 	"regexp"
 	"strings"
 
-	"sigs.k8s.io/kustomize/api/transform"
-	"sigs.k8s.io/kustomize/api/types"
-
+	"sigs.k8s.io/kustomize/api/filters/imagetag"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -31,18 +31,18 @@ func (p *ImageTagTransformerPlugin) Config(
 
 func (p *ImageTagTransformerPlugin) Transform(m resmap.ResMap) error {
 	for _, r := range m.Resources() {
-		for _, path := range p.FieldSpecs {
-			if !r.OrgId().IsSelected(&path.Gvk) {
-				continue
-			}
-			err := transform.MutateField(
-				r.Map(), path.PathSlice(), false, p.mutateImage)
-			if err != nil {
-				return err
-			}
-		}
-		// Kept for backward compatibility
-		if err := p.findAndReplaceImage(r.Map()); err != nil && r.OrgId().Kind != `CustomResourceDefinition` {
+		// If you're here because someone expected any field containing
+		// the string "containers" or "initContainers" to get an image
+		// update (not just spec/template/spec/containers[], etc.) then
+		// a code change is needed.  See api/filters/imagetag/legacy
+		// for the start of an implementation that won't use an
+		// allowlist like FsSlice, and instead walks the object looking
+		// for fields named containers or initContainers.
+		err := filtersutil.ApplyToJSON(imagetag.Filter{
+			ImageTag: p.ImageTag,
+			FsSlice:  p.FieldSpecs,
+		}, r)
+		if err != nil {
 			return err
 		}
 	}

api/builtins/NamespaceTransformer.go

@@ -5,13 +5,11 @@ package builtins
 
 import (
 	"fmt"
-	"strings"
 
 	"sigs.k8s.io/kustomize/api/filters/namespace"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
-	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
@@ -21,22 +19,12 @@ import (
 type NamespaceTransformerPlugin struct {
 	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	FieldSpecs       []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
-
-	// YAMLSupport can be set to true to use the kyaml filter instead of the
-	// kunstruct transformer.
-	// TODO: change the default to use kyaml when it is stable
-	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *NamespaceTransformerPlugin) Config(
 	_ *resmap.PluginHelpers, c []byte) (err error) {
 	p.Namespace = ""
 	p.FieldSpecs = nil
-	if !strings.Contains(string(c), "yamlSupport") {
-		// If not explicitly denied,
-		// activate kyaml-based transformation.
-		p.YAMLSupport = true
-	}
 	return yaml.Unmarshal(c, p)
 }
 
@@ -49,31 +37,13 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 			// Don't mutate empty objects?
 			continue
 		}
-
-		id := r.OrgId()
-
-		if p.YAMLSupport {
-			// use the new style transform
-			err := filtersutil.ApplyToJSON(namespace.Filter{
-				Namespace: p.Namespace,
-				FsSlice:   p.FieldSpecs,
-			}, r)
-			if err != nil {
-				return err
-			}
-		} else {
-			// use the old style transform
-			applicableFs := p.applicableFieldSpecs(id)
-			for _, fs := range applicableFs {
-				err := transform.MutateField(
-					r.Map(), fs.PathSlice(), fs.CreateIfNotPresent,
-					p.changeNamespace(r))
-				if err != nil {
-					return err
-				}
-			}
+		err := filtersutil.ApplyToJSON(namespace.Filter{
+			Namespace: p.Namespace,
+			FsSlice:   p.FieldSpecs,
+		}, r)
+		if err != nil {
+			return err
 		}
-
 		matches := m.GetMatchingResourcesByCurrentId(r.CurId().Equals)
 		if len(matches) != 1 {
 			return fmt.Errorf(

api/builtins/PatchJson6902Transformer.go

@@ -5,7 +5,6 @@ package builtins
 
 import (
 	"fmt"
-	"strings"
 
 	jsonpatch "github.com/evanphx/json-patch"
 	"github.com/pkg/errors"
@@ -24,8 +23,6 @@ type PatchJson6902TransformerPlugin struct {
 	Target       types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
 	Path         string            `json:"path,omitempty" yaml:"path,omitempty"`
 	JsonOp       string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
-
-	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *PatchJson6902TransformerPlugin) Config(
@@ -35,11 +32,6 @@ func (p *PatchJson6902TransformerPlugin) Config(
 	if err != nil {
 		return err
 	}
-	if !strings.Contains(string(c), "yamlSupport") {
-		// If not explicitly denied,
-		// activate kyaml-based transformation.
-		p.YAMLSupport = true
-	}
 	if p.Target.Name == "" {
 		return fmt.Errorf("must specify the target name")
 	}
@@ -93,22 +85,9 @@ func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
 	if err != nil {
 		return err
 	}
-	if !p.YAMLSupport {
-		rawObj, err := obj.MarshalJSON()
-		if err != nil {
-			return err
-		}
-		modifiedObj, err := p.decodedPatch.Apply(rawObj)
-		if err != nil {
-			return errors.Wrapf(
-				err, "failed to apply json patch '%s'", p.JsonOp)
-		}
-		return obj.UnmarshalJSON(modifiedObj)
-	} else {
-		return filtersutil.ApplyToJSON(patchjson6902.Filter{
-			Patch: p.JsonOp,
-		}, obj)
-	}
+	return filtersutil.ApplyToJSON(patchjson6902.Filter{
+		Patch: p.JsonOp,
+	}, obj)
 }
 
 func NewPatchJson6902TransformerPlugin() resmap.TransformerPlugin {

api/builtins/PatchStrategicMergeTransformer.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
@@ -20,8 +21,6 @@ type PatchStrategicMergeTransformerPlugin struct {
 	loadedPatches []*resource.Resource
 	Paths         []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 	Patches       string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
-
-	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *PatchStrategicMergeTransformerPlugin) Config(
@@ -31,11 +30,6 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 	if err != nil {
 		return err
 	}
-	if !strings.Contains(string(c), "yamlSupport") {
-		// If not explicitly denied,
-		// activate kyaml-based transformation.
-		p.YAMLSupport = true
-	}
 	if len(p.Paths) == 0 && p.Patches == "" {
 		return fmt.Errorf("empty file path and empty patch content")
 	}
@@ -79,24 +73,34 @@ func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error
 		if err != nil {
 			return err
 		}
-		if !p.YAMLSupport {
-			err = target.Patch(patch.Copy())
-		} else {
-			patchCopy := patch.DeepCopy()
-			patchCopy.SetName(target.GetName())
-			patchCopy.SetNamespace(target.GetNamespace())
-			patchCopy.SetGvk(target.GetGvk())
-			node, err := filtersutil.GetRNode(patchCopy)
-			if err != nil {
-				return err
-			}
-			err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-				Patch: node,
-			}, target)
-		}
+		patchCopy := patch.DeepCopy()
+		patchCopy.SetName(target.GetName())
+		patchCopy.SetNamespace(target.GetNamespace())
+		patchCopy.SetGvk(target.GetGvk())
+		node, err := filtersutil.GetRNode(patchCopy)
 		if err != nil {
 			return err
 		}
+		err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
+			Patch: node,
+		}, target)
+		if err != nil {
+			// Check for an error string from UnmarshalJSON that's indicative
+			// of an object that's missing basic KRM fields, and thus may have been
+			// entirely deleted (an acceptable outcome).  This error handling should
+			// be deleted along with use of ResMap and apimachinery functions like
+			// UnmarshalJSON.
+			if !strings.Contains(err.Error(), "Object 'Kind' is missing") {
+				// Some unknown error, let it through.
+				return err
+			}
+			if len(target.Map()) != 0 {
+				return errors.Wrapf(
+					err, "with unexpectedly non-empty object map of size %d",
+					len(target.Map()))
+			}
+			// Fall through to handle deleted object.
+		}
 		if len(target.Map()) == 0 {
 			// This means all fields have been removed from the object.
 			// This can happen if a patch required deletion of the

api/builtins/PatchTransformer.go

@@ -8,7 +8,6 @@ import (
 	"strings"
 
 	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -24,8 +23,6 @@ type PatchTransformerPlugin struct {
 	Path         string          `json:"path,omitempty" yaml:"path,omitempty"`
 	Patch        string          `json:"patch,omitempty" yaml:"patch,omitempty"`
 	Target       *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
-
-	YAMLSupport bool `json:"yamlSupport,omitempty" yaml:"yamlSupport,omitempty"`
 }
 
 func (p *PatchTransformerPlugin) Config(
@@ -34,11 +31,6 @@ func (p *PatchTransformerPlugin) Config(
 	if err != nil {
 		return err
 	}
-	if !strings.Contains(string(c), "yamlSupport") {
-		// If not explicitly denied,
-		// activate kyaml-based transformation.
-		p.YAMLSupport = true
-	}
 	p.Patch = strings.TrimSpace(p.Patch)
 	if p.Patch == "" && p.Path == "" {
 		return fmt.Errorf(
@@ -78,11 +70,11 @@ func (p *PatchTransformerPlugin) Config(
 }
 
 func (p *PatchTransformerPlugin) Transform(m resmap.ResMap) error {
-	if p.loadedPatch != nil {
+	if p.loadedPatch == nil {
+		return p.transformJson6902(m, p.decodedPatch)
+	} else {
 		// The patch was a strategic merge patch
 		return p.transformStrategicMerge(m, p.loadedPatch)
-	} else {
-		return p.transformJson6902(m, p.decodedPatch)
 	}
 }
 
@@ -116,20 +108,15 @@ func (p *PatchTransformerPlugin) transformStrategicMerge(m resmap.ResMap, patch
 }
 
 // applySMPatch applies the provided strategic merge patch to the
-// given resource. Depending on the value of YAMLSupport, it will either
-// use the legacy implementation or the kyaml-based solution.
+// given resource.
 func (p *PatchTransformerPlugin) applySMPatch(resource, patch *resource.Resource) error {
-	if !p.YAMLSupport {
-		return resource.Patch(patch.Copy())
-	} else {
-		node, err := filtersutil.GetRNode(patch)
-		if err != nil {
-			return err
-		}
-		return filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-			Patch: node,
-		}, resource)
+	node, err := filtersutil.GetRNode(patch)
+	if err != nil {
+		return err
 	}
+	return filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
+		Patch: node,
+	}, resource)
 }
 
 // transformJson6902 applies the provided json6902 patch
@@ -138,13 +125,14 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 	if p.Target == nil {
 		return fmt.Errorf("must specify a target for patch %s", p.Patch)
 	}
-
 	resources, err := m.Select(*p.Target)
 	if err != nil {
 		return err
 	}
 	for _, res := range resources {
-		err = p.applyJson6902Patch(res, patch)
+		err = filtersutil.ApplyToJSON(patchjson6902.Filter{
+			Patch: p.Patch,
+		}, res)
 		if err != nil {
 			return err
 		}
@@ -152,28 +140,6 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 	return nil
 }
 
-// applyJson6902Patch applies the provided patch to the given resource.
-// Depending on the value of YAMLSupport, it will either
-// use the legacy implementation or the kyaml-based solution.
-func (p *PatchTransformerPlugin) applyJson6902Patch(resource *resource.Resource, patch jsonpatch.Patch) error {
-	if !p.YAMLSupport {
-		rawObj, err := resource.MarshalJSON()
-		if err != nil {
-			return err
-		}
-		modifiedObj, err := patch.Apply(rawObj)
-		if err != nil {
-			return errors.Wrapf(
-				err, "failed to apply json patch '%s'", p.Patch)
-		}
-		return resource.UnmarshalJSON(modifiedObj)
-	} else {
-		return filtersutil.ApplyToJSON(patchjson6902.Filter{
-			Patch: p.Patch,
-		}, resource)
-	}
-}
-
 // jsonPatchFromBytes loads a Json 6902 patch from
 // a bytes input
 func jsonPatchFromBytes(

api/builtins/PrefixSuffixTransformer.go

@@ -5,31 +5,28 @@ package builtins
 
 import (
 	"errors"
-	"fmt"
-
-	"sigs.k8s.io/kustomize/api/transform"
-	"sigs.k8s.io/kustomize/api/types"
 
+	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
 // Add the given prefix and suffix to the field.
 type PrefixSuffixTransformerPlugin struct {
-	Prefix     string            `json:"prefix,omitempty" yaml:"prefix,omitempty"`
-	Suffix     string            `json:"suffix,omitempty" yaml:"suffix,omitempty"`
-	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+	Prefix     string        `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+	Suffix     string        `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+	FieldSpecs types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
-// Not placed in a file yet due to lack of demand.
-var prefixSuffixFieldSpecsToSkip = []types.FieldSpec{
-	{
-		Gvk: resid.Gvk{Kind: "CustomResourceDefinition"},
-	},
-	{
-		Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"},
-	},
+// A Gvk skip list for prefix/suffix modification.
+// hard coded for now - eventually should be part of config.
+var prefixSuffixFieldSpecsToSkip = types.FsSlice{
+	{Gvk: resid.Gvk{Kind: "CustomResourceDefinition"}},
+	{Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"}},
+	{Gvk: resid.Gvk{Kind: "Namespace"}},
 }
 
 func (p *PrefixSuffixTransformerPlugin) Config(
@@ -48,29 +45,24 @@ func (p *PrefixSuffixTransformerPlugin) Config(
 }
 
 func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
-
 	// Even if both the Prefix and Suffix are empty we want
 	// to proceed with the transformation. This allows to add contextual
 	// information to the resources (AddNamePrefix and AddNameSuffix).
-
 	for _, r := range m.Resources() {
+		// TODO: move this test into the filter (i.e. make a better filter)
 		if p.shouldSkip(r.OrgId()) {
-			// Don't change the actual definition
-			// of a CRD.
 			continue
 		}
 		id := r.OrgId()
 		// current default configuration contains
 		// only one entry: "metadata/name" with no GVK
-		for _, path := range p.FieldSpecs {
-			if !id.IsSelected(&path.Gvk) {
-				// With the currrent default configuration,
-				// because no Gvk is specified, so a wild
-				// card
+		for _, fs := range p.FieldSpecs {
+			// TODO: this is redundant to filter (but needed for now)
+			if !id.IsSelected(&fs.Gvk) {
 				continue
 			}
-
-			if smellsLikeANameChange(&path) {
+			// TODO: move this test into the filter.
+			if smellsLikeANameChange(&fs) {
 				// "metadata/name" is the only field.
 				// this will add a prefix and a suffix
 				// to the resource even if those are
@@ -78,15 +70,11 @@ func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
 				r.AddNamePrefix(p.Prefix)
 				r.AddNameSuffix(p.Suffix)
 			}
-
-			// the addPrefixSuffix method will not
-			// change the name if both the prefix and suffix
-			// are empty.
-			err := transform.MutateField(
-				r.Map(),
-				path.PathSlice(),
-				path.CreateIfNotPresent,
-				p.addPrefixSuffix)
+			err := filtersutil.ApplyToJSON(prefixsuffix.Filter{
+				Prefix:    p.Prefix,
+				Suffix:    p.Suffix,
+				FieldSpec: fs,
+			}, r)
 			if err != nil {
 				return err
 			}
@@ -99,8 +87,7 @@ func smellsLikeANameChange(fs *types.FieldSpec) bool {
 	return fs.Path == "metadata/name"
 }
 
-func (p *PrefixSuffixTransformerPlugin) shouldSkip(
-	id resid.ResId) bool {
+func (p *PrefixSuffixTransformerPlugin) shouldSkip(id resid.ResId) bool {
 	for _, path := range prefixSuffixFieldSpecsToSkip {
 		if id.IsSelected(&path.Gvk) {
 			return true
@@ -109,15 +96,6 @@ func (p *PrefixSuffixTransformerPlugin) shouldSkip(
 	return false
 }
 
-func (p *PrefixSuffixTransformerPlugin) addPrefixSuffix(
-	in interface{}) (interface{}, error) {
-	s, ok := in.(string)
-	if !ok {
-		return nil, fmt.Errorf("%#v is expected to be %T", in, s)
-	}
-	return fmt.Sprintf("%s%s%s", p.Prefix, s, p.Suffix), nil
-}
-
 func NewPrefixSuffixTransformerPlugin() resmap.TransformerPlugin {
 	return &PrefixSuffixTransformerPlugin{}
 }

api/builtins/ReplicaCountTransformer.go

@@ -6,7 +6,8 @@ package builtins
 import (
 	"fmt"
 
-	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/filters/replicacount"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -30,18 +31,24 @@ func (p *ReplicaCountTransformerPlugin) Config(
 
 func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 	found := false
-	for i, replicaSpec := range p.FieldSpecs {
-		matcher := p.createMatcher(i)
+	for _, fs := range p.FieldSpecs {
+		matcher := p.createMatcher(fs)
 		matchOriginal := m.GetMatchingResourcesByOriginalId(matcher)
-		matchCurrent := m.GetMatchingResourcesByCurrentId(matcher)
-
-		for _, res := range append(matchOriginal, matchCurrent...) {
+		resList := append(
+			matchOriginal, m.GetMatchingResourcesByCurrentId(matcher)...)
+		if len(resList) > 0 {
 			found = true
-			err := transform.MutateField(
-				res.Map(), replicaSpec.PathSlice(),
-				replicaSpec.CreateIfNotPresent, p.addReplicas)
-			if err != nil {
-				return err
+			for _, r := range resList {
+				// There are redundant checks in the filter
+				// that we'll live with until resolution of
+				// https://github.com/kubernetes-sigs/kustomize/issues/2506
+				err := filtersutil.ApplyToJSON(replicacount.Filter{
+					Replica:   p.Replica,
+					FieldSpec: fs,
+				}, r)
+				if err != nil {
+					return err
+				}
 			}
 		}
 	}
@@ -59,30 +66,12 @@ func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 }
 
 // Match Replica.Name and FieldSpec
-func (p *ReplicaCountTransformerPlugin) createMatcher(i int) resmap.IdMatcher {
+func (p *ReplicaCountTransformerPlugin) createMatcher(fs types.FieldSpec) resmap.IdMatcher {
 	return func(r resid.ResId) bool {
-		return r.Name == p.Replica.Name &&
-			r.Gvk.IsSelected(&p.FieldSpecs[i].Gvk)
+		return r.Name == p.Replica.Name && r.Gvk.IsSelected(&fs.Gvk)
 	}
 }
 
-func (p *ReplicaCountTransformerPlugin) addReplicas(in interface{}) (interface{}, error) {
-	switch m := in.(type) {
-	case int64:
-		// Was already in the field.
-	case map[string]interface{}:
-		if len(m) != 0 {
-			// A map was already in the replicas field, don't want to
-			// discard this data silently.
-			return nil, fmt.Errorf("%#v is expected to be %T", in, m)
-		}
-		// Just got added, default type is map, but we can return anything.
-	default:
-		return nil, fmt.Errorf("%#v is expected to be %T", in, m)
-	}
-	return p.Replica.Count, nil
-}
-
 func NewReplicaCountTransformerPlugin() resmap.TransformerPlugin {
 	return &ReplicaCountTransformerPlugin{}
 }

api/filters/annotations/annotations.go

@@ -29,10 +29,11 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
-					FsSlice:    f.FsSlice,
-					SetValue:   fsslice.SetEntry(k, f.Annotations[k], yaml.StringTag),
+					FsSlice: f.FsSlice,
+					SetValue: filtersutil.SetEntry(
+						k, f.Annotations[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Annotations are MappingNodes.
-					CreateTag:  "!!map",
+					CreateTag:  yaml.NodeTagMap,
 				}); err != nil {
 					return nil, err
 				}

api/filters/fieldspec/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package fieldspec contains a yaml.Filter to modify a resource
+// that matches the FieldSpec.
+package fieldspec

api/filters/fieldspec/example_test.go

@@ -0,0 +1,61 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fieldspec_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+
+	. "sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func ExampleFilter() {
+	in := &kio.ByteReader{
+		Reader: bytes.NewBufferString(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+---
+apiVersion: example.com/v1
+kind: Bar
+metadata:
+  name: instance
+`),
+	}
+	fltr := Filter{
+		CreateKind: yaml.ScalarNode,
+		SetValue:   filtersutil.SetScalar("green"),
+		FieldSpec:  types.FieldSpec{Path: "a/b", CreateIfNotPresent: true},
+	}
+
+	err := kio.Pipeline{
+		Inputs:  []kio.Reader{in},
+		Filters: []kio.Filter{kio.FilterAll(fltr)},
+		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
+	}.Execute()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	// apiVersion: example.com/v1
+	// kind: Foo
+	// metadata:
+	//   name: instance
+	// a:
+	//   b: green
+	// ---
+	// apiVersion: example.com/v1
+	// kind: Bar
+	// metadata:
+	//   name: instance
+	// a:
+	//   b: green
+}

api/filters/fieldspec/fieldspec.go

@@ -1,24 +1,27 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package fsslice
+package fieldspec
 
 import (
 	"strings"
 
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// fieldSpecFilter applies a single fieldSpec to a single object
-// fieldSpecFilter stores internal state and should not be reused
-type fieldSpecFilter struct {
+var _ yaml.Filter = Filter{}
+
+// Filter applies a single fieldSpec to a single object
+// Filter stores internal state and should not be reused
+type Filter struct {
 	// FieldSpec contains the path to the value to set.
 	FieldSpec types.FieldSpec `yaml:"fieldSpec"`
 
 	// Set the field using this function
-	SetValue SetFn
+	SetValue filtersutil.SetFn
 
 	// CreateKind defines the type of node to create if the field is not found
 	CreateKind yaml.Kind
@@ -29,21 +32,21 @@ type fieldSpecFilter struct {
 	path []string
 }
 
-func (fltr fieldSpecFilter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
+func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 	// check if the FieldSpec applies to the object
 	if match, err := isMatchGVK(fltr.FieldSpec, obj); !match || err != nil {
 		return obj, errors.Wrap(err)
 	}
-	fltr.path = strings.Split(fltr.FieldSpec.Path, "/")
+	fltr.path = splitPath(fltr.FieldSpec.Path)
 	if err := fltr.filter(obj); err != nil {
 		s, _ := obj.String()
 		return nil, errors.WrapPrefixf(err,
-			"obj %v at path %v", s, fltr.FieldSpec.Path)
+			"obj '%s' at path '%v'", s, fltr.FieldSpec.Path)
 	}
 	return obj, nil
 }
 
-func (fltr fieldSpecFilter) filter(obj *yaml.RNode) error {
+func (fltr Filter) filter(obj *yaml.RNode) error {
 	if len(fltr.path) == 0 {
 		// found the field -- set its value
 		return fltr.SetValue(obj)
@@ -53,24 +56,27 @@ func (fltr fieldSpecFilter) filter(obj *yaml.RNode) error {
 		return fltr.seq(obj)
 	case yaml.MappingNode:
 		return fltr.field(obj)
+	default:
+		return errors.Errorf("expected sequence or mapping node")
 	}
-	// not found -- this might be an error since the type doesn't match
-
-	return errors.Errorf("unsupported yaml node")
 }
 
 // field calls filter on the field matching the next path element
-func (fltr fieldSpecFilter) field(obj *yaml.RNode) error {
+func (fltr Filter) field(obj *yaml.RNode) error {
 	fieldName, isSeq := isSequenceField(fltr.path[0])
-
 	// lookup the field matching the next path element
 	var lookupField yaml.Filter
 	var kind yaml.Kind
-	var tag string
+	tag := "" // TODO: change to yaml.NodeTagEmpty
 	switch {
 	case !fltr.FieldSpec.CreateIfNotPresent || fltr.CreateKind == 0 || isSeq:
 		// dont' create the field if we don't find it
 		lookupField = yaml.Lookup(fieldName)
+		if isSeq {
+			// The query path thinks this field should be a sequence;
+			// accept this hint for use later if the tag is NodeTagNull.
+			kind = yaml.SequenceNode
+		}
 	case len(fltr.path) <= 1:
 		// create the field if it is missing: use the provided node kind
 		lookupField = yaml.LookupCreate(fltr.CreateKind, fieldName)
@@ -80,7 +86,7 @@ func (fltr fieldSpecFilter) field(obj *yaml.RNode) error {
 		// create the field if it is missing: must be a mapping node
 		lookupField = yaml.LookupCreate(yaml.MappingNode, fieldName)
 		kind = yaml.MappingNode
-		tag = "!!map"
+		tag = yaml.NodeTagMap
 	}
 
 	// locate (or maybe create) the field
@@ -91,7 +97,7 @@ func (fltr fieldSpecFilter) field(obj *yaml.RNode) error {
 
 	// if the value exists, but is null, then change it to the creation type
 	// TODO: update yaml.LookupCreate to support this
-	if field.YNode().Tag == "!!null" {
+	if field.YNode().Tag == yaml.NodeTagNull {
 		field.YNode().Kind = kind
 		field.YNode().Tag = tag
 	}
@@ -104,9 +110,9 @@ func (fltr fieldSpecFilter) field(obj *yaml.RNode) error {
 }
 
 // seq calls filter on all sequence elements
-func (fltr fieldSpecFilter) seq(obj *yaml.RNode) error {
+func (fltr Filter) seq(obj *yaml.RNode) error {
 	if err := obj.VisitElements(func(node *yaml.RNode) error {
-		// recurse on each element -- re-allocating a fieldSpecFilter is
+		// recurse on each element -- re-allocating a Filter is
 		// not strictly required, but is more consistent with field
 		// and less likely to have side effects
 		// keep the entire path -- it does not contain parts for sequences
@@ -153,3 +159,18 @@ func isMatchGVK(fs types.FieldSpec, obj *yaml.RNode) (bool, error) {
 
 	return true, nil
 }
+
+func splitPath(path string) []string {
+	ps := strings.Split(path, "/")
+	var res []string
+	res = append(res, ps[0])
+	for i := 1; i < len(ps); i++ {
+		lastIndex := len(res) - 1
+		if strings.HasSuffix(res[lastIndex], "\\") {
+			res[lastIndex] = strings.TrimSuffix(res[lastIndex], "\\") + "/" + ps[i]
+		} else {
+			res = append(res, ps[i])
+		}
+	}
+	return res
+}

api/filters/fieldspec/fieldspec_test.go

@@ -0,0 +1,536 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fieldspec_test
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type TestCase struct {
+	name      string
+	input     string
+	expected  string
+	filter    fieldspec.Filter
+	fieldSpec string
+	error     string
+}
+
+var tests = []TestCase{
+	{
+		name: "update",
+		fieldSpec: `
+path: a/b
+group: foo
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b: e
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-kind-not-match",
+		fieldSpec: `
+path: a/b
+group: foo
+kind: Bar1
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar2
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar2
+a:
+  b: c
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-group-not-match",
+		fieldSpec: `
+path: a/b
+group: foo1
+kind: Bar
+`,
+		input: `
+apiVersion: foo2/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo2/v1beta1
+kind: Bar
+a:
+  b: c
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "update-version-not-match",
+		fieldSpec: `
+path: a/b
+group: foo
+version: v1beta1
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta2
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta2
+kind: Bar
+a:
+  b: c
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "bad-version",
+		fieldSpec: `
+path: a/b
+group: foo
+version: v1beta1
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta2/something
+kind: Bar
+a:
+  b: c
+`,
+		expected: `
+apiVersion: foo/v1beta2/something
+kind: Bar
+a:
+  b: c
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "bad-meta",
+		fieldSpec: `
+path: a/b
+group: foo
+version: v1beta1
+kind: Bar
+`,
+		input: `
+a:
+  b: c
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+		error: "missing Resource metadata",
+	},
+
+	{
+		name: "miss-match-type",
+		fieldSpec: `
+path: a/b/c
+kind: Bar
+`,
+		input: `
+kind: Bar
+a:
+  b: a
+`,
+		error: "obj 'kind: Bar\na:\n  b: a\n' at path 'a/b/c': " +
+			"expected sequence or mapping node",
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	{
+		name: "add",
+		fieldSpec: `
+path: a/b/c/d
+group: foo
+create: true
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {b: {c: {d: e}}}
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	{
+		name: "update-in-sequence",
+		fieldSpec: `
+path: a/b[]/c/d
+group: foo
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c:
+      d: a
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c:
+      d: e
+`,
+		filter: fieldspec.Filter{
+			SetValue: filtersutil.SetScalar("e"),
+		},
+	},
+
+	// Don't create a sequence
+	{
+		name: "empty-sequence-no-create",
+		fieldSpec: `
+path: a/b[]/c/d
+group: foo
+create: true
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a: {}
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	// Create a new field for an element in a sequence
+	{
+		name: "empty-sequence-create",
+		fieldSpec: `
+path: a/b[]/c/d
+group: foo
+create: true
+kind: Bar
+`,
+		input: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c: {}
+`,
+		expected: `
+apiVersion: foo/v1beta1
+kind: Bar
+a:
+  b:
+  - c: {d: e}
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	{
+		name: "group v1",
+		fieldSpec: `
+path: a/b
+group: v1
+create: true
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+
+	{
+		name: "version v1",
+		fieldSpec: `
+path: a/b
+version: v1
+create: true
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+a:
+  b: e
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("e"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "successfully set field on array entry no sequence hint",
+		fieldSpec: `
+path: spec/containers/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "successfully set field on array entry with sequence hint",
+		fieldSpec: `
+path: spec/containers[]/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "failure to set field on array entry with sequence hint in path",
+		fieldSpec: `
+path: spec/containers[]/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers: []
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "failure to set field on array entry, no sequence hint in path",
+		fieldSpec: `
+path: spec/containers/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+		error: "obj '' at path 'spec/containers/image': expected sequence or mapping node",
+	},
+	{
+		name: "filedname with slash '/'",
+		fieldSpec: `
+path: a/b\/c/d
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "filedname with multiple '/'",
+		fieldSpec: `
+path: a/b\/c/d\/e/f
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d/e:
+      f: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d/e:
+      f: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+}
+
+func TestFilter_Filter(t *testing.T) {
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			err := yaml.Unmarshal([]byte(test.fieldSpec), &test.filter.FieldSpec)
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+
+			out := &bytes.Buffer{}
+			rw := &kio.ByteReadWriter{
+				Reader:                bytes.NewBufferString(test.input),
+				Writer:                out,
+				OmitReaderAnnotations: true,
+			}
+
+			// run the filter
+			err = kio.Pipeline{
+				Inputs:  []kio.Reader{rw},
+				Filters: []kio.Filter{kio.FilterAll(test.filter)},
+				Outputs: []kio.Writer{rw},
+			}.Execute()
+			if test.error != "" {
+				if !assert.EqualError(t, err, test.error) {
+					t.FailNow()
+				}
+				// stop rest of test
+				return
+			}
+
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+
+			// check results
+			if !assert.Equal(t,
+				strings.TrimSpace(test.expected),
+				strings.TrimSpace(out.String())) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/fieldspec/gvk.go

@@ -1,6 +1,6 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
-package fsslice
+package fieldspec
 
 import (
 	"strings"

api/filters/fieldspec/gvk_test.go

@@ -1,6 +1,6 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
-package fsslice
+package fieldspec
 
 import (
 	"strings"

api/filters/filtersutil/setters.go

@@ -0,0 +1,33 @@
+package filtersutil
+
+import (
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// SetFn is a function that accepts an RNode to possibly modify.
+type SetFn func(*yaml.RNode) error
+
+// SetScalar returns a SetFn to set a scalar value
+func SetScalar(value string) SetFn {
+	return func(node *yaml.RNode) error {
+		return node.PipeE(yaml.FieldSetter{StringValue: value})
+	}
+}
+
+// SetEntry returns a SetFn to set an entry in a map
+func SetEntry(key, value, tag string) SetFn {
+	n := &yaml.Node{
+		Kind:  yaml.ScalarNode,
+		Value: value,
+		Tag:   tag,
+	}
+	if tag == yaml.NodeTagString && yaml.IsYaml1_1NonString(n) {
+		n.Style = yaml.DoubleQuotedStyle
+	}
+	return func(node *yaml.RNode) error {
+		return node.PipeE(yaml.FieldSetter{
+			Name:  key,
+			Value: yaml.NewRNode(n),
+		})
+	}
+}

api/filters/fsslice/doc.go

@@ -1,6 +1,6 @@
 // Copyright 2020 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-// Package fsslice contains a yaml.Filter to modify a resource using an
-// FsSlice to identify fields to be updated within the resource.
+// Package fsslice contains a yaml.Filter to modify a resource if
+// it matches one or more FieldSpec entries.
 package fsslice

api/filters/fsslice/example_test.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"os"
 
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/filters/fsslice"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
@@ -30,7 +31,7 @@ metadata:
 	}
 	fltr := fsslice.Filter{
 		CreateKind: yaml.ScalarNode,
-		SetValue:   fsslice.SetScalar("green"),
+		SetValue:   filtersutil.SetScalar("green"),
 		FsSlice: []types.FieldSpec{
 			{Path: "a/b", CreateIfNotPresent: true},
 		},

api/filters/fsslice/fsslice.go

@@ -4,48 +4,22 @@
 package fsslice
 
 import (
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// SetFn sets a value
-type SetFn func(*yaml.RNode) error
-
-// SetScalar returns a SetFn to set a scalar value
-func SetScalar(value string) SetFn {
-	return func(node *yaml.RNode) error {
-		return node.PipeE(yaml.FieldSetter{StringValue: value})
-	}
-}
-
-// SetEntry returns a SetFn to set an entry in a map
-func SetEntry(key, value, tag string) SetFn {
-	n := &yaml.Node{
-		Kind:  yaml.ScalarNode,
-		Value: value,
-		Tag:   tag,
-	}
-	if tag == yaml.StringTag && yaml.IsYaml1_1NonString(n) {
-		n.Style = yaml.DoubleQuotedStyle
-	}
-	return func(node *yaml.RNode) error {
-		return node.PipeE(yaml.FieldSetter{
-			Name:  key,
-			Value: yaml.NewRNode(n),
-		})
-	}
-
-}
-
 var _ yaml.Filter = Filter{}
 
-// Filter uses an FsSlice to modify fields on a single object
+// Filter ranges over an FsSlice to modify fields on a single object.
+// An FsSlice is a range of FieldSpecs. A FieldSpec is a GVK plus a path.
 type Filter struct {
 	// FieldSpecList list of FieldSpecs to set
 	FsSlice types.FsSlice `yaml:"fsSlice"`
 
 	// SetValue is called on each field that matches one of the FieldSpecs
-	SetValue SetFn
+	SetValue filtersutil.SetFn
 
 	// CreateKind is used to create fields that do not exist
 	CreateKind yaml.Kind
@@ -59,7 +33,7 @@ func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 		// apply this FieldSpec
 		// create a new filter for each iteration because they
 		// store internal state about the field paths
-		_, err := (&fieldSpecFilter{
+		_, err := (&fieldspec.Filter{
 			FieldSpec:  fltr.FsSlice[i],
 			SetValue:   fltr.SetValue,
 			CreateKind: fltr.CreateKind,

api/filters/fsslice/fsslice_test.go

@@ -9,335 +9,77 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	. "sigs.k8s.io/kustomize/api/filters/fsslice"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 type TestCase struct {
-	name     string
 	input    string
 	expected string
-	filter   fsslice.Filter
+	filter   Filter
 	fsSlice  string
 	error    string
 }
 
-var tests = []TestCase{
-	{
-		name: "update",
+var tests = map[string]TestCase{
+	"empty": {
 		fsSlice: `
-- path: a/b
-  group: foo
-  kind: Bar
 `,
 		input: `
-apiVersion: foo/v1beta1
+apiVersion: foo/v1
 kind: Bar
-a:
-  b: c
 `,
 		expected: `
-apiVersion: foo/v1beta1
+apiVersion: foo/v1
 kind: Bar
-a:
-  b: e
 `,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "update-kind-not-match",
-		fsSlice: `
-- path: a/b
-  group: foo
-  kind: Bar1
-`,
-		input: `
-apiVersion: foo/v1beta1
-kind: Bar2
-a:
-  b: c
-`,
-		expected: `
-apiVersion: foo/v1beta1
-kind: Bar2
-a:
-  b: c
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "update-group-not-match",
-		fsSlice: `
-- path: a/b
-  group: foo1
-  kind: Bar
-`,
-		input: `
-apiVersion: foo2/v1beta1
-kind: Bar
-a:
-  b: c
-`,
-		expected: `
-apiVersion: foo2/v1beta1
-kind: Bar
-a:
-  b: c
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "update-version-not-match",
-		fsSlice: `
-- path: a/b
-  group: foo
-  version: v1beta1
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta2
-kind: Bar
-a:
-  b: c
-`,
-		expected: `
-apiVersion: foo/v1beta2
-kind: Bar
-a:
-  b: c
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "bad-version",
-		fsSlice: `
-- path: a/b
-  group: foo
-  version: v1beta1
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta2/something
-kind: Bar
-a:
-  b: c
-`,
-		expected: `
-apiVersion: foo/v1beta2/something
-kind: Bar
-a:
-  b: c
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "bad-meta",
-		fsSlice: `
-- path: a/b
-  group: foo
-  version: v1beta1
-  kind: Bar
-`,
-		input: `
-a:
-  b: c
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-		error: "missing Resource metadata",
-	},
-
-	{
-		name: "miss-match-type",
-		fsSlice: `
-- path: a/b/c
-  kind: Bar
-`,
-		input: `
-kind: Bar
-a:
-  b: a
-`,
-		error: "obj kind: Bar\na:\n  b: a\n at path a/b/c: unsupported yaml node",
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	{
-		name: "add",
-		fsSlice: `
-- path: a/b/c/d
-  group: foo
-  create: true
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta1
-kind: Bar
-a: {}
-`,
-		expected: `
-apiVersion: foo/v1beta1
-kind: Bar
-a: {b: {c: {d: e}}}
-`,
-		filter: fsslice.Filter{
-			SetValue:   fsslice.SetScalar("e"),
+		filter: Filter{
+			SetValue:   filtersutil.SetScalar("e"),
 			CreateKind: yaml.ScalarNode,
 		},
 	},
-
-	{
-		name: "update-in-sequence",
-		fsSlice: `
-- path: a/b[]/c/d
-  group: foo
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta1
-kind: Bar
-a:
-  b:
-  - c:
-      d: a
-`,
-		expected: `
-apiVersion: foo/v1beta1
-kind: Bar
-a:
-  b:
-  - c:
-      d: e
-`,
-		filter: fsslice.Filter{
-			SetValue: fsslice.SetScalar("e"),
-		},
-	},
-
-	// Don't create a sequence
-	{
-		name: "empty-sequence-no-create",
-		fsSlice: `
-- path: a/b[]/c/d
-  group: foo
-  create: true
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta1
-kind: Bar
-a: {}
-`,
-		expected: `
-apiVersion: foo/v1beta1
-kind: Bar
-a: {}
-`,
-		filter: fsslice.Filter{
-			SetValue:   fsslice.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
-		},
-	},
-
-	// Create a new field for an element in a sequence
-	{
-		name: "empty-sequence-create",
-		fsSlice: `
-- path: a/b[]/c/d
-  group: foo
-  create: true
-  kind: Bar
-`,
-		input: `
-apiVersion: foo/v1beta1
-kind: Bar
-a:
-  b:
-  - c: {}
-`,
-		expected: `
-apiVersion: foo/v1beta1
-kind: Bar
-a:
-  b:
-  - c: {d: e}
-`,
-		filter: fsslice.Filter{
-			SetValue:   fsslice.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
-		},
-	},
-
-	{
-		name: "group v1",
+	"two": {
 		fsSlice: `
 - path: a/b
-  group: v1
+  group: foo
+  version: v1
   create: true
   kind: Bar
-`,
-		input: `
-apiVersion: v1
-kind: Bar
-`,
-		expected: `
-apiVersion: v1
-kind: Bar
-`,
-		filter: fsslice.Filter{
-			SetValue:   fsslice.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
-		},
-	},
-
-	{
-		name: "version v1",
-		fsSlice: `
-- path: a/b
+- path: q/r[]/s/t
+  group: foo
   version: v1
   create: true
   kind: Bar
 `,
 		input: `
-apiVersion: v1
+apiVersion: foo/v1
 kind: Bar
+q:
+  r:
+  - s: {}
 `,
 		expected: `
-apiVersion: v1
+apiVersion: foo/v1
 kind: Bar
+q:
+  r:
+  - s: {t: e}
 a:
   b: e
 `,
-		filter: fsslice.Filter{
-			SetValue:   fsslice.SetScalar("e"),
+		filter: Filter{
+			SetValue:   filtersutil.SetScalar("e"),
 			CreateKind: yaml.ScalarNode,
 		},
 	},
 }
 
-func TestFilter_Filter(t *testing.T) {
-	for i := range tests {
-		test := tests[i]
-		t.Run(test.name, func(t *testing.T) {
+func TestFilter(t *testing.T) {
+	for name := range tests {
+		test := tests[name]
+		t.Run(name, func(t *testing.T) {
 			err := yaml.Unmarshal([]byte(test.fsSlice), &test.filter.FsSlice)
 			if !assert.NoError(t, err) {
 				t.FailNow()

api/filters/imagetag/imagetag.go

@@ -4,17 +4,24 @@
 package imagetag
 
 import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/filters/fsslice"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
+// Filter modifies an "image tag", the value used to specify the
+// name, tag, version digest etc. of (docker) container images
+// used by a pod template.
 type Filter struct {
 	// imageTag is the tag we want to apply to the inputs
+	// The name of the image is used as a key, and other fields
+	// can specify a new name, tag, etc.
 	ImageTag types.Image `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
 
-	// FsSlice contains the FieldSpecs to locate the namespace field
+	// FsSlice contains the FieldSpecs to locate an image field,
+	// e.g. Path: "spec/myContainers[]/image"
 	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
@@ -26,6 +33,12 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 }
 
 func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
+	// FsSlice is an allowlist, not a denyList, so to deny
+	// something via configuration a new config mechanism is
+	// needed. Until then, hardcode it.
+	if f.isOnDenyList(node) {
+		return node, nil
+	}
 	if err := node.PipeE(fsslice.Filter{
 		FsSlice:  f.FsSlice,
 		SetValue: updateImageTagFn(f.ImageTag),
@@ -35,7 +48,19 @@ func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
 	return node, nil
 }
 
-func updateImageTagFn(imageTag types.Image) fsslice.SetFn {
+func (f Filter) isOnDenyList(node *yaml.RNode) bool {
+	meta, err := node.GetMeta()
+	if err != nil {
+		// A missing 'meta' field will cause problems elsewhere;
+		// ignore it here to keep the signature simple.
+		return false
+	}
+	// Ignore CRDs
+	// https://github.com/kubernetes-sigs/kustomize/issues/890
+	return meta.Kind == `CustomResourceDefinition`
+}
+
+func updateImageTagFn(imageTag types.Image) filtersutil.SetFn {
 	return func(node *yaml.RNode) error {
 		return node.PipeE(imageTagUpdater{
 			ImageTag: imageTag,

api/filters/imagetag/imagetag_test.go

@@ -19,6 +19,162 @@ func TestImageTagUpdater_Filter(t *testing.T) {
 		filter         Filter
 		fsSlice        types.FsSlice
 	}{
+		"ignore CustomResourceDefinition": {
+			input: `
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: whatever
+spec:
+  containers:
+  - image: whatever
+`,
+			expectedOutput: `
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: whatever
+spec:
+  containers:
+  - image: whatever
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "whatever",
+					NewName: "theImageShouldNotChangeInACrd",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+			},
+		},
+
+		"legacy multiple images in containers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: nginx:2.1.2
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache@12345
+  - image: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+			},
+		},
+		"legacy both containers and initContainers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: nginx:1.2.1
+  - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: apache:3.2.1
+  - image: apache:1.2.3
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+				{
+					Path: "spec/initContainers/image",
+				},
+			},
+		},
+		"legacy updates at multiple depths": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec:
+      initContainers:
+      - image: nginx:1.2.1
+      - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec:
+      initContainers:
+      - image: apache:3.2.1
+      - image: apache:1.2.3
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers/image",
+				},
+			},
+		},
 		"update with digest": {
 			input: `
 apiVersion: example.com/v1
@@ -49,6 +205,7 @@ spec:
 				},
 			},
 		},
+
 		"multiple matches in sequence": {
 			input: `
 apiVersion: example.com/v1
@@ -85,6 +242,422 @@ spec:
 				},
 			},
 		},
+
+		"new Tag": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:v2
+        name: nginx-tagged
+      - image: nginx:v2
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx:v2
+        name: nginx-notag
+      - image: nginx:v2
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					NewTag: "v2",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newImage": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox:1.7.9
+        name: nginx-tagged
+      - image: busybox:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox
+        name: nginx-notag
+      - image: busybox@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newImageAndTag": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox:v3
+        name: nginx-tagged
+      - image: busybox:v3
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox:v3
+        name: nginx-notag
+      - image: busybox:v3
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+					NewTag:  "v3",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newDigest": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx@sha256:222222222222222222
+        name: nginx-tagged
+      - image: nginx@sha256:222222222222222222
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx@sha256:222222222222222222
+        name: nginx-notag
+      - image: nginx@sha256:222222222222222222
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					Digest: "sha256:222222222222222222",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers/image",
+				},
+			},
+		},
+		"newImageAndDigest": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox@sha256:222222222222222222
+        name: nginx-tagged
+      - image: busybox@sha256:222222222222222222
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox@sha256:222222222222222222
+        name: nginx-notag
+      - image: busybox@sha256:222222222222222222
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+					Digest:  "sha256:222222222222222222",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"emptyContainers": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  containers:
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  containers: []
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					NewTag: "v2",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers[]/image",
+					//					CreateIfNotPresent: true,
+				},
+			},
+		},
+		"tagWithBraces": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: some.registry.io/my-image:{GENERATED_TAG}
+        name: my-image
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: some.registry.io/my-image:my-fixed-tag
+        name: my-image
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "some.registry.io/my-image",
+					NewTag: "my-fixed-tag",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/filters/labels/labels.go

@@ -30,10 +30,11 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
-					FsSlice:    f.FsSlice,
-					SetValue:   fsslice.SetEntry(k, f.Labels[k], yaml.StringTag),
+					FsSlice: f.FsSlice,
+					SetValue: filtersutil.SetEntry(
+						k, f.Labels[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Labels are MappingNodes.
-					CreateTag:  "!!map",
+					CreateTag:  yaml.NodeTagMap,
 				}); err != nil {
 					return nil, err
 				}

api/filters/nameref/doc.go

@@ -0,0 +1,3 @@
+// Package nameref contains a kio.Filter implementation of the kustomize
+// name reference transformer.
+package nameref

api/filters/nameref/nameref.go

@@ -0,0 +1,214 @@
+package nameref
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter will update the name reference
+type Filter struct {
+	FieldSpec          types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+	Referrer           *resource.Resource
+	Target             resid.Gvk
+	ReferralCandidates resmap.ResMap
+}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
+}
+
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec: f.FieldSpec,
+		SetValue:  f.set,
+	})
+	return node, err
+}
+
+func (f Filter) set(node *yaml.RNode) error {
+	if yaml.IsMissingOrNull(node) {
+		return nil
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		return f.setScalar(node)
+	case yaml.MappingNode:
+		// Kind: ValidatingWebhookConfiguration
+		// FieldSpec is webhooks/clientConfig/service
+		return f.setMapping(node)
+	case yaml.SequenceNode:
+		return f.setSequence(node)
+	default:
+		return fmt.Errorf(
+			"node is expected to be either a string or a slice of string or a map of string")
+	}
+}
+
+func (f Filter) setSequence(node *yaml.RNode) error {
+	return applyFilterToSeq(seqFilter{
+		setScalarFn:  f.setScalar,
+		setMappingFn: f.setMapping,
+	}, node)
+}
+
+func (f Filter) setMapping(node *yaml.RNode) error {
+	return setNameAndNs(
+		node,
+		f.Referrer,
+		f.Target,
+		f.ReferralCandidates,
+	)
+}
+
+func (f Filter) setScalar(node *yaml.RNode) error {
+	newValue, err := getSimpleNameField(
+		node.YNode().Value,
+		f.Referrer,
+		f.Target,
+		f.ReferralCandidates,
+		f.ReferralCandidates.Resources(),
+	)
+	if err != nil {
+		return err
+	}
+	err = filtersutil.SetScalar(newValue)(node)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// selectReferral picks the referral among a subset of candidates.
+// It returns the current name and namespace of the selected candidate.
+// Note that the content of the referricalCandidateSubset slice is most of the time
+// identical to the referralCandidates resmap. Still in some cases, such
+// as ClusterRoleBinding, the subset only contains the resources of a specific
+// namespace.
+func selectReferral(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (string, string, error) {
+
+	for _, res := range referralCandidateSubset {
+		id := res.OrgId()
+		if id.IsSelected(&target) && res.GetOriginalName() == oldName {
+			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
+			// If there's more than one match, there's no way
+			// to know which one to pick, so emit error.
+			if len(matches) > 1 {
+				return "", "", fmt.Errorf(
+					"multiple matches for %s:\n  %v",
+					id, getIds(matches))
+			}
+			// In the resource, note that it is referenced
+			// by the referrer.
+			res.AppendRefBy(referrer.CurId())
+			// Return transformed name of the object,
+			// complete with prefixes, hashes, etc.
+			return res.GetName(), res.GetNamespace(), nil
+		}
+	}
+
+	return oldName, "", nil
+}
+
+// utility function to replace a simple string by the new name
+func getSimpleNameField(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (string, error) {
+
+	newName, _, err := selectReferral(oldName, referrer, target,
+		referralCandidates, referralCandidateSubset)
+
+	return newName, err
+}
+
+func getIds(rs []*resource.Resource) []string {
+	var result []string
+	for _, r := range rs {
+		result = append(result, r.CurId().String()+"\n")
+	}
+	return result
+}
+
+// utility function to replace name field within a map RNode
+// and leverage the namespace field.
+func setNameAndNs(
+	in *yaml.RNode,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap) error {
+
+	if in.YNode().Kind != yaml.MappingNode {
+		return fmt.Errorf("expect a mapping node")
+	}
+
+	// Get name field
+	nameNode, err := in.Pipe(yaml.FieldMatcher{
+		Name: "name",
+	})
+	if err != nil || nameNode == nil {
+		return fmt.Errorf("cannot find field 'name' in node")
+	}
+
+	// Get namespace field
+	namespaceNode, err := in.Pipe(yaml.FieldMatcher{
+		Name: "namespace",
+	})
+	if err != nil {
+		return fmt.Errorf("error when find field 'namespace'")
+	}
+
+	// check is namespace matched
+	// name will bot be updated if the namespace doesn't match
+	subset := referralCandidates.Resources()
+	if namespaceNode != nil {
+		namespace := namespaceNode.YNode().Value
+		bynamespace := referralCandidates.GroupedByOriginalNamespace()
+		if _, ok := bynamespace[namespace]; !ok {
+			return nil
+		}
+		subset = bynamespace[namespace]
+	}
+
+	oldName := nameNode.YNode().Value
+	newname, newnamespace, err := selectReferral(oldName, referrer, target,
+		referralCandidates, subset)
+	if err != nil {
+		return err
+	}
+
+	if (newname == oldName) && (newnamespace == "") {
+		// no candidate found.
+		return nil
+	}
+
+	// set name
+	in.Pipe(yaml.FieldSetter{
+		Name:        "name",
+		StringValue: newname,
+	})
+	if newnamespace != "" {
+		// We don't want value "" to replace value "default" since
+		// the empty string is handled as a wild card here not default namespace
+		// by kubernetes.
+		in.Pipe(yaml.FieldSetter{
+			Name:        "namespace",
+			StringValue: newnamespace,
+		})
+	}
+	return nil
+}

api/filters/nameref/nameref_test.go

@@ -0,0 +1,333 @@
+package nameref
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestNamerefFilter(t *testing.T) {
+	testCases := map[string]struct {
+		input         string
+		candidates    string
+		expected      string
+		filter        Filter
+		originalNames []string
+	}{
+		"simple scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+seq:
+- oldName1
+- oldName2
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName1", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+seq:
+- newName
+- oldName2
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "seq"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"mapping": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "map"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"mapping with namespace": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: oldName
+  namespace: oldNs
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+  namespace: oldNs
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: newName
+  namespace: oldNs
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "map"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			factory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+			referrer, err := factory.FromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatal(err)
+			}
+			tc.filter.Referrer = referrer
+
+			resMapFactory := resmap.NewFactory(factory, nil)
+			candidatesRes, err := factory.SliceFromBytesWithNames(
+				tc.originalNames, []byte(tc.candidates))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			candidates := resMapFactory.FromResourceSlice(candidatesRes)
+			tc.filter.ReferralCandidates = candidates
+
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestNamerefFilterUnhappy(t *testing.T) {
+	testCases := map[string]struct {
+		input         string
+		candidates    string
+		expected      string
+		filter        Filter
+		originalNames []string
+	}{
+		"invalid node type": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: null
+`,
+			candidates:    "",
+			originalNames: []string{},
+			expected:      "obj '' at path 'ref/name': node is expected to be either a string or a slice of string or a map of string",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"multiple match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"no name": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  notName: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			factory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+			referrer, err := factory.FromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatal(err)
+			}
+			tc.filter.Referrer = referrer
+
+			resMapFactory := resmap.NewFactory(factory, nil)
+			candidatesRes, err := factory.SliceFromBytesWithNames(
+				tc.originalNames, []byte(tc.candidates))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			candidates := resMapFactory.FromResourceSlice(candidatesRes)
+			tc.filter.ReferralCandidates = candidates
+
+			_, err = filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			if err == nil {
+				t.Fatalf("expect an error")
+			}
+			if tc.expected != "" && !assert.EqualError(t, err, tc.expected) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/nameref/seqfilter.go

@@ -0,0 +1,57 @@
+package nameref
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type setFn func(*yaml.RNode) error
+
+type seqFilter struct {
+	setScalarFn  setFn
+	setMappingFn setFn
+}
+
+func (sf seqFilter) Filter(node *yaml.RNode) (*yaml.RNode, error) {
+	if yaml.IsMissingOrNull(node) {
+		return node, nil
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		// Kind: Role/ClusterRole
+		// FieldSpec is rules.resourceNames
+		err := sf.setScalarFn(node)
+		return node, err
+	case yaml.MappingNode:
+		// Kind: RoleBinding/ClusterRoleBinding
+		// FieldSpec is subjects
+		// Note: The corresponding fieldSpec had been changed from
+		// from path: subjects/name to just path: subjects. This is
+		// what get mutatefield to request the mapping of the whole
+		// map containing namespace and name instead of just a simple
+		// string field containing the name
+		err := sf.setMappingFn(node)
+		return node, err
+	default:
+		return node, fmt.Errorf(
+			"%#v is expected to be either a string or a map of string", node)
+	}
+}
+
+// applyFilterToSeq will apply the filter to each element in the sequence node
+func applyFilterToSeq(filter yaml.Filter, node *yaml.RNode) error {
+	if node.YNode().Kind != yaml.SequenceNode {
+		return fmt.Errorf("expect a sequence node but got %v", node.YNode().Kind)
+	}
+
+	for _, elem := range node.Content() {
+		rnode := yaml.NewRNode(elem)
+		err := rnode.PipeE(filter)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

api/filters/nameref/seqfilter_test.go

@@ -0,0 +1,80 @@
+package nameref
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func SeqFilter(node *yaml.RNode) (*yaml.RNode, error) {
+	if node.YNode().Value == "aaa" {
+		node.YNode().SetString("ccc")
+	}
+	return node, nil
+}
+
+func TestApplyFilterToSeq(t *testing.T) {
+	fltr := yaml.FilterFunc(SeqFilter)
+
+	testCases := map[string]struct {
+		input  string
+		expect string
+	}{
+		"replace in seq": {
+			input: `
+- aaa
+- bbb`,
+			expect: `
+- ccc
+- bbb`,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			node, err := yaml.Parse(tc.input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = applyFilterToSeq(fltr, node)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expect),
+				strings.TrimSpace(node.MustString())) {
+				t.Fatalf("expect:\n%s\nactual:\n%s",
+					strings.TrimSpace(tc.expect),
+					strings.TrimSpace(node.MustString()))
+			}
+		})
+	}
+}
+
+func TestApplyFilterToSeqUnhappy(t *testing.T) {
+	fltr := yaml.FilterFunc(SeqFilter)
+
+	testCases := map[string]struct {
+		input string
+	}{
+		"replace in seq": {
+			input: `
+aaa`,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			node, err := yaml.Parse(tc.input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = applyFilterToSeq(fltr, node)
+			if err == nil {
+				t.Fatalf("expect an error")
+			}
+		})
+	}
+}

api/filters/namespace/namespace.go

@@ -4,6 +4,8 @@
 package namespace
 
 import (
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/filters/fsslice"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
@@ -42,9 +44,9 @@ func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 	// transformations based on data -- :)
 	err := node.PipeE(fsslice.Filter{
 		FsSlice:    ns.FsSlice,
-		SetValue:   fsslice.SetScalar(ns.Namespace),
+		SetValue:   filtersutil.SetScalar(ns.Namespace),
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
-		CreateTag:  yaml.StringTag,
+		CreateTag:  yaml.NodeTagString,
 	})
 	return node, err
 }
@@ -73,7 +75,7 @@ func (ns Filter) hacks(obj *yaml.RNode) error {
 // if they are cluster scoped through either an annotation on the resources,
 // or through inlined OpenAPI on the resource as a YAML comment.
 func (ns Filter) metaNamespaceHack(obj *yaml.RNode, meta yaml.ResourceMeta) error {
-	gvk := fsslice.GetGVK(meta)
+	gvk := fieldspec.GetGVK(meta)
 	if !gvk.IsNamespaceableKind() {
 		return nil
 	}
@@ -81,7 +83,7 @@ func (ns Filter) metaNamespaceHack(obj *yaml.RNode, meta yaml.ResourceMeta) erro
 		FsSlice: []types.FieldSpec{
 			{Path: types.MetadataNamespacePath, CreateIfNotPresent: true},
 		},
-		SetValue:   fsslice.SetScalar(ns.Namespace),
+		SetValue:   filtersutil.SetScalar(ns.Namespace),
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
 	}
 	_, err := f.Filter(obj)

api/filters/prefixsuffix/example_test.go

@@ -9,12 +9,11 @@ import (
 	"os"
 
 	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
-	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 )
 
 func ExampleFilter() {
-	fss := builtinconfig.MakeDefaultConfig().NamePrefix
 	err := kio.Pipeline{
 		Inputs: []kio.Reader{&kio.ByteReader{Reader: bytes.NewBufferString(`
 apiVersion: example.com/v1
@@ -27,7 +26,8 @@ kind: Bar
 metadata:
   name: instance
 `)}},
-		Filters: []kio.Filter{prefixsuffix.Filter{Prefix: "baz-", FsSlice: fss}},
+		Filters: []kio.Filter{prefixsuffix.Filter{
+			Prefix: "baz-", FieldSpec: types.FieldSpec{Path: "metadata/name"}}},
 		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},
 	}.Execute()
 	if err != nil {

api/filters/prefixsuffix/prefixsuffix.go

@@ -6,7 +6,8 @@ package prefixsuffix
 import (
 	"fmt"
 
-	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -17,28 +18,26 @@ type Filter struct {
 	Prefix string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
 	Suffix string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
 
-	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
 }
 
 var _ kio.Filter = Filter{}
 
-func (ns Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
-	return kio.FilterAll(yaml.FilterFunc(ns.run)).Filter(nodes)
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
 }
 
-// Run runs the filter on a single node rather than a slice
-func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	// transformations based on data -- :)
-	err := node.PipeE(fsslice.Filter{
-		FsSlice:    ns.FsSlice,
-		SetValue:   ns.set,
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec:  f.FieldSpec,
+		SetValue:   f.evaluateField,
 		CreateKind: yaml.ScalarNode, // Name is a ScalarNode
-		CreateTag:  yaml.StringTag,
+		CreateTag:  yaml.NodeTagString,
 	})
 	return node, err
 }
 
-func (ns Filter) set(node *yaml.RNode) error {
-	return fsslice.SetScalar(fmt.Sprintf(
-		"%s%s%s", ns.Prefix, node.YNode().Value, ns.Suffix))(node)
+func (f Filter) evaluateField(node *yaml.RNode) error {
+	return filtersutil.SetScalar(fmt.Sprintf(
+		"%s%s%s", f.Prefix, node.YNode().Value, f.Suffix))(node)
 }

api/filters/prefixsuffix/prefixsuffix_test.go

@@ -9,14 +9,12 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
-	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-var tests = []TestCase{
-	{
-		name: "prefix",
+var tests = map[string]TestCase{
+	"prefix": {
 		input: `
 apiVersion: example.com/v1
 kind: Foo
@@ -40,10 +38,10 @@ metadata:
   name: foo-instance
 `,
 		filter: prefixsuffix.Filter{Prefix: "foo-"},
+		fs:     types.FieldSpec{Path: "metadata/name"},
 	},
 
-	{
-		name: "suffix",
+	"suffix": {
 		input: `
 apiVersion: example.com/v1
 kind: Foo
@@ -67,10 +65,10 @@ metadata:
   name: instance-foo
 `,
 		filter: prefixsuffix.Filter{Suffix: "-foo"},
+		fs:     types.FieldSpec{Path: "metadata/name"},
 	},
 
-	{
-		name: "prefix-suffix",
+	"prefix-suffix": {
 		input: `
 apiVersion: example.com/v1
 kind: Foo
@@ -94,10 +92,10 @@ metadata:
   name: bar-instance-foo
 `,
 		filter: prefixsuffix.Filter{Prefix: "bar-", Suffix: "-foo"},
+		fs:     types.FieldSpec{Path: "metadata/name"},
 	},
 
-	{
-		name: "data-fieldspecs",
+	"data-fieldspecs": {
 		input: `
 apiVersion: example.com/v1
 kind: Foo
@@ -119,7 +117,7 @@ a:
 apiVersion: example.com/v1
 kind: Foo
 metadata:
-  name: foo-instance
+  name: instance
 a:
   b:
     c: foo-d
@@ -127,35 +125,28 @@ a:
 apiVersion: example.com/v1
 kind: Bar
 metadata:
-  name: foo-instance
+  name: instance
 a:
   b:
     c: foo-d
 `,
 		filter: prefixsuffix.Filter{Prefix: "foo-"},
-		fsslice: []types.FieldSpec{
-			{
-				Path: "a/b/c",
-			},
-		},
+		fs:     types.FieldSpec{Path: "a/b/c"},
 	},
 }
 
 type TestCase struct {
-	name     string
 	input    string
 	expected string
 	filter   prefixsuffix.Filter
-	fsslice  types.FsSlice
+	fs       types.FieldSpec
 }
 
-var config = builtinconfig.MakeDefaultConfig()
-
 func TestFilter(t *testing.T) {
-	for i := range tests {
-		test := tests[i]
-		t.Run(test.name, func(t *testing.T) {
-			test.filter.FsSlice = append(config.NamePrefix, test.fsslice...)
+	for name := range tests {
+		test := tests[name]
+		t.Run(name, func(t *testing.T) {
+			test.filter.FieldSpec = test.fs
 			if !assert.Equal(t,
 				strings.TrimSpace(test.expected),
 				strings.TrimSpace(

api/filters/refvar/doc.go

@@ -0,0 +1,3 @@
+// Package refvar contains a kio.Filter implementation of the kustomize
+// refvar transformer.
+package refvar

api/filters/refvar/refvar.go

@@ -0,0 +1,104 @@
+package refvar
+
+import (
+	"fmt"
+	"strconv"
+
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+)
+
+// Filter updates $(VAR) style variables with values.
+// The fieldSpecs are the places to look for occurrences of $(VAR).
+type Filter struct {
+	MappingFunc func(string) interface{} `json:"mappingFunc,omitempty" yaml:"mappingFunc,omitempty"`
+	FieldSpec   types.FieldSpec          `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
+}
+
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec: f.FieldSpec,
+		SetValue:  f.set,
+	})
+	return node, err
+}
+
+func (f Filter) set(node *yaml.RNode) error {
+	if yaml.IsMissingOrNull(node) {
+		return nil
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		return f.setScalar(node)
+	case yaml.MappingNode:
+		return f.setMap(node)
+	case yaml.SequenceNode:
+		return f.setSeq(node)
+	default:
+		return fmt.Errorf("invalid type encountered %v", node.YNode().Kind)
+	}
+}
+
+func updateNodeValue(node *yaml.Node, newValue interface{}) {
+	switch newValue := newValue.(type) {
+	case int64:
+		node.Value = strconv.FormatInt(newValue, 10)
+		node.Tag = yaml.NodeTagInt
+	case bool:
+		node.SetString(strconv.FormatBool(newValue))
+		node.Tag = yaml.NodeTagBool
+	case float64:
+		node.SetString(strconv.FormatFloat(newValue, 'f', -1, 64))
+		node.Tag = yaml.NodeTagFloat
+	default:
+		node.SetString(newValue.(string))
+		node.Tag = yaml.NodeTagString
+	}
+	node.Style = 0
+}
+
+func (f Filter) setScalar(node *yaml.RNode) error {
+	if node.YNode().Kind != yaml.ScalarNode || node.YNode().Tag != yaml.NodeTagString {
+		// Only process string values
+		return nil
+	}
+	v := expansion2.Expand(node.YNode().Value, f.MappingFunc)
+	updateNodeValue(node.YNode(), v)
+	return nil
+}
+
+func (f Filter) setMap(node *yaml.RNode) error {
+	contents := node.YNode().Content
+	for i := 0; i < len(contents); i += 2 {
+		if contents[i].Kind != yaml.ScalarNode || contents[i].Tag != yaml.NodeTagString {
+			return fmt.Errorf("invalid map key: %s, type: %s", contents[i].Value, contents[i].Tag)
+		}
+		if contents[i+1].Kind != yaml.ScalarNode || contents[i+1].Tag != yaml.NodeTagString {
+			// value is not a string
+			continue
+		}
+		newValue := expansion2.Expand(contents[i+1].Value, f.MappingFunc)
+		updateNodeValue(contents[i+1], newValue)
+	}
+	return nil
+}
+
+func (f Filter) setSeq(node *yaml.RNode) error {
+	for _, item := range node.YNode().Content {
+		if item.Kind != yaml.ScalarNode || item.Tag != yaml.NodeTagString {
+			// value is not a string
+			return fmt.Errorf("invalid value type expect a string")
+		}
+		newValue := expansion2.Expand(item.Value, f.MappingFunc)
+		updateNodeValue(item, newValue)
+	}
+	return nil
+}

api/filters/refvar/refvar_test.go

@@ -0,0 +1,287 @@
+package refvar
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestFilter(t *testing.T) {
+	replacementCounts := make(map[string]int)
+
+	testCases := map[string]struct {
+		input    string
+		expected string
+		filter   Filter
+	}{
+		"simple scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: $(VAR)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 5`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
+			},
+		},
+		"non-string scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
+			},
+		},
+		"wrong path": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "a/b/c"},
+			},
+		},
+		"sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+- $(FOO)
+- $(BAR)
+- $(BAZ)
+- $(FOO)+$(BAR)
+- $(BOOL)
+- $(FLOAT)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+- foo
+- bar
+- $(BAZ)
+- foo+bar
+- false
+- 1.23`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO":   "foo",
+					"BAR":   "bar",
+					"BOOL":  false,
+					"FLOAT": 1.23,
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+		"maps": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: $(FOO)
+  BAR: $(BAR)
+  BAZ: $(BAZ)
+  PLUS: $(FOO)+$(BAR)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: foo
+  BAR: bar
+  BAZ: $(BAZ)
+  PLUS: foo+bar`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO": "foo",
+					"BAR": "bar",
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+		"complicated case": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice1:
+  - $(FOO)
+  slice2:
+    FOO: $(FOO)
+    BAR: $(BAR)
+    BOOL: false
+    INT: 0
+    SLICE:
+    - $(FOO)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice1:
+  - $(FOO)
+  slice2:
+    FOO: foo
+    BAR: bar
+    BOOL: false
+    INT: 0
+    SLICE:
+    - $(FOO)`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO": "foo",
+					"BAR": "bar",
+				}),
+				FieldSpec: types.FieldSpec{Path: "data/slice2"},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestFilterUnhappy(t *testing.T) {
+	replacementCounts := make(map[string]int)
+
+	testCases := map[string]struct {
+		input         string
+		expectedError string
+		filter        Filter
+	}{
+		"non-string in sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice:
+  - false`,
+			expectedError: `obj 'apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+  annotations:
+    config.kubernetes.io/index: '0'
+data:
+  slice:
+  - false
+' at path 'data/slice': invalid value type expect a string`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "data/slice"},
+			},
+		},
+		"invalid key in map": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  1: str`,
+			expectedError: `obj 'apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+  annotations:
+    config.kubernetes.io/index: '0'
+data:
+  1: str
+' at path 'data': invalid map key: 1, type: ` + yaml.NodeTagInt,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+		"null input": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: null`,
+			expectedError: "obj '' at path 'data/FOO': invalid type encountered 0",
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{}),
+				FieldSpec:   types.FieldSpec{Path: "data/FOO"},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			_, err := filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			if !assert.EqualError(t, err, tc.expectedError) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/replicacount/example_test.go

@@ -33,10 +33,8 @@ spec:
 				Count: 42,
 				Name:  "instance",
 			},
-			FsSlice: types.FsSlice{
-				{
-					Path: "spec/template/replicas",
-				},
+			FieldSpec: types.FieldSpec{
+				Path: "spec/template/replicas",
 			},
 		}},
 		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},

api/filters/replicacount/replicacount.go

@@ -3,7 +3,8 @@ package replicacount
 import (
 	"strconv"
 
-	"sigs.k8s.io/kustomize/api/filters/fsslice"
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -11,10 +12,8 @@ import (
 
 // Filter updates/sets replicas fields using the fieldSpecs
 type Filter struct {
-	Replica types.Replica `json:"replica,omitempty" yaml:"replica,omitempty"`
-
-	// FsSlice contains the FieldSpecs to locate the namespace field
-	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+	Replica   types.Replica   `json:"replica,omitempty" yaml:"replica,omitempty"`
+	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
 }
 
 var _ kio.Filter = Filter{}
@@ -23,27 +22,16 @@ func (rc Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(rc.run)).Filter(nodes)
 }
 
-// run processes each node individually.
 func (rc Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	meta, err := node.GetMeta()
-	if err != nil {
-		return nil, err
-	}
-
-	// only update resources where the name matches the Replica name.
-	if meta.Name != rc.Replica.Name {
-		return node, nil
-	}
-
-	err = node.PipeE(fsslice.Filter{
-		FsSlice:    rc.FsSlice,
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec:  rc.FieldSpec,
 		SetValue:   rc.set,
 		CreateKind: yaml.ScalarNode, // replicas is a ScalarNode
-		CreateTag:  yaml.IntTag,
+		CreateTag:  yaml.NodeTagInt,
 	})
 	return node, err
 }
 
 func (rc Filter) set(node *yaml.RNode) error {
-	return fsslice.SetScalar(strconv.FormatInt(rc.Replica.Count, 10))(node)
+	return filtersutil.SetScalar(strconv.FormatInt(rc.Replica.Count, 10))(node)
 }

api/filters/replicacount/replicacount_test.go

@@ -5,19 +5,16 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
 func TestFilter(t *testing.T) {
-	var config = builtinconfig.MakeDefaultConfig()
 
 	testCases := map[string]struct {
 		input    string
 		expected string
 		filter   Filter
-		fsslice  types.FsSlice
 	}{
 		"update field": {
 			input: `
@@ -41,11 +38,7 @@ spec:
 					Name:  "dep",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
-					Path: "spec/replicas",
-				},
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
 			},
 		},
 		"add field": {
@@ -73,9 +66,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path:               "spec/template/replicas",
 					CreateIfNotPresent: true,
 				},
@@ -108,9 +99,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path:               "spec/template/replicas",
 					CreateIfNotPresent: true,
 				},
@@ -140,9 +129,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path: "spec/template/replicas",
 				},
 			},
@@ -154,7 +141,6 @@ kind: Custom
 metadata:
   name: cus
 spec:
-  replicas: 5
   template:
     replicas: 5
 `,
@@ -164,7 +150,6 @@ kind: Custom
 metadata:
   name: cus
 spec:
-  replicas: 42
   template:
     replicas: 42
 `,
@@ -173,21 +158,13 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
-					Path: "spec/template/replicas",
-				},
-				{
-					Path: "spec/replicas",
-				},
+				FieldSpec: types.FieldSpec{Path: "spec/template/replicas"},
 			},
 		},
 	}
 
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			tc.filter.FsSlice = append(config.Replicas, tc.fsslice...)
 			if !assert.Equal(t,
 				strings.TrimSpace(tc.expected),
 				strings.TrimSpace(

api/go.mod

@@ -16,6 +16,8 @@ require (
 	k8s.io/apimachinery v0.17.0
 	k8s.io/client-go v0.17.0
 	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
-	sigs.k8s.io/kustomize/kyaml v0.3.4
+	sigs.k8s.io/kustomize/kyaml v0.5.0
 	sigs.k8s.io/yaml v1.2.0
 )
+
+replace sigs.k8s.io/kustomize/kyaml v0.5.0 => ../kyaml

api/go.sum

@@ -239,6 +239,7 @@ github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoD
 github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
 github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
@@ -438,6 +439,7 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392 h1:ACG4HJsFiNMf47Y4PeRoebLNy/2lXT9EtprMuTFWt1M=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -464,11 +466,11 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -499,6 +501,7 @@ golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -554,8 +557,8 @@ gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71 h1:Xe2gvTZUJpsvOWUnvmL/tmhVBZUmHSvLbMjRj6NUUKo=
+gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
@@ -573,6 +576,7 @@ k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a h1:UcxjrRMyNx/i/y8G7kPvLyy7rfbeuf1PYyBf973pgyU=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/utils v0.0.0-20191114184206-e782cd3c129f h1:GiPwtSzdP43eI1hpPCbROQCCIgCuiMMNF8YUVLF3vJo=
 k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed h1:WX1yoOaKQfddO/mLzdV4wptyWgoH/6hwLs7QHTixo0I=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
@@ -580,8 +584,6 @@ mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b h1:DxJ5nJdkhDlLok9K6qO+5290kphD
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f h1:Cq7MalBHYACRd6EesksG1Q8EoIAKOsiZviGKbOLIej4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.3.4 h1:RhxnabYltv4mdD5+I7pIaJtae+eaTn4TiZqPT7K+C7A=
-sigs.k8s.io/kustomize/kyaml v0.3.4/go.mod h1:XJL84E6sOFeNrQ7CADiemc1B0EjIxHo3OhW4o1aJYNw=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=

api/hasher/hasher.go

@@ -8,6 +8,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"sort"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // SortArrayAndComputeHash sorts a string array and
@@ -50,3 +52,105 @@ func Encode(hex string) (string, error) {
 func Hash(data string) string {
 	return fmt.Sprintf("%x", sha256.Sum256([]byte(data)))
 }
+
+// HashRNode returns the hash value of input RNode
+func HashRNode(node *yaml.RNode) (string, error) {
+	// get node kind
+	kindNode, err := node.Pipe(yaml.FieldMatcher{Name: "kind"})
+	if err != nil {
+		return "", err
+	}
+	kind := kindNode.YNode().Value
+
+	// calculate hash for different kinds
+	encoded := ""
+	switch kind {
+	case "ConfigMap":
+		encoded, err = encodeConfigMap(node)
+	case "Secret":
+		encoded, err = encodeSecret(node)
+	default:
+		var encodedBytes []byte
+		encodedBytes, err = json.Marshal(node.YNode())
+		encoded = string(encodedBytes)
+	}
+	if err != nil {
+		return "", err
+	}
+	return Encode(Hash(encoded))
+}
+
+func getNodeValues(node *yaml.RNode, paths []string) (map[string]interface{}, error) {
+	values := make(map[string]interface{})
+	for _, p := range paths {
+		vn, err := node.Pipe(yaml.Lookup(p))
+		if err != nil {
+			return map[string]interface{}{}, err
+		}
+		if vn == nil {
+			values[p] = ""
+			continue
+		}
+		if vn.YNode().Kind != yaml.ScalarNode {
+			vs, err := vn.MarshalJSON()
+			if err != nil {
+				return map[string]interface{}{}, err
+			}
+			// data, binaryData and stringData are all maps
+			var v map[string]interface{}
+			json.Unmarshal(vs, &v)
+			values[p] = v
+		} else {
+			values[p] = vn.YNode().Value
+		}
+	}
+	return values, nil
+}
+
+// encodeConfigMap encodes a ConfigMap.
+// Data, Kind, and Name are taken into account.
+// BinaryData is included if it's not empty to avoid useless key in output.
+func encodeConfigMap(node *yaml.RNode) (string, error) {
+	// get fields
+	paths := []string{"metadata/name", "data", "binaryData"}
+	values, err := getNodeValues(node, paths)
+	if err != nil {
+		return "", err
+	}
+	m := map[string]interface{}{"kind": "ConfigMap", "name": values["metadata/name"],
+		"data": values["data"]}
+	if _, ok := values["binaryData"].(map[string]interface{}); ok {
+		m["binaryData"] = values["binaryData"]
+	}
+
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// encodeSecret encodes a Secret.
+// Data, Kind, Name, and Type are taken into account.
+// StringData is included if it's not empty to avoid useless key in output.
+func encodeSecret(node *yaml.RNode) (string, error) {
+	// get fields
+	paths := []string{"type", "metadata/name", "data", "stringData"}
+	values, err := getNodeValues(node, paths)
+	if err != nil {
+		return "", err
+	}
+	m := map[string]interface{}{"kind": "Secret", "type": values["type"],
+		"name": values["metadata/name"], "data": values["data"]}
+	if _, ok := values["stringData"].(map[string]interface{}); ok {
+		m["stringData"] = values["stringData"]
+	}
+
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}

api/hasher/hasher_test.go

@@ -1,12 +1,13 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package hasher_test
+package hasher
 
 import (
+	"strings"
 	"testing"
 
-	. "sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 func TestSortArrayAndComputeHash(t *testing.T) {
@@ -39,3 +40,314 @@ func TestHash(t *testing.T) {
 		t.Errorf("expected hash %q but got %q", expect, sum)
 	}
 }
+
+func TestConfigMapHash(t *testing.T) {
+	cases := []struct {
+		desc   string
+		cmYaml string
+		hash   string
+		err    string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, "6ct58987ht", ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+data: 
+  one: ""`, "9g67k2htb6", ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  two: 2
+  one: ""
+  three: 3`, "7757f9kkct", ""},
+		// empty binary data map
+		{"empty binary data", `
+apiVersion: v1
+kind: ConfigMap`, "6ct58987ht", ""},
+		// one key with binary data
+		{"one key with binary data", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  one: ""`, "6mtk2m274t", ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys with binary data", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  two: 2
+  one: ""
+  three: 3`, "9th7kc28dg", ""},
+		// two keys, one with string and another with binary data
+		{"two keys with one each", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  one: ""
+binaryData:
+  two: ""`, "698h7c7t9m", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.cmYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestSecretHash(t *testing.T) {
+	cases := []struct {
+		desc       string
+		secretYaml string
+		hash       string
+		err        string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: Secret
+type: my-type`, "5gmgkf8578", ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, "74bd68bm66", ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  two: 2
+  one: ""
+  three: 3`, "4gf75c7476", ""},
+		// with stringdata
+		{"stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""
+stringData:
+  two: 2`, "c4h4264gdb", ""},
+		// empty stringdata
+		{"empty stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, "74bd68bm66", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.secretYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestUnstructuredHash(t *testing.T) {
+	cases := []struct {
+		desc         string
+		unstructured string
+		hash         string
+		err          string
+	}{
+		{"minimal", `
+apiVersion: test/v1
+kind: TestResource
+metadata:
+  name: my-resource`, "244782mkb7", ""},
+		{"with spec", `
+apiVersion: test/v1
+kind: TestResource
+metadata:
+  name: my-resource
+spec:
+  foo: 1
+  bar: abc`, "59m2mdccg4", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.unstructured)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestEncodeConfigMap(t *testing.T) {
+	cases := []struct {
+		desc   string
+		cmYaml string
+		expect string
+		err    string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, `{"data":"","kind":"ConfigMap","name":""}`, ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+data: 
+  one: ""`, `{"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  two: 2
+  one: ""
+  three: 3`, `{"data":{"one":"","three":3,"two":2},"kind":"ConfigMap","name":""}`, ""},
+		// empty binary map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, `{"data":"","kind":"ConfigMap","name":""}`, ""},
+		// one key with binary data
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  one: ""`, `{"binaryData":{"one":""},"data":"","kind":"ConfigMap","name":""}`, ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  two: 2
+  one: ""
+  three: 3`, `{"binaryData":{"one":"","three":3,"two":2},"data":"","kind":"ConfigMap","name":""}`, ""},
+		// two keys, one string and one binary values
+		{"two keys with one each", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  one: ""
+binaryData:
+  two: ""`, `{"binaryData":{"two":""},"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+	}
+	for _, c := range cases {
+		node, err := yaml.Parse(c.cmYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, err := encodeConfigMap(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.cmYaml)
+		}
+	}
+}
+
+func TestEncodeSecret(t *testing.T) {
+	cases := []struct {
+		desc       string
+		secretYaml string
+		expect     string
+		err        string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: Secret
+type: my-type`, `{"data":"","kind":"Secret","name":"","type":"my-type"}`, ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// three keys (tests sorting order) - note json.Marshal base64 encodes the values because they come in as []byte
+		{"three keys", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  two: 2
+  one: ""
+  three: 3`, `{"data":{"one":"","three":3,"two":2},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// with stringdata
+		{"stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""
+stringData:
+  two: 2`, `{"data":{"one":""},"kind":"Secret","name":"","stringData":{"two":2},"type":"my-type"}`, ""},
+		// empty stringdata
+		{"empty stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
+	}
+	for _, c := range cases {
+		node, err := yaml.Parse(c.secretYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, err := encodeSecret(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.secretYaml)
+		}
+	}
+}
+
+// SkipRest returns true if there was a non-nil error or if we expected an error that didn't happen,
+// and logs the appropriate error on the test object.
+// The return value indicates whether we should skip the rest of the test case due to the error result.
+func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	if err != nil {
+		if len(contains) == 0 {
+			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())
+		} else if !strings.Contains(err.Error(), contains) {
+			t.Errorf("case %q, expect error to contain %q but got %q", desc, contains, err.Error())
+		}
+		return true
+	} else if len(contains) > 0 {
+		t.Errorf("case %q, expect error to contain %q but got nil error", desc, contains)
+		return true
+	}
+	return false
+}

api/internal/accumulator/namereferencetransformer.go

@@ -4,14 +4,12 @@
 package accumulator
 
 import (
-	"fmt"
 	"log"
 
+	"sigs.k8s.io/kustomize/api/filters/nameref"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 type nameReferenceTransformer struct {
@@ -86,16 +84,12 @@ func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
 					if candidates == nil {
 						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
 					}
-					err := transform.MutateField(
-						referrer.Map(),
-						fSpec.PathSlice(),
-						fSpec.CreateIfNotPresent,
-						o.getNewNameFunc(
-							// referrer could be an HPA instance,
-							// target could be Gvk for Deployment,
-							// candidate a list of resources "reachable"
-							// from the HPA.
-							referrer, target.Gvk, candidates))
+					err := filtersutil.ApplyToJSON(nameref.Filter{
+						FieldSpec:          fSpec,
+						Referrer:           referrer,
+						Target:             target.Gvk,
+						ReferralCandidates: candidates,
+					}, referrer)
 					if err != nil {
 						return err
 					}
@@ -105,165 +99,3 @@ func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
 	}
 	return nil
 }
-
-// selectReferral picks the referral among a subset of candidates.
-// It returns the current name and namespace of the selected candidate.
-// Note that the content of the referricalCandidateSubset slice is most of the time
-// identical to the referralCandidates resmap. Still in some cases, such
-// as ClusterRoleBinding, the subset only contains the resources of a specific
-// namespace.
-func (o *nameReferenceTransformer) selectReferral(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource) (interface{}, interface{}, error) {
-
-	for _, res := range referralCandidateSubset {
-		id := res.OrgId()
-		if id.IsSelected(&target) && res.GetOriginalName() == oldName {
-			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
-			// If there's more than one match, there's no way
-			// to know which one to pick, so emit error.
-			if len(matches) > 1 {
-				return nil, nil, fmt.Errorf(
-					"multiple matches for %s:\n  %v",
-					id, getIds(matches))
-			}
-			// In the resource, note that it is referenced
-			// by the referrer.
-			res.AppendRefBy(referrer.CurId())
-			// Return transformed name of the object,
-			// complete with prefixes, hashes, etc.
-			return res.GetName(), res.GetNamespace(), nil
-		}
-	}
-
-	return oldName, nil, nil
-}
-
-// utility function to replace a simple string by the new name
-func (o *nameReferenceTransformer) getSimpleNameField(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource) (interface{}, error) {
-
-	newName, _, err := o.selectReferral(oldName, referrer, target,
-		referralCandidates, referralCandidateSubset)
-
-	return newName, err
-}
-
-// utility function to replace name field within a map[string]interface{}
-// and leverage the namespace field.
-func (o *nameReferenceTransformer) getNameAndNsStruct(
-	inMap map[string]interface{},
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap) (interface{}, error) {
-
-	// Example:
-	if _, ok := inMap["name"]; !ok {
-		return nil, fmt.Errorf(
-			"%#v is expected to contain a name field", inMap)
-	}
-	oldName, ok := inMap["name"].(string)
-	if !ok {
-		return nil, fmt.Errorf(
-			"%#v is expected to contain a name field of type string", oldName)
-	}
-
-	subset := referralCandidates.Resources()
-	if namespacevalue, ok := inMap["namespace"]; ok {
-		namespace := namespacevalue.(string)
-		bynamespace := referralCandidates.GroupedByOriginalNamespace()
-		if _, ok := bynamespace[namespace]; !ok {
-			return inMap, nil
-		}
-		subset = bynamespace[namespace]
-	}
-
-	newname, newnamespace, err := o.selectReferral(oldName, referrer, target,
-		referralCandidates, subset)
-	if err != nil {
-		return nil, err
-	}
-
-	if (newname == oldName) && (newnamespace == nil) {
-		// no candidate found.
-		return inMap, nil
-	}
-
-	inMap["name"] = newname
-	if newnamespace != "" {
-		// We don't want value "" to replace value "default" since
-		// the empty string is handled as a wild card here not default namespace
-		// by kubernetes.
-		inMap["namespace"] = newnamespace
-	}
-	return inMap, nil
-
-}
-
-func (o *nameReferenceTransformer) getNewNameFunc(
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap) func(in interface{}) (interface{}, error) {
-	return func(in interface{}) (interface{}, error) {
-		switch thing := in.(type) {
-		case string:
-			return o.getSimpleNameField(thing, referrer, target,
-				referralCandidates, referralCandidates.Resources())
-		case map[string]interface{}:
-			// Kind: ValidatingWebhookConfiguration
-			// FieldSpec is webhooks/clientConfig/service
-			return o.getNameAndNsStruct(thing, referrer, target,
-				referralCandidates)
-		case []interface{}:
-			for idx, item := range thing {
-				switch value := item.(type) {
-				case string:
-					// Kind: Role/ClusterRole
-					// FieldSpec is rules.resourceNames
-					newName, err := o.getSimpleNameField(value, referrer, target,
-						referralCandidates, referralCandidates.Resources())
-					if err != nil {
-						return nil, err
-					}
-					thing[idx] = newName
-				case map[string]interface{}:
-					// Kind: RoleBinding/ClusterRoleBinding
-					// FieldSpec is subjects
-					// Note: The corresponding fieldSpec had been changed from
-					// from path: subjects/name to just path: subjects. This is
-					// what get mutatefield to request the mapping of the whole
-					// map containing namespace and name instead of just a simple
-					// string field containing the name
-					newMap, err := o.getNameAndNsStruct(value, referrer, target,
-						referralCandidates)
-					if err != nil {
-						return nil, err
-					}
-					thing[idx] = newMap
-				default:
-					return nil, fmt.Errorf(
-						"%#v is expected to be either a []string or a []map[string]interface{}", in)
-				}
-			}
-			return in, nil
-		default:
-			return nil, fmt.Errorf(
-				"%#v is expected to be either a string or a []interface{}", in)
-		}
-	}
-}
-
-func getIds(rs []*resource.Resource) []string {
-	var result []string
-	for _, r := range rs {
-		result = append(result, r.CurId().String()+"\n")
-	}
-	return result
-}

api/internal/accumulator/namereferencetransformer_test.go

@@ -520,7 +520,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 						},
 					},
 				}).ResMap(),
-			expectedErr: "is expected to contain a name field"},
+			expectedErr: "cannot find field 'name' in node"},
 	}
 
 	nrt := newNameReferenceTransformer(builtinconfig.MakeDefaultConfig().NameReference)

api/internal/accumulator/refvartransformer.go

@@ -4,13 +4,12 @@
 package accumulator
 
 import (
-	"fmt"
-
 	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
 
+	"sigs.k8s.io/kustomize/api/filters/refvar"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 type refVarTransformer struct {
@@ -31,59 +30,6 @@ func newRefVarTransformer(
 	}
 }
 
-// replaceVars accepts as 'in' a string, or string array, which can have
-// embedded instances of $VAR style variables, e.g. a container command string.
-// The function returns the string with the variables expanded to their final
-// values.
-func (rv *refVarTransformer) replaceVars(in interface{}) (interface{}, error) {
-	switch vt := in.(type) {
-	case []interface{}:
-		var xs []interface{}
-		for _, a := range in.([]interface{}) {
-			x, ok := a.(string)
-			if !ok {
-				return nil, fmt.Errorf("expected array of strings, found %v", in)
-			}
-			xs = append(xs, expansion2.Expand(x, rv.mappingFunc))
-		}
-		return xs, nil
-	case map[string]interface{}:
-		inMap := in.(map[string]interface{})
-		xs := make(map[string]interface{}, len(inMap))
-		for k, v := range inMap {
-			s, ok := v.(string)
-			if !ok {
-				// This field can not contain a $(VAR) since it is not
-				// of string type. For instance .spec.replicas: 3 in
-				// a Deployment object
-				xs[k] = v
-			} else {
-				// This field can potentially contains a $(VAR) since it is
-				// of string type. For instance .spec.replicas: $(REPLICAS)
-				// in a Deployment object
-				xs[k] = expansion2.Expand(s, rv.mappingFunc)
-			}
-		}
-		return xs, nil
-	case interface{}:
-		s, ok := in.(string)
-		if !ok {
-			// This field can not contain a $(VAR) since it is not of string type.
-			return in, nil
-		}
-		// This field can potentially contain a $(VAR) since it is
-		// of string type.
-		return expansion2.Expand(s, rv.mappingFunc), nil
-	// staticcheck erroneously claims that `case nil`
-	// is unreachable here, so suppressing it.
-	//nolint:staticcheck
-	case nil:
-		return nil, nil
-	default:
-		return "", fmt.Errorf("invalid type encountered %T", vt)
-	}
-}
-
 // UnusedVars returns slice of Var names that were unused
 // after a Transform run.
 func (rv *refVarTransformer) UnusedVars() []string {
@@ -104,12 +50,12 @@ func (rv *refVarTransformer) Transform(m resmap.ResMap) error {
 		rv.replacementCounts, rv.varMap)
 	for _, res := range m.Resources() {
 		for _, fieldSpec := range rv.fieldSpecs {
-			if res.OrgId().IsSelected(&fieldSpec.Gvk) {
-				if err := transform.MutateField(
-					res.Map(), fieldSpec.PathSlice(),
-					false, rv.replaceVars); err != nil {
-					return err
-				}
+			err := filtersutil.ApplyToJSON(refvar.Filter{
+				MappingFunc: rv.mappingFunc,
+				FieldSpec:   fieldSpec,
+			}, res)
+			if err != nil {
+				return err
 			}
 		}
 	}

api/internal/accumulator/refvartransformer_test.go

@@ -44,7 +44,6 @@ func TestRefVarTransformer(t *testing.T) {
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/map"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/interface"},
-					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/num"},
 				},
 				res: resmaptest_test.NewRmBuilder(
@@ -63,7 +62,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"item4": "$(BAZ)+$(BAZ)",
 								"item5": "$(BOO)",
 								"item6": "if $(BOO)",
-								"item7": 2019,
+								"item7": int64(2019),
 							},
 							"slice": []interface{}{
 								"$(FOO)",
@@ -74,8 +73,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"if $(BOO)",
 							},
 							"interface": "$(FOO)",
-							"nil":       nil,
-							"num":       2019,
+							"num":       int64(2019),
 						}}).ResMap(),
 			},
 			expected: expected{
@@ -95,7 +93,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"item4": "5+5",
 								"item5": true,
 								"item6": "if true",
-								"item7": 2019,
+								"item7": int64(2019),
 							},
 							"slice": []interface{}{
 								"replacementForFoo",
@@ -106,8 +104,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"if true",
 							},
 							"interface": "replacementForFoo",
-							"nil":       nil,
-							"num":       2019,
+							"num":       int64(2019),
 						}}).ResMap(),
 				unused: []string{"BAR"},
 			},
@@ -131,7 +128,29 @@ func TestRefVarTransformer(t *testing.T) {
 							"slice": []interface{}{5}, // noticeably *not* a []string
 						}}).ResMap(),
 			},
-			errMessage: "expected array of strings, found [5]",
+			errMessage: `obj '{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
+' at path 'data/slice': invalid value type expect a string`,
+		},
+		{
+			description: "var replacement panic in nil",
+			given: given{
+				varMap: map[string]interface{}{},
+				fs: []types.FieldSpec{
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
+				},
+				res: resmaptest_test.NewRmBuilder(
+					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"nil": nil, // noticeably *not* a []string
+						}}).ResMap(),
+			},
+			errMessage: `obj '' at path 'data/nil': invalid type encountered 0`,
 		},
 	}
 

api/internal/crawl/go.sum

@@ -16,8 +16,10 @@ github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmU
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/StackExchange/wmi v0.0.0-20180116203802-5d049714c4a6/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
 github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
@@ -72,6 +74,7 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-critic/go-critic v0.3.5-0.20190904082202-d79a9f0c64db/go.mod h1:+sE8vrLDS2M0pZkBk0wy6+nLdKexVDrl/jBqQOTDThA=
+github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
@@ -91,11 +94,13 @@ github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+
 github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/jsonreference v0.19.3 h1:5cxNfTy0UVC3X8JL5ymxzyoUZmo8iZb+jeTWn7tUa8o=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
 github.com/go-openapi/loads v0.17.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
 github.com/go-openapi/loads v0.18.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
@@ -110,6 +115,7 @@ github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsd
 github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
 github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/spec v0.19.5 h1:Xm0Ao53uqnk9QE/LlYV5DEU09UAgpliA85QoT9LzqPw=
 github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
 github.com/go-openapi/strfmt v0.17.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
 github.com/go-openapi/strfmt v0.18.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
@@ -120,6 +126,7 @@ github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dp
 github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+MYsct2VUrAJ4=
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
@@ -242,6 +249,7 @@ github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
@@ -353,6 +361,7 @@ github.com/valyala/quicktemplate v1.2.0/go.mod h1:EH+4AkTd43SvgIbQHYu59/cJyxDoOV
 github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
 github.com/vektah/gqlparser v1.1.2/go.mod h1:1ycwN7Ij5njmMkPPAOaRFY4rET2Enx7IkVv3vaXspKw=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
@@ -404,8 +413,6 @@ golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -494,7 +501,8 @@ gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71 h1:Xe2gvTZUJpsvOWUnvmL/tmhVBZUmHSvLbMjRj6NUUKo=
+gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
@@ -515,7 +523,8 @@ k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.3.4/go.mod h1:XJL84E6sOFeNrQ7CADiemc1B0EjIxHo3OhW4o1aJYNw=
+sigs.k8s.io/kustomize/kyaml v0.5.0 h1:xufpSxgpugQxtd0aN1ZsWnr3Kj0fpAi7GN4dnEs4oPg=
+sigs.k8s.io/kustomize/kyaml v0.5.0/go.mod h1:bEzbO5pN9OvlEeCLvFHo8Pu7SA26Herc2m60UeWZBdI=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

api/internal/target/kusttarget.go

@@ -4,7 +4,6 @@
 package target
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -60,7 +59,7 @@ func (kt *KustTarget) Load() error {
 		return err
 	}
 	var k types.Kustomization
-	err = unmarshal(content, &k)
+	err = k.Unmarshal(content)
 	if err != nil {
 		return err
 	}
@@ -104,18 +103,8 @@ func loadKustFile(ldr ifc.Loader) ([]byte, error) {
 	}
 }
 
-func unmarshal(y []byte, o interface{}) error {
-	j, err := yaml.YAMLToJSON(y)
-	if err != nil {
-		return err
-	}
-	dec := json.NewDecoder(bytes.NewReader(j))
-	dec.DisallowUnknownFields()
-	return dec.Decode(o)
-}
-
 // MakeCustomizedResMap creates a fully customized ResMap
-// per the instructions contained in its kustomiztion instance.
+// per the instructions contained in its kustomization instance.
 func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
 	return kt.makeCustomizedResMap()
 }

api/internal/target/kusttarget_test.go

@@ -187,7 +187,7 @@ metadata:
 			"apiVersion": "v1",
 			"kind":       "Namespace",
 			"metadata": map[string]interface{}{
-				"name": "foo-ns1-bar",
+				"name": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
 				},
@@ -201,7 +201,7 @@ metadata:
 				"apiVersion": "v1",
 				"kind":       "ConfigMap",
 				"metadata": map[string]interface{}{
-					"name":      "foo-literalConfigMap-bar-8d2dkb8k24",
+					"name":      "foo-literalConfigMap-bar-g5f6t456f5",
 					"namespace": "ns1",
 					"labels": map[string]interface{}{
 						"app": "nginx",
@@ -220,7 +220,7 @@ metadata:
 				"apiVersion": "v1",
 				"kind":       "Secret",
 				"metadata": map[string]interface{}{
-					"name":      "foo-secret-bar-9btc7bt4kb",
+					"name":      "foo-secret-bar-82c2g5f8f6",
 					"namespace": "ns1",
 					"labels": map[string]interface{}{
 						"app": "nginx",

api/k8sdeps/kunstruct/hasher.go

@@ -4,13 +4,9 @@
 package kunstruct
 
 import (
-	"encoding/json"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"sigs.k8s.io/kustomize/api/hasher"
 	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 // kustHash computes a hash of an unstructured object.
@@ -21,109 +17,11 @@ func NewKustHash() *kustHash {
 	return &kustHash{}
 }
 
-// Hash returns a hash of either a ConfigMap or a Secret
+// Hash returns a hash of the given object
 func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
-	u := unstructured.Unstructured{
-		Object: m.Map(),
-	}
-	kind := u.GetKind()
-	switch kind {
-	case "ConfigMap":
-		cm, err := unstructuredToConfigmap(u)
-		if err != nil {
-			return "", err
-		}
-		return configMapHash(cm)
-	case "Secret":
-		sec, err := unstructuredToSecret(u)
-
-		if err != nil {
-			return "", err
-		}
-		return secretHash(sec)
-	default:
-		return "", fmt.Errorf(
-			"type %s is not supported for hashing in %v",
-			kind, m.Map())
-	}
-}
-
-// configMapHash returns a hash of the ConfigMap.
-// The Data, Kind, and Name are taken into account.
-func configMapHash(cm *corev1.ConfigMap) (string, error) {
-	encoded, err := encodeConfigMap(cm)
+	node, err := filtersutil.GetRNode(m)
 	if err != nil {
 		return "", err
 	}
-	h, err := hasher.Encode(hasher.Hash(encoded))
-	if err != nil {
-		return "", err
-	}
-	return h, nil
-}
-
-// SecretHash returns a hash of the Secret.
-// The Data, Kind, Name, and Type are taken into account.
-func secretHash(sec *corev1.Secret) (string, error) {
-	encoded, err := encodeSecret(sec)
-	if err != nil {
-		return "", err
-	}
-	h, err := hasher.Encode(hasher.Hash(encoded))
-	if err != nil {
-		return "", err
-	}
-	return h, nil
-}
-
-// encodeConfigMap encodes a ConfigMap.
-// Data, Kind, and Name are taken into account.
-// BinaryData is included if it's not empty to avoid useless key in output.
-func encodeConfigMap(cm *corev1.ConfigMap) (string, error) {
-	// json.Marshal sorts the keys in a stable order in the encoding
-	m := map[string]interface{}{"kind": "ConfigMap", "name": cm.Name, "data": cm.Data}
-	if len(cm.BinaryData) > 0 {
-		m["binaryData"] = cm.BinaryData
-	}
-	data, err := json.Marshal(m)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-// encodeSecret encodes a Secret.
-// Data, Kind, Name, and Type are taken into account.
-// StringData is included if it's not empty to avoid useless key in output.
-func encodeSecret(sec *corev1.Secret) (string, error) {
-	// json.Marshal sorts the keys in a stable order in the encoding
-	m := map[string]interface{}{"kind": "Secret", "type": sec.Type, "name": sec.Name, "data": sec.Data}
-	if len(sec.StringData) > 0 {
-		m["stringData"] = sec.StringData
-	}
-	data, err := json.Marshal(m)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-func unstructuredToConfigmap(u unstructured.Unstructured) (*corev1.ConfigMap, error) {
-	marshaled, err := json.Marshal(u.Object)
-	if err != nil {
-		return nil, err
-	}
-	var out corev1.ConfigMap
-	err = json.Unmarshal(marshaled, &out)
-	return &out, err
-}
-
-func unstructuredToSecret(u unstructured.Unstructured) (*corev1.Secret, error) {
-	marshaled, err := json.Marshal(u.Object)
-	if err != nil {
-		return nil, err
-	}
-	var out corev1.Secret
-	err = json.Unmarshal(marshaled, &out)
-	return &out, err
+	return hasher.HashRNode(node)
 }

api/k8sdeps/kunstruct/hasher_test.go

@@ -1,190 +1,34 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
 package kunstruct
 
 import (
-	"reflect"
-	"strings"
 	"testing"
-
-	corev1 "k8s.io/api/core/v1"
 )
 
-func TestConfigMapHash(t *testing.T) {
-	cases := []struct {
-		desc string
-		cm   *corev1.ConfigMap
-		hash string
-		err  string
-	}{
-		// empty map
-		{"empty data", &corev1.ConfigMap{Data: map[string]string{}, BinaryData: map[string][]byte{}}, "42745tchd9", ""},
-		// one key
-		{"one key", &corev1.ConfigMap{Data: map[string]string{"one": ""}}, "9g67k2htb6", ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}}, "f5h7t85m9b", ""},
-		// empty binary data map
-		{"empty binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{}}, "dk855m5d49", ""},
-		// one key with binary data
-		{"one key with binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}}, "mk79584b8c", ""},
-		// three keys with binary data (tests sorting order)
-		{"three keys with binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "t458mc6db2", ""},
-		// two keys, one with string and another with binary data
-		{"two keys with one each", &corev1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}}, "698h7c7t9m", ""},
-	}
-
-	for _, c := range cases {
-		h, err := configMapHash(c.cm)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if c.hash != h {
-			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
-		}
-	}
-}
-
-func TestSecretHash(t *testing.T) {
-	cases := []struct {
-		desc   string
-		secret *corev1.Secret
-		hash   string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.Secret{Type: "my-type", Data: map[string][]byte{}}, "t75bgf6ctb", ""},
-		// one key
-		{"one key", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, "74bd68bm66", ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "dgcb6h9tmk", ""},
-		// with stringdata
-		{"stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{"two": "2"}}, "ckm7f798g2", ""},
-		// empty stringdata
-		{"empty stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{}}, "74bd68bm66", ""},
-	}
-
-	for _, c := range cases {
-		h, err := secretHash(c.secret)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if c.hash != h {
-			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
-		}
-	}
-}
-
-func TestEncodeConfigMap(t *testing.T) {
-	cases := []struct {
-		desc   string
-		cm     *corev1.ConfigMap
-		expect string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.ConfigMap{Data: map[string]string{}}, `{"data":{},"kind":"ConfigMap","name":""}`, ""},
-		// one key
-		{"one key", &corev1.ConfigMap{Data: map[string]string{"one": ""}}, `{"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}},
-			`{"data":{"one":"","three":"3","two":"2"},"kind":"ConfigMap","name":""}`, ""},
-		// empty binary map
-		{"empty data", &corev1.ConfigMap{BinaryData: map[string][]byte{}}, `{"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// one key with binary data
-		{"one key", &corev1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}},
-			`{"binaryData":{"one":""},"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// three keys with binary data (tests sorting order)
-		{"three keys", &corev1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}},
-			`{"binaryData":{"one":"","three":"Mw==","two":"Mg=="},"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// two keys, one string and one binary values
-		{"two keys with one each", &corev1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}},
-			`{"binaryData":{"two":""},"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
-	}
-	for _, c := range cases {
-		s, err := encodeConfigMap(c.cm)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if s != c.expect {
-			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.cm)
-		}
-	}
-}
-
-func TestEncodeSecret(t *testing.T) {
-	cases := []struct {
-		desc   string
-		secret *corev1.Secret
-		expect string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.Secret{Type: "my-type", Data: map[string][]byte{}}, `{"data":{},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// one key
-		{"one key", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// three keys (tests sorting order) - note json.Marshal base64 encodes the values because they come in as []byte
-		{"three keys", &corev1.Secret{
-			Type: "my-type",
-			Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")},
-		},
-			`{"data":{"one":"","three":"Mw==","two":"Mg=="},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// with stringdata
-		{"stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{"two": "2"}},
-			`{"data":{"one":""},"kind":"Secret","name":"","stringData":{"two":"2"},"type":"my-type"}`, ""},
-		// empty stringdata
-		{"empty stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{}},
-			`{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
-	}
-	for _, c := range cases {
-		s, err := encodeSecret(c.secret)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if s != c.expect {
-			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.secret)
-		}
-	}
-}
-
-// warn devs who change types that they might have to update a hash function
-// not perfect, as it only checks the number of top-level fields
-func TestTypeStability(t *testing.T) {
-	errfmt := `case %q, expected %d fields but got %d
-Depending on the field(s) you added, you may need to modify the hash function for this type.
-To guide you: the hash function targets fields that comprise the contents of objects,
-not their metadata (e.g. the Data of a ConfigMap, but nothing in ObjectMeta).
+func TestHasher(t *testing.T) {
+	input := `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+data:
+  one: ""
+binaryData:
+  two: ""
 `
-	cases := []struct {
-		typeName string
-		obj      interface{}
-		expect   int
-	}{
-		{"ConfigMap", corev1.ConfigMap{}, 4},
-		{"Secret", corev1.Secret{}, 5},
-	}
-	for _, c := range cases {
-		val := reflect.ValueOf(c.obj)
-		if num := val.NumField(); c.expect != num {
-			t.Errorf(errfmt, c.typeName, c.expect, num)
-		}
-	}
-}
+	expect := "698h7c7t9m"
 
-// SkipRest returns true if there was a non-nil error or if we expected an error that didn't happen,
-// and logs the appropriate error on the test object.
-// The return value indicates whether we should skip the rest of the test case due to the error result.
-func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	factory := NewKunstructuredFactoryImpl()
+	k, err := factory.SliceFromBytes([]byte(input))
 	if err != nil {
-		if len(contains) == 0 {
-			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())
-		} else if !strings.Contains(err.Error(), contains) {
-			t.Errorf("case %q, expect error to contain %q but got %q", desc, contains, err.Error())
-		}
-		return true
-	} else if len(contains) > 0 {
-		t.Errorf("case %q, expect error to contain %q but got nil error", desc, contains)
-		return true
+		t.Fatal(err)
+	}
+
+	hasher := NewKustHash()
+	result, err := hasher.Hash(k[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result != expect {
+		t.Fatalf("expect %s but got %s", expect, result)
 	}
-	return false
 }

api/konfig/builtinpluginconsts/images.go

@@ -4,7 +4,15 @@
 package builtinpluginconsts
 
 const (
-	// imageFieldSpecs is left empty since `containers` and `initContainers`
-	// of *ANY* kind in *ANY* path are builtin supported in code
-	imagesFieldSpecs = ``
+	imagesFieldSpecs = `
+images:
+- path: spec/containers[]/image
+  create: true
+- path: spec/initContainers[]/image
+  create: true
+- path: spec/template/spec/containers[]/image
+  create: true
+- path: spec/template/spec/initContainers[]/image
+  create: true
+`
 )

api/krusty/baseandoverlaymedium_test.go

@@ -231,7 +231,7 @@ spec:
           valueFrom:
             configMapKeyRef:
               key: somekey
-              name: test-infra-app-env-ffmd9b969m
+              name: test-infra-app-env-8h5mh7f7ch
         image: nginx:1.8.0
         name: nginx
         ports:
@@ -240,7 +240,7 @@ spec:
         - configMapRef:
             name: someConfigMap
         - configMapRef:
-            name: test-infra-app-env-ffmd9b969m
+            name: test-infra-app-env-8h5mh7f7ch
         image: busybox
         name: busybox
         volumeMounts:
@@ -248,7 +248,7 @@ spec:
           name: app-env
       volumes:
       - configMap:
-          name: test-infra-app-env-ffmd9b969m
+          name: test-infra-app-env-8h5mh7f7ch
         name: app-env
 ---
 apiVersion: v1
@@ -288,7 +288,7 @@ metadata:
     app: mungebot
     org: kubernetes
     repo: test-infra
-  name: test-infra-app-env-ffmd9b969m
+  name: test-infra-app-env-8h5mh7f7ch
 ---
 apiVersion: v1
 data:
@@ -301,6 +301,6 @@ metadata:
     app: mungebot
     org: kubernetes
     repo: test-infra
-  name: test-infra-app-config-f462h769f9
+  name: test-infra-app-config-49d6f5h7b5
 `)
 }

api/krusty/baseandoverlaysmall_test.go

@@ -70,7 +70,7 @@ metadata:
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: p-b-myNs
+  name: myNs
 ---
 apiVersion: v1
 kind: Role
@@ -95,7 +95,7 @@ metadata:
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: p-myNs2
+  name: myNs2
 `)
 }
 

api/krusty/component_test.go

@@ -39,8 +39,8 @@ resources:
 configMapGenerator:
 - name: my-configmap
   literals:	
-    - testValue=1
-    - otherValue=10
+  - testValue=1
+  - otherValue=10
 `)
 	th.WriteF("/app/base/deploy.yaml", `
 apiVersion: v1
@@ -59,13 +59,13 @@ replicas:
 - name: storefront
   count: 3
 resources:
-  - stub.yaml
+- stub.yaml
 configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-    - testValue=2
-    - compValue=5
+  - testValue=2
+  - compValue=5
 `)
 	th.WriteF("/app/comp/stub.yaml", `
 apiVersion: v1
@@ -132,7 +132,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: comp-my-configmap-ct5bgtbccd
+  name: comp-my-configmap-kc6k2kmkh9
 ---
 apiVersion: v1
 kind: Deployment
@@ -156,7 +156,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-    - otherValue=9
+  - otherValue=9
 `),
 				writeK("/app/prod", `
 resources:
@@ -186,7 +186,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: comp-my-configmap-dgf97tmg6h
+  name: comp-my-configmap-55249mf5kb
 ---
 apiVersion: v1
 kind: Deployment
@@ -211,8 +211,8 @@ components:
 configMapGenerator:
 - name: my-configmap
   behavior: merge
-  literals:	
-    - otherValue=9
+  literals:
+  - otherValue=9
 `),
 				writeK("/app/prod", `
 resources:
@@ -241,7 +241,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: comp-my-configmap-dgf97tmg6h
+  name: comp-my-configmap-55249mf5kb
 ---
 apiVersion: v1
 kind: Deployment
@@ -283,7 +283,7 @@ data:
   testValue: "1"
 kind: ConfigMap
 metadata:
-  name: my-configmap-7k9t4h74f8
+  name: my-configmap-2g9c94mhb8
 ---
 apiVersion: v1
 kind: Deployment
@@ -301,7 +301,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: comp-my-configmap-ct5bgtbccd
+  name: comp-my-configmap-kc6k2kmkh9
 ---
 apiVersion: v1
 kind: Deployment
@@ -327,8 +327,8 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-    - compValue=5
-    - testValue=2
+  - compValue=5
+  - testValue=2
 `),
 			},
 			runPath: "/app/direct-component",
@@ -349,7 +349,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: my-configmap-96dt22k28h
+  name: my-configmap-kc6k2kmkh9
 `,
 		},
 		"missing-optional-component-api-version": {
@@ -360,7 +360,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-    - otherValue=9
+  - otherValue=9
 `),
 			},
 			runPath: "/app/prod",
@@ -380,7 +380,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: my-configmap-72cfg2mg5d
+  name: my-configmap-5g7gh5mgt5
 ---
 apiVersion: v1
 kind: Deployment
@@ -427,7 +427,7 @@ data:
   testValue: "1"
 kind: ConfigMap
 metadata:
-  name: my-configmap-a-b-tfb7c5t69m
+  name: my-configmap-a-b-2g9c94mhb8
 ---
 apiVersion: v1
 kind: Deployment
@@ -442,7 +442,7 @@ data:
   testValue: "1"
 kind: ConfigMap
 metadata:
-  name: my-configmap-b-8h7b8862bb
+  name: my-configmap-b-2g9c94mhb8
 `,
 		},
 
@@ -574,7 +574,7 @@ configMapGenerator:
 - name: my-configmap
   behavior: merge
   literals:	
-    - otherValue=9
+  - otherValue=9
 `),
 			},
 			runPath:       "/app/prod",

api/krusty/configmaps_test.go

@@ -81,7 +81,7 @@ data:
   vegetable: broccoli
 kind: ConfigMap
 metadata:
-  name: blah-bob-k772g5db55
+  name: blah-bob-d87t8m8tgm
 ---
 apiVersion: v1
 data:
@@ -89,7 +89,7 @@ data:
   v2: '[{"path": "var/druid/segment-cache"}]'
 kind: ConfigMap
 metadata:
-  name: blah-json-9gtcc2fgb4
+  name: blah-json-5298bc8g99
 ---
 apiVersion: v1
 data:
@@ -101,7 +101,7 @@ data:
   vegetable: YnJvY2NvbGk=
 kind: Secret
 metadata:
-  name: blah-bob-gmc2824f4b
+  name: blah-bob-ftht6hfgmb
 type: Opaque
 `)
 }
@@ -155,7 +155,7 @@ data:
   vegetable: broccoli
 kind: ConfigMap
 metadata:
-  name: blah-bob-gfkcbk5ckf
+  name: blah-bob-db529cg5bk
 `)
 }
 
@@ -217,7 +217,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: p1-com1-dhbbm922gd
+  name: p1-com1-8tc62428t2
 ---
 apiVersion: v1
 data:
@@ -226,7 +226,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: p2-com2-c4b8md75k9
+  name: p2-com2-87mcggf7d7
 `)
 }
 
@@ -274,7 +274,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: o1-cm-28g596k77k
+  name: o1-cm-ft9mmdc8c6
 ---
 apiVersion: v1
 data:
@@ -284,6 +284,6 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: cm-o2-gfcc59fg5m
+  name: cm-o2-5k95kd76ft
 `)
 }

api/krusty/disablenamesuffix_test.go

@@ -83,7 +83,7 @@ metadata:
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
 	}
-	if secret.GetName() != "foo-secret-bar-9btc7bt4kb" {
+	if secret.GetName() != "foo-secret-bar-82c2g5f8f6" {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 
@@ -140,7 +140,7 @@ secretGenerator:
 	if secret == nil {
 		t.Errorf("Expected to find a Secret")
 	}
-	if secret.GetName() != "yeshash-mcgcmdcm69" {
+	if secret.GetName() != "yeshash-82c2g5f8f6" {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 }

api/krusty/extendedpatch_test.go

@@ -156,7 +156,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -232,7 +233,8 @@ spec:
         - mountPath: /tmp/ps
           name: nginx-persistent-storage
       volumes:
-      - name: nginx-persistent-storage
+      - emptyDir: {}
+        name: nginx-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -258,7 +260,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -332,7 +335,8 @@ spec:
         - mountPath: /tmp/ps
           name: nginx-persistent-storage
       volumes:
-      - name: nginx-persistent-storage
+      - emptyDir: {}
+        name: nginx-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -459,7 +463,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -559,7 +564,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -661,7 +667,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -762,7 +769,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -957,7 +965,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -1171,7 +1180,8 @@ spec:
         - mountPath: /tmp/ps
           name: busybox-persistent-storage
       volumes:
-      - name: busybox-persistent-storage
+      - emptyDir: {}
+        name: busybox-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base

api/krusty/generatormergeandreplace_test.go

@@ -251,7 +251,7 @@ spec:
       - emptyDir: {}
         name: nginx-persistent-storage
       - configMap:
-          name: team-foo-configmap-in-base-bbdmdh7m8t
+          name: team-foo-configmap-in-base-798k5k7g9f
         name: configmap-in-base
 ---
 apiVersion: v1
@@ -283,7 +283,7 @@ metadata:
     app: mynginx
     org: example.com
     team: foo
-  name: team-foo-configmap-in-base-bbdmdh7m8t
+  name: team-foo-configmap-in-base-798k5k7g9f
 ---
 apiVersion: v1
 data:
@@ -297,7 +297,7 @@ metadata:
     app: mynginx
     org: example.com
     team: foo
-  name: team-foo-secret-in-base-tkm7hhtf8d
+  name: team-foo-secret-in-base-bgd6bkgdm2
 type: Opaque
 `)
 }
@@ -386,10 +386,10 @@ spec:
           pdName: nginx-persistent-storage
         name: nginx-persistent-storage
       - configMap:
-          name: staging-team-foo-configmap-in-base-gh9d7t85gb
+          name: staging-team-foo-configmap-in-base-hc6g9dk6g9
         name: configmap-in-base
       - configMap:
-          name: staging-configmap-in-overlay-k7cbc75tg8
+          name: staging-configmap-in-overlay-dc6fm46dhm
         name: configmap-in-overlay
 ---
 apiVersion: v1
@@ -424,7 +424,7 @@ metadata:
     env: staging
     org: example.com
     team: override-foo
-  name: staging-team-foo-configmap-in-base-gh9d7t85gb
+  name: staging-team-foo-configmap-in-base-hc6g9dk6g9
 ---
 apiVersion: v1
 data:
@@ -440,7 +440,7 @@ metadata:
     env: staging
     org: example.com
     team: override-foo
-  name: staging-team-foo-secret-in-base-c8db7gk2m2
+  name: staging-team-foo-secret-in-base-k2k4692t9g
 type: Opaque
 ---
 apiVersion: v1
@@ -451,7 +451,7 @@ metadata:
   labels:
     env: staging
     team: override-foo
-  name: staging-configmap-in-overlay-k7cbc75tg8
+  name: staging-configmap-in-overlay-dc6fm46dhm
 `)
 }
 
@@ -486,7 +486,7 @@ data:
   key: value
 kind: ConfigMap
 metadata:
-  name: test-t5t4md8fdm
+  name: test-t757gk2bmf
   namespace: default
 ---
 apiVersion: v1
@@ -494,7 +494,7 @@ data:
   key: value
 kind: ConfigMap
 metadata:
-  name: test-t5t4md8fdm
+  name: test-t757gk2bmf
   namespace: kube-system
 ---
 apiVersion: v1
@@ -503,7 +503,7 @@ data:
   username: YWRtaW4=
 kind: Secret
 metadata:
-  name: test-h65t9hg6kc
+  name: test-bgd6bkgdm2
   namespace: default
 type: Opaque
 ---
@@ -513,7 +513,7 @@ data:
   username: YWRtaW4=
 kind: Secret
 metadata:
-  name: test-h65t9hg6kc
+  name: test-bgd6bkgdm2
   namespace: kube-system
 type: Opaque
 `)

api/krusty/generatoroptions_test.go

@@ -40,7 +40,7 @@ data:
   passphrase: ZGF0IHBocmFzZQ==
 kind: Secret
 metadata:
-  name: bob-kf5c9fccbt
+  name: bob-bh645k7tmg
 type: Opaque
 `)
 }
@@ -91,6 +91,6 @@ kind: ConfigMap
 metadata:
   labels:
     fruit: apple
-  name: shouldHaveHash-2k9hc848ff
+  name: shouldHaveHash-c9867f8446
 `)
 }

api/krusty/inlinepatch_test.go

@@ -79,7 +79,8 @@ spec:
         - mountPath: /tmp/ps
           name: nginx-persistent-storage
       volumes:
-      - name: nginx-persistent-storage
+      - emptyDir: {}
+        name: nginx-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base
@@ -222,7 +223,8 @@ spec:
         - mountPath: /tmp/ps
           name: nginx-persistent-storage
       volumes:
-      - name: nginx-persistent-storage
+      - emptyDir: {}
+        name: nginx-persistent-storage
       - configMap:
           name: configmap-in-base
         name: configmap-in-base

api/krusty/keepemptyarray_test.go

@@ -0,0 +1,48 @@
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestKeepEmptyArray(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("/app/resources.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testing123
+spec:
+  replicas: 1
+  selector: null
+  template:
+    spec:
+      containers:
+      - name: event
+        image: testing123
+        imagePullPolicy: IfNotPresent
+      imagePullSecrets: []`)
+
+	th.WriteK("/app", `
+resources:
+- resources.yaml`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: testing123
+spec:
+  replicas: 1
+  selector: null
+  template:
+    spec:
+      containers:
+      - image: testing123
+        imagePullPolicy: IfNotPresent
+        name: event
+      imagePullSecrets: []
+`)
+}

api/krusty/multiplepatch_test.go

@@ -147,10 +147,10 @@ spec:
           pdName: nginx-persistent-storage
         name: nginx-persistent-storage
       - configMap:
-          name: a-b-configmap-in-base-fm96mhk4dt
+          name: a-b-configmap-in-base-798k5k7g9f
         name: configmap-in-base
       - configMap:
-          name: a-configmap-in-overlay-ffm9hf78mc
+          name: a-configmap-in-overlay-dc6fm46dhm
         name: configmap-in-overlay
 ---
 apiVersion: v1
@@ -175,7 +175,7 @@ metadata:
   labels:
     env: staging
     team: foo
-  name: a-b-configmap-in-base-fm96mhk4dt
+  name: a-b-configmap-in-base-798k5k7g9f
 ---
 apiVersion: v1
 data:
@@ -184,7 +184,7 @@ kind: ConfigMap
 metadata:
   labels:
     env: staging
-  name: a-configmap-in-overlay-ffm9hf78mc
+  name: a-configmap-in-overlay-dc6fm46dhm
 `)
 }
 
@@ -352,10 +352,10 @@ spec:
           pdName: nginx-persistent-storage
         name: nginx-persistent-storage
       - configMap:
-          name: staging-team-foo-configmap-in-base-g7k6gt2889
+          name: staging-team-foo-configmap-in-base-798k5k7g9f
         name: configmap-in-base
       - configMap:
-          name: staging-configmap-in-overlay-k7cbc75tg8
+          name: staging-configmap-in-overlay-dc6fm46dhm
         name: configmap-in-overlay
 ---
 apiVersion: v1
@@ -390,7 +390,7 @@ metadata:
     env: staging
     org: example.com
     team: foo
-  name: staging-team-foo-configmap-in-base-g7k6gt2889
+  name: staging-team-foo-configmap-in-base-798k5k7g9f
 ---
 apiVersion: v1
 data:
@@ -399,7 +399,7 @@ kind: ConfigMap
 metadata:
   labels:
     env: staging
-  name: staging-configmap-in-overlay-k7cbc75tg8
+  name: staging-configmap-in-overlay-dc6fm46dhm
 `)
 }
 
@@ -540,9 +540,10 @@ spec:
         - mountPath: /tmp/ps
           name: nginx-persistent-storage
       volumes:
-      - name: nginx-persistent-storage
+      - emptyDir: {}
+        name: nginx-persistent-storage
       - configMap:
-          name: staging-team-foo-configmap-in-base-g7k6gt2889
+          name: staging-team-foo-configmap-in-base-798k5k7g9f
         name: configmap-in-base
 ---
 apiVersion: v1
@@ -577,7 +578,7 @@ metadata:
     env: staging
     org: example.com
     team: foo
-  name: staging-team-foo-configmap-in-base-g7k6gt2889
+  name: staging-team-foo-configmap-in-base-798k5k7g9f
 ---
 apiVersion: v1
 data:
@@ -586,7 +587,7 @@ kind: ConfigMap
 metadata:
   labels:
     env: staging
-  name: staging-configmap-in-overlay-k7cbc75tg8
+  name: staging-configmap-in-overlay-dc6fm46dhm
 `)
 		})
 	}

api/krusty/namereference_test.go

@@ -0,0 +1,44 @@
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestEmptyFieldSpecValue(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+generators:
+- generators.yaml
+configurations:
+- kustomizeconfig.yaml
+`)
+	th.WriteF("/app/generators.yaml", `
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: secret-example
+labels:
+  app.kubernetes.io/name: secret-example
+literals:
+- this_is_a_secret_name=
+`)
+	th.WriteF("/app/kustomizeconfig.yaml", `
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: data/this_is_a_secret_name
+    kind: ConfigMap
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  this_is_a_secret_name: ""
+kind: ConfigMap
+metadata:
+  name: secret-example-7hf4fh868h
+`)
+}

api/krusty/namespacedgenerators_test.go

@@ -42,7 +42,7 @@ data:
   enableRisky: "false"
 kind: ConfigMap
 metadata:
-  name: the-non-default-namespace-map-b6h49k7mt8
+  name: the-non-default-namespace-map-64b2md8tth
   namespace: non-default
 ---
 apiVersion: v1
@@ -51,14 +51,14 @@ data:
   enableRisky: "false"
 kind: ConfigMap
 metadata:
-  name: the-map-4959m5tm6c
+  name: the-map-tg7t5hk8bk
 ---
 apiVersion: v1
 data:
   password.txt: dmVyeVNlY3JldA==
 kind: Secret
 metadata:
-  name: the-non-default-namespace-secret-h8d9hkgtb9
+  name: the-non-default-namespace-secret-8tc9gdd76t
   namespace: non-default
 type: Opaque
 ---
@@ -67,7 +67,7 @@ data:
   password.txt: YW5vdGhlclNlY3JldA==
 kind: Secret
 metadata:
-  name: the-secret-fgb45h45bh
+  name: the-secret-6557m7fcg8
 type: Opaque
 `)
 }
@@ -104,7 +104,7 @@ kind: ConfigMap
 metadata:
   annotations: {}
   labels: {}
-  name: testCase-4g75kbk6gm
+  name: testCase-bcbmmg48hd
   namespace: overlay
 `)
 }

api/krusty/rolebindingacrossnamespace_test.go

@@ -0,0 +1,215 @@
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestRoleBindingAcrossNamespace(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK("/app", `
+resources:
+- resource.yaml
+nameSuffix: -ns2
+`)
+	th.WriteF("/app/resource.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa1
+  namespace: ns1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa2
+  namespace: ns2
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa3
+  namespace: ns3
+---
+apiVersion: v1
+kind: NotServiceAccount
+metadata:
+  name: my-nsa
+  namespace: ns1
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: my-role
+  namespace: ns2
+rules:
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: my-role-binding
+  namespace: ns2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: my-role
+subjects:
+  - kind: ServiceAccount
+    name: my-sa1
+    namespace: ns1
+  - kind: ServiceAccount
+    name: my-sa2
+    namespace: ns2
+  - kind: ServiceAccount
+    name: my-sa3
+    namespace: ns3
+  - kind: NotServiceAccount
+    name: my-nsa
+    namespace: ns1
+`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa1-ns2
+  namespace: ns1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa2-ns2
+  namespace: ns2
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa3-ns2
+  namespace: ns3
+---
+apiVersion: v1
+kind: NotServiceAccount
+metadata:
+  name: my-nsa-ns2
+  namespace: ns1
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: my-role-ns2
+  namespace: ns2
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: my-role-binding-ns2
+  namespace: ns2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: my-role-ns2
+subjects:
+- kind: ServiceAccount
+  name: my-sa1-ns2
+  namespace: ns1
+- kind: ServiceAccount
+  name: my-sa2-ns2
+  namespace: ns2
+- kind: ServiceAccount
+  name: my-sa3-ns2
+  namespace: ns3
+- kind: NotServiceAccount
+  name: my-nsa
+  namespace: ns1
+`)
+}
+
+func TestRoleBindingAcrossNamespaceWoSubjects(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK("/app", `
+resources:
+- resource.yaml
+nameSuffix: -ns2
+`)
+	th.WriteF("/app/resource.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa1
+  namespace: ns1
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: my-role
+  namespace: ns2
+rules:
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: my-role-binding
+  namespace: ns2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: my-role
+`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-sa1-ns2
+  namespace: ns1
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: my-role-ns2
+  namespace: ns2
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: my-role-binding-ns2
+  namespace: ns2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: my-role-ns2
+`)
+}

api/krusty/transformerplugin_test.go

@@ -10,24 +10,6 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-func writeDeployment(th *kusttest_test.HarnessEnhanced, path string) {
-	th.WriteF(path, `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myDeployment
-spec:
-  template:
-    metadata:
-      labels:
-        backend: awesome
-    spec:
-      containers:
-      - name: whatever
-        image: whatever
-`)
-}
-
 func writeStringPrefixer(th *kusttest_test.HarnessEnhanced, path, name string) {
 	th.WriteF(path, `
 apiVersion: someteam.example.com/v1
@@ -37,53 +19,6 @@ metadata:
 `)
 }
 
-func writeDatePrefixer(th *kusttest_test.HarnessEnhanced, path, name string) {
-	th.WriteF(path, `
-apiVersion: someteam.example.com/v1
-kind: DatePrefixer
-metadata:
-  name: `+name+`
-`)
-}
-
-func TestOrderedTransformers(t *testing.T) {
-	th := kusttest_test.MakeEnhancedHarness(t).
-		BuildGoPlugin("someteam.example.com", "v1", "StringPrefixer").
-		BuildGoPlugin("someteam.example.com", "v1", "DatePrefixer")
-	defer th.Reset()
-
-	th.WriteK("/app", `
-resources:
-- deployment.yaml
-transformers:
-- peachPrefixer.yaml
-- date1Prefixer.yaml
-- applePrefixer.yaml
-- date2Prefixer.yaml
-`)
-	writeDeployment(th, "/app/deployment.yaml")
-	writeStringPrefixer(th, "/app/applePrefixer.yaml", "apple")
-	writeStringPrefixer(th, "/app/peachPrefixer.yaml", "peach")
-	writeDatePrefixer(th, "/app/date1Prefixer.yaml", "date1")
-	writeDatePrefixer(th, "/app/date2Prefixer.yaml", "date2")
-	m := th.Run("/app", th.MakeOptionsPluginsEnabled())
-	th.AssertActualEqualsExpected(m, `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: 2018-05-11-apple-2018-05-11-peach-myDeployment
-spec:
-  template:
-    metadata:
-      labels:
-        backend: awesome
-    spec:
-      containers:
-      - image: whatever
-        name: whatever
-`)
-}
-
 func TestPluginsNotEnabled(t *testing.T) {
 	th := kusttest_test.MakeEnhancedHarness(t).
 		BuildGoPlugin("someteam.example.com", "v1", "StringPrefixer")
@@ -161,7 +96,79 @@ data:
   FOO: foo
 kind: ConfigMap
 metadata:
-  name: test-k4bkhftttd
+  name: test-6bc28fff49
+`)
+}
+
+/*
+
+The tests below are disabled until the StringPrefixer and DatePrefixer
+can be rewritten using kyaml, instead of depending on the
+PrefixSuffixTransformerPlugin.  That dependency is causing
+failures in the test loader.
+
+func writeDeployment(th *kusttest_test.HarnessEnhanced, path string) {
+	th.WriteF(path, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - name: whatever
+        image: whatever
+`)
+}
+
+func writeDatePrefixer(th *kusttest_test.HarnessEnhanced, path, name string) {
+	th.WriteF(path, `
+apiVersion: someteam.example.com/v1
+kind: DatePrefixer
+metadata:
+  name: `+name+`
+`)
+}
+
+func TestOrderedTransformers(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t).
+		BuildGoPlugin("someteam.example.com", "v1", "StringPrefixer").
+		BuildGoPlugin("someteam.example.com", "v1", "DatePrefixer")
+	defer th.Reset()
+
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+transformers:
+- peachPrefixer.yaml
+- date1Prefixer.yaml
+- applePrefixer.yaml
+- date2Prefixer.yaml
+`)
+	writeDeployment(th, "/app/deployment.yaml")
+	writeStringPrefixer(th, "/app/applePrefixer.yaml", "apple")
+	writeStringPrefixer(th, "/app/peachPrefixer.yaml", "peach")
+	writeDatePrefixer(th, "/app/date1Prefixer.yaml", "date1")
+	writeDatePrefixer(th, "/app/date2Prefixer.yaml", "date2")
+	m := th.Run("/app", th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: 2018-05-11-apple-2018-05-11-peach-myDeployment
+spec:
+  template:
+    metadata:
+      labels:
+        backend: awesome
+    spec:
+      containers:
+      - image: whatever
+        name: whatever
 `)
 }
 
@@ -205,3 +212,4 @@ spec:
         name: whatever
 `)
 }
+*/

api/krusty/transformersimage_test.go

@@ -173,6 +173,9 @@ spec:
 `)
 }
 
+// The default configuration recognizes image paths starting
+// with "spec", not spec2 or spec3, so the latter two specs won't
+// have their image entries changed.
 func TestTransfomersImageDefaultConfig(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	makeTransfomersImageBase(th)
@@ -212,25 +215,25 @@ spec2:
   template:
     spec:
       containers:
-      - image: nginx:v2
+      - image: nginx:v1
         name: nginx3
-      - image: my-nginx:previous
+      - image: my-nginx:latest
         name: nginx4
 spec3:
   template:
     spec:
       initContainers:
-      - image: my-postgres:v3
+      - image: postgres:alpine-9
         name: postgresdb
-      - image: my-docker@sha256:25a0d4b4
+      - image: docker:17-git
         name: init-docker
-      - image: myprivaterepohostname:1234/my/image:v1.0.1
+      - image: myprivaterepohostname:1234/my/image:latest
         name: myImage
-      - image: myprivaterepohostname:1234/my/image:v1.0.1
+      - image: myprivaterepohostname:1234/my/image
         name: myImage2
       - image: my-app-image:v1
         name: my-app
-      - image: my-cool-app:latest
+      - image: gcr.io:8080/my-project/my-cool-app:latest
         name: my-cool-app
 `)
 }
@@ -299,11 +302,11 @@ spec3:
 	th.WriteF("/app/base/config/custom.yaml", `
 images:
 - kind: Custom
-  path: spec/template/spec/myContainers/image
+  path: spec/template/spec/myContainers[]/image
 - kind: Custom
-  path: spec2/template/spec/myContainers/image
+  path: spec2/template/spec/myContainers[]/image
 - kind: Custom
-  path: spec3/template/spec/myInitContainers/image
+  path: spec3/template/spec/myInitContainers[]/image
 `)
 }
 

api/krusty/variableref_test.go

@@ -895,7 +895,7 @@ spec:
           - command:
             - echo
             - dev-base-cockroachdb
-            - dev-base-test-config-map-b2g2dmd64b
+            - dev-base-test-config-map-6b85g79g7g
             env:
             - name: CDB_PUBLIC_SVC
               value: dev-base-cockroachdb-public
@@ -921,7 +921,7 @@ data:
   foo: bar
 kind: ConfigMap
 metadata:
-  name: dev-base-test-config-map-b2g2dmd64b
+  name: dev-base-test-config-map-6b85g79g7g
 `)
 }
 

api/resid/gvk.go

@@ -95,6 +95,8 @@ var orderFirst = []string{
 	"Service",
 	"LimitRange",
 	"PriorityClass",
+	"PersistentVolume",
+	"PersistentVolumeClaim",
 	"Deployment",
 	"StatefulSet",
 	"CronJob",

api/resmap/factory.go

@@ -40,6 +40,15 @@ func (rmF *Factory) FromResource(res *resource.Resource) ResMap {
 	return m
 }
 
+// FromResourceSlice returns a ResMap with a slice of resources.
+func (rmF *Factory) FromResourceSlice(ress []*resource.Resource) ResMap {
+	m, err := newResMapFromResourceSlice(ress)
+	if err != nil {
+		panic(err)
+	}
+	return m
+}
+
 // FromFile returns a ResMap given a resource path.
 func (rmF *Factory) FromFile(
 	loader ifc.Loader, path string) (ResMap, error) {

api/resmap/resmap.go

@@ -611,19 +611,50 @@ func (m *resWrangler) SubsetThatCouldBeReferencedByResource(
 	inputId := inputRes.CurId()
 	isInputIdNamespaceable := inputId.IsNamespaceableKind()
 	rctxm := inputRes.PrefixesSuffixesEquals
+	subjectNamespaces := getNamespacesForRoleBinding(inputRes)
 	for _, r := range m.Resources() {
 		// Need to match more accuratly both at the time of selection and transformation.
 		// OutmostPrefixSuffixEquals is not accurate enough since it is only using
 		// the outer most suffix and the last prefix. Use PrefixedSuffixesEquals instead.
 		resId := r.CurId()
-		if (!isInputIdNamespaceable || !resId.IsNamespaceableKind() || resId.IsNsEquals(inputId)) &&
-			r.InSameKustomizeCtx(rctxm) {
+		if (!isInputIdNamespaceable || !resId.IsNamespaceableKind() || resId.IsNsEquals(inputId) ||
+			isRoleBindingNamespace(&subjectNamespaces, r.GetNamespace())) && r.InSameKustomizeCtx(rctxm) {
 			result.append(r)
 		}
 	}
 	return result
 }
 
+// isRoleBindingNamespace returns true is the namespace `ns` is in role binding
+// namespaces `m`
+func isRoleBindingNamespace(m *map[string]bool, ns string) bool {
+	return (*m)[ns]
+}
+
+// getNamespacesForRoleBinding returns referenced ServiceAccount namespaces if the inputRes is
+// a RoleBinding
+func getNamespacesForRoleBinding(inputRes *resource.Resource) map[string]bool {
+	res := make(map[string]bool)
+	if inputRes.GetKind() != "RoleBinding" {
+		return res
+	}
+	subjects, err := inputRes.GetSlice("subjects")
+	if err != nil || subjects == nil {
+		return res
+	}
+
+	for _, s := range subjects {
+		subject := s.(map[string]interface{})
+		if subject["namespace"] == nil || subject["kind"] == nil ||
+			subject["kind"].(string) != "ServiceAccount" {
+			continue
+		}
+		res[subject["namespace"].(string)] = true
+	}
+
+	return res
+}
+
 func (m *resWrangler) append(res *resource.Resource) {
 	m.rList = append(m.rList, res)
 }

api/resource/factory.go

@@ -146,6 +146,22 @@ func (rf *Factory) SliceFromBytes(in []byte) ([]*Resource, error) {
 	return result, nil
 }
 
+// SliceFromBytesWithNames unmarshals bytes into a Resource slice with specified original
+// name.
+func (rf *Factory) SliceFromBytesWithNames(names []string, in []byte) ([]*Resource, error) {
+	result, err := rf.SliceFromBytes(in)
+	if err != nil {
+		return nil, err
+	}
+	if len(names) != len(result) {
+		return nil, fmt.Errorf("number of names doesn't match number of resources")
+	}
+	for i, res := range result {
+		res.originalName = names[i]
+	}
+	return result, nil
+}
+
 // MakeConfigMap makes an instance of Resource for ConfigMap
 func (rf *Factory) MakeConfigMap(kvLdr ifc.KvLoader, args *types.ConfigMapArgs) (*Resource, error) {
 	u, err := rf.kf.MakeConfigMap(kvLdr, args)

api/resource/factory_test.go

@@ -13,6 +13,178 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
+func TestSliceFromBytes(t *testing.T) {
+	type testCase struct {
+		input    string
+		expected []string
+	}
+	testCases := map[string]testCase{
+		"empty1": {
+			input:    "",
+			expected: []string{},
+		},
+		"empty2": {
+			input: `
+---
+---
+`,
+			expected: []string{},
+		},
+		"deployment1": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pooh
+---
+`,
+			expected: []string{
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pooh
+`,
+			},
+		},
+		"deployment2": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      foo: bar
+  template:
+    metadata:
+      annotations:
+        baseAnno: This is a base annotation
+      labels:
+        app: mungebot
+        foo: bar
+    spec:
+      containers:
+      - env:
+        - name: foo
+          value: bar
+        image: nginx
+        name: nginx
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot-service
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: mungebot
+    foo: bar
+`,
+			expected: []string{
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      foo: bar
+  template:
+    metadata:
+      annotations:
+        baseAnno: This is a base annotation
+      labels:
+        app: mungebot
+        foo: bar
+    spec:
+      containers:
+      - env:
+        - name: foo
+          value: bar
+        image: nginx
+        name: nginx
+        ports:
+        - containerPort: 80
+`,
+				`apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    baseAnno: This is a base annotation
+  labels:
+    app: mungebot
+    foo: bar
+  name: baseprefix-mungebot-service
+spec:
+  ports:
+  - port: 7002
+  selector:
+    app: mungebot
+    foo: bar
+`,
+			},
+		},
+	}
+
+	for name := range testCases {
+		tc := testCases[name]
+		t.Run(name, func(t *testing.T) {
+			result, err := factory.SliceFromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatalf("%v: fails with err: %v", name, err)
+			}
+			if len(result) != len(tc.expected) {
+				for i := range result {
+					bytes, err := result[i].AsYAML()
+					if err != nil {
+						t.Fatalf("%v: result to YAML fails with err: %v", name, err)
+					}
+					tmp := string(bytes)
+					t.Logf("--- %d:\n%s", i, tmp)
+				}
+				t.Fatalf(
+					"%v: actual len %d != expected len %d",
+					name, len(result), len(tc.expected))
+			}
+			for i := range tc.expected {
+				bytes, err := result[i].AsYAML()
+				if err != nil {
+					t.Fatalf("%v: result to YAML fails with err: %v", name, err)
+				}
+				tmp := string(bytes)
+				if tmp != tc.expected[i] {
+					t.Fatalf(
+						"%v: string mismatch in item %d\n"+
+							"actual:\n-----\n%s\n-----\n"+
+							"expected:\n-----\n%s\n-----\n",
+						name, i, tmp, tc.expected[i])
+				}
+			}
+		})
+	}
+}
+
 func TestSliceFromPatches(t *testing.T) {
 	patchGood1 := types.PatchStrategicMerge("patch1.yaml")
 	patch1 := `

api/testutils/filtertest/runfilter.go

@@ -11,7 +11,7 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/kio"
 )
 
-func RunFilter(t *testing.T, input string, f kio.Filter) string {
+func run(input string, f kio.Filter) (string, error) {
 	var out bytes.Buffer
 	rw := kio.ByteReadWriter{
 		Reader: bytes.NewBufferString(input),
@@ -23,8 +23,26 @@ func RunFilter(t *testing.T, input string, f kio.Filter) string {
 		Filters: []kio.Filter{f},
 		Outputs: []kio.Writer{&rw},
 	}.Execute()
+	if err != nil {
+		return "", err
+	}
+	return out.String(), nil
+}
+
+// RunFilter runs filter and panic if there is error
+func RunFilter(t *testing.T, input string, f kio.Filter) string {
+	output, err := run(input, f)
 	if !assert.NoError(t, err) {
 		t.FailNow()
 	}
-	return out.String()
+	return output
+}
+
+// RunFilterE runs filter and return error if there is
+func RunFilterE(t *testing.T, input string, f kio.Filter) (string, error) {
+	output, err := run(input, f)
+	if err != nil {
+		return "", err
+	}
+	return output, nil
 }

api/testutils/kusttest/harnessenhanced.go

@@ -4,9 +4,6 @@
 package kusttest_test
 
 import (
-	"bytes"
-	"fmt"
-	"strconv"
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
@@ -20,8 +17,6 @@ import (
 	"sigs.k8s.io/kustomize/api/resource"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/kio"
-	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // HarnessEnhanced manages a full plugin environment for tests.
@@ -130,42 +125,8 @@ func (th *HarnessEnhanced) LoadAndRunTransformer(
 
 func (th *HarnessEnhanced) RunTransformerAndCheckResult(
 	config, input, expected string) {
-	for _, b := range []bool{true, false} {
-		th.t.Run(fmt.Sprintf("yaml-%v", b), func(t *testing.T) {
-			c, err := toggleYamlSupportField(config, b)
-			if err != nil {
-				th.t.Fatalf("Err: %v", err)
-			}
-			resMap, err := th.RunTransformer(c, input)
-			if err != nil {
-				th.t.Fatalf("Err: %v", err)
-			}
-			th.AssertActualEqualsExpected(resMap, expected)
-		})
-	}
-}
-
-func toggleYamlSupportField(config string, yamlSupport bool) (string, error) {
-	var out bytes.Buffer
-	rw := kio.ByteReadWriter{
-		Reader: bytes.NewBufferString(config),
-		Writer: &out,
-	}
-	err := kio.Pipeline{
-		Inputs: []kio.Reader{&rw},
-		Filters: []kio.Filter{
-			kio.FilterAll(yaml.FilterFunc(
-				func(node *yaml.RNode) (*yaml.RNode, error) {
-					return node.Pipe(yaml.FieldSetter{
-						Name:        "yamlSupport",
-						StringValue: strconv.FormatBool(yamlSupport),
-					})
-				}),
-			),
-		},
-		Outputs: []kio.Writer{&rw},
-	}.Execute()
-	return out.String(), err
+	resMap := th.LoadAndRunTransformer(config, input)
+	th.AssertActualEqualsExpected(resMap, expected)
 }
 
 func (th *HarnessEnhanced) ErrorFromLoadAndRunTransformer(
@@ -178,16 +139,8 @@ type AssertFunc func(t *testing.T, err error)
 
 func (th *HarnessEnhanced) RunTransformerAndCheckError(
 	config, input string, assertFn AssertFunc) {
-	for _, b := range []bool{true, false} {
-		th.t.Run(fmt.Sprintf("yaml-%v", b), func(t *testing.T) {
-			c, err := toggleYamlSupportField(config, b)
-			if err != nil {
-				th.t.Fatalf("Err: %v", err)
-			}
-			_, err = th.RunTransformer(c, input)
-			assertFn(t, err)
-		})
-	}
+	_, err := th.RunTransformer(config, input)
+	assertFn(th.t, err)
 }
 
 func (th *HarnessEnhanced) RunTransformer(
@@ -203,6 +156,7 @@ func (th *HarnessEnhanced) RunTransformerFromResMap(
 	config string, resMap resmap.ResMap) (resmap.ResMap, error) {
 	transConfig, err := th.rf.RF().FromBytes([]byte(config))
 	if err != nil {
+		th.t.Logf("config: '%s'", config)
 		th.t.Fatalf("Err: %v", err)
 	}
 	g, err := th.pl.LoadTransformer(

api/types/kustomization.go

@@ -3,6 +3,13 @@
 
 package types
 
+import (
+	"bytes"
+	"encoding/json"
+
+	"sigs.k8s.io/yaml"
+)
+
 const (
 	KustomizationVersion  = "kustomize.config.k8s.io/v1beta1"
 	KustomizationKind     = "Kustomization"
@@ -165,3 +172,20 @@ func (k *Kustomization) EnforceFields() []string {
 	}
 	return errs
 }
+
+// Unmarshal replace k with the content in YAML input y
+func (k *Kustomization) Unmarshal(y []byte) error {
+	j, err := yaml.YAMLToJSON(y)
+	if err != nil {
+		return err
+	}
+	dec := json.NewDecoder(bytes.NewReader(j))
+	dec.DisallowUnknownFields()
+	var nk Kustomization
+	err = dec.Decode(&nk)
+	if err != nil {
+		return err
+	}
+	*k = nk
+	return nil
+}

api/types/kustomization_test.go

@@ -0,0 +1,184 @@
+package types
+
+import (
+	"testing"
+)
+
+func fixKustomizationPostUnmarshallingCheck(k, e *Kustomization) bool {
+	return (k.Kind == e.Kind && k.APIVersion == e.APIVersion &&
+		len(k.Resources) == len(e.Resources) && k.Resources[0] == e.Resources[0] &&
+		k.Bases == nil)
+}
+
+func TestFixKustomizationPostUnmarshalling(t *testing.T) {
+	var k Kustomization
+	k.Bases = append(k.Bases, "foo")
+	k.FixKustomizationPostUnmarshalling()
+
+	expected := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       KustomizationKind,
+			APIVersion: KustomizationVersion,
+		},
+		Resources: []string{"foo"},
+	}
+
+	if !fixKustomizationPostUnmarshallingCheck(&k, &expected) {
+		t.Fatalf("unexpected output: %v", k)
+	}
+}
+
+func TestFixKustomizationPostUnmarshalling_2(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind: ComponentKind,
+		},
+	}
+	k.Bases = append(k.Bases, "foo")
+	k.FixKustomizationPostUnmarshalling()
+
+	expected := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       ComponentKind,
+			APIVersion: ComponentVersion,
+		},
+		Resources: []string{"foo"},
+	}
+
+	if !fixKustomizationPostUnmarshallingCheck(&k, &expected) {
+		t.Fatalf("unexpected output: %v", k)
+	}
+}
+
+func TestEnforceFields_InvalidKindAndVersion(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       "foo",
+			APIVersion: "bar",
+		},
+	}
+
+	errs := k.EnforceFields()
+	if len(errs) != 2 {
+		t.Fatalf("number of errors should be 2 but got: %v", errs)
+	}
+}
+
+func TestEnforceFields_InvalidKind(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       "foo",
+			APIVersion: KustomizationVersion,
+		},
+	}
+
+	errs := k.EnforceFields()
+	if len(errs) != 1 {
+		t.Fatalf("number of errors should be 1 but got: %v", errs)
+	}
+
+	expected := "kind should be " + KustomizationKind + " or " + ComponentKind
+	if errs[0] != expected {
+		t.Fatalf("error should be %v but got: %v", expected, errs[0])
+	}
+}
+
+func TestEnforceFields_InvalidVersion(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       KustomizationKind,
+			APIVersion: "bar",
+		},
+	}
+
+	errs := k.EnforceFields()
+	if len(errs) != 1 {
+		t.Fatalf("number of errors should be 1 but got: %v", errs)
+	}
+
+	expected := "apiVersion for " + k.Kind + " should be " + KustomizationVersion
+	if errs[0] != expected {
+		t.Fatalf("error should be %v but got: %v", expected, errs[0])
+	}
+}
+
+func TestEnforceFields_ComponentKind(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       ComponentKind,
+			APIVersion: "bar",
+		},
+	}
+
+	errs := k.EnforceFields()
+	if len(errs) != 1 {
+		t.Fatalf("number of errors should be 1 but got: %v", errs)
+	}
+
+	expected := "apiVersion for " + k.Kind + " should be " + ComponentVersion
+	if errs[0] != expected {
+		t.Fatalf("error should be %v but got: %v", expected, errs[0])
+	}
+}
+
+func TestEnforceFields(t *testing.T) {
+	k := Kustomization{
+		TypeMeta: TypeMeta{
+			Kind:       KustomizationKind,
+			APIVersion: KustomizationVersion,
+		},
+	}
+
+	errs := k.EnforceFields()
+	if len(errs) != 0 {
+		t.Fatalf("number of errors should be 0 but got: %v", errs)
+	}
+}
+
+func TestUnmarshal(t *testing.T) {
+	y := []byte(`
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- foo
+- bar
+nameSuffix: dog
+namePrefix: cat`)
+	var k Kustomization
+	err := k.Unmarshal(y)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if k.Kind != KustomizationKind || k.APIVersion != KustomizationVersion ||
+		len(k.Resources) != 2 || k.NamePrefix != "cat" || k.NameSuffix != "dog" {
+		t.Fatalf("wrong unmarshal result: %v", k)
+	}
+}
+
+func TestUnmarshal_UnkownField(t *testing.T) {
+	y := []byte(`
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+unknown: foo`)
+	var k Kustomization
+	err := k.Unmarshal(y)
+	if err == nil {
+		t.Fatalf("expect an error")
+	}
+	expect := "json: unknown field \"unknown\""
+	if err.Error() != expect {
+		t.Fatalf("expect %v but got: %v", expect, err.Error())
+	}
+}
+
+func TestUnmarshal_InvalidYaml(t *testing.T) {
+	y := []byte(`
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+unknown`)
+	var k Kustomization
+	err := k.Unmarshal(y)
+	if err == nil {
+		t.Fatalf("expect an error")
+	}
+}

cmd/config/docs/commands/delete-setter.md

@@ -0,0 +1,65 @@
+## delete-setter
+
+[Alpha] Delete a custom setter for a Resource field
+
+### Synopsis
+
+Delete a custom setter for a Resource field.
+
+  DIR
+
+    A directory containing Resource configuration.
+
+  NAME
+
+    The name of the setter to create.
+
+### Deleting a Custom Setter
+
+**Given the YAML:**
+
+    # resource.yaml
+    apiVersion: v1
+    kind: Service
+    metadata:
+      ...
+    spec:
+      ...
+      ports:
+        ...
+      - name: http
+        port: 8080  # {"type":"integer","x-kustomize":{"partialFieldSetters":[{"name":"http-port","value":"8080"}]}}
+        ...
+
+**Delete setter:**
+
+    # delete a setter for ports
+    $ kustomize cfg set create DIR/ http-port
+
+comment will be removed for this field is not settable any more.
+
+**Newly modified YAML:**
+
+    # resource.yaml
+    apiVersion: v1
+    kind: Service
+    metadata:
+      ...
+    spec:
+      ...
+      ports:
+        ...
+      - name: http
+        port: 8080
+        ...
+
+
+### Deleting a setter used in substitution
+
+If the setter is also used in substitution, it will ask you to delete the substitution first.
+
+
+### Examples
+
+    # delete a setter for port
+    kustomize cfg create-setter DIR/ port

cmd/config/go.mod

@@ -14,6 +14,6 @@ require (
 	k8s.io/cli-runtime v0.17.3
 	k8s.io/client-go v0.17.3
 	k8s.io/kubectl v0.0.0-20191219154910-1528d4eea6dd
-	sigs.k8s.io/cli-utils v0.16.0
-	sigs.k8s.io/kustomize/kyaml v0.4.0
+	sigs.k8s.io/cli-utils v0.17.0
+	sigs.k8s.io/kustomize/kyaml v0.5.0
 )

cmd/config/go.sum

@@ -452,6 +452,7 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -616,14 +617,15 @@ modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
 modernc.org/strutil v1.0.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
 modernc.org/xc v1.0.0/go.mod h1:mRNCo0bvLjGhHO9WsyuKVU4q0ceiDDDoEeWDJHrNx8I=
-sigs.k8s.io/cli-utils v0.16.0 h1:Wr32m1oxjIqc9G9l+igr13PeIM9LCyq8jQ8KjXKelvg=
-sigs.k8s.io/cli-utils v0.16.0/go.mod h1:9Jqm9K2W6ShhCxsEuaz6HSRKKOXigPUx3ZfypGgxBLY=
+sigs.k8s.io/cli-utils v0.17.0 h1:iQ0nhgU8DZiRphHTErI1IHcHYp2fZaULrrFN4NF3dCc=
+sigs.k8s.io/cli-utils v0.17.0/go.mod h1:9Jqm9K2W6ShhCxsEuaz6HSRKKOXigPUx3ZfypGgxBLY=
 sigs.k8s.io/controller-runtime v0.4.0 h1:wATM6/m+3w8lj8FXNaO6Fs/rq/vqoOjO1Q116Z9NPsg=
 sigs.k8s.io/controller-runtime v0.4.0/go.mod h1:ApC79lpY3PHW9xj/w9pj+lYkLgwAAUZwfXkME1Lajns=
 sigs.k8s.io/kustomize v2.0.3+incompatible h1:JUufWFNlI44MdtnjUqVnvh29rR37PQFzPbLXqhyOyX0=
 sigs.k8s.io/kustomize v2.0.3+incompatible/go.mod h1:MkjgH3RdOWrievjo6c9T245dYlB5QeXV4WCbnt/PEpU=
-sigs.k8s.io/kustomize/kyaml v0.4.0 h1:jMQrJOJmiUz5Y018ki0mXWpEreEXjvad1NRfXTdi9vU=
 sigs.k8s.io/kustomize/kyaml v0.4.0/go.mod h1:XJL84E6sOFeNrQ7CADiemc1B0EjIxHo3OhW4o1aJYNw=
+sigs.k8s.io/kustomize/kyaml v0.5.0 h1:xufpSxgpugQxtd0aN1ZsWnr3Kj0fpAi7GN4dnEs4oPg=
+sigs.k8s.io/kustomize/kyaml v0.5.0/go.mod h1:bEzbO5pN9OvlEeCLvFHo8Pu7SA26Herc2m60UeWZBdI=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190817042607-6149e4549fca/go.mod h1:IIgPezJWb76P0hotTxzDbWsMYB8APh18qZnxkomBpxA=
 sigs.k8s.io/structured-merge-diff v1.0.1-0.20191108220359-b1b620dd3f06 h1:zD2IemQ4LmOcAumeiyDWXKUI2SO0NYDe3H6QGvPOVgU=

cmd/config/internal/commands/cmdcreatesetter.go

@@ -4,6 +4,10 @@
 package commands
 
 import (
+	"encoding/json"
+	"io/ioutil"
+	"strings"
+
 	"github.com/go-openapi/spec"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/ext"
@@ -52,7 +56,7 @@ func NewCreateSetterRunner(parent string) *CreateSetterRunner {
 		"use this version of the setter format")
 	set.Flags().BoolVar(&r.CreateSetter.Required, "required", false,
 		"indicates that this setter must be set by package consumer before live apply/preview")
-	set.Flags().StringVar(&r.CreateSetter.SchemaPath, "schema-path", "",
+	set.Flags().StringVar(&r.SchemaPath, "schema-path", "",
 		`openAPI schema file path for setter constraints -- file content `+
 			`e.g. {"type": "string", "maxLength": 15, "enum": ["allowedValue1", "allowedValue2"]}`)
 	set.Flags().MarkHidden("version")
@@ -70,6 +74,7 @@ type CreateSetterRunner struct {
 	Set          setters.CreateSetter
 	CreateSetter settersutil.SetterCreator
 	OpenAPIFile  string
+	SchemaPath   string
 }
 
 func (r *CreateSetterRunner) runE(c *cobra.Command, args []string) error {
@@ -95,12 +100,16 @@ func (r *CreateSetterRunner) preRunE(c *cobra.Command, args []string) error {
 	if setterVersion == "" {
 		if len(args) == 2 && r.Set.SetPartialField.Type == "array" && c.Flag("field").Changed {
 			setterVersion = "v2"
-		} else if len(args) < 2 || !c.Flag("value").Changed && len(args) < 3 {
-			setterVersion = "v1"
 		} else if err := initSetterVersion(c, args); err != nil {
 			return err
 		}
 	}
+
+	if r.Set.SetPartialField.Type != "array" && !c.Flag("value").Changed && len(args) < 3 {
+		return errors.Errorf("setter name and value must be provided, " +
+			"value can either be an argument or can be passed as a flag --value")
+	}
+
 	if setterVersion == "v2" {
 		var err error
 		r.OpenAPIFile, err = ext.GetOpenAPIFile(args)
@@ -125,10 +134,28 @@ func (r *CreateSetterRunner) preRunE(c *cobra.Command, args []string) error {
 				"substitution and setter can't have same name", r.CreateSetter.Name)
 		}
 
+		// check if setter with same name exists and throw error
+		ref, err = spec.NewRef(fieldmeta.DefinitionsPrefix + fieldmeta.SetterDefinitionPrefix + r.CreateSetter.Name)
+		if err != nil {
+			return err
+		}
+
+		setter, _ := openapi.Resolve(&ref)
+		// if setter already exists with the input setter name, throw error
+		if setter != nil {
+			return errors.Errorf("setter with name %s already exists, "+
+				"if you want to modify it, please delete the existing setter and recreate it", r.CreateSetter.Name)
+		}
+
 		r.CreateSetter.Description = r.Set.SetPartialField.Description
 		r.CreateSetter.SetBy = r.Set.SetPartialField.SetBy
 		r.CreateSetter.Type = r.Set.SetPartialField.Type
 
+		err = r.processSchema()
+		if err != nil {
+			return err
+		}
+
 		if r.CreateSetter.Type == "array" {
 			if !c.Flag("field").Changed {
 				return errors.Errorf("field flag must be set for array type setters")
@@ -138,6 +165,51 @@ func (r *CreateSetterRunner) preRunE(c *cobra.Command, args []string) error {
 	return nil
 }
 
+func (r *CreateSetterRunner) processSchema() error {
+	sc, err := schemaFromFile(r.SchemaPath)
+	if err != nil {
+		return err
+	}
+
+	flagType := r.CreateSetter.Type
+	var schemaType string
+	switch {
+	// json schema allows more than one type to be specified, but openapi
+	// only allows one. So we follow the openapi convention.
+	case len(sc.Type) > 1:
+		return errors.Errorf("only one type is supported: %s",
+			strings.Join(sc.Type, ", "))
+	case len(sc.Type) == 1:
+		schemaType = sc.Type[0]
+	}
+
+	// Since type can be set both through the schema file and through the
+	// --type flag, we make sure the same value is set in both places. If they
+	// are both set with different values, we return an error.
+	switch {
+	case flagType == "" && schemaType != "":
+		r.CreateSetter.Type = schemaType
+	case flagType != "" && schemaType == "":
+		sc.Type = []string{flagType}
+	case flagType != "" && schemaType != "":
+		if flagType != schemaType {
+			return errors.Errorf("type provided in type flag (%s) and in schema (%s) doesn't match",
+				r.CreateSetter.Type, sc.Type[0])
+		}
+	}
+
+	// Only marshal the properties in SchemaProps. This means any fields in
+	// the schema file that isn't recognized will be dropped.
+	// TODO: Consider if we should return an error here instead of just dropping
+	// the unknown fields.
+	b, err := json.Marshal(sc.SchemaProps)
+	if err != nil {
+		return errors.Errorf("error marshalling schema: %v", err)
+	}
+	r.CreateSetter.Schema = string(b)
+	return nil
+}
+
 func (r *CreateSetterRunner) set(c *cobra.Command, args []string) error {
 	if setterVersion == "v2" {
 		return r.CreateSetter.Create(r.OpenAPIFile, args[0])
@@ -153,3 +225,25 @@ func (r *CreateSetterRunner) set(c *cobra.Command, args []string) error {
 	}
 	return nil
 }
+
+// schemaFromFile reads the contents from schemaPath and returns schema
+func schemaFromFile(schemaPath string) (*spec.Schema, error) {
+	sc := &spec.Schema{}
+	if schemaPath == "" {
+		return sc, nil
+	}
+	sch, err := ioutil.ReadFile(schemaPath)
+	if err != nil {
+		return sc, err
+	}
+
+	if len(sch) == 0 {
+		return sc, nil
+	}
+
+	err = sc.UnmarshalJSON(sch)
+	if err != nil {
+		return sc, errors.Errorf("unable to parse schema: %v", err)
+	}
+	return sc, nil
+}

cmd/config/internal/commands/cmdcreatesetter_test.go

@@ -125,6 +125,24 @@ openAPI:
 			err: "substitution with name my-image already exists, substitution and setter can't have same name",
 		},
 
+		{
+			name: "error if setter with same name exists",
+			args: []string{
+				"my-image", "ubuntu"},
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.setters.my-image:
+      x-k8s-cli:
+        setter:
+          name: my-image
+          value: "nginx"
+ `,
+			err: "setter with name my-image already exists, if you want to modify it, please delete the existing setter and recreate it",
+		},
+
 		{
 			name:   "add replicas with schema",
 			args:   []string{"replicas", "3", "--description", "hello world", "--set-by", "me"},
@@ -166,6 +184,36 @@ spec:
  `,
 		},
 
+		{
+			name: "add replicas not enough arguments",
+			args: []string{"replicas", "--description", "hello world", "--set-by", "me"},
+			err:  `setter name and value must be provided, value can either be an argument or can be passed as a flag --value`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+		},
+
 		{
 			name:   "list values with schema",
 			args:   []string{"list", "--description", "hello world", "--set-by", "me", "--type", "array", "--field", "spec.list"},
@@ -368,6 +416,318 @@ openAPI:
 			expectedResources: `
 apiVersion: apps/v1
 kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3 # {"$openapi":"replicas"}
+ `,
+		},
+		{
+			name: "add setter with . in the name",
+			args: []string{"foo.bar", "3"},
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.setters.foo.bar:
+      x-k8s-cli:
+        setter:
+          name: foo.bar
+          value: "3"
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3 # {"$openapi":"foo.bar"}
+ `,
+		},
+
+		{
+			name: "create setter v1",
+			args: []string{"hubsetter", "my-hub"},
+			inputOpenAPI: `
+ `,
+			input: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name"
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub: my-hub
+ `,
+			expectedOpenAPI: `
+ `,
+			expectedResources: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name"
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub: my-hub # {"type":"","x-kustomize":{"setter":{"name":"hubsetter","value":"my-hub"}}}
+ `,
+		},
+
+		{
+			name: "create partial setter v1",
+			args: []string{"regionsetter", "us-east1-d", "--partial"},
+			inputOpenAPI: `
+ `,
+			input: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name" # {"type":"","x-kustomize":{"partialSetters":[{"name":"projectsetter","value":"project-id"}]}}
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub: my-hub # {"type":"","x-kustomize":{"setter":{"name":"hubsetter","value":"my-hub"}}}
+ `,
+			expectedOpenAPI: `
+ `,
+			expectedResources: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name" # {"type":"","x-kustomize":{"partialSetters":[{"name":"projectsetter","value":"project-id"},{"name":"regionsetter","value":"us-east1-d"}]}}
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub: my-hub # {"type":"","x-kustomize":{"setter":{"name":"hubsetter","value":"my-hub"}}}
+ `,
+		},
+		{
+			name:   "provide different type values in schema and with flag",
+			args:   []string{"replicas", "3", "--description", "hello world", "--type", "string"},
+			schema: `{"type": "integer"}`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			err: `type provided in type flag (string) and in schema (integer) doesn't match`,
+		},
+		{
+			name:   "invalid json in schema",
+			args:   []string{"replicas", "3"},
+			schema: `{"foo": bar`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			err: "unable to parse schema: invalid character 'b' looking for beginning of value",
+		},
+		{
+			name:   "unknown fields in schema are dropped",
+			args:   []string{"replicas", "3"},
+			schema: `{"foo": "bar"}`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.setters.replicas:
+      x-k8s-cli:
+        setter:
+          name: replicas
+          value: "3"
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3 # {"$openapi":"replicas"}
+ `,
+		},
+		{
+			name:   "unknown types are not accepted",
+			args:   []string{"replicas", "3"},
+			schema: `{"type": "int"}`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			err: `invalid schema: type "int" is not supported. Must be one of: object, array, string, integer, number, boolean, file, null`,
+		},
+		{
+			name:   "unknown types are not accepted in nested structures",
+			args:   []string{"replicas", "3", "--field", "replicas"},
+			schema: `{"maxItems": 3, "type": "array", "items": {"type": "foo"}}`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			err: `invalid schema: type "foo" is not supported. Must be one of: object, array, string, integer, number, boolean, file, null`,
+		},
+		{
+			name: "unknown types are not accepted in --type flag",
+			args: []string{"replicas", "3", "--type", "bar"},
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			err: `invalid schema: type "bar" is not supported. Must be one of: object, array, string, integer, number, boolean, file, null`,
+		},
+		{
+			name:   "unknown properties in schema are dropped",
+			args:   []string{"replicas", "3", "--type", "integer"},
+			schema: `{"maximum": 3, "unknown": 42}`,
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+ `,
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+`,
+			expectedOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.setters.replicas:
+      maximum: 3
+      type: integer
+      x-k8s-cli:
+        setter:
+          name: replicas
+          value: "3"
+ `,
+			expectedResources: `
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: nginx-deployment
 spec:

cmd/config/internal/commands/cmdcreatesubstitution.go

@@ -5,8 +5,6 @@ package commands
 
 import (
 	"fmt"
-	"regexp"
-	"strings"
 
 	"github.com/go-openapi/spec"
 	"github.com/spf13/cobra"
@@ -14,7 +12,6 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/fieldmeta"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
-	"sigs.k8s.io/kustomize/kyaml/setters2"
 	"sigs.k8s.io/kustomize/kyaml/setters2/settersutil"
 )
 
@@ -71,8 +68,20 @@ func (r *CreateSubstitutionRunner) preRunE(c *cobra.Command, args []string) erro
 		return err
 	}
 
+	// check if substitution with same name exists and throw error
+	ref, err := spec.NewRef(fieldmeta.DefinitionsPrefix + fieldmeta.SubstitutionDefinitionPrefix + r.CreateSubstitution.Name)
+	if err != nil {
+		return err
+	}
+
+	subst, _ := openapi.Resolve(&ref)
+	// if substitution already exists with the input substitution name, throw error
+	if subst != nil {
+		return errors.Errorf("substitution with name %s already exists", r.CreateSubstitution.Name)
+	}
+
 	// check if setter with same name exists and throw error
-	ref, err := spec.NewRef(fieldmeta.DefinitionsPrefix + fieldmeta.SetterDefinitionPrefix + r.CreateSubstitution.Name)
+	ref, err = spec.NewRef(fieldmeta.DefinitionsPrefix + fieldmeta.SetterDefinitionPrefix + r.CreateSubstitution.Name)
 	if err != nil {
 		return err
 	}
@@ -84,37 +93,5 @@ func (r *CreateSubstitutionRunner) preRunE(c *cobra.Command, args []string) erro
 			"substitution and setter can't have same name", r.CreateSubstitution.Name))
 	}
 
-	// extract setter name tokens from pattern enclosed in ${}
-	re := regexp.MustCompile(`\$\{([^}]*)\}`)
-	markers := re.FindAll([]byte(r.CreateSubstitution.Pattern), -1)
-	if len(markers) == 0 {
-		return errors.Errorf("unable to find setter or substitution names in pattern, " +
-			"setter names must be enclosed in ${}")
-	}
-
-	for _, marker := range markers {
-		name := strings.TrimSuffix(strings.TrimPrefix(string(marker), "${"), "}")
-
-		ref, err := spec.NewRef(fieldmeta.DefinitionsPrefix + fieldmeta.SubstitutionDefinitionPrefix + name)
-		if err != nil {
-			return err
-		}
-
-		var markerRef string
-		subst, _ := openapi.Resolve(&ref)
-		// check if the substitution exists with the marker name or fall back to creating setter
-		// ref with the name
-		if subst != nil {
-			markerRef = fieldmeta.DefinitionsPrefix + fieldmeta.SubstitutionDefinitionPrefix + name
-		} else {
-			markerRef = fieldmeta.DefinitionsPrefix + fieldmeta.SetterDefinitionPrefix + name
-		}
-
-		r.CreateSubstitution.Values = append(
-			r.CreateSubstitution.Values,
-			setters2.Value{Marker: string(marker), Ref: markerRef},
-		)
-	}
-
 	return nil
 }

cmd/config/internal/commands/cmdcreatesubstitution_test.go

@@ -104,6 +104,27 @@ spec:
         image: sidecar:1.7.9
  `,
 		},
+		{
+			name: "error if substitution with same name exists",
+			args: []string{"my-image", "--field-value", "some:image", "--pattern", "some:${image}"},
+			inputOpenAPI: `
+apiVersion: v1alpha1
+kind: Example
+openAPI:
+  definitions:
+    io.k8s.cli.substitutions.my-image:
+      x-k8s-cli:
+        substitution:
+          name: my-image
+          pattern: something/${my-image-setter}::${my-tag-setter}/nginxotherthing
+          values:
+          - marker: ${my-image-setter}
+            ref: '#/definitions/io.k8s.cli.setters.my-image-setter'
+          - marker: ${my-tag-setter}
+            ref: '#/definitions/io.k8s.cli.setters.my-tag-setter'
+ `,
+			err: "substitution with name my-image already exists",
+		},
 		{
 			name: "error if setter with same name exists",
 			args: []string{
@@ -290,123 +311,37 @@ spec:
  `,
 		},
 		{
-			name: "nested cyclic substitution",
-			args: []string{"my-nested-subst", "--field-value", "something/nginx::1.7.9/nginxotherthing",
-				"--pattern", "something/${my-image-subst}/${my-other-setter}"},
+			name: "substitution with non-existing setter with same name",
+			args: []string{
+				"foo", "--field-value", "prefix-1234", "--pattern", "prefix-${foo}"},
+			input: `
+apiVersion: test/v1
+kind: Foo
+metadata:
+  name: foo
+spec:
+  setterVal: 1234
+  substVal: prefix-1234
+ `,
 			inputOpenAPI: `
 apiVersion: v1alpha1
 kind: Example
-openAPI:
-  definitions:
-    io.k8s.cli.setters.my-image-setter:
-      x-k8s-cli:
-        setter:
-          name: my-image-setter
-          value: nginx
-    io.k8s.cli.setters.my-tag-setter:
-      x-k8s-cli:
-        setter:
-          name: my-tag-setter
-          value: 1.7.9
-    io.k8s.cli.substitutions.my-image-subst:
-      x-k8s-cli:
-        substitution:
-          name: my-image-subst
-          pattern: ${my-nested-subst}::${my-tag-setter}
-          values:
-          - marker: ${my-nested-subst}
-            ref: '#/definitions/io.k8s.cli.substitutions.my-nested-subst'
-          - marker: ${my-tag-setter}
-            ref: '#/definitions/io.k8s.cli.setters.my-tag-setter'
-    io.k8s.cli.setters.my-other-setter:
-      x-k8s-cli:
-        setter:
-          name: my-other-setter
-          value: nginxotherthing
-    io.k8s.cli.substitutions.my-nested-subst:
-      x-k8s-cli:
-        substitution:
-          name: my-nested-subst
-          pattern: something/${my-image-subst}/${my-other-setter}
-          values:
-          - marker: ${my-image-subst}
-            ref: '#/definitions/io.k8s.cli.substitutions.my-image-subst'
-          - marker: ${my-other-setter}
-            ref: '#/definitions/io.k8s.cli.setters.my-other-setter'
- `,
-			input: `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx-deployment
-spec:
-  replicas: 3
-  template:
-    spec:
-      containers:
-      - name: nginx
-        image: something/nginx::1.7.9/nginxotherthing # {"$openapi":"my-nested-subst"}
-      - name: sidecar
-        image: nginx::1.7.9 # {"$openapi":"my-image-subst"}
  `,
 			expectedOpenAPI: `
 apiVersion: v1alpha1
 kind: Example
-openAPI:
-  definitions:
-    io.k8s.cli.setters.my-image-setter:
-      x-k8s-cli:
-        setter:
-          name: my-image-setter
-          value: nginx
-    io.k8s.cli.setters.my-tag-setter:
-      x-k8s-cli:
-        setter:
-          name: my-tag-setter
-          value: 1.7.9
-    io.k8s.cli.substitutions.my-image-subst:
-      x-k8s-cli:
-        substitution:
-          name: my-image-subst
-          pattern: ${my-nested-subst}::${my-tag-setter}
-          values:
-          - marker: ${my-nested-subst}
-            ref: '#/definitions/io.k8s.cli.substitutions.my-nested-subst'
-          - marker: ${my-tag-setter}
-            ref: '#/definitions/io.k8s.cli.setters.my-tag-setter'
-    io.k8s.cli.setters.my-other-setter:
-      x-k8s-cli:
-        setter:
-          name: my-other-setter
-          value: nginxotherthing
-    io.k8s.cli.substitutions.my-nested-subst:
-      x-k8s-cli:
-        substitution:
-          name: my-nested-subst
-          pattern: something/${my-image-subst}/${my-other-setter}
-          values:
-          - marker: ${my-image-subst}
-            ref: '#/definitions/io.k8s.cli.substitutions.my-image-subst'
-          - marker: ${my-other-setter}
-            ref: '#/definitions/io.k8s.cli.setters.my-other-setter'
-
  `,
 			expectedResources: `
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: test/v1
+kind: Foo
 metadata:
-  name: nginx-deployment
+  name: foo
 spec:
-  replicas: 3
-  template:
-    spec:
-      containers:
-      - name: nginx
-        image: something/nginx::1.7.9/nginxotherthing # {"$openapi":"my-nested-subst"}
-      - name: sidecar
-        image: nginx::1.7.9 # {"$openapi":"my-image-subst"}
-`,
-			err: "cyclic substitution detected with name my-nested-subst",
+  setterVal: 1234
+  substVal: prefix-1234
+        	            	
+ `,
+			err: "setters must have different name than the substitution: foo",
 		},
 	}
 	for i := range tests {
@@ -451,7 +386,7 @@ spec:
 				if !assert.NotNil(t, err) {
 					t.FailNow()
 				}
-				assert.Equal(t, err.Error(), test.err)
+				assert.Equal(t, test.err, err.Error())
 				return
 			}
 			if !assert.NoError(t, err) {

cmd/config/internal/commands/cmddeletesetter.go

@@ -6,6 +6,7 @@ package commands
 import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/ext"
+	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/kustomize/kyaml/setters2/settersutil"
 )
@@ -16,9 +17,9 @@ func NewDeleteSetterRunner(parent string) *DeleteSetterRunner {
 	c := &cobra.Command{
 		Use:     "delete-setter DIR NAME",
 		Args:    cobra.MinimumNArgs(2),
-		Short:   "delete values on Resources fields.",
-		Long:    "",
-		Example: "",
+		Short:   commands.DeleteSetterShort,
+		Long:    commands.DeleteSetterLong,
+		Example: commands.DeleteSetterExamples,
 		PreRunE: r.preRunE,
 		RunE:    r.runE,
 	}

cmd/config/internal/commands/cmdset_test.go

@@ -941,6 +941,70 @@ spec:
 `,
 			errMsg: "cyclic substitution detected with name my-nested-subst",
 		},
+
+		{
+			name: "set v1 setter asm",
+			args: []string{"profilesetter", "my-asm"},
+			out:  "set 1 fields\n",
+			inputOpenAPI: `
+ `,
+			input: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name"
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub:
+  - --gcr.io/asm-testing
+  - --gcr.io/asm-testing2
+ `,
+			expectedOpenAPI: `
+ `,
+			expectedResources: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name"
+spec:
+  profile: my-asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"my-asm"}}}
+  hub:
+  - --gcr.io/asm-testing
+  - --gcr.io/asm-testing2
+ `,
+		},
+
+		{
+			name: "set v1 partial setter",
+			args: []string{"gcloud.core.project", "my-project"},
+			out:  "set 1 fields\n",
+			inputOpenAPI: `
+ `,
+			input: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "project-id/us-east1-d/cluster-name" # {"type":"string","x-kustomize":{"partialSetters":[{"name":"gcloud.core.project","value":"project-id"},{"name":"cluster-name","value":"cluster-name"},{"name":"gcloud.compute.zone","value":"us-east1-d"}]}}
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub:
+  - --gcr.io/asm-testing
+  - --gcr.io/asm-testing2
+ `,
+			expectedOpenAPI: `
+ `,
+			expectedResources: `
+apiVersion: install.istio.io/v1alpha2
+kind: IstioControlPlane
+metadata:
+  clusterName: "my-project/us-east1-d/cluster-name" # {"type":"string","x-kustomize":{"partialSetters":[{"name":"gcloud.core.project","value":"my-project"},{"name":"cluster-name","value":"cluster-name"},{"name":"gcloud.compute.zone","value":"us-east1-d"}]}}
+spec:
+  profile: asm # {"type":"string","x-kustomize":{"setter":{"name":"profilesetter","value":"asm"}}}
+  hub:
+  - --gcr.io/asm-testing
+  - --gcr.io/asm-testing2
+ `,
+		},
 	}
 	for i := range tests {
 		test := tests[i]

cmd/config/internal/generateddocs/commands/docs.go

@@ -89,6 +89,22 @@ var CreateSetterExamples = `
     kustomize cfg create-setter DIR/ image-tag v1.0.1 --type "string" \
         --field image --description "current stable release"`
 
+var DeleteSetterShort = `[Alpha] Delete a custom setter for a Resource field`
+var DeleteSetterLong = `
+Delete a custom setter for a Resource field.
+
+  DIR
+
+    A directory containing Resource configuration.
+
+  NAME
+
+    The name of the setter to create.
+`
+var DeleteSetterExamples = `
+    # delete a setter for port
+    kustomize cfg create-setter DIR/ port`
+
 var FmtShort = `[Alpha] Format yaml configuration files.`
 var FmtLong = `
 [Alpha] Format yaml configuration files.

docs/api-reference/glossary/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -1147,7 +1147,7 @@ cpu and memory requests.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 15, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/518147c129f831913d33226cf17068d0d4270f41">add zh docsy (518147c1)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 

docs/api-reference/kustomization/bases/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -812,7 +812,7 @@ ordered relative to other input resources.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 7, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/42497c664f619a36cc86156e366b53099bd633cb">Convert docs to docsy (42497c66)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/commonannotations/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -846,7 +846,7 @@ the value will be overridden.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 11, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/589ddcb4faa1170e1cd549a41b11f18e146197d8">kustomize docs tweaks (589ddcb4)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/commonlabels/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -889,7 +889,7 @@ resource has been applied to a cluster.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 11, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/589ddcb4faa1170e1cd549a41b11f18e146197d8">kustomize docs tweaks (589ddcb4)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/components/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 

docs/api-reference/kustomization/configmapgenerator/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -873,7 +873,7 @@ configmap is created is <code>whatever.ini</code>.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 7, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/42497c664f619a36cc86156e366b53099bd633cb">Convert docs to docsy (42497c66)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/crds/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -828,7 +828,7 @@ same way.</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 7, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/42497c664f619a36cc86156e366b53099bd633cb">Convert docs to docsy (42497c66)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/generatoroptions/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -818,7 +818,7 @@ generator. For details on per-resource generatorOptions usage see
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 15, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/518147c129f831913d33226cf17068d0d4270f41">add zh docsy (518147c1)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/images/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
 
@@ -838,7 +838,7 @@ kubernetes Deployment fragment:</p>
 
 	
 	
-	<div class="text-muted mt-5 pt-3 border-top">Last modified June 7, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/42497c664f619a36cc86156e366b53099bd633cb">Convert docs to docsy (42497c66)</a>
+	<div class="text-muted mt-5 pt-3 border-top">Last modified July 16, 2020: <a  href="https://github.com/kubernetes-sigs/kustomize/commit/f9ee578aed600136133c3232fff03029cdfc526e">Docs: Auto-fix markdownlint issues (f9ee578a)</a>
 </div>
 </div>
 

docs/api-reference/kustomization/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-<meta name="generator" content="Hugo 0.73.0" />
+<meta name="generator" content="Hugo 0.73.0-DEV" />
 
 <META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">