Merge pull request #3406 from monopole/pinToCmdConfig_v0.8.7

Pin to cmd/confg v0.8.7

.dockerignore

@@ -0,0 +1,8 @@
+.github
+docs
+examples
+functions
+hack
+site
+travis
+*.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,68 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ""
+labels:
+  - kind/bug
+assignees: ""
+---
+
+<!--
+Please read this page: https://kubernetes-sigs.github.io/kustomize/contributing/bugs/ before
+filing a bug
+-->
+
+<!-- Feel free to skip the sections if they are not applicable. -->
+
+**Describe the bug**
+
+<!-- A clear and concise description of what the bug is. -->
+
+**Files that can reproduce the issue**
+
+<!--
+We cannot figure out or fix the issue if we don't know how to reproduce. Please
+provide a minimum set of files that can reproduce the issue. You can paste the
+file contents here or provide a link to a tarball or git repo.
+
+Example:
+
+kustomization.yaml
+
+```
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+...
+```
+
+resources.yaml
+
+```
+apiVersion: v1
+kind: Deployment
+...
+```
+
+...
+-->
+
+**Expected output**
+
+<!-- What's the expected output? -->
+
+**Actual output**
+
+<!-- What's the actual output? -->
+
+**Kustomize version**
+
+<!-- Please use the latest version when it's possible. -->
+
+**Platform**
+
+<!-- Linux/macOS/Windows? -->
+
+**Additional context**
+
+<!-- Add any other context about the problem here. -->

.github/ISSUE_TEMPLATE/config.yaml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,26 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ""
+labels:
+  - kind/feature
+assignees: ""
+---
+
+<!-- Feel free to skip the sections if they are not applicable. -->
+
+**Is your feature request related to a problem? Please describe.**
+
+<!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] -->
+
+**Describe the solution you'd like**
+
+<!-- A clear and concise description of what you want to happen. -->
+
+**Describe alternatives you've considered**
+
+<!-- A clear and concise description of any alternative solutions or features you've considered. -->
+
+**Additional context**
+
+<!-- Add any other context or screenshots about the feature request here. -->

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,9 @@
+---
+name: Question
+about: Ask a question about the kustomize
+title: "[Question]"
+labels: ""
+assignees: ""
+---
+
+<!-- Please describe your question here -->

.github/workflows/go.yml

@@ -23,7 +23,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Lint
-      run: ./travis/kyaml-pre-commit.sh
+      run: ./scripts/kyaml-pre-commit.sh
       env:
         KUSTOMIZE_DOCKER_E2E: false # don't need to do e2e tests for linting
 

Makefile

@@ -6,6 +6,17 @@
 MYGOBIN := $(shell go env GOPATH)/bin
 SHELL := /bin/bash
 export PATH := $(MYGOBIN):$(PATH)
+MODULES := '"cmd/config" "api/" "kustomize/" "kyaml/"'
+
+# Provide defaults for REPO_OWNER and REPO_NAME if not present.
+# Typically these values would be provided by Prow.
+ifndef REPO_OWNER
+REPO_OWNER := "kubernetes-sigs"
+endif
+
+ifndef REPO_NAME
+REPO_NAME := "kustomize"
+endif
 
 .PHONY: all
 all: verify-kustomize
@@ -15,18 +26,21 @@ verify-kustomize: \
 	lint-kustomize \
 	test-unit-kustomize-all \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.8.0
+	test-examples-kustomize-against-3.9.0 \
+	test-examples-kustomize-against-3.8.8
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
 .PHONY: prow-presubmit-check
 prow-presubmit-check: \
 	lint-kustomize \
+	test-multi-module \
 	test-unit-kustomize-all \
 	test-unit-cmd-all \
 	test-go-mod \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.8.0
+	test-examples-kustomize-against-3.9.0 \
+	test-examples-kustomize-against-3.8.8
 
 .PHONY: verify-kustomize-e2e
 verify-kustomize-e2e: test-examples-e2e-kustomize
@@ -45,34 +59,37 @@ $(MYGOBIN)/golangci-lint-kustomize:
 		GO111MODULE=on go build -tags=tools -o $(MYGOBIN)/golangci-lint-kustomize github.com/golangci/golangci-lint/cmd/golangci-lint; \
 	)
 
-# Version pinned by api/go.mod
+# Install from version specified in api/go.mod.
 $(MYGOBIN)/mdrip:
 	cd api; \
 	go install github.com/monopole/mdrip
 
-# Version pinned by api/go.mod
+# Install from version specified in api/go.mod.
 $(MYGOBIN)/stringer:
 	cd api; \
 	go install golang.org/x/tools/cmd/stringer
 
-# Version pinned by api/go.mod
+# Install from version specified in api/go.mod.
 $(MYGOBIN)/goimports:
 	cd api; \
 	go install golang.org/x/tools/cmd/goimports
 
-# Install resource from whatever is checked out.
-$(MYGOBIN)/resource:
-	cd cmd/resource; \
+# Build from local source.
+$(MYGOBIN)/gorepomod:
+	cd cmd/gorepomod; \
 	go install .
 
-# To pin pluginator, use this recipe instead:
-#   cd api;
-#   go install sigs.k8s.io/kustomize/pluginator/v2
+# Build from local source.
 $(MYGOBIN)/pluginator:
-	cd pluginator; \
+	cd cmd/pluginator; \
 	go install .
 
-# Install kustomize from whatever is checked out.
+# Build from local source.
+$(MYGOBIN)/prchecker:
+	cd cmd/prchecker; \
+	go install .
+
+# Build from local source.
 $(MYGOBIN)/kustomize:
 	cd kustomize; \
 	go install .
@@ -81,9 +98,13 @@ $(MYGOBIN)/kustomize:
 install-tools: \
 	$(MYGOBIN)/goimports \
 	$(MYGOBIN)/golangci-lint-kustomize \
+	$(MYGOBIN)/gh \
+	$(MYGOBIN)/gorepomod \
 	$(MYGOBIN)/mdrip \
 	$(MYGOBIN)/pluginator \
-	$(MYGOBIN)/stringer
+	$(MYGOBIN)/prchecker \
+	$(MYGOBIN)/stringer \
+	$(MYGOBIN)/helm
 
 ### Begin kustomize plugin rules.
 #
@@ -125,7 +146,8 @@ _builtinplugins = \
 	PrefixSuffixTransformer.go \
 	ReplicaCountTransformer.go \
 	SecretGenerator.go \
-	ValueAddTransformer.go
+	ValueAddTransformer.go \
+	HelmChartInflationGenerator.go
 
 # Maintaining this explicit list of generated files, and
 # adding it as a dependency to a few targets, to assure
@@ -151,6 +173,7 @@ $(pGen)/PrefixSuffixTransformer.go: $(pSrc)/prefixsuffixtransformer/PrefixSuffix
 $(pGen)/ReplicaCountTransformer.go: $(pSrc)/replicacounttransformer/ReplicaCountTransformer.go
 $(pGen)/SecretGenerator.go: $(pSrc)/secretgenerator/SecretGenerator.go
 $(pGen)/ValueAddTransformer.go: $(pSrc)/valueaddtransformer/ValueAddTransformer.go
+$(pGen)/HelmChartInflationGenerator.go: $(pSrc)/helmchartinflationgenerator/HelmChartInflationGenerator.go
 
 # The (verbose but portable) Makefile way to convert to lowercase.
 toLowerCase = $(subst A,a,$(subst B,b,$(subst C,c,$(subst D,d,$(subst E,e,$(subst F,f,$(subst G,g,$(subst H,h,$(subst I,i,$(subst J,j,$(subst K,k,$(subst L,l,$(subst M,m,$(subst N,n,$(subst O,o,$(subst P,p,$(subst Q,q,$(subst R,r,$(subst S,s,$(subst T,t,$(subst U,u,$(subst V,v,$(subst W,w,$(subst X,x,$(subst Y,y,$(subst Z,z,$1))))))))))))))))))))))))))
@@ -169,24 +192,27 @@ $(pGen)/%.go: $(MYGOBIN)/pluginator
 .PHONY: generate-kustomize-builtin-plugins
 generate-kustomize-builtin-plugins: $(builtinplugins)
 
-.PHONY: kustomize-external-go-plugin-build
-kustomize-external-go-plugin-build:
+.PHONY: build-kustomize-external-go-plugin
+build-kustomize-external-go-plugin:
 	./hack/buildExternalGoPlugins.sh ./plugin
 
-.PHONY: kustomize-external-go-plugin-clean
-kustomize-external-go-plugin-clean:
+.PHONY: clean-kustomize-external-go-plugin
+clean-kustomize-external-go-plugin:
 	./hack/buildExternalGoPlugins.sh ./plugin clean
 
 ### End kustomize plugin rules.
 
 .PHONY: lint-kustomize
 lint-kustomize: install-tools $(builtinplugins)
-	cd api; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../.golangci-kustomize.yml run ./...
-	cd kustomize; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../.golangci-kustomize.yml run ./...
-	cd pluginator; \
-	$(MYGOBIN)/golangci-lint-kustomize -c ../.golangci-kustomize.yml run ./...
+	cd api; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../.golangci-kustomize.yml \
+	  run ./...
+	cd kustomize; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../.golangci-kustomize.yml \
+	  run ./...
+	cd cmd/pluginator; $(MYGOBIN)/golangci-lint-kustomize \
+	  -c ../../.golangci-kustomize.yml \
+	  run ./...
 
 # Used to add non-default compilation flags when experimenting with
 # plugin-to-api compatibility checks.
@@ -194,6 +220,10 @@ lint-kustomize: install-tools $(builtinplugins)
 build-kustomize-api: $(builtinplugins)
 	cd api; go build ./...
 
+.PHONY: generate-kustomize-api
+generate-kustomize-api:
+	cd api; go generate ./...
+
 .PHONY: test-unit-kustomize-api
 test-unit-kustomize-api: build-kustomize-api
 	cd api; go test ./...  -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
@@ -213,10 +243,23 @@ test-unit-kustomize-all: \
 	test-unit-kustomize-plugins
 
 test-unit-cmd-all:
-	./travis/kyaml-pre-commit.sh
+	./scripts/kyaml-pre-commit.sh
 
 test-go-mod:
-	./travis/check-go-mod.sh
+	./scripts/check-go-mod.sh
+
+# Environment variables are defined at
+# https://github.com/kubernetes/test-infra/blob/master/prow/jobs.md#job-environment-variables
+.PHONY: test-multi-module
+test-multi-module: $(MYGOBIN)/prchecker
+	( \
+		export MYGOBIN=$(MYGOBIN); \
+		export REPO_OWNER=$(REPO_OWNER); \
+		export REPO_NAME=$(REPO_NAME); \
+		export PULL_NUMBER=$(PULL_NUMBER); \
+		export MODULES=$(MODULES); \
+		./scripts/check-multi-module.sh; \
+	)
 
 .PHONY:
 test-examples-e2e-kustomize: $(MYGOBIN)/mdrip $(MYGOBIN)/kind
@@ -233,17 +276,12 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-3.8.0: $(MYGOBIN)/mdrip
-	( \
-		set -e; \
-		tag=v3.8.0; \
-		/bin/rm -f $(MYGOBIN)/kustomize; \
-		echo "Installing kustomize $$tag."; \
-		GO111MODULE=on go get sigs.k8s.io/kustomize/kustomize/v3@$${tag}; \
-		./hack/testExamplesAgainstKustomize.sh $$tag; \
-		echo "Reinstalling kustomize from HEAD."; \
-		cd kustomize; go install .; \
-	)
+test-examples-kustomize-against-3.9.0: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.9.0
+
+.PHONY:
+test-examples-kustomize-against-3.8.8: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.8.8
 
 # linux only.
 # This is for testing an example plugin that
@@ -283,16 +321,16 @@ $(MYGOBIN)/helmV3:
 	( \
 		set -e; \
 		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=helm-v3.2.0-rc.1-linux-amd64.tar.gz; \
+		tgzFile=helm-v3.4.0-linux-amd64.tar.gz; \
 		wget https://get.helm.sh/$$tgzFile; \
 		tar -xvzf $$tgzFile; \
 		mv linux-amd64/helm $(MYGOBIN)/helmV3; \
 		rm -rf $$d \
 	)
 
-# Default version of helm is v2 for the time being.
-$(MYGOBIN)/helm: $(MYGOBIN)/helmV2
-	ln -s $(MYGOBIN)/helmV2 $(MYGOBIN)/helm
+# Default version of helm is v3.
+$(MYGOBIN)/helm: $(MYGOBIN)/helmV3
+	ln -s $(MYGOBIN)/helmV3 $(MYGOBIN)/helm
 
 $(MYGOBIN)/kind:
 	( \
@@ -304,14 +342,28 @@ $(MYGOBIN)/kind:
         rm -rf $$d; \
 	)
 
+# linux only.
+$(MYGOBIN)/gh:
+	( \
+		set -e; \
+		d=$(shell mktemp -d); cd $$d; \
+		tgzFile=gh_1.0.0_linux_amd64.tar.gz; \
+		wget https://github.com/cli/cli/releases/download/v1.0.0/$$tgzFile; \
+		tar -xvzf $$tgzFile; \
+		mv gh_1.0.0_linux_amd64/bin/gh  $(MYGOBIN)/gh; \
+		rm -rf $$d \
+	)
+
 .PHONY: clean
-clean: kustomize-external-go-plugin-clean
+clean: clean-kustomize-external-go-plugin
 	go clean --cache
 	rm -f $(builtinplugins)
-	rm -f $(MYGOBIN)/pluginator
 	rm -f $(MYGOBIN)/kustomize
 	rm -f $(MYGOBIN)/golangci-lint-kustomize
 
+# Handle pluginator manually.
+# rm -f $(MYGOBIN)/pluginator
+
 # Nuke the site from orbit.  It's the only way to be sure.
 .PHONY: nuke
 nuke: clean

OWNERS_ALIASES

@@ -11,3 +11,4 @@ aliases:
     - pwittrock
     - mortent
     - phanimarupaka
+    - Shell32-Natsu

README.md

@@ -9,29 +9,31 @@ patch [kubernetes style] API objects.  It's like
 [`make`], in that what it does is declared in a file,
 and it's like [`sed`], in that it emits edited text.
 
-This tool is sponsored by [sig-cli] ([KEP]), and
-inspired by [DAM].
+This tool is sponsored by [sig-cli] ([KEP]).
+
+ - [Installation instructions](https://kubernetes-sigs.github.io/kustomize/installation)
+ - [General documentation](https://kubernetes-sigs.github.io/kustomize)
+ - [Examples](examples)
 
 [![Build Status](https://prow.k8s.io/badge.svg?jobs=kustomize-presubmit-master)](https://prow.k8s.io/job-history/kubernetes-jenkins/pr-logs/directory/kustomize-presubmit-master)
 [![Go Report Card](https://goreportcard.com/badge/github.com/kubernetes-sigs/kustomize)](https://goreportcard.com/report/github.com/kubernetes-sigs/kustomize)
 
-Download a binary from the [release page], or see
-these [instructions](https://kubernetes-sigs.github.io/kustomize/installation/).
-
-Browse the [docs](https://kubernetes-sigs.github.io/kustomize/) or jump right into the
-tested [examples](examples).
-
 ## kubectl integration
 
-Since [v1.14][kubectl announcement] the kustomize build system has been included in kubectl.
+The kustomize build flow at [v2.0.3] was added
+to [kubectl v1.14][kubectl announcement].  The kustomize
+flow in kubectl has remained frozen at v2.0.3 while work
+to extract kubectl from the k/k repo, and work to remove
+kustomize's dependence on core k/k code ([#2506]) has proceeded.
+The reintegration effort is tracked in [#1500] (and its blocking
+issues).
 
-| kubectl version | kustomize version |
-|---------|--------|
-| v1.16.0 | [v2.0.3](/../../tree/v2.0.3) |
-| v1.15.x | [v2.0.3](/../../tree/v2.0.3) |
-| v1.14.x | [v2.0.3](/../../tree/v2.0.3) |
+[v2.0.3]: /../../tree/v2.0.3
+[#2506]: https://github.com/kubernetes-sigs/kustomize/issues/2506
+[#1500]: https://github.com/kubernetes-sigs/kustomize/issues/1500
 
-For examples and guides for using the kubectl integration please see the [kubectl book] or the [kubernetes documentation].
+For examples and guides for using the kubectl integration please
+see the [kubectl book] or the [kubernetes documentation].
 
 ## Usage
 
@@ -151,7 +153,7 @@ is governed by the [Kubernetes Code of Conduct].
 [imageBase]: docs/images/base.jpg
 [imageOverlay]: docs/images/overlay.jpg
 [kubectl announcement]: https://kubernetes.io/blog/2019/03/25/kubernetes-1-14-release-announcement
-[kubectl book]: https://kubectl.docs.kubernetes.io/pages/app_customization/introduction.html
+[kubectl book]: https://kubectl.docs.kubernetes.io/guides/introduction/kustomize/
 [kubernetes documentation]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
 [kubernetes style]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#kubernetes-style-object
 [kustomization]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#kustomization

api/builtins/HelmChartInflationGenerator.go

@@ -0,0 +1,251 @@
+// Code generated by pluginator on HelmChartInflationGenerator; DO NOT EDIT.
+// pluginator {unknown  1970-01-01T00:00:00Z  }
+
+package builtins
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path"
+	"regexp"
+	"strings"
+
+	"github.com/imdario/mergo"
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// HelmChartInflationGeneratorPlugin is a plugin to generate resources
+// from a remote or local helm chart.
+type HelmChartInflationGeneratorPlugin struct {
+	h                *resmap.PluginHelpers
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	runHelmCommand   func([]string) ([]byte, error)
+	types.HelmChartArgs
+	tmpDir string
+}
+
+var KustomizePlugin HelmChartInflationGeneratorPlugin
+
+// Config uses the input plugin configurations `config` to setup the generator
+// options
+func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, config []byte) error {
+	p.h = h
+	err := yaml.Unmarshal(config, p)
+	if err != nil {
+		return err
+	}
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return err
+	}
+	p.tmpDir = string(tmpDir)
+	if p.ChartName == "" {
+		return fmt.Errorf("chartName cannot be empty")
+	}
+	if p.ChartHome == "" {
+		p.ChartHome = path.Join(p.tmpDir, "chart")
+	}
+	if p.ChartRepoName == "" {
+		p.ChartRepoName = "stable"
+	}
+	if p.HelmBin == "" {
+		p.HelmBin = "helm"
+	}
+	if p.HelmHome == "" {
+		p.HelmHome = path.Join(p.tmpDir, ".helm")
+	}
+	if p.Values == "" {
+		p.Values = path.Join(p.ChartHome, p.ChartName, "values.yaml")
+	}
+	if p.ValuesMerge == "" {
+		p.ValuesMerge = "override"
+	}
+	// runHelmCommand will run `helm` command with args provided. Return stdout
+	// and error if there is any.
+	p.runHelmCommand = func(args []string) ([]byte, error) {
+		stdout := new(bytes.Buffer)
+		stderr := new(bytes.Buffer)
+		cmd := exec.Command(p.HelmBin, args...)
+		cmd.Stdout = stdout
+		cmd.Stderr = stderr
+		cmd.Env = append(cmd.Env,
+			fmt.Sprintf("HELM_CONFIG_HOME=%s", p.HelmHome),
+			fmt.Sprintf("HELM_CACHE_HOME=%s/.cache", p.HelmHome),
+			fmt.Sprintf("HELM_DATA_HOME=%s/.data", p.HelmHome),
+		)
+		err := cmd.Run()
+		if err != nil {
+			return stdout.Bytes(),
+				errors.Wrap(
+					fmt.Errorf("failed to run command %s %s", p.HelmBin, strings.Join(args, " ")),
+					stderr.String(),
+				)
+		}
+		return stdout.Bytes(), nil
+	}
+	return nil
+}
+
+// EncodeValues for writing
+func (p *HelmChartInflationGeneratorPlugin) EncodeValues(w io.Writer) error {
+	d, err := yaml.Marshal(p.ValuesLocal)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(d)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// useValuesLocal process (merge) inflator config provided values with chart default values.yaml
+func (p *HelmChartInflationGeneratorPlugin) useValuesLocal() error {
+	fn := path.Join(p.ChartHome, p.ChartName, "kustomize-values.yaml")
+	vf, err := os.Create(fn)
+	defer vf.Close()
+	if err != nil {
+		return err
+	}
+	// override, merge, none
+	if p.ValuesMerge == "none" || p.ValuesMerge == "no" || p.ValuesMerge == "false" {
+		p.Values = fn
+	} else {
+		pValues, err := ioutil.ReadFile(p.Values)
+		if err != nil {
+			return err
+		}
+		chValues := make(map[string]interface{})
+		err = yaml.Unmarshal(pValues, &chValues)
+		if err != nil {
+			return err
+		}
+		if p.ValuesMerge == "override" {
+			err = mergo.Merge(&chValues, p.ValuesLocal, mergo.WithOverride)
+			if err != nil {
+				return err
+			}
+		}
+		if p.ValuesMerge == "merge" {
+			err = mergo.Merge(&chValues, p.ValuesLocal)
+			if err != nil {
+				return err
+			}
+		}
+		p.ValuesLocal = chValues
+		p.Values = fn
+	}
+	err = p.EncodeValues(vf)
+	if err != nil {
+		return err
+	}
+	vf.Sync()
+	return nil
+}
+
+// Generate implements generator
+func (p *HelmChartInflationGeneratorPlugin) Generate() (resmap.ResMap, error) {
+	// cleanup
+	defer os.RemoveAll(p.tmpDir)
+	// check helm version. we only support V3
+	err := p.checkHelmVersion()
+	if err != nil {
+		return nil, err
+	}
+	// pull the chart
+	if !p.checkLocalChart() {
+		_, err := p.runHelmCommand(p.getPullCommandArgs())
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// inflator config valuesLocal
+	if len(p.ValuesLocal) > 0 {
+		err := p.useValuesLocal()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// render the charts
+	stdout, err := p.runHelmCommand(p.getTemplateCommandArgs())
+	if err != nil {
+		return nil, err
+	}
+
+	return p.h.ResmapFactory().NewResMapFromBytes(stdout)
+}
+
+func (p *HelmChartInflationGeneratorPlugin) getTemplateCommandArgs() []string {
+	args := []string{"template"}
+	if p.ReleaseName != "" {
+		args = append(args, p.ReleaseName)
+	}
+	args = append(args, path.Join(p.ChartHome, p.ChartName))
+	if p.ReleaseNamespace != "" {
+		args = append(args, "--namespace", p.ReleaseNamespace)
+	}
+	if p.Values != "" {
+		args = append(args, "--values", p.Values)
+	}
+	args = append(args, p.ExtraArgs...)
+	return args
+}
+
+func (p *HelmChartInflationGeneratorPlugin) getPullCommandArgs() []string {
+	args := []string{"pull", "--untar", "--untardir", p.ChartHome}
+	chartName := fmt.Sprintf("%s/%s", p.ChartRepoName, p.ChartName)
+	if p.ChartVersion != "" {
+		args = append(args, "--version", p.ChartVersion)
+	}
+	if p.ChartRepoURL != "" {
+		args = append(args, "--repo", p.ChartRepoURL)
+		chartName = p.ChartName
+	}
+
+	args = append(args, chartName)
+
+	return args
+}
+
+// checkLocalChart will return true if the chart does exist in
+// local chart home.
+func (p *HelmChartInflationGeneratorPlugin) checkLocalChart() bool {
+	path := path.Join(p.ChartHome, p.ChartName)
+	s, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return s.IsDir()
+}
+
+// checkHelmVersion will return an error if the helm version is not V3
+func (p *HelmChartInflationGeneratorPlugin) checkHelmVersion() error {
+	stdout, err := p.runHelmCommand([]string{"version", "-c", "--short"})
+	if err != nil {
+		return err
+	}
+	r, err := regexp.Compile(`v\d+(\.\d+)+`)
+	if err != nil {
+		return err
+	}
+	v := string(r.Find(stdout))[1:]
+	majorVersion := strings.Split(v, ".")[0]
+	if majorVersion != "3" {
+		return fmt.Errorf("this plugin requires helm V3 but got v%s", v)
+	}
+	return nil
+}
+
+func NewHelmChartInflationGeneratorPlugin() resmap.GeneratorPlugin {
+	return &HelmChartInflationGeneratorPlugin{}
+}

api/builtins/ImageTagTransformer.go

@@ -8,10 +8,10 @@ import (
 	"regexp"
 	"strings"
 
-	"sigs.k8s.io/kustomize/api/transform"
-	"sigs.k8s.io/kustomize/api/types"
-
+	"sigs.k8s.io/kustomize/api/filters/imagetag"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -31,18 +31,19 @@ func (p *ImageTagTransformerPlugin) Config(
 
 func (p *ImageTagTransformerPlugin) Transform(m resmap.ResMap) error {
 	for _, r := range m.Resources() {
-		for _, path := range p.FieldSpecs {
-			if !r.OrgId().IsSelected(&path.Gvk) {
-				continue
-			}
-			err := transform.MutateField(
-				r.Map(), path.PathSlice(), false, p.mutateImage)
-			if err != nil {
-				return err
-			}
+		// traverse all fields at first
+		err := filtersutil.ApplyToJSON(imagetag.LegacyFilter{
+			ImageTag: p.ImageTag,
+		}, r)
+		if err != nil {
+			return err
 		}
-		// Kept for backward compatibility
-		if err := p.findAndReplaceImage(r.Map()); err != nil && r.OrgId().Kind != `CustomResourceDefinition` {
+		// then use user specified field specs
+		err = filtersutil.ApplyToJSON(imagetag.Filter{
+			ImageTag: p.ImageTag,
+			FsSlice:  p.FieldSpecs,
+		}, r)
+		if err != nil {
 			return err
 		}
 	}

api/builtins/NamespaceTransformer.go

@@ -7,9 +7,7 @@ import (
 	"fmt"
 
 	"sigs.k8s.io/kustomize/api/filters/namespace"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
@@ -33,7 +31,7 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 		return nil
 	}
 	for _, r := range m.Resources() {
-		if len(r.Map()) == 0 {
+		if r.IsEmpty() {
 			// Don't mutate empty objects?
 			continue
 		}
@@ -53,74 +51,6 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 	return nil
 }
 
-// Special casing metadata.namespace since
-// all objects have it, even "ClusterKind" objects
-// that don't exist in a namespace (the Namespace
-// object itself doesn't live in a namespace).
-func (p *NamespaceTransformerPlugin) applicableFieldSpecs(id resid.ResId) []types.FieldSpec {
-	var res []types.FieldSpec
-	for _, fs := range p.FieldSpecs {
-		if id.IsSelected(&fs.Gvk) &&
-			(fs.Path != types.MetadataNamespacePath ||
-				(fs.Path == types.MetadataNamespacePath && id.IsNamespaceableKind())) {
-			res = append(res, fs)
-		}
-	}
-	return res
-}
-
-func (p *NamespaceTransformerPlugin) changeNamespace(
-	_ *resource.Resource) func(in interface{}) (interface{}, error) {
-	return func(in interface{}) (interface{}, error) {
-		switch in.(type) {
-		case string:
-			// will happen when the metadata/namespace
-			// value is replaced
-			return p.Namespace, nil
-		case []interface{}:
-			l, _ := in.([]interface{})
-			for idx, item := range l {
-				switch item.(type) {
-				case map[string]interface{}:
-					// Will happen when mutating the subjects
-					// field of ClusterRoleBinding and RoleBinding
-					inMap, _ := item.(map[string]interface{})
-					if _, ok := inMap["name"]; !ok {
-						continue
-					}
-					name, ok := inMap["name"].(string)
-					if !ok {
-						continue
-					}
-					// The only case we need to force the namespace
-					// if for the "service account". "default" is
-					// kind of hardcoded here for right now.
-					if name != "default" {
-						continue
-					}
-					inMap["namespace"] = p.Namespace
-					l[idx] = inMap
-				default:
-					// nothing to do for right now
-				}
-			}
-			return in, nil
-		case map[string]interface{}:
-			// Will happen if the createField=true
-			// when the namespace is added to the
-			// object
-			inMap := in.(map[string]interface{})
-			if len(inMap) == 0 {
-				return p.Namespace, nil
-			} else {
-				return in, nil
-			}
-		default:
-			return in, nil
-		}
-	}
-}
-
 func NewNamespaceTransformerPlugin() resmap.TransformerPlugin {
 	return &NamespaceTransformerPlugin{}
 }

api/builtins/PatchJson6902Transformer.go

@@ -10,7 +10,6 @@ import (
 	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filtersutil"
@@ -20,9 +19,9 @@ import (
 type PatchJson6902TransformerPlugin struct {
 	ldr          ifc.Loader
 	decodedPatch jsonpatch.Patch
-	Target       types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
-	Path         string            `json:"path,omitempty" yaml:"path,omitempty"`
-	JsonOp       string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
+	Target       *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
+	Path         string          `json:"path,omitempty" yaml:"path,omitempty"`
+	JsonOp       string          `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
 }
 
 func (p *PatchJson6902TransformerPlugin) Config(
@@ -72,22 +71,22 @@ func (p *PatchJson6902TransformerPlugin) Config(
 }
 
 func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
-	id := resid.NewResIdWithNamespace(
-		resid.Gvk{
-			Group:   p.Target.Group,
-			Version: p.Target.Version,
-			Kind:    p.Target.Kind,
-		},
-		p.Target.Name,
-		p.Target.Namespace,
-	)
-	obj, err := m.GetById(id)
+	if p.Target == nil {
+		return fmt.Errorf("must specify a target for patch %s", p.JsonOp)
+	}
+	resources, err := m.Select(*p.Target)
 	if err != nil {
 		return err
 	}
-	return filtersutil.ApplyToJSON(patchjson6902.Filter{
-		Patch: p.JsonOp,
-	}, obj)
+	for _, res := range resources {
+		err = filtersutil.ApplyToJSON(patchjson6902.Filter{
+			Patch: p.JsonOp,
+		}, res)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func NewPatchJson6902TransformerPlugin() resmap.TransformerPlugin {

api/builtins/PatchStrategicMergeTransformer.go

@@ -5,19 +5,14 @@ package builtins
 
 import (
 	"fmt"
-	"strings"
 
-	"github.com/pkg/errors"
-	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/yaml"
 )
 
 type PatchStrategicMergeTransformerPlugin struct {
-	h             *resmap.PluginHelpers
 	loadedPatches []*resource.Resource
 	Paths         []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 	Patches       string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
@@ -25,7 +20,6 @@ type PatchStrategicMergeTransformerPlugin struct {
 
 func (p *PatchStrategicMergeTransformerPlugin) Config(
 	h *resmap.PluginHelpers, c []byte) (err error) {
-	p.h = h
 	err = yaml.Unmarshal(c, p)
 	if err != nil {
 		return err
@@ -35,13 +29,18 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 	}
 	if len(p.Paths) != 0 {
 		for _, onePath := range p.Paths {
-			res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(onePath))
+			// The following oddly attempts to interpret a path string as an
+			// actual patch (instead of as a path to a file containing a patch).
+			// All tests pass if this code is commented out.  This code should
+			// be deleted; the user should use the Patches field which
+			// exists for this purpose (inline patch declaration).
+			res, err := h.ResmapFactory().RF().SliceFromBytes([]byte(onePath))
 			if err == nil {
 				p.loadedPatches = append(p.loadedPatches, res...)
 				continue
 			}
-			res, err = p.h.ResmapFactory().RF().SliceFromPatches(
-				p.h.Loader(), []types.PatchStrategicMerge{onePath})
+			res, err = h.ResmapFactory().RF().SliceFromPatches(
+				h.Loader(), []types.PatchStrategicMerge{onePath})
 			if err != nil {
 				return err
 			}
@@ -49,7 +48,7 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 		}
 	}
 	if p.Patches != "" {
-		res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(p.Patches))
+		res, err := h.ResmapFactory().RF().SliceFromBytes([]byte(p.Patches))
 		if err != nil {
 			return err
 		}
@@ -60,57 +59,25 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 		return fmt.Errorf(
 			"patch appears to be empty; files=%v, Patch=%s", p.Paths, p.Patches)
 	}
-	return err
-}
-
-func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error {
-	patches, err := p.h.ResmapFactory().MergePatches(p.loadedPatches)
+	// Merge the patches, looking for conflicts.
+	m, err := h.ResmapFactory().ConflatePatches(p.loadedPatches)
 	if err != nil {
 		return err
 	}
-	for _, patch := range patches.Resources() {
+	p.loadedPatches = m.Resources()
+	return nil
+}
+
+func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, patch := range p.loadedPatches {
 		target, err := m.GetById(patch.OrgId())
 		if err != nil {
 			return err
 		}
-		patchCopy := patch.DeepCopy()
-		patchCopy.SetName(target.GetName())
-		patchCopy.SetNamespace(target.GetNamespace())
-		patchCopy.SetGvk(target.GetGvk())
-		node, err := filtersutil.GetRNode(patchCopy)
-		if err != nil {
+		if err = m.ApplySmPatch(
+			resource.MakeIdSet([]*resource.Resource{target}), patch); err != nil {
 			return err
 		}
-		err = filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-			Patch: node,
-		}, target)
-		if err != nil {
-			// Check for an error string from UnmarshalJSON that's indicative
-			// of an object that's missing basic KRM fields, and thus may have been
-			// entirely deleted (an acceptable outcome).  This error handling should
-			// be deleted along with use of ResMap and apimachinery functions like
-			// UnmarshalJSON.
-			if !strings.Contains(err.Error(), "Object 'Kind' is missing") {
-				// Some unknown error, let it through.
-				return err
-			}
-			if len(target.Map()) != 0 {
-				return errors.Wrapf(
-					err, "with unexpectedly non-empty object map of size %d",
-					len(target.Map()))
-			}
-			// Fall through to handle deleted object.
-		}
-		if len(target.Map()) == 0 {
-			// This means all fields have been removed from the object.
-			// This can happen if a patch required deletion of the
-			// entire resource (not just a part of it).  This means
-			// the overall resmap must shrink by one.
-			err = m.Remove(target.CurId())
-			if err != nil {
-				return err
-			}
-		}
 	}
 	return nil
 }

api/builtins/PatchTransformer.go

@@ -9,7 +9,6 @@ import (
 
 	jsonpatch "github.com/evanphx/json-patch"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
-	"sigs.k8s.io/kustomize/api/filters/patchstrategicmerge"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
@@ -40,7 +39,6 @@ func (p *PatchTransformerPlugin) Config(
 		return fmt.Errorf(
 			"patch and path can't be set at the same time\n%s", string(c))
 	}
-
 	if p.Path != "" {
 		loaded, loadErr := h.Loader().Load(p.Path)
 		if loadErr != nil {
@@ -87,36 +85,13 @@ func (p *PatchTransformerPlugin) transformStrategicMerge(m resmap.ResMap, patch
 		if err != nil {
 			return err
 		}
-		return p.applySMPatch(target, patch)
+		return target.ApplySmPatch(patch)
 	}
-
-	resources, err := m.Select(*p.Target)
+	selected, err := m.Select(*p.Target)
 	if err != nil {
 		return err
 	}
-	for _, res := range resources {
-		patchCopy := patch.DeepCopy()
-		patchCopy.SetName(res.GetName())
-		patchCopy.SetNamespace(res.GetNamespace())
-		patchCopy.SetGvk(res.GetGvk())
-		err := p.applySMPatch(res, patchCopy)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// applySMPatch applies the provided strategic merge patch to the
-// given resource.
-func (p *PatchTransformerPlugin) applySMPatch(resource, patch *resource.Resource) error {
-	node, err := filtersutil.GetRNode(patch)
-	if err != nil {
-		return err
-	}
-	return filtersutil.ApplyToJSON(patchstrategicmerge.Filter{
-		Patch: node,
-	}, resource)
+	return m.ApplySmPatch(resource.MakeIdSet(selected), patch)
 }
 
 // transformJson6902 applies the provided json6902 patch

api/builtins/PrefixSuffixTransformer.go

@@ -26,6 +26,7 @@ type PrefixSuffixTransformerPlugin struct {
 var prefixSuffixFieldSpecsToSkip = types.FsSlice{
 	{Gvk: resid.Gvk{Kind: "CustomResourceDefinition"}},
 	{Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"}},
+	{Gvk: resid.Gvk{Kind: "Namespace"}},
 }
 
 func (p *PrefixSuffixTransformerPlugin) Config(

api/builtins/ReplicaCountTransformer.go

@@ -6,7 +6,8 @@ package builtins
 import (
 	"fmt"
 
-	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/filters/replicacount"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -30,18 +31,24 @@ func (p *ReplicaCountTransformerPlugin) Config(
 
 func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 	found := false
-	for i, replicaSpec := range p.FieldSpecs {
-		matcher := p.createMatcher(i)
+	for _, fs := range p.FieldSpecs {
+		matcher := p.createMatcher(fs)
 		matchOriginal := m.GetMatchingResourcesByOriginalId(matcher)
-		matchCurrent := m.GetMatchingResourcesByCurrentId(matcher)
-
-		for _, res := range append(matchOriginal, matchCurrent...) {
+		resList := append(
+			matchOriginal, m.GetMatchingResourcesByCurrentId(matcher)...)
+		if len(resList) > 0 {
 			found = true
-			err := transform.MutateField(
-				res.Map(), replicaSpec.PathSlice(),
-				replicaSpec.CreateIfNotPresent, p.addReplicas)
-			if err != nil {
-				return err
+			for _, r := range resList {
+				// There are redundant checks in the filter
+				// that we'll live with until resolution of
+				// https://github.com/kubernetes-sigs/kustomize/issues/2506
+				err := filtersutil.ApplyToJSON(replicacount.Filter{
+					Replica:   p.Replica,
+					FieldSpec: fs,
+				}, r)
+				if err != nil {
+					return err
+				}
 			}
 		}
 	}
@@ -59,30 +66,12 @@ func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 }
 
 // Match Replica.Name and FieldSpec
-func (p *ReplicaCountTransformerPlugin) createMatcher(i int) resmap.IdMatcher {
+func (p *ReplicaCountTransformerPlugin) createMatcher(fs types.FieldSpec) resmap.IdMatcher {
 	return func(r resid.ResId) bool {
-		return r.Name == p.Replica.Name &&
-			r.Gvk.IsSelected(&p.FieldSpecs[i].Gvk)
+		return r.Name == p.Replica.Name && r.Gvk.IsSelected(&fs.Gvk)
 	}
 }
 
-func (p *ReplicaCountTransformerPlugin) addReplicas(in interface{}) (interface{}, error) {
-	switch m := in.(type) {
-	case int64:
-		// Was already in the field.
-	case map[string]interface{}:
-		if len(m) != 0 {
-			// A map was already in the replicas field, don't want to
-			// discard this data silently.
-			return nil, fmt.Errorf("%#v is expected to be %T", in, m)
-		}
-		// Just got added, default type is map, but we can return anything.
-	default:
-		return nil, fmt.Errorf("%#v is expected to be %T", in, m)
-	}
-	return p.Replica.Count, nil
-}
-
 func NewReplicaCountTransformerPlugin() resmap.TransformerPlugin {
 	return &ReplicaCountTransformerPlugin{}
 }

api/filters/annotations/annotations.go

@@ -29,10 +29,11 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
-					FsSlice:    f.FsSlice,
-					SetValue:   filtersutil.SetEntry(k, f.Annotations[k], yaml.StringTag),
+					FsSlice: f.FsSlice,
+					SetValue: filtersutil.SetEntry(
+						k, f.Annotations[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Annotations are MappingNodes.
-					CreateTag:  "!!map",
+					CreateTag:  yaml.NodeTagMap,
 				}); err != nil {
 					return nil, err
 				}

api/filters/fieldspec/fieldspec.go

@@ -37,11 +37,11 @@ func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 	if match, err := isMatchGVK(fltr.FieldSpec, obj); !match || err != nil {
 		return obj, errors.Wrap(err)
 	}
-	fltr.path = strings.Split(fltr.FieldSpec.Path, "/")
+	fltr.path = splitPath(fltr.FieldSpec.Path)
 	if err := fltr.filter(obj); err != nil {
 		s, _ := obj.String()
 		return nil, errors.WrapPrefixf(err,
-			"obj %v at path %v", s, fltr.FieldSpec.Path)
+			"obj '%s' at path '%v'", s, fltr.FieldSpec.Path)
 	}
 	return obj, nil
 }
@@ -51,29 +51,35 @@ func (fltr Filter) filter(obj *yaml.RNode) error {
 		// found the field -- set its value
 		return fltr.SetValue(obj)
 	}
+	if obj.IsTaggedNull() {
+		return nil
+	}
 	switch obj.YNode().Kind {
 	case yaml.SequenceNode:
 		return fltr.seq(obj)
 	case yaml.MappingNode:
 		return fltr.field(obj)
+	default:
+		return errors.Errorf("expected sequence or mapping node")
 	}
-	// not found -- this might be an error since the type doesn't match
-
-	return errors.Errorf("unsupported yaml node")
 }
 
 // field calls filter on the field matching the next path element
 func (fltr Filter) field(obj *yaml.RNode) error {
 	fieldName, isSeq := isSequenceField(fltr.path[0])
-
 	// lookup the field matching the next path element
 	var lookupField yaml.Filter
 	var kind yaml.Kind
-	var tag string
+	tag := yaml.NodeTagEmpty
 	switch {
 	case !fltr.FieldSpec.CreateIfNotPresent || fltr.CreateKind == 0 || isSeq:
 		// dont' create the field if we don't find it
 		lookupField = yaml.Lookup(fieldName)
+		if isSeq {
+			// The query path thinks this field should be a sequence;
+			// accept this hint for use later if the tag is NodeTagNull.
+			kind = yaml.SequenceNode
+		}
 	case len(fltr.path) <= 1:
 		// create the field if it is missing: use the provided node kind
 		lookupField = yaml.LookupCreate(fltr.CreateKind, fieldName)
@@ -83,7 +89,7 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 		// create the field if it is missing: must be a mapping node
 		lookupField = yaml.LookupCreate(yaml.MappingNode, fieldName)
 		kind = yaml.MappingNode
-		tag = "!!map"
+		tag = yaml.NodeTagMap
 	}
 
 	// locate (or maybe create) the field
@@ -92,9 +98,10 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 		return errors.WrapPrefixf(err, "fieldName: %s", fieldName)
 	}
 
-	// if the value exists, but is null, then change it to the creation type
+	// if the value exists, but is null and kind is set,
+	// then change it to the creation type
 	// TODO: update yaml.LookupCreate to support this
-	if field.YNode().Tag == "!!null" {
+	if field.YNode().Tag == yaml.NodeTagNull && yaml.IsCreate(kind) {
 		field.YNode().Kind = kind
 		field.YNode().Tag = tag
 	}
@@ -156,3 +163,18 @@ func isMatchGVK(fs types.FieldSpec, obj *yaml.RNode) (bool, error) {
 
 	return true, nil
 }
+
+func splitPath(path string) []string {
+	ps := strings.Split(path, "/")
+	var res []string
+	res = append(res, ps[0])
+	for i := 1; i < len(ps); i++ {
+		lastIndex := len(res) - 1
+		if strings.HasSuffix(res[lastIndex], "\\") {
+			res[lastIndex] = strings.TrimSuffix(res[lastIndex], "\\") + "/" + ps[i]
+		} else {
+			res = append(res, ps[i])
+		}
+	}
+	return res
+}

api/filters/fieldspec/fieldspec_test.go

@@ -176,7 +176,8 @@ kind: Bar
 a:
   b: a
 `,
-		error: "obj kind: Bar\na:\n  b: a\n at path a/b/c: unsupported yaml node",
+		error: "obj 'kind: Bar\na:\n  b: a\n' at path 'a/b/c': " +
+			"expected sequence or mapping node",
 		filter: fieldspec.Filter{
 			SetValue: filtersutil.SetScalar("e"),
 		},
@@ -333,6 +334,160 @@ a:
 			CreateKind: yaml.ScalarNode,
 		},
 	},
+	{
+		name: "successfully set field on array entry no sequence hint",
+		fieldSpec: `
+path: spec/containers/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "successfully set field on array entry with sequence hint",
+		fieldSpec: `
+path: spec/containers[]/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+  - image: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "failure to set field on array entry with sequence hint in path",
+		fieldSpec: `
+path: spec/containers[]/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers: []
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "failure to set field on array entry, no sequence hint in path",
+		fieldSpec: `
+path: spec/containers/image
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+spec:
+  containers:
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "filedname with slash '/'",
+		fieldSpec: `
+path: a/b\/c/d
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
+	{
+		name: "filedname with multiple '/'",
+		fieldSpec: `
+path: a/b\/c/d\/e/f
+version: v1
+kind: Bar
+`,
+		input: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d/e:
+      f: foo
+`,
+		expected: `
+apiVersion: v1
+kind: Bar
+a:
+  b/c:
+    d/e:
+      f: bar
+`,
+		filter: fieldspec.Filter{
+			SetValue:   filtersutil.SetScalar("bar"),
+			CreateKind: yaml.ScalarNode,
+		},
+	},
 }
 
 func TestFilter_Filter(t *testing.T) {

api/filters/filtersutil/setters.go

@@ -21,7 +21,7 @@ func SetEntry(key, value, tag string) SetFn {
 		Value: value,
 		Tag:   tag,
 	}
-	if tag == yaml.StringTag && yaml.IsYaml1_1NonString(n) {
+	if tag == yaml.NodeTagString && yaml.IsYaml1_1NonString(n) {
 		n.Style = yaml.DoubleQuotedStyle
 	}
 	return func(node *yaml.RNode) error {

api/filters/imagetag/imagetag.go

@@ -11,11 +11,17 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
+// Filter modifies an "image tag", the value used to specify the
+// name, tag, version digest etc. of (docker) container images
+// used by a pod template.
 type Filter struct {
 	// imageTag is the tag we want to apply to the inputs
+	// The name of the image is used as a key, and other fields
+	// can specify a new name, tag, etc.
 	ImageTag types.Image `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
 
-	// FsSlice contains the FieldSpecs to locate the namespace field
+	// FsSlice contains the FieldSpecs to locate an image field,
+	// e.g. Path: "spec/myContainers[]/image"
 	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
@@ -27,6 +33,12 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 }
 
 func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
+	// FsSlice is an allowlist, not a denyList, so to deny
+	// something via configuration a new config mechanism is
+	// needed. Until then, hardcode it.
+	if f.isOnDenyList(node) {
+		return node, nil
+	}
 	if err := node.PipeE(fsslice.Filter{
 		FsSlice:  f.FsSlice,
 		SetValue: updateImageTagFn(f.ImageTag),
@@ -36,6 +48,18 @@ func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
 	return node, nil
 }
 
+func (f Filter) isOnDenyList(node *yaml.RNode) bool {
+	meta, err := node.GetMeta()
+	if err != nil {
+		// A missing 'meta' field will cause problems elsewhere;
+		// ignore it here to keep the signature simple.
+		return false
+	}
+	// Ignore CRDs
+	// https://github.com/kubernetes-sigs/kustomize/issues/890
+	return meta.Kind == `CustomResourceDefinition`
+}
+
 func updateImageTagFn(imageTag types.Image) filtersutil.SetFn {
 	return func(node *yaml.RNode) error {
 		return node.PipeE(imageTagUpdater{

api/filters/imagetag/imagetag_test.go

@@ -19,6 +19,162 @@ func TestImageTagUpdater_Filter(t *testing.T) {
 		filter         Filter
 		fsSlice        types.FsSlice
 	}{
+		"ignore CustomResourceDefinition": {
+			input: `
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: whatever
+spec:
+  containers:
+  - image: whatever
+`,
+			expectedOutput: `
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: whatever
+spec:
+  containers:
+  - image: whatever
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "whatever",
+					NewName: "theImageShouldNotChangeInACrd",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+			},
+		},
+
+		"legacy multiple images in containers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: nginx:2.1.2
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache@12345
+  - image: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+			},
+		},
+		"legacy both containers and initContainers": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: nginx:1.2.1
+  - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  initContainers:
+  - image: apache:3.2.1
+  - image: apache:1.2.3
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+				{
+					Path: "spec/initContainers/image",
+				},
+			},
+		},
+		"legacy updates at multiple depths": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: nginx:1.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec:
+      initContainers:
+      - image: nginx:1.2.1
+      - image: apache:1.2.3
+`,
+			expectedOutput: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: instance
+spec:
+  containers:
+  - image: apache:3.2.1
+  - image: tomcat:1.2.3
+  template:
+    spec:
+      initContainers:
+      - image: apache:3.2.1
+      - image: apache:1.2.3
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					NewTag:  "3.2.1",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers/image",
+				},
+			},
+		},
 		"update with digest": {
 			input: `
 apiVersion: example.com/v1
@@ -49,6 +205,7 @@ spec:
 				},
 			},
 		},
+
 		"multiple matches in sequence": {
 			input: `
 apiVersion: example.com/v1
@@ -85,6 +242,422 @@ spec:
 				},
 			},
 		},
+
+		"new Tag": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:v2
+        name: nginx-tagged
+      - image: nginx:v2
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx:v2
+        name: nginx-notag
+      - image: nginx:v2
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					NewTag: "v2",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newImage": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox:1.7.9
+        name: nginx-tagged
+      - image: busybox:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox
+        name: nginx-notag
+      - image: busybox@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newImageAndTag": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox:v3
+        name: nginx-tagged
+      - image: busybox:v3
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox:v3
+        name: nginx-notag
+      - image: busybox:v3
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+					NewTag:  "v3",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"newDigest": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx@sha256:222222222222222222
+        name: nginx-tagged
+      - image: nginx@sha256:222222222222222222
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx@sha256:222222222222222222
+        name: nginx-notag
+      - image: nginx@sha256:222222222222222222
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					Digest: "sha256:222222222222222222",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers/image",
+				},
+			},
+		},
+		"newImageAndDigest": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:latest
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: nginx
+        name: nginx-notag
+      - image: nginx@sha256:111111111111111111
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox@sha256:222222222222222222
+        name: nginx-tagged
+      - image: busybox@sha256:222222222222222222
+        name: nginx-latest
+      - image: foobar:1
+        name: replaced-with-digest
+      - image: postgres:1.8.0
+        name: postgresdb
+      initContainers:
+      - image: busybox@sha256:222222222222222222
+        name: nginx-notag
+      - image: busybox@sha256:222222222222222222
+        name: nginx-sha256
+      - image: alpine:1.8.0
+        name: init-alpine
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "busybox",
+					Digest:  "sha256:222222222222222222",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
+		"emptyContainers": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  containers:
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  containers: []
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "nginx",
+					NewTag: "v2",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/containers[]/image",
+					//					CreateIfNotPresent: true,
+				},
+			},
+		},
+		"tagWithBraces": {
+			input: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: some.registry.io/my-image:{GENERATED_TAG}
+        name: my-image
+`,
+			expectedOutput: `
+group: apps
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy1
+spec:
+  template:
+    spec:
+      containers:
+      - image: some.registry.io/my-image:my-fixed-tag
+        name: my-image
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:   "some.registry.io/my-image",
+					NewTag: "my-fixed-tag",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/template/spec/containers[]/image",
+				},
+				{
+					Path: "spec/template/spec/initContainers[]/image",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/filters/labels/labels.go

@@ -30,10 +30,11 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 		func(node *yaml.RNode) (*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
-					FsSlice:    f.FsSlice,
-					SetValue:   filtersutil.SetEntry(k, f.Labels[k], yaml.StringTag),
+					FsSlice: f.FsSlice,
+					SetValue: filtersutil.SetEntry(
+						k, f.Labels[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Labels are MappingNodes.
-					CreateTag:  "!!map",
+					CreateTag:  yaml.NodeTagMap,
 				}); err != nil {
 					return nil, err
 				}

api/filters/nameref/doc.go

@@ -0,0 +1,3 @@
+// Package nameref contains a kio.Filter implementation of the kustomize
+// name reference transformer.
+package nameref

api/filters/nameref/nameref.go

@@ -0,0 +1,297 @@
+package nameref
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	kyaml_filtersutil "sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter will update the name reference
+type Filter struct {
+	FieldSpec          types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+	Referrer           *resource.Resource
+	Target             resid.Gvk
+	ReferralCandidates resmap.ResMap
+	isRoleRef          bool
+}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
+}
+
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec: f.FieldSpec,
+		SetValue:  f.set,
+	})
+	return node, err
+}
+
+func (f Filter) set(node *yaml.RNode) error {
+	if yaml.IsMissingOrNull(node) {
+		return nil
+	}
+	if strings.HasSuffix(f.FieldSpec.Path, "roleRef/name") {
+		f.isRoleRef = true
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		return f.setScalar(node)
+	case yaml.MappingNode:
+		// Kind: ValidatingWebhookConfiguration
+		// FieldSpec is webhooks/clientConfig/service
+		return f.setMapping(node)
+	case yaml.SequenceNode:
+		return f.setSequence(node)
+	default:
+		return fmt.Errorf(
+			"node is expected to be either a string or a slice of string or a map of string")
+	}
+}
+
+func (f Filter) setSequence(node *yaml.RNode) error {
+	return applyFilterToSeq(seqFilter{
+		setScalarFn:  f.setScalar,
+		setMappingFn: f.setMapping,
+	}, node)
+}
+
+func (f Filter) setMapping(node *yaml.RNode) error {
+	return setNameAndNs(
+		node,
+		f.Referrer,
+		f.Target,
+		f.ReferralCandidates,
+		f.isRoleRef,
+	)
+}
+
+func (f Filter) setScalar(node *yaml.RNode) error {
+	newValue, err := getSimpleNameField(
+		node.YNode().Value,
+		f.Referrer,
+		f.Target,
+		f.ReferralCandidates,
+		f.ReferralCandidates.Resources(),
+		f.isRoleRef,
+	)
+	if err != nil {
+		return err
+	}
+	err = filtersutil.SetScalar(newValue)(node)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// getRoleRefGvk returns a Gvk in the roleRef field. Return error
+// if the roleRef, roleRef/apiGroup or roleRef/kind is missing.
+func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
+	n, err := kyaml_filtersutil.GetRNode(res)
+	if err != nil {
+		return nil, err
+	}
+	roleRef, err := n.Pipe(yaml.Lookup("roleRef"))
+	if err != nil {
+		return nil, err
+	}
+	if roleRef.IsNil() {
+		return nil, fmt.Errorf("roleRef cannot be found in %s", n.MustString())
+	}
+	apiGroup, err := roleRef.Pipe(yaml.Lookup("apiGroup"))
+	if err != nil {
+		return nil, err
+	}
+	if apiGroup.IsNil() {
+		return nil, fmt.Errorf("apiGroup cannot be found in roleRef %s", roleRef.MustString())
+	}
+	kind, err := roleRef.Pipe(yaml.Lookup("kind"))
+	if err != nil {
+		return nil, err
+	}
+	if kind.IsNil() {
+		return nil, fmt.Errorf("kind cannot be found in roleRef %s", roleRef.MustString())
+	}
+	return &resid.Gvk{
+		Group: apiGroup.YNode().Value,
+		Kind:  kind.YNode().Value,
+	}, nil
+}
+
+func filterReferralCandidates(
+	referrer *resource.Resource,
+	matches []*resource.Resource,
+	target resid.Gvk,
+) []*resource.Resource {
+	var ret []*resource.Resource
+	for _, m := range matches {
+		// If target kind is not ServiceAccount, we shouldn't consider condidates which
+		// doesn't have same namespace.
+		if target.Kind != "ServiceAccount" && m.GetNamespace() != referrer.GetNamespace() {
+			continue
+		}
+		if !referrer.PrefixesSuffixesEquals(m) {
+			continue
+		}
+		ret = append(ret, m)
+	}
+	return ret
+}
+
+// selectReferral picks the referral among a subset of candidates.
+// It returns the current name and namespace of the selected candidate.
+// Note that the content of the referricalCandidateSubset slice is most of the time
+// identical to the referralCandidates resmap. Still in some cases, such
+// as ClusterRoleBinding, the subset only contains the resources of a specific
+// namespace.
+func selectReferral(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource,
+	isRoleRef bool) (string, string, error) {
+	var roleRefGvk *resid.Gvk
+	if isRoleRef {
+		var err error
+		roleRefGvk, err = getRoleRefGvk(referrer)
+		if err != nil {
+			return "", "", err
+		}
+	}
+	for _, res := range referralCandidateSubset {
+		id := res.OrgId()
+		// If the we are processing a roleRef, the apiGroup and Kind in the
+		// roleRef are needed to be considered.
+		if (!isRoleRef || id.IsSelected(roleRefGvk)) &&
+			id.IsSelected(&target) && res.GetOriginalName() == oldName {
+			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
+			// If there's more than one match,
+			// filter the matches by prefix and suffix
+			if len(matches) > 1 {
+				filteredMatches := filterReferralCandidates(referrer, matches, target)
+				if len(filteredMatches) > 1 {
+					return "", "", fmt.Errorf(
+						"multiple matches for %s:\n  %v",
+						id, getIds(filteredMatches))
+				}
+				// Check is the match the resource we are working on
+				if len(filteredMatches) == 0 || res != filteredMatches[0] {
+					continue
+				}
+			}
+			// In the resource, note that it is referenced
+			// by the referrer.
+			res.AppendRefBy(referrer.CurId())
+			// Return transformed name of the object,
+			// complete with prefixes, hashes, etc.
+			return res.GetName(), res.GetNamespace(), nil
+		}
+	}
+
+	return oldName, "", nil
+}
+
+// utility function to replace a simple string by the new name
+func getSimpleNameField(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource,
+	isRoleRef bool) (string, error) {
+
+	newName, _, err := selectReferral(oldName, referrer, target,
+		referralCandidates, referralCandidateSubset, isRoleRef)
+
+	return newName, err
+}
+
+func getIds(rs []*resource.Resource) []string {
+	var result []string
+	for _, r := range rs {
+		result = append(result, r.CurId().String()+"\n")
+	}
+	return result
+}
+
+// utility function to replace name field within a map RNode
+// and leverage the namespace field.
+func setNameAndNs(
+	in *yaml.RNode,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	isRoleRef bool) error {
+
+	if in.YNode().Kind != yaml.MappingNode {
+		return fmt.Errorf("expect a mapping node")
+	}
+
+	// Get name field
+	nameNode, err := in.Pipe(yaml.FieldMatcher{
+		Name: "name",
+	})
+	if err != nil || nameNode == nil {
+		return fmt.Errorf("cannot find field 'name' in node")
+	}
+
+	// Get namespace field
+	namespaceNode, err := in.Pipe(yaml.FieldMatcher{
+		Name: "namespace",
+	})
+	if err != nil {
+		return fmt.Errorf("error when find field 'namespace'")
+	}
+
+	// check is namespace matched
+	// name will bot be updated if the namespace doesn't match
+	subset := referralCandidates.Resources()
+	if namespaceNode != nil {
+		namespace := namespaceNode.YNode().Value
+		bynamespace := referralCandidates.GroupedByOriginalNamespace()
+		if _, ok := bynamespace[namespace]; !ok {
+			return nil
+		}
+		subset = bynamespace[namespace]
+	}
+
+	oldName := nameNode.YNode().Value
+	newname, newnamespace, err := selectReferral(oldName, referrer, target,
+		referralCandidates, subset, isRoleRef)
+	if err != nil {
+		return err
+	}
+
+	if (newname == oldName) && (newnamespace == "") {
+		// no candidate found.
+		return nil
+	}
+
+	// set name
+	in.Pipe(yaml.FieldSetter{
+		Name:        "name",
+		StringValue: newname,
+	})
+	if newnamespace != "" {
+		// We don't want value "" to replace value "default" since
+		// the empty string is handled as a wild card here not default namespace
+		// by kubernetes.
+		in.Pipe(yaml.FieldSetter{
+			Name:        "namespace",
+			StringValue: newnamespace,
+		})
+	}
+	return nil
+}

api/filters/nameref/nameref_test.go

@@ -0,0 +1,780 @@
+package nameref
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/provider"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestNamerefFilter(t *testing.T) {
+	testCases := map[string]struct {
+		input         string
+		candidates    string
+		expected      string
+		filter        Filter
+		originalNames []string
+	}{
+		"simple scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+seq:
+- oldName1
+- oldName2
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName1", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+seq:
+- newName
+- oldName2
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "seq"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"mapping": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "map"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"mapping with namespace": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: oldName
+  namespace: oldNs
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+  namespace: oldNs
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: newName
+  namespace: oldNs
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "map"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"null value": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: null
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: NotSecret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", ""},
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+map:
+  name: null
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "map"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatal(err)
+			}
+			tc.filter.Referrer = referrer
+
+			resMapFactory := resmap.NewFactory(factory, nil)
+			candidatesRes, err := factory.SliceFromBytesWithNames(
+				tc.originalNames, []byte(tc.candidates))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			candidates := resMapFactory.FromResourceSlice(candidatesRes)
+			tc.filter.ReferralCandidates = candidates
+
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestNamerefFilterUnhappy(t *testing.T) {
+	testCases := map[string]struct {
+		input         string
+		candidates    string
+		expected      string
+		filter        Filter
+		originalNames []string
+	}{
+		"multiple match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+		"no name": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  notName: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatal(err)
+			}
+			tc.filter.Referrer = referrer
+
+			resMapFactory := resmap.NewFactory(factory, nil)
+			candidatesRes, err := factory.SliceFromBytesWithNames(
+				tc.originalNames, []byte(tc.candidates))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			candidates := resMapFactory.FromResourceSlice(candidatesRes)
+			tc.filter.ReferralCandidates = candidates
+
+			_, err = filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			if err == nil {
+				t.Fatalf("expect an error")
+			}
+			if tc.expected != "" && !assert.EqualError(t, err, tc.expected) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestCandidatesWithDifferentPrefixSuffix(t *testing.T) {
+	testCases := map[string]struct {
+		input         string
+		candidates    string
+		expected      string
+		filter        Filter
+		originalNames []string
+		prefix        []string
+		suffix        []string
+		inputPrefix   string
+		inputSuffix   string
+		err           bool
+	}{
+		"prefix match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix1", "prefix2"},
+			suffix:        []string{"", "suffix2"},
+			inputPrefix:   "prefix1",
+			inputSuffix:   "",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+		"suffix match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"", "prefix2"},
+			suffix:        []string{"suffix1", "suffix2"},
+			inputPrefix:   "",
+			inputSuffix:   "suffix1",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+		"prefix suffix both match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix1", "prefix2"},
+			suffix:        []string{"suffix1", "suffix2"},
+			inputPrefix:   "prefix1",
+			inputSuffix:   "suffix1",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: newName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+		"multiple match: both": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix", "prefix"},
+			suffix:        []string{"suffix", "suffix"},
+			inputPrefix:   "prefix",
+			inputSuffix:   "suffix",
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: true,
+		},
+		"multiple match: only prefix": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix", "prefix"},
+			suffix:        []string{"", ""},
+			inputPrefix:   "prefix",
+			inputSuffix:   "",
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: true,
+		},
+		"multiple match: only suffix": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"", ""},
+			suffix:        []string{"suffix", "suffix"},
+			inputPrefix:   "",
+			inputSuffix:   "suffix",
+			expected:      "",
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: true,
+		},
+		"no match: neither match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix1", "prefix2"},
+			suffix:        []string{"suffix1", "suffix2"},
+			inputPrefix:   "prefix",
+			inputSuffix:   "suffix",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+		"no match: prefix doesn't match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix1", "prefix2"},
+			suffix:        []string{"suffix", "suffix"},
+			inputPrefix:   "prefix",
+			inputSuffix:   "suffix",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+		"no match: suffix doesn't match": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			candidates: `
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: newName2
+`,
+			originalNames: []string{"oldName", "oldName"},
+			prefix:        []string{"prefix", "prefix"},
+			suffix:        []string{"suffix1", "suffix2"},
+			inputPrefix:   "prefix",
+			inputSuffix:   "suffix",
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+ref:
+  name: oldName
+`,
+			filter: Filter{
+				FieldSpec: types.FieldSpec{Path: "ref/name"},
+				Target: resid.Gvk{
+					Group:   "apps",
+					Version: "v1",
+					Kind:    "Secret",
+				},
+			},
+			err: false,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			factory := provider.NewDefaultDepProvider().GetResourceFactory()
+			referrer, err := factory.FromBytes([]byte(tc.input))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if tc.inputPrefix != "" {
+				referrer.AddNamePrefix(tc.inputPrefix)
+			}
+			if tc.inputSuffix != "" {
+				referrer.AddNameSuffix(tc.inputSuffix)
+			}
+			tc.filter.Referrer = referrer
+
+			resMapFactory := resmap.NewFactory(factory, nil)
+			candidatesRes, err := factory.SliceFromBytesWithNames(
+				tc.originalNames, []byte(tc.candidates))
+			if err != nil {
+				t.Fatal(err)
+			}
+			for i := range candidatesRes {
+				if tc.prefix[i] != "" {
+					candidatesRes[i].AddNamePrefix(tc.prefix[i])
+				}
+				if tc.suffix[i] != "" {
+					candidatesRes[i].AddNameSuffix(tc.suffix[i])
+				}
+			}
+
+			candidates := resMapFactory.FromResourceSlice(candidatesRes)
+			tc.filter.ReferralCandidates = candidates
+
+			if !tc.err {
+				if !assert.Equal(t,
+					strings.TrimSpace(tc.expected),
+					strings.TrimSpace(
+						filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+					t.FailNow()
+				}
+			} else {
+				_, err := filtertest_test.RunFilterE(t, tc.input, tc.filter)
+				if err == nil {
+					t.Fatalf("an error is expected")
+				}
+			}
+		})
+	}
+}

api/filters/nameref/seqfilter.go

@@ -0,0 +1,57 @@
+package nameref
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+type setFn func(*yaml.RNode) error
+
+type seqFilter struct {
+	setScalarFn  setFn
+	setMappingFn setFn
+}
+
+func (sf seqFilter) Filter(node *yaml.RNode) (*yaml.RNode, error) {
+	if yaml.IsMissingOrNull(node) {
+		return node, nil
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		// Kind: Role/ClusterRole
+		// FieldSpec is rules.resourceNames
+		err := sf.setScalarFn(node)
+		return node, err
+	case yaml.MappingNode:
+		// Kind: RoleBinding/ClusterRoleBinding
+		// FieldSpec is subjects
+		// Note: The corresponding fieldSpec had been changed from
+		// from path: subjects/name to just path: subjects. This is
+		// what get mutatefield to request the mapping of the whole
+		// map containing namespace and name instead of just a simple
+		// string field containing the name
+		err := sf.setMappingFn(node)
+		return node, err
+	default:
+		return node, fmt.Errorf(
+			"%#v is expected to be either a string or a map of string", node)
+	}
+}
+
+// applyFilterToSeq will apply the filter to each element in the sequence node
+func applyFilterToSeq(filter yaml.Filter, node *yaml.RNode) error {
+	if node.YNode().Kind != yaml.SequenceNode {
+		return fmt.Errorf("expect a sequence node but got %v", node.YNode().Kind)
+	}
+
+	for _, elem := range node.Content() {
+		rnode := yaml.NewRNode(elem)
+		err := rnode.PipeE(filter)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

api/filters/nameref/seqfilter_test.go

@@ -0,0 +1,80 @@
+package nameref
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func SeqFilter(node *yaml.RNode) (*yaml.RNode, error) {
+	if node.YNode().Value == "aaa" {
+		node.YNode().SetString("ccc")
+	}
+	return node, nil
+}
+
+func TestApplyFilterToSeq(t *testing.T) {
+	fltr := yaml.FilterFunc(SeqFilter)
+
+	testCases := map[string]struct {
+		input  string
+		expect string
+	}{
+		"replace in seq": {
+			input: `
+- aaa
+- bbb`,
+			expect: `
+- ccc
+- bbb`,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			node, err := yaml.Parse(tc.input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = applyFilterToSeq(fltr, node)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expect),
+				strings.TrimSpace(node.MustString())) {
+				t.Fatalf("expect:\n%s\nactual:\n%s",
+					strings.TrimSpace(tc.expect),
+					strings.TrimSpace(node.MustString()))
+			}
+		})
+	}
+}
+
+func TestApplyFilterToSeqUnhappy(t *testing.T) {
+	fltr := yaml.FilterFunc(SeqFilter)
+
+	testCases := map[string]struct {
+		input string
+	}{
+		"replace in seq": {
+			input: `
+aaa`,
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			node, err := yaml.Parse(tc.input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = applyFilterToSeq(fltr, node)
+			if err == nil {
+				t.Fatalf("expect an error")
+			}
+		})
+	}
+}

api/filters/namespace/namespace.go

@@ -46,7 +46,7 @@ func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		FsSlice:    ns.FsSlice,
 		SetValue:   filtersutil.SetScalar(ns.Namespace),
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
-		CreateTag:  yaml.StringTag,
+		CreateTag:  yaml.NodeTagString,
 	})
 	return node, err
 }
@@ -69,7 +69,7 @@ func (ns Filter) hacks(obj *yaml.RNode) error {
 // metaNamespaceHack is a hack for implementing the namespace transform
 // for the metadata.namespace field on namespace scoped resources.
 // namespace scoped resources are determined by NOT being present
-// in a blacklist of cluster-scoped resource types (by apiVersion and kind).
+// in a hard-coded list of cluster-scoped resource types (by apiVersion and kind).
 //
 // This hack should be updated to allow individual resources to specify
 // if they are cluster scoped through either an annotation on the resources,
@@ -112,7 +112,7 @@ func (ns Filter) roleBindingHack(obj *yaml.RNode, meta yaml.ResourceMeta) error
 	// Lookup the namespace field on all elements.
 	// We should change the fieldspec so this isn't necessary.
 	obj, err := obj.Pipe(yaml.Lookup(subjectsField))
-	if err != nil || yaml.IsEmpty(obj) {
+	if err != nil || yaml.IsMissingOrNull(obj) {
 		return err
 	}
 
@@ -125,7 +125,7 @@ func (ns Filter) roleBindingHack(obj *yaml.RNode, meta yaml.ResourceMeta) error
 		name, err := o.Pipe(
 			yaml.Lookup("name"), yaml.Match("default"),
 		)
-		if err != nil || yaml.IsEmpty(name) {
+		if err != nil || yaml.IsMissingOrNull(name) {
 			return err
 		}
 

api/filters/namespace/namespace_test.go

@@ -194,47 +194,47 @@ metadata:
 	{
 		name: "update-clusterrolebinding",
 		input: `
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: default
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: default
   namespace: foo
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: something
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: something
   namespace: foo
 `,
 		expected: `
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: default
   namespace: bar
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: default
   namespace: bar
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: something
 ---
-apiVersion: example.com/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 subjects:
 - name: something

api/filters/patchstrategicmerge/patchstrategicmerge.go

@@ -18,7 +18,12 @@ var _ kio.Filter = Filter{}
 func (pf Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	var result []*yaml.RNode
 	for i := range nodes {
-		r, err := merge2.Merge(pf.Patch, nodes[i])
+		r, err := merge2.Merge(
+			pf.Patch, nodes[i],
+			yaml.MergeOptions{
+				ListIncreaseDirection: yaml.MergeOptionsListPrepend,
+			},
+		)
 		if err != nil {
 			return nil, err
 		}

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -15,6 +15,101 @@ func TestFilter(t *testing.T) {
 		patch    *yaml.RNode
 		expected string
 	}{
+		"simple": {
+			input: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 1
+`,
+			patch: yaml.MustParse(`apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 999
+`),
+			expected: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 999
+`,
+		},
+		"nullMapEntry1": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    B:
+    C: Z
+`,
+			patch: yaml.MustParse(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`),
+			expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+		},
+		"nullMapEntry2": {
+			input: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+			patch: yaml.MustParse(`
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    B:
+    C: Z
+`),
+			expected: `
+apiVersion: example.com/v1
+kind: Foo
+metadata:
+  name: my-foo
+spec:
+  bar:
+    C: Z
+    D: W
+  baz:
+    hello: world
+`,
+		},
 		"simple patch": {
 			input: `
 apiVersion: apps/v1
@@ -67,10 +162,10 @@ spec:
   template:
     spec:
       containers:
+      - name: foo0
       - name: foo1
       - name: foo2
       - name: foo3
-      - name: foo0
 `,
 		},
 		"volumes patch": {
@@ -107,10 +202,10 @@ spec:
   template:
     spec:
       volumes:
+      - name: foo0
       - name: foo1
       - name: foo2
       - name: foo3
-      - name: foo0
 `,
 		},
 		"nested patch": {
@@ -142,6 +237,441 @@ spec:
   - name: nginx
     args:
     - def
+`,
+		},
+		"remove mapping - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+        $patch: delete   
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers: []
+`,
+		},
+		"replace mapping - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      $patch: replace
+      containers:
+      - name: new
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: new
+`,
+		},
+		"merge mapping - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test1
+        $patch: merge   
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test1
+`,
+		},
+		"remove list - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - whatever
+      - $patch: delete
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec: {}
+`,
+		},
+		"replace list - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: replace
+        image: replace
+      - $patch: replace   
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: replace
+        image: replace
+`,
+		},
+		"merge list - directive": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: test
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test2
+        image: test2
+      - $patch: merge   
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: test2
+        image: test2
+      - name: test
+        image: test
+`,
+		},
+		"list map keys - add a port, no names": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: TCP
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: UDP
+       - containerPort: 80
+         protocol: UDP
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: test-image
+        name: test-deployment
+        ports:
+        - containerPort: 8080
+          protocol: UDP
+        - containerPort: 80
+          protocol: UDP
+        - containerPort: 8080
+          protocol: TCP
+`,
+		},
+		"list map keys - add name to port": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: UDP
+       - containerPort: 8080
+         protocol: TCP
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: UDP
+         name: UDP-name-patch
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: test-image
+        name: test-deployment
+        ports:
+        - containerPort: 8080
+          protocol: UDP
+          name: UDP-name-patch
+        - containerPort: 8080
+          protocol: TCP
+`,
+		},
+		"list map keys - replace port name": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: UDP
+         name: UDP-name-original
+       - containerPort: 8080
+         protocol: TCP
+         name: TCP-name-original
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+         protocol: UDP
+         name: UDP-name-patch
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: test-image
+        name: test-deployment
+        ports:
+        - containerPort: 8080
+          protocol: UDP
+          name: UDP-name-patch
+        - containerPort: 8080
+          protocol: TCP
+          name: TCP-name-original
+`,
+		},
+		"list map keys - add a port, no protocol": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 8080
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: test-deployment
+spec:
+ template:
+   spec:
+     containers:
+     - image: test-image
+       name: test-deployment
+       ports:
+       - containerPort: 80
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: test-image
+        name: test-deployment
+        ports:
+        - containerPort: 80
+        - containerPort: 8080
 `,
 		},
 	}

api/filters/prefixsuffix/prefixsuffix.go

@@ -32,7 +32,7 @@ func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		FieldSpec:  f.FieldSpec,
 		SetValue:   f.evaluateField,
 		CreateKind: yaml.ScalarNode, // Name is a ScalarNode
-		CreateTag:  yaml.StringTag,
+		CreateTag:  yaml.NodeTagString,
 	})
 	return node, err
 }

api/filters/refvar/doc.go

@@ -0,0 +1,3 @@
+// Package refvar contains a kio.Filter implementation of the kustomize
+// refvar transformer.
+package refvar

api/filters/refvar/refvar.go

@@ -0,0 +1,101 @@
+package refvar
+
+import (
+	"fmt"
+	"strconv"
+
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+)
+
+// Filter updates $(VAR) style variables with values.
+// The fieldSpecs are the places to look for occurrences of $(VAR).
+type Filter struct {
+	MappingFunc func(string) interface{} `json:"mappingFunc,omitempty" yaml:"mappingFunc,omitempty"`
+	FieldSpec   types.FieldSpec          `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
+}
+
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec: f.FieldSpec,
+		SetValue:  f.set,
+	})
+	return node, err
+}
+
+func (f Filter) set(node *yaml.RNode) error {
+	if yaml.IsMissingOrNull(node) {
+		return nil
+	}
+	switch node.YNode().Kind {
+	case yaml.ScalarNode:
+		return f.setScalar(node)
+	case yaml.MappingNode:
+		return f.setMap(node)
+	case yaml.SequenceNode:
+		return f.setSeq(node)
+	default:
+		return fmt.Errorf("invalid type encountered %v", node.YNode().Kind)
+	}
+}
+
+func updateNodeValue(node *yaml.Node, newValue interface{}) {
+	switch newValue := newValue.(type) {
+	case int64:
+		node.Value = strconv.FormatInt(newValue, 10)
+		node.Tag = yaml.NodeTagInt
+	case bool:
+		node.SetString(strconv.FormatBool(newValue))
+		node.Tag = yaml.NodeTagBool
+	case float64:
+		node.SetString(strconv.FormatFloat(newValue, 'f', -1, 64))
+		node.Tag = yaml.NodeTagFloat
+	default:
+		node.SetString(newValue.(string))
+		node.Tag = yaml.NodeTagString
+	}
+	node.Style = 0
+}
+
+func (f Filter) setScalar(node *yaml.RNode) error {
+	if !yaml.IsYNodeString(node.YNode()) {
+		return nil
+	}
+	v := expansion2.Expand(node.YNode().Value, f.MappingFunc)
+	updateNodeValue(node.YNode(), v)
+	return nil
+}
+
+func (f Filter) setMap(node *yaml.RNode) error {
+	contents := node.YNode().Content
+	for i := 0; i < len(contents); i += 2 {
+		if !yaml.IsYNodeString(contents[i]) {
+			return fmt.Errorf("invalid map key: %s, type: %s", contents[i].Value, contents[i].Tag)
+		}
+		if !yaml.IsYNodeString(contents[i+1]) {
+			continue
+		}
+		newValue := expansion2.Expand(contents[i+1].Value, f.MappingFunc)
+		updateNodeValue(contents[i+1], newValue)
+	}
+	return nil
+}
+
+func (f Filter) setSeq(node *yaml.RNode) error {
+	for _, item := range node.YNode().Content {
+		if !yaml.IsYNodeString(item) {
+			return fmt.Errorf("invalid value type expect a string")
+		}
+		newValue := expansion2.Expand(item.Value, f.MappingFunc)
+		updateNodeValue(item, newValue)
+	}
+	return nil
+}

api/filters/refvar/refvar_test.go

@@ -0,0 +1,293 @@
+package refvar
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestFilter(t *testing.T) {
+	replacementCounts := make(map[string]int)
+
+	testCases := map[string]struct {
+		input    string
+		expected string
+		filter   Filter
+	}{
+		"simple scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: $(VAR)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 5`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
+			},
+		},
+		"non-string scalar": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
+			},
+		},
+		"wrong path": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+spec:
+  replicas: 1`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "a/b/c"},
+			},
+		},
+		"sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+- $(FOO)
+- $(BAR)
+- $(BAZ)
+- $(FOO)+$(BAR)
+- $(BOOL)
+- $(FLOAT)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+- foo
+- bar
+- $(BAZ)
+- foo+bar
+- false
+- 1.23`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO":   "foo",
+					"BAR":   "bar",
+					"BOOL":  false,
+					"FLOAT": 1.23,
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+		"maps": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: $(FOO)
+  BAR: $(BAR)
+  BAZ: $(BAZ)
+  PLUS: $(FOO)+$(BAR)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: foo
+  BAR: bar
+  BAZ: $(BAZ)
+  PLUS: foo+bar`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO": "foo",
+					"BAR": "bar",
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+		"complicated case": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice1:
+  - $(FOO)
+  slice2:
+    FOO: $(FOO)
+    BAR: $(BAR)
+    BOOL: false
+    INT: 0
+    SLICE:
+    - $(FOO)`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice1:
+  - $(FOO)
+  slice2:
+    FOO: foo
+    BAR: bar
+    BOOL: false
+    INT: 0
+    SLICE:
+    - $(FOO)`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"FOO": "foo",
+					"BAR": "bar",
+				}),
+				FieldSpec: types.FieldSpec{Path: "data/slice2"},
+			},
+		},
+		"null value": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: null`,
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  FOO: null`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{}),
+				FieldSpec:   types.FieldSpec{Path: "data/FOO"},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			if !assert.Equal(t,
+				strings.TrimSpace(tc.expected),
+				strings.TrimSpace(
+					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestFilterUnhappy(t *testing.T) {
+	replacementCounts := make(map[string]int)
+
+	testCases := map[string]struct {
+		input         string
+		expectedError string
+		filter        Filter
+	}{
+		"non-string in sequence": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  slice:
+  - false`,
+			expectedError: `obj 'apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+  annotations:
+    config.kubernetes.io/index: '0'
+data:
+  slice:
+  - false
+' at path 'data/slice': invalid value type expect a string`,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "data/slice"},
+			},
+		},
+		"invalid key in map": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+data:
+  1: str`,
+			expectedError: `obj 'apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dep
+  annotations:
+    config.kubernetes.io/index: '0'
+data:
+  1: str
+' at path 'data': invalid map key: 1, type: ` + yaml.NodeTagInt,
+			filter: Filter{
+				MappingFunc: expansion2.MappingFuncFor(replacementCounts, map[string]interface{}{
+					"VAR": int64(5),
+				}),
+				FieldSpec: types.FieldSpec{Path: "data"},
+			},
+		},
+	}
+
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
+			_, err := filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			if !assert.EqualError(t, err, tc.expectedError) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/filters/replicacount/example_test.go

@@ -33,10 +33,8 @@ spec:
 				Count: 42,
 				Name:  "instance",
 			},
-			FsSlice: types.FsSlice{
-				{
-					Path: "spec/template/replicas",
-				},
+			FieldSpec: types.FieldSpec{
+				Path: "spec/template/replicas",
 			},
 		}},
 		Outputs: []kio.Writer{kio.ByteWriter{Writer: os.Stdout}},

api/filters/replicacount/replicacount.go

@@ -3,8 +3,8 @@ package replicacount
 import (
 	"strconv"
 
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
-	"sigs.k8s.io/kustomize/api/filters/fsslice"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -12,10 +12,8 @@ import (
 
 // Filter updates/sets replicas fields using the fieldSpecs
 type Filter struct {
-	Replica types.Replica `json:"replica,omitempty" yaml:"replica,omitempty"`
-
-	// FsSlice contains the FieldSpecs to locate the namespace field
-	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+	Replica   types.Replica   `json:"replica,omitempty" yaml:"replica,omitempty"`
+	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
 }
 
 var _ kio.Filter = Filter{}
@@ -24,23 +22,12 @@ func (rc Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(rc.run)).Filter(nodes)
 }
 
-// run processes each node individually.
 func (rc Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	meta, err := node.GetMeta()
-	if err != nil {
-		return nil, err
-	}
-
-	// only update resources where the name matches the Replica name.
-	if meta.Name != rc.Replica.Name {
-		return node, nil
-	}
-
-	err = node.PipeE(fsslice.Filter{
-		FsSlice:    rc.FsSlice,
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec:  rc.FieldSpec,
 		SetValue:   rc.set,
 		CreateKind: yaml.ScalarNode, // replicas is a ScalarNode
-		CreateTag:  yaml.IntTag,
+		CreateTag:  yaml.NodeTagInt,
 	})
 	return node, err
 }

api/filters/replicacount/replicacount_test.go

@@ -5,19 +5,16 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	filtertest_test "sigs.k8s.io/kustomize/api/testutils/filtertest"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
 func TestFilter(t *testing.T) {
-	var config = builtinconfig.MakeDefaultConfig()
 
 	testCases := map[string]struct {
 		input    string
 		expected string
 		filter   Filter
-		fsslice  types.FsSlice
 	}{
 		"update field": {
 			input: `
@@ -41,11 +38,7 @@ spec:
 					Name:  "dep",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
-					Path: "spec/replicas",
-				},
+				FieldSpec: types.FieldSpec{Path: "spec/replicas"},
 			},
 		},
 		"add field": {
@@ -73,9 +66,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path:               "spec/template/replicas",
 					CreateIfNotPresent: true,
 				},
@@ -108,9 +99,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path:               "spec/template/replicas",
 					CreateIfNotPresent: true,
 				},
@@ -140,9 +129,7 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
+				FieldSpec: types.FieldSpec{
 					Path: "spec/template/replicas",
 				},
 			},
@@ -154,7 +141,6 @@ kind: Custom
 metadata:
   name: cus
 spec:
-  replicas: 5
   template:
     replicas: 5
 `,
@@ -164,7 +150,6 @@ kind: Custom
 metadata:
   name: cus
 spec:
-  replicas: 42
   template:
     replicas: 42
 `,
@@ -173,21 +158,13 @@ spec:
 					Name:  "cus",
 					Count: 42,
 				},
-			},
-			fsslice: types.FsSlice{
-				{
-					Path: "spec/template/replicas",
-				},
-				{
-					Path: "spec/replicas",
-				},
+				FieldSpec: types.FieldSpec{Path: "spec/template/replicas"},
 			},
 		},
 	}
 
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
-			tc.filter.FsSlice = append(config.Replicas, tc.fsslice...)
 			if !assert.Equal(t,
 				strings.TrimSpace(tc.expected),
 				strings.TrimSpace(

api/go.mod

@@ -1,23 +1,26 @@
 module sigs.k8s.io/kustomize/api
 
-go 1.14
+go 1.15
 
 require (
 	github.com/evanphx/json-patch v4.5.0+incompatible
+	github.com/go-errors/errors v1.0.1
 	github.com/go-openapi/spec v0.19.5
 	github.com/golangci/golangci-lint v1.21.0
+	github.com/google/go-cmp v0.3.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
+	github.com/hashicorp/go-multierror v1.1.0
+	github.com/imdario/mergo v0.3.5
 	github.com/pkg/errors v0.8.1
 	github.com/stretchr/testify v1.4.0
-	github.com/yujunz/go-getter v1.4.1-lite
-	golang.org/x/tools v0.0.0-20191010075000-0337d82405ff
+	github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf
+	golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e
 	gopkg.in/yaml.v2 v2.3.0
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c
 	k8s.io/api v0.17.0
 	k8s.io/apimachinery v0.17.0
 	k8s.io/client-go v0.17.0
 	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
-	sigs.k8s.io/kustomize/kyaml v0.4.1
+	sigs.k8s.io/kustomize/kyaml v0.10.5
 	sigs.k8s.io/yaml v1.2.0
 )
-
-replace sigs.k8s.io/kustomize/kyaml v0.4.1 => ../kyaml

api/go.sum

@@ -158,6 +158,7 @@ github.com/go-toolsmith/strparse v1.0.0 h1:Vcw78DnpCAKlM20kSbAyO4mPfJn/lyYA4BJUD
 github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
 github.com/go-toolsmith/typep v1.0.0 h1:zKymWyA1TRYvqYrYDrfEMZULyrhcnGY3x7LDKU2XQaA=
 github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
+github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gofrs/flock v0.0.0-20190320160742-5135e617513b h1:ekuhfTjngPhisSjOJ0QWKpPQE8/rbknHaes6WVJj5Hw=
@@ -166,6 +167,7 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -225,6 +227,7 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d h1:7XGaL1e6bYS1yIonGp9761ExpPPV1ui0SAC59Yube9k=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3 h1:JVnpOZS+qxli+rgVl98ILOXVNbW+kb5wcxeGx8ShUIw=
 github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=
@@ -232,18 +235,24 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
+github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
 github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
@@ -282,6 +291,7 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb h1:RHba4YImhrUVQDHUCe2BNSOz4tVy2yGyXhvYDvxGgeE=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA=
@@ -306,6 +316,8 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/mozilla/tls-observatory v0.0.0-20190404164649-a3c1b6cfecfd/go.mod h1:SrKMQvPiws7F7iqYp8/TX+IhxCYhzr6N/1yb8cwHsGk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -358,6 +370,7 @@ github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e h1:MZM7FHLqUHYI0Y/mQAt
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041 h1:llrF3Fs4018ePo4+G/HV/uQUqEI1HMDjCeOf2V6puPc=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
@@ -399,8 +412,8 @@ github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiff
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
-github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
+github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ultraware/funlen v0.0.2 h1:Av96YVBwwNSe4MLR7iI/BIa3VyI7/djnto/pK3Uxbdo=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4 h1:If7Va4cM03mpgrNH9k49/VOicWpGoG70XPBFFODYDsg=
@@ -416,8 +429,8 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
-github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf h1:gvEmqF83GB8R5XtrMseJb6A6R0OCtNAS8f4TmZg2dGc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf/go.mod h1:bL0Pr07HEdsMZ1WBqZIxXj96r5LnFsY4LgPaPEGkw1k=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@@ -438,6 +451,7 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392 h1:ACG4HJsFiNMf47Y4PeRoebLNy/2lXT9EtprMuTFWt1M=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -464,11 +478,11 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -499,6 +513,7 @@ golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -523,6 +538,8 @@ golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20190930201159-7c411dea38b0/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191010075000-0337d82405ff h1:XdBG6es/oFDr1HwaxkxgVve7NB281QhxgK/i4voubFs=
 golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e h1:aZzprAO9/8oim3qStq3wc1Xuxx4QmAGriC4VU4ojemQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -550,12 +567,13 @@ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bl
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
@@ -573,6 +591,7 @@ k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a h1:UcxjrRMyNx/i/y8G7kPvLyy7rfbeuf1PYyBf973pgyU=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/utils v0.0.0-20191114184206-e782cd3c129f h1:GiPwtSzdP43eI1hpPCbROQCCIgCuiMMNF8YUVLF3vJo=
 k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed h1:WX1yoOaKQfddO/mLzdV4wptyWgoH/6hwLs7QHTixo0I=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
@@ -580,6 +599,8 @@ mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b h1:DxJ5nJdkhDlLok9K6qO+5290kphD
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f h1:Cq7MalBHYACRd6EesksG1Q8EoIAKOsiZviGKbOLIej4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
+sigs.k8s.io/kustomize/kyaml v0.10.5 h1:PbJcsZsEM7O3hHtUWTR+4WkHVbQRW9crSy75or1gRbI=
+sigs.k8s.io/kustomize/kyaml v0.10.5/go.mod h1:P6Oy/ah/GZMKzJMIJA2a3/bc8YrBkuL5kJji13PSIzY=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=

api/hasher/hasher.go

@@ -8,6 +8,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"sort"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // SortArrayAndComputeHash sorts a string array and
@@ -50,3 +52,105 @@ func Encode(hex string) (string, error) {
 func Hash(data string) string {
 	return fmt.Sprintf("%x", sha256.Sum256([]byte(data)))
 }
+
+// HashRNode returns the hash value of input RNode
+func HashRNode(node *yaml.RNode) (string, error) {
+	// get node kind
+	kindNode, err := node.Pipe(yaml.FieldMatcher{Name: "kind"})
+	if err != nil {
+		return "", err
+	}
+	kind := kindNode.YNode().Value
+
+	// calculate hash for different kinds
+	encoded := ""
+	switch kind {
+	case "ConfigMap":
+		encoded, err = encodeConfigMap(node)
+	case "Secret":
+		encoded, err = encodeSecret(node)
+	default:
+		var encodedBytes []byte
+		encodedBytes, err = json.Marshal(node.YNode())
+		encoded = string(encodedBytes)
+	}
+	if err != nil {
+		return "", err
+	}
+	return Encode(Hash(encoded))
+}
+
+func getNodeValues(node *yaml.RNode, paths []string) (map[string]interface{}, error) {
+	values := make(map[string]interface{})
+	for _, p := range paths {
+		vn, err := node.Pipe(yaml.Lookup(p))
+		if err != nil {
+			return map[string]interface{}{}, err
+		}
+		if vn == nil {
+			values[p] = ""
+			continue
+		}
+		if vn.YNode().Kind != yaml.ScalarNode {
+			vs, err := vn.MarshalJSON()
+			if err != nil {
+				return map[string]interface{}{}, err
+			}
+			// data, binaryData and stringData are all maps
+			var v map[string]interface{}
+			json.Unmarshal(vs, &v)
+			values[p] = v
+		} else {
+			values[p] = vn.YNode().Value
+		}
+	}
+	return values, nil
+}
+
+// encodeConfigMap encodes a ConfigMap.
+// Data, Kind, and Name are taken into account.
+// BinaryData is included if it's not empty to avoid useless key in output.
+func encodeConfigMap(node *yaml.RNode) (string, error) {
+	// get fields
+	paths := []string{"metadata/name", "data", "binaryData"}
+	values, err := getNodeValues(node, paths)
+	if err != nil {
+		return "", err
+	}
+	m := map[string]interface{}{"kind": "ConfigMap", "name": values["metadata/name"],
+		"data": values["data"]}
+	if _, ok := values["binaryData"].(map[string]interface{}); ok {
+		m["binaryData"] = values["binaryData"]
+	}
+
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// encodeSecret encodes a Secret.
+// Data, Kind, Name, and Type are taken into account.
+// StringData is included if it's not empty to avoid useless key in output.
+func encodeSecret(node *yaml.RNode) (string, error) {
+	// get fields
+	paths := []string{"type", "metadata/name", "data", "stringData"}
+	values, err := getNodeValues(node, paths)
+	if err != nil {
+		return "", err
+	}
+	m := map[string]interface{}{"kind": "Secret", "type": values["type"],
+		"name": values["metadata/name"], "data": values["data"]}
+	if _, ok := values["stringData"].(map[string]interface{}); ok {
+		m["stringData"] = values["stringData"]
+	}
+
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}

api/hasher/hasher_test.go

@@ -1,12 +1,13 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package hasher_test
+package hasher
 
 import (
+	"strings"
 	"testing"
 
-	. "sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 func TestSortArrayAndComputeHash(t *testing.T) {
@@ -39,3 +40,314 @@ func TestHash(t *testing.T) {
 		t.Errorf("expected hash %q but got %q", expect, sum)
 	}
 }
+
+func TestConfigMapHash(t *testing.T) {
+	cases := []struct {
+		desc   string
+		cmYaml string
+		hash   string
+		err    string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, "6ct58987ht", ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+data: 
+  one: ""`, "9g67k2htb6", ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  two: 2
+  one: ""
+  three: 3`, "7757f9kkct", ""},
+		// empty binary data map
+		{"empty binary data", `
+apiVersion: v1
+kind: ConfigMap`, "6ct58987ht", ""},
+		// one key with binary data
+		{"one key with binary data", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  one: ""`, "6mtk2m274t", ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys with binary data", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  two: 2
+  one: ""
+  three: 3`, "9th7kc28dg", ""},
+		// two keys, one with string and another with binary data
+		{"two keys with one each", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  one: ""
+binaryData:
+  two: ""`, "698h7c7t9m", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.cmYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestSecretHash(t *testing.T) {
+	cases := []struct {
+		desc       string
+		secretYaml string
+		hash       string
+		err        string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: Secret
+type: my-type`, "5gmgkf8578", ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, "74bd68bm66", ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  two: 2
+  one: ""
+  three: 3`, "4gf75c7476", ""},
+		// with stringdata
+		{"stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""
+stringData:
+  two: 2`, "c4h4264gdb", ""},
+		// empty stringdata
+		{"empty stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, "74bd68bm66", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.secretYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestUnstructuredHash(t *testing.T) {
+	cases := []struct {
+		desc         string
+		unstructured string
+		hash         string
+		err          string
+	}{
+		{"minimal", `
+apiVersion: test/v1
+kind: TestResource
+metadata:
+  name: my-resource`, "244782mkb7", ""},
+		{"with spec", `
+apiVersion: test/v1
+kind: TestResource
+metadata:
+  name: my-resource
+spec:
+  foo: 1
+  bar: abc`, "59m2mdccg4", ""},
+	}
+
+	for _, c := range cases {
+		node, err := yaml.Parse(c.unstructured)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h, err := HashRNode(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestEncodeConfigMap(t *testing.T) {
+	cases := []struct {
+		desc   string
+		cmYaml string
+		expect string
+		err    string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, `{"data":"","kind":"ConfigMap","name":""}`, ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+data: 
+  one: ""`, `{"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+		// three keys (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  two: 2
+  one: ""
+  three: 3`, `{"data":{"one":"","three":3,"two":2},"kind":"ConfigMap","name":""}`, ""},
+		// empty binary map
+		{"empty data", `
+apiVersion: v1
+kind: ConfigMap`, `{"data":"","kind":"ConfigMap","name":""}`, ""},
+		// one key with binary data
+		{"one key", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  one: ""`, `{"binaryData":{"one":""},"data":"","kind":"ConfigMap","name":""}`, ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys", `
+apiVersion: v1
+kind: ConfigMap
+binaryData:
+  two: 2
+  one: ""
+  three: 3`, `{"binaryData":{"one":"","three":3,"two":2},"data":"","kind":"ConfigMap","name":""}`, ""},
+		// two keys, one string and one binary values
+		{"two keys with one each", `
+apiVersion: v1
+kind: ConfigMap
+data:
+  one: ""
+binaryData:
+  two: ""`, `{"binaryData":{"two":""},"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+	}
+	for _, c := range cases {
+		node, err := yaml.Parse(c.cmYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, err := encodeConfigMap(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.cmYaml)
+		}
+	}
+}
+
+func TestEncodeSecret(t *testing.T) {
+	cases := []struct {
+		desc       string
+		secretYaml string
+		expect     string
+		err        string
+	}{
+		// empty map
+		{"empty data", `
+apiVersion: v1
+kind: Secret
+type: my-type`, `{"data":"","kind":"Secret","name":"","type":"my-type"}`, ""},
+		// one key
+		{"one key", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// three keys (tests sorting order) - note json.Marshal base64 encodes the values because they come in as []byte
+		{"three keys", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  two: 2
+  one: ""
+  three: 3`, `{"data":{"one":"","three":3,"two":2},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// with stringdata
+		{"stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""
+stringData:
+  two: 2`, `{"data":{"one":""},"kind":"Secret","name":"","stringData":{"two":2},"type":"my-type"}`, ""},
+		// empty stringdata
+		{"empty stringdata", `
+apiVersion: v1
+kind: Secret
+type: my-type
+data:
+  one: ""`, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
+	}
+	for _, c := range cases {
+		node, err := yaml.Parse(c.secretYaml)
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, err := encodeSecret(node)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.secretYaml)
+		}
+	}
+}
+
+// SkipRest returns true if there was a non-nil error or if we expected an error that didn't happen,
+// and logs the appropriate error on the test object.
+// The return value indicates whether we should skip the rest of the test case due to the error result.
+func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	if err != nil {
+		if len(contains) == 0 {
+			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())
+		} else if !strings.Contains(err.Error(), contains) {
+			t.Errorf("case %q, expect error to contain %q but got %q", desc, contains, err.Error())
+		}
+		return true
+	} else if len(contains) > 0 {
+		t.Errorf("case %q, expect error to contain %q but got nil error", desc, contains)
+		return true
+	}
+	return false
+}

api/ifc/ifc.go

@@ -38,35 +38,71 @@ type Loader interface {
 	Cleanup() error
 }
 
-// Kunstructured allows manipulation of k8s objects
-// that do not have Golang structs.
+// Kunstructured represents a Kubernetes Resource Model object.
 type Kunstructured interface {
+	// Several uses.
 	Copy() Kunstructured
+
+	// GetAnnotations returns the k8s annotations.
 	GetAnnotations() map[string]string
-	GetBool(path string) (bool, error)
+
+	// GetData returns a top-level "data" field, as in a ConfigMap.
+	GetDataMap() map[string]string
+
+	// Used by ResAccumulator and ReplacementTransformer.
 	GetFieldValue(string) (interface{}, error)
-	GetFloat64(path string) (float64, error)
+
+	// Used by Resource.OrgId
 	GetGvk() resid.Gvk
-	GetInt64(path string) (int64, error)
+
+	// Used by resource.Factory.SliceFromBytes
 	GetKind() string
+
+	// GetLabels returns the k8s labels.
 	GetLabels() map[string]string
-	GetMap(path string) (map[string]interface{}, error)
+
+	// Used by Resource.CurId and resource factory.
 	GetName() string
+
+	// Used by special case code in
+	// ResMap.SubsetThatCouldBeReferencedByResource
 	GetSlice(path string) ([]interface{}, error)
+
+	// GetString returns the value of a string field.
+	// Used by Resource.GetNamespace
 	GetString(string) (string, error)
-	GetStringMap(path string) (map[string]string, error)
-	GetStringSlice(string) ([]string, error)
+
+	// Several uses.
 	Map() map[string]interface{}
+
+	// Used by Resource.AsYAML and Resource.String
 	MarshalJSON() ([]byte, error)
+
+	// Used by resWrangler.Select
 	MatchesAnnotationSelector(selector string) (bool, error)
+
+	// Used by resWrangler.Select
 	MatchesLabelSelector(selector string) (bool, error)
-	Patch(Kunstructured) error
+
+	// SetAnnotations replaces the k8s annotations.
 	SetAnnotations(map[string]string)
+
+	// SetDataMap sets a top-level "data" field, as in a ConfigMap.
+	SetDataMap(map[string]string)
+
+	// Used by PatchStrategicMergeTransformer.
 	SetGvk(resid.Gvk)
+
+	// SetLabels replaces the k8s labels.
 	SetLabels(map[string]string)
-	SetMap(map[string]interface{})
+
+	// SetName changes the name.
 	SetName(string)
+
+	// SetNamespace changes the namespace.
 	SetNamespace(string)
+
+	// Needed, for now, by kyaml/filtersutil.ApplyToJSON.
 	UnmarshalJSON([]byte) error
 }
 

api/internal/accumulator/namereferencetransformer.go

@@ -4,14 +4,12 @@
 package accumulator
 
 import (
-	"fmt"
 	"log"
 
+	"sigs.k8s.io/kustomize/api/filters/nameref"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 type nameReferenceTransformer struct {
@@ -86,16 +84,12 @@ func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
 					if candidates == nil {
 						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
 					}
-					err := transform.MutateField(
-						referrer.Map(),
-						fSpec.PathSlice(),
-						fSpec.CreateIfNotPresent,
-						o.getNewNameFunc(
-							// referrer could be an HPA instance,
-							// target could be Gvk for Deployment,
-							// candidate a list of resources "reachable"
-							// from the HPA.
-							referrer, target.Gvk, candidates))
+					err := filtersutil.ApplyToJSON(nameref.Filter{
+						FieldSpec:          fSpec,
+						Referrer:           referrer,
+						Target:             target.Gvk,
+						ReferralCandidates: candidates,
+					}, referrer)
 					if err != nil {
 						return err
 					}
@@ -105,165 +99,3 @@ func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
 	}
 	return nil
 }
-
-// selectReferral picks the referral among a subset of candidates.
-// It returns the current name and namespace of the selected candidate.
-// Note that the content of the referricalCandidateSubset slice is most of the time
-// identical to the referralCandidates resmap. Still in some cases, such
-// as ClusterRoleBinding, the subset only contains the resources of a specific
-// namespace.
-func (o *nameReferenceTransformer) selectReferral(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource) (interface{}, interface{}, error) {
-
-	for _, res := range referralCandidateSubset {
-		id := res.OrgId()
-		if id.IsSelected(&target) && res.GetOriginalName() == oldName {
-			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
-			// If there's more than one match, there's no way
-			// to know which one to pick, so emit error.
-			if len(matches) > 1 {
-				return nil, nil, fmt.Errorf(
-					"multiple matches for %s:\n  %v",
-					id, getIds(matches))
-			}
-			// In the resource, note that it is referenced
-			// by the referrer.
-			res.AppendRefBy(referrer.CurId())
-			// Return transformed name of the object,
-			// complete with prefixes, hashes, etc.
-			return res.GetName(), res.GetNamespace(), nil
-		}
-	}
-
-	return oldName, nil, nil
-}
-
-// utility function to replace a simple string by the new name
-func (o *nameReferenceTransformer) getSimpleNameField(
-	oldName string,
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap,
-	referralCandidateSubset []*resource.Resource) (interface{}, error) {
-
-	newName, _, err := o.selectReferral(oldName, referrer, target,
-		referralCandidates, referralCandidateSubset)
-
-	return newName, err
-}
-
-// utility function to replace name field within a map[string]interface{}
-// and leverage the namespace field.
-func (o *nameReferenceTransformer) getNameAndNsStruct(
-	inMap map[string]interface{},
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap) (interface{}, error) {
-
-	// Example:
-	if _, ok := inMap["name"]; !ok {
-		return nil, fmt.Errorf(
-			"%#v is expected to contain a name field", inMap)
-	}
-	oldName, ok := inMap["name"].(string)
-	if !ok {
-		return nil, fmt.Errorf(
-			"%#v is expected to contain a name field of type string", oldName)
-	}
-
-	subset := referralCandidates.Resources()
-	if namespacevalue, ok := inMap["namespace"]; ok {
-		namespace := namespacevalue.(string)
-		bynamespace := referralCandidates.GroupedByOriginalNamespace()
-		if _, ok := bynamespace[namespace]; !ok {
-			return inMap, nil
-		}
-		subset = bynamespace[namespace]
-	}
-
-	newname, newnamespace, err := o.selectReferral(oldName, referrer, target,
-		referralCandidates, subset)
-	if err != nil {
-		return nil, err
-	}
-
-	if (newname == oldName) && (newnamespace == nil) {
-		// no candidate found.
-		return inMap, nil
-	}
-
-	inMap["name"] = newname
-	if newnamespace != "" {
-		// We don't want value "" to replace value "default" since
-		// the empty string is handled as a wild card here not default namespace
-		// by kubernetes.
-		inMap["namespace"] = newnamespace
-	}
-	return inMap, nil
-
-}
-
-func (o *nameReferenceTransformer) getNewNameFunc(
-	referrer *resource.Resource,
-	target resid.Gvk,
-	referralCandidates resmap.ResMap) func(in interface{}) (interface{}, error) {
-	return func(in interface{}) (interface{}, error) {
-		switch thing := in.(type) {
-		case string:
-			return o.getSimpleNameField(thing, referrer, target,
-				referralCandidates, referralCandidates.Resources())
-		case map[string]interface{}:
-			// Kind: ValidatingWebhookConfiguration
-			// FieldSpec is webhooks/clientConfig/service
-			return o.getNameAndNsStruct(thing, referrer, target,
-				referralCandidates)
-		case []interface{}:
-			for idx, item := range thing {
-				switch value := item.(type) {
-				case string:
-					// Kind: Role/ClusterRole
-					// FieldSpec is rules.resourceNames
-					newName, err := o.getSimpleNameField(value, referrer, target,
-						referralCandidates, referralCandidates.Resources())
-					if err != nil {
-						return nil, err
-					}
-					thing[idx] = newName
-				case map[string]interface{}:
-					// Kind: RoleBinding/ClusterRoleBinding
-					// FieldSpec is subjects
-					// Note: The corresponding fieldSpec had been changed from
-					// from path: subjects/name to just path: subjects. This is
-					// what get mutatefield to request the mapping of the whole
-					// map containing namespace and name instead of just a simple
-					// string field containing the name
-					newMap, err := o.getNameAndNsStruct(value, referrer, target,
-						referralCandidates)
-					if err != nil {
-						return nil, err
-					}
-					thing[idx] = newMap
-				default:
-					return nil, fmt.Errorf(
-						"%#v is expected to be either a []string or a []map[string]interface{}", in)
-				}
-			}
-			return in, nil
-		default:
-			return nil, fmt.Errorf(
-				"%#v is expected to be either a string or a []interface{}", in)
-		}
-	}
-}
-
-func getIds(rs []*resource.Resource) []string {
-	var result []string
-	for _, r := range rs {
-		result = append(result, r.CurId().String()+"\n")
-	}
-	return result
-}

api/internal/accumulator/namereferencetransformer_test.go

@@ -8,17 +8,14 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 )
 
 func TestNameReferenceHappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).AddWithName(
+	m := resmaptest_test.NewRmBuilderDefault(t).AddWithName(
 		"cm1",
 		map[string]interface{}{
 			"apiVersion": "v1",
@@ -220,6 +217,7 @@ func TestNameReferenceHappyRun(t *testing.T) {
 						"secret1",
 						"secret1",
 						"secret2",
+						"cm1",
 					},
 				},
 			},
@@ -261,7 +259,8 @@ func TestNameReferenceHappyRun(t *testing.T) {
 			},
 		}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).ReplaceResource(
+	expected := resmaptest_test.NewSeededRmBuilderDefault(
+		t, m.ShallowCopy()).ReplaceResource(
 		map[string]interface{}{
 			"group":      "apps",
 			"apiVersion": "v1",
@@ -422,6 +421,7 @@ func TestNameReferenceHappyRun(t *testing.T) {
 						"someprefix-secret1-somehash",
 						"someprefix-secret1-somehash",
 						"secret2",
+						"someprefix-cm1-somehash",
 					},
 				},
 			},
@@ -475,14 +475,12 @@ func TestNameReferenceHappyRun(t *testing.T) {
 }
 
 func TestNameReferenceUnhappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
 	tests := []struct {
 		resMap      resmap.ResMap
 		expectedErr string
 	}{
 		{
-			resMap: resmaptest_test.NewRmBuilder(t, rf).Add(
+			resMap: resmaptest_test.NewRmBuilderDefault(t).Add(
 				map[string]interface{}{
 					"apiVersion": "rbac.authorization.k8s.io/v1",
 					"kind":       "ClusterRole",
@@ -502,7 +500,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 				}).ResMap(),
 			expectedErr: "is expected to be"},
 		{
-			resMap: resmaptest_test.NewRmBuilder(t, rf).Add(
+			resMap: resmaptest_test.NewRmBuilderDefault(t).Add(
 				map[string]interface{}{
 					"apiVersion": "rbac.authorization.k8s.io/v1",
 					"kind":       "ClusterRole",
@@ -520,7 +518,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 						},
 					},
 				}).ResMap(),
-			expectedErr: "is expected to contain a name field"},
+			expectedErr: "cannot find field 'name' in node"},
 	}
 
 	nrt := newNameReferenceTransformer(builtinconfig.MakeDefaultConfig().NameReference)
@@ -538,8 +536,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 }
 
 func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 
 	v1 := rf.FromMapWithName(
 		"volume1",
@@ -664,9 +661,7 @@ const (
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceNamespace(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		// Add ConfigMap with the same org name in noNs, "ns1" and "ns2" namespaces
 		AddWithName(orgname, map[string]interface{}{
 			"apiVersion": "v1",
@@ -715,7 +710,7 @@ func TestNameReferenceNamespace(t *testing.T) {
 		AddWithNsAndName(ns1, orgname, deploymentMap(ns1, prefixedname, orgname, orgname)).
 		AddWithNsAndName(ns2, orgname, deploymentMap(ns2, suffixedname, orgname, orgname)).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(deploymentMap(defaultNs, modifiedname, modifiedname, modifiedname)).
 		ReplaceResource(deploymentMap(ns1, prefixedname, prefixedname, prefixedname)).
 		ReplaceResource(deploymentMap(ns2, suffixedname, suffixedname, suffixedname)).ResMap()
@@ -735,9 +730,7 @@ func TestNameReferenceNamespace(t *testing.T) {
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceClusterWide(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		// Add ServiceAccount with the same org name in noNs, "ns1" and "ns2" namespaces
 		AddWithName(orgname, map[string]interface{}{
 			"apiVersion": "v1",
@@ -789,9 +782,9 @@ func TestNameReferenceClusterWide(t *testing.T) {
 				"name": modifiedname,
 			},
 			"roleRef": map[string]interface{}{
-				"apiVersion": "rbac.authorization.k8s.io/v1",
-				"kind":       "ClusterRole",
-				"name":       orgname,
+				"apiGroup": "rbac.authorization.k8s.io",
+				"kind":     "ClusterRole",
+				"name":     orgname,
 			},
 			"subjects": []interface{}{
 				map[string]interface{}{
@@ -816,7 +809,7 @@ func TestNameReferenceClusterWide(t *testing.T) {
 				},
 			}}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(
 			map[string]interface{}{
 				"apiVersion": "rbac.authorization.k8s.io/v1",
@@ -845,9 +838,9 @@ func TestNameReferenceClusterWide(t *testing.T) {
 					"name": modifiedname,
 				},
 				"roleRef": map[string]interface{}{
-					"apiVersion": "rbac.authorization.k8s.io/v1",
-					"kind":       "ClusterRole",
-					"name":       modifiedname,
+					"apiGroup": "rbac.authorization.k8s.io",
+					"kind":     "ClusterRole",
+					"name":     modifiedname,
 				},
 				// The following tests required a change in
 				// getNameFunc implementation in order to leverage
@@ -898,9 +891,7 @@ func TestNameReferenceClusterWide(t *testing.T) {
 // object with the same original names (uniquename) in different namespaces
 // and with different current Id.
 func TestNameReferenceNamespaceTransformation(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		AddWithNsAndName(ns4, orgname, map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Secret",
@@ -937,9 +928,9 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 				"name": modifiedname,
 			},
 			"roleRef": map[string]interface{}{
-				"apiVersion": "rbac.authorization.k8s.io/v1",
-				"kind":       "ClusterRole",
-				"name":       orgname,
+				"apiGroup": "rbac.authorization.k8s.io",
+				"kind":     "ClusterRole",
+				"name":     orgname,
 			},
 			"subjects": []interface{}{
 				map[string]interface{}{
@@ -964,7 +955,7 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 				},
 			}}).ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(
 			map[string]interface{}{
 				"apiVersion": "rbac.authorization.k8s.io/v1",
@@ -973,9 +964,9 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 					"name": modifiedname,
 				},
 				"roleRef": map[string]interface{}{
-					"apiVersion": "rbac.authorization.k8s.io/v1",
-					"kind":       "ClusterRole",
-					"name":       modifiedname,
+					"apiGroup": "rbac.authorization.k8s.io",
+					"kind":     "ClusterRole",
+					"name":     modifiedname,
 				},
 				// The following tests required a change in
 				// getNameFunc implementation in order to leverage
@@ -1026,9 +1017,7 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 // It validates the change done is IsSameFuzzyNamespace which
 // uses the IsNsEquals method instead of the simple == operator.
 func TestNameReferenceCandidateSelection(t *testing.T) {
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		AddWithName("cm1", map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "ConfigMap",
@@ -1045,7 +1034,7 @@ func TestNameReferenceCandidateSelection(t *testing.T) {
 		AddWithName("deploy1", deploymentMap("", "p1-deploy1", "cm1", "secret1")).
 		ResMap()
 
-	expected := resmaptest_test.NewSeededRmBuilder(t, rf, m.ShallowCopy()).
+	expected := resmaptest_test.NewSeededRmBuilderDefault(t, m.ShallowCopy()).
 		ReplaceResource(deploymentMap("", "p1-deploy1", "p1-cm1-hash", "p1-secret1-hash")).
 		ResMap()
 

api/internal/accumulator/refvartransformer.go

@@ -4,13 +4,12 @@
 package accumulator
 
 import (
-	"fmt"
-
 	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
 
+	"sigs.k8s.io/kustomize/api/filters/refvar"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 type refVarTransformer struct {
@@ -31,59 +30,6 @@ func newRefVarTransformer(
 	}
 }
 
-// replaceVars accepts as 'in' a string, or string array, which can have
-// embedded instances of $VAR style variables, e.g. a container command string.
-// The function returns the string with the variables expanded to their final
-// values.
-func (rv *refVarTransformer) replaceVars(in interface{}) (interface{}, error) {
-	switch vt := in.(type) {
-	case []interface{}:
-		var xs []interface{}
-		for _, a := range in.([]interface{}) {
-			x, ok := a.(string)
-			if !ok {
-				return nil, fmt.Errorf("expected array of strings, found %v", in)
-			}
-			xs = append(xs, expansion2.Expand(x, rv.mappingFunc))
-		}
-		return xs, nil
-	case map[string]interface{}:
-		inMap := in.(map[string]interface{})
-		xs := make(map[string]interface{}, len(inMap))
-		for k, v := range inMap {
-			s, ok := v.(string)
-			if !ok {
-				// This field can not contain a $(VAR) since it is not
-				// of string type. For instance .spec.replicas: 3 in
-				// a Deployment object
-				xs[k] = v
-			} else {
-				// This field can potentially contains a $(VAR) since it is
-				// of string type. For instance .spec.replicas: $(REPLICAS)
-				// in a Deployment object
-				xs[k] = expansion2.Expand(s, rv.mappingFunc)
-			}
-		}
-		return xs, nil
-	case interface{}:
-		s, ok := in.(string)
-		if !ok {
-			// This field can not contain a $(VAR) since it is not of string type.
-			return in, nil
-		}
-		// This field can potentially contain a $(VAR) since it is
-		// of string type.
-		return expansion2.Expand(s, rv.mappingFunc), nil
-	// staticcheck erroneously claims that `case nil`
-	// is unreachable here, so suppressing it.
-	//nolint:staticcheck
-	case nil:
-		return nil, nil
-	default:
-		return "", fmt.Errorf("invalid type encountered %T", vt)
-	}
-}
-
 // UnusedVars returns slice of Var names that were unused
 // after a Transform run.
 func (rv *refVarTransformer) UnusedVars() []string {
@@ -104,12 +50,12 @@ func (rv *refVarTransformer) Transform(m resmap.ResMap) error {
 		rv.replacementCounts, rv.varMap)
 	for _, res := range m.Resources() {
 		for _, fieldSpec := range rv.fieldSpecs {
-			if res.OrgId().IsSelected(&fieldSpec.Gvk) {
-				if err := transform.MutateField(
-					res.Map(), fieldSpec.PathSlice(),
-					false, rv.replaceVars); err != nil {
-					return err
-				}
+			err := filtersutil.ApplyToJSON(refvar.Filter{
+				MappingFunc: rv.mappingFunc,
+				FieldSpec:   fieldSpec,
+			}, res)
+			if err != nil {
+				return err
 			}
 		}
 	}

api/internal/accumulator/refvartransformer_test.go

@@ -7,10 +7,8 @@ import (
 	"reflect"
 	"testing"
 
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 	"sigs.k8s.io/kustomize/api/types"
 )
@@ -44,11 +42,9 @@ func TestRefVarTransformer(t *testing.T) {
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/map"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/interface"},
-					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/num"},
 				},
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -63,7 +59,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"item4": "$(BAZ)+$(BAZ)",
 								"item5": "$(BOO)",
 								"item6": "if $(BOO)",
-								"item7": 2019,
+								"item7": int64(2019),
 							},
 							"slice": []interface{}{
 								"$(FOO)",
@@ -74,13 +70,11 @@ func TestRefVarTransformer(t *testing.T) {
 								"if $(BOO)",
 							},
 							"interface": "$(FOO)",
-							"nil":       nil,
-							"num":       2019,
+							"num":       int64(2019),
 						}}).ResMap(),
 			},
 			expected: expected{
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -95,7 +89,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"item4": "5+5",
 								"item5": true,
 								"item6": "if true",
-								"item7": 2019,
+								"item7": int64(2019),
 							},
 							"slice": []interface{}{
 								"replacementForFoo",
@@ -106,8 +100,7 @@ func TestRefVarTransformer(t *testing.T) {
 								"if true",
 							},
 							"interface": "replacementForFoo",
-							"nil":       nil,
-							"num":       2019,
+							"num":       int64(2019),
 						}}).ResMap(),
 				unused: []string{"BAR"},
 			},
@@ -119,8 +112,7 @@ func TestRefVarTransformer(t *testing.T) {
 				fs: []types.FieldSpec{
 					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
 				},
-				res: resmaptest_test.NewRmBuilder(
-					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+				res: resmaptest_test.NewRmBuilderDefault(t).
 					Add(map[string]interface{}{
 						"apiVersion": "v1",
 						"kind":       "ConfigMap",
@@ -131,7 +123,39 @@ func TestRefVarTransformer(t *testing.T) {
 							"slice": []interface{}{5}, // noticeably *not* a []string
 						}}).ResMap(),
 			},
-			errMessage: "expected array of strings, found [5]",
+			errMessage: `obj '{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
+' at path 'data/slice': invalid value type expect a string`,
+		},
+		{
+			description: "var replacement in nil",
+			given: given{
+				varMap: map[string]interface{}{},
+				fs: []types.FieldSpec{
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
+				},
+				res: resmaptest_test.NewRmBuilderDefault(t).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"nil": nil, // noticeably *not* a []string
+						}}).ResMap(),
+			},
+			expected: expected{
+				res: resmaptest_test.NewRmBuilderDefault(t).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"nil": nil, // noticeably *not* a []string
+						}}).ResMap(),
+			},
 		},
 	}
 

api/internal/accumulator/resaccumulator.go

@@ -41,13 +41,11 @@ func (ra *ResAccumulator) Vars() []types.Var {
 	return ra.varSet.AsSlice()
 }
 
-func (ra *ResAccumulator) AppendAll(
-	resources resmap.ResMap) error {
+func (ra *ResAccumulator) AppendAll(resources resmap.ResMap) error {
 	return ra.resMap.AppendAll(resources)
 }
 
-func (ra *ResAccumulator) AbsorbAll(
-	resources resmap.ResMap) error {
+func (ra *ResAccumulator) AbsorbAll(resources resmap.ResMap) error {
 	return ra.resMap.AbsorbAll(resources)
 }
 

api/internal/accumulator/resaccumulator_test.go

@@ -12,7 +12,7 @@ import (
 
 	. "sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
@@ -20,16 +20,14 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
+func makeResAccumulator(t *testing.T) *ResAccumulator {
 	ra := MakeEmptyAccumulator()
 	err := ra.MergeConfig(builtinconfig.MakeDefaultConfig())
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	rf := resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl())
 	err = ra.AppendAll(
-		resmaptest_test.NewRmBuilder(t, rf).
+		resmaptest_test.NewRmBuilderDefault(t).
 			Add(map[string]interface{}{
 				"apiVersion": "apps/v1",
 				"kind":       "Deployment",
@@ -66,11 +64,11 @@ func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	return ra, rf
+	return ra
 }
 
 func TestResolveVarsHappy(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -99,7 +97,7 @@ func TestResolveVarsHappy(t *testing.T) {
 }
 
 func TestResolveVarsOneUnused(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -140,11 +138,10 @@ func expectLog(t *testing.T, log bytes.Buffer, expect string) {
 }
 
 func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
-	ra, rf := makeResAccumulator(t)
-
+	ra := makeResAccumulator(t)
 	rm0 := resmap.New()
 	err := rm0.Append(
-		rf.FromMap(
+		provider.NewDefaultDepProvider().GetResourceFactory().FromMap(
 			map[string]interface{}{
 				"apiVersion": "v1",
 				"kind":       "Service",
@@ -213,8 +210,7 @@ func makeVarToNamepaceAndPath(
 }
 
 func TestResolveVarConflicts(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
-
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	// create configmaps in foo and bar namespaces with `data.provider` values.
 	fooAws := makeNamespacedConfigMapWithDataProviderValue("foo", "aws")
 	barAws := makeNamespacedConfigMapWithDataProviderValue("bar", "aws")
@@ -261,7 +257,7 @@ func TestResolveVarConflicts(t *testing.T) {
 }
 
 func TestResolveVarsGoodResIdBadField(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -286,7 +282,7 @@ func TestResolveVarsGoodResIdBadField(t *testing.T) {
 }
 
 func TestResolveVarsUnmappableVar(t *testing.T) {
-	ra, _ := makeResAccumulator(t)
+	ra := makeResAccumulator(t)
 	err := ra.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_THREE",
@@ -310,7 +306,7 @@ func TestResolveVarsUnmappableVar(t *testing.T) {
 }
 
 func TestResolveVarsWithNoambiguation(t *testing.T) {
-	ra1, rf := makeResAccumulator(t)
+	ra1 := makeResAccumulator(t)
 	err := ra1.MergeVars([]types.Var{
 		{
 			Name: "SERVICE_ONE",
@@ -327,7 +323,7 @@ func TestResolveVarsWithNoambiguation(t *testing.T) {
 	// Create another accumulator having a resource with different prefix
 	ra2 := MakeEmptyAccumulator()
 
-	m := resmaptest_test.NewRmBuilder(t, rf).
+	m := resmaptest_test.NewRmBuilderDefault(t).
 		Add(map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "Deployment",

api/internal/conflict/factory.go

@@ -0,0 +1,23 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+type cdFactory struct{}
+
+var _ resource.ConflictDetectorFactory = &cdFactory{}
+
+// NewFactory returns a new conflict detector factory.
+func NewFactory() resource.ConflictDetectorFactory {
+	return &cdFactory{}
+}
+
+// New returns an instance of smPatchMergeOnlyDetector.
+func (c cdFactory) New(_ resid.Gvk) (resource.ConflictDetector, error) {
+	return &smPatchMergeOnlyDetector{}, nil
+}

api/internal/conflict/smpatchmergeonlydetector.go

@@ -0,0 +1,33 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// smPatchMergeOnlyDetector ignores conflicts,
+// but does real strategic merge patching.
+// This is part of an effort to eliminate dependence on
+// apimachinery package to allow kustomize integration
+// into kubectl (#2506 and #1500)
+type smPatchMergeOnlyDetector struct{}
+
+var _ resource.ConflictDetector = &smPatchMergeOnlyDetector{}
+
+func (c *smPatchMergeOnlyDetector) HasConflict(
+	_, _ *resource.Resource) (bool, error) {
+	return false, nil
+}
+
+// There's at least one case that doesn't work.  Suppose one has a
+// Deployment with a volume with the bizarre "emptyDir: {}" entry.
+// If you want to get rid of this entry via a patch containing
+// the entry "emptyDir: null", then the following won't work,
+// because null entries are eliminated.
+func (c *smPatchMergeOnlyDetector) MergePatches(
+	r, patch *resource.Resource) (*resource.Resource, error) {
+	err := r.ApplySmPatch(patch)
+	return r, err
+}

api/internal/crawl/README.md

@@ -217,7 +217,7 @@ overview of each component with the following sections going into more details.
 
 The overall structure is outlined in the following figure:
 ![overview](
-https://sigs.k8s.io/kustomize/internal/tools/pictures/sys_arch.png)
+https://github.com/kubernetes-sigs/kustomize/blob/master/api/internal/crawl/pictures/token_config.png)
 
 #### Crawler
 The leftmost component consists of a crawler with an http cache of GitHub

api/internal/crawl/doc/doc.go

@@ -7,14 +7,13 @@ import (
 	"sort"
 	"strings"
 
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/provider"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 )
 
-var fileReader = kunstruct.NewKunstructuredFactoryImpl()
-
 // This document is meant to be used at the elasticsearch document type.
 // Fields are serialized as-is to elasticsearch, where indices are built
 // to facilitate text search queries. Identifiers, Values, FilePath,
@@ -42,6 +41,7 @@ type KustomizationDocument struct {
 	Kinds       []string `json:"kinds,omitempty"`
 	Identifiers []string `json:"identifiers,omitempty"`
 	Values      []string `json:"values,omitempty"`
+	resFactory  *resource.Factory
 }
 
 type set map[string]struct{}
@@ -52,6 +52,7 @@ func (doc *KustomizationDocument) Copy() *KustomizationDocument {
 		Kinds:       doc.Kinds,
 		Identifiers: doc.Identifiers,
 		Values:      doc.Values,
+		resFactory:  provider.NewDefaultDepProvider().GetResourceFactory(),
 	}
 }
 
@@ -150,7 +151,7 @@ func (doc *KustomizationDocument) readBytes() ([]map[string]interface{}, error)
 	}
 
 	configs := make([]map[string]interface{}, 0)
-	ks, err := fileReader.SliceFromBytes(data)
+	ks, err := doc.resFactory.SliceFromBytes(data)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse resource: %v", err)
 	}

api/internal/crawl/go.mod

@@ -1,6 +1,6 @@
 module sigs.k8s.io/kustomize/api/internal/crawl
 
-go 1.14
+go 1.15
 
 require (
 	github.com/elastic/go-elasticsearch/v6 v6.8.5

api/internal/crawl/go.sum

@@ -16,8 +16,10 @@ github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmU
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/StackExchange/wmi v0.0.0-20180116203802-5d049714c4a6/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
 github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
@@ -72,6 +74,7 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-critic/go-critic v0.3.5-0.20190904082202-d79a9f0c64db/go.mod h1:+sE8vrLDS2M0pZkBk0wy6+nLdKexVDrl/jBqQOTDThA=
+github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
@@ -91,11 +94,13 @@ github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+
 github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/jsonreference v0.19.3 h1:5cxNfTy0UVC3X8JL5ymxzyoUZmo8iZb+jeTWn7tUa8o=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
 github.com/go-openapi/loads v0.17.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
 github.com/go-openapi/loads v0.18.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
@@ -110,6 +115,7 @@ github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsd
 github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
 github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/spec v0.19.5 h1:Xm0Ao53uqnk9QE/LlYV5DEU09UAgpliA85QoT9LzqPw=
 github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
 github.com/go-openapi/strfmt v0.17.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
 github.com/go-openapi/strfmt v0.18.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
@@ -120,6 +126,7 @@ github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dp
 github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+MYsct2VUrAJ4=
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
@@ -138,6 +145,7 @@ github.com/go-toolsmith/pkgload v0.0.0-20181119091011-e9e65178eee8/go.mod h1:WoM
 github.com/go-toolsmith/pkgload v1.0.0/go.mod h1:5eFArkbO80v7Z0kdngIxsRXRMTaX4Ilcwuh3clNrQJc=
 github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
 github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
+github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gofrs/flock v0.0.0-20190320160742-5135e617513b/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -199,8 +207,10 @@ github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:Fecb
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
@@ -210,6 +220,7 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
@@ -242,7 +253,9 @@ github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
@@ -263,6 +276,8 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/mozilla/tls-observatory v0.0.0-20190404164649-a3c1b6cfecfd/go.mod h1:SrKMQvPiws7F7iqYp8/TX+IhxCYhzr6N/1yb8cwHsGk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -305,6 +320,7 @@ github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/securego/gosec v0.0.0-20191002120514-e680875ea14d/go.mod h1:w5+eXa0mYznDkHaMCXA4XYffjlH+cy1oyKbfzJXa2Do=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shirou/gopsutil v0.0.0-20190901111213-e4ec7b275ada/go.mod h1:WWnYX4lzhCH5h/3YBfyVA3VbLYjlMZZAQcW9ojMexNc=
 github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
@@ -330,6 +346,7 @@ github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DM
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -342,8 +359,8 @@ github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiff
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
-github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
+github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ultraware/funlen v0.0.2/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
 github.com/ultraware/whitespace v0.0.4/go.mod h1:aVMh/gQve5Maj9hQ/hg+F75lr/X5A89uZnzAmWSineA=
 github.com/uudashr/gocognit v0.0.0-20190926065955-1655d0de0517/go.mod h1:j44Ayx2KW4+oB6SWMv8KsmHzZrOInQav7D3cQMJ5JUM=
@@ -353,10 +370,11 @@ github.com/valyala/quicktemplate v1.2.0/go.mod h1:EH+4AkTd43SvgIbQHYu59/cJyxDoOV
 github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
 github.com/vektah/gqlparser v1.1.2/go.mod h1:1ycwN7Ij5njmMkPPAOaRFY4rET2Enx7IkVv3vaXspKw=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yujunz/go-getter v1.4.1-lite h1:FhvNc94AXMZkfqUwfMKhnQEC9phkphSGdPTL7tIdhOM=
-github.com/yujunz/go-getter v1.4.1-lite/go.mod h1:sbmqxXjyLunH1PkF3n7zSlnVeMvmYUuIl9ZVs/7NyCc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf h1:gvEmqF83GB8R5XtrMseJb6A6R0OCtNAS8f4TmZg2dGc=
+github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf/go.mod h1:bL0Pr07HEdsMZ1WBqZIxXj96r5LnFsY4LgPaPEGkw1k=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@@ -404,8 +422,6 @@ golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -462,6 +478,7 @@ golang.org/x/tools v0.0.0-20190719005602-e377ae9d6386/go.mod h1:jcCCGcm9btYwXyDq
 golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190930201159-7c411dea38b0/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -490,11 +507,13 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
@@ -515,7 +534,8 @@ k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.4.1/go.mod h1:XJL84E6sOFeNrQ7CADiemc1B0EjIxHo3OhW4o1aJYNw=
+sigs.k8s.io/kustomize/kyaml v0.10.5 h1:PbJcsZsEM7O3hHtUWTR+4WkHVbQRW9crSy75or1gRbI=
+sigs.k8s.io/kustomize/kyaml v0.10.5/go.mod h1:P6Oy/ah/GZMKzJMIJA2a3/bc8YrBkuL5kJji13PSIzY=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

api/internal/generators/configmap.go

@@ -0,0 +1,51 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// MakeConfigMap makes a configmap.
+//
+// ConfigMap: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#configmap-v1-core
+//
+// ConfigMaps and Secrets are similar.
+//
+// Both objects have a `data` field, which contains a map from keys to
+// values that must be UTF-8 valid strings.  Such data might be simple text,
+// or whoever made the data may have done so by performing a base64 encoding
+// on binary data. Regardless, k8s has no means to know this, so it treats
+// the data field as a string.
+//
+// The ConfigMap has an additional field `binaryData`, also a map, but its
+// values are _intended_ to be interpreted as a base64 encoding of []byte,
+// by whatever makes use of the ConfigMap.
+//
+// In a ConfigMap, any key used in `data` cannot also be used in `binaryData`
+// and vice-versa.  A key must be unique across both maps.
+func MakeConfigMap(
+	ldr ifc.KvLoader, args *types.ConfigMapArgs) (rn *yaml.RNode, err error) {
+	rn, err = makeBaseNode("ConfigMap", args.Name, args.Namespace)
+	if err != nil {
+		return nil, err
+	}
+	m, err := makeValidatedDataMap(ldr, args.Name, args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	for _, k := range filtersutil.SortedMapKeys(m) {
+		fldName, vrN := makeConfigMapValueRNode(m[k])
+		if _, err = rn.Pipe(
+			yaml.LookupCreate(yaml.MappingNode, fldName),
+			yaml.SetField(k, vrN)); err != nil {
+			return nil, err
+		}
+	}
+	copyLabelsAndAnnotations(rn, args.Options)
+	return rn, err
+}

api/internal/generators/configmap_test.go

@@ -0,0 +1,223 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filesys"
+	. "sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var binaryHello = []byte{
+	0xff, // non-utf8
+	0x68, // h
+	0x65, // e
+	0x6c, // l
+	0x6c, // l
+	0x6f, // o
+}
+
+func manyHellos(count int) (result []byte) {
+	for i := 0; i < count; i++ {
+		result = append(result, binaryHello...)
+	}
+	return
+}
+
+func TestMakeConfigMap(t *testing.T) {
+	type expected struct {
+		out    string
+		errMsg string
+	}
+
+	testCases := map[string]struct {
+		args types.ConfigMapArgs
+		exp  expected
+	}{
+		"construct config map from env": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envConfigMap",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("configmap", "app.env"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envConfigMap
+data:
+  DB_PASSWORD: qwerty
+  DB_USERNAME: admin
+`,
+			},
+		},
+		"construct config map from text file": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileConfigMap1",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fileConfigMap1
+data:
+  app-init.ini: |
+    FOO=bar
+    BAR=baz
+`,
+			},
+		},
+		"construct config map from text and binary file": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileConfigMap2",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+							filepath.Join("configmap", "app.bin"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fileConfigMap2
+data:
+  app-init.ini: |
+    FOO=bar
+    BAR=baz
+binaryData:
+  app.bin: |
+    /2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbG
+    xv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hl
+    bGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv/2
+    hlbGxv/2hlbGxv/2hlbGxv/2hlbGxv
+`,
+			},
+		},
+		"construct config map from literal": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalConfigMap1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: literalConfigMap1
+  labels:
+    foo: 'bar'
+data:
+  a: x
+  b: y
+  c: Hello World
+  d: "true"
+`,
+			},
+		},
+		"construct config map from literal with GeneratorOptions in ConfigMapArgs": {
+			args: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalConfigMap2",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"veggie": "celery",
+							"dog":    "beagle",
+							"cat":    "annoying",
+						},
+						Annotations: map[string]string{
+							"river": "Missouri",
+							"city":  "Iowa City",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: literalConfigMap2
+  labels:
+    cat: 'annoying'
+    dog: 'beagle'
+    veggie: 'celery'
+  annotations:
+    city: 'Iowa City'
+    river: 'Missouri'
+data:
+  a: x
+  b: y
+  c: Hello World
+  d: "true"
+`,
+			},
+		},
+	}
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=qwerty\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.bin"),
+		manyHellos(30))
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rn, err := MakeConfigMap(kvLdr, &tc.args)
+			if err != nil {
+				if !assert.EqualError(t, err, tc.exp.errMsg) {
+					t.FailNow()
+				}
+				return
+			}
+			if tc.exp.errMsg != "" {
+				t.Fatalf("%s: should return error '%s'", n, tc.exp.errMsg)
+			}
+			output := rn.MustString()
+			if !assert.Equal(t, tc.exp.out, output) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/internal/generators/secret.go

@@ -0,0 +1,64 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// MakeSecret makes a kubernetes Secret.
+//
+// Secret: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#secret-v1-core
+//
+// ConfigMaps and Secrets are similar.
+//
+// Like a ConfigMap, a Secret has a `data` field, but unlike a ConfigMap it has
+// no `binaryData` field.
+//
+// All of a Secret's data is assumed to be opaque in nature, and assumed to be
+// base64 encoded from its original representation, regardless of whether the
+// original data was UTF-8 text or binary.
+//
+// This encoding provides no secrecy. It's just a neutral, common means to
+// represent opaque text and binary data.  Beneath the base64 encoding
+// is presumably further encoding under control of the Secret's consumer.
+//
+// A Secret has string field `type` which holds an identifier, used by the
+// client, to choose the algorithm to interpret the `data` field.  Kubernetes
+// cannot make use of this data; it's up to a controller or some pod's service
+// to interpret the value, using `type` as a clue as to how to do this.
+func MakeSecret(
+	ldr ifc.KvLoader, args *types.SecretArgs) (rn *yaml.RNode, err error) {
+	rn, err = makeBaseNode("Secret", args.Name, args.Namespace)
+	if err != nil {
+		return nil, err
+	}
+	t := "Opaque"
+	if args.Type != "" {
+		t = args.Type
+	}
+	if _, err := rn.Pipe(
+		yaml.FieldSetter{
+			Name:  "type",
+			Value: yaml.NewStringRNode(t)}); err != nil {
+		return nil, err
+	}
+	m, err := makeValidatedDataMap(ldr, args.Name, args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	for _, k := range filtersutil.SortedMapKeys(m) {
+		vrN := makeSecretValueRNode(m[k])
+		if _, err = rn.Pipe(
+			yaml.LookupCreate(yaml.MappingNode, yaml.DataField),
+			yaml.SetField(k, vrN)); err != nil {
+			return nil, err
+		}
+	}
+	copyLabelsAndAnnotations(rn, args.Options)
+	return rn, err
+}

api/internal/generators/secret_test.go

@@ -0,0 +1,231 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/filesys"
+	. "sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestMakeSecret(t *testing.T) {
+	type expected struct {
+		out    string
+		errMsg string
+	}
+
+	testCases := map[string]struct {
+		args types.SecretArgs
+		exp  expected
+	}{
+		"construct secret from env": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envSecret",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("secret", "app.env"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: envSecret
+type: Opaque
+data:
+  DB_PASSWORD: cXdlcnR5
+  DB_USERNAME: YWRtaW4=
+`,
+			},
+		},
+		"construct secret from text file": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileSecret1",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("secret", "app-init.ini"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: fileSecret1
+type: Opaque
+data:
+  app-init.ini: Rk9PPWJhcgpCQVI9YmF6Cg==
+`,
+			},
+		},
+		"construct secret from text and binary file": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileSecret2",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("secret", "app-init.ini"),
+							filepath.Join("secret", "app.bin"),
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: fileSecret2
+type: Opaque
+data:
+  app-init.ini: Rk9PPWJhcgpCQVI9YmF6Cg==
+  app.bin: //0=
+`,
+			},
+		},
+		"construct secret from literal": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret1
+  labels:
+    foo: 'bar'
+type: Opaque
+data:
+  a: eA==
+  b: eQ==
+  c: SGVsbG8gV29ybGQ=
+  d: dHJ1ZQ==
+`,
+			},
+		},
+		"construct secret with type": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret1",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+				Type: "foobar",
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret1
+  labels:
+    foo: 'bar'
+type: foobar
+data:
+  a: eA==
+`,
+			},
+		},
+		"construct secret from literal with GeneratorOptions in SecretArgs": {
+			args: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret2",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+					Options: &types.GeneratorOptions{
+						Labels: map[string]string{
+							"veggie": "celery",
+							"dog":    "beagle",
+							"cat":    "annoying",
+						},
+						Annotations: map[string]string{
+							"river": "Missouri",
+							"city":  "Iowa City",
+						},
+					},
+				},
+			},
+			exp: expected{
+				out: `apiVersion: v1
+kind: Secret
+metadata:
+  name: literalSecret2
+  labels:
+    cat: 'annoying'
+    dog: 'beagle'
+    veggie: 'celery'
+  annotations:
+    city: 'Iowa City'
+    river: 'Missouri'
+type: Opaque
+data:
+  a: eA==
+  b: eQ==
+  c: SGVsbG8gV29ybGQ=
+  d: dHJ1ZQ==
+`,
+			},
+		},
+	}
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=qwerty\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("secret", "app.bin"),
+		[]byte{0xff, 0xfd})
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rn, err := MakeSecret(kvLdr, &tc.args)
+			if err != nil {
+				if !assert.EqualError(t, err, tc.exp.errMsg) {
+					t.FailNow()
+				}
+				return
+			}
+			if tc.exp.errMsg != "" {
+				t.Fatalf("%s: should return error '%s'", n, tc.exp.errMsg)
+			}
+			output := rn.MustString()
+			if !assert.Equal(t, tc.exp.out, output) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/internal/generators/utils.go

@@ -0,0 +1,139 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package generators
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/go-errors/errors"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func makeBaseNode(kind, name, namespace string) (*yaml.RNode, error) {
+	rn, err := yaml.Parse(fmt.Sprintf(`
+apiVersion: v1
+kind: %s
+`, kind))
+	if err != nil {
+		return nil, err
+	}
+	if name == "" {
+		return nil, errors.Errorf("a configmap must have a name")
+	}
+	if _, err := rn.Pipe(yaml.SetK8sName(name)); err != nil {
+		return nil, err
+	}
+	if namespace != "" {
+		if _, err := rn.Pipe(yaml.SetK8sNamespace(namespace)); err != nil {
+			return nil, err
+		}
+	}
+	return rn, nil
+}
+
+func makeValidatedDataMap(
+	ldr ifc.KvLoader, name string, sources types.KvPairSources) (map[string]string, error) {
+	pairs, err := ldr.Load(sources)
+	if err != nil {
+		return nil, errors.WrapPrefix(err, "loading KV pairs", 0)
+	}
+	knownKeys := make(map[string]string)
+	for _, p := range pairs {
+		// legal key: alphanumeric characters, '-', '_' or '.'
+		if err := ldr.Validator().ErrIfInvalidKey(p.Key); err != nil {
+			return nil, err
+		}
+		if _, ok := knownKeys[p.Key]; ok {
+			return nil, errors.Errorf(
+				"configmap %s illegally repeats the key `%s`", name, p.Key)
+		}
+		knownKeys[p.Key] = p.Value
+	}
+	return knownKeys, nil
+}
+
+// copyLabelsAndAnnotations copies labels and annotations from
+// GeneratorOptions into the given object.
+func copyLabelsAndAnnotations(
+	rn *yaml.RNode, opts *types.GeneratorOptions) error {
+	if opts == nil {
+		return nil
+	}
+	for _, k := range filtersutil.SortedMapKeys(opts.Labels) {
+		v := opts.Labels[k]
+		if _, err := rn.Pipe(yaml.SetLabel(k, v)); err != nil {
+			return err
+		}
+	}
+	for _, k := range filtersutil.SortedMapKeys(opts.Annotations) {
+		v := opts.Annotations[k]
+		if _, err := rn.Pipe(yaml.SetAnnotation(k, v)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// In a secret, all data is base64 encoded, regardless of its conformance
+// or lack thereof to UTF-8.
+func makeSecretValueRNode(s string) *yaml.RNode {
+	yN := &yaml.Node{Kind: yaml.ScalarNode}
+	// Purposely don't use YAML tags to identify the data as being plain text or
+	// binary.  It kubernetes Secrets the values in the `data` map are expected
+	// to be base64 encoded, and in ConfigMaps that same can be said for the
+	// values in the `binaryData` field.
+	yN.Tag = yaml.NodeTagString
+	yN.Value = encodeBase64(s)
+	if strings.Contains(yN.Value, "\n") {
+		yN.Style = yaml.LiteralStyle
+	}
+	return yaml.NewRNode(yN)
+}
+
+func makeConfigMapValueRNode(s string) (field string, rN *yaml.RNode) {
+	yN := &yaml.Node{Kind: yaml.ScalarNode}
+	yN.Tag = yaml.NodeTagString
+	if utf8.ValidString(s) {
+		field = yaml.DataField
+		yN.Value = s
+	} else {
+		field = yaml.BinaryDataField
+		yN.Value = encodeBase64(s)
+	}
+	if strings.Contains(yN.Value, "\n") {
+		yN.Style = yaml.LiteralStyle
+	}
+	return field, yaml.NewRNode(yN)
+}
+
+// encodeBase64 encodes s as base64 that is broken up into multiple lines
+// as appropriate for the resulting length.
+func encodeBase64(s string) string {
+	const lineLen = 70
+	encLen := base64.StdEncoding.EncodedLen(len(s))
+	lines := encLen/lineLen + 1
+	buf := make([]byte, encLen*2+lines)
+	in := buf[0:encLen]
+	out := buf[encLen:]
+	base64.StdEncoding.Encode(in, []byte(s))
+	k := 0
+	for i := 0; i < len(in); i += lineLen {
+		j := i + lineLen
+		if j > len(in) {
+			j = len(in)
+		}
+		k += copy(out[k:], in[i:j])
+		if lines > 1 {
+			out[k] = '\n'
+			k++
+		}
+	}
+	return string(out[:k])
+}

api/internal/git/cloner.go

@@ -4,10 +4,6 @@
 package git
 
 import (
-	"log"
-	"os/exec"
-
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filesys"
 )
 
@@ -18,71 +14,29 @@ type Cloner func(repoSpec *RepoSpec) error
 // to say, some remote API, to obtain a local clone of
 // a remote repo.
 func ClonerUsingGitExec(repoSpec *RepoSpec) error {
-	gitProgram, err := exec.LookPath("git")
-	if err != nil {
-		return errors.Wrap(err, "no 'git' program on path")
-	}
-	repoSpec.Dir, err = filesys.NewTmpConfirmedDir()
+	r, err := newCmdRunner()
 	if err != nil {
 		return err
 	}
-
-	if repoSpec.Ref == "" {
-		repoSpec.Ref = "master"
+	repoSpec.Dir = r.dir
+	if err = r.run("init"); err != nil {
+		return err
 	}
-	cmd := exec.Command(
-		gitProgram,
-		"clone",
-		"--depth=1",
-		repoSpec.CloneSpec(),
-		repoSpec.Dir.String())
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error cloning git repo: %s", out)
-		return errors.Wrapf(
-			err,
-			"trouble cloning git repo %v in %s",
-			repoSpec.CloneSpec(), repoSpec.Dir.String())
+	if err = r.run(
+		"remote", "add", "origin", repoSpec.CloneSpec()); err != nil {
+		return err
 	}
-
-	cmd = exec.Command(
-		gitProgram,
-		"fetch",
-		"--depth=1",
-		"origin",
-		repoSpec.Ref)
-	cmd.Dir = repoSpec.Dir.String()
-	out, err = cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error fetching ref: %s", out)
-		return errors.Wrapf(err, "trouble fetching %s", repoSpec.Ref)
+	ref := "HEAD"
+	if repoSpec.Ref != "" {
+		ref = repoSpec.Ref
 	}
-
-	cmd = exec.Command(
-		gitProgram,
-		"checkout",
-		"FETCH_HEAD")
-	cmd.Dir = repoSpec.Dir.String()
-	out, err = cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error checking out ref: %s", out)
-		return errors.Wrapf(err, "trouble checking out %s", repoSpec.Ref)
+	if err = r.run("fetch", "--depth=1", "origin", ref); err != nil {
+		return err
 	}
-
-	cmd = exec.Command(
-		gitProgram,
-		"submodule",
-		"update",
-		"--init",
-		"--recursive")
-	cmd.Dir = repoSpec.Dir.String()
-	out, err = cmd.CombinedOutput()
-	if err != nil {
-		log.Printf("Error fetching submodules: %s", out)
-		return errors.Wrapf(err, "trouble fetching submodules for %s", repoSpec.CloneSpec())
+	if err = r.run("checkout", "FETCH_HEAD"); err != nil {
+		return err
 	}
-
-	return nil
+	return r.run("submodule", "update", "--init", "--recursive")
 }
 
 // DoNothingCloner returns a cloner that only sets

api/internal/git/gitrunner.go

@@ -0,0 +1,58 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"os/exec"
+	"time"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+// Arbitrary, but non-infinite, timeout for running commands.
+const defaultDuration = 27 * time.Second
+
+// gitRunner runs the external git binary.
+type gitRunner struct {
+	gitProgram string
+	duration   time.Duration
+	dir        filesys.ConfirmedDir
+}
+
+// newCmdRunner returns a gitRunner if it can find the binary.
+// It also creats a temp directory for cloning repos.
+func newCmdRunner() (*gitRunner, error) {
+	gitProgram, err := exec.LookPath("git")
+	if err != nil {
+		return nil, errors.Wrap(err, "no 'git' program on path")
+	}
+	dir, err := filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return nil, err
+	}
+	return &gitRunner{
+		gitProgram: gitProgram,
+		duration:   defaultDuration,
+		dir:        dir,
+	}, nil
+}
+
+// run a command with a timeout.
+func (r gitRunner) run(args ...string) error {
+	//nolint: gosec
+	cmd := exec.Command(r.gitProgram, args...)
+	cmd.Dir = r.dir.String()
+	return utils.TimedCall(
+		cmd.String(),
+		r.duration,
+		func() error {
+			_, err := cmd.CombinedOutput()
+			if err != nil {
+				return errors.Wrapf(err, "git cmd = '%s'", cmd.String())
+			}
+			return err
+		})
+}

api/internal/k8sdeps/conflict/conflictdetectorjson.go

@@ -0,0 +1,43 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"encoding/json"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// conflictDetectorJson detects conflicts in a list of JSON patches.
+type conflictDetectorJson struct {
+	resourceFactory *resource.Factory
+}
+
+var _ resource.ConflictDetector = &conflictDetectorJson{}
+
+func (cd *conflictDetectorJson) HasConflict(
+	p1, p2 *resource.Resource) (bool, error) {
+	return mergepatch.HasConflicts(p1.Map(), p2.Map())
+}
+
+func (cd *conflictDetectorJson) MergePatches(
+	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	baseBytes, err := json.Marshal(patch1.Map())
+	if err != nil {
+		return nil, err
+	}
+	patchBytes, err := json.Marshal(patch2.Map())
+	if err != nil {
+		return nil, err
+	}
+	mergedBytes, err := jsonpatch.MergeMergePatches(baseBytes, patchBytes)
+	if err != nil {
+		return nil, err
+	}
+	mergedMap := make(map[string]interface{})
+	err = json.Unmarshal(mergedBytes, &mergedMap)
+	return cd.resourceFactory.FromMap(mergedMap), err
+}

api/internal/k8sdeps/conflict/conflictdetectorsm.go

@@ -0,0 +1,65 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// conflictDetectorSm detects conflicts in a list of strategic merge patches.
+type conflictDetectorSm struct {
+	lookupPatchMeta strategicpatch.LookupPatchMeta
+	resourceFactory *resource.Factory
+}
+
+var _ resource.ConflictDetector = &conflictDetectorSm{}
+
+func (cd *conflictDetectorSm) HasConflict(
+	p1, p2 *resource.Resource) (bool, error) {
+	return strategicpatch.MergingMapsHaveConflicts(
+		p1.Map(), p2.Map(), cd.lookupPatchMeta)
+}
+
+func (cd *conflictDetectorSm) MergePatches(
+	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	if cd.hasDeleteDirectiveMarker(patch2.Map()) {
+		if cd.hasDeleteDirectiveMarker(patch1.Map()) {
+			return nil, fmt.Errorf(
+				"cannot merge patches both containing '$patch: delete' directives")
+		}
+		patch1, patch2 = patch2, patch1
+	}
+	mergedMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
+		cd.lookupPatchMeta, patch1.Map(), patch2.Map())
+	return cd.resourceFactory.FromMap(mergedMap), err
+}
+
+func (cd *conflictDetectorSm) hasDeleteDirectiveMarker(
+	patch map[string]interface{}) bool {
+	if v, ok := patch["$patch"]; ok && v == "delete" {
+		return true
+	}
+	for _, v := range patch {
+		switch typedV := v.(type) {
+		case map[string]interface{}:
+			if cd.hasDeleteDirectiveMarker(typedV) {
+				return true
+			}
+		case []interface{}:
+			for _, sv := range typedV {
+				typedE, ok := sv.(map[string]interface{})
+				if !ok {
+					break
+				}
+				if cd.hasDeleteDirectiveMarker(typedE) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}

api/internal/k8sdeps/conflict/factory.go

@@ -0,0 +1,45 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package conflict
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	sp "k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+type cdFactory struct {
+	rf *resource.Factory
+}
+
+var _ resource.ConflictDetectorFactory = &cdFactory{}
+
+// NewFactory returns a conflict detector factory.
+// The detector uses a resource factory to convert resources to/from
+// json/yaml/maps representations.
+func NewFactory(rf *resource.Factory) resource.ConflictDetectorFactory {
+	return &cdFactory{rf: rf}
+}
+
+// New returns a conflict detector that's aware of the GVK type.
+func (f *cdFactory) New(gvk resid.Gvk) (resource.ConflictDetector, error) {
+	// Convert to apimachinery representation of object
+	obj, err := scheme.Scheme.New(schema.GroupVersionKind{
+		Group:   gvk.Group,
+		Version: gvk.Version,
+		Kind:    gvk.Kind,
+	})
+	if err == nil {
+		meta, err := sp.NewPatchMetaFromStruct(obj)
+		return &conflictDetectorSm{
+			lookupPatchMeta: meta, resourceFactory: f.rf}, err
+	}
+	if runtime.IsNotRegisteredError(err) {
+		return &conflictDetectorJson{resourceFactory: f.rf}, nil
+	}
+	return nil, err
+}

api/internal/k8sdeps/transformer/factory.go

@@ -1,25 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package transformer provides transformer factory
-package transformer
-
-import (
-	"sigs.k8s.io/kustomize/api/internal/k8sdeps/transformer/patch"
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-// FactoryImpl makes patch transformer and name hash transformer
-type FactoryImpl struct{}
-
-// NewFactoryImpl makes a new factoryImpl instance
-func NewFactoryImpl() *FactoryImpl {
-	return &FactoryImpl{}
-}
-
-func (p *FactoryImpl) MergePatches(patches []*resource.Resource,
-	rf *resource.Factory) (
-	resmap.ResMap, error) {
-	return patch.MergePatches(patches, rf)
-}

api/internal/k8sdeps/transformer/patch/conflictdetector.go

@@ -1,221 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package patch
-
-import (
-	"encoding/json"
-	"fmt"
-
-	jsonpatch "github.com/evanphx/json-patch"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/util/mergepatch"
-	"k8s.io/apimachinery/pkg/util/strategicpatch"
-	"k8s.io/client-go/kubernetes/scheme"
-	"sigs.k8s.io/kustomize/api/resid"
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-type conflictDetector interface {
-	hasConflict(patch1, patch2 *resource.Resource) (bool, error)
-	findConflict(conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error)
-	mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error)
-}
-
-type jsonMergePatch struct {
-	rf *resource.Factory
-}
-
-var _ conflictDetector = &jsonMergePatch{}
-
-func newJMPConflictDetector(rf *resource.Factory) conflictDetector {
-	return &jsonMergePatch{rf: rf}
-}
-
-func (jmp *jsonMergePatch) hasConflict(
-	patch1, patch2 *resource.Resource) (bool, error) {
-	return mergepatch.HasConflicts(patch1.Map(), patch2.Map())
-}
-
-func (jmp *jsonMergePatch) findConflict(
-	conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error) {
-	for i, patch := range patches {
-		if i == conflictingPatchIdx {
-			continue
-		}
-		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
-			continue
-		}
-		conflict, err := mergepatch.HasConflicts(
-			patch.Map(),
-			patches[conflictingPatchIdx].Map())
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			return patch, nil
-		}
-	}
-	return nil, nil
-}
-
-func (jmp *jsonMergePatch) mergePatches(
-	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
-	baseBytes, err := json.Marshal(patch1.Map())
-	if err != nil {
-		return nil, err
-	}
-	patchBytes, err := json.Marshal(patch2.Map())
-	if err != nil {
-		return nil, err
-	}
-	mergedBytes, err := jsonpatch.MergeMergePatches(baseBytes, patchBytes)
-	if err != nil {
-		return nil, err
-	}
-	mergedMap := make(map[string]interface{})
-	err = json.Unmarshal(mergedBytes, &mergedMap)
-	return jmp.rf.FromMap(mergedMap), err
-}
-
-type strategicMergePatch struct {
-	lookupPatchMeta strategicpatch.LookupPatchMeta
-	rf              *resource.Factory
-}
-
-var _ conflictDetector = &strategicMergePatch{}
-
-func newSMPConflictDetector(
-	versionedObj runtime.Object,
-	rf *resource.Factory) (conflictDetector, error) {
-	lookupPatchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObj)
-	return &strategicMergePatch{lookupPatchMeta: lookupPatchMeta, rf: rf}, err
-}
-
-func (smp *strategicMergePatch) hasConflict(p1, p2 *resource.Resource) (bool, error) {
-	return strategicpatch.MergingMapsHaveConflicts(
-		p1.Map(), p2.Map(), smp.lookupPatchMeta)
-}
-
-func (smp *strategicMergePatch) findConflict(
-	conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error) {
-	for i, patch := range patches {
-		if i == conflictingPatchIdx {
-			continue
-		}
-		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
-			continue
-		}
-		conflict, err := strategicpatch.MergingMapsHaveConflicts(
-			patch.Map(),
-			patches[conflictingPatchIdx].Map(),
-			smp.lookupPatchMeta)
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			return patch, nil
-		}
-	}
-	return nil, nil
-}
-
-func (smp *strategicMergePatch) mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error) {
-	if hasDeleteDirectiveMarker(patch2.Map()) {
-		if hasDeleteDirectiveMarker(patch1.Map()) {
-			return nil, fmt.Errorf("cannot merge patches both containing '$patch: delete' directives")
-		}
-		patch1, patch2 = patch2, patch1
-	}
-	mergeJSONMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
-		smp.lookupPatchMeta, patch1.Map(), patch2.Map())
-	return smp.rf.FromMap(mergeJSONMap), err
-}
-
-// MergePatches merge and index patches by OrgId.
-// It errors out if there is conflict between patches.
-func MergePatches(patches []*resource.Resource,
-	rf *resource.Factory) (resmap.ResMap, error) {
-	rc := resmap.New()
-	for ix, patch := range patches {
-		id := patch.OrgId()
-		existing := rc.GetMatchingResourcesByOriginalId(id.Equals)
-		if len(existing) == 0 {
-			rc.Append(patch)
-			continue
-		}
-		if len(existing) > 1 {
-			return nil, fmt.Errorf("self conflict in patches")
-		}
-
-		versionedObj, err := scheme.Scheme.New(toSchemaGvk(id.Gvk))
-		if err != nil && !runtime.IsNotRegisteredError(err) {
-			return nil, err
-		}
-		var cd conflictDetector
-		if err != nil {
-			cd = newJMPConflictDetector(rf)
-		} else {
-			cd, err = newSMPConflictDetector(versionedObj, rf)
-			if err != nil {
-				return nil, err
-			}
-		}
-
-		conflict, err := cd.hasConflict(existing[0], patch)
-		if err != nil {
-			return nil, err
-		}
-		if conflict {
-			conflictingPatch, err := cd.findConflict(ix, patches)
-			if err != nil {
-				return nil, err
-			}
-			return nil, fmt.Errorf(
-				"conflict between %#v and %#v",
-				conflictingPatch.Map(), patch.Map())
-		}
-		merged, err := cd.mergePatches(existing[0], patch)
-		if err != nil {
-			return nil, err
-		}
-		rc.Replace(merged)
-	}
-	return rc, nil
-}
-
-// toSchemaGvk converts to a schema.GroupVersionKind.
-func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
-	return schema.GroupVersionKind{
-		Group:   x.Group,
-		Version: x.Version,
-		Kind:    x.Kind,
-	}
-}
-
-func hasDeleteDirectiveMarker(patch map[string]interface{}) bool {
-	if v, ok := patch["$patch"]; ok && v == "delete" {
-		return true
-	}
-	for _, v := range patch {
-		switch typedV := v.(type) {
-		case map[string]interface{}:
-			if hasDeleteDirectiveMarker(typedV) {
-				return true
-			}
-		case []interface{}:
-			for _, sv := range typedV {
-				typedE, ok := sv.(map[string]interface{})
-				if !ok {
-					break
-				}
-				if hasDeleteDirectiveMarker(typedE) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}

api/internal/plugins/builtinhelpers/builtinplugintype_string.go

@@ -23,11 +23,12 @@ func _() {
 	_ = x[ReplicaCountTransformer-12]
 	_ = x[SecretGenerator-13]
 	_ = x[ValueAddTransformer-14]
+	_ = x[HelmChartInflationGenerator-15]
 }
 
-const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformer"
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGenerator"
 
-var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 62, 81, 97, 119, 139, 163, 193, 209, 232, 255, 270, 289}
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 62, 81, 97, 119, 139, 163, 193, 209, 232, 255, 270, 289, 316}
 
 func (i BuiltinPluginType) String() string {
 	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {

api/internal/plugins/builtinhelpers/builtins.go

@@ -27,6 +27,7 @@ const (
 	ReplicaCountTransformer
 	SecretGenerator
 	ValueAddTransformer
+	HelmChartInflationGenerator
 )
 
 var stringToBuiltinPluginTypeMap map[string]BuiltinPluginType
@@ -55,8 +56,9 @@ func GetBuiltinPluginType(n string) BuiltinPluginType {
 }
 
 var GeneratorFactories = map[BuiltinPluginType]func() resmap.GeneratorPlugin{
-	ConfigMapGenerator: builtins.NewConfigMapGeneratorPlugin,
-	SecretGenerator:    builtins.NewSecretGeneratorPlugin,
+	ConfigMapGenerator:          builtins.NewConfigMapGeneratorPlugin,
+	SecretGenerator:             builtins.NewSecretGeneratorPlugin,
+	HelmChartInflationGenerator: builtins.NewHelmChartInflationGeneratorPlugin,
 }
 
 var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin{

api/internal/plugins/doc.go

@@ -94,7 +94,7 @@ TO GENERATE CODE
   cd $repo/plugin/builtin
   go generate ./...
 
-See travis/kyaml-pre-commit.sh for canonical way
+See scripts/kyaml-pre-commit.sh for canonical way
 to execute the above.
 
 This creates

api/internal/plugins/execplugin/execplugin.go

@@ -9,6 +9,7 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
+	"runtime"
 	"strings"
 
 	"github.com/google/shlex"
@@ -50,7 +51,14 @@ func (p *ExecPlugin) ErrIfNotExecutable() error {
 	if err != nil {
 		return err
 	}
-	if f.Mode()&0111 == 0000 {
+	// In Windows, it is not possible to determine whether a
+	// file is executable through file mode.
+	// TODO: provide for setting the executable FileMode bit on Windows
+	// The (fs *fileStat) Mode() (m FileMode) {} function in
+	// https://golang.org/src/os/types_windows.go
+	// lacks the ability to set the FileMode executable bit in response
+	// to file data on Windows.
+	if f.Mode()&0111 == 0000 && runtime.GOOS != "windows" {
 		return fmt.Errorf("unexecutable plugin at: %s", p.path)
 	}
 	return nil

api/internal/plugins/execplugin/execplugin_test.go

@@ -4,18 +4,19 @@
 package execplugin_test
 
 import (
+	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 )
 
 func TestExecPluginConfig(t *testing.T) {
@@ -30,10 +31,9 @@ s/$BAR/bar baz/g
 	if err != nil {
 		t.Fatal(err)
 	}
+	pvd := provider.NewDefaultDepProvider()
 	rf := resmap.NewFactory(
-		resource.NewFactory(
-			kunstruct.NewKunstructuredFactoryImpl()), nil)
-	v := valtest_test.MakeFakeValidator()
+		pvd.GetResourceFactory(), pvd.GetConflictDetectorFactory())
 	pluginConfig := rf.RF().FromMap(
 		map[string]interface{}{
 			"apiVersion": "someteam.example.com/v1",
@@ -59,7 +59,7 @@ s/$BAR/bar baz/g
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	p.Config(resmap.NewPluginHelpers(ldr, v, rf), yaml)
+	p.Config(resmap.NewPluginHelpers(ldr, pvd.GetFieldValidator(), rf), yaml)
 
 	expected := "someteam.example.com/v1/sedtransformer/SedTransformer"
 	if !strings.HasSuffix(p.Path(), expected) {
@@ -89,3 +89,32 @@ metadata:
 		t.Fatalf("unexpected arg array: %#v", p.Args())
 	}
 }
+
+func TestExecPlugin_ErrIfNotExecutable(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skipf("always returns nil on Windows")
+	}
+
+	srcRoot, err := utils.DeterminePluginSrcRoot(filesys.MakeFsOnDisk())
+	if err != nil {
+		t.Error(err)
+	}
+
+	// Test unexecutable plugin
+	unexecutablePlugin := filepath.Join(
+		srcRoot, "builtin", "", "secretgenerator", "SecretGenerator.so")
+	p := NewExecPlugin(unexecutablePlugin)
+	err = p.ErrIfNotExecutable()
+	if err == nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	// Test executable plugin
+	executablePlugin := filepath.Join(
+		srcRoot, "someteam.example.com", "v1", "bashedconfigmap", "BashedConfigMap")
+	p = NewExecPlugin(executablePlugin)
+	err = p.ErrIfNotExecutable()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}

api/internal/plugins/fnplugin/fnplugin.go

@@ -74,10 +74,10 @@ func NewFnPlugin(o *types.FnPluginLoadingOptions) *FnPlugin {
 		runFns: runfn.RunFns{
 			Functions:      []*yaml.RNode{},
 			Network:        o.Network,
-			NetworkName:    o.NetworkName,
 			EnableStarlark: o.EnableStar,
 			EnableExec:     o.EnableExec,
 			StorageMounts:  toStorageMounts(o.Mounts),
+			Env:            o.Env,
 		},
 	}
 }
@@ -173,11 +173,11 @@ func (p *FnPlugin) invokePlugin(input []byte) ([]byte, error) {
 	// TODO(donnyxia): This is actually not used by generator and only used to bypass a kio limitation.
 	// Need better solution.
 	if input == nil {
-		yaml, err := functionConfig.String()
+		yml, err := functionConfig.String()
 		if err != nil {
 			return nil, err
 		}
-		input = []byte(yaml)
+		input = []byte(yml)
 	}
 
 	// Configure and Execute Fn. We don't need to convert resources to ResourceList here

api/internal/plugins/loader/loader_test.go

@@ -8,11 +8,10 @@ import (
 
 	"sigs.k8s.io/kustomize/api/filesys"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/loader"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
@@ -51,8 +50,9 @@ func TestLoader(t *testing.T) {
 		BuildGoPlugin("builtin", "", "SecretGenerator").
 		BuildGoPlugin("someteam.example.com", "v1", "SomeServiceGenerator")
 	defer th.Reset()
-	rmF := resmap.NewFactory(resource.NewFactory(
-		kunstruct.NewKunstructuredFactoryImpl()), nil)
+	p := provider.NewDefaultDepProvider()
+	rmF := resmap.NewFactory(
+		p.GetResourceFactory(), p.GetConflictDetectorFactory())
 	fLdr, err := loader.NewLoader(
 		loader.RestrictionRootOnly,
 		filesys.Separator, filesys.MakeFsInMemory())
@@ -65,8 +65,8 @@ func TestLoader(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, behavior := range []types.BuiltinPluginLoadingOptions{
-		types.BploUseStaticallyLinked,
-		types.BploLoadFromFileSys} {
+		/* types.BploUseStaticallyLinked,
+		types.BploLoadFromFileSys */} {
 		c, err := konfig.EnabledPluginConfig(behavior)
 		if err != nil {
 			t.Fatal(err)

api/internal/plugins/utils/utils_test.go

@@ -9,9 +9,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
@@ -64,7 +65,7 @@ func strptr(s string) *string {
 }
 
 func TestUpdateResourceOptions(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	in := resmap.New()
 	expected := resmap.New()
 	cases := []struct {
@@ -87,28 +88,12 @@ func TestUpdateResourceOptions(t *testing.T) {
 		expected.Append(makeConfigMapOptions(rf, name, c.behavior, !c.needsHash))
 	}
 	actual, err := UpdateResourceOptions(in)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err.Error())
-	}
-	for i, a := range expected.Resources() {
-		b := actual.GetByIndex(i)
-		if b == nil {
-			t.Fatalf("resource %d missing from processed map", i)
-		}
-		if !a.Equals(b) {
-			t.Errorf("expected %v got %v", a, b)
-		}
-		if a.NeedHashSuffix() != b.NeedHashSuffix() {
-			t.Errorf("")
-		}
-		if a.Behavior() != b.Behavior() {
-			t.Errorf("expected %v got %v", a.Behavior(), b.Behavior())
-		}
-	}
+	assert.NoError(t, err)
+	assert.NoError(t, expected.ErrorIfNotEqualLists(actual))
 }
 
 func TestUpdateResourceOptionsWithInvalidHashAnnotationValues(t *testing.T) {
-	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	rf := provider.NewDefaultDepProvider().GetResourceFactory()
 	cases := []string{
 		"",
 		"FaLsE",

api/internal/target/kusttarget.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/go-multierror"
 	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/builtins"
 	"sigs.k8s.io/kustomize/api/ifc"
@@ -17,7 +18,6 @@ import (
 	"sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/transform"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 )
@@ -28,7 +28,6 @@ type KustTarget struct {
 	ldr           ifc.Loader
 	validator     ifc.Validator
 	rFactory      *resmap.Factory
-	tFactory      resmap.PatchFactory
 	pLdr          *loader.Loader
 }
 
@@ -37,13 +36,11 @@ func NewKustTarget(
 	ldr ifc.Loader,
 	validator ifc.Validator,
 	rFactory *resmap.Factory,
-	tFactory resmap.PatchFactory,
 	pLdr *loader.Loader) *KustTarget {
 	return &KustTarget{
 		ldr:       ldr,
 		validator: validator,
 		rFactory:  rFactory,
-		tFactory:  tFactory,
 		pLdr:      pLdr,
 	}
 }
@@ -238,7 +235,18 @@ func (kt *KustTarget) runGenerators(
 
 func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error) {
 	ra := accumulator.MakeEmptyAccumulator()
-	ra, err := kt.accumulateResources(ra, kt.kustomization.Generators)
+	var generatorPaths []string
+	for _, p := range kt.kustomization.Generators {
+		// handle inline generators
+		rm, err := kt.rFactory.NewResMapFromBytes([]byte(p))
+		if err != nil {
+			// not an inline config
+			generatorPaths = append(generatorPaths, p)
+			continue
+		}
+		ra.AppendAll(rm)
+	}
+	ra, err := kt.accumulateResources(ra, generatorPaths)
 	if err != nil {
 		return nil, err
 	}
@@ -258,13 +266,23 @@ func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
 		return err
 	}
 	r = append(r, lts...)
-	t := transform.NewMultiTransformer(r)
-	return ra.Transform(t)
+	return ra.Transform(newMultiTransformer(r))
 }
 
 func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]resmap.Transformer, error) {
 	ra := accumulator.MakeEmptyAccumulator()
-	ra, err := kt.accumulateResources(ra, transformers)
+	var transformerPaths []string
+	for _, p := range transformers {
+		// handle inline transformers
+		rm, err := kt.rFactory.NewResMapFromBytes([]byte(p))
+		if err != nil {
+			// not an inline config
+			transformerPaths = append(transformerPaths, p)
+			continue
+		}
+		ra.AppendAll(rm)
+	}
+	ra, err := kt.accumulateResources(ra, transformerPaths)
 
 	if err != nil {
 		return nil, err
@@ -294,7 +312,6 @@ func (kt *KustTarget) runValidators(ra *accumulator.ResAccumulator) error {
 }
 
 func (kt *KustTarget) removeValidatedByLabel(rm resmap.ResMap) {
-
 	resources := rm.Resources()
 	for _, r := range resources {
 		labels := r.GetLabels()
@@ -319,12 +336,18 @@ func (kt *KustTarget) accumulateResources(
 		if errF := kt.accumulateFile(ra, path); errF != nil {
 			ldr, errL := kt.ldr.New(path)
 			if errL != nil {
-				return nil, fmt.Errorf("accumulateFile %q, loader.New %q", errF, errL)
+				return nil, multierror.Append(
+					fmt.Errorf("accumulateFile error: %q", errF),
+					fmt.Errorf("loader.New error: %q", errL),
+				)
 			}
 			var errD error
 			ra, errD = kt.accumulateDirectory(ra, ldr, false)
 			if errD != nil {
-				return nil, fmt.Errorf("accumulateFile %q, accumulateDirector: %q", errF, errD)
+				return nil, multierror.Append(
+					fmt.Errorf("accumulateFile error: %q", errF),
+					fmt.Errorf("accumulateDirector error: %q", errD),
+				)
 			}
 		}
 	}
@@ -353,8 +376,7 @@ func (kt *KustTarget) accumulateComponents(
 func (kt *KustTarget) accumulateDirectory(
 	ra *accumulator.ResAccumulator, ldr ifc.Loader, isComponent bool) (*accumulator.ResAccumulator, error) {
 	defer ldr.Cleanup()
-	subKt := NewKustTarget(
-		ldr, kt.validator, kt.rFactory, kt.tFactory, kt.pLdr)
+	subKt := NewKustTarget(ldr, kt.validator, kt.rFactory, kt.pLdr)
 	err := subKt.Load()
 	if err != nil {
 		return nil, errors.Wrapf(

api/internal/target/kusttarget_configplugin.go

@@ -32,6 +32,7 @@ func (kt *KustTarget) configureBuiltinGenerators() (
 	for _, bpt := range []builtinhelpers.BuiltinPluginType{
 		builtinhelpers.ConfigMapGenerator,
 		builtinhelpers.SecretGenerator,
+		builtinhelpers.HelmChartInflationGenerator,
 	} {
 		r, err := generatorConfigurators[bpt](
 			kt, bpt, builtinhelpers.GeneratorFactories[bpt])
@@ -110,6 +111,23 @@ var generatorConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		}
 		return
 	},
+
+	builtinhelpers.HelmChartInflationGenerator: func(kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f gFactory) (
+		result []resmap.Generator, err error) {
+		var c struct {
+			types.HelmChartArgs
+		}
+		for _, args := range kt.kustomization.HelmChartInflationGenerator {
+			c.HelmChartArgs = args
+			p := f()
+			err := kt.configureBuiltinPlugin(p, c, bpt)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, p)
+		}
+		return
+	},
 }
 
 type tFactory func() resmap.TransformerPlugin
@@ -141,12 +159,12 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, _ *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
 		var c struct {
-			Target types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
-			Path   string            `json:"path,omitempty" yaml:"path,omitempty"`
-			JsonOp string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
+			Target *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
+			Path   string          `json:"path,omitempty" yaml:"path,omitempty"`
+			JsonOp string          `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
 		}
 		for _, args := range kt.kustomization.PatchesJson6902 {
-			c.Target = *args.Target
+			c.Target = args.Target
 			c.Path = args.Path
 			c.JsonOp = args.Patch
 			p := f()
@@ -165,8 +183,7 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			return
 		}
 		var c struct {
-			Paths   []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
-			Patches string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
+			Paths []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
 		}
 		c.Paths = kt.kustomization.PatchesStrategicMerge
 		p := f()

api/internal/target/kusttarget_test.go

@@ -8,9 +8,10 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/ifc"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
@@ -76,8 +77,7 @@ commonLabels:
 	}
 
 	kt := makeKustTargetWithRf(
-		t, th.GetFSys(), "/",
-		resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl()))
+		t, th.GetFSys(), "/", provider.NewDefaultDepProvider())
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
 			th.WriteK("/", tc.content)
@@ -148,7 +148,8 @@ metadata:
     {"op": "add", "path": "/spec/replica", "value": "3"}
 ]`)
 
-	resFactory := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+	pvd := provider.NewDefaultDepProvider()
+	resFactory := pvd.GetResourceFactory()
 
 	resources := []*resource.Resource{
 		resFactory.FromMapWithName("dply1", map[string]interface{}{
@@ -187,7 +188,7 @@ metadata:
 			"apiVersion": "v1",
 			"kind":       "Namespace",
 			"metadata": map[string]interface{}{
-				"name": "foo-ns1-bar",
+				"name": "ns1",
 				"labels": map[string]interface{}{
 					"app": "nginx",
 				},
@@ -201,7 +202,7 @@ metadata:
 				"apiVersion": "v1",
 				"kind":       "ConfigMap",
 				"metadata": map[string]interface{}{
-					"name":      "foo-literalConfigMap-bar-8d2dkb8k24",
+					"name":      "foo-literalConfigMap-bar-g5f6t456f5",
 					"namespace": "ns1",
 					"labels": map[string]interface{}{
 						"app": "nginx",
@@ -220,7 +221,7 @@ metadata:
 				"apiVersion": "v1",
 				"kind":       "Secret",
 				"metadata": map[string]interface{}{
-					"name":      "foo-secret-bar-9btc7bt4kb",
+					"name":      "foo-secret-bar-82c2g5f8f6",
 					"namespace": "ns1",
 					"labels": map[string]interface{}{
 						"app": "nginx",
@@ -243,19 +244,14 @@ metadata:
 			t.Fatalf("unexpected error %v", err)
 		}
 	}
+	expYaml, err := expected.AsYaml()
+	assert.NoError(t, err)
 
-	kt := makeKustTargetWithRf(
-		t, th.GetFSys(), "/whatever", resFactory)
-	err := kt.Load()
-	if err != nil {
-		t.Fatalf("unexpected Resources error %v", err)
-	}
+	kt := makeKustTargetWithRf(t, th.GetFSys(), "/whatever", pvd)
+	assert.NoError(t, kt.Load())
 	actual, err := kt.MakeCustomizedResMap()
-	if err != nil {
-		t.Fatalf("unexpected Resources error %v", err)
-	}
-
-	if err = expected.ErrorIfNotEqualLists(actual); err != nil {
-		t.Fatalf("unexpected inequality: %v", err)
-	}
+	assert.NoError(t, err)
+	actYaml, err := actual.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, expYaml, actYaml)
 }

api/internal/target/maker_test.go

@@ -7,14 +7,12 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/internal/k8sdeps/transformer"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
-	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/api/konfig"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 )
 
@@ -22,9 +20,7 @@ func makeAndLoadKustTarget(
 	t *testing.T,
 	fSys filesys.FileSystem,
 	root string) *target.KustTarget {
-	kt := makeKustTargetWithRf(
-		t, fSys, root,
-		resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl()))
+	kt := makeKustTargetWithRf(t, fSys, root, provider.NewDefaultDepProvider())
 	if err := kt.Load(); err != nil {
 		t.Fatalf("Unexpected load error %v", err)
 	}
@@ -35,17 +31,17 @@ func makeKustTargetWithRf(
 	t *testing.T,
 	fSys filesys.FileSystem,
 	root string,
-	resFact *resource.Factory) *target.KustTarget {
-	rf := resmap.NewFactory(resFact, transformer.NewFactoryImpl())
-	pc := konfig.DisabledPluginConfig()
+	pvd *provider.DepProvider) *target.KustTarget {
 	ldr, err := fLdr.NewLoader(fLdr.RestrictionRootOnly, root, fSys)
 	if err != nil {
 		t.Fatal(err)
 	}
+	rf := resmap.NewFactory(
+		pvd.GetResourceFactory(), pvd.GetConflictDetectorFactory())
+	pc := konfig.DisabledPluginConfig()
 	return target.NewKustTarget(
 		ldr,
 		valtest_test.MakeFakeValidator(),
 		rf,
-		transformer.NewFactoryImpl(),
 		pLdr.NewLoader(pc, rf))
 }

api/internal/target/multitransformer.go

@@ -1,7 +1,7 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package transform
+package target
 
 import (
 	"fmt"
@@ -17,8 +17,8 @@ type multiTransformer struct {
 
 var _ resmap.Transformer = &multiTransformer{}
 
-// NewMultiTransformer constructs a multiTransformer.
-func NewMultiTransformer(t []resmap.Transformer) resmap.Transformer {
+// newMultiTransformer constructs a multiTransformer.
+func newMultiTransformer(t []resmap.Transformer) resmap.Transformer {
 	r := &multiTransformer{
 		transformers:         make([]resmap.Transformer, len(t)),
 		checkConflictEnabled: false}
@@ -26,13 +26,15 @@ func NewMultiTransformer(t []resmap.Transformer) resmap.Transformer {
 	return r
 }
 
-// Transform prepends the name prefix.
+// Transform applies the member transformers in order to the resources,
+// optionally detecting and erroring on commutation conflict.
 func (o *multiTransformer) Transform(m resmap.ResMap) error {
 	if o.checkConflictEnabled {
 		return o.transformWithCheckConflict(m)
 	}
 	return o.transform(m)
 }
+
 func (o *multiTransformer) transform(m resmap.ResMap) error {
 	for _, t := range o.transformers {
 		err := t.Transform(m)

api/internal/tools/tools.go

@@ -21,5 +21,5 @@ import (
 	// major version increments in pluginator with each
 	// api release to allow this trick to work and not
 	// introduce cycles.
-	// _ "sigs.k8s.io/kustomize/pluginator/v2"
+	// _ "sigs.k8s.io/kustomize/cmd/pluginator/v2"
 )

api/internal/utils/errtimeout.go

@@ -0,0 +1,36 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+type errTimeOut struct {
+	duration time.Duration
+	cmd      string
+}
+
+func NewErrTimeOut(d time.Duration, c string) errTimeOut {
+	return errTimeOut{duration: d, cmd: c}
+}
+
+func (e errTimeOut) Error() string {
+	return fmt.Sprintf("hit %s timeout running '%s'", e.duration, e.cmd)
+}
+
+func IsErrTimeout(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(errTimeOut)
+	if ok {
+		return true
+	}
+	_, ok = errors.Cause(err).(errTimeOut)
+	return ok
+}

api/internal/utils/timedcall.go

@@ -0,0 +1,23 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"time"
+)
+
+// TimedCall runs fn, failing if it doesn't complete in the given duration.
+// The description is used in the timeout error message.
+func TimedCall(description string, d time.Duration, fn func() error) error {
+	done := make(chan error)
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	go func() { done <- fn() }()
+	select {
+	case err := <-done:
+		return err
+	case <-timer.C:
+		return NewErrTimeOut(d, description)
+	}
+}

api/internal/utils/timedcall_test.go

@@ -0,0 +1,64 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+const (
+	timeToWait = 10 * time.Millisecond
+	tooSlow    = 2 * timeToWait
+)
+
+func errMsg(msg string) string {
+	return fmt.Sprintf("hit %s timeout running '%s'", timeToWait, msg)
+}
+
+func TestTimedCallFastNoError(t *testing.T) {
+	err := TimedCall(
+		"fast no error", timeToWait,
+		func() error { return nil })
+	if !assert.NoError(t, err) {
+		t.Fatal(err)
+	}
+}
+
+func TestTimedCallFastWithError(t *testing.T) {
+	err := TimedCall(
+		"fast with error", timeToWait,
+		func() error { return assert.AnError })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, assert.AnError.Error())
+	} else {
+		t.Fail()
+	}
+}
+
+func TestTimedCallSlowNoError(t *testing.T) {
+	err := TimedCall(
+		"slow no error", timeToWait,
+		func() error { time.Sleep(tooSlow); return nil })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("slow no error"))
+	} else {
+		t.Fail()
+	}
+}
+
+func TestTimedCallSlowWithError(t *testing.T) {
+	err := TimedCall(
+		"slow with error", timeToWait,
+		func() error { time.Sleep(tooSlow); return assert.AnError })
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("slow with error"))
+	} else {
+		t.Fail()
+	}
+}

api/internal/validate/fieldvalidator.go

@@ -0,0 +1,68 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package validate
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// FieldValidator implements ifc.Validator to check
+// the values of various KRM string fields,
+// e.g. labels, annotations, names, namespaces.
+//
+// TODO: Have this use kyaml/yaml/internal/k8sgen/pkg/labels
+//  which has label and annotation validation code, but is internal
+//  so this impl would need to move to kyaml (a fine idea).
+type FieldValidator struct {
+}
+
+var _ ifc.Validator = (*FieldValidator)(nil)
+
+func NewFieldValidator() *FieldValidator {
+	return &FieldValidator{}
+}
+
+// TODO(#FieldValidator): implement MakeAnnotationValidator
+func (f FieldValidator) MakeAnnotationValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		return nil
+	}
+}
+
+// TODO(#FieldValidator): implement MakeAnnotationNameValidator
+func (f FieldValidator) MakeAnnotationNameValidator() func([]string) error {
+	return func(x []string) error {
+		return nil
+	}
+}
+
+// TODO(#FieldValidator): implement MakeLabelValidator
+func (f FieldValidator) MakeLabelValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		return nil
+	}
+}
+
+// TODO(#FieldValidator): implement MakeLabelNameValidator
+func (f FieldValidator) MakeLabelNameValidator() func([]string) error {
+	return func(x []string) error {
+		return nil
+	}
+}
+
+// TODO(#FieldValidator): implement ValidateNamespace
+func (f FieldValidator) ValidateNamespace(s string) []string {
+	var errs []string
+	return errs
+}
+
+// TODO(#FieldValidator): implement ErrIfInvalidKey
+func (f FieldValidator) ErrIfInvalidKey(s string) error {
+	return nil
+}
+
+// TODO(#FieldValidator): implement IsEnvVarName
+func (f FieldValidator) IsEnvVarName(k string) error {
+	return nil
+}

api/internal/validate/fieldvalidator_test.go

@@ -0,0 +1,4 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package validate_test

api/internal/wrappy/factory.go

@@ -0,0 +1,108 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package wrappy
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// WNodeFactory makes instances of WNode.
+//
+// These instances in turn adapt
+//   sigs.k8s.io/kustomize/kyaml/yaml.RNode
+// to implement ifc.Unstructured.
+// This factory is meant to implement ifc.KunstructuredFactory.
+//
+// This implementation should be thin, as both WNode and WNodeFactory must be
+// factored away (deleted) along with ifc.Kunstructured in favor of direct use
+// of RNode methods upon completion of
+// https://github.com/kubernetes-sigs/kustomize/issues/2506.
+//
+// See also api/krusty/internal/provider/depprovider.go
+type WNodeFactory struct {
+}
+
+var _ ifc.KunstructuredFactory = (*WNodeFactory)(nil)
+
+func (k *WNodeFactory) SliceFromBytes(bs []byte) ([]ifc.Kunstructured, error) {
+	yamlRNodes, err := kio.FromBytes(bs)
+	if err != nil {
+		return nil, err
+	}
+	var result []ifc.Kunstructured
+	for i := range yamlRNodes {
+		rn := yamlRNodes[i]
+		meta, err := rn.GetValidatedMetadata()
+		if err != nil {
+			return nil, err
+		}
+		if !shouldDropObject(meta) {
+			if foundNil, path := rn.HasNilEntryInList(); foundNil {
+				return nil, fmt.Errorf("empty item at %v in object %v", path, rn)
+			}
+			result = append(result, FromRNode(rn))
+		}
+	}
+	return result, nil
+}
+
+// shouldDropObject returns true if the resource should not be accumulated.
+func shouldDropObject(m yaml.ResourceMeta) bool {
+	_, y := m.ObjectMeta.Annotations[konfig.IgnoredByKustomizeResourceAnnotation]
+	return y
+}
+
+func (k *WNodeFactory) FromMap(m map[string]interface{}) ifc.Kunstructured {
+	rn, err := FromMap(m)
+	if err != nil {
+		// TODO(#WNodeFactory): handle or bubble error"
+		panic(err)
+	}
+	return rn
+}
+
+// kustHash computes a hash of an unstructured object.
+type kustHash struct{}
+
+// Hash returns a hash of the given object
+func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
+	node, err := filtersutil.GetRNode(m)
+	if err != nil {
+		return "", err
+	}
+	return hasher.HashRNode(node)
+}
+
+func (k *WNodeFactory) Hasher() ifc.KunstructuredHasher {
+	return &kustHash{}
+}
+
+// MakeConfigMap makes a wrapped configmap.
+func (k *WNodeFactory) MakeConfigMap(
+	ldr ifc.KvLoader, args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
+	rn, err := generators.MakeConfigMap(ldr, args)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(rn), nil
+}
+
+// MakeSecret makes a wrapped secret.
+func (k *WNodeFactory) MakeSecret(
+	ldr ifc.KvLoader, args *types.SecretArgs) (ifc.Kunstructured, error) {
+	rn, err := generators.MakeSecret(ldr, args)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(rn), nil
+}

api/internal/wrappy/factory_test.go

@@ -0,0 +1,321 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package wrappy_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/wrappy"
+)
+
+func TestHasher(t *testing.T) {
+	input := `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+data:
+  one: ""
+binaryData:
+  two: ""
+`
+	expect := "698h7c7t9m"
+
+	factory := &WNodeFactory{}
+	k, err := factory.SliceFromBytes([]byte(input))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	hasher := factory.Hasher()
+	result, err := hasher.Hash(k[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result != expect {
+		t.Fatalf("expect %s but got %s", expect, result)
+	}
+}
+
+func TestSliceFromBytes(t *testing.T) {
+	factory := &WNodeFactory{}
+	testConfigMap :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "winnie",
+			},
+		}
+	testConfigMapList :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMapList",
+			"items": []interface{}{
+				testConfigMap,
+				testConfigMap,
+			},
+		}
+	testDeploymentSpec := map[string]interface{}{
+		"template": map[string]interface{}{
+			"spec": map[string]interface{}{
+				"hostAliases": []interface{}{
+					map[string]interface{}{
+						"hostnames": []interface{}{
+							"a.example.com",
+						},
+						"ip": "8.8.8.8",
+					},
+				},
+			},
+		},
+	}
+	testDeploymentA := map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name": "deployment-a",
+		},
+		"spec": testDeploymentSpec,
+	}
+	testDeploymentB := map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name": "deployment-b",
+		},
+		"spec": testDeploymentSpec,
+	}
+	testDeploymentList :=
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "DeploymentList",
+			"items": []interface{}{
+				testDeploymentA,
+				testDeploymentB,
+			},
+		}
+
+	type expected struct {
+		out   []map[string]interface{}
+		isErr bool
+	}
+
+	testCases := map[string]struct {
+		input []byte
+		exp   expected
+	}{
+		"garbage": {
+			input: []byte("garbageIn: garbageOut"),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"noBytes": {
+			input: []byte{},
+			exp: expected{
+				out: []map[string]interface{}{},
+			},
+		},
+		"goodJson": {
+			input: []byte(`
+{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie"}}
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"goodYaml1": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"goodYaml2": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap, testConfigMap},
+			},
+		},
+		"localConfigYaml": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie-skip
+  annotations:
+    # this annotation causes the Resource to be ignored by kustomize
+    config.kubernetes.io/local-config: ""
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMap},
+			},
+		},
+		"garbageInOneOfTwoObjects": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+WOOOOOOOOOOOOOOOOOOOOOOOOT:  woot
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"emptyObjects": {
+			input: []byte(`
+---
+#a comment
+
+---
+
+`),
+			exp: expected{
+				out: []map[string]interface{}{},
+			},
+		},
+		"Missing .metadata.name in object": {
+			input: []byte(`
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    foo: bar
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"nil value in list": {
+			input: []byte(`
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: kube100-site
+	labels:
+	  app: web
+testList:
+- testA
+-
+`),
+			exp: expected{
+				isErr: true,
+			},
+		},
+		"List": {
+			input: []byte(`
+apiVersion: v1
+kind: List
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{
+					testConfigMap,
+					testConfigMap},
+			},
+		},
+		"ConfigMapList": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMapList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			exp: expected{
+				out: []map[string]interface{}{testConfigMapList},
+			},
+		},
+		"listWithAnchors": {
+			input: []byte(`
+apiVersion: v1
+kind: DeploymentList
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: deployment-a
+  spec: &hostAliases
+    template:
+      spec:
+        hostAliases:
+        - hostnames:
+          - a.example.com
+          ip: 8.8.8.8
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: deployment-b
+  spec:
+    <<: *hostAliases
+`),
+			exp: expected{
+				out: []map[string]interface{}{testDeploymentList},
+			},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			rs, err := factory.SliceFromBytes(tc.input)
+			if err != nil {
+				assert.True(t, tc.exp.isErr)
+				return
+			}
+			assert.False(t, tc.exp.isErr)
+			assert.Equal(t, len(tc.exp.out), len(rs))
+			for i := range rs {
+				assert.Equal(
+					t, fmt.Sprintf("%v", tc.exp.out[i]), fmt.Sprintf("%v", rs[i].Map()))
+				if n != "listWithAnchors" {
+					// https://github.com/kubernetes-sigs/kustomize/issues/3271
+					if !reflect.DeepEqual(tc.exp.out[i], rs[i].Map()) {
+						t.Fatalf("%s:\nexpected: %v\n  actual: %v",
+							n, tc.exp.out[i], rs[i].Map())
+					}
+				}
+			}
+		})
+	}
+}

api/internal/wrappy/wnode.go

@@ -0,0 +1,235 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package wrappy
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// WNode implements ifc.Kunstructured using yaml.RNode.
+//
+// It exists only to help manage a switch from
+// kunstruct.UnstructAdapter to yaml.RNode as the core
+// representation of KRM objects in kustomize.
+//
+// It's got a silly name because we don't want it around for long,
+// and want its use to be obvious.
+type WNode struct {
+	node *yaml.RNode
+}
+
+var _ ifc.Kunstructured = (*WNode)(nil)
+
+func NewWNode() *WNode {
+	return FromRNode(yaml.NewRNode(nil))
+}
+
+func FromMap(m map[string]interface{}) (*WNode, error) {
+	n, err := yaml.FromMap(m)
+	if err != nil {
+		return nil, err
+	}
+	return FromRNode(n), nil
+}
+
+func FromRNode(node *yaml.RNode) *WNode {
+	return &WNode{node: node}
+}
+
+func (wn *WNode) demandMetaData(label string) yaml.ResourceMeta {
+	meta, err := wn.node.GetMeta()
+	if err != nil {
+		// Log and die since interface doesn't allow error.
+		log.Fatalf("for %s', expected valid resource: %v", label, err)
+	}
+	return meta
+}
+
+// Copy implements ifc.Kunstructured.
+func (wn *WNode) Copy() ifc.Kunstructured {
+	return &WNode{node: wn.node.Copy()}
+}
+
+// GetAnnotations implements ifc.Kunstructured.
+func (wn *WNode) GetAnnotations() map[string]string {
+	return wn.demandMetaData("GetAnnotations").Annotations
+}
+
+// GetFieldValue implements ifc.Kunstructured.
+func (wn *WNode) GetFieldValue(path string) (interface{}, error) {
+	fields := strings.Split(path, ".")
+	rn, err := wn.node.Pipe(yaml.Lookup(fields...))
+	if err != nil {
+		return nil, err
+	}
+	if rn == nil {
+		return nil, NoFieldError{path}
+	}
+	yn := rn.YNode()
+
+	// If this is an alias node, resolve it
+	if yn.Kind == yaml.AliasNode {
+		yn = yn.Alias
+	}
+
+	// Return value as map for DocumentNode and MappingNode kinds
+	if yn.Kind == yaml.DocumentNode || yn.Kind == yaml.MappingNode {
+		var result map[string]interface{}
+		if err := yn.Decode(&result); err != nil {
+			return nil, err
+		}
+		return result, err
+	}
+
+	// Return value as slice for SequenceNode kind
+	if yn.Kind == yaml.SequenceNode {
+		var result []interface{}
+		if err := yn.Decode(&result); err != nil {
+			return nil, err
+		}
+		return result, nil
+	}
+
+	// Return value value directly for all other (ScalarNode) kinds
+	return yn.Value, nil
+}
+
+// GetGvk implements ifc.Kunstructured.
+func (wn *WNode) GetGvk() resid.Gvk {
+	meta := wn.demandMetaData("GetGvk")
+	g, v := resid.ParseGroupVersion(meta.APIVersion)
+	return resid.Gvk{Group: g, Version: v, Kind: meta.Kind}
+}
+
+// GetDataMap implements ifc.Kunstructured.
+func (wn *WNode) GetDataMap() map[string]string {
+	return wn.node.GetDataMap()
+}
+
+// SetDataMap implements ifc.Kunstructured.
+func (wn *WNode) SetDataMap(m map[string]string) {
+	wn.node.SetDataMap(m)
+}
+
+// GetKind implements ifc.Kunstructured.
+func (wn *WNode) GetKind() string {
+	return wn.demandMetaData("GetKind").Kind
+}
+
+// GetLabels implements ifc.Kunstructured.
+func (wn *WNode) GetLabels() map[string]string {
+	return wn.demandMetaData("GetLabels").Labels
+}
+
+// GetName implements ifc.Kunstructured.
+func (wn *WNode) GetName() string {
+	return wn.demandMetaData("GetName").Name
+}
+
+// GetSlice implements ifc.Kunstructured.
+func (wn *WNode) GetSlice(path string) ([]interface{}, error) {
+	value, err := wn.GetFieldValue(path)
+	if err != nil {
+		return nil, err
+	}
+	if sliceValue, ok := value.([]interface{}); ok {
+		return sliceValue, nil
+	}
+	return nil, fmt.Errorf("node %s is not a slice", path)
+}
+
+// GetSlice implements ifc.Kunstructured.
+func (wn *WNode) GetString(path string) (string, error) {
+	value, err := wn.GetFieldValue(path)
+	if err != nil {
+		return "", err
+	}
+	if v, ok := value.(string); ok {
+		return v, nil
+	}
+	return "", fmt.Errorf("node %s is not a string: %v", path, value)
+}
+
+// Map implements ifc.Kunstructured.
+func (wn *WNode) Map() map[string]interface{} {
+	var result map[string]interface{}
+	if err := wn.node.YNode().Decode(&result); err != nil {
+		// Log and die since interface doesn't allow error.
+		log.Fatalf("failed to decode ynode: %v", err)
+	}
+	return result
+}
+
+// MarshalJSON implements ifc.Kunstructured.
+func (wn *WNode) MarshalJSON() ([]byte, error) {
+	return wn.node.MarshalJSON()
+}
+
+// MatchesAnnotationSelector implements ifc.Kunstructured.
+func (wn *WNode) MatchesAnnotationSelector(selector string) (bool, error) {
+	return wn.node.MatchesAnnotationSelector(selector)
+}
+
+// MatchesLabelSelector implements ifc.Kunstructured.
+func (wn *WNode) MatchesLabelSelector(selector string) (bool, error) {
+	return wn.node.MatchesLabelSelector(selector)
+}
+
+// SetAnnotations implements ifc.Kunstructured.
+func (wn *WNode) SetAnnotations(annotations map[string]string) {
+	if err := wn.node.SetAnnotations(annotations); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
+}
+
+// SetGvk implements ifc.Kunstructured.
+func (wn *WNode) SetGvk(gvk resid.Gvk) {
+	wn.setMapField(yaml.NewScalarRNode(gvk.Kind), yaml.KindField)
+	wn.setMapField(yaml.NewScalarRNode(gvk.ApiVersion()), yaml.APIVersionField)
+}
+
+// SetLabels implements ifc.Kunstructured.
+func (wn *WNode) SetLabels(labels map[string]string) {
+	if err := wn.node.SetLabels(labels); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
+}
+
+// SetName implements ifc.Kunstructured.
+func (wn *WNode) SetName(name string) {
+	wn.setMapField(yaml.NewScalarRNode(name), yaml.MetadataField, yaml.NameField)
+}
+
+// SetNamespace implements ifc.Kunstructured.
+func (wn *WNode) SetNamespace(ns string) {
+	if err := wn.node.SetNamespace(ns); err != nil {
+		log.Fatal(err) // interface doesn't allow error.
+	}
+}
+
+func (wn *WNode) setMapField(value *yaml.RNode, path ...string) {
+	if err := wn.node.SetMapField(value, path...); err != nil {
+		// Log and die since interface doesn't allow error.
+		log.Fatalf("failed to set field %v: %v", path, err)
+	}
+}
+
+// UnmarshalJSON implements ifc.Kunstructured.
+func (wn *WNode) UnmarshalJSON(data []byte) error {
+	return wn.node.UnmarshalJSON(data)
+}
+
+type NoFieldError struct {
+	Field string
+}
+
+func (e NoFieldError) Error() string {
+	return fmt.Sprintf("no field named '%s'", e.Field)
+}

api/internal/wrappy/wnode_test.go

@@ -0,0 +1,585 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package wrappy
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"gopkg.in/yaml.v3"
+	"sigs.k8s.io/kustomize/api/resid"
+	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+const (
+	deploymentLittleJson = `{"apiVersion":"apps/v1","kind":"Deployment",` +
+		`"metadata":{"name":"homer","namespace":"simpsons"}}`
+
+	deploymentBiggerJson = `
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "name": "homer",
+    "namespace": "simpsons",
+    "labels": {
+      "fruit": "apple",
+      "veggie": "carrot"
+    },
+    "annotations": {
+      "area": "51",
+      "greeting": "Take me to your leader."
+    }
+  }
+}
+`
+	bigMapYaml = `Kind: Service
+complextree:
+  - field1:
+      - boolfield: true
+        floatsubfield: 1.01
+        intsubfield: 1010
+        stringsubfield: idx1010
+      - boolfield: false
+        floatsubfield: 1.011
+        intsubfield: 1011
+        stringsubfield: idx1011
+    field2:
+      - boolfield: true
+        floatsubfield: 1.02
+        intsubfield: 1020
+        stringsubfield: idx1020
+      - boolfield: false
+        floatsubfield: 1.021
+        intsubfield: 1021
+        stringsubfield: idx1021
+  - field1:
+      - boolfield: true
+        floatsubfield: 1.11
+        intsubfield: 1110
+        stringsubfield: idx1110
+      - boolfield: false
+        floatsubfield: 1.111
+        intsubfield: 1111
+        stringsubfield: idx1111
+    field2:
+      - boolfield: true
+        floatsubfield: 1.112
+        intsubfield: 1120
+        stringsubfield: idx1120
+      - boolfield: false
+        floatsubfield: 1.1121
+        intsubfield: 1121
+        stringsubfield: idx1121
+metadata:
+    labels:
+        app: application-name
+    name: service-name
+spec:
+    ports:
+        port: 80
+that:
+  - idx0
+  - idx1
+  - idx2
+  - idx3
+these:
+  - field1:
+      - idx010
+      - idx011
+    field2:
+      - idx020
+      - idx021
+  - field1:
+      - idx110
+      - idx111
+    field2:
+      - idx120
+      - idx121
+  - field1:
+      - idx210
+      - idx211
+    field2:
+      - idx220
+      - idx221
+this:
+    is:
+        aBool: true
+        aFloat: 1.001
+        aNilValue: null
+        aNumber: 1000
+        anEmptyMap: {}
+        anEmptySlice: []
+those:
+  - field1: idx0foo
+    field2: idx0bar
+  - field1: idx1foo
+    field2: idx1bar
+  - field1: idx2foo
+    field2: idx2bar
+`
+)
+
+func makeBigMap() map[string]interface{} {
+	return map[string]interface{}{
+		"Kind": "Service",
+		"metadata": map[string]interface{}{
+			"labels": map[string]interface{}{
+				"app": "application-name",
+			},
+			"name": "service-name",
+		},
+		"spec": map[string]interface{}{
+			"ports": map[string]interface{}{
+				"port": int64(80),
+			},
+		},
+		"this": map[string]interface{}{
+			"is": map[string]interface{}{
+				"aNumber":      int64(1000),
+				"aFloat":       float64(1.001),
+				"aNilValue":    nil,
+				"aBool":        true,
+				"anEmptyMap":   map[string]interface{}{},
+				"anEmptySlice": []interface{}{},
+				/*
+					TODO: test for unrecognizable (e.g. a function)
+						"unrecognizable": testing.InternalExample{
+							Name: "fooBar",
+						},
+				*/
+			},
+		},
+		"that": []interface{}{
+			"idx0",
+			"idx1",
+			"idx2",
+			"idx3",
+		},
+		"those": []interface{}{
+			map[string]interface{}{
+				"field1": "idx0foo",
+				"field2": "idx0bar",
+			},
+			map[string]interface{}{
+				"field1": "idx1foo",
+				"field2": "idx1bar",
+			},
+			map[string]interface{}{
+				"field1": "idx2foo",
+				"field2": "idx2bar",
+			},
+		},
+		"these": []interface{}{
+			map[string]interface{}{
+				"field1": []interface{}{"idx010", "idx011"},
+				"field2": []interface{}{"idx020", "idx021"},
+			},
+			map[string]interface{}{
+				"field1": []interface{}{"idx110", "idx111"},
+				"field2": []interface{}{"idx120", "idx121"},
+			},
+			map[string]interface{}{
+				"field1": []interface{}{"idx210", "idx211"},
+				"field2": []interface{}{"idx220", "idx221"},
+			},
+		},
+		"complextree": []interface{}{
+			map[string]interface{}{
+				"field1": []interface{}{
+					map[string]interface{}{
+						"stringsubfield": "idx1010",
+						"intsubfield":    int64(1010),
+						"floatsubfield":  float64(1.010),
+						"boolfield":      true,
+					},
+					map[string]interface{}{
+						"stringsubfield": "idx1011",
+						"intsubfield":    int64(1011),
+						"floatsubfield":  float64(1.011),
+						"boolfield":      false,
+					},
+				},
+				"field2": []interface{}{
+					map[string]interface{}{
+						"stringsubfield": "idx1020",
+						"intsubfield":    int64(1020),
+						"floatsubfield":  float64(1.020),
+						"boolfield":      true,
+					},
+					map[string]interface{}{
+						"stringsubfield": "idx1021",
+						"intsubfield":    int64(1021),
+						"floatsubfield":  float64(1.021),
+						"boolfield":      false,
+					},
+				},
+			},
+			map[string]interface{}{
+				"field1": []interface{}{
+					map[string]interface{}{
+						"stringsubfield": "idx1110",
+						"intsubfield":    int64(1110),
+						"floatsubfield":  float64(1.110),
+						"boolfield":      true,
+					},
+					map[string]interface{}{
+						"stringsubfield": "idx1111",
+						"intsubfield":    int64(1111),
+						"floatsubfield":  float64(1.111),
+						"boolfield":      false,
+					},
+				},
+				"field2": []interface{}{
+					map[string]interface{}{
+						"stringsubfield": "idx1120",
+						"intsubfield":    int64(1120),
+						"floatsubfield":  float64(1.1120),
+						"boolfield":      true,
+					},
+					map[string]interface{}{
+						"stringsubfield": "idx1121",
+						"intsubfield":    int64(1121),
+						"floatsubfield":  float64(1.1121),
+						"boolfield":      false,
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestBasicYamlOperationFromMap(t *testing.T) {
+	bytes, err := yaml.Marshal(makeBigMap())
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	if string(bytes) != bigMapYaml {
+		t.Fatalf("unexpected string equality")
+	}
+	rNode, err := kyaml.Parse(string(bytes))
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	rNodeString := rNode.MustString()
+	// The result from MustString has more indentation
+	// than bigMapYaml.
+	rNodeStrings := strings.Split(rNodeString, "\n")
+	bigMapStrings := strings.Split(bigMapYaml, "\n")
+	if len(rNodeStrings) != len(bigMapStrings) {
+		t.Fatalf("line count mismatch")
+	}
+	for i := range rNodeStrings {
+		s1 := strings.TrimSpace(rNodeStrings[i])
+		s2 := strings.TrimSpace(bigMapStrings[i])
+		if s1 != s2 {
+			t.Fatalf("expected '%s'=='%s'", s1, s2)
+		}
+	}
+}
+
+func TestRoundTripJSON(t *testing.T) {
+	wn := NewWNode()
+	err := wn.UnmarshalJSON([]byte(deploymentLittleJson))
+	if err != nil {
+		t.Fatalf("unexpected UnmarshalJSON err: %v", err)
+	}
+	data, err := wn.MarshalJSON()
+	if err != nil {
+		t.Fatalf("unexpected MarshalJSON err: %v", err)
+	}
+	actual := string(data)
+	if actual != deploymentLittleJson {
+		t.Fatalf("expected %s, got %s", deploymentLittleJson, actual)
+	}
+}
+
+func TestGettingFields(t *testing.T) {
+	wn := NewWNode()
+	err := wn.UnmarshalJSON([]byte(deploymentBiggerJson))
+	if err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	gvk := wn.GetGvk()
+	expected := "apps"
+	actual := gvk.Group
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	expected = "v1"
+	actual = gvk.Version
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	expected = "Deployment"
+	actual = gvk.Kind
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	actual = wn.GetKind()
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	expected = "homer"
+	actual = wn.GetName()
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	actualMap := wn.GetLabels()
+	v, ok := actualMap["fruit"]
+	if !ok || v != "apple" {
+		t.Fatalf("unexpected labels '%v'", actualMap)
+	}
+	actualMap = wn.GetAnnotations()
+	v, ok = actualMap["greeting"]
+	if !ok || v != "Take me to your leader." {
+		t.Fatalf("unexpected annotations '%v'", actualMap)
+	}
+}
+
+func TestGetFieldValueReturnsMap(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	expected := map[string]interface{}{
+		"fruit":  "apple",
+		"veggie": "carrot",
+	}
+	actual, err := wn.GetFieldValue("metadata.labels")
+	if err != nil {
+		t.Fatalf("error getting field value: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual map does not deep equal expected map:\n%v", diff)
+	}
+}
+
+func TestGetFieldValueReturnsSlice(t *testing.T) {
+	bytes, err := yaml.Marshal(makeBigMap())
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	rNode, err := kyaml.Parse(string(bytes))
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	wn := FromRNode(rNode)
+	expected := []interface{}{"idx0", "idx1", "idx2", "idx3"}
+	actual, err := wn.GetFieldValue("that")
+	if err != nil {
+		t.Fatalf("error getting slice: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual slice does not deep equal expected slice:\n%v", diff)
+	}
+}
+
+func TestGetFieldValueReturnsSliceOfMappings(t *testing.T) {
+	bytes, err := yaml.Marshal(makeBigMap())
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	rNode, err := kyaml.Parse(string(bytes))
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	wn := FromRNode(rNode)
+	expected := []interface{}{
+		map[string]interface{}{
+			"field1": "idx0foo",
+			"field2": "idx0bar",
+		},
+		map[string]interface{}{
+			"field1": "idx1foo",
+			"field2": "idx1bar",
+		},
+		map[string]interface{}{
+			"field1": "idx2foo",
+			"field2": "idx2bar",
+		},
+	}
+	actual, err := wn.GetFieldValue("those")
+	if err != nil {
+		t.Fatalf("error getting slice: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual slice does not deep equal expected slice:\n%v", diff)
+	}
+}
+
+func TestGetFieldValueReturnsString(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	actual, err := wn.GetFieldValue("metadata.labels.fruit")
+	if err != nil {
+		t.Fatalf("error getting field value: %v", err)
+	}
+	v, ok := actual.(string)
+	if !ok || v != "apple" {
+		t.Fatalf("unexpected value '%v'", actual)
+	}
+}
+
+func TestGetFieldValueResolvesAlias(t *testing.T) {
+	yamlWithAlias := `
+foo: &a theValue
+bar: *a
+`
+	rNode, err := kyaml.Parse(yamlWithAlias)
+	if err != nil {
+		t.Fatalf("unexpected yaml parse error: %v", err)
+	}
+	wn := FromRNode(rNode)
+	actual, err := wn.GetFieldValue("bar")
+	if err != nil {
+		t.Fatalf("error getting field value: %v", err)
+	}
+	v, ok := actual.(string)
+	if !ok || v != "theValue" {
+		t.Fatalf("unexpected value '%v'", actual)
+	}
+}
+
+func TestGetString(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	expected := "carrot"
+	actual, err := wn.GetString("metadata.labels.veggie")
+	if err != nil {
+		t.Fatalf("error getting string: %v", err)
+	}
+	if expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}
+
+func TestGetSlice(t *testing.T) {
+	bytes, err := yaml.Marshal(makeBigMap())
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	rNode, err := kyaml.Parse(string(bytes))
+	if err != nil {
+		t.Fatalf("unexpected yaml.Marshal err: %v", err)
+	}
+	wn := FromRNode(rNode)
+	expected := []interface{}{"idx0", "idx1", "idx2", "idx3"}
+	actual, err := wn.GetSlice("that")
+	if err != nil {
+		t.Fatalf("error getting slice: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual slice does not deep equal expected slice:\n%v", diff)
+	}
+}
+
+func TestMap(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentLittleJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+
+	expected := map[string]interface{}{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":      "homer",
+			"namespace": "simpsons",
+		},
+	}
+
+	actual := wn.Map()
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual map does not deep equal expected map:\n%v", diff)
+	}
+}
+
+func TestSetName(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	wn.SetName("marge")
+	if expected, actual := "marge", wn.GetName(); expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}
+
+func TestSetNamespace(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	wn.SetNamespace("flanders")
+	meta, _ := wn.node.GetMeta()
+	if expected, actual := "flanders", meta.Namespace; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}
+
+func TestSetLabels(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	wn.SetLabels(map[string]string{
+		"label1": "foo",
+		"label2": "bar",
+	})
+	labels := wn.GetLabels()
+	if expected, actual := 2, len(labels); expected != actual {
+		t.Fatalf("expected '%d', got '%d'", expected, actual)
+	}
+	if expected, actual := "foo", labels["label1"]; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	if expected, actual := "bar", labels["label2"]; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}
+
+func TestGetAnnotations(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	wn.SetAnnotations(map[string]string{
+		"annotation1": "foo",
+		"annotation2": "bar",
+	})
+	annotations := wn.GetAnnotations()
+	if expected, actual := 2, len(annotations); expected != actual {
+		t.Fatalf("expected '%d', got '%d'", expected, actual)
+	}
+	if expected, actual := "foo", annotations["annotation1"]; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	if expected, actual := "bar", annotations["annotation2"]; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}
+
+func TestSetGvk(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	wn.SetGvk(resid.GvkFromString("grp_ver_knd"))
+	gvk := wn.GetGvk()
+	if expected, actual := "grp", gvk.Group; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	if expected, actual := "ver", gvk.Version; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+	if expected, actual := "knd", gvk.Kind; expected != actual {
+		t.Fatalf("expected '%s', got '%s'", expected, actual)
+	}
+}

api/k8sdeps/kunstruct/factory.go

@@ -14,10 +14,15 @@ import (
 	"k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/k8sdeps/configmapandsecret"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-// KunstructuredFactoryImpl hides construction using apimachinery types.
+// KunstructuredFactoryImpl makes instances of UnstructAdapter.
+// These instances in turn adapt structs in
+//   k8s.io/apimachinery/pkg/apis/meta/v1/unstructured
+// to implement ifc.Kunstructured.
+// This factory is meant to implement ifc.KunstructuredFactory.
 type KunstructuredFactoryImpl struct {
 	hasher *kustHash
 }
@@ -112,10 +117,6 @@ func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error
 	return nil
 }
 
-// nonKustomizableResourceAnnotation if set on a Resource will cause Kustomize to
-// ignore the Resource rather than Kustomize it.
-const ignoredByKustomizeResourceAnnotation = "config.kubernetes.io/local-config"
-
 // skipResource returns true if the Resource should not be accumulated
 func (kf *KunstructuredFactoryImpl) skipResource(u unstructured.Unstructured) bool {
 	an := u.GetAnnotations()
@@ -124,7 +125,7 @@ func (kf *KunstructuredFactoryImpl) skipResource(u unstructured.Unstructured) bo
 		return false
 	}
 	// check if the Resource has opt-ed out of kustomize
-	_, found := an[ignoredByKustomizeResourceAnnotation]
+	_, found := an[konfig.IgnoredByKustomizeResourceAnnotation]
 	return found
 }
 

api/k8sdeps/kunstruct/hasher.go

@@ -4,13 +4,9 @@
 package kunstruct
 
 import (
-	"encoding/json"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"sigs.k8s.io/kustomize/api/hasher"
 	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 )
 
 // kustHash computes a hash of an unstructured object.
@@ -21,109 +17,11 @@ func NewKustHash() *kustHash {
 	return &kustHash{}
 }
 
-// Hash returns a hash of either a ConfigMap or a Secret
+// Hash returns a hash of the given object
 func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
-	u := unstructured.Unstructured{
-		Object: m.Map(),
-	}
-	kind := u.GetKind()
-	switch kind {
-	case "ConfigMap":
-		cm, err := unstructuredToConfigmap(u)
-		if err != nil {
-			return "", err
-		}
-		return configMapHash(cm)
-	case "Secret":
-		sec, err := unstructuredToSecret(u)
-
-		if err != nil {
-			return "", err
-		}
-		return secretHash(sec)
-	default:
-		return "", fmt.Errorf(
-			"type %s is not supported for hashing in %v",
-			kind, m.Map())
-	}
-}
-
-// configMapHash returns a hash of the ConfigMap.
-// The Data, Kind, and Name are taken into account.
-func configMapHash(cm *corev1.ConfigMap) (string, error) {
-	encoded, err := encodeConfigMap(cm)
+	node, err := filtersutil.GetRNode(m)
 	if err != nil {
 		return "", err
 	}
-	h, err := hasher.Encode(hasher.Hash(encoded))
-	if err != nil {
-		return "", err
-	}
-	return h, nil
-}
-
-// SecretHash returns a hash of the Secret.
-// The Data, Kind, Name, and Type are taken into account.
-func secretHash(sec *corev1.Secret) (string, error) {
-	encoded, err := encodeSecret(sec)
-	if err != nil {
-		return "", err
-	}
-	h, err := hasher.Encode(hasher.Hash(encoded))
-	if err != nil {
-		return "", err
-	}
-	return h, nil
-}
-
-// encodeConfigMap encodes a ConfigMap.
-// Data, Kind, and Name are taken into account.
-// BinaryData is included if it's not empty to avoid useless key in output.
-func encodeConfigMap(cm *corev1.ConfigMap) (string, error) {
-	// json.Marshal sorts the keys in a stable order in the encoding
-	m := map[string]interface{}{"kind": "ConfigMap", "name": cm.Name, "data": cm.Data}
-	if len(cm.BinaryData) > 0 {
-		m["binaryData"] = cm.BinaryData
-	}
-	data, err := json.Marshal(m)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-// encodeSecret encodes a Secret.
-// Data, Kind, Name, and Type are taken into account.
-// StringData is included if it's not empty to avoid useless key in output.
-func encodeSecret(sec *corev1.Secret) (string, error) {
-	// json.Marshal sorts the keys in a stable order in the encoding
-	m := map[string]interface{}{"kind": "Secret", "type": sec.Type, "name": sec.Name, "data": sec.Data}
-	if len(sec.StringData) > 0 {
-		m["stringData"] = sec.StringData
-	}
-	data, err := json.Marshal(m)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-func unstructuredToConfigmap(u unstructured.Unstructured) (*corev1.ConfigMap, error) {
-	marshaled, err := json.Marshal(u.Object)
-	if err != nil {
-		return nil, err
-	}
-	var out corev1.ConfigMap
-	err = json.Unmarshal(marshaled, &out)
-	return &out, err
-}
-
-func unstructuredToSecret(u unstructured.Unstructured) (*corev1.Secret, error) {
-	marshaled, err := json.Marshal(u.Object)
-	if err != nil {
-		return nil, err
-	}
-	var out corev1.Secret
-	err = json.Unmarshal(marshaled, &out)
-	return &out, err
+	return hasher.HashRNode(node)
 }

api/k8sdeps/kunstruct/hasher_test.go

@@ -1,190 +1,34 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
 package kunstruct
 
 import (
-	"reflect"
-	"strings"
 	"testing"
-
-	corev1 "k8s.io/api/core/v1"
 )
 
-func TestConfigMapHash(t *testing.T) {
-	cases := []struct {
-		desc string
-		cm   *corev1.ConfigMap
-		hash string
-		err  string
-	}{
-		// empty map
-		{"empty data", &corev1.ConfigMap{Data: map[string]string{}, BinaryData: map[string][]byte{}}, "42745tchd9", ""},
-		// one key
-		{"one key", &corev1.ConfigMap{Data: map[string]string{"one": ""}}, "9g67k2htb6", ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}}, "f5h7t85m9b", ""},
-		// empty binary data map
-		{"empty binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{}}, "dk855m5d49", ""},
-		// one key with binary data
-		{"one key with binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}}, "mk79584b8c", ""},
-		// three keys with binary data (tests sorting order)
-		{"three keys with binary data", &corev1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "t458mc6db2", ""},
-		// two keys, one with string and another with binary data
-		{"two keys with one each", &corev1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}}, "698h7c7t9m", ""},
-	}
-
-	for _, c := range cases {
-		h, err := configMapHash(c.cm)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if c.hash != h {
-			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
-		}
-	}
-}
-
-func TestSecretHash(t *testing.T) {
-	cases := []struct {
-		desc   string
-		secret *corev1.Secret
-		hash   string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.Secret{Type: "my-type", Data: map[string][]byte{}}, "t75bgf6ctb", ""},
-		// one key
-		{"one key", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, "74bd68bm66", ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "dgcb6h9tmk", ""},
-		// with stringdata
-		{"stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{"two": "2"}}, "ckm7f798g2", ""},
-		// empty stringdata
-		{"empty stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{}}, "74bd68bm66", ""},
-	}
-
-	for _, c := range cases {
-		h, err := secretHash(c.secret)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if c.hash != h {
-			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
-		}
-	}
-}
-
-func TestEncodeConfigMap(t *testing.T) {
-	cases := []struct {
-		desc   string
-		cm     *corev1.ConfigMap
-		expect string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.ConfigMap{Data: map[string]string{}}, `{"data":{},"kind":"ConfigMap","name":""}`, ""},
-		// one key
-		{"one key", &corev1.ConfigMap{Data: map[string]string{"one": ""}}, `{"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
-		// three keys (tests sorting order)
-		{"three keys", &corev1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}},
-			`{"data":{"one":"","three":"3","two":"2"},"kind":"ConfigMap","name":""}`, ""},
-		// empty binary map
-		{"empty data", &corev1.ConfigMap{BinaryData: map[string][]byte{}}, `{"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// one key with binary data
-		{"one key", &corev1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}},
-			`{"binaryData":{"one":""},"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// three keys with binary data (tests sorting order)
-		{"three keys", &corev1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}},
-			`{"binaryData":{"one":"","three":"Mw==","two":"Mg=="},"data":null,"kind":"ConfigMap","name":""}`, ""},
-		// two keys, one string and one binary values
-		{"two keys with one each", &corev1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}},
-			`{"binaryData":{"two":""},"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
-	}
-	for _, c := range cases {
-		s, err := encodeConfigMap(c.cm)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if s != c.expect {
-			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.cm)
-		}
-	}
-}
-
-func TestEncodeSecret(t *testing.T) {
-	cases := []struct {
-		desc   string
-		secret *corev1.Secret
-		expect string
-		err    string
-	}{
-		// empty map
-		{"empty data", &corev1.Secret{Type: "my-type", Data: map[string][]byte{}}, `{"data":{},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// one key
-		{"one key", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// three keys (tests sorting order) - note json.Marshal base64 encodes the values because they come in as []byte
-		{"three keys", &corev1.Secret{
-			Type: "my-type",
-			Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")},
-		},
-			`{"data":{"one":"","three":"Mw==","two":"Mg=="},"kind":"Secret","name":"","type":"my-type"}`, ""},
-		// with stringdata
-		{"stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{"two": "2"}},
-			`{"data":{"one":""},"kind":"Secret","name":"","stringData":{"two":"2"},"type":"my-type"}`, ""},
-		// empty stringdata
-		{"empty stringdata", &corev1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}, StringData: map[string]string{}},
-			`{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
-	}
-	for _, c := range cases {
-		s, err := encodeSecret(c.secret)
-		if SkipRest(t, c.desc, err, c.err) {
-			continue
-		}
-		if s != c.expect {
-			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.secret)
-		}
-	}
-}
-
-// warn devs who change types that they might have to update a hash function
-// not perfect, as it only checks the number of top-level fields
-func TestTypeStability(t *testing.T) {
-	errfmt := `case %q, expected %d fields but got %d
-Depending on the field(s) you added, you may need to modify the hash function for this type.
-To guide you: the hash function targets fields that comprise the contents of objects,
-not their metadata (e.g. the Data of a ConfigMap, but nothing in ObjectMeta).
+func TestHasher(t *testing.T) {
+	input := `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: foo
+data:
+  one: ""
+binaryData:
+  two: ""
 `
-	cases := []struct {
-		typeName string
-		obj      interface{}
-		expect   int
-	}{
-		{"ConfigMap", corev1.ConfigMap{}, 4},
-		{"Secret", corev1.Secret{}, 5},
-	}
-	for _, c := range cases {
-		val := reflect.ValueOf(c.obj)
-		if num := val.NumField(); c.expect != num {
-			t.Errorf(errfmt, c.typeName, c.expect, num)
-		}
-	}
-}
+	expect := "698h7c7t9m"
 
-// SkipRest returns true if there was a non-nil error or if we expected an error that didn't happen,
-// and logs the appropriate error on the test object.
-// The return value indicates whether we should skip the rest of the test case due to the error result.
-func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	factory := NewKunstructuredFactoryImpl()
+	k, err := factory.SliceFromBytes([]byte(input))
 	if err != nil {
-		if len(contains) == 0 {
-			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())
-		} else if !strings.Contains(err.Error(), contains) {
-			t.Errorf("case %q, expect error to contain %q but got %q", desc, contains, err.Error())
-		}
-		return true
-	} else if len(contains) > 0 {
-		t.Errorf("case %q, expect error to contain %q but got nil error", desc, contains)
-		return true
+		t.Fatal(err)
+	}
+
+	hasher := NewKustHash()
+	result, err := hasher.Hash(k[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result != expect {
+		t.Fatalf("expect %s but got %s", expect, result)
 	}
-	return false
 }

api/k8sdeps/kunstruct/unstructadapter.go

@@ -7,6 +7,7 @@ package kunstruct
 import (
 	"encoding/json"
 	"fmt"
+	"log"
 
 	jsonpatch "github.com/evanphx/json-patch"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -249,6 +250,29 @@ func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error)
 	return nil, NoFieldError{Field: path}
 }
 
+func (fs *UnstructAdapter) GetDataMap() map[string]string {
+	m, err := fs.GetStringMap("data")
+	if err != nil {
+		return map[string]string{}
+	}
+	return m
+}
+
+func (fs *UnstructAdapter) SetDataMap(m map[string]string) {
+	if m == nil {
+		unstructured.RemoveNestedField(fs.Object, "data")
+		return
+	}
+	s := make(map[string]interface{}, len(m))
+	for i, v := range m {
+		s[i] = v
+	}
+	err := unstructured.SetNestedMap(fs.Object, s, "data")
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
 // GetMap returns value at the given fieldpath.
 func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
 	content, fields, found, err := fs.selectSubtree(path)

api/k8sdeps/kunstruct/unstructadapter_test.go

@@ -6,6 +6,8 @@ package kunstruct
 import (
 	"reflect"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 var kunstructured = NewKunstructuredFactoryImpl().FromMap(map[string]interface{}{
@@ -466,278 +468,6 @@ func TestGetString(t *testing.T) {
 	}
 }
 
-func TestGetInt64(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		expectedValue int64
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "numberAsValue",
-			pathToField:   "this.is.aNumber",
-			errorExpected: false,
-			expectedValue: int64(1000),
-		},
-		{
-			name:          "validStructSubFieldIndexSubfield",
-			pathToField:   "complextree[1].field2[1].intsubfield",
-			errorExpected: false,
-			expectedValue: int64(1121),
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "no field named 'these[1].field2[99]'",
-		},
-		{
-			name:          "validDownwardAPISpecs",
-			pathToField:   `spec.ports['port']`,
-			errorExpected: false,
-			expectedValue: int64(80),
-		},
-	}
-
-	for _, test := range tests {
-		s, err := kunstructured.GetInt64(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
-	}
-}
-
-func TestGetFloat64(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		expectedValue float64
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "floatAsValue",
-			pathToField:   "this.is.aFloat",
-			errorExpected: false,
-			expectedValue: float64(1.001),
-		},
-		{
-			name:          "validStructSubFieldIndexSubfield",
-			pathToField:   "complextree[1].field2[1].floatsubfield",
-			errorExpected: false,
-			expectedValue: float64(1.1121),
-		},
-		{
-			name:          "validDownwardAPIThis",
-			pathToField:   `this.is[aFloat]`,
-			errorExpected: false,
-			expectedValue: float64(1.001),
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "index 99 is out of bounds",
-		},
-	}
-
-	for _, test := range tests {
-		s, err := kunstructured.GetFloat64(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
-	}
-}
-
-func TestGetBool(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		expectedValue bool
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "boolAsValue",
-			pathToField:   "this.is.aBool",
-			errorExpected: false,
-			expectedValue: true,
-		},
-		{
-			name:          "validStructSubFieldIndexSubfield",
-			pathToField:   "complextree[1].field2[1].boolfield",
-			errorExpected: false,
-			expectedValue: false,
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "no field named 'these[1].field2[99]'",
-		},
-	}
-
-	for _, test := range tests {
-		s, err := kunstructured.GetBool(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
-	}
-}
-
-func TestGetStringMap(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "validStringMap",
-			pathToField:   "those[2]",
-			errorExpected: false,
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "no field named 'these[1].field2[99]'",
-		},
-	}
-
-	for _, test := range tests {
-		_, err := kunstructured.GetStringMap(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-	}
-}
-
-func TestGetMap(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "validMap",
-			pathToField:   "those[2]",
-			errorExpected: false,
-		},
-		{
-			name:          "validStructSubFieldIndexSubfield",
-			pathToField:   "complextree[1].field2[1]",
-			errorExpected: false,
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "no field named 'these[1].field2[99]'",
-		},
-	}
-
-	for _, test := range tests {
-		_, err := kunstructured.GetMap(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-	}
-}
-
-func TestGetStringSlice(t *testing.T) {
-	tests := []struct {
-		name          string
-		pathToField   string
-		errorExpected bool
-		errorMsg      string
-	}{
-		{
-			name:          "validStringSlice",
-			pathToField:   "that",
-			errorExpected: false,
-		},
-		{
-			name:          "twoFieldsOneMissing",
-			pathToField:   "metadata.banana",
-			errorExpected: true,
-			errorMsg:      "no field named 'metadata.banana'",
-		},
-		{
-			name:          "validStructSubFieldOutOfBoundIndex",
-			pathToField:   "these[1].field2[99]",
-			errorExpected: true,
-			errorMsg:      "no field named 'these[1].field2[99]'",
-		},
-	}
-
-	for _, test := range tests {
-		_, err := kunstructured.GetStringSlice(test.pathToField)
-		if test.errorExpected {
-			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
-			continue
-		}
-		if err != nil {
-			unExpectedError(t, test.name, test.pathToField, err)
-		}
-	}
-}
-
 func TestGetSlice(t *testing.T) {
 	tests := []struct {
 		name          string
@@ -829,3 +559,139 @@ func compareValues(t *testing.T, name string, pathToField string, expectedValue
 		t.Logf("%T value at `%s`", typedV, pathToField)
 	}
 }
+
+func TestKunstGetDataMap(t *testing.T) {
+	emptyMap := map[string]string{}
+	testCases := map[string]struct {
+		theMap   map[string]interface{}
+		expected map[string]string
+	}{
+		"actuallyNil": {
+			theMap:   nil,
+			expected: emptyMap,
+		},
+		"empty": {
+			theMap:   map[string]interface{}{},
+			expected: emptyMap,
+		},
+		"mostlyEmpty": {
+			theMap: map[string]interface{}{
+				"hey": "there",
+			},
+			expected: emptyMap,
+		},
+		"noNameConfigMap": {
+			theMap: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "ConfigMap",
+			},
+			expected: emptyMap,
+		},
+		"configMap": {
+			theMap: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "ConfigMap",
+				"metadata": map[string]interface{}{
+					"name": "winnie",
+				},
+				"data": map[string]interface{}{
+					"wine":   "cabernet",
+					"truck":  "ford",
+					"rocket": "falcon9",
+					"planet": "mars",
+					"city":   "brownsville",
+				},
+			},
+			// order irrelevant, because assert.Equals is smart about maps.
+			expected: map[string]string{
+				"city":   "brownsville",
+				"wine":   "cabernet",
+				"planet": "mars",
+				"rocket": "falcon9",
+				"truck":  "ford",
+			},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			kunstr := NewKunstructuredFactoryImpl().FromMap(tc.theMap)
+			m := kunstr.GetDataMap()
+			if !assert.Equal(t, tc.expected, m) {
+				t.FailNow()
+			}
+		})
+	}
+}
+
+func TestKunstSetDataMap(t *testing.T) {
+	testCases := map[string]struct {
+		theMap   map[string]interface{}
+		input    map[string]string
+		expected map[string]string
+	}{
+		"empty": {
+			theMap: map[string]interface{}{},
+			input: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+			expected: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+		},
+		"replace": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+			expected: map[string]string{
+				"wine":  "cabernet",
+				"truck": "ford",
+			},
+		},
+		"clear1": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input:    map[string]string{},
+			expected: map[string]string{},
+		},
+		"clear2": {
+			theMap: map[string]interface{}{
+				"foo": 3,
+				"data": map[string]string{
+					"rocket": "falcon9",
+					"planet": "mars",
+				},
+			},
+			input:    nil,
+			expected: map[string]string{},
+		},
+	}
+
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			kunstr := NewKunstructuredFactoryImpl().FromMap(tc.theMap)
+			kunstr.SetDataMap(tc.input)
+			m := kunstr.GetDataMap()
+			if !assert.Equal(t, tc.expected, m) {
+				t.FailNow()
+			}
+		})
+	}
+}

api/k8sdeps/validator/kustvalidator.go

@@ -14,11 +14,14 @@ import (
 	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
+	"sigs.k8s.io/kustomize/api/ifc"
 )
 
 // KustValidator validates Labels and annotations by apimachinery
 type KustValidator struct{}
 
+var _ ifc.Validator = (*KustValidator)(nil)
+
 // NewKustValidator returns a KustValidator object
 func NewKustValidator() *KustValidator {
 	return &KustValidator{}

api/konfig/builtinpluginconsts/commonlabels.go

@@ -51,6 +51,11 @@ commonLabels:
   group: apps
   kind: Deployment
 
+- path: spec/template/spec/topologySpreadConstraints/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
 - path: spec/selector/matchLabels
   create: true
   kind: ReplicaSet
@@ -97,6 +102,11 @@ commonLabels:
   group: apps
   kind: StatefulSet
 
+- path: spec/template/spec/topologySpreadConstraints/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
 - path: spec/volumeClaimTemplates[]/metadata/labels
   create: true
   group: apps

api/konfig/builtinpluginconsts/images.go

@@ -4,7 +4,15 @@
 package builtinpluginconsts
 
 const (
-	// imageFieldSpecs is left empty since `containers` and `initContainers`
-	// of *ANY* kind in *ANY* path are builtin supported in code
-	imagesFieldSpecs = ``
+	imagesFieldSpecs = `
+images:
+- path: spec/containers[]/image
+  create: true
+- path: spec/initContainers[]/image
+  create: true
+- path: spec/template/spec/containers[]/image
+  create: true
+- path: spec/template/spec/initContainers[]/image
+  create: true
+`
 )