Merge pull request #1674 from monopole/dealWithDeprecationsInGoReleaser

Deal with goreleaser field deprecations.
2026-06-17 20:08:17 +00:00 · 2019-10-22 12:12:34 -07:00 · 2019-10-22 12:11:13 -07:00 · 2019-10-22 11:52:55 -07:00 · 2019-10-22 11:51:26 -07:00 · 2019-10-22 10:16:51 -07:00
8373 changed files with 76204 additions and 3897251 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,9 @@

 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
+
+# We use sed -i.bak when doing in-line replace, because it works better cross-platform
+.bak
+
+# macOS
+*.DS_store
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -0,0 +1,30 @@
+run:
+  deadline: 5m
+
+linters:
+  disable-all: true
+  enable:
+    - dupl
+    - goconst
+    - gocyclo
+    - gofmt
+    - golint
+    - govet
+    - ineffassign
+    - interfacer
+    - lll
+    - misspell
+    - nakedret
+    - structcheck
+    - unparam
+    - varcheck
+
+linters-settings:
+  dupl:
+    threshold: 400 
+  lll:   
+    line-length: 170
+  gocyclo:
+    min-complexity: 15
+  golint:
+    min-confidence: 0.85
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,28 +1,41 @@
+os:
+  - linux
+# TODO: Uncomment this when someone figures out how
+# to speed up the slowness of homebrew installation on
+# oxs; presumably cache images?
+#  - osx
+#
+# TODO: Uncomment when some gets the tests running on Windows.
+#  - windows
+
+addons:
+  apt:
+    packages:
+    - tree
+  homebrew:
+    packages:
+    - tree
+    update: true
+
+# Only clone the most recent commit.
+git:
+  depth: 1
+
 language: go

 go:
-  - 1.10.x
+  - "1.13"

 go_import_path: sigs.k8s.io/kustomize

 before_install:
-  - source ./bin/consider-early-travis-exit.sh
-  - sudo apt-get install tree
-  - go get -u github.com/golang/lint/golint
-  - go get -u golang.org/x/tools/cmd/goimports
-  - go get -u github.com/onsi/ginkgo/ginkgo
-  - go get -u github.com/monopole/mdrip
-  - go get -u github.com/fzipp/gocyclo
-  - go get -u gopkg.in/alecthomas/gometalinter.v2 && gometalinter.v2 --install
+  - source ./travis/consider-early-travis-exit.sh

-# Install must be set to prevent default `go get` to run.
-# The dependencies have already been vendored by `dep` so
-# we don't need to fetch them.
-install:
-  -
+# Skip the install process; let pre-commit.sh do it.
+install: true

 script:
-  - ./bin/pre-commit.sh
+  - ./travis/pre-commit.sh

 # TBD. Suppressing for now.
 notifications:
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,22 @@
+# Contributing Guidelines
+
+Welcome to Kubernetes. We are excited about the prospect of you joining our [community](https://github.com/kubernetes/community)! The Kubernetes community abides by the CNCF [code of conduct](code-of-conduct.md). Here is an excerpt:
+
+_As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities._
+
+## Getting Started
+
+We have full documentation on how to get started contributing here:
+
+- [Contributor License Agreement](https://git.k8s.io/community/CLA.md) Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests
+- [Kubernetes Contributor Guide](http://git.k8s.io/community/contributors/guide) - Main contributor documentation, or you can just jump directly to the [contributing section](http://git.k8s.io/community/contributors/guide#contributing)
+- [Contributor Cheat Sheet](https://git.k8s.io/community/contributors/guide/contributor-cheatsheet.md) - Common resources for existing developers
+
+## Mentorship
+
+- [Mentoring Initiatives](https://git.k8s.io/community/mentoring) - We have a diverse set of mentorship programs available that are always looking for volunteers!
+
+## Contact Information
+
+- [Slack channel](https://kubernetes.slack.com/messages/sig-cli)
+- [Mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-cli)
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -1,527 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  digest = "1:8e47871087b94913898333f37af26732faaab30cdb41571136cf7aec9921dae7"
-  name = "github.com/PuerkitoBio/purell"
-  packages = ["."]
-  pruneopts = ""
-  revision = "0bcb03f4b4d0a9428594752bd2a3b9aa0a9d4bd4"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:331a419049c2be691e5ba1d24342fc77c7e767a80c666a18fd8a9f7b82419c1c"
-  name = "github.com/PuerkitoBio/urlesc"
-  packages = ["."]
-  pruneopts = ""
-  revision = "de5bf2ad457846296e2031421a34e2568e304e35"
-
-[[projects]]
-  digest = "1:9299ad32dcec0f92ad06773f73426bd46a21efa96f6a8138c287bb185933e77e"
-  name = "github.com/aws/aws-sdk-go"
-  packages = [
-    "aws",
-    "aws/awserr",
-    "aws/awsutil",
-    "aws/client",
-    "aws/client/metadata",
-    "aws/corehandlers",
-    "aws/credentials",
-    "aws/credentials/ec2rolecreds",
-    "aws/credentials/endpointcreds",
-    "aws/credentials/stscreds",
-    "aws/csm",
-    "aws/defaults",
-    "aws/ec2metadata",
-    "aws/endpoints",
-    "aws/request",
-    "aws/session",
-    "aws/signer/v4",
-    "internal/sdkio",
-    "internal/sdkrand",
-    "internal/sdkuri",
-    "internal/shareddefaults",
-    "private/protocol",
-    "private/protocol/eventstream",
-    "private/protocol/eventstream/eventstreamapi",
-    "private/protocol/query",
-    "private/protocol/query/queryutil",
-    "private/protocol/rest",
-    "private/protocol/restxml",
-    "private/protocol/xml/xmlutil",
-    "service/s3",
-    "service/sts",
-  ]
-  pruneopts = ""
-  revision = "daed0c76021ea9c4e659e3ec80bcd2d657297100"
-  version = "v1.15.12"
-
-[[projects]]
-  branch = "master"
-  digest = "1:98e84060475ed245c3b355042afd43a74aa7d32efe50658f4f995977916f9fc3"
-  name = "github.com/bgentry/go-netrc"
-  packages = ["netrc"]
-  pruneopts = ""
-  revision = "9fd32a8b3d3d3f9d43c341bfe098430e07609480"
-
-[[projects]]
-  digest = "1:56c130d885a4aacae1dd9c7b71cfe39912c7ebc1ff7d2b46083c8812996dc43b"
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  pruneopts = ""
-  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:971e9ba63a417c5f1f83ab358677bc59e96ff04285f26c6646ff089fb60b15e8"
-  name = "github.com/emicklei/go-restful"
-  packages = [
-    ".",
-    "log",
-  ]
-  pruneopts = ""
-  revision = "3658237ded108b4134956c1b3050349d93e7b895"
-  version = "v2.7.1"
-
-[[projects]]
-  digest = "1:dcefbadf4534c5ecac8573698fba6e6e601157bfa8f96aafe29df31ae582ef2a"
-  name = "github.com/evanphx/json-patch"
-  packages = ["."]
-  pruneopts = ""
-  revision = "afac545df32f2287a079e2dfb7ba2745a643747e"
-  version = "v3.0.0"
-
-[[projects]]
-  digest = "1:b13707423743d41665fd23f0c36b2f37bb49c30e94adb813319c44188a51ba22"
-  name = "github.com/ghodss/yaml"
-  packages = ["."]
-  pruneopts = ""
-  revision = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:858b7fe7b0f4bc7ef9953926828f2816ea52d01a88d72d1c45bc8c108f23c356"
-  name = "github.com/go-ini/ini"
-  packages = ["."]
-  pruneopts = ""
-  revision = "358ee7663966325963d4e8b2e1fbd570c5195153"
-  version = "v1.38.1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:e116a4866bffeec941056a1fcfd37e520fad1ee60e4e3579719f19a43c392e10"
-  name = "github.com/go-openapi/jsonpointer"
-  packages = ["."]
-  pruneopts = ""
-  revision = "3a0015ad55fa9873f41605d3e8f28cd279c32ab2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:3830527ef0f4f9b268d9286661c0f52f9115f8aefd9f45ee7352516f93489ac9"
-  name = "github.com/go-openapi/jsonreference"
-  packages = ["."]
-  pruneopts = ""
-  revision = "3fb327e6747da3043567ee86abd02bb6376b6be2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:238a056875c4b053b4b29984765ee335bf8c539fdf17e527fd9b7aa72521c8dd"
-  name = "github.com/go-openapi/spec"
-  packages = ["."]
-  pruneopts = ""
-  revision = "bcff419492eeeb01f76e77d2ebc714dc97b607f5"
-
-[[projects]]
-  branch = "master"
-  digest = "1:7b067ca8b94982960860d18c42e29f15bbd0e8d9ae8145a83a218296e75393cf"
-  name = "github.com/go-openapi/swag"
-  packages = ["."]
-  pruneopts = ""
-  revision = "811b1089cde9dad18d4d0c2d09fbdbf28dbd27a5"
-
-[[projects]]
-  digest = "1:0a3f6a0c68ab8f3d455f8892295503b179e571b7fefe47cc6c556405d1f83411"
-  name = "github.com/gogo/protobuf"
-  packages = [
-    "proto",
-    "sortkeys",
-  ]
-  pruneopts = ""
-  revision = "1adfc126b41513cc696b209667c8656ea7aac67c"
-  version = "v1.0.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:107b233e45174dbab5b1324201d092ea9448e58243ab9f039e4c0f332e121e3a"
-  name = "github.com/golang/glog"
-  packages = ["."]
-  pruneopts = ""
-  revision = "23def4e6c14b4da8ac2ed8007337bc5eb5007998"
-
-[[projects]]
-  digest = "1:f958a1c137db276e52f0b50efee41a1a389dcdded59a69711f3e872757dab34b"
-  name = "github.com/golang/protobuf"
-  packages = [
-    "proto",
-    "ptypes",
-    "ptypes/any",
-    "ptypes/duration",
-    "ptypes/timestamp",
-  ]
-  pruneopts = ""
-  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:754f77e9c839b24778a4b64422236d38515301d2baeb63113aa3edc42e6af692"
-  name = "github.com/google/gofuzz"
-  packages = ["."]
-  pruneopts = ""
-  revision = "24818f796faf91cd76ec7bddd72458fbced7a6c1"
-
-[[projects]]
-  digest = "1:2a131706ff80636629ab6373f2944569b8252ecc018cda8040931b05d32e3c16"
-  name = "github.com/googleapis/gnostic"
-  packages = [
-    "OpenAPIv2",
-    "compiler",
-    "extensions",
-  ]
-  pruneopts = ""
-  revision = "ee43cbb60db7bd22502942cccbc39059117352ab"
-  version = "v0.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:f5d25fd7bdda08e39e01193ef94a1ebf7547b1b931bcdec785d08050598f306c"
-  name = "github.com/hashicorp/go-cleanhttp"
-  packages = ["."]
-  pruneopts = ""
-  revision = "d5fe4b57a186c716b0e00b8c301cbd9b4182694d"
-
-[[projects]]
-  branch = "master"
-  digest = "1:fd15b3f6aac9d0fe68c6e38922282e0d2e88cd77b927ac3dd842e363645522c0"
-  name = "github.com/hashicorp/go-getter"
-  packages = [
-    ".",
-    "helper/url",
-  ]
-  pruneopts = ""
-  revision = "4bda8fa99001c61db3cad96b421d4c12a81f256d"
-
-[[projects]]
-  branch = "master"
-  digest = "1:2cf6c60c74eacadd31652674364af55c8d54a86b8ea193548f1c37f8c9af8f9c"
-  name = "github.com/hashicorp/go-safetemp"
-  packages = ["."]
-  pruneopts = ""
-  revision = "b1a1dbde6fdc11e3ae79efd9039009e22d4ae240"
-
-[[projects]]
-  branch = "master"
-  digest = "1:139bdc2c89779b8ff8b1150be28f889b0ed964e6da96f32cbc9035bd4642881c"
-  name = "github.com/hashicorp/go-version"
-  packages = ["."]
-  pruneopts = ""
-  revision = "270f2f71b1ee587f3b609f00f422b76a6b28f348"
-
-[[projects]]
-  digest = "1:870d441fe217b8e689d7949fef6e43efbc787e50f200cb1e70dbca9204a1d6be"
-  name = "github.com/inconshreveable/mousetrap"
-  packages = ["."]
-  pruneopts = ""
-  revision = "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75"
-  version = "v1.0"
-
-[[projects]]
-  digest = "1:6f49eae0c1e5dab1dafafee34b207aeb7a42303105960944828c2079b92fc88e"
-  name = "github.com/jmespath/go-jmespath"
-  packages = ["."]
-  pruneopts = ""
-  revision = "0b12d6b5"
-
-[[projects]]
-  digest = "1:9eab2325abbed0ebcee9d44bb3660a69d5d10e42d5ac4a0e77f7a6ea22bfce88"
-  name = "github.com/json-iterator/go"
-  packages = ["."]
-  pruneopts = ""
-  revision = "ca39e5af3ece67bbcda3d0f4f56a8e24d9f2dad4"
-  version = "1.1.3"
-
-[[projects]]
-  digest = "1:10e1dfc240bcd0fce14366215fd2b070e79d9b9460b27382db4423ad74204f2b"
-  name = "github.com/krishicks/yaml-patch"
-  packages = ["."]
-  pruneopts = ""
-  revision = "83cc9ac50becbbfafb86a89167f3bc5372e8e530"
-  version = "v0.0.10"
-
-[[projects]]
-  branch = "master"
-  digest = "1:d9e483f4b9e306facf126bd90b02d512bd22ea4471e1568867e32221a8abbb16"
-  name = "github.com/mailru/easyjson"
-  packages = [
-    "buffer",
-    "jlexer",
-    "jwriter",
-  ]
-  pruneopts = ""
-  revision = "3fdea8d05856a0c8df22ed4bc71b3219245e4485"
-
-[[projects]]
-  branch = "master"
-  digest = "1:83854f6b1d2ce047b69657e3a87ba7602f4c5505e8bdfd02ab857db8e983bde1"
-  name = "github.com/mitchellh/go-homedir"
-  packages = ["."]
-  pruneopts = ""
-  revision = "58046073cbffe2f25d425fe1331102f55cf719de"
-
-[[projects]]
-  branch = "master"
-  digest = "1:51c98e2c9a8d0a724a69f46421876af14e12132cb02f1d0e144785d752247162"
-  name = "github.com/mitchellh/go-testing-interface"
-  packages = ["."]
-  pruneopts = ""
-  revision = "a61a99592b77c9ba629d254a693acffaeb4b7e28"
-
-[[projects]]
-  digest = "1:0c0ff2a89c1bb0d01887e1dac043ad7efbf3ec77482ef058ac423d13497e16fd"
-  name = "github.com/modern-go/concurrent"
-  packages = ["."]
-  pruneopts = ""
-  revision = "bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94"
-  version = "1.0.3"
-
-[[projects]]
-  digest = "1:420f9231f816eeca3ff5aab070caac3ed7f27e4d37ded96ce9de3d7a7a2e31ad"
-  name = "github.com/modern-go/reflect2"
-  packages = ["."]
-  pruneopts = ""
-  revision = "1df9eeb2bb81f327b96228865c5687bc2194af3f"
-  version = "1.0.0"
-
-[[projects]]
-  digest = "1:7365acd48986e205ccb8652cc746f09c8b7876030d53710ea6ef7d0bd0dcd7ca"
-  name = "github.com/pkg/errors"
-  packages = ["."]
-  pruneopts = ""
-  revision = "645ef00459ed84a119197bfb8d8205042c6df63d"
-  version = "v0.8.0"
-
-[[projects]]
-  digest = "1:74c32990510c9f188556aa17600313e867d1d06f5a9db244056a95d144ec34ce"
-  name = "github.com/spf13/cobra"
-  packages = ["."]
-  pruneopts = ""
-  revision = "a1f051bc3eba734da4772d60e2d677f47cf93ef4"
-  version = "v0.0.2"
-
-[[projects]]
-  digest = "1:8e243c568f36b09031ec18dff5f7d2769dcf5ca4d624ea511c8e3197dc3d352d"
-  name = "github.com/spf13/pflag"
-  packages = ["."]
-  pruneopts = ""
-  revision = "583c0c0531f06d5278b7d917446061adc344b5cd"
-  version = "v1.0.1"
-
-[[projects]]
-  digest = "1:ee723e6a1962a196eeba1b24f82af61a4f60f8821d7aa96d48e787f8337bcffc"
-  name = "github.com/ulikunitz/xz"
-  packages = [
-    ".",
-    "internal/hash",
-    "internal/xlog",
-    "lzma",
-  ]
-  pruneopts = ""
-  revision = "0c6b41e72360850ca4f98dc341fd999726ea007f"
-  version = "v0.5.4"
-
-[[projects]]
-  branch = "master"
-  digest = "1:9e548233d0dc00e74be262e54a9d1bbe7e4c19e5951083520261740e37daeb02"
-  name = "golang.org/x/net"
-  packages = [
-    "http/httpguts",
-    "http2",
-    "http2/hpack",
-    "idna",
-  ]
-  pruneopts = ""
-  revision = "2491c5de3490fced2f6cff376127c667efeed857"
-
-[[projects]]
-  digest = "1:5acd3512b047305d49e8763eef7ba423901e85d5dd2fd1e71778a0ea8de10bd4"
-  name = "golang.org/x/text"
-  packages = [
-    "collate",
-    "collate/build",
-    "internal/colltab",
-    "internal/gen",
-    "internal/tag",
-    "internal/triegen",
-    "internal/ucd",
-    "language",
-    "secure/bidirule",
-    "transform",
-    "unicode/bidi",
-    "unicode/cldr",
-    "unicode/norm",
-    "unicode/rangetable",
-    "width",
-  ]
-  pruneopts = ""
-  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
-  version = "v0.3.0"
-
-[[projects]]
-  digest = "1:75fb3fcfc73a8c723efde7777b40e8e8ff9babf30d8c56160d01beffea8a95a6"
-  name = "gopkg.in/inf.v0"
-  packages = ["."]
-  pruneopts = ""
-  revision = "d2d2541c53f18d2a059457998ce2876cc8e67cbf"
-  version = "v0.9.1"
-
-[[projects]]
-  digest = "1:f0620375dd1f6251d9973b5f2596228cc8042e887cd7f827e4220bc1ce8c30e2"
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  pruneopts = ""
-  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
-  version = "v2.2.1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:663df6da5560210fc39194a0a2c4fceba09ead717c330f1174bb15597cf18ce8"
-  name = "k8s.io/api"
-  packages = [
-    "admissionregistration/v1alpha1",
-    "admissionregistration/v1beta1",
-    "apps/v1",
-    "apps/v1beta1",
-    "apps/v1beta2",
-    "authentication/v1",
-    "authentication/v1beta1",
-    "authorization/v1",
-    "authorization/v1beta1",
-    "autoscaling/v1",
-    "autoscaling/v2beta1",
-    "batch/v1",
-    "batch/v1beta1",
-    "batch/v2alpha1",
-    "certificates/v1beta1",
-    "core/v1",
-    "events/v1beta1",
-    "extensions/v1beta1",
-    "networking/v1",
-    "policy/v1beta1",
-    "rbac/v1",
-    "rbac/v1alpha1",
-    "rbac/v1beta1",
-    "scheduling/v1alpha1",
-    "settings/v1alpha1",
-    "storage/v1",
-    "storage/v1alpha1",
-    "storage/v1beta1",
-  ]
-  pruneopts = ""
-  revision = "53d615ae3f440f957cb9989d989d597f047262d9"
-
-[[projects]]
-  branch = "master"
-  digest = "1:bcb2285bb525712de7903a5d254c2789df65c8b58d2cfac5a26d950ad94c2079"
-  name = "k8s.io/apimachinery"
-  packages = [
-    "pkg/api/equality",
-    "pkg/api/meta",
-    "pkg/api/resource",
-    "pkg/api/validation",
-    "pkg/apis/meta/v1",
-    "pkg/apis/meta/v1/unstructured",
-    "pkg/apis/meta/v1/validation",
-    "pkg/apis/meta/v1beta1",
-    "pkg/conversion",
-    "pkg/conversion/queryparams",
-    "pkg/fields",
-    "pkg/labels",
-    "pkg/runtime",
-    "pkg/runtime/schema",
-    "pkg/runtime/serializer",
-    "pkg/runtime/serializer/json",
-    "pkg/runtime/serializer/protobuf",
-    "pkg/runtime/serializer/recognizer",
-    "pkg/runtime/serializer/versioning",
-    "pkg/selection",
-    "pkg/types",
-    "pkg/util/errors",
-    "pkg/util/framer",
-    "pkg/util/intstr",
-    "pkg/util/json",
-    "pkg/util/mergepatch",
-    "pkg/util/net",
-    "pkg/util/runtime",
-    "pkg/util/sets",
-    "pkg/util/strategicpatch",
-    "pkg/util/validation",
-    "pkg/util/validation/field",
-    "pkg/util/wait",
-    "pkg/util/yaml",
-    "pkg/watch",
-    "third_party/forked/golang/json",
-    "third_party/forked/golang/reflect",
-  ]
-  pruneopts = ""
-  revision = "13b73596e4b63e03203e86f6d9c7bcc1b937c62f"
-
-[[projects]]
-  digest = "1:071cc2f032b701b9dba26568e040940f26931a49e3a3985f3375f17f7f6d9c5f"
-  name = "k8s.io/client-go"
-  packages = ["kubernetes/scheme"]
-  pruneopts = ""
-  revision = "23781f4d6632d88e869066eaebb743857aa1ef9b"
-  version = "v7.0.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:386c5d69077ce740614e8309ddf107dde91a5db25d3d779143f452fb4fbdfd1e"
-  name = "k8s.io/kube-openapi"
-  packages = [
-    "pkg/common",
-    "pkg/util/proto",
-  ]
-  pruneopts = ""
-  revision = "b3f03f55328800731ce03a164b80973014ecd455"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "github.com/evanphx/json-patch",
-    "github.com/ghodss/yaml",
-    "github.com/golang/glog",
-    "github.com/hashicorp/go-getter",
-    "github.com/krishicks/yaml-patch",
-    "github.com/pkg/errors",
-    "github.com/spf13/cobra",
-    "gopkg.in/yaml.v2",
-    "k8s.io/api/core/v1",
-    "k8s.io/apimachinery/pkg/api/validation",
-    "k8s.io/apimachinery/pkg/apis/meta/v1",
-    "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
-    "k8s.io/apimachinery/pkg/apis/meta/v1/validation",
-    "k8s.io/apimachinery/pkg/runtime",
-    "k8s.io/apimachinery/pkg/runtime/schema",
-    "k8s.io/apimachinery/pkg/util/mergepatch",
-    "k8s.io/apimachinery/pkg/util/sets",
-    "k8s.io/apimachinery/pkg/util/strategicpatch",
-    "k8s.io/apimachinery/pkg/util/validation",
-    "k8s.io/apimachinery/pkg/util/validation/field",
-    "k8s.io/apimachinery/pkg/util/yaml",
-    "k8s.io/client-go/kubernetes/scheme",
-    "k8s.io/kube-openapi/pkg/common",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -1,66 +0,0 @@
-
-# Gopkg.toml example
-#
-# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#  name = "github.com/x/y"
-#  version = "2.4.0"
-
-
-[[constraint]]
-  name = "github.com/evanphx/json-patch"
-  version = "3.0.0"
-
-[[constraint]]
-  name = "github.com/ghodss/yaml"
-  version = "1.0.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/golang/glog"
-
-[[constraint]]
-  name = "github.com/spf13/cobra"
-  version = "0.0.2"
-
-[[constraint]]
-  branch = "master"
-  name = "k8s.io/api"
-
-[[constraint]]
-  branch = "master"
-  name = "k8s.io/apimachinery"
-
-[[constraint]]
-  name = "k8s.io/client-go"
-  version = "7.0.0"
-
-[[override]]
-  branch = "master"
-  name = "k8s.io/utils"
-
-[[override]]
-  branch = "master"
-  name = "github.com/go-openapi/spec"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/hashicorp/go-getter"
-
-[[constraint]]
-  name = "github.com/krishicks/yaml-patch"
-  version = "0.0.10"
--- a/37
+++ b/37
@@ -0,0 +1,37 @@
+BIN_NAME=kustomize
+
+COVER_FILE=coverage.out
+
+export GO111MODULE=on
+
+all: test build
+
+test: generate-code test-lint test-go
+
+test-go:
+	go test -v ./...
+
+test-lint:
+	golangci-lint run ./...
+
+generate-code:
+	./plugin/generateBuiltins.sh $(GOPATH)
+
+build:
+	go build -o $(BIN_NAME) cmd/kustomize/main.go
+
+install:
+	go install $(PWD)/cmd/kustomize
+
+cover:
+	# The plugin directory eludes coverage, and is therefore omitted
+	go test ./pkg/... ./k8sdeps/... ./internal/... -coverprofile=$(COVER_FILE) && \
+	go tool cover -html=$(COVER_FILE)
+
+
+clean:
+	go clean
+	rm -f $(BIN_NAME)
+	rm -f $(COVER_FILE)
+
+.PHONY: test build install clean generate-code test-go test-lint cover
--- a/1
+++ b/1
@@ -1,6 +1,5 @@
 aliases:
  kustomize-admins:
-    - grodrigues3
    - monopole
    - pwittrock
  kustomize-maintainers:
--- a/README.md
+++ b/README.md
@@ -7,14 +7,32 @@ untouched and usable as is.
 `kustomize` targets kubernetes; it understands and can
 patch [kubernetes style] API objects.  It's like
 [`make`], in that what it does is declared in a file,
-and it's like [`sed`], in that it emits editted text.
+and it's like [`sed`], in that it emits edited text.
+
+This tool is sponsored by [sig-cli] ([KEP]), and
+inspired by [DAM].
+

 [![Build Status](https://travis-ci.org/kubernetes-sigs/kustomize.svg?branch=master)](https://travis-ci.org/kubernetes-sigs/kustomize)
 [![Go Report Card](https://goreportcard.com/badge/github.com/kubernetes-sigs/kustomize)](https://goreportcard.com/report/github.com/kubernetes-sigs/kustomize)

-**Installation**: Download a binary from the [release
-page], or see these [install] notes. Then try one of
-the tested [examples].
+Download a binary from the [release page], or see
+these [instructions](docs/INSTALL.md).
+
+Browse the [docs](docs) or jump right into the
+tested [examples](examples).
+
+## kubectl integration
+
+Since [v1.14][kubectl announcement] the kustomize build system has been included in kubectl.
+
+| kubectl version | kustomize version |
+|---------|--------|
+| v1.16.0 | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+| v1.15.x | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+| v1.14.x | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+
+For examples and guides for using the kubectl integration please see the [kubectl book] or the [kubernetes documentation].

 ## Usage

@@ -113,21 +131,46 @@ The YAML can be directly [applied] to a cluster:
 > kustomize build ~/someApp/overlays/production | kubectl apply -f -
 > ```

-## About
+## Community

-This tool is sponsored by [sig-cli] ([KEP]).
+To file bugs please read [this](docs/bugs.md).

+Before working on an implementation, please
+
+ * Read the [eschewed feature list].
+ * File an issue describing
+   how the new feature would behave
+   and label it [kind/feature].
+
+### Other communication channels
+
+- [Slack]
+- [Mailing List]
+- General kubernetes [community page]
+
+### Code of conduct
+
+Participation in the Kubernetes community
+is governed by the [Kubernetes Code of Conduct].

-[KEP]: https://github.com/kubernetes/community/blob/master/keps/sig-cli/0008-kustomize.md
 [`make`]: https://www.gnu.org/software/make
 [`sed`]: https://www.gnu.org/software/sed
+[DAM]: docs/glossary.md#declarative-application-management
+[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/0008-kustomize.md
+[Kubernetes Code of Conduct]: code-of-conduct.md
+[Mailing List]: https://groups.google.com/forum/#!forum/kubernetes-sig-cli
+[Slack]: https://kubernetes.slack.com/messages/sig-cli
 [applied]: docs/glossary.md#apply
 [base]: docs/glossary.md#base
+[community page]: http://kubernetes.io/community/
 [declarative configuration]: docs/glossary.md#declarative-application-management
-[examples]: examples/README.md
-[imageBase]: docs/base.jpg
-[imageOverlay]: docs/overlay.jpg
-[install]: docs/INSTALL.md
+[eschewed feature list]: docs/eschewedFeatures.md
+[imageBase]: docs/images/base.jpg
+[imageOverlay]: docs/images/overlay.jpg
+[kind/feature]: https://github.com/kubernetes-sigs/kustomize/labels/kind%2Ffeature
+[kubectl announcement]: https://kubernetes.io/blog/2019/03/25/kubernetes-1-14-release-announcement
+[kubectl book]: https://kubectl.docs.kubernetes.io/pages/app_customization/introduction.html
+[kubernetes documentation]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
 [kubernetes style]: docs/glossary.md#kubernetes-style-object
 [kustomization]: docs/glossary.md#kustomization
 [overlay]: docs/glossary.md#overlay
@@ -138,4 +181,6 @@ This tool is sponsored by [sig-cli] ([KEP]).
 [sig-cli]: https://github.com/kubernetes/community/blob/master/sig-cli/README.md
 [variant]: docs/glossary.md#variant
 [variants]: docs/glossary.md#variant
+[v2.0.3]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.0.3
+[v2.1.0]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.1.0
 [workflows]: docs/workflows.md
--- a/docs/SECURITY_CONTACTS
+++ b/docs/SECURITY_CONTACTS
--- a/api/filesys/confirmeddir.go
+++ b/api/filesys/confirmeddir.go
@@ -0,0 +1,79 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+)
+
+// ConfirmedDir is a clean, absolute, delinkified path
+// that was confirmed to point to an existing directory.
+type ConfirmedDir string
+
+// NewTmpConfirmedDir returns a temporary dir, else error.
+// The directory is cleaned, no symlinks, etc. so it's
+// returned as a ConfirmedDir.
+func NewTmpConfirmedDir() (ConfirmedDir, error) {
+	n, err := ioutil.TempDir("", "kustomize-")
+	if err != nil {
+		return "", err
+	}
+
+	// In MacOs `ioutil.TempDir` creates a directory
+	// with root in the `/var` folder, which is in turn
+	// a symlinked path to `/private/var`.
+	// Function `filepath.EvalSymlinks`is used to
+	// resolve the real absolute path.
+	deLinked, err := filepath.EvalSymlinks(n)
+	return ConfirmedDir(deLinked), err
+}
+
+// HasPrefix returns true if the directory argument
+// is a prefix of self (d) from the point of view of
+// a file system.
+//
+// I.e., it's true if the argument equals or contains
+// self (d) in a file path sense.
+//
+// HasPrefix emulates the semantics of strings.HasPrefix
+// such that the following are true:
+//
+//   strings.HasPrefix("foobar", "foobar")
+//   strings.HasPrefix("foobar", "foo")
+//   strings.HasPrefix("foobar", "")
+//
+//   d := fSys.ConfirmDir("/foo/bar")
+//   d.HasPrefix("/foo/bar")
+//   d.HasPrefix("/foo")
+//   d.HasPrefix("/")
+//
+// Not contacting a file system here to check for
+// actual path existence.
+//
+// This is tested on linux, but will have trouble
+// on other operating systems.
+// TODO(monopole) Refactor when #golang/go/18358 closes.
+// See also:
+//   https://github.com/golang/go/issues/18358
+//   https://github.com/golang/dep/issues/296
+//   https://github.com/golang/dep/blob/master/internal/fs/fs.go#L33
+//   https://codereview.appspot.com/5712045
+func (d ConfirmedDir) HasPrefix(path ConfirmedDir) bool {
+	if path.String() == string(filepath.Separator) || path == d {
+		return true
+	}
+	return strings.HasPrefix(
+		string(d),
+		string(path)+string(filepath.Separator))
+}
+
+func (d ConfirmedDir) Join(path string) string {
+	return filepath.Join(string(d), path)
+}
+
+func (d ConfirmedDir) String() string {
+	return string(d)
+}
--- a/api/filesys/confirmeddir_test.go
+++ b/api/filesys/confirmeddir_test.go
@@ -0,0 +1,109 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
+)
+
+func TestJoin(t *testing.T) {
+	fSys := MakeFsInMemory()
+	err := fSys.Mkdir("/foo")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	d, f, err := fSys.CleanedAbs("/foo")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if f != "" {
+		t.Fatalf("unexpected file: %v", f)
+	}
+	if d.Join("bar") != "/foo/bar" {
+		t.Fatalf("expected join %s", d.Join("bar"))
+	}
+}
+
+func TestHasPrefix_Slash(t *testing.T) {
+	fSys := MakeFsInMemory()
+	d, f, err := fSys.CleanedAbs("/")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if f != "" {
+		t.Fatalf("unexpected file: %v", f)
+	}
+	if d.HasPrefix("/hey") {
+		t.Fatalf("should be false")
+	}
+	if !d.HasPrefix("/") {
+		t.Fatalf("/ should have the prefix /")
+	}
+}
+
+func TestHasPrefix_SlashFoo(t *testing.T) {
+	fSys := MakeFsInMemory()
+	err := fSys.Mkdir("/foo")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	d, _, err := fSys.CleanedAbs("/foo")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if d.HasPrefix("/fo") {
+		t.Fatalf("/foo does not have path prefix /fo")
+	}
+	if d.HasPrefix("/fod") {
+		t.Fatalf("/foo does not have path prefix /fod")
+	}
+	if !d.HasPrefix("/foo") {
+		t.Fatalf("/foo should have prefix /foo")
+	}
+}
+
+func TestHasPrefix_SlashFooBar(t *testing.T) {
+	fSys := MakeFsInMemory()
+	err := fSys.MkdirAll("/foo/bar")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	d, _, err := fSys.CleanedAbs("/foo/bar")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if d.HasPrefix("/fo") {
+		t.Fatalf("/foo/bar does not have path prefix /fo")
+	}
+	if d.HasPrefix("/foobar") {
+		t.Fatalf("/foo/bar does not have path prefix /foobar")
+	}
+	if !d.HasPrefix("/foo/bar") {
+		t.Fatalf("/foo/bar should have prefix /foo/bar")
+	}
+	if !d.HasPrefix("/foo") {
+		t.Fatalf("/foo/bar should have prefix /foo")
+	}
+	if !d.HasPrefix("/") {
+		t.Fatalf("/foo/bar should have prefix /")
+	}
+}
+
+func TestNewTempConfirmDir(t *testing.T) {
+	tmp, err := NewTmpConfirmedDir()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	delinked, err := filepath.EvalSymlinks(string(tmp))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(tmp) != delinked {
+		t.Fatalf("unexpected path containing symlinks")
+	}
+}
--- a/api/filesys/file.go
+++ b/api/filesys/file.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"io"
+	"os"
+	"time"
+)
+
+var _ os.FileInfo = &fileInfo{}
+
+// fileInfo implements os.FileInfo for a fileInMemory instance.
+type fileInfo struct {
+	*fileInMemory
+}
+
+// Name returns the name of the file
+func (fi *fileInfo) Name() string { return fi.name }
+
+// Size returns the size of the file
+func (fi *fileInfo) Size() int64 { return int64(len(fi.content)) }
+
+// Mode returns the file mode
+func (fi *fileInfo) Mode() os.FileMode { return 0777 }
+
+// ModTime returns the modification time
+func (fi *fileInfo) ModTime() time.Time { return time.Time{} }
+
+// IsDir returns if it is a directory
+func (fi *fileInfo) IsDir() bool { return fi.dir }
+
+// Sys should return underlying data source, but it now returns nil
+func (fi *fileInfo) Sys() interface{} { return nil }
+
+// File groups the basic os.File methods.
+type File interface {
+	io.ReadWriteCloser
+	Stat() (os.FileInfo, error)
+}
--- a/api/filesys/fileinmemory.go
+++ b/api/filesys/fileinmemory.go
@@ -0,0 +1,56 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"bytes"
+	"os"
+)
+
+var _ File = &fileInMemory{}
+
+// fileInMemory implements File in-memory for tests.
+type fileInMemory struct {
+	name    string
+	content []byte
+	dir     bool
+	open    bool
+}
+
+// makeDir makes a fake directory.
+func makeDir(name string) *fileInMemory {
+	return &fileInMemory{name: name, dir: true}
+}
+
+// Close marks the fake file closed.
+func (f *fileInMemory) Close() error {
+	f.open = false
+	return nil
+}
+
+// Read never fails, and doesn't mutate p.
+func (f *fileInMemory) Read(p []byte) (n int, err error) {
+	return len(p), nil
+}
+
+// Write saves the contents of the argument to memory.
+func (f *fileInMemory) Write(p []byte) (n int, err error) {
+	f.content = p
+	return len(p), nil
+}
+
+// ContentMatches returns true if v matches fake file's content.
+func (f *fileInMemory) ContentMatches(v []byte) bool {
+	return bytes.Equal(v, f.content)
+}
+
+// GetContent the content of a fake file.
+func (f *fileInMemory) GetContent() []byte {
+	return f.content
+}
+
+// Stat returns nil.
+func (f *fileInMemory) Stat() (os.FileInfo, error) {
+	return nil, nil
+}
--- a/api/filesys/fileondisk.go
+++ b/api/filesys/fileondisk.go
@@ -0,0 +1,27 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"os"
+)
+
+var _ File = &fileOnDisk{}
+
+// fileOnDisk implements File using the local filesystem.
+type fileOnDisk struct {
+	file *os.File
+}
+
+// Close closes a file.
+func (f *fileOnDisk) Close() error { return f.file.Close() }
+
+// Read reads a file's content.
+func (f *fileOnDisk) Read(p []byte) (n int, err error) { return f.file.Read(p) }
+
+// Write writes bytes to a file
+func (f *fileOnDisk) Write(p []byte) (n int, err error) { return f.file.Write(p) }
+
+// Stat returns an interface which has all the information regarding the file.
+func (f *fileOnDisk) Stat() (os.FileInfo, error) { return f.file.Stat() }
--- a/api/filesys/filesystem.go
+++ b/api/filesys/filesystem.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package filesys provides a file system abstraction layer.
+package filesys
+
+import (
+	"path/filepath"
+)
+
+// FileSystem groups basic os filesystem methods.
+type FileSystem interface {
+	// Create a file.
+	Create(name string) (File, error)
+	// MkDir makes a directory.
+	Mkdir(path string) error
+	// MkDir makes a directory path, creating intervening directories.
+	MkdirAll(path string) error
+	// RemoveAll removes path and any children it contains.
+	RemoveAll(path string) error
+	// Open opens the named file for reading.
+	Open(path string) (File, error)
+	// IsDir returns true if the path is a directory.
+	IsDir(path string) bool
+	// CleanedAbs converts the given path into a
+	// directory and a file name, where the directory
+	// is represented as a ConfirmedDir and all that implies.
+	// If the entire path is a directory, the file component
+	// is an empty string.
+	CleanedAbs(path string) (ConfirmedDir, string, error)
+	// Exists is true if the path exists in the file system.
+	Exists(path string) bool
+	// Glob returns the list of matching files
+	Glob(pattern string) ([]string, error)
+	// ReadFile returns the contents of the file at the given path.
+	ReadFile(path string) ([]byte, error)
+	// WriteFile writes the data to a file at the given path.
+	WriteFile(path string, data []byte) error
+	// Walk walks the file system with the given WalkFunc.
+	Walk(path string, walkFn filepath.WalkFunc) error
+}
--- a/api/filesys/fsinmemory.go
+++ b/api/filesys/fsinmemory.go
@@ -0,0 +1,223 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+var _ FileSystem = &fsInMemory{}
+
+// fsInMemory implements FileSystem using a in-memory filesystem
+// primarily for use in tests.
+type fsInMemory struct {
+	m map[string]*fileInMemory
+}
+
+// MakeFsInMemory returns an instance of fsInMemory with no files in it.
+func MakeFsInMemory() FileSystem {
+	result := &fsInMemory{m: map[string]*fileInMemory{}}
+	result.Mkdir(separator)
+	return result
+}
+
+const (
+	separator = string(filepath.Separator)
+	doubleSep = separator + separator
+)
+
+// Create assures a fake file appears in the in-memory file system.
+func (fs *fsInMemory) Create(name string) (File, error) {
+	f := &fileInMemory{}
+	f.open = true
+	fs.m[name] = f
+	return fs.m[name], nil
+}
+
+// Mkdir assures a fake directory appears in the in-memory file system.
+func (fs *fsInMemory) Mkdir(name string) error {
+	fs.m[name] = makeDir(name)
+	return nil
+}
+
+// MkdirAll delegates to Mkdir
+func (fs *fsInMemory) MkdirAll(name string) error {
+	return fs.Mkdir(name)
+}
+
+// RemoveAll presumably does rm -r on a path.
+// There's no error.
+func (fs *fsInMemory) RemoveAll(name string) error {
+	var toRemove []string
+	for k := range fs.m {
+		if strings.HasPrefix(k, name) {
+			toRemove = append(toRemove, k)
+		}
+	}
+	for _, k := range toRemove {
+		delete(fs.m, k)
+	}
+	return nil
+}
+
+// Open returns a fake file in the open state.
+func (fs *fsInMemory) Open(name string) (File, error) {
+	if _, found := fs.m[name]; !found {
+		return nil, fmt.Errorf("file %q cannot be opened", name)
+	}
+	return fs.m[name], nil
+}
+
+// CleanedAbs cannot fail.
+func (fs *fsInMemory) CleanedAbs(path string) (ConfirmedDir, string, error) {
+	if fs.IsDir(path) {
+		return ConfirmedDir(path), "", nil
+	}
+	d := filepath.Dir(path)
+	if d == path {
+		return ConfirmedDir(d), "", nil
+	}
+	return ConfirmedDir(d), filepath.Base(path), nil
+}
+
+// Exists returns true if file is known.
+func (fs *fsInMemory) Exists(name string) bool {
+	_, found := fs.m[name]
+	return found
+}
+
+// Glob returns the list of matching files
+func (fs *fsInMemory) Glob(pattern string) ([]string, error) {
+	var result []string
+	for p := range fs.m {
+		if fs.pathMatch(p, pattern) {
+			result = append(result, p)
+		}
+	}
+	sort.Strings(result)
+	return result, nil
+}
+
+// IsDir returns true if the file exists and is a directory.
+func (fs *fsInMemory) IsDir(name string) bool {
+	f, found := fs.m[name]
+	if found && f.dir {
+		return true
+	}
+	if !strings.HasSuffix(name, separator) {
+		name = name + separator
+	}
+	for k := range fs.m {
+		if strings.HasPrefix(k, name) {
+			return true
+		}
+	}
+	return false
+}
+
+// ReadFile always returns an empty bytes and error depending on content of m.
+func (fs *fsInMemory) ReadFile(name string) ([]byte, error) {
+	if ff, found := fs.m[name]; found {
+		return ff.content, nil
+	}
+	return nil, fmt.Errorf("cannot read file %q", name)
+}
+
+// WriteFile always succeeds and does nothing.
+func (fs *fsInMemory) WriteFile(name string, c []byte) error {
+	ff := &fileInMemory{}
+	ff.Write(c)
+	fs.m[name] = ff
+	return nil
+}
+
+// Walk implements filepath.Walk using the fake filesystem.
+func (fs *fsInMemory) Walk(path string, walkFn filepath.WalkFunc) error {
+	info, err := fs.lstat(path)
+	if err != nil {
+		err = walkFn(path, info, err)
+	} else {
+		err = fs.walk(path, info, walkFn)
+	}
+	if err == filepath.SkipDir {
+		return nil
+	}
+	return err
+}
+
+func (fs *fsInMemory) pathMatch(path, pattern string) bool {
+	match, _ := filepath.Match(pattern, path)
+	return match
+}
+
+func (fs *fsInMemory) lstat(path string) (*fileInfo, error) {
+	f, found := fs.m[path]
+	if !found {
+		return nil, os.ErrNotExist
+	}
+	return &fileInfo{f}, nil
+}
+
+func (fs *fsInMemory) join(elem ...string) string {
+	for i, e := range elem {
+		if e != "" {
+			return strings.Replace(
+				strings.Join(elem[i:], separator), doubleSep, separator, -1)
+		}
+	}
+	return ""
+}
+
+func (fs *fsInMemory) readDirNames(path string) []string {
+	var names []string
+	if !strings.HasSuffix(path, separator) {
+		path += separator
+	}
+	pathSegments := strings.Count(path, separator)
+	for name := range fs.m {
+		if name == path {
+			continue
+		}
+		if strings.Count(name, separator) > pathSegments {
+			continue
+		}
+		if strings.HasPrefix(name, path) {
+			names = append(names, filepath.Base(name))
+		}
+	}
+	sort.Strings(names)
+	return names
+}
+
+func (fs *fsInMemory) walk(path string, info os.FileInfo, walkFn filepath.WalkFunc) error {
+	if !info.IsDir() {
+		return walkFn(path, info, nil)
+	}
+
+	names := fs.readDirNames(path)
+	if err := walkFn(path, info, nil); err != nil {
+		return err
+	}
+	for _, name := range names {
+		filename := fs.join(path, name)
+		fileInfo, err := fs.lstat(filename)
+		if err != nil {
+			if err := walkFn(filename, fileInfo, os.ErrNotExist); err != nil && err != filepath.SkipDir {
+				return err
+			}
+		} else {
+			err = fs.walk(filename, fileInfo, walkFn)
+			if err != nil {
+				if !fileInfo.IsDir() || err != filepath.SkipDir {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
--- a/api/filesys/fsinmemory_test.go
+++ b/api/filesys/fsinmemory_test.go
@@ -0,0 +1,149 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys_test
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
+)
+
+func TestExists(t *testing.T) {
+	fSys := MakeFsInMemory()
+	if fSys.Exists("foo") {
+		t.Fatalf("expected no foo")
+	}
+	fSys.Mkdir("/")
+	if !fSys.IsDir("/") {
+		t.Fatalf("expected dir at /")
+	}
+}
+
+func TestIsDir(t *testing.T) {
+	fSys := MakeFsInMemory()
+	expectedName := "my-dir"
+	err := fSys.Mkdir(expectedName)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	shouldExist(t, fSys, expectedName)
+	if !fSys.IsDir(expectedName) {
+		t.Fatalf(expectedName + " should be a dir")
+	}
+}
+
+func shouldExist(t *testing.T, fSys FileSystem, name string) {
+	if !fSys.Exists(name) {
+		t.Fatalf(name + " should exist")
+	}
+}
+
+func shouldNotExist(t *testing.T, fSys FileSystem, name string) {
+	if fSys.Exists(name) {
+		t.Fatalf(name + " should not exist")
+	}
+}
+
+func TestRemoveAll(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.WriteFile("/foo/project/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/project/subdir/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/apple/subdir/file.yaml", []byte("Unused"))
+	shouldExist(t, fSys, "/foo/project/file.yaml")
+	shouldExist(t, fSys, "/foo/project/subdir/file.yaml")
+	shouldExist(t, fSys, "/foo/apple/subdir/file.yaml")
+	err := fSys.RemoveAll("/foo/project")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	shouldNotExist(t, fSys, "/foo/project/file.yaml")
+	shouldNotExist(t, fSys, "/foo/project/subdir/file.yaml")
+	shouldExist(t, fSys, "/foo/apple/subdir/file.yaml")
+}
+
+func TestIsDirDeeper(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.WriteFile("/foo/project/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/project/subdir/file.yaml", []byte("Unused"))
+	if !fSys.IsDir("/") {
+		t.Fatalf("/ should be a dir")
+	}
+	if !fSys.IsDir("/foo") {
+		t.Fatalf("/foo should be a dir")
+	}
+	if !fSys.IsDir("/foo/project") {
+		t.Fatalf("/foo/project should be a dir")
+	}
+	if fSys.IsDir("/fo") {
+		t.Fatalf("/fo should not be a dir")
+	}
+	if fSys.IsDir("/x") {
+		t.Fatalf("/x should not be a dir")
+	}
+}
+
+func TestCreate(t *testing.T) {
+	fSys := MakeFsInMemory()
+	f, err := fSys.Create("foo")
+	if f == nil {
+		t.Fatalf("expected file")
+	}
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	shouldExist(t, fSys, "foo")
+}
+
+func TestReadFile(t *testing.T) {
+	fSys := MakeFsInMemory()
+	f, err := fSys.Create("foo")
+	if f == nil {
+		t.Fatalf("expected file")
+	}
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	content, err := fSys.ReadFile("foo")
+	if len(content) != 0 {
+		t.Fatalf("expected no content")
+	}
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+}
+
+func TestWriteFile(t *testing.T) {
+	fSys := MakeFsInMemory()
+	c := []byte("heybuddy")
+	err := fSys.WriteFile("foo", c)
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	content, err := fSys.ReadFile("foo")
+	if err != nil {
+		t.Fatalf("expected read to work: %v", err)
+	}
+	if bytes.Compare(c, content) != 0 {
+		t.Fatalf("incorrect content: %v", content)
+	}
+}
+
+func TestGlob(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.Create("dir/foo")
+	fSys.Create("dir/bar")
+	files, err := fSys.Glob("dir/*")
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	expected := []string{
+		"dir/bar",
+		"dir/foo",
+	}
+	if !reflect.DeepEqual(files, expected) {
+		t.Fatalf("incorrect files found by glob: %v", files)
+	}
+}
--- a/api/filesys/fsondisk.go
+++ b/api/filesys/fsondisk.go
@@ -0,0 +1,114 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"path/filepath"
+)
+
+var _ FileSystem = fsOnDisk{}
+
+// fsOnDisk implements FileSystem using the local filesystem.
+type fsOnDisk struct{}
+
+// MakeFsOnDisk makes an instance of fsOnDisk.
+func MakeFsOnDisk() FileSystem {
+	return fsOnDisk{}
+}
+
+// Create delegates to os.Create.
+func (fsOnDisk) Create(name string) (File, error) { return os.Create(name) }
+
+// Mkdir delegates to os.Mkdir.
+func (fsOnDisk) Mkdir(name string) error {
+	return os.Mkdir(name, 0777|os.ModeDir)
+}
+
+// MkdirAll delegates to os.MkdirAll.
+func (fsOnDisk) MkdirAll(name string) error {
+	return os.MkdirAll(name, 0777|os.ModeDir)
+}
+
+// RemoveAll delegates to os.RemoveAll.
+func (fsOnDisk) RemoveAll(name string) error {
+	return os.RemoveAll(name)
+}
+
+// Open delegates to os.Open.
+func (fsOnDisk) Open(name string) (File, error) { return os.Open(name) }
+
+// CleanedAbs converts the given path into a
+// directory and a file name, where the directory
+// is represented as a ConfirmedDir and all that implies.
+// If the entire path is a directory, the file component
+// is an empty string.
+func (x fsOnDisk) CleanedAbs(
+	path string) (ConfirmedDir, string, error) {
+	absRoot, err := filepath.Abs(path)
+	if err != nil {
+		return "", "", fmt.Errorf(
+			"abs path error on '%s' : %v", path, err)
+	}
+	deLinked, err := filepath.EvalSymlinks(absRoot)
+	if err != nil {
+		return "", "", fmt.Errorf(
+			"evalsymlink failure on '%s' : %v", path, err)
+	}
+	if x.IsDir(deLinked) {
+		return ConfirmedDir(deLinked), "", nil
+	}
+	d := filepath.Dir(deLinked)
+	if !x.IsDir(d) {
+		// Programmer/assumption error.
+		log.Fatalf("first part of '%s' not a directory", deLinked)
+	}
+	if d == deLinked {
+		// Programmer/assumption error.
+		log.Fatalf("d '%s' should be a subset of deLinked", d)
+	}
+	f := filepath.Base(deLinked)
+	if filepath.Join(d, f) != deLinked {
+		// Programmer/assumption error.
+		log.Fatalf("these should be equal: '%s', '%s'",
+			filepath.Join(d, f), deLinked)
+	}
+	return ConfirmedDir(d), f, nil
+}
+
+// Exists returns true if os.Stat succeeds.
+func (fsOnDisk) Exists(name string) bool {
+	_, err := os.Stat(name)
+	return err == nil
+}
+
+// Glob returns the list of matching files
+func (fsOnDisk) Glob(pattern string) ([]string, error) {
+	return filepath.Glob(pattern)
+}
+
+// IsDir delegates to os.Stat and FileInfo.IsDir
+func (fsOnDisk) IsDir(name string) bool {
+	info, err := os.Stat(name)
+	if err != nil {
+		return false
+	}
+	return info.IsDir()
+}
+
+// ReadFile delegates to ioutil.ReadFile.
+func (fsOnDisk) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(name) }
+
+// WriteFile delegates to ioutil.WriteFile with read/write permissions.
+func (fsOnDisk) WriteFile(name string, c []byte) error {
+	return ioutil.WriteFile(name, c, 0666)
+}
+
+// Walk delegates to filepath.Walk.
+func (fsOnDisk) Walk(path string, walkFn filepath.WalkFunc) error {
+	return filepath.Walk(path, walkFn)
+}
--- a/api/filesys/fsondisk_test.go
+++ b/api/filesys/fsondisk_test.go
@@ -0,0 +1,165 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
+)
+
+func makeTestDir(t *testing.T) (FileSystem, string) {
+	fSys := MakeFsOnDisk()
+	td, err := ioutil.TempDir("", "kustomize_testing_dir")
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+	testDir, err := filepath.EvalSymlinks(td)
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+	if !fSys.Exists(testDir) {
+		t.Fatalf("expected existence")
+	}
+	if !fSys.IsDir(testDir) {
+		t.Fatalf("expected directory")
+	}
+	return fSys, testDir
+}
+
+func TestCleanedAbs_1(t *testing.T) {
+	fSys, testDir := makeTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	d, f, err := fSys.CleanedAbs("")
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	if d.String() != wd {
+		t.Fatalf("unexpected d=%s", d)
+	}
+	if f != "" {
+		t.Fatalf("unexpected f=%s", f)
+	}
+}
+
+func TestCleanedAbs_2(t *testing.T) {
+	fSys, testDir := makeTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	d, f, err := fSys.CleanedAbs("/")
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	if d != "/" {
+		t.Fatalf("unexpected d=%s", d)
+	}
+	if f != "" {
+		t.Fatalf("unexpected f=%s", f)
+	}
+}
+
+func TestCleanedAbs_3(t *testing.T) {
+	fSys, testDir := makeTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	err := fSys.WriteFile(
+		filepath.Join(testDir, "foo"), []byte(`foo`))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+
+	d, f, err := fSys.CleanedAbs(filepath.Join(testDir, "foo"))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	if d.String() != testDir {
+		t.Fatalf("unexpected d=%s", d)
+	}
+	if f != "foo" {
+		t.Fatalf("unexpected f=%s", f)
+	}
+}
+
+func TestCleanedAbs_4(t *testing.T) {
+	fSys, testDir := makeTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	err := fSys.MkdirAll(filepath.Join(testDir, "d1", "d2"))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	err = fSys.WriteFile(
+		filepath.Join(testDir, "d1", "d2", "bar"),
+		[]byte(`bar`))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+
+	d, f, err := fSys.CleanedAbs(
+		filepath.Join(testDir, "d1", "d2"))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	if d.String() != filepath.Join(testDir, "d1", "d2") {
+		t.Fatalf("unexpected d=%s", d)
+	}
+	if f != "" {
+		t.Fatalf("unexpected f=%s", f)
+	}
+
+	d, f, err = fSys.CleanedAbs(
+		filepath.Join(testDir, "d1", "d2", "bar"))
+	if err != nil {
+		t.Fatalf("unexpected err=%v", err)
+	}
+	if d.String() != filepath.Join(testDir, "d1", "d2") {
+		t.Fatalf("unexpected d=%s", d)
+	}
+	if f != "bar" {
+		t.Fatalf("unexpected f=%s", f)
+	}
+}
+
+func TestReadFilesRealFS(t *testing.T) {
+	fSys, testDir := makeTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	err := fSys.WriteFile(path.Join(testDir, "foo"), []byte(`foo`))
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+	if !fSys.Exists(path.Join(testDir, "foo")) {
+		t.Fatalf("expected foo")
+	}
+	if fSys.IsDir(path.Join(testDir, "foo")) {
+		t.Fatalf("expected foo not to be a directory")
+	}
+
+	err = fSys.WriteFile(path.Join(testDir, "bar"), []byte(`bar`))
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+
+	files, err := fSys.Glob(path.Join("testDir", "*"))
+	expected := []string{
+		path.Join(testDir, "bar"),
+		path.Join(testDir, "foo"),
+	}
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	if reflect.DeepEqual(files, expected) {
+		t.Fatalf("incorrect files found by glob: %v", files)
+	}
+}
--- a/api/filesys/rpath.go
+++ b/api/filesys/rpath.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import "path/filepath"
+
+// RootedPath returns a rooted path, e.g. "/foo/bar" as
+// opposed to "foo/bar".
+func RootedPath(elem ...string) string {
+	return separator + filepath.Join(elem...)
+}
--- a/api/git/cloner.go
+++ b/api/git/cloner.go
@@ -0,0 +1,121 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"bytes"
+	"log"
+	"os/exec"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+// Cloner is a function that can clone a git repo.
+type Cloner func(repoSpec *RepoSpec) error
+
+// ClonerUsingGitExec uses a local git install, as opposed
+// to say, some remote API, to obtain a local clone of
+// a remote repo.
+func ClonerUsingGitExec(repoSpec *RepoSpec) error {
+	gitProgram, err := exec.LookPath("git")
+	if err != nil {
+		return errors.Wrap(err, "no 'git' program on path")
+	}
+	repoSpec.Dir, err = filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return err
+	}
+	cmd := exec.Command(
+		gitProgram,
+		"init",
+		repoSpec.Dir.String())
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error initializing empty git repo: %s", out.String())
+		return errors.Wrapf(
+			err,
+			"trouble initializing empty git repo in %s",
+			repoSpec.Dir.String())
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"remote",
+		"add",
+		"origin",
+		repoSpec.CloneSpec())
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error setting git remote: %s", out.String())
+		return errors.Wrapf(
+			err,
+			"trouble adding remote %s",
+			repoSpec.CloneSpec())
+	}
+	if repoSpec.Ref == "" {
+		repoSpec.Ref = "master"
+	}
+	cmd = exec.Command(
+		gitProgram,
+		"fetch",
+		"--depth=1",
+		"origin",
+		repoSpec.Ref)
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error performing git fetch: %s", out.String())
+		return errors.Wrapf(err, "trouble fetching %s", repoSpec.Ref)
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"reset",
+		"--hard",
+		"FETCH_HEAD")
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error performing git reset: %s", out.String())
+		return errors.Wrapf(
+			err, "trouble hard resetting empty repository to %s", repoSpec.Ref)
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"submodule",
+		"update",
+		"--init",
+		"--recursive")
+	cmd.Stdout = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		return errors.Wrapf(err, "trouble fetching submodules for %s", repoSpec.Ref)
+	}
+
+	return nil
+}
+
+// DoNothingCloner returns a cloner that only sets
+// cloneDir field in the repoSpec.  It's assumed that
+// the cloneDir is associated with some fake filesystem
+// used in a test.
+func DoNothingCloner(dir filesys.ConfirmedDir) Cloner {
+	return func(rs *RepoSpec) error {
+		rs.Dir = dir
+		return nil
+	}
+}
--- a/api/git/repospec.go
+++ b/api/git/repospec.go
@@ -0,0 +1,219 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+// Used as a temporary non-empty occupant of the cloneDir
+// field, as something distinguishable from the empty string
+// in various outputs (especially tests). Not using an
+// actual directory name here, as that's a temporary directory
+// with a unique name that isn't created until clone time.
+const notCloned = filesys.ConfirmedDir("/notCloned")
+
+// RepoSpec specifies a git repository and a branch and path therein.
+type RepoSpec struct {
+	// Raw, original spec, used to look for cycles.
+	// TODO(monopole): Drop raw, use processed fields instead.
+	raw string
+
+	// Host, e.g. github.com
+	Host string
+
+	// orgRepo name (organization/repoName),
+	// e.g. kubernetes-sigs/kustomize
+	OrgRepo string
+
+	// Dir where the orgRepo is cloned to.
+	Dir filesys.ConfirmedDir
+
+	// Relative path in the repository, and in the cloneDir,
+	// to a Kustomization.
+	Path string
+
+	// Branch or tag reference.
+	Ref string
+
+	// e.g. .git or empty in case of _git is present
+	GitSuffix string
+}
+
+// CloneSpec returns a string suitable for "git clone {spec}".
+func (x *RepoSpec) CloneSpec() string {
+	if isAzureHost(x.Host) || isAWSHost(x.Host) {
+		return x.Host + x.OrgRepo
+	}
+	return x.Host + x.OrgRepo + x.GitSuffix
+}
+
+func (x *RepoSpec) CloneDir() filesys.ConfirmedDir {
+	return x.Dir
+}
+
+func (x *RepoSpec) Raw() string {
+	return x.raw
+}
+
+func (x *RepoSpec) AbsPath() string {
+	return x.Dir.Join(x.Path)
+}
+
+func (x *RepoSpec) Cleaner(fSys filesys.FileSystem) func() error {
+	return func() error { return fSys.RemoveAll(x.Dir.String()) }
+}
+
+// From strings like git@github.com:someOrg/someRepo.git or
+// https://github.com/someOrg/someRepo?ref=someHash, extract
+// the parts.
+func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
+	if filepath.IsAbs(n) {
+		return nil, fmt.Errorf("uri looks like abs path: %s", n)
+	}
+	host, orgRepo, path, gitRef, gitSuffix := parseGitUrl(n)
+	if orgRepo == "" {
+		return nil, fmt.Errorf("url lacks orgRepo: %s", n)
+	}
+	if host == "" {
+		return nil, fmt.Errorf("url lacks host: %s", n)
+	}
+	return &RepoSpec{
+		raw: n, Host: host, OrgRepo: orgRepo,
+		Dir: notCloned, Path: path, Ref: gitRef, GitSuffix: gitSuffix}, nil
+}
+
+const (
+	refQuery      = "?ref="
+	refQueryRegex = "\\?(version|ref)="
+	gitSuffix     = ".git"
+	gitDelimiter  = "_git/"
+)
+
+// From strings like git@github.com:someOrg/someRepo.git or
+// https://github.com/someOrg/someRepo?ref=someHash, extract
+// the parts.
+func parseGitUrl(n string) (
+	host string, orgRepo string, path string, gitRef string, gitSuff string) {
+
+	if strings.Contains(n, gitDelimiter) {
+		index := strings.Index(n, gitDelimiter)
+		// Adding _git/ to host
+		host = normalizeGitHostSpec(n[:index+len(gitDelimiter)])
+		orgRepo = strings.Split(strings.Split(n[index+len(gitDelimiter):], "/")[0], "?")[0]
+		path, gitRef = peelQuery(n[index+len(gitDelimiter)+len(orgRepo):])
+		return
+	}
+	host, n = parseHostSpec(n)
+	gitSuff = gitSuffix
+	if strings.Contains(n, gitSuffix) {
+		index := strings.Index(n, gitSuffix)
+		orgRepo = n[0:index]
+		n = n[index+len(gitSuffix):]
+		path, gitRef = peelQuery(n)
+		return
+	}
+
+	i := strings.Index(n, "/")
+	if i < 1 {
+		return "", "", "", "", ""
+	}
+	j := strings.Index(n[i+1:], "/")
+	if j >= 0 {
+		j += i + 1
+		orgRepo = n[:j]
+		path, gitRef = peelQuery(n[j+1:])
+		return
+	}
+	path = ""
+	orgRepo, gitRef = peelQuery(n)
+	return host, orgRepo, path, gitRef, gitSuff
+}
+
+func peelQuery(arg string) (string, string) {
+
+	r, _ := regexp.Compile(refQueryRegex)
+	j := r.FindStringIndex(arg)
+
+	if len(j) > 0 {
+		return arg[:j[0]], arg[j[0]+len(r.FindString(arg)):]
+	}
+	return arg, ""
+}
+
+func parseHostSpec(n string) (string, string) {
+	var host string
+	// Start accumulating the host part.
+	for _, p := range []string{
+		// Order matters here.
+		"git::", "gh:", "ssh://", "https://", "http://",
+		"git@", "github.com:", "github.com/"} {
+		if len(p) < len(n) && strings.ToLower(n[:len(p)]) == p {
+			n = n[len(p):]
+			host += p
+		}
+	}
+	if host == "git@" {
+		i := strings.Index(n, "/")
+		if i > -1 {
+			host += n[:i+1]
+			n = n[i+1:]
+		} else {
+			i = strings.Index(n, ":")
+			if i > -1 {
+				host += n[:i+1]
+				n = n[i+1:]
+			}
+		}
+		return host, n
+	}
+
+	// If host is a http(s) or ssh URL, grab the domain part.
+	for _, p := range []string{
+		"ssh://", "https://", "http://"} {
+		if strings.HasSuffix(host, p) {
+			i := strings.Index(n, "/")
+			if i > -1 {
+				host = host + n[0:i+1]
+				n = n[i+1:]
+			}
+			break
+		}
+	}
+
+	return normalizeGitHostSpec(host), n
+}
+
+func normalizeGitHostSpec(host string) string {
+	s := strings.ToLower(host)
+	if strings.Contains(s, "github.com") {
+		if strings.Contains(s, "git@") || strings.Contains(s, "ssh:") {
+			host = "git@github.com:"
+		} else {
+			host = "https://github.com/"
+		}
+	}
+	if strings.HasPrefix(s, "git::") {
+		host = strings.TrimPrefix(s, "git::")
+	}
+	return host
+}
+
+// The format of Azure repo URL is documented
+// https://docs.microsoft.com/en-us/azure/devops/repos/git/clone?view=vsts&tabs=visual-studio#clone_url
+func isAzureHost(host string) bool {
+	return strings.Contains(host, "dev.azure.com") ||
+		strings.Contains(host, "visualstudio.com")
+}
+
+// The format of AWS repo URL is documented
+// https://docs.aws.amazon.com/codecommit/latest/userguide/regions.html
+func isAWSHost(host string) bool {
+	return strings.Contains(host, "amazonaws.com")
+}
--- a/api/git/repospec_test.go
+++ b/api/git/repospec_test.go
@@ -0,0 +1,288 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+var orgRepos = []string{"someOrg/someRepo", "kubernetes/website"}
+
+var pathNames = []string{"README.md", "foo/krusty.txt", ""}
+
+var hrefArgs = []string{"someBranch", "master", "v0.1.0", ""}
+
+var hostNamesRawAndNormalized = [][]string{
+	{"gh:", "gh:"},
+	{"GH:", "gh:"},
+	{"gitHub.com/", "https://github.com/"},
+	{"github.com:", "https://github.com/"},
+	{"http://github.com/", "https://github.com/"},
+	{"https://github.com/", "https://github.com/"},
+	{"hTTps://github.com/", "https://github.com/"},
+	{"https://git-codecommit.us-east-2.amazonaws.com/", "https://git-codecommit.us-east-2.amazonaws.com/"},
+	{"https://fabrikops2.visualstudio.com/", "https://fabrikops2.visualstudio.com/"},
+	{"ssh://git.example.com:7999/", "ssh://git.example.com:7999/"},
+	{"git::https://gitlab.com/", "https://gitlab.com/"},
+	{"git::http://git.example.com/", "http://git.example.com/"},
+	{"git::https://git.example.com/", "https://git.example.com/"},
+	{"git@github.com:", "git@github.com:"},
+	{"git@github.com/", "git@github.com:"},
+	{"git@gitlab2.sqtools.ru:10022/", "git@gitlab2.sqtools.ru:10022/"},
+}
+
+func makeUrl(hostFmt, orgRepo, path, href string) string {
+	if len(path) > 0 {
+		orgRepo = filepath.Join(orgRepo, path)
+	}
+	url := hostFmt + orgRepo
+	if href != "" {
+		url += refQuery + href
+	}
+	return url
+}
+
+func TestNewRepoSpecFromUrl(t *testing.T) {
+	var bad [][]string
+	for _, tuple := range hostNamesRawAndNormalized {
+		hostRaw := tuple[0]
+		hostSpec := tuple[1]
+		for _, orgRepo := range orgRepos {
+			for _, pathName := range pathNames {
+				for _, hrefArg := range hrefArgs {
+					uri := makeUrl(hostRaw, orgRepo, pathName, hrefArg)
+					rs, err := NewRepoSpecFromUrl(uri)
+					if err != nil {
+						t.Errorf("problem %v", err)
+					}
+					if rs.Host != hostSpec {
+						bad = append(bad, []string{"host", uri, rs.Host, hostSpec})
+					}
+					if rs.OrgRepo != orgRepo {
+						bad = append(bad, []string{"orgRepo", uri, rs.OrgRepo, orgRepo})
+					}
+					if rs.Path != pathName {
+						bad = append(bad, []string{"path", uri, rs.Path, pathName})
+					}
+					if rs.Ref != hrefArg {
+						bad = append(bad, []string{"ref", uri, rs.Ref, hrefArg})
+					}
+				}
+			}
+		}
+	}
+	if len(bad) > 0 {
+		for _, tuple := range bad {
+			fmt.Printf("\n"+
+				"     from uri: %s\n"+
+				"  actual %4s: %s\n"+
+				"expected %4s: %s\n",
+				tuple[1], tuple[0], tuple[2], tuple[0], tuple[3])
+		}
+		t.Fail()
+	}
+}
+
+var badData = [][]string{
+	{"/tmp", "uri looks like abs path"},
+	{"iauhsdiuashduas", "url lacks orgRepo"},
+	{"htxxxtp://github.com/", "url lacks host"},
+	{"ssh://git.example.com", "url lacks orgRepo"},
+	{"git::___", "url lacks orgRepo"},
+}
+
+func TestNewRepoSpecFromUrlErrors(t *testing.T) {
+	for _, tuple := range badData {
+		_, err := NewRepoSpecFromUrl(tuple[0])
+		if err == nil {
+			t.Error("expected error")
+		}
+		if !strings.Contains(err.Error(), tuple[1]) {
+			t.Errorf("unexpected error: %s", err)
+		}
+	}
+}
+
+func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
+	testcases := []struct {
+		input     string
+		cloneSpec string
+		absPath   string
+		ref       string
+	}{
+		{
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
+		},
+		{
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir?ref=testbranch",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "testbranch",
+		},
+		{
+			input:     "https://fabrikops2.visualstudio.com/someorg/somerepo?ref=master",
+			cloneSpec: "https://fabrikops2.visualstudio.com/someorg/somerepo",
+			absPath:   notCloned.String(),
+			ref:       "master",
+		},
+		{
+			input:     "http://github.com/someorg/somerepo/somedir",
+			cloneSpec: "https://github.com/someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
+		},
+		{
+			input:     "git@github.com:someorg/somerepo/somedir",
+			cloneSpec: "git@github.com:someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
+		},
+		{
+			input:     "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git?ref=v0.1.0",
+			cloneSpec: "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git",
+			absPath:   notCloned.String(),
+			ref:       "v0.1.0",
+		},
+		{
+			input:     "git@bitbucket.org:company/project.git//path?ref=branch",
+			cloneSpec: "git@bitbucket.org:company/project.git",
+			absPath:   notCloned.Join("path"),
+			ref:       "branch",
+		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "",
+		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos?version=v1.0.0",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "v1.0.0",
+		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos/somedir?version=v1.0.0",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "v1.0.0",
+		},
+		{
+			input:     "git::https://itfs.mycompany.com/collection/project/_git/somerepos",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "",
+		},
+	}
+	for _, testcase := range testcases {
+		rs, err := NewRepoSpecFromUrl(testcase.input)
+		if err != nil {
+			t.Errorf("Unexpected error: %v", err)
+		}
+		if rs.CloneSpec() != testcase.cloneSpec {
+			t.Errorf("CloneSpec expected to be %v, but got %v on %s",
+				testcase.cloneSpec, rs.CloneSpec(), testcase.input)
+		}
+		if rs.AbsPath() != testcase.absPath {
+			t.Errorf("AbsPath expected to be %v, but got %v on %s",
+				testcase.absPath, rs.AbsPath(), testcase.input)
+		}
+		if rs.Ref != testcase.ref {
+			t.Errorf("ref expected to be %v, but got %v on %s",
+				testcase.ref, rs.Ref, testcase.input)
+		}
+	}
+}
+
+func TestIsAzureHost(t *testing.T) {
+	testcases := []struct {
+		input  string
+		expect bool
+	}{
+		{
+			input:  "https://git-codecommit.us-east-2.amazonaws.com",
+			expect: false,
+		},
+		{
+			input:  "ssh://git-codecommit.us-east-2.amazonaws.com",
+			expect: false,
+		},
+		{
+			input:  "https://fabrikops2.visualstudio.com/",
+			expect: true,
+		},
+		{
+			input:  "https://dev.azure.com/myorg/myproject/",
+			expect: true,
+		},
+	}
+	for _, testcase := range testcases {
+		actual := isAzureHost(testcase.input)
+		if actual != testcase.expect {
+			t.Errorf("IsAzureHost: expected %v, but got %v on %s", testcase.expect, actual, testcase.input)
+		}
+	}
+}
+
+func TestPeelQuery(t *testing.T) {
+	testcases := []struct {
+		input  string
+		expect [2]string
+	}{
+		{
+			input:  "somerepos?ref=v1.0.0",
+			expect: [2]string{"somerepos", "v1.0.0"},
+		},
+		{
+			input:  "somerepos?version=master",
+			expect: [2]string{"somerepos", "master"},
+		},
+		{
+			input:  "somerepos",
+			expect: [2]string{"somerepos", ""},
+		},
+	}
+	for _, testcase := range testcases {
+		path, ref := peelQuery(testcase.input)
+		if path != testcase.expect[0] || ref != testcase.expect[1] {
+			t.Errorf("peelQuery: expected (%s, %s) got (%s, %s) on %s", testcase.expect[0], testcase.expect[1], path, ref, testcase.input)
+		}
+	}
+}
+
+func TestIsAWSHost(t *testing.T) {
+	testcases := []struct {
+		input  string
+		expect bool
+	}{
+		{
+			input:  "https://git-codecommit.us-east-2.amazonaws.com",
+			expect: true,
+		},
+		{
+			input:  "ssh://git-codecommit.us-east-2.amazonaws.com",
+			expect: true,
+		},
+		{
+			input:  "git@github.com:",
+			expect: false,
+		},
+		{
+			input:  "http://github.com/",
+			expect: false,
+		},
+	}
+	for _, testcase := range testcases {
+		actual := isAWSHost(testcase.input)
+		if actual != testcase.expect {
+			t.Errorf("IsAWSHost: expected %v, but got %v on %s", testcase.expect, actual, testcase.input)
+		}
+	}
+}
--- a/api/go.mod
+++ b/api/go.mod
@@ -0,0 +1,21 @@
+module sigs.k8s.io/kustomize/api
+
+go 1.13
+
+require (
+	github.com/evanphx/json-patch v4.5.0+incompatible
+	github.com/go-openapi/spec v0.19.4
+	github.com/golang/protobuf v1.3.2 // indirect
+	github.com/pkg/errors v0.8.1
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.4.0 // indirect
+	golang.org/x/net v0.0.0-20190923162816-aa69164e4478 // indirect
+	golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 // indirect
+	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	gopkg.in/yaml.v2 v2.2.4
+	k8s.io/api v0.0.0-20191016225839-816a9b7df678
+	k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5
+	k8s.io/client-go v11.0.0+incompatible
+	k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d
+	sigs.k8s.io/yaml v1.1.0
+)
--- a/api/go.sum
+++ b/api/go.sum
@@ -0,0 +1,162 @@
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633 h1:H2pdYOb3KQ1/YsqVWoWNLQO+fusocsw354rqGTZtAgw=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
+github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.19.2 h1:o20suLFB4Ri0tuzpWtyHlh7E7HnkqTNLq6aR6WVNS1w=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.19.4 h1:ixzUSnHTd6hCemgtAJgluaTSGYpLNpJY4mA2DIkdOAo=
+github.com/go-openapi/spec v0.19.4/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d h1:7XGaL1e6bYS1yIonGp9761ExpPPV1ui0SAC59Yube9k=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e h1:hB2xlXdHp/pmPZq0y3QnmWAArdw9PqbmotexnWx/FU8=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
+github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o=
+gopkg.in/inf.v0 v0.9.0/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+k8s.io/api v0.0.0-20191016225839-816a9b7df678 h1:z/0BV/tMBIvdwZvqBH/f7TWjQX9y3dj1nMNhrSK0h/8=
+k8s.io/api v0.0.0-20191016225839-816a9b7df678/go.mod h1:LZQaT8MvVpl7Bg2lYFcQm7+Mpdxq8p1NFl3yh+5DCwY=
+k8s.io/apimachinery v0.0.0-20191016225534-b1267f8c42b4/go.mod h1:92mWDd8Ji2sw2157KIgino5wCxffA8KSvhW2oY4ypdw=
+k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5 h1:r3/YL3+t1U46lJF5zUSArskUpnLyWuM28rQDpM1qQPI=
+k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5/go.mod h1:92mWDd8Ji2sw2157KIgino5wCxffA8KSvhW2oY4ypdw=
+k8s.io/client-go v11.0.0+incompatible h1:LBbX2+lOwY9flffWlJM7f1Ct8V2SRNiMRDFeiwnJo9o=
+k8s.io/client-go v11.0.0+incompatible/go.mod h1:7vJpHMYJwNQCWgzmNV+VYUl1zCObLyodBc8nIyt8L5s=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
+k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d h1:Xpe6sK+RY4ZgCTyZ3y273UmFmURhjtoJiwOMbQsXitY=
+k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
--- a/api/hasher/hasher.go
+++ b/api/hasher/hasher.go
@@ -0,0 +1,52 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package hasher
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"sort"
+)
+
+// SortArrayAndComputeHash sorts a string array and
+// returns a hash for it
+func SortArrayAndComputeHash(s []string) (string, error) {
+	sort.Strings(s)
+	data, err := json.Marshal(s)
+	if err != nil {
+		return "", err
+	}
+	return Encode(Hash(string(data)))
+}
+
+// Copied from https://github.com/kubernetes/kubernetes
+// /blob/master/pkg/kubectl/util/hash/hash.go
+func Encode(hex string) (string, error) {
+	if len(hex) < 10 {
+		return "", fmt.Errorf(
+			"input length must be at least 10")
+	}
+	enc := []rune(hex[:10])
+	for i := range enc {
+		switch enc[i] {
+		case '0':
+			enc[i] = 'g'
+		case '1':
+			enc[i] = 'h'
+		case '3':
+			enc[i] = 'k'
+		case 'a':
+			enc[i] = 'm'
+		case 'e':
+			enc[i] = 't'
+		}
+	}
+	return string(enc), nil
+}
+
+// Hash returns the hex form of the sha256 of the argument.
+func Hash(data string) string {
+	return fmt.Sprintf("%x", sha256.Sum256([]byte(data)))
+}
--- a/api/hasher/hasher_test.go
+++ b/api/hasher/hasher_test.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package hasher_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/hasher"
+)
+
+func TestSortArrayAndComputeHash(t *testing.T) {
+	array1 := []string{"a", "b", "c", "d"}
+	array2 := []string{"c", "b", "d", "a"}
+	h1, err := SortArrayAndComputeHash(array1)
+	if err != nil {
+		t.Errorf("unexpected error %v", err)
+	}
+	if h1 == "" {
+		t.Errorf("failed to hash %v", array1)
+	}
+	h2, err := SortArrayAndComputeHash(array2)
+	if err != nil {
+		t.Errorf("unexpected error %v", err)
+	}
+	if h2 == "" {
+		t.Errorf("failed to hash %v", array2)
+	}
+	if h1 != h2 {
+		t.Errorf("hash is not consistent with reordered list: %s %s", h1, h2)
+	}
+}
+
+func TestHash(t *testing.T) {
+	// hash the empty string to be sure that sha256 is being used
+	expect := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+	sum := Hash("")
+	if expect != sum {
+		t.Errorf("expected hash %q but got %q", expect, sum)
+	}
+}
--- a/api/ifc/ifc.go
+++ b/api/ifc/ifc.go
@@ -0,0 +1,95 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package ifc holds miscellaneous interfaces used by kustomize.
+package ifc
+
+import (
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// Validator provides functions to validate annotations and labels
+type Validator interface {
+	MakeAnnotationValidator() func(map[string]string) error
+	MakeAnnotationNameValidator() func([]string) error
+	MakeLabelValidator() func(map[string]string) error
+	MakeLabelNameValidator() func([]string) error
+	ValidateNamespace(string) []string
+	ErrIfInvalidKey(string) error
+	IsEnvVarName(k string) error
+}
+
+// KvLoader reads and validates KV pairs.
+type KvLoader interface {
+	Validator() Validator
+	Load(args types.KvPairSources) (all []types.Pair, err error)
+}
+
+// Loader interface exposes methods to read bytes.
+type Loader interface {
+	// Root returns the root location for this Loader.
+	Root() string
+	// New returns Loader located at newRoot.
+	New(newRoot string) (Loader, error)
+	// Load returns the bytes read from the location or an error.
+	Load(location string) ([]byte, error)
+	// Cleanup cleans the loader
+	Cleanup() error
+}
+
+// Kunstructured allows manipulation of k8s objects
+// that do not have Golang structs.
+type Kunstructured interface {
+	Map() map[string]interface{}
+	SetMap(map[string]interface{})
+	Copy() Kunstructured
+	GetFieldValue(string) (interface{}, error)
+	GetString(string) (string, error)
+	GetStringSlice(string) ([]string, error)
+	GetBool(path string) (bool, error)
+	GetFloat64(path string) (float64, error)
+	GetInt64(path string) (int64, error)
+	GetSlice(path string) ([]interface{}, error)
+	GetStringMap(path string) (map[string]string, error)
+	GetMap(path string) (map[string]interface{}, error)
+	MarshalJSON() ([]byte, error)
+	UnmarshalJSON([]byte) error
+	GetGvk() resid.Gvk
+	SetGvk(resid.Gvk)
+	GetKind() string
+	GetName() string
+	SetName(string)
+	SetNamespace(string)
+	GetLabels() map[string]string
+	SetLabels(map[string]string)
+	GetAnnotations() map[string]string
+	SetAnnotations(map[string]string)
+	MatchesLabelSelector(selector string) (bool, error)
+	MatchesAnnotationSelector(selector string) (bool, error)
+	Patch(Kunstructured) error
+}
+
+// KunstructuredFactory makes instances of Kunstructured.
+type KunstructuredFactory interface {
+	SliceFromBytes([]byte) ([]Kunstructured, error)
+	FromMap(m map[string]interface{}) Kunstructured
+	Hasher() KunstructuredHasher
+	MakeConfigMap(
+		kvLdr KvLoader,
+		options *types.GeneratorOptions,
+		args *types.ConfigMapArgs) (Kunstructured, error)
+	MakeSecret(
+		kvLdr KvLoader,
+		options *types.GeneratorOptions,
+		args *types.SecretArgs) (Kunstructured, error)
+}
+
+// KunstructuredHasher returns a hash of the argument
+// or an error.
+type KunstructuredHasher interface {
+	Hash(Kunstructured) (string, error)
+}
+
+// See core.v1.SecretTypeOpaque
+const SecretTypeOpaque = "Opaque"
--- a/api/internal/accumulator/expansion/expand.go
+++ b/api/internal/accumulator/expansion/expand.go
@@ -1,24 +1,12 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 // Package expansion provides functions find and replace $(FOO) style variables in strings.
 package expansion

 import (
 	"bytes"
+	"fmt"
 )

 const (
@@ -36,15 +24,22 @@ func syntaxWrap(input string) string {
 // implements the expansion semantics defined in the expansion spec; it
 // returns the input string wrapped in the expansion syntax if no mapping
 // for the input is found.
-func MappingFuncFor(context ...map[string]string) func(string) string {
-	return func(input string) string {
+func MappingFuncFor(
+	counts map[string]int,
+	context ...map[string]interface{}) func(string) interface{} {
+	return func(input string) interface{} {
 		for _, vars := range context {
 			val, ok := vars[input]
 			if ok {
-				return val
+				counts[input]++
+				switch typedV := val.(type) {
+				case string, int64, float64, bool:
+					return typedV
+				default:
+					return syntaxWrap(input)
+				}
 			}
 		}
-
 		return syntaxWrap(input)
 	}
 }
@@ -52,7 +47,7 @@ func MappingFuncFor(context ...map[string]string) func(string) string {
 // Expand replaces variable references in the input string according to
 // the expansion spec using the given mapping function to resolve the
 // values of variables.
-func Expand(input string, mapping func(string) string) string {
+func Expand(input string, mapping func(string) interface{}) interface{} {
 	var buf bytes.Buffer
 	checkpoint := 0
 	for cursor := 0; cursor < len(input); cursor++ {
@@ -69,7 +64,14 @@ func Expand(input string, mapping func(string) string) string {
 				// We were able to read a variable name correctly;
 				// apply the mapping to the variable name and copy the
 				// bytes into the buffer
-				buf.WriteString(mapping(read))
+				mapped := mapping(read)
+				if input == syntaxWrap(read) {
+					// Preserve the type of variable
+					return mapped
+				}
+
+				// Variable is used in a middle of a string
+				buf.WriteString(fmt.Sprintf("%v", mapped))
 			} else {
 				// Not a variable name; copy the read bytes into the buffer
 				buf.WriteString(read)
--- a/api/internal/accumulator/expansion/expand_test.go
+++ b/api/internal/accumulator/expansion/expand_test.go
@@ -0,0 +1,365 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package expansion_test
+
+import (
+	"fmt"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+)
+
+type expected struct {
+	count  int
+	edited string
+}
+
+func TestMapReference(t *testing.T) {
+	type env struct {
+		Name  string
+		Value interface{}
+	}
+	envs := []env{
+		{
+			Name:  "FOO",
+			Value: "bar",
+		},
+		{
+			Name:  "ZOO",
+			Value: "$(FOO)-1",
+		},
+		{
+			Name:  "BLU",
+			Value: "$(ZOO)-2",
+		},
+		{
+			Name:  "INT",
+			Value: 2,
+		},
+		{
+			Name:  "ZINT",
+			Value: "$(INT)",
+		},
+		{
+			Name:  "BOOL",
+			Value: true,
+		},
+		{
+			Name:  "ZBOOL",
+			Value: "$(BOOL)",
+		},
+	}
+
+	declaredEnv := map[string]interface{}{
+		"FOO":   "bar",
+		"ZOO":   "$(FOO)-1",
+		"BLU":   "$(ZOO)-2",
+		"INT":   "2",
+		"ZINT":  "$(INT)",
+		"BOOL":  "true",
+		"ZBOOL": "$(BOOL)",
+	}
+
+	counts := make(map[string]int)
+	mapping := MappingFuncFor(counts, declaredEnv)
+
+	for _, env := range envs {
+		declaredEnv[env.Name] = Expand(fmt.Sprintf("%v", env.Value), mapping)
+	}
+
+	expectedEnv := map[string]expected{
+		"FOO":   {count: 1, edited: "bar"},
+		"ZOO":   {count: 1, edited: "bar-1"},
+		"BLU":   {count: 0, edited: "bar-1-2"},
+		"INT":   {count: 1, edited: "2"},
+		"ZINT":  {count: 0, edited: "2"},
+		"BOOL":  {count: 1, edited: "true"},
+		"ZBOOL": {count: 0, edited: "true"},
+	}
+
+	for k, v := range expectedEnv {
+		if e, a := v, declaredEnv[k]; e.edited != a || e.count != counts[k] {
+			t.Errorf("Expected %v count=%d, got %v count=%d",
+				e.edited, e.count, a, counts[k])
+		} else {
+			delete(declaredEnv, k)
+		}
+	}
+
+	if len(declaredEnv) != 0 {
+		t.Errorf("Unexpected keys in declared env: %v", declaredEnv)
+	}
+}
+
+func TestMapping(t *testing.T) {
+	context := map[string]interface{}{
+		"VAR_A":     "A",
+		"VAR_B":     "B",
+		"VAR_C":     "C",
+		"VAR_REF":   "$(VAR_A)",
+		"VAR_EMPTY": "",
+	}
+	doExpansionTest(t, context)
+}
+
+func TestMappingDual(t *testing.T) {
+	context := map[string]interface{}{
+		"VAR_A":     "A",
+		"VAR_EMPTY": "",
+	}
+	context2 := map[string]interface{}{
+		"VAR_B":   "B",
+		"VAR_C":   "C",
+		"VAR_REF": "$(VAR_A)",
+	}
+
+	doExpansionTest(t, context, context2)
+}
+
+func doExpansionTest(t *testing.T, context ...map[string]interface{}) {
+	cases := []struct {
+		name     string
+		input    string
+		expected string
+		counts   map[string]int
+	}{
+		{
+			name:     "whole string",
+			input:    "$(VAR_A)",
+			expected: "A",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "repeat",
+			input:    "$(VAR_A)-$(VAR_A)",
+			expected: "A-A",
+			counts:   map[string]int{"VAR_A": 2},
+		},
+		{
+			name:     "multiple repeats",
+			input:    "$(VAR_A)-$(VAR_B)-$(VAR_B)-$(VAR_B)-$(VAR_A)",
+			expected: "A-B-B-B-A",
+			counts:   map[string]int{"VAR_A": 2, "VAR_B": 3},
+		},
+		{
+			name:     "beginning",
+			input:    "$(VAR_A)-1",
+			expected: "A-1",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "middle",
+			input:    "___$(VAR_B)___",
+			expected: "___B___",
+			counts:   map[string]int{"VAR_B": 1},
+		},
+		{
+			name:     "end",
+			input:    "___$(VAR_C)",
+			expected: "___C",
+			counts:   map[string]int{"VAR_C": 1},
+		},
+		{
+			name:     "compound",
+			input:    "$(VAR_A)_$(VAR_B)_$(VAR_C)",
+			expected: "A_B_C",
+			counts:   map[string]int{"VAR_A": 1, "VAR_B": 1, "VAR_C": 1},
+		},
+		{
+			name:     "escape & expand",
+			input:    "$$(VAR_B)_$(VAR_A)",
+			expected: "$(VAR_B)_A",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "compound escape",
+			input:    "$$(VAR_A)_$$(VAR_B)",
+			expected: "$(VAR_A)_$(VAR_B)",
+		},
+		{
+			name:     "mixed in escapes",
+			input:    "f000-$$VAR_A",
+			expected: "f000-$VAR_A",
+		},
+		{
+			name:     "backslash escape ignored",
+			input:    "foo\\$(VAR_C)bar",
+			expected: "foo\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
+		},
+		{
+			name:     "backslash escape ignored",
+			input:    "foo\\\\$(VAR_C)bar",
+			expected: "foo\\\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
+		},
+		{
+			name:     "lots of backslashes",
+			input:    "foo\\\\\\\\$(VAR_A)bar",
+			expected: "foo\\\\\\\\Abar",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "nested var references",
+			input:    "$(VAR_A$(VAR_B))",
+			expected: "$(VAR_A$(VAR_B))",
+		},
+		{
+			name:     "nested var references second type",
+			input:    "$(VAR_A$(VAR_B)",
+			expected: "$(VAR_A$(VAR_B)",
+		},
+		{
+			name:     "value is a reference",
+			input:    "$(VAR_REF)",
+			expected: "$(VAR_A)",
+			counts:   map[string]int{"VAR_REF": 1},
+		},
+		{
+			name:     "value is a reference x 2",
+			input:    "%%$(VAR_REF)--$(VAR_REF)%%",
+			expected: "%%$(VAR_A)--$(VAR_A)%%",
+			counts:   map[string]int{"VAR_REF": 2},
+		},
+		{
+			name:     "empty var",
+			input:    "foo$(VAR_EMPTY)bar",
+			expected: "foobar",
+			counts:   map[string]int{"VAR_EMPTY": 1},
+		},
+		{
+			name:     "unterminated expression",
+			input:    "foo$(VAR_Awhoops!",
+			expected: "foo$(VAR_Awhoops!",
+		},
+		{
+			name:     "expression without operator",
+			input:    "f00__(VAR_A)__",
+			expected: "f00__(VAR_A)__",
+		},
+		{
+			name:     "shell special vars pass through",
+			input:    "$?_boo_$!",
+			expected: "$?_boo_$!",
+		},
+		{
+			name:     "bare operators are ignored",
+			input:    "$VAR_A",
+			expected: "$VAR_A",
+		},
+		{
+			name:     "undefined vars are passed through",
+			input:    "$(VAR_DNE)",
+			expected: "$(VAR_DNE)",
+		},
+		{
+			name:     "multiple (even) operators, var undefined",
+			input:    "$$$$$$(BIG_MONEY)",
+			expected: "$$$(BIG_MONEY)",
+		},
+		{
+			name:     "multiple (even) operators, var defined",
+			input:    "$$$$$$(VAR_A)",
+			expected: "$$$(VAR_A)",
+		},
+		{
+			name:     "multiple (odd) operators, var undefined",
+			input:    "$$$$$$$(GOOD_ODDS)",
+			expected: "$$$$(GOOD_ODDS)",
+		},
+		{
+			name:     "multiple (odd) operators, var defined",
+			input:    "$$$$$$$(VAR_A)",
+			expected: "$$$A",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "missing open expression",
+			input:    "$VAR_A)",
+			expected: "$VAR_A)",
+		},
+		{
+			name:     "shell syntax ignored",
+			input:    "${VAR_A}",
+			expected: "${VAR_A}",
+		},
+		{
+			name:     "trailing incomplete expression not consumed",
+			input:    "$(VAR_B)_______$(A",
+			expected: "B_______$(A",
+			counts:   map[string]int{"VAR_B": 1},
+		},
+		{
+			name:     "trailing incomplete expression, no content, is not consumed",
+			input:    "$(VAR_C)_______$(",
+			expected: "C_______$(",
+			counts:   map[string]int{"VAR_C": 1},
+		},
+		{
+			name:     "operator at end of input string is preserved",
+			input:    "$(VAR_A)foobarzab$",
+			expected: "Afoobarzab$",
+			counts:   map[string]int{"VAR_A": 1},
+		},
+		{
+			name:     "shell escaped incomplete expr",
+			input:    "foo-\\$(VAR_A",
+			expected: "foo-\\$(VAR_A",
+		},
+		{
+			name:     "lots of $( in middle",
+			input:    "--$($($($($--",
+			expected: "--$($($($($--",
+		},
+		{
+			name:     "lots of $( in beginning",
+			input:    "$($($($($--foo$(",
+			expected: "$($($($($--foo$(",
+		},
+		{
+			name:     "lots of $( at end",
+			input:    "foo0--$($($($(",
+			expected: "foo0--$($($($(",
+		},
+		{
+			name:     "escaped operators in variable names are not escaped",
+			input:    "$(foo$$var)",
+			expected: "$(foo$$var)",
+		},
+		{
+			name:     "newline not expanded",
+			input:    "\n",
+			expected: "\n",
+		},
+	}
+
+	for _, tc := range cases {
+		counts := make(map[string]int)
+		mapping := MappingFuncFor(counts, context...)
+		expanded := Expand(fmt.Sprintf("%v", tc.input), mapping)
+		if e, a := tc.expected, expanded; e != a {
+			t.Errorf("%v: expected %q, got %q", tc.name, e, a)
+		}
+		if len(counts) != len(tc.counts) {
+			t.Errorf("%v: len(counts)=%d != len(tc.counts)=%d",
+				tc.name, len(counts), len(tc.counts))
+		}
+		if len(tc.counts) > 0 {
+			for k, expectedCount := range tc.counts {
+				c, ok := counts[k]
+				if ok {
+					if c != expectedCount {
+						t.Errorf(
+							"%v: k=%s, expected count %d, got %d",
+							tc.name, k, expectedCount, c)
+					}
+				} else {
+					t.Errorf(
+						"%v: k=%s, expected count %d, got zero",
+						tc.name, k, expectedCount)
+				}
+			}
+		}
+	}
+}
--- a/api/internal/accumulator/loadconfigfromcrds.go
+++ b/api/internal/accumulator/loadconfigfromcrds.go
@@ -0,0 +1,190 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/go-openapi/spec"
+	"github.com/pkg/errors"
+	"k8s.io/kube-openapi/pkg/common"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type myProperties map[string]spec.Schema
+type nameToApiMap map[string]common.OpenAPIDefinition
+
+// LoadConfigFromCRDs parse CRD schemas from paths into a TransformerConfig
+func LoadConfigFromCRDs(
+	ldr ifc.Loader, paths []string) (*builtinconfig.TransformerConfig, error) {
+	tc := builtinconfig.MakeEmptyConfig()
+	for _, path := range paths {
+		content, err := ldr.Load(path)
+		if err != nil {
+			return nil, err
+		}
+		m, err := makeNameToApiMap(content)
+		if err != nil {
+			return nil, errors.Wrapf(err, "unable to parse open API definition from '%s'", path)
+		}
+		otherTc, err := makeConfigFromApiMap(m)
+		if err != nil {
+			return nil, err
+		}
+		tc, err = tc.Merge(otherTc)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return tc, nil
+}
+
+func makeNameToApiMap(content []byte) (result nameToApiMap, err error) {
+	if content[0] == '{' {
+		err = json.Unmarshal(content, &result)
+	} else {
+		err = yaml.Unmarshal(content, &result)
+	}
+	return
+}
+
+func makeConfigFromApiMap(m nameToApiMap) (*builtinconfig.TransformerConfig, error) {
+	result := builtinconfig.MakeEmptyConfig()
+	for name, api := range m {
+		if !looksLikeAk8sType(api.Schema.SchemaProps.Properties) {
+			continue
+		}
+		tc := builtinconfig.MakeEmptyConfig()
+		err := loadCrdIntoConfig(
+			tc, makeGvkFromTypeName(name), m, name, []string{})
+		if err != nil {
+			return result, err
+		}
+		result, err = result.Merge(tc)
+		if err != nil {
+			return result, err
+		}
+	}
+	return result, nil
+}
+
+// TODO: Get Group and Version for CRD from the
+// openAPI definition once
+// "x-kubernetes-group-version-kind" is available in CRD
+func makeGvkFromTypeName(n string) resid.Gvk {
+	names := strings.Split(n, ".")
+	kind := names[len(names)-1]
+	return resid.Gvk{Kind: kind}
+}
+
+func looksLikeAk8sType(properties myProperties) bool {
+	_, ok := properties["kind"]
+	if !ok {
+		return false
+	}
+	_, ok = properties["apiVersion"]
+	if !ok {
+		return false
+	}
+	_, ok = properties["metadata"]
+	if !ok {
+		return false
+	}
+	return true
+}
+
+const (
+	// "x-kubernetes-annotation": ""
+	xAnnotation = "x-kubernetes-annotation"
+
+	// "x-kubernetes-label-selector": ""
+	xLabelSelector = "x-kubernetes-label-selector"
+
+	// "x-kubernetes-identity": ""
+	xIdentity = "x-kubernetes-identity"
+
+	// "x-kubernetes-object-ref-api-version": <apiVersion name>
+	xVersion = "x-kubernetes-object-ref-api-version"
+
+	// "x-kubernetes-object-ref-kind": <kind name>
+	xKind = "x-kubernetes-object-ref-kind"
+
+	// "x-kubernetes-object-ref-name-key": "name"
+	// default is "name"
+	xNameKey = "x-kubernetes-object-ref-name-key"
+)
+
+// loadCrdIntoConfig loads a CRD spec into a TransformerConfig
+func loadCrdIntoConfig(
+	theConfig *builtinconfig.TransformerConfig, theGvk resid.Gvk, theMap nameToApiMap,
+	typeName string, path []string) (err error) {
+	api, ok := theMap[typeName]
+	if !ok {
+		return nil
+	}
+	for propName, property := range api.Schema.SchemaProps.Properties {
+		_, annotate := property.Extensions.GetString(xAnnotation)
+		if annotate {
+			err = theConfig.AddAnnotationFieldSpec(
+				makeFs(theGvk, append(path, propName)))
+			if err != nil {
+				return
+			}
+		}
+		_, label := property.Extensions.GetString(xLabelSelector)
+		if label {
+			err = theConfig.AddLabelFieldSpec(
+				makeFs(theGvk, append(path, propName)))
+			if err != nil {
+				return
+			}
+		}
+		_, identity := property.Extensions.GetString(xIdentity)
+		if identity {
+			err = theConfig.AddPrefixFieldSpec(
+				makeFs(theGvk, append(path, propName)))
+			if err != nil {
+				return
+			}
+		}
+		version, ok := property.Extensions.GetString(xVersion)
+		if ok {
+			kind, ok := property.Extensions.GetString(xKind)
+			if ok {
+				nameKey, ok := property.Extensions.GetString(xNameKey)
+				if !ok {
+					nameKey = "name"
+				}
+				err = theConfig.AddNamereferenceFieldSpec(
+					builtinconfig.NameBackReferences{
+						Gvk: resid.Gvk{Kind: kind, Version: version},
+						FieldSpecs: []types.FieldSpec{
+							makeFs(theGvk, append(path, propName, nameKey))},
+					})
+				if err != nil {
+					return
+				}
+			}
+		}
+		if property.Ref.GetURL() != nil {
+			loadCrdIntoConfig(
+				theConfig, theGvk, theMap,
+				property.Ref.String(), append(path, propName))
+		}
+	}
+	return nil
+}
+
+func makeFs(in resid.Gvk, path []string) types.FieldSpec {
+	return types.FieldSpec{
+		CreateIfNotPresent: false,
+		Gvk:                in,
+		Path:               strings.Join(path, "/"),
+	}
+}
--- a/api/internal/accumulator/loadconfigfromcrds_test.go
+++ b/api/internal/accumulator/loadconfigfromcrds_test.go
@@ -0,0 +1,182 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator_test
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	. "sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/internal/loadertest"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// This defines two CRD's:  Bee and MyKind.
+//
+// Bee is boring, it's spec has no dependencies.
+//
+// MyKind, however, has a spec that contains
+// a Bee and a (k8s native) Secret.
+const (
+	crdContent = `
+{
+	"github.com/example/pkg/apis/jingfang/v1beta1.Bee": {
+		"Schema": {
+			"description": "Bee",
+			"properties": {
+				"apiVersion": {
+					"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert 
+recognized schemas to the latest internal value, and may reject unrecognized values. 
+More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
+					"type": "string"
+				},
+				"kind": {
+					"description": "Kind is a string value representing the REST resource this object represents. Servers may infer
+this from the endpoint the client submits requests to. Cannot be updated. In CamelCase.
+More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
+					"type": "string"
+				},
+				"metadata": {
+					"$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+				},
+				"spec": {
+					"$ref": "github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec"
+				},
+				"status": {
+					"$ref": "github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus"
+				}
+			}
+		},
+		"Dependencies": [
+			"github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec",
+			"github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus",
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+		]
+	},
+	"github.com/example/pkg/apis/jingfang/v1beta1.BeeSpec": {
+		"Schema": {
+			"description": "BeeSpec defines the desired state of Bee"
+		},
+		"Dependencies": []
+	},
+	"github.com/example/pkg/apis/jingfang/v1beta1.BeeStatus": {
+		"Schema": {
+			"description": "BeeStatus defines the observed state of Bee"
+		},
+		"Dependencies": []
+	},
+	"github.com/example/pkg/apis/jingfang/v1beta1.MyKind": {
+		"Schema": {
+			"description": "MyKind",
+			"properties": {
+				"apiVersion": {
+					"description": "APIVersion defines the versioned schema of this representation of an object.
+Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values.
+More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
+					"type": "string"
+				},
+				"kind": {
+					"description": "Kind is a string value representing the REST resource this object represents.
+Servers may infer this from the endpoint the client submits requests to. Cannot be updated.
+In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
+					"type": "string"
+				},
+				"metadata": {
+					"$ref": "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+				},
+				"spec": {
+					"$ref": "github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec"
+				},
+				"status": {
+					"$ref": "github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus"
+				}
+			}
+		},
+		"Dependencies": [
+			"github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec",
+			"github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus",
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"
+		]
+	},
+	"github.com/example/pkg/apis/jingfang/v1beta1.MyKindSpec": {
+		"Schema": {
+			"description": "MyKindSpec defines the desired state of MyKind",
+			"properties": {
+				"beeRef": {
+					"x-kubernetes-object-ref-api-version": "v1beta1",
+					"x-kubernetes-object-ref-kind": "Bee",
+					"$ref": "github.com/example/pkg/apis/jingfang/v1beta1.Bee"
+				},
+				"secretRef": {
+					"description": "If defined, we use this secret for configuring the MYSQL_ROOT_PASSWORD 
+If it is not set we generate a secret dynamically",
+					"x-kubernetes-object-ref-api-version": "v1",
+					"x-kubernetes-object-ref-kind": "Secret",
+					"$ref": "k8s.io/api/core/v1.LocalObjectReference"
+				}
+			}
+		},
+		"Dependencies": [
+			"github.com/example/pkg/apis/jingfang/v1beta1.Bee",
+			"k8s.io/api/core/v1.LocalObjectReference"
+		]
+	},
+	"github.com/example/pkg/apis/jingfang/v1beta1.MyKindStatus": {
+		"Schema": {
+			"description": "MyKindStatus defines the observed state of MyKind"
+		},
+		"Dependencies": []
+	}
+}
+`
+)
+
+func makeLoader(t *testing.T) ifc.Loader {
+	ldr := loadertest.NewFakeLoader("/testpath")
+	err := ldr.AddFile("/testpath/crd.json", []byte(crdContent))
+	if err != nil {
+		t.Fatalf("Failed to setup fake ldr.")
+	}
+	return ldr
+}
+
+func TestLoadCRDs(t *testing.T) {
+	nbrs := []builtinconfig.NameBackReferences{
+		{
+			Gvk: resid.Gvk{Kind: "Secret", Version: "v1"},
+			FieldSpecs: []types.FieldSpec{
+				{
+					CreateIfNotPresent: false,
+					Gvk:                resid.Gvk{Kind: "MyKind"},
+					Path:               "spec/secretRef/name",
+				},
+			},
+		},
+		{
+			Gvk: resid.Gvk{Kind: "Bee", Version: "v1beta1"},
+			FieldSpecs: []types.FieldSpec{
+				{
+					CreateIfNotPresent: false,
+					Gvk:                resid.Gvk{Kind: "MyKind"},
+					Path:               "spec/beeRef/name",
+				},
+			},
+		},
+	}
+
+	expectedTc := &builtinconfig.TransformerConfig{
+		NameReference: nbrs,
+	}
+
+	actualTc, err := LoadConfigFromCRDs(makeLoader(t), []string{"crd.json"})
+	if err != nil {
+		t.Fatalf("unexpected error:%v", err)
+	}
+	if !reflect.DeepEqual(actualTc, expectedTc) {
+		t.Fatalf("expected\n %v\n but got\n %v\n", expectedTc, actualTc)
+	}
+}
--- a/api/internal/accumulator/namereferencetransformer.go
+++ b/api/internal/accumulator/namereferencetransformer.go
@@ -0,0 +1,274 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+	"log"
+
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/transform"
+)
+
+type nameReferenceTransformer struct {
+	backRefs []builtinconfig.NameBackReferences
+}
+
+var _ resmap.Transformer = &nameReferenceTransformer{}
+
+// newNameReferenceTransformer constructs a nameReferenceTransformer
+// with a given slice of NameBackReferences.
+func newNameReferenceTransformer(br []builtinconfig.NameBackReferences) resmap.Transformer {
+	if br == nil {
+		log.Fatal("backrefs not expected to be nil")
+	}
+	return &nameReferenceTransformer{backRefs: br}
+}
+
+// Transform updates name references in resource A that
+// refer to resource B, given that B's name may have
+// changed.
+//
+// For example, a HorizontalPodAutoscaler (HPA)
+// necessarily refers to a Deployment, the thing that
+// the HPA scales. The Deployment name might change
+// (e.g. prefix added), and the reference in the HPA
+// has to be fixed.
+//
+// In the outer loop over the ResMap below, say we
+// encounter a specific HPA. Then, in scanning backrefs,
+// we encounter an entry like
+//
+//   - kind: Deployment
+//     fieldSpecs:
+//     - kind: HorizontalPodAutoscaler
+//       path: spec/scaleTargetRef/name
+//
+// This entry says that an HPA, via its
+// 'spec/scaleTargetRef/name' field, may refer to a
+// Deployment.  This match to HPA means we may need to
+// modify the value in its 'spec/scaleTargetRef/name'
+// field, by searching for the thing it refers to,
+// and getting its new name.
+//
+// As a filter, and search optimization, we compute a
+// subset of all resources that the HPA could refer to,
+// by excluding objects from other namespaces, and
+// excluding objects that don't have the same prefix-
+// suffix mods as the HPA.
+//
+// We look in this subset for all Deployment objects
+// with a resId that has a Name matching the field value
+// present in the HPA.  If no match do nothing; if more
+// than one match, it's an error.
+//
+// We overwrite the HPA name field with the value found
+// in the Deployment's name field (the name in the raw
+// object - the modified name - not the unmodified name
+// in the Deployment's resId).
+//
+// This process assumes that the name stored in a ResId
+// (the ResMap key) isn't modified by name transformers.
+// Name transformers should only modify the name in the
+// body of the resource object (the value in the ResMap).
+//
+func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
+	// TODO: Too much looping, here and in transitive calls.
+	for _, referrer := range m.Resources() {
+		var candidates resmap.ResMap
+		for _, target := range o.backRefs {
+			for _, fSpec := range target.FieldSpecs {
+				if referrer.OrgId().IsSelected(&fSpec.Gvk) {
+					if candidates == nil {
+						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
+					}
+					err := transform.MutateField(
+						referrer.Map(),
+						fSpec.PathSlice(),
+						fSpec.CreateIfNotPresent,
+						o.getNewNameFunc(
+							// referrer could be an HPA instance,
+							// target could be Gvk for Deployment,
+							// candidate a list of resources "reachable"
+							// from the HPA.
+							referrer, target.Gvk, candidates))
+					if err != nil {
+						return err
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// selectReferral picks the referral among a subset of candidates.
+// It returns the current name and namespace of the selected candidate.
+// Note that the content of the referricalCandidateSubset slice is most of the time
+// identical to the referralCandidates resmap. Still in some cases, such
+// as ClusterRoleBinding, the subset only contains the resources of a specific
+// namespace.
+func (o *nameReferenceTransformer) selectReferral(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (interface{}, interface{}, error) {
+
+	for _, res := range referralCandidateSubset {
+		id := res.OrgId()
+		if id.IsSelected(&target) && res.GetOriginalName() == oldName {
+			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
+			// If there's more than one match, there's no way
+			// to know which one to pick, so emit error.
+			if len(matches) > 1 {
+				return nil, nil, fmt.Errorf(
+					"multiple matches for %s:\n  %v",
+					id, getIds(matches))
+			}
+			// In the resource, note that it is referenced
+			// by the referrer.
+			res.AppendRefBy(referrer.CurId())
+			// Return transformed name of the object,
+			// complete with prefixes, hashes, etc.
+			return res.GetName(), res.GetNamespace(), nil
+		}
+	}
+
+	return oldName, nil, nil
+}
+
+// utility function to replace a simple string by the new name
+func (o *nameReferenceTransformer) getSimpleNameField(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (interface{}, error) {
+
+	newName, _, err := o.selectReferral(oldName, referrer, target,
+		referralCandidates, referralCandidateSubset)
+
+	return newName, err
+}
+
+// utility function to replace name field within a map[string]interface{}
+// and leverage the namespace field.
+func (o *nameReferenceTransformer) getNameAndNsStruct(
+	inMap map[string]interface{},
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap) (interface{}, error) {
+
+	// Example:
+	if _, ok := inMap["name"]; !ok {
+		return nil, fmt.Errorf(
+			"%#v is expected to contain a name field", inMap)
+	}
+	oldName, ok := inMap["name"].(string)
+	if !ok {
+		return nil, fmt.Errorf(
+			"%#v is expected to contain a name field of type string", oldName)
+	}
+
+	subset := referralCandidates.Resources()
+	if namespacevalue, ok := inMap["namespace"]; ok {
+		namespace := namespacevalue.(string)
+		bynamespace := referralCandidates.GroupedByOriginalNamespace()
+		if _, ok := bynamespace[namespace]; !ok {
+			return inMap, nil
+		}
+		subset = bynamespace[namespace]
+	}
+
+	newname, newnamespace, err := o.selectReferral(oldName, referrer, target,
+		referralCandidates, subset)
+	if err != nil {
+		return nil, err
+	}
+
+	if (newname == oldName) && (newnamespace == nil) {
+		// no candidate found.
+		return inMap, nil
+	}
+
+	inMap["name"] = newname
+	if newnamespace != "" {
+		// We don't want value "" to replace value "default" since
+		// the empty string is handled as a wild card here not default namespace
+		// by kubernetes.
+		inMap["namespace"] = newnamespace
+	}
+	return inMap, nil
+
+}
+
+func (o *nameReferenceTransformer) getNewNameFunc(
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap) func(in interface{}) (interface{}, error) {
+	return func(in interface{}) (interface{}, error) {
+		switch in.(type) {
+		case string:
+			oldName, _ := in.(string)
+			return o.getSimpleNameField(oldName, referrer, target,
+				referralCandidates, referralCandidates.Resources())
+		case map[string]interface{}:
+			// Kind: ValidatingWebhookConfiguration
+			// FieldSpec is webhooks/clientConfig/service
+			oldMap, _ := in.(map[string]interface{})
+			return o.getNameAndNsStruct(oldMap, referrer, target,
+				referralCandidates)
+		case []interface{}:
+			l, _ := in.([]interface{})
+			for idx, item := range l {
+				switch item.(type) {
+				case string:
+					// Kind: Role/ClusterRole
+					// FieldSpec is rules.resourceNames
+					oldName, _ := item.(string)
+					newName, err := o.getSimpleNameField(oldName, referrer, target,
+						referralCandidates, referralCandidates.Resources())
+					if err != nil {
+						return nil, err
+					}
+					l[idx] = newName
+				case map[string]interface{}:
+					// Kind: RoleBinding/ClusterRoleBinding
+					// FieldSpec is subjects
+					// Note: The corresponding fieldSpec had been changed from
+					// from path: subjects/name to just path: subjects. This is
+					// what get mutatefield to request the mapping of the whole
+					// map containing namespace and name instead of just a simple
+					// string field containing the name
+					oldMap, _ := item.(map[string]interface{})
+					newMap, err := o.getNameAndNsStruct(oldMap, referrer, target,
+						referralCandidates)
+					if err != nil {
+						return nil, err
+					}
+					l[idx] = newMap
+				default:
+					return nil, fmt.Errorf(
+						"%#v is expected to be either a []string or a []map[string]interface{}", in)
+				}
+			}
+			return in, nil
+		default:
+			return nil, fmt.Errorf(
+				"%#v is expected to be either a string or a []interface{}", in)
+		}
+	}
+}
+
+func getIds(rs []*resource.Resource) []string {
+	var result []string
+	for _, r := range rs {
+		result = append(result, r.CurId().String()+"\n")
+	}
+	return result
+}
--- a/api/internal/accumulator/namereferencetransformer_test.go
+++ b/api/internal/accumulator/namereferencetransformer_test.go
--- a/api/internal/accumulator/refvartransformer.go
+++ b/api/internal/accumulator/refvartransformer.go
@@ -0,0 +1,110 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+type refVarTransformer struct {
+	varMap            map[string]interface{}
+	replacementCounts map[string]int
+	fieldSpecs        []types.FieldSpec
+	mappingFunc       func(string) interface{}
+}
+
+// newRefVarTransformer returns a new refVarTransformer
+// that replaces $(VAR) style variables with values.
+// The fieldSpecs are the places to look for occurrences of $(VAR).
+func newRefVarTransformer(
+	varMap map[string]interface{}, fs []types.FieldSpec) *refVarTransformer {
+	return &refVarTransformer{
+		varMap:     varMap,
+		fieldSpecs: fs,
+	}
+}
+
+// replaceVars accepts as 'in' a string, or string array, which can have
+// embedded instances of $VAR style variables, e.g. a container command string.
+// The function returns the string with the variables expanded to their final
+// values.
+func (rv *refVarTransformer) replaceVars(in interface{}) (interface{}, error) {
+	switch vt := in.(type) {
+	case []interface{}:
+		var xs []interface{}
+		for _, a := range in.([]interface{}) {
+			xs = append(xs, expansion2.Expand(a.(string), rv.mappingFunc))
+		}
+		return xs, nil
+	case map[string]interface{}:
+		inMap := in.(map[string]interface{})
+		xs := make(map[string]interface{}, len(inMap))
+		for k, v := range inMap {
+			s, ok := v.(string)
+			if !ok {
+				// This field not contain a $(VAR) since it is not
+				// of string type. For instance .spec.replicas: 3 in
+				// a Deployment object
+				xs[k] = v
+			} else {
+				// This field can potentially contains a $(VAR) since it is
+				// of string type. For instance .spec.replicas: $(REPLICAS)
+				// in a Deployment object
+				xs[k] = expansion2.Expand(s, rv.mappingFunc)
+			}
+		}
+		return xs, nil
+	case interface{}:
+		s, ok := in.(string)
+		if !ok {
+			// This field not contain a $(VAR) since it is not of string type.
+			return in, nil
+		}
+		// This field can potentially contain a $(VAR) since it is
+		// of string type.
+		return expansion2.Expand(s, rv.mappingFunc), nil
+	case nil:
+		return nil, nil
+	default:
+		return "", fmt.Errorf("invalid type encountered %T", vt)
+	}
+}
+
+// UnusedVars returns slice of Var names that were unused
+// after a Transform run.
+func (rv *refVarTransformer) UnusedVars() []string {
+	var unused []string
+	for k := range rv.varMap {
+		_, ok := rv.replacementCounts[k]
+		if !ok {
+			unused = append(unused, k)
+		}
+	}
+	return unused
+}
+
+// Transform replaces $(VAR) style variables with values.
+func (rv *refVarTransformer) Transform(m resmap.ResMap) error {
+	rv.replacementCounts = make(map[string]int)
+	rv.mappingFunc = expansion2.MappingFuncFor(
+		rv.replacementCounts, rv.varMap)
+	for _, res := range m.Resources() {
+		for _, fieldSpec := range rv.fieldSpecs {
+			if res.OrgId().IsSelected(&fieldSpec.Gvk) {
+				if err := transform.MutateField(
+					res.Map(), fieldSpec.PathSlice(),
+					false, rv.replaceVars); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
--- a/api/internal/accumulator/refvartransformer_test.go
+++ b/api/internal/accumulator/refvartransformer_test.go
@@ -0,0 +1,137 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/testutils/resmaptest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestRefVarTransformer(t *testing.T) {
+	type given struct {
+		varMap map[string]interface{}
+		fs     []types.FieldSpec
+		res    resmap.ResMap
+	}
+	type expected struct {
+		res    resmap.ResMap
+		unused []string
+	}
+	testCases := []struct {
+		description string
+		given       given
+		expected    expected
+	}{
+		{
+			description: "var replacement in map[string]",
+			given: given{
+				varMap: map[string]interface{}{
+					"FOO": "replacementForFoo",
+					"BAR": "replacementForBar",
+					"BAZ": int64(5),
+					"BOO": true,
+				},
+				fs: []types.FieldSpec{
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/map"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/interface"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/num"},
+				},
+				res: resmaptest_test.NewRmBuilder(
+					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"map": map[string]interface{}{
+								"item1": "$(FOO)",
+								"item2": "bla",
+								"item3": "$(BAZ)",
+								"item4": "$(BAZ)+$(BAZ)",
+								"item5": "$(BOO)",
+								"item6": "if $(BOO)",
+								"item7": 2019,
+							},
+							"slice": []interface{}{
+								"$(FOO)",
+								"bla",
+								"$(BAZ)",
+								"$(BAZ)+$(BAZ)",
+								"$(BOO)",
+								"if $(BOO)",
+							},
+							"interface": "$(FOO)",
+							"nil":       nil,
+							"num":       2019,
+						}}).ResMap(),
+			},
+			expected: expected{
+				res: resmaptest_test.NewRmBuilder(
+					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"map": map[string]interface{}{
+								"item1": "replacementForFoo",
+								"item2": "bla",
+								"item3": int64(5),
+								"item4": "5+5",
+								"item5": true,
+								"item6": "if true",
+								"item7": 2019,
+							},
+							"slice": []interface{}{
+								"replacementForFoo",
+								"bla",
+								int64(5),
+								"5+5",
+								true,
+								"if true",
+							},
+							"interface": "replacementForFoo",
+							"nil":       nil,
+							"num":       2019,
+						}}).ResMap(),
+				unused: []string{"BAR"},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			// arrange
+			tr := newRefVarTransformer(tc.given.varMap, tc.given.fs)
+
+			// act
+			err := tr.Transform(tc.given.res)
+
+			// assert
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+
+			a, e := tc.given.res, tc.expected.res
+			if !reflect.DeepEqual(a, e) {
+				err = e.ErrorIfNotEqualLists(a)
+				t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+			}
+
+		})
+	}
+}
--- a/api/internal/accumulator/resaccumulator.go
+++ b/api/internal/accumulator/resaccumulator.go
@@ -0,0 +1,166 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// ResAccumulator accumulates resources and the rules
+// used to customize those resources.  It's a ResMap
+// plus stuff needed to modify the ResMap.
+type ResAccumulator struct {
+	resMap  resmap.ResMap
+	tConfig *builtinconfig.TransformerConfig
+	varSet  types.VarSet
+}
+
+func MakeEmptyAccumulator() *ResAccumulator {
+	ra := &ResAccumulator{}
+	ra.resMap = resmap.New()
+	ra.tConfig = &builtinconfig.TransformerConfig{}
+	ra.varSet = types.NewVarSet()
+	return ra
+}
+
+// ResMap returns a copy of the internal resMap.
+func (ra *ResAccumulator) ResMap() resmap.ResMap {
+	return ra.resMap.ShallowCopy()
+}
+
+// Vars returns a copy of underlying vars.
+func (ra *ResAccumulator) Vars() []types.Var {
+	return ra.varSet.AsSlice()
+}
+
+func (ra *ResAccumulator) AppendAll(
+	resources resmap.ResMap) error {
+	return ra.resMap.AppendAll(resources)
+}
+
+func (ra *ResAccumulator) AbsorbAll(
+	resources resmap.ResMap) error {
+	return ra.resMap.AbsorbAll(resources)
+}
+
+func (ra *ResAccumulator) MergeConfig(
+	tConfig *builtinconfig.TransformerConfig) (err error) {
+	ra.tConfig, err = ra.tConfig.Merge(tConfig)
+	return err
+}
+
+func (ra *ResAccumulator) GetTransformerConfig() *builtinconfig.TransformerConfig {
+	return ra.tConfig
+}
+
+func (ra *ResAccumulator) MergeVars(incoming []types.Var) error {
+	for _, v := range incoming {
+		targetId := resid.NewResIdWithNamespace(v.ObjRef.GVK(), v.ObjRef.Name, v.ObjRef.Namespace)
+		idMatcher := targetId.GvknEquals
+		if targetId.Namespace != "" || !targetId.IsNamespaceableKind() {
+			// Preserve backward compatibility. An empty namespace means
+			// wildcard search on the namespace hence we still use GvknEquals
+			idMatcher = targetId.Equals
+		}
+		matched := ra.resMap.GetMatchingResourcesByOriginalId(idMatcher)
+		if len(matched) > 1 {
+			return fmt.Errorf(
+				"found %d resId matches for var %s "+
+					"(unable to disambiguate)",
+				len(matched), v)
+		}
+		if len(matched) == 1 {
+			matched[0].AppendRefVarName(v)
+		}
+	}
+	return ra.varSet.MergeSlice(incoming)
+}
+
+func (ra *ResAccumulator) MergeAccumulator(other *ResAccumulator) (err error) {
+	err = ra.AppendAll(other.resMap)
+	if err != nil {
+		return err
+	}
+	err = ra.MergeConfig(other.tConfig)
+	if err != nil {
+		return err
+	}
+	return ra.varSet.MergeSet(other.varSet)
+}
+
+func (ra *ResAccumulator) findVarValueFromResources(v types.Var) (interface{}, error) {
+	for _, res := range ra.resMap.Resources() {
+		for _, varName := range res.GetRefVarNames() {
+			if varName == v.Name {
+				s, err := res.GetFieldValue(v.FieldRef.FieldPath)
+				if err != nil {
+					return "", fmt.Errorf(
+						"field specified in var '%v' "+
+							"not found in corresponding resource", v)
+				}
+
+				return s, nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf(
+		"var '%v' cannot be mapped to a field "+
+			"in the set of known resources", v)
+}
+
+// makeVarReplacementMap returns a map of Var names to
+// their final values. The values are strings intended
+// for substitution wherever the $(var.Name) occurs.
+func (ra *ResAccumulator) makeVarReplacementMap() (map[string]interface{}, error) {
+	result := map[string]interface{}{}
+	for _, v := range ra.Vars() {
+		s, err := ra.findVarValueFromResources(v)
+		if err != nil {
+			return nil, err
+		}
+
+		result[v.Name] = s
+	}
+
+	return result, nil
+}
+
+func (ra *ResAccumulator) Transform(t resmap.Transformer) error {
+	return t.Transform(ra.resMap)
+}
+
+func (ra *ResAccumulator) ResolveVars() error {
+	replacementMap, err := ra.makeVarReplacementMap()
+	if err != nil {
+		return err
+	}
+	if len(replacementMap) == 0 {
+		return nil
+	}
+	t := newRefVarTransformer(
+		replacementMap, ra.tConfig.VarReference)
+	err = ra.Transform(t)
+	if len(t.UnusedVars()) > 0 {
+		log.Printf(
+			"well-defined vars that were never replaced: %s\n",
+			strings.Join(t.UnusedVars(), ","))
+	}
+	return err
+}
+
+func (ra *ResAccumulator) FixBackReferences() (err error) {
+	if ra.tConfig.NameReference == nil {
+		return nil
+	}
+	return ra.Transform(newNameReferenceTransformer(
+		ra.tConfig.NameReference))
+}
--- a/api/internal/accumulator/resaccumulator_test.go
+++ b/api/internal/accumulator/resaccumulator_test.go
@@ -0,0 +1,417 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"strings"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/testutils/resmaptest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
+	ra := MakeEmptyAccumulator()
+	err := ra.MergeConfig(builtinconfig.MakeDefaultConfig())
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	rf := resource.NewFactory(
+		kunstruct.NewKunstructuredFactoryImpl())
+	err = ra.AppendAll(
+		resmaptest_test.NewRmBuilder(t, rf).
+			Add(map[string]interface{}{
+				"apiVersion": "apps/v1",
+				"kind":       "Deployment",
+				"metadata": map[string]interface{}{
+					"name": "deploy1",
+				},
+				"spec": map[string]interface{}{
+					"template": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"containers": []interface{}{
+								map[string]interface{}{
+									"command": []interface{}{
+										"myserver",
+										"--somebackendService $(SERVICE_ONE)",
+										"--yetAnother $(SERVICE_TWO)",
+									},
+								},
+							},
+						},
+					},
+				}}).
+			Add(map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendOne",
+				}}).
+			Add(map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendTwo",
+				}}).ResMap())
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	return ra, rf
+}
+
+func TestResolveVarsHappy(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_TWO",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother backendTwo" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func TestResolveVarsOneUnused(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_UNUSED",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	expectLog(t, buf, "well-defined vars that were never replaced: SERVICE_UNUSED")
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother $(SERVICE_TWO)" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func expectLog(t *testing.T, log bytes.Buffer, expect string) {
+	if !strings.Contains(log.String(), expect) {
+		t.Fatalf("expected log containing '%s', got '%s'", expect, log.String())
+	}
+}
+
+func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
+	ra, rf := makeResAccumulator(t)
+
+	rm0 := resmap.New()
+	err := rm0.Append(
+		rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name":      "backendOne",
+					"namespace": "fooNamespace",
+				},
+			}))
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.AppendAll(rm0)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(), "unable to disambiguate") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func makeNamespacedConfigMapWithDataProviderValue(
+	namespace string,
+	value string,
+) map[string]interface{} {
+	return map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "ConfigMap",
+		"metadata": map[string]interface{}{
+			"name":      "environment",
+			"namespace": namespace,
+		},
+		"data": map[string]interface{}{
+			"provider": value,
+		},
+	}
+}
+
+func makeVarToNamepaceAndPath(
+	name string,
+	namespace string,
+	path string,
+) types.Var {
+	return types.Var{
+		Name: name,
+		ObjRef: types.Target{
+			Gvk:       resid.Gvk{Version: "v1", Kind: "ConfigMap"},
+			Name:      "environment",
+			Namespace: namespace,
+		},
+		FieldRef: types.FieldSelector{FieldPath: path},
+	}
+}
+
+func TestResolveVarConflicts(t *testing.T) {
+	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+
+	// create configmaps in foo and bar namespaces with `data.provider` values.
+	fooAws := makeNamespacedConfigMapWithDataProviderValue("foo", "aws")
+	barAws := makeNamespacedConfigMapWithDataProviderValue("bar", "aws")
+	barGcp := makeNamespacedConfigMapWithDataProviderValue("bar", "gcp")
+
+	// create two variables with (apparently) conflicting names that point to
+	// fieldpaths that could be generalized.
+	varFoo := makeVarToNamepaceAndPath("PROVIDER", "foo", "data.provider")
+	varBar := makeVarToNamepaceAndPath("PROVIDER", "bar", "data.provider")
+
+	// create accumulators holding apparently conflicting vars that are not
+	// actually in conflict because they point to the same concrete value.
+	rm0 := resmap.New()
+	rm0.Append(rf.FromMap(fooAws))
+	ac0 := MakeEmptyAccumulator()
+	ac0.AppendAll(rm0)
+	ac0.MergeVars([]types.Var{varFoo})
+
+	rm1 := resmap.New()
+	rm1.Append(rf.FromMap(barAws))
+	ac1 := MakeEmptyAccumulator()
+	ac1.AppendAll(rm1)
+	ac1.MergeVars([]types.Var{varBar})
+
+	// validate that two vars of the same name which reference the same concrete
+	// value do not produce a conflict.
+	err := ac0.MergeAccumulator(ac1)
+	if err == nil {
+		t.Fatalf("see bug gh-1600")
+	}
+
+	// create an accumulator will have an actually conflicting value with the
+	// two above (because it contains a variable whose name is used in the other
+	// accumulators AND whose concrete values are different).
+	rm2 := resmap.New()
+	rm2.Append(rf.FromMap(barGcp))
+	ac2 := MakeEmptyAccumulator()
+	ac2.AppendAll(rm2)
+	ac2.MergeVars([]types.Var{varBar})
+	err = ac1.MergeAccumulator(ac2)
+	if err == nil {
+		t.Fatalf("dupe vars w/ different concrete values should conflict")
+	}
+}
+
+func TestResolveVarsGoodResIdBadField(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+			FieldRef: types.FieldSelector{FieldPath: "nope_nope_nope"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"not found in corresponding resource") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsUnmappableVar(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_THREE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "doesNotExist"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"cannot be mapped to a field in the set of known resources") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsWithNoambiguation(t *testing.T) {
+	ra1, rf := makeResAccumulator(t)
+	err := ra1.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	// Create another accumulator having a resource with different prefix
+	ra2 := MakeEmptyAccumulator()
+
+	m := resmaptest_test.NewRmBuilder(t, rf).
+		Add(map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name": "deploy2",
+			},
+			"spec": map[string]interface{}{
+				"template": map[string]interface{}{
+					"spec": map[string]interface{}{
+						"containers": []interface{}{
+							map[string]interface{}{
+								"command": []interface{}{
+									"myserver",
+									"--somebackendService $(SUB_SERVICE_ONE)",
+								},
+							},
+						},
+					},
+				},
+			}}).
+		Add(map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]interface{}{
+				"name": "backendOne",
+			}}).ResMap()
+
+	// Make it seem like this resource
+	// went through a prefix transformer.
+	r := m.GetByIndex(1)
+	r.AddNamePrefix("sub-")
+	r.SetName("sub-backendOne") // original name remains "backendOne"
+
+	err = ra2.AppendAll(m)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra2.MergeVars([]types.Var{
+		{
+			Name: "SUB_SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra1.MergeAccumulator(ra2)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra1.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func find(name string, resMap resmap.ResMap) *resource.Resource {
+	for _, r := range resMap.Resources() {
+		if r.GetName() == name {
+			return r
+		}
+	}
+	return nil
+}
+
+// Assumes arg is a deployment, returns the command of first container.
+func getCommand(r *resource.Resource) string {
+	var m map[string]interface{}
+	var c []interface{}
+	m, _ = r.Map()["spec"].(map[string]interface{})
+	m, _ = m["template"].(map[string]interface{})
+	m, _ = m["spec"].(map[string]interface{})
+	c, _ = m["containers"].([]interface{})
+	m, _ = c[0].(map[string]interface{})
+
+	cmd, _ := m["command"].([]interface{})
+	n := make([]string, len(cmd))
+	for i, v := range cmd {
+		n[i] = v.(string)
+	}
+	return strings.Join(n, " ")
+}
--- a/api/internal/kusterr/yamlformaterror.go
+++ b/api/internal/kusterr/yamlformaterror.go
@@ -0,0 +1,35 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package error has contextual error types.
+package kusterr
+
+import (
+	"fmt"
+	"strings"
+)
+
+// YamlFormatError represents error with yaml file name where json/yaml format error happens.
+type YamlFormatError struct {
+	Path     string
+	ErrorMsg string
+}
+
+func (e YamlFormatError) Error() string {
+	return fmt.Sprintf("YAML file [%s] encounters a format error.\n%s\n", e.Path, e.ErrorMsg)
+}
+
+// Handler handles YamlFormatError
+func Handler(e error, path string) error {
+	if isYAMLSyntaxError(e) {
+		return YamlFormatError{
+			Path:     path,
+			ErrorMsg: e.Error(),
+		}
+	}
+	return e
+}
+
+func isYAMLSyntaxError(e error) bool {
+	return strings.Contains(e.Error(), "error converting YAML to JSON") || strings.Contains(e.Error(), "error unmarshaling JSON")
+}
--- a/api/internal/kusterr/yamlformaterror_test.go
+++ b/api/internal/kusterr/yamlformaterror_test.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kusterr
+
+import (
+	"fmt"
+	"testing"
+)
+
+const (
+	filepath = "/path/to/whatever"
+	expected = "YAML file [/path/to/whatever] encounters a format error.\n" +
+		"error converting YAML to JSON: yaml: line 2: found character that cannot start any token\n"
+)
+
+func TestYamlFormatError_Error(t *testing.T) {
+	testErr := YamlFormatError{
+		Path:     filepath,
+		ErrorMsg: "error converting YAML to JSON: yaml: line 2: found character that cannot start any token",
+	}
+	if testErr.Error() != expected {
+		t.Errorf("Expected : %s\n, but found : %s\n", expected, testErr.Error())
+	}
+}
+
+func TestErrorHandler(t *testing.T) {
+	err := fmt.Errorf("error converting YAML to JSON: yaml: line 2: found character that cannot start any token")
+	testErr := Handler(err, filepath)
+	expectedErr := fmt.Errorf("format error message")
+	fmtErr := Handler(expectedErr, filepath)
+	if fmtErr.Error() != expectedErr.Error() {
+		t.Errorf("Expected returning fmt.Error, but found %T", fmtErr)
+	}
+	if _, ok := testErr.(YamlFormatError); !ok {
+		t.Errorf("Expected returning YamlFormatError, but found %T", testErr)
+	}
+	if testErr == nil || testErr.Error() != expected {
+		t.Errorf("Expected : %s\n, but found : %s\n", expected, testErr.Error())
+	}
+}
--- a/api/internal/loadertest/fakeloader.go
+++ b/api/internal/loadertest/fakeloader.go
@@ -0,0 +1,76 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package loadertest holds a fake for the Loader interface.
+package loadertest
+
+import (
+	"log"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/loader"
+)
+
+// FakeLoader encapsulates the delegate Loader and the fake file system.
+type FakeLoader struct {
+	fs       filesys.FileSystem
+	delegate ifc.Loader
+}
+
+// NewFakeLoader returns a Loader that uses a fake filesystem.
+// The loader will be restricted to root only.
+// The initialDir argument should be an absolute file path.
+func NewFakeLoader(initialDir string) FakeLoader {
+	return NewFakeLoaderWithRestrictor(
+		loader.RestrictionRootOnly, initialDir)
+}
+
+// NewFakeLoaderWithRestrictor returns a Loader that
+// uses a fake filesystem.
+// The initialDir argument should be an absolute file path.
+func NewFakeLoaderWithRestrictor(
+	lr loader.LoadRestrictorFunc, initialDir string) FakeLoader {
+	// Create fake filesystem and inject it into initial Loader.
+	fSys := filesys.MakeFsInMemory()
+	fSys.Mkdir(initialDir)
+	ldr, err := loader.NewLoader(lr, initialDir, fSys)
+	if err != nil {
+		log.Fatalf("Unable to make loader: %v", err)
+	}
+	return FakeLoader{fs: fSys, delegate: ldr}
+}
+
+// AddFile adds a fake file to the file system.
+func (f FakeLoader) AddFile(fullFilePath string, content []byte) error {
+	return f.fs.WriteFile(fullFilePath, content)
+}
+
+// AddDirectory adds a fake directory to the file system.
+func (f FakeLoader) AddDirectory(fullDirPath string) error {
+	return f.fs.Mkdir(fullDirPath)
+}
+
+// Root delegates.
+func (f FakeLoader) Root() string {
+	return f.delegate.Root()
+}
+
+// New creates a new loader from a new root.
+func (f FakeLoader) New(newRoot string) (ifc.Loader, error) {
+	l, err := f.delegate.New(newRoot)
+	if err != nil {
+		return nil, err
+	}
+	return FakeLoader{fs: f.fs, delegate: l}, nil
+}
+
+// Load delegates.
+func (f FakeLoader) Load(location string) ([]byte, error) {
+	return f.delegate.Load(location)
+}
+
+// Cleanup delegates.
+func (f FakeLoader) Cleanup() error {
+	return f.delegate.Cleanup()
+}
--- a/api/inventory/constants.go
+++ b/api/inventory/constants.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory
+
+const (
+	// Annotation that contains the inventory content.
+	ContentAnnotation = "kustomize.config.k8s.io/Inventory"
+
+	// Annotation for inventory content hash.
+	HashAnnotation = "kustomize.config.k8s.io/InventoryHash"
+)
--- a/api/inventory/inventory.go
+++ b/api/inventory/inventory.go
@@ -0,0 +1,235 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory
+
+import (
+	"encoding/json"
+
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+//Refs is a reference map.  Each key is the id
+//of a k8s resource, and each value is a list of
+//object ids that refer back to the object in the
+//key.
+
+//For example, the key could correspond to a
+//ConfigMap, and the list of values might include
+//several different Deployments that get data from
+//that ConfigMap (and thus refer to it).
+
+//References are important in inventory management
+//because one may not delete an object before all
+//objects referencing it have been removed.
+type Refs map[resid.ResId][]resid.ResId
+
+func NewRefs() Refs {
+	return Refs{}
+}
+
+// Merge merges a Refs into an existing Refs
+func (rf Refs) Merge(b Refs) Refs {
+	for key, value := range b {
+		_, ok := rf[key]
+		if ok {
+			rf[key] = append(rf[key], value...)
+		} else {
+			rf[key] = value
+		}
+	}
+	return rf
+}
+
+// removeIfContains removes the reference relationship
+//  a --> b
+// from the Refs if it exists
+func (rf Refs) RemoveIfContains(a, b resid.ResId) {
+	refs, ok := rf[a]
+	if !ok {
+		return
+	}
+	for i, ref := range refs {
+		if ref.Equals(b) {
+			rf[a] = append(refs[:i], refs[i+1:]...)
+			break
+		}
+	}
+}
+
+//Inventory is a an object intended for
+//serialization into the annotations of a so-called
+//apply-root object (a ConfigMap, an Application,
+//etc.) living in the cluster.  This apply-root
+//object is written as part of an apply operation as
+//a means to record overall cluster state changes.
+
+//At the end of a successful apply, the "current"
+//field in Inventory will be a map whose keys all
+//correspond to an object in the cluster, and
+//"previous" will be the previous such set (an empty
+//set on the first apply).
+
+//An Inventory allows the Prune method to work.
+type Inventory struct {
+	Current  Refs `json:"current,omitempty"`
+	Previous Refs `json:"previous,omitempty"`
+}
+
+// NewInventory returns an Inventory object
+func NewInventory() *Inventory {
+	return &Inventory{
+		Current:  NewRefs(),
+		Previous: NewRefs(),
+	}
+}
+
+// UpdateCurrent updates the Inventory given a
+// new current Refs
+// The existing Current refs is merged into
+// the Previous refs
+func (a *Inventory) UpdateCurrent(curref Refs) *Inventory {
+	if len(a.Previous) > 0 {
+		a.Previous.Merge(a.Current)
+	} else {
+		a.Previous = a.Current
+	}
+	a.Current = curref
+	return a
+}
+
+func (a *Inventory) removeNewlyOrphanedItemsFromPrevious() []resid.ResId {
+	var results []resid.ResId
+	for item, refs := range a.Previous {
+		if _, ok := a.Current[item]; ok {
+			delete(a.Previous, item)
+			continue
+		}
+
+		var newRefs []resid.ResId
+		toDelete := true
+		for _, ref := range refs {
+			if _, ok := a.Current[ref]; ok {
+				toDelete = false
+				newRefs = append(newRefs, ref)
+			}
+		}
+		if toDelete {
+			results = append(results, item)
+			delete(a.Previous, item)
+		} else {
+			a.Previous[item] = newRefs
+		}
+	}
+	return results
+}
+
+func (a *Inventory) removeOrphanedItemsFromPreviousThatAreNotInCurrent() []resid.ResId {
+	var results []resid.ResId
+	for item, refs := range a.Previous {
+		if _, ok := a.Current[item]; ok {
+			continue
+		}
+		if len(refs) == 0 {
+			results = append(results, item)
+			delete(a.Previous, item)
+		}
+	}
+	return results
+}
+
+func (a *Inventory) removeOrphanedItemsFromPreviousThatAreInCurrent() {
+	//Remove references from Previous that are already in Current refs
+	for item, refs := range a.Current {
+		for _, ref := range refs {
+			a.Previous.RemoveIfContains(item, ref)
+		}
+	}
+	//Remove items from Previous that are already in Current refs
+	for item, refs := range a.Previous {
+		if len(refs) == 0 {
+			if _, ok := a.Current[item]; ok {
+				delete(a.Previous, item)
+			}
+		}
+	}
+}
+
+// Prune computes the diff of Current refs and Previous refs
+// and returns a list of Items that can be pruned.
+// An item that can be pruned shows up only in Previous refs.
+// Prune also updates the Previous refs with those items removed
+func (a *Inventory) Prune() []resid.ResId {
+	a.removeOrphanedItemsFromPreviousThatAreInCurrent()
+
+	// These are candidates for deletion from the cluster.
+	removable1 := a.removeOrphanedItemsFromPreviousThatAreNotInCurrent()
+	removable2 := a.removeNewlyOrphanedItemsFromPrevious()
+	return append(removable1, removable2...)
+}
+
+// inventory is the internal type used for serialization
+type inventory struct {
+	Current  map[string][]resid.ResId `json:"current,omitempty"`
+	Previous map[string][]resid.ResId `json:"previous,omitempty"`
+}
+
+func (a *Inventory) toInternalType() inventory {
+	prev := map[string][]resid.ResId{}
+	curr := map[string][]resid.ResId{}
+	for id, refs := range a.Current {
+		curr[id.String()] = refs
+	}
+	for id, refs := range a.Previous {
+		prev[id.String()] = refs
+	}
+	return inventory{
+		Current:  curr,
+		Previous: prev,
+	}
+}
+
+func (a *Inventory) fromInternalType(i *inventory) {
+	for s, refs := range i.Previous {
+		a.Previous[resid.FromString(s)] = refs
+	}
+	for s, refs := range i.Current {
+		a.Current[resid.FromString(s)] = refs
+	}
+}
+
+func (a *Inventory) marshal() ([]byte, error) {
+	return json.Marshal(a.toInternalType())
+}
+
+func (a *Inventory) unMarshal(data []byte) error {
+	inv := &inventory{
+		Current:  map[string][]resid.ResId{},
+		Previous: map[string][]resid.ResId{},
+	}
+	err := json.Unmarshal(data, inv)
+	if err != nil {
+		return err
+	}
+	a.fromInternalType(inv)
+	return nil
+}
+
+// UpdateAnnotations update the annotation map
+func (a *Inventory) UpdateAnnotations(annot map[string]string) error {
+	data, err := a.marshal()
+	if err != nil {
+		return err
+	}
+	annot[ContentAnnotation] = string(data)
+	return nil
+}
+
+// LoadFromAnnotation loads the Inventory date from the annotation map
+func (a *Inventory) LoadFromAnnotation(annot map[string]string) error {
+	value, ok := annot[ContentAnnotation]
+	if ok {
+		return a.unMarshal([]byte(value))
+	}
+	return nil
+}
--- a/api/inventory/inventory_test.go
+++ b/api/inventory/inventory_test.go
@@ -0,0 +1,60 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/inventory"
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+func makeRefs() (Refs, Refs) {
+	a := resid.FromString("G1_V1_K1|ns1|nm1")
+	b := resid.FromString("G2_V2_K2|ns2|nm2")
+	c := resid.FromString("G3_V3_K3|ns3|nm3")
+	current := NewRefs()
+	current[a] = []resid.ResId{b, c}
+	current[b] = []resid.ResId{}
+	current[c] = []resid.ResId{}
+	newRefs := NewRefs()
+	newRefs[a] = []resid.ResId{b}
+	newRefs[b] = []resid.ResId{}
+	return current, newRefs
+}
+
+func TestInventory(t *testing.T) {
+	inventory := NewInventory()
+	curref, _ := makeRefs()
+
+	inventory.UpdateCurrent(curref)
+	if len(inventory.Current) != 3 {
+		t.Fatalf("not getting the correct inventory %v", inventory)
+	}
+	curref, newref := makeRefs()
+	inventory.UpdateCurrent(curref)
+	if len(inventory.Current) != 3 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+	if len(inventory.Previous) != 3 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+
+	items := inventory.Prune()
+	if len(items) != 0 {
+		t.Fatalf("not getting the corrent items %v", items)
+	}
+	if len(inventory.Previous) != 0 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+
+	inventory.UpdateCurrent(newref)
+	items = inventory.Prune()
+	if len(items) != 1 {
+		t.Fatalf("not getting the corrent items %v", items)
+	}
+	if len(inventory.Previous) != 0 {
+		t.Fatalf("not getting the corrent inventory %v", inventory.Previous)
+	}
+}
--- a/api/k8sdeps/configmapandsecret/configmapfactory.go
+++ b/api/k8sdeps/configmapandsecret/configmapfactory.go
@@ -0,0 +1,72 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package configmapandsecret generates configmaps and secrets per generator rules.
+package configmapandsecret
+
+import (
+	"fmt"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"k8s.io/api/core/v1"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeFreshConfigMap(
+	args *types.ConfigMapArgs) *v1.ConfigMap {
+	cm := &v1.ConfigMap{}
+	cm.APIVersion = "v1"
+	cm.Kind = "ConfigMap"
+	cm.Name = args.Name
+	cm.Namespace = args.Namespace
+	cm.Data = map[string]string{}
+	return cm
+}
+
+// MakeConfigMap returns a new ConfigMap, or nil and an error.
+func (f *Factory) MakeConfigMap(
+	args *types.ConfigMapArgs) (*v1.ConfigMap, error) {
+	all, err := f.kvLdr.Load(args.KvPairSources)
+	if err != nil {
+		return nil, errors.Wrap(err, "loading KV pairs")
+	}
+	cm := makeFreshConfigMap(args)
+	for _, p := range all {
+		err = f.addKvToConfigMap(cm, p)
+		if err != nil {
+			return nil, errors.Wrap(err, "trouble mapping")
+		}
+	}
+	if f.options != nil {
+		cm.SetLabels(f.options.Labels)
+		cm.SetAnnotations(f.options.Annotations)
+	}
+	return cm, nil
+}
+
+// addKvToConfigMap adds the given key and data to the given config map.
+// Error if key invalid, or already exists.
+func (f *Factory) addKvToConfigMap(configMap *v1.ConfigMap, p types.Pair) error {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(p.Key); err != nil {
+		return err
+	}
+	// If the configmap data contains byte sequences that are all in the UTF-8
+	// range, we will write it to .Data
+	if utf8.Valid([]byte(p.Value)) {
+		if _, entryExists := configMap.Data[p.Key]; entryExists {
+			return fmt.Errorf(keyExistsErrorMsg, p.Key, configMap.Data)
+		}
+		configMap.Data[p.Key] = p.Value
+		return nil
+	}
+	// otherwise, it's BinaryData
+	if configMap.BinaryData == nil {
+		configMap.BinaryData = map[string][]byte{}
+	}
+	if _, entryExists := configMap.BinaryData[p.Key]; entryExists {
+		return fmt.Errorf(keyExistsErrorMsg, p.Key, configMap.BinaryData)
+	}
+	configMap.BinaryData[p.Key] = []byte(p.Value)
+	return nil
+}
--- a/api/k8sdeps/configmapandsecret/configmapfactory_test.go
+++ b/api/k8sdeps/configmapandsecret/configmapfactory_test.go
@@ -0,0 +1,158 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeEnvConfigMap(name string) *corev1.ConfigMap {
+	return &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "ConfigMap",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string]string{
+			"DB_USERNAME": "admin",
+			"DB_PASSWORD": "somepw",
+		},
+	}
+}
+
+func makeFileConfigMap(name string) *corev1.ConfigMap {
+	return &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "ConfigMap",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string]string{
+			"app-init.ini": `FOO=bar
+BAR=baz
+`,
+		},
+		BinaryData: map[string][]byte{
+			"app.bin": {0xff, 0xfd},
+		},
+	}
+}
+
+func makeLiteralConfigMap(name string) *corev1.ConfigMap {
+	cm := &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "ConfigMap",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string]string{
+			"a": "x",
+			"b": "y",
+			"c": "Hello World",
+			"d": "true",
+		},
+	}
+	cm.SetLabels(map[string]string{"foo": "bar"})
+	return cm
+}
+
+func TestConstructConfigMap(t *testing.T) {
+	type testCase struct {
+		description string
+		input       types.ConfigMapArgs
+		options     *types.GeneratorOptions
+		expected    *corev1.ConfigMap
+	}
+
+	testCases := []testCase{
+		{
+			description: "construct config map from env",
+			input: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envConfigMap",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("configmap", "app.env"),
+						},
+					},
+				},
+			},
+			options:  nil,
+			expected: makeEnvConfigMap("envConfigMap"),
+		},
+		{
+			description: "construct config map from file",
+			input: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileConfigMap",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+							filepath.Join("configmap", "app.bin"),
+						},
+					},
+				},
+			},
+			options:  nil,
+			expected: makeFileConfigMap("fileConfigMap"),
+		},
+		{
+			description: "construct config map from literal",
+			input: types.ConfigMapArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalConfigMap",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
+					},
+				},
+			},
+			options: &types.GeneratorOptions{
+				Labels: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: makeLiteralConfigMap("literalConfigMap"),
+		},
+	}
+
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.bin"),
+		[]byte{0xff, 0xfd})
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+	for _, tc := range testCases {
+		f := NewFactory(kvLdr, tc.options)
+		cm, err := f.MakeConfigMap(&tc.input)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(*cm, *tc.expected) {
+			t.Fatalf("in testcase: %q updated:\n%#v\ndoesn't match expected:\n%#v\n", tc.description, *cm, tc.expected)
+		}
+	}
+}
--- a/api/k8sdeps/configmapandsecret/factory.go
+++ b/api/k8sdeps/configmapandsecret/factory.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// Factory makes ConfigMaps and Secrets.
+type Factory struct {
+	kvLdr   ifc.KvLoader
+	options *types.GeneratorOptions
+}
+
+// NewFactory returns a new factory that makes ConfigMaps and Secrets.
+func NewFactory(
+	kvLdr ifc.KvLoader, o *types.GeneratorOptions) *Factory {
+	return &Factory{kvLdr: kvLdr, options: o}
+}
+
+const keyExistsErrorMsg = "cannot add key %s, another key by that name already exists: %v"
--- a/api/k8sdeps/configmapandsecret/secretfactory.go
+++ b/api/k8sdeps/configmapandsecret/secretfactory.go
@@ -0,0 +1,58 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeFreshSecret(
+	args *types.SecretArgs) *corev1.Secret {
+	s := &corev1.Secret{}
+	s.APIVersion = "v1"
+	s.Kind = "Secret"
+	s.Name = args.Name
+	s.Namespace = args.Namespace
+	s.Type = corev1.SecretType(args.Type)
+	if s.Type == "" {
+		s.Type = corev1.SecretTypeOpaque
+	}
+	s.Data = map[string][]byte{}
+	return s
+}
+
+// MakeSecret returns a new secret.
+func (f *Factory) MakeSecret(
+	args *types.SecretArgs) (*corev1.Secret, error) {
+	all, err := f.kvLdr.Load(args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	s := makeFreshSecret(args)
+	for _, p := range all {
+		err = f.addKvToSecret(s, p.Key, p.Value)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if f.options != nil {
+		s.SetLabels(f.options.Labels)
+		s.SetAnnotations(f.options.Annotations)
+	}
+	return s, nil
+}
+
+func (f *Factory) addKvToSecret(secret *corev1.Secret, keyName, data string) error {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(keyName); err != nil {
+		return err
+	}
+	if _, entryExists := secret.Data[keyName]; entryExists {
+		return fmt.Errorf(keyExistsErrorMsg, keyName, secret.Data)
+	}
+	secret.Data[keyName] = []byte(data)
+	return nil
+}
--- a/api/k8sdeps/configmapandsecret/secretfactory_test.go
+++ b/api/k8sdeps/configmapandsecret/secretfactory_test.go
@@ -0,0 +1,143 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"reflect"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeEnvSecret(name string) *corev1.Secret {
+	return &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string][]byte{
+			"DB_PASSWORD": []byte("somepw"),
+			"DB_USERNAME": []byte("admin"),
+		},
+		Type: "Opaque",
+	}
+}
+
+func makeFileSecret(name string) *corev1.Secret {
+	return &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string][]byte{
+			"app-init.ini": []byte(`FOO=bar
+BAR=baz
+`),
+		},
+		Type: "Opaque",
+	}
+}
+
+func makeLiteralSecret(name string) *corev1.Secret {
+	s := &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Data: map[string][]byte{
+			"a": []byte("x"),
+			"b": []byte("y"),
+		},
+		Type: "Opaque",
+	}
+	s.SetLabels(map[string]string{"foo": "bar"})
+	return s
+}
+
+func TestConstructSecret(t *testing.T) {
+	type testCase struct {
+		description string
+		input       types.SecretArgs
+		options     *types.GeneratorOptions
+		expected    *corev1.Secret
+	}
+
+	testCases := []testCase{
+		{
+			description: "construct secret from env",
+			input: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "envSecret",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{"secret/app.env"},
+					},
+				},
+			},
+			options:  nil,
+			expected: makeEnvSecret("envSecret"),
+		},
+		{
+			description: "construct secret from file",
+			input: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "fileSecret",
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{"secret/app-init.ini"},
+					},
+				},
+			},
+			options:  nil,
+			expected: makeFileSecret("fileSecret"),
+		},
+		{
+			description: "construct secret from literal",
+			input: types.SecretArgs{
+				GeneratorArgs: types.GeneratorArgs{
+					Name: "literalSecret",
+					KvPairSources: types.KvPairSources{
+						LiteralSources: []string{"a=x", "b=y"},
+					},
+				},
+			},
+			options: &types.GeneratorOptions{
+				Labels: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: makeLiteralSecret("literalSecret"),
+		},
+	}
+
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile("/secret/app.env", []byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
+	fSys.WriteFile("/secret/app-init.ini", []byte("FOO=bar\nBAR=baz\n"))
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
+	for _, tc := range testCases {
+		f := NewFactory(kvLdr, tc.options)
+		cm, err := f.MakeSecret(&tc.input)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(*cm, *tc.expected) {
+			t.Fatalf("in testcase: %q updated:\n%#v\ndoesn't match expected:\n%#v\n", tc.description, *cm, tc.expected)
+		}
+	}
+}
--- a/api/k8sdeps/doc.go
+++ b/api/k8sdeps/doc.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// It's possible that kustomize's features will be vendored into
+// the kubernetes/kubernetes repo and made available to kubectl
+// commands, while at the same time the kustomize program will
+// continue to exist as an independent CLI.  Vendoring snapshots
+// would be taken just before a kubectl release.
+//
+// This creates a problem in that freestanding-kustomize depends on
+// (for example):
+//
+//   https://github.com/kubernetes/apimachinery/
+//       tree/master/pkg/util/yaml
+//
+// It vendors that package into
+//   sigs.k8s.io/kustomize/vendor/k8s.io/apimachinery/
+//
+// Whereas kubectl-kustomize would have to depend on the "staging"
+// version of this code, located at
+//
+//   https://github.com/kubernetes/kubernetes/
+//       blob/master/staging/src/k8s.io/apimachinery/pkg/util/yaml
+//
+// which is "vendored" via symlinks:
+//   k8s.io/kubernetes/vendor/k8s.io/apimachinery
+// is a symlink to
+//   ../../staging/src/k8s.io/apimachinery
+//
+// The staging version is the canonical, under-development
+// version of the code that kubectl depends on, whereas the packages
+// at kubernetes/apimachinery are periodic snapshots of staging made
+// for outside tools to depend on.
+//
+// apimachinery isn't the only package that poses this problem, just
+// using it as a specific example.
+//
+// The kubectl binary cannot vendor in kustomize code that in
+// turn vendors in the non-staging packages.
+//
+// One way to fix some of this would be to copy code - a hard fork.
+// This has all the problems associated with a hard forking.
+//
+// Another way would be to break the kustomize repo into three:
+//
+// (1) kustomize - repo with the main() function,
+//     vendoring (2) and (3).
+//
+// (2) kustomize-libs - packages used by (1) with no
+//     apimachinery dependence.
+//
+// (3) kustomize-k8sdeps - A thin code layer that depends
+//     on (vendors) apimachinery to provide thin implementations
+//     to interfaces used in (2).
+//
+// The kubectl repo would then vendor from (2) only, and have
+// a local implementation of (3).  With that in mind, it's clear
+// that (3) doesn't have to be a repo; the kustomize version of
+// the thin layer can live directly in (1).
+//
+// This package is the code in (3), meant for kustomize.
+
+package k8sdeps
--- a/api/k8sdeps/kunstruct/factory.go
+++ b/api/k8sdeps/kunstruct/factory.go
@@ -0,0 +1,138 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/yaml"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/k8sdeps/configmapandsecret"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// KunstructuredFactoryImpl hides construction using apimachinery types.
+type KunstructuredFactoryImpl struct {
+	hasher *kustHash
+}
+
+var _ ifc.KunstructuredFactory = &KunstructuredFactoryImpl{}
+
+// NewKunstructuredFactoryImpl returns a factory.
+func NewKunstructuredFactoryImpl() ifc.KunstructuredFactory {
+	return &KunstructuredFactoryImpl{hasher: NewKustHash()}
+}
+
+// Hasher returns a kunstructured hasher
+// input: kunstructured; output: string hash.
+func (kf *KunstructuredFactoryImpl) Hasher() ifc.KunstructuredHasher {
+	return kf.hasher
+}
+
+// SliceFromBytes returns a slice of Kunstructured.
+func (kf *KunstructuredFactoryImpl) SliceFromBytes(
+	in []byte) ([]ifc.Kunstructured, error) {
+	decoder := yaml.NewYAMLOrJSONDecoder(bytes.NewReader(in), 1024)
+	var result []ifc.Kunstructured
+	var err error
+	for err == nil || isEmptyYamlError(err) {
+		var out unstructured.Unstructured
+		err = decoder.Decode(&out)
+		if err == nil {
+			if len(out.Object) == 0 {
+				continue
+			}
+			err = kf.validate(out)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, &UnstructAdapter{Unstructured: out})
+		}
+	}
+	if err != io.EOF {
+		return nil, err
+	}
+	return result, nil
+}
+
+func isEmptyYamlError(err error) bool {
+	return strings.Contains(err.Error(), "is missing in 'null'")
+}
+
+// FromMap returns an instance of Kunstructured.
+func (kf *KunstructuredFactoryImpl) FromMap(
+	m map[string]interface{}) ifc.Kunstructured {
+	return &UnstructAdapter{Unstructured: unstructured.Unstructured{Object: m}}
+}
+
+// MakeConfigMap returns an instance of Kunstructured for ConfigMap
+func (kf *KunstructuredFactoryImpl) MakeConfigMap(
+	kvLdr ifc.KvLoader,
+	options *types.GeneratorOptions,
+	args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
+	o, err := configmapandsecret.NewFactory(
+		kvLdr, options).MakeConfigMap(args)
+	if err != nil {
+		return nil, err
+	}
+	return NewKunstructuredFromObject(o)
+}
+
+// MakeSecret returns an instance of Kunstructured for Secret
+func (kf *KunstructuredFactoryImpl) MakeSecret(
+	kvLdr ifc.KvLoader,
+	options *types.GeneratorOptions,
+	args *types.SecretArgs) (ifc.Kunstructured, error) {
+	o, err := configmapandsecret.NewFactory(
+		kvLdr, options).MakeSecret(args)
+	if err != nil {
+		return nil, err
+	}
+	return NewKunstructuredFromObject(o)
+}
+
+// validate validates that u has kind and name
+// except for kind `List`, which doesn't require a name
+func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error {
+	kind := u.GetKind()
+	if kind == "" {
+		return fmt.Errorf("missing kind in object %v", u)
+	} else if strings.HasSuffix(kind, "List") {
+		return nil
+	}
+	if u.GetName() == "" {
+		return fmt.Errorf("missing metadata.name in object %v", u)
+	}
+
+	if result, path := checkListItemNil(u.Object); result {
+		return fmt.Errorf("empty item at %v in object %v", path, u)
+	}
+	return nil
+}
+
+func checkListItemNil(in interface{}) (bool, string) {
+	switch v := in.(type) {
+	case map[string]interface{}:
+		for key, s := range v {
+			if result, path := checkListItemNil(s); result {
+				return result, key + "/" + path
+			}
+		}
+	case []interface{}:
+		for index, s := range v {
+			if s == nil {
+				return true, ""
+			}
+			if result, path := checkListItemNil(s); result {
+				return result, "[" + strconv.Itoa(index) + "]/" + path
+			}
+		}
+	}
+	return false, ""
+}
--- a/api/k8sdeps/kunstruct/factory_test.go
+++ b/api/k8sdeps/kunstruct/factory_test.go
@@ -0,0 +1,218 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kunstruct
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+func TestSliceFromBytes(t *testing.T) {
+	factory := NewKunstructuredFactoryImpl()
+	testConfigMap := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "winnie",
+			},
+		})
+	testList := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "List",
+			"items": []interface{}{
+				testConfigMap.Map(),
+				testConfigMap.Map(),
+			},
+		})
+	testConfigMapList := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMapList",
+			"items": []interface{}{
+				testConfigMap.Map(),
+				testConfigMap.Map(),
+			},
+		})
+
+	tests := []struct {
+		name        string
+		input       []byte
+		expectedOut []ifc.Kunstructured
+		expectedErr bool
+	}{
+		{
+			name:        "garbage",
+			input:       []byte("garbageIn: garbageOut"),
+			expectedOut: []ifc.Kunstructured{},
+			expectedErr: true,
+		},
+		{
+			name:        "noBytes",
+			input:       []byte{},
+			expectedOut: []ifc.Kunstructured{},
+			expectedErr: false,
+		},
+		{
+			name: "goodJson",
+			input: []byte(`
+{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie"}}
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMap},
+			expectedErr: false,
+		},
+		{
+			name: "goodYaml1",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMap},
+			expectedErr: false,
+		},
+		{
+			name: "goodYaml2",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMap, testConfigMap},
+			expectedErr: false,
+		},
+		{
+			name: "garbageInOneOfTwoObjects",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: winnie
+---
+WOOOOOOOOOOOOOOOOOOOOOOOOT:  woot
+`),
+			expectedOut: []ifc.Kunstructured{},
+			expectedErr: true,
+		},
+		{
+			name: "emptyObjects",
+			input: []byte(`
+---
+#a comment
+
+---
+
+`),
+			expectedOut: []ifc.Kunstructured{},
+			expectedErr: false,
+		},
+		{
+			name: "Missing .metadata.name in object",
+			input: []byte(`
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    foo: bar
+`),
+			expectedOut: nil,
+			expectedErr: true,
+		},
+		{
+			name: "nil value in list",
+			input: []byte(`
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: kube100-site
+  labels:
+    app: web
+    testList:
+      - testA
+      - 
+`),
+			expectedOut: nil,
+			expectedErr: true,
+		},
+		{
+			name: "List",
+			input: []byte(`
+apiVersion: v1
+kind: List
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testList},
+			expectedErr: false,
+		},
+		{
+			name: "ConfigMapList",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMapList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMapList},
+			expectedErr: false,
+		},
+	}
+
+	for _, test := range tests {
+		rs, err := factory.SliceFromBytes(test.input)
+		if test.expectedErr && err == nil {
+			t.Fatalf("%v: should return error", test.name)
+		}
+		if !test.expectedErr && err != nil {
+			t.Fatalf("%v: unexpected error: %s", test.name, err)
+		}
+		if len(rs) != len(test.expectedOut) {
+			t.Fatalf("%s: length mismatch %d != %d",
+				test.name, len(rs), len(test.expectedOut))
+		}
+		for i := range rs {
+			if !reflect.DeepEqual(test.expectedOut[i], rs[i]) {
+				t.Fatalf("%s: Got: %v\nexpected:%v",
+					test.name, test.expectedOut[i], rs[i])
+			}
+		}
+	}
+}
--- a/api/k8sdeps/kunstruct/hasher.go
+++ b/api/k8sdeps/kunstruct/hasher.go
@@ -0,0 +1,123 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// kustHash computes a hash of an unstructured object.
+type kustHash struct{}
+
+// NewKustHash returns a kustHash object
+func NewKustHash() *kustHash {
+	return &kustHash{}
+}
+
+// Hash returns a hash of either a ConfigMap or a Secret
+func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
+	u := unstructured.Unstructured{
+		Object: m.Map(),
+	}
+	kind := u.GetKind()
+	switch kind {
+	case "ConfigMap":
+		cm, err := unstructuredToConfigmap(u)
+		if err != nil {
+			return "", err
+		}
+		return configMapHash(cm)
+	case "Secret":
+		sec, err := unstructuredToSecret(u)
+
+		if err != nil {
+			return "", err
+		}
+		return secretHash(sec)
+	default:
+		return "", fmt.Errorf(
+			"type %s is not supported for hashing in %v",
+			kind, m.Map())
+	}
+}
+
+// configMapHash returns a hash of the ConfigMap.
+// The Data, Kind, and Name are taken into account.
+func configMapHash(cm *v1.ConfigMap) (string, error) {
+	encoded, err := encodeConfigMap(cm)
+	if err != nil {
+		return "", err
+	}
+	h, err := hasher.Encode(hasher.Hash(encoded))
+	if err != nil {
+		return "", err
+	}
+	return h, nil
+}
+
+// SecretHash returns a hash of the Secret.
+// The Data, Kind, Name, and Type are taken into account.
+func secretHash(sec *v1.Secret) (string, error) {
+	encoded, err := encodeSecret(sec)
+	if err != nil {
+		return "", err
+	}
+	h, err := hasher.Encode(hasher.Hash(encoded))
+	if err != nil {
+		return "", err
+	}
+	return h, nil
+}
+
+// encodeConfigMap encodes a ConfigMap.
+// Data, Kind, and Name are taken into account.
+func encodeConfigMap(cm *v1.ConfigMap) (string, error) {
+	// json.Marshal sorts the keys in a stable order in the encoding
+	m := map[string]interface{}{"kind": "ConfigMap", "name": cm.Name, "data": cm.Data}
+	if len(cm.BinaryData) > 0 {
+		m["binaryData"] = cm.BinaryData
+	}
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// encodeSecret encodes a Secret.
+// Data, Kind, Name, and Type are taken into account.
+func encodeSecret(sec *v1.Secret) (string, error) {
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(map[string]interface{}{"kind": "Secret", "type": sec.Type, "name": sec.Name, "data": sec.Data})
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func unstructuredToConfigmap(u unstructured.Unstructured) (*v1.ConfigMap, error) {
+	marshaled, err := json.Marshal(u.Object)
+	if err != nil {
+		return nil, err
+	}
+	var out v1.ConfigMap
+	err = json.Unmarshal(marshaled, &out)
+	return &out, err
+}
+
+func unstructuredToSecret(u unstructured.Unstructured) (*v1.Secret, error) {
+	marshaled, err := json.Marshal(u.Object)
+	if err != nil {
+		return nil, err
+	}
+	var out v1.Secret
+	err = json.Unmarshal(marshaled, &out)
+	return &out, err
+}
--- a/api/k8sdeps/kunstruct/hasher_test.go
+++ b/api/k8sdeps/kunstruct/hasher_test.go
@@ -0,0 +1,180 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/api/core/v1"
+)
+
+func TestConfigMapHash(t *testing.T) {
+	cases := []struct {
+		desc string
+		cm   *v1.ConfigMap
+		hash string
+		err  string
+	}{
+		// empty map
+		{"empty data", &v1.ConfigMap{Data: map[string]string{}, BinaryData: map[string][]byte{}}, "42745tchd9", ""},
+		// one key
+		{"one key", &v1.ConfigMap{Data: map[string]string{"one": ""}}, "9g67k2htb6", ""},
+		// three keys (tests sorting order)
+		{"three keys", &v1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}}, "f5h7t85m9b", ""},
+		// empty binary data map
+		{"empty binary data", &v1.ConfigMap{BinaryData: map[string][]byte{}}, "dk855m5d49", ""},
+		// one key with binary data
+		{"one key with binary data", &v1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}}, "mk79584b8c", ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys with binary data", &v1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "t458mc6db2", ""},
+		// two keys, one with string and another with binary data
+		{"two keys with one each", &v1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}}, "698h7c7t9m", ""},
+	}
+
+	for _, c := range cases {
+		h, err := configMapHash(c.cm)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestSecretHash(t *testing.T) {
+	cases := []struct {
+		desc   string
+		secret *v1.Secret
+		hash   string
+		err    string
+	}{
+		// empty map
+		{"empty data", &v1.Secret{Type: "my-type", Data: map[string][]byte{}}, "t75bgf6ctb", ""},
+		// one key
+		{"one key", &v1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, "74bd68bm66", ""},
+		// three keys (tests sorting order)
+		{"three keys", &v1.Secret{Type: "my-type", Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}}, "dgcb6h9tmk", ""},
+	}
+
+	for _, c := range cases {
+		h, err := secretHash(c.secret)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if c.hash != h {
+			t.Errorf("case %q, expect hash %q but got %q", c.desc, c.hash, h)
+		}
+	}
+}
+
+func TestEncodeConfigMap(t *testing.T) {
+	cases := []struct {
+		desc   string
+		cm     *v1.ConfigMap
+		expect string
+		err    string
+	}{
+		// empty map
+		{"empty data", &v1.ConfigMap{Data: map[string]string{}}, `{"data":{},"kind":"ConfigMap","name":""}`, ""},
+		// one key
+		{"one key", &v1.ConfigMap{Data: map[string]string{"one": ""}}, `{"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+		// three keys (tests sorting order)
+		{"three keys", &v1.ConfigMap{Data: map[string]string{"two": "2", "one": "", "three": "3"}},
+			`{"data":{"one":"","three":"3","two":"2"},"kind":"ConfigMap","name":""}`, ""},
+		// empty binary map
+		{"empty data", &v1.ConfigMap{BinaryData: map[string][]byte{}}, `{"data":null,"kind":"ConfigMap","name":""}`, ""},
+		// one key with binary data
+		{"one key", &v1.ConfigMap{BinaryData: map[string][]byte{"one": []byte("")}},
+			`{"binaryData":{"one":""},"data":null,"kind":"ConfigMap","name":""}`, ""},
+		// three keys with binary data (tests sorting order)
+		{"three keys", &v1.ConfigMap{BinaryData: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")}},
+			`{"binaryData":{"one":"","three":"Mw==","two":"Mg=="},"data":null,"kind":"ConfigMap","name":""}`, ""},
+		// two keys, one string and one binary values
+		{"two keys with one each", &v1.ConfigMap{Data: map[string]string{"one": ""}, BinaryData: map[string][]byte{"two": []byte("")}},
+			`{"binaryData":{"two":""},"data":{"one":""},"kind":"ConfigMap","name":""}`, ""},
+	}
+	for _, c := range cases {
+		s, err := encodeConfigMap(c.cm)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.cm)
+		}
+	}
+}
+
+func TestEncodeSecret(t *testing.T) {
+	cases := []struct {
+		desc   string
+		secret *v1.Secret
+		expect string
+		err    string
+	}{
+		// empty map
+		{"empty data", &v1.Secret{Type: "my-type", Data: map[string][]byte{}}, `{"data":{},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// one key
+		{"one key", &v1.Secret{Type: "my-type", Data: map[string][]byte{"one": []byte("")}}, `{"data":{"one":""},"kind":"Secret","name":"","type":"my-type"}`, ""},
+		// three keys (tests sorting order) - note json.Marshal base64 encodes the values because they come in as []byte
+		{"three keys", &v1.Secret{
+			Type: "my-type",
+			Data: map[string][]byte{"two": []byte("2"), "one": []byte(""), "three": []byte("3")},
+		},
+			`{"data":{"one":"","three":"Mw==","two":"Mg=="},"kind":"Secret","name":"","type":"my-type"}`, ""},
+	}
+	for _, c := range cases {
+		s, err := encodeSecret(c.secret)
+		if SkipRest(t, c.desc, err, c.err) {
+			continue
+		}
+		if s != c.expect {
+			t.Errorf("case %q, expect %q but got %q from encode %#v", c.desc, c.expect, s, c.secret)
+		}
+	}
+}
+
+// warn devs who change types that they might have to update a hash function
+// not perfect, as it only checks the number of top-level fields
+func TestTypeStability(t *testing.T) {
+	errfmt := `case %q, expected %d fields but got %d
+Depending on the field(s) you added, you may need to modify the hash function for this type.
+To guide you: the hash function targets fields that comprise the contents of objects,
+not their metadata (e.g. the Data of a ConfigMap, but nothing in ObjectMeta).
+`
+	cases := []struct {
+		typeName string
+		obj      interface{}
+		expect   int
+	}{
+		{"ConfigMap", v1.ConfigMap{}, 4},
+		{"Secret", v1.Secret{}, 5},
+	}
+	for _, c := range cases {
+		val := reflect.ValueOf(c.obj)
+		if num := val.NumField(); c.expect != num {
+			t.Errorf(errfmt, c.typeName, c.expect, num)
+		}
+	}
+}
+
+// SkipRest returns true if there was a non-nil error or if we expected an error that didn't happen,
+// and logs the appropriate error on the test object.
+// The return value indicates whether we should skip the rest of the test case due to the error result.
+func SkipRest(t *testing.T, desc string, err error, contains string) bool {
+	if err != nil {
+		if len(contains) == 0 {
+			t.Errorf("case %q, expect nil error but got %q", desc, err.Error())
+		} else if !strings.Contains(err.Error(), contains) {
+			t.Errorf("case %q, expect error to contain %q but got %q", desc, contains, err.Error())
+		}
+		return true
+	} else if len(contains) > 0 {
+		t.Errorf("case %q, expect error to contain %q but got nil error", desc, contains)
+		return true
+	}
+	return false
+}
--- a/api/k8sdeps/kunstruct/helper.go
+++ b/api/k8sdeps/kunstruct/helper.go
@@ -0,0 +1,95 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package kunstruct provides unstructured from api machinery and factory for creating unstructured
+package kunstruct
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// A PathSection contains a list of nested fields, which may end with an
+// indexable value. For instance, foo.bar resolves to a PathSection with 2
+// fields and no index, while foo[0].bar resolves to two path sections, the
+// first containing the field foo and the index 0, and the second containing
+// the field bar, with no index. The latter PathSection references the bar
+// field of the first item in the foo list
+type PathSection struct {
+	fields []string
+	idx    int
+}
+
+func newPathSection() PathSection {
+	return PathSection{idx: -1}
+}
+
+func appendNonEmpty(section *PathSection, field string) {
+	if len(field) != 0 {
+		section.fields = append(section.fields, field)
+	}
+}
+
+func parseFields(path string) (result []PathSection, err error) {
+	section := newPathSection()
+	if !strings.Contains(path, "[") {
+		section.fields = strings.Split(path, ".")
+		result = append(result, section)
+		return result, nil
+	}
+
+	start := 0
+	insideParentheses := false
+	for i, c := range path {
+		switch c {
+		case '.':
+			if !insideParentheses {
+				appendNonEmpty(&section, path[start:i])
+				start = i + 1
+			}
+		case '[':
+			if !insideParentheses {
+				appendNonEmpty(&section, path[start:i])
+				start = i + 1
+				insideParentheses = true
+			} else {
+				return nil, fmt.Errorf("nested parentheses are not allowed: %s", path)
+			}
+		case ']':
+			if insideParentheses {
+				// Assign this index to the current
+				// PathSection, save it to the result, then begin
+				// a new PathSection
+				tmpIdx, err := strconv.Atoi(path[start:i])
+				if err == nil {
+					// We have detected an integer so an array.
+					section.idx = tmpIdx
+				} else {
+					// We have detected the downwardapi syntax
+					appendNonEmpty(&section, path[start:i])
+				}
+				result = append(result, section)
+				section = newPathSection()
+
+				start = i + 1
+				insideParentheses = false
+			} else {
+				return nil, fmt.Errorf("invalid field path %s", path)
+			}
+		}
+	}
+	if start < len(path)-1 {
+		appendNonEmpty(&section, path[start:])
+		result = append(result, section)
+	}
+
+	for _, section := range result {
+		for i, f := range section.fields {
+			if strings.HasPrefix(f, "\"") || strings.HasPrefix(f, "'") {
+				section.fields[i] = strings.Trim(f, "\"'")
+			}
+		}
+	}
+	return result, nil
+}
--- a/api/k8sdeps/kunstruct/helper_test.go
+++ b/api/k8sdeps/kunstruct/helper_test.go
@@ -0,0 +1,152 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"reflect"
+	"testing"
+)
+
+type PathSectionSlice []PathSection
+
+func buildPath(idx int, fields ...string) PathSectionSlice {
+	return PathSectionSlice{PathSection{fields: fields, idx: idx}}
+}
+
+func (a PathSectionSlice) addSection(idx int, fields ...string) PathSectionSlice {
+	return append(a, PathSection{fields: fields, idx: idx})
+}
+
+func TestParseField(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue []PathSection
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: buildPath(-1, "Kind"),
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: buildPath(-1, "metadata", "name"),
+			errorExpected: false,
+		},
+		{
+			name:          "threeFields",
+			pathToField:   "spec.ports.port",
+			expectedValue: buildPath(-1, "spec", "ports", "port"),
+			errorExpected: false,
+		},
+		{
+			name:          "empty",
+			pathToField:   "",
+			expectedValue: buildPath(-1, ""),
+			errorExpected: false,
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[1]",
+			expectedValue: buildPath(1, "that"),
+			errorExpected: false,
+		},
+		{
+			name:          "sliceInSlice",
+			pathToField:   "that[1][0]",
+			expectedValue: buildPath(1, "that").addSection(0),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			expectedValue: buildPath(1, "those").addSection(-1, "field2"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[0]",
+			expectedValue: buildPath(1, "these").addSection(0, "field2"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			expectedValue: buildPath(1, "complextree").addSection(1, "field2").addSection(-1, "stringsubfield"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructDownwardAPI",
+			pathToField:   `metadata.labels["app.kubernetes.io/component"]`,
+			expectedValue: buildPath(-1, "metadata", "labels", "app.kubernetes.io/component"),
+			errorExpected: false,
+		},
+		{
+			name:          "invalidIndexInIndex",
+			pathToField:   "complextree[1[0]]",
+			errorExpected: true,
+			errorMsg:      "nested parentheses are not allowed: complextree[1[0]]",
+		},
+		{
+			name:          "invalidClosingBrackets",
+			pathToField:   "complextree[1]]",
+			errorExpected: true,
+			errorMsg:      "invalid field path complextree[1]]",
+		},
+		{
+			name:          "validFieldsWithQuotes",
+			pathToField:   "'complextree'[1].field2[1].'stringsubfield'",
+			expectedValue: buildPath(1, "complextree").addSection(1, "field2").addSection(-1, "stringsubfield"),
+			errorExpected: false,
+		},
+	}
+
+	for _, test := range tests {
+		s, err := parseFields(test.pathToField)
+		if test.errorExpected {
+			compareExpectedParserError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedParserError(t, test.name, test.pathToField, err)
+		}
+		compareParserValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+// unExpectedError function handles unexpected error
+func unExpectedParserError(t *testing.T, name string, pathToField string, err error) {
+	t.Fatalf("%q; path %q - unexpected error %v", name, pathToField, err)
+}
+
+// compareExpectedError compares the expectedError and the actualError return by parseFields
+func compareExpectedParserError(t *testing.T, name string, pathToField string, err error, errorMsg string) {
+	if err == nil {
+		t.Fatalf("%q; path %q - should return error, but no error returned",
+			name, pathToField)
+	}
+
+	if errorMsg != err.Error() {
+		t.Fatalf("%q; path %q - expected error: \"%s\", got error: \"%v\"",
+			name, pathToField, errorMsg, err.Error())
+	}
+}
+
+// compareValues compares the expectedValue and actualValue returned by parseFields
+func compareParserValues(t *testing.T, name string, pathToField string, expectedValue PathSectionSlice, actualValue []PathSection) {
+	t.Helper()
+	if len(expectedValue) != len(actualValue) {
+		t.Fatalf("%q; Path: %s Got: %v Expected: %v", name, pathToField, actualValue, expectedValue)
+	}
+
+	for idx, expected := range expectedValue {
+		if !reflect.DeepEqual(expected, actualValue[idx]) {
+			t.Fatalf("%q; Path: %s idx: %v Fields Got: %v Expected: %v", name, pathToField, idx, actualValue[idx], expected)
+		}
+	}
+}
--- a/api/k8sdeps/kunstruct/unstructadapter.go
+++ b/api/k8sdeps/kunstruct/unstructadapter.go
@@ -0,0 +1,350 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package kunstruct provides unstructured from api machinery and factory for creating unstructured
+package kunstruct
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+var _ ifc.Kunstructured = &UnstructAdapter{}
+
+// UnstructAdapter wraps unstructured.Unstructured from
+// https://github.com/kubernetes/apimachinery/blob/master/
+//     pkg/apis/meta/v1/unstructured/unstructured.go
+// to isolate dependence on apimachinery.
+type UnstructAdapter struct {
+	unstructured.Unstructured
+}
+
+// NewKunstructuredFromObject returns a new instance of Kunstructured.
+func NewKunstructuredFromObject(obj runtime.Object) (ifc.Kunstructured, error) {
+	// Convert obj to a byte stream, then convert that to JSON (Unstructured).
+	marshaled, err := json.Marshal(obj)
+	if err != nil {
+		return &UnstructAdapter{}, err
+	}
+	var u unstructured.Unstructured
+	err = u.UnmarshalJSON(marshaled)
+	// creationTimestamp always 'null', remove it
+	u.SetCreationTimestamp(metav1.Time{})
+	return &UnstructAdapter{Unstructured: u}, err
+}
+
+// GetGvk returns the Gvk name of the object.
+func (fs *UnstructAdapter) GetGvk() resid.Gvk {
+	x := fs.GroupVersionKind()
+	return resid.Gvk{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+// SetGvk set the Gvk of the object to the input Gvk
+func (fs *UnstructAdapter) SetGvk(g resid.Gvk) {
+	fs.SetGroupVersionKind(toSchemaGvk(g))
+}
+
+// Copy provides a copy behind an interface.
+func (fs *UnstructAdapter) Copy() ifc.Kunstructured {
+	return &UnstructAdapter{*fs.DeepCopy()}
+}
+
+// Map returns the unstructured content map.
+func (fs *UnstructAdapter) Map() map[string]interface{} {
+	return fs.Object
+}
+
+// SetMap overrides the unstructured content map.
+func (fs *UnstructAdapter) SetMap(m map[string]interface{}) {
+	fs.Object = m
+}
+
+func (fs *UnstructAdapter) selectSubtree(path string) (map[string]interface{}, []string, bool, error) {
+	sections, err := parseFields(path)
+	if len(sections) == 0 || (err != nil) {
+		return nil, nil, false, err
+	}
+
+	content := fs.UnstructuredContent()
+	lastSectionIdx := len(sections)
+
+	// There are multiple sections to walk
+	for sectionIdx := 0; sectionIdx < lastSectionIdx; sectionIdx++ {
+		idx := sections[sectionIdx].idx
+		fields := sections[sectionIdx].fields
+
+		if idx == -1 {
+			// This section has no index
+			return content, fields, true, nil
+		}
+
+		// This section is terminated by an indexed field.
+		// Let's extract the slice first
+		indexedField, found, err := unstructured.NestedFieldNoCopy(content, fields...)
+		if !found || err != nil {
+			return content, fields, found, err
+		}
+		s, ok := indexedField.([]interface{})
+		if !ok {
+			return content, fields, false, fmt.Errorf("%v is of the type %T, expected []interface{}", indexedField, indexedField)
+		}
+		if idx >= len(s) {
+			return content, fields, false, fmt.Errorf("index %d is out of bounds", idx)
+		}
+
+		if sectionIdx == lastSectionIdx-1 {
+			// This is the last section. Let's build a fake map
+			// to let the rest of the field extraction to work.
+			idxstring := fmt.Sprintf("[%v]", idx)
+			newContent := map[string]interface{}{idxstring: s[idx]}
+			newFields := []string{idxstring}
+			return newContent, newFields, true, nil
+		}
+
+		newContent, ok := s[idx].(map[string]interface{})
+		if !ok {
+			// Only map are supported here
+			return content, fields, false,
+				fmt.Errorf("%#v is expected to be of type map[string]interface{}", s[idx])
+		}
+		content = newContent
+	}
+
+	// It seems to be an invalid path
+	return nil, []string{}, false, nil
+}
+
+// GetFieldValue returns the value at the given fieldpath.
+func (fs *UnstructAdapter) GetFieldValue(path string) (interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedFieldNoCopy(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetString returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetString(path string) (string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return "", noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedString(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return "", noFieldError{Field: path}
+}
+
+// GetStringSlice returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetStringSlice(path string) ([]string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return []string{}, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedStringSlice(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return []string{}, noFieldError{Field: path}
+}
+
+// GetBool returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetBool(path string) (bool, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return false, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedBool(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return false, noFieldError{Field: path}
+}
+
+// GetFloat64 returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetFloat64(path string) (float64, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return 0, err
+	}
+
+	s, found, err := unstructured.NestedFloat64(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return 0, noFieldError{Field: path}
+}
+
+// GetInt64 returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetInt64(path string) (int64, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return 0, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedInt64(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return 0, noFieldError{Field: path}
+}
+
+// GetSlice returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetSlice(path string) ([]interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedSlice(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetStringMap returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedStringMap(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetMap returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedMap(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+func (fs *UnstructAdapter) MatchesLabelSelector(selector string) (bool, error) {
+	s, err := labels.Parse(selector)
+	if err != nil {
+		return false, err
+	}
+	return s.Matches(labels.Set(fs.GetLabels())), nil
+}
+
+func (fs *UnstructAdapter) MatchesAnnotationSelector(selector string) (bool, error) {
+	s, err := labels.Parse(selector)
+	if err != nil {
+		return false, err
+	}
+	return s.Matches(labels.Set(fs.GetAnnotations())), nil
+}
+
+func (fs *UnstructAdapter) Patch(patch ifc.Kunstructured) error {
+	versionedObj, err := scheme.Scheme.New(
+		toSchemaGvk(patch.GetGvk()))
+	merged := map[string]interface{}{}
+	saveName := fs.GetName()
+	switch {
+	case runtime.IsNotRegisteredError(err):
+		baseBytes, err := json.Marshal(fs.Map())
+		if err != nil {
+			return err
+		}
+		patchBytes, err := json.Marshal(patch.Map())
+		if err != nil {
+			return err
+		}
+		mergedBytes, err := jsonpatch.MergePatch(baseBytes, patchBytes)
+		if err != nil {
+			return err
+		}
+		err = json.Unmarshal(mergedBytes, &merged)
+		if err != nil {
+			return err
+		}
+	case err != nil:
+		return err
+	default:
+		// Use Strategic-Merge-Patch to handle types w/ schema
+		// TODO: Change this to use the new Merge package.
+		// Store the name of the target object, because this name may have been munged.
+		// Apply this name to the patched object.
+		lookupPatchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObj)
+		if err != nil {
+			return err
+		}
+		merged, err = strategicpatch.StrategicMergeMapPatchUsingLookupPatchMeta(
+			fs.Map(),
+			patch.Map(),
+			lookupPatchMeta)
+		if err != nil {
+			return err
+		}
+	}
+	fs.SetMap(merged)
+	if len(fs.Map()) != 0 {
+		// if the patch deletes the object
+		// don't reset the name
+		fs.SetName(saveName)
+	}
+	return nil
+}
+
+// toSchemaGvk converts to a schema.GroupVersionKind.
+func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+// noFieldError is returned when a field is expected, but missing.
+type noFieldError struct {
+	Field string
+}
+
+func (e noFieldError) Error() string {
+	return fmt.Sprintf("no field named '%s'", e.Field)
+}
--- a/api/k8sdeps/kunstruct/unstructadapter_test.go
+++ b/api/k8sdeps/kunstruct/unstructadapter_test.go
@@ -0,0 +1,831 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"reflect"
+	"testing"
+)
+
+var kunstructured = NewKunstructuredFactoryImpl().FromMap(map[string]interface{}{
+	"Kind": "Service",
+	"metadata": map[string]interface{}{
+		"labels": map[string]interface{}{
+			"app": "application-name",
+		},
+		"name": "service-name",
+	},
+	"spec": map[string]interface{}{
+		"ports": map[string]interface{}{
+			"port": int64(80),
+		},
+	},
+	"this": map[string]interface{}{
+		"is": map[string]interface{}{
+			"aNumber":      int64(1000),
+			"aFloat":       float64(1.001),
+			"aNilValue":    nil,
+			"aBool":        true,
+			"anEmptyMap":   map[string]interface{}{},
+			"anEmptySlice": []interface{}{},
+			"unrecognizable": testing.InternalExample{
+				Name: "fooBar",
+			},
+		},
+	},
+	"that": []interface{}{
+		"idx0",
+		"idx1",
+		"idx2",
+		"idx3",
+	},
+	"those": []interface{}{
+		map[string]interface{}{
+			"field1": "idx0foo",
+			"field2": "idx0bar",
+		},
+		map[string]interface{}{
+			"field1": "idx1foo",
+			"field2": "idx1bar",
+		},
+		map[string]interface{}{
+			"field1": "idx2foo",
+			"field2": "idx2bar",
+		},
+	},
+	"these": []interface{}{
+		map[string]interface{}{
+			"field1": []interface{}{"idx010", "idx011"},
+			"field2": []interface{}{"idx020", "idx021"},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{"idx110", "idx111"},
+			"field2": []interface{}{"idx120", "idx121"},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{"idx210", "idx211"},
+			"field2": []interface{}{"idx220", "idx221"},
+		},
+	},
+	"complextree": []interface{}{
+		map[string]interface{}{
+			"field1": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1010",
+					"intsubfield":    int64(1010),
+					"floatsubfield":  float64(1.010),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1011",
+					"intsubfield":    int64(1011),
+					"floatsubfield":  float64(1.011),
+					"boolfield":      false,
+				},
+			},
+			"field2": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1020",
+					"intsubfield":    int64(1020),
+					"floatsubfield":  float64(1.020),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1021",
+					"intsubfield":    int64(1021),
+					"floatsubfield":  float64(1.021),
+					"boolfield":      false,
+				},
+			},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1110",
+					"intsubfield":    int64(1110),
+					"floatsubfield":  float64(1.110),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1111",
+					"intsubfield":    int64(1111),
+					"floatsubfield":  float64(1.111),
+					"boolfield":      false,
+				},
+			},
+			"field2": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1120",
+					"intsubfield":    int64(1120),
+					"floatsubfield":  float64(1.1120),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1121",
+					"intsubfield":    int64(1121),
+					"floatsubfield":  float64(1.1121),
+					"boolfield":      false,
+				},
+			},
+		},
+	},
+})
+
+func TestGetFieldValue(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue interface{}
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: "Service",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: "service-name",
+			errorExpected: false,
+		},
+		{
+			name:          "threeFields",
+			pathToField:   "spec.ports.port",
+			expectedValue: int64(80),
+			errorExpected: false,
+		},
+		{
+			name:          "empty",
+			pathToField:   "",
+			errorExpected: true,
+			errorMsg:      "no field named ''",
+		},
+		{
+			name:          "emptyDotEmpty",
+			pathToField:   ".",
+			errorExpected: true,
+			errorMsg:      "no field named '.'",
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "deeperMissingField",
+			pathToField:   "this.is.aDeep.field.that.does.not.exist",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is.aDeep.field.that.does.not.exist'",
+		},
+		{
+			name:          "emptyMap",
+			pathToField:   "this.is.anEmptyMap",
+			errorExpected: false,
+			expectedValue: map[string]interface{}{},
+		},
+		{
+			name:          "emptySlice",
+			pathToField:   "this.is.anEmptySlice",
+			errorExpected: false,
+			expectedValue: []interface{}{},
+		},
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: false,
+			expectedValue: int64(1000),
+		},
+		{
+			name:          "floatAsValue",
+			pathToField:   "this.is.aFloat",
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "boolAsValue",
+			pathToField:   "this.is.aBool",
+			errorExpected: false,
+			expectedValue: true,
+		},
+		{
+			name:          "nilAsValue",
+			pathToField:   "this.is.aNilValue",
+			errorExpected: false,
+			expectedValue: nil,
+		},
+		{
+			name:          "unrecognizable",
+			pathToField:   "this.is.unrecognizable.Name",
+			errorExpected: true,
+			errorMsg:      ".this.is.unrecognizable.Name accessor error: {fooBar <nil>  false} is of the type testing.InternalExample, expected map[string]interface{}",
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[2]",
+			expectedValue: "idx2",
+			errorExpected: false,
+		},
+		{
+			name:          "outOfBoundIndex",
+			pathToField:   "that[99]",
+			errorMsg:      "no field named 'that[99]'",
+			errorExpected: true,
+		},
+		{
+			name:          "accessorError",
+			pathToField:   "that[downwardapi]",
+			errorMsg:      ".that.downwardapi accessor error: [idx0 idx1 idx2 idx3] is of the type []interface {}, expected map[string]interface{}",
+			errorExpected: true,
+		},
+		{
+			name:          "unknownSlice",
+			pathToField:   "unknown[0]",
+			errorMsg:      "no field named 'unknown[0]'",
+			errorExpected: true,
+		},
+		{
+			name:          "sliceInSlice",
+			pathToField:   "that[2][0]",
+			errorExpected: true,
+			errorMsg:      "no field named 'that[2][0]'",
+		},
+		{
+			name:          "validStructIndex",
+			pathToField:   "those[1]",
+			errorExpected: false,
+			expectedValue: map[string]interface{}{"field1": "idx1foo", "field2": "idx1bar"},
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			errorExpected: false,
+			expectedValue: "idx1bar",
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[1]",
+			errorExpected: false,
+			expectedValue: "idx121",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+		{
+			name:          "validStructSubFieldIndexInvalidName",
+			pathToField:   "complextree[1].field2[1].invalidsubfield",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1].field2[1].invalidsubfield'",
+		},
+		{
+			name:          "validDownwardAPILabels",
+			pathToField:   `metadata.labels["app"]`,
+			errorExpected: false,
+			expectedValue: "application-name",
+		},
+		{
+			name:          "validDownwardAPISpecs",
+			pathToField:   `spec.ports['port']`,
+			errorExpected: false,
+			expectedValue: int64(80),
+		},
+		{
+			name:          "validDownwardAPIThis",
+			pathToField:   `this.is[aFloat]`,
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "downwardAPIInvalidLabel",
+			pathToField:   `metadata.labels["theisnotanint"]`,
+			errorExpected: true,
+			errorMsg:      `no field named 'metadata.labels["theisnotanint"]'`,
+		},
+		{
+			name:          "downwardAPIInvalidLabel2",
+			pathToField:   `invalidfield.labels["app"]`,
+			errorExpected: true,
+			errorMsg:      `no field named 'invalidfield.labels["app"]'`,
+		},
+		{
+			name:          "invalidIndexInIndex",
+			pathToField:   "complextree[1[0]]",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1[0]]'",
+		},
+		{
+			name:          "invalidClosingBrackets",
+			pathToField:   "complextree[1]]",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1]]'",
+		},
+		{
+			name:          "validFieldsWithQuotes",
+			pathToField:   "'complextree'[1].field2[1].'stringsubfield'",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetFieldValue(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetString(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: "Service",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: "service-name",
+			errorExpected: false,
+		},
+		{
+			name:          "emptyMap",
+			pathToField:   "this.is.anEmptyMap",
+			errorExpected: true,
+			errorMsg:      ".this.is.anEmptyMap accessor error: map[] is of the type map[string]interface {}, expected string",
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "emptySlice",
+			pathToField:   "this.is.anEmptySlice",
+			errorExpected: true,
+			errorMsg:      ".this.is.anEmptySlice accessor error: [] is of the type []interface {}, expected string",
+		},
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: true,
+			errorMsg:      ".this.is.aNumber accessor error: 1000 is of the type int64, expected string",
+		},
+		{
+			name:          "nilAsValue",
+			pathToField:   "this.is.aNilValue",
+			errorExpected: true,
+			errorMsg:      ".this.is.aNilValue accessor error: <nil> is of the type <nil>, expected string",
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[2]",
+			expectedValue: "idx2",
+			errorExpected: false,
+		},
+		{
+			name:          "validStructIndex",
+			pathToField:   "those[1]",
+			errorExpected: true,
+			errorMsg:      ".[1] accessor error: map[field1:idx1foo field2:idx1bar] is of the type map[string]interface {}, expected string",
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			errorExpected: false,
+			expectedValue: "idx1bar",
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[1]",
+			errorExpected: false,
+			expectedValue: "idx121",
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+		{
+			name:          "invalidIndexInMap",
+			pathToField:   "this.is[1]",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is[1]'",
+		},
+		{
+			name:          "anotherInvalidIndexInMap",
+			pathToField:   "this.is[1].aString",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is[1].aString'",
+		},
+		{
+			name:          "validDownwardAPIField",
+			pathToField:   `metadata.labels["app"]`,
+			errorExpected: false,
+			expectedValue: "application-name",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetString(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetInt64(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue int64
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: false,
+			expectedValue: int64(1000),
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].intsubfield",
+			errorExpected: false,
+			expectedValue: int64(1121),
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+		{
+			name:          "validDownwardAPISpecs",
+			pathToField:   `spec.ports['port']`,
+			errorExpected: false,
+			expectedValue: int64(80),
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetInt64(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetFloat64(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue float64
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "floatAsValue",
+			pathToField:   "this.is.aFloat",
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].floatsubfield",
+			errorExpected: false,
+			expectedValue: float64(1.1121),
+		},
+		{
+			name:          "validDownwardAPIThis",
+			pathToField:   `this.is[aFloat]`,
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "index 99 is out of bounds",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetFloat64(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetBool(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue bool
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "boolAsValue",
+			pathToField:   "this.is.aBool",
+			errorExpected: false,
+			expectedValue: true,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].boolfield",
+			errorExpected: false,
+			expectedValue: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetBool(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetStringMap(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validStringMap",
+			pathToField:   "those[2]",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetStringMap(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetMap(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validMap",
+			pathToField:   "those[2]",
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1]",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetMap(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetStringSlice(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validStringSlice",
+			pathToField:   "that",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetStringSlice(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetSlice(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validSlice1",
+			pathToField:   "that",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice2",
+			pathToField:   "those",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice3",
+			pathToField:   "these",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice4",
+			pathToField:   "complextree",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetSlice(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+// unExpectedError function handles unexpected error
+func unExpectedError(t *testing.T, name string, pathToField string, err error) {
+	t.Fatalf("%q; path %q - unexpected error %v", name, pathToField, err)
+}
+
+// compareExpectedError compares the expectedError and the actualError return by GetFieldValue
+func compareExpectedError(t *testing.T, name string, pathToField string, err error, errorMsg string) {
+	if err == nil {
+		t.Fatalf("%q; path %q - should return error, but no error returned",
+			name, pathToField)
+	}
+
+	if errorMsg != err.Error() {
+		t.Fatalf("%q; path %q - expected error: \"%s\", got error: \"%v\"",
+			name, pathToField, errorMsg, err.Error())
+	}
+}
+
+// compareValues compares the expectedValue and actualValue returned by GetFieldValue
+func compareValues(t *testing.T, name string, pathToField string, expectedValue interface{}, actualValue interface{}) {
+	t.Helper()
+	switch typedV := expectedValue.(type) {
+	case nil, string, bool, float64, int, int64:
+		if expectedValue != actualValue {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	case map[string]interface{}:
+		if !reflect.DeepEqual(expectedValue, actualValue) {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	case []interface{}:
+		if !reflect.DeepEqual(expectedValue, actualValue) {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	default:
+		t.Logf("%T value at `%s`", typedV, pathToField)
+	}
+}
--- a/api/k8sdeps/transformer/factory.go
+++ b/api/k8sdeps/transformer/factory.go
@@ -0,0 +1,25 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package transformer provides transformer factory
+package transformer
+
+import (
+	"sigs.k8s.io/kustomize/api/k8sdeps/transformer/patch"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// FactoryImpl makes patch transformer and name hash transformer
+type FactoryImpl struct{}
+
+// NewFactoryImpl makes a new factoryImpl instance
+func NewFactoryImpl() *FactoryImpl {
+	return &FactoryImpl{}
+}
+
+func (p *FactoryImpl) MergePatches(patches []*resource.Resource,
+	rf *resource.Factory) (
+	resmap.ResMap, error) {
+	return patch.MergePatches(patches, rf)
+}
--- a/api/k8sdeps/transformer/patch/conflictdetector.go
+++ b/api/k8sdeps/transformer/patch/conflictdetector.go
@@ -0,0 +1,221 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package patch
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+type conflictDetector interface {
+	hasConflict(patch1, patch2 *resource.Resource) (bool, error)
+	findConflict(conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error)
+	mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error)
+}
+
+type jsonMergePatch struct {
+	rf *resource.Factory
+}
+
+var _ conflictDetector = &jsonMergePatch{}
+
+func newJMPConflictDetector(rf *resource.Factory) conflictDetector {
+	return &jsonMergePatch{rf: rf}
+}
+
+func (jmp *jsonMergePatch) hasConflict(
+	patch1, patch2 *resource.Resource) (bool, error) {
+	return mergepatch.HasConflicts(patch1.Map(), patch2.Map())
+}
+
+func (jmp *jsonMergePatch) findConflict(
+	conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error) {
+	for i, patch := range patches {
+		if i == conflictingPatchIdx {
+			continue
+		}
+		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
+			continue
+		}
+		conflict, err := mergepatch.HasConflicts(
+			patch.Map(),
+			patches[conflictingPatchIdx].Map())
+		if err != nil {
+			return nil, err
+		}
+		if conflict {
+			return patch, nil
+		}
+	}
+	return nil, nil
+}
+
+func (jmp *jsonMergePatch) mergePatches(
+	patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	baseBytes, err := json.Marshal(patch1.Map())
+	if err != nil {
+		return nil, err
+	}
+	patchBytes, err := json.Marshal(patch2.Map())
+	if err != nil {
+		return nil, err
+	}
+	mergedBytes, err := jsonpatch.MergeMergePatches(baseBytes, patchBytes)
+	if err != nil {
+		return nil, err
+	}
+	mergedMap := make(map[string]interface{})
+	err = json.Unmarshal(mergedBytes, &mergedMap)
+	return jmp.rf.FromMap(mergedMap), err
+}
+
+type strategicMergePatch struct {
+	lookupPatchMeta strategicpatch.LookupPatchMeta
+	rf              *resource.Factory
+}
+
+var _ conflictDetector = &strategicMergePatch{}
+
+func newSMPConflictDetector(
+	versionedObj runtime.Object,
+	rf *resource.Factory) (conflictDetector, error) {
+	lookupPatchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObj)
+	return &strategicMergePatch{lookupPatchMeta: lookupPatchMeta, rf: rf}, err
+}
+
+func (smp *strategicMergePatch) hasConflict(p1, p2 *resource.Resource) (bool, error) {
+	return strategicpatch.MergingMapsHaveConflicts(
+		p1.Map(), p2.Map(), smp.lookupPatchMeta)
+}
+
+func (smp *strategicMergePatch) findConflict(
+	conflictingPatchIdx int, patches []*resource.Resource) (*resource.Resource, error) {
+	for i, patch := range patches {
+		if i == conflictingPatchIdx {
+			continue
+		}
+		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
+			continue
+		}
+		conflict, err := strategicpatch.MergingMapsHaveConflicts(
+			patch.Map(),
+			patches[conflictingPatchIdx].Map(),
+			smp.lookupPatchMeta)
+		if err != nil {
+			return nil, err
+		}
+		if conflict {
+			return patch, nil
+		}
+	}
+	return nil, nil
+}
+
+func (smp *strategicMergePatch) mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	if hasDeleteDirectiveMarker(patch2.Map()) {
+		if hasDeleteDirectiveMarker(patch1.Map()) {
+			return nil, fmt.Errorf("cannot merge patches both containing '$patch: delete' directives")
+		}
+		patch1, patch2 = patch2, patch1
+	}
+	mergeJSONMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
+		smp.lookupPatchMeta, patch1.Map(), patch2.Map())
+	return smp.rf.FromMap(mergeJSONMap), err
+}
+
+// MergePatches merge and index patches by OrgId.
+// It errors out if there is conflict between patches.
+func MergePatches(patches []*resource.Resource,
+	rf *resource.Factory) (resmap.ResMap, error) {
+	rc := resmap.New()
+	for ix, patch := range patches {
+		id := patch.OrgId()
+		existing := rc.GetMatchingResourcesByOriginalId(id.Equals)
+		if len(existing) == 0 {
+			rc.Append(patch)
+			continue
+		}
+		if len(existing) > 1 {
+			return nil, fmt.Errorf("self conflict in patches")
+		}
+
+		versionedObj, err := scheme.Scheme.New(toSchemaGvk(id.Gvk))
+		if err != nil && !runtime.IsNotRegisteredError(err) {
+			return nil, err
+		}
+		var cd conflictDetector
+		if err != nil {
+			cd = newJMPConflictDetector(rf)
+		} else {
+			cd, err = newSMPConflictDetector(versionedObj, rf)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		conflict, err := cd.hasConflict(existing[0], patch)
+		if err != nil {
+			return nil, err
+		}
+		if conflict {
+			conflictingPatch, err := cd.findConflict(ix, patches)
+			if err != nil {
+				return nil, err
+			}
+			return nil, fmt.Errorf(
+				"conflict between %#v and %#v",
+				conflictingPatch.Map(), patch.Map())
+		}
+		merged, err := cd.mergePatches(existing[0], patch)
+		if err != nil {
+			return nil, err
+		}
+		rc.Replace(merged)
+	}
+	return rc, nil
+}
+
+// toSchemaGvk converts to a schema.GroupVersionKind.
+func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+func hasDeleteDirectiveMarker(patch map[string]interface{}) bool {
+	if v, ok := patch["$patch"]; ok && v == "delete" {
+		return true
+	}
+	for _, v := range patch {
+		switch typedV := v.(type) {
+		case map[string]interface{}:
+			if hasDeleteDirectiveMarker(typedV) {
+				return true
+			}
+		case []interface{}:
+			for _, sv := range typedV {
+				typedE, ok := sv.(map[string]interface{})
+				if !ok {
+					break
+				}
+				if hasDeleteDirectiveMarker(typedE) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
--- a/api/k8sdeps/validator/validators.go
+++ b/api/k8sdeps/validator/validators.go
@@ -0,0 +1,102 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package validator provides functions to validate labels, annotations,
+// namespaces and configmap/secret keys using apimachinery functions.
+package validator
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	apivalidation "k8s.io/apimachinery/pkg/api/validation"
+	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// KustValidator validates Labels and annotations by apimachinery
+type KustValidator struct{}
+
+// NewKustValidator returns a KustValidator object
+func NewKustValidator() *KustValidator {
+	return &KustValidator{}
+}
+
+func (v *KustValidator) ErrIfInvalidKey(k string) error {
+	if errs := validation.IsConfigMapKey(k); len(errs) != 0 {
+		return fmt.Errorf(
+			"%q is not a valid key name: %s",
+			k, strings.Join(errs, ";"))
+	}
+	return nil
+}
+
+func (v *KustValidator) IsEnvVarName(k string) error {
+	if errs := validation.IsEnvVarName(k); len(errs) != 0 {
+		return fmt.Errorf(
+			"%q is not a valid key name: %s",
+			k, strings.Join(errs, ";"))
+	}
+	return nil
+}
+
+// MakeAnnotationValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeAnnotationValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		errs := apivalidation.ValidateAnnotations(x, field.NewPath("field"))
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeAnnotationNameValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeAnnotationNameValidator() func([]string) error {
+	return func(x []string) error {
+		errs := field.ErrorList{}
+		fldPath := field.NewPath("field")
+		for _, k := range x {
+			for _, msg := range validation.IsQualifiedName(strings.ToLower(k)) {
+				errs = append(errs, field.Invalid(fldPath, k, msg))
+			}
+		}
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeLabelValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeLabelValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		errs := v1validation.ValidateLabels(x, field.NewPath("field"))
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeLabelNameValidator returns a ArrayValidatorFunc using apimachinery.
+func (v *KustValidator) MakeLabelNameValidator() func([]string) error {
+	return func(x []string) error {
+		errs := field.ErrorList{}
+		fldPath := field.NewPath("field")
+		for _, k := range x {
+			errs = append(errs, v1validation.ValidateLabelName(k, fldPath)...)
+		}
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// ValidateNamespace validates a string is a valid namespace using apimachinery.
+func (v *KustValidator) ValidateNamespace(s string) []string {
+	return validation.IsDNS1123Label(s)
+}
--- a/api/kv/kv.go
+++ b/api/kv/kv.go
@@ -0,0 +1,213 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kv
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var utf8bom = []byte{0xEF, 0xBB, 0xBF}
+
+// loader reads and validates KV pairs.
+type loader struct {
+	// Used to read the filesystem.
+	ldr ifc.Loader
+
+	// Used to validate various k8s data fields.
+	validator ifc.Validator
+}
+
+func NewLoader(ldr ifc.Loader, v ifc.Validator) ifc.KvLoader {
+	return &loader{ldr: ldr, validator: v}
+}
+
+func (kvl *loader) Validator() ifc.Validator {
+	return kvl.validator
+}
+
+func (kvl *loader) Load(
+	args types.KvPairSources) (all []types.Pair, err error) {
+	pairs, err := kvl.keyValuesFromEnvFiles(args.EnvSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"env source files: %v",
+			args.EnvSources))
+	}
+	all = append(all, pairs...)
+
+	pairs, err = keyValuesFromLiteralSources(args.LiteralSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"literal sources %v", args.LiteralSources))
+	}
+	all = append(all, pairs...)
+
+	pairs, err = kvl.keyValuesFromFileSources(args.FileSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"file sources: %v", args.FileSources))
+	}
+	return append(all, pairs...), nil
+}
+
+func keyValuesFromLiteralSources(sources []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, s := range sources {
+		k, v, err := parseLiteralSource(s)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, types.Pair{Key: k, Value: v})
+	}
+	return kvs, nil
+}
+
+func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, s := range sources {
+		k, fPath, err := parseFileSource(s)
+		if err != nil {
+			return nil, err
+		}
+		content, err := kvl.ldr.Load(fPath)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, types.Pair{Key: k, Value: string(content)})
+	}
+	return kvs, nil
+}
+
+func (kvl *loader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, p := range paths {
+		content, err := kvl.ldr.Load(p)
+		if err != nil {
+			return nil, err
+		}
+		more, err := kvl.keyValuesFromLines(content)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, more...)
+	}
+	return kvs, nil
+}
+
+// keyValuesFromLines parses given content in to a list of key-value pairs.
+func (kvl *loader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
+	var kvs []types.Pair
+
+	scanner := bufio.NewScanner(bytes.NewReader(content))
+	currentLine := 0
+	for scanner.Scan() {
+		// Process the current line, retrieving a key/value pair if
+		// possible.
+		scannedBytes := scanner.Bytes()
+		kv, err := kvl.keyValuesFromLine(scannedBytes, currentLine)
+		if err != nil {
+			return nil, err
+		}
+		currentLine++
+
+		if len(kv.Key) == 0 {
+			// no key means line was empty or a comment
+			continue
+		}
+
+		kvs = append(kvs, kv)
+	}
+	return kvs, nil
+}
+
+// KeyValuesFromLine returns a kv with blank key if the line is empty or a comment.
+// The value will be retrieved from the environment if necessary.
+func (kvl *loader) keyValuesFromLine(line []byte, currentLine int) (types.Pair, error) {
+	kv := types.Pair{}
+
+	if !utf8.Valid(line) {
+		return kv, fmt.Errorf("line %d has invalid utf8 bytes : %v", line, string(line))
+	}
+
+	// We trim UTF8 BOM from the first line of the file but no others
+	if currentLine == 0 {
+		line = bytes.TrimPrefix(line, utf8bom)
+	}
+
+	// trim the line from all leading whitespace first
+	line = bytes.TrimLeftFunc(line, unicode.IsSpace)
+
+	// If the line is empty or a comment, we return a blank key/value pair.
+	if len(line) == 0 || line[0] == '#' {
+		return kv, nil
+	}
+
+	data := strings.SplitN(string(line), "=", 2)
+	key := data[0]
+	if err := kvl.validator.IsEnvVarName(key); err != nil {
+		return kv, err
+	}
+
+	if len(data) == 2 {
+		kv.Value = data[1]
+	} else {
+		// No value (no `=` in the line) is a signal to obtain the value
+		// from the environment.
+		kv.Value = os.Getenv(key)
+	}
+	kv.Key = key
+	return kv, nil
+}
+
+// ParseFileSource parses the source given.
+//
+//  Acceptable formats include:
+//   1.  source-path: the basename will become the key name
+//   2.  source-name=source-path: the source-name will become the key name and
+//       source-path is the path to the key file.
+//
+// Key names cannot include '='.
+func parseFileSource(source string) (keyName, filePath string, err error) {
+	numSeparators := strings.Count(source, "=")
+	switch {
+	case numSeparators == 0:
+		return path.Base(source), source, nil
+	case numSeparators == 1 && strings.HasPrefix(source, "="):
+		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
+	case numSeparators == 1 && strings.HasSuffix(source, "="):
+		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
+	case numSeparators > 1:
+		return "", "", errors.New("key names or file paths cannot contain '='")
+	default:
+		components := strings.Split(source, "=")
+		return components[0], components[1], nil
+	}
+}
+
+// ParseLiteralSource parses the source key=val pair into its component pieces.
+// This functionality is distinguished from strings.SplitN(source, "=", 2) since
+// it returns an error in the case of empty keys, values, or a missing equals sign.
+func parseLiteralSource(source string) (keyName, value string, err error) {
+	// leading equal is invalid
+	if strings.Index(source, "=") == 0 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	// split after the first equal (so values can have the = character)
+	items := strings.SplitN(source, "=", 2)
+	if len(items) != 2 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	return items[0], strings.Trim(items[1], "\"'"), nil
+}
--- a/api/kv/kv_test.go
+++ b/api/kv/kv_test.go
@@ -0,0 +1,97 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kv
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	ldr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeKvLoader(fSys filesys.FileSystem) *loader {
+	return &loader{
+		ldr:       ldr.NewFileLoaderAtRoot(fSys),
+		validator: valtest_test.MakeFakeValidator()}
+}
+
+func TestKeyValuesFromLines(t *testing.T) {
+	tests := []struct {
+		desc          string
+		content       string
+		expectedPairs []types.Pair
+		expectedErr   bool
+	}{
+		{
+			desc: "valid kv content parse",
+			content: `
+		k1=v1
+		k2=v2
+		`,
+			expectedPairs: []types.Pair{
+				{Key: "k1", Value: "v1"},
+				{Key: "k2", Value: "v2"},
+			},
+			expectedErr: false,
+		},
+		{
+			desc: "content with comments",
+			content: `
+		k1=v1
+		#k2=v2
+		`,
+			expectedPairs: []types.Pair{
+				{Key: "k1", Value: "v1"},
+			},
+			expectedErr: false,
+		},
+		// TODO: add negative testcases
+	}
+
+	kvl := makeKvLoader(filesys.MakeFsInMemory())
+	for _, test := range tests {
+		pairs, err := kvl.keyValuesFromLines([]byte(test.content))
+		if test.expectedErr && err == nil {
+			t.Fatalf("%s should not return error", test.desc)
+		}
+		if !reflect.DeepEqual(pairs, test.expectedPairs) {
+			t.Errorf("%s should succeed, got:%v exptected:%v", test.desc, pairs, test.expectedPairs)
+		}
+	}
+}
+
+func TestKeyValuesFromFileSources(t *testing.T) {
+	tests := []struct {
+		description string
+		sources     []string
+		expected    []types.Pair
+	}{
+		{
+			description: "create kvs from file sources",
+			sources:     []string{"files/app-init.ini"},
+			expected: []types.Pair{
+				{
+					Key:   "app-init.ini",
+					Value: "FOO=bar",
+				},
+			},
+		},
+	}
+
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile("/files/app-init.ini", []byte("FOO=bar"))
+	kvl := makeKvLoader(fSys)
+	for _, tc := range tests {
+		kvs, err := kvl.keyValuesFromFileSources(tc.sources)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(kvs, tc.expected) {
+			t.Fatalf("in testcase: %q updated:\n%#v\ndoesn't match expected:\n%#v\n", tc.description, kvs, tc.expected)
+		}
+	}
+}
--- a/api/loader/fileloader.go
+++ b/api/loader/fileloader.go
@@ -0,0 +1,312 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"fmt"
+	"log"
+	"path/filepath"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// fileLoader is a kustomization's interface to files.
+//
+// The directory in which a kustomization file sits
+// is referred to below as the kustomization's _root_.
+//
+// An instance of fileLoader has an immutable root,
+// and offers a `New` method returning a new loader
+// with a new root.
+//
+// A kustomization file refers to two kinds of files:
+//
+// * supplemental data paths
+//
+//   `Load` is used to visit these paths.
+//
+//   These paths refer to resources, patches,
+//   data for ConfigMaps and Secrets, etc.
+//
+//   The loadRestrictor may disallow certain paths
+//   or classes of paths.
+//
+// * bases (other kustomizations)
+//
+//   `New` is used to load bases.
+//
+//   A base can be either a remote git repo URL, or
+//   a directory specified relative to the current
+//   root. In the former case, the repo is locally
+//   cloned, and the new loader is rooted on a path
+//   in that clone.
+//
+//   As loaders create new loaders, a root history
+//   is established, and used to disallow:
+//
+//   - A base that is a repository that, in turn,
+//     specifies a base repository seen previously
+//     in the loading stack (a cycle).
+//
+//   - An overlay depending on a base positioned at
+//     or above it.  I.e. '../foo' is OK, but '.',
+//     '..', '../..', etc. are disallowed.  Allowing
+//     such a base has no advantages and encourages
+//     cycles, particularly if some future change
+//     were to introduce globbing to file
+//     specifications in the kustomization file.
+//
+// These restrictions assure that kustomizations
+// are self-contained and relocatable, and impose
+// some safety when relying on remote kustomizations,
+// e.g. a remotely loaded ConfigMap generator specified
+// to read from /etc/passwd will fail.
+//
+type fileLoader struct {
+	// Loader that spawned this loader.
+	// Used to avoid cycles.
+	referrer *fileLoader
+
+	// An absolute, cleaned path to a directory.
+	// The Load function will read non-absolute
+	// paths relative to this directory.
+	root filesys.ConfirmedDir
+
+	// Restricts behavior of Load function.
+	loadRestrictor LoadRestrictorFunc
+
+	// If this is non-nil, the files were
+	// obtained from the given repository.
+	repoSpec *git.RepoSpec
+
+	// File system utilities.
+	fSys filesys.FileSystem
+
+	// Used to clone repositories.
+	cloner git.Cloner
+
+	// Used to clean up, as needed.
+	cleaner func() error
+}
+
+const CWD = "."
+
+// NewFileLoaderAtCwd returns a loader that loads from ".".
+// A convenience for kustomize edit commands.
+func NewFileLoaderAtCwd(fSys filesys.FileSystem) *fileLoader {
+	return newLoaderOrDie(
+		RestrictionRootOnly, fSys, CWD)
+}
+
+// NewFileLoaderAtRoot returns a loader that loads from "/".
+// A convenience for tests.
+func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
+	return newLoaderOrDie(
+		RestrictionRootOnly, fSys, string(filepath.Separator))
+}
+
+// Root returns the absolute path that is prepended to any
+// relative paths used in Load.
+func (fl *fileLoader) Root() string {
+	return fl.root.String()
+}
+
+func newLoaderOrDie(
+	lr LoadRestrictorFunc,
+	fSys filesys.FileSystem, path string) *fileLoader {
+	root, err := demandDirectoryRoot(fSys, path)
+	if err != nil {
+		log.Fatalf("unable to make loader at '%s'; %v", path, err)
+	}
+	return newLoaderAtConfirmedDir(
+		lr, root, fSys, nil, git.ClonerUsingGitExec)
+}
+
+// newLoaderAtConfirmedDir returns a new fileLoader with given root.
+func newLoaderAtConfirmedDir(
+	lr LoadRestrictorFunc,
+	root filesys.ConfirmedDir, fSys filesys.FileSystem,
+	referrer *fileLoader, cloner git.Cloner) *fileLoader {
+	return &fileLoader{
+		loadRestrictor: lr,
+		root:           root,
+		referrer:       referrer,
+		fSys:           fSys,
+		cloner:         cloner,
+		cleaner:        func() error { return nil },
+	}
+}
+
+// Assure that the given path is in fact a directory.
+func demandDirectoryRoot(
+	fSys filesys.FileSystem, path string) (filesys.ConfirmedDir, error) {
+	if path == "" {
+		return "", fmt.Errorf(
+			"loader root cannot be empty")
+	}
+	d, f, err := fSys.CleanedAbs(path)
+	if err != nil {
+		return "", fmt.Errorf(
+			"absolute path error in '%s' : %v", path, err)
+	}
+	if f != "" {
+		return "", fmt.Errorf(
+			"got file '%s', but '%s' must be a directory to be a root",
+			f, path)
+	}
+	return d, nil
+}
+
+// New returns a new Loader, rooted relative to current loader,
+// or rooted in a temp directory holding a git repo clone.
+func (fl *fileLoader) New(path string) (ifc.Loader, error) {
+	if path == "" {
+		return nil, fmt.Errorf("new root cannot be empty")
+	}
+	repoSpec, err := git.NewRepoSpecFromUrl(path)
+	if err == nil {
+		// Treat this as git repo clone request.
+		if err := fl.errIfRepoCycle(repoSpec); err != nil {
+			return nil, err
+		}
+		return newLoaderAtGitClone(
+			repoSpec, fl.fSys, fl, fl.cloner)
+	}
+	if filepath.IsAbs(path) {
+		return nil, fmt.Errorf("new root '%s' cannot be absolute", path)
+	}
+	root, err := demandDirectoryRoot(fl.fSys, fl.root.Join(path))
+	if err != nil {
+		return nil, err
+	}
+	if err := fl.errIfGitContainmentViolation(root); err != nil {
+		return nil, err
+	}
+	if err := fl.errIfArgEqualOrHigher(root); err != nil {
+		return nil, err
+	}
+	return newLoaderAtConfirmedDir(
+		fl.loadRestrictor, root, fl.fSys, fl, fl.cloner), nil
+}
+
+// newLoaderAtGitClone returns a new Loader pinned to a temporary
+// directory holding a cloned git repo.
+func newLoaderAtGitClone(
+	repoSpec *git.RepoSpec, fSys filesys.FileSystem,
+	referrer *fileLoader, cloner git.Cloner) (ifc.Loader, error) {
+	cleaner := repoSpec.Cleaner(fSys)
+	err := cloner(repoSpec)
+	if err != nil {
+		cleaner()
+		return nil, err
+	}
+	root, f, err := fSys.CleanedAbs(repoSpec.AbsPath())
+	if err != nil {
+		cleaner()
+		return nil, err
+	}
+	// We don't know that the path requested in repoSpec
+	// is a directory until we actually clone it and look
+	// inside.  That just happened, hence the error check
+	// is here.
+	if f != "" {
+		cleaner()
+		return nil, fmt.Errorf(
+			"'%s' refers to file '%s'; expecting directory",
+			repoSpec.AbsPath(), f)
+	}
+	return &fileLoader{
+		// Clones never allowed to escape root.
+		loadRestrictor: RestrictionRootOnly,
+		root:           root,
+		referrer:       referrer,
+		repoSpec:       repoSpec,
+		fSys:           fSys,
+		cloner:         cloner,
+		cleaner:        cleaner,
+	}, nil
+}
+
+func (fl *fileLoader) errIfGitContainmentViolation(
+	base filesys.ConfirmedDir) error {
+	containingRepo := fl.containingRepo()
+	if containingRepo == nil {
+		return nil
+	}
+	if !base.HasPrefix(containingRepo.CloneDir()) {
+		return fmt.Errorf(
+			"security; bases in kustomizations found in "+
+				"cloned git repos must be within the repo, "+
+				"but base '%s' is outside '%s'",
+			base, containingRepo.CloneDir())
+	}
+	return nil
+}
+
+// Looks back through referrers for a git repo, returning nil
+// if none found.
+func (fl *fileLoader) containingRepo() *git.RepoSpec {
+	if fl.repoSpec != nil {
+		return fl.repoSpec
+	}
+	if fl.referrer == nil {
+		return nil
+	}
+	return fl.referrer.containingRepo()
+}
+
+// errIfArgEqualOrHigher tests whether the argument,
+// is equal to or above the root of any ancestor.
+func (fl *fileLoader) errIfArgEqualOrHigher(
+	candidateRoot filesys.ConfirmedDir) error {
+	if fl.root.HasPrefix(candidateRoot) {
+		return fmt.Errorf(
+			"cycle detected: candidate root '%s' contains visited root '%s'",
+			candidateRoot, fl.root)
+	}
+	if fl.referrer == nil {
+		return nil
+	}
+	return fl.referrer.errIfArgEqualOrHigher(candidateRoot)
+}
+
+// TODO(monopole): Distinguish branches?
+// I.e. Allow a distinction between git URI with
+// path foo and tag bar and a git URI with the same
+// path but a different tag?
+func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
+	// TODO(monopole): Use parsed data instead of Raw().
+	if fl.repoSpec != nil &&
+		strings.HasPrefix(fl.repoSpec.Raw(), newRepoSpec.Raw()) {
+		return fmt.Errorf(
+			"cycle detected: URI '%s' referenced by previous URI '%s'",
+			newRepoSpec.Raw(), fl.repoSpec.Raw())
+	}
+	if fl.referrer == nil {
+		return nil
+	}
+	return fl.referrer.errIfRepoCycle(newRepoSpec)
+}
+
+// Load returns the content of file at the given path,
+// else an error.  Relative paths are taken relative
+// to the root.
+func (fl *fileLoader) Load(path string) ([]byte, error) {
+	if !filepath.IsAbs(path) {
+		path = fl.root.Join(path)
+	}
+	path, err := fl.loadRestrictor(fl.fSys, fl.root, path)
+	if err != nil {
+		return nil, err
+	}
+	return fl.fSys.ReadFile(path)
+}
+
+// Cleanup runs the cleaner.
+func (fl *fileLoader) Cleanup() error {
+	return fl.cleaner()
+}
--- a/api/loader/fileloader_test.go
+++ b/api/loader/fileloader_test.go
@@ -0,0 +1,581 @@
+/// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/pgmconfig"
+)
+
+type testData struct {
+	path            string
+	expectedContent string
+}
+
+var testCases = []testData{
+	{
+		path:            "foo/project/fileA.yaml",
+		expectedContent: "fileA content",
+	},
+	{
+		path:            "foo/project/subdir1/fileB.yaml",
+		expectedContent: "fileB content",
+	},
+	{
+		path:            "foo/project/subdir2/fileC.yaml",
+		expectedContent: "fileC content",
+	},
+	{
+		path:            "foo/project/fileD.yaml",
+		expectedContent: "fileD content",
+	},
+}
+
+func MakeFakeFs(td []testData) filesys.FileSystem {
+	fSys := filesys.MakeFsInMemory()
+	for _, x := range td {
+		fSys.WriteFile("/"+x.path, []byte(x.expectedContent))
+	}
+	return fSys
+}
+
+func makeLoader() *fileLoader {
+	return NewFileLoaderAtRoot(MakeFakeFs(testCases))
+
+}
+func TestLoaderLoad(t *testing.T) {
+	l1 := makeLoader()
+	if "/" != l1.Root() {
+		t.Fatalf("incorrect root: '%s'\n", l1.Root())
+	}
+	for _, x := range testCases {
+		b, err := l1.Load(x.path)
+		if err != nil {
+			t.Fatalf("unexpected load error: %v", err)
+		}
+		if !reflect.DeepEqual([]byte(x.expectedContent), b) {
+			t.Fatalf("in load expected %s, but got %s", x.expectedContent, b)
+		}
+	}
+	l2, err := l1.New("foo/project")
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if "/foo/project" != l2.Root() {
+		t.Fatalf("incorrect root: %s\n", l2.Root())
+	}
+	for _, x := range testCases {
+		b, err := l2.Load(strings.TrimPrefix(x.path, "foo/project/"))
+		if err != nil {
+			t.Fatalf("unexpected load error %v", err)
+		}
+		if !reflect.DeepEqual([]byte(x.expectedContent), b) {
+			t.Fatalf("in load expected %s, but got %s", x.expectedContent, b)
+		}
+	}
+	l2, err = l1.New("foo/project/") // Assure trailing slash stripped
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if "/foo/project" != l2.Root() {
+		t.Fatalf("incorrect root: %s\n", l2.Root())
+	}
+}
+
+func TestLoaderNewSubDir(t *testing.T) {
+	l1, err := makeLoader().New("foo/project")
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	l2, err := l1.New("subdir1")
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	if "/foo/project/subdir1" != l2.Root() {
+		t.Fatalf("incorrect root: %s\n", l2.Root())
+	}
+	x := testCases[1]
+	b, err := l2.Load("fileB.yaml")
+	if err != nil {
+		t.Fatalf("unexpected load error %v", err)
+	}
+	if !reflect.DeepEqual([]byte(x.expectedContent), b) {
+		t.Fatalf("in load expected %s, but got %s", x.expectedContent, b)
+	}
+}
+
+func TestLoaderBadRelative(t *testing.T) {
+	l1, err := makeLoader().New("foo/project/subdir1")
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if "/foo/project/subdir1" != l1.Root() {
+		t.Fatalf("incorrect root: %s\n", l1.Root())
+	}
+
+	// Cannot cd into a file.
+	l2, err := l1.New("fileB.yaml")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's not okay to stay at the same place.
+	l2, err = l1.New(".")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's not okay to go up and back down into same place.
+	l2, err = l1.New("../subdir1")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's not okay to go up via a relative path.
+	l2, err = l1.New("..")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's not okay to go up via an absolute path.
+	l2, err = l1.New("/foo/project")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's not okay to go to the root.
+	l2, err = l1.New("/")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l2.Root())
+	}
+
+	// It's okay to go up and down to a sibling.
+	l2, err = l1.New("../subdir2")
+	if err != nil {
+		t.Fatalf("unexpected new error %v", err)
+	}
+	if "/foo/project/subdir2" != l2.Root() {
+		t.Fatalf("incorrect root: %s\n", l2.Root())
+	}
+	x := testCases[2]
+	b, err := l2.Load("fileC.yaml")
+	if err != nil {
+		t.Fatalf("unexpected load error %v", err)
+	}
+	if !reflect.DeepEqual([]byte(x.expectedContent), b) {
+		t.Fatalf("in load expected %s, but got %s", x.expectedContent, b)
+	}
+
+	// It's not OK to go over to a previously visited directory.
+	// Must disallow going back and forth in a cycle.
+	l1, err = l2.New("../subdir1")
+	if err == nil {
+		t.Fatalf("expected err, but got root %s", l1.Root())
+	}
+}
+
+func TestLoaderMisc(t *testing.T) {
+	l := makeLoader()
+	_, err := l.New("")
+	if err == nil {
+		t.Fatalf("Expected error for empty root location not returned")
+	}
+	_, err = l.New("https://google.com/project")
+	if err == nil {
+		t.Fatalf("Expected error")
+	}
+}
+
+const (
+	contentOk           = "hi there, i'm OK data"
+	contentExteriorData = "i am data from outside the root"
+)
+
+// Create a structure like this
+//
+//   /tmp/kustomize-test-random
+//   ├── base
+//   │   ├── okayData
+//   │   ├── symLinkToOkayData -> okayData
+//   │   └── symLinkToExteriorData -> ../exteriorData
+//   └── exteriorData
+//
+func commonSetupForLoaderRestrictionTest() (string, filesys.FileSystem, error) {
+	dir, err := ioutil.TempDir("", "kustomize-test-")
+	if err != nil {
+		return "", nil, err
+	}
+	fSys := filesys.MakeFsOnDisk()
+	fSys.Mkdir(filepath.Join(dir, "base"))
+
+	fSys.WriteFile(
+		filepath.Join(dir, "base", "okayData"), []byte(contentOk))
+
+	fSys.WriteFile(
+		filepath.Join(dir, "exteriorData"), []byte(contentExteriorData))
+
+	os.Symlink(
+		filepath.Join(dir, "base", "okayData"),
+		filepath.Join(dir, "base", "symLinkToOkayData"))
+	os.Symlink(
+		filepath.Join(dir, "exteriorData"),
+		filepath.Join(dir, "base", "symLinkToExteriorData"))
+	return dir, fSys, nil
+}
+
+// Make sure everything works when loading files
+// in or below the loader root.
+func doSanityChecksAndDropIntoBase(
+	t *testing.T, l ifc.Loader) ifc.Loader {
+	data, err := l.Load(path.Join("base", "okayData"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != contentOk {
+		t.Fatalf("unexpected content: %v", data)
+	}
+	data, err = l.Load("exteriorData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != contentExteriorData {
+		t.Fatalf("unexpected content: %v", data)
+	}
+
+	// Drop in.
+	l, err = l.New("base")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Reading okayData works.
+	data, err = l.Load("okayData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != contentOk {
+		t.Fatalf("unexpected content: %v", data)
+	}
+
+	// Reading local symlink to okayData works.
+	data, err = l.Load("symLinkToOkayData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != contentOk {
+		t.Fatalf("unexpected content: %v", data)
+	}
+	return l
+}
+
+func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
+	dir, fSys, err := commonSetupForLoaderRestrictionTest()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	var l ifc.Loader
+
+	l = newLoaderOrDie(RestrictionRootOnly, fSys, dir)
+
+	l = doSanityChecksAndDropIntoBase(t, l)
+
+	// Reading symlink to exteriorData fails.
+	_, err = l.Load("symLinkToExteriorData")
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "is not in or below") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	// Attempt to read "up" fails, though earlier we were
+	// able to read this file when root was "..".
+	_, err = l.Load("../exteriorData")
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "is not in or below") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestRestrictionNoneInRealLoader(t *testing.T) {
+	dir, fSys, err := commonSetupForLoaderRestrictionTest()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	var l ifc.Loader
+
+	l = newLoaderOrDie(RestrictionNone, fSys, dir)
+
+	l = doSanityChecksAndDropIntoBase(t, l)
+
+	// Reading symlink to exteriorData works.
+	_, err = l.Load("symLinkToExteriorData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Attempt to read "up" works.
+	_, err = l.Load("../exteriorData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func splitOnNthSlash(v string, n int) (string, string) {
+	left := ""
+	for i := 0; i < n; i++ {
+		k := strings.Index(v, "/")
+		if k < 0 {
+			break
+		}
+		left = left + v[:k+1]
+		v = v[k+1:]
+	}
+	return left[:len(left)-1], v
+}
+
+func TestSplit(t *testing.T) {
+	p := "a/b/c/d/e/f/g"
+	if left, right := splitOnNthSlash(p, 2); left != "a/b" || right != "c/d/e/f/g" {
+		t.Fatalf("got left='%s', right='%s'", left, right)
+	}
+	if left, right := splitOnNthSlash(p, 3); left != "a/b/c" || right != "d/e/f/g" {
+		t.Fatalf("got left='%s', right='%s'", left, right)
+	}
+	if left, right := splitOnNthSlash(p, 6); left != "a/b/c/d/e/f" || right != "g" {
+		t.Fatalf("got left='%s', right='%s'", left, right)
+	}
+}
+
+func TestNewLoaderAtGitClone(t *testing.T) {
+	rootUrl := "github.com/someOrg/someRepo"
+	pathInRepo := "foo/base"
+	url := rootUrl + "/" + pathInRepo
+	coRoot := "/tmp"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(coRoot)
+	fSys.MkdirAll(coRoot + "/" + pathInRepo)
+	fSys.WriteFile(
+		coRoot+"/"+pathInRepo+"/"+
+			pgmconfig.DefaultKustomizationFileName(),
+		[]byte(`
+whatever
+`))
+
+	repoSpec, err := git.NewRepoSpecFromUrl(url)
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	l, err := newLoaderAtGitClone(
+		repoSpec, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(coRoot)))
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if coRoot+"/"+pathInRepo != l.Root() {
+		t.Fatalf("expected root '%s', got '%s'\n",
+			coRoot+"/"+pathInRepo, l.Root())
+	}
+	if _, err = l.New(url); err == nil {
+		t.Fatalf("expected cycle error 1")
+	}
+	if _, err = l.New(rootUrl + "/" + "foo"); err == nil {
+		t.Fatalf("expected cycle error 2")
+	}
+
+	pathInRepo = "foo/overlay"
+	fSys.MkdirAll(coRoot + "/" + pathInRepo)
+	url = rootUrl + "/" + pathInRepo
+	l2, err := l.New(url)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if coRoot+"/"+pathInRepo != l2.Root() {
+		t.Fatalf("expected root '%s', got '%s'\n",
+			coRoot+"/"+pathInRepo, l2.Root())
+	}
+}
+
+func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
+	// Define an overlay-base structure in the file system.
+	topDir := "/whatever"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir + "/highBase")
+	fSys.MkdirAll(cloneRoot + "/foo/base")
+	fSys.MkdirAll(cloneRoot + "/foo/overlay")
+
+	var l1 ifc.Loader
+
+	// Establish that a local overlay can navigate
+	// to the local bases.
+	l1 = newLoaderOrDie(
+		RestrictionRootOnly, fSys, cloneRoot+"/foo/overlay")
+	if l1.Root() != cloneRoot+"/foo/overlay" {
+		t.Fatalf("unexpected root %s", l1.Root())
+	}
+	l2, err := l1.New("../base")
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	if l2.Root() != cloneRoot+"/foo/base" {
+		t.Fatalf("unexpected root %s", l2.Root())
+	}
+	l3, err := l2.New("../../../highBase")
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	if l3.Root() != topDir+"/highBase" {
+		t.Fatalf("unexpected root %s", l3.Root())
+	}
+
+	// Establish that a Kustomization found in cloned
+	// repo can reach (non-remote) bases inside the clone
+	// but cannot reach a (non-remote) base outside the
+	// clone but legitimately on the local file system.
+	// This is to avoid a surprising interaction between
+	// a remote K and local files.  The remote K would be
+	// non-functional on its own since by definition it
+	// would refer to a non-remote base file that didn't
+	// exist in its own repository, so presumably the
+	// remote K would be deliberately designed to phish
+	// for local K's.
+	repoSpec, err := git.NewRepoSpecFromUrl(
+		"github.com/someOrg/someRepo/foo/overlay")
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	l1, err = newLoaderAtGitClone(
+		repoSpec, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if l1.Root() != cloneRoot+"/foo/overlay" {
+		t.Fatalf("unexpected root %s", l1.Root())
+	}
+	// This is okay.
+	l2, err = l1.New("../base")
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	if l2.Root() != cloneRoot+"/foo/base" {
+		t.Fatalf("unexpected root %s", l2.Root())
+	}
+	// This is not okay.
+	l3, err = l2.New("../../../highBase")
+	if err == nil {
+		t.Fatalf("expected err")
+	}
+	if !strings.Contains(err.Error(),
+		"base '/whatever/highBase' is outside '/whatever/someClone'") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestLocalLoaderReferencingGitBase(t *testing.T) {
+	topDir := "/whatever"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot + "/foo/base")
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	l1 := newLoaderAtConfirmedDir(
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+	if l1.Root() != topDir {
+		t.Fatalf("unexpected root %s", l1.Root())
+	}
+	l2, err := l1.New("github.com/someOrg/someRepo/foo/base")
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	if l2.Root() != cloneRoot+"/foo/base" {
+		t.Fatalf("unexpected root %s", l2.Root())
+	}
+}
+
+func TestRepoDirectCycleDetection(t *testing.T) {
+	topDir := "/cycles"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot)
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	l1 := newLoaderAtConfirmedDir(
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+	p1 := "github.com/someOrg/someRepo/foo"
+	rs1, err := git.NewRepoSpecFromUrl(p1)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l1.repoSpec = rs1
+	_, err = l1.New(p1)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "cycle detected") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestRepoIndirectCycleDetection(t *testing.T) {
+	topDir := "/cycles"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot)
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l0 := newLoaderAtConfirmedDir(
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+
+	p1 := "github.com/someOrg/someRepo1"
+	p2 := "github.com/someOrg/someRepo2"
+
+	l1, err := l0.New(p1)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l2, err := l1.New(p2)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	_, err = l2.New(p1)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "cycle detected") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
--- a/api/loader/loader.go
+++ b/api/loader/loader.go
@@ -0,0 +1,34 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package loader has a data loading interface and various implementations.
+package loader
+
+import (
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// NewLoader returns a Loader pointed at the given target.
+// If the target is remote, the loader will be restricted
+// to the root and below only.  If the target is local, the
+// loader will have the restrictions passed in.  Regardless,
+// if a local target attempts to transitively load remote bases,
+// the remote bases will all be root-only restricted.
+func NewLoader(
+	lr LoadRestrictorFunc,
+	target string, fSys filesys.FileSystem) (ifc.Loader, error) {
+	repoSpec, err := git.NewRepoSpecFromUrl(target)
+	if err == nil {
+		// The target qualifies as a remote git target.
+		return newLoaderAtGitClone(
+			repoSpec, fSys, nil, git.ClonerUsingGitExec)
+	}
+	root, err := demandDirectoryRoot(fSys, target)
+	if err != nil {
+		return nil, err
+	}
+	return newLoaderAtConfirmedDir(
+		lr, root, fSys, nil, git.ClonerUsingGitExec), nil
+}
--- a/api/loader/loadrestrictions.go
+++ b/api/loader/loadrestrictions.go
@@ -0,0 +1,76 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+//go:generate stringer -type=loadRestrictions
+type loadRestrictions int
+
+const (
+	unknown loadRestrictions = iota
+	rootOnly
+	none
+)
+
+const (
+	flagName = "load_restrictor"
+)
+
+var (
+	flagValue = rootOnly.String()
+	flagHelp  = "if set to '" + none.String() +
+		"', local kustomizations may load files from outside their root. " +
+		"This does, however, break the relocatability of the kustomization."
+)
+
+func AddFlagLoadRestrictor(set *pflag.FlagSet) {
+	set.StringVar(
+		&flagValue, flagName,
+		rootOnly.String(), flagHelp)
+}
+
+func ValidateFlagLoadRestrictor() (LoadRestrictorFunc, error) {
+	switch flagValue {
+	case rootOnly.String():
+		return RestrictionRootOnly, nil
+	case none.String():
+		return RestrictionNone, nil
+	default:
+		return nil, fmt.Errorf(
+			"illegal flag value --%s %s; legal values: %v",
+			flagName, flagValue,
+			[]string{rootOnly.String(), none.String()})
+	}
+}
+
+type LoadRestrictorFunc func(
+	filesys.FileSystem, filesys.ConfirmedDir, string) (string, error)
+
+func RestrictionRootOnly(
+	fSys filesys.FileSystem, root filesys.ConfirmedDir, path string) (string, error) {
+	d, f, err := fSys.CleanedAbs(path)
+	if err != nil {
+		return "", err
+	}
+	if f == "" {
+		return "", fmt.Errorf("'%s' must be a file", path)
+	}
+	if !d.HasPrefix(root) {
+		return "", fmt.Errorf(
+			"security; file '%s' is not in or below '%s'",
+			path, root)
+	}
+	return d.Join(f), nil
+}
+
+func RestrictionNone(
+	_ filesys.FileSystem, _ filesys.ConfirmedDir, path string) (string, error) {
+	return path, nil
+}
--- a/api/loader/loadrestrictions_string.go
+++ b/api/loader/loadrestrictions_string.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by "stringer -type=loadRestrictions"; DO NOT EDIT.
+
+package loader
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[unknown-0]
+	_ = x[rootOnly-1]
+	_ = x[none-2]
+}
+
+const _loadRestrictions_name = "unknownrootOnlynone"
+
+var _loadRestrictions_index = [...]uint8{0, 7, 15, 19}
+
+func (i loadRestrictions) String() string {
+	if i < 0 || i >= loadRestrictions(len(_loadRestrictions_index)-1) {
+		return "loadRestrictions(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _loadRestrictions_name[_loadRestrictions_index[i]:_loadRestrictions_index[i+1]]
+}
--- a/api/loader/loadrestrictions_test.go
+++ b/api/loader/loadrestrictions_test.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package loader
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+func TestRestrictionNone(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	root := filesys.ConfirmedDir("irrelevant")
+	path := "whatever"
+	p, err := RestrictionNone(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+}
+
+func TestRestrictionRootOnly(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	root := filesys.ConfirmedDir("/tmp/foo")
+
+	path := "/tmp/foo/whatever/beans"
+	p, err := RestrictionRootOnly(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+
+	// Legal.
+	path = "/tmp/foo/whatever/../../foo/whatever"
+	p, err = RestrictionRootOnly(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path = "/tmp/foo/whatever"
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+
+	// Illegal.
+	path = "/tmp/illegal"
+	_, err = RestrictionRootOnly(fSys, root, path)
+	if err == nil {
+		t.Fatal("should have an error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"file '/tmp/illegal' is not in or below '/tmp/foo'") {
+		t.Fatalf("unexpected err: %s", err)
+	}
+}
--- a/api/main.go
+++ b/api/main.go
@@ -0,0 +1,21 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// A dummy main to help with releasing the kustomize API module.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/provenance"
+)
+
+// TODO: delete this when we find a better way to generate release notes.
+func main() {
+	fmt.Println(`
+This 'main' exists only to make goreleaser create release notes for the API.
+See https://github.com/goreleaser/goreleaser/issues/981
+and https://github.com/kubernetes-sigs/kustomize/tree/master/releasing`)
+	provenance.GetProvenance().Print(os.Stdout, false)
+}
--- a/api/pgmconfig/pgmconfig.go
+++ b/api/pgmconfig/pgmconfig.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package pgmconfig
+
+// RecognizedKustomizationFileNames is a list of file names
+// that kustomize recognizes.
+// To avoid ambiguity, a kustomization directory may not
+// contain more than one match to this list.
+func RecognizedKustomizationFileNames() []string {
+	return []string{
+		"kustomization.yaml",
+		"kustomization.yml",
+		"Kustomization",
+	}
+}
+
+func DefaultKustomizationFileName() string {
+	return RecognizedKustomizationFileNames()[0]
+}
+
+const (
+	// An environment variable to consult for kustomization
+	// configuration data.  See:
+	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+	XdgConfigHome = "XDG_CONFIG_HOME"
+
+	// Use this when XdgConfigHome not defined.
+	DefaultConfigSubdir = ".config"
+
+	// Program name, for help, finding the XDG_CONFIG_DIR, etc.
+	ProgramName = "kustomize"
+
+	// TODO: delete this.  it's a copy of a const
+	// defined elsewhere but used by pluginator.
+	DomainName = "sigs.k8s.io"
+
+	// TODO: delete this.  its a copy of a const
+	// defined elsewhere but used by pluginator.
+	PluginRoot = "plugin"
+)
--- a/api/plugins/builtinconfig/consts/commonannotations.go
+++ b/api/plugins/builtinconfig/consts/commonannotations.go
@@ -0,0 +1,47 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const commonAnnotationFieldSpecs = `
+commonAnnotations:
+- path: metadata/annotations
+  create: true
+
+- path: spec/template/metadata/annotations
+  create: true
+  version: v1
+  kind: ReplicationController
+
+- path: spec/template/metadata/annotations
+  create: true
+  kind: Deployment
+
+- path: spec/template/metadata/annotations
+  create: true
+  kind: ReplicaSet
+
+- path: spec/template/metadata/annotations
+  create: true
+  kind: DaemonSet
+
+- path: spec/template/metadata/annotations
+  create: true
+  kind: StatefulSet
+
+- path: spec/template/metadata/annotations
+  create: true
+  group: batch
+  kind: Job
+
+- path: spec/jobTemplate/metadata/annotations
+  create: true
+  group: batch
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/metadata/annotations
+  create: true
+  group: batch
+  kind: CronJob
+
+`
--- a/api/plugins/builtinconfig/consts/commonlabels.go
+++ b/api/plugins/builtinconfig/consts/commonlabels.go
@@ -0,0 +1,149 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const commonLabelFieldSpecs = `
+commonLabels:
+- path: metadata/labels
+  create: true
+
+- path: spec/selector
+  create: true
+  version: v1
+  kind: Service
+
+- path: spec/selector
+  create: true
+  version: v1
+  kind: ReplicationController
+
+- path: spec/template/metadata/labels
+  create: true
+  version: v1
+  kind: ReplicationController
+
+- path: spec/selector/matchLabels
+  create: true
+  kind: Deployment
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: Deployment
+
+- path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
+- path: spec/template/spec/affinity/podAffinity/requiredDuringSchedulingIgnoredDuringExecution/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
+- path: spec/template/spec/affinity/podAntiAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
+- path: spec/template/spec/affinity/podAntiAffinity/requiredDuringSchedulingIgnoredDuringExecution/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: Deployment
+
+- path: spec/selector/matchLabels
+  create: true
+  kind: ReplicaSet
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: ReplicaSet
+
+- path: spec/selector/matchLabels
+  create: true
+  kind: DaemonSet
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: DaemonSet
+
+- path: spec/selector/matchLabels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/spec/affinity/podAffinity/requiredDuringSchedulingIgnoredDuringExecution/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/spec/affinity/podAntiAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/spec/affinity/podAntiAffinity/requiredDuringSchedulingIgnoredDuringExecution/labelSelector/matchLabels
+  create: false
+  group: apps
+  kind: StatefulSet
+
+- path: spec/volumeClaimTemplates[]/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/selector/matchLabels
+  create: false
+  group: batch
+  kind: Job
+
+- path: spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: Job
+
+- path: spec/jobTemplate/spec/selector/matchLabels
+  create: false
+  group: batch
+  kind: CronJob
+
+- path: spec/jobTemplate/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+
+- path: spec/selector/matchLabels
+  create: false
+  group: policy
+  kind: PodDisruptionBudget
+
+- path: spec/podSelector/matchLabels
+  create: false
+  group: networking.k8s.io
+  kind: NetworkPolicy
+
+- path: spec/ingress/from/podSelector/matchLabels
+  create: false
+  group: networking.k8s.io
+  kind: NetworkPolicy
+
+- path: spec/egress/to/podSelector/matchLabels
+  create: false
+  group: networking.k8s.io
+  kind: NetworkPolicy
+`
--- a/api/plugins/builtinconfig/consts/defaultconfig.go
+++ b/api/plugins/builtinconfig/consts/defaultconfig.go
@@ -0,0 +1,38 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+import (
+	"bytes"
+)
+
+// GetDefaultFieldSpecs returns default fieldSpecs.
+func GetDefaultFieldSpecs() []byte {
+	configData := [][]byte{
+		[]byte(namePrefixFieldSpecs),
+		[]byte(commonLabelFieldSpecs),
+		[]byte(commonAnnotationFieldSpecs),
+		[]byte(namespaceFieldSpecs),
+		[]byte(varReferenceFieldSpecs),
+		[]byte(nameReferenceFieldSpecs),
+		[]byte(imagesFieldSpecs),
+		[]byte(replicasFieldSpecs),
+	}
+	return bytes.Join(configData, []byte("\n"))
+}
+
+// GetDefaultFieldSpecsAsMap returns default fieldSpecs
+// as a string->string map.
+func GetDefaultFieldSpecsAsMap() map[string]string {
+	result := make(map[string]string)
+	result["nameprefix"] = namePrefixFieldSpecs
+	result["commonlabels"] = commonLabelFieldSpecs
+	result["commonannotations"] = commonAnnotationFieldSpecs
+	result["namespace"] = namespaceFieldSpecs
+	result["varreference"] = varReferenceFieldSpecs
+	result["namereference"] = nameReferenceFieldSpecs
+	result["images"] = imagesFieldSpecs
+	result["replicas"] = replicasFieldSpecs
+	return result
+}
--- a/api/plugins/builtinconfig/consts/doc.go
+++ b/api/plugins/builtinconfig/consts/doc.go
@@ -0,0 +1,5 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package consts provides builtin plugin configuration data.
+package consts
--- a/api/plugins/builtinconfig/consts/images.go
+++ b/api/plugins/builtinconfig/consts/images.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	// imageFieldSpecs is left empty since `containers` and `initContainers`
+	// of *ANY* kind in *ANY* path are builtin supported in code
+	imagesFieldSpecs = ``
+)
--- a/api/plugins/builtinconfig/consts/nameprefix.go
+++ b/api/plugins/builtinconfig/consts/nameprefix.go
@@ -0,0 +1,11 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	namePrefixFieldSpecs = `
+namePrefix:
+- path: metadata/name
+`
+)
--- a/api/plugins/builtinconfig/consts/namereference.go
+++ b/api/plugins/builtinconfig/consts/namereference.go
@@ -0,0 +1,347 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	nameReferenceFieldSpecs = `
+nameReference:
+- kind: Deployment
+  fieldSpecs:
+  - path: spec/scaleTargetRef/name
+    kind: HorizontalPodAutoscaler
+
+- kind: ReplicationController
+  fieldSpecs:
+  - path: spec/scaleTargetRef/name
+    kind: HorizontalPodAutoscaler
+
+- kind: ReplicaSet
+  fieldSpecs:
+  - path: spec/scaleTargetRef/name
+    kind: HorizontalPodAutoscaler
+
+- kind: ConfigMap
+  version: v1
+  fieldSpecs:
+  - path: spec/volumes/configMap/name
+    version: v1
+    kind: Pod
+  - path: spec/containers/env/valueFrom/configMapKeyRef/name
+    version: v1
+    kind: Pod
+  - path: spec/initContainers/env/valueFrom/configMapKeyRef/name
+    version: v1
+    kind: Pod
+  - path: spec/containers/envFrom/configMapRef/name
+    version: v1
+    kind: Pod
+  - path: spec/initContainers/envFrom/configMapRef/name
+    version: v1
+    kind: Pod
+  - path: spec/volumes/projected/sources/configMap/name
+    version: v1
+    kind: Pod
+  - path: spec/template/spec/volumes/configMap/name
+    kind: Deployment
+  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: Deployment
+  - path: spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: Deployment
+  - path: spec/template/spec/containers/envFrom/configMapRef/name
+    kind: Deployment
+  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: Deployment
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: Deployment
+  - path: spec/template/spec/volumes/configMap/name
+    kind: ReplicaSet
+  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/containers/envFrom/configMapRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: ReplicaSet
+  - path: spec/template/spec/volumes/configMap/name
+    kind: DaemonSet
+  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/containers/envFrom/configMapRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: DaemonSet
+  - path: spec/template/spec/volumes/configMap/name
+    kind: StatefulSet
+  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/containers/envFrom/configMapRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: StatefulSet
+  - path: spec/template/spec/volumes/configMap/name
+    kind: Job
+  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: Job
+  - path: spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: Job
+  - path: spec/template/spec/containers/envFrom/configMapRef/name
+    kind: Job
+  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: Job
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: Job
+  - path: spec/jobTemplate/spec/template/spec/volumes/configMap/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/volumes/projected/sources/configMap/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/containers/envFrom/configMapRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/initContainers/envFrom/configMapRef/name
+    kind: CronJob
+
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/volumes/secret/secretName
+    version: v1
+    kind: Pod
+  - path: spec/containers/env/valueFrom/secretKeyRef/name
+    version: v1
+    kind: Pod
+  - path: spec/initContainers/env/valueFrom/secretKeyRef/name
+    version: v1
+    kind: Pod
+  - path: spec/containers/envFrom/secretRef/name
+    version: v1
+    kind: Pod
+  - path: spec/initContainers/envFrom/secretRef/name
+    version: v1
+    kind: Pod
+  - path: spec/imagePullSecrets/name
+    version: v1
+    kind: Pod
+  - path: spec/volumes/projected/sources/secret/name
+    version: v1
+    kind: Pod
+  - path: spec/template/spec/volumes/secret/secretName
+    kind: Deployment
+  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: Deployment
+  - path: spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: Deployment
+  - path: spec/template/spec/containers/envFrom/secretRef/name
+    kind: Deployment
+  - path: spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: Deployment
+  - path: spec/template/spec/imagePullSecrets/name
+    kind: Deployment
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: Deployment
+  - path: spec/template/spec/volumes/secret/secretName
+    kind: ReplicaSet
+  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/containers/envFrom/secretRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: ReplicaSet
+  - path: spec/template/spec/imagePullSecrets/name
+    kind: ReplicaSet
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: ReplicaSet
+  - path: spec/template/spec/volumes/secret/secretName
+    kind: DaemonSet
+  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/containers/envFrom/secretRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: DaemonSet
+  - path: spec/template/spec/imagePullSecrets/name
+    kind: DaemonSet
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: DaemonSet
+  - path: spec/template/spec/volumes/secret/secretName
+    kind: StatefulSet
+  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/containers/envFrom/secretRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: StatefulSet
+  - path: spec/template/spec/imagePullSecrets/name
+    kind: StatefulSet
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: StatefulSet
+  - path: spec/template/spec/volumes/secret/secretName
+    kind: Job
+  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: Job
+  - path: spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: Job
+  - path: spec/template/spec/containers/envFrom/secretRef/name
+    kind: Job
+  - path: spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: Job
+  - path: spec/template/spec/imagePullSecrets/name
+    kind: Job
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: Job
+  - path: spec/jobTemplate/spec/template/spec/volumes/secret/secretName
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/volumes/projected/sources/secret/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/containers/envFrom/secretRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/initContainers/envFrom/secretRef/name
+    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/imagePullSecrets/name
+    kind: CronJob
+  - path: spec/tls/secretName
+    kind: Ingress
+  - path: metadata/annotations/ingress.kubernetes.io\/auth-secret
+    kind: Ingress
+  - path: metadata/annotations/nginx.ingress.kubernetes.io\/auth-secret
+    kind: Ingress
+  - path: metadata/annotations/nginx.ingress.kubernetes.io\/auth-tls-secret
+    kind: Ingress
+  - path: imagePullSecrets/name
+    kind: ServiceAccount
+  - path: parameters/secretName
+    kind: StorageClass
+  - path: parameters/adminSecretName
+    kind: StorageClass
+  - path: parameters/userSecretName
+    kind: StorageClass
+  - path: parameters/secretRef
+    kind: StorageClass
+  - path: rules/resourceNames
+    kind: Role
+  - path: rules/resourceNames
+    kind: ClusterRole
+
+- kind: Service
+  version: v1
+  fieldSpecs:
+  - path: spec/serviceName
+    kind: StatefulSet
+    group: apps
+  - path: spec/rules/http/paths/backend/serviceName
+    kind: Ingress
+  - path: spec/backend/serviceName
+    kind: Ingress
+  - path: spec/service/name
+    kind: APIService
+    group: apiregistration.k8s.io
+  - path: webhooks/clientConfig/service
+    kind: ValidatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+  - path: webhooks/clientConfig/service
+    kind: MutatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+
+- kind: Role
+  group: rbac.authorization.k8s.io
+  fieldSpecs:
+  - path: roleRef/name
+    kind: RoleBinding
+    group: rbac.authorization.k8s.io
+
+- kind: ClusterRole
+  group: rbac.authorization.k8s.io
+  fieldSpecs:
+  - path: roleRef/name
+    kind: RoleBinding
+    group: rbac.authorization.k8s.io
+  - path: roleRef/name
+    kind: ClusterRoleBinding
+    group: rbac.authorization.k8s.io
+
+- kind: ServiceAccount
+  version: v1
+  fieldSpecs:
+  - path: subjects
+    kind: RoleBinding
+    group: rbac.authorization.k8s.io
+  - path: subjects
+    kind: ClusterRoleBinding
+    group: rbac.authorization.k8s.io
+  - path: spec/serviceAccountName
+    kind: Pod
+  - path: spec/template/spec/serviceAccountName
+    kind: StatefulSet
+  - path: spec/template/spec/serviceAccountName
+    kind: Deployment
+  - path: spec/template/spec/serviceAccountName
+    kind: ReplicationController
+  - path: spec/jobTemplate/spec/template/spec/serviceAccountName
+    kind: CronJob
+  - path: spec/template/spec/serviceAccountName
+    kind: Job
+  - path: spec/template/spec/serviceAccountName
+    kind: DaemonSet
+
+- kind: PersistentVolumeClaim
+  version: v1
+  fieldSpecs:
+  - path: spec/volumes/persistentVolumeClaim/claimName
+    kind: Pod
+  - path: spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: StatefulSet
+  - path: spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: Deployment
+  - path: spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: ReplicationController
+  - path: spec/jobTemplate/spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: CronJob
+  - path: spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: Job
+  - path: spec/template/spec/volumes/persistentVolumeClaim/claimName
+    kind: DaemonSet
+
+- kind: PersistentVolume
+  version: v1
+  fieldSpecs:
+  - path: spec/volumeName
+    kind: PersistentVolumeClaim
+  - path: rules/resourceNames
+    kind: ClusterRole
+
+- kind: StorageClass
+  version: v1
+  group: storage.k8s.io
+  fieldSpecs:
+  - path: spec/storageClassName
+    kind: PersistentVolume
+  - path: spec/storageClassName
+    kind: PersistentVolumeClaim
+  - path: spec/volumeClaimTemplates/spec/storageClassName
+    kind: StatefulSet
+`
+)
--- a/api/plugins/builtinconfig/consts/namespace.go
+++ b/api/plugins/builtinconfig/consts/namespace.go
@@ -0,0 +1,16 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	namespaceFieldSpecs = `
+namespace:
+- path: metadata/namespace
+  create: true
+- path: subjects
+  kind: RoleBinding
+- path: subjects
+  kind: ClusterRoleBinding
+`
+)
--- a/api/plugins/builtinconfig/consts/replicas.go
+++ b/api/plugins/builtinconfig/consts/replicas.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const replicasFieldSpecs = `
+replicas:
+- path: spec/replicas
+  create: true
+  kind: Deployment
+
+- path: spec/replicas
+  create: true
+  kind: ReplicationController
+
+- path: spec/replicas
+  create: true
+  kind: ReplicaSet
+
+- path: spec/replicas
+  create: true
+  kind: StatefulSet
+`
--- a/api/plugins/builtinconfig/consts/varreference.go
+++ b/api/plugins/builtinconfig/consts/varreference.go
@@ -0,0 +1,194 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	varReferenceFieldSpecs = `
+varReference:
+- path: spec/jobTemplate/spec/template/spec/containers/args
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/containers/command
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/containers/env/value
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/containers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/initContainers/args
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/initContainers/command
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/initContainers/env/value
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/template/spec/containers/args
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/command
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/env/value
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/args
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/command
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/args
+  kind: Deployment
+
+- path: spec/template/spec/containers/command
+  kind: Deployment
+
+- path: spec/template/spec/containers/env/value
+  kind: Deployment
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/args
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/command
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/env/value
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: spec/rules/host
+  kind: Ingress
+
+- path: spec/tls/hosts
+  kind: Ingress
+  
+- path: spec/tls/secretName
+  kind: Ingress
+
+- path: spec/template/spec/containers/args
+  kind: Job
+
+- path: spec/template/spec/containers/command
+  kind: Job
+
+- path: spec/template/spec/containers/env/value
+  kind: Job
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/template/spec/initContainers/args
+  kind: Job
+
+- path: spec/template/spec/initContainers/command
+  kind: Job
+
+- path: spec/template/spec/initContainers/env/value
+  kind: Job
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/containers/args
+  kind: Pod
+
+- path: spec/containers/command
+  kind: Pod
+
+- path: spec/containers/env/value
+  kind: Pod
+
+- path: spec/containers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/initContainers/args
+  kind: Pod
+
+- path: spec/initContainers/command
+  kind: Pod
+
+- path: spec/initContainers/env/value
+  kind: Pod
+
+- path: spec/initContainers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/template/spec/containers/args
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/command
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/env/value
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/args
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/command
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/ports/port
+  kind: Service
+
+- path: spec/ports/targetPort
+  kind: Service
+
+- path: spec/template/spec/containers/args
+  kind: StatefulSet
+
+- path: spec/template/spec/containers/command
+  kind: StatefulSet
+
+- path: spec/template/spec/containers/env/value
+  kind: StatefulSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/args
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/command
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: metadata/labels
+`
+)
--- a/api/plugins/builtinconfig/doc.go
+++ b/api/plugins/builtinconfig/doc.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package builtinconfig provides legacy methods for
+// configuring builtin plugins from a common config file.
+// As a user, its best to configure plugins individually
+// with plugin config files specified in the `transformers:`
+// or `generators:` field, than to use this legacy
+// configuration technique.
+package builtinconfig
--- a/api/plugins/builtinconfig/loaddefaultconfig.go
+++ b/api/plugins/builtinconfig/loaddefaultconfig.go
@@ -0,0 +1,42 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/yaml"
+)
+
+// loadDefaultConfig returns a TranformerConfig
+// object from a list of files.
+func loadDefaultConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	result := &TransformerConfig{}
+	for _, path := range paths {
+		data, err := ldr.Load(path)
+		if err != nil {
+			return nil, err
+		}
+		t, err := makeTransformerConfigFromBytes(data)
+		if err != nil {
+			return nil, err
+		}
+		result, err = result.Merge(t)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+// makeTransformerConfigFromBytes returns a TransformerConfig object from bytes
+func makeTransformerConfigFromBytes(data []byte) (*TransformerConfig, error) {
+	var t TransformerConfig
+	err := yaml.Unmarshal(data, &t)
+	if err != nil {
+		return nil, err
+	}
+	t.sortFields()
+	return &t, nil
+}
--- a/api/plugins/builtinconfig/loaddefaultconfig_test.go
+++ b/api/plugins/builtinconfig/loaddefaultconfig_test.go
@@ -0,0 +1,37 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/internal/loadertest"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestLoadDefaultConfigsFromFiles(t *testing.T) {
+	ldr := loadertest.NewFakeLoader("/app")
+	ldr.AddFile("/app/config.yaml", []byte(`
+namePrefix:
+- path: nameprefix/path
+  kind: SomeKind
+`))
+	tcfg, err := loadDefaultConfig(ldr, []string{"/app/config.yaml"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expected := &TransformerConfig{
+		NamePrefix: []types.FieldSpec{
+			{
+				Gvk:  resid.Gvk{Kind: "SomeKind"},
+				Path: "nameprefix/path",
+			},
+		},
+	}
+	if !reflect.DeepEqual(tcfg, expected) {
+		t.Fatalf("expected %v\n but go6t %v\n", expected, tcfg)
+	}
+}
--- a/api/plugins/builtinconfig/namebackreferences.go
+++ b/api/plugins/builtinconfig/namebackreferences.go
@@ -0,0 +1,93 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// NameBackReferences is an association between a gvk.GVK and a list
+// of FieldSpec instances that could refer to it.
+//
+// It is used to handle name changes, and can be thought of as a
+// a contact list.  If you change your own contact info (name,
+// phone number, etc.), you must tell your contacts or they won't
+// know about the change.
+//
+// For example, ConfigMaps can be used by Pods and everything that
+// contains a Pod; Deployment, Job, StatefulSet, etc.  To change
+// the name of a ConfigMap instance from 'alice' to 'bob', one
+// must visit all objects that could refer to the ConfigMap, see if
+// they mention 'alice', and if so, change the reference to 'bob'.
+//
+// The NameBackReferences instance to aid in this could look like
+//   {
+//     kind: ConfigMap
+//     version: v1
+//     FieldSpecs:
+//     - kind: Pod
+//       version: v1
+//       path: spec/volumes/configMap/name
+//     - kind: Deployment
+//       path: spec/template/spec/volumes/configMap/name
+//     - kind: Job
+//       path: spec/template/spec/volumes/configMap/name
+//       (etc.)
+//   }
+type NameBackReferences struct {
+	resid.Gvk  `json:",inline,omitempty" yaml:",inline,omitempty"`
+	FieldSpecs types.FsSlice `json:"FieldSpecs,omitempty" yaml:"FieldSpecs,omitempty"`
+}
+
+func (n NameBackReferences) String() string {
+	var r []string
+	for _, f := range n.FieldSpecs {
+		r = append(r, f.String())
+	}
+	return n.Gvk.String() + ":  (\n" +
+		strings.Join(r, "\n") + "\n)"
+}
+
+type nbrSlice []NameBackReferences
+
+func (s nbrSlice) Len() int      { return len(s) }
+func (s nbrSlice) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+func (s nbrSlice) Less(i, j int) bool {
+	return s[i].Gvk.IsLessThan(s[j].Gvk)
+}
+
+func (s nbrSlice) mergeAll(o nbrSlice) (result nbrSlice, err error) {
+	result = s
+	for _, r := range o {
+		result, err = result.mergeOne(r)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+func (s nbrSlice) mergeOne(other NameBackReferences) (nbrSlice, error) {
+	var result nbrSlice
+	var err error
+	found := false
+	for _, c := range s {
+		if c.Gvk.Equals(other.Gvk) {
+			c.FieldSpecs, err = c.FieldSpecs.MergeAll(other.FieldSpecs)
+			if err != nil {
+				return nil, err
+			}
+			found = true
+		}
+		result = append(result, c)
+	}
+
+	if !found {
+		result = append(result, other)
+	}
+	return result, nil
+}
--- a/api/plugins/builtinconfig/namebackreferences_test.go
+++ b/api/plugins/builtinconfig/namebackreferences_test.go
@@ -0,0 +1,97 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestMergeAll(t *testing.T) {
+	fsSlice1 := []types.FieldSpec{
+		{
+			Gvk: resid.Gvk{
+				Kind: "Pod",
+			},
+			Path:               "path/to/a/name",
+			CreateIfNotPresent: false,
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "Deployment",
+			},
+			Path:               "another/path/to/some/name",
+			CreateIfNotPresent: false,
+		},
+	}
+	fsSlice2 := []types.FieldSpec{
+		{
+			Gvk: resid.Gvk{
+				Kind: "Job",
+			},
+			Path:               "morepath/to/name",
+			CreateIfNotPresent: false,
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "StatefulSet",
+			},
+			Path:               "yet/another/path/to/a/name",
+			CreateIfNotPresent: false,
+		},
+	}
+
+	nbrsSlice1 := nbrSlice{
+		{
+			Gvk: resid.Gvk{
+				Kind: "ConfigMap",
+			},
+			FieldSpecs: fsSlice1,
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "Secret",
+			},
+			FieldSpecs: fsSlice2,
+		},
+	}
+	nbrsSlice2 := nbrSlice{
+		{
+			Gvk: resid.Gvk{
+				Kind: "ConfigMap",
+			},
+			FieldSpecs: fsSlice1,
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "Secret",
+			},
+			FieldSpecs: fsSlice2,
+		},
+	}
+	expected := nbrSlice{
+		{
+			Gvk: resid.Gvk{
+				Kind: "ConfigMap",
+			},
+			FieldSpecs: fsSlice1,
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "Secret",
+			},
+			FieldSpecs: fsSlice2,
+		},
+	}
+	actual, err := nbrsSlice1.mergeAll(nbrsSlice2)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("expected\n %v\n but got\n %v\n", expected, actual)
+	}
+}
--- a/api/plugins/builtinconfig/transformerconfig.go
+++ b/api/plugins/builtinconfig/transformerconfig.go
@@ -0,0 +1,148 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"log"
+	"sort"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig/consts"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// TransformerConfig holds the data needed to perform transformations.
+type TransformerConfig struct {
+	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
+	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
+	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
+	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
+	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
+	Images            types.FsSlice `json:"images,omitempty" yaml:"images,omitempty"`
+	Replicas          types.FsSlice `json:"replicas,omitempty" yaml:"replicas,omitempty"`
+}
+
+// MakeEmptyConfig returns an empty TransformerConfig object
+func MakeEmptyConfig() *TransformerConfig {
+	return &TransformerConfig{}
+}
+
+// MakeDefaultConfig returns a default TransformerConfig.
+func MakeDefaultConfig() *TransformerConfig {
+	c, err := makeTransformerConfigFromBytes(
+		consts.GetDefaultFieldSpecs())
+	if err != nil {
+		log.Fatalf("Unable to make default transformconfig: %v", err)
+	}
+	return c
+}
+
+// MakeTransformerConfig returns a merger of custom config,
+// if any, with default config.
+func MakeTransformerConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	t1 := MakeDefaultConfig()
+	if len(paths) == 0 {
+		return t1, nil
+	}
+	t2, err := loadDefaultConfig(ldr, paths)
+	if err != nil {
+		return nil, err
+	}
+	return t1.Merge(t2)
+}
+
+// sortFields provides determinism in logging, tests, etc.
+func (t *TransformerConfig) sortFields() {
+	sort.Sort(t.NamePrefix)
+	sort.Sort(t.NameSpace)
+	sort.Sort(t.CommonLabels)
+	sort.Sort(t.CommonAnnotations)
+	sort.Sort(t.NameReference)
+	sort.Sort(t.VarReference)
+	sort.Sort(t.Images)
+	sort.Sort(t.Replicas)
+}
+
+// AddPrefixFieldSpec adds a FieldSpec to NamePrefix
+func (t *TransformerConfig) AddPrefixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NamePrefix, err = t.NamePrefix.MergeOne(fs)
+	return err
+}
+
+// AddSuffixFieldSpec adds a FieldSpec to NameSuffix
+func (t *TransformerConfig) AddSuffixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NameSuffix, err = t.NameSuffix.MergeOne(fs)
+	return err
+}
+
+// AddLabelFieldSpec adds a FieldSpec to CommonLabels
+func (t *TransformerConfig) AddLabelFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonLabels, err = t.CommonLabels.MergeOne(fs)
+	return err
+}
+
+// AddAnnotationFieldSpec adds a FieldSpec to CommonAnnotations
+func (t *TransformerConfig) AddAnnotationFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonAnnotations, err = t.CommonAnnotations.MergeOne(fs)
+	return err
+}
+
+// AddNamereferenceFieldSpec adds a NameBackReferences to NameReference
+func (t *TransformerConfig) AddNamereferenceFieldSpec(
+	nbrs NameBackReferences) (err error) {
+	t.NameReference, err = t.NameReference.mergeOne(nbrs)
+	return err
+}
+
+// Merge merges two TransformerConfigs objects into
+// a new TransformerConfig object
+func (t *TransformerConfig) Merge(input *TransformerConfig) (
+	merged *TransformerConfig, err error) {
+	if input == nil {
+		return t, nil
+	}
+	merged = &TransformerConfig{}
+	merged.NamePrefix, err = t.NamePrefix.MergeAll(input.NamePrefix)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameSuffix, err = t.NameSuffix.MergeAll(input.NameSuffix)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameSpace, err = t.NameSpace.MergeAll(input.NameSpace)
+	if err != nil {
+		return nil, err
+	}
+	merged.CommonAnnotations, err = t.CommonAnnotations.MergeAll(
+		input.CommonAnnotations)
+	if err != nil {
+		return nil, err
+	}
+	merged.CommonLabels, err = t.CommonLabels.MergeAll(input.CommonLabels)
+	if err != nil {
+		return nil, err
+	}
+	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameReference, err = t.NameReference.mergeAll(input.NameReference)
+	if err != nil {
+		return nil, err
+	}
+	merged.Images, err = t.Images.MergeAll(input.Images)
+	if err != nil {
+		return nil, err
+	}
+	merged.Replicas, err = t.Replicas.MergeAll(input.Replicas)
+	if err != nil {
+		return nil, err
+	}
+	merged.sortFields()
+	return merged, nil
+}
--- a/api/plugins/builtinconfig/transformerconfig_test.go
+++ b/api/plugins/builtinconfig/transformerconfig_test.go
@@ -0,0 +1,175 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig_test
+
+import (
+	"reflect"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestMakeDefaultConfig(t *testing.T) {
+	// Confirm default can be made without fatal error inside call.
+	_ = MakeDefaultConfig()
+}
+
+func TestAddNamereferenceFieldSpec(t *testing.T) {
+	cfg := &TransformerConfig{}
+
+	nbrs := NameBackReferences{
+		Gvk: resid.Gvk{
+			Kind: "KindA",
+		},
+		FieldSpecs: []types.FieldSpec{
+			{
+				Gvk: resid.Gvk{
+					Kind: "KindB",
+				},
+				Path:               "path/to/a/field",
+				CreateIfNotPresent: false,
+			},
+		},
+	}
+
+	err := cfg.AddNamereferenceFieldSpec(nbrs)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(cfg.NameReference) != 1 {
+		t.Fatal("failed to add namereference FieldSpec")
+	}
+}
+
+func TestAddFieldSpecs(t *testing.T) {
+	cfg := &TransformerConfig{}
+
+	fieldSpec := types.FieldSpec{
+		Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindB"},
+		Path:               "path/to/a/field",
+		CreateIfNotPresent: true,
+	}
+
+	err := cfg.AddPrefixFieldSpec(fieldSpec)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(cfg.NamePrefix) != 1 {
+		t.Fatalf("failed to add nameprefix FieldSpec")
+	}
+	err = cfg.AddSuffixFieldSpec(fieldSpec)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(cfg.NameSuffix) != 1 {
+		t.Fatalf("failed to add namesuffix FieldSpec")
+	}
+	err = cfg.AddLabelFieldSpec(fieldSpec)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(cfg.CommonLabels) != 1 {
+		t.Fatalf("failed to add nameprefix FieldSpec")
+	}
+	err = cfg.AddAnnotationFieldSpec(fieldSpec)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if len(cfg.CommonAnnotations) != 1 {
+		t.Fatalf("failed to add nameprefix FieldSpec")
+	}
+}
+
+func TestMerge(t *testing.T) {
+	nameReference := []NameBackReferences{
+		{
+			Gvk: resid.Gvk{
+				Kind: "KindA",
+			},
+			FieldSpecs: []types.FieldSpec{
+				{
+					Gvk: resid.Gvk{
+						Kind: "KindB",
+					},
+					Path:               "path/to/a/field",
+					CreateIfNotPresent: false,
+				},
+			},
+		},
+		{
+			Gvk: resid.Gvk{
+				Kind: "KindA",
+			},
+			FieldSpecs: []types.FieldSpec{
+				{
+					Gvk: resid.Gvk{
+						Kind: "KindC",
+					},
+					Path:               "path/to/a/field",
+					CreateIfNotPresent: false,
+				},
+			},
+		},
+	}
+	fieldSpecs := []types.FieldSpec{
+		{
+			Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindB"},
+			Path:               "path/to/a/field",
+			CreateIfNotPresent: true,
+		},
+		{
+			Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindC"},
+			Path:               "path/to/a/field",
+			CreateIfNotPresent: true,
+		},
+	}
+	cfga := &TransformerConfig{}
+	cfga.AddNamereferenceFieldSpec(nameReference[0])
+	cfga.AddPrefixFieldSpec(fieldSpecs[0])
+	cfga.AddSuffixFieldSpec(fieldSpecs[0])
+
+	cfgb := &TransformerConfig{}
+	cfgb.AddNamereferenceFieldSpec(nameReference[1])
+	cfgb.AddPrefixFieldSpec(fieldSpecs[1])
+	cfga.AddSuffixFieldSpec(fieldSpecs[1])
+
+	actual, err := cfga.Merge(cfgb)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	if len(actual.NamePrefix) != 2 {
+		t.Fatal("merge failed for namePrefix FieldSpec")
+	}
+
+	if len(actual.NameSuffix) != 2 {
+		t.Fatal("merge failed for nameSuffix FieldSpec")
+	}
+
+	if len(actual.NameReference) != 1 {
+		t.Fatal("merge failed for namereference FieldSpec")
+	}
+
+	expected := &TransformerConfig{}
+	expected.AddNamereferenceFieldSpec(nameReference[0])
+	expected.AddNamereferenceFieldSpec(nameReference[1])
+	expected.AddPrefixFieldSpec(fieldSpecs[0])
+	expected.AddPrefixFieldSpec(fieldSpecs[1])
+	expected.AddSuffixFieldSpec(fieldSpecs[0])
+	expected.AddSuffixFieldSpec(fieldSpecs[1])
+
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("expected: %v\n but got: %v\n", expected, actual)
+	}
+
+	actual, err = cfga.Merge(nil)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !reflect.DeepEqual(actual, cfga) {
+		t.Fatalf("expected: %v\n but got: %v\n", cfga, actual)
+	}
+}
--- a/api/plugins/builtinhelpers/builtinplugintype_string.go
+++ b/api/plugins/builtinhelpers/builtinplugintype_string.go
@@ -0,0 +1,37 @@
+// Code generated by "stringer -type=BuiltinPluginType"; DO NOT EDIT.
+
+package builtinhelpers
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Unknown-0]
+	_ = x[AnnotationsTransformer-1]
+	_ = x[ConfigMapGenerator-2]
+	_ = x[HashTransformer-3]
+	_ = x[ImageTagTransformer-4]
+	_ = x[InventoryTransformer-5]
+	_ = x[LabelTransformer-6]
+	_ = x[LegacyOrderTransformer-7]
+	_ = x[NamespaceTransformer-8]
+	_ = x[PatchJson6902Transformer-9]
+	_ = x[PatchStrategicMergeTransformer-10]
+	_ = x[PatchTransformer-11]
+	_ = x[PrefixSuffixTransformer-12]
+	_ = x[ReplicaCountTransformer-13]
+	_ = x[SecretGenerator-14]
+}
+
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorHashTransformerImageTagTransformerInventoryTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerReplicaCountTransformerSecretGenerator"
+
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 62, 81, 101, 117, 139, 159, 183, 213, 229, 252, 275, 290}
+
+func (i BuiltinPluginType) String() string {
+	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {
+		return "BuiltinPluginType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _BuiltinPluginType_name[_BuiltinPluginType_index[i]:_BuiltinPluginType_index[i+1]]
+}
--- a/api/plugins/builtinhelpers/builtins.go
+++ b/api/plugins/builtinhelpers/builtins.go
@@ -0,0 +1,75 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinhelpers
+
+import (
+	"sigs.k8s.io/kustomize/api/plugins/builtins"
+	"sigs.k8s.io/kustomize/api/resmap"
+)
+
+//go:generate stringer -type=BuiltinPluginType
+type BuiltinPluginType int
+
+const (
+	Unknown BuiltinPluginType = iota
+	AnnotationsTransformer
+	ConfigMapGenerator
+	HashTransformer
+	ImageTagTransformer
+	InventoryTransformer
+	LabelTransformer
+	LegacyOrderTransformer
+	NamespaceTransformer
+	PatchJson6902Transformer
+	PatchStrategicMergeTransformer
+	PatchTransformer
+	PrefixSuffixTransformer
+	ReplicaCountTransformer
+	SecretGenerator
+)
+
+var stringToBuiltinPluginTypeMap map[string]BuiltinPluginType
+
+func init() {
+	stringToBuiltinPluginTypeMap = makeStringToBuiltinPluginTypeMap()
+}
+
+func makeStringToBuiltinPluginTypeMap() (result map[string]BuiltinPluginType) {
+	result = make(map[string]BuiltinPluginType, 23)
+	for k := range GeneratorFactories {
+		result[k.String()] = k
+	}
+	for k := range TransformerFactories {
+		result[k.String()] = k
+	}
+	return
+}
+
+func GetBuiltinPluginType(n string) BuiltinPluginType {
+	result, ok := stringToBuiltinPluginTypeMap[n]
+	if ok {
+		return result
+	}
+	return Unknown
+}
+
+var GeneratorFactories = map[BuiltinPluginType]func() resmap.GeneratorPlugin{
+	ConfigMapGenerator: builtins.NewConfigMapGeneratorPlugin,
+	SecretGenerator:    builtins.NewSecretGeneratorPlugin,
+}
+
+var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin{
+	AnnotationsTransformer:         builtins.NewAnnotationsTransformerPlugin,
+	HashTransformer:                builtins.NewHashTransformerPlugin,
+	ImageTagTransformer:            builtins.NewImageTagTransformerPlugin,
+	InventoryTransformer:           builtins.NewInventoryTransformerPlugin,
+	LabelTransformer:               builtins.NewLabelTransformerPlugin,
+	LegacyOrderTransformer:         builtins.NewLegacyOrderTransformerPlugin,
+	NamespaceTransformer:           builtins.NewNamespaceTransformerPlugin,
+	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
+	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
+	PatchTransformer:               builtins.NewPatchTransformerPlugin,
+	PrefixSuffixTransformer:        builtins.NewPrefixSuffixTransformerPlugin,
+	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
+}
--- a/api/plugins/builtinhelpers/generateBuiltins.sh
+++ b/api/plugins/builtinhelpers/generateBuiltins.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# Generate the Go code for the generator and
+# transformer factory functions in
+#
+#   sigs.k8s.io/kustomize/api/plugins/builtins
+#
+# from the raw plugin directories found under
+#
+#   sigs.k8s.io/kustomize/plugin/builtin
+
+set -e
+
+myGoPath=$1
+if [ -z ${1+x} ]; then
+  myGoPath=$GOPATH
+fi
+
+if [ -z "$myGoPath" ]; then
+  echo "Must specify a GOPATH"
+  exit 1
+fi
+
+dir=$myGoPath/src/sigs.k8s.io/kustomize
+
+if [ ! -d "$dir" ]; then
+  echo "$dir is not a directory."
+  exit 1
+fi
+
+for goMod in $(find ./plugin/builtin -name 'go.mod'); do
+  dir=$(dirname "${goMod}")
+  (cd $dir; GOPATH=$myGoPath go generate ./...)
+  echo "Formatting $dir"
+  (cd $dir; GOPATH=$myGoPath go fmt ./...)
+done
+
+echo All done.
--- a/api/plugins/builtins/AnnotationsTransformer.go
+++ b/api/plugins/builtins/AnnotationsTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Add the given annotations to the given field specifications.
+type AnnotationsTransformerPlugin struct {
+	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+	FieldSpecs  []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *AnnotationsTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Annotations = nil
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *AnnotationsTransformerPlugin) Transform(m resmap.ResMap) error {
+	t, err := transform.NewMapTransformer(
+		p.FieldSpecs,
+		p.Annotations,
+	)
+	if err != nil {
+		return err
+	}
+	return t.Transform(m)
+}
+
+func NewAnnotationsTransformerPlugin() resmap.TransformerPlugin {
+  return &AnnotationsTransformerPlugin{}
+}
--- a/api/plugins/builtins/ConfigMapGenerator.go
+++ b/api/plugins/builtins/ConfigMapGenerator.go
@@ -0,0 +1,46 @@
+// Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type ConfigMapGeneratorPlugin struct {
+	h                *resmap.PluginHelpers
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	types.GeneratorOptions
+	types.ConfigMapArgs
+}
+
+
+func (p *ConfigMapGeneratorPlugin) Config(
+	h *resmap.PluginHelpers, config []byte) (err error) {
+	p.GeneratorOptions = types.GeneratorOptions{}
+	p.ConfigMapArgs = types.ConfigMapArgs{}
+	err = yaml.Unmarshal(config, p)
+	if p.ConfigMapArgs.Name == "" {
+		p.ConfigMapArgs.Name = p.Name
+	}
+	if p.ConfigMapArgs.Namespace == "" {
+		p.ConfigMapArgs.Namespace = p.Namespace
+	}
+	p.h = h
+	return
+}
+
+func (p *ConfigMapGeneratorPlugin) Generate() (resmap.ResMap, error) {
+	return p.h.ResmapFactory().FromConfigMapArgs(
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.ConfigMapArgs)
+}
+
+func NewConfigMapGeneratorPlugin() resmap.GeneratorPlugin {
+  return &ConfigMapGeneratorPlugin{}
+}
--- a/api/plugins/builtins/HashTransformer.go
+++ b/api/plugins/builtins/HashTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on HashTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resmap"
+)
+
+type HashTransformerPlugin struct {
+	hasher ifc.KunstructuredHasher
+}
+
+
+func (p *HashTransformerPlugin) Config(
+	h *resmap.PluginHelpers, config []byte) (err error) {
+	p.hasher = h.ResmapFactory().RF().Hasher()
+	return nil
+}
+
+// Transform appends hash to generated resources.
+func (p *HashTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, res := range m.Resources() {
+		if res.NeedHashSuffix() {
+			h, err := p.hasher.Hash(res)
+			if err != nil {
+				return err
+			}
+			res.SetName(fmt.Sprintf("%s-%s", res.GetName(), h))
+		}
+	}
+	return nil
+}
+
+func NewHashTransformerPlugin() resmap.TransformerPlugin {
+  return &HashTransformerPlugin{}
+}
--- a/api/plugins/builtins/ImageTagTransformer.go
+++ b/api/plugins/builtins/ImageTagTransformer.go
@@ -0,0 +1,188 @@
+// Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/yaml"
+)
+
+// Find matching image declarations and replace
+// the name, tag and/or digest.
+type ImageTagTransformerPlugin struct {
+	ImageTag   types.Image       `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
+	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *ImageTagTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.ImageTag = types.Image{}
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *ImageTagTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, r := range m.Resources() {
+		for _, path := range p.FieldSpecs {
+			if !r.OrgId().IsSelected(&path.Gvk) {
+				continue
+			}
+			err := transform.MutateField(
+				r.Map(), path.PathSlice(), false, p.mutateImage)
+			if err != nil {
+				return err
+			}
+		}
+		// Kept for backward compatibility
+		if err := p.findAndReplaceImage(r.Map()); err != nil && r.OrgId().Kind != `CustomResourceDefinition` {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p *ImageTagTransformerPlugin) mutateImage(in interface{}) (interface{}, error) {
+	original, ok := in.(string)
+	if !ok {
+		return nil, fmt.Errorf("image path is not of type string but %T", in)
+	}
+
+	if !isImageMatched(original, p.ImageTag.Name) {
+		return original, nil
+	}
+	name, tag := split(original)
+	if p.ImageTag.NewName != "" {
+		name = p.ImageTag.NewName
+	}
+	if p.ImageTag.NewTag != "" {
+		tag = ":" + p.ImageTag.NewTag
+	}
+	if p.ImageTag.Digest != "" {
+		tag = "@" + p.ImageTag.Digest
+	}
+	return name + tag, nil
+}
+
+// findAndReplaceImage replaces the image name and
+// tags inside one object.
+// It searches the object for container session
+// then loops though all images inside containers
+// session, finds matched ones and update the
+// image name and tag name
+func (p *ImageTagTransformerPlugin) findAndReplaceImage(obj map[string]interface{}) error {
+	paths := []string{"containers", "initContainers"}
+	updated := false
+	for _, path := range paths {
+		containers, found := obj[path]
+		if found {
+			if _, err := p.updateContainers(containers); err != nil {
+				return err
+			}
+			updated = true
+		}
+	}
+	if !updated {
+		return p.findContainers(obj)
+	}
+	return nil
+}
+
+func (p *ImageTagTransformerPlugin) updateContainers(in interface{}) (interface{}, error) {
+	containers, ok := in.([]interface{})
+	if !ok {
+		return nil, fmt.Errorf(
+			"containers path is not of type []interface{} but %T", in)
+	}
+	for i := range containers {
+		container := containers[i].(map[string]interface{})
+		containerImage, found := container["image"]
+		if !found {
+			continue
+		}
+		imageName := containerImage.(string)
+		if isImageMatched(imageName, p.ImageTag.Name) {
+			newImage, err := p.mutateImage(imageName)
+			if err != nil {
+				return nil, err
+			}
+			container["image"] = newImage
+		}
+	}
+	return containers, nil
+}
+
+func (p *ImageTagTransformerPlugin) findContainers(obj map[string]interface{}) error {
+	for key := range obj {
+		switch typedV := obj[key].(type) {
+		case map[string]interface{}:
+			err := p.findAndReplaceImage(typedV)
+			if err != nil {
+				return err
+			}
+		case []interface{}:
+			for i := range typedV {
+				item := typedV[i]
+				typedItem, ok := item.(map[string]interface{})
+				if ok {
+					err := p.findAndReplaceImage(typedItem)
+					if err != nil {
+						return err
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func isImageMatched(s, t string) bool {
+	// Tag values are limited to [a-zA-Z0-9_.-].
+	pattern, _ := regexp.Compile("^" + t + "(@sha256)?(:[a-zA-Z0-9_.-]*)?$")
+	return pattern.MatchString(s)
+}
+
+// split separates and returns the name and tag parts
+// from the image string using either colon `:` or at `@` separators.
+// Note that the returned tag keeps its separator.
+func split(imageName string) (name string, tag string) {
+	// check if image name contains a domain
+	// if domain is present, ignore domain and check for `:`
+	ic := -1
+	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
+		ic = strings.LastIndex(imageName, ":")
+	} else {
+		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
+		// set ic only if `:` is present
+		if lastIc > 0 {
+			ic = slashIndex + lastIc
+		}
+	}
+	ia := strings.LastIndex(imageName, "@")
+	if ic < 0 && ia < 0 {
+		return imageName, ""
+	}
+
+	i := ic
+	if ia > 0 {
+		i = ia
+	}
+
+	name = imageName[:i]
+	tag = imageName[i:]
+	return
+}
+
+func NewImageTagTransformerPlugin() resmap.TransformerPlugin {
+  return &ImageTagTransformerPlugin{}
+}
--- a/api/plugins/builtins/InventoryTransformer.go
+++ b/api/plugins/builtins/InventoryTransformer.go
@@ -0,0 +1,131 @@
+// Code generated by pluginator on InventoryTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/api/inventory"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type InventoryTransformerPlugin struct {
+	h                *resmap.PluginHelpers
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Policy           string `json:"policy,omitempty" yaml:"policy,omitempty"`
+}
+
+
+func (p *InventoryTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.h = h
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return err
+	}
+	if p.Policy == "" {
+		p.Policy = types.GarbageIgnore.String()
+	}
+	if p.Policy != types.GarbageCollect.String() &&
+		p.Policy != types.GarbageIgnore.String() {
+		return fmt.Errorf(
+			"unrecognized garbagePolicy '%s'", p.Policy)
+	}
+	return nil
+}
+
+// Transform generates an inventory object from the input ResMap.
+// This ConfigMap supports the pruning command in
+// the client side tool proposed here:
+// https://github.com/kubernetes/enhancements/pull/810
+//
+// The inventory data is written to the ConfigMap's
+// annotations, rather than to the key-value pairs in
+// the ConfigMap's data field, since
+//   1. Keys in a ConfigMap's data field are too
+//      constrained for this purpose.
+//   2. Using annotations allow any object to be used,
+//      not just a ConfigMap, should some other object
+//      (e.g. some App object) become more desirable
+//      for this purpose.
+func (p *InventoryTransformerPlugin) Transform(m resmap.ResMap) error {
+
+	inv, h, err := makeInventory(m)
+	if err != nil {
+		return err
+	}
+
+	args := types.ConfigMapArgs{}
+	args.Name = p.Name
+	args.Namespace = p.Namespace
+	opts := &types.GeneratorOptions{
+		Annotations: make(map[string]string),
+	}
+	opts.Annotations[inventory.HashAnnotation] = h
+	err = inv.UpdateAnnotations(opts.Annotations)
+	if err != nil {
+		return err
+	}
+
+	cm, err := p.h.ResmapFactory().RF().MakeConfigMap(
+		kv.NewLoader(p.h.Loader(), p.h.Validator()), opts, &args)
+	if err != nil {
+		return err
+	}
+
+	if p.Policy == types.GarbageCollect.String() {
+		for _, byeBye := range m.AllIds() {
+			m.Remove(byeBye)
+		}
+	}
+	return m.Append(cm)
+}
+
+func makeInventory(m resmap.ResMap) (
+	inv *inventory.Inventory, hash string, err error) {
+	inv = inventory.NewInventory()
+	var keys []string
+	for _, r := range m.Resources() {
+		ns := r.GetNamespace()
+		item := resid.NewResIdWithNamespace(r.GetGvk(), r.GetName(), ns)
+		if _, ok := inv.Current[item]; ok {
+			return nil, "", fmt.Errorf(
+				"item '%v' already in inventory", item)
+		}
+		inv.Current[item], err = computeRefs(r, m)
+		if err != nil {
+			return nil, "", err
+		}
+		keys = append(keys, item.String())
+	}
+	h, err := hasher.SortArrayAndComputeHash(keys)
+	return inv, h, err
+}
+
+func computeRefs(
+	r *resource.Resource, m resmap.ResMap) (refs []resid.ResId, err error) {
+	for _, refid := range r.GetRefBy() {
+		ref, err := m.GetByCurrentId(refid)
+		if err != nil {
+			return nil, err
+		}
+		refs = append(
+			refs,
+			resid.NewResIdWithNamespace(
+				ref.GetGvk(), ref.GetName(), ref.GetNamespace()))
+	}
+	return
+}
+
+func NewInventoryTransformerPlugin() resmap.TransformerPlugin {
+  return &InventoryTransformerPlugin{}
+}
--- a/api/plugins/builtins/LabelTransformer.go
+++ b/api/plugins/builtins/LabelTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on LabelTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Add the given labels to the given field specifications.
+type LabelTransformerPlugin struct {
+	Labels     map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
+	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *LabelTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Labels = nil
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *LabelTransformerPlugin) Transform(m resmap.ResMap) error {
+	t, err := transform.NewMapTransformer(
+		p.FieldSpecs,
+		p.Labels,
+	)
+	if err != nil {
+		return err
+	}
+	return t.Transform(m)
+}
+
+func NewLabelTransformerPlugin() resmap.TransformerPlugin {
+  return &LabelTransformerPlugin{}
+}
--- a/api/plugins/builtins/LegacyOrderTransformer.go
+++ b/api/plugins/builtins/LegacyOrderTransformer.go
@@ -0,0 +1,49 @@
+// Code generated by pluginator on LegacyOrderTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sort"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// Sort the resources using an ordering defined in the Gvk class.
+// This puts cluster-wide basic resources with no
+// dependencies (like Namespace, StorageClass, etc.)
+// first, and resources with a high number of dependencies
+// (like ValidatingWebhookConfiguration) last.
+type LegacyOrderTransformerPlugin struct{}
+
+
+// Nothing needed for configuration.
+func (p *LegacyOrderTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	return nil
+}
+
+func (p *LegacyOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
+	resources := make([]*resource.Resource, m.Size())
+	ids := m.AllIds()
+	sort.Sort(resmap.IdSlice(ids))
+	for i, id := range ids {
+		resources[i], err = m.GetByCurrentId(id)
+		if err != nil {
+			return errors.Wrap(err, "expected match for sorting")
+		}
+	}
+	m.Clear()
+	for _, r := range resources {
+		m.Append(r)
+	}
+	return nil
+}
+
+func NewLegacyOrderTransformerPlugin() resmap.TransformerPlugin {
+  return &LegacyOrderTransformerPlugin{}
+}
--- a/api/plugins/builtins/NamespaceTransformer.go
+++ b/api/plugins/builtins/NamespaceTransformer.go
@@ -0,0 +1,134 @@
+// Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/transform"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Change or set the namespace of non-cluster level resources.
+type NamespaceTransformerPlugin struct {
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	FieldSpecs       []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *NamespaceTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Namespace = ""
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
+	if len(p.Namespace) == 0 {
+		return nil
+	}
+	for _, r := range m.Resources() {
+		if len(r.Map()) == 0 {
+			// Don't mutate empty objects?
+			continue
+		}
+
+		id := r.OrgId()
+		applicableFs := p.applicableFieldSpecs(id)
+
+		for _, fs := range applicableFs {
+			err := transform.MutateField(
+				r.Map(), fs.PathSlice(), fs.CreateIfNotPresent,
+				p.changeNamespace(r))
+			if err != nil {
+				return err
+			}
+		}
+
+		matches := m.GetMatchingResourcesByCurrentId(r.CurId().Equals)
+		if len(matches) != 1 {
+			return fmt.Errorf("namespace tranformation produces ID conflict: %#v", matches)
+		}
+	}
+	return nil
+}
+
+const metaNamespace = "metadata/namespace"
+
+// Special casing metadata.namespace since
+// all objects have it, even "ClusterKind" objects
+// that don't exist in a namespace (the Namespace
+// object itself doesn't live in a namespace).
+func (p *NamespaceTransformerPlugin) applicableFieldSpecs(id resid.ResId) []types.FieldSpec {
+	var res []types.FieldSpec
+	for _, fs := range p.FieldSpecs {
+		if id.IsSelected(&fs.Gvk) && (fs.Path != metaNamespace || (fs.Path == metaNamespace && id.IsNamespaceableKind())) {
+			res = append(res, fs)
+		}
+	}
+	return res
+}
+
+func (p *NamespaceTransformerPlugin) changeNamespace(
+	referrer *resource.Resource) func(in interface{}) (interface{}, error) {
+	return func(in interface{}) (interface{}, error) {
+		switch in.(type) {
+		case string:
+			// will happen when the metadata/namespace
+			// value is replaced
+			return p.Namespace, nil
+		case []interface{}:
+			l, _ := in.([]interface{})
+			for idx, item := range l {
+				switch item.(type) {
+				case map[string]interface{}:
+					// Will happen when mutating the subjects
+					// field of ClusterRoleBinding and RoleBinding
+					inMap, _ := item.(map[string]interface{})
+					if _, ok := inMap["name"]; !ok {
+						continue
+					}
+					name, ok := inMap["name"].(string)
+					if !ok {
+						continue
+					}
+					// The only case we need to force the namespace
+					// if for the "service account". "default" is
+					// kind of hardcoded here for right now.
+					if name != "default" {
+						continue
+					}
+					inMap["namespace"] = p.Namespace
+					l[idx] = inMap
+				default:
+					// nothing to do for right now
+				}
+			}
+			return in, nil
+		case map[string]interface{}:
+			// Will happen if the createField=true
+			// when the namespace is added to the
+			// object
+			inMap := in.(map[string]interface{})
+			if len(inMap) == 0 {
+				return p.Namespace, nil
+			} else {
+				return in, nil
+			}
+		default:
+			return in, nil
+		}
+	}
+}
+
+func NewNamespaceTransformerPlugin() resmap.TransformerPlugin {
+  return &NamespaceTransformerPlugin{}
+}
--- a/Show More
+++ b/Show More