Merge pull request #4280 from KnVerey/more_releases

Add s390x and ppc64le binaries to releases

.github/workflows/go.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v2
       with:
-        go-version: ^1.13
+        go-version: ^1.16
       id: go
 
     - name: Check out code into the Go module directory
@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v2
         with:
-          go-version: ^1.13
+          go-version: ^1.16
         id: go
 
       - name: Check out code into the Go module directory
@@ -63,7 +63,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v2
         with:
-          go-version: ^1.13
+          go-version: ^1.16
         id: go
 
       - name: Check out code into the Go module directory
@@ -91,7 +91,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v2
         with:
-          go-version: ^1.13
+          go-version: ^1.16
         id: go
 
       - name: Check out code into the Go module directory

CONTRIBUTING.md

@@ -1,6 +1,25 @@
+[SIG-CLI]: https://github.com/kubernetes/community/tree/master/sig-cli
+[Slack channel]: https://kubernetes.slack.com/messages/kustomize
+[Mailing list]: https://groups.google.com/forum/#!forum/kubernetes-sig-cli
+
+[OWNERS file spec]: https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md
+[Kustomize OWNERS_ALIASES]: https://github.com/kubernetes-sigs/kustomize/blob/8049f7b1af52e8a7ec26faf6cf714f560d0043c5/OWNERS_ALIASES
+[SIG-CLI Teams]: https://github.com/kubernetes/org/blob/main/config/kubernetes-sigs/sig-cli/teams.yaml
+[Github permissions]: https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization#repository-access-for-each-permission-level
+
+[Contributor License Agreement]: https://git.k8s.io/community/CLA.md
+[Kubernetes Contributor Guide]: http://git.k8s.io/community/contributors/guide
+[Contributor Cheat Sheet]: https://git.k8s.io/community/contributors/guide/contributor-cheatsheet/README.md
+[CNCF Code of Conduct]: https://github.com/cncf/foundation/blob/master/code-of-conduct.md
+[Kubernetes Community Membership]: https://github.com/kubernetes/community/blob/master/community-membership.md
+
+[Contribution Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/
+[MacOS Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/mac/
+[Windows Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/windows/
+
 # Contributing Guidelines
 
-Welcome to Kubernetes. We are excited about the prospect of you joining our [community](https://github.com/kubernetes/community)! The Kubernetes community abides by the CNCF [code of conduct](code-of-conduct.md). Here is an excerpt:
+Welcome to Kubernetes. We are excited about the prospect of you joining our [community](https://github.com/kubernetes/community)! The Kubernetes community abides by the [CNCF Code of Conduct]. Here is an excerpt:
 
 _As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities._
 
@@ -8,13 +27,22 @@ _As contributors and maintainers of this project, and in the interest of fosteri
 
 Dev guides:
 
-- [Mac](docs/macDevGuide.md)
+- [Contribution Guide]
+- [MacOS Dev Guide]
+- [Windows Dev Guide]
 
-We have full documentation on how to get started contributing here:
+General resources for contributors:
 
-- [Contributor License Agreement](https://git.k8s.io/community/CLA.md) Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests
-- [Kubernetes Contributor Guide](http://git.k8s.io/community/contributors/guide) - Main contributor documentation, or you can just jump directly to the [contributing section](http://git.k8s.io/community/contributors/guide#contributing)
-- [Contributor Cheat Sheet](https://git.k8s.io/community/contributors/guide/contributor-cheatsheet/README.md) - Common resources for existing developers
+- [Contributor License Agreement] - Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests.
+- [Kubernetes Contributor Guide] - Main contributor documentation.
+- [Contributor Cheat Sheet] - Common resources for existing developers.
+
+Here are some additional ideas to help you get started with Kustomize:
+- Attend a Kustomize Bug Scrub. Check the [SIG-CLI] meetings list to find the next one.
+- Help triage issues by confirming validity and applying the appropriate `kind` label (e.g. comment `/kind bug`).
+- Pick up an issue to fix. Issues with the `help-wanted` label are a good place to start, but you can also look for any issue with the `triage/accepted` label and no assignee. Remember to `/assign` yourself to let others know you're working on it.
+- Help confirm new issues labelled `kind/bug` by reproducing them with the latest release.
+- Support Kustomize users by responding to questions on issues labelled `kind/support` or in the [Slack channel].
 
 ## Mentorship
 
@@ -22,19 +50,22 @@ We have full documentation on how to get started contributing here:
 
 ## Contributor Ladder
 
-Kustomize generally follows the [Kubernetes Community Membership](https://github.com/kubernetes/community/blob/master/community-membership.md) contributor ladder. Roles are as follows:
+Kustomize follows the [Kubernetes Community Membership] contributor ladder. Roles are as follows:
 
-1. Contributor: Anyone who actively contributes code, issues or reviews to the project. There are no Kustomize-specific requirements for this status. All contributors must [sign the CLA](https://github.com/kubernetes/community/tree/master/contributors/guide#prerequisites).
-1. Member/Reviewer: All Kubernetes-SIGs org members have LGTM rights on the Kustomize repo. There are no Kustomize-specific requirements. Kustomize does not currently have any formal reviewers, but the role will be created if there is interest.
-1. Maintainer/Approver: Highly experienced active reviewer and contributor to Kustomize. Has both LTGM and approval rights on the Kustomize repo, as well as [Github "maintain" rights](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization#repository-access-for-each-permission-level).
-1. Admin/Owner: Maintainer who sets technical direction and makes or approves design decisions for the project. Has LGTM and approval rights on the Kustomize repo as well as [Github "admin" rights](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization#repository-access-for-each-permission-level).
+1. Contributor: Anyone who actively contributes code, issues or reviews to the project. All contributors must sign the [Contributor License Agreement].
+1. Reviewer: Contributors with a history of review and authorship on Kustomize. Has LGTM rights on the Kustomize repo (as do all kubernetes-sigs org members). Active contributors are encouraged to join the reviewers list to be automatically pinged on PRs.
+1. Approver: Highly experienced active reviewer and contributor to Kustomize. Has both LTGM and approval rights on the Kustomize repo, as well as "maintain" [Github permissions].
+1. Owner: Approver who sets technical direction and makes or approves design decisions for the project. Has LGTM and approval rights on the Kustomize repo as well as "admin" [Github permissions].
+
+The kyaml module within the Kustomize repo has additional owners following the same ladder.
 
 Administrative notes:
-- Maintainers and admins must be added to the appropriate list both [in the Kustomize repo](https://github.com/kubernetes-sigs/kustomize/blob/8049f7b1af52e8a7ec26faf6cf714f560d0043c5/OWNERS_ALIASES) and [in the community repo](https://github.com/kubernetes/org/blob/main/config/kubernetes-sigs/sig-cli/teams.yaml). If this isn't done, the individual in question will lack either PR approval rights (Kustomize list) or the appropriate Github repository permissions (community list).
-- The spec for the OWNERS file is [in the community repo](https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md).
+
+- The [OWNERS file spec] is a useful resources in making changes.
+- Maintainers and admins must be added to the appropriate lists in both [Kustomize OWNERS_ALIASES] and [SIG-CLI Teams]. If this isn't done, the individual in question will lack either PR approval rights (Kustomize list) or the appropriate Github repository permissions (community list).
 
 
 ## Contact Information
 
-- [Slack channel](https://kubernetes.slack.com/messages/sig-cli)
-- [Mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-cli)
+- [Slack channel]
+- [Mailing list]

Makefile

@@ -4,12 +4,15 @@
 # Makefile for kustomize CLI and API.
 
 SHELL := /usr/bin/env bash
+GOOS = $(shell go env GOOS)
+GOARCH = $(shell go env GOARCH)
 MYGOBIN = $(shell go env GOBIN)
 ifeq ($(MYGOBIN),)
 MYGOBIN = $(shell go env GOPATH)/bin
 endif
 export PATH := $(MYGOBIN):$(PATH)
 MODULES := '"cmd/config" "api/" "kustomize/" "kyaml/"'
+LATEST_V4_RELEASE=v4.4.0
 
 # Provide defaults for REPO_OWNER and REPO_NAME if not present.
 # Typically these values would be provided by Prow.
@@ -29,7 +32,7 @@ verify-kustomize: \
 	lint-kustomize \
 	test-unit-kustomize-all \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-4.1
+	test-examples-kustomize-against-v4-release
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
@@ -42,7 +45,7 @@ prow-presubmit-check: \
 	test-unit-cmd-all \
 	test-go-mod \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-4.1
+	test-examples-kustomize-against-v4-release
 
 .PHONY: verify-kustomize-e2e
 verify-kustomize-e2e: test-examples-e2e-kustomize
@@ -226,7 +229,8 @@ generate-kustomize-api: $(MYGOBIN)/k8scopy
 
 .PHONY: test-unit-kustomize-api
 test-unit-kustomize-api: build-kustomize-api
-	cd api; go test ./...  -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"
+	cd api; go test ./...  -ldflags "-X sigs.k8s.io/kustomize/api/provenance.version=v444.333.222"; \
+	cd krusty; OPENAPI_TEST=true go test -run TestCustomOpenAPIFieldFromComponentWithOverlays
 
 .PHONY: test-unit-kustomize-plugins
 test-unit-kustomize-plugins:
@@ -276,8 +280,8 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-4.1: $(MYGOBIN)/mdrip
-	./hack/testExamplesAgainstKustomize.sh v4@v4.1.2
+test-examples-kustomize-against-v4-release: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v4@$(LATEST_V4_RELEASE)
 
 # linux only.
 # This is for testing an example plugin that
@@ -289,8 +293,8 @@ $(MYGOBIN)/kubeval:
 	( \
 		set -e; \
 		d=$(shell mktemp -d); cd $$d; \
-		wget https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz; \
-		tar xf kubeval-linux-amd64.tar.gz; \
+		wget https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-$(GOOS)-$(GOARCH).tar.gz; \
+		tar xf kubeval-$(GOOS)-$(GOARCH).tar.gz; \
 		mv kubeval $(MYGOBIN); \
 		rm -rf $$d; \
 	)
@@ -304,10 +308,10 @@ $(MYGOBIN)/helmV2:
 	( \
 		set -e; \
 		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=helm-v2.13.1-linux-amd64.tar.gz; \
+		tgzFile=helm-v2.13.1-$(GOOS)-$(GOARCH).tar.gz; \
 		wget https://storage.googleapis.com/kubernetes-helm/$$tgzFile; \
 		tar -xvzf $$tgzFile; \
-		mv linux-amd64/helm $(MYGOBIN)/helmV2; \
+		mv $(GOOS)-$(GOARCH)/helm $(MYGOBIN)/helmV2; \
 		rm -rf $$d \
 	)
 
@@ -317,10 +321,10 @@ $(MYGOBIN)/helmV3:
 	( \
 		set -e; \
 		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=helm-v3.5.3-linux-amd64.tar.gz; \
+		tgzFile=helm-v3.6.3-$(GOOS)-$(GOARCH).tar.gz; \
 		wget https://get.helm.sh/$$tgzFile; \
 		tar -xvzf $$tgzFile; \
-		mv linux-amd64/helm $(MYGOBIN)/helmV3; \
+		mv $(GOOS)-$(GOARCH)/helm $(MYGOBIN)/helmV3; \
 		rm -rf $$d \
 	)
 
@@ -328,7 +332,7 @@ $(MYGOBIN)/kind:
 	( \
         set -e; \
         d=$(shell mktemp -d); cd $$d; \
-        wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-$(shell uname)-amd64; \
+        wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-$(GOOS)-$(GOARCH); \
         chmod +x ./kind; \
         mv ./kind $(MYGOBIN); \
         rm -rf $$d; \
@@ -339,10 +343,10 @@ $(MYGOBIN)/gh:
 	( \
 		set -e; \
 		d=$(shell mktemp -d); cd $$d; \
-		tgzFile=gh_1.0.0_linux_amd64.tar.gz; \
+		tgzFile=gh_1.0.0_$(GOOS)_$(GOARCH).tar.gz; \
 		wget https://github.com/cli/cli/releases/download/v1.0.0/$$tgzFile; \
 		tar -xvzf $$tgzFile; \
-		mv gh_1.0.0_linux_amd64/bin/gh  $(MYGOBIN)/gh; \
+		mv gh_1.0.0_$(GOOS)_$(GOARCH)/bin/gh  $(MYGOBIN)/gh; \
 		rm -rf $$d \
 	)
 

OWNERS

@@ -1,4 +1,6 @@
 # See https://github.com/kubernetes/community/blob/master/community-membership.md
 approvers:
-  - kustomize-admins
-  - kustomize-maintainers
+  - kustomize-approvers
+
+reviewers:
+  - kustomize-reviewers

OWNERS_ALIASES

@@ -1,16 +1,30 @@
-# Keep *-admins and *-maintainers list in sync with corresponding lists in
+# Keep *-owners and *-approvers lists in sync with *-admins and *-maintainers in
 # https://github.com/kubernetes/org/blob/main/config/kubernetes-sigs/sig-cli/teams.yaml
 aliases:
-  kustomize-admins:
+  kustomize-owners:
     - knverey
     - monopole
     - pwittrock
-  kustomize-maintainers:
+  kustomize-approvers:
     - justinsb
-    - mortent
+    - knverey
+    - monopole
     - natasha41575
-    - phanimarupaka
-    - Shell32-Natsu
-  emeritus-maintainers:
-    - liujingfang1
+    - pwittrock
+  kustomize-reviewers:
+    - knverey
+    - monopole
+    - natasha41575
+
+  kyaml-approvers:
     - mengqiy
+    - mortent
+    - phanimarupaka
+  kyaml-reviewers:
+    - mengqiy
+    - mortent
+    - phanimarupaka
+
+  emeritus-approvers:
+    - liujingfang1
+    - Shell32-Natsu

README.md

@@ -32,6 +32,7 @@ will be reflected in the Kubernetes release notes.
 | < v1.14 | n/a |
 | v1.14-v1.20 | v2.0.3 |
 | v1.21 | v4.0.5 |
+| v1.22 | v4.2.0 |
 
 [v2.0.3]: /../../tree/v2.0.3
 [#2506]: https://github.com/kubernetes-sigs/kustomize/issues/2506
@@ -151,7 +152,7 @@ is governed by the [Kubernetes Code of Conduct].
 [`make`]: https://www.gnu.org/software/make
 [`sed`]: https://www.gnu.org/software/sed
 [DAM]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#declarative-application-management
-[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/0008-kustomize.md
+[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/2377-Kustomize/README.md
 [Kubernetes Code of Conduct]: code-of-conduct.md
 [applied]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#apply
 [base]: https://kubernetes-sigs.github.io/kustomize/api-reference/glossary#base

api/builtins/PatchJson6902Transformer.go

@@ -12,6 +12,7 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -78,12 +79,23 @@ func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
 		return err
 	}
 	for _, res := range resources {
+		internalAnnotations := kioutil.GetInternalAnnotations(&res.RNode)
+
 		err = res.ApplyFilter(patchjson6902.Filter{
 			Patch: p.JsonOp,
 		})
 		if err != nil {
 			return err
 		}
+
+		annotations := res.GetAnnotations()
+		for key, value := range internalAnnotations {
+			annotations[key] = value
+		}
+		err = res.SetAnnotations(annotations)
+		if err != nil {
+			return err
+		}
 	}
 	return nil
 }

api/builtins/PatchTransformer.go

@@ -12,6 +12,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/yaml"
 )
 
@@ -111,12 +112,19 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 	}
 	for _, res := range resources {
 		res.StorePreviousId()
+		internalAnnotations := kioutil.GetInternalAnnotations(&res.RNode)
 		err = res.ApplyFilter(patchjson6902.Filter{
 			Patch: p.Patch,
 		})
 		if err != nil {
 			return err
 		}
+
+		annotations := res.GetAnnotations()
+		for key, value := range internalAnnotations {
+			annotations[key] = value
+		}
+		err = res.SetAnnotations(annotations)
 	}
 	return nil
 }

api/filters/nameref/nameref.go

@@ -56,6 +56,7 @@ func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		// sanity check.
 		return nil, err
 	}
+	f.NameFieldToUpdate.Gvk = f.Referrer.GetGvk()
 	if err := node.PipeE(fieldspec.Filter{
 		FieldSpec: f.NameFieldToUpdate,
 		SetValue:  f.set,

api/filters/refvar/refvar_test.go

@@ -250,6 +250,7 @@ metadata:
   name: dep
   annotations:
     config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/index: '0'
 data:
   slice:
   - false
@@ -276,6 +277,7 @@ metadata:
   name: dep
   annotations:
     config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/index: '0'
 data:
   1: str
 : invalid map key: value='1', tag='` + yaml.NodeTagInt + `'`,

api/filters/replacement/replacement.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/internal/utils"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -48,6 +49,17 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targets []*types.T
 			if err != nil {
 				return nil, err
 			}
+
+			// filter targets by label and annotation selectors
+			selectByAnnoAndLabel, err := selectByAnnoAndLabel(n, t)
+			if err != nil {
+				return nil, err
+			}
+			if !selectByAnnoAndLabel {
+				continue
+			}
+
+			// filter targets by matching resource IDs
 			for _, id := range ids {
 				if id.IsSelectedBy(t.Select.ResId) && !rejectId(t.Reject, &id) {
 					err := applyToNode(n, value, t)
@@ -62,9 +74,37 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targets []*types.T
 	return nodes, nil
 }
 
+func selectByAnnoAndLabel(n *yaml.RNode, t *types.TargetSelector) (bool, error) {
+	if matchesSelect, err := matchesAnnoAndLabelSelector(n, t.Select); !matchesSelect || err != nil {
+		return false, err
+	}
+	for _, reject := range t.Reject {
+		if reject.AnnotationSelector == "" && reject.LabelSelector == "" {
+			continue
+		}
+		if m, err := matchesAnnoAndLabelSelector(n, reject); m || err != nil {
+			return false, err
+		}
+	}
+	return true, nil
+}
+
+func matchesAnnoAndLabelSelector(n *yaml.RNode, selector *types.Selector) (bool, error) {
+	r := resource.Resource{RNode: *n}
+	annoMatch, err := r.MatchesAnnotationSelector(selector.AnnotationSelector)
+	if err != nil {
+		return false, err
+	}
+	labelMatch, err := r.MatchesLabelSelector(selector.LabelSelector)
+	if err != nil {
+		return false, err
+	}
+	return annoMatch && labelMatch, nil
+}
+
 func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
 	for _, r := range rejects {
-		if id.IsSelectedBy(r.ResId) {
+		if !r.ResId.IsEmpty() && id.IsSelectedBy(r.ResId) {
 			return true
 		}
 	}
@@ -131,10 +171,11 @@ func getReplacement(nodes []*yaml.RNode, r *types.Replacement) (*yaml.RNode, err
 	if err != nil {
 		return nil, err
 	}
-	if !rn.IsNilOrEmpty() {
-		return getRefinedValue(r.Source.Options, rn)
+	if rn.IsNilOrEmpty() {
+		return nil, fmt.Errorf("fieldPath `%s` is missing for replacement source %s", r.Source.FieldPath, r.Source)
 	}
-	return rn, nil
+
+	return getRefinedValue(r.Source.Options, rn)
 }
 
 func getRefinedValue(options *types.FieldOptions, rn *yaml.RNode) (*yaml.RNode, error) {

api/filters/replacement/replacement_test.go

@@ -1514,9 +1514,9 @@ kind: Deployment
 metadata:
   name: pre-deploy
   annotations: 
-    config.kubernetes.io/previousNames: deploy,deploy
-    config.kubernetes.io/previousKinds: CronJob,Deployment
-    config.kubernetes.io/previousNamespaces: default,default
+    internal.config.kubernetes.io/previousNames: deploy,deploy
+    internal.config.kubernetes.io/previousKinds: CronJob,Deployment
+    internal.config.kubernetes.io/previousNamespaces: default,default
 spec:
   template:
     spec:
@@ -1543,9 +1543,9 @@ kind: Deployment
 metadata:
   name: pre-deploy
   annotations:
-    config.kubernetes.io/previousNames: deploy,deploy
-    config.kubernetes.io/previousKinds: CronJob,Deployment
-    config.kubernetes.io/previousNamespaces: default,default
+    internal.config.kubernetes.io/previousNames: deploy,deploy
+    internal.config.kubernetes.io/previousKinds: CronJob,Deployment
+    internal.config.kubernetes.io/previousNamespaces: default,default
 spec:
   template:
     spec:
@@ -1554,6 +1554,262 @@ spec:
         name: nginx-tagged
       - image: nginx:1.7.9
         name: postgresdb
+`,
+		},
+
+		"replacement source.fieldPath does not exist": {
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ports-from
+data:
+  grpcPort: 8080
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ports-to
+data:
+  grpcPort: 8081
+`,
+			replacements: `replacements:
+- source:
+    kind: ConfigMap
+    name: ports-from
+    fieldPath: data.httpPort
+  targets:
+  - select:
+      kind: ConfigMap
+      name: ports-to
+    fieldPaths:
+    - data.grpcPort
+    options:
+      create: true
+`,
+			expectedErr: "fieldPath `data.httpPort` is missing for replacement source ~G_~V_ConfigMap|~X|ports-from:data.httpPort",
+		},
+		"annotationSelector": {
+			input: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  annotations:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  annotations:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+
+`,
+			replacements: `replacements:
+- source:
+    kind: Deployment
+    name: deploy-1
+    fieldPath: spec.template.spec.containers.0.image
+  targets:
+  - select:
+      annotationSelector: foo=bar-1
+    fieldPaths: 
+    - spec.template.spec.containers.1.image
+`,
+			expected: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  annotations:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:1.7.9
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  annotations:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+`,
+		},
+		"labelSelector": {
+			input: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  labels:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  labels:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+
+`,
+			replacements: `replacements:
+- source:
+    kind: Deployment
+    name: deploy-1
+    fieldPath: spec.template.spec.containers.0.image
+  targets:
+  - select:
+      labelSelector: foo=bar-1
+    fieldPaths: 
+    - spec.template.spec.containers.1.image
+`,
+			expected: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  labels:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:1.7.9
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  labels:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+`,
+		},
+		"reject via labelSelector": {
+			input: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  labels:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  labels:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
+
+`,
+			replacements: `replacements:
+- source:
+    kind: Deployment
+    name: deploy-1
+    fieldPath: spec.template.spec.containers.0.image
+  targets:
+  - select:
+      kind: Deployment
+    reject:
+    - labelSelector: foo=bar-2
+    fieldPaths: 
+    - spec.template.spec.containers.1.image
+`,
+			expected: `apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-1
+  labels:
+    foo: bar-1
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: nginx:1.7.9
+        name: postgresdb
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: deploy-2
+  labels:
+    foo: bar-2
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx-tagged
+      - image: postgres:1.8.0
+        name: postgresdb
 `,
 		},
 	}

api/go.mod

@@ -11,6 +11,8 @@ require (
 	github.com/stretchr/testify v1.5.1
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e
-	sigs.k8s.io/kustomize/kyaml v0.11.0
+	sigs.k8s.io/kustomize/kyaml v0.12.0
 	sigs.k8s.io/yaml v1.2.0
 )
+
+replace sigs.k8s.io/kustomize/kyaml => ../kyaml

api/go.sum

@@ -223,8 +223,6 @@ k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e h1:KLHHjkdQFomZy8+06csTWZ0m1343QqxZhR2LJ1OxCYM=
 k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
-sigs.k8s.io/kustomize/kyaml v0.11.0 h1:9KhiCPKaVyuPcgOLJXkvytOvjMJLoxpjodiycb4gHsA=
-sigs.k8s.io/kustomize/kyaml v0.11.0/go.mod h1:GNMwjim4Ypgp/MueD3zXHLRJEjz7RvtPae0AwlvEMFM=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

api/internal/accumulator/namereferencetransformer.go

@@ -11,6 +11,7 @@ import (
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/kyaml/resid"
 )
 
 type nameReferenceTransformer struct {
@@ -109,11 +110,18 @@ func debug(fMap filterMap) {
 // 'spec/scaleTargetRef/name' field. Return a filter that can do that.
 func (t *nameReferenceTransformer) determineFilters(
 	resources []*resource.Resource) (fMap filterMap) {
+
+	// We cache the resource OrgId values because they don't change and otherwise are very visible in a memory pprof
+	resourceOrgIds := make([]resid.ResId, len(resources))
+	for i, resource := range resources {
+		resourceOrgIds[i] = resource.OrgId()
+	}
+
 	fMap = make(filterMap)
 	for _, backReference := range t.backRefs {
 		for _, referrerSpec := range backReference.Referrers {
-			for _, res := range resources {
-				if res.OrgId().IsSelected(&referrerSpec.Gvk) {
+			for i, res := range resources {
+				if resourceOrgIds[i].IsSelected(&referrerSpec.Gvk) {
 					// If this is true, the res might be a referrer, and if
 					// so, the name reference it holds might need an update.
 					if resHasField(res, referrerSpec.Path) {

api/internal/accumulator/namereferencetransformer_test.go

@@ -897,7 +897,9 @@ func TestNameReferenceClusterWide(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	expected.RemoveBuildAnnotations()
 	m.RemoveBuildAnnotations()
+
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
 		t.Fatalf(notEqualErrFmt, err)
 	}

api/internal/accumulator/resaccumulator.go

@@ -168,3 +168,23 @@ func (ra *ResAccumulator) FixBackReferences() (err error) {
 	return ra.Transform(
 		newNameReferenceTransformer(ra.tConfig.NameReference))
 }
+
+// Intersection drops the resources which "other" does not have.
+func (ra *ResAccumulator) Intersection(other resmap.ResMap) error {
+	for _, curId := range ra.resMap.AllIds() {
+		toDelete := true
+		for _, otherId := range other.AllIds() {
+			if otherId == curId {
+				toDelete = false
+				break
+			}
+		}
+		if toDelete {
+			err := ra.resMap.Remove(curId)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

api/internal/accumulator/resaccumulator_test.go

@@ -362,10 +362,10 @@ func TestResolveVarsWithNoambiguation(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name": "sub-backendOne",
 				"annotations": map[string]interface{}{
-					"config.kubernetes.io/previousKinds":      "Service",
-					"config.kubernetes.io/previousNames":      "backendOne",
-					"config.kubernetes.io/previousNamespaces": "default",
-					"config.kubernetes.io/prefixes":           "sub-",
+					"internal.config.kubernetes.io/previousKinds":      "Service",
+					"internal.config.kubernetes.io/previousNames":      "backendOne",
+					"internal.config.kubernetes.io/previousNamespaces": "default",
+					"internal.config.kubernetes.io/prefixes":           "sub-",
 				},
 			}}).ResMap()
 

api/internal/git/repospec.go

@@ -125,7 +125,7 @@ func parseGitUrl(n string) (
 		index := strings.Index(n, gitSuffix)
 		orgRepo = n[0:index]
 		n = n[index+len(gitSuffix):]
-		if n[0] == '/' {
+		if len(n) > 0 && n[0] == '/' {
 			n = n[1:]
 		}
 		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n)

api/internal/git/repospec_test.go

@@ -182,6 +182,12 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 			absPath:   notCloned.String(),
 			ref:       "",
 		},
+		"t12": {
+			input:     "https://bitbucket.example.com/scm/project/repository.git",
+			cloneSpec: "https://bitbucket.example.com/scm/project/repository.git",
+			absPath:   notCloned.String(),
+			ref:       "",
+		},
 	}
 	for tn, tc := range testcases {
 		t.Run(tn, func(t *testing.T) {

api/internal/plugins/fnplugin/fnplugin.go

@@ -79,6 +79,7 @@ func NewFnPlugin(o *types.FnPluginLoadingOptions) *FnPlugin {
 			StorageMounts:  toStorageMounts(o.Mounts),
 			Env:            o.Env,
 			AsCurrentUser:  o.AsCurrentUser,
+			WorkingDir:     o.WorkingDir,
 		},
 	}
 }

api/internal/plugins/loader/loader.go

@@ -47,6 +47,11 @@ func (l *Loader) Config() *types.PluginConfig {
 	return l.pc
 }
 
+// SetWorkDir sets the working directory for this loader's plugins
+func (l *Loader) SetWorkDir(wd string) {
+	l.pc.FnpLoadingOptions.WorkingDir = wd
+}
+
 func (l *Loader) LoadGenerators(
 	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]resmap.Generator, error) {
 	var result []resmap.Generator

api/internal/plugins/utils/utils.go

@@ -231,10 +231,10 @@ func UpdateResourceOptions(rm resmap.ResMap) (resmap.ResMap, error) {
 		if err := r.SetAnnotations(annotations); err != nil {
 			return nil, err
 		}
-		r.SetOptions(types.NewGenArgs(
-			&types.GeneratorArgs{
-				Behavior: behavior,
-				Options:  &types.GeneratorOptions{DisableNameSuffixHash: !needsHash}}))
+		if needsHash {
+			r.EnableHashSuffix()
+		}
+		r.SetBehavior(types.NewGenerationBehavior(behavior))
 	}
 	return rm, nil
 }

api/internal/target/kusttarget.go

@@ -10,14 +10,17 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
+
 	"sigs.k8s.io/kustomize/api/builtins"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/loader"
+	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/yaml"
@@ -38,11 +41,13 @@ func NewKustTarget(
 	validator ifc.Validator,
 	rFactory *resmap.Factory,
 	pLdr *loader.Loader) *KustTarget {
+	pLdrCopy := *pLdr
+	pLdrCopy.SetWorkDir(ldr.Root())
 	return &KustTarget{
 		ldr:       ldr,
 		validator: validator,
 		rFactory:  rFactory,
-		pLdr:      pLdr,
+		pLdr:      &pLdrCopy,
 	}
 }
 
@@ -108,7 +113,7 @@ func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
 }
 
 func (kt *KustTarget) makeCustomizedResMap() (resmap.ResMap, error) {
-	ra, err := kt.AccumulateTarget()
+	ra, err := kt.AccumulateTarget(&resource.Origin{})
 	if err != nil {
 		return nil, err
 	}
@@ -151,20 +156,29 @@ func (kt *KustTarget) addHashesToNames(
 // holding customized resources and the data/rules used
 // to do so.  The name back references and vars are
 // not yet fixed.
-func (kt *KustTarget) AccumulateTarget() (
+// The origin parameter is used through the recursive calls
+// to annotate each resource with information about where
+// the resource came from, e.g. the file and/or the repository
+// it originated from.
+// As an entrypoint, one can pass an empty resource.Origin object to
+// AccumulateTarget. As AccumulateTarget moves recursively
+// through kustomization directories, it updates `origin.path`
+// accordingly. When a remote base is found, it updates `origin.repo`
+// and `origin.ref` accordingly.
+func (kt *KustTarget) AccumulateTarget(origin *resource.Origin) (
 	ra *accumulator.ResAccumulator, err error) {
-	return kt.accumulateTarget(accumulator.MakeEmptyAccumulator())
+	return kt.accumulateTarget(accumulator.MakeEmptyAccumulator(), origin)
 }
 
 // ra should be empty when this KustTarget is a Kustomization, or the ra of the parent if this KustTarget is a Component
 // (or empty if the Component does not have a parent).
-func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
+func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator, origin *resource.Origin) (
 	resRa *accumulator.ResAccumulator, err error) {
-	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources)
+	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources, origin)
 	if err != nil {
 		return nil, errors.Wrap(err, "accumulating resources")
 	}
-	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components)
+	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components, origin)
 	if err != nil {
 		return nil, errors.Wrap(err, "accumulating components")
 	}
@@ -205,9 +219,26 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 		return nil, errors.Wrapf(
 			err, "merging vars %v", kt.kustomization.Vars)
 	}
+	err = kt.IgnoreLocal(ra)
+	if err != nil {
+		return nil, err
+	}
 	return ra, nil
 }
 
+// IgnoreLocal drops the local resource by checking the annotation "config.kubernetes.io/local-config".
+func (kt *KustTarget) IgnoreLocal(ra *accumulator.ResAccumulator) error {
+	rf := kt.rFactory.RF()
+	if rf.IncludeLocalConfigs {
+		return nil
+	}
+	remainRes, err := rf.DropLocalNodes(ra.ResMap().ToRNodeSlice())
+	if err != nil {
+		return err
+	}
+	return ra.Intersection(kt.rFactory.FromResourceSlice(remainRes))
+}
+
 func (kt *KustTarget) runGenerators(
 	ra *accumulator.ResAccumulator) error {
 	var generators []resmap.Generator
@@ -247,7 +278,7 @@ func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error)
 		}
 		ra.AppendAll(rm)
 	}
-	ra, err := kt.accumulateResources(ra, generatorPaths)
+	ra, err := kt.accumulateResources(ra, generatorPaths, &resource.Origin{})
 	if err != nil {
 		return nil, err
 	}
@@ -283,8 +314,7 @@ func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]re
 		}
 		ra.AppendAll(rm)
 	}
-	ra, err := kt.accumulateResources(ra, transformerPaths)
-
+	ra, err := kt.accumulateResources(ra, transformerPaths, &resource.Origin{})
 	if err != nil {
 		return nil, err
 	}
@@ -332,16 +362,16 @@ func (kt *KustTarget) removeValidatedByLabel(rm resmap.ResMap) error {
 // accumulateResources fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateResources(
-	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, paths []string, origin *resource.Origin) (*accumulator.ResAccumulator, error) {
 	for _, path := range paths {
 		// try loading resource as file then as base (directory or git repository)
-		if errF := kt.accumulateFile(ra, path); errF != nil {
+		if errF := kt.accumulateFile(ra, path, origin); errF != nil {
 			ldr, err := kt.ldr.New(path)
 			if err != nil {
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
 			}
-			ra, err = kt.accumulateDirectory(ra, ldr, false)
+			ra, err = kt.accumulateDirectory(ra, ldr, origin.Append(path), false)
 			if err != nil {
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
@@ -354,7 +384,7 @@ func (kt *KustTarget) accumulateResources(
 // accumulateResources fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateComponents(
-	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, paths []string, origin *resource.Origin) (*accumulator.ResAccumulator, error) {
 	for _, path := range paths {
 		// Components always refer to directories
 		ldr, errL := kt.ldr.New(path)
@@ -362,7 +392,8 @@ func (kt *KustTarget) accumulateComponents(
 			return nil, fmt.Errorf("loader.New %q", errL)
 		}
 		var errD error
-		ra, errD = kt.accumulateDirectory(ra, ldr, true)
+		origin.Path = filepath.Join(origin.Path, path)
+		ra, errD = kt.accumulateDirectory(ra, ldr, origin, true)
 		if errD != nil {
 			return nil, fmt.Errorf("accumulateDirectory: %q", errD)
 		}
@@ -371,7 +402,7 @@ func (kt *KustTarget) accumulateComponents(
 }
 
 func (kt *KustTarget) accumulateDirectory(
-	ra *accumulator.ResAccumulator, ldr ifc.Loader, isComponent bool) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, ldr ifc.Loader, origin *resource.Origin, isComponent bool) (*accumulator.ResAccumulator, error) {
 	defer ldr.Cleanup()
 	subKt := NewKustTarget(ldr, kt.validator, kt.rFactory, kt.pLdr)
 	err := subKt.Load()
@@ -379,6 +410,7 @@ func (kt *KustTarget) accumulateDirectory(
 		return nil, errors.Wrapf(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
+	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
 	var bytes []byte
 	path := ldr.Root()
 	if openApiPath, exists := subKt.Kustomization().OpenAPI["path"]; exists {
@@ -402,12 +434,12 @@ func (kt *KustTarget) accumulateDirectory(
 	var subRa *accumulator.ResAccumulator
 	if isComponent {
 		// Components don't create a new accumulator: the kustomization directives are added to the current accumulator
-		subRa, err = subKt.accumulateTarget(ra)
+		subRa, err = subKt.accumulateTarget(ra, origin)
 		ra = accumulator.MakeEmptyAccumulator()
 	} else {
 		// Child Kustomizations create a new accumulator which resolves their kustomization directives, which will later
 		// be merged into the current accumulator.
-		subRa, err = subKt.AccumulateTarget()
+		subRa, err = subKt.AccumulateTarget(origin)
 	}
 	if err != nil {
 		return nil, errors.Wrapf(
@@ -422,11 +454,18 @@ func (kt *KustTarget) accumulateDirectory(
 }
 
 func (kt *KustTarget) accumulateFile(
-	ra *accumulator.ResAccumulator, path string) error {
+	ra *accumulator.ResAccumulator, path string, origin *resource.Origin) error {
 	resources, err := kt.rFactory.FromFile(kt.ldr, path)
 	if err != nil {
 		return errors.Wrapf(err, "accumulating resources from '%s'", path)
 	}
+	if utils.StringSliceContains(kt.kustomization.BuildMetadata, "originAnnotations") {
+		origin = origin.Append(path)
+		err = resources.AnnotateAll(utils.OriginAnnotation, origin.String())
+		if err != nil {
+			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+		}
+	}
 	err = ra.AppendAll(resources)
 	if err != nil {
 		return errors.Wrapf(err, "merging resources from '%s'", path)

api/internal/target/kusttarget_test.go

@@ -255,5 +255,5 @@ metadata:
 	actual.RemoveBuildAnnotations()
 	actYaml, err := actual.AsYaml()
 	assert.NoError(t, err)
-	assert.Equal(t, expYaml, actYaml)
+	assert.Equal(t, string(expYaml), string(actYaml))
 }

api/internal/target/vars_test.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"sigs.k8s.io/kustomize/api/resource"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
@@ -65,7 +66,7 @@ vars:
       apiVersion: v300
 `)
 	ra, err := makeAndLoadKustTarget(
-		t, th.GetFSys(), "/app").AccumulateTarget()
+		t, th.GetFSys(), "/app").AccumulateTarget(&resource.Origin{})
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
@@ -120,7 +121,7 @@ resources:
 `)
 
 	ra, err := makeAndLoadKustTarget(
-		t, th.GetFSys(), "/app/overlays/o2").AccumulateTarget()
+		t, th.GetFSys(), "/app/overlays/o2").AccumulateTarget(&resource.Origin{})
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
@@ -177,7 +178,7 @@ resources:
 - ../o1
 `)
 	_, err := makeAndLoadKustTarget(
-		t, th.GetFSys(), "/app/overlays/o2").AccumulateTarget()
+		t, th.GetFSys(), "/app/overlays/o2").AccumulateTarget(&resource.Origin{})
 	if err == nil {
 		t.Fatalf("expected var collision")
 	}

api/internal/utils/annotations.go

@@ -0,0 +1,23 @@
+package utils
+
+import "sigs.k8s.io/kustomize/api/konfig"
+
+const (
+	BuildAnnotationPreviousKinds      = konfig.ConfigAnnoDomain + "/previousKinds"
+	BuildAnnotationPreviousNames      = konfig.ConfigAnnoDomain + "/previousNames"
+	BuildAnnotationPrefixes           = konfig.ConfigAnnoDomain + "/prefixes"
+	BuildAnnotationSuffixes           = konfig.ConfigAnnoDomain + "/suffixes"
+	BuildAnnotationPreviousNamespaces = konfig.ConfigAnnoDomain + "/previousNamespaces"
+	BuildAnnotationsRefBy             = konfig.ConfigAnnoDomain + "/refBy"
+	BuildAnnotationsGenBehavior       = konfig.ConfigAnnoDomain + "/generatorBehavior"
+	BuildAnnotationsGenAddHashSuffix  = konfig.ConfigAnnoDomain + "/needsHashSuffix"
+
+	// the following are only for patches, to specify whether they can change names
+	// and kinds of their targets
+	BuildAnnotationAllowNameChange = konfig.ConfigAnnoDomain + "/allowNameChange"
+	BuildAnnotationAllowKindChange = konfig.ConfigAnnoDomain + "/allowKindChange"
+
+	OriginAnnotation = "config.kubernetes.io/origin"
+
+	Enabled = "enabled"
+)

api/internal/utils/makeResIds.go

@@ -4,25 +4,10 @@ import (
 	"fmt"
 	"strings"
 
-	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-const (
-	BuildAnnotationPreviousKinds      = konfig.ConfigAnnoDomain + "/previousKinds"
-	BuildAnnotationPreviousNames      = konfig.ConfigAnnoDomain + "/previousNames"
-	BuildAnnotationPrefixes           = konfig.ConfigAnnoDomain + "/prefixes"
-	BuildAnnotationSuffixes           = konfig.ConfigAnnoDomain + "/suffixes"
-	BuildAnnotationPreviousNamespaces = konfig.ConfigAnnoDomain + "/previousNamespaces"
-
-	// the following are only for patches, to specify whether they can change names
-	// and kinds of their targets
-	BuildAnnotationAllowNameChange = konfig.ConfigAnnoDomain + "/allowNameChange"
-	BuildAnnotationAllowKindChange = konfig.ConfigAnnoDomain + "/allowKindChange"
-	Allowed                        = "allowed"
-)
-
 // MakeResIds returns all of an RNode's current and previous Ids
 func MakeResIds(n *yaml.RNode) ([]resid.ResId, error) {
 	var result []resid.ResId

api/konfig/general.go

@@ -31,11 +31,12 @@ const (
 	// A program name, for use in help, finding the XDG_CONFIG_DIR, etc.
 	ProgramName = "kustomize"
 
-	// ConfigAnnoDomain is configuration-related annotation namespace.
-	ConfigAnnoDomain = "config.kubernetes.io"
+	// ConfigAnnoDomain is internal configuration-related annotation namespace.
+	// See https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md.
+	ConfigAnnoDomain = "internal.config.kubernetes.io"
 
 	// If a resource has this annotation, kustomize will drop it.
-	IgnoredByKustomizeAnnotation = ConfigAnnoDomain + "/local-config"
+	IgnoredByKustomizeAnnotation = "config.kubernetes.io/local-config"
 
 	// Label key that indicates the resources are built from Kustomize
 	ManagedbyLabelKey = "app.kubernetes.io/managed-by"

api/krusty/buildmetadata_test.go

@@ -0,0 +1,265 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	_ "sigs.k8s.io/kustomize/api/krusty"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestAnnoOriginLocalFiles(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+spec:
+  ports:
+  - port: 7002
+`)
+	th.WriteK(".", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- service.yaml
+buildMetadata: [originAnnotations]
+`)
+	options := th.MakeDefaultOptions()
+	m := th.Run(".", options)
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: service.yaml
+  name: myService
+spec:
+  ports:
+  - port: 7002
+`)
+}
+
+func TestAnnoOriginLocalFilesWithOverlay(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+namePrefix: b-
+resources:
+- namespace.yaml
+- role.yaml
+- service.yaml
+- deployment.yaml
+`)
+	th.WriteF("base/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+`)
+	th.WriteF("base/namespace.yaml", `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: myNs
+`)
+	th.WriteF("base/role.yaml", `
+apiVersion: v1
+kind: Role
+metadata:
+  name: myRole
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: myDep
+`)
+	th.WriteK("prod", `
+namePrefix: p-
+resources:
+- ../base
+- service.yaml
+- namespace.yaml
+buildMetadata: [originAnnotations]
+`)
+	th.WriteF("prod/service.yaml", `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService2
+`)
+	th.WriteF("prod/namespace.yaml", `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: myNs2
+`)
+	m := th.Run("prod", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: ../base/namespace.yaml
+  name: myNs
+---
+apiVersion: v1
+kind: Role
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: ../base/role.yaml
+  name: p-b-myRole
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: ../base/service.yaml
+  name: p-b-myService
+---
+apiVersion: v1
+kind: Deployment
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: ../base/deployment.yaml
+  name: p-b-myDep
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: service.yaml
+  name: p-myService2
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: namespace.yaml
+  name: myNs2
+`)
+}
+
+// This is a copy of TestGeneratorBasics in configmaps_test.go,
+// except that we've enabled the addAnnoOrigin option
+// (which doesn't do anything yet).
+// TODO: Generated resources should receive the annotation
+//      config.kubernetes.io/origin: |
+//        generated-by: path/to/kustomization.yaml
+func TestGeneratorWithAnnoOrigin(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  literals:
+  - fruit=apple
+  - vegetable=broccoli
+  envs:
+  - foo.env
+  env: bar.env
+  files:
+  - passphrase=phrase.dat
+  - forces.txt
+- name: json
+  literals:
+  - 'v2=[{"path": "var/druid/segment-cache"}]'
+  - >- 
+    druid_segmentCache_locations=[{"path": 
+    "var/druid/segment-cache", 
+    "maxSize": 32000000000, 
+    "freeSpacePercent": 1.0}]
+secretGenerator:
+- name: bob
+  literals:
+  - fruit=apple
+  - vegetable=broccoli
+  envs:
+  - foo.env
+  files:
+  - passphrase=phrase.dat
+  - forces.txt
+  env: bar.env
+`)
+	th.WriteF("foo.env", `
+MOUNTAIN=everest
+OCEAN=pacific
+`)
+	th.WriteF("bar.env", `
+BIRD=falcon
+`)
+	th.WriteF("phrase.dat", `
+Life is short.
+But the years are long.
+Not while the evil days come not.
+`)
+	th.WriteF("forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	opts := th.MakeDefaultOptions()
+	m := th.Run(".", opts)
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: v1
+data:
+  BIRD: falcon
+  MOUNTAIN: everest
+  OCEAN: pacific
+  forces.txt: |2
+
+    gravitational
+    electromagnetic
+    strong nuclear
+    weak nuclear
+  fruit: apple
+  passphrase: |2
+
+    Life is short.
+    But the years are long.
+    Not while the evil days come not.
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-g9df72cd5b
+---
+apiVersion: v1
+data:
+  druid_segmentCache_locations: '[{"path":  "var/druid/segment-cache",  "maxSize":
+    32000000000,  "freeSpacePercent": 1.0}]'
+  v2: '[{"path": "var/druid/segment-cache"}]'
+kind: ConfigMap
+metadata:
+  name: blah-json-5298bc8g99
+---
+apiVersion: v1
+data:
+  BIRD: ZmFsY29u
+  MOUNTAIN: ZXZlcmVzdA==
+  OCEAN: cGFjaWZpYw==
+  forces.txt: |
+    CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbn
+    VjbGVhcgo=
+  fruit: YXBwbGU=
+  passphrase: |
+    CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aG
+    UgZXZpbCBkYXlzIGNvbWUgbm90Lgo=
+  vegetable: YnJvY2NvbGk=
+kind: Secret
+metadata:
+  name: blah-bob-58g62h555c
+type: Opaque
+`)
+}

api/krusty/configmaps_test.go

@@ -549,3 +549,26 @@ metadata:
   name: testing-tt4769fb52
 `)
 }
+
+// regression test for https://github.com/kubernetes-sigs/kustomize/issues/4233
+func TestDataEndsWithQuotes(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+configMapGenerator:
+  - name: test
+    literals:
+      - TEST=this is a 'test'
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(
+		m, `apiVersion: v1
+data:
+  TEST: this is a 'test'
+kind: ConfigMap
+metadata:
+  name: test-k9cc55dfm5
+`)
+}

api/krusty/fnplugin_test.go

@@ -1,17 +1,52 @@
 package krusty_test
 
 import (
+	"os"
 	"os/exec"
+	"path/filepath"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
-func TestFnExecGenerator(t *testing.T) {
-	// Function plugins should not need the env setup done by MakeEnhancedHarness
-	th := kusttest_test.MakeHarness(t)
+const generateDeploymentDotSh = `#!/bin/sh
 
-	th.WriteK(".", `
+cat <<EOF
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+  annotations:
+    tshirt-size: small # this injects the resource reservations
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+EOF
+`
+
+func TestFnExecGenerator(t *testing.T) {
+	fSys := filesys.MakeFsOnDisk()
+
+	th := kusttest_test.MakeHarnessWithFs(t, fSys)
+	o := th.MakeOptionsPluginsEnabled()
+	o.PluginConfig.FnpLoadingOptions.EnableExec = true
+
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	th.WriteK(tmpDir.String(), `
 resources:
 - short_secret.yaml
 generators:
@@ -19,7 +54,8 @@ generators:
 `)
 
 	// Create some additional resource just to make sure everything is added
-	th.WriteF("short_secret.yaml", `
+	th.WriteF(filepath.Join(tmpDir.String(), "short_secret.yaml"),
+		`
 apiVersion: v1
 kind: Secret
 metadata:
@@ -32,22 +68,25 @@ stringData:
     bootcmd:
     - mkdir /mnt/vda
 `)
+	th.WriteF(filepath.Join(tmpDir.String(), "generateDeployment.sh"), generateDeploymentDotSh)
 
-	th.WriteF("gener.yaml", `
+	assert.NoError(t, os.Chmod(filepath.Join(tmpDir.String(), "generateDeployment.sh"), 0777))
+	th.WriteF(filepath.Join(tmpDir.String(), "gener.yaml"), `
 kind: executable
 metadata:
   name: demo
   annotations:
     config.kubernetes.io/function: |
       exec:
-        path: ./fnplugin_test/fnexectest.sh
+        path: ./generateDeployment.sh
 spec:
 `)
-	o := th.MakeOptionsPluginsEnabled()
-	o.PluginConfig.FnpLoadingOptions.EnableExec = true
-	m := th.Run(".", o)
-	th.AssertActualEqualsExpected(m, `
-apiVersion: v1
+
+	m := th.Run(tmpDir.String(), o)
+	assert.NoError(t, err)
+	yml, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
 kind: Secret
 metadata:
   labels:
@@ -63,7 +102,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    config.kubernetes.io/path: deployment_nginx.yaml
     tshirt-size: small
   labels:
     app: nginx
@@ -80,7 +118,99 @@ spec:
       containers:
       - image: nginx
         name: nginx
+`, string(yml))
+	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+}
+
+func TestFnExecGeneratorWithOverlay(t *testing.T) {
+	fSys := filesys.MakeFsOnDisk()
+
+	th := kusttest_test.MakeHarnessWithFs(t, fSys)
+	o := th.MakeOptionsPluginsEnabled()
+	o.PluginConfig.FnpLoadingOptions.EnableExec = true
+
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	base := filepath.Join(tmpDir.String(), "base")
+	prod := filepath.Join(tmpDir.String(), "prod")
+	assert.NoError(t, fSys.Mkdir(base))
+	assert.NoError(t, fSys.Mkdir(prod))
+	th.WriteK(base, `
+resources:
+- short_secret.yaml
+generators:
+- gener.yaml
 `)
+	th.WriteK(prod, `
+resources:
+- ../base
+`)
+	th.WriteF(filepath.Join(base, "short_secret.yaml"),
+		`
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    airshipit.org/ephemeral-user-data: "true"
+  name: node1-bmc-secret
+type: Opaque
+stringData:
+  userData: |
+    bootcmd:
+    - mkdir /mnt/vda
+`)
+	th.WriteF(filepath.Join(base, "generateDeployment.sh"), generateDeploymentDotSh)
+
+	assert.NoError(t, os.Chmod(filepath.Join(base, "generateDeployment.sh"), 0777))
+	th.WriteF(filepath.Join(base, "gener.yaml"), `
+kind: executable
+metadata:
+  name: demo
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ./generateDeployment.sh
+spec:
+`)
+
+	m := th.Run(prod, o)
+	assert.NoError(t, err)
+	yml, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    airshipit.org/ephemeral-user-data: "true"
+  name: node1-bmc-secret
+stringData:
+  userData: |
+    bootcmd:
+    - mkdir /mnt/vda
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    tshirt-size: small
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+`, string(yml))
+	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
 }
 
 func skipIfNoDocker(t *testing.T) {
@@ -146,8 +276,6 @@ type: Opaque
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
-  annotations:
-    config.kubernetes.io/path: config/demo-budget_poddisruptionbudget.yaml
   labels:
     app: cockroachdb
     name: demo
@@ -162,8 +290,6 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    config.kubernetes.io/path: config/demo-public_service.yaml
   labels:
     app: cockroachdb
     name: demo
@@ -184,7 +310,6 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    config.kubernetes.io/path: config/demo_service.yaml
     prometheus.io/path: _status/vars
     prometheus.io/port: "8080"
     prometheus.io/scrape: "true"
@@ -209,8 +334,6 @@ spec:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  annotations:
-    config.kubernetes.io/path: config/demo_statefulset.yaml
   labels:
     app: cockroachdb
     name: demo
@@ -383,7 +506,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    config.kubernetes.io/path: deployment_nginx.yaml
     tshirt-size: small
   labels:
     app: nginx
@@ -450,8 +572,6 @@ data:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    config.kubernetes.io/path: namespace_my-namespace.yaml
   labels:
     my-ns-name: function-test
   name: my-namespace
@@ -459,8 +579,6 @@ metadata:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    config.kubernetes.io/path: namespace_another-namespace.yaml
   labels:
     my-ns-name: function-test
   name: another-namespace
@@ -508,8 +626,6 @@ data:
   value: value
 kind: ConfigMap
 metadata:
-  annotations:
-    config.kubernetes.io/path: configmap_env.yaml
   name: env
 `)
 }

api/krusty/fnplugin_test/fnexectest.sh

@@ -1,24 +0,0 @@
-#!/bin/sh
-
-cat <<EOF
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx
-  labels:
-    app: nginx
-  annotations:
-    tshirt-size: small # this injects the resource reservations
-spec:
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-      - name: nginx
-        image: nginx
-EOF

api/krusty/gvknpatch_test.go

@@ -685,3 +685,167 @@ spec:
             name: new-name
 `)
 }
+
+func TestNameReferenceAfterJsonPatch(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("resources.yaml", `
+apiVersion: v1
+data:
+  bar: bar
+kind: ConfigMap
+metadata:
+  name: cm
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: foo
+spec:
+  selector:
+    matchLabels:
+      foo: foo
+  template:
+    metadata:
+      labels:
+        foo: foo
+    spec:
+      containers:
+      - name: foo
+        image: example
+        volumeMounts:
+        - mountPath: /path
+          name: myvol
+      volumes:
+      - configMap:
+          name: cm
+        name: myvol
+`)
+	th.WriteK(".", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: foo-
+resources:
+- resources.yaml
+patches:
+- target:
+    group: apps
+    version: v1
+    name: foo
+  patch: |
+    - op: replace
+      path: /kind
+      value: Deployment
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: v1
+data:
+  bar: bar
+kind: ConfigMap
+metadata:
+  name: foo-cm
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo-foo
+spec:
+  selector:
+    matchLabels:
+      foo: foo
+  template:
+    metadata:
+      labels:
+        foo: foo
+    spec:
+      containers:
+      - image: example
+        name: foo
+        volumeMounts:
+        - mountPath: /path
+          name: myvol
+      volumes:
+      - configMap:
+          name: foo-cm
+        name: myvol
+`)
+}
+
+func TestNameReferenceAfterJsonPatchConfigMapGenerator(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteF("statefulset.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: foo
+spec:
+  selector:
+    matchLabels:
+      foo: foo
+  template:
+    metadata:
+      labels:
+        foo: foo
+    spec:
+      containers:
+      - name: foo
+        image: example
+        volumeMounts:
+        - mountPath: /path
+          name: myvol
+      volumes:
+      - configMap:
+          name: cm
+        name: myvol
+`)
+	th.WriteK(".", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- statefulset.yaml
+patches:
+- target:
+    group: apps
+    version: v1
+    name: foo
+  patch: |
+    - op: replace
+      path: /kind
+      value: Deployment
+configMapGenerator:
+- name: cm
+  literals:
+  - bar=bar
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  selector:
+    matchLabels:
+      foo: foo
+  template:
+    metadata:
+      labels:
+        foo: foo
+    spec:
+      containers:
+      - image: example
+        name: foo
+        volumeMounts:
+        - mountPath: /path
+          name: myvol
+      volumes:
+      - configMap:
+          name: cm-8hm8224gfd
+        name: myvol
+---
+apiVersion: v1
+data:
+  bar: bar
+kind: ConfigMap
+metadata:
+  name: cm-8hm8224gfd
+`)
+}

api/krusty/inlinepatch_test.go

@@ -230,3 +230,92 @@ spec:
         name: configmap-in-base
 `)
 }
+
+func TestPathWithCronJobV1(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- resources.yaml
+patches:
+- patch: |
+    apiVersion: batch/v1
+    kind: CronJob
+    metadata:
+      name: test
+    spec:
+      jobTemplate:
+        spec:
+          template:
+            spec:
+              containers:
+              - name: test
+                env:
+                - name: ENV_NEW
+                  value: val_new
+  target:
+    kind: CronJob
+    name: test
+`)
+	th.WriteF("resources.yaml", `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: test
+spec:
+  schedule: "5 10 * * 1"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+          - name: test
+            image: bash
+            command:
+            - /bin/sh
+            - -c
+            - echo "test"
+            env:
+            - name: ENV1
+              value: val1
+            - name: ENV2
+              value: val2
+            - name: ENV3
+              value: val3`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: test
+spec:
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          containers:
+          - command:
+            - /bin/sh
+            - -c
+            - echo "test"
+            env:
+            - name: ENV_NEW
+              value: val_new
+            - name: ENV1
+              value: val1
+            - name: ENV2
+              value: val2
+            - name: ENV3
+              value: val3
+            image: bash
+            name: test
+          restartPolicy: Never
+  schedule: 5 10 * * 1
+`)
+}

api/krusty/kustomizer.go

@@ -26,7 +26,7 @@ import (
 // used instead of performing an exec to a kustomize CLI subprocess.
 // To use, load a filesystem with kustomization files (any
 // number of overlays and bases), then make a Kustomizer
-// injected with the given fileystem, then call Run.
+// injected with the given filesystem, then call Run.
 type Kustomizer struct {
 	options     *Options
 	depProvider *provider.DepProvider

api/krusty/localconfig_test.go

@@ -0,0 +1,70 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// This test checks that if a resource is annotated as "local-config", this resource won't be ignored until
+// all transformations have completed. This makes sure the local resource can be used as a transformation input.
+// See https://github.com/kubernetes-sigs/kustomize/issues/4124 for details.
+func TestSKipLocalConfigAfterTransform(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pod.yaml
+  - deployment.yaml
+transformers:
+  - replacement.yaml
+`)
+	th.WriteF("pod.yaml", `apiVersion: v1
+kind: Pod
+metadata:
+  name: buildup
+  annotations:
+    config.kubernetes.io/local-config: "true"
+spec:
+  containers:
+    - name: app
+      image: nginx
+`)
+	th.WriteF("deployment.yaml", `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buildup
+`)
+	th.WriteF("replacement.yaml", `
+apiVersion: builtin
+kind: ReplacementTransformer
+metadata:
+  name: buildup
+replacements:
+- source:
+    kind: Pod
+    fieldPath: spec
+  targets:
+  - select:
+      kind: Deployment
+    fieldPaths:
+    - spec.template.spec
+    options:
+      create: true
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buildup
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx
+        name: app
+`)
+}

api/krusty/multiplepatch_test.go

@@ -1646,3 +1646,64 @@ spec:
   type: NodePort
 `)
 }
+
+// test for #4111
+func TestPatchPreservesInternalAnnotations(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+nameSuffix: -abc
+resources:
+  - fluentd.yaml
+patchesJson6902:
+  - path: patch.yaml
+    target:
+      name: fluentd-sa
+      kind: ServiceAccount
+      version: v1
+`)
+	th.WriteF("fluentd.yaml", `
+apiVersion: v1
+kind: DaemonSet
+metadata:
+  name: fluentd
+spec:
+  template:
+    spec:
+      containers:
+        - image: fluentd:latest 
+          name: fluentd
+      serviceAccountName: fluentd-sa
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fluentd-sa
+`)
+	th.WriteF("patch.yaml", `
+- op: add
+  path: /metadata/annotations
+  value:
+    note: this is a test annotation
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: DaemonSet
+metadata:
+  name: fluentd-abc
+spec:
+  template:
+    spec:
+      containers:
+      - image: fluentd:latest
+        name: fluentd
+      serviceAccountName: fluentd-sa-abc
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    note: this is a test annotation
+  name: fluentd-sa-abc
+`)
+}

api/krusty/openapicustomschema_test.go

@@ -5,6 +5,7 @@ package krusty_test
 
 import (
 	"io/ioutil"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -17,6 +18,11 @@ func writeTestSchema(th kusttest_test.Harness, filepath string) {
 	th.WriteF(filepath+"mycrd_schema.json", string(bytes))
 }
 
+func writeTestSchemaYaml(th kusttest_test.Harness, filepath string) {
+	bytes, _ := ioutil.ReadFile("testdata/customschema.yaml")
+	th.WriteF(filepath+"mycrd_schema.yaml", string(bytes))
+}
+
 func writeCustomResource(th kusttest_test.Harness, filepath string) {
 	th.WriteF(filepath, `
 apiVersion: example.com/v1alpha1
@@ -37,6 +43,26 @@ spec:
 `)
 }
 
+func writeOtherCustomResource(th kusttest_test.Harness, filepath string) {
+	th.WriteF(filepath, `
+apiVersion: v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - name: server
+        image: server
+        command: example
+        ports:
+        - name: grpc
+          protocol: TCP
+          containerPort: 8080
+`)
+}
+
 func writeTestComponentWithCustomSchema(th kusttest_test.Harness) {
 	writeTestSchema(th, "comp/")
 	openapi.ResetOpenAPI()
@@ -69,6 +95,32 @@ patchesStrategicMerge:
           image: nginx
 `
 
+const customSchemaPatchMultipleGvks = `
+patchesStrategicMerge:
+- |-
+  apiVersion: example.com/v1alpha1
+  kind: MyCRD
+  metadata:
+    name: service
+  spec:
+    template:
+      spec:
+        containers:
+        - name: server
+          image: nginx
+- |-
+  apiVersion: v1alpha1
+  kind: MyCRD
+  metadata:
+    name: service
+  spec:
+    template:
+      spec:
+        containers:
+        - name: server
+          image: nginx
+`
+
 const patchedCustomResource = `
 apiVersion: example.com/v1alpha1
 kind: MyCRD
@@ -103,6 +155,69 @@ openapi:
 	th.AssertActualEqualsExpected(m, patchedCustomResource)
 }
 
+func TestCustomOpenApiFieldWithTwoGvks(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- mycrd.yaml
+- myothercrd.yaml
+openapi:
+  path: mycrd_schema.json
+`+customSchemaPatchMultipleGvks)
+	writeCustomResource(th, "mycrd.yaml")
+	writeOtherCustomResource(th, "myothercrd.yaml")
+	writeTestSchema(th, "./")
+	openapi.ResetOpenAPI()
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: example.com/v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - command: example
+        image: nginx
+        name: server
+        ports:
+        - containerPort: 8080
+          name: grpc
+          protocol: TCP
+---
+apiVersion: v1alpha1
+kind: MyCRD
+metadata:
+  name: service
+spec:
+  template:
+    spec:
+      containers:
+      - command: example
+        image: nginx
+        name: server
+        ports:
+        - containerPort: 8080
+          name: grpc
+          protocol: TCP
+`)
+}
+
+func TestCustomOpenApiFieldYaml(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- mycrd.yaml
+openapi:
+  path: mycrd_schema.yaml
+`+customSchemaPatch)
+	writeCustomResource(th, "mycrd.yaml")
+	writeTestSchemaYaml(th, "./")
+	openapi.ResetOpenAPI()
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, patchedCustomResource)
+}
+
 // Error if user tries to specify both builtin version
 // and custom schema
 func TestCustomOpenApiFieldBothPathAndVersion(t *testing.T) {
@@ -111,7 +226,7 @@ func TestCustomOpenApiFieldBothPathAndVersion(t *testing.T) {
 resources:
 - mycrd.yaml
 openapi:
-  version: v1.20.4
+  version: v1.21.2
   path: mycrd_schema.json
 `+customSchemaPatch)
 	writeCustomResource(th, "mycrd.yaml")
@@ -197,7 +312,7 @@ openapi:
 resources:
 - ../base
 openapi:
-  version: v1.20.4
+  version: v1.21.2
 `+customSchemaPatch)
 	writeCustomResource(th, "base/mycrd.yaml")
 	writeTestSchema(th, "base/")
@@ -215,7 +330,7 @@ spec:
       - image: nginx
         name: server
 `)
-	assert.Equal(t, "v1204", openapi.GetSchemaVersion())
+	assert.Equal(t, "v1212", openapi.GetSchemaVersion())
 }
 
 func TestCustomOpenAPIFieldFromComponent(t *testing.T) {
@@ -232,3 +347,109 @@ func TestCustomOpenAPIFieldFromComponent(t *testing.T) {
 	th.Run("prod", th.MakeDefaultOptions())
 	assert.Equal(t, "using custom schema from file provided", openapi.GetSchemaVersion())
 }
+
+// test for https://github.com/kubernetes-sigs/kustomize/issues/4179
+// kustomize is not seeing the openapi field from the component defined in the overlay
+func TestCustomOpenAPIFieldFromComponentWithOverlays(t *testing.T) {
+	if val, ok := os.LookupEnv("OPENAPI_TEST"); !ok || val != "true" {
+		t.SkipNow()
+	}
+
+	th := kusttest_test.MakeHarness(t)
+
+	// overlay declaring the component
+	th.WriteK("overlays/overlay-component-openapi", `resources:
+- ../base/
+components:
+- ../../components/dc-openapi
+`)
+
+	// base kustomization
+	th.WriteK("overlays/base", `resources:
+- dc.yml
+`)
+
+	// resource declared in the base kustomization
+	th.WriteF("overlays/base/dc.yml", `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      initContainers:
+        - name: init
+      containers:
+        - name: container
+          env:
+            - name: foo
+              value: bar
+          volumeMounts:
+            - name: cm
+              mountPath: /opt/cm
+      volumes:
+        - name: cm
+          configMap:
+            name: cm
+`)
+
+	// openapi schema referred to by the component
+	bytes, _ := ioutil.ReadFile("testdata/openshiftschema.json")
+	th.WriteF("components/dc-openapi/openapi.json", string(bytes))
+
+	// patch referred to by the component
+	th.WriteF("components/dc-openapi/patch.yml", `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      containers:
+        - name: container
+          volumeMounts:
+            - name: additional-cm
+              mountPath: /mnt
+      volumes:
+        - name: additional-cm
+          configMap:
+             name: additional-cm
+`)
+
+	// component declared in overlay with custom schema and patch
+	th.WriteC("components/dc-openapi", `patches:
+  - patch.yml
+openapi:
+  path: openapi.json
+`)
+
+	openapi.ResetOpenAPI()
+	m := th.Run("overlays/overlay-component-openapi", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: apps.openshift.io/v1
+kind: DeploymentConfig
+metadata:
+  name: my-dc
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: foo
+          value: bar
+        name: container
+        volumeMounts:
+        - mountPath: /mnt
+          name: additional-cm
+        - mountPath: /opt/cm
+          name: cm
+      initContainers:
+      - name: init
+      volumes:
+      - configMap:
+          name: additional-cm
+        name: additional-cm
+      - configMap:
+          name: cm
+        name: cm
+`)
+}

api/krusty/openapiversion_test.go

@@ -16,7 +16,7 @@ func TestOpenApiFieldBasicUsage(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteK(".", `
 openapi:
-  version: v1.20.4
+  version: v1.21.2
 resources:
 - deployment.yaml
 `)
@@ -44,7 +44,8 @@ spec:
       containers:
       - image: whatever
 `)
-	assert.Equal(t, "v1204", openapi.GetSchemaVersion())
+	assert.Equal(t, "v1212", openapi.GetSchemaVersion())
+	openapi.ResetOpenAPI()
 }
 
 func TestOpenApiFieldNotBuiltin(t *testing.T) {
@@ -71,6 +72,7 @@ spec:
 	if err == nil {
 		t.Fatalf("expected an error")
 	}
+	openapi.ResetOpenAPI()
 }
 
 func TestOpenApiFieldDefaultVersion(t *testing.T) {
@@ -104,4 +106,5 @@ spec:
       - image: whatever
 `)
 	assert.Equal(t, kubernetesapi.DefaultOpenAPI, openapi.GetSchemaVersion())
+	openapi.ResetOpenAPI()
 }

api/krusty/remoteload_test.go

@@ -4,6 +4,7 @@
 package krusty_test
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -39,3 +40,124 @@ spec:
     name: nginx
 `, string(yml))
 }
+
+func TestRemoteResource(t *testing.T) {
+	fSys := filesys.MakeFsOnDisk()
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+resources:
+- github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	if utils.IsErrTimeout(err) {
+		// Don't fail on timeouts.
+		t.SkipNow()
+	}
+	assert.NoError(t, err)
+	yml, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: myapp
+  name: dev-myapp-pod
+spec:
+  containers:
+  - image: nginx:1.7.9
+    name: nginx
+`, string(yml))
+	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+}
+
+func TestRemoteResourceAnnoOrigin(t *testing.T) {
+	fSys := filesys.MakeFsOnDisk()
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+resources:
+- github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
+buildMetadata: [originAnnotations]
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	if utils.IsErrTimeout(err) {
+		// Don't fail on timeouts.
+		t.SkipNow()
+	}
+	assert.NoError(t, err)
+	yml, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: examples/multibases/base/pod.yaml
+      repo: https://github.com/kubernetes-sigs/kustomize
+      ref: v1.0.6
+  labels:
+    app: myapp
+  name: dev-myapp-pod
+spec:
+  containers:
+  - image: nginx:1.7.9
+    name: nginx
+`, string(yml))
+	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+}
+
+func TestRemoteResourceAsBaseWithAnnoOrigin(t *testing.T) {
+	fSys := filesys.MakeFsOnDisk()
+	b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
+	tmpDir, err := filesys.NewTmpConfirmedDir()
+	assert.NoError(t, err)
+	base := filepath.Join(tmpDir.String(), "base")
+	prod := filepath.Join(tmpDir.String(), "prod")
+	assert.NoError(t, fSys.Mkdir(base))
+	assert.NoError(t, fSys.Mkdir(prod))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(base, "kustomization.yaml"), []byte(`
+resources:
+- github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(prod, "kustomization.yaml"), []byte(`
+resources:
+- ../base
+namePrefix: prefix-
+buildMetadata: [originAnnotations]
+`)))
+
+	m, err := b.Run(
+		fSys,
+		prod)
+	if utils.IsErrTimeout(err) {
+		// Don't fail on timeouts.
+		t.SkipNow()
+	}
+	assert.NoError(t, err)
+	yml, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    config.kubernetes.io/origin: |
+      path: examples/multibases/base/pod.yaml
+      repo: https://github.com/kubernetes-sigs/kustomize
+      ref: v1.0.6
+  labels:
+    app: myapp
+  name: prefix-dev-myapp-pod
+spec:
+  containers:
+  - image: nginx:1.7.9
+    name: nginx
+`, string(yml))
+	assert.NoError(t, fSys.RemoveAll(tmpDir.String()))
+}

api/krusty/replacementtransformer_test.go

@@ -342,3 +342,143 @@ spec:
         name: nginx
 `)
 }
+
+// TODO: Address namePrefix in overlay not applying to replacement targets
+// The property `data.blue-name` should end up being `overlay-blue` instead of `blue`
+// https://github.com/kubernetes-sigs/kustomize/issues/4034
+func TestReplacementTransformerWithNamePrefixOverlay(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK("base", `
+generatorOptions:
+ disableNameSuffixHash: true
+configMapGenerator:
+- name: blue
+- name: red
+replacements:
+- source:
+    kind: ConfigMap
+    name: blue
+    fieldPath: metadata.name
+  targets:
+  - select:
+      name: red
+    fieldPaths:
+    - data.blue-name
+    options:
+      create: true
+`)
+
+	th.WriteK(".", `
+namePrefix: overlay-
+resources:
+- base
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: overlay-blue
+---
+apiVersion: v1
+data:
+  blue-name: blue
+kind: ConfigMap
+metadata:
+  name: overlay-red
+`)
+}
+
+// TODO: Address namespace in overlay not applying to replacement targets
+// The property `data.blue-namespace` should end up being `overlay-namespace` instead of `base-namespace`
+// https://github.com/kubernetes-sigs/kustomize/issues/4034
+func TestReplacementTransformerWithNamespaceOverlay(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK("base", `
+namespace: base-namespace
+generatorOptions:
+ disableNameSuffixHash: true
+configMapGenerator:
+- name: blue
+- name: red
+replacements:
+- source:
+    kind: ConfigMap
+    name: blue
+    fieldPath: metadata.namespace
+  targets:
+  - select:
+      name: red
+    fieldPaths:
+    - data.blue-namespace
+    options:
+      create: true
+`)
+
+	th.WriteK(".", `
+namespace: overlay-namespace
+resources:
+- base
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blue
+  namespace: overlay-namespace
+---
+apiVersion: v1
+data:
+  blue-namespace: base-namespace
+kind: ConfigMap
+metadata:
+  name: red
+  namespace: overlay-namespace
+`)
+}
+
+// TODO: Address configMapGenerator suffix not applying to replacement targets
+// The property `data.blue-name` should end up being `blue-6ct58987ht` instead of `blue`
+// https://github.com/kubernetes-sigs/kustomize/issues/4034
+func TestReplacementTransformerWithConfigMapGenerator(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteK(".", `
+configMapGenerator:
+- name: blue
+- name: red
+replacements:
+- source:
+    kind: ConfigMap
+    name: blue
+    fieldPath: metadata.name
+  targets:
+  - select:
+      name: red
+    fieldPaths:
+    - data.blue-name
+    options:
+      create: true
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blue-6ct58987ht
+---
+apiVersion: v1
+data:
+  blue-name: blue
+kind: ConfigMap
+metadata:
+  name: red-dc6gc5btkc
+`)
+}

api/krusty/testdata/customschema.json

@@ -34,6 +34,11 @@
           "group": "example.com",
           "kind": "MyCRD",
           "version": "v1alpha1"
+        },
+        {
+          "group": "",
+          "kind": "MyCRD",
+          "version": "v1alpha1"
         }
       ]
     },

api/krusty/testdata/customschema.yaml

@@ -0,0 +1,78 @@
+definitions:
+  v1alpha1.MyCRD:
+    properties:
+      apiVersion:
+        type: string
+      kind:
+        type: string
+      metadata:
+        type: object
+      spec:
+        properties:
+          template:
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec"
+        type: object
+      status:
+        properties:
+          success:
+            type: boolean
+        type: object
+    type: object
+    x-kubernetes-group-version-kind:
+      - group: example.com
+        kind: MyCRD
+        version: v1alpha1
+      - group: ""
+        kind: MyCRD
+        version: v1alpha1
+  io.k8s.api.core.v1.PodTemplateSpec:
+    properties:
+      metadata:
+        "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"
+      spec:
+        "$ref": "#/definitions/io.k8s.api.core.v1.PodSpec"
+    type: object
+  io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta:
+    properties:
+      name:
+        type: string
+    type: object
+  io.k8s.api.core.v1.PodSpec:
+    properties:
+      containers:
+        items:
+          "$ref": "#/definitions/io.k8s.api.core.v1.Container"
+        type: array
+        x-kubernetes-patch-merge-key: name
+        x-kubernetes-patch-strategy: merge
+    type: object
+  io.k8s.api.core.v1.Container:
+    properties:
+      command:
+        items:
+          type: string
+        type: array
+      image:
+        type: string
+      name:
+        type: string
+      ports:
+        items:
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort"
+        type: array
+        x-kubernetes-list-map-keys:
+          - containerPort
+          - protocol
+        x-kubernetes-list-type: map
+        x-kubernetes-patch-merge-key: containerPort
+        x-kubernetes-patch-strategy: merge
+    type: object
+  io.k8s.api.core.v1.ContainerPort:
+    properties:
+      containerPort:
+        type: integer
+      name:
+        type: string
+      protocol:
+        type: string
+    type: object

api/krusty/testdata/openshiftschema.json

@@ -0,0 +1,76 @@
+{
+  "definitions": {
+    "com.github.openshift.api.apps.v1.DeploymentConfig": {
+      "type": "object",
+      "required": [
+        "spec"
+      ],
+      "properties": {
+        "apiVersion": {
+          "type": "string"
+        },
+        "kind": {
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"
+        },
+        "spec": {
+          "$ref": "#/definitions/com.github.openshift.api.apps.v1.DeploymentConfigSpec"
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps.openshift.io",
+          "kind": "DeploymentConfig",
+          "version": "v1"
+        }
+      ]
+    },
+    "com.github.openshift.api.apps.v1.DeploymentConfigSpec": {
+      "type": "object",
+      "properties": {
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec"
+        }
+      }
+    },
+    "io.k8s.api.core.v1.Volume": {
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "configMap": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapVolumeSource"
+        },
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "io.k8s.api.core.v1.VolumeMount": {
+      "type": "object",
+      "required": [
+        "name",
+        "mountPath"
+      ],
+      "properties": {
+        "mountPath": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

api/kv/kv.go

@@ -209,5 +209,17 @@ func parseLiteralSource(source string) (keyName, value string, err error) {
 	if len(items) != 2 {
 		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
 	}
-	return items[0], strings.Trim(items[1], "\"'"), nil
+	return items[0], removeQuotes(items[1]), nil
+}
+
+// removeQuotes removes the surrounding quotes from the provided string only if it is surrounded on both sides
+// rather than blindly trimming all quotation marks on either side.
+func removeQuotes(str string) string {
+	if len(str) == 0 || str[0] != str[len(str)-1] {
+		return str
+	}
+	if str[0] == '"' || str[0] == '\'' {
+		return str[1 : len(str)-1]
+	}
+	return str
 }

api/resmap/factory_test.go

@@ -219,8 +219,10 @@ BAR=baz
 		}
 		r, err := rmF.NewResMapFromConfigMapArgs(kvLdr, tc.input)
 		assert.NoError(t, err, tc.description)
+		r.RemoveBuildAnnotations()
 		rYaml, err := r.AsYaml()
 		assert.NoError(t, err, tc.description)
+		tc.expected.RemoveBuildAnnotations()
 		expYaml, err := tc.expected.AsYaml()
 		assert.NoError(t, err, tc.description)
 		assert.Equal(t, expYaml, rYaml)
@@ -252,6 +254,7 @@ func TestNewResMapFromSecretArgs(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
+	actual.RemoveBuildAnnotations()
 	actYaml, err := actual.AsYaml()
 	assert.NoError(t, err)
 

api/resmap/resmap.go

@@ -136,6 +136,10 @@ type ResMap interface {
 	// self, then its behavior _cannot_ be merge or replace.
 	AbsorbAll(ResMap) error
 
+	// AnnotateAll annotates all resources in the ResMap with
+	// the provided key value pair.
+	AnnotateAll(key string, value string) error
+
 	// AsYaml returns the yaml form of resources.
 	AsYaml() ([]byte, error)
 
@@ -210,6 +214,35 @@ type ResMap interface {
 	// namespaces. Cluster wide objects are never excluded.
 	SubsetThatCouldBeReferencedByResource(*resource.Resource) ResMap
 
+	// DeAnchor replaces YAML aliases with structured data copied from anchors.
+	// This cannot be undone; if desired, call DeepCopy first.
+	// Subsequent marshalling to YAML will no longer have anchor
+	// definitions ('&') or aliases ('*').
+	//
+	// Anchors are not expected to work across YAML 'documents'.
+	// If three resources are loaded from one file containing three YAML docs:
+	//
+	//   {resourceA}
+	//   ---
+	//   {resourceB}
+	//   ---
+	//   {resourceC}
+	//
+	// then anchors defined in A cannot be seen from B and C and vice versa.
+	// OTOH, cross-resource links (a field in B referencing fields in A) will
+	// work if the resources are gathered in a ResourceList:
+	//
+	//   apiVersion: config.kubernetes.io/v1
+	//   kind: ResourceList
+	//   metadata:
+	//     name: someList
+	//   items:
+	//   - {resourceA}
+	//   - {resourceB}
+	//   - {resourceC}
+	//
+	DeAnchor() error
+
 	// DeepCopy copies the ResMap and underlying resources.
 	DeepCopy() ResMap
 

api/resmap/reswrangler.go

@@ -9,6 +9,7 @@ import (
 	"reflect"
 
 	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filters/annotations"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
@@ -531,6 +532,19 @@ func (m *resWrangler) appendReplaceOrMerge(res *resource.Resource) error {
 	}
 }
 
+// AnnotateAll implements ResMap
+func (m *resWrangler) AnnotateAll(key string, value string) error {
+	return m.ApplyFilter(annotations.Filter{
+		Annotations: map[string]string{
+			key: value,
+		},
+		FsSlice: []types.FieldSpec{{
+			Path:               "metadata/annotations",
+			CreateIfNotPresent: true,
+		}},
+	})
+}
+
 // Select returns a list of resources that
 // are selected by a Selector
 func (m *resWrangler) Select(s types.Selector) ([]*resource.Resource, error) {
@@ -593,6 +607,16 @@ func (m *resWrangler) ToRNodeSlice() []*kyaml.RNode {
 	return result
 }
 
+// DeAnchor implements ResMap.
+func (m *resWrangler) DeAnchor() (err error) {
+	for i := range m.rList {
+		if err = m.rList[i].DeAnchor(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // ApplySmPatch applies the patch, and errors on Id collisions.
 func (m *resWrangler) ApplySmPatch(
 	selectedSet *resource.IdSet, patch *resource.Resource) error {

api/resmap/reswrangler_test.go

@@ -343,9 +343,9 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name": "new-alice",
 				"annotations": map[string]interface{}{
-					"config.kubernetes.io/previousKinds":      "ConfigMap",
-					"config.kubernetes.io/previousNames":      "alice",
-					"config.kubernetes.io/previousNamespaces": "default",
+					"internal.config.kubernetes.io/previousKinds":      "ConfigMap",
+					"internal.config.kubernetes.io/previousNames":      "alice",
+					"internal.config.kubernetes.io/previousNamespaces": "default",
 				},
 			},
 		})
@@ -356,9 +356,9 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name": "new-bob",
 				"annotations": map[string]interface{}{
-					"config.kubernetes.io/previousKinds":      "ConfigMap,ConfigMap",
-					"config.kubernetes.io/previousNames":      "bob,bob2",
-					"config.kubernetes.io/previousNamespaces": "default,default",
+					"internal.config.kubernetes.io/previousKinds":      "ConfigMap,ConfigMap",
+					"internal.config.kubernetes.io/previousNames":      "bob,bob2",
+					"internal.config.kubernetes.io/previousNamespaces": "default,default",
 				},
 			},
 		})
@@ -370,9 +370,9 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				"name":      "new-bob",
 				"namespace": "new-happy",
 				"annotations": map[string]interface{}{
-					"config.kubernetes.io/previousKinds":      "ConfigMap",
-					"config.kubernetes.io/previousNames":      "bob",
-					"config.kubernetes.io/previousNamespaces": "happy",
+					"internal.config.kubernetes.io/previousKinds":      "ConfigMap",
+					"internal.config.kubernetes.io/previousNames":      "bob",
+					"internal.config.kubernetes.io/previousNamespaces": "happy",
 				},
 			},
 		})
@@ -384,9 +384,9 @@ func TestGetMatchingResourcesByAnyId(t *testing.T) {
 				"name":      "charlie",
 				"namespace": "happy",
 				"annotations": map[string]interface{}{
-					"config.kubernetes.io/previousKinds":      "ConfigMap",
-					"config.kubernetes.io/previousNames":      "charlie",
-					"config.kubernetes.io/previousNamespaces": "default",
+					"internal.config.kubernetes.io/previousKinds":      "ConfigMap",
+					"internal.config.kubernetes.io/previousNames":      "charlie",
+					"internal.config.kubernetes.io/previousNamespaces": "default",
 				},
 			},
 		})
@@ -845,6 +845,8 @@ func TestAbsorbAll(t *testing.T) {
 		}))
 	w := makeMap1()
 	assert.NoError(t, w.AbsorbAll(makeMap2(types.BehaviorMerge)))
+	expected.RemoveBuildAnnotations()
+	w.RemoveBuildAnnotations()
 	assert.NoError(t, expected.ErrorIfNotEqualLists(w))
 	w = makeMap1()
 	assert.NoError(t, w.AbsorbAll(nil))
@@ -853,6 +855,7 @@ func TestAbsorbAll(t *testing.T) {
 	w = makeMap1()
 	w2 := makeMap2(types.BehaviorReplace)
 	assert.NoError(t, w.AbsorbAll(w2))
+	w2.RemoveBuildAnnotations()
 	assert.NoError(t, w2.ErrorIfNotEqualLists(w))
 	w = makeMap1()
 	w2 = makeMap2(types.BehaviorUnspecified)
@@ -899,6 +902,100 @@ rules:
 	}
 }
 
+func TestDeAnchorSingleDoc(t *testing.T) {
+	input := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wildcard
+data:
+  color: &color-used blue
+  feeling: *color-used
+`
+	rm, err := rmF.NewResMapFromBytes([]byte(input))
+	assert.NoError(t, err)
+	assert.NoError(t, rm.DeAnchor())
+	yaml, err := rm.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, strings.TrimSpace(`
+apiVersion: v1
+data:
+  color: blue
+  feeling: blue
+kind: ConfigMap
+metadata:
+  name: wildcard
+`), strings.TrimSpace(string(yaml)))
+}
+
+// Anchor references don't cross YAML document boundaries.
+func TestDeAnchorMultiDoc(t *testing.T) {
+	input := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: betty
+data:
+  color: &color-used blue
+  feeling: *color-used
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bob
+data:
+  color: red
+  feeling: *color-used
+`
+	_, err := rmF.NewResMapFromBytes([]byte(input))
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown anchor 'color-used' referenced")
+}
+
+// Anchor references cross list elements in a ResourceList.
+func TestDeAnchorResourceList(t *testing.T) {
+	input := `apiVersion: config.kubernetes.io/v1
+kind: ResourceList
+metadata:
+  name: aShortList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: betty
+  data:
+    color: &color-used blue
+    feeling: *color-used
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: bob
+  data:
+    color: red
+    feeling: *color-used
+`
+	rm, err := rmF.NewResMapFromBytes([]byte(input))
+	assert.NoError(t, err)
+	assert.NoError(t, rm.DeAnchor())
+	yaml, err := rm.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, strings.TrimSpace(`
+apiVersion: v1
+data:
+  color: blue
+  feeling: blue
+kind: ConfigMap
+metadata:
+  name: betty
+---
+apiVersion: v1
+data:
+  color: red
+  feeling: blue
+kind: ConfigMap
+metadata:
+  name: bob
+`), strings.TrimSpace(string(yaml)))
+}
+
 func TestApplySmPatch_General(t *testing.T) {
 	const (
 		myDeployment      = "Deployment"

api/resource/factory.go

@@ -64,18 +64,23 @@ func (rf *Factory) FromMapAndOption(
 		// TODO: return err instead of log.
 		log.Fatal(err)
 	}
-	return rf.makeOne(n, types.NewGenArgs(args))
+	return rf.makeOne(n, args)
 }
 
 // makeOne returns a new instance of Resource.
-func (rf *Factory) makeOne(rn *yaml.RNode, o *types.GenArgs) *Resource {
+func (rf *Factory) makeOne(rn *yaml.RNode, o *types.GeneratorArgs) *Resource {
 	if rn == nil {
 		log.Fatal("RNode must not be null")
 	}
-	if o == nil {
-		o = types.NewGenArgs(nil)
+	resource := &Resource{RNode: *rn}
+	if o != nil {
+		if o.Options == nil || !o.Options.DisableNameSuffixHash {
+			resource.EnableHashSuffix()
+		}
+		resource.SetBehavior(types.NewGenerationBehavior(o.Behavior))
 	}
-	return &Resource{RNode: *rn, options: o}
+
+	return resource
 }
 
 // SliceFromPatches returns a slice of resources given a patch path
@@ -119,14 +124,34 @@ func (rf *Factory) SliceFromBytes(in []byte) ([]*Resource, error) {
 	return rf.resourcesFromRNodes(nodes), nil
 }
 
+// DropLocalNodes removes the local nodes by default. Local nodes are detected via the annotation `config.kubernetes.io/local-config: "true"`
+func (rf *Factory) DropLocalNodes(nodes []*yaml.RNode) ([]*Resource, error) {
+	var result []*yaml.RNode
+	for _, node := range nodes {
+		if node.IsNilOrEmpty() {
+			continue
+		}
+		md, err := node.GetValidatedMetadata()
+		if err != nil {
+			return nil, err
+		}
+
+		if rf.IncludeLocalConfigs {
+			result = append(result, node)
+			continue
+		}
+		localConfig, exist := md.ObjectMeta.Annotations[konfig.IgnoredByKustomizeAnnotation]
+		if !exist || localConfig == "false" {
+			result = append(result, node)
+		}
+	}
+	return rf.resourcesFromRNodes(result), nil
+}
+
 // ResourcesFromRNodes converts RNodes to Resources.
 func (rf *Factory) ResourcesFromRNodes(
 	nodes []*yaml.RNode) (result []*Resource, err error) {
-	nodes, err = rf.dropBadNodes(nodes)
-	if err != nil {
-		return nil, err
-	}
-	return rf.resourcesFromRNodes(nodes), nil
+	return rf.DropLocalNodes(nodes)
 }
 
 // resourcesFromRNode assumes all nodes are good.
@@ -138,7 +163,7 @@ func (rf *Factory) resourcesFromRNodes(
 	return
 }
 
-func (rf *Factory) RNodesFromBytes(b []byte) (result []*yaml.RNode, err error) {
+func (rf *Factory) RNodesFromBytes(b []byte) ([]*yaml.RNode, error) {
 	nodes, err := kio.FromBytes(b)
 	if err != nil {
 		return nil, err
@@ -147,9 +172,17 @@ func (rf *Factory) RNodesFromBytes(b []byte) (result []*yaml.RNode, err error) {
 	if err != nil {
 		return nil, err
 	}
+	return rf.inlineAnyEmbeddedLists(nodes)
+}
+
+// inlineAnyEmbeddedLists scans the RNode slice for nodes named FooList.
+// Such nodes are expected to be lists of resources, each of type Foo.
+// These lists are replaced in the result by their inlined resources.
+func (rf *Factory) inlineAnyEmbeddedLists(
+	nodes []*yaml.RNode) (result []*yaml.RNode, err error) {
+	var n0 *yaml.RNode
 	for len(nodes) > 0 {
-		n0 := nodes[0]
-		nodes = nodes[1:]
+		n0, nodes = nodes[0], nodes[1:]
 		kind := n0.GetKind()
 		if !strings.HasSuffix(kind, "List") {
 			result = append(result, n0)
@@ -159,7 +192,7 @@ func (rf *Factory) RNodesFromBytes(b []byte) (result []*yaml.RNode, err error) {
 		var m map[string]interface{}
 		m, err = n0.Map()
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("trouble expanding list of %s; %w", kind, err)
 		}
 		items, ok := m["items"]
 		if !ok {
@@ -211,38 +244,20 @@ func (rf *Factory) convertObjectSliceToNodeSlice(
 func (rf *Factory) dropBadNodes(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	var result []*yaml.RNode
 	for _, n := range nodes {
-		ignore, err := rf.shouldIgnore(n)
-		if err != nil {
+		if n.IsNilOrEmpty() {
+			continue
+		}
+		if _, err := n.GetValidatedMetadata(); err != nil {
 			return nil, err
 		}
-		if !ignore {
-			result = append(result, n)
+		if foundNil, path := n.HasNilEntryInList(); foundNil {
+			return nil, fmt.Errorf("empty item at %v in object %v", path, n)
 		}
+		result = append(result, n)
 	}
 	return result, nil
 }
 
-// shouldIgnore returns true if there's some reason to ignore the node.
-func (rf *Factory) shouldIgnore(n *yaml.RNode) (bool, error) {
-	if n.IsNilOrEmpty() {
-		return true, nil
-	}
-	if !rf.IncludeLocalConfigs {
-		md, err := n.GetValidatedMetadata()
-		if err != nil {
-			return true, err
-		}
-		_, ignore := md.ObjectMeta.Annotations[konfig.IgnoredByKustomizeAnnotation]
-		if ignore {
-			return true, nil
-		}
-	}
-	if foundNil, path := n.HasNilEntryInList(); foundNil {
-		return true, fmt.Errorf("empty item at %v in object %v", path, n)
-	}
-	return false, nil
-}
-
 // SliceFromBytesWithNames unmarshals bytes into a Resource slice with specified original
 // name.
 func (rf *Factory) SliceFromBytesWithNames(names []string, in []byte) ([]*Resource, error) {
@@ -265,7 +280,7 @@ func (rf *Factory) MakeConfigMap(kvLdr ifc.KvLoader, args *types.ConfigMapArgs)
 	if err != nil {
 		return nil, err
 	}
-	return rf.makeOne(rn, types.NewGenArgs(&args.GeneratorArgs)), nil
+	return rf.makeOne(rn, &args.GeneratorArgs), nil
 }
 
 // MakeSecret makes an instance of Resource for Secret
@@ -274,5 +289,5 @@ func (rf *Factory) MakeSecret(kvLdr ifc.KvLoader, args *types.SecretArgs) (*Reso
 	if err != nil {
 		return nil, err
 	}
-	return rf.makeOne(rn, types.NewGenArgs(&args.GeneratorArgs)), nil
+	return rf.makeOne(rn, &args.GeneratorArgs), nil
 }

api/resource/factory_test.go

@@ -5,7 +5,7 @@ package resource_test
 
 import (
 	"fmt"
-	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -13,9 +13,10 @@ import (
 	. "sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
+	"sigs.k8s.io/kustomize/kyaml/kio"
 )
 
-func TestSliceFromBytes(t *testing.T) {
+func TestRNodesFromBytes(t *testing.T) {
 	type testCase struct {
 		input    string
 		expected []string
@@ -399,60 +400,11 @@ binaryData:
 	}
 }
 
-func TestSliceFromBytesMore(t *testing.T) {
-	testConfigMap :=
-		map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "ConfigMap",
-			"metadata": map[string]interface{}{
-				"name": "winnie",
-			},
-		}
-	testDeploymentSpec := map[string]interface{}{
-		"template": map[string]interface{}{
-			"spec": map[string]interface{}{
-				"hostAliases": []interface{}{
-					map[string]interface{}{
-						"hostnames": []interface{}{
-							"a.example.com",
-						},
-						"ip": "8.8.8.8",
-					},
-				},
-			},
-		},
-	}
-	testDeploymentA := map[string]interface{}{
-		"apiVersion": "apps/v1",
-		"kind":       "Deployment",
-		"metadata": map[string]interface{}{
-			"name": "deployment-a",
-		},
-		"spec": testDeploymentSpec,
-	}
-	testDeploymentB := map[string]interface{}{
-		"apiVersion": "apps/v1",
-		"kind":       "Deployment",
-		"metadata": map[string]interface{}{
-			"name": "deployment-b",
-		},
-		"spec": testDeploymentSpec,
-	}
-	testDeploymentList :=
-		map[string]interface{}{
-			"apiVersion": "v1",
-			"kind":       "DeploymentList",
-			"items": []interface{}{
-				testDeploymentA,
-				testDeploymentB,
-			},
-		}
-
+func TestMoreRNodesFromBytes(t *testing.T) {
 	type expected struct {
-		out   []map[string]interface{}
+		out   []string
 		isErr bool
 	}
-
 	testCases := map[string]struct {
 		input []byte
 		exp   expected
@@ -465,16 +417,16 @@ func TestSliceFromBytesMore(t *testing.T) {
 		},
 		"noBytes": {
 			input: []byte{},
-			exp: expected{
-				out: []map[string]interface{}{},
-			},
+			exp:   expected{},
 		},
 		"goodJson": {
 			input: []byte(`
 {"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie"}}
 `),
 			exp: expected{
-				out: []map[string]interface{}{testConfigMap},
+				out: []string{
+					`{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "winnie"}}`,
+				},
 			},
 		},
 		"goodYaml1": {
@@ -485,7 +437,12 @@ metadata:
   name: winnie
 `),
 			exp: expected{
-				out: []map[string]interface{}{testConfigMap},
+				out: []string{`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`},
 			},
 		},
 		"goodYaml2": {
@@ -501,26 +458,17 @@ metadata:
   name: winnie
 `),
 			exp: expected{
-				out: []map[string]interface{}{testConfigMap, testConfigMap},
-			},
-		},
-		"localConfigYaml": {
-			input: []byte(`
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: winnie-skip
-  annotations:
-    # this annotation causes the Resource to be ignored by kustomize
-    config.kubernetes.io/local-config: ""
----
+				out: []string{`
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: winnie
-`),
-			exp: expected{
-				out: []map[string]interface{}{testConfigMap},
+`, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`},
 			},
 		},
 		"garbageInOneOfTwoObjects": {
@@ -545,7 +493,7 @@ WOOOOOOOOOOOOOOOOOOOOOOOOT:  woot
 
 `),
 			exp: expected{
-				out: []map[string]interface{}{},
+				out: []string{},
 			},
 		},
 		"Missing .metadata.name in object": {
@@ -591,9 +539,18 @@ items:
     name: winnie
 `),
 			exp: expected{
-				out: []map[string]interface{}{
-					testConfigMap,
-					testConfigMap},
+				out: []string{`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`,
+				},
 			},
 		},
 		"ConfigMapList": {
@@ -611,9 +568,9 @@ items:
     name: winnie
 `),
 			exp: expected{
-				out: []map[string]interface{}{
-					testConfigMap,
-					testConfigMap,
+				out: []string{
+					`{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "winnie"}}`,
+					`{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "winnie"}}`,
 				},
 			},
 		},
@@ -626,7 +583,7 @@ items:
   kind: Deployment
   metadata:
     name: deployment-a
-  spec: &hostAliases
+  spec: &foo
     template:
       spec:
         hostAliases:
@@ -638,23 +595,39 @@ items:
   metadata:
     name: deployment-b
   spec:
-    <<: *hostAliases
+    *foo
 `),
 			exp: expected{
-				// TODO(3271): This should work.
-				// https://github.com/kubernetes-sigs/kustomize/issues/3271
-				// json.Marshal(obj) fails on the 2nd list item.
-				// The value of the 1st list item's first spec field is
-				//  map[string]interface{}
-				// The value of the 2nd list item's first spec field is
-				//  map[interface{}]interface{}
-				// which causes a encoding/json.UnsupportedTypeError.
-				isErr: true,
-				out:   []map[string]interface{}{testDeploymentList},
+				out: []string{
+					`{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "deployment-a"}, ` +
+						`"spec": {"template": {"spec": {"hostAliases": [{"hostnames": ["a.example.com"], "ip": "8.8.8.8"}]}}}}`,
+					`{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "deployment-b"}, ` +
+						`"spec": {"template": {"spec": {"hostAliases": [{"hostnames": ["a.example.com"], "ip": "8.8.8.8"}]}}}}`},
+			},
+		},
+		"simpleAnchor": {
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wildcard
+data:
+  color: &color-used blue
+  feeling: *color-used
+`),
+			exp: expected{
+				out: []string{`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wildcard
+data:
+  color: blue
+  feeling: blue
+`},
 			},
 		},
 	}
-
 	for n := range testCases {
 		tc := testCases[n]
 		t.Run(n, func(t *testing.T) {
@@ -666,15 +639,100 @@ items:
 			assert.False(t, tc.exp.isErr)
 			assert.Equal(t, len(tc.exp.out), len(rs))
 			for i := range rs {
-				rsMap, err := rs[i].Map()
+				actual, err := rs[i].String()
 				assert.NoError(t, err)
 				assert.Equal(
-					t, fmt.Sprintf("%v", tc.exp.out[i]), fmt.Sprintf("%v", rsMap))
-				m, _ := rs[i].Map()
-				if !reflect.DeepEqual(tc.exp.out[i], m) {
-					t.Fatalf("%s:\nexpected: %v\n  actual: %v",
-						n, tc.exp.out[i], m)
-				}
+					t, strings.TrimSpace(tc.exp.out[i]), strings.TrimSpace(actual))
+			}
+		})
+	}
+}
+
+func TestDropLocalNodes(t *testing.T) {
+	testCases := map[string]struct {
+		input    []byte
+		expected []byte
+	}{
+		"localConfigUnset": {
+			input: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			expected: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+		},
+		"localConfigSet": {
+			input: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie-skip
+  annotations:
+     # this annotation causes the Resource to be ignored by kustomize
+     config.kubernetes.io/local-config: ""
+`),
+			expected: nil,
+		},
+		"localConfigSetToTrue": {
+			input: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie-skip
+  annotations:
+	 config.kubernetes.io/local-config: "true"
+		`),
+			expected: nil,
+		},
+		"localConfigSetToFalse": {
+			input: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+  annotations:
+    config.kubernetes.io/local-config: "false"
+`),
+			expected: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    config.kubernetes.io/local-config: "false"
+  name: winnie
+`),
+		},
+		"localConfigMultiInput": {
+			input: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie-skip
+  annotations:
+    config.kubernetes.io/local-config: "true"
+`),
+			expected: []byte(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+		},
+	}
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			nin, _ := kio.FromBytes(tc.input)
+			res, err := factory.DropLocalNodes(nin)
+			assert.NoError(t, err)
+			if tc.expected == nil {
+				assert.Equal(t, 0, len(res))
+			} else {
+				actual, _ := res[0].AsYAML()
+				assert.Equal(t, tc.expected, actual)
 			}
 		})
 	}

api/resource/origin.go

@@ -0,0 +1,60 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package resource
+
+import (
+	"path/filepath"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/internal/git"
+)
+
+// Origin retains information about where resources in the output
+// of `kustomize build` originated from
+type Origin struct {
+	// Path is the path to the resource, rooted from the directory upon
+	// which `kustomize build` was invoked
+	Path string
+
+	// Repo is the remote repository that the resource originated from if it is
+	// not from a local file
+	Repo string
+
+	// Ref is the ref of the remote repository that the resource originated from
+	// if it is not from a local file
+	Ref string
+}
+
+// Copy returns a copy of origin
+func (origin *Origin) Copy() Origin {
+	return *origin
+}
+
+// Append returns a copy of origin with a path appended to it
+func (origin *Origin) Append(path string) *Origin {
+	originCopy := origin.Copy()
+	repoSpec, err := git.NewRepoSpecFromUrl(path)
+	if err == nil {
+		originCopy.Repo = repoSpec.Host + repoSpec.OrgRepo
+		absPath := repoSpec.AbsPath()
+		path = absPath[strings.Index(absPath[1:], "/")+1:][1:]
+		originCopy.Path = ""
+		originCopy.Ref = repoSpec.Ref
+	}
+	originCopy.Path = filepath.Join(originCopy.Path, path)
+	return &originCopy
+}
+
+// String returns a string version of origin
+func (origin *Origin) String() string {
+	var anno string
+	anno = anno + "path: " + origin.Path + "\n"
+	if origin.Repo != "" {
+		anno = anno + "repo: " + origin.Repo + "\n"
+	}
+	if origin.Ref != "" {
+		anno = anno + "ref: " + origin.Ref + "\n"
+	}
+	return anno
+}

api/resource/origin_test.go

@@ -0,0 +1,83 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package resource_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/resource"
+)
+
+func TestOriginAppend(t *testing.T) {
+	tests := []struct {
+		in       *Origin
+		path     string
+		expected string
+	}{
+		{
+			in: &Origin{
+				Path: "prod",
+			},
+			path: "service.yaml",
+			expected: `path: prod/service.yaml
+`,
+		},
+		{
+			in: &Origin{
+				Path: "overlay/prod",
+			},
+			path: "github.com/kubernetes-sigs/kustomize/examples/multibases/dev/",
+			expected: `path: examples/multibases/dev
+repo: https://github.com/kubernetes-sigs/kustomize
+`,
+		},
+	}
+	for _, test := range tests {
+		actual := test.in.Append(test.path).String()
+		if actual != test.expected {
+			t.Fatalf("Expected %v, but got %v\n", test.expected, actual)
+		}
+	}
+}
+
+func TestOriginString(t *testing.T) {
+	tests := []struct {
+		in       *Origin
+		expected string
+	}{
+		{
+			in: &Origin{
+				Path: "prod/service.yaml",
+				Repo: "github.com/kubernetes-sigs/kustomize/examples/multibases/dev/",
+				Ref:  "v1.0.6",
+			},
+			expected: `path: prod/service.yaml
+repo: github.com/kubernetes-sigs/kustomize/examples/multibases/dev/
+ref: v1.0.6
+`,
+		},
+		{
+			in: &Origin{
+				Path: "prod/service.yaml",
+				Repo: "github.com/kubernetes-sigs/kustomize/examples/multibases/dev/",
+			},
+			expected: `path: prod/service.yaml
+repo: github.com/kubernetes-sigs/kustomize/examples/multibases/dev/
+`,
+		},
+		{
+			in: &Origin{
+				Path: "prod/service.yaml",
+			},
+			expected: `path: prod/service.yaml
+`,
+		},
+	}
+
+	for _, test := range tests {
+		if test.in.String() != test.expected {
+			t.Fatalf("Expected %v, but got %v\n", test.expected, test.in.String())
+		}
+	}
+}

api/resource/resource.go

@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
 	"sigs.k8s.io/yaml"
@@ -22,11 +23,10 @@ import (
 // paired with metadata used by kustomize.
 type Resource struct {
 	kyaml.RNode
-	options     *types.GenArgs
-	refBy       []resid.ResId
 	refVarNames []string
 }
 
+// nolint
 var BuildAnnotations = []string{
 	utils.BuildAnnotationPreviousKinds,
 	utils.BuildAnnotationPreviousNames,
@@ -35,6 +35,16 @@ var BuildAnnotations = []string{
 	utils.BuildAnnotationPreviousNamespaces,
 	utils.BuildAnnotationAllowNameChange,
 	utils.BuildAnnotationAllowKindChange,
+	utils.BuildAnnotationsRefBy,
+	utils.BuildAnnotationsGenBehavior,
+	utils.BuildAnnotationsGenAddHashSuffix,
+
+	kioutil.PathAnnotation,
+	kioutil.IndexAnnotation,
+	kioutil.SeqIndentAnnotation,
+
+	kioutil.LegacyPathAnnotation,
+	kioutil.LegacyIndexAnnotation,
 }
 
 func (r *Resource) ResetRNode(incoming *Resource) {
@@ -80,6 +90,8 @@ func (r *Resource) DeepCopy() *Resource {
 // CopyMergeMetaDataFieldsFrom copies everything but the non-metadata in
 // the resource.
 // TODO: move to RNode, use GetMeta to improve performance.
+// TODO: make a version of mergeStringMaps that is build-annotation aware
+//   to avoid repeatedly setting refby and genargs annotations
 // Must remove the kustomize bit at the end.
 func (r *Resource) CopyMergeMetaDataFieldsFrom(other *Resource) error {
 	if err := r.SetLabels(
@@ -87,7 +99,7 @@ func (r *Resource) CopyMergeMetaDataFieldsFrom(other *Resource) error {
 		return fmt.Errorf("copyMerge cannot set labels - %w", err)
 	}
 	if err := r.SetAnnotations(
-		mergeStringMaps(other.GetAnnotations(), r.GetAnnotations())); err != nil {
+		mergeStringMapsWithBuildAnnotations(other.GetAnnotations(), r.GetAnnotations())); err != nil {
 		return fmt.Errorf("copyMerge cannot set annotations - %w", err)
 	}
 	if err := r.SetName(other.GetName()); err != nil {
@@ -101,8 +113,6 @@ func (r *Resource) CopyMergeMetaDataFieldsFrom(other *Resource) error {
 }
 
 func (r *Resource) copyKustomizeSpecificFields(other *Resource) {
-	r.options = other.options
-	r.refBy = other.copyRefBy()
 	r.refVarNames = copyStringSlice(other.refVarNames)
 }
 
@@ -144,10 +154,10 @@ func (r *Resource) ErrIfNotEquals(o *Resource) error {
 func (r *Resource) ReferencesEqual(other *Resource) bool {
 	setSelf := make(map[resid.ResId]bool)
 	setOther := make(map[resid.ResId]bool)
-	for _, ref := range other.refBy {
+	for _, ref := range other.GetRefBy() {
 		setOther[ref] = true
 	}
-	for _, ref := range r.refBy {
+	for _, ref := range r.GetRefBy() {
 		if _, ok := setOther[ref]; !ok {
 			return false
 		}
@@ -156,15 +166,6 @@ func (r *Resource) ReferencesEqual(other *Resource) bool {
 	return len(setSelf) == len(setOther)
 }
 
-func (r *Resource) copyRefBy() []resid.ResId {
-	if r.refBy == nil {
-		return nil
-	}
-	s := make([]resid.ResId, len(r.refBy))
-	copy(s, r.refBy)
-	return s
-}
-
 func copyStringSlice(s []string) []string {
 	if s == nil {
 		return nil
@@ -250,41 +251,45 @@ func (r *Resource) setPreviousId(ns string, n string, k string) *Resource {
 
 // AllowNameChange allows name changes to the resource.
 func (r *Resource) AllowNameChange() {
-	annotations := r.GetAnnotations()
-	annotations[utils.BuildAnnotationAllowNameChange] = utils.Allowed
-	if err := r.SetAnnotations(annotations); err != nil {
-		panic(err)
-	}
+	r.enable(utils.BuildAnnotationAllowNameChange)
 }
 
+// NameChangeAllowed checks if a patch resource is allowed to change another resource's name.
 func (r *Resource) NameChangeAllowed() bool {
-	annotations := r.GetAnnotations()
-	v, ok := annotations[utils.BuildAnnotationAllowNameChange]
-	return ok && v == utils.Allowed
+	return r.isEnabled(utils.BuildAnnotationAllowNameChange)
 }
 
 // AllowKindChange allows kind changes to the resource.
 func (r *Resource) AllowKindChange() {
+	r.enable(utils.BuildAnnotationAllowKindChange)
+}
+
+// KindChangeAllowed checks if a patch resource is allowed to change another resource's kind.
+func (r *Resource) KindChangeAllowed() bool {
+	return r.isEnabled(utils.BuildAnnotationAllowKindChange)
+}
+
+func (r *Resource) isEnabled(annoKey string) bool {
 	annotations := r.GetAnnotations()
-	annotations[utils.BuildAnnotationAllowKindChange] = utils.Allowed
+	v, ok := annotations[annoKey]
+	return ok && v == utils.Enabled
+}
+
+func (r *Resource) enable(annoKey string) {
+	annotations := r.GetAnnotations()
+	annotations[annoKey] = utils.Enabled
 	if err := r.SetAnnotations(annotations); err != nil {
 		panic(err)
 	}
 }
 
-func (r *Resource) KindChangeAllowed() bool {
-	annotations := r.GetAnnotations()
-	v, ok := annotations[utils.BuildAnnotationAllowKindChange]
-	return ok && v == utils.Allowed
-}
-
 // String returns resource as JSON.
 func (r *Resource) String() string {
 	bs, err := r.MarshalJSON()
 	if err != nil {
 		return "<" + err.Error() + ">"
 	}
-	return strings.TrimSpace(string(bs)) + r.options.String()
+	return strings.TrimSpace(string(bs))
 }
 
 // AsYAML returns the resource in Yaml form.
@@ -306,20 +311,34 @@ func (r *Resource) MustYaml() string {
 	return string(yml)
 }
 
-// SetOptions updates the generator options for the resource.
-func (r *Resource) SetOptions(o *types.GenArgs) {
-	r.options = o
-}
-
 // Behavior returns the behavior for the resource.
 func (r *Resource) Behavior() types.GenerationBehavior {
-	return r.options.Behavior()
+	annotations := r.GetAnnotations()
+	if v, ok := annotations[utils.BuildAnnotationsGenBehavior]; ok {
+		return types.NewGenerationBehavior(v)
+	}
+	return types.NewGenerationBehavior("")
+}
+
+// SetBehavior sets the behavior for the resource.
+func (r *Resource) SetBehavior(behavior types.GenerationBehavior) {
+	annotations := r.GetAnnotations()
+	annotations[utils.BuildAnnotationsGenBehavior] = behavior.String()
+	if err := r.SetAnnotations(annotations); err != nil {
+		panic(err)
+	}
 }
 
 // NeedHashSuffix returns true if a resource content
 // hash should be appended to the name of the resource.
 func (r *Resource) NeedHashSuffix() bool {
-	return r.options != nil && r.options.ShouldAddHashSuffixToName()
+	return r.isEnabled(utils.BuildAnnotationsGenAddHashSuffix)
+}
+
+// EnableHashSuffix marks the resource as needing a content
+// hash to be appended to the name of the resource.
+func (r *Resource) EnableHashSuffix() {
+	r.enable(utils.BuildAnnotationsGenAddHashSuffix)
 }
 
 // OrgId returns the original, immutable ResId for the resource.
@@ -363,12 +382,18 @@ func (r *Resource) CurId() resid.ResId {
 
 // GetRefBy returns the ResIds that referred to current resource
 func (r *Resource) GetRefBy() []resid.ResId {
-	return r.refBy
+	var resIds []resid.ResId
+	asStrings := r.getCsvAnnotation(utils.BuildAnnotationsRefBy)
+	for _, s := range asStrings {
+		resIds = append(resIds, resid.FromString(s))
+	}
+	return resIds
 }
 
 // AppendRefBy appends a ResId into the refBy list
-func (r *Resource) AppendRefBy(id resid.ResId) {
-	r.refBy = append(r.refBy, id)
+// Using any type except fmt.Stringer here results in a compilation error
+func (r *Resource) AppendRefBy(id fmt.Stringer) {
+	r.appendCsvAnnotation(utils.BuildAnnotationsRefBy, id.String())
 }
 
 // GetRefVarNames returns vars that refer to current resource
@@ -424,3 +449,17 @@ func mergeStringMaps(maps ...map[string]string) map[string]string {
 	}
 	return result
 }
+
+func mergeStringMapsWithBuildAnnotations(maps ...map[string]string) map[string]string {
+	result := mergeStringMaps(maps...)
+	for i := range BuildAnnotations {
+		if len(maps) > 0 {
+			if v, ok := maps[0][BuildAnnotations[i]]; ok {
+				result[BuildAnnotations[i]] = v
+				continue
+			}
+		}
+		delete(result, BuildAnnotations[i])
+	}
+	return result
+}

api/resource/resource_test.go

@@ -28,8 +28,6 @@ var testConfigMap = factory.FromMap(
 		},
 	})
 
-const genArgOptions = "{nsfx:false,beh:unspecified}"
-
 //nolint:gosec
 const configMapAsString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
 
@@ -66,17 +64,15 @@ func TestResourceString(t *testing.T) {
 	}{
 		{
 			in: testConfigMap,
-			s:  configMapAsString + genArgOptions,
+			s:  configMapAsString,
 		},
 		{
 			in: testDeployment,
-			s:  deploymentAsString + genArgOptions,
+			s:  deploymentAsString,
 		},
 	}
 	for _, test := range tests {
-		if test.in.String() != test.s {
-			t.Fatalf("Expected %s == %s", test.in.String(), test.s)
-		}
+		assert.Equal(t, test.in.String(), test.s)
 	}
 }
 
@@ -284,6 +280,266 @@ spec:
 `, string(bytes))
 }
 
+func TestApplySmPatchShouldOutputListItemsInCorrectOrder(t *testing.T) {
+	cases := []struct {
+		name           string
+		skip           bool
+		patch          string
+		expectedOutput string
+	}{
+		{
+			name: "Order should not change when patch has foo only",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: foo
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+  - name: foo
+  - name: bar
+`,
+		},
+		{
+			name: "Order changes when patch has bar only",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: bar
+`,
+			// This test records current behavior, but this behavior might be undesirable.
+			// If so, feel free to change the test to pass with some improved algorithm.
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+  - name: bar
+  - name: foo
+`,
+		},
+		{
+			name: "Order should not change and should include a new item at the beginning when patch has a new list item",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: baz
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+  - name: baz
+  - name: foo
+  - name: bar
+`,
+		},
+		{
+			name: "Order should not change when patch has foo and bar in same order",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: foo
+    - name: bar
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+  - name: foo
+  - name: bar
+`,
+		},
+		{
+			name: "Order should change when patch has foo and bar in different order",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: bar
+    - name: foo
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+  - name: bar
+  - name: foo
+`,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.skip {
+				t.Skip()
+			}
+
+			resource, err := factory.FromBytes([]byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+spec:
+  initContainers:
+    - name: foo
+    - name: bar
+`))
+			assert.NoError(t, err)
+
+			patch, err := factory.FromBytes([]byte(tc.patch))
+			assert.NoError(t, err)
+			assert.NoError(t, resource.ApplySmPatch(patch))
+			bytes, err := resource.AsYAML()
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expectedOutput, string(bytes))
+		})
+	}
+}
+
+func TestApplySmPatchShouldOutputPrimitiveListItemsInCorrectOrder(t *testing.T) {
+	cases := []struct {
+		name           string
+		skip           bool
+		patch          string
+		expectedOutput string
+	}{
+		{
+			name: "Order should not change when patch has foo only",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  finalizers: ["foo"]
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  finalizers:
+  - foo
+  - bar
+  name: test
+`,
+		},
+		{
+			name: "Order should not change when patch has bar only",
+			skip: true, // TODO: This test should pass but fails currently. Fix the problem and unskip this test
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+ name: test
+ finalizers: ["bar"]
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+ finalizers:
+ - foo
+ - bar
+ name: test
+`,
+		},
+		{
+			name: "Order should not change and should include a new item at the beginning when patch has a new list item",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  finalizers: ["baz"]
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  finalizers:
+  - baz
+  - foo
+  - bar
+  name: test
+`,
+		},
+		{
+			name: "Order should not change when patch has foo and bar in same order",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  finalizers: ["foo", "bar"]
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  finalizers:
+  - foo
+  - bar
+  name: test
+`,
+		},
+		{
+			name: "Order should change when patch has foo and bar in different order",
+			patch: `apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  finalizers: ["bar", "foo"]
+`,
+			expectedOutput: `apiVersion: v1
+kind: Pod
+metadata:
+  finalizers:
+  - bar
+  - foo
+  name: test
+`,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.skip {
+				t.Skip()
+			}
+
+			resource, err := factory.FromBytes([]byte(`
+kind: Pod
+metadata:
+  name: test
+  finalizers: ["foo", "bar"]
+`))
+			assert.NoError(t, err)
+
+			patch, err := factory.FromBytes([]byte(tc.patch))
+			assert.NoError(t, err)
+			assert.NoError(t, resource.ApplySmPatch(patch))
+			bytes, err := resource.AsYAML()
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expectedOutput, string(bytes))
+		})
+	}
+}
+
 func TestMergeDataMapFrom(t *testing.T) {
 	resource, err := factory.FromBytes([]byte(`
 apiVersion: v1
@@ -717,9 +973,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret
-    config.kubernetes.io/previousNames: oldName
-    config.kubernetes.io/previousNamespaces: default
+    internal.config.kubernetes.io/previousKinds: Secret
+    internal.config.kubernetes.io/previousNames: oldName
+    internal.config.kubernetes.io/previousNamespaces: default
   name: newName
 `,
 		},
@@ -729,9 +985,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret
-    config.kubernetes.io/previousNames: oldName
-    config.kubernetes.io/previousNamespaces: default
+    internal.config.kubernetes.io/previousKinds: Secret
+    internal.config.kubernetes.io/previousNames: oldName
+    internal.config.kubernetes.io/previousNamespaces: default
   name: oldName2
 `,
 			newName: "newName",
@@ -740,9 +996,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret,Secret
-    config.kubernetes.io/previousNames: oldName,oldName2
-    config.kubernetes.io/previousNamespaces: default,default
+    internal.config.kubernetes.io/previousKinds: Secret,Secret
+    internal.config.kubernetes.io/previousNames: oldName,oldName2
+    internal.config.kubernetes.io/previousNamespaces: default,default
   name: newName
 `,
 		},
@@ -752,9 +1008,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret
-    config.kubernetes.io/previousNames: oldName
-    config.kubernetes.io/previousNamespaces: default
+    internal.config.kubernetes.io/previousKinds: Secret
+    internal.config.kubernetes.io/previousNames: oldName
+    internal.config.kubernetes.io/previousNamespaces: default
   name: oldName2
   namespace: oldNamespace
 `,
@@ -764,9 +1020,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret,Secret
-    config.kubernetes.io/previousNames: oldName,oldName2
-    config.kubernetes.io/previousNamespaces: default,oldNamespace
+    internal.config.kubernetes.io/previousKinds: Secret,Secret
+    internal.config.kubernetes.io/previousNames: oldName,oldName2
+    internal.config.kubernetes.io/previousNamespaces: default,oldNamespace
   name: newName
   namespace: newNamespace
 `,
@@ -814,9 +1070,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret
-    config.kubernetes.io/previousNames: oldName
-    config.kubernetes.io/previousNamespaces: default
+    internal.config.kubernetes.io/previousKinds: Secret
+    internal.config.kubernetes.io/previousNames: oldName
+    internal.config.kubernetes.io/previousNamespaces: default
   name: newName
 `,
 			expected: []resid.ResId{
@@ -833,9 +1089,9 @@ metadata:
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/previousKinds: Secret,Secret
-    config.kubernetes.io/previousNames: oldName,oldName2
-    config.kubernetes.io/previousNamespaces: default,oldNamespace
+    internal.config.kubernetes.io/previousKinds: Secret,Secret
+    internal.config.kubernetes.io/previousNames: oldName,oldName2
+    internal.config.kubernetes.io/previousNamespaces: default,oldNamespace
   name: newName
   namespace: newNamespace
 `,
@@ -1133,3 +1389,41 @@ spec:
 		t.Fatalf("expected '%s', got '%s'", expected, actual)
 	}
 }
+
+func TestRefBy(t *testing.T) {
+	r, err := factory.FromBytes([]byte(`
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+spec:
+  numReplicas: 1
+`))
+	assert.NoError(t, err)
+	r.AppendRefBy(resid.FromString("gr1_ver1_knd1|ns1|name1"))
+	assert.Equal(t, r.RNode.MustString(), `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+  annotations:
+    internal.config.kubernetes.io/refBy: gr1_ver1_knd1|ns1|name1
+spec:
+  numReplicas: 1
+`)
+	assert.Equal(t, r.GetRefBy(), []resid.ResId{resid.FromString("gr1_ver1_knd1|ns1|name1")})
+
+	r.AppendRefBy(resid.FromString("gr2_ver2_knd2|ns2|name2"))
+	assert.Equal(t, r.RNode.MustString(), `apiVersion: v1
+kind: Deployment
+metadata:
+  name: clown
+  annotations:
+    internal.config.kubernetes.io/refBy: gr1_ver1_knd1|ns1|name1,gr2_ver2_knd2|ns2|name2
+spec:
+  numReplicas: 1
+`)
+	assert.Equal(t, r.GetRefBy(), []resid.ResId{
+		resid.FromString("gr1_ver1_knd1|ns1|name1"),
+		resid.FromString("gr2_ver2_knd2|ns2|name2"),
+	})
+}

api/testutils/kusttest/harnessenhanced.go

@@ -148,6 +148,13 @@ func (th *HarnessEnhanced) ResetLoaderRoot(root string) {
 }
 
 func (th *HarnessEnhanced) LoadAndRunGenerator(
+	config string) resmap.ResMap {
+	rm := th.LoadAndRunGeneratorWithBuildAnnotations(config)
+	rm.RemoveBuildAnnotations()
+	return rm
+}
+
+func (th *HarnessEnhanced) LoadAndRunGeneratorWithBuildAnnotations(
 	config string) resmap.ResMap {
 	res, err := th.rf.RF().FromBytes([]byte(config))
 	if err != nil {
@@ -162,7 +169,6 @@ func (th *HarnessEnhanced) LoadAndRunGenerator(
 	if err != nil {
 		th.t.Fatalf("generate err: %v", err)
 	}
-	rm.RemoveBuildAnnotations()
 	return rm
 }
 

api/types/genargs.go

@@ -1,46 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-import (
-	"strconv"
-	"strings"
-)
-
-// GenArgs is a facade over GeneratorArgs, exposing a few readonly properties.
-type GenArgs struct {
-	args *GeneratorArgs
-}
-
-// NewGenArgs returns a new instance of GenArgs.
-func NewGenArgs(args *GeneratorArgs) *GenArgs {
-	return &GenArgs{args: args}
-}
-
-func (g *GenArgs) String() string {
-	if g == nil {
-		return "{nilGenArgs}"
-	}
-	return "{" +
-		strings.Join([]string{
-			"nsfx:" + strconv.FormatBool(g.ShouldAddHashSuffixToName()),
-			"beh:" + g.Behavior().String()},
-			",") +
-		"}"
-}
-
-// ShouldAddHashSuffixToName returns true if a resource
-// content hash should be appended to the name of the resource.
-func (g *GenArgs) ShouldAddHashSuffixToName() bool {
-	return g.args != nil &&
-		(g.args.Options == nil || !g.args.Options.DisableNameSuffixHash)
-}
-
-// Behavior returns Behavior field of GeneratorArgs
-func (g *GenArgs) Behavior() GenerationBehavior {
-	if g == nil || g.args == nil {
-		return BehaviorUnspecified
-	}
-	return NewGenerationBehavior(g.args.Behavior)
-}

api/types/genargs_test.go

@@ -1,39 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types_test
-
-import (
-	"testing"
-
-	. "sigs.k8s.io/kustomize/api/types"
-)
-
-func TestGenArgs_String(t *testing.T) {
-	tests := []struct {
-		ga       *GenArgs
-		expected string
-	}{
-		{
-			ga:       nil,
-			expected: "{nilGenArgs}",
-		},
-		{
-			ga:       &GenArgs{},
-			expected: "{nsfx:false,beh:unspecified}",
-		},
-		{
-			ga: NewGenArgs(
-				&GeneratorArgs{
-					Behavior: "merge",
-					Options:  &GeneratorOptions{DisableNameSuffixHash: false},
-				}),
-			expected: "{nsfx:true,beh:merge}",
-		},
-	}
-	for _, test := range tests {
-		if test.ga.String() != test.expected {
-			t.Fatalf("Expected '%s', got '%s'", test.expected, test.ga.String())
-		}
-	}
-}

api/types/kustomization.go

@@ -161,6 +161,9 @@ type Kustomization struct {
 	// Inventory appends an object that contains the record
 	// of all other objects, which can be used in apply, prune and delete
 	Inventory *Inventory `json:"inventory,omitempty" yaml:"inventory,omitempty"`
+
+	// BuildMetadata is a list of strings used to toggle different build options
+	BuildMetadata []string `json:"buildMetadata,omitempty" yaml:"buildMetadata,omitempty"`
 }
 
 // FixKustomizationPostUnmarshalling fixes things

api/types/pluginrestrictions.go

@@ -57,4 +57,6 @@ type FnPluginLoadingOptions struct {
 	Env []string
 	// Run as uid and gid of the command executor
 	AsCurrentUser bool
+	// Run in this working directory
+	WorkingDir string
 }

api/types/replacement.go

@@ -16,10 +16,10 @@ const DefaultReplacementFieldPath = "metadata.name"
 // where it is from and where it is to.
 type Replacement struct {
 	// The source of the value.
-	Source *SourceSelector `json:"source" yaml:"source"`
+	Source *SourceSelector `json:"source,omitempty" yaml:"source,omitempty"`
 
 	// The N fields to write the value to.
-	Targets []*TargetSelector `json:"targets" yaml:"targets"`
+	Targets []*TargetSelector `json:"targets,omitempty" yaml:"targets,omitempty"`
 }
 
 // SourceSelector is the source of the replacement transformer.

cmd/config/OWNERS

@@ -0,0 +1,6 @@
+# See https://github.com/kubernetes/community/blob/master/community-membership.md
+approvers:
+  - kyaml-approvers
+
+reviewers:
+  - kyaml-reviewers

cmd/config/docs/api-conventions/functions-impl.md

@@ -5,7 +5,7 @@ container workflow orchestrator including Tekton, Cloud Build, or run directly u
 
 Run `config help docs-fn-spec` to see the Configuration Functions Specification.
 
-`kustomize config run` is an example orchestrator for invoking Configuration Functions. This
+`kustomize fn run` is an example orchestrator for invoking Configuration Functions. This
 document describes how to implement and invoke an example function.
 
 ## Example Function Implementation
@@ -28,7 +28,7 @@ The script wraps itself using `config run wrap -- $0` which will:
 
 ```bash
 #!/bin/bash
-# script must run wrapped by "kustomize config run wrap"
+# script must run wrapped by "kustomize fn run wrap"
 # for parsing input the functionConfig into env vars
 if [ -z ${WRAPPED} ]; then
   export WRAPPED=true
@@ -82,7 +82,7 @@ End-of-message
 
 ### Dockerfile
 
-`Dockerfile` installs `kustomize config` and copies the script into the container image.
+`Dockerfile` installs `kustomize fn` and copies the script into the container image.
 
 ```
 FROM golang:1.13-stretch
@@ -94,9 +94,9 @@ CMD ["nginx-template.sh]
 
 ## Example Function Usage
 
-Following is an example of running the `kustomize config run` using the preceding API.
+Following is an example of running the `kustomize fn run` using the preceding API.
 
-When run by `kustomize config run`, functions are run in containers with the
+When run by `kustomize fn run`, functions are run in containers with the
 following environment:
 
 - Network: `none`
@@ -129,7 +129,7 @@ spec:
 
 ### Output
 
-The function is invoked using byrunning `kustomize config run dir/`.
+The function is invoked using byrunning `kustomize fn run dir/`.
 
 `dir/my-instance_deployment.yaml` contains the Deployment:
 

cmd/config/docs/api-conventions/functions-spec.md

@@ -245,8 +245,8 @@ items:
       labels:
         app: wordpress
       annotations:
-        config.kubernetes.io/index: "0"
-        config.kubernetes.io/path: "service.yaml"
+        internal.config.kubernetes.io/index: "0"
+        internal.config.kubernetes.io/path: "service.yaml"
     spec: # Example comment
       type: LoadBalancer
       selector:
@@ -271,8 +271,8 @@ items:
       labels:
         app: wordpress
       annotations:
-        config.kubernetes.io/index: "0"
-        config.kubernetes.io/path: "service.yaml"
+        internal.config.kubernetes.io/index: "0"
+        internal.config.kubernetes.io/path: "service.yaml"
     spec: # Example comment
       type: LoadBalancer
       selector:
@@ -327,49 +327,51 @@ A function SHOULD preserve comments when input serialization format is YAML.
 This allows for human authoring of configuration to coexist with changes made by
 functions.
 
-### Annotations
+### Internal Annotations
 
-The orchestrator annotates resources in the wire format with annotation prefix
-`config.kubernetes.io`. These annotations are not persisted when the
-orchestrator writes the resources to the filesystem. The orchestrator sets this
-annotation when reading files from the local filesystem and removes the
-annotation when writing the output of functions back to the filesystem.
+For orchestration purposes, the orchestrator will use a set of annotations,
+referred to as _internal annotations_, on resources in `Resources.items`. These
+annotations are not persisted to resource manifests on the filesystem: The
+orchestrator sets this annotation when reading files from the local filesystem
+and removes the annotation when writing the output of functions back to the
+filesystem.
 
-In general, a function MUST NOT modify these annotations except the ones
-explicitly listed below.
+Annotation prefix `internal.config.kubernetes.io` is reserved for use for
+internal annotations. In general, a function MUST NOT modify these annotations with
+the exception of the specific annotations listed below. This enables orchestrators to add additional internal annotations, without requiring changes to existing functions.
 
-#### `config.kubernetes.io/path`
+#### `internal.config.kubernetes.io/path`
 
 Records the slash-delimited, OS-agnostic, relative file path to a resource. The
 path is relative to a fix location on the filesystem. Different orchestrator
 implementations can choose different fixed points.
 
-A function SHOULD NOT modify this annotation.
+A function SHOULD NOT modify these annotations.
 
 Example:
 
 ```yaml
 metadata:
   annotations:
-    config.kubernetes.io/path: "relative/file/path.yaml"
+    internal.config.kubernetes.io/path: "relative/file/path.yaml"
 ```
 
-#### `config.kubernetes.io/index`
+#### `internal.config.kubernetes.io/index`
 
 Records the index of a Resource in file. In a multi-object YAML file, resources
 are separated by three dashes (`---`), and the index represents the position of
 the Resource starting from zero. When this annotation is not specified, it
 implies a value of `0`.
 
-A function SHOULD NOT modify this annotation.
+A function SHOULD NOT modify these annotations.
 
 Example:
 
 ```yaml
 metadata:
   annotations:
-    config.kubernetes.io/path: "relative/file/path.yaml"
-    config.kubernetes.io/index: 2
+    internal.config.kubernetes.io/path: "relative/file/path.yaml"
+    internal.config.kubernetes.io/index: 2
 ```
 
 This represents the third resource in the file.

cmd/config/docs/api-conventions/manifest-annotations.md

@@ -0,0 +1,11 @@
+# Manifest Annotations
+
+This document lists the annotations that can be declared in resource manifests.
+
+### `config.kubernetes.io/local-config`
+
+A value of `"true"` for this annotation declares that the resource is only consumed by
+client-side tooling and should not be applied to the API server.
+
+A value of `"false"` can be used to declare that a resource should be applied to
+the API server even when it is assumed to be local.

cmd/config/docs/tutorials/function-basics.md

@@ -2,7 +2,7 @@
 
 ### Synopsis
 
-  `kustomize config` enables encapsulating function for manipulating Resource
+  `kustomize fn` enables encapsulating function for manipulating Resource
   configuration inside containers, which are run using `run`.
 
   First fetch the kustomize repository, which contains a collection of example
@@ -14,7 +14,7 @@
 ### Templating -- CockroachDB
 
   This section demonstrates how to leverage templating based solutions from
-  `kustomize config`.  The templating function is implemented as a `bash` script
+  `kustomize fn`.  The templating function is implemented as a `bash` script
   using a `heredoc`.
 
   #### 1: Generate the Resources

cmd/config/go.mod

@@ -16,5 +16,7 @@ require (
 	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
 	gopkg.in/inf.v0 v0.9.1
 	k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e
-	sigs.k8s.io/kustomize/kyaml v0.11.0
+	sigs.k8s.io/kustomize/kyaml v0.12.0
 )
+
+replace sigs.k8s.io/kustomize/kyaml => ../../kyaml

cmd/config/go.sum

@@ -245,7 +245,6 @@ k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e h1:KLHHjkdQFomZy8+06csTWZ0m1343QqxZhR2LJ1OxCYM=
 k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
-sigs.k8s.io/kustomize/kyaml v0.11.0 h1:9KhiCPKaVyuPcgOLJXkvytOvjMJLoxpjodiycb4gHsA=
-sigs.k8s.io/kustomize/kyaml v0.11.0/go.mod h1:GNMwjim4Ypgp/MueD3zXHLRJEjz7RvtPae0AwlvEMFM=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

cmd/config/internal/commands/annotate.go

@@ -21,12 +21,13 @@ import (
 func NewAnnotateRunner(parent string) *AnnotateRunner {
 	r := &AnnotateRunner{}
 	c := &cobra.Command{
-		Use:     "annotate [DIR]",
-		Args:    cobra.MaximumNArgs(1),
-		Short:   commands.AnnotateShort,
-		Long:    commands.AnnotateLong,
-		Example: commands.AnnotateExamples,
-		RunE:    r.runE,
+		Use:        "annotate [DIR]",
+		Args:       cobra.MaximumNArgs(1),
+		Short:      commands.AnnotateShort,
+		Long:       commands.AnnotateLong,
+		Example:    commands.AnnotateExamples,
+		RunE:       r.runE,
+		Deprecated: "use the `commonAnnotations` field in your kustomization file.",
 	}
 	runner.FixDocs(parent, c)
 	r.Command = c

cmd/config/internal/commands/annotate_test.go

@@ -164,6 +164,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -175,6 +177,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -191,6 +195,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -206,6 +212,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -222,6 +230,8 @@ metadata:
     c: 'd'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -234,6 +244,8 @@ metadata:
     c: 'd'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -251,6 +263,8 @@ metadata:
     c: 'd'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -267,6 +281,8 @@ metadata:
     c: 'd'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -281,6 +297,8 @@ metadata:
     app: nginx2
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -292,6 +310,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -307,6 +327,8 @@ metadata:
     config.kubernetes.io/local-config: "true"
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -321,6 +343,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -335,6 +359,8 @@ metadata:
     app: nginx2
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -345,6 +371,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -361,6 +389,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -375,6 +405,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -389,6 +421,8 @@ metadata:
     app: nginx2
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -399,6 +433,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -414,6 +450,8 @@ metadata:
     config.kubernetes.io/local-config: "true"
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -429,6 +467,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -443,6 +483,8 @@ metadata:
     app: nginx2
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -453,6 +495,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -469,6 +513,8 @@ metadata:
     a: 'b'
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: bar
 spec:
   replicas: 3
@@ -483,6 +529,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f2.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f2.yaml'
   namespace: foo
 spec:
   replicas: 3
@@ -559,7 +607,7 @@ added annotations in the package
 
 			expected := strings.Replace(test.expected, "${baseDir}", baseDir, -1)
 			expectedNormalized := strings.Replace(expected, "\\", "/", -1)
-			if !assert.Equal(t, expectedNormalized, actualNormalized) {
+			if !assert.Contains(t, actualNormalized, expectedNormalized) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/cat.go

@@ -17,6 +17,7 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/kio/filters"
+	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -165,6 +166,7 @@ func (r *CatRunner) catFilters() []kio.Filter {
 	return fltrs
 }
 
+// nolint
 func (r *CatRunner) out(w io.Writer) ([]kio.Writer, error) {
 	var outputs []kio.Writer
 	var functionConfig *yaml.RNode
@@ -182,7 +184,7 @@ func (r *CatRunner) out(w io.Writer) ([]kio.Writer, error) {
 
 	// remove this annotation explicitly, the ByteWriter won't clear it by
 	// default because it doesn't set it
-	clear := []string{"config.kubernetes.io/path"}
+	clear := []string{kioutil.LegacyPathAnnotation, kioutil.PathAnnotation}
 	if r.KeepAnnotations {
 		clear = nil
 	}

cmd/config/internal/commands/cmdcreatesetter.go

@@ -32,6 +32,8 @@ func NewCreateSetterRunner(parent string) *CreateSetterRunner {
 		Example: commands.CreateSetterExamples,
 		PreRunE: r.preRunE,
 		RunE:    r.runE,
+		Deprecated: "setter commands will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	set.Flags().StringVar(&r.FieldValue, "value", "",
 		"optional flag, alternative to specifying the value as an argument. e.g. used to specify values that start with '-'")

cmd/config/internal/commands/cmdcreatesetter_test.go

@@ -869,7 +869,7 @@ setter with name "namespace" already exists, if you want to modify it, please de
 
 			expected := strings.Replace(test.expected, "${baseDir}", baseDir, -1)
 			expectedNormalized := strings.Replace(expected, "\\", "/", -1)
-			if !assert.Equal(t, expectedNormalized, actualNormalized) {
+			if !assert.Contains(t, actualNormalized, expectedNormalized) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/cmdcreatesubstitution.go

@@ -23,6 +23,8 @@ func NewCreateSubstitutionRunner(parent string) *CreateSubstitutionRunner {
 		Args:   cobra.ExactArgs(2),
 		PreRun: r.preRun,
 		RunE:   r.runE,
+		Deprecated: "imperative substitutions will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	cs.Flags().StringVar(&r.CreateSubstitution.FieldName, "field", "",
 		"name of the field to set -- e.g. --field image")

cmd/config/internal/commands/cmdcreatesubstitution_test.go

@@ -506,7 +506,7 @@ created substitution "image-tag"`,
 
 			expected := strings.Replace(test.expected, "${baseDir}", baseDir, -1)
 			expectedNormalized := strings.Replace(expected, "\\", "/", -1)
-			if !assert.Equal(t, strings.TrimSpace(expectedNormalized), strings.TrimSpace(actualNormalized)) {
+			if !assert.Contains(t, strings.TrimSpace(actualNormalized), strings.TrimSpace(expectedNormalized)) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/cmdinit.go

@@ -26,6 +26,8 @@ func GetInitRunner(name string) *InitRunner {
 		Long:    commands.InitLong,
 		Example: commands.InitExamples,
 		RunE:    r.runE,
+		Deprecated: "setter commands and substitutions will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	runner.FixDocs(name, c)
 	r.Command = c

cmd/config/internal/commands/cmdlistsetters.go

@@ -31,6 +31,8 @@ func NewListSettersRunner(parent string) *ListSettersRunner {
 		Example: commands.ListSettersExamples,
 		PreRunE: r.preRunE,
 		RunE:    r.runE,
+		Deprecated: "setter commands will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	c.Flags().BoolVar(&r.Markdown, "markdown", false,
 		"output as github markdown")

cmd/config/internal/commands/cmdlistsetters_test.go

@@ -525,7 +525,7 @@ test/testdata/dataset-with-setters/mysql/
 			// normalize path format for windows
 			actualNormalized := strings.Replace(actual.String(), "\\", "/", -1)
 
-			if !assert.Equal(t, strings.TrimSpace(test.expected), strings.TrimSpace(actualNormalized)) {
+			if !assert.Contains(t, strings.TrimSpace(actualNormalized), strings.TrimSpace(test.expected)) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/cmdset.go

@@ -27,6 +27,8 @@ func NewSetRunner(parent string) *SetRunner {
 		Example: commands.SetExamples,
 		PreRunE: r.preRunE,
 		RunE:    r.runE,
+		Deprecated: "setter commands will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	runner.FixDocs(parent, c)
 	r.Command = c

cmd/config/internal/commands/cmdset_test.go

@@ -1137,7 +1137,7 @@ set 1 field(s) of setter "namespace" to value "otherspace"
 			expectedNormalized := strings.Replace(
 				strings.Replace(expected, "\\", "/", -1),
 				"//", "/", -1)
-			if !assert.Equal(t, strings.TrimSpace(expectedNormalized), strings.TrimSpace(actualNormalized)) {
+			if !assert.Contains(t, strings.TrimSpace(actualNormalized), strings.TrimSpace(expectedNormalized)) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/cmdwrap.go

@@ -5,6 +5,7 @@ package commands
 
 import (
 	"bytes"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -47,6 +48,7 @@ Environment Variables:
 
 `,
 		RunE:               r.runE,
+		PreRunE:            r.preRunE,
 		SilenceUsage:       true,
 		FParseErrWhitelist: cobra.FParseErrWhitelist{UnknownFlags: true},
 		Args:               cobra.MinimumNArgs(1),
@@ -78,6 +80,12 @@ func WrapCommand() *cobra.Command {
 	return GetWrapRunner().Command
 }
 
+func (r *WrapRunner) preRunE(_ *cobra.Command, _ []string) error {
+	_, err := fmt.Fprintln(os.Stderr, `Command "wrap" is deprecated, this will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.`)
+	return err
+}
+
 func (r *WrapRunner) runE(c *cobra.Command, args []string) error {
 	if r.getEnv == nil {
 		r.getEnv = os.Getenv

cmd/config/internal/commands/cmdwrap_test.go

@@ -14,7 +14,7 @@ import (
 )
 
 const (
-	input = `apiVersion: config.kubernetes.io/v1alpha1
+	input = `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 functionConfig:
   metadata:
@@ -68,7 +68,7 @@ items:
       name: test
 `
 
-	output = `apiVersion: config.kubernetes.io/v1alpha1
+	output = `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - apiVersion: apps/v1
@@ -81,6 +81,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_deployment.yaml'
   spec:
     replicas: 11
     selector:
@@ -112,6 +114,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_service.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_service.yaml'
   spec:
     selector:
       name: test
@@ -123,7 +127,7 @@ items:
       targetPort: 8080
 `
 
-	outputNoMerge = `apiVersion: config.kubernetes.io/v1alpha1
+	outputNoMerge = `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - apiVersion: apps/v1
@@ -136,6 +140,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_deployment.yaml'
   spec:
     replicas: 11
     selector:
@@ -164,6 +170,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_service.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_service.yaml'
   spec:
     selector:
       name: test
@@ -175,7 +183,7 @@ items:
       targetPort: 8080
 `
 
-	outputOverride = `apiVersion: config.kubernetes.io/v1alpha1
+	outputOverride = `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - apiVersion: apps/v1
@@ -186,6 +194,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/mysql-deployment_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/mysql-deployment_deployment.yaml'
   spec:
     replicas: 3
     template:
@@ -201,6 +211,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/nosetters-deployment_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/nosetters-deployment_deployment.yaml'
   spec:
     replicas: 4
     template:
@@ -216,6 +228,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/storage-deployment_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/storage-deployment_deployment.yaml'
   spec:
     replicas: 4
     template:
@@ -233,6 +247,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_deployment.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_deployment.yaml'
   spec:
     replicas: 11
     selector:
@@ -264,6 +280,8 @@ items:
     annotations:
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'config/test_service.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'config/test_service.yaml'
   spec:
     selector:
       name: test

cmd/config/internal/commands/cmdxargs.go

@@ -60,6 +60,7 @@ $ kyaml cat pkg/ --function-config config.yaml --wrap-kind ResourceList | kyaml
 
 `,
 		RunE:               r.runE,
+		PreRunE:            r.preRunE,
 		SilenceUsage:       true,
 		FParseErrWhitelist: cobra.FParseErrWhitelist{UnknownFlags: true},
 		Args:               cobra.MinimumNArgs(1),
@@ -84,6 +85,12 @@ func XArgsCommand() *cobra.Command {
 	return GetXArgsRunner().Command
 }
 
+func (r *XArgsRunner) preRunE(_ *cobra.Command, _ []string) error {
+	_, err := fmt.Fprintln(os.Stderr, `Command "xargs" is deprecated, this will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.`)
+	return err
+}
+
 func (r *XArgsRunner) runE(c *cobra.Command, _ []string) error {
 	if len(r.Args) == 0 {
 		r.Args = os.Args

cmd/config/internal/commands/cmdxargs_test.go

@@ -39,7 +39,7 @@ functionConfig:
   - 4
 `
 
-	resourceInput = `apiVersion: config.kubernetes.io/v1alpha1
+	resourceInput = `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - apiVersion: apps/v1

cmd/config/internal/commands/e2e/e2e_test.go

@@ -542,13 +542,13 @@ kind: Input
 metadata:
   name: foo
   annotations:
-    a-bool-value: true
-    a-int-value: 2
-    a-string-value: a
     config.kubernetes.io/function: |
       starlark:
         path: script.star
         name: fn
+    a-bool-value: true
+    a-int-value: 2
+    a-string-value: a
 data:
   boolValue: true
   intValue: 2

cmd/config/internal/commands/fmt.go

@@ -25,6 +25,8 @@ func GetFmtRunner(name string) *FmtRunner {
 		Example: commands.FmtExamples,
 		RunE:    r.runE,
 		PreRunE: r.preRunE,
+		Deprecated: "imperative formatting will no longer be available in kustomize v5.\n" +
+			"Declare a formatting transformer in your kustomization instead.",
 	}
 	runner.FixDocs(name, c)
 	c.Flags().StringVar(&r.FilenamePattern, "pattern", filters.DefaultFilenamePattern,

cmd/config/internal/commands/fmt_test.go

@@ -78,7 +78,7 @@ func TestFmtCommand_stdin(t *testing.T) {
 	assert.NoError(t, err)
 
 	// verify the output
-	assert.Equal(t, string(testyaml.FormattedYaml1), out.String())
+	assert.Contains(t, out.String(), string(testyaml.FormattedYaml1))
 }
 
 // TestCmd_filesAndstdin verifies that if both files and stdin input are provided, only
@@ -238,7 +238,7 @@ formatted resource files in the package
 
 			expected := strings.Replace(test.expected, "${baseDir}", baseDir, -1)
 			expectedNormalized := strings.Replace(expected, "\\", "/", -1)
-			if !assert.Equal(t, strings.TrimSpace(expectedNormalized), strings.TrimSpace(actualNormalized)) {
+			if !assert.Contains(t, strings.TrimSpace(actualNormalized), strings.TrimSpace(expectedNormalized)) {
 				t.FailNow()
 			}
 		})

cmd/config/internal/commands/grep_test.go

@@ -79,6 +79,8 @@ metadata:
     app: nginx2
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   replicas: 1
 ---
@@ -89,6 +91,8 @@ metadata:
     app: nginx
     config.kubernetes.io/index: '1'
     config.kubernetes.io/path: 'f1.yaml'
+    internal.config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/path: 'f1.yaml'
 spec:
   selector:
     app: nginx
@@ -146,6 +150,7 @@ metadata:
   annotations:
     app: nginx2
     config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/index: '0'
 spec:
   replicas: 1
 ---
@@ -155,6 +160,7 @@ metadata:
   annotations:
     app: nginx
     config.kubernetes.io/index: '1'
+    internal.config.kubernetes.io/index: '1'
 spec:
   selector:
     app: nginx
@@ -295,6 +301,8 @@ metadata:
   annotations:
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'deployment.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'deployment.yaml'
 spec:
   replicas: 3
   template:
@@ -314,6 +322,8 @@ metadata:
   annotations:
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'deployment.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'deployment.yaml'
 spec:
   replicas: 4
   template:
@@ -339,6 +349,8 @@ metadata:
   annotations:
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'deployment.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'deployment.yaml'
 spec:
   replicas: 3
   template:
@@ -364,6 +376,8 @@ metadata:
   annotations:
     config.kubernetes.io/index: '0'
     config.kubernetes.io/path: 'deployment.yaml'
+    internal.config.kubernetes.io/index: '0'
+    internal.config.kubernetes.io/path: 'deployment.yaml'
 spec:
   replicas: 4
   template:

cmd/config/internal/commands/init_test.go

@@ -43,7 +43,9 @@ kind: Krmfile
 		t.FailNow()
 	}
 
-	if !assert.Equal(t, "", b.String()) {
+	if !assert.Equal(t, `Command "init" is deprecated, setter commands and substitutions will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.
+`, b.String()) {
 		t.FailNow()
 	}
 }
@@ -78,7 +80,9 @@ kind: Krmfile
 		t.FailNow()
 	}
 
-	if !assert.Equal(t, "", b.String()) {
+	if !assert.Equal(t, `Command "init" is deprecated, setter commands and substitutions will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.
+`, b.String()) {
 		t.FailNow()
 	}
 }

cmd/config/internal/commands/merge.go

@@ -19,6 +19,8 @@ func GetMergeRunner(name string) *MergeRunner {
 		Long:    commands.MergeLong,
 		Example: commands.MergeExamples,
 		RunE:    r.runE,
+		Deprecated: "this will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	runner.FixDocs(name, c)
 	r.Command = c

cmd/config/internal/commands/merge3.go

@@ -18,6 +18,8 @@ func GetMerge3Runner(name string) *Merge3Runner {
 		Long:    commands.Merge3Long,
 		Example: commands.Merge3Examples,
 		RunE:    r.runE,
+		Deprecated: "this will no longer be available in kustomize v5.\n" +
+			"See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.",
 	}
 	runner.FixDocs(name, c)
 	c.Flags().StringVar(&r.ancestor, "ancestor", "",

cmd/config/internal/commands/run-fns.go

@@ -6,6 +6,7 @@ package commands
 import (
 	"fmt"
 	"io"
+	"os"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -73,6 +74,7 @@ func GetRunFnRunner(name string) *RunFnRunner {
 		"a list of environment variables to be used by functions")
 	r.Command.Flags().BoolVar(
 		&r.AsCurrentUser, "as-current-user", false, "use the uid and gid of the command executor to run the function in the container")
+
 	return r
 }
 
@@ -302,6 +304,11 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 	// parse mounts to set storageMounts
 	storageMounts := toStorageMounts(r.Mounts)
 
+	wd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+
 	r.RunFns = runfn.RunFns{
 		FunctionPaths:  r.FnPaths,
 		GlobalScope:    r.GlobalScope,
@@ -317,6 +324,7 @@ func (r *RunFnRunner) preRunE(c *cobra.Command, args []string) error {
 		LogSteps:       r.LogSteps,
 		Env:            r.Env,
 		AsCurrentUser:  r.AsCurrentUser,
+		WorkingDir:     wd,
 	}
 
 	// don't consider args for the function

cmd/config/internal/commands/run_test.go

@@ -11,13 +11,14 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
-
 	"sigs.k8s.io/kustomize/kyaml/runfn"
 )
 
 // TestRunFnCommand_preRunE verifies that preRunE correctly parses the commandline
 // flags and arguments into the RunFns structure to be executed.
 func TestRunFnCommand_preRunE(t *testing.T) {
+	wd, err := os.Getwd()
+	assert.NoError(t, err)
 	tests := []struct {
 		name           string
 		args           []string
@@ -201,6 +202,7 @@ apiVersion: v1
 				Path:           "dir",
 				EnableStarlark: true,
 				Env:            []string{},
+				WorkingDir:     wd,
 			},
 		},
 		{
@@ -254,6 +256,7 @@ apiVersion: v1
 				Path:       "dir",
 				ResultsDir: "foo/",
 				Env:        []string{},
+				WorkingDir: wd,
 			},
 			expected: `
 metadata:
@@ -286,9 +289,10 @@ apiVersion: v1
 			args: []string{"run", "dir", "--log-steps"},
 			path: "dir",
 			expectedStruct: &runfn.RunFns{
-				Path:     "dir",
-				LogSteps: true,
-				Env:      []string{},
+				Path:       "dir",
+				LogSteps:   true,
+				Env:        []string{},
+				WorkingDir: wd,
 			},
 		},
 		{
@@ -296,8 +300,9 @@ apiVersion: v1
 			args: []string{"run", "dir", "--env", "FOO=BAR", "-e", "BAR"},
 			path: "dir",
 			expectedStruct: &runfn.RunFns{
-				Path: "dir",
-				Env:  []string{"FOO=BAR", "BAR"},
+				Path:       "dir",
+				Env:        []string{"FOO=BAR", "BAR"},
+				WorkingDir: wd,
 			},
 		},
 		{
@@ -308,6 +313,7 @@ apiVersion: v1
 				Path:          "dir",
 				AsCurrentUser: true,
 				Env:           []string{},
+				WorkingDir:    wd,
 			},
 		},
 	}

cmd/config/internal/commands/sink.go

@@ -4,6 +4,9 @@
 package commands
 
 import (
+	"fmt"
+	"os"
+
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 	"sigs.k8s.io/kustomize/cmd/config/runner"
@@ -20,6 +23,7 @@ func GetSinkRunner(name string) *SinkRunner {
 		Long:    commands.SinkLong,
 		Example: commands.SinkExamples,
 		RunE:    r.runE,
+		PreRunE: r.preRunE,
 		Args:    cobra.MaximumNArgs(1),
 	}
 	runner.FixDocs(name, c)
@@ -36,6 +40,13 @@ type SinkRunner struct {
 	Command *cobra.Command
 }
 
+func (r *SinkRunner) preRunE(c *cobra.Command, args []string) error {
+	_, err := fmt.Fprintln(os.Stderr, `Command "sink" is deprecated, this will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.`)
+	return err
+}
+
+// nolint
 func (r *SinkRunner) runE(c *cobra.Command, args []string) error {
 	var outputs []kio.Writer
 	if len(args) == 1 {
@@ -43,7 +54,7 @@ func (r *SinkRunner) runE(c *cobra.Command, args []string) error {
 	} else {
 		outputs = []kio.Writer{&kio.ByteWriter{
 			Writer:           c.OutOrStdout(),
-			ClearAnnotations: []string{kioutil.PathAnnotation}},
+			ClearAnnotations: []string{kioutil.PathAnnotation, kioutil.LegacyPathAnnotation}},
 		}
 	}
 

cmd/config/internal/commands/sink_test.go

@@ -22,7 +22,7 @@ func TestSinkCommand(t *testing.T) {
 	defer os.RemoveAll(d)
 
 	r := commands.GetSinkRunner("")
-	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1alpha1
+	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - kind: Deployment
@@ -144,7 +144,7 @@ func TestSinkCommandJSON(t *testing.T) {
 	defer os.RemoveAll(d)
 
 	r := commands.GetSinkRunner("")
-	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1alpha1
+	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo",
@@ -191,7 +191,7 @@ func TestSinkCommand_Stdout(t *testing.T) {
 	// fmt the files
 	out := &bytes.Buffer{}
 	r := commands.GetSinkRunner("")
-	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1alpha1
+	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - kind: Deployment
@@ -305,7 +305,7 @@ func TestSinkCommandJSON_Stdout(t *testing.T) {
 	// fmt the files
 	out := &bytes.Buffer{}
 	r := commands.GetSinkRunner("")
-	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1alpha1
+	r.Command.SetIn(bytes.NewBufferString(`apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo",

cmd/config/internal/commands/source.go

@@ -5,6 +5,7 @@ package commands
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
@@ -22,6 +23,7 @@ func GetSourceRunner(name string) *SourceRunner {
 		Long:    commands.SourceLong,
 		Example: commands.SourceExamples,
 		RunE:    r.runE,
+		PreRunE: r.preRunE,
 	}
 	runner.FixDocs(name, c)
 	c.Flags().StringVar(&r.WrapKind, "wrap-kind", kio.ResourceListKind,
@@ -47,6 +49,12 @@ type SourceRunner struct {
 	Command        *cobra.Command
 }
 
+func (r *SourceRunner) preRunE(c *cobra.Command, args []string) error {
+	_, err := fmt.Fprintln(os.Stderr, `Command "source" is deprecated, this will no longer be available in kustomize v5.
+See discussion in https://github.com/kubernetes-sigs/kustomize/issues/3953.`)
+	return err
+}
+
 func (r *SourceRunner) runE(c *cobra.Command, args []string) error {
 	// if there is a function-config specified, emit it
 	var functionConfig *yaml.RNode

cmd/config/internal/commands/source_test.go

@@ -81,7 +81,7 @@ spec:
 		return
 	}
 
-	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1alpha1
+	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - kind: Deployment
@@ -93,6 +93,8 @@ items:
       app: nginx2
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'f1.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'f1.yaml'
   spec:
     replicas: 1
 - kind: Service
@@ -102,6 +104,8 @@ items:
       app: nginx
       config.kubernetes.io/index: '1'
       config.kubernetes.io/path: 'f1.yaml'
+      internal.config.kubernetes.io/index: '1'
+      internal.config.kubernetes.io/path: 'f1.yaml'
   spec:
     selector:
       app: nginx
@@ -116,6 +120,8 @@ items:
       config.kubernetes.io/local-config: "true"
       config.kubernetes.io/index: '0'
       config.kubernetes.io/path: 'f2.yaml'
+      internal.config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/path: 'f2.yaml'
   spec:
     replicas: 3
 - apiVersion: apps/v1
@@ -128,6 +134,8 @@ items:
       app: nginx
       config.kubernetes.io/index: '1'
       config.kubernetes.io/path: 'f2.yaml'
+      internal.config.kubernetes.io/index: '1'
+      internal.config.kubernetes.io/path: 'f2.yaml'
   spec:
     replicas: 3
 `, b.String()) {
@@ -191,11 +199,11 @@ func TestSourceCommandJSON(t *testing.T) {
 		return
 	}
 
-	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1alpha1
+	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
-- {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo", "annotations": {"app": "nginx2", config.kubernetes.io/index: '0', config.kubernetes.io/path: 'f1.json'}}, "spec": {"replicas": 1}}
-- {"apiVersion": "v1", "kind": "Abstraction", "metadata": {"name": "foo", "annotations": {"config.kubernetes.io/function": "container:\n  image: gcr.io/example/reconciler:v1\n", "config.kubernetes.io/local-config": "true", config.kubernetes.io/index: '0', config.kubernetes.io/path: 'f2.json'}}, "spec": {"replicas": 3}}
+- {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo", "annotations": {"app": "nginx2", config.kubernetes.io/index: '0', config.kubernetes.io/path: 'f1.json', internal.config.kubernetes.io/index: '0', internal.config.kubernetes.io/path: 'f1.json'}}, "spec": {"replicas": 1}}
+- {"apiVersion": "v1", "kind": "Abstraction", "metadata": {"name": "foo", "annotations": {"config.kubernetes.io/function": "container:\n  image: gcr.io/example/reconciler:v1\n", "config.kubernetes.io/local-config": "true", config.kubernetes.io/index: '0', config.kubernetes.io/path: 'f2.json', internal.config.kubernetes.io/index: '0', internal.config.kubernetes.io/path: 'f2.json'}}, "spec": {"replicas": 3}}
 `, b.String()) {
 		return
 	}
@@ -238,7 +246,7 @@ spec:
 		return
 	}
 
-	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1alpha1
+	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
 - kind: Deployment
@@ -249,6 +257,7 @@ items:
     annotations:
       app: nginx2
       config.kubernetes.io/index: '0'
+      internal.config.kubernetes.io/index: '0'
   spec:
     replicas: 1
 - kind: Service
@@ -257,6 +266,7 @@ items:
     annotations:
       app: nginx
       config.kubernetes.io/index: '1'
+      internal.config.kubernetes.io/index: '1'
   spec:
     selector:
       app: nginx
@@ -299,10 +309,10 @@ func TestSourceCommandJSON_Stdin(t *testing.T) {
 		return
 	}
 
-	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1alpha1
+	if !assert.Equal(t, `apiVersion: config.kubernetes.io/v1
 kind: ResourceList
 items:
-- {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo", "annotations": {"app": "nginx2", config.kubernetes.io/index: '0'}}, "spec": {"replicas": 1}}
+- {"kind": "Deployment", "metadata": {"labels": {"app": "nginx2"}, "name": "foo", "annotations": {"app": "nginx2", config.kubernetes.io/index: '0', internal.config.kubernetes.io/index: '0'}}, "spec": {"replicas": 1}}
 `, out.String()) {
 		return
 	}

cmd/config/internal/generateddocs/api/docs.go

@@ -61,15 +61,16 @@ Example:
 	  annotations:
 	    config.kubernetes.io/local-config: "true"`
 
-var FunctionsImplShort = `Following is an example for implementing an nginx abstraction using a configuration`
-var FunctionsImplLong = `# Running Configuration Functions using kustomize CLI
+var (
+	FunctionsImplShort = `Following is an example for implementing an nginx abstraction using a configuration`
+	FunctionsImplLong  = `# Running Configuration Functions using kustomize CLI
 
 Configuration functions can be implemented using any toolchain and invoked using any
 container workflow orchestrator including Tekton, Cloud Build, or run directly using ` + "`" + `docker run` + "`" + `.
 
 Run ` + "`" + `config help docs-fn-spec` + "`" + ` to see the Configuration Functions Specification.
 
-` + "`" + `kustomize config run` + "`" + ` is an example orchestrator for invoking Configuration Functions. This
+` + "`" + `kustomize fn run` + "`" + ` is an example orchestrator for invoking Configuration Functions. This
 document describes how to implement and invoke an example function.
 
 function.
@@ -88,7 +89,7 @@ The script wraps itself using ` + "`" + `config run wrap -- $0` + "`" + ` which
 4. Format the output
 
 	#!/bin/bash
-	# script must run wrapped by "kustomize config run wrap"
+	# script must run wrapped by "kustomize fn run wrap"
 	# for parsing input the functionConfig into env vars
 	if [ -z ${WRAPPED} ]; then
 	  export WRAPPED=true
@@ -141,7 +142,7 @@ The script wraps itself using ` + "`" + `config run wrap -- $0` + "`" + ` which
 
 ### Dockerfile
 
-` + "`" + `Dockerfile` + "`" + ` installs ` + "`" + `kustomize config` + "`" + ` and copies the script into the container image.
+` + "`" + `Dockerfile` + "`" + ` installs ` + "`" + `kustomize fn` + "`" + ` and copies the script into the container image.
 
 	FROM golang:1.13-stretch
 	RUN go get sigs.k8s.io/kustomize/cmd/config
@@ -151,9 +152,9 @@ The script wraps itself using ` + "`" + `config run wrap -- $0` + "`" + ` which
 
 ## Example Function Usage
 
-Following is an example of running the ` + "`" + `kustomize config run` + "`" + ` using the preceding API.
+Following is an example of running the ` + "`" + `kustomize fn run` + "`" + ` using the preceding API.
 
-When run by ` + "`" + `kustomize config run` + "`" + `, functions are run in containers with the
+When run by ` + "`" + `kustomize fn run` + "`" + `, functions are run in containers with the
 following environment:
 
 - Network: ` + "`" + `none` + "`" + `
@@ -184,7 +185,7 @@ are passed to the Function through the ` + "`" + `ResourceList.functionConfig` +
 
 ### Output
 
-The function is invoked using byrunning ` + "`" + `kustomize config run dir/` + "`" + `.
+The function is invoked using byrunning ` + "`" + `kustomize fn run dir/` + "`" + `.
 
 ` + "`" + `dir/my-instance_deployment.yaml` + "`" + ` contains the Deployment:
 
@@ -230,9 +231,11 @@ The function is invoked using byrunning ` + "`" + `kustomize config run dir/` +
 	  selector:
 	    app: nginx
 	    instance: my-instance`
+)
 
-var FunctionsSpecShort = `_Configuration functions_ enable shift-left practices (client-side) through:`
-var FunctionsSpecLong = `# Configuration Functions Specification
+var (
+	FunctionsSpecShort = `_Configuration functions_ enable shift-left practices (client-side) through:`
+	FunctionsSpecLong  = `# Configuration Functions Specification
 
 This document specifies a standard for client-side functions that operate on
 Kubernetes declarative configurations. This standard enables creating
@@ -408,6 +411,7 @@ A non-zero exit code indicates a failure.
 [1]: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md
 [2]: https://tools.ietf.org/html/rfc2119
 [3]: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds`
+)
 
 var Merge2Long = `# Merge (2-way)
 

cmd/config/internal/generateddocs/tutorials/docs.go

@@ -2,6 +2,7 @@
 package tutorials
 
 var ConfigurationBasicsShort = `### Synopsis`
+
 var ConfigurationBasicsLong = `
 ` + "`" + `kustomize cfg` + "`" + ` provides tools for working with local configuration directories.
 
@@ -274,9 +275,10 @@ var ConfigurationBasicsLong = `
     │               └── image: <YOUR-CONTAINER>
     ...`
 
-var FunctionBasicsShort = `### Synopsis`
-var FunctionBasicsLong = `
-  ` + "`" + `kustomize config` + "`" + ` enables encapsulating function for manipulating Resource
+var (
+	FunctionBasicsShort = `### Synopsis`
+	FunctionBasicsLong  = `
+  ` + "`" + `kustomize fn` + "`" + ` enables encapsulating function for manipulating Resource
   configuration inside containers, which are run using ` + "`" + `run` + "`" + `.
 
   First fetch the kustomize repository, which contains a collection of example
@@ -288,7 +290,7 @@ var FunctionBasicsLong = `
 ### Templating -- CockroachDB
 
   This section demonstrates how to leverage templating based solutions from
-  ` + "`" + `kustomize config` + "`" + `.  The templating function is implemented as a ` + "`" + `bash` + "`" + ` script
+  ` + "`" + `kustomize fn` + "`" + `.  The templating function is implemented as a ` + "`" + `bash` + "`" + ` script
   using a ` + "`" + `heredoc` + "`" + `.
 
   #### 1: Generate the Resources
@@ -455,3 +457,4 @@ Functions may be composed together.  Try putting the Injection (tshirt-size) and
 Validation functions together in the same .yaml file (separated by ` + "`" + `---` + "`" + `).  Run
 ` + "`" + `run` + "`" + ` and observe that the first function in the file is applied to the Resources,
 and then the second function in the file is applied.`
+)