Merge pull request #842 from narayanan/annotation-with-colon

Fix for #818 - Added support for quoted values

.travis.yml

@@ -1,3 +1,15 @@
+os:
+# TODO: Enable this when we can get the tests to work
+#  - windows
+  - linux
+  - osx
+
+addons:
+  apt:
+    packages: tree
+  homebrew:
+    packages: tree
+
 language: go
 
 go:
@@ -17,7 +29,6 @@ env:
 
 before_install:
   - source ./bin/consider-early-travis-exit.sh
-  - sudo apt-get install tree
   - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $GOPATH/bin ${GOLANGCI_RELEASE}
   - go get -u github.com/monopole/mdrip
 

Gopkg.lock

@@ -207,16 +207,16 @@
 
 [[projects]]
   branch = "master"
-  digest = "1:d1a6ebe75268a41b6fbb1d43947cf8688d8580423b7484fa5ae608beef6df24d"
+  digest = "1:18108bc7e384e395b4805632a637405a3df71fa518e22f9b39b0c08b89a52b96"
   name = "golang.org/x/net"
   packages = [
+    "http/httpguts",
     "http2",
     "http2/hpack",
     "idna",
-    "lex/httplex",
   ]
   pruneopts = "NUT"
-  revision = "1c05540f6879653db88113bc4a2b70aec4bd491f"
+  revision = "fe579d43d83210096a79b46dcca0e3721058393a"
 
 [[projects]]
   digest = "1:e33513a825fcd765e97b5de639a2f7547542d1a8245df0cef18e1fd390b778a9"
@@ -366,6 +366,7 @@
   input-imports = [
     "github.com/evanphx/json-patch",
     "github.com/ghodss/yaml",
+    "github.com/go-openapi/spec",
     "github.com/pkg/errors",
     "github.com/spf13/cobra",
     "gopkg.in/yaml.v2",

docs/eschewedFeatures.md

@@ -96,7 +96,7 @@ For example, to set the tag used on an image to match an
 environment variable, run
 
 ```
-kustomize edit set imagetag nginx:$MY_NGINX_VERSION
+kustomize edit set image nginx:$MY_NGINX_VERSION
 ```
 
 as part of some encapsulating work flow executed before

docs/kustomization.yaml

@@ -69,13 +69,16 @@ commonAnnotations:
 # markers ("---").
 resources:
 - some-service.yaml
-- ../some-dir/some-deployment.yaml
+- sub-dir/some-deployment.yaml
 
 # Each entry in this list results in the creation of
 # one ConfigMap resource (it's a generator of n maps).
 # The example below creates two ConfigMaps. One with the
 # names and contents of the given files, the other with
 # key/value as data.
+# Each configMapGenerator item accepts a parameter of
+# behavior: [create|replace|merge]. This allows an overlay to modify or
+# replace an existing configMap from the parent.
 configMapGenerator:
 - name: myJavaServerProps
   files:
@@ -198,7 +201,7 @@ patchesJson6902:
   path: add_service_annotation.yaml
 
 # Each entry in this list should be a relative path to
-# a file for custom resource definition(CRD).
+# a file for custom resource definition(CRD) in openAPI definition.
 #
 # The presence of this field is to allow kustomize be
 # aware of CRDs and apply proper
@@ -208,14 +211,22 @@ patchesJson6902:
 # In kustomization, the ConfigMap object name may change by adding namePrefix, nameSuffix, or hashing
 # The name reference for this ConfigMap object in CRD object need to be
 # updated with namePrefix, nameSuffix, or hashing in the same way.
+#
+# The annotations can be put into openAPI definitions are:
+#   "x-kubernetes-annotation": ""
+#   "x-kubernetes-label-selector": ""
+#   "x-kubernetes-identity": ""
+#   "x-kubernetes-object-ref-api-version": "v1",
+#   "x-kubernetes-object-ref-kind": "Secret",
+#   "x-kubernetes-object-ref-name-key": "name",
 crds:
-- crds/typeA.yaml
-- crds/typeB.yaml
+- crds/typeA.json
+- crds/typeB.json
 
 # Vars are used to capture text from one resource's field
 # and insert that text elsewhere.
 #
-# For example, suppose one specify the name of a k8s Service
+# For example, suppose someone specifies the name of a k8s Service
 # object in a container's command line, and the name of a
 # k8s Secret object in a container's environment variable,
 # so that the following would work:
@@ -255,7 +266,7 @@ vars:
 # reference within that object.  That's where the text is found.
 #
 # The field reference is optional; it defaults to `metadata.name`,
-# a normal default, since kustomize is used to generates or
+# a normal default, since kustomize is used to generate or
 # modify the names of resources.
 #
 # At time of writing, only string type fields are supported.

examples/transformerconfigs/README.md

@@ -91,6 +91,5 @@ nameReference:
 
 Kustomize has a default set of configurations. They can be saved to local directory through `kustomize config save -d`. Kustomize allows modifying those configuration files and using them in kustomization.yaml file. This tutorial shows how to customize those configurations to
 - [support a CRD type](crd/README.md)
-- disabling adding commonLabels to fields in some kind of resources
 - add extra fields for variable substitution
 - add extra fields for name reference

examples/transformerconfigs/crd/README.md

@@ -8,38 +8,6 @@ Create a workspace by
 DEMO_HOME=$(mktemp -d)
 ```
 
-### Get the native config as a starting point
-
-Get the default transformer configurations using this command:
-
-<!-- @saveConfig @test -->
-```
-kustomize config save -d $DEMO_HOME/kustomizeconfig
-```
-The default configurations are saved
-in the directory `$DEMO_HOME/kustomizeconfig` as several files
-
-> ```
-> commonannotations.yaml
-> commonlabels.yaml
-> nameprefix.yaml
-> namereference.yaml
-> namespace.yaml
-> varreference.yaml
-> ```
-
-These files contain the field specifications for native resources
-that transformation directives like `namePrefix`, `commonLabels`, etc.
-need to do their work.
-
-These default configurations already include some common
-field specifictions for all types:
-
-- nameprefix is added to `.metadata.name`
-- namespace is added to `.metadata.namespace`
-- labels is added to `.metadata.labels`
-- annotations is added to `.metadata.annotations`
-
 ### Adding a custom resource
 
 Consider a CRD of kind `MyKind` with fields
@@ -51,6 +19,7 @@ Consider a CRD of kind `MyKind` with fields
 Add the following file to configure the transformers for the above fields
 <!-- @addConfig @test -->
 ```
+mkdir $DEMO_HOME/kustomizeconfig
 cat > $DEMO_HOME/kustomizeconfig/mykind.yaml << EOF
 
 commonLabels:
@@ -148,12 +117,6 @@ in the kustomization file:
 cat >> $DEMO_HOME/kustomization.yaml << EOF
 configurations:
 - kustomizeconfig/mykind.yaml
-- kustomizeconfig/commonannotations.yaml
-- kustomizeconfig/commonlabels.yaml
-- kustomizeconfig/nameprefix.yaml
-- kustomizeconfig/namereference.yaml
-- kustomizeconfig/namespace.yaml
-- kustomizeconfig/varreference.yaml
 EOF
 ```
 

k8sdeps/configmapandsecret/configmapfactory.go

@@ -81,8 +81,8 @@ func (f *ConfigMapFactory) MakeConfigMap(
 	}
 	all = append(all, pairs...)
 
-	for _, kv := range all {
-		err = addKvToConfigMap(cm, kv.Key, kv.Value)
+	for _, p := range all {
+		err = addKvToConfigMap(cm, p.Key, p.Value)
 		if err != nil {
 			return nil, err
 		}

k8sdeps/configmapandsecret/secretfactory.go

@@ -80,8 +80,8 @@ func (f *SecretFactory) MakeSecret(args *types.SecretArgs, options *types.Genera
 	}
 	all = append(all, pairs...)
 
-	for _, kv := range all {
-		err = addKvToSecret(s, kv.Key, kv.Value)
+	for _, p := range all {
+		err = addKvToSecret(s, p.Key, p.Value)
 		if err != nil {
 			return nil, err
 		}

k8sdeps/kunstruct/factory.go

@@ -108,7 +108,7 @@ func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error
 	kind := u.GetKind()
 	if kind == "" {
 		return fmt.Errorf("missing kind in object %v", u)
-	} else if kind == "List" {
+	} else if strings.HasSuffix(kind, "List") {
 		return nil
 	}
 	if u.GetName() == "" {

k8sdeps/kunstruct/factory_test.go

@@ -42,6 +42,15 @@ func TestSliceFromBytes(t *testing.T) {
 				testConfigMap.Map(),
 			},
 		})
+	testConfigMapList := factory.FromMap(
+		map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMapList",
+			"items": []interface{}{
+				testConfigMap.Map(),
+				testConfigMap.Map(),
+			},
+		})
 
 	tests := []struct {
 		name        string
@@ -151,6 +160,24 @@ items:
 			expectedOut: []ifc.Kunstructured{testList},
 			expectedErr: false,
 		},
+		{
+			name: "ConfigMapList",
+			input: []byte(`
+apiVersion: v1
+kind: ConfigMapList
+items:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: winnie
+`),
+			expectedOut: []ifc.Kunstructured{testConfigMapList},
+			expectedErr: false,
+		},
 	}
 
 	for _, test := range tests {

k8sdeps/transformer/patch/patch.go

@@ -60,7 +60,7 @@ func (pt *patchTransformer) Transform(baseResourceMap resmap.ResMap) error {
 	for _, patch := range patches {
 		// Merge patches with base resource.
 		id := patch.Id()
-		matchedIds := baseResourceMap.FindByGVKN(id)
+		matchedIds := baseResourceMap.GetMatchingIds(id.GvknEquals)
 		if len(matchedIds) == 0 {
 			return fmt.Errorf("failed to find an object with %s to apply the patch", id.GvknString())
 		}

pkg/commands/build/build.go

@@ -108,7 +108,7 @@ func (o *Options) RunBuild(
 		return err
 	}
 	defer ldr.Cleanup()
-	kt, err := target.NewKustTarget(ldr, fSys, rf, ptf)
+	kt, err := target.NewKustTarget(ldr, rf, ptf)
 	if err != nil {
 		return err
 	}

pkg/commands/build/build_test.go

@@ -22,6 +22,12 @@ import (
 	"sigs.k8s.io/kustomize/pkg/constants"
 )
 
+func TestNewOptionsToSilenceCodeInspectionError(t *testing.T) {
+	if NewOptions("foo", "bar") == nil {
+		t.Fatal("could not make new options")
+	}
+}
+
 func TestBuildValidate(t *testing.T) {
 	var cases = []struct {
 		name  string

pkg/commands/edit/add/addmetadata.go

@@ -130,17 +130,18 @@ func (o *addMetadataOptions) convertToMap(arg string) (map[string]string, error)
 	result := make(map[string]string)
 	inputs := strings.Split(arg, ",")
 	for _, input := range inputs {
-		kv := strings.Split(input, ":")
-		if len(kv[0]) < 1 {
-			return nil, o.makeError(input, "empty key")
-		}
-		if len(kv) > 2 {
-			return nil, o.makeError(input, "too many colons")
-		}
-		if len(kv) > 1 {
-			result[kv[0]] = kv[1]
+		c := strings.Index(input, ":")
+		if c == 0 {
+			// key is not passed
+			return nil, o.makeError(input, "need k:v pair where v may be quoted")
+		} else if c < 0 {
+			// only key passed
+			result[input] = ""
 		} else {
-			result[kv[0]] = ""
+			// both key and value passed
+			key := input[:c]
+			value := trimQuotes(input[c+1:])
+			result[key] = value
 		}
 	}
 	return result, nil
@@ -171,5 +172,14 @@ func (o *addMetadataOptions) writeToMap(m map[string]string, kind kindOfAdd) err
 }
 
 func (o *addMetadataOptions) makeError(input string, message string) error {
-	return fmt.Errorf("invalid %s: %s (%s)", o.kind, input, message)
+	return fmt.Errorf("invalid %s: '%s' (%s)", o.kind, input, message)
+}
+
+func trimQuotes(s string) string {
+	if len(s) >= 2 {
+		if s[0] == '"' && s[len(s)-1] == '"' {
+			return s[1 : len(s)-1]
+		}
+	}
+	return s
 }

pkg/commands/edit/add/addmetadata_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package add
 
 import (
+	"reflect"
 	"testing"
 
 	"sigs.k8s.io/kustomize/pkg/commands/kustfile"
@@ -103,6 +104,32 @@ func TestAddAnnotationManyArgs(t *testing.T) {
 	}
 }
 
+func TestAddAnnotationValueQuoted(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
+	v := validators.MakeHappyMapValidator(t)
+	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
+	args := []string{"k1:\"v1\""}
+	err := cmd.RunE(cmd, args)
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+}
+
+func TestAddAnnotationValueWithColon(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
+	v := validators.MakeHappyMapValidator(t)
+	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
+	args := []string{"k1:\"v1:v2\""}
+	err := cmd.RunE(cmd, args)
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+}
+
 func TestAddAnnotationNoKey(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
 	v := validators.MakeHappyMapValidator(t)
@@ -113,23 +140,21 @@ func TestAddAnnotationNoKey(t *testing.T) {
 	if err == nil {
 		t.Errorf("expected an error")
 	}
-	if err.Error() != "invalid annotation: :nokey (empty key)" {
+	if err.Error() != "invalid annotation: ':nokey' (need k:v pair where v may be quoted)" {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
 
 func TestAddAnnotationTooManyColons(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
 	v := validators.MakeHappyMapValidator(t)
 	cmd := newCmdAddAnnotation(fakeFS, v.Validator)
 	args := []string{"key:v1:v2"}
 	err := cmd.RunE(cmd, args)
-	v.VerifyNoCall()
-	if err == nil {
-		t.Errorf("expected an error")
-	}
-	if err.Error() != "invalid annotation: key:v1:v2 (too many colons)" {
-		t.Errorf("incorrect error: %v", err.Error())
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
 	}
 }
 
@@ -223,23 +248,21 @@ func TestAddLabelNoKey(t *testing.T) {
 	if err == nil {
 		t.Errorf("expected an error")
 	}
-	if err.Error() != "invalid label: :nokey (empty key)" {
+	if err.Error() != "invalid label: ':nokey' (need k:v pair where v may be quoted)" {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
 
 func TestAddLabelTooManyColons(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
+	fakeFS.WriteTestKustomization()
 	v := validators.MakeHappyMapValidator(t)
 	cmd := newCmdAddLabel(fakeFS, v.Validator)
 	args := []string{"key:v1:v2"}
 	err := cmd.RunE(cmd, args)
-	v.VerifyNoCall()
-	if err == nil {
-		t.Errorf("expected an error")
-	}
-	if err.Error() != "invalid label: key:v1:v2 (too many colons)" {
-		t.Errorf("incorrect error: %v", err.Error())
+	v.VerifyCall()
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
 	}
 }
 
@@ -271,3 +294,36 @@ func TestAddLabelMultipleArgs(t *testing.T) {
 		t.Errorf("incorrect error: %v", err.Error())
 	}
 }
+
+func TestConvertToMap(t *testing.T) {
+	var o addMetadataOptions
+	args := "a:b,c:\"d\",e:\"f:g\",g:h:k"
+	expected := make(map[string]string)
+	expected["a"] = "b"
+	expected["c"] = "d"
+	expected["e"] = "f:g"
+	expected["g"] = "h:k"
+
+	result, err := o.convertToMap(args)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err.Error())
+	}
+
+	eq := reflect.DeepEqual(expected, result)
+	if !eq {
+		t.Errorf("Converted map does not match expected, expected: %v, result: %v\n", expected, result)
+	}
+}
+
+func TestConvertToMapError(t *testing.T) {
+	var o addMetadataOptions
+	args := "a:b,c:\"d\",:f:g"
+
+	_, err := o.convertToMap(args)
+	if err == nil {
+		t.Errorf("expected an error")
+	}
+	if err.Error() != "invalid annotation: ':f:g' (need k:v pair where v may be quoted)" {
+		t.Errorf("incorrect error: %v", err.Error())
+	}
+}

pkg/commands/edit/add/flagsandargs.go

@@ -18,6 +18,7 @@ package add
 
 import (
 	"fmt"
+	"strings"
 
 	"sigs.k8s.io/kustomize/pkg/fs"
 )
@@ -53,11 +54,54 @@ func (a *flagsAndArgs) Validate(args []string) error {
 	return nil
 }
 
+// ExpandFileSource normalizes a string list, possibly
+// containing globs, into a validated, globless list.
+// For example, this list:
+//     some/path
+//     some/dir/a*
+//     bfile=some/dir/b*
+// becomes:
+//     some/path
+//     some/dir/airplane
+//     some/dir/ant
+//     some/dir/apple
+//     bfile=some/dir/banana
+// i.e. everything is converted to a key=value pair,
+// where the value is always a relative file path,
+// and the key, if missing, is the same as the value.
+// In the case where the key is explicitly declared,
+// the globbing, if present, must have exactly one match.
 func (a *flagsAndArgs) ExpandFileSource(fSys fs.FileSystem) error {
-	result, err := globPatterns(fSys, a.FileSources)
-	if err != nil {
-		return err
+	var results []string
+	for _, pattern := range a.FileSources {
+		var patterns []string
+		key := ""
+		// check if the pattern is in `--from-file=[key=]source` format
+		// and if so split it to send only the file-pattern to glob function
+		s := strings.Split(pattern, "=")
+		if len(s) == 2 {
+			patterns = append(patterns, s[1])
+			key = s[0]
+		} else {
+			patterns = append(patterns, s[0])
+		}
+		result, err := globPatterns(fSys, patterns)
+		if err != nil {
+			return err
+		}
+		// if the format is `--from-file=[key=]source` accept only one result
+		// and extend it with the `key=` prefix
+		if key != "" {
+			if len(result) != 1 {
+				return fmt.Errorf(
+					"'pattern '%s' catches files %v, should catch only one", pattern, result)
+			}
+			fileSource := fmt.Sprintf("%s=%s", key, result[0])
+			results = append(results, fileSource)
+		} else {
+			results = append(results, result...)
+		}
 	}
-	a.FileSources = result
+	a.FileSources = results
 	return nil
 }

pkg/commands/edit/add/flagsandargs_test.go

@@ -89,7 +89,7 @@ func TestExpandFileSource(t *testing.T) {
 	fakeFS := fs.MakeFakeFS()
 	fakeFS.Create("dir/fa1")
 	fakeFS.Create("dir/fa2")
-	fakeFS.Create("dir/reademe")
+	fakeFS.Create("dir/readme")
 	fa := flagsAndArgs{
 		FileSources: []string{"dir/fa*"},
 	}
@@ -102,3 +102,37 @@ func TestExpandFileSource(t *testing.T) {
 		t.Fatalf("FileSources is not correctly expanded: %v", fa.FileSources)
 	}
 }
+
+func TestExpandFileSourceWithKey(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.Create("dir/faaaaaaaaaabbbbbbbbbccccccccccccccccc")
+	fakeFS.Create("dir/foobar")
+	fakeFS.Create("dir/simplebar")
+	fakeFS.Create("dir/readme")
+	fa := flagsAndArgs{
+		FileSources: []string{"foo-key=dir/fa*", "bar-key=dir/foobar", "dir/simplebar"},
+	}
+	fa.ExpandFileSource(fakeFS)
+	expected := []string{
+		"foo-key=dir/faaaaaaaaaabbbbbbbbbccccccccccccccccc",
+		"bar-key=dir/foobar",
+		"dir/simplebar",
+	}
+	if !reflect.DeepEqual(fa.FileSources, expected) {
+		t.Fatalf("FileSources is not correctly expanded: %v", fa.FileSources)
+	}
+}
+
+func TestExpandFileSourceWithKeyAndError(t *testing.T) {
+	fakeFS := fs.MakeFakeFS()
+	fakeFS.Create("dir/fa1")
+	fakeFS.Create("dir/fa2")
+	fakeFS.Create("dir/readme")
+	fa := flagsAndArgs{
+		FileSources: []string{"foo-key=dir/fa*"},
+	}
+	err := fa.ExpandFileSource(fakeFS)
+	if err == nil {
+		t.Fatalf("FileSources should not be correctly expanded: %v", fa.FileSources)
+	}
+}

pkg/commands/misc/version.go

@@ -19,14 +19,15 @@ package misc
 import (
 	"fmt"
 	"io"
+	"runtime"
 
 	"github.com/spf13/cobra"
 )
 
 var (
 	kustomizeVersion = "unknown"
-	goos             = "unknown"
-	goarch           = "unknown"
+	goos             = runtime.GOOS
+	goarch           = runtime.GOARCH
 	gitCommit        = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD)
 
 	buildDate = "1970-01-01T00:00:00Z" // build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')

pkg/expansion/expand.go

@@ -36,15 +36,17 @@ func syntaxWrap(input string) string {
 // implements the expansion semantics defined in the expansion spec; it
 // returns the input string wrapped in the expansion syntax if no mapping
 // for the input is found.
-func MappingFuncFor(context ...map[string]string) func(string) string {
+func MappingFuncFor(
+	counts map[string]int,
+	context ...map[string]string) func(string) string {
 	return func(input string) string {
 		for _, vars := range context {
 			val, ok := vars[input]
 			if ok {
+				counts[input]++
 				return val
 			}
 		}
-
 		return syntaxWrap(input)
 	}
 }

pkg/expansion/expand_test.go

@@ -14,12 +14,19 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package expansion
+package expansion_test
 
 import (
 	"testing"
+
+	. "sigs.k8s.io/kustomize/pkg/expansion"
 )
 
+type expected struct {
+	count  int
+	edited string
+}
+
 func TestMapReference(t *testing.T) {
 	type env struct {
 		Name  string
@@ -46,23 +53,23 @@ func TestMapReference(t *testing.T) {
 		"BLU": "$(ZOO)-2",
 	}
 
-	serviceEnv := map[string]string{}
-
-	mapping := MappingFuncFor(declaredEnv, serviceEnv)
+	counts := make(map[string]int)
+	mapping := MappingFuncFor(counts, declaredEnv)
 
 	for _, env := range envs {
 		declaredEnv[env.Name] = Expand(env.Value, mapping)
 	}
 
-	expectedEnv := map[string]string{
-		"FOO": "bar",
-		"ZOO": "bar-1",
-		"BLU": "bar-1-2",
+	expectedEnv := map[string]expected{
+		"FOO": {count: 1, edited: "bar"},
+		"ZOO": {count: 1, edited: "bar-1"},
+		"BLU": {count: 0, edited: "bar-1-2"},
 	}
 
 	for k, v := range expectedEnv {
-		if e, a := v, declaredEnv[k]; e != a {
-			t.Errorf("Expected %v, got %v", e, a)
+		if e, a := v, declaredEnv[k]; e.edited != a || e.count != counts[k] {
+			t.Errorf("Expected %v count=%d, got %v count=%d",
+				e.edited, e.count, a, counts[k])
 		} else {
 			delete(declaredEnv, k)
 		}
@@ -81,9 +88,7 @@ func TestMapping(t *testing.T) {
 		"VAR_REF":   "$(VAR_A)",
 		"VAR_EMPTY": "",
 	}
-	mapping := MappingFuncFor(context)
-
-	doExpansionTest(t, mapping)
+	doExpansionTest(t, context)
 }
 
 func TestMappingDual(t *testing.T) {
@@ -96,51 +101,64 @@ func TestMappingDual(t *testing.T) {
 		"VAR_C":   "C",
 		"VAR_REF": "$(VAR_A)",
 	}
-	mapping := MappingFuncFor(context, context2)
 
-	doExpansionTest(t, mapping)
+	doExpansionTest(t, context, context2)
 }
 
-func doExpansionTest(t *testing.T, mapping func(string) string) {
+func doExpansionTest(t *testing.T, context ...map[string]string) {
 	cases := []struct {
 		name     string
 		input    string
 		expected string
+		counts   map[string]int
 	}{
 		{
 			name:     "whole string",
 			input:    "$(VAR_A)",
 			expected: "A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "repeat",
 			input:    "$(VAR_A)-$(VAR_A)",
 			expected: "A-A",
+			counts:   map[string]int{"VAR_A": 2},
+		},
+		{
+			name:     "multiple repeats",
+			input:    "$(VAR_A)-$(VAR_B)-$(VAR_B)-$(VAR_B)-$(VAR_A)",
+			expected: "A-B-B-B-A",
+			counts:   map[string]int{"VAR_A": 2, "VAR_B": 3},
 		},
 		{
 			name:     "beginning",
 			input:    "$(VAR_A)-1",
 			expected: "A-1",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "middle",
 			input:    "___$(VAR_B)___",
 			expected: "___B___",
+			counts:   map[string]int{"VAR_B": 1},
 		},
 		{
 			name:     "end",
 			input:    "___$(VAR_C)",
 			expected: "___C",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "compound",
 			input:    "$(VAR_A)_$(VAR_B)_$(VAR_C)",
 			expected: "A_B_C",
+			counts:   map[string]int{"VAR_A": 1, "VAR_B": 1, "VAR_C": 1},
 		},
 		{
 			name:     "escape & expand",
 			input:    "$$(VAR_B)_$(VAR_A)",
 			expected: "$(VAR_B)_A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "compound escape",
@@ -156,16 +174,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "backslash escape ignored",
 			input:    "foo\\$(VAR_C)bar",
 			expected: "foo\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "backslash escape ignored",
 			input:    "foo\\\\$(VAR_C)bar",
 			expected: "foo\\\\Cbar",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "lots of backslashes",
 			input:    "foo\\\\\\\\$(VAR_A)bar",
 			expected: "foo\\\\\\\\Abar",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "nested var references",
@@ -181,16 +202,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "value is a reference",
 			input:    "$(VAR_REF)",
 			expected: "$(VAR_A)",
+			counts:   map[string]int{"VAR_REF": 1},
 		},
 		{
 			name:     "value is a reference x 2",
 			input:    "%%$(VAR_REF)--$(VAR_REF)%%",
 			expected: "%%$(VAR_A)--$(VAR_A)%%",
+			counts:   map[string]int{"VAR_REF": 2},
 		},
 		{
 			name:     "empty var",
 			input:    "foo$(VAR_EMPTY)bar",
 			expected: "foobar",
+			counts:   map[string]int{"VAR_EMPTY": 1},
 		},
 		{
 			name:     "unterminated expression",
@@ -236,6 +260,7 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "multiple (odd) operators, var defined",
 			input:    "$$$$$$$(VAR_A)",
 			expected: "$$$A",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "missing open expression",
@@ -251,16 +276,19 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 			name:     "trailing incomplete expression not consumed",
 			input:    "$(VAR_B)_______$(A",
 			expected: "B_______$(A",
+			counts:   map[string]int{"VAR_B": 1},
 		},
 		{
 			name:     "trailing incomplete expression, no content, is not consumed",
 			input:    "$(VAR_C)_______$(",
 			expected: "C_______$(",
+			counts:   map[string]int{"VAR_C": 1},
 		},
 		{
 			name:     "operator at end of input string is preserved",
 			input:    "$(VAR_A)foobarzab$",
 			expected: "Afoobarzab$",
+			counts:   map[string]int{"VAR_A": 1},
 		},
 		{
 			name:     "shell escaped incomplete expr",
@@ -295,9 +323,31 @@ func doExpansionTest(t *testing.T, mapping func(string) string) {
 	}
 
 	for _, tc := range cases {
+		counts := make(map[string]int)
+		mapping := MappingFuncFor(counts, context...)
 		expanded := Expand(tc.input, mapping)
 		if e, a := tc.expected, expanded; e != a {
 			t.Errorf("%v: expected %q, got %q", tc.name, e, a)
 		}
+		if len(counts) != len(tc.counts) {
+			t.Errorf("%v: len(counts)=%d != len(tc.counts)=%d",
+				tc.name, len(counts), len(tc.counts))
+		}
+		if len(tc.counts) > 0 {
+			for k, expectedCount := range tc.counts {
+				c, ok := counts[k]
+				if ok {
+					if c != expectedCount {
+						t.Errorf(
+							"%v: k=%s, expected count %d, got %d",
+							tc.name, k, expectedCount, c)
+					}
+				} else {
+					t.Errorf(
+						"%v: k=%s, expected count %d, got zero",
+						tc.name, k, expectedCount)
+				}
+			}
+		}
 	}
 }

pkg/fs/confirmeddir.go

@@ -26,7 +26,7 @@ import (
 // that was confirmed to point to an existing directory.
 type ConfirmedDir string
 
-// Return a temporary dir, else error.
+// NewTmpConfirmedDir returns a temporary dir, else error.
 // The directory is cleaned, no symlinks, etc. so its
 // returned as a ConfirmedDir.
 func NewTmpConfirmedDir() (ConfirmedDir, error) {
@@ -34,7 +34,15 @@ func NewTmpConfirmedDir() (ConfirmedDir, error) {
 	if err != nil {
 		return "", err
 	}
-	return ConfirmedDir(n), nil
+
+	// In MacOs `ioutil.TempDir` creates a directory
+	// with root in the `/var` folder, which is in turn a symlinked path
+	// to `/private/var`.
+	// Function `filepath.EvalSymlinks`is used to
+	// resolve the real absolute path.
+	deLinked, err := filepath.EvalSymlinks(n)
+	return ConfirmedDir(deLinked), err
+
 }
 
 // HasPrefix returns true if the directory argument

pkg/fs/confirmeddir_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package fs
 
 import (
+	"path/filepath"
 	"testing"
 )
 
@@ -101,3 +102,18 @@ func TestHasPrefix_SlashFooBar(t *testing.T) {
 		t.Fatalf("/foo/bar should have prefix /")
 	}
 }
+
+func TestNewTempConfirmDir(t *testing.T) {
+	tmp, err := NewTmpConfirmedDir()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	delinked, err := filepath.EvalSymlinks(string(tmp))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(tmp) != delinked {
+		t.Fatalf("unexpected path containing symlinks")
+	}
+}

pkg/fs/realfs_test.go

@@ -27,7 +27,11 @@ import (
 
 func makeTestDir(t *testing.T) (FileSystem, string) {
 	x := MakeRealFS()
-	testDir, err := ioutil.TempDir("", "kustomize_testing_dir")
+	td, err := ioutil.TempDir("", "kustomize_testing_dir")
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+	testDir, err := filepath.EvalSymlinks(td)
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
 	}

pkg/git/repospec.go

@@ -24,6 +24,13 @@ import (
 	"sigs.k8s.io/kustomize/pkg/fs"
 )
 
+// Used as a temporary non-empty occupant of the cloneDir
+// field, as something distinguishable from the empty string
+// in various outputs (especially tests). Not using an
+// actual directory name here, as that's a temporary directory
+// with a unique name that isn't created until clone time.
+const notCloned = fs.ConfirmedDir("/notCloned")
+
 // RepoSpec specifies a git repository and a branch and path therein.
 type RepoSpec struct {
 	// Raw, original spec, used to look for cycles.
@@ -88,7 +95,7 @@ func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
 	}
 	return &RepoSpec{
 		raw: n, host: host, orgRepo: orgRepo,
-		path: path, ref: gitRef}, nil
+		cloneDir: notCloned, path: path, ref: gitRef}, nil
 }
 
 const (

pkg/git/repospec_test.go

@@ -122,46 +122,52 @@ func TestNewRepoSpecFromUrlErrors(t *testing.T) {
 
 func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 	testcases := []struct {
-		input string
-		repo  string
-		path  string
-		ref   string
+		input     string
+		cloneSpec string
+		absPath   string
+		ref       string
 	}{
 		{
-			input: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir",
-			repo:  "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
-			path:  "somedir",
-			ref:   "",
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir?ref=testbranch",
-			repo:  "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
-			path:  "somedir",
-			ref:   "testbranch",
+			input:     "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo/somedir?ref=testbranch",
+			cloneSpec: "https://git-codecommit.us-east-2.amazonaws.com/someorg/somerepo",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "testbranch",
 		},
 		{
-			input: "https://fabrikops2.visualstudio.com/someorg/somerepo?ref=master",
-			repo:  "https://fabrikops2.visualstudio.com/someorg/somerepo",
-			path:  "",
-			ref:   "master",
+			input:     "https://fabrikops2.visualstudio.com/someorg/somerepo?ref=master",
+			cloneSpec: "https://fabrikops2.visualstudio.com/someorg/somerepo",
+			absPath:   notCloned.String(),
+			ref:       "master",
 		},
 		{
-			input: "http://github.com/someorg/somerepo/somedir",
-			repo:  "https://github.com/someorg/somerepo.git",
-			path:  "somedir",
-			ref:   "",
+			input:     "http://github.com/someorg/somerepo/somedir",
+			cloneSpec: "https://github.com/someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "git@github.com:someorg/somerepo/somedir",
-			repo:  "git@github.com:someorg/somerepo.git",
-			path:  "somedir",
-			ref:   "",
+			input:     "git@github.com:someorg/somerepo/somedir",
+			cloneSpec: "git@github.com:someorg/somerepo.git",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "",
 		},
 		{
-			input: "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git?ref=v0.1.0",
-			repo:  "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git",
-			path:  "",
-			ref:   "v0.1.0",
+			input:     "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git?ref=v0.1.0",
+			cloneSpec: "git@gitlab2.sqtools.ru:10022/infra/kubernetes/thanos-base.git",
+			absPath:   notCloned.String(),
+			ref:       "v0.1.0",
+		},
+		{
+			input:     "git@bitbucket.org:company/project.git//path?ref=branch",
+			cloneSpec: "git@bitbucket.org:company/project.git",
+			absPath:   notCloned.Join("path"),
+			ref:       "branch",
 		},
 	}
 	for _, testcase := range testcases {
@@ -169,13 +175,13 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 		if err != nil {
 			t.Errorf("Unexpected error: %v", err)
 		}
-		if rs.CloneSpec() != testcase.repo {
+		if rs.CloneSpec() != testcase.cloneSpec {
 			t.Errorf("CloneSpec expected to be %v, but got %v on %s",
-				testcase.repo, rs.CloneSpec(), testcase.input)
+				testcase.cloneSpec, rs.CloneSpec(), testcase.input)
 		}
-		if rs.path != testcase.path {
-			t.Errorf("path expected to be %v, but got %v on %s",
-				testcase.path, rs.path, testcase.input)
+		if rs.AbsPath() != testcase.absPath {
+			t.Errorf("AbsPath expected to be %v, but got %v on %s",
+				testcase.absPath, rs.AbsPath(), testcase.input)
 		}
 		if rs.ref != testcase.ref {
 			t.Errorf("ref expected to be %v, but got %v on %s",

pkg/gvk/gvk.go

@@ -73,6 +73,8 @@ var order = []string{
 	"Namespace",
 	"StorageClass",
 	"CustomResourceDefinition",
+	"MutatingWebhookConfiguration",
+	"ValidatingWebhookConfiguration",
 	"ServiceAccount",
 	"Role",
 	"ClusterRole",

pkg/patch/transformer/factory.go

@@ -21,8 +21,6 @@ import (
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/resid"
 
-	"github.com/evanphx/json-patch"
-	"github.com/ghodss/yaml"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/patch"
 	"sigs.k8s.io/kustomize/pkg/transformers"
@@ -77,19 +75,7 @@ func (f PatchJson6902Factory) makeOnePatchJson6902Transformer(p patch.Json6902)
 		return nil, err
 	}
 
-	if !isJsonFormat(rawOp) {
-		// if it isn't JSON, try to parse it as YAML
-		rawOp, err = yaml.YAMLToJSON(rawOp)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	decodedPatch, err := jsonpatch.DecodePatch(rawOp)
-	if err != nil {
-		return nil, err
-	}
-	return newPatchJson6902JSONTransformer(targetId, decodedPatch)
+	return newPatchJson6902JSONTransformer(targetId, rawOp)
 }
 
 func isJsonFormat(data []byte) bool {

pkg/patch/transformer/patchjson6902json.go

@@ -17,9 +17,14 @@ limitations under the License.
 package transformer
 
 import (
+	"fmt"
+
 	"github.com/evanphx/json-patch"
+	"github.com/ghodss/yaml"
+	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
+	"sigs.k8s.io/kustomize/pkg/resource"
 	"sigs.k8s.io/kustomize/pkg/transformers"
 )
 
@@ -27,22 +32,37 @@ import (
 type patchJson6902JSONTransformer struct {
 	target resid.ResId
 	patch  jsonpatch.Patch
+	rawOp  []byte
 }
 
 var _ transformers.Transformer = &patchJson6902JSONTransformer{}
 
 // newPatchJson6902JSONTransformer constructs a PatchJson6902 transformer.
-func newPatchJson6902JSONTransformer(t resid.ResId, p jsonpatch.Patch) (transformers.Transformer, error) {
-	if len(p) == 0 {
+func newPatchJson6902JSONTransformer(
+	id resid.ResId, rawOp []byte) (transformers.Transformer, error) {
+	op := rawOp
+	var err error
+	if !isJsonFormat(op) {
+		// if it isn't JSON, try to parse it as YAML
+		op, err = yaml.YAMLToJSON(rawOp)
+		if err != nil {
+			return nil, err
+		}
+	}
+	decodedPatch, err := jsonpatch.DecodePatch(op)
+	if err != nil {
+		return nil, err
+	}
+	if len(decodedPatch) == 0 {
 		return transformers.NewNoOpTransformer(), nil
 	}
-	return &patchJson6902JSONTransformer{target: t, patch: p}, nil
+	return &patchJson6902JSONTransformer{target: id, patch: decodedPatch, rawOp: rawOp}, nil
 }
 
 // Transform apply the json patches on top of the base resources.
-func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap) error {
-	obj, err := findTargetObj(baseResourceMap, t.target)
-	if obj == nil {
+func (t *patchJson6902JSONTransformer) Transform(m resmap.ResMap) error {
+	obj, err := t.findTargetObj(m)
+	if err != nil {
 		return err
 	}
 	rawObj, err := obj.MarshalJSON()
@@ -51,7 +71,7 @@ func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap)
 	}
 	modifiedObj, err := t.patch.Apply(rawObj)
 	if err != nil {
-		return err
+		return errors.Wrapf(err, "failed to apply json patch '%s'", string(t.rawOp))
 	}
 	err = obj.UnmarshalJSON(modifiedObj)
 	if err != nil {
@@ -59,3 +79,30 @@ func (t *patchJson6902JSONTransformer) Transform(baseResourceMap resmap.ResMap)
 	}
 	return nil
 }
+
+func (t *patchJson6902JSONTransformer) findTargetObj(
+	m resmap.ResMap) (*resource.Resource, error) {
+	var matched []resid.ResId
+	// TODO(monopole): namespace bug in json patch?
+	// Since introduction in PR #300
+	// (see pkg/patch/transformer/util.go),
+	// this code has treated an empty namespace like a wildcard
+	// rather than like an additional restriction to match
+	// only the empty namespace.  No test coverage to confirm.
+	// Not sure if desired, keeping it for now.
+	if t.target.Namespace() != "" {
+		matched = m.GetMatchingIds(t.target.NsGvknEquals)
+	} else {
+		matched = m.GetMatchingIds(t.target.GvknEquals)
+	}
+	if len(matched) == 0 {
+		return nil, fmt.Errorf(
+			"couldn't find target %v for json patch", t.target)
+	}
+	if len(matched) > 1 {
+		return nil, fmt.Errorf(
+			"found multiple targets %v matching %v for json patch",
+			matched, t.target)
+	}
+	return m[matched[0]], nil
+}

pkg/patch/transformer/patchjson6902json_test.go

@@ -18,9 +18,9 @@ package transformer
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/evanphx/json-patch"
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
@@ -67,10 +67,7 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
         {"op": "add", "path": "/spec/replica", "value": "3"},
         {"op": "add", "path": "/spec/template/spec/containers/0/command", "value": ["arg1", "arg2", "arg3"]}
 ]`)
-	patch, err := jsonpatch.DecodePatch(operations)
-	if err != nil {
-		t.Fatalf("unexpected error : %v", err)
-	}
+
 	expected := resmap.ResMap{
 		id: rf.FromMap(
 			map[string]interface{}{
@@ -104,7 +101,7 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
 				},
 			}),
 	}
-	jpt, err := newPatchJson6902JSONTransformer(id, patch)
+	jpt, err := newPatchJson6902JSONTransformer(id, operations)
 	if err != nil {
 		t.Fatalf("unexpected error : %v", err)
 	}
@@ -117,3 +114,52 @@ func TestJsonPatchJSONTransformer_Transform(t *testing.T) {
 		t.Fatalf("actual doesn't match expected: %v", err)
 	}
 }
+
+func TestJsonPatchJSONTransformer_UnHappyTransform(t *testing.T) {
+	rf := resource.NewFactory(
+		kunstruct.NewKunstructuredFactoryImpl())
+	id := resid.NewResId(deploy, "deploy1")
+	base := resmap.ResMap{
+		id: rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "apps/v1",
+				"kind":       "Deployment",
+				"metadata": map[string]interface{}{
+					"name": "deploy1",
+				},
+				"spec": map[string]interface{}{
+					"template": map[string]interface{}{
+						"metadata": map[string]interface{}{
+							"labels": map[string]interface{}{
+								"old-label": "old-value",
+							},
+						},
+						"spec": map[string]interface{}{
+							"containers": []interface{}{
+								map[string]interface{}{
+									"name":  "nginx",
+									"image": "nginx",
+								},
+							},
+						},
+					},
+				},
+			}),
+	}
+
+	operations := []byte(`[
+        {"op": "add", "path": "/spec/template/spec/containers/0/command/", "value": ["arg1", "arg2", "arg3"]}
+]`)
+
+	jpt, err := newPatchJson6902JSONTransformer(id, operations)
+	if err != nil {
+		t.Fatalf("unexpected error : %v", err)
+	}
+	err = jpt.Transform(base)
+	if err == nil {
+		t.Fatalf("expected error didn't happen")
+	}
+	if !strings.HasPrefix(err.Error(), "failed to apply json patch") || !strings.Contains(err.Error(), string(operations)) {
+		t.Fatalf("expected error didn't happen, but got %v", err)
+	}
+}

pkg/patch/transformer/util.go

@@ -1,46 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package transformer
-
-import (
-	"fmt"
-
-	"sigs.k8s.io/kustomize/pkg/resid"
-	"sigs.k8s.io/kustomize/pkg/resmap"
-	"sigs.k8s.io/kustomize/pkg/resource"
-)
-
-func findTargetObj(m resmap.ResMap, targetId resid.ResId) (*resource.Resource, error) {
-	matchedIds := m.FindByGVKN(targetId)
-	if targetId.Namespace() != "" {
-		var ids []resid.ResId
-		for _, id := range matchedIds {
-			if id.Namespace() == targetId.Namespace() {
-				ids = append(ids, id)
-			}
-		}
-		matchedIds = ids
-	}
-
-	if len(matchedIds) == 0 {
-		return nil, fmt.Errorf("couldn't find any object to apply the json patch %v", targetId)
-	}
-	if len(matchedIds) > 1 {
-		return nil, fmt.Errorf("found multiple objects that the patch can apply %v", matchedIds)
-	}
-	return m[matchedIds[0]], nil
-}

pkg/resid/resid.go

@@ -22,23 +22,30 @@ import (
 	"sigs.k8s.io/kustomize/pkg/gvk"
 )
 
-// ResId conflates GroupVersionKind with a textual name to uniquely identify a kubernetes resource (object).
+// ResId is an immutable identifier of a k8s resource object.
 type ResId struct {
 	// Gvk of the resource.
 	gvKind gvk.Gvk
-	// original name of the resource before transformation.
+
+	// name of the resource before transformation.
 	name string
-	// namePrefix of the resource
-	// an untransformed resource has no prefix, fully transformed resource has an arbitrary number of prefixes
-	// concatenated together.
+
+	// namePrefix of the resource.
+	// An untransformed resource has no prefix.
+	// A fully transformed resource has an arbitrary
+	// number of prefixes concatenated together.
 	prefix string
-	// nameSuffix of the resource
-	// an untransformed resource has no suffix, fully transformed resource has an arbitrary number of suffixes
-	// concatenated together.
+
+	// nameSuffix of the resource.
+	// An untransformed resource has no suffix.
+	// A fully transformed resource has an arbitrary
+	// number of suffixes concatenated together.
 	suffix string
-	// namespace the resource belongs to
-	// an untransformed resource has no namespace, fully transformed resource has the namespace from
-	// the top most overlay
+
+	// Namespace the resource belongs to.
+	// An untransformed resource has no namespace.
+	// A fully transformed resource has the namespace
+	// from the top most overlay.
 	namespace string
 }
 
@@ -108,10 +115,16 @@ func (n ResId) GvknString() string {
 	return n.gvKind.String() + separator + n.name
 }
 
-// GvknEquals return if two ResId have the same Group/Version/Kind and name
-// The comparison excludes prefix and suffix
+// GvknEquals returns true if the other id matches
+// Group/Version/Kind/name.
 func (n ResId) GvknEquals(id ResId) bool {
-	return n.gvKind.Equals(id.gvKind) && n.name == id.name
+	return n.name == id.name && n.gvKind.Equals(id.gvKind)
+}
+
+// NsGvknEquals returns true if the other id matches
+// namespace/Group/Version/Kind/name.
+func (n ResId) NsGvknEquals(id ResId) bool {
+	return n.namespace == id.namespace && n.GvknEquals(id)
 }
 
 // Gvk returns Group/Version/Kind of the resource.

pkg/resid/resid_test.go

@@ -10,31 +10,80 @@ var stringTests = []struct {
 	x ResId
 	s string
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"g_v_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_v_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_k|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_~K|ns|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s"},
-		"~G_~V_~K|~X|p|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", suffix: "s"},
-		"~G_~V_~K|~X|~P|nm|s"},
-	{ResId{gvKind: gvk.Gvk{},
-		suffix: "s"},
-		"~G_~V_~K|~X|~P|~N|s"},
-	{ResId{gvKind: gvk.Gvk{}},
-		"~G_~V_~K|~X|~P|~N|~S"},
-	{ResId{},
-		"~G_~V_~K|~X|~P|~N|~S"},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"g_v_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_v_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_k|ns|p|nm|s",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_~K|ns|p|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			prefix: "p",
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|p|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|~P|nm|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			suffix: "s",
+		},
+		"~G_~V_~K|~X|~P|~N|s",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+		},
+		"~G_~V_~K|~X|~P|~N|~S",
+	},
+	{
+		ResId{},
+		"~G_~V_~K|~X|~P|~N|~S",
+	},
 }
 
 func TestString(t *testing.T) {
@@ -49,31 +98,80 @@ var gvknStringTests = []struct {
 	x ResId
 	s string
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"g_v_k|nm"},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_v_k|nm"},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_k|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s", namespace: "ns"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", prefix: "p", suffix: "s"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		name: "nm", suffix: "s"},
-		"~G_~V_~K|nm"},
-	{ResId{gvKind: gvk.Gvk{},
-		suffix: "s"},
-		"~G_~V_~K|"},
-	{ResId{gvKind: gvk.Gvk{}},
-		"~G_~V_~K|"},
-	{ResId{},
-		"~G_~V_~K|"},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"g_v_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_v_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_k|nm",
+	},
+	{
+		ResId{
+			namespace: "ns",
+			gvKind:    gvk.Gvk{},
+			name:      "nm",
+			prefix:    "p",
+			suffix:    "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			prefix: "p",
+			suffix: "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			name:   "nm",
+			suffix: "s",
+		},
+		"~G_~V_~K|nm",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+			suffix: "s",
+		},
+		"~G_~V_~K|",
+	},
+	{
+		ResId{
+			gvKind: gvk.Gvk{},
+		},
+		"~G_~V_~K|",
+	},
+	{
+		ResId{},
+		"~G_~V_~K|",
+	},
 }
 
 func TestGvknString(t *testing.T) {
@@ -85,47 +183,147 @@ func TestGvknString(t *testing.T) {
 }
 
 var GvknEqualsTest = []struct {
-	x1 ResId
-	x2 ResId
+	id1          ResId
+	id2          ResId
+	gVknResult   bool
+	nSgVknResult bool
 }{
-	{ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Version: "v", Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{gvKind: gvk.Gvk{Kind: "k"},
-		name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{gvKind: gvk.Gvk{Kind: "k"},
-			name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
-	{ResId{name: "nm", prefix: "AA", suffix: "aa", namespace: "X"},
-		ResId{name: "nm", prefix: "BB", suffix: "bb", namespace: "Z"}},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: true,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			gvKind: gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
+			name:   "nm",
+			prefix: "BB",
+			suffix: "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Version: "v", Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			gvKind:    gvk.Gvk{Kind: "k"},
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
+	{
+		id1: ResId{
+			namespace: "X",
+			name:      "nm",
+			prefix:    "AA",
+			suffix:    "aa",
+		},
+		id2: ResId{
+			namespace: "Z",
+			name:      "nm",
+			prefix:    "BB",
+			suffix:    "bb",
+		},
+		gVknResult:   true,
+		nSgVknResult: false,
+	},
 }
 
 func TestEquals(t *testing.T) {
-	for _, hey := range GvknEqualsTest {
-		if !hey.x1.GvknEquals(hey.x2) {
-			t.Fatalf("%v should equal %v", hey.x1, hey.x2)
+	for _, tst := range GvknEqualsTest {
+		if tst.id1.GvknEquals(tst.id2) != tst.gVknResult {
+			t.Fatalf("GvknEquals(\n%v,\n%v\n) should be %v",
+				tst.id1, tst.id2, tst.gVknResult)
+		}
+		if tst.id1.NsGvknEquals(tst.id2) != tst.nSgVknResult {
+			t.Fatalf("NsGvknEquals(\n%v,\n%v\n) should be %v",
+				tst.id1, tst.id2, tst.nSgVknResult)
 		}
 	}
 }
 
 func TestCopyWithNewPrefixSuffix(t *testing.T) {
 	r1 := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "X"}
+	}
 	r2 := r1.CopyWithNewPrefixSuffix("p-", "-s")
 	expected := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "p-a",
 		suffix:    "b-s",
-		namespace: "X"}
+	}
 	if !r2.GvknEquals(expected) {
 		t.Fatalf("%v should equal %v", r2, expected)
 	}
@@ -133,18 +331,20 @@ func TestCopyWithNewPrefixSuffix(t *testing.T) {
 
 func TestCopyWithNewNamespace(t *testing.T) {
 	r1 := ResId{
+		namespace: "X",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "X"}
+	}
 	r2 := r1.CopyWithNewNamespace("zzz")
 	expected := ResId{
+		namespace: "zzz",
 		gvKind:    gvk.Gvk{Group: "g", Version: "v", Kind: "k"},
 		name:      "nm",
 		prefix:    "a",
 		suffix:    "b",
-		namespace: "zzz"}
+	}
 	if !r2.GvknEquals(expected) {
 		t.Fatalf("%v should equal %v", r2, expected)
 	}

pkg/resmap/factory.go

@@ -50,7 +50,7 @@ func (rmF *Factory) FromFiles(
 		if err != nil {
 			return nil, errors.Wrap(err, "Load from path "+path+" failed")
 		}
-		res, err := rmF.newResMapFromBytes(content)
+		res, err := rmF.NewResMapFromBytes(content)
 		if err != nil {
 			return nil, internal.Handler(err, path)
 		}
@@ -60,7 +60,7 @@ func (rmF *Factory) FromFiles(
 }
 
 // newResMapFromBytes decodes a list of objects in byte array format.
-func (rmF *Factory) newResMapFromBytes(b []byte) (ResMap, error) {
+func (rmF *Factory) NewResMapFromBytes(b []byte) (ResMap, error) {
 	resources, err := rmF.resF.SliceFromBytes(b)
 	if err != nil {
 		return nil, err

pkg/resmap/factory_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resmap
+package resmap_test
 
 import (
 	"encoding/base64"
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/loader"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
@@ -124,7 +125,7 @@ metadata:
 				},
 			}),
 	}
-	m, err := rmF.newResMapFromBytes(encoded)
+	m, err := rmF.NewResMapFromBytes(encoded)
 	fmt.Printf("%v\n", m)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)

pkg/resmap/resmap.go

@@ -32,26 +32,20 @@ import (
 // ResMap is a map from ResId to Resource.
 type ResMap map[resid.ResId]*resource.Resource
 
-// FindByGVKN find the matched ResIds by Group/Version/Kind and Name
-func (m ResMap) FindByGVKN(inputId resid.ResId) []resid.ResId {
+type IdMatcher func(resid.ResId) bool
+
+// GetMatchingIds returns a slice of ResId keys from the map
+// that all satisfy the given matcher function.
+func (m ResMap) GetMatchingIds(matches IdMatcher) []resid.ResId {
 	var result []resid.ResId
 	for id := range m {
-		if id.GvknEquals(inputId) {
+		if matches(id) {
 			result = append(result, id)
 		}
 	}
 	return result
 }
 
-// DemandOneMatchForId find the matched resource by Group/Version/Kind and Name
-func (m ResMap) DemandOneMatchForId(inputId resid.ResId) (*resource.Resource, bool) {
-	result := m.FindByGVKN(inputId)
-	if len(result) == 1 {
-		return m[result[0]], true
-	}
-	return nil, false
-}
-
 // EncodeAsYaml encodes a ResMap to YAML; encoded objects separated by `---`.
 func (m ResMap) EncodeAsYaml() ([]byte, error) {
 	var ids []resid.ResId
@@ -177,7 +171,7 @@ func MergeWithOverride(maps ...ResMap) (ResMap, error) {
 			continue
 		}
 		for id, r := range m {
-			matchedId := result.FindByGVKN(id)
+			matchedId := result.GetMatchingIds(id.GvknEquals)
 			if len(matchedId) == 1 {
 				id = matchedId[0]
 				switch r.Behavior() {

pkg/resmap/resmap_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resmap
+package resmap_test
 
 import (
 	"reflect"
@@ -23,6 +23,7 @@ import (
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
@@ -71,7 +72,7 @@ metadata:
 	}
 }
 
-func TestDemandOneMatchForId(t *testing.T) {
+func TestDemandOneGvknMatchForId(t *testing.T) {
 	rm1 := ResMap{
 		resid.NewResIdWithPrefixNamespace(cmap, "cm1", "prefix1", "ns1"): rf.FromMap(
 			map[string]interface{}{
@@ -91,31 +92,34 @@ func TestDemandOneMatchForId(t *testing.T) {
 			}),
 	}
 
-	_, ok := rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix1", "ns1"))
-	if !ok {
-		t.Fatal("Expected single map entry but got none")
+	result := rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix1", "ns1").GvknEquals)
+	if len(result) != 1 {
+		t.Fatalf("Expected single map entry but got %v", result)
 	}
 
 	// confirm that ns and prefix are not included in match
-	_, ok = rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix", "ns"))
-	if !ok {
-		t.Fatal("Expected single map entry but got none")
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm2", "prefix", "ns").GvknEquals)
+	if len(result) != 1 {
+		t.Fatalf("Expected single map entry but got %v", result)
 	}
 
 	// confirm that name is matched correctly
-	result, ok := rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap, "cm3", "prefix1", "ns1"))
-	if ok {
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap, "cm3", "prefix1", "ns1").GvknEquals)
+	if len(result) > 0 {
 		t.Fatalf("Expected no map entries but got %v", result)
 	}
 
 	cmap2 := gvk.Gvk{Version: "v2", Kind: "ConfigMap"}
 
 	// confirm that gvk is matched correctly
-	result, ok = rm1.DemandOneMatchForId(resid.NewResIdWithPrefixNamespace(cmap2, "cm2", "prefix1", "ns1"))
-	if ok {
+	result = rm1.GetMatchingIds(
+		resid.NewResIdWithPrefixNamespace(cmap2, "cm2", "prefix1", "ns1").GvknEquals)
+	if len(result) > 0 {
 		t.Fatalf("Expected no map entries but got %v", result)
 	}
-
 }
 
 func TestFilterBy(t *testing.T) {
@@ -291,8 +295,73 @@ func TestDeepCopy(t *testing.T) {
 	}
 }
 
-func TestErrorIfNotEqual(t *testing.T) {
+func TestGetMatchingIds(t *testing.T) {
+	// These ids used as map keys.
+	// They must be different to avoid overwriting
+	// map entries during construction.
+	ids := []resid.ResId{
+		resid.NewResId(
+			gvk.Gvk{Kind: "vegetable"},
+			"bedlam"),
+		resid.NewResId(
+			gvk.Gvk{Group: "g1", Version: "v1", Kind: "vegetable"},
+			"domino"),
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Kind: "vegetable"},
+			"peter", "p", "happy"),
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Version: "v1", Kind: "fruit"},
+			"shatterstar", "p", "happy"),
+	}
 
+	m := ResMap{}
+	for _, id := range ids {
+		// Resources values don't matter in this test.
+		m[id] = nil
+	}
+	if len(m) != len(ids) {
+		t.Fatalf("unexpected map len %d presumably due to duplicate keys", len(m))
+	}
+
+	tests := []struct {
+		name    string
+		matcher IdMatcher
+		count   int
+	}{
+		{
+			"match everything",
+			func(resid.ResId) bool { return true },
+			4,
+		},
+		{
+			"match nothing",
+			func(resid.ResId) bool { return false },
+			0,
+		},
+		{
+			"name is peter",
+			func(x resid.ResId) bool { return x.Name() == "peter" },
+			1,
+		},
+		{
+			"happy vegetable",
+			func(x resid.ResId) bool {
+				return x.Namespace() == "happy" &&
+					x.Gvk().Kind == "vegetable"
+			},
+			1,
+		},
+	}
+	for _, tst := range tests {
+		result := m.GetMatchingIds(tst.matcher)
+		if len(result) != tst.count {
+			t.Fatalf("test '%s';  actual: %d, expected: %d",
+				tst.name, len(result), tst.count)
+		}
+	}
+}
+
+func TestErrorIfNotEqual(t *testing.T) {
 	rm1 := ResMap{
 		resid.NewResId(cmap, "cm1"): rf.FromMap(
 			map[string]interface{}{
@@ -436,7 +505,6 @@ func TestMergeWithoutOverride(t *testing.T) {
 }
 
 func generateMergeFixtures(b types.GenerationBehavior) []ResMap {
-
 	input1 := ResMap{
 		resid.NewResId(cmap, "cmap"): rf.FromMapAndOption(
 			map[string]interface{}{

pkg/resource/factory.go

@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"strings"
 
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	internal "sigs.k8s.io/kustomize/pkg/internal/error"
@@ -94,10 +95,14 @@ func (rf *Factory) SliceFromBytes(in []byte) ([]*Resource, error) {
 	for len(kunStructs) > 0 {
 		u := kunStructs[0]
 		kunStructs = kunStructs[1:]
-		if u.GetKind() == "List" {
+		if strings.HasSuffix(u.GetKind(), "List") {
 			items := u.Map()["items"]
 			itemsSlice, ok := items.([]interface{})
 			if !ok {
+				if items == nil {
+					// an empty list
+					continue
+				}
 				return nil, fmt.Errorf("items in List is type %T, expected array", items)
 			}
 			for _, item := range itemsSlice {

pkg/resource/factory_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resource
+package resource_test
 
 import (
 	"reflect"
@@ -22,6 +22,7 @@ import (
 
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/patch"
+	. "sigs.k8s.io/kustomize/pkg/resource"
 )
 
 func TestSliceFromPatches(t *testing.T) {
@@ -67,7 +68,7 @@ items:
 	patchList2 := patch.StrategicMerge("patch5.yaml")
 	patch5 := `
 apiVersion: v1
-kind: List
+kind: DeploymentList
 items:
 - apiVersion: apps/v1
   kind: Deployment
@@ -86,6 +87,17 @@ items:
     name: deployment-b
   spec:
     <<: *hostAliases
+`
+	patchList3 := patch.StrategicMerge("patch6.yaml")
+	patch6 := `
+apiVersion: v1
+kind: List
+items:
+`
+	patchList4 := patch.StrategicMerge("patch7.yaml")
+	patch7 := `
+apiVersion: v1
+kind: List
 `
 	testDeploymentSpec := map[string]interface{}{
 		"template": map[string]interface{}{
@@ -125,6 +137,8 @@ items:
 	l.AddFile("/"+string(patchBad), []byte(patch3))
 	l.AddFile("/"+string(patchList), []byte(patch4))
 	l.AddFile("/"+string(patchList2), []byte(patch5))
+	l.AddFile("/"+string(patchList3), []byte(patch6))
+	l.AddFile("/"+string(patchList4), []byte(patch7))
 
 	tests := []struct {
 		name        string
@@ -162,6 +176,18 @@ items:
 			expectedOut: []*Resource{testDeploymentA, testDeploymentB},
 			expectedErr: false,
 		},
+		{
+			name:        "listWithNoEntries",
+			input:       []patch.StrategicMerge{patchList3},
+			expectedOut: []*Resource{},
+			expectedErr: false,
+		},
+		{
+			name:        "listWithNo'items:'",
+			input:       []patch.StrategicMerge{patchList4},
+			expectedOut: []*Resource{},
+			expectedErr: false,
+		},
 	}
 	for _, test := range tests {
 		rs, err := factory.SliceFromPatches(l, test.input)

pkg/resource/resource.go

@@ -38,7 +38,7 @@ func (r *Resource) String() string {
 	if err != nil {
 		return "<" + err.Error() + ">"
 	}
-	return strings.TrimSpace(string(bs))
+	return strings.TrimSpace(string(bs)) + r.options.String()
 }
 
 // DeepCopy returns a new copy of resource

pkg/resource/resource_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resource
+package resource_test
 
 import (
 	"testing"
@@ -22,6 +22,7 @@ import (
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/resid"
+	. "sigs.k8s.io/kustomize/pkg/resource"
 )
 
 var factory = NewFactory(
@@ -37,7 +38,9 @@ var testConfigMap = factory.FromMap(
 		},
 	})
 
-const testConfigMapString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
+const genArgOptions = "{nsfx:false,beh:unspecified}"
+
+const configMapAsString = `{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"winnie","namespace":"hundred-acre-wood"}}`
 
 var testDeployment = factory.FromMap(
 	map[string]interface{}{
@@ -48,7 +51,7 @@ var testDeployment = factory.FromMap(
 		},
 	})
 
-const testDeploymentString = `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"pooh"}}`
+const deploymentAsString = `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"pooh"}}`
 
 func TestResourceString(t *testing.T) {
 	tests := []struct {
@@ -57,11 +60,11 @@ func TestResourceString(t *testing.T) {
 	}{
 		{
 			in: testConfigMap,
-			s:  testConfigMapString,
+			s:  configMapAsString + genArgOptions,
 		},
 		{
 			in: testDeployment,
-			s:  testDeploymentString,
+			s:  deploymentAsString + genArgOptions,
 		},
 	}
 	for _, test := range tests {

pkg/target/baseandoverlaymedium_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/baseandoverlaysmall_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/configmaps_test.go

@@ -14,17 +14,162 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"
 )
 
-func TestGenerator1(t *testing.T) {
+// Generate a Secret and a ConfigMap from the same data
+// to compare the result.
+func TestGeneratorBasics(t *testing.T) {
+	th := NewKustTestHarness(t, "/app")
+	th.writeK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  env: foo.env
+  files:
+    - passphrase=phrase.dat
+    - forces.txt
+- name: json
+  literals:
+    - 'v2=[{"path": "var/druid/segment-cache"}]'
+secretGenerator:
+- name: bob
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  env: foo.env
+  files:
+    - passphrase=phrase.dat
+    - forces.txt
+`)
+	th.writeF("/app/foo.env", `
+MOUNTAIN=everest
+OCEAN=pacific
+`)
+	th.writeF("/app/phrase.dat", `
+Life is short.
+But the years are long.
+Not while the evil days come not.
+`)
+	th.writeF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  MOUNTAIN: everest
+  OCEAN: pacific
+  forces.txt: |2
+
+    gravitational
+    electromagnetic
+    strong nuclear
+    weak nuclear
+  fruit: apple
+  passphrase: |2
+
+    Life is short.
+    But the years are long.
+    Not while the evil days come not.
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-k772g5db55
+---
+apiVersion: v1
+data:
+  v2: '[{"path": "var/druid/segment-cache"}]'
+kind: ConfigMap
+metadata:
+  name: blah-json-tkh79m5tbc
+---
+apiVersion: v1
+data:
+  MOUNTAIN: ZXZlcmVzdA==
+  OCEAN: cGFjaWZpYw==
+  forces.txt: CmdyYXZpdGF0aW9uYWwKZWxlY3Ryb21hZ25ldGljCnN0cm9uZyBudWNsZWFyCndlYWsgbnVjbGVhcgo=
+  fruit: YXBwbGU=
+  passphrase: CkxpZmUgaXMgc2hvcnQuCkJ1dCB0aGUgeWVhcnMgYXJlIGxvbmcuCk5vdCB3aGlsZSB0aGUgZXZpbCBkYXlzIGNvbWUgbm90Lgo=
+  vegetable: YnJvY2NvbGk=
+kind: Secret
+metadata:
+  name: blah-bob-gmc2824f4b
+type: Opaque
+`)
+}
+
+// TODO: These should be errors instead.
+func TestGeneratorRepeatsInKustomization(t *testing.T) {
+	th := NewKustTestHarness(t, "/app")
+	th.writeK("/app", `
+namePrefix: blah-
+configMapGenerator:
+- name: bob
+  behavior: create
+  literals:
+    - bean=pinto
+    - star=wolf-rayet
+  literals:
+    - fruit=apple
+    - vegetable=broccoli
+  files:
+    - forces.txt
+  files:
+    - nobles=nobility.txt
+`)
+	th.writeF("/app/forces.txt", `
+gravitational
+electromagnetic
+strong nuclear
+weak nuclear
+`)
+	th.writeF("/app/nobility.txt", `
+helium
+neon
+argon
+krypton
+xenon
+radon
+`)
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  fruit: apple
+  nobles: |2
+
+    helium
+    neon
+    argon
+    krypton
+    xenon
+    radon
+  vegetable: broccoli
+kind: ConfigMap
+metadata:
+  name: blah-bob-gfkcbk5ckf
+`)
+}
+
+func TestGeneratorOverlays(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay")
 	th.writeK("/app/base1", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: p1-
 configMapGenerator:
 - name: com1
@@ -33,8 +178,6 @@ configMapGenerator:
     - from=base
 `)
 	th.writeK("/app/base2", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: p2-
 configMapGenerator:
 - name: com2
@@ -43,8 +186,6 @@ configMapGenerator:
     - from=base
 `)
 	th.writeK("/app/overlay/o1", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - ../../base1
 configMapGenerator:
@@ -54,8 +195,6 @@ configMapGenerator:
     - from=overlay
 `)
 	th.writeK("/app/overlay/o2", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - ../../base2
 configMapGenerator:
@@ -65,8 +204,6 @@ configMapGenerator:
     - from=overlay
 `)
 	th.writeK("/app/overlay", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 bases:
 - o1
 - o2

pkg/target/crd_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/customconfig_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/generatormergeandreplace_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/generatoroptions_test.go

@@ -11,7 +11,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/kusttarget.go

@@ -26,7 +26,6 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/pkg/constants"
-	"sigs.k8s.io/kustomize/pkg/fs"
 	"sigs.k8s.io/kustomize/pkg/ifc"
 	"sigs.k8s.io/kustomize/pkg/ifc/transformer"
 	interror "sigs.k8s.io/kustomize/pkg/internal/error"
@@ -42,7 +41,6 @@ import (
 type KustTarget struct {
 	kustomization *types.Kustomization
 	ldr           ifc.Loader
-	fSys          fs.FileSystem
 	rFactory      *resmap.Factory
 	tFactory      transformer.Factory
 }
@@ -50,7 +48,6 @@ type KustTarget struct {
 // NewKustTarget returns a new instance of KustTarget primed with a Loader.
 func NewKustTarget(
 	ldr ifc.Loader,
-	fSys fs.FileSystem,
 	rFactory *resmap.Factory,
 	tFactory transformer.Factory) (*KustTarget, error) {
 	content, err := loadKustFile(ldr)
@@ -70,12 +67,23 @@ func NewKustTarget(
 	return &KustTarget{
 		kustomization: &k,
 		ldr:           ldr,
-		fSys:          fSys,
 		rFactory:      rFactory,
 		tFactory:      tFactory,
 	}, nil
 }
 
+func quoted(l []string) []string {
+	r := make([]string, len(l))
+	for i, v := range l {
+		r[i] = "'" + v + "'"
+	}
+	return r
+}
+
+func commaOr(q []string) string {
+	return strings.Join(q[:len(q)-1], ", ") + " or " + q[len(q)-1]
+}
+
 func loadKustFile(ldr ifc.Loader) ([]byte, error) {
 	var content []byte
 	match := 0
@@ -88,8 +96,9 @@ func loadKustFile(ldr ifc.Loader) ([]byte, error) {
 	}
 	switch match {
 	case 0:
-		return nil, fmt.Errorf("No kustomization file found in %s. Kustomize supports the following kustomization files: %s",
-			ldr.Root(), strings.Join(constants.KustomizationFileNames, ", "))
+		return nil, fmt.Errorf(
+			"unable to find one of %v in directory '%s'",
+			commaOr(quoted(constants.KustomizationFileNames)), ldr.Root())
 	case 1:
 		return content, nil
 	default:
@@ -110,7 +119,7 @@ func unmarshal(y []byte, o interface{}) error {
 // MakeCustomizedResMap creates a ResMap per kustomization instructions.
 // The Resources in the returned ResMap are fully customized.
 func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
-	ra, err := kt.accumulateTarget()
+	ra, err := kt.AccumulateTarget()
 	if err != nil {
 		return nil, err
 	}
@@ -134,11 +143,11 @@ func (kt *KustTarget) shouldAddHashSuffixesToGeneratedResources() bool {
 		!kt.kustomization.GeneratorOptions.DisableNameSuffixHash
 }
 
-// accumulateTarget returns a new ResAccumulator,
+// AccumulateTarget returns a new ResAccumulator,
 // holding customized resources and the data/rules used
 // to do so.  The name back references and vars are
 // not yet fixed.
-func (kt *KustTarget) accumulateTarget() (
+func (kt *KustTarget) AccumulateTarget() (
 	ra *ResAccumulator, err error) {
 	// TODO(monopole): Get rid of the KustomizationErrors accumulator.
 	// It's not consistently used, and complicates tests.
@@ -236,15 +245,15 @@ func (kt *KustTarget) accumulateBases() (
 			continue
 		}
 		subKt, err := NewKustTarget(
-			ldr, kt.fSys, kt.rFactory, kt.tFactory)
+			ldr, kt.rFactory, kt.tFactory)
 		if err != nil {
 			errs.Append(errors.Wrap(err, "couldn't make target for "+path))
 			ldr.Cleanup()
 			continue
 		}
-		subRa, err := subKt.accumulateTarget()
+		subRa, err := subKt.AccumulateTarget()
 		if err != nil {
-			errs.Append(errors.Wrap(err, "accumulateTarget"))
+			errs.Append(errors.Wrap(err, "AccumulateTarget"))
 			ldr.Cleanup()
 			continue
 		}

pkg/target/kusttarget_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"encoding/base64"
@@ -25,14 +25,16 @@ import (
 
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
 const (
-	kustomizationContent1 = `
+	kustomizationContent = `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namePrefix: foo-
@@ -45,6 +47,8 @@ commonAnnotations:
 resources:
   - deployment.yaml
   - namespace.yaml
+generatorOptions:
+  disableNameSuffixHash: false
 configMapGenerator:
 - name: literalConfigMap
   literals:
@@ -81,9 +85,9 @@ metadata:
 ]`
 )
 
-func TestResources1(t *testing.T) {
+func TestResources(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever/", kustomizationContent1)
+	th.writeK("/whatever/", kustomizationContent)
 	th.writeF("/whatever/deployment.yaml", deploymentContent)
 	th.writeF("/whatever/namespace.yaml", namespaceContent)
 	th.writeF("/whatever/jsonpatch.json", jsonpatchContent)
@@ -144,7 +148,9 @@ func TestResources1(t *testing.T) {
 					"DB_USERNAME": "admin",
 					"DB_PASSWORD": "somepw",
 				},
-			}, &types.GeneratorArgs{}, nil),
+			},
+			&types.GeneratorArgs{},
+			&types.GeneratorOptions{}),
 		resid.NewResIdWithPrefixSuffixNamespace(
 			gvk.Gvk{Version: "v1", Kind: "Secret"},
 			"secret", "foo-", "-bar", "ns1"): th.fromMapAndOption(
@@ -166,7 +172,9 @@ func TestResources1(t *testing.T) {
 					"DB_USERNAME": base64.StdEncoding.EncodeToString([]byte("admin")),
 					"DB_PASSWORD": base64.StdEncoding.EncodeToString([]byte("somepw")),
 				},
-			}, &types.GeneratorArgs{}, nil),
+			},
+			&types.GeneratorArgs{},
+			&types.GeneratorOptions{}),
 		resid.NewResIdWithPrefixSuffixNamespace(
 			gvk.Gvk{Version: "v1", Kind: "Namespace"},
 			"ns1", "foo-", "-bar", ""): th.fromMap(
@@ -195,9 +203,20 @@ func TestResources1(t *testing.T) {
 	}
 }
 
+func TestKustomizationNotFound(t *testing.T) {
+	_, err := NewKustTarget(loadertest.NewFakeLoader("/foo"), nil, nil)
+	if err == nil {
+		t.Fatalf("expected an error")
+	}
+	if err.Error() !=
+		`unable to find one of 'kustomization.yaml', 'kustomization.yml' or 'Kustomization' in directory '/foo'` {
+		t.Fatalf("unexpected error: %q", err)
+	}
+}
+
 func TestResourceNotFound(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever", kustomizationContent1)
+	th.writeK("/whatever", kustomizationContent)
 	_, err := th.makeKustTarget().MakeCustomizedResMap()
 	if err == nil {
 		t.Fatalf("Didn't get the expected error for an unknown resource")
@@ -218,13 +237,12 @@ func findSecret(m resmap.ResMap) *resource.Resource {
 
 func TestDisableNameSuffixHash(t *testing.T) {
 	th := NewKustTestHarness(t, "/whatever")
-	th.writeK("/whatever/", kustomizationContent1)
+	th.writeK("/whatever/", kustomizationContent)
 	th.writeF("/whatever/deployment.yaml", deploymentContent)
 	th.writeF("/whatever/namespace.yaml", namespaceContent)
 	th.writeF("/whatever/jsonpatch.json", jsonpatchContent)
 
-	kt := th.makeKustTarget()
-	m, err := kt.MakeCustomizedResMap()
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
 	if err != nil {
 		t.Fatalf("unexpected Resources error %v", err)
 	}
@@ -236,9 +254,11 @@ func TestDisableNameSuffixHash(t *testing.T) {
 		t.Errorf("unexpected secret resource name: %s", secret.GetName())
 	}
 
-	kt.kustomization.GeneratorOptions = &types.GeneratorOptions{
-		DisableNameSuffixHash: true}
-	m, err = kt.MakeCustomizedResMap()
+	th.writeK("/whatever/",
+		strings.Replace(kustomizationContent,
+			"disableNameSuffixHash: false",
+			"disableNameSuffixHash: true", -1))
+	m, err = th.makeKustTarget().MakeCustomizedResMap()
 	if err != nil {
 		t.Fatalf("unexpected Resources error %v", err)
 	}
@@ -324,11 +344,11 @@ vars:
       name: heron
       apiVersion: v300
 `)
-	ra, err := th.makeKustTarget().accumulateTarget()
+	ra, err := th.makeKustTarget().AccumulateTarget()
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
-	vars := ra.varSet.Set()
+	vars := ra.Vars()
 	if len(vars) != 2 {
 		t.Fatalf("unexpected size %d", len(vars))
 	}
@@ -374,11 +394,11 @@ vars:
 bases:
 - ../o1
 `)
-	ra, err := th.makeKustTarget().accumulateTarget()
+	ra, err := th.makeKustTarget().AccumulateTarget()
 	if err != nil {
 		t.Fatalf("Err: %v", err)
 	}
-	vars := ra.varSet.Set()
+	vars := ra.Vars()
 	if len(vars) != 4 {
 		for i, v := range vars {
 			fmt.Printf("%v: %v\n", i, v)
@@ -427,7 +447,7 @@ vars:
 bases:
 - ../o1
 `)
-	_, err := th.makeKustTarget().accumulateTarget()
+	_, err := th.makeKustTarget().AccumulateTarget()
 	if err == nil {
 		t.Fatalf("expected var collision")
 	}

pkg/target/kusttestharness_test.go

@@ -14,24 +14,24 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 // A collection of utilities used in target tests.
 
 import (
 	"fmt"
 	"path/filepath"
-	"sigs.k8s.io/kustomize/pkg/transformers/config/defaultconfig"
 	"strings"
 	"testing"
 
 	"sigs.k8s.io/kustomize/k8sdeps/kunstruct"
 	"sigs.k8s.io/kustomize/k8sdeps/transformer"
 	"sigs.k8s.io/kustomize/pkg/constants"
-	"sigs.k8s.io/kustomize/pkg/fs"
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
+	"sigs.k8s.io/kustomize/pkg/transformers/config/defaultconfig"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
@@ -50,17 +50,8 @@ func NewKustTestHarness(t *testing.T, path string) *KustTestHarness {
 }
 
 func (th *KustTestHarness) makeKustTarget() *KustTarget {
-	// Warning: the following filesystem - a fake - must be rooted at /.
-	// This fs root is used as the working directory for the shell spawned by
-	// the secretgenerator, and has nothing to do with the filesystem used
-	// to load relative paths from the fake filesystem.
-	// This trick only works for secret generator commands that don't actually
-	// try to read the file system, because these tests don't write to the
-	// real "/" directory.  See use of exec package in the secretfactory.
-	fakeFs := fs.MakeFakeFS()
-	fakeFs.Mkdir("/")
 	kt, err := NewKustTarget(
-		th.ldr, fakeFs, th.rf, transformer.NewFactoryImpl())
+		th.ldr, th.rf, transformer.NewFactoryImpl())
 	if err != nil {
 		th.t.Fatalf("Unexpected construction error %v", err)
 	}

pkg/target/multiplepatch_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"strings"

pkg/target/namespacedgenerators_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/nullvalues_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"

pkg/target/resaccumulator.go

@@ -19,6 +19,8 @@ package target
 import (
 	"fmt"
 	"log"
+	"strings"
+
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/transformers"
@@ -55,6 +57,11 @@ func (ra *ResAccumulator) ResMap() resmap.ResMap {
 	return result
 }
 
+// Vars returns a copy of underlying vars.
+func (ra *ResAccumulator) Vars() []types.Var {
+	return ra.varSet.Set()
+}
+
 func (ra *ResAccumulator) MergeResourcesWithErrorOnIdCollision(
 	resources resmap.ResMap) (err error) {
 	ra.resMap, err = resmap.MergeWithErrorOnIdCollision(
@@ -96,17 +103,27 @@ func (ra *ResAccumulator) MergeAccumulator(other *ResAccumulator) (err error) {
 // for substitution wherever the $(var.Name) occurs.
 func (ra *ResAccumulator) makeVarReplacementMap() (map[string]string, error) {
 	result := map[string]string{}
-	for _, v := range ra.varSet.Set() {
-		id := resid.NewResId(v.ObjRef.GVK(), v.ObjRef.Name)
-		if r, found := ra.resMap.DemandOneMatchForId(id); found {
-			s, err := r.GetFieldValue(v.FieldRef.FieldPath)
+	for _, v := range ra.Vars() {
+		matched := ra.resMap.GetMatchingIds(
+			resid.NewResId(v.ObjRef.GVK(), v.ObjRef.Name).GvknEquals)
+		if len(matched) > 1 {
+			return nil, fmt.Errorf(
+				"found %d resId matches for var %s "+
+					"(unable to disambiguate)",
+				len(matched), v)
+		}
+		if len(matched) == 1 {
+			s, err := ra.resMap[matched[0]].GetFieldValue(v.FieldRef.FieldPath)
 			if err != nil {
-				return nil, fmt.Errorf("field path err for var: %+v", v)
+				return nil, fmt.Errorf(
+					"field specified in var '%v' "+
+						"not found in corresponding resource", v)
 			}
 			result[v.Name] = s
 		} else {
-			// Should this be an error?
-			log.Printf("var %v defined but not used", v)
+			return nil, fmt.Errorf(
+				"var '%v' cannot be mapped to a field "+
+					"in the set of known resources", v)
 		}
 	}
 	return result, nil
@@ -121,8 +138,18 @@ func (ra *ResAccumulator) ResolveVars() error {
 	if err != nil {
 		return err
 	}
-	return ra.Transform(transformers.NewRefVarTransformer(
-		replacementMap, ra.tConfig.VarReference))
+	if len(replacementMap) == 0 {
+		return nil
+	}
+	t := transformers.NewRefVarTransformer(
+		replacementMap, ra.tConfig.VarReference)
+	err = ra.Transform(t)
+	if len(t.UnusedVars()) > 0 {
+		log.Printf(
+			"well-defined vars that were never replaced: %s\n",
+			strings.Join(t.UnusedVars(), ","))
+	}
+	return err
 }
 
 func (ra *ResAccumulator) FixBackReferences() (err error) {

pkg/target/resaccumulator_test.go

@@ -14,9 +14,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
+	"bytes"
+	"log"
+	"os"
 	"strings"
 	"testing"
 
@@ -25,15 +28,16 @@ import (
 	"sigs.k8s.io/kustomize/pkg/resid"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
+	. "sigs.k8s.io/kustomize/pkg/target"
 	"sigs.k8s.io/kustomize/pkg/transformers/config"
 	"sigs.k8s.io/kustomize/pkg/types"
 )
 
-func TestResolveVars(t *testing.T) {
+func makeResAccumulator() (*ResAccumulator, *resource.Factory, error) {
 	ra := MakeEmptyAccumulator()
 	err := ra.MergeConfig(config.MakeDefaultConfig())
 	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
+		return nil, nil, err
 	}
 	rf := resource.NewFactory(
 		kunstruct.NewKunstructuredFactoryImpl())
@@ -54,8 +58,8 @@ func TestResolveVars(t *testing.T) {
 								map[string]interface{}{
 									"command": []interface{}{
 										"myserver",
-										"--somebackendService $(FOO)",
-										"--yetAnother $(BAR)",
+										"--somebackendService $(SERVICE_ONE)",
+										"--yetAnother $(SERVICE_TWO)",
 									},
 								},
 							},
@@ -84,14 +88,23 @@ func TestResolveVars(t *testing.T) {
 				},
 			}),
 	})
+	return ra, rf, nil
+}
+
+func TestResolveVarsHappy(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
 	err = ra.MergeVars([]types.Var{
 		{
-			Name: "FOO",
+			Name: "SERVICE_ONE",
 			ObjRef: types.Target{
 				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
 				Name: "backendOne"},
-		}, {
-			Name: "BAR",
+		},
+		{
+			Name: "SERVICE_TWO",
 			ObjRef: types.Target{
 				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
 				Name: "backendTwo"},
@@ -110,6 +123,145 @@ func TestResolveVars(t *testing.T) {
 	}
 }
 
+func TestResolveVarsOneUnused(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_UNUSED",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	expectLog(t, buf, "well-defined vars that were never replaced: SERVICE_UNUSED")
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother $(SERVICE_TWO)" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func expectLog(t *testing.T, log bytes.Buffer, expect string) {
+	if !strings.Contains(log.String(), expect) {
+		t.Fatalf("expected log containing '%s', got '%s'", expect, log.String())
+	}
+}
+
+func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
+	ra, rf, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	ra.MergeResourcesWithErrorOnIdCollision(resmap.ResMap{
+		resid.NewResIdWithPrefixNamespace(
+			gvk.Gvk{Version: "v1", Kind: "Service"},
+			"backendOne", "", "fooNamespace"): rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendOne",
+				},
+			}),
+	})
+
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(), "unable to disambiguate") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsGoodResIdBadField(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+			FieldRef: types.FieldSelector{FieldPath: "nope_nope_nope"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"not found in corresponding resource") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsUnmappableVar(t *testing.T) {
+	ra, _, err := makeResAccumulator()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_THREE",
+			ObjRef: types.Target{
+				Gvk:  gvk.Gvk{Version: "v1", Kind: "Service"},
+				Name: "doesNotExist"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"cannot be mapped to a field in the set of known resources") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
 func find(name string, resMap resmap.ResMap) *resource.Resource {
 	for k, v := range resMap {
 		if k.Name() == name {

pkg/target/resourceconflict_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"strings"

pkg/target/variableref_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package target
+package target_test
 
 import (
 	"testing"
@@ -23,8 +23,6 @@ import (
 func TestVariableRef(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay/staging")
 	th.writeK("/app/base", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: base-
 resources:
  - cockroachdb-statefulset-secure.yaml
@@ -323,8 +321,6 @@ spec:
           storage: 1Gi
 `)
 	th.writeK("/app/overlay/staging", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namePrefix: dev-
 bases:
 - ../../base
@@ -583,8 +579,6 @@ spec:
 func TestVariableRefIngress(t *testing.T) {
 	th := NewKustTestHarness(t, "/app/overlay")
 	th.writeK("/app/base", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 resources:
 - deployment.yaml
 - ingress.yaml
@@ -657,8 +651,6 @@ spec:
     targetPort: http
 `)
 	th.writeK("/app/overlay", `
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 nameprefix: kustomized-
 bases:
 - ../base
@@ -723,3 +715,137 @@ spec:
     - kustomized-nginx.example.com
 `)
 }
+
+func TestVariableRefMounthPath(t *testing.T) {
+	th := NewKustTestHarness(t, "/app/base")
+	th.writeK("/app/base", `
+resources:
+- deployment.yaml
+- namespace.yaml
+
+vars:
+- name: NAMESPACE
+  objref:
+    apiVersion: v1
+    kind: Namespace
+    name: my-namespace
+
+`)
+	th.writeF("/app/base/deployment.yaml", `
+  apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-deployment 
+  spec:
+    template:
+      spec:
+        containers:
+        - name: app
+          image: busybox
+          volumeMounts:
+          - name: my-volume
+            mountPath: "/$(NAMESPACE)"
+          env:
+          - name: NAMESPACE
+            value: $(NAMESPACE)
+        volumes:
+        - name: my-volume
+          emptyDir: {}
+`)
+	th.writeF("/app/base/namespace.yaml", `
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: my-namespace
+`)
+
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: my-namespace
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - env:
+        - name: NAMESPACE
+          value: my-namespace
+        image: busybox
+        name: app
+        volumeMounts:
+        - mountPath: /my-namespace
+          name: my-volume
+      volumes:
+      - emptyDir: {}
+        name: my-volume
+`)
+}
+
+func TestVariableRefMaps(t *testing.T) {
+	th := NewKustTestHarness(t, "/app/base")
+	th.writeK("/app/base", `
+resources:
+- deployment.yaml
+- namespace.yaml
+vars:
+- name: NAMESPACE
+  objref:
+    apiVersion: v1
+    kind: Namespace
+    name: my-namespace
+`)
+	th.writeF("/app/base/deployment.yaml", `
+  apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-deployment
+    labels:
+      my-label: $(NAMESPACE)
+  spec:
+    template:
+      spec:
+        containers:
+        - name: app
+          image: busybox  
+`)
+	th.writeF("/app/base/namespace.yaml", `
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: my-namespace
+`)
+
+	m, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err != nil {
+		t.Fatalf("Err: %v", err)
+	}
+	th.assertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: my-namespace
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    my-label: my-namespace
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - image: busybox
+        name: app
+`)
+}

pkg/transformers/config/defaultconfig/varreference.go

@@ -100,10 +100,63 @@ varReference:
 - path: spec/containers/env/value
   kind: Pod
 
+- path: spec/initContainers/command
+  kind: Pod
+
+- path: spec/initContainers/args
+  kind: Pod
+
+- path: spec/initContainers/env/value
+  kind: Pod
+
 - path: spec/rules/host
   kind: Ingress
 
 - path: spec/tls/hosts
   kind: Ingress
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: StatefulSet
+
+- path: spec/containers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/initContainers/volumeMounts/mountPath
+  kind: Pod
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Job
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: CronJob
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: metadata/labels
 `
 )

pkg/transformers/config/factorycrd.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/ghodss/yaml"
 	"github.com/go-openapi/spec"
+	"github.com/pkg/errors"
 	"k8s.io/kube-openapi/pkg/common"
 	"sigs.k8s.io/kustomize/pkg/gvk"
 	"sigs.k8s.io/kustomize/pkg/ifc"
@@ -41,7 +42,7 @@ func LoadConfigFromCRDs(
 		}
 		m, err := makeNameToApiMap(content)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrapf(err, "unable to parse open API definition from '%s'", path)
 		}
 		otherTc, err := makeConfigFromApiMap(m)
 		if err != nil {

pkg/transformers/image.go

@@ -17,6 +17,7 @@ limitations under the License.
 package transformers
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
@@ -75,7 +76,10 @@ func (pt *imageTransformer) findAndReplaceImage(obj map[string]interface{}) erro
 }
 
 func (pt *imageTransformer) updateContainers(obj map[string]interface{}, path string) error {
-	containers := obj[path].([]interface{})
+	containers, ok := obj[path].([]interface{})
+	if !ok {
+		return fmt.Errorf("containers path is not of type []interface{} but %T", obj[path])
+	}
 	for i := range containers {
 		container := containers[i].(map[string]interface{})
 		containerImage, found := container["image"]
@@ -85,20 +89,21 @@ func (pt *imageTransformer) updateContainers(obj map[string]interface{}, path st
 
 		imageName := containerImage.(string)
 		for _, img := range pt.images {
-			if isImageMatched(imageName, img.Name) {
-				name, tag := split(imageName)
-				if img.NewName != "" {
-					name = img.NewName
-				}
-				if img.NewTag != "" {
-					tag = ":" + img.NewTag
-				}
-				if img.Digest != "" {
-					tag = "@" + img.Digest
-				}
-				container["image"] = name + tag
-				break
+			if !isImageMatched(imageName, img.Name) {
+				continue
 			}
+			name, tag := split(imageName)
+			if img.NewName != "" {
+				name = img.NewName
+			}
+			if img.NewTag != "" {
+				tag = ":" + img.NewTag
+			}
+			if img.Digest != "" {
+				tag = "@" + img.Digest
+			}
+			container["image"] = name + tag
+			break
 		}
 	}
 	return nil
@@ -138,7 +143,18 @@ func isImageMatched(s, t string) bool {
 // from the image string using either colon `:` or at `@` separators.
 // Note that the returned tag keeps its separator.
 func split(imageName string) (name string, tag string) {
-	ic := strings.LastIndex(imageName, ":")
+	// check if image name contains a domain
+	// if domain is present, ignore domain and check for `:`
+	ic := -1
+	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
+		ic = strings.LastIndex(imageName, ":")
+	} else {
+		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
+		// set ic only if `:` is present
+		if lastIc > 0 {
+			ic = slashIndex + lastIc
+		}
+	}
 	ia := strings.LastIndex(imageName, "@")
 	if ic < 0 && ia < 0 {
 		return imageName, ""

pkg/transformers/image_test.go

@@ -118,6 +118,10 @@ func TestImageTransformer(t *testing.T) {
 									"name":  "myimage",
 									"image": "myprivaterepohostname:1234/my/image:latest",
 								},
+								map[string]interface{}{
+									"name":  "myimage2",
+									"image": "myprivaterepohostname:1234/my/image",
+								},
 								map[string]interface{}{
 									"name":  "my-app",
 									"image": "my-app-image:v1",
@@ -218,6 +222,10 @@ func TestImageTransformer(t *testing.T) {
 									"name":  "myimage",
 									"image": "myprivaterepohostname:1234/my/image:v1.0.1",
 								},
+								map[string]interface{}{
+									"name":  "myimage2",
+									"image": "myprivaterepohostname:1234/my/image:v1.0.1",
+								},
 								map[string]interface{}{
 									"name":  "my-app",
 									"image": "gcr.io/my-project/my-app-image:v1",

pkg/transformers/namereference.go

@@ -89,7 +89,7 @@ func (o *nameReferenceTransformer) updateNameReference(
 			s, _ := in.(string)
 			for id, res := range m {
 				if id.Gvk().IsSelected(&backRef) && id.Name() == s {
-					matchedIds := m.FindByGVKN(id)
+					matchedIds := m.GetMatchingIds(id.GvknEquals)
 					// If there's more than one match, there's no way
 					// to know which one to pick, so emit error.
 					if len(matchedIds) > 1 {
@@ -115,7 +115,7 @@ func (o *nameReferenceTransformer) updateNameReference(
 			for id, res := range m {
 				indexes := indexOf(id.Name(), names)
 				if id.Gvk().IsSelected(&backRef) && len(indexes) > 0 {
-					matchedIds := m.FindByGVKN(id)
+					matchedIds := m.GetMatchingIds(id.GvknEquals)
 					if len(matchedIds) > 1 {
 						return nil, fmt.Errorf(
 							"Multiple matches for name %s:\n %v", id, matchedIds)

pkg/transformers/refvars.go

@@ -2,28 +2,26 @@ package transformers
 
 import (
 	"fmt"
-
 	"sigs.k8s.io/kustomize/pkg/expansion"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/transformers/config"
 )
 
-type refvarTransformer struct {
-	fieldSpecs  []config.FieldSpec
-	mappingFunc func(string) string
+type RefVarTransformer struct {
+	varMap            map[string]string
+	replacementCounts map[string]int
+	fieldSpecs        []config.FieldSpec
+	mappingFunc       func(string) string
 }
 
-// NewRefVarTransformer returns a Transformer that replaces $(VAR) style
-// variables with values.
+// NewRefVarTransformer returns a new RefVarTransformer
+// that replaces $(VAR) style variables with values.
 // The fieldSpecs are the places to look for occurrences of $(VAR).
 func NewRefVarTransformer(
-	varMap map[string]string, fs []config.FieldSpec) Transformer {
-	if len(varMap) == 0 {
-		return NewNoOpTransformer()
-	}
-	return &refvarTransformer{
-		fieldSpecs:  fs,
-		mappingFunc: expansion.MappingFuncFor(varMap),
+	varMap map[string]string, fs []config.FieldSpec) *RefVarTransformer {
+	return &RefVarTransformer{
+		varMap:     varMap,
+		fieldSpecs: fs,
 	}
 }
 
@@ -31,7 +29,7 @@ func NewRefVarTransformer(
 // embedded instances of $VAR style variables, e.g. a container command string.
 // The function returns the string with the variables expanded to their final
 // values.
-func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
+func (rv *RefVarTransformer) replaceVars(in interface{}) (interface{}, error) {
 	switch vt := in.(type) {
 	case []interface{}:
 		var xs []string
@@ -39,6 +37,17 @@ func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
 			xs = append(xs, expansion.Expand(a.(string), rv.mappingFunc))
 		}
 		return xs, nil
+	case map[string]interface{}:
+		inMap := in.(map[string]interface{})
+		xs := make(map[string]interface{}, len(inMap))
+		for k, v := range inMap {
+			s, ok := v.(string)
+			if !ok {
+				return nil, fmt.Errorf("%#v is expected to be %T", v, s)
+			}
+			xs[k] = expansion.Expand(s, rv.mappingFunc)
+		}
+		return xs, nil
 	case interface{}:
 		s, ok := in.(string)
 		if !ok {
@@ -52,8 +61,24 @@ func (rv *refvarTransformer) replaceVars(in interface{}) (interface{}, error) {
 	}
 }
 
+// UnusedVars returns slice of Var names that were unused
+// after a Transform run.
+func (rv *RefVarTransformer) UnusedVars() []string {
+	var unused []string
+	for k := range rv.varMap {
+		_, ok := rv.replacementCounts[k]
+		if !ok {
+			unused = append(unused, k)
+		}
+	}
+	return unused
+}
+
 // Transform replaces $(VAR) style variables with values.
-func (rv *refvarTransformer) Transform(m resmap.ResMap) error {
+func (rv *RefVarTransformer) Transform(m resmap.ResMap) error {
+	rv.replacementCounts = make(map[string]int)
+	rv.mappingFunc = expansion.MappingFuncFor(
+		rv.replacementCounts, rv.varMap)
 	for id, res := range m {
 		for _, fieldSpec := range rv.fieldSpecs {
 			if id.Gvk().IsSelected(&fieldSpec.Gvk) {

pkg/transformers/refvars_test.go

@@ -0,0 +1,93 @@
+package transformers
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/pkg/resid"
+	"sigs.k8s.io/kustomize/pkg/resmap"
+	"sigs.k8s.io/kustomize/pkg/transformers/config"
+)
+
+func TestVarRef(t *testing.T) {
+	type given struct {
+		varMap map[string]string
+		fs     []config.FieldSpec
+		res    resmap.ResMap
+	}
+	type expected struct {
+		res    resmap.ResMap
+		unused []string
+	}
+	testCases := []struct {
+		description string
+		given       given
+		expected    expected
+	}{
+		{
+			description: "var replacement in map[string]",
+			given: given{
+				varMap: map[string]string{
+					"FOO": "replacementForFoo",
+					"BAR": "replacementForBar",
+				},
+				fs: []config.FieldSpec{
+					{Gvk: cmap, Path: "data"},
+				},
+				res: resmap.ResMap{
+					resid.NewResId(cmap, "cm1"): rf.FromMap(
+						map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "ConfigMap",
+							"metadata": map[string]interface{}{
+								"name": "cm1",
+							},
+							"data": map[string]interface{}{
+								"item1": "$(FOO)",
+								"item2": "bla",
+							},
+						}),
+				},
+			},
+			expected: expected{
+				res: resmap.ResMap{
+					resid.NewResId(cmap, "cm1"): rf.FromMap(
+						map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "ConfigMap",
+							"metadata": map[string]interface{}{
+								"name": "cm1",
+							},
+							"data": map[string]interface{}{
+								"item1": "replacementForFoo",
+								"item2": "bla",
+							},
+						}),
+				},
+				unused: []string{"BAR"},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			// arrange
+			tr := NewRefVarTransformer(tc.given.varMap, tc.given.fs)
+
+			// act
+			err := tr.Transform(tc.given.res)
+
+			// assert
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+
+			a, e := tc.given.res, tc.expected.res
+			if !reflect.DeepEqual(a, e) {
+				err = e.ErrorIfNotEqual(a)
+				t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+			}
+
+		})
+	}
+}

pkg/types/genargs.go

@@ -16,6 +16,11 @@ limitations under the License.
 
 package types
 
+import (
+	"strconv"
+	"strings"
+)
+
 // GenArgs contains both generator args and options
 type GenArgs struct {
 	args *GeneratorArgs
@@ -30,6 +35,18 @@ func NewGenArgs(args *GeneratorArgs, opts *GeneratorOptions) *GenArgs {
 	}
 }
 
+func (g *GenArgs) String() string {
+	if g == nil {
+		return "{nilGenArgs}"
+	}
+	return "{" +
+		strings.Join([]string{
+			"nsfx:" + strconv.FormatBool(g.NeedsHashSuffix()),
+			"beh:" + g.Behavior().String()},
+			",") +
+		"}"
+}
+
 // NeedHashSuffix returns true if the hash suffix is needed.
 // It is needed when the two conditions are both met
 //  1) GenArgs is not nil

pkg/types/genargs_test.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+ Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+     http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/pkg/types"
+)
+
+func TestGenArgs_String(t *testing.T) {
+	tests := []struct {
+		ga       *GenArgs
+		expected string
+	}{
+		{
+			ga:       nil,
+			expected: "{nilGenArgs}",
+		},
+		{
+			ga:       &GenArgs{},
+			expected: "{nsfx:false,beh:unspecified}",
+		},
+		{
+			ga: NewGenArgs(
+				&GeneratorArgs{Behavior: "merge"},
+				&GeneratorOptions{DisableNameSuffixHash: false}),
+			expected: "{nsfx:true,beh:merge}",
+		},
+	}
+	for _, test := range tests {
+		if test.ga.String() != test.expected {
+			t.Fatalf("Expected '%s', got '%s'", test.expected, test.ga.String())
+		}
+	}
+}

pkg/types/var.go

@@ -75,9 +75,11 @@ type VarSet struct {
 	set []Var
 }
 
-// Set returns the var set.
+// Set returns a copy of the var set.
 func (vs *VarSet) Set() []Var {
-	return vs.set
+	s := make([]Var, len(vs.set))
+	copy(s, vs.set)
+	return s
 }
 
 // MergeSet absorbs other vars with error on name collision.

vendor/golang.org/x/net/http/httpguts/guts.go

@@ -0,0 +1,50 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package httpguts provides functions implementing various details
+// of the HTTP specification.
+//
+// This package is shared by the standard library (which vendors it)
+// and x/net/http2. It comes with no API stability promise.
+package httpguts
+
+import (
+	"net/textproto"
+	"strings"
+)
+
+// ValidTrailerHeader reports whether name is a valid header field name to appear
+// in trailers.
+// See RFC 7230, Section 4.1.2
+func ValidTrailerHeader(name string) bool {
+	name = textproto.CanonicalMIMEHeaderKey(name)
+	if strings.HasPrefix(name, "If-") || badTrailer[name] {
+		return false
+	}
+	return true
+}
+
+var badTrailer = map[string]bool{
+	"Authorization":       true,
+	"Cache-Control":       true,
+	"Connection":          true,
+	"Content-Encoding":    true,
+	"Content-Length":      true,
+	"Content-Range":       true,
+	"Content-Type":        true,
+	"Expect":              true,
+	"Host":                true,
+	"Keep-Alive":          true,
+	"Max-Forwards":        true,
+	"Pragma":              true,
+	"Proxy-Authenticate":  true,
+	"Proxy-Authorization": true,
+	"Proxy-Connection":    true,
+	"Range":               true,
+	"Realm":               true,
+	"Te":                  true,
+	"Trailer":             true,
+	"Transfer-Encoding":   true,
+	"Www-Authenticate":    true,
+}

vendor/golang.org/x/net/http/httpguts/httplex.go

@@ -2,12 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package httplex contains rules around lexical matters of various
-// HTTP-related specifications.
-//
-// This package is shared by the standard library (which vendors it)
-// and x/net/http2. It comes with no API stability promise.
-package httplex
+package httpguts
 
 import (
 	"net"

vendor/golang.org/x/net/http2/ciphers.go

@@ -5,7 +5,7 @@
 package http2
 
 // A list of the possible cipher suite ids. Taken from
-// http://www.iana.org/assignments/tls-parameters/tls-parameters.txt
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.txt
 
 const (
 	cipher_TLS_NULL_WITH_NULL_NULL               uint16 = 0x0000

vendor/golang.org/x/net/http2/client_conn_pool.go

@@ -52,9 +52,31 @@ const (
 	noDialOnMiss = false
 )
 
+// shouldTraceGetConn reports whether getClientConn should call any
+// ClientTrace.GetConn hook associated with the http.Request.
+//
+// This complexity is needed to avoid double calls of the GetConn hook
+// during the back-and-forth between net/http and x/net/http2 (when the
+// net/http.Transport is upgraded to also speak http2), as well as support
+// the case where x/net/http2 is being used directly.
+func (p *clientConnPool) shouldTraceGetConn(st clientConnIdleState) bool {
+	// If our Transport wasn't made via ConfigureTransport, always
+	// trace the GetConn hook if provided, because that means the
+	// http2 package is being used directly and it's the one
+	// dialing, as opposed to net/http.
+	if _, ok := p.t.ConnPool.(noDialClientConnPool); !ok {
+		return true
+	}
+	// Otherwise, only use the GetConn hook if this connection has
+	// been used previously for other requests. For fresh
+	// connections, the net/http package does the dialing.
+	return !st.freshConn
+}
+
 func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMiss bool) (*ClientConn, error) {
 	if isConnectionCloseRequest(req) && dialOnMiss {
 		// It gets its own connection.
+		traceGetConn(req, addr)
 		const singleUse = true
 		cc, err := p.t.dialClientConn(addr, singleUse)
 		if err != nil {
@@ -64,7 +86,10 @@ func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMis
 	}
 	p.mu.Lock()
 	for _, cc := range p.conns[addr] {
-		if cc.CanTakeNewRequest() {
+		if st := cc.idleState(); st.canTakeNewRequest {
+			if p.shouldTraceGetConn(st) {
+				traceGetConn(req, addr)
+			}
 			p.mu.Unlock()
 			return cc, nil
 		}
@@ -73,6 +98,7 @@ func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMis
 		p.mu.Unlock()
 		return nil, ErrNoCachedConn
 	}
+	traceGetConn(req, addr)
 	call := p.getStartDialLocked(addr)
 	p.mu.Unlock()
 	<-call.done

vendor/golang.org/x/net/http2/configure_transport.go

@@ -1,80 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.6
-
-package http2
-
-import (
-	"crypto/tls"
-	"fmt"
-	"net/http"
-)
-
-func configureTransport(t1 *http.Transport) (*Transport, error) {
-	connPool := new(clientConnPool)
-	t2 := &Transport{
-		ConnPool: noDialClientConnPool{connPool},
-		t1:       t1,
-	}
-	connPool.t = t2
-	if err := registerHTTPSProtocol(t1, noDialH2RoundTripper{t2}); err != nil {
-		return nil, err
-	}
-	if t1.TLSClientConfig == nil {
-		t1.TLSClientConfig = new(tls.Config)
-	}
-	if !strSliceContains(t1.TLSClientConfig.NextProtos, "h2") {
-		t1.TLSClientConfig.NextProtos = append([]string{"h2"}, t1.TLSClientConfig.NextProtos...)
-	}
-	if !strSliceContains(t1.TLSClientConfig.NextProtos, "http/1.1") {
-		t1.TLSClientConfig.NextProtos = append(t1.TLSClientConfig.NextProtos, "http/1.1")
-	}
-	upgradeFn := func(authority string, c *tls.Conn) http.RoundTripper {
-		addr := authorityAddr("https", authority)
-		if used, err := connPool.addConnIfNeeded(addr, t2, c); err != nil {
-			go c.Close()
-			return erringRoundTripper{err}
-		} else if !used {
-			// Turns out we don't need this c.
-			// For example, two goroutines made requests to the same host
-			// at the same time, both kicking off TCP dials. (since protocol
-			// was unknown)
-			go c.Close()
-		}
-		return t2
-	}
-	if m := t1.TLSNextProto; len(m) == 0 {
-		t1.TLSNextProto = map[string]func(string, *tls.Conn) http.RoundTripper{
-			"h2": upgradeFn,
-		}
-	} else {
-		m["h2"] = upgradeFn
-	}
-	return t2, nil
-}
-
-// registerHTTPSProtocol calls Transport.RegisterProtocol but
-// converting panics into errors.
-func registerHTTPSProtocol(t *http.Transport, rt http.RoundTripper) (err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			err = fmt.Errorf("%v", e)
-		}
-	}()
-	t.RegisterProtocol("https", rt)
-	return nil
-}
-
-// noDialH2RoundTripper is a RoundTripper which only tries to complete the request
-// if there's already has a cached connection to the host.
-type noDialH2RoundTripper struct{ t *Transport }
-
-func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	res, err := rt.t.RoundTrip(req)
-	if err == ErrNoCachedConn {
-		return nil, http.ErrSkipAltProtocol
-	}
-	return res, err
-}

vendor/golang.org/x/net/http2/flow.go

@@ -41,10 +41,10 @@ func (f *flow) take(n int32) {
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
 func (f *flow) add(n int32) bool {
-	remain := (1<<31 - 1) - f.n
-	if n > remain {
-		return false
+	sum := f.n + n
+	if (sum > n) == (f.n > 0) {
+		f.n = sum
+		return true
 	}
-	f.n += n
-	return true
+	return false
 }

vendor/golang.org/x/net/http2/frame.go

@@ -14,8 +14,8 @@ import (
 	"strings"
 	"sync"
 
+	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2/hpack"
-	"golang.org/x/net/lex/httplex"
 )
 
 const frameHeaderLen = 9
@@ -643,7 +643,7 @@ func (f *Framer) WriteData(streamID uint32, endStream bool, data []byte) error {
 	return f.WriteDataPadded(streamID, endStream, data, nil)
 }
 
-// WriteData writes a DATA frame with optional padding.
+// WriteDataPadded writes a DATA frame with optional padding.
 //
 // If pad is nil, the padding bit is not sent.
 // The length of pad must not exceed 255 bytes.
@@ -733,32 +733,67 @@ func (f *SettingsFrame) IsAck() bool {
 	return f.FrameHeader.Flags.Has(FlagSettingsAck)
 }
 
-func (f *SettingsFrame) Value(s SettingID) (v uint32, ok bool) {
+func (f *SettingsFrame) Value(id SettingID) (v uint32, ok bool) {
 	f.checkValid()
-	buf := f.p
-	for len(buf) > 0 {
-		settingID := SettingID(binary.BigEndian.Uint16(buf[:2]))
-		if settingID == s {
-			return binary.BigEndian.Uint32(buf[2:6]), true
+	for i := 0; i < f.NumSettings(); i++ {
+		if s := f.Setting(i); s.ID == id {
+			return s.Val, true
 		}
-		buf = buf[6:]
 	}
 	return 0, false
 }
 
+// Setting returns the setting from the frame at the given 0-based index.
+// The index must be >= 0 and less than f.NumSettings().
+func (f *SettingsFrame) Setting(i int) Setting {
+	buf := f.p
+	return Setting{
+		ID:  SettingID(binary.BigEndian.Uint16(buf[i*6 : i*6+2])),
+		Val: binary.BigEndian.Uint32(buf[i*6+2 : i*6+6]),
+	}
+}
+
+func (f *SettingsFrame) NumSettings() int { return len(f.p) / 6 }
+
+// HasDuplicates reports whether f contains any duplicate setting IDs.
+func (f *SettingsFrame) HasDuplicates() bool {
+	num := f.NumSettings()
+	if num == 0 {
+		return false
+	}
+	// If it's small enough (the common case), just do the n^2
+	// thing and avoid a map allocation.
+	if num < 10 {
+		for i := 0; i < num; i++ {
+			idi := f.Setting(i).ID
+			for j := i + 1; j < num; j++ {
+				idj := f.Setting(j).ID
+				if idi == idj {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	seen := map[SettingID]bool{}
+	for i := 0; i < num; i++ {
+		id := f.Setting(i).ID
+		if seen[id] {
+			return true
+		}
+		seen[id] = true
+	}
+	return false
+}
+
 // ForeachSetting runs fn for each setting.
 // It stops and returns the first error.
 func (f *SettingsFrame) ForeachSetting(fn func(Setting) error) error {
 	f.checkValid()
-	buf := f.p
-	for len(buf) > 0 {
-		if err := fn(Setting{
-			SettingID(binary.BigEndian.Uint16(buf[:2])),
-			binary.BigEndian.Uint32(buf[2:6]),
-		}); err != nil {
+	for i := 0; i < f.NumSettings(); i++ {
+		if err := fn(f.Setting(i)); err != nil {
 			return err
 		}
-		buf = buf[6:]
 	}
 	return nil
 }
@@ -1442,7 +1477,7 @@ func (fr *Framer) maxHeaderStringLen() int {
 }
 
 // readMetaFrame returns 0 or more CONTINUATION frames from fr and
-// merge them into into the provided hf and returns a MetaHeadersFrame
+// merge them into the provided hf and returns a MetaHeadersFrame
 // with the decoded hpack values.
 func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
 	if fr.AllowIllegalReads {
@@ -1462,7 +1497,7 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
 		if VerboseLogs && fr.logReads {
 			fr.debugReadLoggerf("http2: decoded hpack field %+v", hf)
 		}
-		if !httplex.ValidHeaderFieldValue(hf.Value) {
+		if !httpguts.ValidHeaderFieldValue(hf.Value) {
 			invalid = headerFieldValueError(hf.Value)
 		}
 		isPseudo := strings.HasPrefix(hf.Name, ":")

vendor/golang.org/x/net/http2/go111.go

@@ -0,0 +1,29 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.11
+
+package http2
+
+import (
+	"net/http/httptrace"
+	"net/textproto"
+)
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool {
+	return trace != nil && trace.WroteHeaderField != nil
+}
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {
+	if trace != nil && trace.WroteHeaderField != nil {
+		trace.WroteHeaderField(k, []string{v})
+	}
+}
+
+func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
+	if trace != nil {
+		return trace.Got1xxResponse
+	}
+	return nil
+}

vendor/golang.org/x/net/http2/go16.go

@@ -1,16 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.6
-
-package http2
-
-import (
-	"net/http"
-	"time"
-)
-
-func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
-	return t1.ExpectContinueTimeout
-}

vendor/golang.org/x/net/http2/go17.go

@@ -1,106 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.7
-
-package http2
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"net/http/httptrace"
-	"time"
-)
-
-type contextContext interface {
-	context.Context
-}
-
-func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx contextContext, cancel func()) {
-	ctx, cancel = context.WithCancel(context.Background())
-	ctx = context.WithValue(ctx, http.LocalAddrContextKey, c.LocalAddr())
-	if hs := opts.baseConfig(); hs != nil {
-		ctx = context.WithValue(ctx, http.ServerContextKey, hs)
-	}
-	return
-}
-
-func contextWithCancel(ctx contextContext) (_ contextContext, cancel func()) {
-	return context.WithCancel(ctx)
-}
-
-func requestWithContext(req *http.Request, ctx contextContext) *http.Request {
-	return req.WithContext(ctx)
-}
-
-type clientTrace httptrace.ClientTrace
-
-func reqContext(r *http.Request) context.Context { return r.Context() }
-
-func (t *Transport) idleConnTimeout() time.Duration {
-	if t.t1 != nil {
-		return t.t1.IdleConnTimeout
-	}
-	return 0
-}
-
-func setResponseUncompressed(res *http.Response) { res.Uncompressed = true }
-
-func traceGotConn(req *http.Request, cc *ClientConn) {
-	trace := httptrace.ContextClientTrace(req.Context())
-	if trace == nil || trace.GotConn == nil {
-		return
-	}
-	ci := httptrace.GotConnInfo{Conn: cc.tconn}
-	cc.mu.Lock()
-	ci.Reused = cc.nextStreamID > 1
-	ci.WasIdle = len(cc.streams) == 0 && ci.Reused
-	if ci.WasIdle && !cc.lastActive.IsZero() {
-		ci.IdleTime = time.Now().Sub(cc.lastActive)
-	}
-	cc.mu.Unlock()
-
-	trace.GotConn(ci)
-}
-
-func traceWroteHeaders(trace *clientTrace) {
-	if trace != nil && trace.WroteHeaders != nil {
-		trace.WroteHeaders()
-	}
-}
-
-func traceGot100Continue(trace *clientTrace) {
-	if trace != nil && trace.Got100Continue != nil {
-		trace.Got100Continue()
-	}
-}
-
-func traceWait100Continue(trace *clientTrace) {
-	if trace != nil && trace.Wait100Continue != nil {
-		trace.Wait100Continue()
-	}
-}
-
-func traceWroteRequest(trace *clientTrace, err error) {
-	if trace != nil && trace.WroteRequest != nil {
-		trace.WroteRequest(httptrace.WroteRequestInfo{Err: err})
-	}
-}
-
-func traceFirstResponseByte(trace *clientTrace) {
-	if trace != nil && trace.GotFirstResponseByte != nil {
-		trace.GotFirstResponseByte()
-	}
-}
-
-func requestTrace(req *http.Request) *clientTrace {
-	trace := httptrace.ContextClientTrace(req.Context())
-	return (*clientTrace)(trace)
-}
-
-// Ping sends a PING frame to the server and waits for the ack.
-func (cc *ClientConn) Ping(ctx context.Context) error {
-	return cc.ping(ctx)
-}

vendor/golang.org/x/net/http2/go17_not18.go

@@ -1,36 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.7,!go1.8
-
-package http2
-
-import "crypto/tls"
-
-// temporary copy of Go 1.7's private tls.Config.clone:
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	return &tls.Config{
-		Rand:                        c.Rand,
-		Time:                        c.Time,
-		Certificates:                c.Certificates,
-		NameToCertificate:           c.NameToCertificate,
-		GetCertificate:              c.GetCertificate,
-		RootCAs:                     c.RootCAs,
-		NextProtos:                  c.NextProtos,
-		ServerName:                  c.ServerName,
-		ClientAuth:                  c.ClientAuth,
-		ClientCAs:                   c.ClientCAs,
-		InsecureSkipVerify:          c.InsecureSkipVerify,
-		CipherSuites:                c.CipherSuites,
-		PreferServerCipherSuites:    c.PreferServerCipherSuites,
-		SessionTicketsDisabled:      c.SessionTicketsDisabled,
-		SessionTicketKey:            c.SessionTicketKey,
-		ClientSessionCache:          c.ClientSessionCache,
-		MinVersion:                  c.MinVersion,
-		MaxVersion:                  c.MaxVersion,
-		CurvePreferences:            c.CurvePreferences,
-		DynamicRecordSizingDisabled: c.DynamicRecordSizingDisabled,
-		Renegotiation:               c.Renegotiation,
-	}
-}

vendor/golang.org/x/net/http2/go18.go

@@ -1,56 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.8
-
-package http2
-
-import (
-	"crypto/tls"
-	"io"
-	"net/http"
-)
-
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	c2 := c.Clone()
-	c2.GetClientCertificate = c.GetClientCertificate // golang.org/issue/19264
-	return c2
-}
-
-var _ http.Pusher = (*responseWriter)(nil)
-
-// Push implements http.Pusher.
-func (w *responseWriter) Push(target string, opts *http.PushOptions) error {
-	internalOpts := pushOptions{}
-	if opts != nil {
-		internalOpts.Method = opts.Method
-		internalOpts.Header = opts.Header
-	}
-	return w.push(target, internalOpts)
-}
-
-func configureServer18(h1 *http.Server, h2 *Server) error {
-	if h2.IdleTimeout == 0 {
-		if h1.IdleTimeout != 0 {
-			h2.IdleTimeout = h1.IdleTimeout
-		} else {
-			h2.IdleTimeout = h1.ReadTimeout
-		}
-	}
-	return nil
-}
-
-func shouldLogPanic(panicValue interface{}) bool {
-	return panicValue != nil && panicValue != http.ErrAbortHandler
-}
-
-func reqGetBody(req *http.Request) func() (io.ReadCloser, error) {
-	return req.GetBody
-}
-
-func reqBodyIsNoBody(body io.ReadCloser) bool {
-	return body == http.NoBody
-}
-
-func go18httpNoBody() io.ReadCloser { return http.NoBody } // for tests only

vendor/golang.org/x/net/http2/go19.go

@@ -1,16 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build go1.9
-
-package http2
-
-import (
-	"net/http"
-)
-
-func configureServer19(s *http.Server, conf *Server) error {
-	s.RegisterOnShutdown(conf.state.startGracefulShutdown)
-	return nil
-}

vendor/golang.org/x/net/http2/headermap.go

@@ -7,15 +7,21 @@ package http2
 import (
 	"net/http"
 	"strings"
+	"sync"
 )
 
 var (
-	commonLowerHeader = map[string]string{} // Go-Canonical-Case -> lower-case
-	commonCanonHeader = map[string]string{} // lower-case -> Go-Canonical-Case
+	commonBuildOnce   sync.Once
+	commonLowerHeader map[string]string // Go-Canonical-Case -> lower-case
+	commonCanonHeader map[string]string // lower-case -> Go-Canonical-Case
 )
 
-func init() {
-	for _, v := range []string{
+func buildCommonHeaderMapsOnce() {
+	commonBuildOnce.Do(buildCommonHeaderMaps)
+}
+
+func buildCommonHeaderMaps() {
+	common := []string{
 		"accept",
 		"accept-charset",
 		"accept-encoding",
@@ -63,7 +69,10 @@ func init() {
 		"vary",
 		"via",
 		"www-authenticate",
-	} {
+	}
+	commonLowerHeader = make(map[string]string, len(common))
+	commonCanonHeader = make(map[string]string, len(common))
+	for _, v := range common {
 		chk := http.CanonicalHeaderKey(v)
 		commonLowerHeader[chk] = v
 		commonCanonHeader[v] = chk
@@ -71,6 +80,7 @@ func init() {
 }
 
 func lowerHeader(v string) string {
+	buildCommonHeaderMapsOnce()
 	if s, ok := commonLowerHeader[v]; ok {
 		return s
 	}

vendor/golang.org/x/net/http2/hpack/encode.go

@@ -206,7 +206,7 @@ func appendVarInt(dst []byte, n byte, i uint64) []byte {
 }
 
 // appendHpackString appends s, as encoded in "String Literal"
-// representation, to dst and returns the the extended buffer.
+// representation, to dst and returns the extended buffer.
 //
 // s will be encoded in Huffman codes only when it produces strictly
 // shorter byte string.

vendor/golang.org/x/net/http2/hpack/hpack.go

@@ -92,6 +92,8 @@ type Decoder struct {
 	// saveBuf is previous data passed to Write which we weren't able
 	// to fully parse before. Unlike buf, we own this data.
 	saveBuf bytes.Buffer
+
+	firstField bool // processing the first field of the header block
 }
 
 // NewDecoder returns a new decoder with the provided maximum dynamic
@@ -101,6 +103,7 @@ func NewDecoder(maxDynamicTableSize uint32, emitFunc func(f HeaderField)) *Decod
 	d := &Decoder{
 		emit:        emitFunc,
 		emitEnabled: true,
+		firstField:  true,
 	}
 	d.dynTab.table.init()
 	d.dynTab.allowedMaxSize = maxDynamicTableSize
@@ -226,11 +229,15 @@ func (d *Decoder) DecodeFull(p []byte) ([]HeaderField, error) {
 	return hf, nil
 }
 
+// Close declares that the decoding is complete and resets the Decoder
+// to be reused again for a new header block. If there is any remaining
+// data in the decoder's buffer, Close returns an error.
 func (d *Decoder) Close() error {
 	if d.saveBuf.Len() > 0 {
 		d.saveBuf.Reset()
 		return DecodingError{errors.New("truncated headers")}
 	}
+	d.firstField = true
 	return nil
 }
 
@@ -266,6 +273,7 @@ func (d *Decoder) Write(p []byte) (n int, err error) {
 			d.saveBuf.Write(d.buf)
 			return len(p), nil
 		}
+		d.firstField = false
 		if err != nil {
 			break
 		}
@@ -389,6 +397,12 @@ func (d *Decoder) callEmit(hf HeaderField) error {
 
 // (same invariants and behavior as parseHeaderFieldRepr)
 func (d *Decoder) parseDynamicTableSizeUpdate() error {
+	// RFC 7541, sec 4.2: This dynamic table size update MUST occur at the
+	// beginning of the first header block following the change to the dynamic table size.
+	if !d.firstField && d.dynTab.size > 0 {
+		return DecodingError{errors.New("dynamic table size update MUST occur at the beginning of a header block")}
+	}
+
 	buf := d.buf
 	size, buf, err := readVarInt(5, buf)
 	if err != nil {

vendor/golang.org/x/net/http2/hpack/huffman.go

@@ -47,6 +47,7 @@ var ErrInvalidHuffman = errors.New("hpack: invalid Huffman-encoded data")
 // If maxLen is greater than 0, attempts to write more to buf than
 // maxLen bytes will return ErrStringLength.
 func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
+	rootHuffmanNode := getRootHuffmanNode()
 	n := rootHuffmanNode
 	// cur is the bit buffer that has not been fed into n.
 	// cbits is the number of low order bits in cur that are valid.
@@ -106,7 +107,7 @@ func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
 
 type node struct {
 	// children is non-nil for internal nodes
-	children []*node
+	children *[256]*node
 
 	// The following are only valid if children is nil:
 	codeLen uint8 // number of bits that led to the output of sym
@@ -114,22 +115,31 @@ type node struct {
 }
 
 func newInternalNode() *node {
-	return &node{children: make([]*node, 256)}
+	return &node{children: new([256]*node)}
 }
 
-var rootHuffmanNode = newInternalNode()
+var (
+	buildRootOnce       sync.Once
+	lazyRootHuffmanNode *node
+)
 
-func init() {
+func getRootHuffmanNode() *node {
+	buildRootOnce.Do(buildRootHuffmanNode)
+	return lazyRootHuffmanNode
+}
+
+func buildRootHuffmanNode() {
 	if len(huffmanCodes) != 256 {
 		panic("unexpected size")
 	}
+	lazyRootHuffmanNode = newInternalNode()
 	for i, code := range huffmanCodes {
 		addDecoderNode(byte(i), code, huffmanCodeLen[i])
 	}
 }
 
 func addDecoderNode(sym byte, code uint32, codeLen uint8) {
-	cur := rootHuffmanNode
+	cur := lazyRootHuffmanNode
 	for codeLen > 8 {
 		codeLen -= 8
 		i := uint8(code >> codeLen)

vendor/golang.org/x/net/http2/http2.go

@@ -29,7 +29,7 @@ import (
 	"strings"
 	"sync"
 
-	"golang.org/x/net/lex/httplex"
+	"golang.org/x/net/http/httpguts"
 )
 
 var (
@@ -179,7 +179,7 @@ var (
 )
 
 // validWireHeaderFieldName reports whether v is a valid header field
-// name (key). See httplex.ValidHeaderName for the base rules.
+// name (key). See httpguts.ValidHeaderName for the base rules.
 //
 // Further, http2 says:
 //   "Just as in HTTP/1.x, header field names are strings of ASCII
@@ -191,7 +191,7 @@ func validWireHeaderFieldName(v string) bool {
 		return false
 	}
 	for _, r := range v {
-		if !httplex.IsTokenRune(r) {
+		if !httpguts.IsTokenRune(r) {
 			return false
 		}
 		if 'A' <= r && r <= 'Z' {
@@ -201,19 +201,12 @@ func validWireHeaderFieldName(v string) bool {
 	return true
 }
 
-var httpCodeStringCommon = map[int]string{} // n -> strconv.Itoa(n)
-
-func init() {
-	for i := 100; i <= 999; i++ {
-		if v := http.StatusText(i); v != "" {
-			httpCodeStringCommon[i] = strconv.Itoa(i)
-		}
-	}
-}
-
 func httpCodeString(code int) string {
-	if s, ok := httpCodeStringCommon[code]; ok {
-		return s
+	switch code {
+	case 200:
+		return "200"
+	case 404:
+		return "404"
 	}
 	return strconv.Itoa(code)
 }
@@ -312,7 +305,7 @@ func mustUint31(v int32) uint32 {
 }
 
 // bodyAllowedForStatus reports whether a given response status code
-// permits a body. See RFC 2616, section 4.4.
+// permits a body. See RFC 7230, section 3.3.
 func bodyAllowedForStatus(status int) bool {
 	switch {
 	case status >= 100 && status <= 199:

vendor/golang.org/x/net/http2/not_go111.go

@@ -0,0 +1,20 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.11
+
+package http2
+
+import (
+	"net/http/httptrace"
+	"net/textproto"
+)
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool { return false }
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {}
+
+func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
+	return nil
+}

vendor/golang.org/x/net/http2/not_go16.go

@@ -1,21 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.6
-
-package http2
-
-import (
-	"net/http"
-	"time"
-)
-
-func configureTransport(t1 *http.Transport) (*Transport, error) {
-	return nil, errTransportVersion
-}
-
-func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
-	return 0
-
-}

vendor/golang.org/x/net/http2/not_go17.go

@@ -1,87 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.7
-
-package http2
-
-import (
-	"crypto/tls"
-	"net"
-	"net/http"
-	"time"
-)
-
-type contextContext interface {
-	Done() <-chan struct{}
-	Err() error
-}
-
-type fakeContext struct{}
-
-func (fakeContext) Done() <-chan struct{} { return nil }
-func (fakeContext) Err() error            { panic("should not be called") }
-
-func reqContext(r *http.Request) fakeContext {
-	return fakeContext{}
-}
-
-func setResponseUncompressed(res *http.Response) {
-	// Nothing.
-}
-
-type clientTrace struct{}
-
-func requestTrace(*http.Request) *clientTrace { return nil }
-func traceGotConn(*http.Request, *ClientConn) {}
-func traceFirstResponseByte(*clientTrace)     {}
-func traceWroteHeaders(*clientTrace)          {}
-func traceWroteRequest(*clientTrace, error)   {}
-func traceGot100Continue(trace *clientTrace)  {}
-func traceWait100Continue(trace *clientTrace) {}
-
-func nop() {}
-
-func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx contextContext, cancel func()) {
-	return nil, nop
-}
-
-func contextWithCancel(ctx contextContext) (_ contextContext, cancel func()) {
-	return ctx, nop
-}
-
-func requestWithContext(req *http.Request, ctx contextContext) *http.Request {
-	return req
-}
-
-// temporary copy of Go 1.6's private tls.Config.clone:
-func cloneTLSConfig(c *tls.Config) *tls.Config {
-	return &tls.Config{
-		Rand:                     c.Rand,
-		Time:                     c.Time,
-		Certificates:             c.Certificates,
-		NameToCertificate:        c.NameToCertificate,
-		GetCertificate:           c.GetCertificate,
-		RootCAs:                  c.RootCAs,
-		NextProtos:               c.NextProtos,
-		ServerName:               c.ServerName,
-		ClientAuth:               c.ClientAuth,
-		ClientCAs:                c.ClientCAs,
-		InsecureSkipVerify:       c.InsecureSkipVerify,
-		CipherSuites:             c.CipherSuites,
-		PreferServerCipherSuites: c.PreferServerCipherSuites,
-		SessionTicketsDisabled:   c.SessionTicketsDisabled,
-		SessionTicketKey:         c.SessionTicketKey,
-		ClientSessionCache:       c.ClientSessionCache,
-		MinVersion:               c.MinVersion,
-		MaxVersion:               c.MaxVersion,
-		CurvePreferences:         c.CurvePreferences,
-	}
-}
-
-func (cc *ClientConn) Ping(ctx contextContext) error {
-	return cc.ping(ctx)
-}
-
-func (t *Transport) idleConnTimeout() time.Duration { return 0 }

vendor/golang.org/x/net/http2/not_go18.go

@@ -1,29 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.8
-
-package http2
-
-import (
-	"io"
-	"net/http"
-)
-
-func configureServer18(h1 *http.Server, h2 *Server) error {
-	// No IdleTimeout to sync prior to Go 1.8.
-	return nil
-}
-
-func shouldLogPanic(panicValue interface{}) bool {
-	return panicValue != nil
-}
-
-func reqGetBody(req *http.Request) func() (io.ReadCloser, error) {
-	return nil
-}
-
-func reqBodyIsNoBody(io.ReadCloser) bool { return false }
-
-func go18httpNoBody() io.ReadCloser { return nil } // for tests only

vendor/golang.org/x/net/http2/not_go19.go

@@ -1,16 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !go1.9
-
-package http2
-
-import (
-	"net/http"
-)
-
-func configureServer19(s *http.Server, conf *Server) error {
-	// not supported prior to go1.9
-	return nil
-}

vendor/golang.org/x/net/http2/server.go

@@ -28,6 +28,7 @@ package http2
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"crypto/tls"
 	"errors"
 	"fmt"
@@ -46,6 +47,7 @@ import (
 	"sync"
 	"time"
 
+	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2/hpack"
 )
 
@@ -208,24 +210,29 @@ func ConfigureServer(s *http.Server, conf *Server) error {
 		conf = new(Server)
 	}
 	conf.state = &serverInternalState{activeConns: make(map[*serverConn]struct{})}
-	if err := configureServer18(s, conf); err != nil {
-		return err
-	}
-	if err := configureServer19(s, conf); err != nil {
-		return err
+	if h1, h2 := s, conf; h2.IdleTimeout == 0 {
+		if h1.IdleTimeout != 0 {
+			h2.IdleTimeout = h1.IdleTimeout
+		} else {
+			h2.IdleTimeout = h1.ReadTimeout
+		}
 	}
+	s.RegisterOnShutdown(conf.state.startGracefulShutdown)
 
 	if s.TLSConfig == nil {
 		s.TLSConfig = new(tls.Config)
 	} else if s.TLSConfig.CipherSuites != nil {
 		// If they already provided a CipherSuite list, return
 		// an error if it has a bad order or is missing
-		// ECDHE_RSA_WITH_AES_128_GCM_SHA256.
-		const requiredCipher = tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+		// ECDHE_RSA_WITH_AES_128_GCM_SHA256 or ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.
 		haveRequired := false
 		sawBad := false
 		for i, cs := range s.TLSConfig.CipherSuites {
-			if cs == requiredCipher {
+			switch cs {
+			case tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				// Alternative MTI cipher to not discourage ECDSA-only servers.
+				// See http://golang.org/cl/30721 for further information.
+				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
 				haveRequired = true
 			}
 			if isBadCipher(cs) {
@@ -235,7 +242,7 @@ func ConfigureServer(s *http.Server, conf *Server) error {
 			}
 		}
 		if !haveRequired {
-			return fmt.Errorf("http2: TLSConfig.CipherSuites is missing HTTP/2-required TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256")
+			return fmt.Errorf("http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher.")
 		}
 	}
 
@@ -403,7 +410,7 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 			// addresses during development.
 			//
 			// TODO: optionally enforce? Or enforce at the time we receive
-			// a new request, and verify the the ServerName matches the :authority?
+			// a new request, and verify the ServerName matches the :authority?
 			// But that precludes proxy situations, perhaps.
 			//
 			// So for now, do nothing here again.
@@ -431,6 +438,15 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	sc.serve()
 }
 
+func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx context.Context, cancel func()) {
+	ctx, cancel = context.WithCancel(context.Background())
+	ctx = context.WithValue(ctx, http.LocalAddrContextKey, c.LocalAddr())
+	if hs := opts.baseConfig(); hs != nil {
+		ctx = context.WithValue(ctx, http.ServerContextKey, hs)
+	}
+	return
+}
+
 func (sc *serverConn) rejectConn(err ErrCode, debug string) {
 	sc.vlogf("http2: server rejecting conn: %v, %s", err, debug)
 	// ignoring errors. hanging up anyway.
@@ -446,7 +462,7 @@ type serverConn struct {
 	conn             net.Conn
 	bw               *bufferedWriter // writing to conn
 	handler          http.Handler
-	baseCtx          contextContext
+	baseCtx          context.Context
 	framer           *Framer
 	doneServing      chan struct{}          // closed when serverConn.serve ends
 	readFrameCh      chan readFrameResult   // written by serverConn.readFrames
@@ -526,7 +542,7 @@ type stream struct {
 	id        uint32
 	body      *pipe       // non-nil if expecting DATA frames
 	cw        closeWaiter // closed wait stream transitions to closed state
-	ctx       contextContext
+	ctx       context.Context
 	cancelCtx func()
 
 	// owned by serverConn's serve loop:
@@ -649,7 +665,7 @@ func (sc *serverConn) condlogf(err error, format string, args ...interface{}) {
 	if err == nil {
 		return
 	}
-	if err == io.EOF || err == io.ErrUnexpectedEOF || isClosedConnError(err) {
+	if err == io.EOF || err == io.ErrUnexpectedEOF || isClosedConnError(err) || err == errPrefaceTimeout {
 		// Boring, expected errors.
 		sc.vlogf(format, args...)
 	} else {
@@ -659,6 +675,7 @@ func (sc *serverConn) condlogf(err error, format string, args ...interface{}) {
 
 func (sc *serverConn) canonicalHeader(v string) string {
 	sc.serveG.check()
+	buildCommonHeaderMapsOnce()
 	cv, ok := commonCanonHeader[v]
 	if ok {
 		return cv
@@ -853,8 +870,13 @@ func (sc *serverConn) serve() {
 			}
 		}
 
-		if sc.inGoAway && sc.curOpenStreams() == 0 && !sc.needToSendGoAway && !sc.writingFrame {
-			return
+		// Start the shutdown timer after sending a GOAWAY. When sending GOAWAY
+		// with no error code (graceful shutdown), don't start the timer until
+		// all open streams have been completed.
+		sentGoAway := sc.inGoAway && !sc.needToSendGoAway && !sc.writingFrame
+		gracefulShutdownComplete := sc.goAwayCode == ErrCodeNo && sc.curOpenStreams() == 0
+		if sentGoAway && sc.shutdownTimer == nil && (sc.goAwayCode != ErrCodeNo || gracefulShutdownComplete) {
+			sc.shutDownIn(goAwayTimeout)
 		}
 	}
 }
@@ -889,8 +911,11 @@ func (sc *serverConn) sendServeMsg(msg interface{}) {
 	}
 }
 
-// readPreface reads the ClientPreface greeting from the peer
-// or returns an error on timeout or an invalid greeting.
+var errPrefaceTimeout = errors.New("timeout waiting for client preface")
+
+// readPreface reads the ClientPreface greeting from the peer or
+// returns errPrefaceTimeout on timeout, or an error if the greeting
+// is invalid.
 func (sc *serverConn) readPreface() error {
 	errc := make(chan error, 1)
 	go func() {
@@ -908,7 +933,7 @@ func (sc *serverConn) readPreface() error {
 	defer timer.Stop()
 	select {
 	case <-timer.C:
-		return errors.New("timeout waiting for client preface")
+		return errPrefaceTimeout
 	case err := <-errc:
 		if err == nil {
 			if VerboseLogs {
@@ -1097,7 +1122,7 @@ func (sc *serverConn) startFrameWrite(wr FrameWriteRequest) {
 
 // errHandlerPanicked is the error given to any callers blocked in a read from
 // Request.Body when the main goroutine panics. Since most handlers read in the
-// the main ServeHTTP goroutine, this will show up rarely.
+// main ServeHTTP goroutine, this will show up rarely.
 var errHandlerPanicked = errors.New("http2: handler panicked")
 
 // wroteFrame is called on the serve goroutine with the result of
@@ -1218,30 +1243,31 @@ func (sc *serverConn) startGracefulShutdown() {
 	sc.shutdownOnce.Do(func() { sc.sendServeMsg(gracefulShutdownMsg) })
 }
 
+// After sending GOAWAY, the connection will close after goAwayTimeout.
+// If we close the connection immediately after sending GOAWAY, there may
+// be unsent data in our kernel receive buffer, which will cause the kernel
+// to send a TCP RST on close() instead of a FIN. This RST will abort the
+// connection immediately, whether or not the client had received the GOAWAY.
+//
+// Ideally we should delay for at least 1 RTT + epsilon so the client has
+// a chance to read the GOAWAY and stop sending messages. Measuring RTT
+// is hard, so we approximate with 1 second. See golang.org/issue/18701.
+//
+// This is a var so it can be shorter in tests, where all requests uses the
+// loopback interface making the expected RTT very small.
+//
+// TODO: configurable?
+var goAwayTimeout = 1 * time.Second
+
 func (sc *serverConn) startGracefulShutdownInternal() {
-	sc.goAwayIn(ErrCodeNo, 0)
+	sc.goAway(ErrCodeNo)
 }
 
 func (sc *serverConn) goAway(code ErrCode) {
-	sc.serveG.check()
-	var forceCloseIn time.Duration
-	if code != ErrCodeNo {
-		forceCloseIn = 250 * time.Millisecond
-	} else {
-		// TODO: configurable
-		forceCloseIn = 1 * time.Second
-	}
-	sc.goAwayIn(code, forceCloseIn)
-}
-
-func (sc *serverConn) goAwayIn(code ErrCode, forceCloseIn time.Duration) {
 	sc.serveG.check()
 	if sc.inGoAway {
 		return
 	}
-	if forceCloseIn != 0 {
-		sc.shutDownIn(forceCloseIn)
-	}
 	sc.inGoAway = true
 	sc.needToSendGoAway = true
 	sc.goAwayCode = code
@@ -1474,6 +1500,12 @@ func (sc *serverConn) processSettings(f *SettingsFrame) error {
 		}
 		return nil
 	}
+	if f.NumSettings() > 100 || f.HasDuplicates() {
+		// This isn't actually in the spec, but hang up on
+		// suspiciously large settings frames or those with
+		// duplicate entries.
+		return ConnectionError(ErrCodeProtocol)
+	}
 	if err := f.ForeachSetting(sc.processSetting); err != nil {
 		return err
 	}
@@ -1595,7 +1627,10 @@ func (sc *serverConn) processData(f *DataFrame) error {
 	// Sender sending more than they'd declared?
 	if st.declBodyBytes != -1 && st.bodyBytes+int64(len(data)) > st.declBodyBytes {
 		st.body.CloseWithError(fmt.Errorf("sender tried to send more than declared Content-Length of %d bytes", st.declBodyBytes))
-		return streamError(id, ErrCodeStreamClosed)
+		// RFC 7540, sec 8.1.2.6: A request or response is also malformed if the
+		// value of a content-length header field does not equal the sum of the
+		// DATA frame payload lengths that form the body.
+		return streamError(id, ErrCodeProtocol)
 	}
 	if f.Length > 0 {
 		// Check whether the client has flow control quota.
@@ -1705,6 +1740,13 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 			// processing this frame.
 			return nil
 		}
+		// RFC 7540, sec 5.1: If an endpoint receives additional frames, other than
+		// WINDOW_UPDATE, PRIORITY, or RST_STREAM, for a stream that is in
+		// this state, it MUST respond with a stream error (Section 5.4.2) of
+		// type STREAM_CLOSED.
+		if st.state == stateHalfClosedRemote {
+			return streamError(id, ErrCodeStreamClosed)
+		}
 		return st.processTrailerHeaders(f)
 	}
 
@@ -1805,7 +1847,7 @@ func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error {
 	if st.trailer != nil {
 		for _, hf := range f.RegularFields() {
 			key := sc.canonicalHeader(hf.Name)
-			if !ValidTrailerHeader(key) {
+			if !httpguts.ValidTrailerHeader(key) {
 				// TODO: send more details to the peer somehow. But http2 has
 				// no way to send debug data at a stream level. Discuss with
 				// HTTP folk.
@@ -1846,7 +1888,7 @@ func (sc *serverConn) newStream(id, pusherID uint32, state streamState) *stream
 		panic("internal error: cannot create stream with id 0")
 	}
 
-	ctx, cancelCtx := contextWithCancel(sc.baseCtx)
+	ctx, cancelCtx := context.WithCancel(sc.baseCtx)
 	st := &stream{
 		sc:        sc,
 		id:        id,
@@ -2012,7 +2054,7 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 		Body:       body,
 		Trailer:    trailer,
 	}
-	req = requestWithContext(req, st.ctx)
+	req = req.WithContext(st.ctx)
 
 	rws := responseWriterStatePool.Get().(*responseWriterState)
 	bwSave := rws.bw
@@ -2040,7 +2082,7 @@ func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler
 				stream: rw.rws.stream,
 			})
 			// Same as net/http:
-			if shouldLogPanic(e) {
+			if e != nil && e != http.ErrAbortHandler {
 				const size = 64 << 10
 				buf := make([]byte, size)
 				buf = buf[:runtime.Stack(buf, false)]
@@ -2272,8 +2314,8 @@ func (rws *responseWriterState) hasTrailers() bool { return len(rws.trailers) !=
 // written in the trailers at the end of the response.
 func (rws *responseWriterState) declareTrailer(k string) {
 	k = http.CanonicalHeaderKey(k)
-	if !ValidTrailerHeader(k) {
-		// Forbidden by RFC 2616 14.40.
+	if !httpguts.ValidTrailerHeader(k) {
+		// Forbidden by RFC 7230, section 4.1.2.
 		rws.conn.logf("ignoring invalid trailer %q", k)
 		return
 	}
@@ -2310,7 +2352,7 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 			clen = strconv.Itoa(len(p))
 		}
 		_, hasContentType := rws.snapHeader["Content-Type"]
-		if !hasContentType && bodyAllowedForStatus(rws.status) {
+		if !hasContentType && bodyAllowedForStatus(rws.status) && len(p) > 0 {
 			ctype = http.DetectContentType(p)
 		}
 		var date string
@@ -2323,6 +2365,19 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 			foreachHeaderElement(v, rws.declareTrailer)
 		}
 
+		// "Connection" headers aren't allowed in HTTP/2 (RFC 7540, 8.1.2.2),
+		// but respect "Connection" == "close" to mean sending a GOAWAY and tearing
+		// down the TCP connection when idle, like we do for HTTP/1.
+		// TODO: remove more Connection-specific header fields here, in addition
+		// to "Connection".
+		if _, ok := rws.snapHeader["Connection"]; ok {
+			v := rws.snapHeader.Get("Connection")
+			delete(rws.snapHeader, "Connection")
+			if v == "close" {
+				rws.conn.startGracefulShutdown()
+			}
+		}
+
 		endStream := (rws.handlerDone && !rws.hasTrailers() && len(p) == 0) || isHeadResp
 		err = rws.conn.writeHeaders(rws.stream, &writeResHeaders{
 			streamID:      rws.stream.id,
@@ -2394,7 +2449,7 @@ const TrailerPrefix = "Trailer:"
 // after the header has already been flushed. Because the Go
 // ResponseWriter interface has no way to set Trailers (only the
 // Header), and because we didn't want to expand the ResponseWriter
-// interface, and because nobody used trailers, and because RFC 2616
+// interface, and because nobody used trailers, and because RFC 7230
 // says you SHOULD (but not must) predeclare any trailers in the
 // header, the official ResponseWriter rules said trailers in Go must
 // be predeclared, and then we reuse the same ResponseWriter.Header()
@@ -2478,6 +2533,24 @@ func (w *responseWriter) Header() http.Header {
 	return rws.handlerHeader
 }
 
+// checkWriteHeaderCode is a copy of net/http's checkWriteHeaderCode.
+func checkWriteHeaderCode(code int) {
+	// Issue 22880: require valid WriteHeader status codes.
+	// For now we only enforce that it's three digits.
+	// In the future we might block things over 599 (600 and above aren't defined
+	// at http://httpwg.org/specs/rfc7231.html#status.codes)
+	// and we might block under 200 (once we have more mature 1xx support).
+	// But for now any three digits.
+	//
+	// We used to send "HTTP/1.1 000 0" on the wire in responses but there's
+	// no equivalent bogus thing we can realistically send in HTTP/2,
+	// so we'll consistently panic instead and help people find their bugs
+	// early. (We can't return an error from WriteHeader even if we wanted to.)
+	if code < 100 || code > 999 {
+		panic(fmt.Sprintf("invalid WriteHeader code %v", code))
+	}
+}
+
 func (w *responseWriter) WriteHeader(code int) {
 	rws := w.rws
 	if rws == nil {
@@ -2488,6 +2561,7 @@ func (w *responseWriter) WriteHeader(code int) {
 
 func (rws *responseWriterState) writeHeader(code int) {
 	if !rws.wroteHeader {
+		checkWriteHeaderCode(code)
 		rws.wroteHeader = true
 		rws.status = code
 		if len(rws.handlerHeader) > 0 {
@@ -2570,14 +2644,9 @@ var (
 	ErrPushLimitReached = errors.New("http2: push would exceed peer's SETTINGS_MAX_CONCURRENT_STREAMS")
 )
 
-// pushOptions is the internal version of http.PushOptions, which we
-// cannot include here because it's only defined in Go 1.8 and later.
-type pushOptions struct {
-	Method string
-	Header http.Header
-}
+var _ http.Pusher = (*responseWriter)(nil)
 
-func (w *responseWriter) push(target string, opts pushOptions) error {
+func (w *responseWriter) Push(target string, opts *http.PushOptions) error {
 	st := w.rws.stream
 	sc := st.sc
 	sc.serveG.checkNotOn()
@@ -2588,6 +2657,10 @@ func (w *responseWriter) push(target string, opts pushOptions) error {
 		return ErrRecursivePush
 	}
 
+	if opts == nil {
+		opts = new(http.PushOptions)
+	}
+
 	// Default options.
 	if opts.Method == "" {
 		opts.Method = "GET"
@@ -2759,7 +2832,7 @@ func (sc *serverConn) startPush(msg *startPushRequest) {
 }
 
 // foreachHeaderElement splits v according to the "#rule" construction
-// in RFC 2616 section 2.1 and calls fn for each non-empty element.
+// in RFC 7230 section 7 and calls fn for each non-empty element.
 func foreachHeaderElement(v string, fn func(string)) {
 	v = textproto.TrimString(v)
 	if v == "" {
@@ -2807,41 +2880,6 @@ func new400Handler(err error) http.HandlerFunc {
 	}
 }
 
-// ValidTrailerHeader reports whether name is a valid header field name to appear
-// in trailers.
-// See: http://tools.ietf.org/html/rfc7230#section-4.1.2
-func ValidTrailerHeader(name string) bool {
-	name = http.CanonicalHeaderKey(name)
-	if strings.HasPrefix(name, "If-") || badTrailer[name] {
-		return false
-	}
-	return true
-}
-
-var badTrailer = map[string]bool{
-	"Authorization":       true,
-	"Cache-Control":       true,
-	"Connection":          true,
-	"Content-Encoding":    true,
-	"Content-Length":      true,
-	"Content-Range":       true,
-	"Content-Type":        true,
-	"Expect":              true,
-	"Host":                true,
-	"Keep-Alive":          true,
-	"Max-Forwards":        true,
-	"Pragma":              true,
-	"Proxy-Authenticate":  true,
-	"Proxy-Authorization": true,
-	"Proxy-Connection":    true,
-	"Range":               true,
-	"Realm":               true,
-	"Te":                  true,
-	"Trailer":             true,
-	"Transfer-Encoding":   true,
-	"Www-Authenticate":    true,
-}
-
 // h1ServerKeepAlivesDisabled reports whether hs has its keep-alives
 // disabled. See comments on h1ServerShutdownChan above for why
 // the code is written this way.

vendor/golang.org/x/net/http2/write.go

@@ -10,10 +10,9 @@ import (
 	"log"
 	"net/http"
 	"net/url"
-	"time"
 
+	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2/hpack"
-	"golang.org/x/net/lex/httplex"
 )
 
 // writeFramer is implemented by any type that is used to write frames.
@@ -90,11 +89,7 @@ type writeGoAway struct {
 
 func (p *writeGoAway) writeFrame(ctx writeContext) error {
 	err := ctx.Framer().WriteGoAway(p.maxStreamID, p.code, nil)
-	if p.code != 0 {
-		ctx.Flush() // ignore error: we're hanging up on them anyway
-		time.Sleep(50 * time.Millisecond)
-		ctx.CloseConn()
-	}
+	ctx.Flush() // ignore error: we're hanging up on them anyway
 	return err
 }
 
@@ -204,7 +199,7 @@ func (w *writeResHeaders) staysWithinBuffer(max int) bool {
 	// TODO: this is a common one. It'd be nice to return true
 	// here and get into the fast path if we could be clever and
 	// calculate the size fast enough, or at least a conservative
-	// uppper bound that usually fires. (Maybe if w.h and
+	// upper bound that usually fires. (Maybe if w.h and
 	// w.trailers are nil, so we don't need to enumerate it.)
 	// Otherwise I'm afraid that just calculating the length to
 	// answer this question would be slower than the ~2µs benefit.
@@ -334,7 +329,7 @@ func (wu writeWindowUpdate) writeFrame(ctx writeContext) error {
 }
 
 // encodeHeaders encodes an http.Header. If keys is not nil, then (k, h[k])
-// is encoded only only if k is in keys.
+// is encoded only if k is in keys.
 func encodeHeaders(enc *hpack.Encoder, h http.Header, keys []string) {
 	if keys == nil {
 		sorter := sorterPool.Get().(*sorter)
@@ -355,7 +350,7 @@ func encodeHeaders(enc *hpack.Encoder, h http.Header, keys []string) {
 		}
 		isTE := k == "transfer-encoding"
 		for _, v := range vv {
-			if !httplex.ValidHeaderFieldValue(v) {
+			if !httpguts.ValidHeaderFieldValue(v) {
 				// TODO: return an error? golang.org/issue/14048
 				// For now just omit it.
 				continue

vendor/golang.org/x/net/idna/idna.go

@@ -21,6 +21,7 @@ import (
 	"unicode/utf8"
 
 	"golang.org/x/text/secure/bidirule"
+	"golang.org/x/text/unicode/bidi"
 	"golang.org/x/text/unicode/norm"
 )
 
@@ -68,7 +69,7 @@ func VerifyDNSLength(verify bool) Option {
 }
 
 // RemoveLeadingDots removes leading label separators. Leading runes that map to
-// dots, such as U+3002, are removed as well.
+// dots, such as U+3002 IDEOGRAPHIC FULL STOP, are removed as well.
 //
 // This is the behavior suggested by the UTS #46 and is adopted by some
 // browsers.
@@ -92,7 +93,7 @@ func ValidateLabels(enable bool) Option {
 	}
 }
 
-// StrictDomainName limits the set of permissable ASCII characters to those
+// StrictDomainName limits the set of permissible ASCII characters to those
 // allowed in domain names as defined in RFC 1034 (A-Z, a-z, 0-9 and the
 // hyphen). This is set by default for MapForLookup and ValidateForRegistration.
 //
@@ -142,7 +143,6 @@ func MapForLookup() Option {
 		o.mapping = validateAndMap
 		StrictDomainName(true)(o)
 		ValidateLabels(true)(o)
-		RemoveLeadingDots(true)(o)
 	}
 }
 
@@ -160,14 +160,14 @@ type options struct {
 
 	// mapping implements a validation and mapping step as defined in RFC 5895
 	// or UTS 46, tailored to, for example, domain registration or lookup.
-	mapping func(p *Profile, s string) (string, error)
+	mapping func(p *Profile, s string) (mapped string, isBidi bool, err error)
 
 	// bidirule, if specified, checks whether s conforms to the Bidi Rule
 	// defined in RFC 5893.
 	bidirule func(s string) bool
 }
 
-// A Profile defines the configuration of a IDNA mapper.
+// A Profile defines the configuration of an IDNA mapper.
 type Profile struct {
 	options
 }
@@ -251,23 +251,21 @@ var (
 
 	punycode = &Profile{}
 	lookup   = &Profile{options{
-		transitional:      true,
-		useSTD3Rules:      true,
-		validateLabels:    true,
-		removeLeadingDots: true,
-		trie:              trie,
-		fromPuny:          validateFromPunycode,
-		mapping:           validateAndMap,
-		bidirule:          bidirule.ValidString,
+		transitional:   true,
+		useSTD3Rules:   true,
+		validateLabels: true,
+		trie:           trie,
+		fromPuny:       validateFromPunycode,
+		mapping:        validateAndMap,
+		bidirule:       bidirule.ValidString,
 	}}
 	display = &Profile{options{
-		useSTD3Rules:      true,
-		validateLabels:    true,
-		removeLeadingDots: true,
-		trie:              trie,
-		fromPuny:          validateFromPunycode,
-		mapping:           validateAndMap,
-		bidirule:          bidirule.ValidString,
+		useSTD3Rules:   true,
+		validateLabels: true,
+		trie:           trie,
+		fromPuny:       validateFromPunycode,
+		mapping:        validateAndMap,
+		bidirule:       bidirule.ValidString,
 	}}
 	registration = &Profile{options{
 		useSTD3Rules:    true,
@@ -302,14 +300,16 @@ func (e runeError) Error() string {
 // see http://www.unicode.org/reports/tr46.
 func (p *Profile) process(s string, toASCII bool) (string, error) {
 	var err error
+	var isBidi bool
 	if p.mapping != nil {
-		s, err = p.mapping(p, s)
+		s, isBidi, err = p.mapping(p, s)
 	}
 	// Remove leading empty labels.
 	if p.removeLeadingDots {
 		for ; len(s) > 0 && s[0] == '.'; s = s[1:] {
 		}
 	}
+	// TODO: allow for a quick check of the tables data.
 	// It seems like we should only create this error on ToASCII, but the
 	// UTS 46 conformance tests suggests we should always check this.
 	if err == nil && p.verifyDNSLength && s == "" {
@@ -335,6 +335,7 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 				// Spec says keep the old label.
 				continue
 			}
+			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
 			labels.set(u)
 			if err == nil && p.validateLabels {
 				err = p.fromPuny(p, u)
@@ -349,6 +350,14 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 			err = p.validateLabel(label)
 		}
 	}
+	if isBidi && p.bidirule != nil && err == nil {
+		for labels.reset(); !labels.done(); labels.next() {
+			if !p.bidirule(labels.label()) {
+				err = &labelError{s, "B"}
+				break
+			}
+		}
+	}
 	if toASCII {
 		for labels.reset(); !labels.done(); labels.next() {
 			label := labels.label()
@@ -380,16 +389,26 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 	return s, err
 }
 
-func normalize(p *Profile, s string) (string, error) {
-	return norm.NFC.String(s), nil
+func normalize(p *Profile, s string) (mapped string, isBidi bool, err error) {
+	// TODO: consider first doing a quick check to see if any of these checks
+	// need to be done. This will make it slower in the general case, but
+	// faster in the common case.
+	mapped = norm.NFC.String(s)
+	isBidi = bidirule.DirectionString(mapped) == bidi.RightToLeft
+	return mapped, isBidi, nil
 }
 
-func validateRegistration(p *Profile, s string) (string, error) {
+func validateRegistration(p *Profile, s string) (idem string, bidi bool, err error) {
+	// TODO: filter need for normalization in loop below.
 	if !norm.NFC.IsNormalString(s) {
-		return s, &labelError{s, "V1"}
+		return s, false, &labelError{s, "V1"}
 	}
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			return s, bidi, runeError(utf8.RuneError)
+		}
+		bidi = bidi || info(v).isBidi(s[i:])
 		// Copy bytes not copied so far.
 		switch p.simplify(info(v).category()) {
 		// TODO: handle the NV8 defined in the Unicode idna data set to allow
@@ -397,21 +416,50 @@ func validateRegistration(p *Profile, s string) (string, error) {
 		case valid, deviation:
 		case disallowed, mapped, unknown, ignored:
 			r, _ := utf8.DecodeRuneInString(s[i:])
-			return s, runeError(r)
+			return s, bidi, runeError(r)
 		}
 		i += sz
 	}
-	return s, nil
+	return s, bidi, nil
 }
 
-func validateAndMap(p *Profile, s string) (string, error) {
+func (c info) isBidi(s string) bool {
+	if !c.isMapped() {
+		return c&attributesMask == rtl
+	}
+	// TODO: also store bidi info for mapped data. This is possible, but a bit
+	// cumbersome and not for the common case.
+	p, _ := bidi.LookupString(s)
+	switch p.Class() {
+	case bidi.R, bidi.AL, bidi.AN:
+		return true
+	}
+	return false
+}
+
+func validateAndMap(p *Profile, s string) (vm string, bidi bool, err error) {
 	var (
-		err error
-		b   []byte
-		k   int
+		b []byte
+		k int
 	)
+	// combinedInfoBits contains the or-ed bits of all runes. We use this
+	// to derive the mayNeedNorm bit later. This may trigger normalization
+	// overeagerly, but it will not do so in the common case. The end result
+	// is another 10% saving on BenchmarkProfile for the common case.
+	var combinedInfoBits info
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			b = append(b, s[k:i]...)
+			b = append(b, "\ufffd"...)
+			k = len(s)
+			if err == nil {
+				err = runeError(utf8.RuneError)
+			}
+			break
+		}
+		combinedInfoBits |= info(v)
+		bidi = bidi || info(v).isBidi(s[i:])
 		start := i
 		i += sz
 		// Copy bytes not copied so far.
@@ -438,7 +486,9 @@ func validateAndMap(p *Profile, s string) (string, error) {
 	}
 	if k == 0 {
 		// No changes so far.
-		s = norm.NFC.String(s)
+		if combinedInfoBits&mayNeedNorm != 0 {
+			s = norm.NFC.String(s)
+		}
 	} else {
 		b = append(b, s[k:]...)
 		if norm.NFC.QuickSpan(b) != len(b) {
@@ -447,7 +497,7 @@ func validateAndMap(p *Profile, s string) (string, error) {
 		// TODO: the punycode converters require strings as input.
 		s = string(b)
 	}
-	return s, err
+	return s, bidi, err
 }
 
 // A labelIter allows iterating over domain name labels.
@@ -542,8 +592,13 @@ func validateFromPunycode(p *Profile, s string) error {
 	if !norm.NFC.IsNormalString(s) {
 		return &labelError{s, "V1"}
 	}
+	// TODO: detect whether string may have to be normalized in the following
+	// loop.
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			return runeError(utf8.RuneError)
+		}
 		if c := p.simplify(info(v).category()); c != valid && c != deviation {
 			return &labelError{s, "V6"}
 		}
@@ -616,16 +671,13 @@ var joinStates = [][numJoinTypes]joinState{
 
 // validateLabel validates the criteria from Section 4.1. Item 1, 4, and 6 are
 // already implicitly satisfied by the overall implementation.
-func (p *Profile) validateLabel(s string) error {
+func (p *Profile) validateLabel(s string) (err error) {
 	if s == "" {
 		if p.verifyDNSLength {
 			return &labelError{s, "A4"}
 		}
 		return nil
 	}
-	if p.bidirule != nil && !p.bidirule(s) {
-		return &labelError{s, "B"}
-	}
 	if !p.validateLabels {
 		return nil
 	}

vendor/golang.org/x/net/idna/trieval.go

@@ -26,9 +26,9 @@ package idna
 //       15..3  index into xor or mapping table
 //     }
 //   } else {
-//       15..13 unused
-//           12 modifier (including virama)
-//           11 virama modifier
+//       15..14 unused
+//       13     mayNeedNorm
+//       12..11 attributes
 //       10..8  joining type
 //        7..3  category type
 //   }
@@ -49,15 +49,20 @@ const (
 	joinShift = 8
 	joinMask  = 0x07
 
-	viramaModifier = 0x0800
+	// Attributes
+	attributesMask = 0x1800
+	viramaModifier = 0x1800
 	modifier       = 0x1000
+	rtl            = 0x0800
+
+	mayNeedNorm = 0x2000
 )
 
 // A category corresponds to a category defined in the IDNA mapping table.
 type category uint16
 
 const (
-	unknown              category = 0 // not defined currently in unicode.
+	unknown              category = 0 // not currently defined in unicode.
 	mapped               category = 1
 	disallowedSTD3Mapped category = 2
 	deviation            category = 3
@@ -110,5 +115,5 @@ func (c info) isModifier() bool {
 }
 
 func (c info) isViramaModifier() bool {
-	return c&(viramaModifier|catSmallMask) == viramaModifier
+	return c&(attributesMask|catSmallMask) == viramaModifier
 }