Merge pull request #1674 from monopole/dealWithDeprecationsInGoReleaser

Deal with goreleaser field deprecations.
2026-06-15 10:58:18 +00:00 · 2019-10-22 12:12:34 -07:00 · 2019-10-22 12:11:13 -07:00 · 2019-10-22 11:52:55 -07:00 · 2019-10-22 11:51:26 -07:00 · 2019-10-22 10:16:51 -07:00
1407 changed files with 64338 additions and 467140 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@
 *.dll
 *.so
 *.dylib
-kustomize

 # Test binary, build with `go test -c`
 *.test
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,45 +1,41 @@
 os:
-# TODO: Enable this when we can get the tests to work
-#  - windows
  - linux
-  - osx
+# TODO: Uncomment this when someone figures out how
+# to speed up the slowness of homebrew installation on
+# oxs; presumably cache images?
+#  - osx
+#
+# TODO: Uncomment when some gets the tests running on Windows.
+#  - windows

 addons:
  apt:
-    packages: tree
+    packages:
+    - tree
  homebrew:
-    packages: tree
-
-language: go
-
-go:
-  - 1.11.x
-
-go_import_path: sigs.k8s.io/kustomize
-
-# Maybe, maybe not.
-# sudo: false
+    packages:
+    - tree
+    update: true

 # Only clone the most recent commit.
 git:
  depth: 1

-env:
- GOLANGCI_RELEASE="v1.10.2"
+language: go
+
+go:
+  - "1.13"
+
+go_import_path: sigs.k8s.io/kustomize

 before_install:
-  - source ./bin/consider-early-travis-exit.sh
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $GOPATH/bin ${GOLANGCI_RELEASE}
-  - go get -u github.com/monopole/mdrip
+  - source ./travis/consider-early-travis-exit.sh

-# Install must be set to prevent default `go get` to run.
-# The dependencies have already been vendored by `dep` so
-# we don't need to fetch them.
-install:
-  -
+# Skip the install process; let pre-commit.sh do it.
+install: true

 script:
-  - ./bin/pre-commit.sh
+  - ./travis/pre-commit.sh

 # TBD. Suppressing for now.
 notifications:
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -1,389 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  digest = "1:d8ebbd207f3d3266d4423ce4860c9f3794956306ded6c7ba312ecc69cdfbf04c"
-  name = "github.com/PuerkitoBio/purell"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "0bcb03f4b4d0a9428594752bd2a3b9aa0a9d4bd4"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:8098cd40cd09879efbf12e33bcd51ead4a66006ac802cd563a66c4f3373b9727"
-  name = "github.com/PuerkitoBio/urlesc"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "de5bf2ad457846296e2031421a34e2568e304e35"
-
-[[projects]]
-  digest = "1:a2c1d0e43bd3baaa071d1b9ed72c27d78169b2b269f71c105ac4ba34b1be4a39"
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  pruneopts = "NUT"
-  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:f8e6f07329067bc182633dcb19a3df53ce5d454b551e1b5a1cac2163748648d9"
-  name = "github.com/emicklei/go-restful"
-  packages = [
-    ".",
-    "log",
-  ]
-  pruneopts = "NUT"
-  revision = "3658237ded108b4134956c1b3050349d93e7b895"
-  version = "v2.7.1"
-
-[[projects]]
-  digest = "1:ad32dc29f37281bacb5dcedff17c9461dc1739dc8a5f63a71ab491c6e92edf8d"
-  name = "github.com/evanphx/json-patch"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "afac545df32f2287a079e2dfb7ba2745a643747e"
-  version = "v3.0.0"
-
-[[projects]]
-  digest = "1:81466b4218bf6adddac2572a30ac733a9255919bc2f470b4827a317bd4ee1756"
-  name = "github.com/ghodss/yaml"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7"
-  version = "v1.0.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:260f7ebefc63024c8dfe2c9f1a2935a89fa4213637a1f522f592f80c001cc441"
-  name = "github.com/go-openapi/jsonpointer"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "3a0015ad55fa9873f41605d3e8f28cd279c32ab2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:98abd61947ff5c7c6fcfec5473d02a4821ed3a2dd99a4fbfdb7925b0dd745546"
-  name = "github.com/go-openapi/jsonreference"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "3fb327e6747da3043567ee86abd02bb6376b6be2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:e95b560c49fb849a61957a5fb3346ce23b3f67426e00e01179e5396cabc9a12c"
-  name = "github.com/go-openapi/spec"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "bcff419492eeeb01f76e77d2ebc714dc97b607f5"
-
-[[projects]]
-  branch = "master"
-  digest = "1:a610c604eb06f0be4b0fc667388b7a221155d77d7f9089f70ac142a4a9daf014"
-  name = "github.com/go-openapi/swag"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "811b1089cde9dad18d4d0c2d09fbdbf28dbd27a5"
-
-[[projects]]
-  digest = "1:1b3dd24f14a5280710fc7a3aa2480b6e4d20fdfc905841de9a3aa2aa2f1d4ee9"
-  name = "github.com/gogo/protobuf"
-  packages = [
-    "proto",
-    "sortkeys",
-  ]
-  pruneopts = "NUT"
-  revision = "1adfc126b41513cc696b209667c8656ea7aac67c"
-  version = "v1.0.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:e2b86e41f3d669fc36b50d31d32d22c8ac656c75aa5ea89717ce7177e134ff2a"
-  name = "github.com/golang/glog"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "23def4e6c14b4da8ac2ed8007337bc5eb5007998"
-
-[[projects]]
-  digest = "1:03e14cff610a8a58b774e36bd337fa979482be86aab01be81fb8bbd6d0f07fc8"
-  name = "github.com/golang/protobuf"
-  packages = [
-    "proto",
-    "ptypes",
-    "ptypes/any",
-    "ptypes/duration",
-    "ptypes/timestamp",
-  ]
-  pruneopts = "NUT"
-  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:52c5834e2bebac9030c97cc0798ac11c3aa8a39f098aeb419f142533da6cd3cc"
-  name = "github.com/google/gofuzz"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "24818f796faf91cd76ec7bddd72458fbced7a6c1"
-
-[[projects]]
-  digest = "1:3d7c1446fc5c710351b246c0dc6700fae843ca27f5294d0bd9f68bab2a810c44"
-  name = "github.com/googleapis/gnostic"
-  packages = [
-    "OpenAPIv2",
-    "compiler",
-    "extensions",
-  ]
-  pruneopts = "NUT"
-  revision = "ee43cbb60db7bd22502942cccbc39059117352ab"
-  version = "v0.1.0"
-
-[[projects]]
-  digest = "1:406338ad39ab2e37b7f4452906442a3dbf0eb3379dd1f06aafb5c07e769a5fbb"
-  name = "github.com/inconshreveable/mousetrap"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75"
-  version = "v1.0"
-
-[[projects]]
-  digest = "1:42c47ace7ccb114261ef7e0d418d274921514ab50a3bf6bdb9e51c3dde8ce13d"
-  name = "github.com/json-iterator/go"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "ca39e5af3ece67bbcda3d0f4f56a8e24d9f2dad4"
-  version = "1.1.3"
-
-[[projects]]
-  branch = "master"
-  digest = "1:ada518b8c338e10e0afa443d84671476d3bd1d926e13713938088e8ddbee1a3e"
-  name = "github.com/mailru/easyjson"
-  packages = [
-    "buffer",
-    "jlexer",
-    "jwriter",
-  ]
-  pruneopts = "NUT"
-  revision = "3fdea8d05856a0c8df22ed4bc71b3219245e4485"
-
-[[projects]]
-  digest = "1:2f42fa12d6911c7b7659738758631bec870b7e9b4c6be5444f963cdcfccc191f"
-  name = "github.com/modern-go/concurrent"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94"
-  version = "1.0.3"
-
-[[projects]]
-  digest = "1:314a5881fab303a80d6d2e35a77000f2224bb50f09ef63a9aa4c1f9eaef985d8"
-  name = "github.com/modern-go/reflect2"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "1df9eeb2bb81f327b96228865c5687bc2194af3f"
-  version = "1.0.0"
-
-[[projects]]
-  digest = "1:5cf3f025cbee5951a4ee961de067c8a89fc95a5adabead774f82822efabab121"
-  name = "github.com/pkg/errors"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "645ef00459ed84a119197bfb8d8205042c6df63d"
-  version = "v0.8.0"
-
-[[projects]]
-  digest = "1:0f156dbd01b40676bdcbc64e51535c09b50f83c9cca5faef3090f82f18bda3c2"
-  name = "github.com/spf13/cobra"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "a1f051bc3eba734da4772d60e2d677f47cf93ef4"
-  version = "v0.0.2"
-
-[[projects]]
-  digest = "1:15e5c398fbd9d2c439b635a08ac161b13d04f0c2aa587fe256b65dc0c3efe8b7"
-  name = "github.com/spf13/pflag"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "583c0c0531f06d5278b7d917446061adc344b5cd"
-  version = "v1.0.1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:18108bc7e384e395b4805632a637405a3df71fa518e22f9b39b0c08b89a52b96"
-  name = "golang.org/x/net"
-  packages = [
-    "http/httpguts",
-    "http2",
-    "http2/hpack",
-    "idna",
-  ]
-  pruneopts = "NUT"
-  revision = "fe579d43d83210096a79b46dcca0e3721058393a"
-
-[[projects]]
-  digest = "1:e33513a825fcd765e97b5de639a2f7547542d1a8245df0cef18e1fd390b778a9"
-  name = "golang.org/x/text"
-  packages = [
-    "collate",
-    "collate/build",
-    "internal/colltab",
-    "internal/gen",
-    "internal/tag",
-    "internal/triegen",
-    "internal/ucd",
-    "language",
-    "secure/bidirule",
-    "transform",
-    "unicode/bidi",
-    "unicode/cldr",
-    "unicode/norm",
-    "unicode/rangetable",
-    "width",
-  ]
-  pruneopts = "NUT"
-  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
-  version = "v0.3.0"
-
-[[projects]]
-  digest = "1:2d1fbdc6777e5408cabeb02bf336305e724b925ff4546ded0fa8715a7267922a"
-  name = "gopkg.in/inf.v0"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "d2d2541c53f18d2a059457998ce2876cc8e67cbf"
-  version = "v0.9.1"
-
-[[projects]]
-  digest = "1:7c95b35057a0ff2e19f707173cc1a947fa43a6eb5c4d300d196ece0334046082"
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
-  version = "v2.2.1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:d895c7c24a0dd1ed2ecd061fd88dfea9e1e84d6f280ed859942a2d1aabee10ec"
-  name = "k8s.io/api"
-  packages = [
-    "admissionregistration/v1alpha1",
-    "admissionregistration/v1beta1",
-    "apps/v1",
-    "apps/v1beta1",
-    "apps/v1beta2",
-    "authentication/v1",
-    "authentication/v1beta1",
-    "authorization/v1",
-    "authorization/v1beta1",
-    "autoscaling/v1",
-    "autoscaling/v2beta1",
-    "batch/v1",
-    "batch/v1beta1",
-    "batch/v2alpha1",
-    "certificates/v1beta1",
-    "core/v1",
-    "events/v1beta1",
-    "extensions/v1beta1",
-    "networking/v1",
-    "policy/v1beta1",
-    "rbac/v1",
-    "rbac/v1alpha1",
-    "rbac/v1beta1",
-    "scheduling/v1alpha1",
-    "settings/v1alpha1",
-    "storage/v1",
-    "storage/v1alpha1",
-    "storage/v1beta1",
-  ]
-  pruneopts = "NUT"
-  revision = "53d615ae3f440f957cb9989d989d597f047262d9"
-
-[[projects]]
-  branch = "master"
-  digest = "1:dff69dd9d9fc681ae077ce5a409aca3c24894d09102ab0395ca7972f6ec01811"
-  name = "k8s.io/apimachinery"
-  packages = [
-    "pkg/api/equality",
-    "pkg/api/meta",
-    "pkg/api/resource",
-    "pkg/api/validation",
-    "pkg/apis/meta/v1",
-    "pkg/apis/meta/v1/unstructured",
-    "pkg/apis/meta/v1/validation",
-    "pkg/apis/meta/v1beta1",
-    "pkg/conversion",
-    "pkg/conversion/queryparams",
-    "pkg/fields",
-    "pkg/labels",
-    "pkg/runtime",
-    "pkg/runtime/schema",
-    "pkg/runtime/serializer",
-    "pkg/runtime/serializer/json",
-    "pkg/runtime/serializer/protobuf",
-    "pkg/runtime/serializer/recognizer",
-    "pkg/runtime/serializer/versioning",
-    "pkg/selection",
-    "pkg/types",
-    "pkg/util/errors",
-    "pkg/util/framer",
-    "pkg/util/intstr",
-    "pkg/util/json",
-    "pkg/util/mergepatch",
-    "pkg/util/net",
-    "pkg/util/runtime",
-    "pkg/util/sets",
-    "pkg/util/strategicpatch",
-    "pkg/util/validation",
-    "pkg/util/validation/field",
-    "pkg/util/wait",
-    "pkg/util/yaml",
-    "pkg/watch",
-    "third_party/forked/golang/json",
-    "third_party/forked/golang/reflect",
-  ]
-  pruneopts = "NUT"
-  revision = "13b73596e4b63e03203e86f6d9c7bcc1b937c62f"
-
-[[projects]]
-  digest = "1:ae9ced9ef7b8eb2794a4f80bc3af9d2bc38ec7d60337367bad9a655c1d641458"
-  name = "k8s.io/client-go"
-  packages = ["kubernetes/scheme"]
-  pruneopts = "NUT"
-  revision = "23781f4d6632d88e869066eaebb743857aa1ef9b"
-  version = "v7.0.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:f4fb3421360af5c51070bfe0c1c7467f8809fa70e278e129f068f5106b5c8a65"
-  name = "k8s.io/kube-openapi"
-  packages = [
-    "pkg/common",
-    "pkg/util/proto",
-  ]
-  pruneopts = "NUT"
-  revision = "b3f03f55328800731ce03a164b80973014ecd455"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "github.com/evanphx/json-patch",
-    "github.com/ghodss/yaml",
-    "github.com/go-openapi/spec",
-    "github.com/pkg/errors",
-    "github.com/spf13/cobra",
-    "gopkg.in/yaml.v2",
-    "k8s.io/api/core/v1",
-    "k8s.io/apimachinery/pkg/api/validation",
-    "k8s.io/apimachinery/pkg/apis/meta/v1",
-    "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
-    "k8s.io/apimachinery/pkg/apis/meta/v1/validation",
-    "k8s.io/apimachinery/pkg/runtime",
-    "k8s.io/apimachinery/pkg/runtime/schema",
-    "k8s.io/apimachinery/pkg/util/mergepatch",
-    "k8s.io/apimachinery/pkg/util/strategicpatch",
-    "k8s.io/apimachinery/pkg/util/validation",
-    "k8s.io/apimachinery/pkg/util/validation/field",
-    "k8s.io/apimachinery/pkg/util/yaml",
-    "k8s.io/client-go/kubernetes/scheme",
-    "k8s.io/kube-openapi/pkg/common",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -1,58 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#  name = "github.com/x/y"
-#  version = "2.4.0"
-
-# prune out unused content from vendor
-[prune]
-  go-tests = true
-  non-go = true
-  unused-packages = true
-
-[[constraint]]
-  name = "github.com/evanphx/json-patch"
-  version = "3.0.0"
-
-[[constraint]]
-  name = "github.com/ghodss/yaml"
-  version = "1.0.0"
-
-[[constraint]]
-  name = "github.com/spf13/cobra"
-  version = "0.0.2"
-
-[[constraint]]
-  branch = "master"
-  name = "k8s.io/api"
-
-[[constraint]]
-  branch = "master"
-  name = "k8s.io/apimachinery"
-
-[[constraint]]
-  name = "k8s.io/client-go"
-  version = "7.0.0"
-
-[[override]]
-  branch = "master"
-  name = "k8s.io/utils"
-
-[[override]]
-  branch = "master"
-  name = "github.com/go-openapi/spec"
--- a/37
+++ b/37
@@ -0,0 +1,37 @@
+BIN_NAME=kustomize
+
+COVER_FILE=coverage.out
+
+export GO111MODULE=on
+
+all: test build
+
+test: generate-code test-lint test-go
+
+test-go:
+	go test -v ./...
+
+test-lint:
+	golangci-lint run ./...
+
+generate-code:
+	./plugin/generateBuiltins.sh $(GOPATH)
+
+build:
+	go build -o $(BIN_NAME) cmd/kustomize/main.go
+
+install:
+	go install $(PWD)/cmd/kustomize
+
+cover:
+	# The plugin directory eludes coverage, and is therefore omitted
+	go test ./pkg/... ./k8sdeps/... ./internal/... -coverprofile=$(COVER_FILE) && \
+	go tool cover -html=$(COVER_FILE)
+
+
+clean:
+	go clean
+	rm -f $(BIN_NAME)
+	rm -f $(COVER_FILE)
+
+.PHONY: test build install clean generate-code test-go test-lint cover
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ untouched and usable as is.
 `kustomize` targets kubernetes; it understands and can
 patch [kubernetes style] API objects.  It's like
 [`make`], in that what it does is declared in a file,
-and it's like [`sed`], in that it emits editted text.
+and it's like [`sed`], in that it emits edited text.

 This tool is sponsored by [sig-cli] ([KEP]), and
 inspired by [DAM].
@@ -16,9 +16,23 @@ inspired by [DAM].
 [![Build Status](https://travis-ci.org/kubernetes-sigs/kustomize.svg?branch=master)](https://travis-ci.org/kubernetes-sigs/kustomize)
 [![Go Report Card](https://goreportcard.com/badge/github.com/kubernetes-sigs/kustomize)](https://goreportcard.com/report/github.com/kubernetes-sigs/kustomize)

-**Installation**: Download a binary from the [release
-page], or see these [install] notes. Then try one of
-the tested [examples].
+Download a binary from the [release page], or see
+these [instructions](docs/INSTALL.md).
+
+Browse the [docs](docs) or jump right into the
+tested [examples](examples).
+
+## kubectl integration
+
+Since [v1.14][kubectl announcement] the kustomize build system has been included in kubectl.
+
+| kubectl version | kustomize version |
+|---------|--------|
+| v1.16.0 | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+| v1.15.x | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+| v1.14.x | [v2.0.3](https://github.com/kubernetes-sigs/kustomize/tree/v2.0.3) |
+
+For examples and guides for using the kubectl integration please see the [kubectl book] or the [kubernetes documentation].

 ## Usage

@@ -119,51 +133,10 @@ The YAML can be directly [applied] to a cluster:

 ## Community

-### Filing bug reports
-
-
-##### A good report specifies
-
- * the output of `kustomize version`,
- * the input (the content of `kustomization.yaml`
-   and any files it refers to),
- * the expected YAML output.
-
-##### A _great_ report is a bug reproduction test
- 
-Kustomize has a simple test harness in the
-[target package] for specifying a kustomization's
-input and the expected output.
-See this [example of a target test].
- 
-The pattern is
- * call `NewKustTestHarness`
- * specify kustomization input data (resources,
-   patches, etc.) as inline strings,
- * call `makeKustTarget().MakeCustomizedResMap()`
- * compare the actual output to expected output
-
-In a bug reproduction test, the expected output string
-initially contains the _wrong_ (unexpected) output,
-thus unambiguously reproducing the bug.
-
-Nearby comments should explain what the output
-_should_ be, and have a TODO pointing to the related
-issue.
-
-The person who fixes the bug then has a clear
-bug reproduction and a test to modify when
-the bug is fixed.
-
-The bug reporter can then see the bug was fixed,
-and has permanent regression coverage to prevent
-its reintroduction.
- 
-### Feature requests
-
-Feature requests are welcome.
+To file bugs please read [this](docs/bugs.md).

 Before working on an implementation, please
+
 * Read the [eschewed feature list].
 * File an issue describing
   how the new feature would behave
@@ -192,12 +165,12 @@ is governed by the [Kubernetes Code of Conduct].
 [community page]: http://kubernetes.io/community/
 [declarative configuration]: docs/glossary.md#declarative-application-management
 [eschewed feature list]: docs/eschewedFeatures.md
-[example of a target test]: https://github.com/kubernetes-sigs/kustomize/blob/master/pkg/target/baseandoverlaysmall_test.go
-[examples]: examples/README.md
-[imageBase]: docs/base.jpg
-[imageOverlay]: docs/overlay.jpg
-[install]: docs/INSTALL.md
+[imageBase]: docs/images/base.jpg
+[imageOverlay]: docs/images/overlay.jpg
 [kind/feature]: https://github.com/kubernetes-sigs/kustomize/labels/kind%2Ffeature
+[kubectl announcement]: https://kubernetes.io/blog/2019/03/25/kubernetes-1-14-release-announcement
+[kubectl book]: https://kubectl.docs.kubernetes.io/pages/app_customization/introduction.html
+[kubernetes documentation]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
 [kubernetes style]: docs/glossary.md#kubernetes-style-object
 [kustomization]: docs/glossary.md#kustomization
 [overlay]: docs/glossary.md#overlay
@@ -206,7 +179,8 @@ is governed by the [Kubernetes Code of Conduct].
 [resource]: docs/glossary.md#resource
 [resources]: docs/glossary.md#resource
 [sig-cli]: https://github.com/kubernetes/community/blob/master/sig-cli/README.md
-[target package]: https://github.com/kubernetes-sigs/kustomize/tree/master/pkg/target
 [variant]: docs/glossary.md#variant
 [variants]: docs/glossary.md#variant
+[v2.0.3]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.0.3
+[v2.1.0]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.1.0
 [workflows]: docs/workflows.md
--- a/api/filesys/confirmeddir.go
+++ b/api/filesys/confirmeddir.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fs
+package filesys

 import (
 	"io/ioutil"
@@ -27,7 +14,7 @@ import (
 type ConfirmedDir string

 // NewTmpConfirmedDir returns a temporary dir, else error.
-// The directory is cleaned, no symlinks, etc. so its
+// The directory is cleaned, no symlinks, etc. so it's
 // returned as a ConfirmedDir.
 func NewTmpConfirmedDir() (ConfirmedDir, error) {
 	n, err := ioutil.TempDir("", "kustomize-")
@@ -36,13 +23,12 @@ func NewTmpConfirmedDir() (ConfirmedDir, error) {
 	}

 	// In MacOs `ioutil.TempDir` creates a directory
-	// with root in the `/var` folder, which is in turn a symlinked path
-	// to `/private/var`.
+	// with root in the `/var` folder, which is in turn
+	// a symlinked path to `/private/var`.
 	// Function `filepath.EvalSymlinks`is used to
 	// resolve the real absolute path.
 	deLinked, err := filepath.EvalSymlinks(n)
 	return ConfirmedDir(deLinked), err
-
 }

 // HasPrefix returns true if the directory argument
--- a/api/filesys/confirmeddir_test.go
+++ b/api/filesys/confirmeddir_test.go
@@ -1,28 +1,17 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fs
+package filesys_test

 import (
 	"path/filepath"
 	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
 )

 func TestJoin(t *testing.T) {
-	fSys := MakeFakeFS()
+	fSys := MakeFsInMemory()
 	err := fSys.Mkdir("/foo")
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
@@ -40,7 +29,8 @@ func TestJoin(t *testing.T) {
 }

 func TestHasPrefix_Slash(t *testing.T) {
-	d, f, err := MakeFakeFS().CleanedAbs("/")
+	fSys := MakeFsInMemory()
+	d, f, err := fSys.CleanedAbs("/")
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
@@ -56,7 +46,7 @@ func TestHasPrefix_Slash(t *testing.T) {
 }

 func TestHasPrefix_SlashFoo(t *testing.T) {
-	fSys := MakeFakeFS()
+	fSys := MakeFsInMemory()
 	err := fSys.Mkdir("/foo")
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
@@ -77,7 +67,7 @@ func TestHasPrefix_SlashFoo(t *testing.T) {
 }

 func TestHasPrefix_SlashFooBar(t *testing.T) {
-	fSys := MakeFakeFS()
+	fSys := MakeFsInMemory()
 	err := fSys.MkdirAll("/foo/bar")
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
--- a/api/filesys/file.go
+++ b/api/filesys/file.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"io"
+	"os"
+	"time"
+)
+
+var _ os.FileInfo = &fileInfo{}
+
+// fileInfo implements os.FileInfo for a fileInMemory instance.
+type fileInfo struct {
+	*fileInMemory
+}
+
+// Name returns the name of the file
+func (fi *fileInfo) Name() string { return fi.name }
+
+// Size returns the size of the file
+func (fi *fileInfo) Size() int64 { return int64(len(fi.content)) }
+
+// Mode returns the file mode
+func (fi *fileInfo) Mode() os.FileMode { return 0777 }
+
+// ModTime returns the modification time
+func (fi *fileInfo) ModTime() time.Time { return time.Time{} }
+
+// IsDir returns if it is a directory
+func (fi *fileInfo) IsDir() bool { return fi.dir }
+
+// Sys should return underlying data source, but it now returns nil
+func (fi *fileInfo) Sys() interface{} { return nil }
+
+// File groups the basic os.File methods.
+type File interface {
+	io.ReadWriteCloser
+	Stat() (os.FileInfo, error)
+}
--- a/api/filesys/fileinmemory.go
+++ b/api/filesys/fileinmemory.go
@@ -0,0 +1,56 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"bytes"
+	"os"
+)
+
+var _ File = &fileInMemory{}
+
+// fileInMemory implements File in-memory for tests.
+type fileInMemory struct {
+	name    string
+	content []byte
+	dir     bool
+	open    bool
+}
+
+// makeDir makes a fake directory.
+func makeDir(name string) *fileInMemory {
+	return &fileInMemory{name: name, dir: true}
+}
+
+// Close marks the fake file closed.
+func (f *fileInMemory) Close() error {
+	f.open = false
+	return nil
+}
+
+// Read never fails, and doesn't mutate p.
+func (f *fileInMemory) Read(p []byte) (n int, err error) {
+	return len(p), nil
+}
+
+// Write saves the contents of the argument to memory.
+func (f *fileInMemory) Write(p []byte) (n int, err error) {
+	f.content = p
+	return len(p), nil
+}
+
+// ContentMatches returns true if v matches fake file's content.
+func (f *fileInMemory) ContentMatches(v []byte) bool {
+	return bytes.Equal(v, f.content)
+}
+
+// GetContent the content of a fake file.
+func (f *fileInMemory) GetContent() []byte {
+	return f.content
+}
+
+// Stat returns nil.
+func (f *fileInMemory) Stat() (os.FileInfo, error) {
+	return nil, nil
+}
--- a/api/filesys/fileondisk.go
+++ b/api/filesys/fileondisk.go
@@ -0,0 +1,27 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"os"
+)
+
+var _ File = &fileOnDisk{}
+
+// fileOnDisk implements File using the local filesystem.
+type fileOnDisk struct {
+	file *os.File
+}
+
+// Close closes a file.
+func (f *fileOnDisk) Close() error { return f.file.Close() }
+
+// Read reads a file's content.
+func (f *fileOnDisk) Read(p []byte) (n int, err error) { return f.file.Read(p) }
+
+// Write writes bytes to a file
+func (f *fileOnDisk) Write(p []byte) (n int, err error) { return f.file.Write(p) }
+
+// Stat returns an interface which has all the information regarding the file.
+func (f *fileOnDisk) Stat() (os.FileInfo, error) { return f.file.Stat() }
--- a/api/filesys/filesystem.go
+++ b/api/filesys/filesystem.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package filesys provides a file system abstraction layer.
+package filesys
+
+import (
+	"path/filepath"
+)
+
+// FileSystem groups basic os filesystem methods.
+type FileSystem interface {
+	// Create a file.
+	Create(name string) (File, error)
+	// MkDir makes a directory.
+	Mkdir(path string) error
+	// MkDir makes a directory path, creating intervening directories.
+	MkdirAll(path string) error
+	// RemoveAll removes path and any children it contains.
+	RemoveAll(path string) error
+	// Open opens the named file for reading.
+	Open(path string) (File, error)
+	// IsDir returns true if the path is a directory.
+	IsDir(path string) bool
+	// CleanedAbs converts the given path into a
+	// directory and a file name, where the directory
+	// is represented as a ConfirmedDir and all that implies.
+	// If the entire path is a directory, the file component
+	// is an empty string.
+	CleanedAbs(path string) (ConfirmedDir, string, error)
+	// Exists is true if the path exists in the file system.
+	Exists(path string) bool
+	// Glob returns the list of matching files
+	Glob(pattern string) ([]string, error)
+	// ReadFile returns the contents of the file at the given path.
+	ReadFile(path string) ([]byte, error)
+	// WriteFile writes the data to a file at the given path.
+	WriteFile(path string, data []byte) error
+	// Walk walks the file system with the given WalkFunc.
+	Walk(path string, walkFn filepath.WalkFunc) error
+}
--- a/api/filesys/fsinmemory.go
+++ b/api/filesys/fsinmemory.go
@@ -0,0 +1,223 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+var _ FileSystem = &fsInMemory{}
+
+// fsInMemory implements FileSystem using a in-memory filesystem
+// primarily for use in tests.
+type fsInMemory struct {
+	m map[string]*fileInMemory
+}
+
+// MakeFsInMemory returns an instance of fsInMemory with no files in it.
+func MakeFsInMemory() FileSystem {
+	result := &fsInMemory{m: map[string]*fileInMemory{}}
+	result.Mkdir(separator)
+	return result
+}
+
+const (
+	separator = string(filepath.Separator)
+	doubleSep = separator + separator
+)
+
+// Create assures a fake file appears in the in-memory file system.
+func (fs *fsInMemory) Create(name string) (File, error) {
+	f := &fileInMemory{}
+	f.open = true
+	fs.m[name] = f
+	return fs.m[name], nil
+}
+
+// Mkdir assures a fake directory appears in the in-memory file system.
+func (fs *fsInMemory) Mkdir(name string) error {
+	fs.m[name] = makeDir(name)
+	return nil
+}
+
+// MkdirAll delegates to Mkdir
+func (fs *fsInMemory) MkdirAll(name string) error {
+	return fs.Mkdir(name)
+}
+
+// RemoveAll presumably does rm -r on a path.
+// There's no error.
+func (fs *fsInMemory) RemoveAll(name string) error {
+	var toRemove []string
+	for k := range fs.m {
+		if strings.HasPrefix(k, name) {
+			toRemove = append(toRemove, k)
+		}
+	}
+	for _, k := range toRemove {
+		delete(fs.m, k)
+	}
+	return nil
+}
+
+// Open returns a fake file in the open state.
+func (fs *fsInMemory) Open(name string) (File, error) {
+	if _, found := fs.m[name]; !found {
+		return nil, fmt.Errorf("file %q cannot be opened", name)
+	}
+	return fs.m[name], nil
+}
+
+// CleanedAbs cannot fail.
+func (fs *fsInMemory) CleanedAbs(path string) (ConfirmedDir, string, error) {
+	if fs.IsDir(path) {
+		return ConfirmedDir(path), "", nil
+	}
+	d := filepath.Dir(path)
+	if d == path {
+		return ConfirmedDir(d), "", nil
+	}
+	return ConfirmedDir(d), filepath.Base(path), nil
+}
+
+// Exists returns true if file is known.
+func (fs *fsInMemory) Exists(name string) bool {
+	_, found := fs.m[name]
+	return found
+}
+
+// Glob returns the list of matching files
+func (fs *fsInMemory) Glob(pattern string) ([]string, error) {
+	var result []string
+	for p := range fs.m {
+		if fs.pathMatch(p, pattern) {
+			result = append(result, p)
+		}
+	}
+	sort.Strings(result)
+	return result, nil
+}
+
+// IsDir returns true if the file exists and is a directory.
+func (fs *fsInMemory) IsDir(name string) bool {
+	f, found := fs.m[name]
+	if found && f.dir {
+		return true
+	}
+	if !strings.HasSuffix(name, separator) {
+		name = name + separator
+	}
+	for k := range fs.m {
+		if strings.HasPrefix(k, name) {
+			return true
+		}
+	}
+	return false
+}
+
+// ReadFile always returns an empty bytes and error depending on content of m.
+func (fs *fsInMemory) ReadFile(name string) ([]byte, error) {
+	if ff, found := fs.m[name]; found {
+		return ff.content, nil
+	}
+	return nil, fmt.Errorf("cannot read file %q", name)
+}
+
+// WriteFile always succeeds and does nothing.
+func (fs *fsInMemory) WriteFile(name string, c []byte) error {
+	ff := &fileInMemory{}
+	ff.Write(c)
+	fs.m[name] = ff
+	return nil
+}
+
+// Walk implements filepath.Walk using the fake filesystem.
+func (fs *fsInMemory) Walk(path string, walkFn filepath.WalkFunc) error {
+	info, err := fs.lstat(path)
+	if err != nil {
+		err = walkFn(path, info, err)
+	} else {
+		err = fs.walk(path, info, walkFn)
+	}
+	if err == filepath.SkipDir {
+		return nil
+	}
+	return err
+}
+
+func (fs *fsInMemory) pathMatch(path, pattern string) bool {
+	match, _ := filepath.Match(pattern, path)
+	return match
+}
+
+func (fs *fsInMemory) lstat(path string) (*fileInfo, error) {
+	f, found := fs.m[path]
+	if !found {
+		return nil, os.ErrNotExist
+	}
+	return &fileInfo{f}, nil
+}
+
+func (fs *fsInMemory) join(elem ...string) string {
+	for i, e := range elem {
+		if e != "" {
+			return strings.Replace(
+				strings.Join(elem[i:], separator), doubleSep, separator, -1)
+		}
+	}
+	return ""
+}
+
+func (fs *fsInMemory) readDirNames(path string) []string {
+	var names []string
+	if !strings.HasSuffix(path, separator) {
+		path += separator
+	}
+	pathSegments := strings.Count(path, separator)
+	for name := range fs.m {
+		if name == path {
+			continue
+		}
+		if strings.Count(name, separator) > pathSegments {
+			continue
+		}
+		if strings.HasPrefix(name, path) {
+			names = append(names, filepath.Base(name))
+		}
+	}
+	sort.Strings(names)
+	return names
+}
+
+func (fs *fsInMemory) walk(path string, info os.FileInfo, walkFn filepath.WalkFunc) error {
+	if !info.IsDir() {
+		return walkFn(path, info, nil)
+	}
+
+	names := fs.readDirNames(path)
+	if err := walkFn(path, info, nil); err != nil {
+		return err
+	}
+	for _, name := range names {
+		filename := fs.join(path, name)
+		fileInfo, err := fs.lstat(filename)
+		if err != nil {
+			if err := walkFn(filename, fileInfo, os.ErrNotExist); err != nil && err != filepath.SkipDir {
+				return err
+			}
+		} else {
+			err = fs.walk(filename, fileInfo, walkFn)
+			if err != nil {
+				if !fileInfo.IsDir() || err != filepath.SkipDir {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
--- a/api/filesys/fsinmemory_test.go
+++ b/api/filesys/fsinmemory_test.go
@@ -0,0 +1,149 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys_test
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
+)
+
+func TestExists(t *testing.T) {
+	fSys := MakeFsInMemory()
+	if fSys.Exists("foo") {
+		t.Fatalf("expected no foo")
+	}
+	fSys.Mkdir("/")
+	if !fSys.IsDir("/") {
+		t.Fatalf("expected dir at /")
+	}
+}
+
+func TestIsDir(t *testing.T) {
+	fSys := MakeFsInMemory()
+	expectedName := "my-dir"
+	err := fSys.Mkdir(expectedName)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	shouldExist(t, fSys, expectedName)
+	if !fSys.IsDir(expectedName) {
+		t.Fatalf(expectedName + " should be a dir")
+	}
+}
+
+func shouldExist(t *testing.T, fSys FileSystem, name string) {
+	if !fSys.Exists(name) {
+		t.Fatalf(name + " should exist")
+	}
+}
+
+func shouldNotExist(t *testing.T, fSys FileSystem, name string) {
+	if fSys.Exists(name) {
+		t.Fatalf(name + " should not exist")
+	}
+}
+
+func TestRemoveAll(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.WriteFile("/foo/project/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/project/subdir/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/apple/subdir/file.yaml", []byte("Unused"))
+	shouldExist(t, fSys, "/foo/project/file.yaml")
+	shouldExist(t, fSys, "/foo/project/subdir/file.yaml")
+	shouldExist(t, fSys, "/foo/apple/subdir/file.yaml")
+	err := fSys.RemoveAll("/foo/project")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	shouldNotExist(t, fSys, "/foo/project/file.yaml")
+	shouldNotExist(t, fSys, "/foo/project/subdir/file.yaml")
+	shouldExist(t, fSys, "/foo/apple/subdir/file.yaml")
+}
+
+func TestIsDirDeeper(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.WriteFile("/foo/project/file.yaml", []byte("Unused"))
+	fSys.WriteFile("/foo/project/subdir/file.yaml", []byte("Unused"))
+	if !fSys.IsDir("/") {
+		t.Fatalf("/ should be a dir")
+	}
+	if !fSys.IsDir("/foo") {
+		t.Fatalf("/foo should be a dir")
+	}
+	if !fSys.IsDir("/foo/project") {
+		t.Fatalf("/foo/project should be a dir")
+	}
+	if fSys.IsDir("/fo") {
+		t.Fatalf("/fo should not be a dir")
+	}
+	if fSys.IsDir("/x") {
+		t.Fatalf("/x should not be a dir")
+	}
+}
+
+func TestCreate(t *testing.T) {
+	fSys := MakeFsInMemory()
+	f, err := fSys.Create("foo")
+	if f == nil {
+		t.Fatalf("expected file")
+	}
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	shouldExist(t, fSys, "foo")
+}
+
+func TestReadFile(t *testing.T) {
+	fSys := MakeFsInMemory()
+	f, err := fSys.Create("foo")
+	if f == nil {
+		t.Fatalf("expected file")
+	}
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	content, err := fSys.ReadFile("foo")
+	if len(content) != 0 {
+		t.Fatalf("expected no content")
+	}
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+}
+
+func TestWriteFile(t *testing.T) {
+	fSys := MakeFsInMemory()
+	c := []byte("heybuddy")
+	err := fSys.WriteFile("foo", c)
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	content, err := fSys.ReadFile("foo")
+	if err != nil {
+		t.Fatalf("expected read to work: %v", err)
+	}
+	if bytes.Compare(c, content) != 0 {
+		t.Fatalf("incorrect content: %v", content)
+	}
+}
+
+func TestGlob(t *testing.T) {
+	fSys := MakeFsInMemory()
+	fSys.Create("dir/foo")
+	fSys.Create("dir/bar")
+	files, err := fSys.Glob("dir/*")
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	expected := []string{
+		"dir/bar",
+		"dir/foo",
+	}
+	if !reflect.DeepEqual(files, expected) {
+		t.Fatalf("incorrect files found by glob: %v", files)
+	}
+}
--- a/api/filesys/fsondisk.go
+++ b/api/filesys/fsondisk.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fs
+package filesys

 import (
 	"fmt"
@@ -24,43 +11,43 @@ import (
 	"path/filepath"
 )

-var _ FileSystem = realFS{}
+var _ FileSystem = fsOnDisk{}

-// realFS implements FileSystem using the local filesystem.
-type realFS struct{}
+// fsOnDisk implements FileSystem using the local filesystem.
+type fsOnDisk struct{}

-// MakeRealFS makes an instance of realFS.
-func MakeRealFS() FileSystem {
-	return realFS{}
+// MakeFsOnDisk makes an instance of fsOnDisk.
+func MakeFsOnDisk() FileSystem {
+	return fsOnDisk{}
 }

 // Create delegates to os.Create.
-func (realFS) Create(name string) (File, error) { return os.Create(name) }
+func (fsOnDisk) Create(name string) (File, error) { return os.Create(name) }

 // Mkdir delegates to os.Mkdir.
-func (realFS) Mkdir(name string) error {
+func (fsOnDisk) Mkdir(name string) error {
 	return os.Mkdir(name, 0777|os.ModeDir)
 }

 // MkdirAll delegates to os.MkdirAll.
-func (realFS) MkdirAll(name string) error {
+func (fsOnDisk) MkdirAll(name string) error {
 	return os.MkdirAll(name, 0777|os.ModeDir)
 }

 // RemoveAll delegates to os.RemoveAll.
-func (realFS) RemoveAll(name string) error {
+func (fsOnDisk) RemoveAll(name string) error {
 	return os.RemoveAll(name)
 }

 // Open delegates to os.Open.
-func (realFS) Open(name string) (File, error) { return os.Open(name) }
+func (fsOnDisk) Open(name string) (File, error) { return os.Open(name) }

-// CleanedAbs returns a cleaned, absolute path
-// with no symbolic links split into directory
-// and file components.  If the entire path is
-// a directory, the file component is an empty
-// string.
-func (x realFS) CleanedAbs(
+// CleanedAbs converts the given path into a
+// directory and a file name, where the directory
+// is represented as a ConfirmedDir and all that implies.
+// If the entire path is a directory, the file component
+// is an empty string.
+func (x fsOnDisk) CleanedAbs(
 	path string) (ConfirmedDir, string, error) {
 	absRoot, err := filepath.Abs(path)
 	if err != nil {
@@ -94,18 +81,18 @@ func (x realFS) CleanedAbs(
 }

 // Exists returns true if os.Stat succeeds.
-func (realFS) Exists(name string) bool {
+func (fsOnDisk) Exists(name string) bool {
 	_, err := os.Stat(name)
 	return err == nil
 }

 // Glob returns the list of matching files
-func (realFS) Glob(pattern string) ([]string, error) {
+func (fsOnDisk) Glob(pattern string) ([]string, error) {
 	return filepath.Glob(pattern)
 }

 // IsDir delegates to os.Stat and FileInfo.IsDir
-func (realFS) IsDir(name string) bool {
+func (fsOnDisk) IsDir(name string) bool {
 	info, err := os.Stat(name)
 	if err != nil {
 		return false
@@ -114,9 +101,14 @@ func (realFS) IsDir(name string) bool {
 }

 // ReadFile delegates to ioutil.ReadFile.
-func (realFS) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(name) }
+func (fsOnDisk) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(name) }

 // WriteFile delegates to ioutil.WriteFile with read/write permissions.
-func (realFS) WriteFile(name string, c []byte) error {
+func (fsOnDisk) WriteFile(name string, c []byte) error {
 	return ioutil.WriteFile(name, c, 0666)
 }
+
+// Walk delegates to filepath.Walk.
+func (fsOnDisk) Walk(path string, walkFn filepath.WalkFunc) error {
+	return filepath.Walk(path, walkFn)
+}
--- a/api/filesys/fsondisk_test.go
+++ b/api/filesys/fsondisk_test.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fs
+package filesys_test

 import (
 	"io/ioutil"
@@ -23,10 +10,12 @@ import (
 	"path/filepath"
 	"reflect"
 	"testing"
+
+	. "sigs.k8s.io/kustomize/api/filesys"
 )

 func makeTestDir(t *testing.T) (FileSystem, string) {
-	x := MakeRealFS()
+	fSys := MakeFsOnDisk()
 	td, err := ioutil.TempDir("", "kustomize_testing_dir")
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
@@ -35,20 +24,20 @@ func makeTestDir(t *testing.T) (FileSystem, string) {
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
 	}
-	if !x.Exists(testDir) {
+	if !fSys.Exists(testDir) {
 		t.Fatalf("expected existence")
 	}
-	if !x.IsDir(testDir) {
+	if !fSys.IsDir(testDir) {
 		t.Fatalf("expected directory")
 	}
-	return x, testDir
+	return fSys, testDir
 }

 func TestCleanedAbs_1(t *testing.T) {
-	x, testDir := makeTestDir(t)
+	fSys, testDir := makeTestDir(t)
 	defer os.RemoveAll(testDir)

-	d, f, err := x.CleanedAbs("")
+	d, f, err := fSys.CleanedAbs("")
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}
@@ -65,10 +54,10 @@ func TestCleanedAbs_1(t *testing.T) {
 }

 func TestCleanedAbs_2(t *testing.T) {
-	x, testDir := makeTestDir(t)
+	fSys, testDir := makeTestDir(t)
 	defer os.RemoveAll(testDir)

-	d, f, err := x.CleanedAbs("/")
+	d, f, err := fSys.CleanedAbs("/")
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}
@@ -81,16 +70,16 @@ func TestCleanedAbs_2(t *testing.T) {
 }

 func TestCleanedAbs_3(t *testing.T) {
-	x, testDir := makeTestDir(t)
+	fSys, testDir := makeTestDir(t)
 	defer os.RemoveAll(testDir)

-	err := x.WriteFile(
+	err := fSys.WriteFile(
 		filepath.Join(testDir, "foo"), []byte(`foo`))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}

-	d, f, err := x.CleanedAbs(filepath.Join(testDir, "foo"))
+	d, f, err := fSys.CleanedAbs(filepath.Join(testDir, "foo"))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}
@@ -100,25 +89,24 @@ func TestCleanedAbs_3(t *testing.T) {
 	if f != "foo" {
 		t.Fatalf("unexpected f=%s", f)
 	}
-
 }

 func TestCleanedAbs_4(t *testing.T) {
-	x, testDir := makeTestDir(t)
+	fSys, testDir := makeTestDir(t)
 	defer os.RemoveAll(testDir)

-	err := x.MkdirAll(filepath.Join(testDir, "d1", "d2"))
+	err := fSys.MkdirAll(filepath.Join(testDir, "d1", "d2"))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}
-	err = x.WriteFile(
+	err = fSys.WriteFile(
 		filepath.Join(testDir, "d1", "d2", "bar"),
 		[]byte(`bar`))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
 	}

-	d, f, err := x.CleanedAbs(
+	d, f, err := fSys.CleanedAbs(
 		filepath.Join(testDir, "d1", "d2"))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
@@ -130,7 +118,7 @@ func TestCleanedAbs_4(t *testing.T) {
 		t.Fatalf("unexpected f=%s", f)
 	}

-	d, f, err = x.CleanedAbs(
+	d, f, err = fSys.CleanedAbs(
 		filepath.Join(testDir, "d1", "d2", "bar"))
 	if err != nil {
 		t.Fatalf("unexpected err=%v", err)
@@ -144,26 +132,26 @@ func TestCleanedAbs_4(t *testing.T) {
 }

 func TestReadFilesRealFS(t *testing.T) {
-	x, testDir := makeTestDir(t)
+	fSys, testDir := makeTestDir(t)
 	defer os.RemoveAll(testDir)

-	err := x.WriteFile(path.Join(testDir, "foo"), []byte(`foo`))
+	err := fSys.WriteFile(path.Join(testDir, "foo"), []byte(`foo`))
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
 	}
-	if !x.Exists(path.Join(testDir, "foo")) {
+	if !fSys.Exists(path.Join(testDir, "foo")) {
 		t.Fatalf("expected foo")
 	}
-	if x.IsDir(path.Join(testDir, "foo")) {
+	if fSys.IsDir(path.Join(testDir, "foo")) {
 		t.Fatalf("expected foo not to be a directory")
 	}

-	err = x.WriteFile(path.Join(testDir, "bar"), []byte(`bar`))
+	err = fSys.WriteFile(path.Join(testDir, "bar"), []byte(`bar`))
 	if err != nil {
 		t.Fatalf("unexpected error %s", err)
 	}

-	files, err := x.Glob(path.Join("testDir", "*"))
+	files, err := fSys.Glob(path.Join("testDir", "*"))
 	expected := []string{
 		path.Join(testDir, "bar"),
 		path.Join(testDir, "foo"),
--- a/api/filesys/rpath.go
+++ b/api/filesys/rpath.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package filesys
+
+import "path/filepath"
+
+// RootedPath returns a rooted path, e.g. "/foo/bar" as
+// opposed to "foo/bar".
+func RootedPath(elem ...string) string {
+	return separator + filepath.Join(elem...)
+}
--- a/api/git/cloner.go
+++ b/api/git/cloner.go
@@ -0,0 +1,121 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package git
+
+import (
+	"bytes"
+	"log"
+	"os/exec"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+// Cloner is a function that can clone a git repo.
+type Cloner func(repoSpec *RepoSpec) error
+
+// ClonerUsingGitExec uses a local git install, as opposed
+// to say, some remote API, to obtain a local clone of
+// a remote repo.
+func ClonerUsingGitExec(repoSpec *RepoSpec) error {
+	gitProgram, err := exec.LookPath("git")
+	if err != nil {
+		return errors.Wrap(err, "no 'git' program on path")
+	}
+	repoSpec.Dir, err = filesys.NewTmpConfirmedDir()
+	if err != nil {
+		return err
+	}
+	cmd := exec.Command(
+		gitProgram,
+		"init",
+		repoSpec.Dir.String())
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error initializing empty git repo: %s", out.String())
+		return errors.Wrapf(
+			err,
+			"trouble initializing empty git repo in %s",
+			repoSpec.Dir.String())
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"remote",
+		"add",
+		"origin",
+		repoSpec.CloneSpec())
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error setting git remote: %s", out.String())
+		return errors.Wrapf(
+			err,
+			"trouble adding remote %s",
+			repoSpec.CloneSpec())
+	}
+	if repoSpec.Ref == "" {
+		repoSpec.Ref = "master"
+	}
+	cmd = exec.Command(
+		gitProgram,
+		"fetch",
+		"--depth=1",
+		"origin",
+		repoSpec.Ref)
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error performing git fetch: %s", out.String())
+		return errors.Wrapf(err, "trouble fetching %s", repoSpec.Ref)
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"reset",
+		"--hard",
+		"FETCH_HEAD")
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		log.Printf("Error performing git reset: %s", out.String())
+		return errors.Wrapf(
+			err, "trouble hard resetting empty repository to %s", repoSpec.Ref)
+	}
+
+	cmd = exec.Command(
+		gitProgram,
+		"submodule",
+		"update",
+		"--init",
+		"--recursive")
+	cmd.Stdout = &out
+	cmd.Dir = repoSpec.Dir.String()
+	err = cmd.Run()
+	if err != nil {
+		return errors.Wrapf(err, "trouble fetching submodules for %s", repoSpec.Ref)
+	}
+
+	return nil
+}
+
+// DoNothingCloner returns a cloner that only sets
+// cloneDir field in the repoSpec.  It's assumed that
+// the cloneDir is associated with some fake filesystem
+// used in a test.
+func DoNothingCloner(dir filesys.ConfirmedDir) Cloner {
+	return func(rs *RepoSpec) error {
+		rs.Dir = dir
+		return nil
+	}
+}
--- a/api/git/repospec.go
+++ b/api/git/repospec.go
@@ -1,27 +1,15 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package git

 import (
 	"fmt"
 	"path/filepath"
+	"regexp"
 	"strings"

-	"sigs.k8s.io/kustomize/pkg/fs"
+	"sigs.k8s.io/kustomize/api/filesys"
 )

 // Used as a temporary non-empty occupant of the cloneDir
@@ -29,7 +17,7 @@ import (
 // in various outputs (especially tests). Not using an
 // actual directory name here, as that's a temporary directory
 // with a unique name that isn't created until clone time.
-const notCloned = fs.ConfirmedDir("/notCloned")
+const notCloned = filesys.ConfirmedDir("/notCloned")

 // RepoSpec specifies a git repository and a branch and path therein.
 type RepoSpec struct {
@@ -38,33 +26,36 @@ type RepoSpec struct {
 	raw string

 	// Host, e.g. github.com
-	host string
+	Host string

 	// orgRepo name (organization/repoName),
 	// e.g. kubernetes-sigs/kustomize
-	orgRepo string
+	OrgRepo string

-	// ConfirmedDir where the orgRepo is cloned to.
-	cloneDir fs.ConfirmedDir
+	// Dir where the orgRepo is cloned to.
+	Dir filesys.ConfirmedDir

 	// Relative path in the repository, and in the cloneDir,
 	// to a Kustomization.
-	path string
+	Path string

 	// Branch or tag reference.
-	ref string
+	Ref string
+
+	// e.g. .git or empty in case of _git is present
+	GitSuffix string
 }

 // CloneSpec returns a string suitable for "git clone {spec}".
 func (x *RepoSpec) CloneSpec() string {
-	if isAzureHost(x.host) || isAWSHost(x.host) {
-		return x.host + x.orgRepo
+	if isAzureHost(x.Host) || isAWSHost(x.Host) {
+		return x.Host + x.OrgRepo
 	}
-	return x.host + x.orgRepo + gitSuffix
+	return x.Host + x.OrgRepo + x.GitSuffix
 }

-func (x *RepoSpec) CloneDir() fs.ConfirmedDir {
-	return x.cloneDir
+func (x *RepoSpec) CloneDir() filesys.ConfirmedDir {
+	return x.Dir
 }

 func (x *RepoSpec) Raw() string {
@@ -72,11 +63,11 @@ func (x *RepoSpec) Raw() string {
 }

 func (x *RepoSpec) AbsPath() string {
-	return x.cloneDir.Join(x.path)
+	return x.Dir.Join(x.Path)
 }

-func (x *RepoSpec) Cleaner(fSys fs.FileSystem) func() error {
-	return func() error { return fSys.RemoveAll(x.cloneDir.String()) }
+func (x *RepoSpec) Cleaner(fSys filesys.FileSystem) func() error {
+	return func() error { return fSys.RemoveAll(x.Dir.String()) }
 }

 // From strings like git@github.com:someOrg/someRepo.git or
@@ -86,7 +77,7 @@ func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
 	if filepath.IsAbs(n) {
 		return nil, fmt.Errorf("uri looks like abs path: %s", n)
 	}
-	host, orgRepo, path, gitRef := parseGithubUrl(n)
+	host, orgRepo, path, gitRef, gitSuffix := parseGitUrl(n)
 	if orgRepo == "" {
 		return nil, fmt.Errorf("url lacks orgRepo: %s", n)
 	}
@@ -94,22 +85,33 @@ func NewRepoSpecFromUrl(n string) (*RepoSpec, error) {
 		return nil, fmt.Errorf("url lacks host: %s", n)
 	}
 	return &RepoSpec{
-		raw: n, host: host, orgRepo: orgRepo,
-		cloneDir: notCloned, path: path, ref: gitRef}, nil
+		raw: n, Host: host, OrgRepo: orgRepo,
+		Dir: notCloned, Path: path, Ref: gitRef, GitSuffix: gitSuffix}, nil
 }

 const (
-	refQuery  = "?ref="
-	gitSuffix = ".git"
+	refQuery      = "?ref="
+	refQueryRegex = "\\?(version|ref)="
+	gitSuffix     = ".git"
+	gitDelimiter  = "_git/"
 )

 // From strings like git@github.com:someOrg/someRepo.git or
 // https://github.com/someOrg/someRepo?ref=someHash, extract
 // the parts.
-func parseGithubUrl(n string) (
-	host string, orgRepo string, path string, gitRef string) {
-	host, n = parseHostSpec(n)
+func parseGitUrl(n string) (
+	host string, orgRepo string, path string, gitRef string, gitSuff string) {

+	if strings.Contains(n, gitDelimiter) {
+		index := strings.Index(n, gitDelimiter)
+		// Adding _git/ to host
+		host = normalizeGitHostSpec(n[:index+len(gitDelimiter)])
+		orgRepo = strings.Split(strings.Split(n[index+len(gitDelimiter):], "/")[0], "?")[0]
+		path, gitRef = peelQuery(n[index+len(gitDelimiter)+len(orgRepo):])
+		return
+	}
+	host, n = parseHostSpec(n)
+	gitSuff = gitSuffix
 	if strings.Contains(n, gitSuffix) {
 		index := strings.Index(n, gitSuffix)
 		orgRepo = n[0:index]
@@ -120,24 +122,27 @@ func parseGithubUrl(n string) (

 	i := strings.Index(n, "/")
 	if i < 1 {
-		return "", "", "", ""
+		return "", "", "", "", ""
 	}
 	j := strings.Index(n[i+1:], "/")
 	if j >= 0 {
 		j += i + 1
 		orgRepo = n[:j]
 		path, gitRef = peelQuery(n[j+1:])
-	} else {
-		path = ""
-		orgRepo, gitRef = peelQuery(n)
+		return
 	}
-	return
+	path = ""
+	orgRepo, gitRef = peelQuery(n)
+	return host, orgRepo, path, gitRef, gitSuff
 }

 func peelQuery(arg string) (string, string) {
-	j := strings.Index(arg, refQuery)
-	if j >= 0 {
-		return arg[:j], arg[j+len(refQuery):]
+
+	r, _ := regexp.Compile(refQueryRegex)
+	j := r.FindStringIndex(arg)
+
+	if len(j) > 0 {
+		return arg[:j[0]], arg[j[0]+len(r.FindString(arg)):]
 	}
 	return arg, ""
 }
@@ -195,7 +200,7 @@ func normalizeGitHostSpec(host string) string {
 		}
 	}
 	if strings.HasPrefix(s, "git::") {
-		host = strings.TrimLeft(s, "git::")
+		host = strings.TrimPrefix(s, "git::")
 	}
 	return host
 }
--- a/api/git/repospec_test.go
+++ b/api/git/repospec_test.go
@@ -1,18 +1,5 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package git

@@ -72,17 +59,17 @@ func TestNewRepoSpecFromUrl(t *testing.T) {
 					if err != nil {
 						t.Errorf("problem %v", err)
 					}
-					if rs.host != hostSpec {
-						bad = append(bad, []string{"host", uri, rs.host, hostSpec})
+					if rs.Host != hostSpec {
+						bad = append(bad, []string{"host", uri, rs.Host, hostSpec})
 					}
-					if rs.orgRepo != orgRepo {
-						bad = append(bad, []string{"orgRepo", uri, rs.orgRepo, orgRepo})
+					if rs.OrgRepo != orgRepo {
+						bad = append(bad, []string{"orgRepo", uri, rs.OrgRepo, orgRepo})
 					}
-					if rs.path != pathName {
-						bad = append(bad, []string{"path", uri, rs.path, pathName})
+					if rs.Path != pathName {
+						bad = append(bad, []string{"path", uri, rs.Path, pathName})
 					}
-					if rs.ref != hrefArg {
-						bad = append(bad, []string{"ref", uri, rs.ref, hrefArg})
+					if rs.Ref != hrefArg {
+						bad = append(bad, []string{"ref", uri, rs.Ref, hrefArg})
 					}
 				}
 			}
@@ -169,6 +156,30 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 			absPath:   notCloned.Join("path"),
 			ref:       "branch",
 		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "",
+		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos?version=v1.0.0",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "v1.0.0",
+		},
+		{
+			input:     "https://itfs.mycompany.com/collection/project/_git/somerepos/somedir?version=v1.0.0",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.Join("somedir"),
+			ref:       "v1.0.0",
+		},
+		{
+			input:     "git::https://itfs.mycompany.com/collection/project/_git/somerepos",
+			cloneSpec: "https://itfs.mycompany.com/collection/project/_git/somerepos",
+			absPath:   notCloned.String(),
+			ref:       "",
+		},
 	}
 	for _, testcase := range testcases {
 		rs, err := NewRepoSpecFromUrl(testcase.input)
@@ -183,9 +194,9 @@ func TestNewRepoSpecFromUrl_CloneSpecs(t *testing.T) {
 			t.Errorf("AbsPath expected to be %v, but got %v on %s",
 				testcase.absPath, rs.AbsPath(), testcase.input)
 		}
-		if rs.ref != testcase.ref {
+		if rs.Ref != testcase.ref {
 			t.Errorf("ref expected to be %v, but got %v on %s",
-				testcase.ref, rs.ref, testcase.input)
+				testcase.ref, rs.Ref, testcase.input)
 		}
 	}
 }
@@ -220,6 +231,32 @@ func TestIsAzureHost(t *testing.T) {
 	}
 }

+func TestPeelQuery(t *testing.T) {
+	testcases := []struct {
+		input  string
+		expect [2]string
+	}{
+		{
+			input:  "somerepos?ref=v1.0.0",
+			expect: [2]string{"somerepos", "v1.0.0"},
+		},
+		{
+			input:  "somerepos?version=master",
+			expect: [2]string{"somerepos", "master"},
+		},
+		{
+			input:  "somerepos",
+			expect: [2]string{"somerepos", ""},
+		},
+	}
+	for _, testcase := range testcases {
+		path, ref := peelQuery(testcase.input)
+		if path != testcase.expect[0] || ref != testcase.expect[1] {
+			t.Errorf("peelQuery: expected (%s, %s) got (%s, %s) on %s", testcase.expect[0], testcase.expect[1], path, ref, testcase.input)
+		}
+	}
+}
+
 func TestIsAWSHost(t *testing.T) {
 	testcases := []struct {
 		input  string
--- a/api/go.mod
+++ b/api/go.mod
@@ -0,0 +1,21 @@
+module sigs.k8s.io/kustomize/api
+
+go 1.13
+
+require (
+	github.com/evanphx/json-patch v4.5.0+incompatible
+	github.com/go-openapi/spec v0.19.4
+	github.com/golang/protobuf v1.3.2 // indirect
+	github.com/pkg/errors v0.8.1
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.4.0 // indirect
+	golang.org/x/net v0.0.0-20190923162816-aa69164e4478 // indirect
+	golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 // indirect
+	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	gopkg.in/yaml.v2 v2.2.4
+	k8s.io/api v0.0.0-20191016225839-816a9b7df678
+	k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5
+	k8s.io/client-go v11.0.0+incompatible
+	k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d
+	sigs.k8s.io/yaml v1.1.0
+)
--- a/api/go.sum
+++ b/api/go.sum
@@ -0,0 +1,162 @@
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633 h1:H2pdYOb3KQ1/YsqVWoWNLQO+fusocsw354rqGTZtAgw=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
+github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.19.2 h1:o20suLFB4Ri0tuzpWtyHlh7E7HnkqTNLq6aR6WVNS1w=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.19.4 h1:ixzUSnHTd6hCemgtAJgluaTSGYpLNpJY4mA2DIkdOAo=
+github.com/go-openapi/spec v0.19.4/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d h1:7XGaL1e6bYS1yIonGp9761ExpPPV1ui0SAC59Yube9k=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e h1:hB2xlXdHp/pmPZq0y3QnmWAArdw9PqbmotexnWx/FU8=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
+github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o=
+gopkg.in/inf.v0 v0.9.0/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+k8s.io/api v0.0.0-20191016225839-816a9b7df678 h1:z/0BV/tMBIvdwZvqBH/f7TWjQX9y3dj1nMNhrSK0h/8=
+k8s.io/api v0.0.0-20191016225839-816a9b7df678/go.mod h1:LZQaT8MvVpl7Bg2lYFcQm7+Mpdxq8p1NFl3yh+5DCwY=
+k8s.io/apimachinery v0.0.0-20191016225534-b1267f8c42b4/go.mod h1:92mWDd8Ji2sw2157KIgino5wCxffA8KSvhW2oY4ypdw=
+k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5 h1:r3/YL3+t1U46lJF5zUSArskUpnLyWuM28rQDpM1qQPI=
+k8s.io/apimachinery v0.0.0-20191020214737-6c8691705fc5/go.mod h1:92mWDd8Ji2sw2157KIgino5wCxffA8KSvhW2oY4ypdw=
+k8s.io/client-go v11.0.0+incompatible h1:LBbX2+lOwY9flffWlJM7f1Ct8V2SRNiMRDFeiwnJo9o=
+k8s.io/client-go v11.0.0+incompatible/go.mod h1:7vJpHMYJwNQCWgzmNV+VYUl1zCObLyodBc8nIyt8L5s=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
+k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d h1:Xpe6sK+RY4ZgCTyZ3y273UmFmURhjtoJiwOMbQsXitY=
+k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
--- a/api/hasher/hasher.go
+++ b/api/hasher/hasher.go
@@ -0,0 +1,52 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package hasher
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"sort"
+)
+
+// SortArrayAndComputeHash sorts a string array and
+// returns a hash for it
+func SortArrayAndComputeHash(s []string) (string, error) {
+	sort.Strings(s)
+	data, err := json.Marshal(s)
+	if err != nil {
+		return "", err
+	}
+	return Encode(Hash(string(data)))
+}
+
+// Copied from https://github.com/kubernetes/kubernetes
+// /blob/master/pkg/kubectl/util/hash/hash.go
+func Encode(hex string) (string, error) {
+	if len(hex) < 10 {
+		return "", fmt.Errorf(
+			"input length must be at least 10")
+	}
+	enc := []rune(hex[:10])
+	for i := range enc {
+		switch enc[i] {
+		case '0':
+			enc[i] = 'g'
+		case '1':
+			enc[i] = 'h'
+		case '3':
+			enc[i] = 'k'
+		case 'a':
+			enc[i] = 'm'
+		case 'e':
+			enc[i] = 't'
+		}
+	}
+	return string(enc), nil
+}
+
+// Hash returns the hex form of the sha256 of the argument.
+func Hash(data string) string {
+	return fmt.Sprintf("%x", sha256.Sum256([]byte(data)))
+}
--- a/api/hasher/hasher_test.go
+++ b/api/hasher/hasher_test.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package hasher_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/hasher"
+)
+
+func TestSortArrayAndComputeHash(t *testing.T) {
+	array1 := []string{"a", "b", "c", "d"}
+	array2 := []string{"c", "b", "d", "a"}
+	h1, err := SortArrayAndComputeHash(array1)
+	if err != nil {
+		t.Errorf("unexpected error %v", err)
+	}
+	if h1 == "" {
+		t.Errorf("failed to hash %v", array1)
+	}
+	h2, err := SortArrayAndComputeHash(array2)
+	if err != nil {
+		t.Errorf("unexpected error %v", err)
+	}
+	if h2 == "" {
+		t.Errorf("failed to hash %v", array2)
+	}
+	if h1 != h2 {
+		t.Errorf("hash is not consistent with reordered list: %s %s", h1, h2)
+	}
+}
+
+func TestHash(t *testing.T) {
+	// hash the empty string to be sure that sha256 is being used
+	expect := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+	sum := Hash("")
+	if expect != sum {
+		t.Errorf("expected hash %q but got %q", expect, sum)
+	}
+}
--- a/api/ifc/ifc.go
+++ b/api/ifc/ifc.go
@@ -0,0 +1,95 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package ifc holds miscellaneous interfaces used by kustomize.
+package ifc
+
+import (
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// Validator provides functions to validate annotations and labels
+type Validator interface {
+	MakeAnnotationValidator() func(map[string]string) error
+	MakeAnnotationNameValidator() func([]string) error
+	MakeLabelValidator() func(map[string]string) error
+	MakeLabelNameValidator() func([]string) error
+	ValidateNamespace(string) []string
+	ErrIfInvalidKey(string) error
+	IsEnvVarName(k string) error
+}
+
+// KvLoader reads and validates KV pairs.
+type KvLoader interface {
+	Validator() Validator
+	Load(args types.KvPairSources) (all []types.Pair, err error)
+}
+
+// Loader interface exposes methods to read bytes.
+type Loader interface {
+	// Root returns the root location for this Loader.
+	Root() string
+	// New returns Loader located at newRoot.
+	New(newRoot string) (Loader, error)
+	// Load returns the bytes read from the location or an error.
+	Load(location string) ([]byte, error)
+	// Cleanup cleans the loader
+	Cleanup() error
+}
+
+// Kunstructured allows manipulation of k8s objects
+// that do not have Golang structs.
+type Kunstructured interface {
+	Map() map[string]interface{}
+	SetMap(map[string]interface{})
+	Copy() Kunstructured
+	GetFieldValue(string) (interface{}, error)
+	GetString(string) (string, error)
+	GetStringSlice(string) ([]string, error)
+	GetBool(path string) (bool, error)
+	GetFloat64(path string) (float64, error)
+	GetInt64(path string) (int64, error)
+	GetSlice(path string) ([]interface{}, error)
+	GetStringMap(path string) (map[string]string, error)
+	GetMap(path string) (map[string]interface{}, error)
+	MarshalJSON() ([]byte, error)
+	UnmarshalJSON([]byte) error
+	GetGvk() resid.Gvk
+	SetGvk(resid.Gvk)
+	GetKind() string
+	GetName() string
+	SetName(string)
+	SetNamespace(string)
+	GetLabels() map[string]string
+	SetLabels(map[string]string)
+	GetAnnotations() map[string]string
+	SetAnnotations(map[string]string)
+	MatchesLabelSelector(selector string) (bool, error)
+	MatchesAnnotationSelector(selector string) (bool, error)
+	Patch(Kunstructured) error
+}
+
+// KunstructuredFactory makes instances of Kunstructured.
+type KunstructuredFactory interface {
+	SliceFromBytes([]byte) ([]Kunstructured, error)
+	FromMap(m map[string]interface{}) Kunstructured
+	Hasher() KunstructuredHasher
+	MakeConfigMap(
+		kvLdr KvLoader,
+		options *types.GeneratorOptions,
+		args *types.ConfigMapArgs) (Kunstructured, error)
+	MakeSecret(
+		kvLdr KvLoader,
+		options *types.GeneratorOptions,
+		args *types.SecretArgs) (Kunstructured, error)
+}
+
+// KunstructuredHasher returns a hash of the argument
+// or an error.
+type KunstructuredHasher interface {
+	Hash(Kunstructured) (string, error)
+}
+
+// See core.v1.SecretTypeOpaque
+const SecretTypeOpaque = "Opaque"
--- a/api/internal/accumulator/expansion/expand.go
+++ b/api/internal/accumulator/expansion/expand.go
@@ -1,24 +1,12 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 // Package expansion provides functions find and replace $(FOO) style variables in strings.
 package expansion

 import (
 	"bytes"
+	"fmt"
 )

 const (
@@ -38,13 +26,18 @@ func syntaxWrap(input string) string {
 // for the input is found.
 func MappingFuncFor(
 	counts map[string]int,
-	context ...map[string]string) func(string) string {
-	return func(input string) string {
+	context ...map[string]interface{}) func(string) interface{} {
+	return func(input string) interface{} {
 		for _, vars := range context {
 			val, ok := vars[input]
 			if ok {
 				counts[input]++
-				return val
+				switch typedV := val.(type) {
+				case string, int64, float64, bool:
+					return typedV
+				default:
+					return syntaxWrap(input)
+				}
 			}
 		}
 		return syntaxWrap(input)
@@ -54,7 +47,7 @@ func MappingFuncFor(
 // Expand replaces variable references in the input string according to
 // the expansion spec using the given mapping function to resolve the
 // values of variables.
-func Expand(input string, mapping func(string) string) string {
+func Expand(input string, mapping func(string) interface{}) interface{} {
 	var buf bytes.Buffer
 	checkpoint := 0
 	for cursor := 0; cursor < len(input); cursor++ {
@@ -71,7 +64,14 @@ func Expand(input string, mapping func(string) string) string {
 				// We were able to read a variable name correctly;
 				// apply the mapping to the variable name and copy the
 				// bytes into the buffer
-				buf.WriteString(mapping(read))
+				mapped := mapping(read)
+				if input == syntaxWrap(read) {
+					// Preserve the type of variable
+					return mapped
+				}
+
+				// Variable is used in a middle of a string
+				buf.WriteString(fmt.Sprintf("%v", mapped))
 			} else {
 				// Not a variable name; copy the read bytes into the buffer
 				buf.WriteString(read)
--- a/api/internal/accumulator/expansion/expand_test.go
+++ b/api/internal/accumulator/expansion/expand_test.go
@@ -1,25 +1,13 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package expansion_test

 import (
+	"fmt"
 	"testing"

-	. "sigs.k8s.io/kustomize/pkg/expansion"
+	. "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
 )

 type expected struct {
@@ -30,7 +18,7 @@ type expected struct {
 func TestMapReference(t *testing.T) {
 	type env struct {
 		Name  string
-		Value string
+		Value interface{}
 	}
 	envs := []env{
 		{
@@ -45,25 +33,49 @@ func TestMapReference(t *testing.T) {
 			Name:  "BLU",
 			Value: "$(ZOO)-2",
 		},
+		{
+			Name:  "INT",
+			Value: 2,
+		},
+		{
+			Name:  "ZINT",
+			Value: "$(INT)",
+		},
+		{
+			Name:  "BOOL",
+			Value: true,
+		},
+		{
+			Name:  "ZBOOL",
+			Value: "$(BOOL)",
+		},
 	}

-	declaredEnv := map[string]string{
-		"FOO": "bar",
-		"ZOO": "$(FOO)-1",
-		"BLU": "$(ZOO)-2",
+	declaredEnv := map[string]interface{}{
+		"FOO":   "bar",
+		"ZOO":   "$(FOO)-1",
+		"BLU":   "$(ZOO)-2",
+		"INT":   "2",
+		"ZINT":  "$(INT)",
+		"BOOL":  "true",
+		"ZBOOL": "$(BOOL)",
 	}

 	counts := make(map[string]int)
 	mapping := MappingFuncFor(counts, declaredEnv)

 	for _, env := range envs {
-		declaredEnv[env.Name] = Expand(env.Value, mapping)
+		declaredEnv[env.Name] = Expand(fmt.Sprintf("%v", env.Value), mapping)
 	}

 	expectedEnv := map[string]expected{
-		"FOO": {count: 1, edited: "bar"},
-		"ZOO": {count: 1, edited: "bar-1"},
-		"BLU": {count: 0, edited: "bar-1-2"},
+		"FOO":   {count: 1, edited: "bar"},
+		"ZOO":   {count: 1, edited: "bar-1"},
+		"BLU":   {count: 0, edited: "bar-1-2"},
+		"INT":   {count: 1, edited: "2"},
+		"ZINT":  {count: 0, edited: "2"},
+		"BOOL":  {count: 1, edited: "true"},
+		"ZBOOL": {count: 0, edited: "true"},
 	}

 	for k, v := range expectedEnv {
@@ -81,7 +93,7 @@ func TestMapReference(t *testing.T) {
 }

 func TestMapping(t *testing.T) {
-	context := map[string]string{
+	context := map[string]interface{}{
 		"VAR_A":     "A",
 		"VAR_B":     "B",
 		"VAR_C":     "C",
@@ -92,11 +104,11 @@ func TestMapping(t *testing.T) {
 }

 func TestMappingDual(t *testing.T) {
-	context := map[string]string{
+	context := map[string]interface{}{
 		"VAR_A":     "A",
 		"VAR_EMPTY": "",
 	}
-	context2 := map[string]string{
+	context2 := map[string]interface{}{
 		"VAR_B":   "B",
 		"VAR_C":   "C",
 		"VAR_REF": "$(VAR_A)",
@@ -105,7 +117,7 @@ func TestMappingDual(t *testing.T) {
 	doExpansionTest(t, context, context2)
 }

-func doExpansionTest(t *testing.T, context ...map[string]string) {
+func doExpansionTest(t *testing.T, context ...map[string]interface{}) {
 	cases := []struct {
 		name     string
 		input    string
@@ -325,7 +337,7 @@ func doExpansionTest(t *testing.T, context ...map[string]string) {
 	for _, tc := range cases {
 		counts := make(map[string]int)
 		mapping := MappingFuncFor(counts, context...)
-		expanded := Expand(tc.input, mapping)
+		expanded := Expand(fmt.Sprintf("%v", tc.input), mapping)
 		if e, a := tc.expected, expanded; e != a {
 			t.Errorf("%v: expected %q, got %q", tc.name, e, a)
 		}
--- a/api/internal/accumulator/loadconfigfromcrds.go
+++ b/api/internal/accumulator/loadconfigfromcrds.go
@@ -1,31 +1,20 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
+package accumulator

 import (
 	"encoding/json"
 	"strings"

-	"github.com/ghodss/yaml"
 	"github.com/go-openapi/spec"
 	"github.com/pkg/errors"
 	"k8s.io/kube-openapi/pkg/common"
-	"sigs.k8s.io/kustomize/pkg/gvk"
-	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
 )

 type myProperties map[string]spec.Schema
@@ -33,8 +22,8 @@ type nameToApiMap map[string]common.OpenAPIDefinition

 // LoadConfigFromCRDs parse CRD schemas from paths into a TransformerConfig
 func LoadConfigFromCRDs(
-	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
-	tc := MakeEmptyConfig()
+	ldr ifc.Loader, paths []string) (*builtinconfig.TransformerConfig, error) {
+	tc := builtinconfig.MakeEmptyConfig()
 	for _, path := range paths {
 		content, err := ldr.Load(path)
 		if err != nil {
@@ -65,13 +54,13 @@ func makeNameToApiMap(content []byte) (result nameToApiMap, err error) {
 	return
 }

-func makeConfigFromApiMap(m nameToApiMap) (*TransformerConfig, error) {
-	result := MakeEmptyConfig()
+func makeConfigFromApiMap(m nameToApiMap) (*builtinconfig.TransformerConfig, error) {
+	result := builtinconfig.MakeEmptyConfig()
 	for name, api := range m {
 		if !looksLikeAk8sType(api.Schema.SchemaProps.Properties) {
 			continue
 		}
-		tc := MakeEmptyConfig()
+		tc := builtinconfig.MakeEmptyConfig()
 		err := loadCrdIntoConfig(
 			tc, makeGvkFromTypeName(name), m, name, []string{})
 		if err != nil {
@@ -88,10 +77,10 @@ func makeConfigFromApiMap(m nameToApiMap) (*TransformerConfig, error) {
 // TODO: Get Group and Version for CRD from the
 // openAPI definition once
 // "x-kubernetes-group-version-kind" is available in CRD
-func makeGvkFromTypeName(n string) gvk.Gvk {
+func makeGvkFromTypeName(n string) resid.Gvk {
 	names := strings.Split(n, ".")
 	kind := names[len(names)-1]
-	return gvk.Gvk{Kind: kind}
+	return resid.Gvk{Kind: kind}
 }

 func looksLikeAk8sType(properties myProperties) bool {
@@ -133,7 +122,7 @@ const (

 // loadCrdIntoConfig loads a CRD spec into a TransformerConfig
 func loadCrdIntoConfig(
-	theConfig *TransformerConfig, theGvk gvk.Gvk, theMap nameToApiMap,
+	theConfig *builtinconfig.TransformerConfig, theGvk resid.Gvk, theMap nameToApiMap,
 	typeName string, path []string) (err error) {
 	api, ok := theMap[typeName]
 	if !ok {
@@ -173,9 +162,9 @@ func loadCrdIntoConfig(
 					nameKey = "name"
 				}
 				err = theConfig.AddNamereferenceFieldSpec(
-					NameBackReferences{
-						Gvk: gvk.Gvk{Kind: kind, Version: version},
-						FieldSpecs: []FieldSpec{
+					builtinconfig.NameBackReferences{
+						Gvk: resid.Gvk{Kind: kind, Version: version},
+						FieldSpecs: []types.FieldSpec{
 							makeFs(theGvk, append(path, propName, nameKey))},
 					})
 				if err != nil {
@@ -192,8 +181,8 @@ func loadCrdIntoConfig(
 	return nil
 }

-func makeFs(in gvk.Gvk, path []string) FieldSpec {
-	return FieldSpec{
+func makeFs(in resid.Gvk, path []string) types.FieldSpec {
+	return types.FieldSpec{
 		CreateIfNotPresent: false,
 		Gvk:                in,
 		Path:               strings.Join(path, "/"),
--- a/api/internal/accumulator/loadconfigfromcrds_test.go
+++ b/api/internal/accumulator/loadconfigfromcrds_test.go
@@ -1,28 +1,18 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
+package accumulator_test

 import (
 	"reflect"
 	"testing"

-	"sigs.k8s.io/kustomize/pkg/gvk"
-	"sigs.k8s.io/kustomize/pkg/ifc"
-	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
+	"sigs.k8s.io/kustomize/api/ifc"
+	. "sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/internal/loadertest"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
 )

 // This defines two CRD's:  Bee and MyKind.
@@ -155,30 +145,30 @@ func makeLoader(t *testing.T) ifc.Loader {
 }

 func TestLoadCRDs(t *testing.T) {
-	nbrs := []NameBackReferences{
+	nbrs := []builtinconfig.NameBackReferences{
 		{
-			Gvk: gvk.Gvk{Kind: "Secret", Version: "v1"},
-			FieldSpecs: []FieldSpec{
+			Gvk: resid.Gvk{Kind: "Secret", Version: "v1"},
+			FieldSpecs: []types.FieldSpec{
 				{
 					CreateIfNotPresent: false,
-					Gvk:                gvk.Gvk{Kind: "MyKind"},
+					Gvk:                resid.Gvk{Kind: "MyKind"},
 					Path:               "spec/secretRef/name",
 				},
 			},
 		},
 		{
-			Gvk: gvk.Gvk{Kind: "Bee", Version: "v1beta1"},
-			FieldSpecs: []FieldSpec{
+			Gvk: resid.Gvk{Kind: "Bee", Version: "v1beta1"},
+			FieldSpecs: []types.FieldSpec{
 				{
 					CreateIfNotPresent: false,
-					Gvk:                gvk.Gvk{Kind: "MyKind"},
+					Gvk:                resid.Gvk{Kind: "MyKind"},
 					Path:               "spec/beeRef/name",
 				},
 			},
 		},
 	}

-	expectedTc := &TransformerConfig{
+	expectedTc := &builtinconfig.TransformerConfig{
 		NameReference: nbrs,
 	}

--- a/api/internal/accumulator/namereferencetransformer.go
+++ b/api/internal/accumulator/namereferencetransformer.go
@@ -0,0 +1,274 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+	"log"
+
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/transform"
+)
+
+type nameReferenceTransformer struct {
+	backRefs []builtinconfig.NameBackReferences
+}
+
+var _ resmap.Transformer = &nameReferenceTransformer{}
+
+// newNameReferenceTransformer constructs a nameReferenceTransformer
+// with a given slice of NameBackReferences.
+func newNameReferenceTransformer(br []builtinconfig.NameBackReferences) resmap.Transformer {
+	if br == nil {
+		log.Fatal("backrefs not expected to be nil")
+	}
+	return &nameReferenceTransformer{backRefs: br}
+}
+
+// Transform updates name references in resource A that
+// refer to resource B, given that B's name may have
+// changed.
+//
+// For example, a HorizontalPodAutoscaler (HPA)
+// necessarily refers to a Deployment, the thing that
+// the HPA scales. The Deployment name might change
+// (e.g. prefix added), and the reference in the HPA
+// has to be fixed.
+//
+// In the outer loop over the ResMap below, say we
+// encounter a specific HPA. Then, in scanning backrefs,
+// we encounter an entry like
+//
+//   - kind: Deployment
+//     fieldSpecs:
+//     - kind: HorizontalPodAutoscaler
+//       path: spec/scaleTargetRef/name
+//
+// This entry says that an HPA, via its
+// 'spec/scaleTargetRef/name' field, may refer to a
+// Deployment.  This match to HPA means we may need to
+// modify the value in its 'spec/scaleTargetRef/name'
+// field, by searching for the thing it refers to,
+// and getting its new name.
+//
+// As a filter, and search optimization, we compute a
+// subset of all resources that the HPA could refer to,
+// by excluding objects from other namespaces, and
+// excluding objects that don't have the same prefix-
+// suffix mods as the HPA.
+//
+// We look in this subset for all Deployment objects
+// with a resId that has a Name matching the field value
+// present in the HPA.  If no match do nothing; if more
+// than one match, it's an error.
+//
+// We overwrite the HPA name field with the value found
+// in the Deployment's name field (the name in the raw
+// object - the modified name - not the unmodified name
+// in the Deployment's resId).
+//
+// This process assumes that the name stored in a ResId
+// (the ResMap key) isn't modified by name transformers.
+// Name transformers should only modify the name in the
+// body of the resource object (the value in the ResMap).
+//
+func (o *nameReferenceTransformer) Transform(m resmap.ResMap) error {
+	// TODO: Too much looping, here and in transitive calls.
+	for _, referrer := range m.Resources() {
+		var candidates resmap.ResMap
+		for _, target := range o.backRefs {
+			for _, fSpec := range target.FieldSpecs {
+				if referrer.OrgId().IsSelected(&fSpec.Gvk) {
+					if candidates == nil {
+						candidates = m.SubsetThatCouldBeReferencedByResource(referrer)
+					}
+					err := transform.MutateField(
+						referrer.Map(),
+						fSpec.PathSlice(),
+						fSpec.CreateIfNotPresent,
+						o.getNewNameFunc(
+							// referrer could be an HPA instance,
+							// target could be Gvk for Deployment,
+							// candidate a list of resources "reachable"
+							// from the HPA.
+							referrer, target.Gvk, candidates))
+					if err != nil {
+						return err
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// selectReferral picks the referral among a subset of candidates.
+// It returns the current name and namespace of the selected candidate.
+// Note that the content of the referricalCandidateSubset slice is most of the time
+// identical to the referralCandidates resmap. Still in some cases, such
+// as ClusterRoleBinding, the subset only contains the resources of a specific
+// namespace.
+func (o *nameReferenceTransformer) selectReferral(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (interface{}, interface{}, error) {
+
+	for _, res := range referralCandidateSubset {
+		id := res.OrgId()
+		if id.IsSelected(&target) && res.GetOriginalName() == oldName {
+			matches := referralCandidates.GetMatchingResourcesByOriginalId(id.Equals)
+			// If there's more than one match, there's no way
+			// to know which one to pick, so emit error.
+			if len(matches) > 1 {
+				return nil, nil, fmt.Errorf(
+					"multiple matches for %s:\n  %v",
+					id, getIds(matches))
+			}
+			// In the resource, note that it is referenced
+			// by the referrer.
+			res.AppendRefBy(referrer.CurId())
+			// Return transformed name of the object,
+			// complete with prefixes, hashes, etc.
+			return res.GetName(), res.GetNamespace(), nil
+		}
+	}
+
+	return oldName, nil, nil
+}
+
+// utility function to replace a simple string by the new name
+func (o *nameReferenceTransformer) getSimpleNameField(
+	oldName string,
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap,
+	referralCandidateSubset []*resource.Resource) (interface{}, error) {
+
+	newName, _, err := o.selectReferral(oldName, referrer, target,
+		referralCandidates, referralCandidateSubset)
+
+	return newName, err
+}
+
+// utility function to replace name field within a map[string]interface{}
+// and leverage the namespace field.
+func (o *nameReferenceTransformer) getNameAndNsStruct(
+	inMap map[string]interface{},
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap) (interface{}, error) {
+
+	// Example:
+	if _, ok := inMap["name"]; !ok {
+		return nil, fmt.Errorf(
+			"%#v is expected to contain a name field", inMap)
+	}
+	oldName, ok := inMap["name"].(string)
+	if !ok {
+		return nil, fmt.Errorf(
+			"%#v is expected to contain a name field of type string", oldName)
+	}
+
+	subset := referralCandidates.Resources()
+	if namespacevalue, ok := inMap["namespace"]; ok {
+		namespace := namespacevalue.(string)
+		bynamespace := referralCandidates.GroupedByOriginalNamespace()
+		if _, ok := bynamespace[namespace]; !ok {
+			return inMap, nil
+		}
+		subset = bynamespace[namespace]
+	}
+
+	newname, newnamespace, err := o.selectReferral(oldName, referrer, target,
+		referralCandidates, subset)
+	if err != nil {
+		return nil, err
+	}
+
+	if (newname == oldName) && (newnamespace == nil) {
+		// no candidate found.
+		return inMap, nil
+	}
+
+	inMap["name"] = newname
+	if newnamespace != "" {
+		// We don't want value "" to replace value "default" since
+		// the empty string is handled as a wild card here not default namespace
+		// by kubernetes.
+		inMap["namespace"] = newnamespace
+	}
+	return inMap, nil
+
+}
+
+func (o *nameReferenceTransformer) getNewNameFunc(
+	referrer *resource.Resource,
+	target resid.Gvk,
+	referralCandidates resmap.ResMap) func(in interface{}) (interface{}, error) {
+	return func(in interface{}) (interface{}, error) {
+		switch in.(type) {
+		case string:
+			oldName, _ := in.(string)
+			return o.getSimpleNameField(oldName, referrer, target,
+				referralCandidates, referralCandidates.Resources())
+		case map[string]interface{}:
+			// Kind: ValidatingWebhookConfiguration
+			// FieldSpec is webhooks/clientConfig/service
+			oldMap, _ := in.(map[string]interface{})
+			return o.getNameAndNsStruct(oldMap, referrer, target,
+				referralCandidates)
+		case []interface{}:
+			l, _ := in.([]interface{})
+			for idx, item := range l {
+				switch item.(type) {
+				case string:
+					// Kind: Role/ClusterRole
+					// FieldSpec is rules.resourceNames
+					oldName, _ := item.(string)
+					newName, err := o.getSimpleNameField(oldName, referrer, target,
+						referralCandidates, referralCandidates.Resources())
+					if err != nil {
+						return nil, err
+					}
+					l[idx] = newName
+				case map[string]interface{}:
+					// Kind: RoleBinding/ClusterRoleBinding
+					// FieldSpec is subjects
+					// Note: The corresponding fieldSpec had been changed from
+					// from path: subjects/name to just path: subjects. This is
+					// what get mutatefield to request the mapping of the whole
+					// map containing namespace and name instead of just a simple
+					// string field containing the name
+					oldMap, _ := item.(map[string]interface{})
+					newMap, err := o.getNameAndNsStruct(oldMap, referrer, target,
+						referralCandidates)
+					if err != nil {
+						return nil, err
+					}
+					l[idx] = newMap
+				default:
+					return nil, fmt.Errorf(
+						"%#v is expected to be either a []string or a []map[string]interface{}", in)
+				}
+			}
+			return in, nil
+		default:
+			return nil, fmt.Errorf(
+				"%#v is expected to be either a string or a []interface{}", in)
+		}
+	}
+}
+
+func getIds(rs []*resource.Resource) []string {
+	var result []string
+	for _, r := range rs {
+		result = append(result, r.CurId().String()+"\n")
+	}
+	return result
+}
--- a/api/internal/accumulator/namereferencetransformer_test.go
+++ b/api/internal/accumulator/namereferencetransformer_test.go
--- a/api/internal/accumulator/refvartransformer.go
+++ b/api/internal/accumulator/refvartransformer.go
@@ -0,0 +1,110 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+
+	expansion2 "sigs.k8s.io/kustomize/api/internal/accumulator/expansion"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+type refVarTransformer struct {
+	varMap            map[string]interface{}
+	replacementCounts map[string]int
+	fieldSpecs        []types.FieldSpec
+	mappingFunc       func(string) interface{}
+}
+
+// newRefVarTransformer returns a new refVarTransformer
+// that replaces $(VAR) style variables with values.
+// The fieldSpecs are the places to look for occurrences of $(VAR).
+func newRefVarTransformer(
+	varMap map[string]interface{}, fs []types.FieldSpec) *refVarTransformer {
+	return &refVarTransformer{
+		varMap:     varMap,
+		fieldSpecs: fs,
+	}
+}
+
+// replaceVars accepts as 'in' a string, or string array, which can have
+// embedded instances of $VAR style variables, e.g. a container command string.
+// The function returns the string with the variables expanded to their final
+// values.
+func (rv *refVarTransformer) replaceVars(in interface{}) (interface{}, error) {
+	switch vt := in.(type) {
+	case []interface{}:
+		var xs []interface{}
+		for _, a := range in.([]interface{}) {
+			xs = append(xs, expansion2.Expand(a.(string), rv.mappingFunc))
+		}
+		return xs, nil
+	case map[string]interface{}:
+		inMap := in.(map[string]interface{})
+		xs := make(map[string]interface{}, len(inMap))
+		for k, v := range inMap {
+			s, ok := v.(string)
+			if !ok {
+				// This field not contain a $(VAR) since it is not
+				// of string type. For instance .spec.replicas: 3 in
+				// a Deployment object
+				xs[k] = v
+			} else {
+				// This field can potentially contains a $(VAR) since it is
+				// of string type. For instance .spec.replicas: $(REPLICAS)
+				// in a Deployment object
+				xs[k] = expansion2.Expand(s, rv.mappingFunc)
+			}
+		}
+		return xs, nil
+	case interface{}:
+		s, ok := in.(string)
+		if !ok {
+			// This field not contain a $(VAR) since it is not of string type.
+			return in, nil
+		}
+		// This field can potentially contain a $(VAR) since it is
+		// of string type.
+		return expansion2.Expand(s, rv.mappingFunc), nil
+	case nil:
+		return nil, nil
+	default:
+		return "", fmt.Errorf("invalid type encountered %T", vt)
+	}
+}
+
+// UnusedVars returns slice of Var names that were unused
+// after a Transform run.
+func (rv *refVarTransformer) UnusedVars() []string {
+	var unused []string
+	for k := range rv.varMap {
+		_, ok := rv.replacementCounts[k]
+		if !ok {
+			unused = append(unused, k)
+		}
+	}
+	return unused
+}
+
+// Transform replaces $(VAR) style variables with values.
+func (rv *refVarTransformer) Transform(m resmap.ResMap) error {
+	rv.replacementCounts = make(map[string]int)
+	rv.mappingFunc = expansion2.MappingFuncFor(
+		rv.replacementCounts, rv.varMap)
+	for _, res := range m.Resources() {
+		for _, fieldSpec := range rv.fieldSpecs {
+			if res.OrgId().IsSelected(&fieldSpec.Gvk) {
+				if err := transform.MutateField(
+					res.Map(), fieldSpec.PathSlice(),
+					false, rv.replaceVars); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
--- a/api/internal/accumulator/refvartransformer_test.go
+++ b/api/internal/accumulator/refvartransformer_test.go
@@ -0,0 +1,137 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/testutils/resmaptest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestRefVarTransformer(t *testing.T) {
+	type given struct {
+		varMap map[string]interface{}
+		fs     []types.FieldSpec
+		res    resmap.ResMap
+	}
+	type expected struct {
+		res    resmap.ResMap
+		unused []string
+	}
+	testCases := []struct {
+		description string
+		given       given
+		expected    expected
+	}{
+		{
+			description: "var replacement in map[string]",
+			given: given{
+				varMap: map[string]interface{}{
+					"FOO": "replacementForFoo",
+					"BAR": "replacementForBar",
+					"BAZ": int64(5),
+					"BOO": true,
+				},
+				fs: []types.FieldSpec{
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/map"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/slice"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/interface"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/nil"},
+					{Gvk: resid.Gvk{Version: "v1", Kind: "ConfigMap"}, Path: "data/num"},
+				},
+				res: resmaptest_test.NewRmBuilder(
+					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"map": map[string]interface{}{
+								"item1": "$(FOO)",
+								"item2": "bla",
+								"item3": "$(BAZ)",
+								"item4": "$(BAZ)+$(BAZ)",
+								"item5": "$(BOO)",
+								"item6": "if $(BOO)",
+								"item7": 2019,
+							},
+							"slice": []interface{}{
+								"$(FOO)",
+								"bla",
+								"$(BAZ)",
+								"$(BAZ)+$(BAZ)",
+								"$(BOO)",
+								"if $(BOO)",
+							},
+							"interface": "$(FOO)",
+							"nil":       nil,
+							"num":       2019,
+						}}).ResMap(),
+			},
+			expected: expected{
+				res: resmaptest_test.NewRmBuilder(
+					t, resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())).
+					Add(map[string]interface{}{
+						"apiVersion": "v1",
+						"kind":       "ConfigMap",
+						"metadata": map[string]interface{}{
+							"name": "cm1",
+						},
+						"data": map[string]interface{}{
+							"map": map[string]interface{}{
+								"item1": "replacementForFoo",
+								"item2": "bla",
+								"item3": int64(5),
+								"item4": "5+5",
+								"item5": true,
+								"item6": "if true",
+								"item7": 2019,
+							},
+							"slice": []interface{}{
+								"replacementForFoo",
+								"bla",
+								int64(5),
+								"5+5",
+								true,
+								"if true",
+							},
+							"interface": "replacementForFoo",
+							"nil":       nil,
+							"num":       2019,
+						}}).ResMap(),
+				unused: []string{"BAR"},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			// arrange
+			tr := newRefVarTransformer(tc.given.varMap, tc.given.fs)
+
+			// act
+			err := tr.Transform(tc.given.res)
+
+			// assert
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+
+			a, e := tc.given.res, tc.expected.res
+			if !reflect.DeepEqual(a, e) {
+				err = e.ErrorIfNotEqualLists(a)
+				t.Fatalf("actual doesn't match expected: \nACTUAL:\n%v\nEXPECTED:\n%v\nERR: %v", a, e, err)
+			}
+
+		})
+	}
+}
--- a/api/internal/accumulator/resaccumulator.go
+++ b/api/internal/accumulator/resaccumulator.go
@@ -0,0 +1,166 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// ResAccumulator accumulates resources and the rules
+// used to customize those resources.  It's a ResMap
+// plus stuff needed to modify the ResMap.
+type ResAccumulator struct {
+	resMap  resmap.ResMap
+	tConfig *builtinconfig.TransformerConfig
+	varSet  types.VarSet
+}
+
+func MakeEmptyAccumulator() *ResAccumulator {
+	ra := &ResAccumulator{}
+	ra.resMap = resmap.New()
+	ra.tConfig = &builtinconfig.TransformerConfig{}
+	ra.varSet = types.NewVarSet()
+	return ra
+}
+
+// ResMap returns a copy of the internal resMap.
+func (ra *ResAccumulator) ResMap() resmap.ResMap {
+	return ra.resMap.ShallowCopy()
+}
+
+// Vars returns a copy of underlying vars.
+func (ra *ResAccumulator) Vars() []types.Var {
+	return ra.varSet.AsSlice()
+}
+
+func (ra *ResAccumulator) AppendAll(
+	resources resmap.ResMap) error {
+	return ra.resMap.AppendAll(resources)
+}
+
+func (ra *ResAccumulator) AbsorbAll(
+	resources resmap.ResMap) error {
+	return ra.resMap.AbsorbAll(resources)
+}
+
+func (ra *ResAccumulator) MergeConfig(
+	tConfig *builtinconfig.TransformerConfig) (err error) {
+	ra.tConfig, err = ra.tConfig.Merge(tConfig)
+	return err
+}
+
+func (ra *ResAccumulator) GetTransformerConfig() *builtinconfig.TransformerConfig {
+	return ra.tConfig
+}
+
+func (ra *ResAccumulator) MergeVars(incoming []types.Var) error {
+	for _, v := range incoming {
+		targetId := resid.NewResIdWithNamespace(v.ObjRef.GVK(), v.ObjRef.Name, v.ObjRef.Namespace)
+		idMatcher := targetId.GvknEquals
+		if targetId.Namespace != "" || !targetId.IsNamespaceableKind() {
+			// Preserve backward compatibility. An empty namespace means
+			// wildcard search on the namespace hence we still use GvknEquals
+			idMatcher = targetId.Equals
+		}
+		matched := ra.resMap.GetMatchingResourcesByOriginalId(idMatcher)
+		if len(matched) > 1 {
+			return fmt.Errorf(
+				"found %d resId matches for var %s "+
+					"(unable to disambiguate)",
+				len(matched), v)
+		}
+		if len(matched) == 1 {
+			matched[0].AppendRefVarName(v)
+		}
+	}
+	return ra.varSet.MergeSlice(incoming)
+}
+
+func (ra *ResAccumulator) MergeAccumulator(other *ResAccumulator) (err error) {
+	err = ra.AppendAll(other.resMap)
+	if err != nil {
+		return err
+	}
+	err = ra.MergeConfig(other.tConfig)
+	if err != nil {
+		return err
+	}
+	return ra.varSet.MergeSet(other.varSet)
+}
+
+func (ra *ResAccumulator) findVarValueFromResources(v types.Var) (interface{}, error) {
+	for _, res := range ra.resMap.Resources() {
+		for _, varName := range res.GetRefVarNames() {
+			if varName == v.Name {
+				s, err := res.GetFieldValue(v.FieldRef.FieldPath)
+				if err != nil {
+					return "", fmt.Errorf(
+						"field specified in var '%v' "+
+							"not found in corresponding resource", v)
+				}
+
+				return s, nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf(
+		"var '%v' cannot be mapped to a field "+
+			"in the set of known resources", v)
+}
+
+// makeVarReplacementMap returns a map of Var names to
+// their final values. The values are strings intended
+// for substitution wherever the $(var.Name) occurs.
+func (ra *ResAccumulator) makeVarReplacementMap() (map[string]interface{}, error) {
+	result := map[string]interface{}{}
+	for _, v := range ra.Vars() {
+		s, err := ra.findVarValueFromResources(v)
+		if err != nil {
+			return nil, err
+		}
+
+		result[v.Name] = s
+	}
+
+	return result, nil
+}
+
+func (ra *ResAccumulator) Transform(t resmap.Transformer) error {
+	return t.Transform(ra.resMap)
+}
+
+func (ra *ResAccumulator) ResolveVars() error {
+	replacementMap, err := ra.makeVarReplacementMap()
+	if err != nil {
+		return err
+	}
+	if len(replacementMap) == 0 {
+		return nil
+	}
+	t := newRefVarTransformer(
+		replacementMap, ra.tConfig.VarReference)
+	err = ra.Transform(t)
+	if len(t.UnusedVars()) > 0 {
+		log.Printf(
+			"well-defined vars that were never replaced: %s\n",
+			strings.Join(t.UnusedVars(), ","))
+	}
+	return err
+}
+
+func (ra *ResAccumulator) FixBackReferences() (err error) {
+	if ra.tConfig.NameReference == nil {
+		return nil
+	}
+	return ra.Transform(newNameReferenceTransformer(
+		ra.tConfig.NameReference))
+}
--- a/api/internal/accumulator/resaccumulator_test.go
+++ b/api/internal/accumulator/resaccumulator_test.go
@@ -0,0 +1,417 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package accumulator_test
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"strings"
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/k8sdeps/kunstruct"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/testutils/resmaptest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeResAccumulator(t *testing.T) (*ResAccumulator, *resource.Factory) {
+	ra := MakeEmptyAccumulator()
+	err := ra.MergeConfig(builtinconfig.MakeDefaultConfig())
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	rf := resource.NewFactory(
+		kunstruct.NewKunstructuredFactoryImpl())
+	err = ra.AppendAll(
+		resmaptest_test.NewRmBuilder(t, rf).
+			Add(map[string]interface{}{
+				"apiVersion": "apps/v1",
+				"kind":       "Deployment",
+				"metadata": map[string]interface{}{
+					"name": "deploy1",
+				},
+				"spec": map[string]interface{}{
+					"template": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"containers": []interface{}{
+								map[string]interface{}{
+									"command": []interface{}{
+										"myserver",
+										"--somebackendService $(SERVICE_ONE)",
+										"--yetAnother $(SERVICE_TWO)",
+									},
+								},
+							},
+						},
+					},
+				}}).
+			Add(map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendOne",
+				}}).
+			Add(map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name": "backendTwo",
+				}}).ResMap())
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	return ra, rf
+}
+
+func TestResolveVarsHappy(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_TWO",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother backendTwo" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func TestResolveVarsOneUnused(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+		},
+		{
+			Name: "SERVICE_UNUSED",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendTwo"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	defer func() {
+		log.SetOutput(os.Stderr)
+	}()
+	err = ra.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	expectLog(t, buf, "well-defined vars that were never replaced: SERVICE_UNUSED")
+	c := getCommand(find("deploy1", ra.ResMap()))
+	if c != "myserver --somebackendService backendOne --yetAnother $(SERVICE_TWO)" {
+		t.Fatalf("unexpected command: %s", c)
+	}
+}
+
+func expectLog(t *testing.T, log bytes.Buffer, expect string) {
+	if !strings.Contains(log.String(), expect) {
+		t.Fatalf("expected log containing '%s', got '%s'", expect, log.String())
+	}
+}
+
+func TestResolveVarsVarNeedsDisambiguation(t *testing.T) {
+	ra, rf := makeResAccumulator(t)
+
+	rm0 := resmap.New()
+	err := rm0.Append(
+		rf.FromMap(
+			map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Service",
+				"metadata": map[string]interface{}{
+					"name":      "backendOne",
+					"namespace": "fooNamespace",
+				},
+			}))
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.AppendAll(rm0)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(), "unable to disambiguate") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func makeNamespacedConfigMapWithDataProviderValue(
+	namespace string,
+	value string,
+) map[string]interface{} {
+	return map[string]interface{}{
+		"apiVersion": "v1",
+		"kind":       "ConfigMap",
+		"metadata": map[string]interface{}{
+			"name":      "environment",
+			"namespace": namespace,
+		},
+		"data": map[string]interface{}{
+			"provider": value,
+		},
+	}
+}
+
+func makeVarToNamepaceAndPath(
+	name string,
+	namespace string,
+	path string,
+) types.Var {
+	return types.Var{
+		Name: name,
+		ObjRef: types.Target{
+			Gvk:       resid.Gvk{Version: "v1", Kind: "ConfigMap"},
+			Name:      "environment",
+			Namespace: namespace,
+		},
+		FieldRef: types.FieldSelector{FieldPath: path},
+	}
+}
+
+func TestResolveVarConflicts(t *testing.T) {
+	rf := resource.NewFactory(kunstruct.NewKunstructuredFactoryImpl())
+
+	// create configmaps in foo and bar namespaces with `data.provider` values.
+	fooAws := makeNamespacedConfigMapWithDataProviderValue("foo", "aws")
+	barAws := makeNamespacedConfigMapWithDataProviderValue("bar", "aws")
+	barGcp := makeNamespacedConfigMapWithDataProviderValue("bar", "gcp")
+
+	// create two variables with (apparently) conflicting names that point to
+	// fieldpaths that could be generalized.
+	varFoo := makeVarToNamepaceAndPath("PROVIDER", "foo", "data.provider")
+	varBar := makeVarToNamepaceAndPath("PROVIDER", "bar", "data.provider")
+
+	// create accumulators holding apparently conflicting vars that are not
+	// actually in conflict because they point to the same concrete value.
+	rm0 := resmap.New()
+	rm0.Append(rf.FromMap(fooAws))
+	ac0 := MakeEmptyAccumulator()
+	ac0.AppendAll(rm0)
+	ac0.MergeVars([]types.Var{varFoo})
+
+	rm1 := resmap.New()
+	rm1.Append(rf.FromMap(barAws))
+	ac1 := MakeEmptyAccumulator()
+	ac1.AppendAll(rm1)
+	ac1.MergeVars([]types.Var{varBar})
+
+	// validate that two vars of the same name which reference the same concrete
+	// value do not produce a conflict.
+	err := ac0.MergeAccumulator(ac1)
+	if err == nil {
+		t.Fatalf("see bug gh-1600")
+	}
+
+	// create an accumulator will have an actually conflicting value with the
+	// two above (because it contains a variable whose name is used in the other
+	// accumulators AND whose concrete values are different).
+	rm2 := resmap.New()
+	rm2.Append(rf.FromMap(barGcp))
+	ac2 := MakeEmptyAccumulator()
+	ac2.AppendAll(rm2)
+	ac2.MergeVars([]types.Var{varBar})
+	err = ac1.MergeAccumulator(ac2)
+	if err == nil {
+		t.Fatalf("dupe vars w/ different concrete values should conflict")
+	}
+}
+
+func TestResolveVarsGoodResIdBadField(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne"},
+			FieldRef: types.FieldSelector{FieldPath: "nope_nope_nope"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"not found in corresponding resource") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsUnmappableVar(t *testing.T) {
+	ra, _ := makeResAccumulator(t)
+	err := ra.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_THREE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "doesNotExist"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra.ResolveVars()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"cannot be mapped to a field in the set of known resources") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestResolveVarsWithNoambiguation(t *testing.T) {
+	ra1, rf := makeResAccumulator(t)
+	err := ra1.MergeVars([]types.Var{
+		{
+			Name: "SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	// Create another accumulator having a resource with different prefix
+	ra2 := MakeEmptyAccumulator()
+
+	m := resmaptest_test.NewRmBuilder(t, rf).
+		Add(map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name": "deploy2",
+			},
+			"spec": map[string]interface{}{
+				"template": map[string]interface{}{
+					"spec": map[string]interface{}{
+						"containers": []interface{}{
+							map[string]interface{}{
+								"command": []interface{}{
+									"myserver",
+									"--somebackendService $(SUB_SERVICE_ONE)",
+								},
+							},
+						},
+					},
+				},
+			}}).
+		Add(map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]interface{}{
+				"name": "backendOne",
+			}}).ResMap()
+
+	// Make it seem like this resource
+	// went through a prefix transformer.
+	r := m.GetByIndex(1)
+	r.AddNamePrefix("sub-")
+	r.SetName("sub-backendOne") // original name remains "backendOne"
+
+	err = ra2.AppendAll(m)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra2.MergeVars([]types.Var{
+		{
+			Name: "SUB_SERVICE_ONE",
+			ObjRef: types.Target{
+				Gvk:  resid.Gvk{Version: "v1", Kind: "Service"},
+				Name: "backendOne",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	err = ra1.MergeAccumulator(ra2)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+
+	err = ra1.ResolveVars()
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func find(name string, resMap resmap.ResMap) *resource.Resource {
+	for _, r := range resMap.Resources() {
+		if r.GetName() == name {
+			return r
+		}
+	}
+	return nil
+}
+
+// Assumes arg is a deployment, returns the command of first container.
+func getCommand(r *resource.Resource) string {
+	var m map[string]interface{}
+	var c []interface{}
+	m, _ = r.Map()["spec"].(map[string]interface{})
+	m, _ = m["template"].(map[string]interface{})
+	m, _ = m["spec"].(map[string]interface{})
+	c, _ = m["containers"].([]interface{})
+	m, _ = c[0].(map[string]interface{})
+
+	cmd, _ := m["command"].([]interface{})
+	n := make([]string, len(cmd))
+	for i, v := range cmd {
+		n[i] = v.(string)
+	}
+	return strings.Join(n, " ")
+}
--- a/api/internal/kusterr/yamlformaterror.go
+++ b/api/internal/kusterr/yamlformaterror.go
@@ -1,21 +1,8 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 // Package error has contextual error types.
-package error
+package kusterr

 import (
 	"fmt"
--- a/api/internal/kusterr/yamlformaterror_test.go
+++ b/api/internal/kusterr/yamlformaterror_test.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package error
+package kusterr

 import (
 	"fmt"
--- a/api/internal/loadertest/fakeloader.go
+++ b/api/internal/loadertest/fakeloader.go
@@ -1,42 +1,40 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 // Package loadertest holds a fake for the Loader interface.
 package loadertest

 import (
 	"log"
-	"sigs.k8s.io/kustomize/pkg/fs"
-	"sigs.k8s.io/kustomize/pkg/ifc"
-	"sigs.k8s.io/kustomize/pkg/loader"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/loader"
 )

 // FakeLoader encapsulates the delegate Loader and the fake file system.
 type FakeLoader struct {
-	fs       fs.FileSystem
+	fs       filesys.FileSystem
 	delegate ifc.Loader
 }

 // NewFakeLoader returns a Loader that uses a fake filesystem.
-// The argument should be an absolute file path.
+// The loader will be restricted to root only.
+// The initialDir argument should be an absolute file path.
 func NewFakeLoader(initialDir string) FakeLoader {
+	return NewFakeLoaderWithRestrictor(
+		loader.RestrictionRootOnly, initialDir)
+}
+
+// NewFakeLoaderWithRestrictor returns a Loader that
+// uses a fake filesystem.
+// The initialDir argument should be an absolute file path.
+func NewFakeLoaderWithRestrictor(
+	lr loader.LoadRestrictorFunc, initialDir string) FakeLoader {
 	// Create fake filesystem and inject it into initial Loader.
-	fSys := fs.MakeFakeFS()
+	fSys := filesys.MakeFsInMemory()
 	fSys.Mkdir(initialDir)
-	ldr, err := loader.NewLoader(initialDir, fSys)
+	ldr, err := loader.NewLoader(lr, initialDir, fSys)
 	if err != nil {
 		log.Fatalf("Unable to make loader: %v", err)
 	}
@@ -53,7 +51,7 @@ func (f FakeLoader) AddDirectory(fullDirPath string) error {
 	return f.fs.Mkdir(fullDirPath)
 }

-// Root returns root.
+// Root delegates.
 func (f FakeLoader) Root() string {
 	return f.delegate.Root()
 }
@@ -67,12 +65,12 @@ func (f FakeLoader) New(newRoot string) (ifc.Loader, error) {
 	return FakeLoader{fs: f.fs, delegate: l}, nil
 }

-// Load performs load from a given location.
+// Load delegates.
 func (f FakeLoader) Load(location string) ([]byte, error) {
 	return f.delegate.Load(location)
 }

-// Cleanup does nothing
+// Cleanup delegates.
 func (f FakeLoader) Cleanup() error {
-	return nil
+	return f.delegate.Cleanup()
 }
--- a/api/inventory/constants.go
+++ b/api/inventory/constants.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory
+
+const (
+	// Annotation that contains the inventory content.
+	ContentAnnotation = "kustomize.config.k8s.io/Inventory"
+
+	// Annotation for inventory content hash.
+	HashAnnotation = "kustomize.config.k8s.io/InventoryHash"
+)
--- a/api/inventory/inventory.go
+++ b/api/inventory/inventory.go
@@ -0,0 +1,235 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory
+
+import (
+	"encoding/json"
+
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+//Refs is a reference map.  Each key is the id
+//of a k8s resource, and each value is a list of
+//object ids that refer back to the object in the
+//key.
+
+//For example, the key could correspond to a
+//ConfigMap, and the list of values might include
+//several different Deployments that get data from
+//that ConfigMap (and thus refer to it).
+
+//References are important in inventory management
+//because one may not delete an object before all
+//objects referencing it have been removed.
+type Refs map[resid.ResId][]resid.ResId
+
+func NewRefs() Refs {
+	return Refs{}
+}
+
+// Merge merges a Refs into an existing Refs
+func (rf Refs) Merge(b Refs) Refs {
+	for key, value := range b {
+		_, ok := rf[key]
+		if ok {
+			rf[key] = append(rf[key], value...)
+		} else {
+			rf[key] = value
+		}
+	}
+	return rf
+}
+
+// removeIfContains removes the reference relationship
+//  a --> b
+// from the Refs if it exists
+func (rf Refs) RemoveIfContains(a, b resid.ResId) {
+	refs, ok := rf[a]
+	if !ok {
+		return
+	}
+	for i, ref := range refs {
+		if ref.Equals(b) {
+			rf[a] = append(refs[:i], refs[i+1:]...)
+			break
+		}
+	}
+}
+
+//Inventory is a an object intended for
+//serialization into the annotations of a so-called
+//apply-root object (a ConfigMap, an Application,
+//etc.) living in the cluster.  This apply-root
+//object is written as part of an apply operation as
+//a means to record overall cluster state changes.
+
+//At the end of a successful apply, the "current"
+//field in Inventory will be a map whose keys all
+//correspond to an object in the cluster, and
+//"previous" will be the previous such set (an empty
+//set on the first apply).
+
+//An Inventory allows the Prune method to work.
+type Inventory struct {
+	Current  Refs `json:"current,omitempty"`
+	Previous Refs `json:"previous,omitempty"`
+}
+
+// NewInventory returns an Inventory object
+func NewInventory() *Inventory {
+	return &Inventory{
+		Current:  NewRefs(),
+		Previous: NewRefs(),
+	}
+}
+
+// UpdateCurrent updates the Inventory given a
+// new current Refs
+// The existing Current refs is merged into
+// the Previous refs
+func (a *Inventory) UpdateCurrent(curref Refs) *Inventory {
+	if len(a.Previous) > 0 {
+		a.Previous.Merge(a.Current)
+	} else {
+		a.Previous = a.Current
+	}
+	a.Current = curref
+	return a
+}
+
+func (a *Inventory) removeNewlyOrphanedItemsFromPrevious() []resid.ResId {
+	var results []resid.ResId
+	for item, refs := range a.Previous {
+		if _, ok := a.Current[item]; ok {
+			delete(a.Previous, item)
+			continue
+		}
+
+		var newRefs []resid.ResId
+		toDelete := true
+		for _, ref := range refs {
+			if _, ok := a.Current[ref]; ok {
+				toDelete = false
+				newRefs = append(newRefs, ref)
+			}
+		}
+		if toDelete {
+			results = append(results, item)
+			delete(a.Previous, item)
+		} else {
+			a.Previous[item] = newRefs
+		}
+	}
+	return results
+}
+
+func (a *Inventory) removeOrphanedItemsFromPreviousThatAreNotInCurrent() []resid.ResId {
+	var results []resid.ResId
+	for item, refs := range a.Previous {
+		if _, ok := a.Current[item]; ok {
+			continue
+		}
+		if len(refs) == 0 {
+			results = append(results, item)
+			delete(a.Previous, item)
+		}
+	}
+	return results
+}
+
+func (a *Inventory) removeOrphanedItemsFromPreviousThatAreInCurrent() {
+	//Remove references from Previous that are already in Current refs
+	for item, refs := range a.Current {
+		for _, ref := range refs {
+			a.Previous.RemoveIfContains(item, ref)
+		}
+	}
+	//Remove items from Previous that are already in Current refs
+	for item, refs := range a.Previous {
+		if len(refs) == 0 {
+			if _, ok := a.Current[item]; ok {
+				delete(a.Previous, item)
+			}
+		}
+	}
+}
+
+// Prune computes the diff of Current refs and Previous refs
+// and returns a list of Items that can be pruned.
+// An item that can be pruned shows up only in Previous refs.
+// Prune also updates the Previous refs with those items removed
+func (a *Inventory) Prune() []resid.ResId {
+	a.removeOrphanedItemsFromPreviousThatAreInCurrent()
+
+	// These are candidates for deletion from the cluster.
+	removable1 := a.removeOrphanedItemsFromPreviousThatAreNotInCurrent()
+	removable2 := a.removeNewlyOrphanedItemsFromPrevious()
+	return append(removable1, removable2...)
+}
+
+// inventory is the internal type used for serialization
+type inventory struct {
+	Current  map[string][]resid.ResId `json:"current,omitempty"`
+	Previous map[string][]resid.ResId `json:"previous,omitempty"`
+}
+
+func (a *Inventory) toInternalType() inventory {
+	prev := map[string][]resid.ResId{}
+	curr := map[string][]resid.ResId{}
+	for id, refs := range a.Current {
+		curr[id.String()] = refs
+	}
+	for id, refs := range a.Previous {
+		prev[id.String()] = refs
+	}
+	return inventory{
+		Current:  curr,
+		Previous: prev,
+	}
+}
+
+func (a *Inventory) fromInternalType(i *inventory) {
+	for s, refs := range i.Previous {
+		a.Previous[resid.FromString(s)] = refs
+	}
+	for s, refs := range i.Current {
+		a.Current[resid.FromString(s)] = refs
+	}
+}
+
+func (a *Inventory) marshal() ([]byte, error) {
+	return json.Marshal(a.toInternalType())
+}
+
+func (a *Inventory) unMarshal(data []byte) error {
+	inv := &inventory{
+		Current:  map[string][]resid.ResId{},
+		Previous: map[string][]resid.ResId{},
+	}
+	err := json.Unmarshal(data, inv)
+	if err != nil {
+		return err
+	}
+	a.fromInternalType(inv)
+	return nil
+}
+
+// UpdateAnnotations update the annotation map
+func (a *Inventory) UpdateAnnotations(annot map[string]string) error {
+	data, err := a.marshal()
+	if err != nil {
+		return err
+	}
+	annot[ContentAnnotation] = string(data)
+	return nil
+}
+
+// LoadFromAnnotation loads the Inventory date from the annotation map
+func (a *Inventory) LoadFromAnnotation(annot map[string]string) error {
+	value, ok := annot[ContentAnnotation]
+	if ok {
+		return a.unMarshal([]byte(value))
+	}
+	return nil
+}
--- a/api/inventory/inventory_test.go
+++ b/api/inventory/inventory_test.go
@@ -0,0 +1,60 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package inventory_test
+
+import (
+	"testing"
+
+	. "sigs.k8s.io/kustomize/api/inventory"
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+func makeRefs() (Refs, Refs) {
+	a := resid.FromString("G1_V1_K1|ns1|nm1")
+	b := resid.FromString("G2_V2_K2|ns2|nm2")
+	c := resid.FromString("G3_V3_K3|ns3|nm3")
+	current := NewRefs()
+	current[a] = []resid.ResId{b, c}
+	current[b] = []resid.ResId{}
+	current[c] = []resid.ResId{}
+	newRefs := NewRefs()
+	newRefs[a] = []resid.ResId{b}
+	newRefs[b] = []resid.ResId{}
+	return current, newRefs
+}
+
+func TestInventory(t *testing.T) {
+	inventory := NewInventory()
+	curref, _ := makeRefs()
+
+	inventory.UpdateCurrent(curref)
+	if len(inventory.Current) != 3 {
+		t.Fatalf("not getting the correct inventory %v", inventory)
+	}
+	curref, newref := makeRefs()
+	inventory.UpdateCurrent(curref)
+	if len(inventory.Current) != 3 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+	if len(inventory.Previous) != 3 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+
+	items := inventory.Prune()
+	if len(items) != 0 {
+		t.Fatalf("not getting the corrent items %v", items)
+	}
+	if len(inventory.Previous) != 0 {
+		t.Fatalf("not getting the corrent inventory %v", inventory)
+	}
+
+	inventory.UpdateCurrent(newref)
+	items = inventory.Prune()
+	if len(items) != 1 {
+		t.Fatalf("not getting the corrent items %v", items)
+	}
+	if len(inventory.Previous) != 0 {
+		t.Fatalf("not getting the corrent inventory %v", inventory.Previous)
+	}
+}
--- a/api/k8sdeps/configmapandsecret/configmapfactory.go
+++ b/api/k8sdeps/configmapandsecret/configmapfactory.go
@@ -0,0 +1,72 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package configmapandsecret generates configmaps and secrets per generator rules.
+package configmapandsecret
+
+import (
+	"fmt"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"k8s.io/api/core/v1"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeFreshConfigMap(
+	args *types.ConfigMapArgs) *v1.ConfigMap {
+	cm := &v1.ConfigMap{}
+	cm.APIVersion = "v1"
+	cm.Kind = "ConfigMap"
+	cm.Name = args.Name
+	cm.Namespace = args.Namespace
+	cm.Data = map[string]string{}
+	return cm
+}
+
+// MakeConfigMap returns a new ConfigMap, or nil and an error.
+func (f *Factory) MakeConfigMap(
+	args *types.ConfigMapArgs) (*v1.ConfigMap, error) {
+	all, err := f.kvLdr.Load(args.KvPairSources)
+	if err != nil {
+		return nil, errors.Wrap(err, "loading KV pairs")
+	}
+	cm := makeFreshConfigMap(args)
+	for _, p := range all {
+		err = f.addKvToConfigMap(cm, p)
+		if err != nil {
+			return nil, errors.Wrap(err, "trouble mapping")
+		}
+	}
+	if f.options != nil {
+		cm.SetLabels(f.options.Labels)
+		cm.SetAnnotations(f.options.Annotations)
+	}
+	return cm, nil
+}
+
+// addKvToConfigMap adds the given key and data to the given config map.
+// Error if key invalid, or already exists.
+func (f *Factory) addKvToConfigMap(configMap *v1.ConfigMap, p types.Pair) error {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(p.Key); err != nil {
+		return err
+	}
+	// If the configmap data contains byte sequences that are all in the UTF-8
+	// range, we will write it to .Data
+	if utf8.Valid([]byte(p.Value)) {
+		if _, entryExists := configMap.Data[p.Key]; entryExists {
+			return fmt.Errorf(keyExistsErrorMsg, p.Key, configMap.Data)
+		}
+		configMap.Data[p.Key] = p.Value
+		return nil
+	}
+	// otherwise, it's BinaryData
+	if configMap.BinaryData == nil {
+		configMap.BinaryData = map[string][]byte{}
+	}
+	if _, entryExists := configMap.BinaryData[p.Key]; entryExists {
+		return fmt.Errorf(keyExistsErrorMsg, p.Key, configMap.BinaryData)
+	}
+	configMap.BinaryData[p.Key] = []byte(p.Value)
+	return nil
+}
--- a/api/k8sdeps/configmapandsecret/configmapfactory_test.go
+++ b/api/k8sdeps/configmapandsecret/configmapfactory_test.go
@@ -1,30 +1,20 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package configmapandsecret

 import (
+	"path/filepath"
 	"reflect"
 	"testing"

 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"sigs.k8s.io/kustomize/pkg/fs"
-	"sigs.k8s.io/kustomize/pkg/loader"
-	"sigs.k8s.io/kustomize/pkg/types"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
 )

 func makeEnvConfigMap(name string) *corev1.ConfigMap {
@@ -97,8 +87,10 @@ func TestConstructConfigMap(t *testing.T) {
 			input: types.ConfigMapArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "envConfigMap",
-					DataSources: types.DataSources{
-						EnvSource: "configmap/app.env",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{
+							filepath.Join("configmap", "app.env"),
+						},
 					},
 				},
 			},
@@ -110,8 +102,11 @@ func TestConstructConfigMap(t *testing.T) {
 			input: types.ConfigMapArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "fileConfigMap",
-					DataSources: types.DataSources{
-						FileSources: []string{"configmap/app-init.ini", "configmap/app.bin"},
+					KvPairSources: types.KvPairSources{
+						FileSources: []string{
+							filepath.Join("configmap", "app-init.ini"),
+							filepath.Join("configmap", "app.bin"),
+						},
 					},
 				},
 			},
@@ -123,7 +118,7 @@ func TestConstructConfigMap(t *testing.T) {
 			input: types.ConfigMapArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "literalConfigMap",
-					DataSources: types.DataSources{
+					KvPairSources: types.KvPairSources{
 						LiteralSources: []string{"a=x", "b=y", "c=\"Hello World\"", "d='true'"},
 					},
 				},
@@ -137,13 +132,22 @@ func TestConstructConfigMap(t *testing.T) {
 		},
 	}

-	fSys := fs.MakeFakeFS()
-	fSys.WriteFile("/configmap/app.env", []byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
-	fSys.WriteFile("/configmap/app-init.ini", []byte("FOO=bar\nBAR=baz\n"))
-	fSys.WriteFile("/configmap/app.bin", []byte{0xff, 0xfd})
-	f := NewConfigMapFactory(loader.NewFileLoaderAtRoot(fSys))
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.env"),
+		[]byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app-init.ini"),
+		[]byte("FOO=bar\nBAR=baz\n"))
+	fSys.WriteFile(
+		filesys.RootedPath("configmap", "app.bin"),
+		[]byte{0xff, 0xfd})
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
 	for _, tc := range testCases {
-		cm, err := f.MakeConfigMap(&tc.input, tc.options)
+		f := NewFactory(kvLdr, tc.options)
+		cm, err := f.MakeConfigMap(&tc.input)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
--- a/api/k8sdeps/configmapandsecret/factory.go
+++ b/api/k8sdeps/configmapandsecret/factory.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// Factory makes ConfigMaps and Secrets.
+type Factory struct {
+	kvLdr   ifc.KvLoader
+	options *types.GeneratorOptions
+}
+
+// NewFactory returns a new factory that makes ConfigMaps and Secrets.
+func NewFactory(
+	kvLdr ifc.KvLoader, o *types.GeneratorOptions) *Factory {
+	return &Factory{kvLdr: kvLdr, options: o}
+}
+
+const keyExistsErrorMsg = "cannot add key %s, another key by that name already exists: %v"
--- a/api/k8sdeps/configmapandsecret/secretfactory.go
+++ b/api/k8sdeps/configmapandsecret/secretfactory.go
@@ -0,0 +1,58 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package configmapandsecret
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeFreshSecret(
+	args *types.SecretArgs) *corev1.Secret {
+	s := &corev1.Secret{}
+	s.APIVersion = "v1"
+	s.Kind = "Secret"
+	s.Name = args.Name
+	s.Namespace = args.Namespace
+	s.Type = corev1.SecretType(args.Type)
+	if s.Type == "" {
+		s.Type = corev1.SecretTypeOpaque
+	}
+	s.Data = map[string][]byte{}
+	return s
+}
+
+// MakeSecret returns a new secret.
+func (f *Factory) MakeSecret(
+	args *types.SecretArgs) (*corev1.Secret, error) {
+	all, err := f.kvLdr.Load(args.KvPairSources)
+	if err != nil {
+		return nil, err
+	}
+	s := makeFreshSecret(args)
+	for _, p := range all {
+		err = f.addKvToSecret(s, p.Key, p.Value)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if f.options != nil {
+		s.SetLabels(f.options.Labels)
+		s.SetAnnotations(f.options.Annotations)
+	}
+	return s, nil
+}
+
+func (f *Factory) addKvToSecret(secret *corev1.Secret, keyName, data string) error {
+	if err := f.kvLdr.Validator().ErrIfInvalidKey(keyName); err != nil {
+		return err
+	}
+	if _, entryExists := secret.Data[keyName]; entryExists {
+		return fmt.Errorf(keyExistsErrorMsg, keyName, secret.Data)
+	}
+	secret.Data[keyName] = []byte(data)
+	return nil
+}
--- a/api/k8sdeps/configmapandsecret/secretfactory_test.go
+++ b/api/k8sdeps/configmapandsecret/secretfactory_test.go
@@ -1,18 +1,5 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package configmapandsecret

@@ -22,9 +9,11 @@ import (

 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"sigs.k8s.io/kustomize/pkg/fs"
-	"sigs.k8s.io/kustomize/pkg/loader"
-	"sigs.k8s.io/kustomize/pkg/types"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
 )

 func makeEnvSecret(name string) *corev1.Secret {
@@ -95,8 +84,8 @@ func TestConstructSecret(t *testing.T) {
 			input: types.SecretArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "envSecret",
-					DataSources: types.DataSources{
-						EnvSource: "secret/app.env",
+					KvPairSources: types.KvPairSources{
+						EnvSources: []string{"secret/app.env"},
 					},
 				},
 			},
@@ -108,7 +97,7 @@ func TestConstructSecret(t *testing.T) {
 			input: types.SecretArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "fileSecret",
-					DataSources: types.DataSources{
+					KvPairSources: types.KvPairSources{
 						FileSources: []string{"secret/app-init.ini"},
 					},
 				},
@@ -121,7 +110,7 @@ func TestConstructSecret(t *testing.T) {
 			input: types.SecretArgs{
 				GeneratorArgs: types.GeneratorArgs{
 					Name: "literalSecret",
-					DataSources: types.DataSources{
+					KvPairSources: types.KvPairSources{
 						LiteralSources: []string{"a=x", "b=y"},
 					},
 				},
@@ -135,12 +124,15 @@ func TestConstructSecret(t *testing.T) {
 		},
 	}

-	fSys := fs.MakeFakeFS()
+	fSys := filesys.MakeFsInMemory()
 	fSys.WriteFile("/secret/app.env", []byte("DB_USERNAME=admin\nDB_PASSWORD=somepw\n"))
 	fSys.WriteFile("/secret/app-init.ini", []byte("FOO=bar\nBAR=baz\n"))
-	f := NewSecretFactory(loader.NewFileLoaderAtRoot(fSys))
+	kvLdr := kv.NewLoader(
+		loader.NewFileLoaderAtRoot(fSys),
+		valtest_test.MakeFakeValidator())
 	for _, tc := range testCases {
-		cm, err := f.MakeSecret(&tc.input, tc.options)
+		f := NewFactory(kvLdr, tc.options)
+		cm, err := f.MakeSecret(&tc.input)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
--- a/api/k8sdeps/doc.go
+++ b/api/k8sdeps/doc.go
--- a/api/k8sdeps/kunstruct/factory.go
+++ b/api/k8sdeps/kunstruct/factory.go
@@ -1,18 +1,5 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package kunstruct

@@ -20,26 +7,32 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"strconv"
 	"strings"

 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/util/yaml"
-	"sigs.k8s.io/kustomize/k8sdeps/configmapandsecret"
-	"sigs.k8s.io/kustomize/pkg/ifc"
-	"sigs.k8s.io/kustomize/pkg/types"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/k8sdeps/configmapandsecret"
+	"sigs.k8s.io/kustomize/api/types"
 )

 // KunstructuredFactoryImpl hides construction using apimachinery types.
 type KunstructuredFactoryImpl struct {
-	cmFactory     *configmapandsecret.ConfigMapFactory
-	secretFactory *configmapandsecret.SecretFactory
+	hasher *kustHash
 }

 var _ ifc.KunstructuredFactory = &KunstructuredFactoryImpl{}

 // NewKunstructuredFactoryImpl returns a factory.
 func NewKunstructuredFactoryImpl() ifc.KunstructuredFactory {
-	return &KunstructuredFactoryImpl{}
+	return &KunstructuredFactoryImpl{hasher: NewKustHash()}
+}
+
+// Hasher returns a kunstructured hasher
+// input: kunstructured; output: string hash.
+func (kf *KunstructuredFactoryImpl) Hasher() ifc.KunstructuredHasher {
+	return kf.hasher
 }

 // SliceFromBytes returns a slice of Kunstructured.
@@ -79,27 +72,29 @@ func (kf *KunstructuredFactoryImpl) FromMap(
 }

 // MakeConfigMap returns an instance of Kunstructured for ConfigMap
-func (kf *KunstructuredFactoryImpl) MakeConfigMap(args *types.ConfigMapArgs, options *types.GeneratorOptions) (ifc.Kunstructured, error) {
-	cm, err := kf.cmFactory.MakeConfigMap(args, options)
+func (kf *KunstructuredFactoryImpl) MakeConfigMap(
+	kvLdr ifc.KvLoader,
+	options *types.GeneratorOptions,
+	args *types.ConfigMapArgs) (ifc.Kunstructured, error) {
+	o, err := configmapandsecret.NewFactory(
+		kvLdr, options).MakeConfigMap(args)
 	if err != nil {
 		return nil, err
 	}
-	return NewKunstructuredFromObject(cm)
+	return NewKunstructuredFromObject(o)
 }

 // MakeSecret returns an instance of Kunstructured for Secret
-func (kf *KunstructuredFactoryImpl) MakeSecret(args *types.SecretArgs, options *types.GeneratorOptions) (ifc.Kunstructured, error) {
-	sec, err := kf.secretFactory.MakeSecret(args, options)
+func (kf *KunstructuredFactoryImpl) MakeSecret(
+	kvLdr ifc.KvLoader,
+	options *types.GeneratorOptions,
+	args *types.SecretArgs) (ifc.Kunstructured, error) {
+	o, err := configmapandsecret.NewFactory(
+		kvLdr, options).MakeSecret(args)
 	if err != nil {
 		return nil, err
 	}
-	return NewKunstructuredFromObject(sec)
-}
-
-// Set sets loader
-func (kf *KunstructuredFactoryImpl) Set(ldr ifc.Loader) {
-	kf.cmFactory = configmapandsecret.NewConfigMapFactory(ldr)
-	kf.secretFactory = configmapandsecret.NewSecretFactory(ldr)
+	return NewKunstructuredFromObject(o)
 }

 // validate validates that u has kind and name
@@ -114,5 +109,30 @@ func (kf *KunstructuredFactoryImpl) validate(u unstructured.Unstructured) error
 	if u.GetName() == "" {
 		return fmt.Errorf("missing metadata.name in object %v", u)
 	}
+
+	if result, path := checkListItemNil(u.Object); result {
+		return fmt.Errorf("empty item at %v in object %v", path, u)
+	}
 	return nil
 }
+
+func checkListItemNil(in interface{}) (bool, string) {
+	switch v := in.(type) {
+	case map[string]interface{}:
+		for key, s := range v {
+			if result, path := checkListItemNil(s); result {
+				return result, key + "/" + path
+			}
+		}
+	case []interface{}:
+		for index, s := range v {
+			if s == nil {
+				return true, ""
+			}
+			if result, path := checkListItemNil(s); result {
+				return result, "[" + strconv.Itoa(index) + "]/" + path
+			}
+		}
+	}
+	return false, ""
+}
--- a/api/k8sdeps/kunstruct/factory_test.go
+++ b/api/k8sdeps/kunstruct/factory_test.go
@@ -20,7 +20,7 @@ import (
 	"reflect"
 	"testing"

-	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/api/ifc"
 )

 func TestSliceFromBytes(t *testing.T) {
@@ -138,6 +138,22 @@ kind: Namespace
 metadata:
  annotations:
    foo: bar
+`),
+			expectedOut: nil,
+			expectedErr: true,
+		},
+		{
+			name: "nil value in list",
+			input: []byte(`
+apiVersion: builtin
+kind: ConfigMapGenerator
+metadata:
+  name: kube100-site
+  labels:
+    app: web
+    testList:
+      - testA
+      - 
 `),
 			expectedOut: nil,
 			expectedErr: true,
--- a/api/k8sdeps/kunstruct/hasher.go
+++ b/api/k8sdeps/kunstruct/hasher.go
@@ -0,0 +1,123 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// kustHash computes a hash of an unstructured object.
+type kustHash struct{}
+
+// NewKustHash returns a kustHash object
+func NewKustHash() *kustHash {
+	return &kustHash{}
+}
+
+// Hash returns a hash of either a ConfigMap or a Secret
+func (h *kustHash) Hash(m ifc.Kunstructured) (string, error) {
+	u := unstructured.Unstructured{
+		Object: m.Map(),
+	}
+	kind := u.GetKind()
+	switch kind {
+	case "ConfigMap":
+		cm, err := unstructuredToConfigmap(u)
+		if err != nil {
+			return "", err
+		}
+		return configMapHash(cm)
+	case "Secret":
+		sec, err := unstructuredToSecret(u)
+
+		if err != nil {
+			return "", err
+		}
+		return secretHash(sec)
+	default:
+		return "", fmt.Errorf(
+			"type %s is not supported for hashing in %v",
+			kind, m.Map())
+	}
+}
+
+// configMapHash returns a hash of the ConfigMap.
+// The Data, Kind, and Name are taken into account.
+func configMapHash(cm *v1.ConfigMap) (string, error) {
+	encoded, err := encodeConfigMap(cm)
+	if err != nil {
+		return "", err
+	}
+	h, err := hasher.Encode(hasher.Hash(encoded))
+	if err != nil {
+		return "", err
+	}
+	return h, nil
+}
+
+// SecretHash returns a hash of the Secret.
+// The Data, Kind, Name, and Type are taken into account.
+func secretHash(sec *v1.Secret) (string, error) {
+	encoded, err := encodeSecret(sec)
+	if err != nil {
+		return "", err
+	}
+	h, err := hasher.Encode(hasher.Hash(encoded))
+	if err != nil {
+		return "", err
+	}
+	return h, nil
+}
+
+// encodeConfigMap encodes a ConfigMap.
+// Data, Kind, and Name are taken into account.
+func encodeConfigMap(cm *v1.ConfigMap) (string, error) {
+	// json.Marshal sorts the keys in a stable order in the encoding
+	m := map[string]interface{}{"kind": "ConfigMap", "name": cm.Name, "data": cm.Data}
+	if len(cm.BinaryData) > 0 {
+		m["binaryData"] = cm.BinaryData
+	}
+	data, err := json.Marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// encodeSecret encodes a Secret.
+// Data, Kind, Name, and Type are taken into account.
+func encodeSecret(sec *v1.Secret) (string, error) {
+	// json.Marshal sorts the keys in a stable order in the encoding
+	data, err := json.Marshal(map[string]interface{}{"kind": "Secret", "type": sec.Type, "name": sec.Name, "data": sec.Data})
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func unstructuredToConfigmap(u unstructured.Unstructured) (*v1.ConfigMap, error) {
+	marshaled, err := json.Marshal(u.Object)
+	if err != nil {
+		return nil, err
+	}
+	var out v1.ConfigMap
+	err = json.Unmarshal(marshaled, &out)
+	return &out, err
+}
+
+func unstructuredToSecret(u unstructured.Unstructured) (*v1.Secret, error) {
+	marshaled, err := json.Marshal(u.Object)
+	if err != nil {
+		return nil, err
+	}
+	var out v1.Secret
+	err = json.Unmarshal(marshaled, &out)
+	return &out, err
+}
--- a/k8sdeps/transformer/hash/hash_test.go
+++ b/k8sdeps/transformer/hash/hash_test.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2017 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package hash
+package kunstruct

 import (
 	"reflect"
@@ -22,14 +9,8 @@ import (
 	"testing"

 	"k8s.io/api/core/v1"
-	"sigs.k8s.io/kustomize/pkg/gvk"
 )

-var service = gvk.Gvk{Version: "v1", Kind: "Service"}
-var secret = gvk.Gvk{Version: "v1", Kind: "Secret"}
-var cmap = gvk.Gvk{Version: "v1", Kind: "ConfigMap"}
-var deploy = gvk.Gvk{Group: "apps", Version: "v1", Kind: "Deployment"}
-
 func TestConfigMapHash(t *testing.T) {
 	cases := []struct {
 		desc string
@@ -54,7 +35,7 @@ func TestConfigMapHash(t *testing.T) {
 	}

 	for _, c := range cases {
-		h, err := ConfigMapHash(c.cm)
+		h, err := configMapHash(c.cm)
 		if SkipRest(t, c.desc, err, c.err) {
 			continue
 		}
@@ -80,7 +61,7 @@ func TestSecretHash(t *testing.T) {
 	}

 	for _, c := range cases {
-		h, err := SecretHash(c.secret)
+		h, err := secretHash(c.secret)
 		if SkipRest(t, c.desc, err, c.err) {
 			continue
 		}
@@ -156,15 +137,6 @@ func TestEncodeSecret(t *testing.T) {
 	}
 }

-func TestHash(t *testing.T) {
-	// hash the empty string to be sure that sha256 is being used
-	expect := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-	sum := hash("")
-	if expect != sum {
-		t.Errorf("expected hash %q but got %q", expect, sum)
-	}
-}
-
 // warn devs who change types that they might have to update a hash function
 // not perfect, as it only checks the number of top-level fields
 func TestTypeStability(t *testing.T) {
--- a/api/k8sdeps/kunstruct/helper.go
+++ b/api/k8sdeps/kunstruct/helper.go
@@ -0,0 +1,95 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package kunstruct provides unstructured from api machinery and factory for creating unstructured
+package kunstruct
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// A PathSection contains a list of nested fields, which may end with an
+// indexable value. For instance, foo.bar resolves to a PathSection with 2
+// fields and no index, while foo[0].bar resolves to two path sections, the
+// first containing the field foo and the index 0, and the second containing
+// the field bar, with no index. The latter PathSection references the bar
+// field of the first item in the foo list
+type PathSection struct {
+	fields []string
+	idx    int
+}
+
+func newPathSection() PathSection {
+	return PathSection{idx: -1}
+}
+
+func appendNonEmpty(section *PathSection, field string) {
+	if len(field) != 0 {
+		section.fields = append(section.fields, field)
+	}
+}
+
+func parseFields(path string) (result []PathSection, err error) {
+	section := newPathSection()
+	if !strings.Contains(path, "[") {
+		section.fields = strings.Split(path, ".")
+		result = append(result, section)
+		return result, nil
+	}
+
+	start := 0
+	insideParentheses := false
+	for i, c := range path {
+		switch c {
+		case '.':
+			if !insideParentheses {
+				appendNonEmpty(&section, path[start:i])
+				start = i + 1
+			}
+		case '[':
+			if !insideParentheses {
+				appendNonEmpty(&section, path[start:i])
+				start = i + 1
+				insideParentheses = true
+			} else {
+				return nil, fmt.Errorf("nested parentheses are not allowed: %s", path)
+			}
+		case ']':
+			if insideParentheses {
+				// Assign this index to the current
+				// PathSection, save it to the result, then begin
+				// a new PathSection
+				tmpIdx, err := strconv.Atoi(path[start:i])
+				if err == nil {
+					// We have detected an integer so an array.
+					section.idx = tmpIdx
+				} else {
+					// We have detected the downwardapi syntax
+					appendNonEmpty(&section, path[start:i])
+				}
+				result = append(result, section)
+				section = newPathSection()
+
+				start = i + 1
+				insideParentheses = false
+			} else {
+				return nil, fmt.Errorf("invalid field path %s", path)
+			}
+		}
+	}
+	if start < len(path)-1 {
+		appendNonEmpty(&section, path[start:])
+		result = append(result, section)
+	}
+
+	for _, section := range result {
+		for i, f := range section.fields {
+			if strings.HasPrefix(f, "\"") || strings.HasPrefix(f, "'") {
+				section.fields[i] = strings.Trim(f, "\"'")
+			}
+		}
+	}
+	return result, nil
+}
--- a/api/k8sdeps/kunstruct/helper_test.go
+++ b/api/k8sdeps/kunstruct/helper_test.go
@@ -0,0 +1,152 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"reflect"
+	"testing"
+)
+
+type PathSectionSlice []PathSection
+
+func buildPath(idx int, fields ...string) PathSectionSlice {
+	return PathSectionSlice{PathSection{fields: fields, idx: idx}}
+}
+
+func (a PathSectionSlice) addSection(idx int, fields ...string) PathSectionSlice {
+	return append(a, PathSection{fields: fields, idx: idx})
+}
+
+func TestParseField(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue []PathSection
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: buildPath(-1, "Kind"),
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: buildPath(-1, "metadata", "name"),
+			errorExpected: false,
+		},
+		{
+			name:          "threeFields",
+			pathToField:   "spec.ports.port",
+			expectedValue: buildPath(-1, "spec", "ports", "port"),
+			errorExpected: false,
+		},
+		{
+			name:          "empty",
+			pathToField:   "",
+			expectedValue: buildPath(-1, ""),
+			errorExpected: false,
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[1]",
+			expectedValue: buildPath(1, "that"),
+			errorExpected: false,
+		},
+		{
+			name:          "sliceInSlice",
+			pathToField:   "that[1][0]",
+			expectedValue: buildPath(1, "that").addSection(0),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			expectedValue: buildPath(1, "those").addSection(-1, "field2"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[0]",
+			expectedValue: buildPath(1, "these").addSection(0, "field2"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			expectedValue: buildPath(1, "complextree").addSection(1, "field2").addSection(-1, "stringsubfield"),
+			errorExpected: false,
+		},
+		{
+			name:          "validStructDownwardAPI",
+			pathToField:   `metadata.labels["app.kubernetes.io/component"]`,
+			expectedValue: buildPath(-1, "metadata", "labels", "app.kubernetes.io/component"),
+			errorExpected: false,
+		},
+		{
+			name:          "invalidIndexInIndex",
+			pathToField:   "complextree[1[0]]",
+			errorExpected: true,
+			errorMsg:      "nested parentheses are not allowed: complextree[1[0]]",
+		},
+		{
+			name:          "invalidClosingBrackets",
+			pathToField:   "complextree[1]]",
+			errorExpected: true,
+			errorMsg:      "invalid field path complextree[1]]",
+		},
+		{
+			name:          "validFieldsWithQuotes",
+			pathToField:   "'complextree'[1].field2[1].'stringsubfield'",
+			expectedValue: buildPath(1, "complextree").addSection(1, "field2").addSection(-1, "stringsubfield"),
+			errorExpected: false,
+		},
+	}
+
+	for _, test := range tests {
+		s, err := parseFields(test.pathToField)
+		if test.errorExpected {
+			compareExpectedParserError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedParserError(t, test.name, test.pathToField, err)
+		}
+		compareParserValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+// unExpectedError function handles unexpected error
+func unExpectedParserError(t *testing.T, name string, pathToField string, err error) {
+	t.Fatalf("%q; path %q - unexpected error %v", name, pathToField, err)
+}
+
+// compareExpectedError compares the expectedError and the actualError return by parseFields
+func compareExpectedParserError(t *testing.T, name string, pathToField string, err error, errorMsg string) {
+	if err == nil {
+		t.Fatalf("%q; path %q - should return error, but no error returned",
+			name, pathToField)
+	}
+
+	if errorMsg != err.Error() {
+		t.Fatalf("%q; path %q - expected error: \"%s\", got error: \"%v\"",
+			name, pathToField, errorMsg, err.Error())
+	}
+}
+
+// compareValues compares the expectedValue and actualValue returned by parseFields
+func compareParserValues(t *testing.T, name string, pathToField string, expectedValue PathSectionSlice, actualValue []PathSection) {
+	t.Helper()
+	if len(expectedValue) != len(actualValue) {
+		t.Fatalf("%q; Path: %s Got: %v Expected: %v", name, pathToField, actualValue, expectedValue)
+	}
+
+	for idx, expected := range expectedValue {
+		if !reflect.DeepEqual(expected, actualValue[idx]) {
+			t.Fatalf("%q; Path: %s idx: %v Fields Got: %v Expected: %v", name, pathToField, idx, actualValue[idx], expected)
+		}
+	}
+}
--- a/api/k8sdeps/kunstruct/unstructadapter.go
+++ b/api/k8sdeps/kunstruct/unstructadapter.go
@@ -0,0 +1,350 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package kunstruct provides unstructured from api machinery and factory for creating unstructured
+package kunstruct
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resid"
+)
+
+var _ ifc.Kunstructured = &UnstructAdapter{}
+
+// UnstructAdapter wraps unstructured.Unstructured from
+// https://github.com/kubernetes/apimachinery/blob/master/
+//     pkg/apis/meta/v1/unstructured/unstructured.go
+// to isolate dependence on apimachinery.
+type UnstructAdapter struct {
+	unstructured.Unstructured
+}
+
+// NewKunstructuredFromObject returns a new instance of Kunstructured.
+func NewKunstructuredFromObject(obj runtime.Object) (ifc.Kunstructured, error) {
+	// Convert obj to a byte stream, then convert that to JSON (Unstructured).
+	marshaled, err := json.Marshal(obj)
+	if err != nil {
+		return &UnstructAdapter{}, err
+	}
+	var u unstructured.Unstructured
+	err = u.UnmarshalJSON(marshaled)
+	// creationTimestamp always 'null', remove it
+	u.SetCreationTimestamp(metav1.Time{})
+	return &UnstructAdapter{Unstructured: u}, err
+}
+
+// GetGvk returns the Gvk name of the object.
+func (fs *UnstructAdapter) GetGvk() resid.Gvk {
+	x := fs.GroupVersionKind()
+	return resid.Gvk{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+// SetGvk set the Gvk of the object to the input Gvk
+func (fs *UnstructAdapter) SetGvk(g resid.Gvk) {
+	fs.SetGroupVersionKind(toSchemaGvk(g))
+}
+
+// Copy provides a copy behind an interface.
+func (fs *UnstructAdapter) Copy() ifc.Kunstructured {
+	return &UnstructAdapter{*fs.DeepCopy()}
+}
+
+// Map returns the unstructured content map.
+func (fs *UnstructAdapter) Map() map[string]interface{} {
+	return fs.Object
+}
+
+// SetMap overrides the unstructured content map.
+func (fs *UnstructAdapter) SetMap(m map[string]interface{}) {
+	fs.Object = m
+}
+
+func (fs *UnstructAdapter) selectSubtree(path string) (map[string]interface{}, []string, bool, error) {
+	sections, err := parseFields(path)
+	if len(sections) == 0 || (err != nil) {
+		return nil, nil, false, err
+	}
+
+	content := fs.UnstructuredContent()
+	lastSectionIdx := len(sections)
+
+	// There are multiple sections to walk
+	for sectionIdx := 0; sectionIdx < lastSectionIdx; sectionIdx++ {
+		idx := sections[sectionIdx].idx
+		fields := sections[sectionIdx].fields
+
+		if idx == -1 {
+			// This section has no index
+			return content, fields, true, nil
+		}
+
+		// This section is terminated by an indexed field.
+		// Let's extract the slice first
+		indexedField, found, err := unstructured.NestedFieldNoCopy(content, fields...)
+		if !found || err != nil {
+			return content, fields, found, err
+		}
+		s, ok := indexedField.([]interface{})
+		if !ok {
+			return content, fields, false, fmt.Errorf("%v is of the type %T, expected []interface{}", indexedField, indexedField)
+		}
+		if idx >= len(s) {
+			return content, fields, false, fmt.Errorf("index %d is out of bounds", idx)
+		}
+
+		if sectionIdx == lastSectionIdx-1 {
+			// This is the last section. Let's build a fake map
+			// to let the rest of the field extraction to work.
+			idxstring := fmt.Sprintf("[%v]", idx)
+			newContent := map[string]interface{}{idxstring: s[idx]}
+			newFields := []string{idxstring}
+			return newContent, newFields, true, nil
+		}
+
+		newContent, ok := s[idx].(map[string]interface{})
+		if !ok {
+			// Only map are supported here
+			return content, fields, false,
+				fmt.Errorf("%#v is expected to be of type map[string]interface{}", s[idx])
+		}
+		content = newContent
+	}
+
+	// It seems to be an invalid path
+	return nil, []string{}, false, nil
+}
+
+// GetFieldValue returns the value at the given fieldpath.
+func (fs *UnstructAdapter) GetFieldValue(path string) (interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedFieldNoCopy(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetString returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetString(path string) (string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return "", noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedString(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return "", noFieldError{Field: path}
+}
+
+// GetStringSlice returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetStringSlice(path string) ([]string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return []string{}, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedStringSlice(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return []string{}, noFieldError{Field: path}
+}
+
+// GetBool returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetBool(path string) (bool, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return false, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedBool(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return false, noFieldError{Field: path}
+}
+
+// GetFloat64 returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetFloat64(path string) (float64, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return 0, err
+	}
+
+	s, found, err := unstructured.NestedFloat64(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return 0, noFieldError{Field: path}
+}
+
+// GetInt64 returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetInt64(path string) (int64, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return 0, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedInt64(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return 0, noFieldError{Field: path}
+}
+
+// GetSlice returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetSlice(path string) ([]interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedSlice(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetStringMap returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetStringMap(path string) (map[string]string, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedStringMap(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+// GetMap returns value at the given fieldpath.
+func (fs *UnstructAdapter) GetMap(path string) (map[string]interface{}, error) {
+	content, fields, found, err := fs.selectSubtree(path)
+	if !found || err != nil {
+		return nil, noFieldError{Field: path}
+	}
+
+	s, found, err := unstructured.NestedMap(
+		content, fields...)
+	if found || err != nil {
+		return s, err
+	}
+	return nil, noFieldError{Field: path}
+}
+
+func (fs *UnstructAdapter) MatchesLabelSelector(selector string) (bool, error) {
+	s, err := labels.Parse(selector)
+	if err != nil {
+		return false, err
+	}
+	return s.Matches(labels.Set(fs.GetLabels())), nil
+}
+
+func (fs *UnstructAdapter) MatchesAnnotationSelector(selector string) (bool, error) {
+	s, err := labels.Parse(selector)
+	if err != nil {
+		return false, err
+	}
+	return s.Matches(labels.Set(fs.GetAnnotations())), nil
+}
+
+func (fs *UnstructAdapter) Patch(patch ifc.Kunstructured) error {
+	versionedObj, err := scheme.Scheme.New(
+		toSchemaGvk(patch.GetGvk()))
+	merged := map[string]interface{}{}
+	saveName := fs.GetName()
+	switch {
+	case runtime.IsNotRegisteredError(err):
+		baseBytes, err := json.Marshal(fs.Map())
+		if err != nil {
+			return err
+		}
+		patchBytes, err := json.Marshal(patch.Map())
+		if err != nil {
+			return err
+		}
+		mergedBytes, err := jsonpatch.MergePatch(baseBytes, patchBytes)
+		if err != nil {
+			return err
+		}
+		err = json.Unmarshal(mergedBytes, &merged)
+		if err != nil {
+			return err
+		}
+	case err != nil:
+		return err
+	default:
+		// Use Strategic-Merge-Patch to handle types w/ schema
+		// TODO: Change this to use the new Merge package.
+		// Store the name of the target object, because this name may have been munged.
+		// Apply this name to the patched object.
+		lookupPatchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObj)
+		if err != nil {
+			return err
+		}
+		merged, err = strategicpatch.StrategicMergeMapPatchUsingLookupPatchMeta(
+			fs.Map(),
+			patch.Map(),
+			lookupPatchMeta)
+		if err != nil {
+			return err
+		}
+	}
+	fs.SetMap(merged)
+	if len(fs.Map()) != 0 {
+		// if the patch deletes the object
+		// don't reset the name
+		fs.SetName(saveName)
+	}
+	return nil
+}
+
+// toSchemaGvk converts to a schema.GroupVersionKind.
+func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+// noFieldError is returned when a field is expected, but missing.
+type noFieldError struct {
+	Field string
+}
+
+func (e noFieldError) Error() string {
+	return fmt.Sprintf("no field named '%s'", e.Field)
+}
--- a/api/k8sdeps/kunstruct/unstructadapter_test.go
+++ b/api/k8sdeps/kunstruct/unstructadapter_test.go
@@ -0,0 +1,831 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kunstruct
+
+import (
+	"reflect"
+	"testing"
+)
+
+var kunstructured = NewKunstructuredFactoryImpl().FromMap(map[string]interface{}{
+	"Kind": "Service",
+	"metadata": map[string]interface{}{
+		"labels": map[string]interface{}{
+			"app": "application-name",
+		},
+		"name": "service-name",
+	},
+	"spec": map[string]interface{}{
+		"ports": map[string]interface{}{
+			"port": int64(80),
+		},
+	},
+	"this": map[string]interface{}{
+		"is": map[string]interface{}{
+			"aNumber":      int64(1000),
+			"aFloat":       float64(1.001),
+			"aNilValue":    nil,
+			"aBool":        true,
+			"anEmptyMap":   map[string]interface{}{},
+			"anEmptySlice": []interface{}{},
+			"unrecognizable": testing.InternalExample{
+				Name: "fooBar",
+			},
+		},
+	},
+	"that": []interface{}{
+		"idx0",
+		"idx1",
+		"idx2",
+		"idx3",
+	},
+	"those": []interface{}{
+		map[string]interface{}{
+			"field1": "idx0foo",
+			"field2": "idx0bar",
+		},
+		map[string]interface{}{
+			"field1": "idx1foo",
+			"field2": "idx1bar",
+		},
+		map[string]interface{}{
+			"field1": "idx2foo",
+			"field2": "idx2bar",
+		},
+	},
+	"these": []interface{}{
+		map[string]interface{}{
+			"field1": []interface{}{"idx010", "idx011"},
+			"field2": []interface{}{"idx020", "idx021"},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{"idx110", "idx111"},
+			"field2": []interface{}{"idx120", "idx121"},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{"idx210", "idx211"},
+			"field2": []interface{}{"idx220", "idx221"},
+		},
+	},
+	"complextree": []interface{}{
+		map[string]interface{}{
+			"field1": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1010",
+					"intsubfield":    int64(1010),
+					"floatsubfield":  float64(1.010),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1011",
+					"intsubfield":    int64(1011),
+					"floatsubfield":  float64(1.011),
+					"boolfield":      false,
+				},
+			},
+			"field2": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1020",
+					"intsubfield":    int64(1020),
+					"floatsubfield":  float64(1.020),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1021",
+					"intsubfield":    int64(1021),
+					"floatsubfield":  float64(1.021),
+					"boolfield":      false,
+				},
+			},
+		},
+		map[string]interface{}{
+			"field1": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1110",
+					"intsubfield":    int64(1110),
+					"floatsubfield":  float64(1.110),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1111",
+					"intsubfield":    int64(1111),
+					"floatsubfield":  float64(1.111),
+					"boolfield":      false,
+				},
+			},
+			"field2": []interface{}{
+				map[string]interface{}{
+					"stringsubfield": "idx1120",
+					"intsubfield":    int64(1120),
+					"floatsubfield":  float64(1.1120),
+					"boolfield":      true,
+				},
+				map[string]interface{}{
+					"stringsubfield": "idx1121",
+					"intsubfield":    int64(1121),
+					"floatsubfield":  float64(1.1121),
+					"boolfield":      false,
+				},
+			},
+		},
+	},
+})
+
+func TestGetFieldValue(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue interface{}
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: "Service",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: "service-name",
+			errorExpected: false,
+		},
+		{
+			name:          "threeFields",
+			pathToField:   "spec.ports.port",
+			expectedValue: int64(80),
+			errorExpected: false,
+		},
+		{
+			name:          "empty",
+			pathToField:   "",
+			errorExpected: true,
+			errorMsg:      "no field named ''",
+		},
+		{
+			name:          "emptyDotEmpty",
+			pathToField:   ".",
+			errorExpected: true,
+			errorMsg:      "no field named '.'",
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "deeperMissingField",
+			pathToField:   "this.is.aDeep.field.that.does.not.exist",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is.aDeep.field.that.does.not.exist'",
+		},
+		{
+			name:          "emptyMap",
+			pathToField:   "this.is.anEmptyMap",
+			errorExpected: false,
+			expectedValue: map[string]interface{}{},
+		},
+		{
+			name:          "emptySlice",
+			pathToField:   "this.is.anEmptySlice",
+			errorExpected: false,
+			expectedValue: []interface{}{},
+		},
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: false,
+			expectedValue: int64(1000),
+		},
+		{
+			name:          "floatAsValue",
+			pathToField:   "this.is.aFloat",
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "boolAsValue",
+			pathToField:   "this.is.aBool",
+			errorExpected: false,
+			expectedValue: true,
+		},
+		{
+			name:          "nilAsValue",
+			pathToField:   "this.is.aNilValue",
+			errorExpected: false,
+			expectedValue: nil,
+		},
+		{
+			name:          "unrecognizable",
+			pathToField:   "this.is.unrecognizable.Name",
+			errorExpected: true,
+			errorMsg:      ".this.is.unrecognizable.Name accessor error: {fooBar <nil>  false} is of the type testing.InternalExample, expected map[string]interface{}",
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[2]",
+			expectedValue: "idx2",
+			errorExpected: false,
+		},
+		{
+			name:          "outOfBoundIndex",
+			pathToField:   "that[99]",
+			errorMsg:      "no field named 'that[99]'",
+			errorExpected: true,
+		},
+		{
+			name:          "accessorError",
+			pathToField:   "that[downwardapi]",
+			errorMsg:      ".that.downwardapi accessor error: [idx0 idx1 idx2 idx3] is of the type []interface {}, expected map[string]interface{}",
+			errorExpected: true,
+		},
+		{
+			name:          "unknownSlice",
+			pathToField:   "unknown[0]",
+			errorMsg:      "no field named 'unknown[0]'",
+			errorExpected: true,
+		},
+		{
+			name:          "sliceInSlice",
+			pathToField:   "that[2][0]",
+			errorExpected: true,
+			errorMsg:      "no field named 'that[2][0]'",
+		},
+		{
+			name:          "validStructIndex",
+			pathToField:   "those[1]",
+			errorExpected: false,
+			expectedValue: map[string]interface{}{"field1": "idx1foo", "field2": "idx1bar"},
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			errorExpected: false,
+			expectedValue: "idx1bar",
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[1]",
+			errorExpected: false,
+			expectedValue: "idx121",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+		{
+			name:          "validStructSubFieldIndexInvalidName",
+			pathToField:   "complextree[1].field2[1].invalidsubfield",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1].field2[1].invalidsubfield'",
+		},
+		{
+			name:          "validDownwardAPILabels",
+			pathToField:   `metadata.labels["app"]`,
+			errorExpected: false,
+			expectedValue: "application-name",
+		},
+		{
+			name:          "validDownwardAPISpecs",
+			pathToField:   `spec.ports['port']`,
+			errorExpected: false,
+			expectedValue: int64(80),
+		},
+		{
+			name:          "validDownwardAPIThis",
+			pathToField:   `this.is[aFloat]`,
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "downwardAPIInvalidLabel",
+			pathToField:   `metadata.labels["theisnotanint"]`,
+			errorExpected: true,
+			errorMsg:      `no field named 'metadata.labels["theisnotanint"]'`,
+		},
+		{
+			name:          "downwardAPIInvalidLabel2",
+			pathToField:   `invalidfield.labels["app"]`,
+			errorExpected: true,
+			errorMsg:      `no field named 'invalidfield.labels["app"]'`,
+		},
+		{
+			name:          "invalidIndexInIndex",
+			pathToField:   "complextree[1[0]]",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1[0]]'",
+		},
+		{
+			name:          "invalidClosingBrackets",
+			pathToField:   "complextree[1]]",
+			errorExpected: true,
+			errorMsg:      "no field named 'complextree[1]]'",
+		},
+		{
+			name:          "validFieldsWithQuotes",
+			pathToField:   "'complextree'[1].field2[1].'stringsubfield'",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetFieldValue(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetString(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "oneField",
+			pathToField:   "Kind",
+			expectedValue: "Service",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFields",
+			pathToField:   "metadata.name",
+			expectedValue: "service-name",
+			errorExpected: false,
+		},
+		{
+			name:          "emptyMap",
+			pathToField:   "this.is.anEmptyMap",
+			errorExpected: true,
+			errorMsg:      ".this.is.anEmptyMap accessor error: map[] is of the type map[string]interface {}, expected string",
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "emptySlice",
+			pathToField:   "this.is.anEmptySlice",
+			errorExpected: true,
+			errorMsg:      ".this.is.anEmptySlice accessor error: [] is of the type []interface {}, expected string",
+		},
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: true,
+			errorMsg:      ".this.is.aNumber accessor error: 1000 is of the type int64, expected string",
+		},
+		{
+			name:          "nilAsValue",
+			pathToField:   "this.is.aNilValue",
+			errorExpected: true,
+			errorMsg:      ".this.is.aNilValue accessor error: <nil> is of the type <nil>, expected string",
+		},
+		{
+			name:          "validStringIndex",
+			pathToField:   "that[2]",
+			expectedValue: "idx2",
+			errorExpected: false,
+		},
+		{
+			name:          "validStructIndex",
+			pathToField:   "those[1]",
+			errorExpected: true,
+			errorMsg:      ".[1] accessor error: map[field1:idx1foo field2:idx1bar] is of the type map[string]interface {}, expected string",
+		},
+		{
+			name:          "validStructSubField",
+			pathToField:   "those[1].field2",
+			errorExpected: false,
+			expectedValue: "idx1bar",
+		},
+		{
+			name:          "validStructSubFieldIndex",
+			pathToField:   "these[1].field2[1]",
+			errorExpected: false,
+			expectedValue: "idx121",
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].stringsubfield",
+			errorExpected: false,
+			expectedValue: "idx1121",
+		},
+		{
+			name:          "invalidIndexInMap",
+			pathToField:   "this.is[1]",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is[1]'",
+		},
+		{
+			name:          "anotherInvalidIndexInMap",
+			pathToField:   "this.is[1].aString",
+			errorExpected: true,
+			errorMsg:      "no field named 'this.is[1].aString'",
+		},
+		{
+			name:          "validDownwardAPIField",
+			pathToField:   `metadata.labels["app"]`,
+			errorExpected: false,
+			expectedValue: "application-name",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetString(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetInt64(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue int64
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "numberAsValue",
+			pathToField:   "this.is.aNumber",
+			errorExpected: false,
+			expectedValue: int64(1000),
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].intsubfield",
+			errorExpected: false,
+			expectedValue: int64(1121),
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+		{
+			name:          "validDownwardAPISpecs",
+			pathToField:   `spec.ports['port']`,
+			errorExpected: false,
+			expectedValue: int64(80),
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetInt64(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetFloat64(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue float64
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "floatAsValue",
+			pathToField:   "this.is.aFloat",
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].floatsubfield",
+			errorExpected: false,
+			expectedValue: float64(1.1121),
+		},
+		{
+			name:          "validDownwardAPIThis",
+			pathToField:   `this.is[aFloat]`,
+			errorExpected: false,
+			expectedValue: float64(1.001),
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "index 99 is out of bounds",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetFloat64(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetBool(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		expectedValue bool
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "boolAsValue",
+			pathToField:   "this.is.aBool",
+			errorExpected: false,
+			expectedValue: true,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1].boolfield",
+			errorExpected: false,
+			expectedValue: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		s, err := kunstructured.GetBool(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+		compareValues(t, test.name, test.pathToField, test.expectedValue, s)
+	}
+}
+
+func TestGetStringMap(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validStringMap",
+			pathToField:   "those[2]",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetStringMap(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetMap(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validMap",
+			pathToField:   "those[2]",
+			errorExpected: false,
+		},
+		{
+			name:          "validStructSubFieldIndexSubfield",
+			pathToField:   "complextree[1].field2[1]",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetMap(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetStringSlice(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validStringSlice",
+			pathToField:   "that",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetStringSlice(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+func TestGetSlice(t *testing.T) {
+	tests := []struct {
+		name          string
+		pathToField   string
+		errorExpected bool
+		errorMsg      string
+	}{
+		{
+			name:          "validSlice1",
+			pathToField:   "that",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice2",
+			pathToField:   "those",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice3",
+			pathToField:   "these",
+			errorExpected: false,
+		},
+		{
+			name:          "validSlice4",
+			pathToField:   "complextree",
+			errorExpected: false,
+		},
+		{
+			name:          "twoFieldsOneMissing",
+			pathToField:   "metadata.banana",
+			errorExpected: true,
+			errorMsg:      "no field named 'metadata.banana'",
+		},
+		{
+			name:          "validStructSubFieldOutOfBoundIndex",
+			pathToField:   "these[1].field2[99]",
+			errorExpected: true,
+			errorMsg:      "no field named 'these[1].field2[99]'",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := kunstructured.GetSlice(test.pathToField)
+		if test.errorExpected {
+			compareExpectedError(t, test.name, test.pathToField, err, test.errorMsg)
+			continue
+		}
+		if err != nil {
+			unExpectedError(t, test.name, test.pathToField, err)
+		}
+	}
+}
+
+// unExpectedError function handles unexpected error
+func unExpectedError(t *testing.T, name string, pathToField string, err error) {
+	t.Fatalf("%q; path %q - unexpected error %v", name, pathToField, err)
+}
+
+// compareExpectedError compares the expectedError and the actualError return by GetFieldValue
+func compareExpectedError(t *testing.T, name string, pathToField string, err error, errorMsg string) {
+	if err == nil {
+		t.Fatalf("%q; path %q - should return error, but no error returned",
+			name, pathToField)
+	}
+
+	if errorMsg != err.Error() {
+		t.Fatalf("%q; path %q - expected error: \"%s\", got error: \"%v\"",
+			name, pathToField, errorMsg, err.Error())
+	}
+}
+
+// compareValues compares the expectedValue and actualValue returned by GetFieldValue
+func compareValues(t *testing.T, name string, pathToField string, expectedValue interface{}, actualValue interface{}) {
+	t.Helper()
+	switch typedV := expectedValue.(type) {
+	case nil, string, bool, float64, int, int64:
+		if expectedValue != actualValue {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	case map[string]interface{}:
+		if !reflect.DeepEqual(expectedValue, actualValue) {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	case []interface{}:
+		if !reflect.DeepEqual(expectedValue, actualValue) {
+			t.Fatalf("%q; Got: %v Expected: %v", name, actualValue, expectedValue)
+		}
+	default:
+		t.Logf("%T value at `%s`", typedV, pathToField)
+	}
+}
--- a/api/k8sdeps/transformer/factory.go
+++ b/api/k8sdeps/transformer/factory.go
@@ -0,0 +1,25 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package transformer provides transformer factory
+package transformer
+
+import (
+	"sigs.k8s.io/kustomize/api/k8sdeps/transformer/patch"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// FactoryImpl makes patch transformer and name hash transformer
+type FactoryImpl struct{}
+
+// NewFactoryImpl makes a new factoryImpl instance
+func NewFactoryImpl() *FactoryImpl {
+	return &FactoryImpl{}
+}
+
+func (p *FactoryImpl) MergePatches(patches []*resource.Resource,
+	rf *resource.Factory) (
+	resmap.ResMap, error) {
+	return patch.MergePatches(patches, rf)
+}
--- a/k8sdeps/transformer/patch/patchconflictdetector.go
+++ b/k8sdeps/transformer/patch/patchconflictdetector.go
@@ -1,29 +1,21 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package patch

 import (
 	"encoding/json"
+	"fmt"

-	"github.com/evanphx/json-patch"
+	jsonpatch "github.com/evanphx/json-patch"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/mergepatch"
 	"k8s.io/apimachinery/pkg/util/strategicpatch"
-	"sigs.k8s.io/kustomize/pkg/resource"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 )

 type conflictDetector interface {
@@ -53,7 +45,7 @@ func (jmp *jsonMergePatch) findConflict(
 		if i == conflictingPatchIdx {
 			continue
 		}
-		if !patches[conflictingPatchIdx].Id().GvknEquals(patch.Id()) {
+		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
 			continue
 		}
 		conflict, err := mergepatch.HasConflicts(
@@ -113,7 +105,7 @@ func (smp *strategicMergePatch) findConflict(
 		if i == conflictingPatchIdx {
 			continue
 		}
-		if !patches[conflictingPatchIdx].Id().GvknEquals(patch.Id()) {
+		if !patches[conflictingPatchIdx].OrgId().Equals(patch.OrgId()) {
 			continue
 		}
 		conflict, err := strategicpatch.MergingMapsHaveConflicts(
@@ -131,7 +123,99 @@ func (smp *strategicMergePatch) findConflict(
 }

 func (smp *strategicMergePatch) mergePatches(patch1, patch2 *resource.Resource) (*resource.Resource, error) {
+	if hasDeleteDirectiveMarker(patch2.Map()) {
+		if hasDeleteDirectiveMarker(patch1.Map()) {
+			return nil, fmt.Errorf("cannot merge patches both containing '$patch: delete' directives")
+		}
+		patch1, patch2 = patch2, patch1
+	}
 	mergeJSONMap, err := strategicpatch.MergeStrategicMergeMapPatchUsingLookupPatchMeta(
 		smp.lookupPatchMeta, patch1.Map(), patch2.Map())
 	return smp.rf.FromMap(mergeJSONMap), err
 }
+
+// MergePatches merge and index patches by OrgId.
+// It errors out if there is conflict between patches.
+func MergePatches(patches []*resource.Resource,
+	rf *resource.Factory) (resmap.ResMap, error) {
+	rc := resmap.New()
+	for ix, patch := range patches {
+		id := patch.OrgId()
+		existing := rc.GetMatchingResourcesByOriginalId(id.Equals)
+		if len(existing) == 0 {
+			rc.Append(patch)
+			continue
+		}
+		if len(existing) > 1 {
+			return nil, fmt.Errorf("self conflict in patches")
+		}
+
+		versionedObj, err := scheme.Scheme.New(toSchemaGvk(id.Gvk))
+		if err != nil && !runtime.IsNotRegisteredError(err) {
+			return nil, err
+		}
+		var cd conflictDetector
+		if err != nil {
+			cd = newJMPConflictDetector(rf)
+		} else {
+			cd, err = newSMPConflictDetector(versionedObj, rf)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		conflict, err := cd.hasConflict(existing[0], patch)
+		if err != nil {
+			return nil, err
+		}
+		if conflict {
+			conflictingPatch, err := cd.findConflict(ix, patches)
+			if err != nil {
+				return nil, err
+			}
+			return nil, fmt.Errorf(
+				"conflict between %#v and %#v",
+				conflictingPatch.Map(), patch.Map())
+		}
+		merged, err := cd.mergePatches(existing[0], patch)
+		if err != nil {
+			return nil, err
+		}
+		rc.Replace(merged)
+	}
+	return rc, nil
+}
+
+// toSchemaGvk converts to a schema.GroupVersionKind.
+func toSchemaGvk(x resid.Gvk) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   x.Group,
+		Version: x.Version,
+		Kind:    x.Kind,
+	}
+}
+
+func hasDeleteDirectiveMarker(patch map[string]interface{}) bool {
+	if v, ok := patch["$patch"]; ok && v == "delete" {
+		return true
+	}
+	for _, v := range patch {
+		switch typedV := v.(type) {
+		case map[string]interface{}:
+			if hasDeleteDirectiveMarker(typedV) {
+				return true
+			}
+		case []interface{}:
+			for _, sv := range typedV {
+				typedE, ok := sv.(map[string]interface{})
+				if !ok {
+					break
+				}
+				if hasDeleteDirectiveMarker(typedE) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
--- a/api/k8sdeps/validator/validators.go
+++ b/api/k8sdeps/validator/validators.go
@@ -0,0 +1,102 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package validator provides functions to validate labels, annotations,
+// namespaces and configmap/secret keys using apimachinery functions.
+package validator
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	apivalidation "k8s.io/apimachinery/pkg/api/validation"
+	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// KustValidator validates Labels and annotations by apimachinery
+type KustValidator struct{}
+
+// NewKustValidator returns a KustValidator object
+func NewKustValidator() *KustValidator {
+	return &KustValidator{}
+}
+
+func (v *KustValidator) ErrIfInvalidKey(k string) error {
+	if errs := validation.IsConfigMapKey(k); len(errs) != 0 {
+		return fmt.Errorf(
+			"%q is not a valid key name: %s",
+			k, strings.Join(errs, ";"))
+	}
+	return nil
+}
+
+func (v *KustValidator) IsEnvVarName(k string) error {
+	if errs := validation.IsEnvVarName(k); len(errs) != 0 {
+		return fmt.Errorf(
+			"%q is not a valid key name: %s",
+			k, strings.Join(errs, ";"))
+	}
+	return nil
+}
+
+// MakeAnnotationValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeAnnotationValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		errs := apivalidation.ValidateAnnotations(x, field.NewPath("field"))
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeAnnotationNameValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeAnnotationNameValidator() func([]string) error {
+	return func(x []string) error {
+		errs := field.ErrorList{}
+		fldPath := field.NewPath("field")
+		for _, k := range x {
+			for _, msg := range validation.IsQualifiedName(strings.ToLower(k)) {
+				errs = append(errs, field.Invalid(fldPath, k, msg))
+			}
+		}
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeLabelValidator returns a MapValidatorFunc using apimachinery.
+func (v *KustValidator) MakeLabelValidator() func(map[string]string) error {
+	return func(x map[string]string) error {
+		errs := v1validation.ValidateLabels(x, field.NewPath("field"))
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// MakeLabelNameValidator returns a ArrayValidatorFunc using apimachinery.
+func (v *KustValidator) MakeLabelNameValidator() func([]string) error {
+	return func(x []string) error {
+		errs := field.ErrorList{}
+		fldPath := field.NewPath("field")
+		for _, k := range x {
+			errs = append(errs, v1validation.ValidateLabelName(k, fldPath)...)
+		}
+		if len(errs) > 0 {
+			return errors.New(errs.ToAggregate().Error())
+		}
+		return nil
+	}
+}
+
+// ValidateNamespace validates a string is a valid namespace using apimachinery.
+func (v *KustValidator) ValidateNamespace(s string) []string {
+	return validation.IsDNS1123Label(s)
+}
--- a/api/kv/kv.go
+++ b/api/kv/kv.go
@@ -0,0 +1,213 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kv
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+var utf8bom = []byte{0xEF, 0xBB, 0xBF}
+
+// loader reads and validates KV pairs.
+type loader struct {
+	// Used to read the filesystem.
+	ldr ifc.Loader
+
+	// Used to validate various k8s data fields.
+	validator ifc.Validator
+}
+
+func NewLoader(ldr ifc.Loader, v ifc.Validator) ifc.KvLoader {
+	return &loader{ldr: ldr, validator: v}
+}
+
+func (kvl *loader) Validator() ifc.Validator {
+	return kvl.validator
+}
+
+func (kvl *loader) Load(
+	args types.KvPairSources) (all []types.Pair, err error) {
+	pairs, err := kvl.keyValuesFromEnvFiles(args.EnvSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"env source files: %v",
+			args.EnvSources))
+	}
+	all = append(all, pairs...)
+
+	pairs, err = keyValuesFromLiteralSources(args.LiteralSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"literal sources %v", args.LiteralSources))
+	}
+	all = append(all, pairs...)
+
+	pairs, err = kvl.keyValuesFromFileSources(args.FileSources)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf(
+			"file sources: %v", args.FileSources))
+	}
+	return append(all, pairs...), nil
+}
+
+func keyValuesFromLiteralSources(sources []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, s := range sources {
+		k, v, err := parseLiteralSource(s)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, types.Pair{Key: k, Value: v})
+	}
+	return kvs, nil
+}
+
+func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, s := range sources {
+		k, fPath, err := parseFileSource(s)
+		if err != nil {
+			return nil, err
+		}
+		content, err := kvl.ldr.Load(fPath)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, types.Pair{Key: k, Value: string(content)})
+	}
+	return kvs, nil
+}
+
+func (kvl *loader) keyValuesFromEnvFiles(paths []string) ([]types.Pair, error) {
+	var kvs []types.Pair
+	for _, p := range paths {
+		content, err := kvl.ldr.Load(p)
+		if err != nil {
+			return nil, err
+		}
+		more, err := kvl.keyValuesFromLines(content)
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, more...)
+	}
+	return kvs, nil
+}
+
+// keyValuesFromLines parses given content in to a list of key-value pairs.
+func (kvl *loader) keyValuesFromLines(content []byte) ([]types.Pair, error) {
+	var kvs []types.Pair
+
+	scanner := bufio.NewScanner(bytes.NewReader(content))
+	currentLine := 0
+	for scanner.Scan() {
+		// Process the current line, retrieving a key/value pair if
+		// possible.
+		scannedBytes := scanner.Bytes()
+		kv, err := kvl.keyValuesFromLine(scannedBytes, currentLine)
+		if err != nil {
+			return nil, err
+		}
+		currentLine++
+
+		if len(kv.Key) == 0 {
+			// no key means line was empty or a comment
+			continue
+		}
+
+		kvs = append(kvs, kv)
+	}
+	return kvs, nil
+}
+
+// KeyValuesFromLine returns a kv with blank key if the line is empty or a comment.
+// The value will be retrieved from the environment if necessary.
+func (kvl *loader) keyValuesFromLine(line []byte, currentLine int) (types.Pair, error) {
+	kv := types.Pair{}
+
+	if !utf8.Valid(line) {
+		return kv, fmt.Errorf("line %d has invalid utf8 bytes : %v", line, string(line))
+	}
+
+	// We trim UTF8 BOM from the first line of the file but no others
+	if currentLine == 0 {
+		line = bytes.TrimPrefix(line, utf8bom)
+	}
+
+	// trim the line from all leading whitespace first
+	line = bytes.TrimLeftFunc(line, unicode.IsSpace)
+
+	// If the line is empty or a comment, we return a blank key/value pair.
+	if len(line) == 0 || line[0] == '#' {
+		return kv, nil
+	}
+
+	data := strings.SplitN(string(line), "=", 2)
+	key := data[0]
+	if err := kvl.validator.IsEnvVarName(key); err != nil {
+		return kv, err
+	}
+
+	if len(data) == 2 {
+		kv.Value = data[1]
+	} else {
+		// No value (no `=` in the line) is a signal to obtain the value
+		// from the environment.
+		kv.Value = os.Getenv(key)
+	}
+	kv.Key = key
+	return kv, nil
+}
+
+// ParseFileSource parses the source given.
+//
+//  Acceptable formats include:
+//   1.  source-path: the basename will become the key name
+//   2.  source-name=source-path: the source-name will become the key name and
+//       source-path is the path to the key file.
+//
+// Key names cannot include '='.
+func parseFileSource(source string) (keyName, filePath string, err error) {
+	numSeparators := strings.Count(source, "=")
+	switch {
+	case numSeparators == 0:
+		return path.Base(source), source, nil
+	case numSeparators == 1 && strings.HasPrefix(source, "="):
+		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
+	case numSeparators == 1 && strings.HasSuffix(source, "="):
+		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
+	case numSeparators > 1:
+		return "", "", errors.New("key names or file paths cannot contain '='")
+	default:
+		components := strings.Split(source, "=")
+		return components[0], components[1], nil
+	}
+}
+
+// ParseLiteralSource parses the source key=val pair into its component pieces.
+// This functionality is distinguished from strings.SplitN(source, "=", 2) since
+// it returns an error in the case of empty keys, values, or a missing equals sign.
+func parseLiteralSource(source string) (keyName, value string, err error) {
+	// leading equal is invalid
+	if strings.Index(source, "=") == 0 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	// split after the first equal (so values can have the = character)
+	items := strings.SplitN(source, "=", 2)
+	if len(items) != 2 {
+		return "", "", fmt.Errorf("invalid literal source %v, expected key=value", source)
+	}
+	return items[0], strings.Trim(items[1], "\"'"), nil
+}
--- a/api/kv/kv_test.go
+++ b/api/kv/kv_test.go
@@ -0,0 +1,97 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kv
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	ldr "sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/testutils/valtest"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func makeKvLoader(fSys filesys.FileSystem) *loader {
+	return &loader{
+		ldr:       ldr.NewFileLoaderAtRoot(fSys),
+		validator: valtest_test.MakeFakeValidator()}
+}
+
+func TestKeyValuesFromLines(t *testing.T) {
+	tests := []struct {
+		desc          string
+		content       string
+		expectedPairs []types.Pair
+		expectedErr   bool
+	}{
+		{
+			desc: "valid kv content parse",
+			content: `
+		k1=v1
+		k2=v2
+		`,
+			expectedPairs: []types.Pair{
+				{Key: "k1", Value: "v1"},
+				{Key: "k2", Value: "v2"},
+			},
+			expectedErr: false,
+		},
+		{
+			desc: "content with comments",
+			content: `
+		k1=v1
+		#k2=v2
+		`,
+			expectedPairs: []types.Pair{
+				{Key: "k1", Value: "v1"},
+			},
+			expectedErr: false,
+		},
+		// TODO: add negative testcases
+	}
+
+	kvl := makeKvLoader(filesys.MakeFsInMemory())
+	for _, test := range tests {
+		pairs, err := kvl.keyValuesFromLines([]byte(test.content))
+		if test.expectedErr && err == nil {
+			t.Fatalf("%s should not return error", test.desc)
+		}
+		if !reflect.DeepEqual(pairs, test.expectedPairs) {
+			t.Errorf("%s should succeed, got:%v exptected:%v", test.desc, pairs, test.expectedPairs)
+		}
+	}
+}
+
+func TestKeyValuesFromFileSources(t *testing.T) {
+	tests := []struct {
+		description string
+		sources     []string
+		expected    []types.Pair
+	}{
+		{
+			description: "create kvs from file sources",
+			sources:     []string{"files/app-init.ini"},
+			expected: []types.Pair{
+				{
+					Key:   "app-init.ini",
+					Value: "FOO=bar",
+				},
+			},
+		},
+	}
+
+	fSys := filesys.MakeFsInMemory()
+	fSys.WriteFile("/files/app-init.ini", []byte("FOO=bar"))
+	kvl := makeKvLoader(fSys)
+	for _, tc := range tests {
+		kvs, err := kvl.keyValuesFromFileSources(tc.sources)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(kvs, tc.expected) {
+			t.Fatalf("in testcase: %q updated:\n%#v\ndoesn't match expected:\n%#v\n", tc.description, kvs, tc.expected)
+		}
+	}
+}
--- a/api/loader/fileloader.go
+++ b/api/loader/fileloader.go
@@ -1,18 +1,5 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package loader

@@ -22,15 +9,15 @@ import (
 	"path/filepath"
 	"strings"

-	"sigs.k8s.io/kustomize/pkg/fs"
-	"sigs.k8s.io/kustomize/pkg/git"
-	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
 )

 // fileLoader is a kustomization's interface to files.
 //
 // The directory in which a kustomization file sits
-// is referred to below as the kustomization's root.
+// is referred to below as the kustomization's _root_.
 //
 // An instance of fileLoader has an immutable root,
 // and offers a `New` method returning a new loader
@@ -42,12 +29,13 @@ import (
 //
 //   `Load` is used to visit these paths.
 //
-//   They must terminate in or below the root.
+//   These paths refer to resources, patches,
+//   data for ConfigMaps and Secrets, etc.
 //
-//   They hold things like resources, patches,
-//   data for ConfigMaps, etc.
+//   The loadRestrictor may disallow certain paths
+//   or classes of paths.
 //
-// * bases; other kustomizations
+// * bases (other kustomizations)
 //
 //   `New` is used to load bases.
 //
@@ -75,69 +63,87 @@ import (
 // These restrictions assure that kustomizations
 // are self-contained and relocatable, and impose
 // some safety when relying on remote kustomizations,
-// e.g. a ConfigMap generator specified to read
-// from /etc/passwd will fail.
+// e.g. a remotely loaded ConfigMap generator specified
+// to read from /etc/passwd will fail.
 //
 type fileLoader struct {
 	// Loader that spawned this loader.
 	// Used to avoid cycles.
 	referrer *fileLoader
+
 	// An absolute, cleaned path to a directory.
-	// The Load function reads from this directory,
-	// or directories below it.
-	root fs.ConfirmedDir
+	// The Load function will read non-absolute
+	// paths relative to this directory.
+	root filesys.ConfirmedDir
+
+	// Restricts behavior of Load function.
+	loadRestrictor LoadRestrictorFunc
+
 	// If this is non-nil, the files were
 	// obtained from the given repository.
 	repoSpec *git.RepoSpec
+
 	// File system utilities.
-	fSys fs.FileSystem
+	fSys filesys.FileSystem
+
 	// Used to clone repositories.
 	cloner git.Cloner
+
 	// Used to clean up, as needed.
 	cleaner func() error
 }

+const CWD = "."
+
 // NewFileLoaderAtCwd returns a loader that loads from ".".
-func NewFileLoaderAtCwd(fSys fs.FileSystem) *fileLoader {
-	return newLoaderOrDie(fSys, ".")
+// A convenience for kustomize edit commands.
+func NewFileLoaderAtCwd(fSys filesys.FileSystem) *fileLoader {
+	return newLoaderOrDie(
+		RestrictionRootOnly, fSys, CWD)
 }

 // NewFileLoaderAtRoot returns a loader that loads from "/".
-func NewFileLoaderAtRoot(fSys fs.FileSystem) *fileLoader {
-	return newLoaderOrDie(fSys, string(filepath.Separator))
+// A convenience for tests.
+func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
+	return newLoaderOrDie(
+		RestrictionRootOnly, fSys, string(filepath.Separator))
 }

 // Root returns the absolute path that is prepended to any
 // relative paths used in Load.
-func (l *fileLoader) Root() string {
-	return l.root.String()
+func (fl *fileLoader) Root() string {
+	return fl.root.String()
 }

-func newLoaderOrDie(fSys fs.FileSystem, path string) *fileLoader {
+func newLoaderOrDie(
+	lr LoadRestrictorFunc,
+	fSys filesys.FileSystem, path string) *fileLoader {
 	root, err := demandDirectoryRoot(fSys, path)
 	if err != nil {
 		log.Fatalf("unable to make loader at '%s'; %v", path, err)
 	}
 	return newLoaderAtConfirmedDir(
-		root, fSys, nil, git.ClonerUsingGitExec)
+		lr, root, fSys, nil, git.ClonerUsingGitExec)
 }

 // newLoaderAtConfirmedDir returns a new fileLoader with given root.
 func newLoaderAtConfirmedDir(
-	root fs.ConfirmedDir, fSys fs.FileSystem,
+	lr LoadRestrictorFunc,
+	root filesys.ConfirmedDir, fSys filesys.FileSystem,
 	referrer *fileLoader, cloner git.Cloner) *fileLoader {
 	return &fileLoader{
-		root:     root,
-		referrer: referrer,
-		fSys:     fSys,
-		cloner:   cloner,
-		cleaner:  func() error { return nil },
+		loadRestrictor: lr,
+		root:           root,
+		referrer:       referrer,
+		fSys:           fSys,
+		cloner:         cloner,
+		cleaner:        func() error { return nil },
 	}
 }

 // Assure that the given path is in fact a directory.
 func demandDirectoryRoot(
-	fSys fs.FileSystem, path string) (fs.ConfirmedDir, error) {
+	fSys filesys.FileSystem, path string) (filesys.ConfirmedDir, error) {
 	if path == "" {
 		return "", fmt.Errorf(
 			"loader root cannot be empty")
@@ -157,46 +163,50 @@ func demandDirectoryRoot(

 // New returns a new Loader, rooted relative to current loader,
 // or rooted in a temp directory holding a git repo clone.
-func (l *fileLoader) New(path string) (ifc.Loader, error) {
+func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 	if path == "" {
 		return nil, fmt.Errorf("new root cannot be empty")
 	}
 	repoSpec, err := git.NewRepoSpecFromUrl(path)
 	if err == nil {
 		// Treat this as git repo clone request.
-		if err := l.errIfRepoCycle(repoSpec); err != nil {
+		if err := fl.errIfRepoCycle(repoSpec); err != nil {
 			return nil, err
 		}
-		return newLoaderAtGitClone(repoSpec, l.fSys, l.referrer, l.cloner)
+		return newLoaderAtGitClone(
+			repoSpec, fl.fSys, fl, fl.cloner)
 	}
 	if filepath.IsAbs(path) {
 		return nil, fmt.Errorf("new root '%s' cannot be absolute", path)
 	}
-	root, err := demandDirectoryRoot(l.fSys, l.root.Join(path))
+	root, err := demandDirectoryRoot(fl.fSys, fl.root.Join(path))
 	if err != nil {
 		return nil, err
 	}
-	if err := l.errIfGitContainmentViolation(root); err != nil {
+	if err := fl.errIfGitContainmentViolation(root); err != nil {
 		return nil, err
 	}
-	if err := l.errIfArgEqualOrHigher(root); err != nil {
+	if err := fl.errIfArgEqualOrHigher(root); err != nil {
 		return nil, err
 	}
 	return newLoaderAtConfirmedDir(
-		root, l.fSys, l, l.cloner), nil
+		fl.loadRestrictor, root, fl.fSys, fl, fl.cloner), nil
 }

 // newLoaderAtGitClone returns a new Loader pinned to a temporary
 // directory holding a cloned git repo.
 func newLoaderAtGitClone(
-	repoSpec *git.RepoSpec, fSys fs.FileSystem,
+	repoSpec *git.RepoSpec, fSys filesys.FileSystem,
 	referrer *fileLoader, cloner git.Cloner) (ifc.Loader, error) {
+	cleaner := repoSpec.Cleaner(fSys)
 	err := cloner(repoSpec)
 	if err != nil {
+		cleaner()
 		return nil, err
 	}
 	root, f, err := fSys.CleanedAbs(repoSpec.AbsPath())
 	if err != nil {
+		cleaner()
 		return nil, err
 	}
 	// We don't know that the path requested in repoSpec
@@ -204,23 +214,26 @@ func newLoaderAtGitClone(
 	// inside.  That just happened, hence the error check
 	// is here.
 	if f != "" {
+		cleaner()
 		return nil, fmt.Errorf(
 			"'%s' refers to file '%s'; expecting directory",
 			repoSpec.AbsPath(), f)
 	}
 	return &fileLoader{
-		root:     root,
-		referrer: referrer,
-		repoSpec: repoSpec,
-		fSys:     fSys,
-		cloner:   cloner,
-		cleaner:  repoSpec.Cleaner(fSys),
+		// Clones never allowed to escape root.
+		loadRestrictor: RestrictionRootOnly,
+		root:           root,
+		referrer:       referrer,
+		repoSpec:       repoSpec,
+		fSys:           fSys,
+		cloner:         cloner,
+		cleaner:        cleaner,
 	}, nil
 }

-func (l *fileLoader) errIfGitContainmentViolation(
-	base fs.ConfirmedDir) error {
-	containingRepo := l.containingRepo()
+func (fl *fileLoader) errIfGitContainmentViolation(
+	base filesys.ConfirmedDir) error {
+	containingRepo := fl.containingRepo()
 	if containingRepo == nil {
 		return nil
 	}
@@ -236,77 +249,64 @@ func (l *fileLoader) errIfGitContainmentViolation(

 // Looks back through referrers for a git repo, returning nil
 // if none found.
-func (l *fileLoader) containingRepo() *git.RepoSpec {
-	if l.repoSpec != nil {
-		return l.repoSpec
+func (fl *fileLoader) containingRepo() *git.RepoSpec {
+	if fl.repoSpec != nil {
+		return fl.repoSpec
 	}
-	if l.referrer == nil {
+	if fl.referrer == nil {
 		return nil
 	}
-	return l.referrer.containingRepo()
+	return fl.referrer.containingRepo()
 }

 // errIfArgEqualOrHigher tests whether the argument,
 // is equal to or above the root of any ancestor.
-func (l *fileLoader) errIfArgEqualOrHigher(
-	candidateRoot fs.ConfirmedDir) error {
-	if l.root.HasPrefix(candidateRoot) {
+func (fl *fileLoader) errIfArgEqualOrHigher(
+	candidateRoot filesys.ConfirmedDir) error {
+	if fl.root.HasPrefix(candidateRoot) {
 		return fmt.Errorf(
 			"cycle detected: candidate root '%s' contains visited root '%s'",
-			candidateRoot, l.root)
+			candidateRoot, fl.root)
 	}
-	if l.referrer == nil {
+	if fl.referrer == nil {
 		return nil
 	}
-	return l.referrer.errIfArgEqualOrHigher(candidateRoot)
+	return fl.referrer.errIfArgEqualOrHigher(candidateRoot)
 }

 // TODO(monopole): Distinguish branches?
 // I.e. Allow a distinction between git URI with
 // path foo and tag bar and a git URI with the same
 // path but a different tag?
-func (l *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
+func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 	// TODO(monopole): Use parsed data instead of Raw().
-	if l.repoSpec != nil &&
-		strings.HasPrefix(l.repoSpec.Raw(), newRepoSpec.Raw()) {
+	if fl.repoSpec != nil &&
+		strings.HasPrefix(fl.repoSpec.Raw(), newRepoSpec.Raw()) {
 		return fmt.Errorf(
 			"cycle detected: URI '%s' referenced by previous URI '%s'",
-			newRepoSpec.Raw(), l.repoSpec.Raw())
+			newRepoSpec.Raw(), fl.repoSpec.Raw())
 	}
-	if l.referrer == nil {
+	if fl.referrer == nil {
 		return nil
 	}
-	return l.referrer.errIfRepoCycle(newRepoSpec)
+	return fl.referrer.errIfRepoCycle(newRepoSpec)
 }

-// Load returns content of file at the given relative path,
-// else an error.  The path must refer to a file in or
-// below the current root.
-func (l *fileLoader) Load(path string) ([]byte, error) {
-	if filepath.IsAbs(path) {
-		return nil, l.loadOutOfBounds(path)
+// Load returns the content of file at the given path,
+// else an error.  Relative paths are taken relative
+// to the root.
+func (fl *fileLoader) Load(path string) ([]byte, error) {
+	if !filepath.IsAbs(path) {
+		path = fl.root.Join(path)
 	}
-	d, f, err := l.fSys.CleanedAbs(l.root.Join(path))
+	path, err := fl.loadRestrictor(fl.fSys, fl.root, path)
 	if err != nil {
 		return nil, err
 	}
-	if f == "" {
-		return nil, fmt.Errorf(
-			"'%s' must be a file (got d='%s')", path, d)
-	}
-	if !d.HasPrefix(l.root) {
-		return nil, l.loadOutOfBounds(path)
-	}
-	return l.fSys.ReadFile(d.Join(f))
-}
-
-func (l *fileLoader) loadOutOfBounds(path string) error {
-	return fmt.Errorf(
-		"security; file '%s' is not in or below '%s'",
-		path, l.root)
+	return fl.fSys.ReadFile(path)
 }

 // Cleanup runs the cleaner.
-func (l *fileLoader) Cleanup() error {
-	return l.cleaner()
+func (fl *fileLoader) Cleanup() error {
+	return fl.cleaner()
 }
--- a/api/loader/fileloader_test.go
+++ b/api/loader/fileloader_test.go
@@ -1,18 +1,5 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+/// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

 package loader

@@ -25,11 +12,10 @@ import (
 	"strings"
 	"testing"

-	"sigs.k8s.io/kustomize/pkg/constants"
-	"sigs.k8s.io/kustomize/pkg/git"
-
-	"sigs.k8s.io/kustomize/pkg/fs"
-	"sigs.k8s.io/kustomize/pkg/ifc"
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/pgmconfig"
 )

 type testData struct {
@@ -56,16 +42,20 @@ var testCases = []testData{
 	},
 }

-func MakeFakeFs(td []testData) fs.FileSystem {
-	fSys := fs.MakeFakeFS()
+func MakeFakeFs(td []testData) filesys.FileSystem {
+	fSys := filesys.MakeFsInMemory()
 	for _, x := range td {
 		fSys.WriteFile("/"+x.path, []byte(x.expectedContent))
 	}
 	return fSys
 }

+func makeLoader() *fileLoader {
+	return NewFileLoaderAtRoot(MakeFakeFs(testCases))
+
+}
 func TestLoaderLoad(t *testing.T) {
-	l1 := NewFileLoaderAtRoot(MakeFakeFs(testCases))
+	l1 := makeLoader()
 	if "/" != l1.Root() {
 		t.Fatalf("incorrect root: '%s'\n", l1.Root())
 	}
@@ -104,7 +94,7 @@ func TestLoaderLoad(t *testing.T) {
 }

 func TestLoaderNewSubDir(t *testing.T) {
-	l1, err := NewFileLoaderAtRoot(MakeFakeFs(testCases)).New("foo/project")
+	l1, err := makeLoader().New("foo/project")
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -126,7 +116,7 @@ func TestLoaderNewSubDir(t *testing.T) {
 }

 func TestLoaderBadRelative(t *testing.T) {
-	l1, err := NewFileLoaderAtRoot(MakeFakeFs(testCases)).New("foo/project/subdir1")
+	l1, err := makeLoader().New("foo/project/subdir1")
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -196,7 +186,7 @@ func TestLoaderBadRelative(t *testing.T) {
 }

 func TestLoaderMisc(t *testing.T) {
-	l := NewFileLoaderAtRoot(MakeFakeFs(testCases))
+	l := makeLoader()
 	_, err := l.New("")
 	if err == nil {
 		t.Fatalf("Expected error for empty root location not returned")
@@ -207,46 +197,47 @@ func TestLoaderMisc(t *testing.T) {
 	}
 }

-func TestRestrictedLoadingInRealLoader(t *testing.T) {
-	// Create a structure like this
-	//
-	//   /tmp/kustomize-test-SZwCZYjySj
-	//   ├── base
-	//   │   ├── okayData
-	//   │   ├── symLinkToOkayData -> okayData
-	//   │   └── symLinkToForbiddenData -> ../forbiddenData
-	//   └── forbiddenData
-	//
+const (
+	contentOk           = "hi there, i'm OK data"
+	contentExteriorData = "i am data from outside the root"
+)
+
+// Create a structure like this
+//
+//   /tmp/kustomize-test-random
+//   ├── base
+//   │   ├── okayData
+//   │   ├── symLinkToOkayData -> okayData
+//   │   └── symLinkToExteriorData -> ../exteriorData
+//   └── exteriorData
+//
+func commonSetupForLoaderRestrictionTest() (string, filesys.FileSystem, error) {
 	dir, err := ioutil.TempDir("", "kustomize-test-")
 	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+		return "", nil, err
 	}
-	defer os.RemoveAll(dir)
-
-	fSys := fs.MakeRealFS()
+	fSys := filesys.MakeFsOnDisk()
 	fSys.Mkdir(filepath.Join(dir, "base"))

-	contentOk := "hi there, i'm OK data"
 	fSys.WriteFile(
 		filepath.Join(dir, "base", "okayData"), []byte(contentOk))

-	contentForbidden := "don't be looking at me"
 	fSys.WriteFile(
-		filepath.Join(dir, "forbiddenData"), []byte(contentForbidden))
+		filepath.Join(dir, "exteriorData"), []byte(contentExteriorData))

 	os.Symlink(
 		filepath.Join(dir, "base", "okayData"),
 		filepath.Join(dir, "base", "symLinkToOkayData"))
 	os.Symlink(
-		filepath.Join(dir, "forbiddenData"),
-		filepath.Join(dir, "base", "symLinkToForbiddenData"))
+		filepath.Join(dir, "exteriorData"),
+		filepath.Join(dir, "base", "symLinkToExteriorData"))
+	return dir, fSys, nil
+}

-	var l ifc.Loader
-
-	l = newLoaderOrDie(fSys, dir)
-
-	// Sanity checks - loading from perspective of "dir".
-	// Everything works, including reading from a subdirectory.
+// Make sure everything works when loading files
+// in or below the loader root.
+func doSanityChecksAndDropIntoBase(
+	t *testing.T, l ifc.Loader) ifc.Loader {
 	data, err := l.Load(path.Join("base", "okayData"))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -254,11 +245,11 @@ func TestRestrictedLoadingInRealLoader(t *testing.T) {
 	if string(data) != contentOk {
 		t.Fatalf("unexpected content: %v", data)
 	}
-	data, err = l.Load("forbiddenData")
+	data, err = l.Load("exteriorData")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if string(data) != contentForbidden {
+	if string(data) != contentExteriorData {
 		t.Fatalf("unexpected content: %v", data)
 	}

@@ -285,9 +276,24 @@ func TestRestrictedLoadingInRealLoader(t *testing.T) {
 	if string(data) != contentOk {
 		t.Fatalf("unexpected content: %v", data)
 	}
+	return l
+}

-	// Reading symlink to forbiddenData fails.
-	_, err = l.Load("symLinkToForbiddenData")
+func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
+	dir, fSys, err := commonSetupForLoaderRestrictionTest()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	var l ifc.Loader
+
+	l = newLoaderOrDie(RestrictionRootOnly, fSys, dir)
+
+	l = doSanityChecksAndDropIntoBase(t, l)
+
+	// Reading symlink to exteriorData fails.
+	_, err = l.Load("symLinkToExteriorData")
 	if err == nil {
 		t.Fatalf("expected error")
 	}
@@ -297,7 +303,7 @@ func TestRestrictedLoadingInRealLoader(t *testing.T) {

 	// Attempt to read "up" fails, though earlier we were
 	// able to read this file when root was "..".
-	_, err = l.Load("../forbiddenData")
+	_, err = l.Load("../exteriorData")
 	if err == nil {
 		t.Fatalf("expected error")
 	}
@@ -306,6 +312,32 @@ func TestRestrictedLoadingInRealLoader(t *testing.T) {
 	}
 }

+func TestRestrictionNoneInRealLoader(t *testing.T) {
+	dir, fSys, err := commonSetupForLoaderRestrictionTest()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	var l ifc.Loader
+
+	l = newLoaderOrDie(RestrictionNone, fSys, dir)
+
+	l = doSanityChecksAndDropIntoBase(t, l)
+
+	// Reading symlink to exteriorData works.
+	_, err = l.Load("symLinkToExteriorData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Attempt to read "up" works.
+	_, err = l.Load("../exteriorData")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
 func splitOnNthSlash(v string, n int) (string, string) {
 	left := ""
 	for i := 0; i < n; i++ {
@@ -337,11 +369,12 @@ func TestNewLoaderAtGitClone(t *testing.T) {
 	pathInRepo := "foo/base"
 	url := rootUrl + "/" + pathInRepo
 	coRoot := "/tmp"
-	fSys := fs.MakeFakeFS()
+	fSys := filesys.MakeFsInMemory()
 	fSys.MkdirAll(coRoot)
 	fSys.MkdirAll(coRoot + "/" + pathInRepo)
 	fSys.WriteFile(
-		coRoot+"/"+pathInRepo+"/"+constants.KustomizationFileNames[0],
+		coRoot+"/"+pathInRepo+"/"+
+			pgmconfig.DefaultKustomizationFileName(),
 		[]byte(`
 whatever
 `))
@@ -352,7 +385,7 @@ whatever
 	}
 	l, err := newLoaderAtGitClone(
 		repoSpec, fSys, nil,
-		git.DoNothingCloner(fs.ConfirmedDir(coRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(coRoot)))
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -384,7 +417,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	// Define an overlay-base structure in the file system.
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
-	fSys := fs.MakeFakeFS()
+	fSys := filesys.MakeFsInMemory()
 	fSys.MkdirAll(topDir + "/highBase")
 	fSys.MkdirAll(cloneRoot + "/foo/base")
 	fSys.MkdirAll(cloneRoot + "/foo/overlay")
@@ -393,7 +426,8 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {

 	// Establish that a local overlay can navigate
 	// to the local bases.
-	l1 = newLoaderOrDie(fSys, cloneRoot+"/foo/overlay")
+	l1 = newLoaderOrDie(
+		RestrictionRootOnly, fSys, cloneRoot+"/foo/overlay")
 	if l1.Root() != cloneRoot+"/foo/overlay" {
 		t.Fatalf("unexpected root %s", l1.Root())
 	}
@@ -430,7 +464,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 	}
 	l1, err = newLoaderAtGitClone(
 		repoSpec, fSys, nil,
-		git.DoNothingCloner(fs.ConfirmedDir(cloneRoot)))
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	if err != nil {
 		t.Fatalf("unexpected err: %v\n", err)
 	}
@@ -459,7 +493,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 func TestLocalLoaderReferencingGitBase(t *testing.T) {
 	topDir := "/whatever"
 	cloneRoot := topDir + "/someClone"
-	fSys := fs.MakeFakeFS()
+	fSys := filesys.MakeFsInMemory()
 	fSys.MkdirAll(topDir)
 	fSys.MkdirAll(cloneRoot + "/foo/base")

@@ -468,8 +502,8 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 		t.Fatalf("unexpected err:  %v\n", err)
 	}
 	l1 := newLoaderAtConfirmedDir(
-		root, fSys, nil,
-		git.DoNothingCloner(fs.ConfirmedDir(cloneRoot)))
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
 	if l1.Root() != topDir {
 		t.Fatalf("unexpected root %s", l1.Root())
 	}
@@ -481,3 +515,67 @@ func TestLocalLoaderReferencingGitBase(t *testing.T) {
 		t.Fatalf("unexpected root %s", l2.Root())
 	}
 }
+
+func TestRepoDirectCycleDetection(t *testing.T) {
+	topDir := "/cycles"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot)
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err: %v\n", err)
+	}
+	l1 := newLoaderAtConfirmedDir(
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+	p1 := "github.com/someOrg/someRepo/foo"
+	rs1, err := git.NewRepoSpecFromUrl(p1)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l1.repoSpec = rs1
+	_, err = l1.New(p1)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "cycle detected") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
+
+func TestRepoIndirectCycleDetection(t *testing.T) {
+	topDir := "/cycles"
+	cloneRoot := topDir + "/someClone"
+	fSys := filesys.MakeFsInMemory()
+	fSys.MkdirAll(topDir)
+	fSys.MkdirAll(cloneRoot)
+
+	root, err := demandDirectoryRoot(fSys, topDir)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l0 := newLoaderAtConfirmedDir(
+		RestrictionRootOnly, root, fSys, nil,
+		git.DoNothingCloner(filesys.ConfirmedDir(cloneRoot)))
+
+	p1 := "github.com/someOrg/someRepo1"
+	p2 := "github.com/someOrg/someRepo2"
+
+	l1, err := l0.New(p1)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	l2, err := l1.New(p2)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	_, err = l2.New(p1)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(err.Error(), "cycle detected") {
+		t.Fatalf("unexpected err: %v", err)
+	}
+}
--- a/api/loader/loader.go
+++ b/api/loader/loader.go
@@ -0,0 +1,34 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package loader has a data loading interface and various implementations.
+package loader
+
+import (
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/git"
+	"sigs.k8s.io/kustomize/api/ifc"
+)
+
+// NewLoader returns a Loader pointed at the given target.
+// If the target is remote, the loader will be restricted
+// to the root and below only.  If the target is local, the
+// loader will have the restrictions passed in.  Regardless,
+// if a local target attempts to transitively load remote bases,
+// the remote bases will all be root-only restricted.
+func NewLoader(
+	lr LoadRestrictorFunc,
+	target string, fSys filesys.FileSystem) (ifc.Loader, error) {
+	repoSpec, err := git.NewRepoSpecFromUrl(target)
+	if err == nil {
+		// The target qualifies as a remote git target.
+		return newLoaderAtGitClone(
+			repoSpec, fSys, nil, git.ClonerUsingGitExec)
+	}
+	root, err := demandDirectoryRoot(fSys, target)
+	if err != nil {
+		return nil, err
+	}
+	return newLoaderAtConfirmedDir(
+		lr, root, fSys, nil, git.ClonerUsingGitExec), nil
+}
--- a/api/loader/loadrestrictions.go
+++ b/api/loader/loadrestrictions.go
@@ -0,0 +1,76 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+//go:generate stringer -type=loadRestrictions
+type loadRestrictions int
+
+const (
+	unknown loadRestrictions = iota
+	rootOnly
+	none
+)
+
+const (
+	flagName = "load_restrictor"
+)
+
+var (
+	flagValue = rootOnly.String()
+	flagHelp  = "if set to '" + none.String() +
+		"', local kustomizations may load files from outside their root. " +
+		"This does, however, break the relocatability of the kustomization."
+)
+
+func AddFlagLoadRestrictor(set *pflag.FlagSet) {
+	set.StringVar(
+		&flagValue, flagName,
+		rootOnly.String(), flagHelp)
+}
+
+func ValidateFlagLoadRestrictor() (LoadRestrictorFunc, error) {
+	switch flagValue {
+	case rootOnly.String():
+		return RestrictionRootOnly, nil
+	case none.String():
+		return RestrictionNone, nil
+	default:
+		return nil, fmt.Errorf(
+			"illegal flag value --%s %s; legal values: %v",
+			flagName, flagValue,
+			[]string{rootOnly.String(), none.String()})
+	}
+}
+
+type LoadRestrictorFunc func(
+	filesys.FileSystem, filesys.ConfirmedDir, string) (string, error)
+
+func RestrictionRootOnly(
+	fSys filesys.FileSystem, root filesys.ConfirmedDir, path string) (string, error) {
+	d, f, err := fSys.CleanedAbs(path)
+	if err != nil {
+		return "", err
+	}
+	if f == "" {
+		return "", fmt.Errorf("'%s' must be a file", path)
+	}
+	if !d.HasPrefix(root) {
+		return "", fmt.Errorf(
+			"security; file '%s' is not in or below '%s'",
+			path, root)
+	}
+	return d.Join(f), nil
+}
+
+func RestrictionNone(
+	_ filesys.FileSystem, _ filesys.ConfirmedDir, path string) (string, error) {
+	return path, nil
+}
--- a/api/loader/loadrestrictions_string.go
+++ b/api/loader/loadrestrictions_string.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by "stringer -type=loadRestrictions"; DO NOT EDIT.
+
+package loader
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[unknown-0]
+	_ = x[rootOnly-1]
+	_ = x[none-2]
+}
+
+const _loadRestrictions_name = "unknownrootOnlynone"
+
+var _loadRestrictions_index = [...]uint8{0, 7, 15, 19}
+
+func (i loadRestrictions) String() string {
+	if i < 0 || i >= loadRestrictions(len(_loadRestrictions_index)-1) {
+		return "loadRestrictions(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _loadRestrictions_name[_loadRestrictions_index[i]:_loadRestrictions_index[i+1]]
+}
--- a/api/loader/loadrestrictions_test.go
+++ b/api/loader/loadrestrictions_test.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package loader
+
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+)
+
+func TestRestrictionNone(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	root := filesys.ConfirmedDir("irrelevant")
+	path := "whatever"
+	p, err := RestrictionNone(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+}
+
+func TestRestrictionRootOnly(t *testing.T) {
+	fSys := filesys.MakeFsInMemory()
+	root := filesys.ConfirmedDir("/tmp/foo")
+
+	path := "/tmp/foo/whatever/beans"
+	p, err := RestrictionRootOnly(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+
+	// Legal.
+	path = "/tmp/foo/whatever/../../foo/whatever"
+	p, err = RestrictionRootOnly(fSys, root, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path = "/tmp/foo/whatever"
+	if p != path {
+		t.Fatalf("expected '%s', got '%s'", path, p)
+	}
+
+	// Illegal.
+	path = "/tmp/illegal"
+	_, err = RestrictionRootOnly(fSys, root, path)
+	if err == nil {
+		t.Fatal("should have an error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"file '/tmp/illegal' is not in or below '/tmp/foo'") {
+		t.Fatalf("unexpected err: %s", err)
+	}
+}
--- a/api/main.go
+++ b/api/main.go
@@ -0,0 +1,21 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// A dummy main to help with releasing the kustomize API module.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"sigs.k8s.io/kustomize/api/provenance"
+)
+
+// TODO: delete this when we find a better way to generate release notes.
+func main() {
+	fmt.Println(`
+This 'main' exists only to make goreleaser create release notes for the API.
+See https://github.com/goreleaser/goreleaser/issues/981
+and https://github.com/kubernetes-sigs/kustomize/tree/master/releasing`)
+	provenance.GetProvenance().Print(os.Stdout, false)
+}
--- a/api/pgmconfig/pgmconfig.go
+++ b/api/pgmconfig/pgmconfig.go
@@ -0,0 +1,41 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package pgmconfig
+
+// RecognizedKustomizationFileNames is a list of file names
+// that kustomize recognizes.
+// To avoid ambiguity, a kustomization directory may not
+// contain more than one match to this list.
+func RecognizedKustomizationFileNames() []string {
+	return []string{
+		"kustomization.yaml",
+		"kustomization.yml",
+		"Kustomization",
+	}
+}
+
+func DefaultKustomizationFileName() string {
+	return RecognizedKustomizationFileNames()[0]
+}
+
+const (
+	// An environment variable to consult for kustomization
+	// configuration data.  See:
+	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+	XdgConfigHome = "XDG_CONFIG_HOME"
+
+	// Use this when XdgConfigHome not defined.
+	DefaultConfigSubdir = ".config"
+
+	// Program name, for help, finding the XDG_CONFIG_DIR, etc.
+	ProgramName = "kustomize"
+
+	// TODO: delete this.  it's a copy of a const
+	// defined elsewhere but used by pluginator.
+	DomainName = "sigs.k8s.io"
+
+	// TODO: delete this.  its a copy of a const
+	// defined elsewhere but used by pluginator.
+	PluginRoot = "plugin"
+)
--- a/pkg/transformers/config/defaultconfig/commonannotations.go
+++ b/pkg/transformers/config/defaultconfig/commonannotations.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package defaultconfig
+package consts

 const commonAnnotationFieldSpecs = `
 commonAnnotations:
--- a/pkg/transformers/config/defaultconfig/commonlabels.go
+++ b/pkg/transformers/config/defaultconfig/commonlabels.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package defaultconfig
+package consts

 const commonLabelFieldSpecs = `
 commonLabels:
@@ -110,7 +97,7 @@ commonLabels:
  group: apps
  kind: StatefulSet

- path: spec/volumeClaimTemplates/metadata/labels
+- path: spec/volumeClaimTemplates[]/metadata/labels
  create: true
  group: apps
  kind: StatefulSet
--- a/pkg/transformers/config/defaultconfig/defaultconfig.go
+++ b/pkg/transformers/config/defaultconfig/defaultconfig.go
@@ -1,22 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package defaultconfig provides the default
-// transformer configurations
-package defaultconfig
+package consts

 import (
 	"bytes"
@@ -31,6 +16,8 @@ func GetDefaultFieldSpecs() []byte {
 		[]byte(namespaceFieldSpecs),
 		[]byte(varReferenceFieldSpecs),
 		[]byte(nameReferenceFieldSpecs),
+		[]byte(imagesFieldSpecs),
+		[]byte(replicasFieldSpecs),
 	}
 	return bytes.Join(configData, []byte("\n"))
 }
@@ -45,5 +32,7 @@ func GetDefaultFieldSpecsAsMap() map[string]string {
 	result["namespace"] = namespaceFieldSpecs
 	result["varreference"] = varReferenceFieldSpecs
 	result["namereference"] = nameReferenceFieldSpecs
+	result["images"] = imagesFieldSpecs
+	result["replicas"] = replicasFieldSpecs
 	return result
 }
--- a/api/plugins/builtinconfig/consts/doc.go
+++ b/api/plugins/builtinconfig/consts/doc.go
@@ -0,0 +1,5 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package consts provides builtin plugin configuration data.
+package consts
--- a/api/plugins/builtinconfig/consts/images.go
+++ b/api/plugins/builtinconfig/consts/images.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	// imageFieldSpecs is left empty since `containers` and `initContainers`
+	// of *ANY* kind in *ANY* path are builtin supported in code
+	imagesFieldSpecs = ``
+)
--- a/api/plugins/builtinconfig/consts/nameprefix.go
+++ b/api/plugins/builtinconfig/consts/nameprefix.go
@@ -0,0 +1,11 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	namePrefixFieldSpecs = `
+namePrefix:
+- path: metadata/name
+`
+)
--- a/pkg/transformers/config/defaultconfig/namereference.go
+++ b/pkg/transformers/config/defaultconfig/namereference.go
@@ -1,20 +1,7 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package defaultconfig
+package consts

 const (
 	nameReferenceFieldSpecs = `
@@ -52,6 +39,9 @@ nameReference:
  - path: spec/initContainers/envFrom/configMapRef/name
    version: v1
    kind: Pod
+  - path: spec/volumes/projected/sources/configMap/name
+    version: v1
+    kind: Pod
  - path: spec/template/spec/volumes/configMap/name
    kind: Deployment
  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
@@ -74,6 +64,8 @@ nameReference:
    kind: ReplicaSet
  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
    kind: ReplicaSet
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: ReplicaSet
  - path: spec/template/spec/volumes/configMap/name
    kind: DaemonSet
  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
@@ -84,6 +76,8 @@ nameReference:
    kind: DaemonSet
  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
    kind: DaemonSet
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: DaemonSet
  - path: spec/template/spec/volumes/configMap/name
    kind: StatefulSet
  - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
@@ -106,15 +100,19 @@ nameReference:
    kind: Job
  - path: spec/template/spec/initContainers/envFrom/configMapRef/name
    kind: Job
+  - path: spec/template/spec/volumes/projected/sources/configMap/name
+    kind: Job
  - path: spec/jobTemplate/spec/template/spec/volumes/configMap/name
    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/volumes/projected/sources/configMap/name
+    kind: CronJob
  - path: spec/jobTemplate/spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
    kind: CronJob
  - path: spec/jobTemplate/spec/template/spec/initContainers/env/valueFrom/configMapKeyRef/name
    kind: CronJob
  - path: spec/jobTemplate/spec/template/spec/containers/envFrom/configMapRef/name
    kind: CronJob
-  - path: spec/jobTemplate/spec/template/spec/initContainers/envFrom/configmapRef/name
+  - path: spec/jobTemplate/spec/template/spec/initContainers/envFrom/configMapRef/name
    kind: CronJob

 - kind: Secret
@@ -138,6 +136,9 @@ nameReference:
  - path: spec/imagePullSecrets/name
    version: v1
    kind: Pod
+  - path: spec/volumes/projected/sources/secret/name
+    version: v1
+    kind: Pod
  - path: spec/template/spec/volumes/secret/secretName
    kind: Deployment
  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
@@ -164,6 +165,8 @@ nameReference:
    kind: ReplicaSet
  - path: spec/template/spec/imagePullSecrets/name
    kind: ReplicaSet
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: ReplicaSet
  - path: spec/template/spec/volumes/secret/secretName
    kind: DaemonSet
  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
@@ -176,6 +179,8 @@ nameReference:
    kind: DaemonSet
  - path: spec/template/spec/imagePullSecrets/name
    kind: DaemonSet
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: DaemonSet
  - path: spec/template/spec/volumes/secret/secretName
    kind: StatefulSet
  - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
@@ -202,8 +207,12 @@ nameReference:
    kind: Job
  - path: spec/template/spec/imagePullSecrets/name
    kind: Job
+  - path: spec/template/spec/volumes/projected/sources/secret/name
+    kind: Job
  - path: spec/jobTemplate/spec/template/spec/volumes/secret/secretName
    kind: CronJob
+  - path: spec/jobTemplate/spec/template/spec/volumes/projected/sources/secret/name
+    kind: CronJob
  - path: spec/jobTemplate/spec/template/spec/containers/env/valueFrom/secretKeyRef/name
    kind: CronJob
  - path: spec/jobTemplate/spec/template/spec/initContainers/env/valueFrom/secretKeyRef/name
@@ -220,6 +229,8 @@ nameReference:
    kind: Ingress
  - path: metadata/annotations/nginx.ingress.kubernetes.io\/auth-secret
    kind: Ingress
+  - path: metadata/annotations/nginx.ingress.kubernetes.io\/auth-tls-secret
+    kind: Ingress
  - path: imagePullSecrets/name
    kind: ServiceAccount
  - path: parameters/secretName
@@ -248,6 +259,12 @@ nameReference:
  - path: spec/service/name
    kind: APIService
    group: apiregistration.k8s.io
+  - path: webhooks/clientConfig/service
+    kind: ValidatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+  - path: webhooks/clientConfig/service
+    kind: MutatingWebhookConfiguration
+    group: admissionregistration.k8s.io

 - kind: Role
  group: rbac.authorization.k8s.io
@@ -269,10 +286,10 @@ nameReference:
 - kind: ServiceAccount
  version: v1
  fieldSpecs:
-  - path: subjects/name
+  - path: subjects
    kind: RoleBinding
    group: rbac.authorization.k8s.io
-  - path: subjects/name
+  - path: subjects
    kind: ClusterRoleBinding
    group: rbac.authorization.k8s.io
  - path: spec/serviceAccountName
@@ -286,7 +303,7 @@ nameReference:
  - path: spec/jobTemplate/spec/template/spec/serviceAccountName
    kind: CronJob
  - path: spec/template/spec/serviceAccountName
-    kind: job
+    kind: Job
  - path: spec/template/spec/serviceAccountName
    kind: DaemonSet

@@ -313,5 +330,18 @@ nameReference:
  fieldSpecs:
  - path: spec/volumeName
    kind: PersistentVolumeClaim
+  - path: rules/resourceNames
+    kind: ClusterRole
+
+- kind: StorageClass
+  version: v1
+  group: storage.k8s.io
+  fieldSpecs:
+  - path: spec/storageClassName
+    kind: PersistentVolume
+  - path: spec/storageClassName
+    kind: PersistentVolumeClaim
+  - path: spec/volumeClaimTemplates/spec/storageClassName
+    kind: StatefulSet
 `
 )
--- a/api/plugins/builtinconfig/consts/namespace.go
+++ b/api/plugins/builtinconfig/consts/namespace.go
@@ -0,0 +1,16 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const (
+	namespaceFieldSpecs = `
+namespace:
+- path: metadata/namespace
+  create: true
+- path: subjects
+  kind: RoleBinding
+- path: subjects
+  kind: ClusterRoleBinding
+`
+)
--- a/api/plugins/builtinconfig/consts/replicas.go
+++ b/api/plugins/builtinconfig/consts/replicas.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package consts
+
+const replicasFieldSpecs = `
+replicas:
+- path: spec/replicas
+  create: true
+  kind: Deployment
+
+- path: spec/replicas
+  create: true
+  kind: ReplicationController
+
+- path: spec/replicas
+  create: true
+  kind: ReplicaSet
+
+- path: spec/replicas
+  create: true
+  kind: StatefulSet
+`
--- a/pkg/transformers/config/defaultconfig/varreference.go
+++ b/pkg/transformers/config/defaultconfig/varreference.go
@@ -1,161 +1,193 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package defaultconfig
+package consts

 const (
 	varReferenceFieldSpecs = `
 varReference:
- path: spec/template/spec/initContainers/command
-  kind: StatefulSet
-
- path: spec/template/spec/containers/command
-  kind: StatefulSet
-
- path: spec/template/spec/initContainers/command
-  kind: Deployment
-
- path: spec/template/spec/containers/command
-  kind: Deployment
-
- path: spec/template/spec/initContainers/command
-  kind: DaemonSet
-
- path: spec/template/spec/containers/command
-  kind: DaemonSet
-
- path: spec/template/spec/containers/command
-  kind: Job
+- path: spec/jobTemplate/spec/template/spec/containers/args
+  kind: CronJob

 - path: spec/jobTemplate/spec/template/spec/containers/command
  kind: CronJob

- path: spec/template/spec/initContainers/args
-  kind: StatefulSet
- 
- path: spec/template/spec/containers/args
-  kind: StatefulSet
-
- path: spec/template/spec/initContainers/args
-  kind: Deployment
-
- path: spec/template/spec/containers/args
-  kind: Deployment
-
- path: spec/template/spec/initContainers/args
-  kind: DaemonSet
-
- path: spec/template/spec/containers/args
-  kind: DaemonSet
-
- path: spec/template/spec/containers/args
-  kind: Job
-
- path: spec/jobTemplate/spec/template/spec/containers/args
-  kind: CronJob
-
- path: spec/template/spec/initContainers/env/value
-  kind: StatefulSet
-
- path: spec/template/spec/containers/env/value
-  kind: StatefulSet
-
- path: spec/template/spec/initContainers/env/value
-  kind: Deployment
-
- path: spec/template/spec/containers/env/value
-  kind: Deployment
-
- path: spec/template/spec/initContainers/env/value
-  kind: DaemonSet
-
- path: spec/template/spec/containers/env/value
-  kind: DaemonSet
-
- path: spec/template/spec/containers/env/value
-  kind: Job
-
 - path: spec/jobTemplate/spec/template/spec/containers/env/value
  kind: CronJob

- path: spec/containers/command
-  kind: Pod
+- path: spec/jobTemplate/spec/template/spec/containers/volumeMounts/mountPath
+  kind: CronJob

- path: spec/containers/args
-  kind: Pod
+- path: spec/jobTemplate/spec/template/spec/initContainers/args
+  kind: CronJob

- path: spec/containers/env/value
-  kind: Pod
+- path: spec/jobTemplate/spec/template/spec/initContainers/command
+  kind: CronJob

- path: spec/initContainers/command
-  kind: Pod
+- path: spec/jobTemplate/spec/template/spec/initContainers/env/value
+  kind: CronJob

- path: spec/initContainers/args
-  kind: Pod
+- path: spec/jobTemplate/spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: CronJob

- path: spec/initContainers/env/value
-  kind: Pod
+- path: spec/template/spec/containers/args
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/command
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/env/value
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/args
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/command
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: DaemonSet
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: DaemonSet
+
+- path: spec/template/spec/containers/args
+  kind: Deployment
+
+- path: spec/template/spec/containers/command
+  kind: Deployment
+
+- path: spec/template/spec/containers/env/value
+  kind: Deployment
+
+- path: spec/template/spec/containers/volumeMounts/mountPath
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/args
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/command
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/env/value
+  kind: Deployment
+
+- path: spec/template/spec/initContainers/volumeMounts/mountPath
+  kind: Deployment

 - path: spec/rules/host
  kind: Ingress

 - path: spec/tls/hosts
  kind: Ingress
+  
+- path: spec/tls/secretName
+  kind: Ingress
+
+- path: spec/template/spec/containers/args
+  kind: Job
+
+- path: spec/template/spec/containers/command
+  kind: Job
+
+- path: spec/template/spec/containers/env/value
+  kind: Job

 - path: spec/template/spec/containers/volumeMounts/mountPath
-  kind: StatefulSet
+  kind: Job
+
+- path: spec/template/spec/initContainers/args
+  kind: Job
+
+- path: spec/template/spec/initContainers/command
+  kind: Job
+
+- path: spec/template/spec/initContainers/env/value
+  kind: Job

 - path: spec/template/spec/initContainers/volumeMounts/mountPath
-  kind: StatefulSet
+  kind: Job
+
+- path: spec/containers/args
+  kind: Pod
+
+- path: spec/containers/command
+  kind: Pod
+
+- path: spec/containers/env/value
+  kind: Pod

 - path: spec/containers/volumeMounts/mountPath
  kind: Pod

+- path: spec/initContainers/args
+  kind: Pod
+
+- path: spec/initContainers/command
+  kind: Pod
+
+- path: spec/initContainers/env/value
+  kind: Pod
+
 - path: spec/initContainers/volumeMounts/mountPath
  kind: Pod

+- path: spec/template/spec/containers/args
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/command
+  kind: ReplicaSet
+
+- path: spec/template/spec/containers/env/value
+  kind: ReplicaSet
+
 - path: spec/template/spec/containers/volumeMounts/mountPath
  kind: ReplicaSet

+- path: spec/template/spec/initContainers/args
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/command
+  kind: ReplicaSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: ReplicaSet
+
 - path: spec/template/spec/initContainers/volumeMounts/mountPath
  kind: ReplicaSet

- path: spec/template/spec/containers/volumeMounts/mountPath
-  kind: Job
+- path: spec/ports/port
+  kind: Service

- path: spec/template/spec/initContainers/volumeMounts/mountPath
-  kind: Job
+- path: spec/ports/targetPort
+  kind: Service
+
+- path: spec/template/spec/containers/args
+  kind: StatefulSet
+
+- path: spec/template/spec/containers/command
+  kind: StatefulSet
+
+- path: spec/template/spec/containers/env/value
+  kind: StatefulSet

 - path: spec/template/spec/containers/volumeMounts/mountPath
-  kind: CronJob
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/args
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/command
+  kind: StatefulSet
+
+- path: spec/template/spec/initContainers/env/value
+  kind: StatefulSet

 - path: spec/template/spec/initContainers/volumeMounts/mountPath
-  kind: CronJob
-
- path: spec/template/spec/containers/volumeMounts/mountPath
-  kind: DaemonSet
-
- path: spec/template/spec/initContainers/volumeMounts/mountPath
-  kind: DaemonSet
-
- path: spec/template/spec/containers/volumeMounts/mountPath
-  kind: Deployment
-
- path: spec/template/spec/initContainers/volumeMounts/mountPath
-  kind: Deployment
+  kind: StatefulSet

 - path: metadata/labels
 `
--- a/api/plugins/builtinconfig/doc.go
+++ b/api/plugins/builtinconfig/doc.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package builtinconfig provides legacy methods for
+// configuring builtin plugins from a common config file.
+// As a user, its best to configure plugins individually
+// with plugin config files specified in the `transformers:`
+// or `generators:` field, than to use this legacy
+// configuration technique.
+package builtinconfig
--- a/api/plugins/builtinconfig/loaddefaultconfig.go
+++ b/api/plugins/builtinconfig/loaddefaultconfig.go
@@ -0,0 +1,42 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/yaml"
+)
+
+// loadDefaultConfig returns a TranformerConfig
+// object from a list of files.
+func loadDefaultConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	result := &TransformerConfig{}
+	for _, path := range paths {
+		data, err := ldr.Load(path)
+		if err != nil {
+			return nil, err
+		}
+		t, err := makeTransformerConfigFromBytes(data)
+		if err != nil {
+			return nil, err
+		}
+		result, err = result.Merge(t)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+// makeTransformerConfigFromBytes returns a TransformerConfig object from bytes
+func makeTransformerConfigFromBytes(data []byte) (*TransformerConfig, error) {
+	var t TransformerConfig
+	err := yaml.Unmarshal(data, &t)
+	if err != nil {
+		return nil, err
+	}
+	t.sortFields()
+	return &t, nil
+}
--- a/api/plugins/builtinconfig/loaddefaultconfig_test.go
+++ b/api/plugins/builtinconfig/loaddefaultconfig_test.go
@@ -0,0 +1,37 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/kustomize/api/internal/loadertest"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+func TestLoadDefaultConfigsFromFiles(t *testing.T) {
+	ldr := loadertest.NewFakeLoader("/app")
+	ldr.AddFile("/app/config.yaml", []byte(`
+namePrefix:
+- path: nameprefix/path
+  kind: SomeKind
+`))
+	tcfg, err := loadDefaultConfig(ldr, []string{"/app/config.yaml"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expected := &TransformerConfig{
+		NamePrefix: []types.FieldSpec{
+			{
+				Gvk:  resid.Gvk{Kind: "SomeKind"},
+				Path: "nameprefix/path",
+			},
+		},
+	}
+	if !reflect.DeepEqual(tcfg, expected) {
+		t.Fatalf("expected %v\n but go6t %v\n", expected, tcfg)
+	}
+}
--- a/api/plugins/builtinconfig/namebackreferences.go
+++ b/api/plugins/builtinconfig/namebackreferences.go
@@ -1,25 +1,13 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
+package builtinconfig

 import (
 	"strings"

-	"sigs.k8s.io/kustomize/pkg/gvk"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
 )

 // NameBackReferences is an association between a gvk.GVK and a list
@@ -51,8 +39,8 @@ import (
 //       (etc.)
 //   }
 type NameBackReferences struct {
-	gvk.Gvk    `json:",inline,omitempty" yaml:",inline,omitempty"`
-	FieldSpecs fsSlice `json:"FieldSpecs,omitempty" yaml:"FieldSpecs,omitempty"`
+	resid.Gvk  `json:",inline,omitempty" yaml:",inline,omitempty"`
+	FieldSpecs types.FsSlice `json:"FieldSpecs,omitempty" yaml:"FieldSpecs,omitempty"`
 }

 func (n NameBackReferences) String() string {
@@ -89,7 +77,7 @@ func (s nbrSlice) mergeOne(other NameBackReferences) (nbrSlice, error) {
 	found := false
 	for _, c := range s {
 		if c.Gvk.Equals(other.Gvk) {
-			c.FieldSpecs, err = c.FieldSpecs.mergeAll(other.FieldSpecs)
+			c.FieldSpecs, err = c.FieldSpecs.MergeAll(other.FieldSpecs)
 			if err != nil {
 				return nil, err
 			}
--- a/api/plugins/builtinconfig/namebackreferences_test.go
+++ b/api/plugins/builtinconfig/namebackreferences_test.go
@@ -1,54 +1,43 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
+package builtinconfig

 import (
 	"reflect"
-	"sigs.k8s.io/kustomize/pkg/gvk"
 	"testing"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
 )

 func TestMergeAll(t *testing.T) {
-	fsSlice1 := []FieldSpec{
+	fsSlice1 := []types.FieldSpec{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Pod",
 			},
 			Path:               "path/to/a/name",
 			CreateIfNotPresent: false,
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Deployment",
 			},
 			Path:               "another/path/to/some/name",
 			CreateIfNotPresent: false,
 		},
 	}
-	fsSlice2 := []FieldSpec{
+	fsSlice2 := []types.FieldSpec{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Job",
 			},
 			Path:               "morepath/to/name",
 			CreateIfNotPresent: false,
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "StatefulSet",
 			},
 			Path:               "yet/another/path/to/a/name",
@@ -58,13 +47,13 @@ func TestMergeAll(t *testing.T) {

 	nbrsSlice1 := nbrSlice{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
 			FieldSpecs: fsSlice1,
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
 			FieldSpecs: fsSlice2,
@@ -72,13 +61,13 @@ func TestMergeAll(t *testing.T) {
 	}
 	nbrsSlice2 := nbrSlice{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
 			FieldSpecs: fsSlice1,
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
 			FieldSpecs: fsSlice2,
@@ -86,13 +75,13 @@ func TestMergeAll(t *testing.T) {
 	}
 	expected := nbrSlice{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "ConfigMap",
 			},
 			FieldSpecs: fsSlice1,
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "Secret",
 			},
 			FieldSpecs: fsSlice2,
--- a/api/plugins/builtinconfig/transformerconfig.go
+++ b/api/plugins/builtinconfig/transformerconfig.go
@@ -0,0 +1,148 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"log"
+	"sort"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/plugins/builtinconfig/consts"
+	"sigs.k8s.io/kustomize/api/types"
+)
+
+// TransformerConfig holds the data needed to perform transformations.
+type TransformerConfig struct {
+	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
+	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
+	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
+	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
+	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
+	Images            types.FsSlice `json:"images,omitempty" yaml:"images,omitempty"`
+	Replicas          types.FsSlice `json:"replicas,omitempty" yaml:"replicas,omitempty"`
+}
+
+// MakeEmptyConfig returns an empty TransformerConfig object
+func MakeEmptyConfig() *TransformerConfig {
+	return &TransformerConfig{}
+}
+
+// MakeDefaultConfig returns a default TransformerConfig.
+func MakeDefaultConfig() *TransformerConfig {
+	c, err := makeTransformerConfigFromBytes(
+		consts.GetDefaultFieldSpecs())
+	if err != nil {
+		log.Fatalf("Unable to make default transformconfig: %v", err)
+	}
+	return c
+}
+
+// MakeTransformerConfig returns a merger of custom config,
+// if any, with default config.
+func MakeTransformerConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	t1 := MakeDefaultConfig()
+	if len(paths) == 0 {
+		return t1, nil
+	}
+	t2, err := loadDefaultConfig(ldr, paths)
+	if err != nil {
+		return nil, err
+	}
+	return t1.Merge(t2)
+}
+
+// sortFields provides determinism in logging, tests, etc.
+func (t *TransformerConfig) sortFields() {
+	sort.Sort(t.NamePrefix)
+	sort.Sort(t.NameSpace)
+	sort.Sort(t.CommonLabels)
+	sort.Sort(t.CommonAnnotations)
+	sort.Sort(t.NameReference)
+	sort.Sort(t.VarReference)
+	sort.Sort(t.Images)
+	sort.Sort(t.Replicas)
+}
+
+// AddPrefixFieldSpec adds a FieldSpec to NamePrefix
+func (t *TransformerConfig) AddPrefixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NamePrefix, err = t.NamePrefix.MergeOne(fs)
+	return err
+}
+
+// AddSuffixFieldSpec adds a FieldSpec to NameSuffix
+func (t *TransformerConfig) AddSuffixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NameSuffix, err = t.NameSuffix.MergeOne(fs)
+	return err
+}
+
+// AddLabelFieldSpec adds a FieldSpec to CommonLabels
+func (t *TransformerConfig) AddLabelFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonLabels, err = t.CommonLabels.MergeOne(fs)
+	return err
+}
+
+// AddAnnotationFieldSpec adds a FieldSpec to CommonAnnotations
+func (t *TransformerConfig) AddAnnotationFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonAnnotations, err = t.CommonAnnotations.MergeOne(fs)
+	return err
+}
+
+// AddNamereferenceFieldSpec adds a NameBackReferences to NameReference
+func (t *TransformerConfig) AddNamereferenceFieldSpec(
+	nbrs NameBackReferences) (err error) {
+	t.NameReference, err = t.NameReference.mergeOne(nbrs)
+	return err
+}
+
+// Merge merges two TransformerConfigs objects into
+// a new TransformerConfig object
+func (t *TransformerConfig) Merge(input *TransformerConfig) (
+	merged *TransformerConfig, err error) {
+	if input == nil {
+		return t, nil
+	}
+	merged = &TransformerConfig{}
+	merged.NamePrefix, err = t.NamePrefix.MergeAll(input.NamePrefix)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameSuffix, err = t.NameSuffix.MergeAll(input.NameSuffix)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameSpace, err = t.NameSpace.MergeAll(input.NameSpace)
+	if err != nil {
+		return nil, err
+	}
+	merged.CommonAnnotations, err = t.CommonAnnotations.MergeAll(
+		input.CommonAnnotations)
+	if err != nil {
+		return nil, err
+	}
+	merged.CommonLabels, err = t.CommonLabels.MergeAll(input.CommonLabels)
+	if err != nil {
+		return nil, err
+	}
+	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
+	if err != nil {
+		return nil, err
+	}
+	merged.NameReference, err = t.NameReference.mergeAll(input.NameReference)
+	if err != nil {
+		return nil, err
+	}
+	merged.Images, err = t.Images.MergeAll(input.Images)
+	if err != nil {
+		return nil, err
+	}
+	merged.Replicas, err = t.Replicas.MergeAll(input.Replicas)
+	if err != nil {
+		return nil, err
+	}
+	merged.sortFields()
+	return merged, nil
+}
--- a/api/plugins/builtinconfig/transformerconfig_test.go
+++ b/api/plugins/builtinconfig/transformerconfig_test.go
@@ -1,39 +1,32 @@
-/*
-Copyright 2018 The Kubernetes Authors.
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0

-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
+package builtinconfig_test

 import (
+	"reflect"
 	"testing"

-	"reflect"
-
-	"sigs.k8s.io/kustomize/pkg/gvk"
+	. "sigs.k8s.io/kustomize/api/plugins/builtinconfig"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/types"
 )

+func TestMakeDefaultConfig(t *testing.T) {
+	// Confirm default can be made without fatal error inside call.
+	_ = MakeDefaultConfig()
+}
+
 func TestAddNamereferenceFieldSpec(t *testing.T) {
 	cfg := &TransformerConfig{}

 	nbrs := NameBackReferences{
-		Gvk: gvk.Gvk{
+		Gvk: resid.Gvk{
 			Kind: "KindA",
 		},
-		FieldSpecs: []FieldSpec{
+		FieldSpecs: []types.FieldSpec{
 			{
-				Gvk: gvk.Gvk{
+				Gvk: resid.Gvk{
 					Kind: "KindB",
 				},
 				Path:               "path/to/a/field",
@@ -54,8 +47,8 @@ func TestAddNamereferenceFieldSpec(t *testing.T) {
 func TestAddFieldSpecs(t *testing.T) {
 	cfg := &TransformerConfig{}

-	fieldSpec := FieldSpec{
-		Gvk:                gvk.Gvk{Group: "GroupA", Kind: "KindB"},
+	fieldSpec := types.FieldSpec{
+		Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindB"},
 		Path:               "path/to/a/field",
 		CreateIfNotPresent: true,
 	}
@@ -93,12 +86,12 @@ func TestAddFieldSpecs(t *testing.T) {
 func TestMerge(t *testing.T) {
 	nameReference := []NameBackReferences{
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []FieldSpec{
+			FieldSpecs: []types.FieldSpec{
 				{
-					Gvk: gvk.Gvk{
+					Gvk: resid.Gvk{
 						Kind: "KindB",
 					},
 					Path:               "path/to/a/field",
@@ -107,12 +100,12 @@ func TestMerge(t *testing.T) {
 			},
 		},
 		{
-			Gvk: gvk.Gvk{
+			Gvk: resid.Gvk{
 				Kind: "KindA",
 			},
-			FieldSpecs: []FieldSpec{
+			FieldSpecs: []types.FieldSpec{
 				{
-					Gvk: gvk.Gvk{
+					Gvk: resid.Gvk{
 						Kind: "KindC",
 					},
 					Path:               "path/to/a/field",
@@ -121,14 +114,14 @@ func TestMerge(t *testing.T) {
 			},
 		},
 	}
-	fieldSpecs := []FieldSpec{
+	fieldSpecs := []types.FieldSpec{
 		{
-			Gvk:                gvk.Gvk{Group: "GroupA", Kind: "KindB"},
+			Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindB"},
 			Path:               "path/to/a/field",
 			CreateIfNotPresent: true,
 		},
 		{
-			Gvk:                gvk.Gvk{Group: "GroupA", Kind: "KindC"},
+			Gvk:                resid.Gvk{Group: "GroupA", Kind: "KindC"},
 			Path:               "path/to/a/field",
 			CreateIfNotPresent: true,
 		},
--- a/api/plugins/builtinhelpers/builtinplugintype_string.go
+++ b/api/plugins/builtinhelpers/builtinplugintype_string.go
@@ -0,0 +1,37 @@
+// Code generated by "stringer -type=BuiltinPluginType"; DO NOT EDIT.
+
+package builtinhelpers
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Unknown-0]
+	_ = x[AnnotationsTransformer-1]
+	_ = x[ConfigMapGenerator-2]
+	_ = x[HashTransformer-3]
+	_ = x[ImageTagTransformer-4]
+	_ = x[InventoryTransformer-5]
+	_ = x[LabelTransformer-6]
+	_ = x[LegacyOrderTransformer-7]
+	_ = x[NamespaceTransformer-8]
+	_ = x[PatchJson6902Transformer-9]
+	_ = x[PatchStrategicMergeTransformer-10]
+	_ = x[PatchTransformer-11]
+	_ = x[PrefixSuffixTransformer-12]
+	_ = x[ReplicaCountTransformer-13]
+	_ = x[SecretGenerator-14]
+}
+
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorHashTransformerImageTagTransformerInventoryTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerReplicaCountTransformerSecretGenerator"
+
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 62, 81, 101, 117, 139, 159, 183, 213, 229, 252, 275, 290}
+
+func (i BuiltinPluginType) String() string {
+	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {
+		return "BuiltinPluginType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _BuiltinPluginType_name[_BuiltinPluginType_index[i]:_BuiltinPluginType_index[i+1]]
+}
--- a/api/plugins/builtinhelpers/builtins.go
+++ b/api/plugins/builtinhelpers/builtins.go
@@ -0,0 +1,75 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinhelpers
+
+import (
+	"sigs.k8s.io/kustomize/api/plugins/builtins"
+	"sigs.k8s.io/kustomize/api/resmap"
+)
+
+//go:generate stringer -type=BuiltinPluginType
+type BuiltinPluginType int
+
+const (
+	Unknown BuiltinPluginType = iota
+	AnnotationsTransformer
+	ConfigMapGenerator
+	HashTransformer
+	ImageTagTransformer
+	InventoryTransformer
+	LabelTransformer
+	LegacyOrderTransformer
+	NamespaceTransformer
+	PatchJson6902Transformer
+	PatchStrategicMergeTransformer
+	PatchTransformer
+	PrefixSuffixTransformer
+	ReplicaCountTransformer
+	SecretGenerator
+)
+
+var stringToBuiltinPluginTypeMap map[string]BuiltinPluginType
+
+func init() {
+	stringToBuiltinPluginTypeMap = makeStringToBuiltinPluginTypeMap()
+}
+
+func makeStringToBuiltinPluginTypeMap() (result map[string]BuiltinPluginType) {
+	result = make(map[string]BuiltinPluginType, 23)
+	for k := range GeneratorFactories {
+		result[k.String()] = k
+	}
+	for k := range TransformerFactories {
+		result[k.String()] = k
+	}
+	return
+}
+
+func GetBuiltinPluginType(n string) BuiltinPluginType {
+	result, ok := stringToBuiltinPluginTypeMap[n]
+	if ok {
+		return result
+	}
+	return Unknown
+}
+
+var GeneratorFactories = map[BuiltinPluginType]func() resmap.GeneratorPlugin{
+	ConfigMapGenerator: builtins.NewConfigMapGeneratorPlugin,
+	SecretGenerator:    builtins.NewSecretGeneratorPlugin,
+}
+
+var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin{
+	AnnotationsTransformer:         builtins.NewAnnotationsTransformerPlugin,
+	HashTransformer:                builtins.NewHashTransformerPlugin,
+	ImageTagTransformer:            builtins.NewImageTagTransformerPlugin,
+	InventoryTransformer:           builtins.NewInventoryTransformerPlugin,
+	LabelTransformer:               builtins.NewLabelTransformerPlugin,
+	LegacyOrderTransformer:         builtins.NewLegacyOrderTransformerPlugin,
+	NamespaceTransformer:           builtins.NewNamespaceTransformerPlugin,
+	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
+	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
+	PatchTransformer:               builtins.NewPatchTransformerPlugin,
+	PrefixSuffixTransformer:        builtins.NewPrefixSuffixTransformerPlugin,
+	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
+}
--- a/api/plugins/builtinhelpers/generateBuiltins.sh
+++ b/api/plugins/builtinhelpers/generateBuiltins.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# Generate the Go code for the generator and
+# transformer factory functions in
+#
+#   sigs.k8s.io/kustomize/api/plugins/builtins
+#
+# from the raw plugin directories found under
+#
+#   sigs.k8s.io/kustomize/plugin/builtin
+
+set -e
+
+myGoPath=$1
+if [ -z ${1+x} ]; then
+  myGoPath=$GOPATH
+fi
+
+if [ -z "$myGoPath" ]; then
+  echo "Must specify a GOPATH"
+  exit 1
+fi
+
+dir=$myGoPath/src/sigs.k8s.io/kustomize
+
+if [ ! -d "$dir" ]; then
+  echo "$dir is not a directory."
+  exit 1
+fi
+
+for goMod in $(find ./plugin/builtin -name 'go.mod'); do
+  dir=$(dirname "${goMod}")
+  (cd $dir; GOPATH=$myGoPath go generate ./...)
+  echo "Formatting $dir"
+  (cd $dir; GOPATH=$myGoPath go fmt ./...)
+done
+
+echo All done.
--- a/api/plugins/builtins/AnnotationsTransformer.go
+++ b/api/plugins/builtins/AnnotationsTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Add the given annotations to the given field specifications.
+type AnnotationsTransformerPlugin struct {
+	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+	FieldSpecs  []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *AnnotationsTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Annotations = nil
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *AnnotationsTransformerPlugin) Transform(m resmap.ResMap) error {
+	t, err := transform.NewMapTransformer(
+		p.FieldSpecs,
+		p.Annotations,
+	)
+	if err != nil {
+		return err
+	}
+	return t.Transform(m)
+}
+
+func NewAnnotationsTransformerPlugin() resmap.TransformerPlugin {
+  return &AnnotationsTransformerPlugin{}
+}
--- a/api/plugins/builtins/ConfigMapGenerator.go
+++ b/api/plugins/builtins/ConfigMapGenerator.go
@@ -0,0 +1,46 @@
+// Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type ConfigMapGeneratorPlugin struct {
+	h                *resmap.PluginHelpers
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	types.GeneratorOptions
+	types.ConfigMapArgs
+}
+
+
+func (p *ConfigMapGeneratorPlugin) Config(
+	h *resmap.PluginHelpers, config []byte) (err error) {
+	p.GeneratorOptions = types.GeneratorOptions{}
+	p.ConfigMapArgs = types.ConfigMapArgs{}
+	err = yaml.Unmarshal(config, p)
+	if p.ConfigMapArgs.Name == "" {
+		p.ConfigMapArgs.Name = p.Name
+	}
+	if p.ConfigMapArgs.Namespace == "" {
+		p.ConfigMapArgs.Namespace = p.Namespace
+	}
+	p.h = h
+	return
+}
+
+func (p *ConfigMapGeneratorPlugin) Generate() (resmap.ResMap, error) {
+	return p.h.ResmapFactory().FromConfigMapArgs(
+		kv.NewLoader(p.h.Loader(), p.h.Validator()),
+		&p.GeneratorOptions, p.ConfigMapArgs)
+}
+
+func NewConfigMapGeneratorPlugin() resmap.GeneratorPlugin {
+  return &ConfigMapGeneratorPlugin{}
+}
--- a/api/plugins/builtins/HashTransformer.go
+++ b/api/plugins/builtins/HashTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on HashTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resmap"
+)
+
+type HashTransformerPlugin struct {
+	hasher ifc.KunstructuredHasher
+}
+
+
+func (p *HashTransformerPlugin) Config(
+	h *resmap.PluginHelpers, config []byte) (err error) {
+	p.hasher = h.ResmapFactory().RF().Hasher()
+	return nil
+}
+
+// Transform appends hash to generated resources.
+func (p *HashTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, res := range m.Resources() {
+		if res.NeedHashSuffix() {
+			h, err := p.hasher.Hash(res)
+			if err != nil {
+				return err
+			}
+			res.SetName(fmt.Sprintf("%s-%s", res.GetName(), h))
+		}
+	}
+	return nil
+}
+
+func NewHashTransformerPlugin() resmap.TransformerPlugin {
+  return &HashTransformerPlugin{}
+}
--- a/api/plugins/builtins/ImageTagTransformer.go
+++ b/api/plugins/builtins/ImageTagTransformer.go
@@ -0,0 +1,188 @@
+// Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/yaml"
+)
+
+// Find matching image declarations and replace
+// the name, tag and/or digest.
+type ImageTagTransformerPlugin struct {
+	ImageTag   types.Image       `json:"imageTag,omitempty" yaml:"imageTag,omitempty"`
+	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *ImageTagTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.ImageTag = types.Image{}
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *ImageTagTransformerPlugin) Transform(m resmap.ResMap) error {
+	for _, r := range m.Resources() {
+		for _, path := range p.FieldSpecs {
+			if !r.OrgId().IsSelected(&path.Gvk) {
+				continue
+			}
+			err := transform.MutateField(
+				r.Map(), path.PathSlice(), false, p.mutateImage)
+			if err != nil {
+				return err
+			}
+		}
+		// Kept for backward compatibility
+		if err := p.findAndReplaceImage(r.Map()); err != nil && r.OrgId().Kind != `CustomResourceDefinition` {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p *ImageTagTransformerPlugin) mutateImage(in interface{}) (interface{}, error) {
+	original, ok := in.(string)
+	if !ok {
+		return nil, fmt.Errorf("image path is not of type string but %T", in)
+	}
+
+	if !isImageMatched(original, p.ImageTag.Name) {
+		return original, nil
+	}
+	name, tag := split(original)
+	if p.ImageTag.NewName != "" {
+		name = p.ImageTag.NewName
+	}
+	if p.ImageTag.NewTag != "" {
+		tag = ":" + p.ImageTag.NewTag
+	}
+	if p.ImageTag.Digest != "" {
+		tag = "@" + p.ImageTag.Digest
+	}
+	return name + tag, nil
+}
+
+// findAndReplaceImage replaces the image name and
+// tags inside one object.
+// It searches the object for container session
+// then loops though all images inside containers
+// session, finds matched ones and update the
+// image name and tag name
+func (p *ImageTagTransformerPlugin) findAndReplaceImage(obj map[string]interface{}) error {
+	paths := []string{"containers", "initContainers"}
+	updated := false
+	for _, path := range paths {
+		containers, found := obj[path]
+		if found {
+			if _, err := p.updateContainers(containers); err != nil {
+				return err
+			}
+			updated = true
+		}
+	}
+	if !updated {
+		return p.findContainers(obj)
+	}
+	return nil
+}
+
+func (p *ImageTagTransformerPlugin) updateContainers(in interface{}) (interface{}, error) {
+	containers, ok := in.([]interface{})
+	if !ok {
+		return nil, fmt.Errorf(
+			"containers path is not of type []interface{} but %T", in)
+	}
+	for i := range containers {
+		container := containers[i].(map[string]interface{})
+		containerImage, found := container["image"]
+		if !found {
+			continue
+		}
+		imageName := containerImage.(string)
+		if isImageMatched(imageName, p.ImageTag.Name) {
+			newImage, err := p.mutateImage(imageName)
+			if err != nil {
+				return nil, err
+			}
+			container["image"] = newImage
+		}
+	}
+	return containers, nil
+}
+
+func (p *ImageTagTransformerPlugin) findContainers(obj map[string]interface{}) error {
+	for key := range obj {
+		switch typedV := obj[key].(type) {
+		case map[string]interface{}:
+			err := p.findAndReplaceImage(typedV)
+			if err != nil {
+				return err
+			}
+		case []interface{}:
+			for i := range typedV {
+				item := typedV[i]
+				typedItem, ok := item.(map[string]interface{})
+				if ok {
+					err := p.findAndReplaceImage(typedItem)
+					if err != nil {
+						return err
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func isImageMatched(s, t string) bool {
+	// Tag values are limited to [a-zA-Z0-9_.-].
+	pattern, _ := regexp.Compile("^" + t + "(@sha256)?(:[a-zA-Z0-9_.-]*)?$")
+	return pattern.MatchString(s)
+}
+
+// split separates and returns the name and tag parts
+// from the image string using either colon `:` or at `@` separators.
+// Note that the returned tag keeps its separator.
+func split(imageName string) (name string, tag string) {
+	// check if image name contains a domain
+	// if domain is present, ignore domain and check for `:`
+	ic := -1
+	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
+		ic = strings.LastIndex(imageName, ":")
+	} else {
+		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
+		// set ic only if `:` is present
+		if lastIc > 0 {
+			ic = slashIndex + lastIc
+		}
+	}
+	ia := strings.LastIndex(imageName, "@")
+	if ic < 0 && ia < 0 {
+		return imageName, ""
+	}
+
+	i := ic
+	if ia > 0 {
+		i = ia
+	}
+
+	name = imageName[:i]
+	tag = imageName[i:]
+	return
+}
+
+func NewImageTagTransformerPlugin() resmap.TransformerPlugin {
+  return &ImageTagTransformerPlugin{}
+}
--- a/api/plugins/builtins/InventoryTransformer.go
+++ b/api/plugins/builtins/InventoryTransformer.go
@@ -0,0 +1,131 @@
+// Code generated by pluginator on InventoryTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/hasher"
+	"sigs.k8s.io/kustomize/api/inventory"
+	"sigs.k8s.io/kustomize/api/kv"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type InventoryTransformerPlugin struct {
+	h                *resmap.PluginHelpers
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Policy           string `json:"policy,omitempty" yaml:"policy,omitempty"`
+}
+
+
+func (p *InventoryTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.h = h
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return err
+	}
+	if p.Policy == "" {
+		p.Policy = types.GarbageIgnore.String()
+	}
+	if p.Policy != types.GarbageCollect.String() &&
+		p.Policy != types.GarbageIgnore.String() {
+		return fmt.Errorf(
+			"unrecognized garbagePolicy '%s'", p.Policy)
+	}
+	return nil
+}
+
+// Transform generates an inventory object from the input ResMap.
+// This ConfigMap supports the pruning command in
+// the client side tool proposed here:
+// https://github.com/kubernetes/enhancements/pull/810
+//
+// The inventory data is written to the ConfigMap's
+// annotations, rather than to the key-value pairs in
+// the ConfigMap's data field, since
+//   1. Keys in a ConfigMap's data field are too
+//      constrained for this purpose.
+//   2. Using annotations allow any object to be used,
+//      not just a ConfigMap, should some other object
+//      (e.g. some App object) become more desirable
+//      for this purpose.
+func (p *InventoryTransformerPlugin) Transform(m resmap.ResMap) error {
+
+	inv, h, err := makeInventory(m)
+	if err != nil {
+		return err
+	}
+
+	args := types.ConfigMapArgs{}
+	args.Name = p.Name
+	args.Namespace = p.Namespace
+	opts := &types.GeneratorOptions{
+		Annotations: make(map[string]string),
+	}
+	opts.Annotations[inventory.HashAnnotation] = h
+	err = inv.UpdateAnnotations(opts.Annotations)
+	if err != nil {
+		return err
+	}
+
+	cm, err := p.h.ResmapFactory().RF().MakeConfigMap(
+		kv.NewLoader(p.h.Loader(), p.h.Validator()), opts, &args)
+	if err != nil {
+		return err
+	}
+
+	if p.Policy == types.GarbageCollect.String() {
+		for _, byeBye := range m.AllIds() {
+			m.Remove(byeBye)
+		}
+	}
+	return m.Append(cm)
+}
+
+func makeInventory(m resmap.ResMap) (
+	inv *inventory.Inventory, hash string, err error) {
+	inv = inventory.NewInventory()
+	var keys []string
+	for _, r := range m.Resources() {
+		ns := r.GetNamespace()
+		item := resid.NewResIdWithNamespace(r.GetGvk(), r.GetName(), ns)
+		if _, ok := inv.Current[item]; ok {
+			return nil, "", fmt.Errorf(
+				"item '%v' already in inventory", item)
+		}
+		inv.Current[item], err = computeRefs(r, m)
+		if err != nil {
+			return nil, "", err
+		}
+		keys = append(keys, item.String())
+	}
+	h, err := hasher.SortArrayAndComputeHash(keys)
+	return inv, h, err
+}
+
+func computeRefs(
+	r *resource.Resource, m resmap.ResMap) (refs []resid.ResId, err error) {
+	for _, refid := range r.GetRefBy() {
+		ref, err := m.GetByCurrentId(refid)
+		if err != nil {
+			return nil, err
+		}
+		refs = append(
+			refs,
+			resid.NewResIdWithNamespace(
+				ref.GetGvk(), ref.GetName(), ref.GetNamespace()))
+	}
+	return
+}
+
+func NewInventoryTransformerPlugin() resmap.TransformerPlugin {
+  return &InventoryTransformerPlugin{}
+}
--- a/api/plugins/builtins/LabelTransformer.go
+++ b/api/plugins/builtins/LabelTransformer.go
@@ -0,0 +1,42 @@
+// Code generated by pluginator on LabelTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Add the given labels to the given field specifications.
+type LabelTransformerPlugin struct {
+	Labels     map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
+	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *LabelTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Labels = nil
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *LabelTransformerPlugin) Transform(m resmap.ResMap) error {
+	t, err := transform.NewMapTransformer(
+		p.FieldSpecs,
+		p.Labels,
+	)
+	if err != nil {
+		return err
+	}
+	return t.Transform(m)
+}
+
+func NewLabelTransformerPlugin() resmap.TransformerPlugin {
+  return &LabelTransformerPlugin{}
+}
--- a/api/plugins/builtins/LegacyOrderTransformer.go
+++ b/api/plugins/builtins/LegacyOrderTransformer.go
@@ -0,0 +1,49 @@
+// Code generated by pluginator on LegacyOrderTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"sort"
+
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+)
+
+// Sort the resources using an ordering defined in the Gvk class.
+// This puts cluster-wide basic resources with no
+// dependencies (like Namespace, StorageClass, etc.)
+// first, and resources with a high number of dependencies
+// (like ValidatingWebhookConfiguration) last.
+type LegacyOrderTransformerPlugin struct{}
+
+
+// Nothing needed for configuration.
+func (p *LegacyOrderTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	return nil
+}
+
+func (p *LegacyOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
+	resources := make([]*resource.Resource, m.Size())
+	ids := m.AllIds()
+	sort.Sort(resmap.IdSlice(ids))
+	for i, id := range ids {
+		resources[i], err = m.GetByCurrentId(id)
+		if err != nil {
+			return errors.Wrap(err, "expected match for sorting")
+		}
+	}
+	m.Clear()
+	for _, r := range resources {
+		m.Append(r)
+	}
+	return nil
+}
+
+func NewLegacyOrderTransformerPlugin() resmap.TransformerPlugin {
+  return &LegacyOrderTransformerPlugin{}
+}
--- a/api/plugins/builtins/NamespaceTransformer.go
+++ b/api/plugins/builtins/NamespaceTransformer.go
@@ -0,0 +1,134 @@
+// Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/transform"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Change or set the namespace of non-cluster level resources.
+type NamespaceTransformerPlugin struct {
+	types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	FieldSpecs       []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+func (p *NamespaceTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Namespace = ""
+	p.FieldSpecs = nil
+	return yaml.Unmarshal(c, p)
+}
+
+func (p *NamespaceTransformerPlugin) Transform(m resmap.ResMap) error {
+	if len(p.Namespace) == 0 {
+		return nil
+	}
+	for _, r := range m.Resources() {
+		if len(r.Map()) == 0 {
+			// Don't mutate empty objects?
+			continue
+		}
+
+		id := r.OrgId()
+		applicableFs := p.applicableFieldSpecs(id)
+
+		for _, fs := range applicableFs {
+			err := transform.MutateField(
+				r.Map(), fs.PathSlice(), fs.CreateIfNotPresent,
+				p.changeNamespace(r))
+			if err != nil {
+				return err
+			}
+		}
+
+		matches := m.GetMatchingResourcesByCurrentId(r.CurId().Equals)
+		if len(matches) != 1 {
+			return fmt.Errorf("namespace tranformation produces ID conflict: %#v", matches)
+		}
+	}
+	return nil
+}
+
+const metaNamespace = "metadata/namespace"
+
+// Special casing metadata.namespace since
+// all objects have it, even "ClusterKind" objects
+// that don't exist in a namespace (the Namespace
+// object itself doesn't live in a namespace).
+func (p *NamespaceTransformerPlugin) applicableFieldSpecs(id resid.ResId) []types.FieldSpec {
+	var res []types.FieldSpec
+	for _, fs := range p.FieldSpecs {
+		if id.IsSelected(&fs.Gvk) && (fs.Path != metaNamespace || (fs.Path == metaNamespace && id.IsNamespaceableKind())) {
+			res = append(res, fs)
+		}
+	}
+	return res
+}
+
+func (p *NamespaceTransformerPlugin) changeNamespace(
+	referrer *resource.Resource) func(in interface{}) (interface{}, error) {
+	return func(in interface{}) (interface{}, error) {
+		switch in.(type) {
+		case string:
+			// will happen when the metadata/namespace
+			// value is replaced
+			return p.Namespace, nil
+		case []interface{}:
+			l, _ := in.([]interface{})
+			for idx, item := range l {
+				switch item.(type) {
+				case map[string]interface{}:
+					// Will happen when mutating the subjects
+					// field of ClusterRoleBinding and RoleBinding
+					inMap, _ := item.(map[string]interface{})
+					if _, ok := inMap["name"]; !ok {
+						continue
+					}
+					name, ok := inMap["name"].(string)
+					if !ok {
+						continue
+					}
+					// The only case we need to force the namespace
+					// if for the "service account". "default" is
+					// kind of hardcoded here for right now.
+					if name != "default" {
+						continue
+					}
+					inMap["namespace"] = p.Namespace
+					l[idx] = inMap
+				default:
+					// nothing to do for right now
+				}
+			}
+			return in, nil
+		case map[string]interface{}:
+			// Will happen if the createField=true
+			// when the namespace is added to the
+			// object
+			inMap := in.(map[string]interface{})
+			if len(inMap) == 0 {
+				return p.Namespace, nil
+			} else {
+				return in, nil
+			}
+		default:
+			return in, nil
+		}
+	}
+}
+
+func NewNamespaceTransformerPlugin() resmap.TransformerPlugin {
+  return &NamespaceTransformerPlugin{}
+}
--- a/api/plugins/builtins/PatchJson6902Transformer.go
+++ b/api/plugins/builtins/PatchJson6902Transformer.go
@@ -0,0 +1,103 @@
+// Code generated by pluginator on PatchJson6902Transformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"github.com/evanphx/json-patch"
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type PatchJson6902TransformerPlugin struct {
+	ldr          ifc.Loader
+	decodedPatch jsonpatch.Patch
+	Target       types.PatchTarget `json:"target,omitempty" yaml:"target,omitempty"`
+	Path         string            `json:"path,omitempty" yaml:"path,omitempty"`
+	JsonOp       string            `json:"jsonOp,omitempty" yaml:"jsonOp,omitempty"`
+}
+
+
+func (p *PatchJson6902TransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.ldr = h.Loader()
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return err
+	}
+	if p.Target.Name == "" {
+		return fmt.Errorf("must specify the target name")
+	}
+	if p.Path == "" && p.JsonOp == "" {
+		return fmt.Errorf("empty file path and empty jsonOp")
+	}
+	if p.Path != "" {
+		if p.JsonOp != "" {
+			return fmt.Errorf("must specify a file path or jsonOp, not both")
+		}
+		rawOp, err := p.ldr.Load(p.Path)
+		if err != nil {
+			return err
+		}
+		p.JsonOp = string(rawOp)
+		if p.JsonOp == "" {
+			return fmt.Errorf("patch file '%s' empty seems to be empty", p.Path)
+		}
+	}
+	if p.JsonOp[0] != '[' {
+		// if it doesn't seem to be JSON, imagine
+		// it is YAML, and convert to JSON.
+		op, err := yaml.YAMLToJSON([]byte(p.JsonOp))
+		if err != nil {
+			return err
+		}
+		p.JsonOp = string(op)
+	}
+	p.decodedPatch, err = jsonpatch.DecodePatch([]byte(p.JsonOp))
+	if err != nil {
+		return errors.Wrapf(err, "decoding %s", p.JsonOp)
+	}
+	if len(p.decodedPatch) == 0 {
+		return fmt.Errorf(
+			"patch appears to be empty; file=%s, JsonOp=%s", p.Path, p.JsonOp)
+	}
+	return err
+}
+
+func (p *PatchJson6902TransformerPlugin) Transform(m resmap.ResMap) error {
+	id := resid.NewResIdWithNamespace(
+		resid.Gvk{
+			Group:   p.Target.Group,
+			Version: p.Target.Version,
+			Kind:    p.Target.Kind,
+		},
+		p.Target.Name,
+		p.Target.Namespace,
+	)
+	obj, err := m.GetById(id)
+	if err != nil {
+		return err
+	}
+	rawObj, err := obj.MarshalJSON()
+	if err != nil {
+		return err
+	}
+	modifiedObj, err := p.decodedPatch.Apply(rawObj)
+	if err != nil {
+		return errors.Wrapf(
+			err, "failed to apply json patch '%s'", p.JsonOp)
+	}
+	return obj.UnmarshalJSON(modifiedObj)
+}
+
+func NewPatchJson6902TransformerPlugin() resmap.TransformerPlugin {
+  return &PatchJson6902TransformerPlugin{}
+}
--- a/api/plugins/builtins/PatchStrategicMergeTransformer.go
+++ b/api/plugins/builtins/PatchStrategicMergeTransformer.go
@@ -0,0 +1,93 @@
+// Code generated by pluginator on PatchStrategicMergeTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type PatchStrategicMergeTransformerPlugin struct {
+	h             *resmap.PluginHelpers
+	loadedPatches []*resource.Resource
+	Paths         []types.PatchStrategicMerge `json:"paths,omitempty" yaml:"paths,omitempty"`
+	Patches       string                      `json:"patches,omitempty" yaml:"patches,omitempty"`
+}
+
+
+func (p *PatchStrategicMergeTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.h = h
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return err
+	}
+	if len(p.Paths) == 0 && p.Patches == "" {
+		return fmt.Errorf("empty file path and empty patch content")
+	}
+	if len(p.Paths) != 0 {
+		for _, onePath := range p.Paths {
+			res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(onePath))
+			if err == nil {
+				p.loadedPatches = append(p.loadedPatches, res...)
+				continue
+			}
+			res, err = p.h.ResmapFactory().RF().SliceFromPatches(
+				p.h.Loader(), []types.PatchStrategicMerge{onePath})
+			if err != nil {
+				return err
+			}
+			p.loadedPatches = append(p.loadedPatches, res...)
+		}
+	}
+	if p.Patches != "" {
+		res, err := p.h.ResmapFactory().RF().SliceFromBytes([]byte(p.Patches))
+		if err != nil {
+			return err
+		}
+		p.loadedPatches = append(p.loadedPatches, res...)
+	}
+
+	if len(p.loadedPatches) == 0 {
+		return fmt.Errorf(
+			"patch appears to be empty; files=%v, Patch=%s", p.Paths, p.Patches)
+	}
+	return err
+}
+
+func (p *PatchStrategicMergeTransformerPlugin) Transform(m resmap.ResMap) error {
+	patches, err := p.h.ResmapFactory().MergePatches(p.loadedPatches)
+	if err != nil {
+		return err
+	}
+	for _, patch := range patches.Resources() {
+		target, err := m.GetById(patch.OrgId())
+		if err != nil {
+			return err
+		}
+		err = target.Patch(patch.Kunstructured)
+		if err != nil {
+			return err
+		}
+		// remove the resource from resmap
+		// when the patch is to $patch: delete that target
+		if len(target.Map()) == 0 {
+			err = m.Remove(target.CurId())
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func NewPatchStrategicMergeTransformerPlugin() resmap.TransformerPlugin {
+  return &PatchStrategicMergeTransformerPlugin{}
+}
--- a/api/plugins/builtins/PatchTransformer.go
+++ b/api/plugins/builtins/PatchTransformer.go
@@ -0,0 +1,148 @@
+// Code generated by pluginator on PatchTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"fmt"
+
+	"github.com/evanphx/json-patch"
+	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+)
+
+type PatchTransformerPlugin struct {
+	loadedPatch  *resource.Resource
+	decodedPatch jsonpatch.Patch
+	Path         string          `json:"path,omitempty" yaml:"path,omitempty"`
+	Patch        string          `json:"patch,omitempty" yaml:"patch,omitempty"`
+	Target       *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
+}
+
+
+func (p *PatchTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return err
+	}
+	if p.Patch == "" && p.Path == "" {
+		err = fmt.Errorf(
+			"must specify one of patch and path in\n%s", string(c))
+		return
+	}
+	if p.Patch != "" && p.Path != "" {
+		err = fmt.Errorf(
+			"patch and path can't be set at the same time\n%s", string(c))
+		return
+	}
+	var in []byte
+	if p.Path != "" {
+		in, err = h.Loader().Load(p.Path)
+		if err != nil {
+			return
+		}
+	}
+	if p.Patch != "" {
+		in = []byte(p.Patch)
+	}
+
+	patchSM, errSM := h.ResmapFactory().RF().FromBytes(in)
+	patchJson, errJson := jsonPatchFromBytes(in)
+	if errSM != nil && errJson != nil {
+		err = fmt.Errorf(
+			"unable to get either a Strategic Merge Patch or JSON patch 6902 from %s", p.Patch)
+		return
+	}
+	if errSM == nil && errJson != nil {
+		p.loadedPatch = patchSM
+	}
+	if errJson == nil && errSM != nil {
+		p.decodedPatch = patchJson
+	}
+	if patchSM != nil && patchJson != nil {
+		err = fmt.Errorf(
+			"a patch can't be both a Strategic Merge Patch and JSON patch 6902 %s", p.Patch)
+	}
+
+	return nil
+}
+
+func (p *PatchTransformerPlugin) Transform(m resmap.ResMap) error {
+	if p.loadedPatch != nil && p.Target == nil {
+		target, err := m.GetById(p.loadedPatch.OrgId())
+		if err != nil {
+			return err
+		}
+		err = target.Patch(p.loadedPatch.Kunstructured)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	if p.Target == nil {
+		return fmt.Errorf("must specify a target for patch %s", p.Patch)
+	}
+
+	resources, err := m.Select(*p.Target)
+	if err != nil {
+		return err
+	}
+	for _, res := range resources {
+		if p.decodedPatch != nil {
+			rawObj, err := res.MarshalJSON()
+			if err != nil {
+				return err
+			}
+			modifiedObj, err := p.decodedPatch.Apply(rawObj)
+			if err != nil {
+				return errors.Wrapf(
+					err, "failed to apply json patch '%s'", p.Patch)
+			}
+			err = res.UnmarshalJSON(modifiedObj)
+			if err != nil {
+				return err
+			}
+		}
+		if p.loadedPatch != nil {
+			patchCopy := p.loadedPatch.DeepCopy()
+			patchCopy.SetName(res.GetName())
+			patchCopy.SetNamespace(res.GetNamespace())
+			patchCopy.SetGvk(res.GetGvk())
+			err = res.Patch(patchCopy.Kunstructured)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// jsonPatchFromBytes loads a Json 6902 patch from
+// a bytes input
+func jsonPatchFromBytes(
+	in []byte) (jsonpatch.Patch, error) {
+	ops := string(in)
+	if ops == "" {
+		return nil, fmt.Errorf("empty json patch operations")
+	}
+
+	if ops[0] != '[' {
+		jsonOps, err := yaml.YAMLToJSON(in)
+		if err != nil {
+			return nil, err
+		}
+		ops = string(jsonOps)
+	}
+	return jsonpatch.DecodePatch([]byte(ops))
+}
+
+func NewPatchTransformerPlugin() resmap.TransformerPlugin {
+  return &PatchTransformerPlugin{}
+}
--- a/api/plugins/builtins/PrefixSuffixTransformer.go
+++ b/api/plugins/builtins/PrefixSuffixTransformer.go
@@ -0,0 +1,126 @@
+// Code generated by pluginator on PrefixSuffixTransformer; DO NOT EDIT.
+// pluginator {Version:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}
+
+
+
+package builtins
+
+import (
+	"errors"
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/transform"
+	"sigs.k8s.io/kustomize/api/types"
+
+	"sigs.k8s.io/kustomize/api/resid"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/yaml"
+)
+
+// Add the given prefix and suffix to the field.
+type PrefixSuffixTransformerPlugin struct {
+	Prefix     string            `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+	Suffix     string            `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+	FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+
+// Not placed in a file yet due to lack of demand.
+var prefixSuffixFieldSpecsToSkip = []types.FieldSpec{
+	{
+		Gvk: resid.Gvk{Kind: "CustomResourceDefinition"},
+	},
+	{
+		Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"},
+	},
+}
+
+func (p *PrefixSuffixTransformerPlugin) Config(
+	h *resmap.PluginHelpers, c []byte) (err error) {
+	p.Prefix = ""
+	p.Suffix = ""
+	p.FieldSpecs = nil
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return
+	}
+	if p.FieldSpecs == nil {
+		return errors.New("fieldSpecs is not expected to be nil")
+	}
+	return
+}
+
+func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
+
+	// Even if both the Prefix and Suffix are empty we want
+	// to proceed with the transformation. This allows to add contextual
+	// information to the resources (AddNamePrefix and AddNameSuffix).
+
+	for _, r := range m.Resources() {
+		if p.shouldSkip(r.OrgId()) {
+			// Don't change the actual definition
+			// of a CRD.
+			continue
+		}
+		id := r.OrgId()
+		// current default configuration contains
+		// only one entry: "metadata/name" with no GVK
+		for _, path := range p.FieldSpecs {
+			if !id.IsSelected(&path.Gvk) {
+				// With the currrent default configuration,
+				// because no Gvk is specified, so a wild
+				// card
+				continue
+			}
+
+			if smellsLikeANameChange(&path) {
+				// "metadata/name" is the only field.
+				// this will add a prefix and a suffix
+				// to the resource even if those are
+				// empty
+				r.AddNamePrefix(p.Prefix)
+				r.AddNameSuffix(p.Suffix)
+			}
+
+			// the addPrefixSuffix method will not
+			// change the name if both the prefix and suffix
+			// are empty.
+			err := transform.MutateField(
+				r.Map(),
+				path.PathSlice(),
+				path.CreateIfNotPresent,
+				p.addPrefixSuffix)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func smellsLikeANameChange(fs *types.FieldSpec) bool {
+	return fs.Path == "metadata/name"
+}
+
+func (p *PrefixSuffixTransformerPlugin) shouldSkip(
+	id resid.ResId) bool {
+	for _, path := range prefixSuffixFieldSpecsToSkip {
+		if id.IsSelected(&path.Gvk) {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *PrefixSuffixTransformerPlugin) addPrefixSuffix(
+	in interface{}) (interface{}, error) {
+	s, ok := in.(string)
+	if !ok {
+		return nil, fmt.Errorf("%#v is expected to be %T", in, s)
+	}
+	return fmt.Sprintf("%s%s%s", p.Prefix, s, p.Suffix), nil
+}
+
+func NewPrefixSuffixTransformerPlugin() resmap.TransformerPlugin {
+  return &PrefixSuffixTransformerPlugin{}
+}
--- a/Show More
+++ b/Show More