Merge pull request #842 from narayanan/annotation-with-colon

Fix for #818 - Added support for quoted values

.travis.yml

@@ -1,3 +1,15 @@
+os:
+# TODO: Enable this when we can get the tests to work
+#  - windows
+  - linux
+  - osx
+
+addons:
+  apt:
+    packages: tree
+  homebrew:
+    packages: tree
+
 language: go
 
 go:
@@ -17,7 +29,6 @@ env:
 
 before_install:
   - source ./bin/consider-early-travis-exit.sh
-  - sudo apt-get install tree
   - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $GOPATH/bin ${GOLANGCI_RELEASE}
   - go get -u github.com/monopole/mdrip
 

Gopkg.lock

@@ -207,16 +207,16 @@
 
 [[projects]]
   branch = "master"
-  digest = "1:d1a6ebe75268a41b6fbb1d43947cf8688d8580423b7484fa5ae608beef6df24d"
+  digest = "1:18108bc7e384e395b4805632a637405a3df71fa518e22f9b39b0c08b89a52b96"
   name = "golang.org/x/net"
   packages = [
+    "http/httpguts",
     "http2",
     "http2/hpack",
     "idna",
-    "lex/httplex",
   ]
   pruneopts = "NUT"
-  revision = "1c05540f6879653db88113bc4a2b70aec4bd491f"
+  revision = "fe579d43d83210096a79b46dcca0e3721058393a"
 
 [[projects]]
   digest = "1:e33513a825fcd765e97b5de639a2f7547542d1a8245df0cef18e1fd390b778a9"
@@ -366,6 +366,7 @@
   input-imports = [
     "github.com/evanphx/json-patch",
     "github.com/ghodss/yaml",
+    "github.com/go-openapi/spec",
     "github.com/pkg/errors",
     "github.com/spf13/cobra",
     "gopkg.in/yaml.v2",

docs/README.md

@@ -9,6 +9,8 @@
  * [versioning policy](versioningPolicy.md) - How the code and the kustomization
    file evolve in time.
    
+ * [version 2.0.0](version2.0.0.md) - Release note of Kustomize 2.0.0.
+
  * [workflow](workflows.md) - Some steps one might take in using
    bespoke and off-the-shelf configurations.
   

docs/eschewedFeatures.md

@@ -96,7 +96,7 @@ For example, to set the tag used on an image to match an
 environment variable, run
 
 ```
-kustomize edit set imagetag nginx:$MY_NGINX_VERSION
+kustomize edit set image nginx:$MY_NGINX_VERSION
 ```
 
 as part of some encapsulating work flow executed before

docs/kustomization.yaml

@@ -69,13 +69,16 @@ commonAnnotations:
 # markers ("---").
 resources:
 - some-service.yaml
-- ../some-dir/some-deployment.yaml
+- sub-dir/some-deployment.yaml
 
 # Each entry in this list results in the creation of
 # one ConfigMap resource (it's a generator of n maps).
 # The example below creates two ConfigMaps. One with the
 # names and contents of the given files, the other with
 # key/value as data.
+# Each configMapGenerator item accepts a parameter of
+# behavior: [create|replace|merge]. This allows an overlay to modify or
+# replace an existing configMap from the parent.
 configMapGenerator:
 - name: myJavaServerProps
   files:
@@ -198,7 +201,7 @@ patchesJson6902:
   path: add_service_annotation.yaml
 
 # Each entry in this list should be a relative path to
-# a file for custom resource definition(CRD).
+# a file for custom resource definition(CRD) in openAPI definition.
 #
 # The presence of this field is to allow kustomize be
 # aware of CRDs and apply proper
@@ -208,14 +211,22 @@ patchesJson6902:
 # In kustomization, the ConfigMap object name may change by adding namePrefix, nameSuffix, or hashing
 # The name reference for this ConfigMap object in CRD object need to be
 # updated with namePrefix, nameSuffix, or hashing in the same way.
+#
+# The annotations can be put into openAPI definitions are:
+#   "x-kubernetes-annotation": ""
+#   "x-kubernetes-label-selector": ""
+#   "x-kubernetes-identity": ""
+#   "x-kubernetes-object-ref-api-version": "v1",
+#   "x-kubernetes-object-ref-kind": "Secret",
+#   "x-kubernetes-object-ref-name-key": "name",
 crds:
-- crds/typeA.yaml
-- crds/typeB.yaml
+- crds/typeA.json
+- crds/typeB.json
 
 # Vars are used to capture text from one resource's field
 # and insert that text elsewhere.
 #
-# For example, suppose one specify the name of a k8s Service
+# For example, suppose someone specifies the name of a k8s Service
 # object in a container's command line, and the name of a
 # k8s Secret object in a container's environment variable,
 # so that the following would work:
@@ -255,7 +266,7 @@ vars:
 # reference within that object.  That's where the text is found.
 #
 # The field reference is optional; it defaults to `metadata.name`,
-# a normal default, since kustomize is used to generates or
+# a normal default, since kustomize is used to generate or
 # modify the names of resources.
 #
 # At time of writing, only string type fields are supported.

docs/version2.0.0.md

@@ -0,0 +1,70 @@
+# Kustomize 2.0.0
+
+After security review, a field used in secret generation (see below) was removed from the definition of a kustomization file with no mechanism to convert it to a new form. Also, the set of files accessible from a kustomization file has been further constrained.
+
+Per the [versioning policy](versioningPolicy.md), backward incompatible changes trigger an increment of the major version number, hence we go from 1.0.11 to 2.0.0. We're taking this major version increment opportunity to remove some already deprecated fields, and the code paths associated with them.
+
+## Backward Incompatible Changes
+
+### Kustomization Path Constraints
+A kustomization file can specify paths to other files, including resources, patches, configmap generation data, secret generation data and bases. In the case of a base, the path can be a git URL instead.
+
+In 1.x, these paths had to be relative to the current kustomization directory (the location of the kustomization file used in the `build` command).
+
+In 2.0, bases can continue to specify, via relative paths, kustomizations outside the current kustomization directory.
+But non-base paths are constrained to terminate in or below the current kustomization directory. Further, bases specified via a git URL may not reference files outside of the directory used to clone the repository.
+
+### Kustomization Field Removals
+
+#### patches
+`patches` was deprecated and replaced by `patchesStrategicMerge` when `patchesJson6902` was introduced.
+In Kustomize 2.0.0, `patches` is removed. Please use `patchesStrategicMerge` instead.
+
+#### imageTags
+`imageTags` is replaced by `images` since `images` can provide more features to change image names, registries, tags and digests.
+
+#### secretGenerator/commands
+`commands` is removed from SecretGenerator due to [security concern](https://docs.google.com/document/d/1FYgLVdq-siB_Cef9yuQBmit0PbrE8lsyTBdGI2eA2y8/edit). One can use `files` or `literals`, similar to ConfigMapGenerator, to generate a secret.
+```
+secretGenerator:
+- name: app-tls
+  files:
+    - secret/tls.cert
+    - secret/tls.key
+  type: "kubernetes.io/tls"
+```
+
+## Compatible Changes (New Features)
+As this release is triggered by a security change,
+there are no major new features to announce. A few things that are worth mentioning in this release are:
+
+* More than _40_ issues closed since 1.0.11 release (including many extensions to transformation rules).
+* Users can run `kustomize edit fix` to migrate a kustomization file working with previous versions to one working with 2.0.0. For example, a kustomization.yaml with following content
+  ```
+  patches:
+    - deployment-patch.yaml
+  imageTags:
+    - name: postgres
+      newTag: v1
+  ```
+  
+  will be converted to
+  
+  ```
+  apiVersion: kustomize.config.k8s.io/v1beta1
+  kind: Kustomization
+  patchesStrategicMerge:
+    - deployment-patch.yaml
+  images:
+    - name: postgres
+      newTag: v1
+  ```
+
+* Kustomization filename
+
+  In previous versions, the canonical name of a kustomization file is `kustomization.yaml`. Kustomize 2.0.0 is extended to recognize more file names: `kustomization.yaml`, `kustomization.yml` and `Kustomization`. In a directory, only one of those filenames is allowed. If there are more than one found, Kustomize will exit with an error. Please select the best filename for your use cases.
+* No longer planning to deprecate namespace prefix/suffix. The deprecation warning
+   ```
+   Adding nameprefix and namesuffix to Namespace resource will be deprecated in next release.
+   ```
+    is removed. Since changing this behavior will break many users' workflow. Kustomize will continue with adding nameprefix and namesuffix to Namespace resources.

docs/versioningPolicy.md

@@ -11,10 +11,9 @@ field version tag (e.g. `1.0.11`) that aspires to
 [semantic versioning].
 
 When enough changes have accumulated to
-(subjectively) warrant a new release,
-a [release process] is followed, and the
-fields in the version number are bumped
-per semver.
+warrant a new release, a [release process]
+is followed, and the fields in the version
+number are bumped per semver.
 
 ## Kustomization File Versioning
 
@@ -88,7 +87,7 @@ will no longer recognize these fields.
 ### Review of k8s API versioning
 
 The k8s API has specific [conventions] and a
-process for making a [changes].
+process for making [changes].
 
 The presence of an `apiVersion` field in a k8s
 native type signals:

examples/transformerconfigs/README.md

@@ -91,6 +91,5 @@ nameReference:
 
 Kustomize has a default set of configurations. They can be saved to local directory through `kustomize config save -d`. Kustomize allows modifying those configuration files and using them in kustomization.yaml file. This tutorial shows how to customize those configurations to
 - [support a CRD type](crd/README.md)
-- disabling adding commonLabels to fields in some kind of resources
 - add extra fields for variable substitution
 - add extra fields for name reference

examples/transformerconfigs/crd/README.md

@@ -8,38 +8,6 @@ Create a workspace by
 DEMO_HOME=$(mktemp -d)
 ```
 
-### Get the native config as a starting point
-
-Get the default transformer configurations using this command:
-
-<!-- @saveConfig @test -->
-```
-kustomize config save -d $DEMO_HOME/kustomizeconfig
-```
-The default configurations are saved
-in the directory `$DEMO_HOME/kustomizeconfig` as several files
-
-> ```
-> commonannotations.yaml
-> commonlabels.yaml
-> nameprefix.yaml
-> namereference.yaml
-> namespace.yaml
-> varreference.yaml
-> ```
-
-These files contain the field specifications for native resources
-that transformation directives like `namePrefix`, `commonLabels`, etc.
-need to do their work.
-
-These default configurations already include some common
-field specifictions for all types:
-
-- nameprefix is added to `.metadata.name`
-- namespace is added to `.metadata.namespace`
-- labels is added to `.metadata.labels`
-- annotations is added to `.metadata.annotations`
-
 ### Adding a custom resource
 
 Consider a CRD of kind `MyKind` with fields
@@ -51,6 +19,7 @@ Consider a CRD of kind `MyKind` with fields
 Add the following file to configure the transformers for the above fields
 <!-- @addConfig @test -->
 ```
+mkdir $DEMO_HOME/kustomizeconfig
 cat > $DEMO_HOME/kustomizeconfig/mykind.yaml << EOF
 
 commonLabels:
@@ -148,12 +117,6 @@ in the kustomization file:
 cat >> $DEMO_HOME/kustomization.yaml << EOF
 configurations:
 - kustomizeconfig/mykind.yaml
-- kustomizeconfig/commonannotations.yaml
-- kustomizeconfig/commonlabels.yaml
-- kustomizeconfig/nameprefix.yaml
-- kustomizeconfig/namereference.yaml
-- kustomizeconfig/namespace.yaml
-- kustomizeconfig/varreference.yaml
 EOF
 ```
 

k8sdeps/configmapandsecret/configmapfactory.go

@@ -19,7 +19,6 @@ package configmapandsecret
 
 import (
 	"fmt"
-	"path"
 	"strings"
 	"unicode/utf8"
 
@@ -27,6 +26,7 @@ import (
 	"k8s.io/api/core/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/validation"
+	"sigs.k8s.io/kustomize/k8sdeps/kv"
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
@@ -55,7 +55,7 @@ func (f *ConfigMapFactory) makeFreshConfigMap(
 // MakeConfigMap returns a new ConfigMap, or nil and an error.
 func (f *ConfigMapFactory) MakeConfigMap(
 	args *types.ConfigMapArgs, options *types.GeneratorOptions) (*corev1.ConfigMap, error) {
-	var all []kvPair
+	var all []kv.Pair
 	var err error
 	cm := f.makeFreshConfigMap(args)
 
@@ -81,8 +81,8 @@ func (f *ConfigMapFactory) MakeConfigMap(
 	}
 	all = append(all, pairs...)
 
-	for _, kv := range all {
-		err = addKvToConfigMap(cm, kv.key, kv.value)
+	for _, p := range all {
+		err = addKvToConfigMap(cm, p.Key, p.Value)
 		if err != nil {
 			return nil, err
 		}
@@ -94,45 +94,6 @@ func (f *ConfigMapFactory) MakeConfigMap(
 	return cm, nil
 }
 
-func keyValuesFromLiteralSources(sources []string) ([]kvPair, error) {
-	var kvs []kvPair
-	for _, s := range sources {
-		k, v, err := parseLiteralSource(s)
-		if err != nil {
-			return nil, err
-		}
-		kvs = append(kvs, kvPair{key: k, value: v})
-	}
-	return kvs, nil
-}
-
-func keyValuesFromFileSources(ldr ifc.Loader, sources []string) ([]kvPair, error) {
-	var kvs []kvPair
-	for _, s := range sources {
-		k, fPath, err := parseFileSource(s)
-		if err != nil {
-			return nil, err
-		}
-		content, err := ldr.Load(fPath)
-		if err != nil {
-			return nil, err
-		}
-		kvs = append(kvs, kvPair{key: k, value: string(content)})
-	}
-	return kvs, nil
-}
-
-func keyValuesFromEnvFile(l ifc.Loader, path string) ([]kvPair, error) {
-	if path == "" {
-		return nil, nil
-	}
-	content, err := l.Load(path)
-	if err != nil {
-		return nil, err
-	}
-	return keyValuesFromLines(content)
-}
-
 // addKvToConfigMap adds the given key and data to the given config map.
 // Error if key invalid, or already exists.
 func addKvToConfigMap(configMap *v1.ConfigMap, keyName, data string) error {
@@ -163,44 +124,3 @@ func addKvToConfigMap(configMap *v1.ConfigMap, keyName, data string) error {
 	configMap.BinaryData[keyName] = []byte(data)
 	return nil
 }
-
-// parseFileSource parses the source given.
-//
-//  Acceptable formats include:
-//   1.  source-path: the basename will become the key name
-//   2.  source-name=source-path: the source-name will become the key name and
-//       source-path is the path to the key file.
-//
-// Key names cannot include '='.
-func parseFileSource(source string) (keyName, filePath string, err error) {
-	numSeparators := strings.Count(source, "=")
-	switch {
-	case numSeparators == 0:
-		return path.Base(source), source, nil
-	case numSeparators == 1 && strings.HasPrefix(source, "="):
-		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
-	case numSeparators == 1 && strings.HasSuffix(source, "="):
-		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
-	case numSeparators > 1:
-		return "", "", errors.New("key names or file paths cannot contain '='")
-	default:
-		components := strings.Split(source, "=")
-		return components[0], components[1], nil
-	}
-}
-
-// parseLiteralSource parses the source key=val pair into its component pieces.
-// This functionality is distinguished from strings.SplitN(source, "=", 2) since
-// it returns an error in the case of empty keys, values, or a missing equals sign.
-func parseLiteralSource(source string) (keyName, value string, err error) {
-	// leading equal is invalid
-	if strings.Index(source, "=") == 0 {
-		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
-	}
-	// split after the first equal (so values can have the = character)
-	items := strings.SplitN(source, "=", 2)
-	if len(items) != 2 {
-		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
-	}
-	return items[0], strings.Trim(items[1], "\"'"), nil
-}

k8sdeps/configmapandsecret/kv.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2018 The Kubernetes Authors.
+Copyright 2019 The Kubernetes Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,86 +17,91 @@ limitations under the License.
 package configmapandsecret
 
 import (
-	"bufio"
-	"bytes"
 	"fmt"
-	"os"
+	"path"
 	"strings"
-	"unicode"
-	"unicode/utf8"
 
-	"k8s.io/apimachinery/pkg/util/validation"
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/k8sdeps/kv"
+	"sigs.k8s.io/kustomize/pkg/ifc"
 )
 
-// kvPair represents a key value pair.
-type kvPair struct {
-	key   string
-	value string
-}
-
-var utf8bom = []byte{0xEF, 0xBB, 0xBF}
-
-// keyValuesFromLines parses given content in to a list of key-value pairs.
-func keyValuesFromLines(content []byte) ([]kvPair, error) {
-	var kvs []kvPair
-
-	scanner := bufio.NewScanner(bytes.NewReader(content))
-	currentLine := 0
-	for scanner.Scan() {
-		// Process the current line, retrieving a key/value pair if
-		// possible.
-		scannedBytes := scanner.Bytes()
-		kv, err := kvFromLine(scannedBytes, currentLine)
+func keyValuesFromLiteralSources(sources []string) ([]kv.Pair, error) {
+	var kvs []kv.Pair
+	for _, s := range sources {
+		k, v, err := parseLiteralSource(s)
 		if err != nil {
 			return nil, err
 		}
-		currentLine++
-
-		if len(kv.key) == 0 {
-			// no key means line was empty or a comment
-			continue
-		}
-
-		kvs = append(kvs, kv)
+		kvs = append(kvs, kv.Pair{Key: k, Value: v})
 	}
 	return kvs, nil
 }
 
-// kvFromLine returns a kv with blank key if the line is empty or a comment.
-// The value will be retrieved from the environment if necessary.
-func kvFromLine(line []byte, currentLine int) (kvPair, error) {
-	kv := kvPair{}
-
-	if !utf8.Valid(line) {
-		return kv, fmt.Errorf("line %d has invalid utf8 bytes : %v", line, string(line))
+func keyValuesFromFileSources(ldr ifc.Loader, sources []string) ([]kv.Pair, error) {
+	var kvs []kv.Pair
+	for _, s := range sources {
+		k, fPath, err := parseFileSource(s)
+		if err != nil {
+			return nil, err
+		}
+		content, err := ldr.Load(fPath)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, kv.Pair{Key: k, Value: string(content)})
 	}
-
-	// We trim UTF8 BOM from the first line of the file but no others
-	if currentLine == 0 {
-		line = bytes.TrimPrefix(line, utf8bom)
-	}
-
-	// trim the line from all leading whitespace first
-	line = bytes.TrimLeftFunc(line, unicode.IsSpace)
-
-	// If the line is empty or a comment, we return a blank key/value pair.
-	if len(line) == 0 || line[0] == '#' {
-		return kv, nil
-	}
-
-	data := strings.SplitN(string(line), "=", 2)
-	key := data[0]
-	if errs := validation.IsEnvVarName(key); len(errs) != 0 {
-		return kv, fmt.Errorf("%q is not a valid key name: %s", key, strings.Join(errs, ";"))
-	}
-
-	if len(data) == 2 {
-		kv.value = data[1]
-	} else {
-		// No value (no `=` in the line) is a signal to obtain the value
-		// from the environment.
-		kv.value = os.Getenv(key)
-	}
-	kv.key = key
-	return kv, nil
+	return kvs, nil
+}
+
+func keyValuesFromEnvFile(l ifc.Loader, path string) ([]kv.Pair, error) {
+	if path == "" {
+		return nil, nil
+	}
+	content, err := l.Load(path)
+	if err != nil {
+		return nil, err
+	}
+	return kv.KeyValuesFromLines(content)
+}
+
+// parseFileSource parses the source given.
+//
+//  Acceptable formats include:
+//   1.  source-path: the basename will become the key name
+//   2.  source-name=source-path: the source-name will become the key name and
+//       source-path is the path to the key file.
+//
+// Key names cannot include '='.
+func parseFileSource(source string) (keyName, filePath string, err error) {
+	numSeparators := strings.Count(source, "=")
+	switch {
+	case numSeparators == 0:
+		return path.Base(source), source, nil
+	case numSeparators == 1 && strings.HasPrefix(source, "="):
+		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
+	case numSeparators == 1 && strings.HasSuffix(source, "="):
+		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
+	case numSeparators > 1:
+		return "", "", errors.New("key names or file paths cannot contain '='")
+	default:
+		components := strings.Split(source, "=")
+		return components[0], components[1], nil
+	}
+}
+
+// parseLiteralSource parses the source key=val pair into its component pieces.
+// This functionality is distinguished from strings.SplitN(source, "=", 2) since
+// it returns an error in the case of empty keys, values, or a missing equals sign.
+func parseLiteralSource(source string) (keyName, value string, err error) {
+	// leading equal is invalid
+	if strings.Index(source, "=") == 0 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	// split after the first equal (so values can have the = character)
+	items := strings.SplitN(source, "=", 2)
+	if len(items) != 2 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	return items[0], strings.Trim(items[1], "\"'"), nil
 }

k8sdeps/configmapandsecret/kv_test.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2018 The Kubernetes Authors.
+Copyright 2019 The Kubernetes Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,50 +19,39 @@ package configmapandsecret
 import (
 	"reflect"
 	"testing"
+
+	"sigs.k8s.io/kustomize/k8sdeps/kv"
+	"sigs.k8s.io/kustomize/pkg/fs"
+	"sigs.k8s.io/kustomize/pkg/loader"
 )
 
-func TestKeyValuesFromLines(t *testing.T) {
+func TestKeyValuesFromFileSources(t *testing.T) {
 	tests := []struct {
-		desc          string
-		content       string
-		expectedPairs []kvPair
-		expectedErr   bool
+		description string
+		sources     []string
+		expected    []kv.Pair
 	}{
 		{
-			desc: "valid kv content parse",
-			content: `
-		k1=v1
-		k2=v2
-		`,
-			expectedPairs: []kvPair{
-				{key: "k1", value: "v1"},
-				{key: "k2", value: "v2"},
+			description: "create kvs from file sources",
+			sources:     []string{"files/app-init.ini"},
+			expected: []kv.Pair{
+				{
+					Key:   "app-init.ini",
+					Value: "FOO=bar",
+				},
 			},
-			expectedErr: false,
 		},
-		{
-			desc: "content with comments",
-			content: `
-		k1=v1
-		#k2=v2
-		`,
-			expectedPairs: []kvPair{
-				{key: "k1", value: "v1"},
-			},
-			expectedErr: false,
-		},
-		// TODO: add negative testcases
 	}
 
-	for _, test := range tests {
-		pairs, err := keyValuesFromLines([]byte(test.content))
-		if test.expectedErr && err == nil {
-			t.Fatalf("%s should not return error", test.desc)
+	fSys := fs.MakeFakeFS()
+	fSys.WriteFile("/files/app-init.ini", []byte("FOO=bar"))
+	for _, tc := range tests {
+		kvs, err := keyValuesFromFileSources(loader.NewFileLoaderAtRoot(fSys), tc.sources)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
 		}
-
-		if !reflect.DeepEqual(pairs, test.expectedPairs) {
-			t.Errorf("%s should succeed, got:%v exptected:%v", test.desc, pairs, test.expectedPairs)
+		if !reflect.DeepEqual(kvs, tc.expected) {
+			t.Fatalf("in testcase: %q updated:\n%#v\ndoesn't match expected:\n%#v\n", tc.description, kvs, tc.expected)
 		}
-
 	}
 }

k8sdeps/configmapandsecret/secretfactory.go

@@ -23,6 +23,7 @@ import (
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/validation"
+	"sigs.k8s.io/kustomize/k8sdeps/kv"
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
@@ -53,7 +54,7 @@ func (f *SecretFactory) makeFreshSecret(args *types.SecretArgs) *corev1.Secret {
 
 // MakeSecret returns a new secret.
 func (f *SecretFactory) MakeSecret(args *types.SecretArgs, options *types.GeneratorOptions) (*corev1.Secret, error) {
-	var all []kvPair
+	var all []kv.Pair
 	var err error
 	s := f.makeFreshSecret(args)
 
@@ -79,8 +80,8 @@ func (f *SecretFactory) MakeSecret(args *types.SecretArgs, options *types.Genera
 	}
 	all = append(all, pairs...)
 
-	for _, kv := range all {
-		err = addKvToSecret(s, kv.key, kv.value)
+	for _, p := range all {
+		err = addKvToSecret(s, p.Key, p.Value)
 		if err != nil {
 			return nil, err
 		}

k8sdeps/kunstruct/factory.go

@@ -108,7 +108,7 @@ func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error
 	kind := u.GetKind()
 	if kind == "" {
 		return fmt.Errorf("missing kind in object %v", u)
-	} else if kind == "List" {
+	} else if strings.HasSuffix(kind, "List") {
 		return nil
 	}
 	if u.GetName() == "" {

k8sdeps/kunstruct/factory_test.go

@@ -42,6 +42,15 @@ func TestSliceFromBytes(t *testing.T) {
 				testConfigMap.Map(),
 			},
 		})
+	testConfigMapList := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMapList",
+			"items": []interface{}{
+				testConfigMap.Map(),
+				testConfigMap.Map(),
+			},
+		})
 
 	tests := []struct {
 		name        string
@@ -151,6 +160,24 @@ items:
 			expectedOut: []ifc.Kunstructured{testList},
 			expectedErr: false,
 		},
+		{
+			name: "ConfigMapList",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMapList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMapList},
+			expectedErr: false,
+		},
 	}
 
 	for _, test := range tests {

k8sdeps/kv/kv.go

@@ -0,0 +1,101 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kv
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"k8s.io/apimachinery/pkg/util/validation"
+)
+
+type Pair struct {
+	Key   string
+	Value string
+}
+
+var utf8bom = []byte{0xEF, 0xBB, 0xBF}
+
+// KeyValuesFromLines parses given content in to a list of key-value pairs.
+func KeyValuesFromLines(content []byte) ([]Pair, error) {
+	var kvs []Pair
+
+	scanner := bufio.NewScanner(bytes.NewReader(content))
+	currentLine := 0
+	for scanner.Scan() {
+		// Process the current line, retrieving a key/value pair if
+		// possible.
+		scannedBytes := scanner.Bytes()
+		kv, err := KeyValuesFromLine(scannedBytes, currentLine)
+		if err != nil {
+			return nil, err
+		}
+		currentLine++
+
+		if len(kv.Key) == 0 {
+			// no key means line was empty or a comment
+			continue
+		}
+
+		kvs = append(kvs, kv)
+	}
+	return kvs, nil
+}
+
+// KeyValuesFromLine returns a kv with blank key if the line is empty or a comment.
+// The value will be retrieved from the environment if necessary.
+func KeyValuesFromLine(line []byte, currentLine int) (Pair, error) {
+	kv := Pair{}
+
+	if !utf8.Valid(line) {
+		return kv, fmt.Errorf("line %d has invalid utf8 bytes : %v", line, string(line))
+	}
+
+	// We trim UTF8 BOM from the first line of the file but no others
+	if currentLine == 0 {
+		line = bytes.TrimPrefix(line, utf8bom)
+	}
+
+	// trim the line from all leading whitespace first
+	line = bytes.TrimLeftFunc(line, unicode.IsSpace)
+
+	// If the line is empty or a comment, we return a blank key/value pair.
+	if len(line) == 0 || line[0] == '#' {
+		return kv, nil
+	}
+
+	data := strings.SplitN(string(line), "=", 2)
+	key := data[0]
+	if errs := validation.IsEnvVarName(key); len(errs) != 0 {
+		return kv, fmt.Errorf("%q is not a valid key name: %s", key, strings.Join(errs, ";"))
+	}
+
+	if len(data) == 2 {
+		kv.Value = data[1]
+	} else {
+		// No value (no `=` in the line) is a signal to obtain the value
+		// from the environment.
+		kv.Value = os.Getenv(key)
+	}
+	kv.Key = key
+	return kv, nil
+}

k8sdeps/kv/kv_test.go

@@ -0,0 +1,68 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kv
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestKeyValuesFromLines(t *testing.T) {
+	tests := []struct {
+		desc          string
+		content       string
+		expectedPairs []Pair
+		expectedErr   bool
+	}{
+		{
+			desc: "valid kv content parse",
+			content: `
+		k1=v1
+		k2=v2
+		`,
+			expectedPairs: []Pair{
+				{Key: "k1", Value: "v1"},
+				{Key: "k2", Value: "v2"},
+			},
+			expectedErr: false,
+		},
+		{
+			desc: "content with comments",
+			content: `
+		k1=v1
+		#k2=v2
+		`,
+			expectedPairs: []Pair{
+				{Key: "k1", Value: "v1"},
+			},
+			expectedErr: false,
+		},
+		// TODO: add negative testcases
+	}
+
+	for _, test := range tests {
+		pairs, err := KeyValuesFromLines([]byte(test.content))
+		if test.expectedErr && err == nil {
+			t.Fatalf("%s should not return error", test.desc)
+		}
+
+		if !reflect.DeepEqual(pairs, test.expectedPairs) {
+			t.Errorf("%s should succeed, got:%v exptected:%v", test.desc, pairs, test.expectedPairs)
+		}
+
+	}
+}

k8sdeps/transformer/patch/patch.go

@@ -60,7 +60,7 @@ func (pt *patchTransformer) Transform(baseResourceMap resmap.ResMap) error {
 	for _, patch := range patches {
 		// Merge patches with base resource.
 		id := patch.Id()
-		matchedIds := baseResourceMap.FindByGVKN(id)
+		matchedIds := baseResourceMap.GetMatchingIds(id.GvknEquals)
 		if len(matchedIds) == 0 {
 			return fmt.Errorf("failed to find an object with %s to apply the patch", id.GvknString())
 		}

pkg/commands/build/build.go

@@ -108,7 +108,7 @@ func (o *Options) RunBuild(
 		return err
 	}
 	defer ldr.Cleanup()
-	kt, err := target.NewKustTarget(ldr, fSys, rf, ptf)
+	kt, err := target.NewKustTarget(ldr, rf, ptf)
 	if err != nil {
 		return err
 	}

pkg/commands/build/build_test.go

@@ -22,6 +22,12 @@ import (
 	"sigs.k8s.io/kustomize/pkg/constants"
 )
 
+func TestNewOptionsToSilenceCodeInspectionError(t *testing.T) {
+	if NewOptions("foo", "bar") == nil {
+		t.Fatal("could not make new options")
+	}
+}
+
 func TestBuildValidate(t *testing.T) {
 	var cases = []struct {
 		name  string

pkg/commands/edit/add/addmetadata.go

@@ -130,17 +130,18 @@ func (o *addMetadataOptions) convertToMap(arg string) (map[string]string, error)
 	result := make(map[string]string)
 	inputs := strings.Split(arg, ",")
 	for _, input := range inputs {
-		kv := strings.Split(input, ":")
-		if len(kv[0]) < 1 {
-			return nil, o.makeError(input, "empty key")
-		}
-		if len(kv) > 2 {
-			return nil, o.makeError(input, "too many colons")
-		}
-		if len(kv) > 1 {
-			result[kv[0]] = kv[1]
+		c := strings.Index(input, ":")
+		if c == 0 {
+			// key is not passed
+			return nil, o.makeError(input, "need k:v pair where v may be quoted")
+		} else if c < 0 {
+			// only key passed
+			result[input] = ""
 		} else {
-			result[kv[0]] = ""
+			// both key and value passed
+			key := input[:c]
+			value := trimQuotes(input[c+1:])
+			result[key] = value
 		}
 	}
 	return result, nil
@@ -171,5 +172,14 @@ func (o *addMetadataOptions) writeToMap(m map[string]string, kind kindOfAdd) err
 }
 
 func (o *addMetadataOptions) makeError(input string, message string) error {
-	return fmt.Errorf("invalid %s: %s (%s)", o.kind, input, message)
+	return fmt.Errorf("invalid %s: '%s' (%s)", o.kind, input, message)
+}
+
+func trimQuotes(s string) string {
+	if len(s) >= 2 {
+		if s[0] == '"' && s[len(s)-1] == '"' {
+			return s[1 : len(s)-1]
+		}
+	}
+	return s
 }

pkg/commands/edit/add/addmetadata_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package add
 
 import (
+	"reflect"
 	"testing"
 
 	"sigs.k8s.io/kustomize/pkg/commands/kustfile"
@@ -103,6 +104,32 @@ func TestAddAnnotationManyArgs(t *testing.T) {
 	}
 }
 
+func TestAddAnnotationValueQuoted(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
+	v := validators.MakeHappyMapValidator(t)
+	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
+	args := []string{"k1:\"v1\""}
+	err := cmd.RunE(cmd, args)
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+}
+
+func TestAddAnnotationValueWithColon(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
+	v := validators.MakeHappyMapValidator(t)
+	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
+	args := []string{"k1:\"v1:v2\""}
+	err := cmd.RunE(cmd, args)
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+}
+
 func TestAddAnnotationNoKey(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
 	v := validators.MakeHappyMapValidator(t)
@@ -113,23 +140,21 @@ func TestAddAnnotationNoKey(t *testing.T) {
 	if err == nil {
 		t.Errorf("expected an error")
 	}
-	if err.Error() != "invalid annotation: :nokey (empty key)" {
+	if err.Error() != "invalid annotation: ':nokey' (need k:v pair where v may be quoted)" {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
 
 func TestAddAnnotationTooManyColons(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
 	v := validators.MakeHappyMapValidator(t)
 	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
 	args := []string{"key:v1:v2"}
 	err := cmd.RunE(cmd, args)
-	v.VerifyNoCall()
-	if err == nil {
-		t.Errorf("expected an error")
-	}
-	if err.Error() != "invalid annotation: key:v1:v2 (too many colons)" {
-		t.Errorf("incorrect error: %v", err.Error())
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
 	}
 }
 
@@ -223,23 +248,21 @@ func TestAddLabelNoKey(t *testing.T) {
 	if err == nil {
 		t.Errorf("expected an error")
 	}
-	if err.Error() != "invalid label: :nokey (empty key)" {
+	if err.Error() != "invalid label: ':nokey' (need k:v pair where v may be quoted)" {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
 
 func TestAddLabelTooManyColons(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
 	v := validators.MakeHappyMapValidator(t)
 	cmd := newCmdAddLabel(fakeFS, v.Validator)
 	args := []string{"key:v1:v2"}
 	err := cmd.RunE(cmd, args)
-	v.VerifyNoCall()
-	if err == nil {
-		t.Errorf("expected an error")
-	}
-	if err.Error() != "invalid label: key:v1:v2 (too many colons)" {
-		t.Errorf("incorrect error: %v", err.Error())
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
 	}
 }
 
@@ -271,3 +294,36 @@ func TestAddLabelMultipleArgs(t *testing.T) {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
+
+func TestConvertToMap(t *testing.T) {
+	var o addMetadataOptions
+	args := "a:b,c:\"d\",e:\"f:g\",g:h:k"
+	expected := make(map[string]string)
+	expected["a"] = "b"
+	expected["c"] = "d"
+	expected["e"] = "f:g"
+	expected["g"] = "h:k"
+
+	result, err := o.convertToMap(args)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+
+	eq := reflect.DeepEqual(expected, result)
+	if !eq {
+		t.Errorf("Converted map does not match expected, expected: %v, result: %v\n", expected, result)
+	}
+}
+
+func TestConvertToMapError(t *testing.T) {
+	var o addMetadataOptions
+	args := "a:b,c:\"d\",:f:g"
+
+	_, err := o.convertToMap(args)
+	if err == nil {
+		t.Errorf("expected an error")
+	}
+	if err.Error() != "invalid annotation: ':f:g' (need k:v pair where v may be quoted)" {
+		t.Errorf("incorrect error: %v", err.Error())
+	}
+}

pkg/commands/edit/add/flagsandargs.go

@@ -18,6 +18,7 @@ package add
 
 import (
 	"fmt"
+	"strings"
 
 	"sigs.k8s.io/kustomize/pkg/fs"
 )
@@ -53,11 +54,54 @@ func (a *flagsAndArgs) Validate(args []string) error {
 	return nil
 }
 
+// ExpandFileSource normalizes a string list, possibly
+// containing globs, into a validated, globless list.
+// For example, this list:
+//     some/path
+//     some/dir/a*
+//     bfile=some/dir/b*
+// becomes:
+//     some/path
+//     some/dir/airplane
+//     some/dir/ant
+//     some/dir/apple
+//     bfile=some/dir/banana
+// i.e. everything is converted to a key=value pair,
+// where the value is always a relative file path,
+// and the key, if missing, is the same as the value.
+// In the case where the key is explicitly declared,
+// the globbing, if present, must have exactly one match.
 func (a *flagsAndArgs) ExpandFileSource(fSys fs.FileSystem) error {
-	result, err := globPatterns(fSys, a.FileSources)
-	if err != nil {
-		return err
+	var results []string
+	for _, pattern := range a.FileSources {
+		var patterns []string
+		key := ""
+		// check if the pattern is in `--from-file=[key=]source` format
+		// and if so split it to send only the file-pattern to glob function
+		s := strings.Split(pattern, "=")
+		if len(s) == 2 {
+			patterns = append(patterns, s[1])
+			key = s[0]
+		} else {
+			patterns = append(patterns, s[0])
+		}
+		result, err := globPatterns(fSys, patterns)
+		if err != nil {
+			return err
+		}
+		// if the format is `--from-file=[key=]source` accept only one result
+		// and extend it with the `key=` prefix
+		if key != "" {
+			if len(result) != 1 {
+				return fmt.Errorf(
+					"'pattern '%s' catches files %v, should catch only one", pattern, result)
+			}
+			fileSource := fmt.Sprintf("%s=%s", key, result[0])
+			results = append(results, fileSource)
+		} else {
+			results = append(results, result...)
+		}
 	}
-	a.FileSources = result
+	a.FileSources = results
 	return nil
 }

pkg/commands/edit/add/flagsandargs_test.go

@@ -89,7 +89,7 @@ func TestExpandFileSource(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
 	fakeFS.Create("dir/fa1")
 	fakeFS.Create("dir/fa2")
-	fakeFS.Create("dir/reademe")
+	fakeFS.Create("dir/readme")
 	fa := flagsAndArgs{
 		FileSources: []string{"dir/fa*"},
 	}
@@ -102,3 +102,37 @@ func TestExpandFileSource(t *testing.T) {
 		t.Fatalf("FileSources is not correctly expanded: %v", fa.FileSources)
 	}
 }
+
+func TestExpandFileSourceWithKey(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.Create("dir/faaaaaaaaaabbbbbbbbbccccccccccccccccc")
+	fakeFS.Create("dir/foobar")
+	fakeFS.Create("dir/simplebar")
+	fakeFS.Create("dir/readme")
+	fa := flagsAndArgs{
+		FileSources: []string{"foo-key=dir/fa*", "bar-key=dir/foobar", "dir/simplebar"},
+	}
+	fa.ExpandFileSource(fakeFS)
+	expected := []string{
+		"foo-key=dir/faaaaaaaaaabbbbbbbbbccccccccccccccccc",
+		"bar-key=dir/foobar",
+		"dir/simplebar",
+	}
+	if !reflect.DeepEqual(fa.FileSources, expected) {
+		t.Fatalf("FileSources is not correctly expanded: %v", fa.FileSources)
+	}
+}
+
+func TestExpandFileSourceWithKeyAndError(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.Create("dir/fa1")
+	fakeFS.Create("dir/fa2")
+	fakeFS.Create("dir/readme")
+	fa := flagsAndArgs{
+		FileSources: []string{"foo-key=dir/fa*"},
+	}
+	err := fa.ExpandFileSource(fakeFS)
+	if err == nil {
+		t.Fatalf("FileSources should not be correctly expanded: %v", fa.FileSources)
+	}
+}

pkg/commands/misc/version.go

@@ -19,14 +19,15 @@ package misc
 import (
 	"fmt"
 	"io"
+	"runtime"
 
 	"github.com/spf13/cobra"
 )
 
 var (
 	kustomizeVersion = "unknown"
-	goos             = "unknown"
-	goarch           = "unknown"
+	goos             = runtime.GOOS
+	goarch           = runtime.GOARCH
 	gitCommit        = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD)
 
 	buildDate = "1970-01-01T00:00:00Z" // build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')

pkg/constants/constants.go

@@ -21,7 +21,7 @@ package constants
 // by Kustomize.
 // In each directory, Kustomize searches for file with the name in this list.
 // Only one match is allowed.
-var KustomizationFileNames = [3]string{
+var KustomizationFileNames = []string{
 	"kustomization.yaml",
 	"kustomization.yml",
 	"Kustomization",

pkg/expansion/expand.go

@@ -36,15 +36,17 @@ func syntaxWrap(input string) string {
 // implements the expansion semantics defined in the expansion spec; it
 // returns the input string wrapped in the expansion syntax if no mapping
 // for the input is found.
-func MappingFuncFor(context ...map[string]string) func(string) string {
+func MappingFuncFor(
+	counts map[string]int,
+	context ...map[string]string) func(string) string {
 	return func(input string) string {
 		for _, vars := range context {
 			val, ok := vars[input]
 			if ok {
+				counts[input]++
 				return val
 			}
 		}
-
 		return syntaxWrap(input)
 	}
 }

pkg/expansion/expand_test.go

@@ -14,12 +14,19 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package expansion
+package expansion_test
 
 import (
 	"testing"
+
+	. "sigs.k8s.io/kustomize/pkg/expansion"
 )
 
+type expected struct {
+	count  int
+	edited string
+}
+
 func TestMapReference(t *testing.T) {
 	type env struct {
 		Name  string
@@ -46,23 +53,23 @@ func TestMapReference(t *testing.T) {
 		"BLU": "$(ZOO)-2",
 	}
 
-	serviceEnv := map[string]string{}
-
-	mapping := MappingFuncFor(declaredEnv, serviceEnv)
+	counts := make(map[string]int)
+	mapping := MappingFuncFor(counts, declaredEnv)
 
 	for _, env := range envs {
 		declaredEnv[env.Name] = Expand(env.Value, mapping)
 	}
 
-	expectedEnv := map[string]string{
-		"FOO": "bar",
-		"ZOO": "bar-1",
-		"BLU": "bar-1-2",
+	expectedEnv := map[string]expected{
+		"FOO": {count: 1, edited: "bar"},
+		"ZOO": {count: 1, edited: "bar-1"},
+		"BLU": {count: 0, edited: "bar-1-2"},
 	}
 
 	for k, v := range expectedEnv {
-		if e, a := v, declaredEnv[k]; e != a {
-			t.Errorf("Expected %v, got %v", e, a)
+		if e, a := v, declaredEnv[k]; e.edited != a || e.count != counts[k] {
+			t.Errorf("Expected %v count=%d, got %v count=%d",
+				e.edited, e.count, a, counts[k])
 		} else {
 			delete(declaredEnv, k)
 		}
@@ -81,9 +88,7 @@ func TestMapping(t *testing.T) {
 		"VAR_REF":   "$(VAR_A)",
 		"VAR_EMPTY": "",
 	}
-	mapping := MappingFuncFor(context)
-
-	doExpansionTest(t, mapping)
+	doExpansionTest(t, context)
 }
 
 func TestMappingDual(t *testing.T) {
@@ -96,51 +101,64 @@ func TestMappingDual(t *testing.T) {
 		"VAR_C":   "C",
 		"VAR_REF": "$(VAR_A)",
 	}
-	mapping := MappingFuncFor(context, context2)
 
-	doExpansionTest(t, mapping)
+	doExpansionTest(t, context, context2)
 }
 
-func doExpansionTest(t *testing.T, mapping func(string) string) {
+func doExpansionTest(t *testing.T, context ...map[string]string) {
 	cases := []struct {
 		name     string
 		input    string
 		expected string
+		counts   map[string]int
 	}{
 		{
 			name:     "whole string",
 			input:    "$(VAR_A)",
 			expected: "A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "repeat",
 			input:    "$(VAR_A)-$(VAR_A)",
 			expected: "A-A",
+			counts:   map[string]int{"VAR_A": 2},
+		},
+		{
+			name:     "multiple repeats",
+			input:    "$(VAR_A)-$(VAR_B)-$(VAR_B)-$(VAR_B)-$(VAR_A)",
+			expected: "A-B-B-B-A",
+			counts:   map[string]int{"VAR_A": 2, "VAR_B": 3},
 		},
 		{
 			name:     "beginning",
 			input:    "$(VAR_A)-1",
 			expected: "A-1",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "middle",
 			input:    "___$(VAR_B)___",
 			expected: "___B___",
+			counts:   map[string]int{"VAR_B": 1},
 		},
 		{
 			name:     "end",
 			input:    "___$(VAR_C)",
 			expected: "___C",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "compound",
 			input:    "$(VAR_A)_$(VAR_B)_$(VAR_C)",
 			expected: "A_B_C",
+			counts:   map[string]int{"VAR_A": 1, "VAR_B": 1, "VAR_C": 1},
 		},
 		{
 			name:     "escape & expand",
 			input:    "$$(VAR_B)_$(VAR_A)",
 			expected: "$(VAR_B)_A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "compound escape",
@@ -156,16 +174,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "backslash escape ignored",
 			input:    "foo\\$(VAR_C)bar",
 			expected: "foo\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "backslash escape ignored",
 			input:    "foo\\\\$(VAR_C)bar",
 			expected: "foo\\\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "lots of backslashes",
 			input:    "foo\\\\\\\\$(VAR_A)bar",
 			expected: "foo\\\\\\\\Abar",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "nested var references",
@@ -181,16 +202,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "value is a reference",
 			input:    "$(VAR_REF)",
 			expected: "$(VAR_A)",
+			counts:   map[string]int{"VAR_REF": 1},
 		},
 		{
 			name:     "value is a reference x 2",
 			input:    "%%$(VAR_REF)--$(VAR_REF)%%",
 			expected: "%%$(VAR_A)--$(VAR_A)%%",
+			counts:   map[string]int{"VAR_REF": 2},
 		},
 		{
 			name:     "empty var",
 			input:    "foo$(VAR_EMPTY)bar",
 			expected: "foobar",
+			counts:   map[string]int{"VAR_EMPTY": 1},
 		},
 		{
 			name:     "unterminated expression",
@@ -236,6 +260,7 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "multiple (odd) operators, var defined",
 			input:    "$$$$$$$(VAR_A)",
 			expected: "$$$A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "missing open expression",
@@ -251,16 +276,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "trailing incomplete expression not consumed",
 			input:    "$(VAR_B)_______$(A",
 			expected: "B_______$(A",
+			counts:   map[string]int{"VAR_B": 1},
 		},
 		{
 			name:     "trailing incomplete expression, no content, is not consumed",
 			input:    "$(VAR_C)_______$(",
 			expected: "C_______$(",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "operator at end of input string is preserved",
 			input:    "$(VAR_A)foobarzab$",
 			expected: "Afoobarzab$",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "shell escaped incomplete expr",
@@ -295,9 +323,31 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 	}
 
 	for _, tc := range cases {
+		counts := make(map[string]int)
+		mapping := MappingFuncFor(counts, context...)
 		expanded := Expand(tc.input, mapping)
 		if e, a := tc.expected, expanded; e != a {
 			t.Errorf("%v: expected %q, got %q", tc.name, e, a)
 		}
+		if len(counts) != len(tc.counts) {
+			t.Errorf("%v: len(counts)=%d != len(tc.counts)=%d",
+				tc.name, len(counts), len(tc.counts))
+		}
+		if len(tc.counts) > 0 {
+			for k, expectedCount := range tc.counts {
+				c, ok := counts[k]
+				if ok {
+					if c != expectedCount {
+						t.Errorf(
+							"%v: k=%s, expected count %d, got %d",
+							tc.name, k, expectedCount, c)
+					}
+				} else {
+					t.Errorf(
+						"%v: k=%s, expected count %d, got zero",
+						tc.name, k, expectedCount)
+				}
+			}
+		}
 	}
 }

pkg/fs/confirmeddir.go

@@ -26,7 +26,7 @@ import (
 // that was confirmed to point to an existing directory.
 type ConfirmedDir string
 
-// Return a temporary dir, else error.
+// NewTmpConfirmedDir returns a temporary dir, else error.
 // The directory is cleaned, no symlinks, etc. so its
 // returned as a ConfirmedDir.
 func NewTmpConfirmedDir() (ConfirmedDir, error) {
@@ -34,7 +34,15 @@ func NewTmpConfirmedDir() (ConfirmedDir, error) {
 	if err != nil {
 		return "", err
 	}
-	return ConfirmedDir(n), nil
+
+	// In MacOs `ioutil.TempDir` creates a directory
+	// with root in the `/var` folder, which is in turn a symlinked path
+	// to `/private/var`.
+	// Function `filepath.EvalSymlinks`is used to
+	// resolve the real absolute path.
+	deLinked, err := filepath.EvalSymlinks(n)
+	return ConfirmedDir(deLinked), err
+
 }
 
 // HasPrefix returns true if the directory argument

pkg/fs/confirmeddir_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package fs
 
 import (
+	"path/filepath"
 	"testing"
 )
 
@@ -101,3 +102,18 @@ func TestHasPrefix_SlashFooBar(t *testing.T) {
 		t.Fatalf("/foo/bar should have prefix /")
 	}
 }
+
+func TestNewTempConfirmDir(t *testing.T) {
+	tmp, err := NewTmpConfirmedDir()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	delinked, err := filepath.EvalSymlinks(string(tmp))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(tmp) != delinked {
+		t.Fatalf("unexpected path containing symlinks")
+	}
+}

pkg/fs/realfs_test.go

@@ -27,7 +27,11 @@ import (
 
 func makeTestDir(t *testing.T) (FileSystem, string) {
 	x := MakeRealFS()
-	testDir, err := ioutil.TempDir("", "kustomize_testing_dir")
+	td, err := ioutil.TempDir("", "kustomize_testing_dir")
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+	testDir, err := filepath.EvalSymlinks(td)
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
 	}

pkg/git/repospec.go

@@ -24,6 +24,13 @@ import (
 	"sigs.k8s.io/kustomize/pkg/fs"
 )
 
+// Used as a temporary non-empty occupant of the cloneDir
+// field, as something distinguishable from the empty string
+// in various outputs (especially tests). Not using an
+// actual directory name here, as that's a temporary directory
+// with a unique name that isn't created until clone time.
+const notCloned = fs.ConfirmedDir("/notCloned")
+
 // RepoSpec specifies a git repository and a branch and path therein.
 type RepoSpec struct {
 	// Raw, original spec, used to look for cycles.
@@ -88,7 +95,7 @@ func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
 	}
 	return &RepoSpec{
 		raw: n, host: host, orgRepo: orgRepo,
-		path: path, ref: gitRef}, nil
+		cloneDir: notCloned, path: path, ref: gitRef}, nil
 }
 
 const (

pkg/git/repospec_test.go

@@ -122,46 +122,52 @@ func TestNewRepoSpecFromUrlErrors(t *testing.T) {
 
 func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 	testcases := []struct {
-		input string
-		repo  string
-		path  string
-		ref   string
+		input     string
+		cloneSpec string
+		absPath   string
+		ref       string
 	}{
 		{
-			input: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir",
-			repo:  "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
-			path:  "somedir",
-			ref:   "",
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir?ref=testbranch",
-			repo:  "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
-			path:  "somedir",
-			ref:   "testbranch",
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir?ref=testbranch",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "testbranch",
 		},
 		{
-			input: "https://fabrikops2.visualstudio.com/someorg/somerepo?ref=master",
-			repo:  "https://fabrikops2.visualstudio.com/someorg/somerepo",
-			path:  "",
-			ref:   "master",
+			input:     "https://fabrikops2.visualstudio.com/someorg/somerepo?ref=master",
+			cloneSpec: "https://fabrikops2.visualstudio.com/someorg/somerepo",
+			absPath:   notCloned.String(),
+			ref:       "master",
 		},
 		{
-			input: "http://github.com/someorg/somerepo/somedir",
-			repo:  "https://github.com/someorg/somerepo.git",
-			path:  "somedir",
-			ref:   "",
+			input:     "http://github.com/someorg/somerepo/somedir",
+			cloneSpec: "https://github.com/someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "git@github.com:someorg/somerepo/somedir",
-			repo:  "git@github.com:someorg/somerepo.git",
-			path:  "somedir",
-			ref:   "",
+			input:     "git@github.com:someorg/somerepo/somedir",
+			cloneSpec: "git@github.com:someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git?ref=v0.1.0",
-			repo:  "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git",
-			path:  "",
-			ref:   "v0.1.0",
+			input:     "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git?ref=v0.1.0",
+			cloneSpec: "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git",
+			absPath:   notCloned.String(),
+			ref:       "v0.1.0",
+		},
+		{
+			input:     "git@bitbucket.org:company/project.git//path?ref=branch",
+			cloneSpec: "git@bitbucket.org:company/project.git",
+			absPath:   notCloned.Join("path"),
+			ref:       "branch",
 		},
 	}
 	for _, testcase := range testcases {
@@ -169,13 +175,13 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 		if err != nil {
 			t.Errorf("Unexpected error: %v", err)
 		}
-		if rs.CloneSpec() != testcase.repo {
+		if rs.CloneSpec() != testcase.cloneSpec {
 			t.Errorf("CloneSpec expected to be %v, but got %v on %s",
-				testcase.repo, rs.CloneSpec(), testcase.input)
+				testcase.cloneSpec, rs.CloneSpec(), testcase.input)
 		}
-		if rs.path != testcase.path {
-			t.Errorf("path expected to be %v, but got %v on %s",
-				testcase.path, rs.path, testcase.input)
+		if rs.AbsPath() != testcase.absPath {
+			t.Errorf("AbsPath expected to be %v, but got %v on %s",
+				testcase.absPath, rs.AbsPath(), testcase.input)
 		}
 		if rs.ref != testcase.ref {
 			t.Errorf("ref expected to be %v, but got %v on %s",

pkg/gvk/gvk.go

@@ -73,6 +73,8 @@ var order = []string{
 	"Namespace",
 	"StorageClass",
 	"CustomResourceDefinition",
+	"MutatingWebhookConfiguration",
+	"ValidatingWebhookConfiguration",
 	"ServiceAccount",
 	"Role",
 	"ClusterRole",

pkg/loader/fileloader.go

@@ -267,7 +267,8 @@ func (l *fileLoader) errIfArgEqualOrHigher(
 // path but a different tag?
 func (l *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 	// TODO(monopole): Use parsed data instead of Raw().
-	if strings.HasPrefix(l.repoSpec.Raw(), newRepoSpec.Raw()) {
+	if l.repoSpec != nil &&
+		strings.HasPrefix(l.repoSpec.Raw(), newRepoSpec.Raw()) {
 		return fmt.Errorf(
 			"cycle detected: URI '%s' referenced by previous URI '%s'",
 			newRepoSpec.Raw(), l.repoSpec.Raw())

pkg/loader/fileloader_test.go

@@ -455,3 +455,29 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 		t.Fatalf("unexpected err: %v", err)
 	}
 }
+
+func TestLocalLoaderReferencingGitBase(t *testing.T) {
+	topDir := "/whatever"
+	cloneRoot := topDir + "/someClone"
+	fSys := fs.MakeFakeFS()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot + "/foo/base")
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	l1 := newLoaderAtConfirmedDir(
+		root, fSys, nil,
+		git.DoNothingCloner(fs.ConfirmedDir(cloneRoot)))
+	if l1.Root() != topDir {
+		t.Fatalf("unexpected root %s", l1.Root())
+	}
+	l2, err := l1.New("github.com/someOrg/someRepo/foo/base")
+	if err != nil {
+		t.Fatalf("unexpected err:  %v\n", err)
+	}
+	if l2.Root() != cloneRoot+"/foo/base" {
+		t.Fatalf("unexpected root %s", l2.Root())
+	}
+}

pkg/patch/transformer/factory.go

@@ -21,8 +21,6 @@ import (
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/resid"
 
-	"github.com/evanphx/json-patch"
-	"github.com/ghodss/yaml"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/patch"
 	"sigs.k8s.io/kustomize/pkg/transformers"
@@ -77,19 +75,7 @@ func (f PatchJson6902Factory) makeOnePatchJson6902Transformer(p patch.Json6902)
 		return nil, err
 	}
 
-	if !isJsonFormat(rawOp) {
-		// if it isn't JSON, try to parse it as YAML
-		rawOp, err = yaml.YAMLToJSON(rawOp)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	decodedPatch, err := jsonpatch.DecodePatch(rawOp)
-	if err != nil {
-		return nil, err
-	}
-	return newPatchJson6902JSONTransformer(targetId, decodedPatch)
+	return newPatchJson6902JSONTransformer(targetId, rawOp)
 }
 
 func isJsonFormat(data []byte) bool {

pkg/patch/transformer/patchjson6902json.go

@@ -17,9 +17,14 @@ limitations under the License.
 package transformer
 
 import (
+	"fmt"
+
 	"github.com/evanphx/json-patch"
+	"github.com/ghodss/yaml"
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
+	"sigs.k8s.io/kustomize/pkg/resource"
 	"sigs.k8s.io/kustomize/pkg/transformers"
 )
 
@@ -27,22 +32,37 @@ import (
 type patchJson6902JSONTransformer struct {
 	target resid.ResId
 	patch  jsonpatch.Patch
+	rawOp  []byte
 }
 
 var _ transformers.Transformer = &patchJson6902JSONTransformer{}
 
 // newPatchJson6902JSONTransformer constructs a PatchJson6902 transformer.
-func newPatchJson6902JSONTransformer(t resid.ResId, p jsonpatch.Patch) (transformers.Transformer, error) {
-	if len(p) == 0 {
+func newPatchJson6902JSONTransformer(
+	id resid.ResId, rawOp []byte) (transformers.Transformer, error) {
+	op := rawOp
+	var err error
+	if !isJsonFormat(op) {
+		// if it isn't JSON, try to parse it as YAML
+		op, err = yaml.YAMLToJSON(rawOp)
+		if err != nil {
+			return nil, err
+		}
+	}
+	decodedPatch, err := jsonpatch.DecodePatch(op)
+	if err != nil {
+		return nil, err
+	}
+	if len(decodedPatch) == 0 {
 		return transformers.NewNoOpTransformer(), nil
 	}
-	return &patchJson6902JSONTransformer{target: t, patch: p}, nil
+	return &patchJson6902JSONTransformer{target: id, patch: decodedPatch, rawOp: rawOp}, nil
 }
 
 // Transform apply the json patches on top of the base resources.
-func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap) error {
-	obj, err := findTargetObj(baseResourceMap, t.target)
-	if obj == nil {
+func (t *patchJson6902JSONTransformer) Transform(m resmap.ResMap) error {
+	obj, err := t.findTargetObj(m)
+	if err != nil {
 		return err
 	}
 	rawObj, err := obj.MarshalJSON()
@@ -51,7 +71,7 @@ func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap)
 	}
 	modifiedObj, err := t.patch.Apply(rawObj)
 	if err != nil {
-		return err
+		return errors.Wrapf(err, "failed to apply json patch '%s'", string(t.rawOp))
 	}
 	err = obj.UnmarshalJSON(modifiedObj)
 	if err != nil {
@@ -59,3 +79,30 @@ func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap)
 	}
 	return nil
 }
+
+func (t *patchJson6902JSONTransformer) findTargetObj(
+	m resmap.ResMap) (*resource.Resource, error) {
+	var matched []resid.ResId
+	// TODO(monopole): namespace bug in json patch?
+	// Since introduction in PR #300
+	// (see pkg/patch/transformer/util.go),
+	// this code has treated an empty namespace like a wildcard
+	// rather than like an additional restriction to match
+	// only the empty namespace.  No test coverage to confirm.
+	// Not sure if desired, keeping it for now.
+	if t.target.Namespace() != "" {
+		matched = m.GetMatchingIds(t.target.NsGvknEquals)
+	} else {
+		matched = m.GetMatchingIds(t.target.GvknEquals)
+	}
+	if len(matched) == 0 {
+		return nil, fmt.Errorf(
+			"couldn't find target %v for json patch", t.target)
+	}
+	if len(matched) > 1 {
+		return nil, fmt.Errorf(
+			"found multiple targets %v matching %v for json patch",
+			matched, t.target)
+	}
+	return m[matched[0]], nil
+}

pkg/patch/transformer/patchjson6902json_test.go

@@ -18,9 +18,9 @@ package transformer
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/evanphx/json-patch"
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
@@ -67,10 +67,7 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
         {"op": "add", "path": "/spec/replica", "value": "3"},
         {"op": "add", "path": "/spec/template/spec/containers/0/command", "value": ["arg1", "arg2", "arg3"]}
 ]`)
-	patch, err := jsonpatch.DecodePatch(operations)
-	if err != nil {
-		t.Fatalf("unexpected error : %v", err)
-	}
+
 	expected := resmap.ResMap{
 		id: rf.FromMap(
 			map[string]interface{}{
@@ -104,7 +101,7 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
 				},
 			}),
 	}
-	jpt, err := newPatchJson6902JSONTransformer(id, patch)
+	jpt, err := newPatchJson6902JSONTransformer(id, operations)
 	if err != nil {
 		t.Fatalf("unexpected error : %v", err)
 	}
@@ -117,3 +114,52 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
 		t.Fatalf("actual doesn't match expected: %v", err)
 	}
 }
+
+func TestJsonPatchJSONTransformer_UnHappyTransform(t *testing.T) {
+	rf := resource.NewFactory(
+		kunstruct.NewKunstructuredFactoryImpl())
+	id := resid.NewResId(deploy, "deploy1")
+	base := resmap.ResMap{
+		id: rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "apps/v1",
+				"kind":       "Deployment",
+				"metadata": map[string]interface{}{
+					"name": "deploy1",
+				},
+				"spec": map[string]interface{}{
+					"template": map[string]interface{}{
+						"metadata": map[string]interface{}{
+							"labels": map[string]interface{}{
+								"old-label": "old-value",
+							},
+						},
+						"spec": map[string]interface{}{
+							"containers": []interface{}{
+								map[string]interface{}{
+									"name":  "nginx",
+									"image": "nginx",
+								},
+							},
+						},
+					},
+				},
+			}),
+	}
+
+	operations := []byte(`[
+        {"op": "add", "path": "/spec/template/spec/containers/0/command/", "value": ["arg1", "arg2", "arg3"]}
+]`)
+
+	jpt, err := newPatchJson6902JSONTransformer(id, operations)
+	if err != nil {
+		t.Fatalf("unexpected error : %v", err)
+	}
+	err = jpt.Transform(base)
+	if err == nil {
+		t.Fatalf("expected error didn't happen")
+	}
+	if !strings.HasPrefix(err.Error(), "failed to apply json patch") || !strings.Contains(err.Error(), string(operations)) {
+		t.Fatalf("expected error didn't happen, but got %v", err)
+	}
+}

pkg/patch/transformer/util.go

@@ -1,46 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package transformer
-
-import (
-	"fmt"
-
-	"sigs.k8s.io/kustomize/pkg/resid"
-	"sigs.k8s.io/kustomize/pkg/resmap"
-	"sigs.k8s.io/kustomize/pkg/resource"
-)
-
-func findTargetObj(m resmap.ResMap, targetId resid.ResId) (*resource.Resource, error) {
-	matchedIds := m.FindByGVKN(targetId)
-	if targetId.Namespace() != "" {
-		var ids []resid.ResId
-		for _, id := range matchedIds {
-			if id.Namespace() == targetId.Namespace() {
-				ids = append(ids, id)
-			}
-		}
-		matchedIds = ids
-	}
-
-	if len(matchedIds) == 0 {
-		return nil, fmt.Errorf("couldn't find any object to apply the json patch %v", targetId)
-	}
-	if len(matchedIds) > 1 {
-		return nil, fmt.Errorf("found multiple objects that the patch can apply %v", matchedIds)
-	}
-	return m[matchedIds[0]], nil
-}

pkg/resid/resid.go

@@ -22,23 +22,30 @@ import (
 	"sigs.k8s.io/kustomize/pkg/gvk"
 )
 
-// ResId conflates GroupVersionKind with a textual name to uniquely identify a kubernetes resource (object).
+// ResId is an immutable identifier of a k8s resource object.
 type ResId struct {
 	// Gvk of the resource.
 	gvKind gvk.Gvk
-	// original name of the resource before transformation.
+
+	// name of the resource before transformation.
 	name string
-	// namePrefix of the resource
-	// an untransformed resource has no prefix, fully transformed resource has an arbitrary number of prefixes
-	// concatenated together.
+
+	// namePrefix of the resource.
+	// An untransformed resource has no prefix.
+	// A fully transformed resource has an arbitrary
+	// number of prefixes concatenated together.
 	prefix string
-	// nameSuffix of the resource
-	// an untransformed resource has no suffix, fully transformed resource has an arbitrary number of suffixes
-	// concatenated together.
+
+	// nameSuffix of the resource.
+	// An untransformed resource has no suffix.
+	// A fully transformed resource has an arbitrary
+	// number of suffixes concatenated together.
 	suffix string
-	// namespace the resource belongs to
-	// an untransformed resource has no namespace, fully transformed resource has the namespace from
-	// the top most overlay
+
+	// Namespace the resource belongs to.
+	// An untransformed resource has no namespace.
+	// A fully transformed resource has the namespace
+	// from the top most overlay.
 	namespace string
 }
 
@@ -108,10 +115,16 @@ func (n ResId) GvknString() string {
 	return n.gvKind.String() + separator + n.name
 }
 
-// GvknEquals return if two ResId have the same Group/Version/Kind and name
-// The comparison excludes prefix and suffix
+// GvknEquals returns true if the other id matches
+// Group/Version/Kind/name.
 func (n ResId) GvknEquals(id ResId) bool {
-	return n.gvKind.Equals(id.gvKind) && n.name == id.name
+	return n.name == id.name && n.gvKind.Equals(id.gvKind)
+}
+
+// NsGvknEquals returns true if the other id matches
+// namespace/Group/Version/Kind/name.
+func (n ResId) NsGvknEquals(id ResId) bool {
+	return n.namespace == id.namespace && n.GvknEquals(id)
 }
 
 // Gvk returns Group/Version/Kind of the resource.

pkg/resid/resid_test.go

@@ -10,31 +10,80 @@ var stringTests = []struct {
 	x ResId
 	s string
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"g_v_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_v_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_~K|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s"},
-		"~G_~V_~K|~X|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", suffix: "s"},
-		"~G_~V_~K|~X|~P|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		suffix: "s"},
-		"~G_~V_~K|~X|~P|~N|s"},
-	{ResId{gvKind: gvk.Gvk{}},
-		"~G_~V_~K|~X|~P|~N|~S"},
-	{ResId{},
-		"~G_~V_~K|~X|~P|~N|~S"},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"g_v_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_v_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_~K|ns|p|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			prefix: "p",
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|p|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|~P|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|~P|~N|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+		},
+		"~G_~V_~K|~X|~P|~N|~S",
+	},
+	{
+		ResId{},
+		"~G_~V_~K|~X|~P|~N|~S",
+	},
 }
 
 func TestString(t *testing.T) {
@@ -49,31 +98,80 @@ var gvknStringTests = []struct {
 	x ResId
 	s string
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"g_v_k|nm"},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_v_k|nm"},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_k|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", suffix: "s"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		suffix: "s"},
-		"~G_~V_~K|"},
-	{ResId{gvKind: gvk.Gvk{}},
-		"~G_~V_~K|"},
-	{ResId{},
-		"~G_~V_~K|"},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"g_v_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_v_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			prefix: "p",
+			suffix: "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			suffix: "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			suffix: "s",
+		},
+		"~G_~V_~K|",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+		},
+		"~G_~V_~K|",
+	},
+	{
+		ResId{},
+		"~G_~V_~K|",
+	},
 }
 
 func TestGvknString(t *testing.T) {
@@ -85,47 +183,147 @@ func TestGvknString(t *testing.T) {
 }
 
 var GvknEqualsTest = []struct {
-	x1 ResId
-	x2 ResId
+	id1          ResId
+	id2          ResId
+	gVknResult   bool
+	nSgVknResult bool
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: true,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:   "nm",
+			prefix: "BB",
+			suffix: "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
 }
 
 func TestEquals(t *testing.T) {
-	for _, hey := range GvknEqualsTest {
-		if !hey.x1.GvknEquals(hey.x2) {
-			t.Fatalf("%v should equal %v", hey.x1, hey.x2)
+	for _, tst := range GvknEqualsTest {
+		if tst.id1.GvknEquals(tst.id2) != tst.gVknResult {
+			t.Fatalf("GvknEquals(\n%v,\n%v\n) should be %v",
+				tst.id1, tst.id2, tst.gVknResult)
+		}
+		if tst.id1.NsGvknEquals(tst.id2) != tst.nSgVknResult {
+			t.Fatalf("NsGvknEquals(\n%v,\n%v\n) should be %v",
+				tst.id1, tst.id2, tst.nSgVknResult)
 		}
 	}
 }
 
 func TestCopyWithNewPrefixSuffix(t *testing.T) {
 	r1 := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "X"}
+	}
 	r2 := r1.CopyWithNewPrefixSuffix("p-", "-s")
 	expected := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "p-a",
 		suffix:    "b-s",
-		namespace: "X"}
+	}
 	if !r2.GvknEquals(expected) {
 		t.Fatalf("%v should equal %v", r2, expected)
 	}
@@ -133,18 +331,20 @@ func TestCopyWithNewPrefixSuffix(t *testing.T) {
 
 func TestCopyWithNewNamespace(t *testing.T) {
 	r1 := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "X"}
+	}
 	r2 := r1.CopyWithNewNamespace("zzz")
 	expected := ResId{
+		namespace: "zzz",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "zzz"}
+	}
 	if !r2.GvknEquals(expected) {
 		t.Fatalf("%v should equal %v", r2, expected)
 	}

pkg/resmap/factory.go

@@ -50,7 +50,7 @@ func (rmF *Factory) FromFiles(
 		if err != nil {
 			return nil, errors.Wrap(err, "Load from path "+path+" failed")
 		}
-		res, err := rmF.newResMapFromBytes(content)
+		res, err := rmF.NewResMapFromBytes(content)
 		if err != nil {
 			return nil, internal.Handler(err, path)
 		}
@@ -60,7 +60,7 @@ func (rmF *Factory) FromFiles(
 }
 
 // newResMapFromBytes decodes a list of objects in byte array format.
-func (rmF *Factory) newResMapFromBytes(b []byte) (ResMap, error) {
+func (rmF *Factory) NewResMapFromBytes(b []byte) (ResMap, error) {
 	resources, err := rmF.resF.SliceFromBytes(b)
 	if err != nil {
 		return nil, err

pkg/resmap/factory_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resmap
+package resmap_test
 
 import (
 	"encoding/base64"
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/loader"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
@@ -124,7 +125,7 @@ metadata:
 				},
 			}),
 	}
-	m, err := rmF.newResMapFromBytes(encoded)
+	m, err := rmF.NewResMapFromBytes(encoded)
 	fmt.Printf("%v\n", m)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)

pkg/resmap/resmap.go

@@ -32,26 +32,20 @@ import (
 // ResMap is a map from ResId to Resource.
 type ResMap map[resid.ResId]*resource.Resource
 
-// FindByGVKN find the matched ResIds by Group/Version/Kind and Name
-func (m ResMap) FindByGVKN(inputId resid.ResId) []resid.ResId {
+type IdMatcher func(resid.ResId) bool
+
+// GetMatchingIds returns a slice of ResId keys from the map
+// that all satisfy the given matcher function.
+func (m ResMap) GetMatchingIds(matches IdMatcher) []resid.ResId {
 	var result []resid.ResId
 	for id := range m {
-		if id.GvknEquals(inputId) {
+		if matches(id) {
 			result = append(result, id)
 		}
 	}
 	return result
 }
 
-// DemandOneMatchForId find the matched resource by Group/Version/Kind and Name
-func (m ResMap) DemandOneMatchForId(inputId resid.ResId) (*resource.Resource, bool) {
-	result := m.FindByGVKN(inputId)
-	if len(result) == 1 {
-		return m[result[0]], true
-	}
-	return nil, false
-}
-
 // EncodeAsYaml encodes a ResMap to YAML; encoded objects separated by `---`.
 func (m ResMap) EncodeAsYaml() ([]byte, error) {
 	var ids []resid.ResId
@@ -177,7 +171,7 @@ func MergeWithOverride(maps ...ResMap) (ResMap, error) {
 			continue
 		}
 		for id, r := range m {
-			matchedId := result.FindByGVKN(id)
+			matchedId := result.GetMatchingIds(id.GvknEquals)
 			if len(matchedId) == 1 {
 				id = matchedId[0]
 				switch r.Behavior() {

pkg/resmap/resmap_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resmap
+package resmap_test
 
 import (
 	"reflect"
@@ -23,6 +23,7 @@ import (
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
@@ -71,7 +72,7 @@ metadata:
 	}
 }
 
-func TestDemandOneMatchForId(t *testing.T) {
+func TestDemandOneGvknMatchForId(t *testing.T) {
 	rm1 := ResMap{
 		resid.NewResIdWithPrefixNamespace(cmap, "cm1", "prefix1", "ns1"): rf.FromMap(
 			map[string]interface{}{
@@ -91,31 +92,34 @@ func TestDemandOneMatchForId(t *testing.T) {
 			}),
 	}
 
-	_, ok := rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix1", "ns1"))
-	if !ok {
-		t.Fatal("Expected single map entry but got none")
+	result := rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix1", "ns1").GvknEquals)
+	if len(result) != 1 {
+		t.Fatalf("Expected single map entry but got %v", result)
 	}
 
 	// confirm that ns and prefix are not included in match
-	_, ok = rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix", "ns"))
-	if !ok {
-		t.Fatal("Expected single map entry but got none")
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix", "ns").GvknEquals)
+	if len(result) != 1 {
+		t.Fatalf("Expected single map entry but got %v", result)
 	}
 
 	// confirm that name is matched correctly
-	result, ok := rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm3", "prefix1", "ns1"))
-	if ok {
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm3", "prefix1", "ns1").GvknEquals)
+	if len(result) > 0 {
 		t.Fatalf("Expected no map entries but got %v", result)
 	}
 
 	cmap2 := gvk.Gvk{Version: "v2", Kind: "ConfigMap"}
 
 	// confirm that gvk is matched correctly
-	result, ok = rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap2, "cm2", "prefix1", "ns1"))
-	if ok {
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap2, "cm2", "prefix1", "ns1").GvknEquals)
+	if len(result) > 0 {
 		t.Fatalf("Expected no map entries but got %v", result)
 	}
-
 }
 
 func TestFilterBy(t *testing.T) {
@@ -291,8 +295,73 @@ func TestDeepCopy(t *testing.T) {
 	}
 }
 
-func TestErrorIfNotEqual(t *testing.T) {
+func TestGetMatchingIds(t *testing.T) {
+	// These ids used as map keys.
+	// They must be different to avoid overwriting
+	// map entries during construction.
+	ids := []resid.ResId{
+		resid.NewResId(
+			gvk.Gvk{Kind: "vegetable"},
+			"bedlam"),
+		resid.NewResId(
+			gvk.Gvk{Group: "g1", Version: "v1", Kind: "vegetable"},
+			"domino"),
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Kind: "vegetable"},
+			"peter", "p", "happy"),
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Version: "v1", Kind: "fruit"},
+			"shatterstar", "p", "happy"),
+	}
 
+	m := ResMap{}
+	for _, id := range ids {
+		// Resources values don't matter in this test.
+		m[id] = nil
+	}
+	if len(m) != len(ids) {
+		t.Fatalf("unexpected map len %d presumably due to duplicate keys", len(m))
+	}
+
+	tests := []struct {
+		name    string
+		matcher IdMatcher
+		count   int
+	}{
+		{
+			"match everything",
+			func(resid.ResId) bool { return true },
+			4,
+		},
+		{
+			"match nothing",
+			func(resid.ResId) bool { return false },
+			0,
+		},
+		{
+			"name is peter",
+			func(x resid.ResId) bool { return x.Name() == "peter" },
+			1,
+		},
+		{
+			"happy vegetable",
+			func(x resid.ResId) bool {
+				return x.Namespace() == "happy" &&
+					x.Gvk().Kind == "vegetable"
+			},
+			1,
+		},
+	}
+	for _, tst := range tests {
+		result := m.GetMatchingIds(tst.matcher)
+		if len(result) != tst.count {
+			t.Fatalf("test '%s';  actual: %d, expected: %d",
+				tst.name, len(result), tst.count)
+		}
+	}
+}
+
+func TestErrorIfNotEqual(t *testing.T) {
 	rm1 := ResMap{
 		resid.NewResId(cmap, "cm1"): rf.FromMap(
 			map[string]interface{}{
@@ -436,7 +505,6 @@ func TestMergeWithoutOverride(t *testing.T) {
 }
 
 func generateMergeFixtures(b types.GenerationBehavior) []ResMap {
-
 	input1 := ResMap{
 		resid.NewResId(cmap, "cmap"): rf.FromMapAndOption(
 			map[string]interface{}{

pkg/resource/factory.go

@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"strings"
 
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	internal "sigs.k8s.io/kustomize/pkg/internal/error"
@@ -94,10 +95,14 @@ func (rf *Factory) SliceFromBytes(in []byte) ([]*Resource, error) {
 	for len(kunStructs) > 0 {
 		u := kunStructs[0]
 		kunStructs = kunStructs[1:]
-		if u.GetKind() == "List" {
+		if strings.HasSuffix(u.GetKind(), "List") {
 			items := u.Map()["items"]
 			itemsSlice, ok := items.([]interface{})
 			if !ok {
+				if items == nil {
+					// an empty list
+					continue
+				}
 				return nil, fmt.Errorf("items in List is type %T, expected array", items)
 			}
 			for _, item := range itemsSlice {

pkg/resource/factory_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resource
+package resource_test
 
 import (
 	"reflect"
@@ -22,6 +22,7 @@ import (
 
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/patch"
+	. "sigs.k8s.io/kustomize/pkg/resource"
 )
 
 func TestSliceFromPatches(t *testing.T) {
@@ -67,7 +68,7 @@ items:
 	patchList2 := patch.StrategicMerge("patch5.yaml")
 	patch5 := `
 apiVersion: v1
-kind: List
+kind: DeploymentList
 items:
 - apiVersion: apps/v1
   kind: Deployment
@@ -86,6 +87,17 @@ items:
     name: deployment-b
   spec:
     <<: *hostAliases
+`
+	patchList3 := patch.StrategicMerge("patch6.yaml")
+	patch6 := `
+apiVersion: v1
+kind: List
+items:
+`
+	patchList4 := patch.StrategicMerge("patch7.yaml")
+	patch7 := `
+apiVersion: v1
+kind: List
 `
 	testDeploymentSpec := map[string]interface{}{
 		"template": map[string]interface{}{
@@ -125,6 +137,8 @@ items:
 	l.AddFile("/"+string(patchBad), []byte(patch3))
 	l.AddFile("/"+string(patchList), []byte(patch4))
 	l.AddFile("/"+string(patchList2), []byte(patch5))
+	l.AddFile("/"+string(patchList3), []byte(patch6))
+	l.AddFile("/"+string(patchList4), []byte(patch7))
 
 	tests := []struct {
 		name        string
@@ -162,6 +176,18 @@ items:
 			expectedOut: []*Resource{testDeploymentA, testDeploymentB},
 			expectedErr: false,
 		},
+		{
+			name:        "listWithNoEntries",
+			input:       []patch.StrategicMerge{patchList3},
+			expectedOut: []*Resource{},
+			expectedErr: false,
+		},
+		{
+			name:        "listWithNo'items:'",
+			input:       []patch.StrategicMerge{patchList4},
+			expectedOut: []*Resource{},
+			expectedErr: false,
+		},
 	}
 	for _, test := range tests {
 		rs, err := factory.SliceFromPatches(l, test.input)

pkg/resource/resource.go

@@ -38,7 +38,7 @@ func (r *Resource) String() string {
 	if err != nil {
 		return "<" + err.Error() + ">"
 	}
-	return strings.TrimSpace(string(bs))
+	return strings.TrimSpace(string(bs)) + r.options.String()
 }
 
 // DeepCopy returns a new copy of resource

pkg/resource/resource_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resource
+package resource_test
 
 import (
 	"testing"
@@ -22,6 +22,7 @@ import (
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resource"
 )
 
 var factory = NewFactory(
@@ -37,7 +38,9 @@ var testConfigMap = factory.FromMap(
 		},
 	})
 
-const testConfigMapString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
+const genArgOptions = "{nsfx:false,beh:unspecified}"
+
+const configMapAsString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
 
 var testDeployment = factory.FromMap(
 	map[string]interface{}{
@@ -48,7 +51,7 @@ var testDeployment = factory.FromMap(
 		},
 	})
 
-const testDeploymentString = `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"pooh"}}`
+const deploymentAsString = `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"pooh"}}`
 
 func TestResourceString(t *testing.T) {
 	tests := []struct {
@@ -57,11 +60,11 @@ func TestResourceString(t *testing.T) {
 	}{
 		{
 			in: testConfigMap,
-			s:  testConfigMapString,
+			s:  configMapAsString + genArgOptions,
 		},
 		{
 			in: testDeployment,
-			s:  testDeploymentString,
+			s:  deploymentAsString + genArgOptions,
 		},
 	}
 	for _, test := range tests {

pkg/target/baseandoverlaymedium_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/baseandoverlaysmall_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/configmaps_test.go

@@ -14,17 +14,162 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"
 )
 
-func TestGenerator1(t *testing.T) {
+// Generate a Secret and a ConfigMap from the same data
+// to compare the result.
+func TestGeneratorBasics(t *testing.T) {
+	th := NewKustTestHarness(t, "/app")
+	th.writeK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  env: foo.env
+  files:
+    - passphrase=phrase.dat
+    - forces.txt
+- name: json
+  literals:
+    - 'v2=[{"path": "var/druid/segment-cache"}]'
+secretGenerator:
+- name: bob
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  env: foo.env
+  files:
+    - passphrase=phrase.dat
+    - forces.txt
+`)
+	th.writeF("/app/foo.env", `
+MOUNTAIN=everest
+OCEAN=pacific
+`)
+	th.writeF("/app/phrase.dat", `
+Life is short.
+But the years are long.
+Not while the evil days come not.
+`)
+	th.writeF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  MOUNTAIN: everest
+  OCEAN: pacific
+  forces.txt: |2
+
+    gravitational
+    electromagnetic
+    strong nuclear
+    weak nuclear
+  fruit: apple
+  passphrase: |2
+
+    Life is short.
+    But the years are long.
+    Not while the evil days come not.
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-k772g5db55
+---
+apiVersion: v1
+data:
+  v2: '[{"path": "var/druid/segment-cache"}]'
+kind: ConfigMap
+metadata:
+  name: blah-json-tkh79m5tbc
+---
+apiVersion: v1
+data:
+  MOUNTAIN: ZXZlcmVzdA==
+  OCEAN: cGFjaWZpYw==
+  forces.txt: CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbnVjbGVhcgo=
+  fruit: YXBwbGU=
+  passphrase: CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aGUgZXZpbCBkYXlzIGNvbWUgbm90Lgo=
+  vegetable: YnJvY2NvbGk=
+kind: Secret
+metadata:
+  name: blah-bob-gmc2824f4b
+type: Opaque
+`)
+}
+
+// TODO: These should be errors instead.
+func TestGeneratorRepeatsInKustomization(t *testing.T) {
+	th := NewKustTestHarness(t, "/app")
+	th.writeK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  behavior: create
+  literals:
+    - bean=pinto
+    - star=wolf-rayet
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  files:
+    - forces.txt
+  files:
+    - nobles=nobility.txt
+`)
+	th.writeF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	th.writeF("/app/nobility.txt", `
+helium
+neon
+argon
+krypton
+xenon
+radon
+`)
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  fruit: apple
+  nobles: |2
+
+    helium
+    neon
+    argon
+    krypton
+    xenon
+    radon
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-gfkcbk5ckf
+`)
+}
+
+func TestGeneratorOverlays(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay")
 	th.writeK("/app/base1", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: p1-
 configMapGenerator:
 - name: com1
@@ -33,8 +178,6 @@ configMapGenerator:
     - from=base
 `)
 	th.writeK("/app/base2", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: p2-
 configMapGenerator:
 - name: com2
@@ -43,8 +186,6 @@ configMapGenerator:
     - from=base
 `)
 	th.writeK("/app/overlay/o1", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - ../../base1
 configMapGenerator:
@@ -54,8 +195,6 @@ configMapGenerator:
     - from=overlay
 `)
 	th.writeK("/app/overlay/o2", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - ../../base2
 configMapGenerator:
@@ -65,8 +204,6 @@ configMapGenerator:
     - from=overlay
 `)
 	th.writeK("/app/overlay", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - o1
 - o2

pkg/target/crd_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/customconfig_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/generatormergeandreplace_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/generatoroptions_test.go

@@ -11,7 +11,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/kusttarget.go

@@ -26,7 +26,6 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/pkg/constants"
-	"sigs.k8s.io/kustomize/pkg/fs"
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/ifc/transformer"
 	interror "sigs.k8s.io/kustomize/pkg/internal/error"
@@ -42,7 +41,6 @@ import (
 type KustTarget struct {
 	kustomization *types.Kustomization
 	ldr           ifc.Loader
-	fSys          fs.FileSystem
 	rFactory      *resmap.Factory
 	tFactory      transformer.Factory
 }
@@ -50,7 +48,6 @@ type KustTarget struct {
 // NewKustTarget returns a new instance of KustTarget primed with a Loader.
 func NewKustTarget(
 	ldr ifc.Loader,
-	fSys fs.FileSystem,
 	rFactory *resmap.Factory,
 	tFactory transformer.Factory) (*KustTarget, error) {
 	content, err := loadKustFile(ldr)
@@ -70,12 +67,23 @@ func NewKustTarget(
 	return &KustTarget{
 		kustomization: &k,
 		ldr:           ldr,
-		fSys:          fSys,
 		rFactory:      rFactory,
 		tFactory:      tFactory,
 	}, nil
 }
 
+func quoted(l []string) []string {
+	r := make([]string, len(l))
+	for i, v := range l {
+		r[i] = "'" + v + "'"
+	}
+	return r
+}
+
+func commaOr(q []string) string {
+	return strings.Join(q[:len(q)-1], ", ") + " or " + q[len(q)-1]
+}
+
 func loadKustFile(ldr ifc.Loader) ([]byte, error) {
 	var content []byte
 	match := 0
@@ -88,11 +96,13 @@ func loadKustFile(ldr ifc.Loader) ([]byte, error) {
 	}
 	switch match {
 	case 0:
-		return nil, fmt.Errorf("no kustomization.yaml file under %s", ldr.Root())
+		return nil, fmt.Errorf(
+			"unable to find one of %v in directory '%s'",
+			commaOr(quoted(constants.KustomizationFileNames)), ldr.Root())
 	case 1:
 		return content, nil
 	default:
-		return nil, fmt.Errorf("Found multiple kustomization file under: %s\n", ldr.Root())
+		return nil, fmt.Errorf("Found multiple kustomization files under: %s\n", ldr.Root())
 	}
 }
 
@@ -109,7 +119,7 @@ func unmarshal(y []byte, o interface{}) error {
 // MakeCustomizedResMap creates a ResMap per kustomization instructions.
 // The Resources in the returned ResMap are fully customized.
 func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
-	ra, err := kt.accumulateTarget()
+	ra, err := kt.AccumulateTarget()
 	if err != nil {
 		return nil, err
 	}
@@ -133,11 +143,11 @@ func (kt *KustTarget) shouldAddHashSuffixesToGeneratedResources() bool {
 		!kt.kustomization.GeneratorOptions.DisableNameSuffixHash
 }
 
-// accumulateTarget returns a new ResAccumulator,
+// AccumulateTarget returns a new ResAccumulator,
 // holding customized resources and the data/rules used
 // to do so.  The name back references and vars are
 // not yet fixed.
-func (kt *KustTarget) accumulateTarget() (
+func (kt *KustTarget) AccumulateTarget() (
 	ra *ResAccumulator, err error) {
 	// TODO(monopole): Get rid of the KustomizationErrors accumulator.
 	// It's not consistently used, and complicates tests.
@@ -235,15 +245,15 @@ func (kt *KustTarget) accumulateBases() (
 			continue
 		}
 		subKt, err := NewKustTarget(
-			ldr, kt.fSys, kt.rFactory, kt.tFactory)
+			ldr, kt.rFactory, kt.tFactory)
 		if err != nil {
 			errs.Append(errors.Wrap(err, "couldn't make target for "+path))
 			ldr.Cleanup()
 			continue
 		}
-		subRa, err := subKt.accumulateTarget()
+		subRa, err := subKt.AccumulateTarget()
 		if err != nil {
-			errs.Append(errors.Wrap(err, "accumulateTarget"))
+			errs.Append(errors.Wrap(err, "AccumulateTarget"))
 			ldr.Cleanup()
 			continue
 		}

pkg/target/kusttarget_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"encoding/base64"
@@ -25,14 +25,16 @@ import (
 
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
 const (
-	kustomizationContent1 = `
+	kustomizationContent = `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namePrefix: foo-
@@ -45,6 +47,8 @@ commonAnnotations:
 resources:
   - deployment.yaml
   - namespace.yaml
+generatorOptions:
+  disableNameSuffixHash: false
 configMapGenerator:
 - name: literalConfigMap
   literals:
@@ -81,9 +85,9 @@ metadata:
 ]`
 )
 
-func TestResources1(t *testing.T) {
+func TestResources(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever/", kustomizationContent1)
+	th.writeK("/whatever/", kustomizationContent)
 	th.writeF("/whatever/deployment.yaml", deploymentContent)
 	th.writeF("/whatever/namespace.yaml", namespaceContent)
 	th.writeF("/whatever/jsonpatch.json", jsonpatchContent)
@@ -144,7 +148,9 @@ func TestResources1(t *testing.T) {
 					"DB_USERNAME": "admin",
 					"DB_PASSWORD": "somepw",
 				},
-			}, &types.GeneratorArgs{}, nil),
+			},
+			&types.GeneratorArgs{},
+			&types.GeneratorOptions{}),
 		resid.NewResIdWithPrefixSuffixNamespace(
 			gvk.Gvk{Version: "v1", Kind: "Secret"},
 			"secret", "foo-", "-bar", "ns1"): th.fromMapAndOption(
@@ -166,7 +172,9 @@ func TestResources1(t *testing.T) {
 					"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
 					"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
 				},
-			}, &types.GeneratorArgs{}, nil),
+			},
+			&types.GeneratorArgs{},
+			&types.GeneratorOptions{}),
 		resid.NewResIdWithPrefixSuffixNamespace(
 			gvk.Gvk{Version: "v1", Kind: "Namespace"},
 			"ns1", "foo-", "-bar", ""): th.fromMap(
@@ -195,9 +203,20 @@ func TestResources1(t *testing.T) {
 	}
 }
 
+func TestKustomizationNotFound(t *testing.T) {
+	_, err := NewKustTarget(loadertest.NewFakeLoader("/foo"), nil, nil)
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+	if err.Error() !=
+		`unable to find one of 'kustomization.yaml', 'kustomization.yml' or 'Kustomization' in directory '/foo'` {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}
+
 func TestResourceNotFound(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever", kustomizationContent1)
+	th.writeK("/whatever", kustomizationContent)
 	_, err := th.makeKustTarget().MakeCustomizedResMap()
 	if err == nil {
 		t.Fatalf("Didn't get the expected error for an unknown resource")
@@ -218,13 +237,12 @@ func findSecret(m resmap.ResMap) *resource.Resource {
 
 func TestDisableNameSuffixHash(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever/", kustomizationContent1)
+	th.writeK("/whatever/", kustomizationContent)
 	th.writeF("/whatever/deployment.yaml", deploymentContent)
 	th.writeF("/whatever/namespace.yaml", namespaceContent)
 	th.writeF("/whatever/jsonpatch.json", jsonpatchContent)
 
-	kt := th.makeKustTarget()
-	m, err := kt.MakeCustomizedResMap()
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
 	if err != nil {
 		t.Fatalf("unexpected Resources error %v", err)
 	}
@@ -236,9 +254,11 @@ func TestDisableNameSuffixHash(t *testing.T) {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 
-	kt.kustomization.GeneratorOptions = &types.GeneratorOptions{
-		DisableNameSuffixHash: true}
-	m, err = kt.MakeCustomizedResMap()
+	th.writeK("/whatever/",
+		strings.Replace(kustomizationContent,
+			"disableNameSuffixHash: false",
+			"disableNameSuffixHash: true", -1))
+	m, err = th.makeKustTarget().MakeCustomizedResMap()
 	if err != nil {
 		t.Fatalf("unexpected Resources error %v", err)
 	}
@@ -324,11 +344,11 @@ vars:
       name: heron
       apiVersion: v300
 `)
-	ra, err := th.makeKustTarget().accumulateTarget()
+	ra, err := th.makeKustTarget().AccumulateTarget()
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
-	vars := ra.varSet.Set()
+	vars := ra.Vars()
 	if len(vars) != 2 {
 		t.Fatalf("unexpected size %d", len(vars))
 	}
@@ -374,11 +394,11 @@ vars:
 bases:
 - ../o1
 `)
-	ra, err := th.makeKustTarget().accumulateTarget()
+	ra, err := th.makeKustTarget().AccumulateTarget()
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
-	vars := ra.varSet.Set()
+	vars := ra.Vars()
 	if len(vars) != 4 {
 		for i, v := range vars {
 			fmt.Printf("%v: %v\n", i, v)
@@ -427,7 +447,7 @@ vars:
 bases:
 - ../o1
 `)
-	_, err := th.makeKustTarget().accumulateTarget()
+	_, err := th.makeKustTarget().AccumulateTarget()
 	if err == nil {
 		t.Fatalf("expected var collision")
 	}

pkg/target/kusttestharness_test.go

@@ -14,24 +14,24 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 // A collection of utilities used in target tests.
 
 import (
 	"fmt"
 	"path/filepath"
-	"sigs.k8s.io/kustomize/pkg/transformers/config/defaultconfig"
 	"strings"
 	"testing"
 
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/k8sdeps/transformer"
 	"sigs.k8s.io/kustomize/pkg/constants"
-	"sigs.k8s.io/kustomize/pkg/fs"
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
+	"sigs.k8s.io/kustomize/pkg/transformers/config/defaultconfig"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
@@ -50,17 +50,8 @@ func NewKustTestHarness(t *testing.T, path string) *KustTestHarness {
 }
 
 func (th *KustTestHarness) makeKustTarget() *KustTarget {
-	// Warning: the following filesystem - a fake - must be rooted at /.
-	// This fs root is used as the working directory for the shell spawned by
-	// the secretgenerator, and has nothing to do with the filesystem used
-	// to load relative paths from the fake filesystem.
-	// This trick only works for secret generator commands that don't actually
-	// try to read the file system, because these tests don't write to the
-	// real "/" directory.  See use of exec package in the secretfactory.
-	fakeFs := fs.MakeFakeFS()
-	fakeFs.Mkdir("/")
 	kt, err := NewKustTarget(
-		th.ldr, fakeFs, th.rf, transformer.NewFactoryImpl())
+		th.ldr, th.rf, transformer.NewFactoryImpl())
 	if err != nil {
 		th.t.Fatalf("Unexpected construction error %v", err)
 	}

pkg/target/multiplepatch_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"strings"

pkg/target/namespacedgenerators_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/nullvalues_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/resaccumulator.go

@@ -19,6 +19,8 @@ package target
 import (
 	"fmt"
 	"log"
+	"strings"
+
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/transformers"
@@ -55,6 +57,11 @@ func (ra *ResAccumulator) ResMap() resmap.ResMap {
 	return result
 }
 
+// Vars returns a copy of underlying vars.
+func (ra *ResAccumulator) Vars() []types.Var {
+	return ra.varSet.Set()
+}
+
 func (ra *ResAccumulator) MergeResourcesWithErrorOnIdCollision(
 	resources resmap.ResMap) (err error) {
 	ra.resMap, err = resmap.MergeWithErrorOnIdCollision(
@@ -96,17 +103,27 @@ func (ra *ResAccumulator) MergeAccumulator(other *ResAccumulator) (err error) {
 // for substitution wherever the $(var.Name) occurs.
 func (ra *ResAccumulator) makeVarReplacementMap() (map[string]string, error) {
 	result := map[string]string{}
-	for _, v := range ra.varSet.Set() {
-		id := resid.NewResId(v.ObjRef.GVK(), v.ObjRef.Name)
-		if r, found := ra.resMap.DemandOneMatchForId(id); found {
-			s, err := r.GetFieldValue(v.FieldRef.FieldPath)
+	for _, v := range ra.Vars() {
+		matched := ra.resMap.GetMatchingIds(
+			resid.NewResId(v.ObjRef.GVK(), v.ObjRef.Name).GvknEquals)
+		if len(matched) > 1 {
+			return nil, fmt.Errorf(
+				"found %d resId matches for var %s "+
+					"(unable to disambiguate)",
+				len(matched), v)
+		}
+		if len(matched) == 1 {
+			s, err := ra.resMap[matched[0]].GetFieldValue(v.FieldRef.FieldPath)
 			if err != nil {
-				return nil, fmt.Errorf("field path err for var: %+v", v)
+				return nil, fmt.Errorf(
+					"field specified in var '%v' "+
+						"not found in corresponding resource", v)
 			}
 			result[v.Name] = s
 		} else {
-			// Should this be an error?
-			log.Printf("var %v defined but not used", v)
+			return nil, fmt.Errorf(
+				"var '%v' cannot be mapped to a field "+
+					"in the set of known resources", v)
 		}
 	}
 	return result, nil
@@ -121,8 +138,18 @@ func (ra *ResAccumulator) ResolveVars() error {
 	if err != nil {
 		return err
 	}
-	return ra.Transform(transformers.NewRefVarTransformer(
-		replacementMap, ra.tConfig.VarReference))
+	if len(replacementMap) == 0 {
+		return nil
+	}
+	t := transformers.NewRefVarTransformer(
+		replacementMap, ra.tConfig.VarReference)
+	err = ra.Transform(t)
+	if len(t.UnusedVars()) > 0 {
+		log.Printf(
+			"well-defined vars that were never replaced: %s\n",
+			strings.Join(t.UnusedVars(), ","))
+	}
+	return err
 }
 
 func (ra *ResAccumulator) FixBackReferences() (err error) {

pkg/target/resaccumulator_test.go

@@ -14,9 +14,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
+	"bytes"
+	"log"
+	"os"
 	"strings"
 	"testing"
 
@@ -25,15 +28,16 @@ import (
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
 	"sigs.k8s.io/kustomize/pkg/transformers/config"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
-func TestResolveVars(t *testing.T) {
+func makeResAccumulator() (*ResAccumulator, *resource.Factory, error) {
 	ra := MakeEmptyAccumulator()
 	err := ra.MergeConfig(config.MakeDefaultConfig())
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		return nil, nil, err
 	}
 	rf := resource.NewFactory(
 		kunstruct.NewKunstructuredFactoryImpl())
@@ -54,8 +58,8 @@ func TestResolveVars(t *testing.T) {
 								map[string]interface{}{
 									"command": []interface{}{
 										"myserver",
-										"--somebackendService $(FOO)",
-										"--yetAnother $(BAR)",
+										"--somebackendService $(SERVICE_ONE)",
+										"--yetAnother $(SERVICE_TWO)",
 									},
 								},
 							},
@@ -84,14 +88,23 @@ func TestResolveVars(t *testing.T) {
 				},
 			}),
 	})
+	return ra, rf, nil
+}
+
+func TestResolveVarsHappy(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
 	err = ra.MergeVars([]types.Var{
 		{
-			Name: "FOO",
+			Name: "SERVICE_ONE",
 			ObjRef: types.Target{
 				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
 				Name: "backendOne"},
-		}, {
-			Name: "BAR",
+		},
+		{
+			Name: "SERVICE_TWO",
 			ObjRef: types.Target{
 				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
 				Name: "backendTwo"},
@@ -110,6 +123,145 @@ func TestResolveVars(t *testing.T) {
 	}
 }
 
+func TestResolveVarsOneUnused(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_UNUSED",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	expectLog(t, buf, "well-defined vars that were never replaced: SERVICE_UNUSED")
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother $(SERVICE_TWO)" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func expectLog(t *testing.T, log bytes.Buffer, expect string) {
+	if !strings.Contains(log.String(), expect) {
+		t.Fatalf("expected log containing '%s', got '%s'", expect, log.String())
+	}
+}
+
+func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
+	ra, rf, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	ra.MergeResourcesWithErrorOnIdCollision(resmap.ResMap{
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Version: "v1", Kind: "Service"},
+			"backendOne", "", "fooNamespace"): rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendOne",
+				},
+			}),
+	})
+
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(), "unable to disambiguate") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsGoodResIdBadField(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+			FieldRef: types.FieldSelector{FieldPath: "nope_nope_nope"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"not found in corresponding resource") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsUnmappableVar(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_THREE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "doesNotExist"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"cannot be mapped to a field in the set of known resources") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
 func find(name string, resMap resmap.ResMap) *resource.Resource {
 	for k, v := range resMap {
 		if k.Name() == name {

pkg/target/resourceconflict_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"strings"

pkg/target/variableref_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"
@@ -23,8 +23,6 @@ import (
 func TestVariableRef(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay/staging")
 	th.writeK("/app/base", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: base-
 resources:
  - cockroachdb-statefulset-secure.yaml
@@ -323,8 +321,6 @@ spec:
           storage: 1Gi
 `)
 	th.writeK("/app/overlay/staging", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: dev-
 bases:
 - ../../base
@@ -583,8 +579,6 @@ spec:
 func TestVariableRefIngress(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay")
 	th.writeK("/app/base", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 resources:
 - deployment.yaml
 - ingress.yaml
@@ -657,8 +651,6 @@ spec:
     targetPort: http
 `)
 	th.writeK("/app/overlay", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 nameprefix: kustomized-
 bases:
 - ../base
@@ -723,3 +715,137 @@ spec:
     - kustomized-nginx.example.com
 `)
 }
+
+func TestVariableRefMounthPath(t *testing.T) {
+	th := NewKustTestHarness(t, "/app/base")
+	th.writeK("/app/base", `
+resources:
+- deployment.yaml
+- namespace.yaml
+
+vars:
+- name: NAMESPACE
+  objref:
+    apiVersion: v1
+    kind: Namespace
+    name: my-namespace
+
+`)
+	th.writeF("/app/base/deployment.yaml", `
+  apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-deployment 
+  spec:
+    template:
+      spec:
+        containers:
+        - name: app
+          image: busybox
+          volumeMounts:
+          - name: my-volume
+            mountPath: "/$(NAMESPACE)"
+          env:
+          - name: NAMESPACE
+            value: $(NAMESPACE)
+        volumes:
+        - name: my-volume
+          emptyDir: {}
+`)
+	th.writeF("/app/base/namespace.yaml", `
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: my-namespace
+`)
+
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: my-namespace
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: NAMESPACE
+          value: my-namespace
+        image: busybox
+        name: app
+        volumeMounts:
+        - mountPath: /my-namespace
+          name: my-volume
+      volumes:
+      - emptyDir: {}
+        name: my-volume
+`)
+}
+
+func TestVariableRefMaps(t *testing.T) {
+	th := NewKustTestHarness(t, "/app/base")
+	th.writeK("/app/base", `
+resources:
+- deployment.yaml
+- namespace.yaml
+vars:
+- name: NAMESPACE
+  objref:
+    apiVersion: v1
+    kind: Namespace
+    name: my-namespace
+`)
+	th.writeF("/app/base/deployment.yaml", `
+  apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-deployment
+    labels:
+      my-label: $(NAMESPACE)
+  spec:
+    template:
+      spec:
+        containers:
+        - name: app
+          image: busybox  
+`)
+	th.writeF("/app/base/namespace.yaml", `
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: my-namespace
+`)
+
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: my-namespace
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    my-label: my-namespace
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox
+        name: app
+`)
+}

pkg/transformers/config/defaultconfig/varreference.go

@@ -100,10 +100,63 @@ varReference:
 - path: spec/containers/env/value
   kind: Pod
 
+- path: spec/initContainers/command
+  kind: Pod
+
+- path: spec/initContainers/args
+  kind: Pod
+
+- path: spec/initContainers/env/value
+  kind: Pod
+
 - path: spec/rules/host
   kind: Ingress
 
 - path: spec/tls/hosts
   kind: Ingress
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: spec/containers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/initContainers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: metadata/labels
 `
 )

pkg/transformers/config/factorycrd.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/ghodss/yaml"
 	"github.com/go-openapi/spec"
+	"github.com/pkg/errors"
 	"k8s.io/kube-openapi/pkg/common"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/ifc"
@@ -41,7 +42,7 @@ func LoadConfigFromCRDs(
 		}
 		m, err := makeNameToApiMap(content)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrapf(err, "unable to parse open API definition from '%s'", path)
 		}
 		otherTc, err := makeConfigFromApiMap(m)
 		if err != nil {

pkg/transformers/image.go

@@ -17,6 +17,7 @@ limitations under the License.
 package transformers
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
@@ -75,7 +76,10 @@ func (pt *imageTransformer) findAndReplaceImage(obj map[string]interface{}) erro
 }
 
 func (pt *imageTransformer) updateContainers(obj map[string]interface{}, path string) error {
-	containers := obj[path].([]interface{})
+	containers, ok := obj[path].([]interface{})
+	if !ok {
+		return fmt.Errorf("containers path is not of type []interface{} but %T", obj[path])
+	}
 	for i := range containers {
 		container := containers[i].(map[string]interface{})
 		containerImage, found := container["image"]
@@ -85,20 +89,21 @@ func (pt *imageTransformer) updateContainers(obj map[string]interface{}, path st
 
 		imageName := containerImage.(string)
 		for _, img := range pt.images {
-			if isImageMatched(imageName, img.Name) {
-				name, tag := split(imageName)
-				if img.NewName != "" {
-					name = img.NewName
-				}
-				if img.NewTag != "" {
-					tag = ":" + img.NewTag
-				}
-				if img.Digest != "" {
-					tag = "@" + img.Digest
-				}
-				container["image"] = name + tag
-				break
+			if !isImageMatched(imageName, img.Name) {
+				continue
 			}
+			name, tag := split(imageName)
+			if img.NewName != "" {
+				name = img.NewName
+			}
+			if img.NewTag != "" {
+				tag = ":" + img.NewTag
+			}
+			if img.Digest != "" {
+				tag = "@" + img.Digest
+			}
+			container["image"] = name + tag
+			break
 		}
 	}
 	return nil
@@ -138,7 +143,18 @@ func isImageMatched(s, t string) bool {
 // from the image string using either colon `:` or at `@` separators.
 // Note that the returned tag keeps its separator.
 func split(imageName string) (name string, tag string) {
-	ic := strings.LastIndex(imageName, ":")
+	// check if image name contains a domain
+	// if domain is present, ignore domain and check for `:`
+	ic := -1
+	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
+		ic = strings.LastIndex(imageName, ":")
+	} else {
+		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
+		// set ic only if `:` is present
+		if lastIc > 0 {
+			ic = slashIndex + lastIc
+		}
+	}
 	ia := strings.LastIndex(imageName, "@")
 	if ic < 0 && ia < 0 {
 		return imageName, ""

pkg/transformers/image_test.go

@@ -118,6 +118,10 @@ func TestImageTransformer(t *testing.T) {
 									"name":  "myimage",
 									"image": "myprivaterepohostname:1234/my/image:latest",
 								},
+								map[string]interface{}{
+									"name":  "myimage2",
+									"image": "myprivaterepohostname:1234/my/image",
+								},
 								map[string]interface{}{
 									"name":  "my-app",
 									"image": "my-app-image:v1",
@@ -218,6 +222,10 @@ func TestImageTransformer(t *testing.T) {
 									"name":  "myimage",
 									"image": "myprivaterepohostname:1234/my/image:v1.0.1",
 								},
+								map[string]interface{}{
+									"name":  "myimage2",
+									"image": "myprivaterepohostname:1234/my/image:v1.0.1",
+								},
 								map[string]interface{}{
 									"name":  "my-app",
 									"image": "gcr.io/my-project/my-app-image:v1",

pkg/transformers/namereference.go

@@ -89,7 +89,7 @@ func (o *nameReferenceTransformer) updateNameReference(
 			s, _ := in.(string)
 			for id, res := range m {
 				if id.Gvk().IsSelected(&backRef) && id.Name() == s {
-					matchedIds := m.FindByGVKN(id)
+					matchedIds := m.GetMatchingIds(id.GvknEquals)
 					// If there's more than one match, there's no way
 					// to know which one to pick, so emit error.
 					if len(matchedIds) > 1 {
@@ -115,7 +115,7 @@ func (o *nameReferenceTransformer) updateNameReference(
 			for id, res := range m {
 				indexes := indexOf(id.Name(), names)
 				if id.Gvk().IsSelected(&backRef) && len(indexes) > 0 {
-					matchedIds := m.FindByGVKN(id)
+					matchedIds := m.GetMatchingIds(id.GvknEquals)
 					if len(matchedIds) > 1 {
 						return nil, fmt.Errorf(
 							"Multiple matches for name %s:\n %v", id, matchedIds)

pkg/transformers/refvars.go

@@ -2,28 +2,26 @@ package transformers
 
 import (
 	"fmt"
-
 	"sigs.k8s.io/kustomize/pkg/expansion"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/transformers/config"
 )
 
-type refvarTransformer struct {
-	fieldSpecs  []config.FieldSpec
-	mappingFunc func(string) string
+type RefVarTransformer struct {
+	varMap            map[string]string
+	replacementCounts map[string]int
+	fieldSpecs        []config.FieldSpec
+	mappingFunc       func(string) string
 }
 
-// NewRefVarTransformer returns a Transformer that replaces $(VAR) style
-// variables with values.
+// NewRefVarTransformer returns a new RefVarTransformer
+// that replaces $(VAR) style variables with values.
 // The fieldSpecs are the places to look for occurrences of $(VAR).
 func NewRefVarTransformer(
-	varMap map[string]string, fs []config.FieldSpec) Transformer {
-	if len(varMap) == 0 {
-		return NewNoOpTransformer()
-	}
-	return &refvarTransformer{
-		fieldSpecs:  fs,
-		mappingFunc: expansion.MappingFuncFor(varMap),
+	varMap map[string]string, fs []config.FieldSpec) *RefVarTransformer {
+	return &RefVarTransformer{
+		varMap:     varMap,
+		fieldSpecs: fs,
 	}
 }
 
@@ -31,7 +29,7 @@ func NewRefVarTransformer(
 // embedded instances of $VAR style variables, e.g. a container command string.
 // The function returns the string with the variables expanded to their final
 // values.
-func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
+func (rv *RefVarTransformer) replaceVars(in interface{}) (interface{}, error) {
 	switch vt := in.(type) {
 	case []interface{}:
 		var xs []string
@@ -39,6 +37,17 @@ func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
 			xs = append(xs, expansion.Expand(a.(string), rv.mappingFunc))
 		}
 		return xs, nil
+	case map[string]interface{}:
+		inMap := in.(map[string]interface{})
+		xs := make(map[string]interface{}, len(inMap))
+		for k, v := range inMap {
+			s, ok := v.(string)
+			if !ok {
+				return nil, fmt.Errorf("%#v is expected to be %T", v, s)
+			}
+			xs[k] = expansion.Expand(s, rv.mappingFunc)
+		}
+		return xs, nil
 	case interface{}:
 		s, ok := in.(string)
 		if !ok {
@@ -52,8 +61,24 @@ func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
 	}
 }
 
+// UnusedVars returns slice of Var names that were unused
+// after a Transform run.
+func (rv *RefVarTransformer) UnusedVars() []string {
+	var unused []string
+	for k := range rv.varMap {
+		_, ok := rv.replacementCounts[k]
+		if !ok {
+			unused = append(unused, k)
+		}
+	}
+	return unused
+}
+
 // Transform replaces $(VAR) style variables with values.
-func (rv *refvarTransformer) Transform(m resmap.ResMap) error {
+func (rv *RefVarTransformer) Transform(m resmap.ResMap) error {
+	rv.replacementCounts = make(map[string]int)
+	rv.mappingFunc = expansion.MappingFuncFor(
+		rv.replacementCounts, rv.varMap)
 	for id, res := range m {
 		for _, fieldSpec := range rv.fieldSpecs {
 			if id.Gvk().IsSelected(&fieldSpec.Gvk) {

pkg/transformers/refvars_test.go

@@ -0,0 +1,93 @@
+package transformers
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/pkg/resid"
+	"sigs.k8s.io/kustomize/pkg/resmap"
+	"sigs.k8s.io/kustomize/pkg/transformers/config"
+)
+
+func TestVarRef(t *testing.T) {
+	type given struct {
+		varMap map[string]string
+		fs     []config.FieldSpec
+		res    resmap.ResMap
+	}
+	type expected struct {
+		res    resmap.ResMap
+		unused []string
+	}
+	testCases := []struct {
+		description string
+		given       given
+		expected    expected
+	}{
+		{
+			description: "var replacement in map[string]",
+			given: given{
+				varMap: map[string]string{
+					"FOO": "replacementForFoo",
+					"BAR": "replacementForBar",
+				},
+				fs: []config.FieldSpec{
+					{Gvk: cmap, Path: "data"},
+				},
+				res: resmap.ResMap{
+					resid.NewResId(cmap, "cm1"): rf.FromMap(
+						map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "ConfigMap",
+							"metadata": map[string]interface{}{
+								"name": "cm1",
+							},
+							"data": map[string]interface{}{
+								"item1": "$(FOO)",
+								"item2": "bla",
+							},
+						}),
+				},
+			},
+			expected: expected{
+				res: resmap.ResMap{
+					resid.NewResId(cmap, "cm1"): rf.FromMap(
+						map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "ConfigMap",
+							"metadata": map[string]interface{}{
+								"name": "cm1",
+							},
+							"data": map[string]interface{}{
+								"item1": "replacementForFoo",
+								"item2": "bla",
+							},
+						}),
+				},
+				unused: []string{"BAR"},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			// arrange
+			tr := NewRefVarTransformer(tc.given.varMap, tc.given.fs)
+
+			// act
+			err := tr.Transform(tc.given.res)
+
+			// assert
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+
+			a, e := tc.given.res, tc.expected.res
+			if !reflect.DeepEqual(a, e) {
+				err = e.ErrorIfNotEqual(a)
+				t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+			}
+
+		})
+	}
+}

pkg/types/genargs.go

@@ -16,6 +16,11 @@ limitations under the License.
 
 package types
 
+import (
+	"strconv"
+	"strings"
+)
+
 // GenArgs contains both generator args and options
 type GenArgs struct {
 	args *GeneratorArgs
@@ -30,6 +35,18 @@ func NewGenArgs(args *GeneratorArgs, opts *GeneratorOptions) *GenArgs {
 	}
 }
 
+func (g *GenArgs) String() string {
+	if g == nil {
+		return "{nilGenArgs}"
+	}
+	return "{" +
+		strings.Join([]string{
+			"nsfx:" + strconv.FormatBool(g.NeedsHashSuffix()),
+			"beh:" + g.Behavior().String()},
+			",") +
+		"}"
+}
+
 // NeedHashSuffix returns true if the hash suffix is needed.
 // It is needed when the two conditions are both met
 //  1) GenArgs is not nil

pkg/types/genargs_test.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+ Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+     http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/pkg/types"
+)
+
+func TestGenArgs_String(t *testing.T) {
+	tests := []struct {
+		ga       *GenArgs
+		expected string
+	}{
+		{
+			ga:       nil,
+			expected: "{nilGenArgs}",
+		},
+		{
+			ga:       &GenArgs{},
+			expected: "{nsfx:false,beh:unspecified}",
+		},
+		{
+			ga: NewGenArgs(
+				&GeneratorArgs{Behavior: "merge"},
+				&GeneratorOptions{DisableNameSuffixHash: false}),
+			expected: "{nsfx:true,beh:merge}",
+		},
+	}
+	for _, test := range tests {
+		if test.ga.String() != test.expected {
+			t.Fatalf("Expected '%s', got '%s'", test.expected, test.ga.String())
+		}
+	}
+}

pkg/types/var.go

@@ -75,9 +75,11 @@ type VarSet struct {
 	set []Var
 }
 
-// Set returns the var set.
+// Set returns a copy of the var set.
 func (vs *VarSet) Set() []Var {
-	return vs.set
+	s := make([]Var, len(vs.set))
+	copy(s, vs.set)
+	return s
 }
 
 // MergeSet absorbs other vars with error on name collision.

vendor/golang.org/x/net/http/httpguts/guts.go

@@ -0,0 +1,50 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package httpguts provides functions implementing various details
+// of the HTTP specification.
+//
+// This package is shared by the standard library (which vendors it)
+// and x/net/http2. It comes with no API stability promise.
+package httpguts
+
+import (
+	"net/textproto"
+	"strings"
+)
+
+// ValidTrailerHeader reports whether name is a valid header field name to appear
+// in trailers.
+// See RFC 7230, Section 4.1.2
+func ValidTrailerHeader(name string) bool {
+	name = textproto.CanonicalMIMEHeaderKey(name)
+	if strings.HasPrefix(name, "If-") || badTrailer[name] {
+		return false
+	}
+	return true
+}
+
+var badTrailer = map[string]bool{
+	"Authorization":       true,
+	"Cache-Control":       true,
+	"Connection":          true,
+	"Content-Encoding":    true,
+	"Content-Length":      true,
+	"Content-Range":       true,
+	"Content-Type":        true,
+	"Expect":              true,
+	"Host":                true,
+	"Keep-Alive":          true,
+	"Max-Forwards":        true,
+	"Pragma":              true,
+	"Proxy-Authenticate":  true,
+	"Proxy-Authorization": true,
+	"Proxy-Connection":    true,
+	"Range":               true,
+	"Realm":               true,
+	"Te":                  true,
+	"Trailer":             true,
+	"Transfer-Encoding":   true,
+	"Www-Authenticate":    true,
+}

vendor/golang.org/x/net/http/httpguts/httplex.go

@@ -2,12 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package httplex contains rules around lexical matters of various
-// HTTP-related specifications.
-//
-// This package is shared by the standard library (which vendors it)
-// and x/net/http2. It comes with no API stability promise.
-package httplex
+package httpguts
 
 import (
 	"net"

vendor/golang.org/x/net/http2/ciphers.go

@@ -5,7 +5,7 @@
 package http2
 
 // A list of the possible cipher suite ids. Taken from
-// http://www.iana.org/assignments/tls-parameters/tls-parameters.txt
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.txt
 
 const (
 	cipher_TLS_NULL_WITH_NULL_NULL               uint16 = 0x0000

vendor/golang.org/x/net/http2/client_conn_pool.go

@@ -52,9 +52,31 @@ const (
 	noDialOnMiss = false
 )
 
+// shouldTraceGetConn reports whether getClientConn should call any
+// ClientTrace.GetConn hook associated with the http.Request.
+//
+// This complexity is needed to avoid double calls of the GetConn hook
+// during the back-and-forth between net/http and x/net/http2 (when the
+// net/http.Transport is upgraded to also speak http2), as well as support
+// the case where x/net/http2 is being used directly.
+func (p *clientConnPool) shouldTraceGetConn(st clientConnIdleState) bool {
+	// If our Transport wasn't made via ConfigureTransport, always
+	// trace the GetConn hook if provided, because that means the
+	// http2 package is being used directly and it's the one
+	// dialing, as opposed to net/http.
+	if _, ok := p.t.ConnPool.(noDialClientConnPool); !ok {
+		return true
+	}
+	// Otherwise, only use the GetConn hook if this connection has
+	// been used previously for other requests. For fresh
+	// connections, the net/http package does the dialing.
+	return !st.freshConn
+}
+
 func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMiss bool) (*ClientConn, error) {
 	if isConnectionCloseRequest(req) && dialOnMiss {
 		// It gets its own connection.
+		traceGetConn(req, addr)
 		const singleUse = true
 		cc, err := p.t.dialClientConn(addr, singleUse)
 		if err != nil {
@@ -64,7 +86,10 @@ func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMis
 	}
 	p.mu.Lock()
 	for _, cc := range p.conns[addr] {
-		if cc.CanTakeNewRequest() {
+		if st := cc.idleState(); st.canTakeNewRequest {
+			if p.shouldTraceGetConn(st) {
+				traceGetConn(req, addr)
+			}
 			p.mu.Unlock()
 			return cc, nil
 		}
@@ -73,6 +98,7 @@ func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMis
 		p.mu.Unlock()
 		return nil, ErrNoCachedConn
 	}
+	traceGetConn(req, addr)
 	call := p.getStartDialLocked(addr)
 	p.mu.Unlock()
 	<-call.done

vendor/golang.org/x/net/http2/configure_transport.go

@@ -1,80 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.6
-
-package http2
-
-import (
-	"crypto/tls"
-	"fmt"
-	"net/http"
-)
-
-func configureTransport(t1 *http.Transport) (*Transport, error) {
-	connPool := new(clientConnPool)
-	t2 := &Transport{
-		ConnPool: noDialClientConnPool{connPool},
-		t1:       t1,
-	}
-	connPool.t = t2
-	if err := registerHTTPSProtocol(t1, noDialH2RoundTripper{t2}); err != nil {
-		return nil, err
-	}
-	if t1.TLSClientConfig == nil {
-		t1.TLSClientConfig = new(tls.Config)
-	}
-	if !strSliceContains(t1.TLSClientConfig.NextProtos, "h2") {
-		t1.TLSClientConfig.NextProtos = append([]string{"h2"}, t1.TLSClientConfig.NextProtos...)
-	}
-	if !strSliceContains(t1.TLSClientConfig.NextProtos, "http/1.1") {
-		t1.TLSClientConfig.NextProtos = append(t1.TLSClientConfig.NextProtos, "http/1.1")
-	}
-	upgradeFn := func(authority string, c *tls.Conn) http.RoundTripper {
-		addr := authorityAddr("https", authority)
-		if used, err := connPool.addConnIfNeeded(addr, t2, c); err != nil {
-			go c.Close()
-			return erringRoundTripper{err}
-		} else if !used {
-			// Turns out we don't need this c.
-			// For example, two goroutines made requests to the same host
-			// at the same time, both kicking off TCP dials. (since protocol
-			// was unknown)
-			go c.Close()
-		}
-		return t2
-	}
-	if m := t1.TLSNextProto; len(m) == 0 {
-		t1.TLSNextProto = map[string]func(string, *tls.Conn) http.RoundTripper{
-			"h2": upgradeFn,
-		}
-	} else {
-		m["h2"] = upgradeFn
-	}
-	return t2, nil
-}
-
-// registerHTTPSProtocol calls Transport.RegisterProtocol but
-// converting panics into errors.
-func registerHTTPSProtocol(t *http.Transport, rt http.RoundTripper) (err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			err = fmt.Errorf("%v", e)
-		}
-	}()
-	t.RegisterProtocol("https", rt)
-	return nil
-}
-
-// noDialH2RoundTripper is a RoundTripper which only tries to complete the request
-// if there's already has a cached connection to the host.
-type noDialH2RoundTripper struct{ t *Transport }
-
-func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	res, err := rt.t.RoundTrip(req)
-	if err == ErrNoCachedConn {
-		return nil, http.ErrSkipAltProtocol
-	}
-	return res, err
-}

vendor/golang.org/x/net/http2/flow.go

@@ -41,10 +41,10 @@ func (f *flow) take(n int32) {
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
 func (f *flow) add(n int32) bool {
-	remain := (1<<31 - 1) - f.n
-	if n > remain {
-		return false
+	sum := f.n + n
+	if (sum > n) == (f.n > 0) {
+		f.n = sum
+		return true
 	}
-	f.n += n
-	return true
+	return false
 }

vendor/golang.org/x/net/http2/frame.go

@@ -14,8 +14,8 @@ import (
 	"strings"
 	"sync"
 
+	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2/hpack"
-	"golang.org/x/net/lex/httplex"
 )
 
 const frameHeaderLen = 9
@@ -643,7 +643,7 @@ func (f *Framer) WriteData(streamID uint32, endStream bool, data []byte) error {
 	return f.WriteDataPadded(streamID, endStream, data, nil)
 }
 
-// WriteData writes a DATA frame with optional padding.
+// WriteDataPadded writes a DATA frame with optional padding.
 //
 // If pad is nil, the padding bit is not sent.
 // The length of pad must not exceed 255 bytes.
@@ -733,32 +733,67 @@ func (f *SettingsFrame) IsAck() bool {
 	return f.FrameHeader.Flags.Has(FlagSettingsAck)
 }
 
-func (f *SettingsFrame) Value(s SettingID) (v uint32, ok bool) {
+func (f *SettingsFrame) Value(id SettingID) (v uint32, ok bool) {
 	f.checkValid()
-	buf := f.p
-	for len(buf) > 0 {
-		settingID := SettingID(binary.BigEndian.Uint16(buf[:2]))
-		if settingID == s {
-			return binary.BigEndian.Uint32(buf[2:6]), true
+	for i := 0; i < f.NumSettings(); i++ {
+		if s := f.Setting(i); s.ID == id {
+			return s.Val, true
 		}
-		buf = buf[6:]
 	}
 	return 0, false
 }
 
+// Setting returns the setting from the frame at the given 0-based index.
+// The index must be >= 0 and less than f.NumSettings().
+func (f *SettingsFrame) Setting(i int) Setting {
+	buf := f.p
+	return Setting{
+		ID:  SettingID(binary.BigEndian.Uint16(buf[i*6 : i*6+2])),
+		Val: binary.BigEndian.Uint32(buf[i*6+2 : i*6+6]),
+	}
+}
+
+func (f *SettingsFrame) NumSettings() int { return len(f.p) / 6 }
+
+// HasDuplicates reports whether f contains any duplicate setting IDs.
+func (f *SettingsFrame) HasDuplicates() bool {
+	num := f.NumSettings()
+	if num == 0 {
+		return false
+	}
+	// If it's small enough (the common case), just do the n^2
+	// thing and avoid a map allocation.
+	if num < 10 {
+		for i := 0; i < num; i++ {
+			idi := f.Setting(i).ID
+			for j := i + 1; j < num; j++ {
+				idj := f.Setting(j).ID
+				if idi == idj {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	seen := map[SettingID]bool{}
+	for i := 0; i < num; i++ {
+		id := f.Setting(i).ID
+		if seen[id] {
+			return true
+		}
+		seen[id] = true
+	}
+	return false
+}
+
 // ForeachSetting runs fn for each setting.
 // It stops and returns the first error.
 func (f *SettingsFrame) ForeachSetting(fn func(Setting) error) error {
 	f.checkValid()
-	buf := f.p
-	for len(buf) > 0 {
-		if err := fn(Setting{
-			SettingID(binary.BigEndian.Uint16(buf[:2])),
-			binary.BigEndian.Uint32(buf[2:6]),
-		}); err != nil {
+	for i := 0; i < f.NumSettings(); i++ {
+		if err := fn(f.Setting(i)); err != nil {
 			return err
 		}
-		buf = buf[6:]
 	}
 	return nil
 }
@@ -1442,7 +1477,7 @@ func (fr *Framer) maxHeaderStringLen() int {
 }
 
 // readMetaFrame returns 0 or more CONTINUATION frames from fr and
-// merge them into into the provided hf and returns a MetaHeadersFrame
+// merge them into the provided hf and returns a MetaHeadersFrame
 // with the decoded hpack values.
 func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
 	if fr.AllowIllegalReads {
@@ -1462,7 +1497,7 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
 		if VerboseLogs && fr.logReads {
 			fr.debugReadLoggerf("http2: decoded hpack field %+v", hf)
 		}
-		if !httplex.ValidHeaderFieldValue(hf.Value) {
+		if !httpguts.ValidHeaderFieldValue(hf.Value) {
 			invalid = headerFieldValueError(hf.Value)
 		}
 		isPseudo := strings.HasPrefix(hf.Name, ":")

vendor/golang.org/x/net/http2/go111.go

@@ -0,0 +1,29 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.11
+
+package http2
+
+import (
+	"net/http/httptrace"
+	"net/textproto"
+)
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool {
+	return trace != nil && trace.WroteHeaderField != nil
+}
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {
+	if trace != nil && trace.WroteHeaderField != nil {
+		trace.WroteHeaderField(k, []string{v})
+	}
+}
+
+func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
+	if trace != nil {
+		return trace.Got1xxResponse
+	}
+	return nil
+}

vendor/golang.org/x/net/http2/go16.go

@@ -1,16 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.6
-
-package http2
-
-import (
-	"net/http"
-	"time"
-)
-
-func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
-	return t1.ExpectContinueTimeout
-}

vendor/golang.org/x/net/http2/go17.go

@@ -1,106 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.7
-
-package http2
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"net/http/httptrace"
-	"time"
-)
-
-type contextContext interface {
-	context.Context
-}
-
-func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx contextContext, cancel func()) {
-	ctx, cancel = context.WithCancel(context.Background())
-	ctx = context.WithValue(ctx, http.LocalAddrContextKey, c.LocalAddr())
-	if hs := opts.baseConfig(); hs != nil {
-		ctx = context.WithValue(ctx, http.ServerContextKey, hs)
-	}
-	return
-}
-
-func contextWithCancel(ctx contextContext) (_ contextContext, cancel func()) {
-	return context.WithCancel(ctx)
-}
-
-func requestWithContext(req *http.Request, ctx contextContext) *http.Request {
-	return req.WithContext(ctx)
-}
-
-type clientTrace httptrace.ClientTrace
-
-func reqContext(r *http.Request) context.Context { return r.Context() }
-
-func (t *Transport) idleConnTimeout() time.Duration {
-	if t.t1 != nil {
-		return t.t1.IdleConnTimeout
-	}
-	return 0
-}
-
-func setResponseUncompressed(res *http.Response) { res.Uncompressed = true }
-
-func traceGotConn(req *http.Request, cc *ClientConn) {
-	trace := httptrace.ContextClientTrace(req.Context())
-	if trace == nil || trace.GotConn == nil {
-		return
-	}
-	ci := httptrace.GotConnInfo{Conn: cc.tconn}
-	cc.mu.Lock()
-	ci.Reused = cc.nextStreamID > 1
-	ci.WasIdle = len(cc.streams) == 0 && ci.Reused
-	if ci.WasIdle && !cc.lastActive.IsZero() {
-		ci.IdleTime = time.Now().Sub(cc.lastActive)
-	}
-	cc.mu.Unlock()
-
-	trace.GotConn(ci)
-}
-
-func traceWroteHeaders(trace *clientTrace) {
-	if trace != nil && trace.WroteHeaders != nil {
-		trace.WroteHeaders()
-	}
-}
-
-func traceGot100Continue(trace *clientTrace) {
-	if trace != nil && trace.Got100Continue != nil {
-		trace.Got100Continue()
-	}
-}
-
-func traceWait100Continue(trace *clientTrace) {
-	if trace != nil && trace.Wait100Continue != nil {
-		trace.Wait100Continue()
-	}
-}
-
-func traceWroteRequest(trace *clientTrace, err error) {
-	if trace != nil && trace.WroteRequest != nil {
-		trace.WroteRequest(httptrace.WroteRequestInfo{Err: err})
-	}
-}
-
-func traceFirstResponseByte(trace *clientTrace) {
-	if trace != nil && trace.GotFirstResponseByte != nil {
-		trace.GotFirstResponseByte()
-	}
-}
-
-func requestTrace(req *http.Request) *clientTrace {
-	trace := httptrace.ContextClientTrace(req.Context())
-	return (*clientTrace)(trace)
-}
-
-// Ping sends a PING frame to the server and waits for the ack.
-func (cc *ClientConn) Ping(ctx context.Context) error {
-	return cc.ping(ctx)
-}

vendor/golang.org/x/net/http2/go17_not18.go

@@ -1,36 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.7,!go1.8
-
-package http2
-
-import "crypto/tls"
-
-// temporary copy of Go 1.7's private tls.Config.clone:
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	return &tls.Config{
-		Rand:                        c.Rand,
-		Time:                        c.Time,
-		Certificates:                c.Certificates,
-		NameToCertificate:           c.NameToCertificate,
-		GetCertificate:              c.GetCertificate,
-		RootCAs:                     c.RootCAs,
-		NextProtos:                  c.NextProtos,
-		ServerName:                  c.ServerName,
-		ClientAuth:                  c.ClientAuth,
-		ClientCAs:                   c.ClientCAs,
-		InsecureSkipVerify:          c.InsecureSkipVerify,
-		CipherSuites:                c.CipherSuites,
-		PreferServerCipherSuites:    c.PreferServerCipherSuites,
-		SessionTicketsDisabled:      c.SessionTicketsDisabled,
-		SessionTicketKey:            c.SessionTicketKey,
-		ClientSessionCache:          c.ClientSessionCache,
-		MinVersion:                  c.MinVersion,
-		MaxVersion:                  c.MaxVersion,
-		CurvePreferences:            c.CurvePreferences,
-		DynamicRecordSizingDisabled: c.DynamicRecordSizingDisabled,
-		Renegotiation:               c.Renegotiation,
-	}
-}

vendor/golang.org/x/net/http2/go18.go

@@ -1,56 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.8
-
-package http2
-
-import (
-	"crypto/tls"
-	"io"
-	"net/http"
-)
-
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	c2 := c.Clone()
-	c2.GetClientCertificate = c.GetClientCertificate // golang.org/issue/19264
-	return c2
-}
-
-var _ http.Pusher = (*responseWriter)(nil)
-
-// Push implements http.Pusher.
-func (w *responseWriter) Push(target string, opts *http.PushOptions) error {
-	internalOpts := pushOptions{}
-	if opts != nil {
-		internalOpts.Method = opts.Method
-		internalOpts.Header = opts.Header
-	}
-	return w.push(target, internalOpts)
-}
-
-func configureServer18(h1 *http.Server, h2 *Server) error {
-	if h2.IdleTimeout == 0 {
-		if h1.IdleTimeout != 0 {
-			h2.IdleTimeout = h1.IdleTimeout
-		} else {
-			h2.IdleTimeout = h1.ReadTimeout
-		}
-	}
-	return nil
-}
-
-func shouldLogPanic(panicValue interface{}) bool {
-	return panicValue != nil && panicValue != http.ErrAbortHandler
-}
-
-func reqGetBody(req *http.Request) func() (io.ReadCloser, error) {
-	return req.GetBody
-}
-
-func reqBodyIsNoBody(body io.ReadCloser) bool {
-	return body == http.NoBody
-}
-
-func go18httpNoBody() io.ReadCloser { return http.NoBody } // for tests only

vendor/golang.org/x/net/http2/go19.go

@@ -1,16 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.9
-
-package http2
-
-import (
-	"net/http"
-)
-
-func configureServer19(s *http.Server, conf *Server) error {
-	s.RegisterOnShutdown(conf.state.startGracefulShutdown)
-	return nil
-}

vendor/golang.org/x/net/http2/headermap.go

@@ -7,15 +7,21 @@ package http2
 import (
 	"net/http"
 	"strings"
+	"sync"
 )
 
 var (
-	commonLowerHeader = map[string]string{} // Go-Canonical-Case -> lower-case
-	commonCanonHeader = map[string]string{} // lower-case -> Go-Canonical-Case
+	commonBuildOnce   sync.Once
+	commonLowerHeader map[string]string // Go-Canonical-Case -> lower-case
+	commonCanonHeader map[string]string // lower-case -> Go-Canonical-Case
 )
 
-func init() {
-	for _, v := range []string{
+func buildCommonHeaderMapsOnce() {
+	commonBuildOnce.Do(buildCommonHeaderMaps)
+}
+
+func buildCommonHeaderMaps() {
+	common := []string{
 		"accept",
 		"accept-charset",
 		"accept-encoding",
@@ -63,7 +69,10 @@ func init() {
 		"vary",
 		"via",
 		"www-authenticate",
-	} {
+	}
+	commonLowerHeader = make(map[string]string, len(common))
+	commonCanonHeader = make(map[string]string, len(common))
+	for _, v := range common {
 		chk := http.CanonicalHeaderKey(v)
 		commonLowerHeader[chk] = v
 		commonCanonHeader[v] = chk
@@ -71,6 +80,7 @@ func init() {
 }
 
 func lowerHeader(v string) string {
+	buildCommonHeaderMapsOnce()
 	if s, ok := commonLowerHeader[v]; ok {
 		return s
 	}

vendor/golang.org/x/net/http2/hpack/encode.go

@@ -206,7 +206,7 @@ func appendVarInt(dst []byte, n byte, i uint64) []byte {
 }
 
 // appendHpackString appends s, as encoded in "String Literal"
-// representation, to dst and returns the the extended buffer.
+// representation, to dst and returns the extended buffer.
 //
 // s will be encoded in Huffman codes only when it produces strictly
 // shorter byte string.

vendor/golang.org/x/net/http2/hpack/hpack.go

@@ -92,6 +92,8 @@ type Decoder struct {
 	// saveBuf is previous data passed to Write which we weren't able
 	// to fully parse before. Unlike buf, we own this data.
 	saveBuf bytes.Buffer
+
+	firstField bool // processing the first field of the header block
 }
 
 // NewDecoder returns a new decoder with the provided maximum dynamic
@@ -101,6 +103,7 @@ func NewDecoder(maxDynamicTableSize uint32, emitFunc func(f HeaderField)) *Decod
 	d := &Decoder{
 		emit:        emitFunc,
 		emitEnabled: true,
+		firstField:  true,
 	}
 	d.dynTab.table.init()
 	d.dynTab.allowedMaxSize = maxDynamicTableSize
@@ -226,11 +229,15 @@ func (d *Decoder) DecodeFull(p []byte) ([]HeaderField, error) {
 	return hf, nil
 }
 
+// Close declares that the decoding is complete and resets the Decoder
+// to be reused again for a new header block. If there is any remaining
+// data in the decoder's buffer, Close returns an error.
 func (d *Decoder) Close() error {
 	if d.saveBuf.Len() > 0 {
 		d.saveBuf.Reset()
 		return DecodingError{errors.New("truncated headers")}
 	}
+	d.firstField = true
 	return nil
 }
 
@@ -266,6 +273,7 @@ func (d *Decoder) Write(p []byte) (n int, err error) {
 			d.saveBuf.Write(d.buf)
 			return len(p), nil
 		}
+		d.firstField = false
 		if err != nil {
 			break
 		}
@@ -389,6 +397,12 @@ func (d *Decoder) callEmit(hf HeaderField) error {
 
 // (same invariants and behavior as parseHeaderFieldRepr)
 func (d *Decoder) parseDynamicTableSizeUpdate() error {
+	// RFC 7541, sec 4.2: This dynamic table size update MUST occur at the
+	// beginning of the first header block following the change to the dynamic table size.
+	if !d.firstField && d.dynTab.size > 0 {
+		return DecodingError{errors.New("dynamic table size update MUST occur at the beginning of a header block")}
+	}
+
 	buf := d.buf
 	size, buf, err := readVarInt(5, buf)
 	if err != nil {

vendor/golang.org/x/net/http2/hpack/huffman.go

@@ -47,6 +47,7 @@ var ErrInvalidHuffman = errors.New("hpack: invalid Huffman-encoded data")
 // If maxLen is greater than 0, attempts to write more to buf than
 // maxLen bytes will return ErrStringLength.
 func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
+	rootHuffmanNode := getRootHuffmanNode()
 	n := rootHuffmanNode
 	// cur is the bit buffer that has not been fed into n.
 	// cbits is the number of low order bits in cur that are valid.
@@ -106,7 +107,7 @@ func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
 
 type node struct {
 	// children is non-nil for internal nodes
-	children []*node
+	children *[256]*node
 
 	// The following are only valid if children is nil:
 	codeLen uint8 // number of bits that led to the output of sym
@@ -114,22 +115,31 @@ type node struct {
 }
 
 func newInternalNode() *node {
-	return &node{children: make([]*node, 256)}
+	return &node{children: new([256]*node)}
 }
 
-var rootHuffmanNode = newInternalNode()
+var (
+	buildRootOnce       sync.Once
+	lazyRootHuffmanNode *node
+)
 
-func init() {
+func getRootHuffmanNode() *node {
+	buildRootOnce.Do(buildRootHuffmanNode)
+	return lazyRootHuffmanNode
+}
+
+func buildRootHuffmanNode() {
 	if len(huffmanCodes) != 256 {
 		panic("unexpected size")
 	}
+	lazyRootHuffmanNode = newInternalNode()
 	for i, code := range huffmanCodes {
 		addDecoderNode(byte(i), code, huffmanCodeLen[i])
 	}
 }
 
 func addDecoderNode(sym byte, code uint32, codeLen uint8) {
-	cur := rootHuffmanNode
+	cur := lazyRootHuffmanNode
 	for codeLen > 8 {
 		codeLen -= 8
 		i := uint8(code >> codeLen)

vendor/golang.org/x/net/http2/http2.go

@@ -29,7 +29,7 @@ import (
 	"strings"
 	"sync"
 
-	"golang.org/x/net/lex/httplex"
+	"golang.org/x/net/http/httpguts"
 )
 
 var (
@@ -179,7 +179,7 @@ var (
 )
 
 // validWireHeaderFieldName reports whether v is a valid header field
-// name (key). See httplex.ValidHeaderName for the base rules.
+// name (key). See httpguts.ValidHeaderName for the base rules.
 //
 // Further, http2 says:
 //   "Just as in HTTP/1.x, header field names are strings of ASCII
@@ -191,7 +191,7 @@ func validWireHeaderFieldName(v string) bool {
 		return false
 	}
 	for _, r := range v {
-		if !httplex.IsTokenRune(r) {
+		if !httpguts.IsTokenRune(r) {
 			return false
 		}
 		if 'A' <= r && r <= 'Z' {
@@ -201,19 +201,12 @@ func validWireHeaderFieldName(v string) bool {
 	return true
 }
 
-var httpCodeStringCommon = map[int]string{} // n -> strconv.Itoa(n)
-
-func init() {
-	for i := 100; i <= 999; i++ {
-		if v := http.StatusText(i); v != "" {
-			httpCodeStringCommon[i] = strconv.Itoa(i)
-		}
-	}
-}
-
 func httpCodeString(code int) string {
-	if s, ok := httpCodeStringCommon[code]; ok {
-		return s
+	switch code {
+	case 200:
+		return "200"
+	case 404:
+		return "404"
 	}
 	return strconv.Itoa(code)
 }
@@ -312,7 +305,7 @@ func mustUint31(v int32) uint32 {
 }
 
 // bodyAllowedForStatus reports whether a given response status code
-// permits a body. See RFC 2616, section 4.4.
+// permits a body. See RFC 7230, section 3.3.
 func bodyAllowedForStatus(status int) bool {
 	switch {
 	case status >= 100 && status <= 199:

vendor/golang.org/x/net/http2/not_go111.go

@@ -0,0 +1,20 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.11
+
+package http2
+
+import (
+	"net/http/httptrace"
+	"net/textproto"
+)
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool { return false }
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {}
+
+func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
+	return nil
+}

vendor/golang.org/x/net/http2/not_go16.go

@@ -1,21 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.6
-
-package http2
-
-import (
-	"net/http"
-	"time"
-)
-
-func configureTransport(t1 *http.Transport) (*Transport, error) {
-	return nil, errTransportVersion
-}
-
-func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
-	return 0
-
-}

vendor/golang.org/x/net/http2/not_go17.go

@@ -1,87 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.7
-
-package http2
-
-import (
-	"crypto/tls"
-	"net"
-	"net/http"
-	"time"
-)
-
-type contextContext interface {
-	Done() <-chan struct{}
-	Err() error
-}
-
-type fakeContext struct{}
-
-func (fakeContext) Done() <-chan struct{} { return nil }
-func (fakeContext) Err() error            { panic("should not be called") }
-
-func reqContext(r *http.Request) fakeContext {
-	return fakeContext{}
-}
-
-func setResponseUncompressed(res *http.Response) {
-	// Nothing.
-}
-
-type clientTrace struct{}
-
-func requestTrace(*http.Request) *clientTrace { return nil }
-func traceGotConn(*http.Request, *ClientConn) {}
-func traceFirstResponseByte(*clientTrace)     {}
-func traceWroteHeaders(*clientTrace)          {}
-func traceWroteRequest(*clientTrace, error)   {}
-func traceGot100Continue(trace *clientTrace)  {}
-func traceWait100Continue(trace *clientTrace) {}
-
-func nop() {}
-
-func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx contextContext, cancel func()) {
-	return nil, nop
-}
-
-func contextWithCancel(ctx contextContext) (_ contextContext, cancel func()) {
-	return ctx, nop
-}
-
-func requestWithContext(req *http.Request, ctx contextContext) *http.Request {
-	return req
-}
-
-// temporary copy of Go 1.6's private tls.Config.clone:
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	return &tls.Config{
-		Rand:                     c.Rand,
-		Time:                     c.Time,
-		Certificates:             c.Certificates,
-		NameToCertificate:        c.NameToCertificate,
-		GetCertificate:           c.GetCertificate,
-		RootCAs:                  c.RootCAs,
-		NextProtos:               c.NextProtos,
-		ServerName:               c.ServerName,
-		ClientAuth:               c.ClientAuth,
-		ClientCAs:                c.ClientCAs,
-		InsecureSkipVerify:       c.InsecureSkipVerify,
-		CipherSuites:             c.CipherSuites,
-		PreferServerCipherSuites: c.PreferServerCipherSuites,
-		SessionTicketsDisabled:   c.SessionTicketsDisabled,
-		SessionTicketKey:         c.SessionTicketKey,
-		ClientSessionCache:       c.ClientSessionCache,
-		MinVersion:               c.MinVersion,
-		MaxVersion:               c.MaxVersion,
-		CurvePreferences:         c.CurvePreferences,
-	}
-}
-
-func (cc *ClientConn) Ping(ctx contextContext) error {
-	return cc.ping(ctx)
-}
-
-func (t *Transport) idleConnTimeout() time.Duration { return 0 }

vendor/golang.org/x/net/http2/not_go18.go

@@ -1,29 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.8
-
-package http2
-
-import (
-	"io"
-	"net/http"
-)
-
-func configureServer18(h1 *http.Server, h2 *Server) error {
-	// No IdleTimeout to sync prior to Go 1.8.
-	return nil
-}
-
-func shouldLogPanic(panicValue interface{}) bool {
-	return panicValue != nil
-}
-
-func reqGetBody(req *http.Request) func() (io.ReadCloser, error) {
-	return nil
-}
-
-func reqBodyIsNoBody(io.ReadCloser) bool { return false }
-
-func go18httpNoBody() io.ReadCloser { return nil } // for tests only

vendor/golang.org/x/net/http2/not_go19.go

@@ -1,16 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.9
-
-package http2
-
-import (
-	"net/http"
-)
-
-func configureServer19(s *http.Server, conf *Server) error {
-	// not supported prior to go1.9
-	return nil
-}