Merge pull request #3565 from monopole/pinToCmdConfig

Pin to cmd/config v0.9.1

Makefile

@@ -4,7 +4,7 @@
 # Makefile for kustomize CLI and API.
 
 MYGOBIN := $(shell go env GOPATH)/bin
-SHELL := /bin/bash
+SHELL := /usr/bin/env bash
 export PATH := $(MYGOBIN):$(PATH)
 MODULES := '"cmd/config" "api/" "kustomize/" "kyaml/"'
 
@@ -26,8 +26,8 @@ verify-kustomize: \
 	lint-kustomize \
 	test-unit-kustomize-all \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.9.2 \
-	test-examples-kustomize-against-3.8.9
+	test-examples-kustomize-against-3.9 \
+	test-examples-kustomize-against-3.8
 
 # The following target referenced by a file in
 # https://github.com/kubernetes/test-infra/tree/master/config/jobs/kubernetes-sigs/kustomize
@@ -39,8 +39,8 @@ prow-presubmit-check: \
 	test-unit-cmd-all \
 	test-go-mod \
 	test-examples-kustomize-against-HEAD \
-	test-examples-kustomize-against-3.9.2 \
-	test-examples-kustomize-against-3.8.9
+	test-examples-kustomize-against-3.9 \
+	test-examples-kustomize-against-3.8
 
 .PHONY: verify-kustomize-e2e
 verify-kustomize-e2e: test-examples-e2e-kustomize
@@ -79,6 +79,11 @@ $(MYGOBIN)/gorepomod:
 	cd cmd/gorepomod; \
 	go install .
 
+# Build from local source.
+$(MYGOBIN)/k8scopy:
+	cd cmd/k8scopy; \
+	go install .
+
 # Build from local source.
 $(MYGOBIN)/pluginator:
 	cd cmd/pluginator; \
@@ -98,13 +103,13 @@ $(MYGOBIN)/kustomize:
 install-tools: \
 	$(MYGOBIN)/goimports \
 	$(MYGOBIN)/golangci-lint-kustomize \
-	$(MYGOBIN)/gh \
 	$(MYGOBIN)/gorepomod \
+	$(MYGOBIN)/helm \
+	$(MYGOBIN)/k8scopy \
 	$(MYGOBIN)/mdrip \
 	$(MYGOBIN)/pluginator \
 	$(MYGOBIN)/prchecker \
-	$(MYGOBIN)/stringer \
-	$(MYGOBIN)/helm
+	$(MYGOBIN)/stringer
 
 ### Begin kustomize plugin rules.
 #
@@ -221,7 +226,7 @@ build-kustomize-api: $(builtinplugins)
 	cd api; go build ./...
 
 .PHONY: generate-kustomize-api
-generate-kustomize-api:
+generate-kustomize-api: $(MYGOBIN)/k8scopy
 	cd api; go generate ./...
 
 .PHONY: test-unit-kustomize-api
@@ -276,12 +281,12 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh HEAD
 
 .PHONY:
-test-examples-kustomize-against-3.9.2: $(MYGOBIN)/mdrip
-	./hack/testExamplesAgainstKustomize.sh v3.9.2
+test-examples-kustomize-against-3.9: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.9.3
 
 .PHONY:
-test-examples-kustomize-against-3.8.9: $(MYGOBIN)/mdrip
-	./hack/testExamplesAgainstKustomize.sh v3.8.9
+test-examples-kustomize-against-3.8: $(MYGOBIN)/mdrip
+	./hack/testExamplesAgainstKustomize.sh v3.8.10
 
 # linux only.
 # This is for testing an example plugin that

api/builtins/HashTransformer.go

@@ -28,7 +28,7 @@ func (p *HashTransformerPlugin) Transform(m resmap.ResMap) error {
 			if err != nil {
 				return err
 			}
-			res.SetOriginalName(res.GetName(), false)
+			res.StorePreviousId()
 			res.SetName(fmt.Sprintf("%s-%s", res.GetName(), h))
 		}
 	}

api/builtins/HelmChartInflationGenerator.go

@@ -10,7 +10,7 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
-	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -51,7 +51,7 @@ func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, conf
 		return fmt.Errorf("chartName cannot be empty")
 	}
 	if p.ChartHome == "" {
-		p.ChartHome = path.Join(p.tmpDir, "chart")
+		p.ChartHome = filepath.Join(p.tmpDir, "chart")
 	}
 	if p.ChartRepoName == "" {
 		p.ChartRepoName = "stable"
@@ -60,10 +60,10 @@ func (p *HelmChartInflationGeneratorPlugin) Config(h *resmap.PluginHelpers, conf
 		p.HelmBin = "helm"
 	}
 	if p.HelmHome == "" {
-		p.HelmHome = path.Join(p.tmpDir, ".helm")
+		p.HelmHome = filepath.Join(p.tmpDir, ".helm")
 	}
 	if p.Values == "" {
-		p.Values = path.Join(p.ChartHome, p.ChartName, "values.yaml")
+		p.Values = filepath.Join(p.ChartHome, p.ChartName, "values.yaml")
 	}
 	if p.ValuesMerge == "" {
 		p.ValuesMerge = "override"
@@ -109,17 +109,16 @@ func (p *HelmChartInflationGeneratorPlugin) EncodeValues(w io.Writer) error {
 
 // useValuesLocal process (merge) inflator config provided values with chart default values.yaml
 func (p *HelmChartInflationGeneratorPlugin) useValuesLocal() error {
-	fn := path.Join(p.ChartHome, p.ChartName, "kustomize-values.yaml")
-	vf, err := os.Create(fn)
-	defer vf.Close()
-	if err != nil {
-		return err
-	}
-	// override, merge, none
-	if p.ValuesMerge == "none" || p.ValuesMerge == "no" || p.ValuesMerge == "false" {
-		p.Values = fn
-	} else {
-		pValues, err := ioutil.ReadFile(p.Values)
+	// not override, merge, none
+	if !(p.ValuesMerge == "none" || p.ValuesMerge == "no" || p.ValuesMerge == "false") {
+		var pValues []byte
+		var err error
+
+		if filepath.IsAbs(p.Values) {
+			pValues, err = ioutil.ReadFile(p.Values)
+		} else {
+			pValues, err = p.h.Loader().Load(p.Values)
+		}
 		if err != nil {
 			return err
 		}
@@ -141,16 +140,48 @@ func (p *HelmChartInflationGeneratorPlugin) useValuesLocal() error {
 			}
 		}
 		p.ValuesLocal = chValues
-		p.Values = fn
 	}
-	err = p.EncodeValues(vf)
+	b, err := yaml.Marshal(p.ValuesLocal)
 	if err != nil {
 		return err
 	}
-	vf.Sync()
+	path, err := p.writeValuesBytes(b)
+	if err != nil {
+		return err
+	}
+	p.Values = path
 	return nil
 }
 
+// copyValues will copy the relative values file into the temp directory
+// to avoid messing up with CWD.
+func (p *HelmChartInflationGeneratorPlugin) copyValues() error {
+	// only copy when the values path is not absolute
+	if filepath.IsAbs(p.Values) {
+		return nil
+	}
+	// we must use use loader to read values file
+	b, err := p.h.Loader().Load(p.Values)
+	if err != nil {
+		return err
+	}
+	path, err := p.writeValuesBytes(b)
+	if err != nil {
+		return err
+	}
+	p.Values = path
+	return nil
+}
+
+func (p *HelmChartInflationGeneratorPlugin) writeValuesBytes(b []byte) (string, error) {
+	path := filepath.Join(p.ChartHome, p.ChartName, "kustomize-values.yaml")
+	err := ioutil.WriteFile(path, b, 0644)
+	if err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
 // Generate implements generator
 func (p *HelmChartInflationGeneratorPlugin) Generate() (resmap.ResMap, error) {
 	// cleanup
@@ -174,6 +205,11 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (resmap.ResMap, error) {
 		if err != nil {
 			return nil, err
 		}
+	} else {
+		err := p.copyValues()
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	// render the charts
@@ -190,7 +226,7 @@ func (p *HelmChartInflationGeneratorPlugin) getTemplateCommandArgs() []string {
 	if p.ReleaseName != "" {
 		args = append(args, p.ReleaseName)
 	}
-	args = append(args, path.Join(p.ChartHome, p.ChartName))
+	args = append(args, filepath.Join(p.ChartHome, p.ChartName))
 	if p.ReleaseNamespace != "" {
 		args = append(args, "--namespace", p.ReleaseNamespace)
 	}
@@ -220,7 +256,7 @@ func (p *HelmChartInflationGeneratorPlugin) getPullCommandArgs() []string {
 // checkLocalChart will return true if the chart does exist in
 // local chart home.
 func (p *HelmChartInflationGeneratorPlugin) checkLocalChart() bool {
-	path := path.Join(p.ChartHome, p.ChartName)
+	path := filepath.Join(p.ChartHome, p.ChartName)
 	s, err := os.Stat(path)
 	if err != nil {
 		return false

api/builtins/NamespaceTransformer.go

@@ -34,7 +34,7 @@ func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
 			// Don't mutate empty objects?
 			continue
 		}
-		r.SetOriginalNs(r.GetNamespace(), false)
+		r.StorePreviousId()
 		err := r.ApplyFilter(namespace.Filter{
 			Namespace: p.Namespace,
 			FsSlice:   p.FieldSpecs,

api/builtins/PatchStrategicMergeTransformer.go

@@ -60,11 +60,10 @@ func (p *PatchStrategicMergeTransformerPlugin) Config(
 			"patch appears to be empty; files=%v, Patch=%s", p.Paths, p.Patches)
 	}
 	// Merge the patches, looking for conflicts.
-	m, err := h.ResmapFactory().ConflatePatches(p.loadedPatches)
+	_, err = h.ResmapFactory().ConflatePatches(p.loadedPatches)
 	if err != nil {
 		return err
 	}
-	p.loadedPatches = m.Resources()
 	return nil
 }
 

api/builtins/PatchTransformer.go

@@ -104,7 +104,7 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 		return err
 	}
 	for _, res := range resources {
-		res.SetOriginalName(res.GetName(), false)
+		res.StorePreviousId()
 		err = res.ApplyFilter(patchjson6902.Filter{
 			Patch: p.Patch,
 		})

api/builtins/PrefixSuffixTransformer.go

@@ -70,7 +70,7 @@ func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
 				r.AddNamePrefix(p.Prefix)
 				r.AddNameSuffix(p.Suffix)
 				if p.Prefix != "" || p.Suffix != "" {
-					r.SetOriginalName(r.GetName(), false)
+					r.StorePreviousId()
 				}
 			}
 			err := r.ApplyFilter(prefixsuffix.Filter{

api/builtins/ReplicaCountTransformer.go

@@ -31,9 +31,7 @@ func (p *ReplicaCountTransformerPlugin) Transform(m resmap.ResMap) error {
 	found := false
 	for _, fs := range p.FieldSpecs {
 		matcher := p.createMatcher(fs)
-		matchOriginal := m.GetMatchingResourcesByOriginalId(matcher)
-		resList := append(
-			matchOriginal, m.GetMatchingResourcesByCurrentId(matcher)...)
+		resList := m.GetMatchingResourcesByAnyId(matcher)
 		if len(resList) > 0 {
 			found = true
 			for _, r := range resList {

api/filesys/confirmeddir_test.go

@@ -4,6 +4,7 @@
 package filesys_test
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -98,6 +99,7 @@ func TestNewTempConfirmDir(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
+	defer os.RemoveAll(string(tmp))
 
 	delinked, err := filepath.EvalSymlinks(string(tmp))
 	if err != nil {

api/filters/fieldspec/fieldspec.go

@@ -4,9 +4,11 @@
 package fieldspec
 
 import (
+	"fmt"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -14,7 +16,16 @@ import (
 
 var _ yaml.Filter = Filter{}
 
-// Filter applies a single fieldSpec to a single object
+// Filter possibly mutates its object argument using a FieldSpec.
+// If the object matches the FieldSpec, and the node found
+// by following the fieldSpec's path is non-null, this filter calls
+// the setValue function on the node at the end of the path.
+// If any part of the path doesn't exist, the filter returns
+// without doing anything and without error, unless it was set
+// to create the path. If set to create, it creates a tree of maps
+// along the path, and the leaf node gets the setValue called on it.
+// Error on GVK mismatch, empty or poorly formed path.
+// Filter expect kustomize style paths, not JSON paths.
 // Filter stores internal state and should not be reused
 type Filter struct {
 	// FieldSpec contains the path to the value to set.
@@ -37,15 +48,17 @@ func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 	if match, err := isMatchGVK(fltr.FieldSpec, obj); !match || err != nil {
 		return obj, errors.Wrap(err)
 	}
-	fltr.path = splitPath(fltr.FieldSpec.Path)
-	if err := fltr.filter(obj); err != nil {
+	fltr.path = utils.PathSplitter(fltr.FieldSpec.Path)
+	err := fltr.filter(obj)
+	if err != nil {
 		s, _ := obj.String()
 		return nil, errors.WrapPrefixf(err,
-			"obj '%s' at path '%v'", s, fltr.FieldSpec.Path)
+			"considering field '%s' of object\n%v", fltr.FieldSpec.Path, s)
 	}
 	return obj, nil
 }
 
+// Recursively called.
 func (fltr Filter) filter(obj *yaml.RNode) error {
 	if len(fltr.path) == 0 {
 		// found the field -- set its value
@@ -56,25 +69,30 @@ func (fltr Filter) filter(obj *yaml.RNode) error {
 	}
 	switch obj.YNode().Kind {
 	case yaml.SequenceNode:
-		return fltr.seq(obj)
+		return fltr.handleSequence(obj)
 	case yaml.MappingNode:
-		return fltr.field(obj)
+		return fltr.handleMap(obj)
+	case yaml.AliasNode:
+		return fltr.filter(yaml.NewRNode(obj.YNode().Alias))
 	default:
 		return errors.Errorf("expected sequence or mapping node")
 	}
 }
 
-// field calls filter on the field matching the next path element
-func (fltr Filter) field(obj *yaml.RNode) error {
+// handleMap calls filter on the map field matching the next path element
+func (fltr Filter) handleMap(obj *yaml.RNode) error {
 	fieldName, isSeq := isSequenceField(fltr.path[0])
+	if fieldName == "" {
+		return fmt.Errorf("cannot set or create an empty field name")
+	}
 	// lookup the field matching the next path element
-	var lookupField yaml.Filter
+	var operation yaml.Filter
 	var kind yaml.Kind
 	tag := yaml.NodeTagEmpty
 	switch {
 	case !fltr.FieldSpec.CreateIfNotPresent || fltr.CreateKind == 0 || isSeq:
-		// dont' create the field if we don't find it
-		lookupField = yaml.Lookup(fieldName)
+		// don't create the field if we don't find it
+		operation = yaml.Lookup(fieldName)
 		if isSeq {
 			// The query path thinks this field should be a sequence;
 			// accept this hint for use later if the tag is NodeTagNull.
@@ -82,21 +100,25 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 		}
 	case len(fltr.path) <= 1:
 		// create the field if it is missing: use the provided node kind
-		lookupField = yaml.LookupCreate(fltr.CreateKind, fieldName)
+		operation = yaml.LookupCreate(fltr.CreateKind, fieldName)
 		kind = fltr.CreateKind
 		tag = fltr.CreateTag
 	default:
 		// create the field if it is missing: must be a mapping node
-		lookupField = yaml.LookupCreate(yaml.MappingNode, fieldName)
+		operation = yaml.LookupCreate(yaml.MappingNode, fieldName)
 		kind = yaml.MappingNode
 		tag = yaml.NodeTagMap
 	}
 
 	// locate (or maybe create) the field
-	field, err := obj.Pipe(lookupField)
-	if err != nil || field == nil {
+	field, err := obj.Pipe(operation)
+	if err != nil {
 		return errors.WrapPrefixf(err, "fieldName: %s", fieldName)
 	}
+	if field == nil {
+		// No error if field not found.
+		return nil
+	}
 
 	// if the value exists, but is null and kind is set,
 	// then change it to the creation type
@@ -114,7 +136,7 @@ func (fltr Filter) field(obj *yaml.RNode) error {
 }
 
 // seq calls filter on all sequence elements
-func (fltr Filter) seq(obj *yaml.RNode) error {
+func (fltr Filter) handleSequence(obj *yaml.RNode) error {
 	if err := obj.VisitElements(func(node *yaml.RNode) error {
 		// recurse on each element -- re-allocating a Filter is
 		// not strictly required, but is more consistent with field
@@ -125,16 +147,14 @@ func (fltr Filter) seq(obj *yaml.RNode) error {
 		return errors.WrapPrefixf(err,
 			"visit traversal on path: %v", fltr.path)
 	}
-
 	return nil
 }
 
 // isSequenceField returns true if the path element is for a sequence field.
 // isSequence also returns the path element with the '[]' suffix trimmed
 func isSequenceField(name string) (string, bool) {
-	isSeq := strings.HasSuffix(name, "[]")
-	name = strings.TrimSuffix(name, "[]")
-	return name, isSeq
+	shorter := strings.TrimSuffix(name, "[]")
+	return shorter, shorter != name
 }
 
 // isMatchGVK returns true if the fs.GVK matches the obj GVK.
@@ -163,18 +183,3 @@ func isMatchGVK(fs types.FieldSpec, obj *yaml.RNode) (bool, error) {
 
 	return true, nil
 }
-
-func splitPath(path string) []string {
-	ps := strings.Split(path, "/")
-	var res []string
-	res = append(res, ps[0])
-	for i := 1; i < len(ps); i++ {
-		lastIndex := len(res) - 1
-		if strings.HasSuffix(res[lastIndex], "\\") {
-			res[lastIndex] = strings.TrimSuffix(res[lastIndex], "\\") + "/" + ps[i]
-		} else {
-			res = append(res, ps[i])
-		}
-	}
-	return res
-}

api/filters/fieldspec/fieldspec_test.go

@@ -15,206 +15,243 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-type TestCase struct {
-	name      string
-	input     string
-	expected  string
-	filter    fieldspec.Filter
-	fieldSpec string
-	error     string
-}
-
-var tests = []TestCase{
-	{
-		name: "update",
-		fieldSpec: `
+func TestFilter_Filter(t *testing.T) {
+	testCases := map[string]struct {
+		input     string
+		expected  string
+		filter    fieldspec.Filter
+		fieldSpec string
+		error     string
+	}{
+		"path not found": {
+			fieldSpec: `
 path: a/b
 group: foo
 kind: Bar
 `,
-		input: `
+			input: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			expected: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+		},
+		"empty path": {
+			fieldSpec: `
+group: foo
+kind: Bar
+`,
+			input: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			expected: `
+apiVersion: foo
+kind: Bar
+xxx:
+`,
+			error: `considering field '' of object
+apiVersion: foo
+kind: Bar
+xxx:
+: cannot set or create an empty field name`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+		},
+
+		"update": {
+			fieldSpec: `
+path: a/b
+group: foo
+kind: Bar
+`,
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b: e
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-kind-not-match",
-		fieldSpec: `
+		"update-kind-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo
 kind: Bar1
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar2
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar2
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-group-not-match",
-		fieldSpec: `
+		"update-group-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo2/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo2/v1beta1
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "update-version-not-match",
-		fieldSpec: `
+		"update-version-not-match": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta2
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta2
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "bad-version",
-		fieldSpec: `
+		"bad-version": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta2/something
 kind: Bar
 a:
   b: c
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta2/something
 kind: Bar
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "bad-meta",
-		fieldSpec: `
+		"bad-meta": {
+			fieldSpec: `
 path: a/b
 group: foo
 version: v1beta1
 kind: Bar
 `,
-		input: `
+			input: `
 a:
   b: c
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
+			error: "missing Resource metadata",
 		},
-		error: "missing Resource metadata",
-	},
 
-	{
-		name: "miss-match-type",
-		fieldSpec: `
+		"miss-match-type": {
+			fieldSpec: `
 path: a/b/c
 kind: Bar
 `,
-		input: `
+			input: `
 kind: Bar
 a:
   b: a
 `,
-		error: "obj 'kind: Bar\na:\n  b: a\n' at path 'a/b/c': " +
-			"expected sequence or mapping node",
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			error: `considering field 'a/b/c' of object
+kind: Bar
+a:
+  b: a
+: expected sequence or mapping node`,
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	{
-		name: "add",
-		fieldSpec: `
+		"add": {
+			fieldSpec: `
 path: a/b/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {b: {c: {d: e}}}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "update-in-sequence",
-		fieldSpec: `
+		"update-in-sequence": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
@@ -222,7 +259,7 @@ a:
   - c:
       d: a
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
@@ -230,244 +267,237 @@ a:
   - c:
       d: e
 `,
-		filter: fieldspec.Filter{
-			SetValue: filtersutil.SetScalar("e"),
+			filter: fieldspec.Filter{
+				SetValue: filtersutil.SetScalar("e"),
+			},
 		},
-	},
 
-	// Don't create a sequence
-	{
-		name: "empty-sequence-no-create",
-		fieldSpec: `
+		// Don't create a sequence
+		"empty-sequence-no-create": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a: {}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	// Create a new field for an element in a sequence
-	{
-		name: "empty-sequence-create",
-		fieldSpec: `
+		// Create a new field for an element in a sequence
+		"empty-sequence-create": {
+			fieldSpec: `
 path: a/b[]/c/d
 group: foo
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b:
   - c: {}
 `,
-		expected: `
+			expected: `
 apiVersion: foo/v1beta1
 kind: Bar
 a:
   b:
   - c: {d: e}
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "group v1",
-		fieldSpec: `
+		"group v1": {
+			fieldSpec: `
 path: a/b
 group: v1
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
 
-	{
-		name: "version v1",
-		fieldSpec: `
+		"version v1": {
+			fieldSpec: `
 path: a/b
 version: v1
 create: true
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
   b: e
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("e"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("e"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "successfully set field on array entry no sequence hint",
-		fieldSpec: `
+
+		"successfully set field on array entry no sequence hint": {
+			fieldSpec: `
 path: spec/containers/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "successfully set field on array entry with sequence hint",
-		fieldSpec: `
+
+		"successfully set field on array entry with sequence hint": {
+			fieldSpec: `
 path: spec/containers[]/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
   - image: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "failure to set field on array entry with sequence hint in path",
-		fieldSpec: `
+		"failure to set field on array entry with sequence hint in path": {
+			fieldSpec: `
 path: spec/containers[]/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers: []
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "failure to set field on array entry, no sequence hint in path",
-		fieldSpec: `
+
+		"failure to set field on array entry, no sequence hint in path": {
+			fieldSpec: `
 path: spec/containers/image
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 spec:
   containers:
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "filedname with slash '/'",
-		fieldSpec: `
+		"fieldname with slash '/'": {
+			fieldSpec: `
 path: a/b\/c/d
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 a:
   b/c:
     d: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
   b/c:
     d: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-	{
-		name: "filedname with multiple '/'",
-		fieldSpec: `
+		"fieldname with multiple '/'": {
+			fieldSpec: `
 path: a/b\/c/d\/e/f
 version: v1
 kind: Bar
 `,
-		input: `
+			input: `
 apiVersion: v1
 kind: Bar
 a:
@@ -475,7 +505,7 @@ a:
     d/e:
       f: foo
 `,
-		expected: `
+			expected: `
 apiVersion: v1
 kind: Bar
 a:
@@ -483,25 +513,24 @@ a:
     d/e:
       f: bar
 `,
-		filter: fieldspec.Filter{
-			SetValue:   filtersutil.SetScalar("bar"),
-			CreateKind: yaml.ScalarNode,
+			filter: fieldspec.Filter{
+				SetValue:   filtersutil.SetScalar("bar"),
+				CreateKind: yaml.ScalarNode,
+			},
 		},
-	},
-}
+	}
 
-func TestFilter_Filter(t *testing.T) {
-	for i := range tests {
-		test := tests[i]
-		t.Run(test.name, func(t *testing.T) {
-			err := yaml.Unmarshal([]byte(test.fieldSpec), &test.filter.FieldSpec)
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			err := yaml.Unmarshal([]byte(tc.fieldSpec), &tc.filter.FieldSpec)
 			if !assert.NoError(t, err) {
 				t.FailNow()
 			}
 
 			out := &bytes.Buffer{}
 			rw := &kio.ByteReadWriter{
-				Reader:                bytes.NewBufferString(test.input),
+				Reader:                bytes.NewBufferString(tc.input),
 				Writer:                out,
 				OmitReaderAnnotations: true,
 			}
@@ -509,11 +538,11 @@ func TestFilter_Filter(t *testing.T) {
 			// run the filter
 			err = kio.Pipeline{
 				Inputs:  []kio.Reader{rw},
-				Filters: []kio.Filter{kio.FilterAll(test.filter)},
+				Filters: []kio.Filter{kio.FilterAll(tc.filter)},
 				Outputs: []kio.Writer{rw},
 			}.Execute()
-			if test.error != "" {
-				if !assert.EqualError(t, err, test.error) {
+			if tc.error != "" {
+				if !assert.EqualError(t, err, tc.error) {
 					t.FailNow()
 				}
 				// stop rest of test
@@ -526,7 +555,7 @@ func TestFilter_Filter(t *testing.T) {
 
 			// check results
 			if !assert.Equal(t,
-				strings.TrimSpace(test.expected),
+				strings.TrimSpace(tc.expected),
 				strings.TrimSpace(out.String())) {
 				t.FailNow()
 			}

api/filters/nameref/nameref.go

@@ -5,30 +5,38 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/fieldspec"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
-	kyaml_filtersutil "sigs.k8s.io/kustomize/kyaml/filtersutil"
+	"sigs.k8s.io/kustomize/kyaml/filtersutil"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // Filter updates a name references.
 type Filter struct {
-	// Referrer is the object that refers to something else by a name,
-	// a name that this filter seeks to update.
+	// Referrer refers to another resource X by X's name.
+	// E.g. A Deployment can refer to a ConfigMap.
+	// The Deployment is the Referrer,
+	// the ConfigMap is the ReferralTarget.
+	// This filter seeks to repair the reference in Deployment, given
+	// that the ConfigMap's name may have changed.
 	Referrer *resource.Resource
 
-	// NameFieldToUpdate is the field in the Referrer that holds the
-	// name requiring an update.
-	NameFieldToUpdate types.FieldSpec `json:"nameFieldToUpdate,omitempty" yaml:"nameFieldToUpdate,omitempty"`
+	// NameFieldToUpdate is the field in the Referrer
+	// that holds the name requiring an update.
+	// This is the field to write.
+	NameFieldToUpdate types.FieldSpec
 
-	// Source of the new value for the name (in its name field).
+	// ReferralTarget is the source of the new value for
+	// the name, always in the 'metadata/name' field.
+	// This is the field to read.
 	ReferralTarget resid.Gvk
 
-	// Set of resources to hunt through to find the ReferralTarget.
+	// Set of resources to scan to find the ReferralTarget.
 	ReferralCandidates resmap.ResMap
 }
 
@@ -38,18 +46,31 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
 }
 
-// The node passed in here is the same node as held in Referrer, and
+// The node passed in here is the same node as held in Referrer;
 // that's how the referrer's name field is updated.
-// However, this filter still needs the extra methods on Referrer
+// Currently, however, this filter still needs the extra methods on Referrer
 // to consult things like the resource Id, its namespace, etc.
+// TODO(3455): No filter should use the Resource api; all information
+// about names should come from annotations, with helper methods
+// on the RNode object.  Resource should get stupider, RNode smarter.
 func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	err := node.PipeE(fieldspec.Filter{
+	if err := f.confirmNodeMatchesReferrer(node); err != nil {
+		// sanity check.
+		return nil, err
+	}
+	if err := node.PipeE(fieldspec.Filter{
 		FieldSpec: f.NameFieldToUpdate,
 		SetValue:  f.set,
-	})
-	return node, err
+	}); err != nil {
+		return nil, errors.Wrapf(
+			err, "updating name reference in '%s' field of '%s'",
+			f.NameFieldToUpdate.Path, f.Referrer.CurId().String())
+	}
+	return node, nil
 }
 
+// This function is called on the node found at FieldSpec.Path.
+// It's some node in the Referrer.
 func (f Filter) set(node *yaml.RNode) error {
 	if yaml.IsMissingOrNull(node) {
 		return nil
@@ -65,97 +86,108 @@ func (f Filter) set(node *yaml.RNode) error {
 			setMappingFn: f.setMapping,
 		}, node)
 	default:
-		return fmt.Errorf(
-			"node is expected to be either a string or a slice of string or a map of string")
+		return fmt.Errorf("node must be a scalar, sequence or map")
 	}
 }
 
-// Replace name field within a map RNode and leverage the namespace field.
+// This method used when NameFieldToUpdate doesn't lead to
+// one scalar field (typically called 'name'), but rather
+// leads to a map field (called anything). In this case we
+// must complete the field path, looking for both  a 'name'
+// and a 'namespace' field to help select the proper
+// ReferralTarget to read the name and namespace from.
 func (f Filter) setMapping(node *yaml.RNode) error {
 	if node.YNode().Kind != yaml.MappingNode {
 		return fmt.Errorf("expect a mapping node")
 	}
 	nameNode, err := node.Pipe(yaml.FieldMatcher{Name: "name"})
-	if err != nil || nameNode == nil {
-		return fmt.Errorf("cannot find field 'name' in node")
-	}
-	namespaceNode, err := node.Pipe(yaml.FieldMatcher{Name: "namespace"})
 	if err != nil {
-		return fmt.Errorf("error when find field 'namespace'")
+		return errors.Wrap(err, "trying to match 'name' field")
 	}
-
-	// name will not be updated if the namespace doesn't match
-	subset := f.ReferralCandidates.Resources()
-	if namespaceNode != nil {
-		namespace := namespaceNode.YNode().Value
-		bynamespace := f.ReferralCandidates.GroupedByOriginalNamespace()
-		if _, ok := bynamespace[namespace]; !ok {
-			bynamespace = f.ReferralCandidates.GroupedByCurrentNamespace()
-			if _, ok := bynamespace[namespace]; !ok {
-				return nil
-			}
-		}
-		subset = bynamespace[namespace]
+	if nameNode == nil {
+		// This is a _configuration_ error; the field path
+		// specified in NameFieldToUpdate.Path doesn't resolve
+		// to a map with a 'name' field, so we have no idea what
+		// field to update with a new name.
+		return fmt.Errorf("path config error; no 'name' field in node")
 	}
-
-	oldName := nameNode.YNode().Value
-	res, err := f.selectReferral(oldName, subset)
-	if err != nil || res == nil {
-		// Nil res means nothing to do.
+	candidates, err := f.filterMapCandidatesByNamespace(node)
+	if err != nil {
 		return err
 	}
-	f.recordTheReferral(res)
-	if res.GetName() == oldName && res.GetNamespace() == "" {
+	oldName := nameNode.YNode().Value
+	referral, err := f.selectReferral(oldName, candidates)
+	if err != nil || referral == nil {
+		// Nil referral means nothing to do.
+		return err
+	}
+	f.recordTheReferral(referral)
+	if referral.GetName() == oldName && referral.GetNamespace() == "" {
 		// The name has not changed, nothing to do.
 		return nil
 	}
-	err = node.PipeE(yaml.FieldSetter{
+	if err = node.PipeE(yaml.FieldSetter{
 		Name:        "name",
-		StringValue: res.GetName(),
-	})
-	if err != nil {
+		StringValue: referral.GetName(),
+	}); err != nil {
 		return err
 	}
-	if res.GetNamespace() != "" {
-		// We don't want value "" to replace value "default" since
-		// the empty string is handled as a wild card here not default namespace
-		// by kubernetes.
-		err = node.PipeE(yaml.FieldSetter{
-			Name:        "namespace",
-			StringValue: res.GetNamespace(),
-		})
+	if referral.GetNamespace() == "" {
+		// Don't write an empty string into the namespace field, as
+		// it should not replace the value "default".  The empty
+		// string is handled as a wild card here, not as an implicit
+		// specification of the "default" k8s namespace.
+		return nil
 	}
-	return err
+	return node.PipeE(yaml.FieldSetter{
+		Name:        "namespace",
+		StringValue: referral.GetNamespace(),
+	})
+}
+
+func (f Filter) filterMapCandidatesByNamespace(
+	node *yaml.RNode) ([]*resource.Resource, error) {
+	namespaceNode, err := node.Pipe(yaml.FieldMatcher{Name: "namespace"})
+	if err != nil {
+		return nil, errors.Wrap(err, "trying to match 'namespace' field")
+	}
+	if namespaceNode == nil {
+		return f.ReferralCandidates.Resources(), nil
+	}
+	namespace := namespaceNode.YNode().Value
+	nsMap := f.ReferralCandidates.GroupedByOriginalNamespace()
+	if candidates, ok := nsMap[namespace]; ok {
+		return candidates, nil
+	}
+	nsMap = f.ReferralCandidates.GroupedByCurrentNamespace()
+	// This could be nil, or an empty list.
+	return nsMap[namespace], nil
 }
 
 func (f Filter) setScalar(node *yaml.RNode) error {
-	res, err := f.selectReferral(
+	referral, err := f.selectReferral(
 		node.YNode().Value, f.ReferralCandidates.Resources())
-	if err != nil || res == nil {
-		// Nil res means nothing to do.
+	if err != nil || referral == nil {
+		// Nil referral means nothing to do.
 		return err
 	}
-	f.recordTheReferral(res)
-	if res.GetName() == node.YNode().Value {
+	f.recordTheReferral(referral)
+	if referral.GetName() == node.YNode().Value {
 		// The name has not changed, nothing to do.
 		return nil
 	}
-	return node.PipeE(yaml.FieldSetter{StringValue: res.GetName()})
+	return node.PipeE(yaml.FieldSetter{StringValue: referral.GetName()})
 }
 
-// In the resource, make a note that it is referred to by the referrer.
-func (f Filter) recordTheReferral(res *resource.Resource) {
-	res.AppendRefBy(f.Referrer.CurId())
-}
-
-func (f Filter) isRoleRef() bool {
-	return strings.HasSuffix(f.NameFieldToUpdate.Path, "roleRef/name")
+// In the resource, make a note that it is referred to by the Referrer.
+func (f Filter) recordTheReferral(referral *resource.Resource) {
+	referral.AppendRefBy(f.Referrer.CurId())
 }
 
 // getRoleRefGvk returns a Gvk in the roleRef field. Return error
 // if the roleRef, roleRef/apiGroup or roleRef/kind is missing.
 func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
-	n, err := kyaml_filtersutil.GetRNode(res)
+	n, err := filtersutil.GetRNode(res)
 	if err != nil {
 		return nil, err
 	}
@@ -188,82 +220,183 @@ func getRoleRefGvk(res json.Marshaler) (*resid.Gvk, error) {
 	}, nil
 }
 
-func (f Filter) filterReferralCandidates(
-	matches []*resource.Resource) []*resource.Resource {
-	var ret []*resource.Resource
-	for _, m := range matches {
-		// If target kind is not ServiceAccount, we shouldn't consider condidates which
-		// doesn't have same namespace.
-		if f.ReferralTarget.Kind != "ServiceAccount" &&
-			m.GetNamespace() != f.Referrer.GetNamespace() {
-			continue
+// sieveFunc returns true if the resource argument satisfies some criteria.
+type sieveFunc func(*resource.Resource) bool
+
+// doSieve uses a function to accept or ignore resources from a list.
+// If list is nil, returns immediately.
+// It's a filter obviously, but that term is overloaded here.
+func doSieve(list []*resource.Resource, fn sieveFunc) (s []*resource.Resource) {
+	for _, r := range list {
+		if fn(r) {
+			s = append(s, r)
 		}
-		if !f.Referrer.PrefixesSuffixesEquals(m) {
-			continue
-		}
-		ret = append(ret, m)
 	}
-	return ret
+	return
 }
 
-// selectReferral picks the referral among a subset of candidates.
-// The content of the candidateSubset slice is most of the time
-// identical to the ReferralCandidates resmap. Still in some cases, such
-// as ClusterRoleBinding, the subset only contains the resources of a specific
-// namespace.
+func acceptAll(r *resource.Resource) bool {
+	return true
+}
+
+func previousNameMatches(name string) sieveFunc {
+	return func(r *resource.Resource) bool {
+		for _, id := range r.PrevIds() {
+			if id.Name == name {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func previousIdSelectedByGvk(gvk *resid.Gvk) sieveFunc {
+	return func(r *resource.Resource) bool {
+		for _, id := range r.PrevIds() {
+			if id.IsSelected(gvk) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+// If the we are updating a 'roleRef/name' field, the 'apiGroup' and 'kind'
+// fields in the same 'roleRef' map must be considered.
+// If either object is cluster-scoped (!IsNamespaceableKind), there
+// can be a referral.
+// E.g. a RoleBinding (which exists in a namespace) can refer
+// to a ClusterRole (cluster-scoped) object.
+// https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
+// Likewise, a ClusterRole can refer to a Secret (in a namespace).
+// Objects in different namespaces generally cannot refer to other
+// with some exceptions (e.g. RoleBinding and ServiceAccount are both
+// namespaceable, but the former can refer to accounts in other namespaces).
+func (f Filter) roleRefFilter() sieveFunc {
+	if !strings.HasSuffix(f.NameFieldToUpdate.Path, "roleRef/name") {
+		return acceptAll
+	}
+	roleRefGvk, err := getRoleRefGvk(f.Referrer)
+	if err != nil {
+		return acceptAll
+	}
+	return previousIdSelectedByGvk(roleRefGvk)
+}
+
+func prefixSuffixEquals(other resource.ResCtx) sieveFunc {
+	return func(r *resource.Resource) bool {
+		return r.PrefixesSuffixesEquals(other)
+	}
+}
+
+func (f Filter) sameCurrentNamespaceAsReferrer() sieveFunc {
+	referrerCurId := f.Referrer.CurId()
+	if !referrerCurId.IsNamespaceableKind() {
+		// If the referrer is cluster-scoped, let anything through.
+		return acceptAll
+	}
+	return func(r *resource.Resource) bool {
+		if !r.CurId().IsNamespaceableKind() {
+			// Allow cluster-scoped through.
+			return true
+		}
+		if r.GetKind() == "ServiceAccount" {
+			// Allow service accounts through, even though they
+			// are in a namespace.  A RoleBinding in another namespace
+			// can reference them.
+			return true
+		}
+		return referrerCurId.IsNsEquals(r.CurId())
+	}
+}
+
+// selectReferral picks the best referral from a list of candidates.
 func (f Filter) selectReferral(
+	// The name referral that may need to be updated.
 	oldName string,
-	candidateSubset []*resource.Resource) (*resource.Resource, error) {
-	var roleRefGvk *resid.Gvk
-	if f.isRoleRef() {
-		var err error
-		roleRefGvk, err = getRoleRefGvk(f.Referrer)
-		if err != nil {
-			return nil, err
-		}
+	candidates []*resource.Resource) (*resource.Resource, error) {
+	candidates = doSieve(candidates, previousNameMatches(oldName))
+	candidates = doSieve(candidates, previousIdSelectedByGvk(&f.ReferralTarget))
+	candidates = doSieve(candidates, f.roleRefFilter())
+	candidates = doSieve(candidates, f.sameCurrentNamespaceAsReferrer())
+	if len(candidates) == 1 {
+		return candidates[0], nil
 	}
-	for _, res := range candidateSubset {
-		if res.GetOriginalName() != oldName {
-			continue
-		}
-		id := res.OrgId()
-		if !id.IsSelected(&f.ReferralTarget) {
-			continue
-		}
-		// If the we are processing a roleRef, the apiGroup and Kind in the
-		// roleRef are needed to be considered.
-		if f.isRoleRef() && !id.IsSelected(roleRefGvk) {
-			continue
-		}
-		matches := f.ReferralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
-		// If there's more than one match,
-		// filter the matches by prefix and suffix
-		if len(matches) > 1 {
-			filteredMatches := f.filterReferralCandidates(matches)
-			if len(filteredMatches) > 1 {
-				return nil, fmt.Errorf(
-					"multiple matches for %s:\n  %v",
-					id, getIds(filteredMatches))
-			}
-			// Check is the match the resource we are working on
-			if len(filteredMatches) == 0 || res != filteredMatches[0] {
-				continue
-			}
-		}
-		// In the resource, note that it is referenced
-		// by the referrer.
-		res.AppendRefBy(f.Referrer.CurId())
-		// Return transformed name of the object,
-		// complete with prefixes, hashes, etc.
-		return res, nil
+	candidates = doSieve(candidates, prefixSuffixEquals(f.Referrer))
+	if len(candidates) == 1 {
+		return candidates[0], nil
 	}
-	return nil, nil
+	if len(candidates) == 0 {
+		return nil, nil
+	}
+	if allNamesAreTheSame(candidates) {
+		// Just take the first one.
+		return candidates[0], nil
+	}
+	ids := getIds(candidates)
+	f.failureDetails(candidates)
+	return nil, fmt.Errorf(" found multiple possible referrals: %s", ids)
 }
 
-func getIds(rs []*resource.Resource) []string {
+func (f Filter) failureDetails(resources []*resource.Resource) {
+	fmt.Printf(
+		"\n**** Too many possible referral targets to referrer:\n%s\n",
+		f.Referrer.MustYaml())
+	for i, r := range resources {
+		fmt.Printf(
+			"--- possible referral %d:\n%s", i, r.MustYaml())
+		fmt.Println("------")
+	}
+}
+
+func allNamesAreTheSame(resources []*resource.Resource) bool {
+	name := resources[0].GetName()
+	for i := 1; i < len(resources); i++ {
+		if name != resources[i].GetName() {
+			return false
+		}
+	}
+	return true
+}
+
+func getIds(rs []*resource.Resource) string {
 	var result []string
 	for _, r := range rs {
-		result = append(result, r.CurId().String()+"\n")
+		result = append(result, r.CurId().String())
 	}
-	return result
+	return strings.Join(result, ", ")
+}
+
+func checkEqual(k, a, b string) error {
+	if a != b {
+		return fmt.Errorf(
+			"node-referrerOriginal '%s' mismatch '%s' != '%s'",
+			k, a, b)
+	}
+	return nil
+}
+
+func (f Filter) confirmNodeMatchesReferrer(node *yaml.RNode) error {
+	meta, err := node.GetMeta()
+	if err != nil {
+		return err
+	}
+	gvk := f.Referrer.GetGvk()
+	if err = checkEqual(
+		"APIVersion", meta.APIVersion, gvk.ApiVersion()); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Kind", meta.Kind, gvk.Kind); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Name", meta.Name, f.Referrer.GetName()); err != nil {
+		return err
+	}
+	if err = checkEqual(
+		"Namespace", meta.Namespace, f.Referrer.GetNamespace()); err != nil {
+		return err
+	}
+	return nil
 }

api/filters/nameref/nameref_test.go

@@ -14,14 +14,14 @@ import (
 
 func TestNamerefFilter(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
 	}{
 		"simple scalar": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -40,8 +40,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -59,7 +59,7 @@ ref:
 			},
 		},
 		"sequence": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -79,8 +79,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName1", ""},
-			expected: `
+			originalNames: []string{"oldName1", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -99,7 +99,7 @@ seq:
 			},
 		},
 		"mapping": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -118,8 +118,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -137,36 +137,43 @@ map:
 			},
 		},
 		"mapping with namespace": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
+  namespace: someNs
 map:
   name: oldName
-  namespace: oldNs
+  namespace: someNs
 `,
 			candidates: `
 apiVersion: apps/v1
 kind: Secret
 metadata:
   name: newName
-  namespace: oldNs
+  namespace: someNs
 ---
 apiVersion: apps/v1
 kind: NotSecret
 metadata:
   name: newName2
+---
+apiVersion: apps/v1
+kind: Secret
+metadata:
+  name: thirdName
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "oldName", "oldName"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
+  namespace: someNs
 map:
   name: newName
-  namespace: oldNs
+  namespace: someNs
 `,
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "map"},
@@ -178,7 +185,7 @@ map:
 			},
 		},
 		"null value": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -197,8 +204,8 @@ kind: NotSecret
 metadata:
   name: newName2
 `,
-			originalNames: []string{"oldName", ""},
-			expected: `
+			originalNames: []string{"oldName", "newName2"},
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -220,7 +227,7 @@ map:
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
 			factory := provider.NewDefaultDepProvider().GetResourceFactory()
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -236,10 +243,10 @@ map:
 			candidates := resMapFactory.FromResourceSlice(candidatesRes)
 			tc.filter.ReferralCandidates = candidates
 
+			result := filtertest_test.RunFilter(t, tc.referrerOriginal, tc.filter)
 			if !assert.Equal(t,
-				strings.TrimSpace(tc.expected),
-				strings.TrimSpace(
-					filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+				strings.TrimSpace(tc.referrerFinal),
+				strings.TrimSpace(result)) {
 				t.FailNow()
 			}
 		})
@@ -248,14 +255,14 @@ map:
 
 func TestNamerefFilterUnhappy(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
 	}{
 		"multiple match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -275,7 +282,7 @@ metadata:
   name: newName2
 `,
 			originalNames: []string{"oldName", "oldName"},
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
 				ReferralTarget: resid.Gvk{
@@ -286,7 +293,7 @@ metadata:
 			},
 		},
 		"no name": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -306,7 +313,7 @@ metadata:
   name: newName2
 `,
 			originalNames: []string{"oldName", "oldName"},
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "ref"},
 				ReferralTarget: resid.Gvk{
@@ -321,7 +328,7 @@ metadata:
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
 			factory := provider.NewDefaultDepProvider().GetResourceFactory()
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -337,11 +344,11 @@ metadata:
 			candidates := resMapFactory.FromResourceSlice(candidatesRes)
 			tc.filter.ReferralCandidates = candidates
 
-			_, err = filtertest_test.RunFilterE(t, tc.input, tc.filter)
+			_, err = filtertest_test.RunFilterE(t, tc.referrerOriginal, tc.filter)
 			if err == nil {
 				t.Fatalf("expect an error")
 			}
-			if tc.expected != "" && !assert.EqualError(t, err, tc.expected) {
+			if tc.referrerFinal != "" && !assert.EqualError(t, err, tc.referrerFinal) {
 				t.FailNow()
 			}
 		})
@@ -350,19 +357,19 @@ metadata:
 
 func TestCandidatesWithDifferentPrefixSuffix(t *testing.T) {
 	testCases := map[string]struct {
-		input         string
-		candidates    string
-		expected      string
-		filter        Filter
-		originalNames []string
-		prefix        []string
-		suffix        []string
-		inputPrefix   string
-		inputSuffix   string
-		err           bool
+		referrerOriginal string
+		candidates       string
+		referrerFinal    string
+		filter           Filter
+		originalNames    []string
+		prefix           []string
+		suffix           []string
+		inputPrefix      string
+		inputSuffix      string
+		err              bool
 	}{
 		"prefix match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -386,7 +393,7 @@ metadata:
 			suffix:        []string{"", "suffix2"},
 			inputPrefix:   "prefix1",
 			inputSuffix:   "",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -405,7 +412,7 @@ ref:
 			err: false,
 		},
 		"suffix match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -429,7 +436,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "",
 			inputSuffix:   "suffix1",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -448,7 +455,7 @@ ref:
 			err: false,
 		},
 		"prefix suffix both match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -472,7 +479,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix1",
 			inputSuffix:   "suffix1",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -491,7 +498,7 @@ ref:
 			err: false,
 		},
 		"multiple match: both": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -515,7 +522,7 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
 				ReferralTarget: resid.Gvk{
@@ -527,7 +534,7 @@ metadata:
 			err: true,
 		},
 		"multiple match: only prefix": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -551,7 +558,7 @@ metadata:
 			suffix:        []string{"", ""},
 			inputPrefix:   "prefix",
 			inputSuffix:   "",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
 				ReferralTarget: resid.Gvk{
@@ -563,7 +570,7 @@ metadata:
 			err: true,
 		},
 		"multiple match: only suffix": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -587,7 +594,7 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "",
 			inputSuffix:   "suffix",
-			expected:      "",
+			referrerFinal: "",
 			filter: Filter{
 				NameFieldToUpdate: types.FieldSpec{Path: "ref/name"},
 				ReferralTarget: resid.Gvk{
@@ -599,7 +606,7 @@ metadata:
 			err: true,
 		},
 		"no match: neither match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -623,7 +630,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -642,7 +649,7 @@ ref:
 			err: false,
 		},
 		"no match: prefix doesn't match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -666,7 +673,7 @@ metadata:
 			suffix:        []string{"suffix", "suffix"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -685,7 +692,7 @@ ref:
 			err: false,
 		},
 		"no match: suffix doesn't match": {
-			input: `
+			referrerOriginal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -709,7 +716,7 @@ metadata:
 			suffix:        []string{"suffix1", "suffix2"},
 			inputPrefix:   "prefix",
 			inputSuffix:   "suffix",
-			expected: `
+			referrerFinal: `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -732,7 +739,7 @@ ref:
 	for tn, tc := range testCases {
 		t.Run(tn, func(t *testing.T) {
 			factory := provider.NewDefaultDepProvider().GetResourceFactory()
-			referrer, err := factory.FromBytes([]byte(tc.input))
+			referrer, err := factory.FromBytes([]byte(tc.referrerOriginal))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -764,13 +771,15 @@ ref:
 
 			if !tc.err {
 				if !assert.Equal(t,
-					strings.TrimSpace(tc.expected),
+					strings.TrimSpace(tc.referrerFinal),
 					strings.TrimSpace(
-						filtertest_test.RunFilter(t, tc.input, tc.filter))) {
+						filtertest_test.RunFilter(
+							t, tc.referrerOriginal, tc.filter))) {
 					t.FailNow()
 				}
 			} else {
-				_, err := filtertest_test.RunFilterE(t, tc.input, tc.filter)
+				_, err := filtertest_test.RunFilterE(
+					t, tc.referrerOriginal, tc.filter)
 				if err == nil {
 					t.Fatalf("an error is expected")
 				}

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -672,6 +672,63 @@ spec:
         ports:
         - containerPort: 80
         - containerPort: 8080
+`,
+		},
+
+		// Test for issue #3513
+		// Currently broken; when one port has only containerPort, the output
+		// should not merge containerPort 8301 together
+		// This occurs because when protocol is missing on the first port,
+		// the merge code uses [containerPort] as the merge key rather than
+		// [containerPort, protocol]
+		"list map keys - protocol only present on some ports": {
+			input: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: consul
+        image: "hashicorp/consul:1.9.1"
+        ports:
+        - containerPort: 8500
+          name: http
+        - containerPort: 8301
+          protocol: "TCP"
+        - containerPort: 8301
+          protocol: "UDP"
+`,
+			patch: yaml.MustParse(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  labels:
+    test: label
+`),
+			expected: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  labels:
+    test: label
+spec:
+  template:
+    spec:
+      containers:
+      - name: consul
+        image: "hashicorp/consul:1.9.1"
+        ports:
+        - containerPort: 8301
+          protocol: "TCP"
+        - containerPort: 8301
+          protocol: "UDP"
+        - containerPort: 8500
+          name: http
 `,
 		},
 	}

api/filters/refvar/refvar_test.go

@@ -243,7 +243,8 @@ metadata:
 data:
   slice:
   - false`,
-			expectedError: `obj 'apiVersion: apps/v1
+			expectedError: `considering field 'data/slice' of object
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
@@ -252,7 +253,7 @@ metadata:
 data:
   slice:
   - false
-' at path 'data/slice': invalid value type expect a string`,
+: invalid value type expect a string`,
 			filter: Filter{
 				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),
@@ -268,7 +269,8 @@ metadata:
   name: dep
 data:
   1: str`,
-			expectedError: `obj 'apiVersion: apps/v1
+			expectedError: `considering field 'data' of object
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: dep
@@ -276,7 +278,7 @@ metadata:
     config.kubernetes.io/index: '0'
 data:
   1: str
-' at path 'data': invalid map key: value='1', tag='` + yaml.NodeTagInt + `'`,
+: invalid map key: value='1', tag='` + yaml.NodeTagInt + `'`,
 			filter: Filter{
 				MappingFunc: makeMf(map[string]interface{}{
 					"VAR": int64(5),

api/filters/valueadd/valueadd.go

@@ -98,7 +98,17 @@ var _ kio.Filter = Filter{}
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	_, err := kio.FilterAll(yaml.FilterFunc(
 		func(node *yaml.RNode) (*yaml.RNode, error) {
-			fields := strings.Split(f.FieldPath, "/")
+			var fields []string
+			// if there is forward slash '/' in the field name, a back slash '\'
+			// will be used to escape it.
+			for _, f := range strings.Split(f.FieldPath, "/") {
+				if len(fields) > 0 && strings.HasSuffix(fields[len(fields)-1], "\\") {
+					concatField := strings.TrimSuffix(fields[len(fields)-1], "\\") + "/" + f
+					fields = append(fields[:len(fields)-1], concatField)
+				} else {
+					fields = append(fields, f)
+				}
+			}
 			// TODO: support SequenceNode.
 			// Presumably here one could look for array indices (digits) at
 			// the end of the field path (as described in IETF RFC 6902 JSON),

api/filters/valueadd/valueadd_test.go

@@ -94,6 +94,20 @@ spec:
 				FilePathPosition: 2,
 			},
 		},
+		"backSlash": {
+			input: `
+kind: SomeKind
+`,
+			expectedOutput: `
+kind: SomeKind
+spec:
+  resourceRef/external: valueAdded
+`,
+			filter: Filter{
+				Value:     "valueAdded",
+				FieldPath: "spec/resourceRef\\/external",
+			},
+		},
 	}
 
 	for tn, tc := range testCases {

api/go.mod

@@ -20,9 +20,6 @@ require (
 	k8s.io/api v0.17.0
 	k8s.io/apimachinery v0.17.0
 	k8s.io/client-go v0.17.0
-	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
-	sigs.k8s.io/kustomize/kyaml v0.10.6
+	sigs.k8s.io/kustomize/kyaml v0.10.9
 	sigs.k8s.io/yaml v1.2.0
 )
-
-replace sigs.k8s.io/kustomize/kyaml => ../kyaml

api/go.sum

@@ -599,6 +599,8 @@ mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b h1:DxJ5nJdkhDlLok9K6qO+5290kphD
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f h1:Cq7MalBHYACRd6EesksG1Q8EoIAKOsiZviGKbOLIej4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=

api/internal/accumulator/loadconfigfromcrds.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/go-openapi/spec"
 	"github.com/pkg/errors"
-	"k8s.io/kube-openapi/pkg/common"
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
@@ -18,8 +17,16 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
+// OpenAPIDefinition describes single type.
+// Normally these definitions are auto-generated using gen-openapi.
+// Same as in k8s.io / kube-openapi / pkg / common.
+type OpenAPIDefinition struct {
+	Schema       spec.Schema
+	Dependencies []string
+}
+
 type myProperties map[string]spec.Schema
-type nameToApiMap map[string]common.OpenAPIDefinition
+type nameToApiMap map[string]OpenAPIDefinition
 
 // LoadConfigFromCRDs parse CRD schemas from paths into a TransformerConfig
 func LoadConfigFromCRDs(
@@ -162,7 +169,7 @@ func loadCrdIntoConfig(
 				err = theConfig.AddNamereferenceFieldSpec(
 					builtinconfig.NameBackReferences{
 						Gvk: resid.Gvk{Kind: kind, Version: version},
-						FieldSpecs: []types.FieldSpec{
+						Referrers: []types.FieldSpec{
 							makeFs(theGvk, append(path, propName, nameKey))},
 					})
 				if err != nil {

api/internal/accumulator/loadconfigfromcrds_test.go

@@ -8,10 +8,9 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/api/loader"
-
 	. "sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/types"
 )
@@ -140,21 +139,19 @@ func TestLoadCRDs(t *testing.T) {
 	nbrs := []builtinconfig.NameBackReferences{
 		{
 			Gvk: resid.Gvk{Kind: "Secret", Version: "v1"},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
-					CreateIfNotPresent: false,
-					Gvk:                resid.Gvk{Kind: "MyKind"},
-					Path:               "spec/secretRef/name",
+					Gvk:  resid.Gvk{Kind: "MyKind"},
+					Path: "spec/secretRef/name",
 				},
 			},
 		},
 		{
 			Gvk: resid.Gvk{Kind: "Bee", Version: "v1beta1"},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
-					CreateIfNotPresent: false,
-					Gvk:                resid.Gvk{Kind: "MyKind"},
-					Path:               "spec/beeRef/name",
+					Gvk:  resid.Gvk{Kind: "MyKind"},
+					Path: "spec/beeRef/name",
 				},
 			},
 		},

api/internal/accumulator/namereferencetransformer.go

@@ -4,19 +4,25 @@
 package accumulator
 
 import (
+	"fmt"
 	"log"
 
 	"sigs.k8s.io/kustomize/api/filters/nameref"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 )
 
 type nameReferenceTransformer struct {
 	backRefs []builtinconfig.NameBackReferences
 }
 
+const doDebug = false
+
 var _ resmap.Transformer = &nameReferenceTransformer{}
 
+type filterMap map[*resource.Resource][]nameref.Filter
+
 // newNameReferenceTransformer constructs a nameReferenceTransformer
 // with a given slice of NameBackReferences.
 func newNameReferenceTransformer(
@@ -29,16 +35,64 @@ func newNameReferenceTransformer(
 
 // Transform updates name references in resource A that
 // refer to resource B, given that B's name may have
-// changed.  A is the referrer, B is the referralTarget.
+// changed.
 //
 // For example, a HorizontalPodAutoscaler (HPA)
 // necessarily refers to a Deployment, the thing that
-// the HPA scales. The Deployment's name might change
-// (e.g. prefix added), and the reference in the HPA
-// has to be fixed.
+// an HPA scales. In this case:
 //
-// In the outer loop over the ResMap below, say we
-// encounter a specific HPA. Then, in scanning the set
+//   - the HPA instance is the Referrer,
+//   - the Deployment instance is the ReferralTarget.
+//
+// If the Deployment's name changes, e.g. a prefix is added,
+// then the HPA's reference to the Deployment must be fixed.
+//
+func (t *nameReferenceTransformer) Transform(m resmap.ResMap) error {
+	fMap := t.determineFilters(m.Resources())
+	debug(fMap)
+	for r, fList := range fMap {
+		c := m.SubsetThatCouldBeReferencedByResource(r)
+		for _, f := range fList {
+			f.Referrer = r
+			f.ReferralCandidates = c
+			if err := f.Referrer.ApplyFilter(f); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func debug(fMap filterMap) {
+	if !doDebug {
+		return
+	}
+	fmt.Printf("filterMap has %d entries:\n", len(fMap))
+	rCount := 0
+	for r, fList := range fMap {
+		yml, _ := r.AsYAML()
+		rCount++
+		fmt.Printf(`
+---- %3d. possible referrer -------------
+%s
+---------`, rCount, string(yml),
+		)
+		for i, f := range fList {
+			fmt.Printf(`
+%3d/%3d update: %s
+          from: %s
+`, rCount, i+1, f.NameFieldToUpdate.Path, f.ReferralTarget,
+			)
+		}
+	}
+}
+
+// Produce a map from referrer resources that might need to be fixed
+// to filters that might fix them.  The keys to this map are potential
+// referrers, so won't include resources like ConfigMap or Secret.
+//
+// In the inner loop over the resources below, say we
+// encounter an HPA instance. Then, in scanning the set
 // of all known backrefs, we encounter an entry like
 //
 //   - kind: Deployment
@@ -48,64 +102,53 @@ func newNameReferenceTransformer(
 //
 // This entry says that an HPA, via its
 // 'spec/scaleTargetRef/name' field, may refer to a
-// Deployment.  This match to HPA means we may need to
-// modify the value in its 'spec/scaleTargetRef/name'
-// field, by searching for the thing it refers to,
-// and getting its new name.
+// Deployment.
 //
-// As a filter, and search optimization, we compute a
-// subset of all resources that the HPA could refer to,
-// by excluding objects from other namespaces, and
-// excluding objects that don't have the same prefix-
-// suffix mods as the HPA.
-//
-// We look in this subset for all Deployment objects
-// with a resId that has a Name matching the field value
-// present in the HPA.  If no match do nothing; if more
-// than one match, it's an error.
-//
-// We overwrite the HPA name field with the value found
-// in the Deployment's name field (the name in the raw
-// object - the modified name - not the unmodified name
-// in the Deployment's resId).
-//
-// This process assumes that the name stored in a ResId
-// (the ResMap key) isn't modified by name transformers.
-// Name transformers should only modify the name in the
-// body of the resource object (the value in the ResMap).
-//
-func (t *nameReferenceTransformer) Transform(m resmap.ResMap) error {
-	// TODO: Too much looping, here and in transitive calls.
-	for _, referrer := range m.Resources() {
-		var candidates resmap.ResMap
-		for _, referralTarget := range t.backRefs {
-			for _, fSpec := range referralTarget.FieldSpecs {
-				if referrer.OrgId().IsSelected(&fSpec.Gvk) {
-					if candidates == nil {
-						// This excludes objects from other namespaces.
-						// In most realistic uses, it returns all elements of m,
-						// (since they're all in the same namespace).
-						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
-					}
-					// One way to get here is with, say, a referrer that's an
-					// HPA, and a target that's a Deployment (one of the
-					// Deployment's fieldSpecs selects an HPA).  Now we look
-					// through the candidates to see if one is a Deployment
-					// (the target), and if so, get the Deployment's name and
-					// write it into the referrer, at the field specfied in
-					// fSpec.
-					err := referrer.ApplyFilter(nameref.Filter{
-						Referrer:           referrer,
-						NameFieldToUpdate:  fSpec,
-						ReferralTarget:     referralTarget.Gvk,
-						ReferralCandidates: candidates,
-					})
-					if err != nil {
-						return err
+// This means that a filter will need to hunt for the right Deployment,
+// obtain it's new name, and write that name into the HPA's
+// 'spec/scaleTargetRef/name' field. Return a filter that can do that.
+func (t *nameReferenceTransformer) determineFilters(
+	resources []*resource.Resource) (fMap filterMap) {
+	fMap = make(filterMap)
+	for _, backReference := range t.backRefs {
+		for _, referrerSpec := range backReference.Referrers {
+			for _, res := range resources {
+				if res.OrgId().IsSelected(&referrerSpec.Gvk) {
+					// If this is true, the res might be a referrer, and if
+					// so, the name reference it holds might need an update.
+					if resHasField(res, referrerSpec.Path) {
+						// Optimization - the referrer has the field
+						// that might need updating.
+						fMap[res] = append(fMap[res], nameref.Filter{
+							// Name field to write in the Referrer.
+							// If the path specified here isn't found in
+							// the Referrer, nothing happens (no error,
+							// no field creation).
+							NameFieldToUpdate: referrerSpec,
+							// Specification of object class to read from.
+							// Always read from metadata/name field.
+							ReferralTarget: backReference.Gvk,
+						})
 					}
 				}
 			}
 		}
 	}
-	return nil
+	return fMap
+}
+
+// TODO: check res for field existence here to avoid extra work.
+// res.GetFieldValue, which uses yaml.Lookup under the hood, doesn't know
+// how to parse fieldspec-style paths that make no distinction
+// between maps and sequences.  This means it cannot lookup commonly
+// used "indeterminate" paths like
+//    spec/containers/env/valueFrom/configMapKeyRef/name
+// ('containers' is a list, not a map).
+// However, the fieldspec filter does know how to handle this;
+// extract that code and call it here?
+func resHasField(res *resource.Resource, path string) bool {
+	return true
+	// fld := strings.Join(utils.PathSplitter(path), ".")
+	// _, e := res.GetFieldValue(fld)
+	// return e == nil
 }

api/internal/accumulator/namereferencetransformer_test.go

@@ -8,12 +8,15 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 )
 
+const notEqualErrFmt = "expected (self) doesn't match actual (other): %v"
+
 func TestNameReferenceHappyRun(t *testing.T) {
 	m := resmaptest_test.NewRmBuilderDefault(t).AddWithName(
 		"cm1",
@@ -470,7 +473,7 @@ func TestNameReferenceHappyRun(t *testing.T) {
 	}
 
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -518,7 +521,27 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 						},
 					},
 				}).ResMap(),
-			expectedErr: "cannot find field 'name' in node"},
+			// TODO(#3304): DECISION - kyaml better; not a bug.
+			expectedErr: konfig.IfApiMachineryElseKyaml(
+				`updating name reference in 'rules/resourceNames' field of `+
+					`'rbac.authorization.k8s.io_v1_ClusterRole|~X|cr'`+
+					`: considering field 'rules/resourceNames' of object
+{"apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRole", "metadata": {
+    "name": "cr"}, "rules": [{"resourceNames": {"foo": "bar"}, "resources": ["secrets"]}]}
+: visit traversal on path: [resourceNames]: path config error; no 'name' field in node`,
+				`updating name reference in 'rules/resourceNames' field of `+
+					`'rbac.authorization.k8s.io_v1_ClusterRole|~X|cr'`+
+					`: considering field 'rules/resourceNames' of object
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cr
+rules:
+- resourceNames:
+    foo: bar
+  resources:
+  - secrets
+: visit traversal on path: [resourceNames]: path config error; no 'name' field in node`)},
 	}
 
 	nrt := newNameReferenceTransformer(builtinconfig.MakeDefaultConfig().NameReference)
@@ -529,7 +552,7 @@ func TestNameReferenceUnhappyRun(t *testing.T) {
 		}
 
 		if !strings.Contains(err.Error(), test.expectedErr) {
-			t.Fatalf("Incorrect error.\nExpected: %s, but got %v",
+			t.Fatalf("Incorrect error.\nExpected:\n %s\nGot:\n%v",
 				test.expectedErr, err)
 		}
 	}
@@ -587,7 +610,7 @@ func TestNameReferencePersistentVolumeHappyRun(t *testing.T) {
 	v2.AppendRefBy(c2.CurId())
 
 	if err := m1.ErrorIfNotEqualLists(m2); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -723,7 +746,7 @@ func TestNameReferenceNamespace(t *testing.T) {
 
 	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -885,7 +908,7 @@ func TestNameReferenceClusterWide(t *testing.T) {
 
 	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -1012,7 +1035,7 @@ func TestNameReferenceNamespaceTransformation(t *testing.T) {
 
 	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }
 
@@ -1049,6 +1072,6 @@ func TestNameReferenceCandidateSelection(t *testing.T) {
 
 	m.RemoveBuildAnnotations()
 	if err = expected.ErrorIfNotEqualLists(m); err != nil {
-		t.Fatalf("actual doesn't match expected: %v", err)
+		t.Fatalf(notEqualErrFmt, err)
 	}
 }

api/internal/accumulator/refvartransformer_test.go

@@ -24,14 +24,12 @@ func TestRefVarTransformer(t *testing.T) {
 		res    resmap.ResMap
 		unused []string
 	}
-	testCases := []struct {
-		description string
-		given       given
-		expected    expected
-		errMessage  string
+	testCases := map[string]struct {
+		given      given
+		expected   expected
+		errMessage string
 	}{
-		{
-			description: "var replacement in map[string]",
+		"var replacement in map[string]": {
 			given: given{
 				varMap: map[string]interface{}{
 					"FOO": "replacementForFoo",
@@ -106,8 +104,7 @@ func TestRefVarTransformer(t *testing.T) {
 				unused: []string{"BAR"},
 			},
 		},
-		{
-			description: "var replacement panic in map[string]",
+		"var replacement panic in map[string]": {
 			given: given{
 				varMap: map[string]interface{}{},
 				fs: []types.FieldSpec{
@@ -126,20 +123,21 @@ func TestRefVarTransformer(t *testing.T) {
 			},
 			// TODO(#3304): DECISION - kyaml better; not a bug.
 			errMessage: konfig.IfApiMachineryElseKyaml(
-				`obj '{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
-' at path 'data/slice': invalid value type expect a string`,
-				`obj 'apiVersion: v1
+				`considering field 'data/slice' of object
+{"apiVersion": "v1", "data": {"slice": [5]}, "kind": "ConfigMap", "metadata": {"name": "cm1"}}
+: invalid value type expect a string`,
+				`considering field 'data/slice' of object
+apiVersion: v1
 data:
   slice:
   - 5
 kind: ConfigMap
 metadata:
   name: cm1
-' at path 'data/slice': invalid value type expect a string`,
+: invalid value type expect a string`,
 			),
 		},
-		{
-			description: "var replacement in nil",
+		"var replacement in nil": {
 			given: given{
 				varMap: map[string]interface{}{},
 				fs: []types.FieldSpec{
@@ -171,20 +169,18 @@ metadata:
 		},
 	}
 
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			// arrange
+	for tn, tc := range testCases {
+		t.Run(tn, func(t *testing.T) {
 			tr := newRefVarTransformer(tc.given.varMap, tc.given.fs)
-
-			// act
 			err := tr.Transform(tc.given.res)
-
-			// assert
 			if tc.errMessage != "" {
 				if err == nil {
 					t.Fatalf("missing expected error %v", tc.errMessage)
 				} else if err.Error() != tc.errMessage {
-					t.Fatalf("actual error doesn't match expected error: \nACTUAL: %v\nEXPECTED: %v", err.Error(), tc.errMessage)
+					t.Fatalf(`actual error doesn't match expected error:
+ACTUAL: %v
+EXPECTED: %v`,
+						err.Error(), tc.errMessage)
 				}
 			} else {
 				if err != nil {
@@ -194,7 +190,13 @@ metadata:
 				a, e := tc.given.res, tc.expected.res
 				if !reflect.DeepEqual(a, e) {
 					err = e.ErrorIfNotEqualLists(a)
-					t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+					t.Fatalf(`actual doesn't match expected:
+ACTUAL:
+%v
+EXPECTED:
+%v
+ERR: %v`,
+						a, e, err)
 				}
 			}
 		})

api/internal/accumulator/resaccumulator.go

@@ -77,7 +77,7 @@ func (ra *ResAccumulator) MergeVars(incoming []types.Var) error {
 			// wildcard search on the namespace hence we still use GvknEquals
 			idMatcher = targetId.Equals
 		}
-		matched := ra.resMap.GetMatchingResourcesByOriginalId(idMatcher)
+		matched := ra.resMap.GetMatchingResourcesByAnyId(idMatcher)
 		if len(matched) > 1 {
 			return fmt.Errorf(
 				"found %d resId matches for var %s "+

api/internal/accumulator/resaccumulator_test.go

@@ -344,20 +344,20 @@ func TestResolveVarsWithNoambiguation(t *testing.T) {
 					},
 				},
 			}}).
+		// Make it seem like this resource
+		// went through a prefix transformer.
 		Add(map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Service",
 			"metadata": map[string]interface{}{
-				"name": "backendOne",
+				"name": "sub-backendOne",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "backendOne",
+					"config.kubernetes.io/previousNamespaces": "default",
+					"config.kubernetes.io/prefixes":           "sub-",
+				},
 			}}).ResMap()
 
-	// Make it seem like this resource
-	// went through a prefix transformer.
-	r := m.GetByIndex(1)
-	r.AddNamePrefix("sub-")
-	r.SetName("sub-backendOne")
-	r.SetOriginalName("backendOne", true)
-
 	err = ra2.AppendAll(m)
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)

api/internal/crawl/go.sum

@@ -534,8 +534,8 @@ k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/kustomize/kyaml v0.10.6 h1:xUJxc/k8JoWqHUahaB8DTqY0KwEPxTbTGStvW8TOcDc=
-sigs.k8s.io/kustomize/kyaml v0.10.6/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

api/internal/plugins/builtinconfig/namebackreferences.go

@@ -10,8 +10,8 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
-// NameBackReferences is an association between a gvk.GVK and a list
-// of FieldSpec instances that could refer to it.
+// NameBackReferences is an association between a gvk.GVK (a ReferralTarget)
+// and a list of Referrers that could refer to it.
 //
 // It is used to handle name changes, and can be thought of as a
 // a contact list.  If you change your own contact info (name,
@@ -19,16 +19,20 @@ import (
 // know about the change.
 //
 // For example, ConfigMaps can be used by Pods and everything that
-// contains a Pod; Deployment, Job, StatefulSet, etc.  To change
-// the name of a ConfigMap instance from 'alice' to 'bob', one
-// must visit all objects that could refer to the ConfigMap, see if
-// they mention 'alice', and if so, change the reference to 'bob'.
+// contains a Pod; Deployment, Job, StatefulSet, etc.
+// The ConfigMap is the ReferralTarget, the others are Referrers.
+//
+// If the the name of a ConfigMap instance changed from 'alice' to 'bob',
+// one must
+//  - visit all objects that could refer to the ConfigMap (the Referrers)
+//  - see if they mention 'alice',
+//  - if so, change the Referrer's name reference to 'bob'.
 //
 // The NameBackReferences instance to aid in this could look like
 //   {
 //     kind: ConfigMap
 //     version: v1
-//     FieldSpecs:
+//     fieldSpecs:
 //     - kind: Pod
 //       version: v1
 //       path: spec/volumes/configMap/name
@@ -39,13 +43,15 @@ import (
 //       (etc.)
 //   }
 type NameBackReferences struct {
-	resid.Gvk  `json:",inline,omitempty" yaml:",inline,omitempty"`
-	FieldSpecs types.FsSlice `json:"FieldSpecs,omitempty" yaml:"FieldSpecs,omitempty"`
+	resid.Gvk `json:",inline,omitempty" yaml:",inline,omitempty"`
+	// TODO: rename json 'fieldSpecs' to 'referrers' for clarity.
+	// This will, however, break anyone using a custom config.
+	Referrers types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
 func (n NameBackReferences) String() string {
 	var r []string
-	for _, f := range n.FieldSpecs {
+	for _, f := range n.Referrers {
 		r = append(r, f.String())
 	}
 	return n.Gvk.String() + ":  (\n" +
@@ -77,7 +83,7 @@ func (s nbrSlice) mergeOne(other NameBackReferences) (nbrSlice, error) {
 	found := false
 	for _, c := range s {
 		if c.Gvk.Equals(other.Gvk) {
-			c.FieldSpecs, err = c.FieldSpecs.MergeAll(other.FieldSpecs)
+			c.Referrers, err = c.Referrers.MergeAll(other.Referrers)
 			if err != nil {
 				return nil, err
 			}

api/internal/plugins/builtinconfig/namebackreferences_test.go

@@ -50,13 +50,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	nbrsSlice2 := nbrSlice{
@@ -64,13 +64,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	expected := nbrSlice{
@@ -78,13 +78,13 @@ func TestMergeAll(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
-			FieldSpecs: fsSlice1,
+			Referrers: fsSlice1,
 		},
 		{
 			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
-			FieldSpecs: fsSlice2,
+			Referrers: fsSlice2,
 		},
 	}
 	actual, err := nbrsSlice1.mergeAll(nbrsSlice2)

api/internal/plugins/builtinconfig/transformerconfig_test.go

@@ -24,7 +24,7 @@ func TestAddNamereferenceFieldSpec(t *testing.T) {
 		Gvk: resid.Gvk{
 			Kind: "KindA",
 		},
-		FieldSpecs: []types.FieldSpec{
+		Referrers: []types.FieldSpec{
 			{
 				Gvk: resid.Gvk{
 					Kind: "KindB",
@@ -89,7 +89,7 @@ func TestMerge(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
 					Gvk: resid.Gvk{
 						Kind: "KindB",
@@ -103,7 +103,7 @@ func TestMerge(t *testing.T) {
 			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []types.FieldSpec{
+			Referrers: []types.FieldSpec{
 				{
 					Gvk: resid.Gvk{
 						Kind: "KindC",

api/internal/plugins/utils/utils.go

@@ -4,6 +4,7 @@
 package utils
 
 import (
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,8 +14,8 @@ import (
 
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/konfig"
-	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 )
@@ -135,9 +136,6 @@ func GetResMapWithIDAnnotation(rm resmap.ResMap) (resmap.ResMap, error) {
 			return nil, err
 		}
 		annotations := r.GetAnnotations()
-		if annotations == nil {
-			annotations = make(map[string]string)
-		}
 		annotations[idAnnotation] = string(idString)
 		r.SetAnnotations(annotations)
 	}
@@ -147,41 +145,65 @@ func GetResMapWithIDAnnotation(rm resmap.ResMap) (resmap.ResMap, error) {
 // UpdateResMapValues updates the Resource value in the given ResMap
 // with the emitted Resource values in output.
 func UpdateResMapValues(pluginName string, h *resmap.PluginHelpers, output []byte, rm resmap.ResMap) error {
-	outputRM, err := h.ResmapFactory().NewResMapFromBytes(output)
+	mapFactory := h.ResmapFactory()
+	resFactory := mapFactory.RF()
+	resources, err := resFactory.SliceFromBytes(output)
 	if err != nil {
 		return err
 	}
-	for _, r := range outputRM.Resources() {
-		// for each emitted Resource, find the matching Resource in the original ResMap
-		// using its id
-		annotations := r.GetAnnotations()
-		idString, ok := annotations[idAnnotation]
-		if !ok {
-			return fmt.Errorf("the transformer %s should not remove annotation %s",
-				pluginName, idAnnotation)
+	// Don't use resources here, or error message will be unfriendly to plugin builders
+	newMap, err := mapFactory.NewResMapFromBytes([]byte{})
+	if err != nil {
+		return err
+	}
+
+	for _, r := range resources {
+		removeIDAnnotation(r) // stale--not manipulated by plugin transformers
+
+		// Add to the new map, checking for duplicates
+		if err := newMap.Append(r); err != nil {
+			prettyID, err := json.Marshal(r.CurId())
+			if err != nil {
+				prettyID = []byte(r.CurId().String())
+			}
+			return fmt.Errorf("plugin %s generated duplicate resource: %s", pluginName, prettyID)
 		}
-		id := resid.ResId{}
-		err := yaml.Unmarshal([]byte(idString), &id)
+
+		// Add to or update the old map
+		oldIdx, err := rm.GetIndexOfCurrentId(r.CurId())
 		if err != nil {
 			return err
 		}
-		res, err := rm.GetByCurrentId(id)
-		if err != nil {
-			return fmt.Errorf("unable to find unique match to %s", id.String())
+		if oldIdx != -1 {
+			rm.GetByIndex(oldIdx).ResetPrimaryData(r)
+		} else {
+			if err := rm.Append(r); err != nil {
+				return err
+			}
 		}
-		// remove the annotation set by Kustomize to track the resource
-		delete(annotations, idAnnotation)
-		if len(annotations) == 0 {
-			annotations = nil
-		}
-		r.SetAnnotations(annotations)
-
-		// update the resource value with the transformed object
-		res.ResetPrimaryData(r)
 	}
+
+	// Remove items the transformer deleted from the old map
+	for _, id := range rm.AllIds() {
+		newIdx, _ := newMap.GetIndexOfCurrentId(id)
+		if newIdx == -1 {
+			rm.Remove(id)
+		}
+	}
+
 	return nil
 }
 
+func removeIDAnnotation(r *resource.Resource) {
+	// remove the annotation set by Kustomize to track the resource
+	annotations := r.GetAnnotations()
+	delete(annotations, idAnnotation)
+	if len(annotations) == 0 {
+		annotations = nil
+	}
+	r.SetAnnotations(annotations)
+}
+
 // UpdateResourceOptions updates the generator options for each resource in the
 // given ResMap based on plugin provided annotations.
 func UpdateResourceOptions(rm resmap.ResMap) (resmap.ResMap, error) {

api/internal/target/kusttarget.go

@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/yaml"
 )
 
@@ -382,6 +383,11 @@ func (kt *KustTarget) accumulateDirectory(
 		return nil, errors.Wrapf(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
+	err = openapi.SetSchemaVersion(subKt.Kustomization().OpenAPI, false)
+	if err != nil {
+		return nil, errors.Wrapf(
+			err, "couldn't set openapi version for path '%s'", ldr.Root())
+	}
 	if isComponent && subKt.kustomization.Kind != types.ComponentKind {
 		return nil, fmt.Errorf(
 			"expected kind '%s' for path '%s' but got '%s'", types.ComponentKind, ldr.Root(), subKt.kustomization.Kind)

api/internal/utils/pathsplitter.go

@@ -0,0 +1,22 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import "strings"
+
+// PathSplitter splits a slash delimited string, permitting escaped slashes.
+func PathSplitter(path string) []string {
+	ps := strings.Split(path, "/")
+	var res []string
+	res = append(res, ps[0])
+	for i := 1; i < len(ps); i++ {
+		last := len(res) - 1
+		if strings.HasSuffix(res[last], `\`) {
+			res[last] = strings.TrimSuffix(res[last], `\`) + "/" + ps[i]
+		} else {
+			res = append(res, ps[i])
+		}
+	}
+	return res
+}

api/internal/utils/pathsplitter_test.go

@@ -0,0 +1,49 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/api/internal/utils"
+)
+
+func TestPathSplitter(t *testing.T) {
+	for _, tc := range []struct {
+		exp  []string
+		path string
+	}{
+		{
+			path: "",
+			exp:  []string{""},
+		},
+		{
+			path: "s",
+			exp:  []string{"s"},
+		},
+		{
+			path: "a/b/c",
+			exp:  []string{"a", "b", "c"},
+		},
+		{
+			path: `a/b[]/c`,
+			exp:  []string{"a", "b[]", "c"},
+		},
+		{
+			path: `a/b\/c/d\/e/f`,
+			exp:  []string{"a", "b/c", "d/e", "f"},
+		},
+		{
+			// The actual reason for this.
+			path: `metadata/annotations/nginx.ingress.kubernetes.io\/auth-secret`,
+			exp: []string{
+				"metadata",
+				"annotations",
+				"nginx.ingress.kubernetes.io/auth-secret"},
+		},
+	} {
+		assert.Equal(t, tc.exp, PathSplitter(tc.path))
+	}
+}

api/internal/wrappy/wnode_test.go

@@ -33,6 +33,38 @@ const (
       "area": "51",
       "greeting": "Take me to your leader."
     }
+  },
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "CM_FOO",
+                "valueFrom": {
+                  "configMapKeyRef": {
+                    "key": "somekey",
+                    "name": "myCm"
+                  }
+                }
+              },
+              {
+                "name": "SECRET_FOO",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "someKey",
+                    "name": "mySecret"
+                  }
+                }
+              }
+            ],
+            "image": "nginx:1.7.9",
+            "name": "nginx"
+          }
+        ]
+      }
+    }
   }
 }
 `
@@ -358,6 +390,51 @@ func TestGetFieldValueReturnsMap(t *testing.T) {
 	}
 }
 
+func TestGetFieldValueReturnsStuff(t *testing.T) {
+	wn := NewWNode()
+	if err := wn.UnmarshalJSON([]byte(deploymentBiggerJson)); err != nil {
+		t.Fatalf("unexpected unmarshaljson err: %v", err)
+	}
+	expected := []interface{}{
+		map[string]interface{}{
+			"env": []interface{}{
+				map[string]interface{}{
+					"name": "CM_FOO",
+					"valueFrom": map[string]interface{}{
+						"configMapKeyRef": map[string]interface{}{
+							"key":  "somekey",
+							"name": "myCm",
+						},
+					},
+				},
+				map[string]interface{}{
+					"name": "SECRET_FOO",
+					"valueFrom": map[string]interface{}{
+						"secretKeyRef": map[string]interface{}{
+							"key":  "someKey",
+							"name": "mySecret",
+						},
+					},
+				},
+			},
+			"image": string("nginx:1.7.9"),
+			"name":  string("nginx"),
+		},
+	}
+	actual, err := wn.GetFieldValue("spec.template.spec.containers")
+	if err != nil {
+		t.Fatalf("error getting field value: %v", err)
+	}
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Fatalf("actual map does not deep equal expected map:\n%v", diff)
+	}
+	// Cannot go deeper yet.
+	_, err = wn.GetFieldValue("spec.template.spec.containers.env")
+	if err == nil {
+		t.Fatalf("expected err %v", err)
+	}
+}
+
 func TestGetFieldValueReturnsSlice(t *testing.T) {
 	bytes, err := yaml.Marshal(makeBigMap())
 	if err != nil {

api/konfig/builtinpluginconsts/namereference.go

@@ -3,6 +3,9 @@
 
 package builtinpluginconsts
 
+// TODO: rename 'fieldSpecs' to 'referrers' for clarity.
+// This will, however, break anyone using a custom config.
+
 const (
 	nameReferenceFieldSpecs = `
 nameReference:

api/krusty/accumulation_test.go

@@ -93,3 +93,70 @@ resources:
 		t.Fatalf("unexpected error: %q", err)
 	}
 }
+
+func TestResourceHasAnchor(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+resources:
+- ingress.yaml
+`)
+	th.WriteF("/app/ingress.yaml", `
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+spec:
+  tls:
+  - hosts:
+    - xyz.me
+    - www.xyz.me
+    secretName: cert-tls
+  rules:
+  - host: xyz.me
+    http: &xxx_rules
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service
+            port:
+              number: 80
+  - host: www.xyz.me
+    http: *xxx_rules
+`)
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+spec:
+  rules:
+  - host: xyz.me
+    http:
+      paths:
+      - backend:
+          service:
+            name: service
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  - host: www.xyz.me
+    http:
+      paths:
+      - backend:
+          service:
+            name: service
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - xyz.me
+    - www.xyz.me
+    secretName: cert-tls
+`)
+}

api/krusty/diamondpatchref_test.go

@@ -0,0 +1,227 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+// In the following structure `top` patches `left-deploy` and `right-deploy` to reference the
+// configMap in `bottom`. This test verifies `configMapRef.name` in `left-deploy` and
+// `right-deploy` is modified correctly.
+//
+//                       top
+//                 /            \
+//           left                   right
+//          /   \                  /    \
+// left-service  bottom        bottom right-service
+//         |          \       /          |
+// left-deploy          bottom        right-deploy
+//                        |
+//                     configMap
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestConfMapNameResolutionInDiamondWithPatches(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK("bottom", `
+configMapGenerator:
+- name: bottom
+  literals:
+  - KEY=value
+`)
+
+	th.WriteK("left-service", `
+resources:
+- deployment.yaml
+`)
+
+	th.WriteF("left-service/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: left-deploy
+  labels:
+    app.kubernetes.io/name: left-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: left-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: left-pod
+    spec:
+      containers:
+      - image: left-image:v1.0
+        name: service
+`)
+
+	th.WriteK("right-service", `
+resources:
+- deployment.yaml
+`)
+
+	th.WriteF("right-service/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: right-deploy
+  labels:
+    app.kubernetes.io/name: right-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: right-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: right-pod
+    spec:
+      containers:
+      - image: right-image:v1.0
+        name: service
+`)
+
+	th.WriteK("top", `
+resources:
+- ./left
+- ./right
+`)
+
+	th.WriteK("top/left", `
+resources:
+- ../../left-service
+- ./bottom
+
+patches:
+- target:
+    kind: Deployment
+    name: left-deploy
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: ignored-by-kustomize
+    spec:
+      template:
+        spec:
+          containers:
+          - name: service
+            env:
+            - name: MAPPED_CONFIG_ITEM
+              valueFrom:
+                configMapKeyRef:
+                  name: left-bottom
+                  key: KEY
+`)
+
+	th.WriteK("top/left/bottom", `
+namePrefix: left-
+
+resources:
+- ../../../bottom
+`)
+
+	th.WriteK("top/right", `
+resources:
+- ../../right-service
+- ./bottom
+
+patches:
+- target:
+    kind: Deployment
+    name: right-deploy
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: ignored-by-kustomize
+    spec:
+      template:
+        spec:
+          containers:
+          - name: service
+            env:
+            - name: MAPPED_CONFIG_ITEM
+              valueFrom:
+                configMapKeyRef:
+                  name: right-bottom
+                  key: KEY
+`)
+
+	th.WriteK("top/right/bottom", `
+namePrefix: right-
+
+resources:
+- ../../../bottom
+`)
+
+	m := th.Run("top", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: left-deploy
+  name: left-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: left-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: left-pod
+    spec:
+      containers:
+      - env:
+        - name: MAPPED_CONFIG_ITEM
+          valueFrom:
+            configMapKeyRef:
+              key: KEY
+              name: left-bottom-9f2t6f5h6d
+        image: left-image:v1.0
+        name: service
+---
+apiVersion: v1
+data:
+  KEY: value
+kind: ConfigMap
+metadata:
+  name: left-bottom-9f2t6f5h6d
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: right-deploy
+  name: right-deploy
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: right-pod
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: right-pod
+    spec:
+      containers:
+      - env:
+        - name: MAPPED_CONFIG_ITEM
+          valueFrom:
+            configMapKeyRef:
+              key: KEY
+              name: right-bottom-9f2t6f5h6d
+        image: right-image:v1.0
+        name: service
+---
+apiVersion: v1
+data:
+  KEY: value
+kind: ConfigMap
+metadata:
+  name: right-bottom-9f2t6f5h6d
+`)
+}

api/krusty/intermediateresourceid_test.go

@@ -0,0 +1,387 @@
+package krusty_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+// Checks that a patch at the top of the stack can refer to resources
+// by an intermediate name after it has gone through multiple name
+// transformations.
+// Ref: Issue #3455
+func TestIntermediateName(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prod-foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	m := th.Run("/app/gcp", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-prod-foo
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+}
+
+// Tests that if resources in different layers (containing name
+// transformations) have the same name, there is no conflict
+func TestIntermediateNameSameNameDifferentLayer(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prod-foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+- deployment.yaml
+`)
+	th.WriteF("/app/emea/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	m := th.Run("/app/gcp", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-prod-foo
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gcp-emea-foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+}
+
+// Same as above test but tries to refer to the name foo
+// instead of prod-foo
+func TestIntermediateNameAmbiguous(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app/gcp", `
+namePrefix: gcp-
+resources:
+- ../emea
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("/app/gcp/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  replicas: 999
+`)
+	th.WriteK("/app/emea", `
+namePrefix: emea-
+resources:
+- ../prod
+- deployment.yaml
+`)
+	th.WriteF("/app/emea/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("/app/prod", `
+namePrefix: prod-
+resources:
+- ../base
+`)
+	th.WriteK("/app/base", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: foo
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	err := th.RunWithErr("/app/gcp", th.MakeDefaultOptions())
+	assert.Error(t, err)
+}
+
+// Test for issue #3228
+// References to resources by their intermediate names after multiple
+// name transformations should be supported
+func TestIntermediateNameSecretKeyRefDiamond(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK(".", `
+namePrefix: project-
+resources:
+- app`)
+
+	th.WriteK("/app", `
+resources:
+- resources/deployment.yaml
+- resources/xql
+`)
+
+	th.WriteK("/app/resources/xql", `
+resources:
+- xql-zero
+- xql-one
+configurations:
+- ./kustomizeconfig.yaml
+`)
+
+	th.WriteF("/app/resources/xql/kustomizeconfig.yaml", `
+varReference:
+- path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+`)
+
+	th.WriteK("/app/resources/xql/xql-one", `
+namePrefix: xql-one-
+resources:
+- ../../../../bases/xql
+secretGenerator:
+- name: xql-secret
+  behavior: merge
+  envs:
+  - config/xql-one-secret.env
+vars:
+- name: PROJECT_XQL_ONE_SECRET_NAME
+  objref:
+    kind: Secret
+    name: xql-secret
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+`)
+
+	th.WriteF("/app/resources/xql/xql-one/config/xql-one-secret.env", `
+arg=1
+`)
+
+	th.WriteK("/app/resources/xql/xql-zero", `
+namePrefix: xql-zero-
+resources:
+- ../../../../bases/xql
+secretGenerator:
+- name: xql-secret
+  behavior: merge
+  envs:
+  - config/xql-zero-secret.env
+vars:
+- name: PROJECT_XQL_ZERO_SECRET_NAME
+  objref:
+    kind: Secret
+    name: xql-secret
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.name
+`)
+
+	th.WriteF("/app/resources/xql/xql-zero/config/xql-zero-secret.env", `
+arg=0
+`)
+
+	th.WriteF("app/resources/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        image: example.com/app:latest
+        imagePullPolicy: Always
+        env:
+        - name: XQL_ZERO_ARG
+          valueFrom:
+            secretKeyRef:
+              name: $(PROJECT_XQL_ZERO_SECRET_NAME)
+              key: arg
+        - name: XQL_ZERO_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: xql-zero-xql-secret
+              key: password
+        - name: XQL_ONE_ARG
+          valueFrom:
+            secretKeyRef:
+              name: $(PROJECT_XQL_ONE_SECRET_NAME)
+              key: arg
+        - name: XQL_ONE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: xql-one-xql-secret
+              key: password
+`)
+
+	th.WriteK("/bases/xql", `
+secretGenerator:
+- name: xql-secret
+  envs:
+  - config/xql-secret.env
+`)
+
+	th.WriteF("bases/xql/config/xql-secret.env", `
+password=SUPER_SECRET_PASSWORD
+`)
+
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: project-app
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: XQL_ZERO_ARG
+          valueFrom:
+            secretKeyRef:
+              key: arg
+              name: project-xql-zero-xql-secret-6khmtc56hm
+        - name: XQL_ZERO_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: project-xql-zero-xql-secret-6khmtc56hm
+        - name: XQL_ONE_ARG
+          valueFrom:
+            secretKeyRef:
+              key: arg
+              name: project-xql-one-xql-secret-79mhmf5dgt
+        - name: XQL_ONE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: project-xql-one-xql-secret-79mhmf5dgt
+        image: example.com/app:latest
+        imagePullPolicy: Always
+        name: app
+---
+apiVersion: v1
+data:
+  arg: MA==
+  password: U1VQRVJfU0VDUkVUX1BBU1NXT1JE
+kind: Secret
+metadata:
+  name: project-xql-zero-xql-secret-6khmtc56hm
+type: Opaque
+---
+apiVersion: v1
+data:
+  arg: MQ==
+  password: U1VQRVJfU0VDUkVUX1BBU1NXT1JE
+kind: Secret
+metadata:
+  name: project-xql-one-xql-secret-79mhmf5dgt
+type: Opaque
+`)
+}

api/krusty/issue3377_test.go

@@ -0,0 +1,283 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package krusty_test
+
+import (
+	"testing"
+
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+)
+
+func TestIssue3377(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	opts := th.MakeDefaultOptions()
+	th.WriteK(".", `
+resources:
+- service-a.yaml
+- service-b.yaml
+
+patchesJson6902:
+- path: service-a-patch.yaml
+  target:
+    version: v1
+    group: networking.k8s.io
+    kind: Ingress
+    name: service-a
+- path: service-b-patch.yaml
+  target:
+    version: v1
+    group: networking.k8s.io
+    kind: Ingress
+    name: service-b
+vars:
+- name: SERVICE_A_DNS_NAME
+  objref:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: service-a
+  fieldref:
+    fieldpath: spec.rules[0].host
+- name: SERVICE_B_DNS_NAME
+  objref:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: service-b
+  fieldref:
+    fieldpath: spec.rules[0].host
+`)
+
+	th.WriteF("service-a.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-a
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-a
+    spec:
+      containers:
+      - image: repository/service-a:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+        env:
+        - name: REDIRECT_URI
+          value: "http://$(SERVICE_B_DNS_NAME):80/oauth_redir"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-a
+  labels:
+    app.kubernetes.io/component: service-a
+spec:
+  type: LoadBalancer
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-a
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-a
+spec:
+  rules:
+  - host: service-a.k8s.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service-a
+            port:
+              number: 8080
+`)
+
+	th.WriteF("service-a-patch.yaml", `
+- op: replace
+  path: /spec/rules/0/host
+  value: new-service-a.k8s.com
+`)
+
+	th.WriteF("service-b.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-b
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-b
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-b
+    spec:
+      containers:
+      - image: repository/service-b:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+        env:
+        - name: REDIRECT_URI
+          value: "http://$(SERVICE_A_DNS_NAME):80/oauth_redir"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-b
+  labels:
+    app.kubernetes.io/component: service-b
+spec:
+  type: LoadBalancer
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-b
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-b
+spec:
+  rules:
+  - host: service-b.k8s.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service-b
+            port:
+              number: 8080
+`)
+	th.WriteF("service-b-patch.yaml", `
+- op: replace
+  path: /spec/rules/0/host
+  value: new-service-b.k8s.com
+`)
+	m := th.Run(".", opts)
+	th.AssertActualEqualsExpected(
+		m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-a
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-a
+    spec:
+      containers:
+      - env:
+        - name: REDIRECT_URI
+          value: http://new-service-b.k8s.com:80/oauth_redir
+        image: repository/service-a:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: service-a
+  name: service-a
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-a
+  type: LoadBalancer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-a
+spec:
+  rules:
+  - host: new-service-a.k8s.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: service-a
+            port:
+              number: 8080
+        path: /
+        pathType: Prefix
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: service-b
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: service-b
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: service-b
+    spec:
+      containers:
+      - env:
+        - name: REDIRECT_URI
+          value: http://new-service-a.k8s.com:80/oauth_redir
+        image: repository/service-b:v1
+        imagePullPolicy: Always
+        name: service-b
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: service-b
+  name: service-b
+spec:
+  ports:
+  - port: 8080
+  selector:
+    app.kubernetes.io/component: service-b
+  type: LoadBalancer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: service-b
+spec:
+  rules:
+  - host: new-service-b.k8s.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: service-b
+            port:
+              number: 8080
+        path: /
+        pathType: Prefix
+`)
+}

api/krusty/kustomizer.go

@@ -16,6 +16,7 @@ import (
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 )
 
 // Kustomizer performs kustomizations.  It's meant to behave
@@ -73,6 +74,10 @@ func (b *Kustomizer) Run(path string) (resmap.ResMap, error) {
 	if err != nil {
 		return nil, err
 	}
+	err = openapi.SetSchemaVersion(kt.Kustomization().OpenAPI, true)
+	if err != nil {
+		return nil, err
+	}
 	var m resmap.ResMap
 	m, err = kt.MakeCustomizedResMap()
 	if err != nil {

api/krusty/multiplepatch_test.go

@@ -1124,3 +1124,92 @@ metadata:
 		}
 	}
 }
+
+// test for #3513
+func TestSmpWithDifferentKeysOnDifferentPorts(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+  - resource.yaml
+patches:
+  - path: patch.yaml
+    target:
+      kind: StatefulSet
+      name: myapp
+`)
+	th.WriteF("resource.yaml", `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: myapp
+spec:
+  template:
+    spec:
+      containers:
+        - name: consul
+          image: "hashicorp/consul:1.9.1"
+          ports:
+            - containerPort: 8500
+              name: http
+            - containerPort: 8501
+              name: https
+            - containerPort: 8301
+              protocol: "TCP"
+              name: serflan-tcp
+            - containerPort: 8301
+              protocol: "UDP"
+              name: serflan-udp
+            - containerPort: 8302
+              name: serfwan
+            - containerPort: 8300
+              name: server
+            - containerPort: 8600
+              name: dns-tcp
+              protocol: "TCP"
+            - containerPort: 8600
+              name: dns-udp
+              protocol: "UDP"`)
+	th.WriteF("patch.yaml", `
+kind: StatefulSet
+metadata:
+  name: myapp
+  labels:
+    test: label
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    test: label
+  name: myapp
+spec:
+  template:
+    spec:
+      containers:
+      - image: hashicorp/consul:1.9.1
+        name: consul
+        ports:
+        - containerPort: 8301
+          name: serflan-tcp
+          protocol: TCP
+        - containerPort: 8301
+          name: serflan-udp
+          protocol: UDP
+        - containerPort: 8600
+          name: dns-tcp
+          protocol: TCP
+        - containerPort: 8600
+          name: dns-udp
+          protocol: UDP
+        - containerPort: 8500
+          name: http
+        - containerPort: 8501
+          name: https
+        - containerPort: 8302
+          name: serfwan
+        - containerPort: 8300
+          name: server
+`)
+}

api/krusty/nameprefixsuffixpatch_test.go

@@ -15,7 +15,6 @@ func TestNamePrefixSuffixPatch(t *testing.T) {
 
 	th.WriteF("handlers/kustomization.yaml", `
 nameSuffix: -suffix
-
 resources:
 - deployment.yaml
 `)

api/krusty/namereference_test.go

@@ -1,11 +1,517 @@
 package krusty_test
 
 import (
+	"fmt"
 	"testing"
 
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
+func TestIssue3489Simplified(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+namespace: kube-system
+resources:
+- aa
+- bb
+`)
+	th.WriteK("aa", `
+resources:
+- ../base
+`)
+	th.WriteK("bb", `
+resources:
+- ../base
+nameSuffix: -private
+`)
+	th.WriteK("base", `
+resources:
+- deployment.yaml
+- serviceAccount.yaml
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDep
+spec:
+  template:
+    spec:
+      serviceAccountName: mySvcAcct
+      containers:
+      - name: whatever
+        image: k8s.gcr.io/governmentCheese
+`)
+	th.WriteF("base/serviceAccount.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mySvcAcct
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDep
+  namespace: kube-system
+spec:
+  template:
+    spec:
+      containers:
+      - image: k8s.gcr.io/governmentCheese
+        name: whatever
+      serviceAccountName: mySvcAcct
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mySvcAcct
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDep-private
+  namespace: kube-system
+spec:
+  template:
+    spec:
+      containers:
+      - image: k8s.gcr.io/governmentCheese
+        name: whatever
+      serviceAccountName: mySvcAcct-private
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mySvcAcct-private
+  namespace: kube-system
+`)
+}
+
+func TestIssue3489(t *testing.T) {
+	const assets = `{
+	"tenantId": "XXXXX-XXXXXX-XXXXX-XXXXXX-XXXXXX",
+	"subscriptionId": "XXXXX-XXXXXX-XXXXX-XXXXXX-XXXXXX",
+	"resourceGroup": "DNS-EUW-XXX-RG",
+	"useManagedIdentityExtension": true,
+	"userAssignedIdentityID": "XXXXX-XXXXXX-XXXXX-XXXXXX-XXXXXX"
+}
+`
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+namespace: kube-system
+resources:
+- external-dns
+- external-dns-private
+`)
+	th.WriteK("external-dns", `
+resources:
+- ../base
+commonLabels:
+  app: external-dns
+  instance: public
+images:
+- name: k8s.gcr.io/external-dns/external-dns
+  newName: xxx.azurecr.io/external-dns
+  newTag: v0.7.4_sylr.1
+- name: quay.io/sylr/external-dns
+  newName: xxx.azurecr.io/external-dns
+  newTag: v0.7.4_sylr.1
+secretGenerator:
+- name: azure-config-file
+  behavior: replace
+  files:
+  - assets/azure.json
+patches:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: external-dns
+  patch: |-
+    - op: replace
+      path: /spec/template/spec/containers/0/args
+      value:
+      - --txt-owner-id="aks"
+      - --txt-prefix=external-dns-
+      - --source=service
+      - --provider=azure
+      - --registry=txt
+      - --domain-filter=dev.company.com
+`)
+
+	th.WriteF("external-dns/assets/azure.json", assets)
+	th.WriteK("external-dns-private", `
+resources:
+- ../base
+nameSuffix: -private
+commonLabels:
+  app: external-dns
+  instance: private
+images:
+- name: k8s.gcr.io/external-dns/external-dns
+  newName: xxx.azurecr.io/external-dns
+  newTag: v0.7.4_sylr.1
+- name: quay.io/sylr/external-dns
+  newName: xxx.azurecr.io/external-dns
+  newTag: v0.7.4_sylr.1
+secretGenerator:
+- name: azure-config-file
+  behavior: replace
+  files:
+  - assets/azure.json
+patches:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: external-dns
+  patch: |-
+    - op: replace
+      path: /spec/template/spec/containers/0/args
+      value:
+      - --txt-owner-id="aks"
+      - --txt-prefix=external-dns-private-
+      - --source=service
+      - --provider=azure-private-dns
+      - --registry=txt
+      - --domain-filter=static.company.az
+`)
+	th.WriteF("external-dns-private/assets/azure.json", assets)
+	th.WriteK("base", `
+resources:
+- clusterrole.yaml
+- clusterrolebinding.yaml
+- deployment.yaml
+- serviceaccount.yaml
+commonLabels:
+  app: external-dns
+  instance: public
+images:
+- name: k8s.gcr.io/external-dns/external-dns
+  newName: quay.io/sylr/external-dns
+  newTag: v0.7.4-73-g00a9a0c7
+secretGenerator:
+- name: azure-config-file
+  files:
+  - assets/azure.json
+`)
+	th.WriteF("base/assets/azure.json", assets)
+	th.WriteF("base/clusterrolebinding.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+- kind: ServiceAccount
+  name: external-dns
+`)
+	th.WriteF("base/clusterrole.yaml", `
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+- apiGroups: ['']
+  resources: ['endpoints', 'pods', 'services', 'nodes']
+  verbs: ['get', 'watch', 'list']
+- apiGroups: ['extensions', 'networking.k8s.io']
+  resources: ['ingresses']
+  verbs: ['get', 'watch', 'list']
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels: {}
+  template:
+    metadata: {}
+    spec:
+      serviceAccountName: external-dns
+      containers:
+      - name: external-dns
+        image: k8s.gcr.io/external-dns/external-dns
+        args:
+        - --domain-filter=""
+        - --txt-owner-id=""
+        - --txt-prefix=external-dns-
+        - --source=service
+        - --provider=azure
+        - --registry=txt
+        resources: {}
+        volumeMounts:
+        - name: azure-config-file
+          mountPath: /etc/kubernetes
+          readOnly: true
+      volumes:
+      - name: azure-config-file
+        secret:
+          secretName: azure-config-file
+`)
+	th.WriteF("base/serviceaccount.yaml", `
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns
+`)
+	opts := th.MakeDefaultOptions()
+	m := th.Run(".", opts)
+	expFmt := `
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: external-dns
+    instance: public
+  name: external-dns
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - pods
+  - services
+  - nodes
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - watch
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: external-dns
+    instance: public
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+- kind: ServiceAccount
+  name: external-dns
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: external-dns
+    instance: public
+  name: external-dns
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: external-dns
+      instance: public
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: external-dns
+        instance: public
+    spec:
+      containers:
+      - args:
+        - --txt-owner-id="aks"
+        - --txt-prefix=external-dns-
+        - --source=service
+        - --provider=azure
+        - --registry=txt
+        - --domain-filter=dev.company.com
+        image: xxx.azurecr.io/external-dns:v0.7.4_sylr.1
+        name: external-dns
+        resources: {}
+        volumeMounts:
+        - mountPath: /etc/kubernetes
+          name: azure-config-file
+          readOnly: true
+      serviceAccountName: external-dns
+      volumes:
+      - name: azure-config-file
+        secret:
+          secretName: azure-config-file-%s
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: external-dns
+    instance: public
+  name: external-dns
+  namespace: kube-system
+---
+apiVersion: v1
+data:
+  azure.json: %s
+kind: Secret
+metadata:
+  labels:
+    app: external-dns
+    instance: public
+  name: azure-config-file-%s
+  namespace: kube-system
+type: Opaque
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: external-dns
+    instance: private
+  name: external-dns-private
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - pods
+  - services
+  - nodes
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - watch
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: external-dns
+    instance: private
+  name: external-dns-viewer-private
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns-private
+subjects:
+- kind: ServiceAccount
+  name: external-dns-private
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: external-dns
+    instance: private
+  name: external-dns-private
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: external-dns
+      instance: private
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: external-dns
+        instance: private
+    spec:
+      containers:
+      - args:
+        - --txt-owner-id="aks"
+        - --txt-prefix=external-dns-private-
+        - --source=service
+        - --provider=azure-private-dns
+        - --registry=txt
+        - --domain-filter=static.company.az
+        image: xxx.azurecr.io/external-dns:v0.7.4_sylr.1
+        name: external-dns
+        resources: {}
+        volumeMounts:
+        - mountPath: /etc/kubernetes
+          name: azure-config-file
+          readOnly: true
+      serviceAccountName: external-dns-private
+      volumes:
+      - name: azure-config-file
+        secret:
+          secretName: azure-config-file-private-%s
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: external-dns
+    instance: private
+  name: external-dns-private
+  namespace: kube-system
+---
+apiVersion: v1
+data:
+  azure.json: %s
+kind: Secret
+metadata:
+  labels:
+    app: external-dns
+    instance: private
+  name: azure-config-file-private-%s
+  namespace: kube-system
+type: Opaque
+`
+	const (
+		nameHashKyaml = "66cc4224mm"
+		contentKyaml  = `|
+    ewoJInRlbmFudElkIjogIlhYWFhYLVhYWFhYWC1YWFhYWC1YWFhYWFgtWFhYWFhYIiwKCS
+    JzdWJzY3JpcHRpb25JZCI6ICJYWFhYWC1YWFhYWFgtWFhYWFgtWFhYWFhYLVhYWFhYWCIs
+    CgkicmVzb3VyY2VHcm91cCI6ICJETlMtRVVXLVhYWC1SRyIsCgkidXNlTWFuYWdlZElkZW
+    50aXR5RXh0ZW5zaW9uIjogdHJ1ZSwKCSJ1c2VyQXNzaWduZWRJZGVudGl0eUlEIjogIlhY
+    WFhYLVhYWFhYWC1YWFhYWC1YWFhYWFgtWFhYWFhYIgp9Cg==`
+		nameHashApiMach = "g2k4bkgt4d"
+		// nolint: lll
+		contentApiMach = `ewoJInRlbmFudElkIjogIlhYWFhYLVhYWFhYWC1YWFhYWC1YWFhYWFgtWFhYWFhYIiwKCSJzdWJzY3JpcHRpb25JZCI6ICJYWFhYWC1YWFhYWFgtWFhYWFgtWFhYWFhYLVhYWFhYWCIsCgkicmVzb3VyY2VHcm91cCI6ICJETlMtRVVXLVhYWC1SRyIsCgkidXNlTWFuYWdlZElkZW50aXR5RXh0ZW5zaW9uIjogdHJ1ZSwKCSJ1c2VyQXNzaWduZWRJZGVudGl0eUlEIjogIlhYWFhYLVhYWFhYWC1YWFhYWC1YWFhYWFgtWFhYWFhYIgp9Cg==`
+	)
+	th.AssertActualEqualsExpected(
+		m,
+		// TODO(#3304): DECISION - kyaml better; not a bug.
+		opts.IfApiMachineryElseKyaml(
+			fmt.Sprintf(expFmt,
+				nameHashApiMach,
+				contentApiMach, nameHashApiMach,
+				nameHashApiMach,
+				contentApiMach, nameHashApiMach),
+			fmt.Sprintf(expFmt,
+				nameHashKyaml,
+				contentKyaml, nameHashKyaml,
+				nameHashKyaml,
+				contentKyaml, nameHashKyaml)))
+}
+
 func TestEmptyFieldSpecValue(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteK("/app", `

api/krusty/namespaces_test.go

@@ -50,10 +50,10 @@ resources:
 - secrets.yaml
 - role.yaml
 `)
-	// This validates Fix #1444. This should not be an error anymore -
+	// This validates fix for Issue #1044. This should not be an error anymore -
 	// the secrets have the same name but are in different namespaces.
 	// The ClusterRole (by def) is not in a namespace,
-	// an in this case applies to *any* Secret resource
+	// and in this case applies to *any* Secret resource
 	// named "dummy"
 	m := th.Run("/app", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, `
@@ -91,13 +91,134 @@ rules:
 `)
 }
 
+func TestNameReferenceDeploymentIssue3489(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+resources:
+- cm.yaml
+- dep.yaml
+`)
+	th.WriteF("base/cm.yaml", `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: myMap
+`)
+	th.WriteF("base/dep.yaml", `
+apiVersion: v1
+group: apps
+kind: Deployment
+metadata:
+  name: myDep
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: CM_FOO
+          valueFrom:
+            configMapKeyRef:
+              key: foo
+              name: myMap
+`)
+	th.WriteK("ov1", `
+resources:
+- ../base
+namePrefix: pp-
+`)
+	th.WriteK("ov2", `
+resources:
+- ../base
+nameSuffix: -ss
+`)
+	th.WriteK("ov3", `
+resources:
+- ../base
+namespace: fred
+nameSuffix: -xx
+`)
+	th.WriteK(".", `
+resources:
+- ../ov1
+- ../ov2
+- ../ov3
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pp-myMap
+---
+apiVersion: v1
+group: apps
+kind: Deployment
+metadata:
+  name: pp-myDep
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: CM_FOO
+          valueFrom:
+            configMapKeyRef:
+              key: foo
+              name: pp-myMap
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: myMap-ss
+---
+apiVersion: v1
+group: apps
+kind: Deployment
+metadata:
+  name: myDep-ss
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: CM_FOO
+          valueFrom:
+            configMapKeyRef:
+              key: foo
+              name: myMap-ss
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: myMap-xx
+  namespace: fred
+---
+apiVersion: v1
+group: apps
+kind: Deployment
+metadata:
+  name: myDep-xx
+  namespace: fred
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: CM_FOO
+          valueFrom:
+            configMapKeyRef:
+              key: foo
+              name: myMap-xx
+`)
+}
+
 // TestNameAndNsTransformation validates that NamespaceTransformer,
 // PrefixSuffixTransformer and namereference transformers are
 // able to deal with simultaneous change of namespace and name.
 func TestNameAndNsTransformation(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 
-	th.WriteK("/nameandns", `
+	th.WriteK(".", `
 namePrefix: p1-
 nameSuffix: -s1
 namespace: newnamespace
@@ -105,7 +226,7 @@ resources:
 - resources.yaml
 `)
 
-	th.WriteF("/nameandns/resources.yaml", `
+	th.WriteF("resources.yaml", `
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -204,7 +325,7 @@ kind: PersistentVolume
 metadata:
   name: pv1
 `)
-	m := th.Run("/nameandns", th.MakeDefaultOptions())
+	m := th.Run(".", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, `
 apiVersion: v1
 kind: ConfigMap

api/krusty/openapiversion_test.go

@@ -0,0 +1,301 @@
+package krusty_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
+	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
+)
+
+func TestOpenApiFieldBasicUsage(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+openapi:
+  version: v1.18.8
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	assert.Equal(t, "v1188", openapi.GetSchemaVersion())
+}
+
+func TestOpenApiFieldNotBuiltin(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+openapi:
+  version: v1.14.1
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+	err := th.RunWithErr("/app", th.MakeDefaultOptions())
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+}
+
+func TestOpenApiFieldDefaultVersion(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("/app", `
+resources:
+- deployment.yaml
+`)
+	th.WriteF("/app/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+
+	m := th.Run("/app", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	assert.Equal(t, kubernetesapi.DefaultOpenAPI, openapi.GetSchemaVersion())
+}
+
+func TestOpenApiFieldFromBase(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+openapi:
+  version: v1.19.0
+namePrefix: a-
+resources:
+- deployment.yaml
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("overlay", `
+namePrefix: b-
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 999
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: b-a-myDeployment
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	assert.Equal(t, "v1190", openapi.GetSchemaVersion())
+}
+
+func TestOpenApiFieldFromOverlay(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+namePrefix: a-
+resources:
+- deployment.yaml
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("overlay", `
+openapi:
+  version: v1.18.8
+namePrefix: b-
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 999
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: b-a-myDeployment
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	assert.Equal(t, "v1188", openapi.GetSchemaVersion())
+}
+
+func TestOpenApiFieldOverlayTakesPrecedence(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK("base", `
+openapi:
+  version: v1.19.0
+namePrefix: a-
+resources:
+- deployment.yaml
+`)
+	th.WriteF("base/deployment.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	th.WriteK("overlay", `
+openapi:
+  version: v1.18.8
+namePrefix: b-
+resources:
+- ../base
+patchesStrategicMerge:
+- depPatch.yaml
+`)
+	th.WriteF("overlay/depPatch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 999
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: b-a-myDeployment
+spec:
+  replicas: 999
+  template:
+    spec:
+      containers:
+      - image: whatever
+`)
+	assert.Equal(t, "v1188", openapi.GetSchemaVersion())
+}
+
+func TestOpenAPIFieldFromComponentDefault(t *testing.T) {
+	input := []FileGen{writeTestBase, writeTestComponent, writeOverlayProd}
+	runPath := "/app/prod"
+
+	th := kusttest_test.MakeHarness(t)
+	for _, f := range input {
+		f(th)
+	}
+	th.Run(runPath, th.MakeDefaultOptions())
+	assert.Equal(t, kubernetesapi.DefaultOpenAPI, openapi.GetSchemaVersion())
+}
+
+func writeTestComponentWithOlderOpenAPIVersion(th kusttest_test.Harness) {
+	th.WriteC("/app/comp", `
+openapi:
+  version: v1.18.8
+`)
+	th.WriteF("/app/comp/stub.yaml", `
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: stub
+spec:
+  replicas: 1
+`)
+}
+
+func TestOpenAPIFieldFromComponent(t *testing.T) {
+	input := []FileGen{
+		writeTestBase,
+		writeTestComponentWithOlderOpenAPIVersion,
+		writeOverlayProd}
+	runPath := "/app/prod"
+
+	th := kusttest_test.MakeHarness(t)
+	for _, f := range input {
+		f(th)
+	}
+	th.Run(runPath, th.MakeDefaultOptions())
+	assert.Equal(t, "v1188", openapi.GetSchemaVersion())
+}

api/krusty/patchdelete_test.go

@@ -69,28 +69,6 @@ spec:
         image: helloworld
         name: whatever
 `
-	// Allow expected variable to be unused
-	_ = expected
-
-	// Currently, kustomize inserts $patch: delete elements into the resulting resources
-	erroneousActual := `
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: whatever
-spec:
-  template:
-    spec:
-      containers:
-      - env:
-        - $patch: delete
-          name: NOT_EXISTING_FOR_REMOVAL
-        - name: EXISTING
-          value: EXISTING_VALUE
-        image: helloworld
-        name: whatever
-`
-
 	m := th.Run(".", th.MakeDefaultOptions())
-	th.AssertActualEqualsExpected(m, erroneousActual)
+	th.AssertActualEqualsExpected(m, expected)
 }

api/krusty/resourceconflict_test.go

@@ -362,7 +362,7 @@ metadata:
 	if err == nil {
 		t.Fatalf("expected error")
 	}
-	if !strings.Contains(err.Error(), "multiple matches for ~G_v1_ServiceAccount|~X|serviceaccount") {
+	if !strings.Contains(err.Error(), "found multiple possible referrals") {
 		t.Fatalf("unexpected error %v", err)
 	}
 }

api/resmap/merginator.go

@@ -47,7 +47,7 @@ func (m *merginator) ConflatePatches(in []*resource.Resource) (ResMap, error) {
 
 func (m *merginator) appendIfNoMatch(index int) (*resource.Resource, error) {
 	candidate := m.incoming[index]
-	matchedResources := m.result.GetMatchingResourcesByOriginalId(
+	matchedResources := m.result.GetMatchingResourcesByAnyId(
 		candidate.OrgId().Equals)
 	if len(matchedResources) == 0 {
 		m.result.Append(candidate)

api/resmap/resmap.go

@@ -142,24 +142,18 @@ type ResMap interface {
 	// who's CurId is matched by the argument.
 	GetMatchingResourcesByCurrentId(matches IdMatcher) []*resource.Resource
 
-	// GetMatchingResourcesByOriginalId returns the resources
-	// who's OriginalId is matched by the argument.
-	GetMatchingResourcesByOriginalId(matches IdMatcher) []*resource.Resource
+	// GetMatchingResourcesByAnyId returns the resources
+	// who's current or previous IDs is matched by the argument.
+	GetMatchingResourcesByAnyId(matches IdMatcher) []*resource.Resource
 
 	// GetByCurrentId is shorthand for calling
 	// GetMatchingResourcesByCurrentId with a matcher requiring
 	// an exact match, returning an error on multiple or no matches.
 	GetByCurrentId(resid.ResId) (*resource.Resource, error)
 
-	// GetByOriginalId is shorthand for calling
-	// GetMatchingResourcesByOriginalId with a matcher requiring
+	// GetById is shorthand for calling
+	// GetMatchingResourcesByAnyId with a matcher requiring
 	// an exact match, returning an error on multiple or no matches.
-	GetByOriginalId(resid.ResId) (*resource.Resource, error)
-
-	// GetById is a helper function which first
-	// attempts GetByOriginalId, then GetByCurrentId,
-	// returning an error if both fail to find a single
-	// match.
 	GetById(resid.ResId) (*resource.Resource, error)
 
 	// GroupedByCurrentNamespace returns a map of namespace

api/resmap/reswrangler.go

@@ -155,8 +155,7 @@ func (m *resWrangler) GetIndexOfCurrentId(id resid.ResId) (int, error) {
 
 type IdFromResource func(r *resource.Resource) resid.ResId
 
-func GetOriginalId(r *resource.Resource) resid.ResId { return r.OrgId() }
-func GetCurrentId(r *resource.Resource) resid.ResId  { return r.CurId() }
+func GetCurrentId(r *resource.Resource) resid.ResId { return r.CurId() }
 
 // GetMatchingResourcesByCurrentId implements ResMap.
 func (m *resWrangler) GetMatchingResourcesByCurrentId(
@@ -164,10 +163,19 @@ func (m *resWrangler) GetMatchingResourcesByCurrentId(
 	return m.filteredById(matches, GetCurrentId)
 }
 
-// GetMatchingResourcesByOriginalId implements ResMap.
-func (m *resWrangler) GetMatchingResourcesByOriginalId(
+// GetMatchingResourcesByAnyId implements ResMap.
+func (m *resWrangler) GetMatchingResourcesByAnyId(
 	matches IdMatcher) []*resource.Resource {
-	return m.filteredById(matches, GetOriginalId)
+	var result []*resource.Resource
+	for _, r := range m.rList {
+		for _, id := range append(r.PrevIds(), r.CurId()) {
+			if matches(id) {
+				result = append(result, r)
+				break
+			}
+		}
+	}
+	return result
 }
 
 func (m *resWrangler) filteredById(
@@ -187,26 +195,16 @@ func (m *resWrangler) GetByCurrentId(
 	return demandOneMatch(m.GetMatchingResourcesByCurrentId, id, "Current")
 }
 
-// GetByOriginalId implements ResMap.
-func (m *resWrangler) GetByOriginalId(
-	id resid.ResId) (*resource.Resource, error) {
-	return demandOneMatch(m.GetMatchingResourcesByOriginalId, id, "Original")
-}
-
 // GetById implements ResMap.
 func (m *resWrangler) GetById(
 	id resid.ResId) (*resource.Resource, error) {
-	match, err1 := m.GetByOriginalId(id)
-	if err1 == nil {
-		return match, nil
+	r, err := demandOneMatch(m.GetMatchingResourcesByAnyId, id, "Id")
+	if err != nil {
+		return nil, fmt.Errorf(
+			"%s; failed to find unique target for patch %s",
+			err.Error(), id.GvknString())
 	}
-	match, err2 := m.GetByCurrentId(id)
-	if err2 == nil {
-		return match, nil
-	}
-	return nil, fmt.Errorf(
-		"%s; %s; failed to find unique target for patch %s",
-		err1.Error(), err2.Error(), id.GvknString())
+	return r, nil
 }
 
 type resFinder func(IdMatcher) []*resource.Resource
@@ -218,7 +216,7 @@ func demandOneMatch(
 		return r[0], nil
 	}
 	if len(r) > 1 {
-		return nil, fmt.Errorf("multiple matches for %sId %s", s, id)
+		return nil, fmt.Errorf("multiple matches for %s %s", s, id)
 	}
 	return nil, fmt.Errorf("no matches for %sId %s", s, id)
 }
@@ -272,9 +270,9 @@ func (m *resWrangler) AsYaml() ([]byte, error) {
 	var b []byte
 	buf := bytes.NewBuffer(b)
 	for _, res := range m.Resources() {
-		out, err := yaml.Marshal(res.Map())
+		out, err := res.AsYAML()
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrapf(err, "%#v", res.Map())
 		}
 		if firstObj {
 			firstObj = false
@@ -377,52 +375,59 @@ func (m *resWrangler) makeCopy(copier resCopier) ResMap {
 
 // SubsetThatCouldBeReferencedByResource implements ResMap.
 func (m *resWrangler) SubsetThatCouldBeReferencedByResource(
-	inputRes *resource.Resource) ResMap {
+	referrer *resource.Resource) ResMap {
+	referrerId := referrer.CurId()
+	if !referrerId.IsNamespaceableKind() {
+		// A cluster scoped resource can refer to anything.
+		return m
+	}
 	result := newOne()
-	inputId := inputRes.CurId()
-	isInputIdNamespaceable := inputId.IsNamespaceableKind()
-	subjectNamespaces := getNamespacesForRoleBinding(inputRes)
-	for _, r := range m.Resources() {
-		// Need to match more accuratly both at the time of selection and transformation.
-		// OutmostPrefixSuffixEquals is not accurate enough since it is only using
-		// the outer most suffix and the last prefix. Use PrefixedSuffixesEquals instead.
-		resId := r.CurId()
-		if !isInputIdNamespaceable || !resId.IsNamespaceableKind() || resId.IsNsEquals(inputId) ||
-			isRoleBindingNamespace(&subjectNamespaces, r.GetNamespace()) {
-			result.append(r)
+	roleBindingNamespaces := getNamespacesForRoleBinding(referrer)
+	for _, possibleTarget := range m.Resources() {
+		id := possibleTarget.CurId()
+		if !id.IsNamespaceableKind() {
+			// A cluster-scoped resource can be referred to by anything.
+			result.append(possibleTarget)
+			continue
+		}
+		if id.IsNsEquals(referrerId) {
+			// The two objects are in the same namespace.
+			result.append(possibleTarget)
+			continue
+		}
+		// The two objects are namespaced (not cluster-scoped), AND
+		// are in different namespaces.
+		// There's still a chance they can refer to each other.
+		ns := possibleTarget.GetNamespace()
+		if roleBindingNamespaces[ns] {
+			result.append(possibleTarget)
 		}
 	}
 	return result
 }
 
-// isRoleBindingNamespace returns true is the namespace `ns` is in role binding
-// namespaces `m`
-func isRoleBindingNamespace(m *map[string]bool, ns string) bool {
-	return (*m)[ns]
-}
-
-// getNamespacesForRoleBinding returns referenced ServiceAccount namespaces if the inputRes is
-// a RoleBinding
-func getNamespacesForRoleBinding(inputRes *resource.Resource) map[string]bool {
-	res := make(map[string]bool)
-	if inputRes.GetKind() != "RoleBinding" {
-		return res
+// getNamespacesForRoleBinding returns referenced ServiceAccount namespaces
+// if the resource is a RoleBinding
+func getNamespacesForRoleBinding(r *resource.Resource) map[string]bool {
+	result := make(map[string]bool)
+	if r.GetKind() != "RoleBinding" {
+		return result
 	}
-	subjects, err := inputRes.GetSlice("subjects")
+	subjects, err := r.GetSlice("subjects")
 	if err != nil || subjects == nil {
-		return res
+		return result
 	}
-
 	for _, s := range subjects {
 		subject := s.(map[string]interface{})
-		if subject["namespace"] == nil || subject["kind"] == nil ||
-			subject["kind"].(string) != "ServiceAccount" {
-			continue
+		if ns, ok1 := subject["namespace"]; ok1 {
+			if kind, ok2 := subject["kind"]; ok2 {
+				if kind.(string) == "ServiceAccount" {
+					result[ns.(string)] = true
+				}
+			}
 		}
-		res[subject["namespace"].(string)] = true
 	}
-
-	return res
+	return result
 }
 
 func (m *resWrangler) append(res *resource.Resource) {
@@ -458,10 +463,7 @@ func (m *resWrangler) AbsorbAll(other ResMap) error {
 
 func (m *resWrangler) appendReplaceOrMerge(res *resource.Resource) error {
 	id := res.CurId()
-	matches := m.GetMatchingResourcesByOriginalId(id.Equals)
-	if len(matches) == 0 {
-		matches = m.GetMatchingResourcesByCurrentId(id.Equals)
-	}
+	matches := m.GetMatchingResourcesByAnyId(id.Equals)
 	switch len(matches) {
 	case 0:
 		switch res.Behavior() {
@@ -586,10 +588,8 @@ func (m *resWrangler) ApplySmPatch(
 			continue
 		}
 		patchCopy := patch.DeepCopy()
-		patchCopy.SetName(res.GetName())
-		patchCopy.SetNamespace(res.GetNamespace())
+		patchCopy.CopyMergeMetaDataFieldsFrom(patch)
 		patchCopy.SetGvk(res.GetGvk())
-		patchCopy.SetOriginalName(res.GetOriginalName(), true)
 		err := res.ApplySmPatch(patchCopy)
 		if err != nil {
 			// Check for an error string from UnmarshalJSON that's indicative

api/resmap/reswrangler_test.go

@@ -331,6 +331,134 @@ func TestGetMatchingResourcesByCurrentId(t *testing.T) {
 	}
 }
 
+func TestGetMatchingResourcesByAnyId(t *testing.T) {
+	r1 := rf.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "new-alice",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "alice",
+					"config.kubernetes.io/previousNamespaces": "default",
+				},
+			},
+		})
+	r2 := rf.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "new-bob",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "bob,bob2",
+					"config.kubernetes.io/previousNamespaces": "default,default",
+				},
+			},
+		})
+	r3 := rf.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name":      "new-bob",
+				"namespace": "new-happy",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "bob",
+					"config.kubernetes.io/previousNamespaces": "happy",
+				},
+			},
+		})
+	r4 := rf.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name":      "charlie",
+				"namespace": "happy",
+				"annotations": map[string]interface{}{
+					"config.kubernetes.io/previousNames":      "charlie",
+					"config.kubernetes.io/previousNamespaces": "default",
+				},
+			},
+		})
+	r5 := rf.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name":      "charlie",
+				"namespace": "happy",
+			},
+		})
+
+	m := resmaptest_test.NewRmBuilder(t, rf).
+		AddR(r1).AddR(r2).AddR(r3).AddR(r4).AddR(r5).ResMap()
+
+	// nolint:goconst
+	tests := []struct {
+		name    string
+		matcher IdMatcher
+		count   int
+	}{
+		{
+			"match everything",
+			func(resid.ResId) bool { return true },
+			5,
+		},
+		{
+			"match nothing",
+			func(resid.ResId) bool { return false },
+			0,
+		},
+		{
+			"name is alice",
+			func(x resid.ResId) bool { return x.Name == "alice" },
+			1,
+		},
+		{
+			"name is charlie",
+			func(x resid.ResId) bool { return x.Name == "charlie" },
+			2,
+		},
+		{
+			"name is bob",
+			func(x resid.ResId) bool { return x.Name == "bob" },
+			2,
+		},
+		{
+			"happy namespace",
+			func(x resid.ResId) bool {
+				return x.Namespace == "happy"
+			},
+			3,
+		},
+		{
+			"happy deployment",
+			func(x resid.ResId) bool {
+				return x.Namespace == "happy" &&
+					x.Gvk.Kind == "Deployment"
+			},
+			1,
+		},
+		{
+			"happy ConfigMap",
+			func(x resid.ResId) bool {
+				return x.Namespace == "happy" &&
+					x.Gvk.Kind == "ConfigMap"
+			},
+			2,
+		},
+	}
+	for _, tst := range tests {
+		result := m.GetMatchingResourcesByAnyId(tst.matcher)
+		if len(result) != tst.count {
+			t.Fatalf("test '%s';  actual: %d, expected: %d",
+				tst.name, len(result), tst.count)
+		}
+	}
+}
+
 func TestSubsetThatCouldBeReferencedByResource(t *testing.T) {
 	r1 := rf.FromMap(
 		map[string]interface{}{

api/resource/factory.go

@@ -11,6 +11,7 @@ import (
 
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/kusterr"
+	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/types"
 )
 
@@ -35,17 +36,12 @@ func (rf *Factory) FromMap(m map[string]interface{}) *Resource {
 
 // FromMapWithName returns a new instance with the given "original" name.
 func (rf *Factory) FromMapWithName(n string, m map[string]interface{}) *Resource {
-	return rf.makeOne(rf.kf.FromMap(m), nil).SetOriginalName(n, true)
-}
-
-// FromMapWithNamespace returns a new instance with the given "original" namespace.
-func (rf *Factory) FromMapWithNamespace(n string, m map[string]interface{}) *Resource {
-	return rf.makeOne(rf.kf.FromMap(m), nil).SetOriginalNs(n, true)
+	return rf.FromMapWithNamespaceAndName(resid.DefaultNamespace, n, m)
 }
 
 // FromMapWithNamespaceAndName returns a new instance with the given "original" namespace.
 func (rf *Factory) FromMapWithNamespaceAndName(ns string, n string, m map[string]interface{}) *Resource {
-	return rf.makeOne(rf.kf.FromMap(m), nil).SetOriginalNs(ns, true).SetOriginalName(n, true)
+	return rf.makeOne(rf.kf.FromMap(m), nil).setPreviousNamespaceAndName(ns, n)
 }
 
 // FromMapAndOption returns a new instance of Resource with given options.
@@ -157,7 +153,7 @@ func (rf *Factory) SliceFromBytesWithNames(names []string, in []byte) ([]*Resour
 		return nil, fmt.Errorf("number of names doesn't match number of resources")
 	}
 	for i, res := range result {
-		res.SetOriginalName(names[i], true)
+		res.setPreviousNamespaceAndName(resid.DefaultNamespace, names[i])
 	}
 	return result, nil
 }

api/resource/resource.go

@@ -4,7 +4,9 @@
 package resource
 
 import (
+	"errors"
 	"fmt"
+	"log"
 	"reflect"
 	"strings"
 
@@ -31,18 +33,29 @@ type Resource struct {
 }
 
 const (
-	buildAnnotationOriginalName      = konfig.ConfigAnnoDomain + "/originalName"
-	buildAnnotationPrefixes          = konfig.ConfigAnnoDomain + "/prefixes"
-	buildAnnotationSuffixes          = konfig.ConfigAnnoDomain + "/suffixes"
-	buildAnnotationOriginalNamespace = konfig.ConfigAnnoDomain + "/originalNs"
+	buildAnnotationPreviousNames      = konfig.ConfigAnnoDomain + "/previousNames"
+	buildAnnotationPrefixes           = konfig.ConfigAnnoDomain + "/prefixes"
+	buildAnnotationSuffixes           = konfig.ConfigAnnoDomain + "/suffixes"
+	buildAnnotationPreviousNamespaces = konfig.ConfigAnnoDomain + "/previousNamespaces"
 )
 
+var buildAnnotations = []string{
+	buildAnnotationPreviousNames,
+	buildAnnotationPrefixes,
+	buildAnnotationSuffixes,
+	buildAnnotationPreviousNamespaces,
+}
+
 func (r *Resource) ResetPrimaryData(incoming *Resource) {
 	r.kunStr = incoming.Copy()
 }
 
 func (r *Resource) GetAnnotations() map[string]string {
-	return r.kunStr.GetAnnotations()
+	annotations := r.kunStr.GetAnnotations()
+	if annotations == nil {
+		return make(map[string]string)
+	}
+	return annotations
 }
 
 func (r *Resource) Copy() ifc.Kunstructured {
@@ -145,8 +158,6 @@ func (r *Resource) UnmarshalJSON(s []byte) error {
 type ResCtx interface {
 	AddNamePrefix(p string)
 	AddNameSuffix(s string)
-	GetOutermostNamePrefix() string
-	GetOutermostNameSuffix() string
 	GetNamePrefixes() []string
 	GetNameSuffixes() []string
 }
@@ -195,21 +206,27 @@ func (r *Resource) ErrIfNotEquals(o *Resource) error {
 		return err
 	}
 	if !r.ReferencesEqual(o) {
-		return fmt.Errorf("references unequal")
+		return fmt.Errorf(
+			`unequal references - self:
+%sreferenced by: %s
+--- other:
+%sreferenced by: %s
+`, meYaml, r.GetRefBy(), otherYaml, o.GetRefBy())
 	}
 	if string(meYaml) != string(otherYaml) {
-		return fmt.Errorf("---  self:\n"+
-			"%s\n"+
-			"--- other:\n"+
-			"%s\n", meYaml, otherYaml)
+		return fmt.Errorf(`---  self:
+%s
+--- other:
+%s
+`, meYaml, otherYaml)
 	}
 	return nil
 }
 
-func (r *Resource) ReferencesEqual(o *Resource) bool {
+func (r *Resource) ReferencesEqual(other *Resource) bool {
 	setSelf := make(map[resid.ResId]bool)
 	setOther := make(map[resid.ResId]bool)
-	for _, ref := range o.refBy {
+	for _, ref := range other.refBy {
 		setOther[ref] = true
 	}
 	for _, ref := range r.refBy {
@@ -245,22 +262,19 @@ func copyStringSlice(s []string) []string {
 
 // Implements ResCtx AddNamePrefix
 func (r *Resource) AddNamePrefix(p string) {
-	r.addAdditiveAnnotation(buildAnnotationPrefixes, p)
+	r.appendCsvAnnotation(buildAnnotationPrefixes, p)
 }
 
 // Implements ResCtx AddNameSuffix
 func (r *Resource) AddNameSuffix(s string) {
-	r.addAdditiveAnnotation(buildAnnotationSuffixes, s)
+	r.appendCsvAnnotation(buildAnnotationSuffixes, s)
 }
 
-func (r *Resource) addAdditiveAnnotation(name, value string) {
+func (r *Resource) appendCsvAnnotation(name, value string) {
 	if value == "" {
 		return
 	}
 	annotations := r.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
 	if existing, ok := annotations[name]; ok {
 		annotations[name] = existing + "," + value
 	} else {
@@ -269,38 +283,16 @@ func (r *Resource) addAdditiveAnnotation(name, value string) {
 	r.SetAnnotations(annotations)
 }
 
-// Implements ResCtx GetOutermostNamePrefix
-func (r *Resource) GetOutermostNamePrefix() string {
-	namePrefixes := r.GetNamePrefixes()
-	if len(namePrefixes) == 0 {
-		return ""
+func SameEndingSubarray(shortest, longest []string) bool {
+	if len(shortest) > len(longest) {
+		longest, shortest = shortest, longest
 	}
-	return namePrefixes[len(namePrefixes)-1]
-}
-
-// Implements ResCtx GetOutermostNameSuffix
-func (r *Resource) GetOutermostNameSuffix() string {
-	nameSuffixes := r.GetNameSuffixes()
-	if len(nameSuffixes) == 0 {
-		return ""
+	diff := len(longest) - len(shortest)
+	if len(shortest) == 0 {
+		return diff == 0
 	}
-	return nameSuffixes[len(nameSuffixes)-1]
-}
-
-func sameEndingSubarray(a, b []string) bool {
-	compareLen := len(b)
-	if len(a) < len(b) {
-		compareLen = len(a)
-	}
-
-	if compareLen == 0 {
-		return true
-	}
-
-	alen := len(a) - 1
-	blen := len(b) - 1
-	for i := 0; i <= compareLen-1; i++ {
-		if a[alen-i] != b[blen-i] {
+	for i := len(shortest) - 1; i >= 0; i-- {
+		if longest[i+diff] != shortest[i] {
 			return false
 		}
 	}
@@ -309,41 +301,27 @@ func sameEndingSubarray(a, b []string) bool {
 
 // Implements ResCtx GetNamePrefixes
 func (r *Resource) GetNamePrefixes() []string {
-	annotations := r.GetAnnotations()
-	if _, ok := annotations[buildAnnotationPrefixes]; !ok {
-		return nil
-	}
-	return strings.Split(annotations[buildAnnotationPrefixes], ",")
+	return r.getCsvAnnotation(buildAnnotationPrefixes)
 }
 
 // Implements ResCtx GetNameSuffixes
 func (r *Resource) GetNameSuffixes() []string {
-	annotations := r.GetAnnotations()
-	if _, ok := annotations[buildAnnotationSuffixes]; !ok {
-		return nil
-	}
-	return strings.Split(annotations[buildAnnotationSuffixes], ",")
+	return r.getCsvAnnotation(buildAnnotationSuffixes)
 }
 
-// OutermostPrefixSuffixEquals returns true if both resources
-// outer suffix and prefix matches.
-func (r *Resource) OutermostPrefixSuffixEquals(o ResCtx) bool {
-	return (r.GetOutermostNamePrefix() == o.GetOutermostNamePrefix()) && (r.GetOutermostNameSuffix() == o.GetOutermostNameSuffix())
+func (r *Resource) getCsvAnnotation(name string) []string {
+	annotations := r.GetAnnotations()
+	if _, ok := annotations[name]; !ok {
+		return nil
+	}
+	return strings.Split(annotations[name], ",")
 }
 
 // PrefixesSuffixesEquals is conceptually doing the same task
 // as OutermostPrefixSuffix but performs a deeper comparison
 // of the suffix and prefix slices.
-//
-// Important note: The PrefixSuffixTransformer is stacking the
-// prefix values in the reverse order of appearance in
-// the transformed name. For this reason the sameEndingSubarray
-// method is used (as opposed to the sameBeginningSubarray)
-// to compare the prefix slice. In the same spirit, the
-// GetOutermostNamePrefix is using the last element of the
-// nameprefix slice and not the first.
 func (r *Resource) PrefixesSuffixesEquals(o ResCtx) bool {
-	return sameEndingSubarray(r.GetNamePrefixes(), o.GetNamePrefixes()) && sameEndingSubarray(r.GetNameSuffixes(), o.GetNameSuffixes())
+	return SameEndingSubarray(r.GetNamePrefixes(), o.GetNamePrefixes()) && SameEndingSubarray(r.GetNameSuffixes(), o.GetNameSuffixes())
 }
 
 // RemoveBuildAnnotations removes annotations created by the build process.
@@ -354,57 +332,15 @@ func (r *Resource) RemoveBuildAnnotations() {
 	if len(annotations) == 0 {
 		return
 	}
-	delete(annotations, buildAnnotationOriginalName)
-	delete(annotations, buildAnnotationPrefixes)
-	delete(annotations, buildAnnotationSuffixes)
-	delete(annotations, buildAnnotationOriginalNamespace)
-	r.SetAnnotations(annotations)
-}
-
-func (r *Resource) GetOriginalName() string {
-	annotations := r.GetAnnotations()
-	if name, ok := annotations[buildAnnotationOriginalName]; ok {
-		return name
-	}
-	return r.kunStr.GetName()
-}
-
-func (r *Resource) SetOriginalName(n string, overwrite bool) *Resource {
-	annotations := r.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	if _, ok := annotations[buildAnnotationOriginalName]; !ok || overwrite {
-		annotations[buildAnnotationOriginalName] = n
-	}
-	r.kunStr.SetAnnotations(annotations)
-	return r
-}
-
-func (r *Resource) GetOriginalNs() string {
-	annotations := r.GetAnnotations()
-	if ns, ok := annotations[buildAnnotationOriginalNamespace]; ok {
-		return ns
-	}
-	ns := r.GetNamespace()
-	if ns == "default" {
-		return ""
-	}
-	return ns
-}
-
-func (r *Resource) SetOriginalNs(n string, overwrite bool) *Resource {
-	if n == "" {
-		n = "default"
-	}
-	annotations := r.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	if _, ok := annotations[buildAnnotationOriginalNamespace]; !ok || overwrite {
-		annotations[buildAnnotationOriginalNamespace] = n
+	for _, a := range buildAnnotations {
+		delete(annotations, a)
 	}
 	r.SetAnnotations(annotations)
+}
+
+func (r *Resource) setPreviousNamespaceAndName(ns string, n string) *Resource {
+	r.appendCsvAnnotation(buildAnnotationPreviousNames, n)
+	r.appendCsvAnnotation(buildAnnotationPreviousNamespaces, ns)
 	return r
 }
 
@@ -427,6 +363,15 @@ func (r *Resource) AsYAML() ([]byte, error) {
 	return yaml.JSONToYAML(json)
 }
 
+// MustYaml returns YAML or panics.
+func (r *Resource) MustYaml() string {
+	yml, err := r.AsYAML()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return string(yml)
+}
+
 // SetOptions updates the generator options for the resource.
 func (r *Resource) SetOptions(o *types.GenArgs) {
 	r.options = o
@@ -452,10 +397,42 @@ func (r *Resource) GetNamespace() string {
 
 // OrgId returns the original, immutable ResId for the resource.
 // This doesn't have to be unique in a ResMap.
-// TODO: compute this once and save it in the resource.
 func (r *Resource) OrgId() resid.ResId {
-	return resid.NewResIdWithNamespace(
-		r.GetGvk(), r.GetOriginalName(), r.GetOriginalNs())
+	ids := r.PrevIds()
+	if len(ids) > 0 {
+		return ids[0]
+	}
+	return r.CurId()
+}
+
+// PrevIds returns a list of ResIds that includes every
+// previous ResId the resource has had through all of its
+// GVKN transformations, in the order that it had that ID.
+// I.e. the oldest ID is first.
+// The returned array does not include the resource's current
+// ID. If there are no previous IDs, this will return nil.
+func (r *Resource) PrevIds() []resid.ResId {
+	var ids []resid.ResId
+	// TODO: merge previous names and namespaces into one list of
+	//     pairs on one annotation so there is no chance of error
+	names := r.getCsvAnnotation(buildAnnotationPreviousNames)
+	ns := r.getCsvAnnotation(buildAnnotationPreviousNamespaces)
+	if len(names) != len(ns) {
+		panic(errors.New(
+			"number of previous names not equal to " +
+				"number of previous namespaces"))
+	}
+	for i := range names {
+		ids = append(ids, resid.NewResIdWithNamespace(
+			r.GetGvk(), names[i], ns[i]))
+	}
+	return ids
+}
+
+// StorePreviousId stores the resource's current ID via build annotations.
+func (r *Resource) StorePreviousId() {
+	id := r.CurId()
+	r.setPreviousNamespaceAndName(id.EffectiveNamespace(), id.Name)
 }
 
 // CurId returns a ResId for the resource using the

api/resource/resource_test.go

@@ -695,322 +695,165 @@ spec:
 	}
 }
 
-func TestSetOriginalNameAndNs(t *testing.T) {
-	input := `apiVersion: apps/v1
+func TestResource_StorePreviousId(t *testing.T) {
+	tests := map[string]struct {
+		input    string
+		newName  string
+		newNs    string
+		expected string
+	}{
+		"default namespace, first previous name": {
+			input: `apiVersion: apps/v1
 kind: Secret
 metadata:
- name: newName`
+  name: oldName
+`,
+			newName: "newName",
+			newNs:   "",
+			expected: `apiVersion: apps/v1
+kind: Secret
+metadata:
+  annotations:
+    config.kubernetes.io/previousNames: oldName
+    config.kubernetes.io/previousNamespaces: default
+  name: newName
+`,
+		},
 
+		"default namespace, second previous name": {
+			input: `apiVersion: apps/v1
+kind: Secret
+metadata:
+  annotations:
+    config.kubernetes.io/previousNames: oldName
+    config.kubernetes.io/previousNamespaces: default
+  name: oldName2
+`,
+			newName: "newName",
+			newNs:   "",
+			expected: `apiVersion: apps/v1
+kind: Secret
+metadata:
+  annotations:
+    config.kubernetes.io/previousNames: oldName,oldName2
+    config.kubernetes.io/previousNamespaces: default,default
+  name: newName
+`,
+		},
+
+		"non-default namespace": {
+			input: `apiVersion: apps/v1
+kind: Secret
+metadata:
+  annotations:
+    config.kubernetes.io/previousNames: oldName
+    config.kubernetes.io/previousNamespaces: default
+  name: oldName2
+  namespace: oldNamespace
+`,
+			newName: "newName",
+			newNs:   "newNamespace",
+			expected: `apiVersion: apps/v1
+kind: Secret
+metadata:
+  annotations:
+    config.kubernetes.io/previousNames: oldName,oldName2
+    config.kubernetes.io/previousNamespaces: default,oldNamespace
+  name: newName
+  namespace: newNamespace
+`,
+		},
+	}
 	factory := provider.NewDefaultDepProvider().GetResourceFactory()
-	resources, err := factory.SliceFromBytes([]byte(input))
-	if err != nil {
-		t.Fatal(err)
+	for i := range tests {
+		test := tests[i]
+		t.Run(i, func(t *testing.T) {
+			resources, err := factory.SliceFromBytes([]byte(test.input))
+			if !assert.NoError(t, err) || len(resources) == 0 {
+				t.FailNow()
+			}
+			r := resources[0]
+			r.StorePreviousId()
+			r.SetName(test.newName)
+			if test.newNs != "" {
+				r.SetNamespace(test.newNs)
+			}
+			bytes, err := r.AsYAML()
+			if !assert.NoError(t, err) {
+				t.FailNow()
+			}
+			assert.Equal(t, test.expected, string(bytes))
+		})
 	}
-
-	res := resources[0]
-	res.SetOriginalName("oldName", false)
-	res.SetOriginalNs("default", false)
-
-	expected := `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: oldName
-    config.kubernetes.io/originalNs: default
-  name: newName
-`
-	bytes, err := res.AsYAML()
-	if err != nil {
-		t.Fatal(err)
-	}
-	assert.Equal(t, expected, string(bytes))
 }
 
-func TestGetOriginalName(t *testing.T) {
-	tests := []struct {
+func TestResource_PrevIds(t *testing.T) {
+	tests := map[string]struct {
 		input    string
-		expected string
+		expected []resid.ResId
 	}{
-		{
-			// no name annotation, return the name
+		"no previous IDs": {
 			input: `apiVersion: apps/v1
 kind: Secret
 metadata:
-  name: mySecret`,
-			expected: "mySecret",
+  name: name
+`,
+			expected: nil,
 		},
 
-		{
-			// return name from name annotation
+		"one previous ID": {
 			input: `apiVersion: apps/v1
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/originalName: oldName
-  name: newName`,
-			expected: "oldName",
-		},
-	}
-
-	for _, test := range tests {
-		factory := provider.NewDefaultDepProvider().GetResourceFactory()
-		resources, err := factory.SliceFromBytes([]byte(test.input))
-		if err != nil {
-			t.Fatal(err)
-		}
-		assert.Equal(t, test.expected, resources[0].GetOriginalName())
-	}
-}
-
-func TestSetOriginalName(t *testing.T) {
-	tests := []struct {
-		input        string
-		originalName string
-		overwrite    bool
-		expected     string
-	}{
-		{
-			// no original name set, overwrite is false
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: newName`,
-			originalName: "oldName",
-			overwrite:    false,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: oldName
+    config.kubernetes.io/previousNames: oldName
+    config.kubernetes.io/previousNamespaces: default
   name: newName
 `,
+			expected: []resid.ResId{
+				{
+					Gvk:       resid.Gvk{Group: "apps", Version: "v1", Kind: "Secret"},
+					Name:      "oldName",
+					Namespace: resid.DefaultNamespace,
+				},
+			},
 		},
 
-		{
-			// no original name set, overwrite is true
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: newName`,
-			originalName: "oldName",
-			overwrite:    true,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: oldName
-  name: newName
-`,
-		},
-
-		{
-			// original name is set, overwrite is false, resource shouldn't change
+		"two ids": {
 			input: `apiVersion: apps/v1
 kind: Secret
 metadata:
   annotations:
-    config.kubernetes.io/originalName: oldName
-  name: newName`,
-			originalName: "newOriginalName",
-			overwrite:    false,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: oldName
-  name: newName
-`,
-		},
-
-		{
-			// original name is set, overwrite is true, resource should change
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: oldName
-  name: newName`,
-			originalName: "newOriginalName",
-			overwrite:    true,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalName: newOriginalName
-  name: newName
-`,
-		},
-	}
-
-	for _, test := range tests {
-		factory := provider.NewDefaultDepProvider().GetResourceFactory()
-		resources, err := factory.SliceFromBytes([]byte(test.input))
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		res := resources[0]
-		res.SetOriginalName(test.originalName, test.overwrite)
-
-		bytes, err := res.AsYAML()
-		if err != nil {
-			t.Fatal(err)
-		}
-		assert.Equal(t, test.expected, string(bytes))
-	}
-}
-
-func TestGetOriginalNs(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected string
-	}{
-		{
-			// no namespace, return default
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: mySecret`,
-			expected: "",
-		},
-
-		{
-			// return old namespace
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: mySecret
-  namespace: myNamespace`,
-			expected: "oldNamespace",
-		},
-
-		{
-			// return namespace
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: mySecret
-  namespace: myNamespace`,
-			expected: "myNamespace",
-		},
-	}
-
-	for _, test := range tests {
-		factory := provider.NewDefaultDepProvider().GetResourceFactory()
-		resources, err := factory.SliceFromBytes([]byte(test.input))
-		if err != nil {
-			t.Fatal(err)
-		}
-		assert.Equal(t, test.expected, resources[0].GetOriginalNs())
-	}
-}
-
-func TestSetOriginalNs(t *testing.T) {
-	tests := []struct {
-		input      string
-		originalNs string
-		overwrite  bool
-		expected   string
-	}{
-		{
-			// no original namespace set, overwrite is false
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: newName
-  namespace: newNamespace`,
-			originalNs: "oldNamespace",
-			overwrite:  false,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: newName
-  namespace: newNamespace
-`,
-		},
-
-		{
-			// no original name set, overwrite is true
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  name: newName
-  namespace: newNamespace`,
-
-			originalNs: "oldNamespace",
-			overwrite:  true,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: newName
-  namespace: newNamespace
-`,
-		},
-
-		{
-			// original name is set, overwrite is false, resource shouldn't change
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: newName
-  namespace: newNamespace`,
-			originalNs: "newOriginalNamespace",
-			overwrite:  false,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: newName
-  namespace: newNamespace
-`,
-		},
-
-		{
-			// original name is set, overwrite is true, resource should change
-			input: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: oldNamespace
-  name: newName
-  namespace: newNamespace`,
-			originalNs: "newOriginalNamespace",
-			overwrite:  true,
-			expected: `apiVersion: apps/v1
-kind: Secret
-metadata:
-  annotations:
-    config.kubernetes.io/originalNs: newOriginalNamespace
+    config.kubernetes.io/previousNames: oldName,oldName2
+    config.kubernetes.io/previousNamespaces: default,oldNamespace
   name: newName
   namespace: newNamespace
 `,
+			expected: []resid.ResId{
+				{
+					Gvk:       resid.Gvk{Group: "apps", Version: "v1", Kind: "Secret"},
+					Name:      "oldName",
+					Namespace: resid.DefaultNamespace,
+				},
+				{
+					Gvk:       resid.Gvk{Group: "apps", Version: "v1", Kind: "Secret"},
+					Name:      "oldName2",
+					Namespace: "oldNamespace",
+				},
+			},
 		},
 	}
-
-	for _, test := range tests {
-		factory := provider.NewDefaultDepProvider().GetResourceFactory()
-		resources, err := factory.SliceFromBytes([]byte(test.input))
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		res := resources[0]
-		res.SetOriginalNs(test.originalNs, test.overwrite)
-
-		bytes, err := res.AsYAML()
-		if err != nil {
-			t.Fatal(err)
-		}
-		assert.Equal(t, test.expected, string(bytes))
+	factory := provider.NewDefaultDepProvider().GetResourceFactory()
+	for i := range tests {
+		test := tests[i]
+		t.Run(i, func(t *testing.T) {
+			resources, err := factory.SliceFromBytes([]byte(test.input))
+			if !assert.NoError(t, err) || len(resources) == 0 {
+				t.FailNow()
+			}
+			r := resources[0]
+			assert.Equal(t, test.expected, r.PrevIds())
+		})
 	}
 }
 
@@ -1177,3 +1020,55 @@ spec:
         name: nginx
 `, imagename)
 }
+
+func TestSameEndingSubarray(t *testing.T) {
+	testCases := map[string]struct {
+		a        []string
+		b        []string
+		expected bool
+	}{
+		"both nil": {
+			expected: true,
+		},
+		"one nil": {
+			b:        []string{},
+			expected: true,
+		},
+		"both empty": {
+			a:        []string{},
+			b:        []string{},
+			expected: true,
+		},
+		"no1": {
+			a:        []string{"a"},
+			b:        []string{},
+			expected: false,
+		},
+		"no2": {
+			a:        []string{"b", "a"},
+			b:        []string{"b"},
+			expected: false,
+		},
+		"yes1": {
+			a:        []string{"a", "b"},
+			b:        []string{"b"},
+			expected: true,
+		},
+		"yes2": {
+			a:        []string{"a", "b", "c"},
+			b:        []string{"b", "c"},
+			expected: true,
+		},
+		"yes3": {
+			a:        []string{"a", "b", "c", "d", "e", "f"},
+			b:        []string{"f"},
+			expected: true,
+		},
+	}
+	for n := range testCases {
+		tc := testCases[n]
+		t.Run(n, func(t *testing.T) {
+			assert.Equal(t, tc.expected, SameEndingSubarray(tc.a, tc.b))
+		})
+	}
+}

api/testutils/kusttest/harnessenhanced.go

@@ -41,6 +41,7 @@ func MakeEnhancedHarness(t *testing.T) *HarnessEnhanced {
 	pte := newPluginTestEnv(t).set()
 
 	pc, err := konfig.EnabledPluginConfig(types.BploLoadFromFileSys)
+	pc.FnpLoadingOptions.EnableStar = true
 	if err != nil {
 		t.Fatal(err)
 	}

api/testutils/resmaptest/rmbuilder.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/provider"
+	"sigs.k8s.io/kustomize/api/resid"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 )
@@ -48,15 +49,7 @@ func (rm *rmBuilder) AddR(r *resource.Resource) *rmBuilder {
 }
 
 func (rm *rmBuilder) AddWithName(n string, m map[string]interface{}) *rmBuilder {
-	err := rm.m.Append(rm.rf.FromMapWithName(n, m))
-	if err != nil {
-		rm.t.Fatalf("test setup failure: %v", err)
-	}
-	return rm
-}
-
-func (rm *rmBuilder) AddWithNs(ns string, m map[string]interface{}) *rmBuilder {
-	err := rm.m.Append(rm.rf.FromMapWithNamespace(ns, m))
+	err := rm.m.Append(rm.rf.FromMapWithNamespaceAndName(resid.DefaultNamespace, n, m))
 	if err != nil {
 		rm.t.Fatalf("test setup failure: %v", err)
 	}

api/types/fieldspec.go

@@ -5,7 +5,6 @@ package types
 
 import (
 	"fmt"
-	"strings"
 
 	"sigs.k8s.io/kustomize/api/resid"
 )
@@ -34,11 +33,6 @@ type FieldSpec struct {
 	CreateIfNotPresent bool   `json:"create,omitempty" yaml:"create,omitempty"`
 }
 
-const (
-	escapedForwardSlash  = "\\/"
-	tempSlashReplacement = "???"
-)
-
 func (fs FieldSpec) String() string {
 	return fmt.Sprintf(
 		"%s:%v:%s", fs.Gvk.String(), fs.CreateIfNotPresent, fs.Path)
@@ -49,34 +43,6 @@ func (fs FieldSpec) effectivelyEquals(other FieldSpec) bool {
 	return fs.IsSelected(&other.Gvk) && fs.Path == other.Path
 }
 
-// PathSlice converts the path string to a slice of strings,
-// separated by a '/'. Forward slash can be contained in a
-// fieldname. such as ingress.kubernetes.io/auth-secret in
-// Ingress annotations. To deal with this special case, the
-// path to this field should be formatted as
-//
-//   metadata/annotations/ingress.kubernetes.io\/auth-secret
-//
-// Then PathSlice will return
-//
-//   []string{
-//      "metadata",
-//      "annotations",
-//      "ingress.auth-secretkubernetes.io/auth-secret"
-//   }
-func (fs FieldSpec) PathSlice() []string {
-	if !strings.Contains(fs.Path, escapedForwardSlash) {
-		return strings.Split(fs.Path, "/")
-	}
-	s := strings.Replace(fs.Path, escapedForwardSlash, tempSlashReplacement, -1)
-	paths := strings.Split(s, "/")
-	var result []string
-	for _, path := range paths {
-		result = append(result, strings.Replace(path, tempSlashReplacement, "/", -1))
-	}
-	return result
-}
-
 type FsSlice []FieldSpec
 
 func (s FsSlice) Len() int      { return len(s) }

api/types/fieldspec_test.go

@@ -13,30 +13,6 @@ import (
 	. "sigs.k8s.io/kustomize/api/types"
 )
 
-func TestPathSlice(t *testing.T) {
-	type path struct {
-		input  string
-		parsed []string
-	}
-	paths := []path{
-		{
-			input:  "spec/metadata/annotations",
-			parsed: []string{"spec", "metadata", "annotations"},
-		},
-		{
-			input:  `metadata/annotations/nginx.ingress.kubernetes.io\/auth-secret`,
-			parsed: []string{"metadata", "annotations", "nginx.ingress.kubernetes.io/auth-secret"},
-		},
-	}
-	for _, p := range paths {
-		fs := FieldSpec{Path: p.input}
-		actual := fs.PathSlice()
-		if !reflect.DeepEqual(actual, p.parsed) {
-			t.Fatalf("expected %v, but got %v", p.parsed, actual)
-		}
-	}
-}
-
 var mergeTests = []struct {
 	name     string
 	original FsSlice

api/types/kustomization.go

@@ -25,6 +25,9 @@ type Kustomization struct {
 	// MetaData is a pointer to avoid marshalling empty struct
 	MetaData *ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
 
+	// OpenAPI contains information about what kubernetes schema to use.
+	OpenAPI map[string]string `json:"openapi,omitempty" yaml:"openapi,omitempty"`
+
 	//
 	// Operators - what kustomize can do.
 	//

cmd/config/Makefile

@@ -1,14 +1,48 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-.PHONY: generate license fix vet fmt test build tidy
+.PHONY: generate license fix vet fmt test build tidy clean
 
 GOBIN := $(shell go env GOPATH)/bin
 
+$(GOBIN)/addlicense:
+	go get github.com/google/addlicense
+
+$(GOBIN)/golangci-lint:
+	go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.19.1
+
+$(GOBIN)/k8scopy:
+	( cd ../k8scopy; go install . )
+
+$(GOBIN)/mdtogo:
+	go get sigs.k8s.io/kustomize/cmd/mdtogo
+
 build:
 	go build -v -o $(GOBIN)/kubectl-krm ./kubectl-krm
 
-all: generate build license fix vet fmt test lint tidy
+all: build license fix vet fmt test lint tidy
+
+k8sGenDir := internal/commands/internal/k8sgen/pkg
+
+generate: $(GOBIN)/mdtogo $(GOBIN)/k8scopy
+	GOBIN=$(GOBIN) go generate ./...
+
+clean:
+	rm -rf $(k8sGenDir)
+
+lint: $(GOBIN)/golangci-lint
+	$(GOBIN)/golangci-lint \
+	  --skip-dirs $(k8sGenDir) \
+	  run ./...
+
+license: $(GOBIN)/addlicense
+	$(GOBIN)/addlicense \
+	  -y 2021 \
+	  -c "The Kubernetes Authors." \
+	  -f LICENSE_TEMPLATE .
+
+test:
+	go test -v -timeout 45m -cover ./...
 
 fix:
 	go fix ./...
@@ -16,24 +50,8 @@ fix:
 fmt:
 	go fmt ./...
 
-generate:
-	(which $(GOBIN)/mdtogo || go get sigs.k8s.io/kustomize/cmd/mdtogo)
-	GOBIN=$(GOBIN) go generate ./...
-
-license:
-	(which $(GOBIN)/addlicense || go get github.com/google/addlicense)
-	$(GOBIN)/addlicense  -y 2019 -c "The Kubernetes Authors." -f LICENSE_TEMPLATE .
-
 tidy:
 	go mod tidy
 
-lint:
-	(which $(GOBIN)/golangci-lint || go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.19.1)
-	$(GOBIN)/golangci-lint run ./...
-
-test:
-	go test -v -timeout 45m -cover ./...
-
 vet:
 	go vet ./...
-

cmd/config/go.mod

@@ -6,16 +6,16 @@ require (
 	github.com/go-errors/errors v1.0.1
 	github.com/go-openapi/spec v0.19.5
 	github.com/google/go-cmp v0.5.2 // indirect
+	github.com/google/uuid v1.1.2 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/olekukonko/tablewriter v0.0.4
 	github.com/spf13/cobra v1.0.0
 	github.com/stretchr/testify v1.6.1
-	golang.org/x/net v0.0.0-20200625001655-4c5254603344 // indirect
+	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b // indirect
+	golang.org/x/text v0.3.4 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
-	k8s.io/apimachinery v0.18.10
-	sigs.k8s.io/kustomize/kyaml v0.10.6
+	gopkg.in/inf.v0 v0.9.1
+	sigs.k8s.io/kustomize/kyaml v0.10.9
 )
-
-replace sigs.k8s.io/kustomize/kyaml => ../../kyaml

cmd/config/go.sum

@@ -1,14 +1,11 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
-github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
@@ -41,15 +38,9 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZm
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96 h1:cenwrSVm+Z7QLSV/BsnenAOcDXdX4cMv4wP0B/5QbPg=
-github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
-github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
@@ -59,8 +50,6 @@ github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logr/logr v0.1.0 h1:M1Tv3VzNlEHg6uyACnRdtrploV2P7wZqH8BoQMtz0cg=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-openapi/analysis v0.0.0-20180825180245-b006789cd277/go.mod h1:k70tL6pCuVxPJOHXQ+wIac1FUrvNkHolPie/cLEU6hI=
 github.com/go-openapi/analysis v0.17.0/go.mod h1:IowGgpVeD0vNm45So8nr+IcQ3pxVtpRoBWb8PVZO0ik=
 github.com/go-openapi/analysis v0.18.0/go.mod h1:IowGgpVeD0vNm45So8nr+IcQ3pxVtpRoBWb8PVZO0ik=
@@ -71,13 +60,11 @@ github.com/go-openapi/errors v0.17.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQH
 github.com/go-openapi/errors v0.18.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQHVjmcZxhka0=
 github.com/go-openapi/errors v0.19.2 h1:a2kIyV3w+OS3S97zxUndRVD46+FhGOUBDFY7nmu4CsY=
 github.com/go-openapi/errors v0.19.2/go.mod h1:qX0BLWsyaKfvhluLejVpVNwNRdXZhEbTA4kxxpKBC94=
-github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
 github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
@@ -93,7 +80,6 @@ github.com/go-openapi/runtime v0.0.0-20180920151709-4f900dc2ade9/go.mod h1:6v9a6
 github.com/go-openapi/runtime v0.19.0/go.mod h1:OwNfisksmmaZse4+gpV3Ne9AyMOlP1lt4sK4FXt0O64=
 github.com/go-openapi/runtime v0.19.4 h1:csnOgcgAiuGoM/Po7PEpKDoNulCcF3FGbSnbHfxgjMI=
 github.com/go-openapi/runtime v0.19.4/go.mod h1:X277bwSUBxVlCYR3r7xgZZGKVvBd/29gLDlFGtJ8NL4=
-github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
@@ -106,7 +92,6 @@ github.com/go-openapi/strfmt v0.19.0/go.mod h1:+uW+93UVvGGq2qGaZxdDeJqSAqBqBdl+Z
 github.com/go-openapi/strfmt v0.19.3/go.mod h1:0yX7dbo8mKIvc3XSKp7MNfxw4JytCfCD6+bY1AVL9LU=
 github.com/go-openapi/strfmt v0.19.5 h1:0utjKrw+BAh8s57XE9Xz8DUBsVvPmRUB6styvl9wWIM=
 github.com/go-openapi/strfmt v0.19.5/go.mod h1:eftuHTlB/dI8Uq8JJOyRlieZf+WkkxUuk0dgdHXr2Qk=
-github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
@@ -120,19 +105,14 @@ github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef h1:veQD95Isof8w9/WXiA+pa3tz3fJXkt5B7QaRBrM62gk=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -140,34 +120,22 @@ github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
-github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0 h1:VKV+ZcuP6l3yW9doeqz6ziZGgcynBVQO+obU0+0hcPo=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok=
-github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -181,7 +149,6 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -195,34 +162,19 @@ github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=
 github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
-github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
-github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -250,7 +202,6 @@ github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
 github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -297,10 +248,8 @@ golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181005035420-146acd28ed58/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -312,17 +261,15 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -331,18 +278,17 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c h1:Vco5b+cuG5NNfORVxZy6bYZQ7rsigisU1WQFkvQ0L5E=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190125232054-d66bd3c5d5a6/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
@@ -362,34 +308,18 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogR
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/apimachinery v0.18.10 h1:Zupk3lPrUfhCF9puTpA8EvEfPsrhNZtrpOqdp66mKVs=
-k8s.io/apimachinery v0.18.10/go.mod h1:PF5taHbXgTEJLU+xMypMmYTXTWPJ5LaW8bfsisxnEXk=
-k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
-k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
-k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
-k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
-sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
-sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
-sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
-sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=

cmd/config/internal/commands/grep.go

@@ -10,8 +10,8 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/api/resource"
 	"sigs.k8s.io/kustomize/cmd/config/ext"
+	"sigs.k8s.io/kustomize/cmd/config/internal/commands/internal/k8sgen/pkg/api/resource"
 	"sigs.k8s.io/kustomize/cmd/config/internal/generateddocs/commands"
 	"sigs.k8s.io/kustomize/cmd/config/runner"
 	"sigs.k8s.io/kustomize/kyaml/kio"

cmd/config/internal/commands/internal/k8sgen/doc.go

@@ -0,0 +1,7 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// All code below this directory is generated.
+// See {repo}/cmd/k8scopy/main.go for more info.
+//go:generate k8scopy k8scopy.yaml internal/commands
+package k8sgen

cmd/config/internal/commands/internal/k8sgen/k8scopy.yaml

@@ -0,0 +1,15 @@
+# Copyright 2020 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+#
+# The files to vendor (copy).
+# See {repo}/cmd/k8scopy/main.go for more info.
+module: k8s.io/apimachinery
+version: v0.18.10
+packages:
+- name: pkg/api/resource
+  files:
+  - amount.go
+  - math.go
+  - quantity.go
+  - scale_int.go
+  - suffix.go

cmd/config/internal/commands/internal/k8sgen/pkg/api/resource/amount.go

@@ -0,0 +1,302 @@
+// Code generated by k8scopy from k8s.io/apimachinery@v0.18.10; DO NOT EDIT.
+// Copied from k8s.io/apimachinery@v0.18.10/pkg/api/resource/amount.go
+
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+	"strconv"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Scale is used for getting and setting the base-10 scaled value.
+// Base-2 scales are omitted for mathematical simplicity.
+// See Quantity.ScaledValue for more details.
+type Scale int32
+
+// infScale adapts a Scale value to an inf.Scale value.
+func (s Scale) infScale() inf.Scale {
+	return inf.Scale(-s) // inf.Scale is upside-down
+}
+
+const (
+	Nano  Scale = -9
+	Micro Scale = -6
+	Milli Scale = -3
+	Kilo  Scale = 3
+	Mega  Scale = 6
+	Giga  Scale = 9
+	Tera  Scale = 12
+	Peta  Scale = 15
+	Exa   Scale = 18
+)
+
+var (
+	Zero = int64Amount{}
+
+	// Used by quantity strings - treat as read only
+	zeroBytes = []byte("0")
+)
+
+// int64Amount represents a fixed precision numerator and arbitrary scale exponent. It is faster
+// than operations on inf.Dec for values that can be represented as int64.
+// +k8s:openapi-gen=true
+type int64Amount struct {
+	value int64
+	scale Scale
+}
+
+// Sign returns 0 if the value is zero, -1 if it is less than 0, or 1 if it is greater than 0.
+func (a int64Amount) Sign() int {
+	switch {
+	case a.value == 0:
+		return 0
+	case a.value > 0:
+		return 1
+	default:
+		return -1
+	}
+}
+
+// AsInt64 returns the current amount as an int64 at scale 0, or false if the value cannot be
+// represented in an int64 OR would result in a loss of precision. This method is intended as
+// an optimization to avoid calling AsDec.
+func (a int64Amount) AsInt64() (int64, bool) {
+	if a.scale == 0 {
+		return a.value, true
+	}
+	if a.scale < 0 {
+		// TODO: attempt to reduce factors, although it is assumed that factors are reduced prior
+		// to the int64Amount being created.
+		return 0, false
+	}
+	return positiveScaleInt64(a.value, a.scale)
+}
+
+// AsScaledInt64 returns an int64 representing the value of this amount at the specified scale,
+// rounding up, or false if that would result in overflow. (1e20).AsScaledInt64(1) would result
+// in overflow because 1e19 is not representable as an int64. Note that setting a scale larger
+// than the current value may result in loss of precision - i.e. (1e-6).AsScaledInt64(0) would
+// return 1, because 0.000001 is rounded up to 1.
+func (a int64Amount) AsScaledInt64(scale Scale) (result int64, ok bool) {
+	if a.scale < scale {
+		result, _ = negativeScaleInt64(a.value, scale-a.scale)
+		return result, true
+	}
+	return positiveScaleInt64(a.value, a.scale-scale)
+}
+
+// AsDec returns an inf.Dec representation of this value.
+func (a int64Amount) AsDec() *inf.Dec {
+	var base inf.Dec
+	base.SetUnscaled(a.value)
+	base.SetScale(inf.Scale(-a.scale))
+	return &base
+}
+
+// Cmp returns 0 if a and b are equal, 1 if a is greater than b, or -1 if a is less than b.
+func (a int64Amount) Cmp(b int64Amount) int {
+	switch {
+	case a.scale == b.scale:
+		// compare only the unscaled portion
+	case a.scale > b.scale:
+		result, remainder, exact := divideByScaleInt64(b.value, a.scale-b.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == a.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return -1
+			default:
+				return 1
+			}
+		}
+		b.value = result
+	default:
+		result, remainder, exact := divideByScaleInt64(a.value, b.scale-a.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == b.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return 1
+			default:
+				return -1
+			}
+		}
+		a.value = result
+	}
+
+	switch {
+	case a.value == b.value:
+		return 0
+	case a.value < b.value:
+		return -1
+	default:
+		return 1
+	}
+}
+
+// Add adds two int64Amounts together, matching scales. It will return false and not mutate
+// a if overflow or underflow would result.
+func (a *int64Amount) Add(b int64Amount) bool {
+	switch {
+	case b.value == 0:
+		return true
+	case a.value == 0:
+		a.value = b.value
+		a.scale = b.scale
+		return true
+	case a.scale == b.scale:
+		c, ok := int64Add(a.value, b.value)
+		if !ok {
+			return false
+		}
+		a.value = c
+	case a.scale > b.scale:
+		c, ok := positiveScaleInt64(a.value, a.scale-b.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(c, b.value)
+		if !ok {
+			return false
+		}
+		a.scale = b.scale
+		a.value = c
+	default:
+		c, ok := positiveScaleInt64(b.value, b.scale-a.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(a.value, c)
+		if !ok {
+			return false
+		}
+		a.value = c
+	}
+	return true
+}
+
+// Sub removes the value of b from the current amount, or returns false if underflow would result.
+func (a *int64Amount) Sub(b int64Amount) bool {
+	return a.Add(int64Amount{value: -b.value, scale: b.scale})
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a int64Amount) AsScale(scale Scale) (int64Amount, bool) {
+	if a.scale >= scale {
+		return a, true
+	}
+	result, exact := negativeScaleInt64(a.value, scale-a.scale)
+	return int64Amount{value: result, scale: scale}, exact
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a int64Amount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.value
+	exponent = int32(a.scale)
+
+	amount, times := removeInt64Factors(mantissa, 10)
+	exponent += int32(times)
+
+	// make sure exponent is a multiple of 3
+	var ok bool
+	switch exponent % 3 {
+	case 1, -2:
+		amount, ok = int64MultiplyScale10(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 1
+	case 2, -1:
+		amount, ok = int64MultiplyScale100(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 2
+	}
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a int64Amount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	value, ok := a.AsScaledInt64(0)
+	if !ok {
+		return infDecAmount{a.AsDec()}.AsCanonicalBase1024Bytes(out)
+	}
+	amount, exponent := removeInt64Factors(value, 1024)
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// infDecAmount implements common operations over an inf.Dec that are specific to the quantity
+// representation.
+type infDecAmount struct {
+	*inf.Dec
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a infDecAmount) AsScale(scale Scale) (infDecAmount, bool) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, scale.infScale(), inf.RoundUp)
+	return infDecAmount{tmp}, tmp.Cmp(a.Dec) == 0
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a infDecAmount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.Dec.UnscaledBig()
+	exponent = int32(-a.Dec.Scale())
+	amount := big.NewInt(0).Set(mantissa)
+	// move all factors of 10 into the exponent for easy reasoning
+	amount, times := removeBigIntFactors(amount, bigTen)
+	exponent += times
+
+	// make sure exponent is a multiple of 3
+	for exponent%3 != 0 {
+		amount.Mul(amount, bigTen)
+		exponent--
+	}
+
+	return append(out, amount.String()...), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a infDecAmount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, 0, inf.RoundUp)
+	amount, exponent := removeBigIntFactors(tmp.UnscaledBig(), big1024)
+	return append(out, amount.String()...), exponent
+}

cmd/config/internal/commands/internal/k8sgen/pkg/api/resource/math.go

@@ -0,0 +1,313 @@
+// Code generated by k8scopy from k8s.io/apimachinery@v0.18.10; DO NOT EDIT.
+// Copied from k8s.io/apimachinery@v0.18.10/pkg/api/resource/math.go
+
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+
+	inf "gopkg.in/inf.v0"
+)
+
+const (
+	// maxInt64Factors is the highest value that will be checked when removing factors of 10 from an int64.
+	// It is also the maximum decimal digits that can be represented with an int64.
+	maxInt64Factors = 18
+)
+
+var (
+	// Commonly needed big.Int values-- treat as read only!
+	bigTen      = big.NewInt(10)
+	bigZero     = big.NewInt(0)
+	bigOne      = big.NewInt(1)
+	bigThousand = big.NewInt(1000)
+	big1024     = big.NewInt(1024)
+
+	// Commonly needed inf.Dec values-- treat as read only!
+	decZero = inf.NewDec(0, 0)
+	decOne  = inf.NewDec(1, 0)
+
+	// Largest (in magnitude) number allowed.
+	maxAllowed = infDecAmount{inf.NewDec((1<<63)-1, 0)} // == max int64
+
+	// The maximum value we can represent milli-units for.
+	// Compare with the return value of Quantity.Value() to
+	// see if it's safe to use Quantity.MilliValue().
+	MaxMilliValue = int64(((1 << 63) - 1) / 1000)
+)
+
+const mostNegative = -(mostPositive + 1)
+const mostPositive = 1<<63 - 1
+
+// int64Add returns a+b, or false if that would overflow int64.
+func int64Add(a, b int64) (int64, bool) {
+	c := a + b
+	switch {
+	case a > 0 && b > 0:
+		if c < 0 {
+			return 0, false
+		}
+	case a < 0 && b < 0:
+		if c > 0 {
+			return 0, false
+		}
+		if a == mostNegative && b == mostNegative {
+			return 0, false
+		}
+	}
+	return c, true
+}
+
+// int64Multiply returns a*b, or false if that would overflow or underflow int64.
+func int64Multiply(a, b int64) (int64, bool) {
+	if a == 0 || b == 0 || a == 1 || b == 1 {
+		return a * b, true
+	}
+	if a == mostNegative || b == mostNegative {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale returns a*b, assuming b is greater than one, or false if that would overflow or underflow int64.
+// Use when b is known to be greater than one.
+func int64MultiplyScale(a int64, b int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * b, true
+	}
+	if a == mostNegative && b != 1 {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale10 multiplies a by 10, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 10) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale10(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 10, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 10
+	return c, c/10 == a
+}
+
+// int64MultiplyScale100 multiplies a by 100, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 100) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale100(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 100, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 100
+	return c, c/100 == a
+}
+
+// int64MultiplyScale1000 multiplies a by 1000, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 1000) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale1000(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 1000, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 1000
+	return c, c/1000 == a
+}
+
+// positiveScaleInt64 multiplies base by 10^scale, returning false if the
+// value overflows. Passing a negative scale is undefined.
+func positiveScaleInt64(base int64, scale Scale) (int64, bool) {
+	switch scale {
+	case 0:
+		return base, true
+	case 1:
+		return int64MultiplyScale10(base)
+	case 2:
+		return int64MultiplyScale100(base)
+	case 3:
+		return int64MultiplyScale1000(base)
+	case 6:
+		return int64MultiplyScale(base, 1000000)
+	case 9:
+		return int64MultiplyScale(base, 1000000000)
+	default:
+		value := base
+		var ok bool
+		for i := Scale(0); i < scale; i++ {
+			if value, ok = int64MultiplyScale(value, 10); !ok {
+				return 0, false
+			}
+		}
+		return value, true
+	}
+}
+
+// negativeScaleInt64 reduces base by the provided scale, rounding up, until the
+// value is zero or the scale is reached. Passing a negative scale is undefined.
+// The value returned, if not exact, is rounded away from zero.
+func negativeScaleInt64(base int64, scale Scale) (result int64, exact bool) {
+	if scale == 0 {
+		return base, true
+	}
+
+	value := base
+	var fraction bool
+	for i := Scale(0); i < scale; i++ {
+		if !fraction && value%10 != 0 {
+			fraction = true
+		}
+		value = value / 10
+		if value == 0 {
+			if fraction {
+				if base > 0 {
+					return 1, false
+				}
+				return -1, false
+			}
+			return 0, true
+		}
+	}
+	if fraction {
+		if base > 0 {
+			value++
+		} else {
+			value--
+		}
+	}
+	return value, !fraction
+}
+
+func pow10Int64(b int64) int64 {
+	switch b {
+	case 0:
+		return 1
+	case 1:
+		return 10
+	case 2:
+		return 100
+	case 3:
+		return 1000
+	case 4:
+		return 10000
+	case 5:
+		return 100000
+	case 6:
+		return 1000000
+	case 7:
+		return 10000000
+	case 8:
+		return 100000000
+	case 9:
+		return 1000000000
+	case 10:
+		return 10000000000
+	case 11:
+		return 100000000000
+	case 12:
+		return 1000000000000
+	case 13:
+		return 10000000000000
+	case 14:
+		return 100000000000000
+	case 15:
+		return 1000000000000000
+	case 16:
+		return 10000000000000000
+	case 17:
+		return 100000000000000000
+	case 18:
+		return 1000000000000000000
+	default:
+		return 0
+	}
+}
+
+// negativeScaleInt64 returns the result of dividing base by scale * 10 and the remainder, or
+// false if no such division is possible. Dividing by negative scales is undefined.
+func divideByScaleInt64(base int64, scale Scale) (result, remainder int64, exact bool) {
+	if scale == 0 {
+		return base, 0, true
+	}
+	// the max scale representable in base 10 in an int64 is 18 decimal places
+	if scale >= 18 {
+		return 0, base, false
+	}
+	divisor := pow10Int64(int64(scale))
+	return base / divisor, base % divisor, true
+}
+
+// removeInt64Factors divides in a loop; the return values have the property that
+// value == result * base ^ scale
+func removeInt64Factors(value int64, base int64) (result int64, times int32) {
+	times = 0
+	result = value
+	negative := result < 0
+	if negative {
+		result = -result
+	}
+	switch base {
+	// allow the compiler to optimize the common cases
+	case 10:
+		for result >= 10 && result%10 == 0 {
+			times++
+			result = result / 10
+		}
+	// allow the compiler to optimize the common cases
+	case 1024:
+		for result >= 1024 && result%1024 == 0 {
+			times++
+			result = result / 1024
+		}
+	default:
+		for result >= base && result%base == 0 {
+			times++
+			result = result / base
+		}
+	}
+	if negative {
+		result = -result
+	}
+	return result, times
+}
+
+// removeBigIntFactors divides in a loop; the return values have the property that
+// d == result * factor ^ times
+// d may be modified in place.
+// If d == 0, then the return values will be (0, 0)
+func removeBigIntFactors(d, factor *big.Int) (result *big.Int, times int32) {
+	q := big.NewInt(0)
+	m := big.NewInt(0)
+	for d.Cmp(bigZero) != 0 {
+		q.DivMod(d, factor, m)
+		if m.Cmp(bigZero) != 0 {
+			break
+		}
+		times++
+		d, q = q, d
+	}
+	return d, times
+}

cmd/config/internal/commands/internal/k8sgen/pkg/api/resource/quantity.go

@@ -0,0 +1,736 @@
+// Code generated by k8scopy from k8s.io/apimachinery@v0.18.10; DO NOT EDIT.
+// Copied from k8s.io/apimachinery@v0.18.10/pkg/api/resource/quantity.go
+
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"math/big"
+	"strconv"
+	"strings"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Quantity is a fixed-point representation of a number.
+// It provides convenient marshaling/unmarshaling in JSON and YAML,
+// in addition to String() and AsInt64() accessors.
+//
+// The serialization format is:
+//
+// <quantity>        ::= <signedNumber><suffix>
+//   (Note that <suffix> may be empty, from the "" case in <decimalSI>.)
+// <digit>           ::= 0 | 1 | ... | 9
+// <digits>          ::= <digit> | <digit><digits>
+// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
+// <sign>            ::= "+" | "-"
+// <signedNumber>    ::= <number> | <sign><number>
+// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
+// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
+//   (International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
+// <decimalSI>       ::= m | "" | k | M | G | T | P | E
+//   (Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
+// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
+//
+// No matter which of the three exponent forms is used, no quantity may represent
+// a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal
+// places. Numbers larger or more precise will be capped or rounded up.
+// (E.g.: 0.1m will rounded up to 1m.)
+// This may be extended in the future if we require larger or smaller quantities.
+//
+// When a Quantity is parsed from a string, it will remember the type of suffix
+// it had, and will use the same type again when it is serialized.
+//
+// Before serializing, Quantity will be put in "canonical form".
+// This means that Exponent/suffix will be adjusted up or down (with a
+// corresponding increase or decrease in Mantissa) such that:
+//   a. No precision is lost
+//   b. No fractional digits will be emitted
+//   c. The exponent (or suffix) is as large as possible.
+// The sign will be omitted unless the number is negative.
+//
+// Examples:
+//   1.5 will be serialized as "1500m"
+//   1.5Gi will be serialized as "1536Mi"
+//
+// Note that the quantity will NEVER be internally represented by a
+// floating point number. That is the whole point of this exercise.
+//
+// Non-canonical values will still parse as long as they are well formed,
+// but will be re-emitted in their canonical form. (So always use canonical
+// form, or don't diff.)
+//
+// This format is intended to make it difficult to use these numbers without
+// writing some sort of special handling code in the hopes that that will
+// cause implementors to also use a fixed point implementation.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-gen=true
+type Quantity struct {
+	// i is the quantity in int64 scaled form, if d.Dec == nil
+	i int64Amount
+	// d is the quantity in inf.Dec form if d.Dec != nil
+	d infDecAmount
+	// s is the generated value of this quantity to avoid recalculation
+	s string
+
+	// Change Format at will. See the comment for Canonicalize for
+	// more details.
+	Format
+}
+
+// CanonicalValue allows a quantity amount to be converted to a string.
+type CanonicalValue interface {
+	// AsCanonicalBytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-10. Callers may
+	// pass a byte slice to the method to avoid allocations.
+	AsCanonicalBytes(out []byte) ([]byte, int32)
+	// AsCanonicalBase1024Bytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-1024. Callers
+	// may pass a byte slice to the method to avoid allocations.
+	AsCanonicalBase1024Bytes(out []byte) ([]byte, int32)
+}
+
+// Format lists the three possible formattings of a quantity.
+type Format string
+
+const (
+	DecimalExponent = Format("DecimalExponent") // e.g., 12e6
+	BinarySI        = Format("BinarySI")        // e.g., 12Mi (12 * 2^20)
+	DecimalSI       = Format("DecimalSI")       // e.g., 12M  (12 * 10^6)
+)
+
+// MustParse turns the given string into a quantity or panics; for tests
+// or others cases where you know the string is valid.
+func MustParse(str string) Quantity {
+	q, err := ParseQuantity(str)
+	if err != nil {
+		panic(fmt.Errorf("cannot parse '%v': %v", str, err))
+	}
+	return q
+}
+
+const (
+	// splitREString is used to separate a number from its suffix; as such,
+	// this is overly permissive, but that's OK-- it will be checked later.
+	splitREString = "^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$"
+)
+
+var (
+	// Errors that could happen while parsing a string.
+	ErrFormatWrong = errors.New("quantities must match the regular expression '" + splitREString + "'")
+	ErrNumeric     = errors.New("unable to parse numeric part of quantity")
+	ErrSuffix      = errors.New("unable to parse quantity's suffix")
+)
+
+// parseQuantityString is a fast scanner for quantity values.
+func parseQuantityString(str string) (positive bool, value, num, denom, suffix string, err error) {
+	positive = true
+	pos := 0
+	end := len(str)
+
+	// handle leading sign
+	if pos < end {
+		switch str[0] {
+		case '-':
+			positive = false
+			pos++
+		case '+':
+			pos++
+		}
+	}
+
+	// strip leading zeros
+Zeroes:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = "0"
+			value = num
+			return
+		}
+		switch str[i] {
+		case '0':
+			pos++
+		default:
+			break Zeroes
+		}
+	}
+
+	// extract the numerator
+Num:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = str[pos:end]
+			value = str[0:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			num = str[pos:i]
+			pos = i
+			break Num
+		}
+	}
+
+	// if we stripped all numerator positions, always return 0
+	if len(num) == 0 {
+		num = "0"
+	}
+
+	// handle a denominator
+	if pos < end && str[pos] == '.' {
+		pos++
+	Denom:
+		for i := pos; ; i++ {
+			if i >= end {
+				denom = str[pos:end]
+				value = str[0:end]
+				return
+			}
+			switch str[i] {
+			case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			default:
+				denom = str[pos:i]
+				pos = i
+				break Denom
+			}
+		}
+		// TODO: we currently allow 1.G, but we may not want to in the future.
+		// if len(denom) == 0 {
+		// 	err = ErrFormatWrong
+		// 	return
+		// }
+	}
+	value = str[0:pos]
+
+	// grab the elements of the suffix
+	suffixStart := pos
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		if !strings.ContainsAny(str[i:i+1], "eEinumkKMGTP") {
+			pos = i
+			break
+		}
+	}
+	if pos < end {
+		switch str[pos] {
+		case '-', '+':
+			pos++
+		}
+	}
+Suffix:
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			break Suffix
+		}
+	}
+	// we encountered a non decimal in the Suffix loop, but the last character
+	// was not a valid exponent
+	err = ErrFormatWrong
+	return
+}
+
+// ParseQuantity turns str into a Quantity, or returns an error.
+func ParseQuantity(str string) (Quantity, error) {
+	if len(str) == 0 {
+		return Quantity{}, ErrFormatWrong
+	}
+	if str == "0" {
+		return Quantity{Format: DecimalSI, s: str}, nil
+	}
+
+	positive, value, num, denom, suf, err := parseQuantityString(str)
+	if err != nil {
+		return Quantity{}, err
+	}
+
+	base, exponent, format, ok := quantitySuffixer.interpret(suffix(suf))
+	if !ok {
+		return Quantity{}, ErrSuffix
+	}
+
+	precision := int32(0)
+	scale := int32(0)
+	mantissa := int64(1)
+	switch format {
+	case DecimalExponent, DecimalSI:
+		scale = exponent
+		precision = maxInt64Factors - int32(len(num)+len(denom))
+	case BinarySI:
+		scale = 0
+		switch {
+		case exponent >= 0 && len(denom) == 0:
+			// only handle positive binary numbers with the fast path
+			mantissa = int64(int64(mantissa) << uint64(exponent))
+			// 1Mi (2^20) has ~6 digits of decimal precision, so exponent*3/10 -1 is roughly the precision
+			precision = 15 - int32(len(num)) - int32(float32(exponent)*3/10) - 1
+		default:
+			precision = -1
+		}
+	}
+
+	if precision >= 0 {
+		// if we have a denominator, shift the entire value to the left by the number of places in the
+		// denominator
+		scale -= int32(len(denom))
+		if scale >= int32(Nano) {
+			shifted := num + denom
+
+			var value int64
+			value, err := strconv.ParseInt(shifted, 10, 64)
+			if err != nil {
+				return Quantity{}, ErrNumeric
+			}
+			if result, ok := int64Multiply(value, int64(mantissa)); ok {
+				if !positive {
+					result = -result
+				}
+				// if the number is in canonical form, reuse the string
+				switch format {
+				case BinarySI:
+					if exponent%10 == 0 && (value&0x07 != 0) {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				default:
+					if scale%3 == 0 && !strings.HasSuffix(shifted, "000") && shifted[0] != '0' {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				}
+				return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format}, nil
+			}
+		}
+	}
+
+	amount := new(inf.Dec)
+	if _, ok := amount.SetString(value); !ok {
+		return Quantity{}, ErrNumeric
+	}
+
+	// So that no one but us has to think about suffixes, remove it.
+	if base == 10 {
+		amount.SetScale(amount.Scale() + Scale(exponent).infScale())
+	} else if base == 2 {
+		// numericSuffix = 2 ** exponent
+		numericSuffix := big.NewInt(1).Lsh(bigOne, uint(exponent))
+		ub := amount.UnscaledBig()
+		amount.SetUnscaledBig(ub.Mul(ub, numericSuffix))
+	}
+
+	// Cap at min/max bounds.
+	sign := amount.Sign()
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	// This rounds non-zero values up to the minimum representable value, under the theory that
+	// if you want some resources, you should get some resources, even if you asked for way too small
+	// of an amount.  Arguably, this should be inf.RoundHalfUp (normal rounding), but that would have
+	// the side effect of rounding values < .5n to zero.
+	if v, ok := amount.Unscaled(); v != int64(0) || !ok {
+		amount.Round(amount, Nano.infScale(), inf.RoundUp)
+	}
+
+	// The max is just a simple cap.
+	// TODO: this prevents accumulating quantities greater than int64, for instance quota across a cluster
+	if format == BinarySI && amount.Cmp(maxAllowed.Dec) > 0 {
+		amount.Set(maxAllowed.Dec)
+	}
+
+	if format == BinarySI && amount.Cmp(decOne) < 0 && amount.Cmp(decZero) > 0 {
+		// This avoids rounding and hopefully confusion, too.
+		format = DecimalSI
+	}
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	return Quantity{d: infDecAmount{amount}, Format: format}, nil
+}
+
+// DeepCopy returns a deep-copy of the Quantity value.  Note that the method
+// receiver is a value, so we can mutate it in-place and return it.
+func (q Quantity) DeepCopy() Quantity {
+	if q.d.Dec != nil {
+		tmp := &inf.Dec{}
+		q.d.Dec = tmp.Set(q.d.Dec)
+	}
+	return q
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Quantity) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Quantity) OpenAPISchemaFormat() string { return "" }
+
+// CanonicalizeBytes returns the canonical form of q and its suffix (see comment on Quantity).
+//
+// Note about BinarySI:
+// * If q.Format is set to BinarySI and q.Amount represents a non-zero value between
+//   -1 and +1, it will be emitted as if q.Format were DecimalSI.
+// * Otherwise, if q.Format is set to BinarySI, fractional parts of q.Amount will be
+//   rounded up. (1.1i becomes 2i.)
+func (q *Quantity) CanonicalizeBytes(out []byte) (result, suffix []byte) {
+	if q.IsZero() {
+		return zeroBytes, nil
+	}
+
+	var rounded CanonicalValue
+	format := q.Format
+	switch format {
+	case DecimalExponent, DecimalSI:
+	case BinarySI:
+		if q.CmpInt64(-1024) > 0 && q.CmpInt64(1024) < 0 {
+			// This avoids rounding and hopefully confusion, too.
+			format = DecimalSI
+		} else {
+			var exact bool
+			if rounded, exact = q.AsScale(0); !exact {
+				// Don't lose precision-- show as DecimalSI
+				format = DecimalSI
+			}
+		}
+	default:
+		format = DecimalExponent
+	}
+
+	// TODO: If BinarySI formatting is requested but would cause rounding, upgrade to
+	// one of the other formats.
+	switch format {
+	case DecimalExponent, DecimalSI:
+		number, exponent := q.AsCanonicalBytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(10, exponent, format)
+		return number, suffix
+	default:
+		// format must be BinarySI
+		number, exponent := rounded.AsCanonicalBase1024Bytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(2, exponent*10, format)
+		return number, suffix
+	}
+}
+
+// AsInt64 returns a representation of the current value as an int64 if a fast conversion
+// is possible. If false is returned, callers must use the inf.Dec form of this quantity.
+func (q *Quantity) AsInt64() (int64, bool) {
+	if q.d.Dec != nil {
+		return 0, false
+	}
+	return q.i.AsInt64()
+}
+
+// ToDec promotes the quantity in place to use an inf.Dec representation and returns itself.
+func (q *Quantity) ToDec() *Quantity {
+	if q.d.Dec == nil {
+		q.d.Dec = q.i.AsDec()
+		q.i = int64Amount{}
+	}
+	return q
+}
+
+// AsDec returns the quantity as represented by a scaled inf.Dec.
+func (q *Quantity) AsDec() *inf.Dec {
+	if q.d.Dec != nil {
+		return q.d.Dec
+	}
+	q.d.Dec = q.i.AsDec()
+	q.i = int64Amount{}
+	return q.d.Dec
+}
+
+// AsCanonicalBytes returns the canonical byte representation of this quantity as a mantissa
+// and base 10 exponent. The out byte slice may be passed to the method to avoid an extra
+// allocation.
+func (q *Quantity) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	if q.d.Dec != nil {
+		return q.d.AsCanonicalBytes(out)
+	}
+	return q.i.AsCanonicalBytes(out)
+}
+
+// IsZero returns true if the quantity is equal to zero.
+func (q *Quantity) IsZero() bool {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign() == 0
+	}
+	return q.i.value == 0
+}
+
+// Sign returns 0 if the quantity is zero, -1 if the quantity is less than zero, or 1 if the
+// quantity is greater than zero.
+func (q *Quantity) Sign() int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign()
+	}
+	return q.i.Sign()
+}
+
+// AsScale returns the current value, rounded up to the provided scale, and returns
+// false if the scale resulted in a loss of precision.
+func (q *Quantity) AsScale(scale Scale) (CanonicalValue, bool) {
+	if q.d.Dec != nil {
+		return q.d.AsScale(scale)
+	}
+	return q.i.AsScale(scale)
+}
+
+// RoundUp updates the quantity to the provided scale, ensuring that the value is at
+// least 1. False is returned if the rounding operation resulted in a loss of precision.
+// Negative numbers are rounded away from zero (-9 scale 1 rounds to -10).
+func (q *Quantity) RoundUp(scale Scale) bool {
+	if q.d.Dec != nil {
+		q.s = ""
+		d, exact := q.d.AsScale(scale)
+		q.d = d
+		return exact
+	}
+	// avoid clearing the string value if we have already calculated it
+	if q.i.scale >= scale {
+		return true
+	}
+	q.s = ""
+	i, exact := q.i.AsScale(scale)
+	q.i = i
+	return exact
+}
+
+// Add adds the provide y quantity to the current value. If the current value is zero,
+// the format of the quantity will be updated to the format of y.
+func (q *Quantity) Add(y Quantity) {
+	q.s = ""
+	if q.d.Dec == nil && y.d.Dec == nil {
+		if q.i.value == 0 {
+			q.Format = y.Format
+		}
+		if q.i.Add(y.i) {
+			return
+		}
+	} else if q.IsZero() {
+		q.Format = y.Format
+	}
+	q.ToDec().d.Dec.Add(q.d.Dec, y.AsDec())
+}
+
+// Sub subtracts the provided quantity from the current value in place. If the current
+// value is zero, the format of the quantity will be updated to the format of y.
+func (q *Quantity) Sub(y Quantity) {
+	q.s = ""
+	if q.IsZero() {
+		q.Format = y.Format
+	}
+	if q.d.Dec == nil && y.d.Dec == nil && q.i.Sub(y.i) {
+		return
+	}
+	q.ToDec().d.Dec.Sub(q.d.Dec, y.AsDec())
+}
+
+// Cmp returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) Cmp(y Quantity) int {
+	if q.d.Dec == nil && y.d.Dec == nil {
+		return q.i.Cmp(y.i)
+	}
+	return q.AsDec().Cmp(y.AsDec())
+}
+
+// CmpInt64 returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) CmpInt64(y int64) int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Cmp(inf.NewDec(y, inf.Scale(0)))
+	}
+	return q.i.Cmp(int64Amount{value: y})
+}
+
+// Neg sets quantity to be the negative value of itself.
+func (q *Quantity) Neg() {
+	q.s = ""
+	if q.d.Dec == nil {
+		q.i.value = -q.i.value
+		return
+	}
+	q.d.Dec.Neg(q.d.Dec)
+}
+
+// Equal checks equality of two Quantities. This is useful for testing with
+// cmp.Equal.
+func (q Quantity) Equal(v Quantity) bool {
+	return q.Cmp(v) == 0
+}
+
+// int64QuantityExpectedBytes is the expected width in bytes of the canonical string representation
+// of most Quantity values.
+const int64QuantityExpectedBytes = 18
+
+// String formats the Quantity as a string, caching the result if not calculated.
+// String is an expensive operation and caching this result significantly reduces the cost of
+// normal parse / marshal operations on Quantity.
+func (q *Quantity) String() string {
+	if len(q.s) == 0 {
+		result := make([]byte, 0, int64QuantityExpectedBytes)
+		number, suffix := q.CanonicalizeBytes(result)
+		number = append(number, suffix...)
+		q.s = string(number)
+	}
+	return q.s
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (q Quantity) MarshalJSON() ([]byte, error) {
+	if len(q.s) > 0 {
+		out := make([]byte, len(q.s)+2)
+		out[0], out[len(out)-1] = '"', '"'
+		copy(out[1:], q.s)
+		return out, nil
+	}
+	result := make([]byte, int64QuantityExpectedBytes, int64QuantityExpectedBytes)
+	result[0] = '"'
+	number, suffix := q.CanonicalizeBytes(result[1:1])
+	// if the same slice was returned to us that we passed in, avoid another allocation by copying number into
+	// the source slice and returning that
+	if len(number) > 0 && &number[0] == &result[1] && (len(number)+len(suffix)+2) <= int64QuantityExpectedBytes {
+		number = append(number, suffix...)
+		number = append(number, '"')
+		return result[:1+len(number)], nil
+	}
+	// if CanonicalizeBytes needed more space than our slice provided, we may need to allocate again so use
+	// append
+	result = result[:1]
+	result = append(result, number...)
+	result = append(result, suffix...)
+	result = append(result, '"')
+	return result, nil
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (q Quantity) ToUnstructured() interface{} {
+	return q.String()
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+// TODO: Remove support for leading/trailing whitespace
+func (q *Quantity) UnmarshalJSON(value []byte) error {
+	l := len(value)
+	if l == 4 && bytes.Equal(value, []byte("null")) {
+		q.d.Dec = nil
+		q.i = int64Amount{}
+		return nil
+	}
+	if l >= 2 && value[0] == '"' && value[l-1] == '"' {
+		value = value[1 : l-1]
+	}
+
+	parsed, err := ParseQuantity(strings.TrimSpace(string(value)))
+	if err != nil {
+		return err
+	}
+
+	// This copy is safe because parsed will not be referred to again.
+	*q = parsed
+	return nil
+}
+
+// NewQuantity returns a new Quantity representing the given
+// value in the given format.
+func NewQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value},
+		Format: format,
+	}
+}
+
+// NewMilliQuantity returns a new Quantity representing the given
+// value * 1/1000 in the given format. Note that BinarySI formatting
+// will round fractional values, and will be changed to DecimalSI for
+// values x where (-1 < x < 1) && (x != 0).
+func NewMilliQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: -3},
+		Format: format,
+	}
+}
+
+// NewScaledQuantity returns a new Quantity representing the given
+// value * 10^scale in DecimalSI format.
+func NewScaledQuantity(value int64, scale Scale) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: scale},
+		Format: DecimalSI,
+	}
+}
+
+// Value returns the unscaled value of q rounded up to the nearest integer away from 0.
+func (q *Quantity) Value() int64 {
+	return q.ScaledValue(0)
+}
+
+// MilliValue returns the value of ceil(q * 1000); this could overflow an int64;
+// if that's a concern, call Value() first to verify the number is small enough.
+func (q *Quantity) MilliValue() int64 {
+	return q.ScaledValue(Milli)
+}
+
+// ScaledValue returns the value of ceil(q / 10^scale).
+// For example, NewQuantity(1, DecimalSI).ScaledValue(Milli) returns 1000.
+// This could overflow an int64.
+// To detect overflow, call Value() first and verify the expected magnitude.
+func (q *Quantity) ScaledValue(scale Scale) int64 {
+	if q.d.Dec == nil {
+		i, _ := q.i.AsScaledInt64(scale)
+		return i
+	}
+	dec := q.d.Dec
+	return scaledValue(dec.UnscaledBig(), int(dec.Scale()), int(scale.infScale()))
+}
+
+// Set sets q's value to be value.
+func (q *Quantity) Set(value int64) {
+	q.SetScaled(value, 0)
+}
+
+// SetMilli sets q's value to be value * 1/1000.
+func (q *Quantity) SetMilli(value int64) {
+	q.SetScaled(value, Milli)
+}
+
+// SetScaled sets q's value to be value * 10^scale
+func (q *Quantity) SetScaled(value int64, scale Scale) {
+	q.s = ""
+	q.d.Dec = nil
+	q.i = int64Amount{value: value, scale: scale}
+}

cmd/config/internal/commands/internal/k8sgen/pkg/api/resource/scale_int.go

@@ -0,0 +1,98 @@
+// Code generated by k8scopy from k8s.io/apimachinery@v0.18.10; DO NOT EDIT.
+// Copied from k8s.io/apimachinery@v0.18.10/pkg/api/resource/scale_int.go
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math"
+	"math/big"
+	"sync"
+)
+
+var (
+	// A sync pool to reduce allocation.
+	intPool  sync.Pool
+	maxInt64 = big.NewInt(math.MaxInt64)
+)
+
+func init() {
+	intPool.New = func() interface{} {
+		return &big.Int{}
+	}
+}
+
+// scaledValue scales given unscaled value from scale to new Scale and returns
+// an int64. It ALWAYS rounds up the result when scale down. The final result might
+// overflow.
+//
+// scale, newScale represents the scale of the unscaled decimal.
+// The mathematical value of the decimal is unscaled * 10**(-scale).
+func scaledValue(unscaled *big.Int, scale, newScale int) int64 {
+	dif := scale - newScale
+	if dif == 0 {
+		return unscaled.Int64()
+	}
+
+	// Handle scale up
+	// This is an easy case, we do not need to care about rounding and overflow.
+	// If any intermediate operation causes overflow, the result will overflow.
+	if dif < 0 {
+		return unscaled.Int64() * int64(math.Pow10(-dif))
+	}
+
+	// Handle scale down
+	// We have to be careful about the intermediate operations.
+
+	// fast path when unscaled < max.Int64 and exp(10,dif) < max.Int64
+	const log10MaxInt64 = 19
+	if unscaled.Cmp(maxInt64) < 0 && dif < log10MaxInt64 {
+		divide := int64(math.Pow10(dif))
+		result := unscaled.Int64() / divide
+		mod := unscaled.Int64() % divide
+		if mod != 0 {
+			return result + 1
+		}
+		return result
+	}
+
+	// We should only convert back to int64 when getting the result.
+	divisor := intPool.Get().(*big.Int)
+	exp := intPool.Get().(*big.Int)
+	result := intPool.Get().(*big.Int)
+	defer func() {
+		intPool.Put(divisor)
+		intPool.Put(exp)
+		intPool.Put(result)
+	}()
+
+	// divisor = 10^(dif)
+	// TODO: create loop up table if exp costs too much.
+	divisor.Exp(bigTen, exp.SetInt64(int64(dif)), nil)
+	// reuse exp
+	remainder := exp
+
+	// result = unscaled / divisor
+	// remainder = unscaled % divisor
+	result.DivMod(unscaled, divisor, remainder)
+	if remainder.Sign() != 0 {
+		return result.Int64() + 1
+	}
+
+	return result.Int64()
+}

cmd/config/internal/commands/internal/k8sgen/pkg/api/resource/suffix.go

@@ -0,0 +1,201 @@
+// Code generated by k8scopy from k8s.io/apimachinery@v0.18.10; DO NOT EDIT.
+// Copied from k8s.io/apimachinery@v0.18.10/pkg/api/resource/suffix.go
+
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"strconv"
+)
+
+type suffix string
+
+// suffixer can interpret and construct suffixes.
+type suffixer interface {
+	interpret(suffix) (base, exponent int32, fmt Format, ok bool)
+	construct(base, exponent int32, fmt Format) (s suffix, ok bool)
+	constructBytes(base, exponent int32, fmt Format) (s []byte, ok bool)
+}
+
+// quantitySuffixer handles suffixes for all three formats that quantity
+// can handle.
+var quantitySuffixer = newSuffixer()
+
+type bePair struct {
+	base, exponent int32
+}
+
+type listSuffixer struct {
+	suffixToBE      map[suffix]bePair
+	beToSuffix      map[bePair]suffix
+	beToSuffixBytes map[bePair][]byte
+}
+
+func (ls *listSuffixer) addSuffix(s suffix, pair bePair) {
+	if ls.suffixToBE == nil {
+		ls.suffixToBE = map[suffix]bePair{}
+	}
+	if ls.beToSuffix == nil {
+		ls.beToSuffix = map[bePair]suffix{}
+	}
+	if ls.beToSuffixBytes == nil {
+		ls.beToSuffixBytes = map[bePair][]byte{}
+	}
+	ls.suffixToBE[s] = pair
+	ls.beToSuffix[pair] = s
+	ls.beToSuffixBytes[pair] = []byte(s)
+}
+
+func (ls *listSuffixer) lookup(s suffix) (base, exponent int32, ok bool) {
+	pair, ok := ls.suffixToBE[s]
+	if !ok {
+		return 0, 0, false
+	}
+	return pair.base, pair.exponent, true
+}
+
+func (ls *listSuffixer) construct(base, exponent int32) (s suffix, ok bool) {
+	s, ok = ls.beToSuffix[bePair{base, exponent}]
+	return
+}
+
+func (ls *listSuffixer) constructBytes(base, exponent int32) (s []byte, ok bool) {
+	s, ok = ls.beToSuffixBytes[bePair{base, exponent}]
+	return
+}
+
+type suffixHandler struct {
+	decSuffixes listSuffixer
+	binSuffixes listSuffixer
+}
+
+type fastLookup struct {
+	*suffixHandler
+}
+
+func (l fastLookup) interpret(s suffix) (base, exponent int32, format Format, ok bool) {
+	switch s {
+	case "":
+		return 10, 0, DecimalSI, true
+	case "n":
+		return 10, -9, DecimalSI, true
+	case "u":
+		return 10, -6, DecimalSI, true
+	case "m":
+		return 10, -3, DecimalSI, true
+	case "k":
+		return 10, 3, DecimalSI, true
+	case "M":
+		return 10, 6, DecimalSI, true
+	case "G":
+		return 10, 9, DecimalSI, true
+	}
+	return l.suffixHandler.interpret(s)
+}
+
+func newSuffixer() suffixer {
+	sh := &suffixHandler{}
+
+	// IMPORTANT: if you change this section you must change fastLookup
+
+	sh.binSuffixes.addSuffix("Ki", bePair{2, 10})
+	sh.binSuffixes.addSuffix("Mi", bePair{2, 20})
+	sh.binSuffixes.addSuffix("Gi", bePair{2, 30})
+	sh.binSuffixes.addSuffix("Ti", bePair{2, 40})
+	sh.binSuffixes.addSuffix("Pi", bePair{2, 50})
+	sh.binSuffixes.addSuffix("Ei", bePair{2, 60})
+	// Don't emit an error when trying to produce
+	// a suffix for 2^0.
+	sh.decSuffixes.addSuffix("", bePair{2, 0})
+
+	sh.decSuffixes.addSuffix("n", bePair{10, -9})
+	sh.decSuffixes.addSuffix("u", bePair{10, -6})
+	sh.decSuffixes.addSuffix("m", bePair{10, -3})
+	sh.decSuffixes.addSuffix("", bePair{10, 0})
+	sh.decSuffixes.addSuffix("k", bePair{10, 3})
+	sh.decSuffixes.addSuffix("M", bePair{10, 6})
+	sh.decSuffixes.addSuffix("G", bePair{10, 9})
+	sh.decSuffixes.addSuffix("T", bePair{10, 12})
+	sh.decSuffixes.addSuffix("P", bePair{10, 15})
+	sh.decSuffixes.addSuffix("E", bePair{10, 18})
+
+	return fastLookup{sh}
+}
+
+func (sh *suffixHandler) construct(base, exponent int32, fmt Format) (s suffix, ok bool) {
+	switch fmt {
+	case DecimalSI:
+		return sh.decSuffixes.construct(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.construct(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return "", false
+		}
+		if exponent == 0 {
+			return "", true
+		}
+		return suffix("e" + strconv.FormatInt(int64(exponent), 10)), true
+	}
+	return "", false
+}
+
+func (sh *suffixHandler) constructBytes(base, exponent int32, format Format) (s []byte, ok bool) {
+	switch format {
+	case DecimalSI:
+		return sh.decSuffixes.constructBytes(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.constructBytes(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return nil, false
+		}
+		if exponent == 0 {
+			return nil, true
+		}
+		result := make([]byte, 8, 8)
+		result[0] = 'e'
+		number := strconv.AppendInt(result[1:1], int64(exponent), 10)
+		if &result[1] == &number[0] {
+			return result[:1+len(number)], true
+		}
+		result = append(result[:1], number...)
+		return result, true
+	}
+	return nil, false
+}
+
+func (sh *suffixHandler) interpret(suffix suffix) (base, exponent int32, fmt Format, ok bool) {
+	// Try lookup tables first
+	if b, e, ok := sh.decSuffixes.lookup(suffix); ok {
+		return b, e, DecimalSI, true
+	}
+	if b, e, ok := sh.binSuffixes.lookup(suffix); ok {
+		return b, e, BinarySI, true
+	}
+
+	if len(suffix) > 1 && (suffix[0] == 'E' || suffix[0] == 'e') {
+		parsed, err := strconv.ParseInt(string(suffix[1:]), 10, 64)
+		if err != nil {
+			return 0, 0, DecimalExponent, false
+		}
+		return 10, int32(parsed), DecimalExponent, true
+	}
+
+	return 0, 0, DecimalExponent, false
+}

cmd/k8scopy/go.mod

@@ -0,0 +1,8 @@
+module sigs.k8s.io/kustomize/cmd/k8scopy
+
+go 1.15
+
+require (
+	github.com/stretchr/testify v1.4.0
+	sigs.k8s.io/yaml v1.2.0
+)

cmd/k8scopy/go.sum

@@ -0,0 +1,15 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

cmd/k8scopy/internal/copier.go

@@ -0,0 +1,114 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package internal
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const (
+	sigsK8sIo = "sigs.k8s.io"
+)
+
+type Copier struct {
+	spec       *ModuleSpec
+	goModCache string
+	topPackage string
+	pwdPackage string
+	srcDir     string
+	pgmName    string
+}
+
+func (c Copier) replacementPath() string {
+	return filepath.Join(c.topPackage, c.subPath())
+}
+
+func (c Copier) subPath() string {
+	return filepath.Join("internal", c.pwdPackage)
+}
+
+func (c Copier) Print() {
+	fmt.Printf("   apiMachineryModule: %s\n", c.spec.Module)
+	fmt.Printf("      replacementPath: %s\n", c.replacementPath())
+	fmt.Printf("           goModCache: %s\n", c.goModCache)
+	fmt.Printf("           topPackage: %s\n", c.topPackage)
+	fmt.Printf("           pwdPackage: %s\n", c.pwdPackage)
+	fmt.Printf("              subPath: %s\n", c.subPath())
+	fmt.Printf("               srcDir: %s\n", c.srcDir)
+	fmt.Printf("  apiMachineryModSpec: %s\n", c.spec.Name())
+	fmt.Printf("              pgmName: %s\n", c.pgmName)
+	fmt.Printf("                  pwd: %s\n", os.Getenv("PWD"))
+}
+
+func NewCopier(s *ModuleSpec, prefix, pgmName string) Copier {
+	tmp := Copier{
+		spec:       s,
+		pgmName:    pgmName,
+		pwdPackage: os.Getenv("GOPACKAGE"),
+		goModCache: RunGetOutputCommand("go", "env", "GOMODCACHE"),
+	}
+	goMod := RunGetOutputCommand("go", "env", "GOMOD")
+	topPackage := filepath.Join(goMod[:len(goMod)-len("go.mod")-1], prefix)
+	k := strings.Index(topPackage, sigsK8sIo)
+	if k < 1 {
+		log.Fatalf("cannot find %s in %s", sigsK8sIo, topPackage)
+	}
+	tmp.srcDir = topPackage[:k-1]
+	tmp.topPackage = topPackage[k:]
+	return tmp
+}
+
+func (c Copier) CopyFile(dir, name string) error {
+	inFile, err := os.Open(
+		filepath.Join(c.goModCache, c.spec.Name(), dir, name))
+	if err != nil {
+		return err
+	}
+	defer inFile.Close()
+	scanner := bufio.NewScanner(inFile)
+
+	w, err := newWriter(dir, name)
+	if err != nil {
+		return err
+	}
+	defer w.close()
+
+	w.write(
+		fmt.Sprintf(
+			// This particular phrasing is required.
+			"// Code generated by %s from %s; DO NOT EDIT.",
+			c.pgmName, c.spec.Name()))
+	w.write(
+		fmt.Sprintf(
+			"// Copied from %s\n",
+			filepath.Join(c.spec.Name(), dir, name)))
+
+	for scanner.Scan() {
+		l := scanner.Text()
+		// Disallow recursive generation.
+		if strings.HasPrefix(l, "//go:generate") {
+			continue
+		}
+		// Don't want it to appear double generated.
+		if strings.HasPrefix(l, "// Code generated") {
+			continue
+		}
+		// Fix self-imports.
+		l = strings.Replace(l, c.spec.Module, c.replacementPath(), 1)
+		// Replace klog with generic log (eschewing k8s.io entirely).
+		l = strings.Replace(l, "\"k8s.io/klog\"", "\"log\"", 1)
+		l = strings.Replace(l, "klog.V(10).Infof(", "log.Printf(", 1)
+		w.write(l)
+	}
+	if err := scanner.Err(); err != nil {
+		return err
+	}
+	w.write("")
+	return nil
+}

cmd/k8scopy/internal/modulespec.go

@@ -0,0 +1,37 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package internal
+
+import (
+	"io/ioutil"
+
+	"sigs.k8s.io/yaml"
+)
+
+type ModuleSpec struct {
+	Module   string        `json:"module,omitempty" yaml:"module,omitempty"`
+	Version  string        `json:"version,omitempty" yaml:"version,omitempty"`
+	Packages []PackageSpec `json:"packages,omitempty" yaml:"packages,omitempty"`
+}
+
+func (s ModuleSpec) Name() string {
+	return s.Module + "@" + s.Version
+}
+
+type PackageSpec struct {
+	Name  string   `json:"name,omitempty" yaml:"name,omitempty"`
+	Files []string `json:"files,omitempty" yaml:"files,omitempty"`
+}
+
+func ReadSpec(fileName string) *ModuleSpec {
+	bytes, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		panic(err)
+	}
+	var spec ModuleSpec
+	if err = yaml.Unmarshal(bytes, &spec); err != nil {
+		panic(err)
+	}
+	return &spec
+}

cmd/k8scopy/internal/modulespec_test.go

@@ -0,0 +1,65 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package internal_test
+
+import (
+	"io/ioutil"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	. "sigs.k8s.io/kustomize/cmd/k8scopy/internal"
+)
+
+var data = []byte(`module: k8s.io/apimachinery
+version: v0.17.0
+packages:
+- name: pkg/labels
+  files:
+  - labels.go
+  - selector.go
+  - zz_generated.deepcopy.go
+- name: pkg/selection
+  files:
+  - operator.go
+- name: pkg/util/sets
+  files:
+  - empty.go
+  - string.go
+- name: pkg/util/errors
+  files:
+  - errors.go
+- name: pkg/util/validation
+  files:
+  - validation.go
+- name: pkg/util/validation/field
+  files:
+  - errors.go
+  - path.go
+`)
+
+func TestReadSpec(t *testing.T) {
+	fn := writeFile(t, data)
+	defer os.Remove(fn)
+	x := ReadSpec(fn)
+	assert.Equal(t, "k8s.io/apimachinery@v0.17.0", x.Name())
+	assert.Equal(t, 6, len(x.Packages))
+	assert.Equal(t, "pkg/util/validation/field", x.Packages[5].Name)
+	assert.Equal(t, "path.go", x.Packages[5].Files[1])
+}
+
+// Write content to temp file, returning file name.
+func writeFile(t *testing.T, content []byte) string {
+	f, err := ioutil.TempFile("", "testjunk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = f.Write(content); err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return f.Name()
+}

cmd/k8scopy/internal/utils.go

@@ -0,0 +1,32 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package internal
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"os/exec"
+	"strings"
+)
+
+func RunNoOutputCommand(n string, args ...string) {
+	o := RunGetOutputCommand(n, args...)
+	if len(o) > 0 {
+		log.Fatalf("unexpected output: %q", o)
+	}
+}
+
+func RunGetOutputCommand(n string, args ...string) string {
+	cmd := exec.Command(n, args...)
+	var outBuf bytes.Buffer
+	cmd.Stdout = &outBuf
+	var errBuf bytes.Buffer
+	cmd.Stderr = &errBuf
+	if err := cmd.Run(); err != nil {
+		fmt.Printf("err: %q\n", errBuf.String())
+		log.Fatal(err)
+	}
+	return strings.TrimSpace(outBuf.String())
+}

cmd/k8scopy/internal/writer.go

@@ -0,0 +1,40 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package internal
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+)
+
+type writer struct {
+	root string
+	f    *os.File
+}
+
+func newWriter(toDir, name string) (*writer, error) {
+	if err := os.MkdirAll(toDir, 0755); err != nil {
+		log.Printf("unable to create directory: %s", toDir)
+		return nil, err
+	}
+	n := filepath.Join(toDir, name)
+	f, err := os.Create(n)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create `%s`; %v", n, err)
+	}
+	return &writer{root: toDir, f: f}, nil
+}
+
+func (w *writer) close() {
+	w.f.Close()
+}
+
+func (w *writer) write(line string) {
+	if _, err := w.f.WriteString(line + "\n"); err != nil {
+		log.Printf("Trouble writing: %s", line)
+		log.Fatalf("Error: %s", err)
+	}
+}

cmd/k8scopy/main.go

@@ -0,0 +1,56 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// k8scopy is a code reuse mechanism for k8s.io code.
+//
+// kustomize, kyaml, cmd/config are kustomize repo modules that want to reuse
+// some small bits of k8s.io code. These modules cannot depend k8s.io via
+// normal Go import or vendoring because kubectl will depend on these things
+// eventually (see kubernetes-sigs/kustomize/issues/1500), and kubectl's code
+// reuse is tricky. While kubectl remains in the k/k repo, it depends on local
+// relative symlinked paths to a 'staging' version of k8s.io code.  No code
+// imported by kubectl can refer to any other version of k8s.io code, not by
+// Go importing, not by Go vendoring.
+//
+// This main exists to allow "go generate" to copy select k8s.io packages into
+// the kustomize repo at well defined tags in reproducible fashion.  It's
+// a form of vendoring reuse that avoids the problems created by k8s staging.
+// The copied code is labelled as generated and is not otherwise edited.
+//
+// When/if kubectl is finally extracted from k/k to its own repo, it can
+// depend on k8s.io code via normal imports, and then so can kustomize,
+// so this technique can be dropped.
+//
+// Until then, if a bug is found in a particular instance of copied k8s.io
+// (highly unlikely, since only old stable versions are copied), just update
+// the version being copied, re-generate, and if need be adjust call points.
+package main
+
+import (
+	"log"
+	"os"
+
+	"sigs.k8s.io/kustomize/cmd/k8scopy/internal"
+)
+
+const pgmName = "k8scopy"
+
+func main() {
+	if len(os.Args) < 3 {
+		log.Fatal("Need name of yaml file containing module specs and prefix.")
+	}
+	spec := internal.ReadSpec(os.Args[1])
+	c := internal.NewCopier(spec, os.Args[2], pgmName)
+	internal.RunNoOutputCommand("go", "get", spec.Name())
+	for _, p := range spec.Packages {
+		for _, n := range p.Files {
+			if err := c.CopyFile(p.Name, n); err != nil {
+				log.Fatal(err)
+			}
+		}
+	}
+	internal.RunNoOutputCommand(
+		"go", "mod", "edit", "-droprequire="+spec.Module)
+	internal.RunNoOutputCommand("go", "mod", "tidy")
+	internal.RunGetOutputCommand("go", "fmt", "./...")
+}

cmd/pluginator/go.mod

@@ -6,11 +6,9 @@ require (
 	github.com/rakyll/statik v0.1.7
 	github.com/spf13/cobra v1.0.0
 	github.com/stretchr/testify v1.4.0
-	sigs.k8s.io/kustomize/api v0.7.2
-	sigs.k8s.io/kustomize/kyaml v0.10.6
+	sigs.k8s.io/kustomize/api v0.7.3
+	sigs.k8s.io/kustomize/kyaml v0.10.9
 	sigs.k8s.io/yaml v1.2.0
 )
 
 replace sigs.k8s.io/kustomize/api => ../../api
-
-replace sigs.k8s.io/kustomize/kyaml => ../../kyaml

cmd/pluginator/go.sum

@@ -534,6 +534,8 @@ k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
+sigs.k8s.io/kustomize/kyaml v0.10.9 h1:n3WNdvPPReRNDxW+XXd2JlyZ8EII721I21D1DBpBVBE=
+sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

examples/springboot/README.md

@@ -103,7 +103,6 @@ the application will pick up an extra `application-<profile>.properties` file. W
 steps. Add an environment variable through the patch and add a file to the configMap.
 
 <!-- @customizeConfigMap @testAgainstLatestRelease -->
-
 ```
 cat <<EOF >$DEMO_HOME/patch.yaml
 apiVersion: apps/v1
@@ -283,7 +282,6 @@ The output contains
 Add these patches to the kustomization:
 
 <!-- @addPatch @testAgainstLatestRelease -->
-
 ```
 cd $DEMO_HOME
 kustomize edit add patch --path memorylimit_patch.yaml --name sbdemo --kind Deployment --group apps --version v1
@@ -320,5 +318,5 @@ create the production environment.
 
 <!-- @finalBuild @testAgainstLatestRelease -->
 ```
-kustomize build $DEMO_HOME  # | kubectl apply -f -
+kustomize build $DEMO_HOME # | kubectl apply -f -
 ```

hack/imports.sh

@@ -1,5 +1,6 @@
 for f in $(find $1 -name '*.go'); do
   echo $f
-  # go run go.coder.com/go-tools/cmd/goimports
-  ~/gopath/bin/goimports -w $f
+  # go get golang.org/x/tools/cmd/goimports
+  # {or} go run go.coder.com/go-tools/cmd/goimports
+  goimports -w $f
 done

hack/install_kustomize.sh

@@ -8,19 +8,28 @@
 # kustomize binary to your current working directory.
 # (e.g. 'install_kustomize.sh 3.8.2')
 #
+# If two arguments are given -> Downloads the specified version of the
+# kustomize binary to the specified directory.
+# (e.g. 'install_kustomize.sh 3.8.2 $(go env GOPATH)/bin')
+# 
 # Fails if the file already exists.
 
 curl_timeout=600
-release_url=https://api.github.com/repos/kubernetes-sigs/kustomize/releases
 
+version=""
+release_url=https://api.github.com/repos/kubernetes-sigs/kustomize/releases
 if [ -n "$1" ]; then
-    version=v$1
-    release_url=${release_url}/tags/kustomize%2F$version
+  version=v$1
+  release_url=${release_url}/tags/kustomize%2F$version
 fi
 
 where=$PWD
+if [ -n "$2" ]; then
+  where=$2
+fi
+
 if [ -f $where/kustomize ]; then
-  echo "A file named kustomize already exists (remove it first)."
+  echo "A file named $where/kustomize already exists (remove it first)."
   exit 1
 fi
 
@@ -63,6 +72,6 @@ cp ./kustomize $where
 
 popd >& /dev/null
 
-./kustomize version
+$where/kustomize version
 
-echo kustomize installed to current directory.
+echo kustomize installed to $where

kustomize/commands/build/build.go

@@ -54,10 +54,10 @@ https://github.com/hashicorp/go-getter#url-format
 `
 
 // NewCmdBuild creates a new build command.
-func NewCmdBuild(out io.Writer) *cobra.Command {
+func NewCmdBuild(cmdName string, out io.Writer) *cobra.Command {
 	var o Options
 	cmd := &cobra.Command{
-		Use: "build {path}",
+		Use: cmdName + " {path}",
 		Short: "Print configuration per contents of " +
 			konfig.DefaultKustomizationFileName(),
 		Example:      examples,

kustomize/commands/build/flagaddmanagedby.go

@@ -7,7 +7,6 @@ import (
 	"os"
 
 	"github.com/spf13/pflag"
-
 	"sigs.k8s.io/kustomize/api/konfig"
 )
 

kustomize/commands/commands.go

@@ -14,11 +14,11 @@ import (
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/cmd/config/completion"
 	"sigs.k8s.io/kustomize/cmd/config/configcobra"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/build"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/create"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/edit"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/openapi"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/version"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/build"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/create"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/edit"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/openapi"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/version"
 )
 
 // NewDefaultCommand returns the default (aka root) command for kustomize command.
@@ -37,7 +37,7 @@ See https://sigs.k8s.io/kustomize
 	pvd := provider.NewDefaultDepProvider()
 	c.AddCommand(
 		completion.NewCommand(),
-		build.NewCmdBuild(stdOut),
+		build.NewCmdBuild("build", stdOut),
 		edit.NewCmdEdit(
 			fSys, pvd.GetFieldValidator(), pvd.GetKunstructuredFactory()),
 		create.NewCmdCreate(fSys, pvd.GetKunstructuredFactory()),

kustomize/commands/create/create.go

@@ -14,8 +14,8 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/loader"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/kustfile"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/util"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/kustfile"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/util"
 )
 
 type createFlags struct {

kustomize/commands/create/create_test.go

@@ -10,7 +10,7 @@ import (
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/types"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/kustfile"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/kustfile"
 )
 
 var factory = provider.NewDefaultDepProvider().GetKunstructuredFactory()

kustomize/commands/edit/add/addbase.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/kustfile"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/kustfile"
 )
 
 type addBaseOptions struct {

kustomize/commands/edit/add/addbase_test.go

@@ -8,8 +8,8 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/kustfile"
-	testutils_test "sigs.k8s.io/kustomize/kustomize/v3/internal/commands/testutils"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/kustfile"
+	testutils_test "sigs.k8s.io/kustomize/kustomize/v3/commands/internal/testutils"
 )
 
 const (

kustomize/commands/edit/add/addcomponent.go

@@ -10,8 +10,8 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/kustomize/api/filesys"
 	"sigs.k8s.io/kustomize/api/loader"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/kustfile"
-	"sigs.k8s.io/kustomize/kustomize/v3/internal/commands/util"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/kustfile"
+	"sigs.k8s.io/kustomize/kustomize/v3/commands/internal/util"
 )
 
 type addComponentOptions struct {

kustomize/commands/edit/add/addcomponent_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/filesys"
-	testutils_test "sigs.k8s.io/kustomize/kustomize/v3/internal/commands/testutils"
+	testutils_test "sigs.k8s.io/kustomize/kustomize/v3/commands/internal/testutils"
 )
 
 const (