Update kubectl kustomize to kyaml/v0.14.1, cmd/config/v0.11.1, api/v0.13.2, kustomize/v5.0.1

LICENSES/vendor/sigs.k8s.io/kustomize/kustomize/v5/LICENSE

@@ -1,4 +1,4 @@
-= vendor/sigs.k8s.io/kustomize/kustomize/v4 licensed under: =
+= vendor/sigs.k8s.io/kustomize/kustomize/v5 licensed under: =
 
                                  Apache License
                            Version 2.0, January 2004
@@ -202,4 +202,4 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
-= vendor/sigs.k8s.io/kustomize/kustomize/v4/LICENSE e3fc50a88d0a364313df4b21ef20c29e
+= vendor/sigs.k8s.io/kustomize/kustomize/v5/LICENSE e3fc50a88d0a364313df4b21ef20c29e

go.mod

@@ -161,7 +161,7 @@ require (
 	github.com/fatih/camelcase v1.0.0 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/fvbommel/sortorder v1.0.1 // indirect
-	github.com/go-errors/errors v1.0.1 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -237,9 +237,9 @@ require (
 	gopkg.in/warnings.v0 v0.1.1 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.1 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/kustomize/api v0.12.1 // indirect
+	sigs.k8s.io/kustomize/api v0.13.2 // indirect
-	sigs.k8s.io/kustomize/kustomize/v4 v4.5.7 // indirect
+	sigs.k8s.io/kustomize/kustomize/v5 v5.0.1 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.14.1 // indirect
 )
 
 replace (

go.sum

@@ -247,8 +247,8 @@ github.com/fvbommel/sortorder v1.0.1 h1:dSnXLt4mJYH25uDDGa3biZNQsozaUWDSWeKJ0qqF
 github.com/fvbommel/sortorder v1.0.1/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
 github.com/getsentry/raven-go v0.2.0 h1:no+xWJRb5ZI7eE8TWgIq1jLulQiIoLG0IfYxv5JYMGs=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -1264,12 +1264,12 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.1 h1:MB1zkK+WMOmfLx
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.1/go.mod h1:/4NLd21PQY0B+H+X0aDZdwUiVXYJQl/2NXA5KVtDiP4=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
+sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA=
-sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s=
+sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw=
-sigs.k8s.io/kustomize/kustomize/v4 v4.5.7 h1:cDW6AVMl6t/SLuQaezMET8hgnadZGIAr8tUrxFVOrpg=
+sigs.k8s.io/kustomize/kustomize/v5 v5.0.1 h1:HWXbyKDNwGqol+s/sMNr/vnfNME/EoMdEraP4ZkUQek=
-sigs.k8s.io/kustomize/kustomize/v4 v4.5.7/go.mod h1:VSNKEH9D9d9bLiWEGbS6Xbg/Ih0tgQalmPvntzRxZ/Q=
+sigs.k8s.io/kustomize/kustomize/v5 v5.0.1/go.mod h1:Q8o+soB41Pn1y26eXzG9cniuECDpTJe2eKOA1fENCU8=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
+sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

hack/unwanted-dependencies.json

@@ -43,11 +43,6 @@
   },
   "status": {
     "unwantedReferences": {
-      "github.com/PuerkitoBio/urlesc": [
-        "sigs.k8s.io/kustomize/api",
-        "sigs.k8s.io/kustomize/kustomize/v4",
-        "sigs.k8s.io/kustomize/kyaml"
-      ],
       "github.com/getsentry/raven-go": [
         "go.etcd.io/etcd/raft/v3"
       ],
@@ -72,7 +67,7 @@
       ],
       "github.com/google/shlex": [
         "sigs.k8s.io/kustomize/api",
-        "sigs.k8s.io/kustomize/kustomize/v4"
+        "sigs.k8s.io/kustomize/kustomize/v5"
       ],
       "github.com/gorilla/websocket": [
         "github.com/moby/spdystream",
@@ -104,8 +99,7 @@
         "gotest.tools/v3",
         "k8s.io/system-validators",
         "sigs.k8s.io/kustomize/api",
-        "sigs.k8s.io/kustomize/kustomize/v4",
+        "sigs.k8s.io/kustomize/kustomize/v5"
-        "sigs.k8s.io/kustomize/kyaml"
       ]
     }
   }

hack/update-kustomize.sh

@@ -49,7 +49,7 @@ fi
 ./hack/pin-dependency.sh sigs.k8s.io/kustomize/kyaml "$LATEST_KYAML"
 ./hack/pin-dependency.sh sigs.k8s.io/kustomize/cmd/config "$LATEST_CONFIG"
 ./hack/pin-dependency.sh sigs.k8s.io/kustomize/api "$LATEST_API"
-./hack/pin-dependency.sh sigs.k8s.io/kustomize/kustomize/v4 "$LATEST_KUSTOMIZE"
+./hack/pin-dependency.sh sigs.k8s.io/kustomize/kustomize/v5 "$LATEST_KUSTOMIZE"
 
 ./hack/update-vendor.sh
 ./hack/update-internal-modules.sh

staging/src/k8s.io/cli-runtime/go.mod

@@ -21,14 +21,14 @@ require (
 	k8s.io/klog/v2 v2.90.1
 	k8s.io/kube-openapi v0.0.0-20230308215209-15aac26d736a
 	k8s.io/utils v0.0.0-20230209194617-a36077c30491
-	sigs.k8s.io/kustomize/api v0.12.1
+	sigs.k8s.io/kustomize/api v0.13.2
-	sigs.k8s.io/kustomize/kyaml v0.13.9
+	sigs.k8s.io/kustomize/kyaml v0.14.1
 	sigs.k8s.io/yaml v1.3.0
 )
 
 require (
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
-	github.com/go-errors/errors v1.0.1 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.1 // indirect

staging/src/k8s.io/cli-runtime/go.sum

@@ -53,8 +53,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
 github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -498,10 +498,10 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
+sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA=
-sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s=
+sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
+sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

staging/src/k8s.io/cli-runtime/pkg/resource/kustomizevisitor.go

@@ -38,7 +38,7 @@ type KustomizeVisitor struct {
 // Visit passes the result of a kustomize build to a StreamVisitor.
 func (v *KustomizeVisitor) Visit(fn VisitorFunc) error {
 	kOpts := krusty.MakeDefaultOptions()
-	kOpts.DoLegacyResourceSort = true
+	kOpts.Reorder = krusty.ReorderOptionLegacy
 	k := krusty.MakeKustomizer(kOpts)
 	m, err := k.Run(v.fSys, v.dirPath)
 	if err != nil {

staging/src/k8s.io/kubectl/go.mod

@@ -41,8 +41,8 @@ require (
 	k8s.io/metrics v0.0.0
 	k8s.io/utils v0.0.0-20230209194617-a36077c30491
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd
-	sigs.k8s.io/kustomize/kustomize/v4 v4.5.7
+	sigs.k8s.io/kustomize/kustomize/v5 v5.0.1
-	sigs.k8s.io/kustomize/kyaml v0.13.9
+	sigs.k8s.io/kustomize/kyaml v0.14.1
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3
 	sigs.k8s.io/yaml v1.3.0
 )
@@ -51,7 +51,7 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
-	github.com/go-errors/errors v1.0.1 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
@@ -87,7 +87,7 @@ require (
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	sigs.k8s.io/kustomize/api v0.12.1 // indirect
+	sigs.k8s.io/kustomize/api v0.13.2 // indirect
 )
 
 replace (

staging/src/k8s.io/kubectl/go.sum

@@ -71,8 +71,8 @@ github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
 github.com/fvbommel/sortorder v1.0.1 h1:dSnXLt4mJYH25uDDGa3biZNQsozaUWDSWeKJ0qqFfzE=
 github.com/fvbommel/sortorder v1.0.1/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
-github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -542,12 +542,12 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
+sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA=
-sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s=
+sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw=
-sigs.k8s.io/kustomize/kustomize/v4 v4.5.7 h1:cDW6AVMl6t/SLuQaezMET8hgnadZGIAr8tUrxFVOrpg=
+sigs.k8s.io/kustomize/kustomize/v5 v5.0.1 h1:HWXbyKDNwGqol+s/sMNr/vnfNME/EoMdEraP4ZkUQek=
-sigs.k8s.io/kustomize/kustomize/v4 v4.5.7/go.mod h1:VSNKEH9D9d9bLiWEGbS6Xbg/Ih0tgQalmPvntzRxZ/Q=
+sigs.k8s.io/kustomize/kustomize/v5 v5.0.1/go.mod h1:Q8o+soB41Pn1y26eXzG9cniuECDpTJe2eKOA1fENCU8=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
+sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

staging/src/k8s.io/kubectl/pkg/cmd/kustomize/kustomize.go

@@ -21,7 +21,7 @@ import (
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/kubectl/pkg/util/i18n"
 	"k8s.io/kubectl/pkg/util/templates"
-	"sigs.k8s.io/kustomize/kustomize/v4/commands/build"
+	"sigs.k8s.io/kustomize/kustomize/v5/commands/build"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 

staging/src/k8s.io/kubectl/pkg/cmd/version/version.go

@@ -36,7 +36,7 @@ import (
 )
 
 // TODO(knverey): remove this hardcoding once kubectl being built with module support makes BuildInfo available.
-const kustomizeVersion = "v4.5.7"
+const kustomizeVersion = "v5.0.1"
 
 // Version is a struct for version information
 type Version struct {
@@ -195,7 +195,7 @@ func GetKustomizeModVersion() (string, bool) {
 		return "", false
 	}
 	for _, dep := range info.Deps {
-		if dep.Path == "sigs.k8s.io/kustomize/kustomize/v4" {
+		if dep.Path == "sigs.k8s.io/kustomize/kustomize/v4" || dep.Path == "sigs.k8s.io/kustomize/kustomize/v5" {
 			return dep.Version, true
 		}
 	}

staging/src/k8s.io/sample-cli-plugin/go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
-	github.com/go-errors/errors v1.0.1 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.1 // indirect
@@ -60,8 +60,8 @@ require (
 	k8s.io/kube-openapi v0.0.0-20230308215209-15aac26d736a // indirect
 	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/kustomize/api v0.12.1 // indirect
+	sigs.k8s.io/kustomize/api v0.13.2 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.14.1 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )

staging/src/k8s.io/sample-cli-plugin/go.sum

@@ -53,8 +53,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
 github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
-github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -498,10 +498,10 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
+sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA=
-sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s=
+sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw=
-sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk=
+sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA=
-sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4=
+sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=

vendor/github.com/go-errors/errors/.travis.yml

@@ -3,3 +3,6 @@ language: go
 go:
   - "1.8.x"
   - "1.10.x"
+  - "1.13.x"
+  - "1.14.x"
+  - "1.16.x"

vendor/github.com/go-errors/errors/README.md

@@ -64,3 +64,19 @@ packages by Facebook and Dropbox, it was moved to one canonical location so
 everyone can benefit.
 
 This package is licensed under the MIT license, see LICENSE.MIT for details.
+
+
+## Changelog
+* v1.1.0 updated to use go1.13's standard-library errors.Is method instead of == in errors.Is
+* v1.2.0 added `errors.As` from the standard library.
+* v1.3.0 *BREAKING* updated error methods to return `error` instead of `*Error`.
+>  Code that needs access to the underlying `*Error` can use the new errors.AsError(e)
+> ```
+>   // before
+>   errors.New(err).ErrorStack()
+>   // after
+>.  errors.AsError(errors.Wrap(err)).ErrorStack()
+> ```
+* v1.4.0 *BREAKING* v1.4.0 reverted all changes from v1.3.0 and is identical to v1.2.0
+* v1.4.1 no code change, but now without an unnecessary cover.out file.
+* v1.4.2 performance improvement to ErrorStack() to avoid unnecessary work https://github.com/go-errors/errors/pull/40

vendor/github.com/go-errors/errors/cover.out

@@ -1,89 +0,0 @@
-mode: set
-github.com/go-errors/errors/stackframe.go:27.51,30.25 2 1
-github.com/go-errors/errors/stackframe.go:33.2,38.8 3 1
-github.com/go-errors/errors/stackframe.go:30.25,32.3 1 0
-github.com/go-errors/errors/stackframe.go:43.47,44.31 1 1
-github.com/go-errors/errors/stackframe.go:47.2,47.48 1 1
-github.com/go-errors/errors/stackframe.go:44.31,46.3 1 1
-github.com/go-errors/errors/stackframe.go:52.42,56.16 3 1
-github.com/go-errors/errors/stackframe.go:60.2,60.60 1 1
-github.com/go-errors/errors/stackframe.go:56.16,58.3 1 0
-github.com/go-errors/errors/stackframe.go:64.55,67.16 2 1
-github.com/go-errors/errors/stackframe.go:71.2,72.61 2 1
-github.com/go-errors/errors/stackframe.go:76.2,76.66 1 1
-github.com/go-errors/errors/stackframe.go:67.16,69.3 1 0
-github.com/go-errors/errors/stackframe.go:72.61,74.3 1 0
-github.com/go-errors/errors/stackframe.go:79.56,91.63 3 1
-github.com/go-errors/errors/stackframe.go:95.2,95.53 1 1
-github.com/go-errors/errors/stackframe.go:100.2,101.18 2 1
-github.com/go-errors/errors/stackframe.go:91.63,94.3 2 1
-github.com/go-errors/errors/stackframe.go:95.53,98.3 2 1
-github.com/go-errors/errors/error.go:70.32,73.23 2 1
-github.com/go-errors/errors/error.go:80.2,85.3 3 1
-github.com/go-errors/errors/error.go:74.2,75.10 1 1
-github.com/go-errors/errors/error.go:76.2,77.28 1 1
-github.com/go-errors/errors/error.go:92.43,95.23 2 1
-github.com/go-errors/errors/error.go:104.2,109.3 3 1
-github.com/go-errors/errors/error.go:96.2,97.11 1 1
-github.com/go-errors/errors/error.go:98.2,99.10 1 1
-github.com/go-errors/errors/error.go:100.2,101.28 1 1
-github.com/go-errors/errors/error.go:115.39,117.19 1 1
-github.com/go-errors/errors/error.go:121.2,121.29 1 1
-github.com/go-errors/errors/error.go:125.2,125.43 1 1
-github.com/go-errors/errors/error.go:129.2,129.14 1 1
-github.com/go-errors/errors/error.go:117.19,119.3 1 1
-github.com/go-errors/errors/error.go:121.29,123.3 1 1
-github.com/go-errors/errors/error.go:125.43,127.3 1 1
-github.com/go-errors/errors/error.go:135.53,137.2 1 1
-github.com/go-errors/errors/error.go:140.34,142.2 1 1
-github.com/go-errors/errors/error.go:146.34,149.42 2 1
-github.com/go-errors/errors/error.go:153.2,153.20 1 1
-github.com/go-errors/errors/error.go:149.42,151.3 1 1
-github.com/go-errors/errors/error.go:158.39,160.2 1 1
-github.com/go-errors/errors/error.go:164.46,165.23 1 1
-github.com/go-errors/errors/error.go:173.2,173.19 1 1
-github.com/go-errors/errors/error.go:165.23,168.32 2 1
-github.com/go-errors/errors/error.go:168.32,170.4 1 1
-github.com/go-errors/errors/error.go:177.37,178.42 1 1
-github.com/go-errors/errors/error.go:181.2,181.41 1 1
-github.com/go-errors/errors/error.go:178.42,180.3 1 1
-github.com/go-errors/errors/parse_panic.go:10.39,12.2 1 1
-github.com/go-errors/errors/parse_panic.go:16.46,24.34 5 1
-github.com/go-errors/errors/parse_panic.go:70.2,70.43 1 1
-github.com/go-errors/errors/parse_panic.go:73.2,73.55 1 0
-github.com/go-errors/errors/parse_panic.go:24.34,27.23 2 1
-github.com/go-errors/errors/parse_panic.go:27.23,28.42 1 1
-github.com/go-errors/errors/parse_panic.go:28.42,31.5 2 1
-github.com/go-errors/errors/parse_panic.go:31.6,33.5 1 0
-github.com/go-errors/errors/parse_panic.go:35.5,35.29 1 1
-github.com/go-errors/errors/parse_panic.go:35.29,36.86 1 1
-github.com/go-errors/errors/parse_panic.go:36.86,38.5 1 1
-github.com/go-errors/errors/parse_panic.go:40.5,40.32 1 1
-github.com/go-errors/errors/parse_panic.go:40.32,41.18 1 1
-github.com/go-errors/errors/parse_panic.go:45.4,46.46 2 1
-github.com/go-errors/errors/parse_panic.go:51.4,53.23 2 1
-github.com/go-errors/errors/parse_panic.go:57.4,58.18 2 1
-github.com/go-errors/errors/parse_panic.go:62.4,63.17 2 1
-github.com/go-errors/errors/parse_panic.go:41.18,43.10 2 1
-github.com/go-errors/errors/parse_panic.go:46.46,49.5 2 1
-github.com/go-errors/errors/parse_panic.go:53.23,55.5 1 0
-github.com/go-errors/errors/parse_panic.go:58.18,60.5 1 0
-github.com/go-errors/errors/parse_panic.go:63.17,65.10 2 1
-github.com/go-errors/errors/parse_panic.go:70.43,72.3 1 1
-github.com/go-errors/errors/parse_panic.go:80.85,82.29 2 1
-github.com/go-errors/errors/parse_panic.go:85.2,85.15 1 1
-github.com/go-errors/errors/parse_panic.go:88.2,90.63 2 1
-github.com/go-errors/errors/parse_panic.go:94.2,94.53 1 1
-github.com/go-errors/errors/parse_panic.go:99.2,101.36 2 1
-github.com/go-errors/errors/parse_panic.go:105.2,106.15 2 1
-github.com/go-errors/errors/parse_panic.go:109.2,112.49 3 1
-github.com/go-errors/errors/parse_panic.go:116.2,117.16 2 1
-github.com/go-errors/errors/parse_panic.go:121.2,126.8 1 1
-github.com/go-errors/errors/parse_panic.go:82.29,84.3 1 0
-github.com/go-errors/errors/parse_panic.go:85.15,87.3 1 1
-github.com/go-errors/errors/parse_panic.go:90.63,93.3 2 1
-github.com/go-errors/errors/parse_panic.go:94.53,97.3 2 1
-github.com/go-errors/errors/parse_panic.go:101.36,103.3 1 0
-github.com/go-errors/errors/parse_panic.go:106.15,108.3 1 0
-github.com/go-errors/errors/parse_panic.go:112.49,114.3 1 1
-github.com/go-errors/errors/parse_panic.go:117.16,119.3 1 0

vendor/github.com/go-errors/errors/error.go

@@ -91,6 +91,10 @@ func New(e interface{}) *Error {
 // fmt.Errorf("%v"). The skip parameter indicates how far up the stack
 // to start the stacktrace. 0 is from the current call, 1 from its caller, etc.
 func Wrap(e interface{}, skip int) *Error {
+	if e == nil {
+		return nil
+	}
+
 	var err error
 
 	switch e := e.(type) {
@@ -117,6 +121,9 @@ func Wrap(e interface{}, skip int) *Error {
 // up the stack to start the stacktrace. 0 is from the current call,
 // 1 from its caller, etc.
 func WrapPrefix(e interface{}, prefix string, skip int) *Error {
+	if e == nil {
+		return nil
+	}
 
 	err := Wrap(e, 1+skip)
 
@@ -132,26 +139,6 @@ func WrapPrefix(e interface{}, prefix string, skip int) *Error {
 
 }
 
-// Is detects whether the error is equal to a given error. Errors
-// are considered equal by this function if they are the same object,
-// or if they both contain the same error inside an errors.Error.
-func Is(e error, original error) bool {
-
-	if e == original {
-		return true
-	}
-
-	if e, ok := e.(*Error); ok {
-		return Is(e.Err, original)
-	}
-
-	if original, ok := original.(*Error); ok {
-		return Is(e, original.Err)
-	}
-
-	return false
-}
-
 // Errorf creates a new error with the given message. You can use it
 // as a drop-in replacement for fmt.Errorf() to provide descriptive
 // errors in return values.
@@ -215,3 +202,8 @@ func (err *Error) TypeName() string {
 	}
 	return reflect.TypeOf(err.Err).String()
 }
+
+// Return the wrapped error (implements api for As function).
+func (err *Error) Unwrap() error {
+	return err.Err
+}

vendor/github.com/go-errors/errors/error_1_13.go

@@ -0,0 +1,31 @@
+// +build go1.13
+
+package errors
+
+import (
+	baseErrors "errors"
+)
+
+// find error in any wrapped error
+func As(err error, target interface{}) bool {
+	return baseErrors.As(err, target)
+}
+
+// Is detects whether the error is equal to a given error. Errors
+// are considered equal by this function if they are matched by errors.Is
+// or if their contained errors are matched through errors.Is
+func Is(e error, original error) bool {
+	if baseErrors.Is(e, original) {
+		return true
+	}
+
+	if e, ok := e.(*Error); ok {
+		return Is(e.Err, original)
+	}
+
+	if original, ok := original.(*Error); ok {
+		return Is(e, original.Err)
+	}
+
+	return false
+}

vendor/github.com/go-errors/errors/error_backward.go

@@ -0,0 +1,57 @@
+// +build !go1.13
+
+package errors
+
+import (
+	"reflect"
+)
+
+type unwrapper interface {
+	Unwrap() error
+}
+
+// As assigns error or any wrapped error to the value target points
+// to. If there is no value of the target type of target As returns
+// false.
+func As(err error, target interface{}) bool {
+	targetType := reflect.TypeOf(target)
+
+	for {
+		errType := reflect.TypeOf(err)
+
+		if errType == nil {
+			return false
+		}
+
+		if reflect.PtrTo(errType) == targetType {
+			reflect.ValueOf(target).Elem().Set(reflect.ValueOf(err))
+			return true
+		}
+
+		wrapped, ok := err.(unwrapper)
+		if ok {
+			err = wrapped.Unwrap()
+		} else {
+			return false
+		}
+	}
+}
+
+// Is detects whether the error is equal to a given error. Errors
+// are considered equal by this function if they are the same object,
+// or if they both contain the same error inside an errors.Error.
+func Is(e error, original error) bool {
+	if e == original {
+		return true
+	}
+
+	if e, ok := e.(*Error); ok {
+		return Is(e.Err, original)
+	}
+
+	if original, ok := original.(*Error); ok {
+		return Is(e, original.Err)
+	}
+
+	return false
+}

vendor/github.com/go-errors/errors/stackframe.go

@@ -1,9 +1,10 @@
 package errors
 
 import (
+	"bufio"
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"runtime"
 	"strings"
 )
@@ -52,7 +53,7 @@ func (frame *StackFrame) Func() *runtime.Func {
 func (frame *StackFrame) String() string {
 	str := fmt.Sprintf("%s:%d (0x%x)\n", frame.File, frame.LineNumber, frame.ProgramCounter)
 
-	source, err := frame.SourceLine()
+	source, err := frame.sourceLine()
 	if err != nil {
 		return str
 	}
@@ -62,18 +63,37 @@ func (frame *StackFrame) String() string {
 
 // SourceLine gets the line of code (from File and Line) of the original source if possible.
 func (frame *StackFrame) SourceLine() (string, error) {
-	data, err := ioutil.ReadFile(frame.File)
+	source, err := frame.sourceLine()
-
 	if err != nil {
-		return "", New(err)
+		return source, New(err)
+	}
+	return source, err
 }
 
-	lines := bytes.Split(data, []byte{'\n'})
+func (frame *StackFrame) sourceLine() (string, error) {
-	if frame.LineNumber <= 0 || frame.LineNumber >= len(lines) {
+	if frame.LineNumber <= 0 {
 		return "???", nil
 	}
-	// -1 because line-numbers are 1 based, but our array is 0 based
+
-	return string(bytes.Trim(lines[frame.LineNumber-1], " \t")), nil
+	file, err := os.Open(frame.File)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	currentLine := 1
+	for scanner.Scan() {
+		if currentLine == frame.LineNumber {
+			return string(bytes.Trim(scanner.Bytes(), " \t")), nil
+		}
+		currentLine++
+	}
+	if err := scanner.Err(); err != nil {
+		return "", err
+	}
+
+	return "???", nil
 }
 
 func packageAndName(fn *runtime.Func) (string, string) {

vendor/modules.txt

@@ -214,8 +214,8 @@ github.com/fsnotify/fsnotify
 # github.com/fvbommel/sortorder v1.0.1
 ## explicit; go 1.13
 github.com/fvbommel/sortorder
-# github.com/go-errors/errors v1.0.1
+# github.com/go-errors/errors v1.4.2
-## explicit
+## explicit; go 1.14
 github.com/go-errors/errors
 # github.com/go-logr/logr v1.2.3
 ## explicit; go 1.16
@@ -2374,8 +2374,8 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
 ## explicit; go 1.18
 sigs.k8s.io/json
 sigs.k8s.io/json/internal/golang/encoding/json
-# sigs.k8s.io/kustomize/api v0.12.1
+# sigs.k8s.io/kustomize/api v0.13.2
-## explicit; go 1.18
+## explicit; go 1.19
 sigs.k8s.io/kustomize/api/filters/annotations
 sigs.k8s.io/kustomize/api/filters/fieldspec
 sigs.k8s.io/kustomize/api/filters/filtersutil
@@ -2420,11 +2420,11 @@ sigs.k8s.io/kustomize/api/provider
 sigs.k8s.io/kustomize/api/resmap
 sigs.k8s.io/kustomize/api/resource
 sigs.k8s.io/kustomize/api/types
-# sigs.k8s.io/kustomize/kustomize/v4 v4.5.7
+# sigs.k8s.io/kustomize/kustomize/v5 v5.0.1
-## explicit; go 1.18
+## explicit; go 1.19
-sigs.k8s.io/kustomize/kustomize/v4/commands/build
+sigs.k8s.io/kustomize/kustomize/v5/commands/build
-# sigs.k8s.io/kustomize/kyaml v0.13.9
+# sigs.k8s.io/kustomize/kyaml v0.14.1
-## explicit; go 1.18
+## explicit; go 1.19
 sigs.k8s.io/kustomize/kyaml/comments
 sigs.k8s.io/kustomize/kyaml/errors
 sigs.k8s.io/kustomize/kyaml/ext
@@ -2441,7 +2441,7 @@ sigs.k8s.io/kustomize/kyaml/kio/filters
 sigs.k8s.io/kustomize/kyaml/kio/kioutil
 sigs.k8s.io/kustomize/kyaml/openapi
 sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi
-sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1212
+sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1_21_2
 sigs.k8s.io/kustomize/kyaml/openapi/kustomizationapi
 sigs.k8s.io/kustomize/kyaml/order
 sigs.k8s.io/kustomize/kyaml/resid

vendor/sigs.k8s.io/kustomize/api/filters/nameref/nameref.go

@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/fieldspec"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -64,7 +64,7 @@ func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		FieldSpec: f.NameFieldToUpdate,
 		SetValue:  f.set,
 	}); err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "updating name reference in '%s' field of '%s'",
 			f.NameFieldToUpdate.Path, f.Referrer.CurId().String())
 	}
@@ -104,7 +104,7 @@ func (f Filter) setMapping(node *yaml.RNode) error {
 	}
 	nameNode, err := node.Pipe(yaml.FieldMatcher{Name: "name"})
 	if err != nil {
-		return errors.Wrap(err, "trying to match 'name' field")
+		return errors.WrapPrefixf(err, "trying to match 'name' field")
 	}
 	if nameNode == nil {
 		// This is a _configuration_ error; the field path
@@ -153,7 +153,7 @@ func (f Filter) filterMapCandidatesByNamespace(
 	node *yaml.RNode) ([]*resource.Resource, error) {
 	namespaceNode, err := node.Pipe(yaml.FieldMatcher{Name: "namespace"})
 	if err != nil {
-		return nil, errors.Wrap(err, "trying to match 'namespace' field")
+		return nil, errors.WrapPrefixf(err, "trying to match 'namespace' field")
 	}
 	if namespaceNode == nil {
 		return f.ReferralCandidates.Resources(), nil

vendor/sigs.k8s.io/kustomize/api/filters/namespace/namespace.go

@@ -79,7 +79,11 @@ func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
 		CreateTag:  yaml.NodeTagString,
 	})
-	return node, err
+	invalidKindErr := &yaml.InvalidNodeKindError{}
+	if err != nil && errors.As(err, &invalidKindErr) && invalidKindErr.ActualNodeKind() != yaml.ScalarNode {
+		return nil, errors.WrapPrefixf(err, "namespace field specs must target scalar nodes")
+	}
+	return node, errors.WrapPrefixf(err, "namespace transformation failed")
 }
 
 // metaNamespaceHack is a hack for implementing the namespace transform
@@ -174,8 +178,7 @@ func setNamespaceField(node *yaml.RNode, setter filtersutil.SetFn) error {
 func (ns Filter) removeRoleBindingSubjectFieldSpecs(fs types.FsSlice) types.FsSlice {
 	var val types.FsSlice
 	for i := range fs {
-		if isRoleBinding(fs[i].Kind) &&
+		if isRoleBinding(fs[i].Kind) && fs[i].Path == subjectsNamespacePath {
-			(fs[i].Path == subjectsNamespacePath || fs[i].Path == subjectsField) {
 			continue
 		}
 		val = append(val, fs[i])

vendor/sigs.k8s.io/kustomize/api/filters/replacement/replacement.go

@@ -4,13 +4,13 @@
 package replacement
 
 import (
-	"errors"
 	"fmt"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml_utils "sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -105,7 +105,7 @@ func getRefinedValue(options *types.FieldOptions, rn *yaml.RNode) (*yaml.RNode,
 func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []*types.TargetSelector) ([]*yaml.RNode, error) {
 	for _, selector := range targetSelectors {
 		if selector.Select == nil {
-			return nil, errors.New("target must specify resources to select")
+			return nil, errors.Errorf("target must specify resources to select")
 		}
 		if len(selector.FieldPaths) == 0 {
 			selector.FieldPaths = []string{types.DefaultReplacementFieldPath}
@@ -179,29 +179,22 @@ func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
 
 func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.TargetSelector) error {
 	for _, fp := range selector.FieldPaths {
-		fieldPath := kyaml_utils.SmarterPathSplitter(fp, ".")
+		createKind := yaml.Kind(0) // do not create
-		create, err := shouldCreateField(selector.Options, fieldPath)
+		if selector.Options != nil && selector.Options.Create {
+			createKind = value.YNode().Kind
+		}
+		targetFieldList, err := target.Pipe(&yaml.PathMatcher{
+			Path:   kyaml_utils.SmarterPathSplitter(fp, "."),
+			Create: createKind})
 		if err != nil {
-			return err
+			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
 		}
-
+		targetFields, err := targetFieldList.Elements()
-		var targetFields []*yaml.RNode
-		if create {
-			createdField, createErr := target.Pipe(yaml.LookupCreate(value.YNode().Kind, fieldPath...))
-			if createErr != nil {
-				return fmt.Errorf("error creating replacement node: %w", createErr)
-			}
-			targetFields = append(targetFields, createdField)
-		} else {
-			// may return multiple fields, always wrapped in a sequence node
-			foundFieldSequence, lookupErr := target.Pipe(&yaml.PathMatcher{Path: fieldPath})
-			if lookupErr != nil {
-				return fmt.Errorf("error finding field in replacement target: %w", lookupErr)
-			}
-			targetFields, err = foundFieldSequence.Elements()
 		if err != nil {
-				return fmt.Errorf("error fetching elements in replacement target: %w", err)
+			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
 		}
+		if len(targetFields) == 0 {
+			return errors.Errorf(fieldRetrievalError(fp, createKind != 0))
 		}
 
 		for _, t := range targetFields {
@@ -209,11 +202,17 @@ func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.Ta
 				return err
 			}
 		}
-
 	}
 	return nil
 }
 
+func fieldRetrievalError(fieldPath string, isCreate bool) string {
+	if isCreate {
+		return fmt.Sprintf("unable to find or create field %q in replacement target", fieldPath)
+	}
+	return fmt.Sprintf("unable to find field %q in replacement target", fieldPath)
+}
+
 func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *yaml.RNode) error {
 	value = value.Copy()
 	if options != nil && options.Delimiter != "" {
@@ -243,16 +242,3 @@ func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *
 
 	return nil
 }
-
-func shouldCreateField(options *types.FieldOptions, fieldPath []string) (bool, error) {
-	if options == nil || !options.Create {
-		return false, nil
-	}
-	// create option is not supported in a wildcard matching
-	for _, f := range fieldPath {
-		if f == "*" {
-			return false, fmt.Errorf("cannot support create option in a multi-value target")
-		}
-	}
-	return true, nil
-}

vendor/sigs.k8s.io/kustomize/api/ifc/ifc.go

@@ -28,12 +28,20 @@ type KvLoader interface {
 
 // Loader interface exposes methods to read bytes.
 type Loader interface {
+
+	// Repo returns the repo location if this Loader was created from a url
+	// or the empty string otherwise.
+	Repo() string
+
 	// Root returns the root location for this Loader.
 	Root() string
+
 	// New returns Loader located at newRoot.
 	New(newRoot string) (Loader, error)
+
 	// Load returns the bytes read from the location or an error.
 	Load(location string) ([]byte, error)
+
 	// Cleanup cleans the loader
 	Cleanup() error
 }

vendor/sigs.k8s.io/kustomize/api/internal/accumulator/loadconfigfromcrds.go

@@ -7,11 +7,11 @@ import (
 	"encoding/json"
 	"strings"
 
-	"github.com/pkg/errors"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/yaml"
@@ -39,7 +39,7 @@ func LoadConfigFromCRDs(
 		}
 		m, err := makeNameToApiMap(content)
 		if err != nil {
-			return nil, errors.Wrapf(err, "unable to parse open API definition from '%s'", path)
+			return nil, errors.WrapPrefixf(err, "unable to parse open API definition from '%s'", path)
 		}
 		otherTc, err := makeConfigFromApiMap(m)
 		if err != nil {

vendor/sigs.k8s.io/kustomize/api/internal/builtins/AnnotationsTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ConfigMapGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/HashTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on HashTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/HelmChartInflationGenerator.go

@@ -1,12 +1,11 @@
 // Code generated by pluginator on HelmChartInflationGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -14,14 +13,14 @@ import (
 	"strings"
 
 	"github.com/imdario/mergo"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/yaml"
 )
 
-// HelmChartInflationGeneratorPlugin is a plugin to generate resources
+// Generate resources from a remote or local helm chart.
-// from a remote or local helm chart.
 type HelmChartInflationGeneratorPlugin struct {
 	h *resmap.PluginHelpers
 	types.HelmGlobals
@@ -29,8 +28,6 @@ type HelmChartInflationGeneratorPlugin struct {
 	tmpDir string
 }
 
-var KustomizePlugin HelmChartInflationGeneratorPlugin
-
 const (
 	valuesMergeOptionMerge    = "merge"
 	valuesMergeOptionOverride = "override"
@@ -73,7 +70,7 @@ func (p *HelmChartInflationGeneratorPlugin) establishTmpDir() (err error) {
 		// already done.
 		return nil
 	}
-	p.tmpDir, err = ioutil.TempDir("", "kustomize-helm-")
+	p.tmpDir, err = os.MkdirTemp("", "kustomize-helm-")
 	return err
 }
 
@@ -87,15 +84,23 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// the loader root (unless root restrictions are
 	// disabled, in which case this can be an absolute path).
 	if p.ChartHome == "" {
-		p.ChartHome = "charts"
+		p.ChartHome = types.HelmDefaultHome
 	}
 
-	// The ValuesFile may be consulted by the plugin, so it must
+	// The ValuesFile(s) may be consulted by the plugin, so it must
 	// be under the loader root (unless root restrictions are
 	// disabled).
 	if p.ValuesFile == "" {
 		p.ValuesFile = filepath.Join(p.ChartHome, p.Name, "values.yaml")
 	}
+	for i, file := range p.AdditionalValuesFiles {
+		// use Load() to enforce root restrictions
+		if _, err := p.h.Loader().Load(file); err != nil {
+			return errors.WrapPrefixf(err, "could not load additionalValuesFile")
+		}
+		// the additional values filepaths must be relative to the kust root
+		p.AdditionalValuesFiles[i] = filepath.Join(p.h.Loader().Root(), file)
+	}
 
 	if err = p.errIfIllegalValuesMerge(); err != nil {
 		return err
@@ -104,7 +109,7 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// ConfigHome is not loaded by the plugin, and can be located anywhere.
 	if p.ConfigHome == "" {
 		if err = p.establishTmpDir(); err != nil {
-			return errors.Wrap(
+			return errors.WrapPrefixf(
 				err, "unable to create tmp dir for HELM_CONFIG_HOME")
 		}
 		p.ConfigHome = filepath.Join(p.tmpDir, "helm")
@@ -148,7 +153,7 @@ func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
 	err := cmd.Run()
 	if err != nil {
 		helm := p.h.GeneralConfig().HelmConfig.Command
-		err = errors.Wrap(
+		err = errors.WrapPrefixf(
 			fmt.Errorf(
 				"unable to run: '%s %s' with env=%s (is '%s' installed?)",
 				helm, strings.Join(args, " "), env, helm),
@@ -211,7 +216,7 @@ func (p *HelmChartInflationGeneratorPlugin) writeValuesBytes(
 		return "", fmt.Errorf("cannot create tmp dir to write helm values")
 	}
 	path := filepath.Join(p.tmpDir, p.Name+"-kustomize-values.yaml")
-	return path, ioutil.WriteFile(path, b, 0644)
+	return path, errors.WrapPrefixf(os.WriteFile(path, b, 0644), "failed to write values file")
 }
 
 func (p *HelmChartInflationGeneratorPlugin) cleanup() {
@@ -244,46 +249,28 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 		return nil, err
 	}
 	var stdout []byte
-	stdout, err = p.runHelmCommand(p.templateCommand())
+	stdout, err = p.runHelmCommand(p.AsHelmArgs(p.absChartHome()))
 	if err != nil {
 		return nil, err
 	}
 
-	rm, err = p.h.ResmapFactory().NewResMapFromBytes(stdout)
+	rm, resMapErr := p.h.ResmapFactory().NewResMapFromBytes(stdout)
-	if err == nil {
+	if resMapErr == nil {
 		return rm, nil
 	}
 	// try to remove the contents before first "---" because
 	// helm may produce messages to stdout before it
-	stdoutStr := string(stdout)
+	r := &kio.ByteReader{Reader: bytes.NewBufferString(string(stdout)), OmitReaderAnnotations: true}
-	if idx := strings.Index(stdoutStr, "---"); idx != -1 {
+	nodes, err := r.Read()
-		return p.h.ResmapFactory().NewResMapFromBytes([]byte(stdoutStr[idx:]))
-	}
-	return nil, err
-}
 
-func (p *HelmChartInflationGeneratorPlugin) templateCommand() []string {
+	if len(nodes) != 0 {
-	args := []string{"template"}
+		rm, err = p.h.ResmapFactory().NewResMapFromRNodeSlice(nodes)
-	if p.ReleaseName != "" {
+		if err != nil {
-		args = append(args, p.ReleaseName)
+			return nil, fmt.Errorf("could not parse rnode slice into resource map: %w\n", err)
 		}
-	if p.Namespace != "" {
+		return rm, nil
-		args = append(args, "--namespace", p.Namespace)
 	}
-	args = append(args, filepath.Join(p.absChartHome(), p.Name))
+	return nil, fmt.Errorf("could not parse bytes into resource map: %w\n", resMapErr)
-	if p.ValuesFile != "" {
-		args = append(args, "--values", p.ValuesFile)
-	}
-	if p.ReleaseName == "" {
-		// AFAICT, this doesn't work as intended due to a bug in helm.
-		// See https://github.com/helm/helm/issues/6019
-		// I've tried placing the flag before and after the name argument.
-		args = append(args, "--generate-name")
-	}
-	if p.IncludeCRDs {
-		args = append(args, "--include-crds")
-	}
-	return args
 }
 
 func (p *HelmChartInflationGeneratorPlugin) pullCommand() []string {

vendor/sigs.k8s.io/kustomize/api/internal/builtins/IAMPolicyGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on IAMPolicyGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ImageTagTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/LabelTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on LabelTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/LegacyOrderTransformer.go

@@ -1,46 +0,0 @@
-// Code generated by pluginator on LegacyOrderTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
-
-package builtins
-
-import (
-	"sort"
-
-	"github.com/pkg/errors"
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-// Sort the resources using an ordering defined in the Gvk class.
-// This puts cluster-wide basic resources with no
-// dependencies (like Namespace, StorageClass, etc.)
-// first, and resources with a high number of dependencies
-// (like ValidatingWebhookConfiguration) last.
-type LegacyOrderTransformerPlugin struct{}
-
-// Nothing needed for configuration.
-func (p *LegacyOrderTransformerPlugin) Config(
-	_ *resmap.PluginHelpers, _ []byte) (err error) {
-	return nil
-}
-
-func (p *LegacyOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
-	resources := make([]*resource.Resource, m.Size())
-	ids := m.AllIds()
-	sort.Sort(resmap.IdSlice(ids))
-	for i, id := range ids {
-		resources[i], err = m.GetByCurrentId(id)
-		if err != nil {
-			return errors.Wrap(err, "expected match for sorting")
-		}
-	}
-	m.Clear()
-	for _, r := range resources {
-		m.Append(r)
-	}
-	return nil
-}
-
-func NewLegacyOrderTransformerPlugin() resmap.TransformerPlugin {
-	return &LegacyOrderTransformerPlugin{}
-}

vendor/sigs.k8s.io/kustomize/api/internal/builtins/NamespaceTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchJson6902Transformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchJson6902Transformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 
@@ -7,11 +7,11 @@ import (
 	"fmt"
 
 	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/yaml"
 )
@@ -61,7 +61,7 @@ func (p *PatchJson6902TransformerPlugin) Config(
 	}
 	p.decodedPatch, err = jsonpatch.DecodePatch([]byte(p.JsonOp))
 	if err != nil {
-		return errors.Wrapf(err, "decoding %s", p.JsonOp)
+		return errors.WrapPrefixf(err, "decoding %s", p.JsonOp)
 	}
 	if len(p.decodedPatch) == 0 {
 		return fmt.Errorf(

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchStrategicMergeTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchStrategicMergeTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PrefixTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PrefixTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ReplacementTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ReplacementTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ReplicaCountTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ReplicaCountTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SecretGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on SecretGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SortOrderTransformer.go

@@ -0,0 +1,244 @@
+// Code generated by pluginator on SortOrderTransformer; DO NOT EDIT.
+// pluginator {(devel)  unknown   }
+
+package builtins
+
+import (
+	"sort"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+	"sigs.k8s.io/yaml"
+)
+
+// Sort the resources using a customizable ordering based of Kind.
+// Defaults to the ordering of the GVK struct, which puts cluster-wide basic
+// resources with no dependencies (like Namespace, StorageClass, etc.) first,
+// and resources with a high number of dependencies
+// (like ValidatingWebhookConfiguration) last.
+type SortOrderTransformerPlugin struct {
+	SortOptions *types.SortOptions `json:"sortOptions,omitempty" yaml:"sortOptions,omitempty"`
+}
+
+func (p *SortOrderTransformerPlugin) Config(
+	_ *resmap.PluginHelpers, c []byte) error {
+	return errors.WrapPrefixf(yaml.Unmarshal(c, p), "Failed to unmarshal SortOrderTransformer config")
+}
+
+func (p *SortOrderTransformerPlugin) applyDefaults() {
+	// Default to FIFO sort, aka no-op.
+	if p.SortOptions == nil {
+		p.SortOptions = &types.SortOptions{
+			Order: types.FIFOSortOrder,
+		}
+	}
+
+	// If legacy sort is selected and no options are given, default to
+	// hardcoded order.
+	if p.SortOptions.Order == types.LegacySortOrder && p.SortOptions.LegacySortOptions == nil {
+		p.SortOptions.LegacySortOptions = &types.LegacySortOptions{
+			OrderFirst: defaultOrderFirst,
+			OrderLast:  defaultOrderLast,
+		}
+	}
+}
+
+func (p *SortOrderTransformerPlugin) validate() error {
+	// Check valid values for SortOrder
+	if p.SortOptions.Order != types.FIFOSortOrder && p.SortOptions.Order != types.LegacySortOrder {
+		return errors.Errorf("the field 'sortOptions.order' must be one of [%s, %s]",
+			types.FIFOSortOrder, types.LegacySortOrder)
+	}
+
+	// Validate that the only options set are the ones corresponding to the
+	// selected sort order.
+	if p.SortOptions.Order == types.FIFOSortOrder &&
+		p.SortOptions.LegacySortOptions != nil {
+		return errors.Errorf("the field 'sortOptions.legacySortOptions' is"+
+			" set but the selected sort order is '%v', not 'legacy'",
+			p.SortOptions.Order)
+	}
+	return nil
+}
+
+func (p *SortOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
+	p.applyDefaults()
+	err = p.validate()
+	if err != nil {
+		return err
+	}
+
+	// Sort
+	if p.SortOptions.Order == types.LegacySortOrder {
+		s := newLegacyIDSorter(m.AllIds(), p.SortOptions.LegacySortOptions)
+		sort.Sort(s)
+		err = applyOrdering(m, s.resids)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// applyOrdering takes resources (given in ResMap) and a desired ordering given
+// as a sequence of ResIds, and updates the ResMap's resources to match the
+// ordering.
+func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
+	var err error
+	resources := make([]*resource.Resource, m.Size())
+	// Clear and refill with the correct order
+	for i, id := range ordering {
+		resources[i], err = m.GetByCurrentId(id)
+		if err != nil {
+			return errors.WrapPrefixf(err, "expected match for sorting")
+		}
+	}
+	m.Clear()
+	for _, r := range resources {
+		err = m.Append(r)
+		if err != nil {
+			return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+		}
+	}
+	return nil
+}
+
+// Code for legacy sorting.
+// Legacy sorting is a "fixed" order sorting maintained for backwards
+// compatibility.
+
+// legacyIDSorter sorts resources based on two priority lists:
+// - orderFirst: Resources that should be placed in the start, in the given order.
+// - orderLast: Resources that should be placed in the end, in the given order.
+type legacyIDSorter struct {
+	// resids only stores the metadata of the object. This is an optimization as
+	// it's expensive to compute these again and again during ordering.
+	resids     []resid.ResId
+	typeOrders map[string]int
+}
+
+func newLegacyIDSorter(
+	resids []resid.ResId,
+	options *types.LegacySortOptions) *legacyIDSorter {
+	// Precalculate a resource ranking based on the priority lists.
+	var typeOrders = func() map[string]int {
+		m := map[string]int{}
+		for i, n := range options.OrderFirst {
+			m[n] = -len(options.OrderFirst) + i
+		}
+		for i, n := range options.OrderLast {
+			m[n] = 1 + i
+		}
+		return m
+	}()
+	return &legacyIDSorter{
+		resids:     resids,
+		typeOrders: typeOrders,
+	}
+}
+
+var _ sort.Interface = legacyIDSorter{}
+
+func (a legacyIDSorter) Len() int { return len(a.resids) }
+func (a legacyIDSorter) Swap(i, j int) {
+	a.resids[i], a.resids[j] = a.resids[j], a.resids[i]
+}
+func (a legacyIDSorter) Less(i, j int) bool {
+	if !a.resids[i].Gvk.Equals(a.resids[j].Gvk) {
+		return gvkLessThan(a.resids[i].Gvk, a.resids[j].Gvk, a.typeOrders)
+	}
+	return legacyResIDSortString(a.resids[i]) < legacyResIDSortString(a.resids[j])
+}
+
+func gvkLessThan(gvk1, gvk2 resid.Gvk, typeOrders map[string]int) bool {
+	index1 := typeOrders[gvk1.Kind]
+	index2 := typeOrders[gvk2.Kind]
+	if index1 != index2 {
+		return index1 < index2
+	}
+	return legacyGVKSortString(gvk1) < legacyGVKSortString(gvk2)
+}
+
+// legacyGVKSortString returns a string representation of given GVK used for
+// stable sorting.
+func legacyGVKSortString(x resid.Gvk) string {
+	legacyNoGroup := "~G"
+	legacyNoVersion := "~V"
+	legacyNoKind := "~K"
+	legacyFieldSeparator := "_"
+
+	g := x.Group
+	if g == "" {
+		g = legacyNoGroup
+	}
+	v := x.Version
+	if v == "" {
+		v = legacyNoVersion
+	}
+	k := x.Kind
+	if k == "" {
+		k = legacyNoKind
+	}
+	return strings.Join([]string{g, v, k}, legacyFieldSeparator)
+}
+
+// legacyResIDSortString returns a string representation of given ResID used for
+// stable sorting.
+func legacyResIDSortString(id resid.ResId) string {
+	legacyNoNamespace := "~X"
+	legacyNoName := "~N"
+	legacySeparator := "|"
+
+	ns := id.Namespace
+	if ns == "" {
+		ns = legacyNoNamespace
+	}
+	nm := id.Name
+	if nm == "" {
+		nm = legacyNoName
+	}
+	return strings.Join(
+		[]string{id.Gvk.String(), ns, nm}, legacySeparator)
+}
+
+// DO NOT CHANGE!
+// Final legacy ordering provided as a default by kustomize.
+// Originally an attempt to apply resources in the correct order, an effort
+// which later proved impossible as not all types are known beforehand.
+// See: https://github.com/kubernetes-sigs/kustomize/issues/3913
+var defaultOrderFirst = []string{ //nolint:gochecknoglobals
+	"Namespace",
+	"ResourceQuota",
+	"StorageClass",
+	"CustomResourceDefinition",
+	"ServiceAccount",
+	"PodSecurityPolicy",
+	"Role",
+	"ClusterRole",
+	"RoleBinding",
+	"ClusterRoleBinding",
+	"ConfigMap",
+	"Secret",
+	"Endpoints",
+	"Service",
+	"LimitRange",
+	"PriorityClass",
+	"PersistentVolume",
+	"PersistentVolumeClaim",
+	"Deployment",
+	"StatefulSet",
+	"CronJob",
+	"PodDisruptionBudget",
+}
+var defaultOrderLast = []string{ //nolint:gochecknoglobals
+	"MutatingWebhookConfiguration",
+	"ValidatingWebhookConfiguration",
+}
+
+func NewSortOrderTransformerPlugin() resmap.TransformerPlugin {
+	return &SortOrderTransformerPlugin{}
+}

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SuffixTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on SuffixTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ValueAddTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ValueAddTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/generators/utils.go

@@ -5,6 +5,8 @@ package generators
 
 import (
 	"fmt"
+	"path"
+	"strings"
 
 	"github.com/go-errors/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
@@ -95,3 +97,28 @@ func setImmutable(
 
 	return nil
 }
+
+// ParseFileSource parses the source given.
+//
+// Acceptable formats include:
+//  1. source-path: the basename will become the key name
+//  2. source-name=source-path: the source-name will become the key name and
+//     source-path is the path to the key file.
+//
+// Key names cannot include '='.
+func ParseFileSource(source string) (keyName, filePath string, err error) {
+	numSeparators := strings.Count(source, "=")
+	switch {
+	case numSeparators == 0:
+		return path.Base(source), source, nil
+	case numSeparators == 1 && strings.HasPrefix(source, "="):
+		return "", "", errors.Errorf("missing key name for file path %q in source %q", strings.TrimPrefix(source, "="), source)
+	case numSeparators == 1 && strings.HasSuffix(source, "="):
+		return "", "", errors.Errorf("missing file path for key name %q in source %q", strings.TrimSuffix(source, "="), source)
+	case numSeparators > 1:
+		return "", "", errors.Errorf("source %q key name or file path contains '='", source)
+	default:
+		components := strings.Split(source, "=")
+		return components[0], components[1], nil
+	}
+}

vendor/sigs.k8s.io/kustomize/api/internal/git/cloner.go

@@ -22,15 +22,11 @@ func ClonerUsingGitExec(repoSpec *RepoSpec) error {
 	if err = r.run("init"); err != nil {
 		return err
 	}
-	if err = r.run(
-		"remote", "add", "origin", repoSpec.CloneSpec()); err != nil {
-		return err
-	}
 	ref := "HEAD"
 	if repoSpec.Ref != "" {
 		ref = repoSpec.Ref
 	}
-	if err = r.run("fetch", "--depth=1", "origin", ref); err != nil {
+	if err = r.run("fetch", "--depth=1", repoSpec.CloneSpec(), ref); err != nil {
 		return err
 	}
 	if err = r.run("checkout", "FETCH_HEAD"); err != nil {

vendor/sigs.k8s.io/kustomize/api/internal/git/gitrunner.go

@@ -7,8 +7,8 @@ import (
 	"os/exec"
 	"time"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/utils"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
@@ -24,7 +24,7 @@ type gitRunner struct {
 func newCmdRunner(timeout time.Duration) (*gitRunner, error) {
 	gitProgram, err := exec.LookPath("git")
 	if err != nil {
-		return nil, errors.Wrap(err, "no 'git' program on path")
+		return nil, errors.WrapPrefixf(err, "no 'git' program on path")
 	}
 	dir, err := filesys.NewTmpConfirmedDir()
 	if err != nil {
@@ -46,9 +46,9 @@ func (r gitRunner) run(args ...string) error {
 		cmd.String(),
 		r.duration,
 		func() error {
-			_, err := cmd.CombinedOutput()
+			out, err := cmd.CombinedOutput()
 			if err != nil {
-				return errors.Wrapf(err, "git cmd = '%s'", cmd.String())
+				return errors.WrapPrefixf(err, "failed to run '%s': %s", cmd.String(), string(out))
 			}
 			return err
 		})

vendor/sigs.k8s.io/kustomize/api/internal/git/repospec.go

@@ -5,12 +5,15 @@ package git
 
 import (
 	"fmt"
+	"log"
 	"net/url"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
@@ -27,26 +30,23 @@ type RepoSpec struct {
 	// TODO(monopole): Drop raw, use processed fields instead.
 	raw string
 
-	// Host, e.g. github.com
+	// Host, e.g. https://github.com/
 	Host string
 
-	// orgRepo name (organization/repoName),
+	// RepoPath name (Path to repository),
 	// e.g. kubernetes-sigs/kustomize
-	OrgRepo string
+	RepoPath string
 
-	// Dir where the orgRepo is cloned to.
+	// Dir is where the repository is cloned to.
 	Dir filesys.ConfirmedDir
 
 	// Relative path in the repository, and in the cloneDir,
 	// to a Kustomization.
-	Path string
+	KustRootPath string
 
 	// Branch or tag reference.
 	Ref string
 
-	// e.g. .git or empty in case of _git is present
-	GitSuffix string
-
 	// Submodules indicates whether or not to clone git submodules.
 	Submodules bool
 
@@ -56,10 +56,7 @@ type RepoSpec struct {
 
 // CloneSpec returns a string suitable for "git clone {spec}".
 func (x *RepoSpec) CloneSpec() string {
-	if isAzureHost(x.Host) || isAWSHost(x.Host) {
+	return x.Host + x.RepoPath
-		return x.Host + x.OrgRepo
-	}
-	return x.Host + x.OrgRepo + x.GitSuffix
 }
 
 func (x *RepoSpec) CloneDir() filesys.ConfirmedDir {
@@ -71,81 +68,140 @@ func (x *RepoSpec) Raw() string {
 }
 
 func (x *RepoSpec) AbsPath() string {
-	return x.Dir.Join(x.Path)
+	return x.Dir.Join(x.KustRootPath)
 }
 
 func (x *RepoSpec) Cleaner(fSys filesys.FileSystem) func() error {
 	return func() error { return fSys.RemoveAll(x.Dir.String()) }
 }
 
-// NewRepoSpecFromURL parses git-like urls.
-// From strings like git@github.com:someOrg/someRepo.git or
-// https://github.com/someOrg/someRepo?ref=someHash, extract
-// the parts.
-func NewRepoSpecFromURL(n string) (*RepoSpec, error) {
-	if filepath.IsAbs(n) {
-		return nil, fmt.Errorf("uri looks like abs path: %s", n)
-	}
-	host, orgRepo, path, gitRef, gitSubmodules, suffix, gitTimeout := parseGitURL(n)
-	if orgRepo == "" {
-		return nil, fmt.Errorf("url lacks orgRepo: %s", n)
-	}
-	if host == "" {
-		return nil, fmt.Errorf("url lacks host: %s", n)
-	}
-	return &RepoSpec{
-		raw: n, Host: host, OrgRepo: orgRepo,
-		Dir: notCloned, Path: path, Ref: gitRef, GitSuffix: suffix,
-		Submodules: gitSubmodules, Timeout: gitTimeout}, nil
-}
-
 const (
 	refQuery         = "?ref="
 	gitSuffix        = ".git"
-	gitDelimiter = "_git/"
+	gitRootDelimiter = "_git/"
+	pathSeparator    = "/" // do not use filepath.Separator, as this is a URL
 )
 
+// NewRepoSpecFromURL parses git-like urls.
 // From strings like git@github.com:someOrg/someRepo.git or
 // https://github.com/someOrg/someRepo?ref=someHash, extract
-// the parts.
+// the different parts of URL, set into a RepoSpec object and return RepoSpec object.
-func parseGitURL(n string) (
+// It MUST return an error if the input is not a git-like URL, as this is used by some code paths
-	host string, orgRepo string, path string, gitRef string, gitSubmodules bool, gitSuff string, gitTimeout time.Duration) {
+// to distinguish between local and remote paths.
-	if strings.Contains(n, gitDelimiter) {
+//
-		index := strings.Index(n, gitDelimiter)
+// In particular, NewRepoSpecFromURL separates the URL used to clone the repo from the
-		// Adding _git/ to host
+// elements Kustomize uses for other purposes (e.g. query params that turn into args, and
-		host = normalizeGitHostSpec(n[:index+len(gitDelimiter)])
+// the path to the kustomization root within the repo).
-		orgRepo = strings.Split(strings.Split(n[index+len(gitDelimiter):], "/")[0], "?")[0]
+func NewRepoSpecFromURL(n string) (*RepoSpec, error) {
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n[index+len(gitDelimiter)+len(orgRepo):])
+	repoSpec := &RepoSpec{raw: n, Dir: notCloned, Timeout: defaultTimeout, Submodules: defaultSubmodules}
-		return
+	if filepath.IsAbs(n) {
-	}
+		return nil, fmt.Errorf("uri looks like abs path: %s", n)
-	host, n = parseHostSpec(n)
-	gitSuff = gitSuffix
-	if strings.Contains(n, gitSuffix) {
-		index := strings.Index(n, gitSuffix)
-		orgRepo = n[0:index]
-		n = n[index+len(gitSuffix):]
-		if len(n) > 0 && n[0] == '/' {
-			n = n[1:]
-		}
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
-		return
 	}
 
-	i := strings.Index(n, "/")
+	// Parse the query first. This is safe because according to rfc3986 "?" is only allowed in the
-	if i < 1 {
+	// query and is not recognized %-encoded.
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
+	// Note that parseQuery returns default values for empty parameters.
-		return
+	n, query, _ := strings.Cut(n, "?")
+	repoSpec.Ref, repoSpec.Timeout, repoSpec.Submodules = parseQuery(query)
+
+	var err error
+
+	// Parse the host (e.g. scheme, username, domain) segment.
+	repoSpec.Host, n, err = extractHost(n)
+	if err != nil {
+		return nil, err
 	}
-	j := strings.Index(n[i+1:], "/")
+
-	if j >= 0 {
+	// In some cases, we're given a path to a git repo + a path to the kustomization root within
-		j += i + 1
+	// that repo. We need to split them so that we can ultimately give the repo only to the cloner.
-		orgRepo = n[:j]
+	repoSpec.RepoPath, repoSpec.KustRootPath, err = parsePathParts(n, defaultRepoPathLength(repoSpec.Host))
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n[j+1:])
+	if err != nil {
-		return
+		return nil, err
 	}
-	path = ""
+
-	orgRepo, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
+	return repoSpec, nil
-	return host, orgRepo, path, gitRef, gitSubmodules, gitSuff, gitTimeout
+}
+
+const allSegments = -999999
+const orgRepoSegments = 2
+
+func defaultRepoPathLength(host string) int {
+	if strings.HasPrefix(host, fileScheme) {
+		return allSegments
+	}
+	return orgRepoSegments
+}
+
+// parsePathParts splits the repo path that will ultimately be passed to git to clone the
+// repo from the kustomization root path, which Kustomize will execute the build in after the repo
+// is cloned.
+//
+// We first try to do this based on explicit markers in the URL (e.g. _git, .git or //).
+// If none are present, we try to apply a historical default repo path length that is derived from
+// Github URLs. If there aren't enough segments, we have historically considered the URL invalid.
+func parsePathParts(n string, defaultSegmentLength int) (string, string, error) {
+	repoPath, kustRootPath, success := tryExplicitMarkerSplit(n)
+	if !success {
+		repoPath, kustRootPath, success = tryDefaultLengthSplit(n, defaultSegmentLength)
+	}
+
+	// Validate the result
+	if !success || len(repoPath) == 0 {
+		return "", "", fmt.Errorf("failed to parse repo path segment")
+	}
+	if kustRootPathExitsRepo(kustRootPath) {
+		return "", "", fmt.Errorf("url path exits repo: %s", n)
+	}
+
+	return repoPath, strings.TrimPrefix(kustRootPath, pathSeparator), nil
+}
+
+func tryExplicitMarkerSplit(n string) (string, string, bool) {
+	// Look for the _git delimiter, which by convention is expected to be ONE directory above the repo root.
+	// If found, split on the NEXT path element, which is the repo root.
+	// Example: https://username@dev.azure.com/org/project/_git/repo/path/to/kustomization/root
+	if gitRootIdx := strings.Index(n, gitRootDelimiter); gitRootIdx >= 0 {
+		gitRootPath := n[:gitRootIdx+len(gitRootDelimiter)]
+		subpathSegments := strings.Split(n[gitRootIdx+len(gitRootDelimiter):], pathSeparator)
+		return gitRootPath + subpathSegments[0], strings.Join(subpathSegments[1:], pathSeparator), true
+
+		// Look for a double-slash in the path, which if present separates the repo root from the kust path.
+		// It is a convention, not a real path element, so do not preserve it in the returned value.
+		// Example: https://github.com/org/repo//path/to/kustomozation/root
+	} else if repoRootIdx := strings.Index(n, "//"); repoRootIdx >= 0 {
+		return n[:repoRootIdx], n[repoRootIdx+2:], true
+
+		// Look for .git in the path, which if present is part of the directory name of the git repo.
+		// This means we want to grab everything up to and including that suffix
+		// Example: https://github.com/org/repo.git/path/to/kustomozation/root
+	} else if gitSuffixIdx := strings.Index(n, gitSuffix); gitSuffixIdx >= 0 {
+		upToGitSuffix := n[:gitSuffixIdx+len(gitSuffix)]
+		afterGitSuffix := n[gitSuffixIdx+len(gitSuffix):]
+		return upToGitSuffix, afterGitSuffix, true
+	}
+	return "", "", false
+}
+
+func tryDefaultLengthSplit(n string, defaultSegmentLength int) (string, string, bool) {
+	// If the default is to take all segments, do so.
+	if defaultSegmentLength == allSegments {
+		return n, "", true
+
+		// If the default is N segments, make sure we have at least that many and take them if so.
+		// If we have less than N, we have historically considered the URL invalid.
+	} else if segments := strings.Split(n, pathSeparator); len(segments) >= defaultSegmentLength {
+		firstNSegments := strings.Join(segments[:defaultSegmentLength], pathSeparator)
+		rest := strings.Join(segments[defaultSegmentLength:], pathSeparator)
+		return firstNSegments, rest, true
+	}
+	return "", "", false
+}
+
+func kustRootPathExitsRepo(kustRootPath string) bool {
+	cleanedPath := filepath.Clean(strings.TrimPrefix(kustRootPath, string(filepath.Separator)))
+	pathElements := strings.Split(cleanedPath, string(filepath.Separator))
+	return len(pathElements) > 0 &&
+		pathElements[0] == filesys.ParentDir
 }
 
 // Clone git submodules by default.
@@ -154,14 +210,12 @@ const defaultSubmodules = true
 // Arbitrary, but non-infinite, timeout for running commands.
 const defaultTimeout = 27 * time.Second
 
-func peelQuery(arg string) (string, string, time.Duration, bool) {
+func parseQuery(query string) (string, time.Duration, bool) {
-	// Parse the given arg into a URL. In the event of a parse failure, return
+	values, err := url.ParseQuery(query)
-	// our defaults.
+	// in event of parse failure, return defaults
-	parsed, err := url.Parse(arg)
 	if err != nil {
-		return arg, "", defaultTimeout, defaultSubmodules
+		return "", defaultTimeout, defaultSubmodules
 	}
-	values := parsed.Query()
 
 	// ref is the desired git ref to target. Can be specified by in a git URL
 	// with ?ref=<string> or ?version=<string>, although ref takes precedence.
@@ -192,76 +246,142 @@ func peelQuery(arg string) (string, string, time.Duration, bool) {
 		}
 	}
 
-	return parsed.Path, ref, duration, submodules
+	return ref, duration, submodules
 }
 
-func parseHostSpec(n string) (string, string) {
+func extractHost(n string) (string, string, error) {
-	var host string
+	n = ignoreForcedGitProtocol(n)
-	// Start accumulating the host part.
+	scheme, n := extractScheme(n)
-	for _, p := range []string{
+	username, n := extractUsername(n)
-		// Order matters here.
+	stdGithub := isStandardGithubHost(n)
-		"git::", "gh:", "ssh://", "https://", "http://",
+	acceptSCP := acceptSCPStyle(scheme, username, stdGithub)
-		"git@", "github.com:", "github.com/"} {
+
-		if len(p) < len(n) && strings.ToLower(n[:len(p)]) == p {
+	// Validate the username and scheme before attempting host/path parsing, because if the parsing
-			n = n[len(p):]
+	// so far has not succeeded, we will not be able to extract the host and path correctly.
-			host += p
+	if err := validateScheme(scheme, acceptSCP); err != nil {
-		}
+		return "", "", err
-	}
-	if host == "git@" {
-		i := strings.Index(n, "/")
-		if i > -1 {
-			host += n[:i+1]
-			n = n[i+1:]
-		} else {
-			i = strings.Index(n, ":")
-			if i > -1 {
-				host += n[:i+1]
-				n = n[i+1:]
-			}
-		}
-		return host, n
 	}
 
-	// If host is a http(s) or ssh URL, grab the domain part.
+	// Now that we have extracted a valid scheme+username, we can parse host itself.
-	for _, p := range []string{
+
-		"ssh://", "https://", "http://"} {
+	// The file protocol specifies an absolute path to a local git repo.
-		if strings.HasSuffix(host, p) {
+	// Everything after the scheme (including any 'username' we found) is actually part of that path.
-			i := strings.Index(n, "/")
+	if scheme == fileScheme {
-			if i > -1 {
+		return scheme, username + n, nil
-				host += n[0 : i+1]
-				n = n[i+1:]
-			}
-			break
 	}
+	var host, rest = n, ""
+	if sepIndex := findPathSeparator(n, acceptSCP); sepIndex >= 0 {
+		host, rest = n[:sepIndex+1], n[sepIndex+1:]
 	}
 
-	return normalizeGitHostSpec(host), n
+	// Github URLs are strictly normalized in a way that may discard scheme and username components.
+	if stdGithub {
+		scheme, username, host = normalizeGithubHostParts(scheme, username)
 	}
 
-func normalizeGitHostSpec(host string) string {
+	// Host is required, so do not concat the scheme and username if we didn't find one.
-	s := strings.ToLower(host)
+	if host == "" {
-	if strings.Contains(s, "github.com") {
+		return "", "", errors.Errorf("failed to parse host segment")
-		if strings.Contains(s, "git@") || strings.Contains(s, "ssh:") {
-			host = "git@github.com:"
-		} else {
-			host = "https://github.com/"
 	}
-	}
+	return scheme + username + host, rest, nil
-	if strings.HasPrefix(s, "git::") {
-		host = strings.TrimPrefix(s, "git::")
-	}
-	return host
 }
 
-// The format of Azure repo URL is documented
+// ignoreForcedGitProtocol strips the "git::" prefix from URLs.
-// https://docs.microsoft.com/en-us/azure/devops/repos/git/clone?view=vsts&tabs=visual-studio#clone_url
+// We used to use go-getter to handle our urls: https://github.com/hashicorp/go-getter.
-func isAzureHost(host string) bool {
+// The git:: prefix signaled go-getter to use the git protocol to fetch the url's contents.
-	return strings.Contains(host, "dev.azure.com") ||
+// We silently strip this prefix to allow these go-getter-style urls to continue to work,
-		strings.Contains(host, "visualstudio.com")
+// although the git protocol (which is insecure and unsupported on many platforms, including Github)
+// will not actually be used as intended.
+func ignoreForcedGitProtocol(n string) string {
+	n, found := trimPrefixIgnoreCase(n, "git::")
+	if found {
+		log.Println("Warning: Forcing the git protocol using the 'git::' URL prefix is not supported. " +
+			"Kustomize currently strips this invalid prefix, but will stop doing so in a future release. " +
+			"Please remove the 'git::' prefix from your configuration.")
+	}
+	return n
 }
 
-// The format of AWS repo URL is documented
+// acceptSCPStyle returns true if the scheme and username indicate potential use of an SCP-style URL.
-// https://docs.aws.amazon.com/codecommit/latest/userguide/regions.html
+// With this style, the scheme is not explicit and the path is delimited by a colon.
-func isAWSHost(host string) bool {
+// Strictly speaking the username is optional in SCP-like syntax, but Kustomize has always
-	return strings.Contains(host, "amazonaws.com")
+// required it for non-Github URLs.
+// Example: user@host.xz:path/to/repo.git/
+func acceptSCPStyle(scheme, username string, isGithubURL bool) bool {
+	return scheme == "" && (username != "" || isGithubURL)
+}
+
+func validateScheme(scheme string, acceptSCPStyle bool) error {
+	// see https://git-scm.com/docs/git-fetch#_git_urls for info relevant to these validations
+	switch scheme {
+	case "":
+		// Empty scheme is only ok if it's a Github URL or if it looks like SCP-style syntax
+		if !acceptSCPStyle {
+			return fmt.Errorf("failed to parse scheme")
+		}
+	case sshScheme, fileScheme, httpsScheme, httpScheme:
+		// These are all supported schemes
+	default:
+		// At time of writing, we should never end up here because we do not parse out
+		// unsupported schemes to begin with.
+		return fmt.Errorf("unsupported scheme %q", scheme)
+	}
+	return nil
+}
+
+const fileScheme = "file://"
+const httpScheme = "http://"
+const httpsScheme = "https://"
+const sshScheme = "ssh://"
+
+func extractScheme(s string) (string, string) {
+	for _, prefix := range []string{sshScheme, httpsScheme, httpScheme, fileScheme} {
+		if rest, found := trimPrefixIgnoreCase(s, prefix); found {
+			return prefix, rest
+		}
+	}
+	return "", s
+}
+
+func extractUsername(s string) (string, string) {
+	var userRegexp = regexp.MustCompile(`^([a-zA-Z][a-zA-Z0-9-]*)@`)
+	if m := userRegexp.FindStringSubmatch(s); m != nil {
+		username := m[1] + "@"
+		return username, s[len(username):]
+	}
+	return "", s
+}
+
+func isStandardGithubHost(s string) bool {
+	lowerCased := strings.ToLower(s)
+	return strings.HasPrefix(lowerCased, "github.com/") ||
+		strings.HasPrefix(lowerCased, "github.com:")
+}
+
+// trimPrefixIgnoreCase returns the rest of s and true if prefix, ignoring case, prefixes s.
+// Otherwise, trimPrefixIgnoreCase returns s and false.
+func trimPrefixIgnoreCase(s, prefix string) (string, bool) {
+	if len(prefix) <= len(s) && strings.ToLower(s[:len(prefix)]) == prefix {
+		return s[len(prefix):], true
+	}
+	return s, false
+}
+
+func findPathSeparator(hostPath string, acceptSCP bool) int {
+	sepIndex := strings.Index(hostPath, pathSeparator)
+	if acceptSCP {
+		colonIndex := strings.Index(hostPath, ":")
+		// The colon acts as a delimiter in scp-style ssh URLs only if not prefixed by '/'.
+		if sepIndex == -1 || (colonIndex > 0 && colonIndex < sepIndex) {
+			sepIndex = colonIndex
+		}
+	}
+	return sepIndex
+}
+
+func normalizeGithubHostParts(scheme, username string) (string, string, string) {
+	if strings.HasPrefix(scheme, sshScheme) || username != "" {
+		return "", username, "github.com:"
+	}
+	return httpsScheme, "", "github.com/"
 }

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/namebackreferences.go

@@ -22,7 +22,7 @@ import (
 // contains a Pod; Deployment, Job, StatefulSet, etc.
 // The ConfigMap is the ReferralTarget, the others are Referrers.
 //
-// If the the name of a ConfigMap instance changed from 'alice' to 'bob',
+// If the name of a ConfigMap instance changed from 'alice' to 'bob',
 // one must
 //  - visit all objects that could refer to the ConfigMap (the Referrers)
 //  - see if they mention 'alice',

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/transformerconfig.go

@@ -10,6 +10,7 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 // TransformerConfig holds the data needed to perform transformations.
@@ -18,6 +19,7 @@ type TransformerConfig struct {
 	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
 	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
 	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
 	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
@@ -58,8 +60,10 @@ func MakeTransformerConfig(
 // sortFields provides determinism in logging, tests, etc.
 func (t *TransformerConfig) sortFields() {
 	sort.Sort(t.NamePrefix)
+	sort.Sort(t.NameSuffix)
 	sort.Sort(t.NameSpace)
 	sort.Sort(t.CommonLabels)
+	sort.Sort(t.TemplateLabels)
 	sort.Sort(t.CommonAnnotations)
 	sort.Sort(t.NameReference)
 	sort.Sort(t.VarReference)
@@ -108,40 +112,44 @@ func (t *TransformerConfig) Merge(input *TransformerConfig) (
 	merged = &TransformerConfig{}
 	merged.NamePrefix, err = t.NamePrefix.MergeAll(input.NamePrefix)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NamePrefix fieldSpec")
 	}
 	merged.NameSuffix, err = t.NameSuffix.MergeAll(input.NameSuffix)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSuffix fieldSpec")
 	}
 	merged.NameSpace, err = t.NameSpace.MergeAll(input.NameSpace)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSpace fieldSpec")
 	}
 	merged.CommonAnnotations, err = t.CommonAnnotations.MergeAll(
 		input.CommonAnnotations)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonAnnotations fieldSpec")
 	}
 	merged.CommonLabels, err = t.CommonLabels.MergeAll(input.CommonLabels)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonLabels fieldSpec")
+	}
+	merged.TemplateLabels, err = t.TemplateLabels.MergeAll(input.TemplateLabels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")
 	}
 	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge VarReference fieldSpec")
 	}
 	merged.NameReference, err = t.NameReference.mergeAll(input.NameReference)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameReference fieldSpec")
 	}
 	merged.Images, err = t.Images.MergeAll(input.Images)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge Images fieldSpec")
 	}
 	merged.Replicas, err = t.Replicas.MergeAll(input.Replicas)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge Replicas fieldSpec")
 	}
 	merged.sortFields()
 	return merged, nil

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtinplugintype_string.go

@@ -15,24 +15,23 @@ func _() {
 	_ = x[HashTransformer-4]
 	_ = x[ImageTagTransformer-5]
 	_ = x[LabelTransformer-6]
-	_ = x[LegacyOrderTransformer-7]
+	_ = x[NamespaceTransformer-7]
-	_ = x[NamespaceTransformer-8]
+	_ = x[PatchJson6902Transformer-8]
-	_ = x[PatchJson6902Transformer-9]
+	_ = x[PatchStrategicMergeTransformer-9]
-	_ = x[PatchStrategicMergeTransformer-10]
+	_ = x[PatchTransformer-10]
-	_ = x[PatchTransformer-11]
+	_ = x[PrefixSuffixTransformer-11]
-	_ = x[PrefixSuffixTransformer-12]
+	_ = x[PrefixTransformer-12]
-	_ = x[PrefixTransformer-13]
+	_ = x[SuffixTransformer-13]
-	_ = x[SuffixTransformer-14]
+	_ = x[ReplicaCountTransformer-14]
-	_ = x[ReplicaCountTransformer-15]
+	_ = x[SecretGenerator-15]
-	_ = x[SecretGenerator-16]
+	_ = x[ValueAddTransformer-16]
-	_ = x[ValueAddTransformer-17]
+	_ = x[HelmChartInflationGenerator-17]
-	_ = x[HelmChartInflationGenerator-18]
+	_ = x[ReplacementTransformer-18]
-	_ = x[ReplacementTransformer-19]
 }
 
-const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
 
-var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 137, 157, 181, 211, 227, 250, 267, 284, 307, 322, 341, 368, 390}
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 135, 159, 189, 205, 228, 245, 262, 285, 300, 319, 346, 368}
 
 func (i BuiltinPluginType) String() string {
 	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtins.go

@@ -19,7 +19,6 @@ const (
 	HashTransformer
 	ImageTagTransformer
 	LabelTransformer
-	LegacyOrderTransformer
 	NamespaceTransformer
 	PatchJson6902Transformer
 	PatchStrategicMergeTransformer
@@ -100,7 +99,6 @@ var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin
 	HashTransformer:                builtins.NewHashTransformerPlugin,
 	ImageTagTransformer:            builtins.NewImageTagTransformerPlugin,
 	LabelTransformer:               builtins.NewLabelTransformerPlugin,
-	LegacyOrderTransformer:         builtins.NewLegacyOrderTransformerPlugin,
 	NamespaceTransformer:           builtins.NewNamespaceTransformerPlugin,
 	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
 	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
@@ -111,4 +109,7 @@ var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin
 	ReplacementTransformer:         builtins.NewReplacementTransformerPlugin,
 	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
 	ValueAddTransformer:            builtins.NewValueAddTransformerPlugin,
+	// Do not wired SortOrderTransformer as a builtin plugin.
+	// We only want it to be available in the top-level kustomization.
+	// See: https://github.com/kubernetes-sigs/kustomize/issues/3913
 }

vendor/sigs.k8s.io/kustomize/api/internal/plugins/execplugin/execplugin.go

@@ -6,7 +6,6 @@ package execplugin
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"runtime"
@@ -14,9 +13,9 @@ import (
 
 	"github.com/google/shlex"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/yaml"
 )
 
@@ -150,19 +149,19 @@ func (p *ExecPlugin) Transform(rm resmap.ResMap) error {
 // passes the full temp file path as the first arg to a process
 // running the plugin binary.  Process output is returned.
 func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
-	f, err := ioutil.TempFile("", tmpConfigFilePrefix)
+	f, err := os.CreateTemp("", tmpConfigFilePrefix)
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "creating tmp plugin config file")
 	}
 	_, err = f.Write(p.cfg)
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "writing plugin config to "+f.Name())
 	}
 	err = f.Close()
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "closing plugin config file "+f.Name())
 	}
 	//nolint:gosec
@@ -176,7 +175,7 @@ func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
 	}
 	result, err := cmd.Output()
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "failure in plugin configured via %s; %v",
 			f.Name(), err.Error())
 	}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/fnplugin/fnplugin.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"fmt"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -51,13 +51,16 @@ func resourceToRNode(res *resource.Resource) (*yaml.RNode, error) {
 }
 
 // GetFunctionSpec return function spec is there is. Otherwise return nil
-func GetFunctionSpec(res *resource.Resource) *runtimeutil.FunctionSpec {
+func GetFunctionSpec(res *resource.Resource) (*runtimeutil.FunctionSpec, error) {
 	rnode, err := resourceToRNode(res)
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("could not convert resource to RNode: %w", err)
 	}
-
+	functionSpec, err := runtimeutil.GetFunctionSpec(rnode)
-	return runtimeutil.GetFunctionSpec(rnode)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get FunctionSpec: %w", err)
+	}
+	return functionSpec, nil
 }
 
 func toStorageMounts(mounts []string) []runtimeutil.StorageMount {
@@ -191,7 +194,7 @@ func (p *FnPlugin) invokePlugin(input []byte) ([]byte, error) {
 
 	err = p.runFns.Execute()
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "couldn't execute function")
 	}
 

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/loader.go

@@ -12,7 +12,6 @@ import (
 	"reflect"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
@@ -22,6 +21,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 )
@@ -42,27 +42,35 @@ func NewLoader(
 	return &Loader{pc: pc, rf: rf, fs: fs}
 }
 
+// LoaderWithWorkingDir returns loader after setting its working directory.
+// NOTE: This is not really a new loader since some of the Loader struct fields are pointers.
+func (l *Loader) LoaderWithWorkingDir(wd string) *Loader {
+	lpc := &types.PluginConfig{
+		PluginRestrictions: l.pc.PluginRestrictions,
+		BpLoadingOptions:   l.pc.BpLoadingOptions,
+		FnpLoadingOptions:  l.pc.FnpLoadingOptions,
+		HelmConfig:         l.pc.HelmConfig,
+	}
+	lpc.FnpLoadingOptions.WorkingDir = wd
+	return &Loader{pc: lpc, rf: l.rf, fs: l.fs}
+}
+
 // Config provides the global (not plugin specific) PluginConfig data.
 func (l *Loader) Config() *types.PluginConfig {
 	return l.pc
 }
 
-// SetWorkDir sets the working directory for this loader's plugins
-func (l *Loader) SetWorkDir(wd string) {
-	l.pc.FnpLoadingOptions.WorkingDir = wd
-}
-
 func (l *Loader) LoadGenerators(
 	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
 	result []*resmap.GeneratorWithProperties, err error) {
 	for _, res := range rm.Resources() {
 		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to load generator: %w", err)
 		}
 		generatorOrigin, err := resource.OriginFromCustomPlugin(res)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to get origin from CustomPlugin: %w", err)
 		}
 		result = append(result, &resmap.GeneratorWithProperties{Generator: g, Origin: generatorOrigin})
 	}
@@ -130,15 +138,19 @@ func (l *Loader) AbsolutePluginPath(id resid.ResId) (string, error) {
 // absPluginHome is the home of kustomize Exec and Go plugins.
 // Kustomize plugin configuration files are k8s-style objects
 // containing the fields 'apiVersion' and 'kind', e.g.
+//
 //	apiVersion: apps/v1
 //	kind: Deployment
+//
 // kustomize reads plugin configuration data from a file path
 // specified in the 'generators:' or 'transformers:' field of a
 // kustomization file.  For Exec and Go plugins, kustomize
 // uses this data to both locate the plugin and configure it.
 // Each Exec or Go plugin (its code, its tests, its supporting data
 // files, etc.) must be housed in its own directory at
+//
 //	${absPluginHome}/${pluginApiVersion}/LOWERCASE(${pluginKind})
+//
 // where
 //   - ${absPluginHome} is an absolute path, defined below.
 //   - ${pluginApiVersion} is taken from the plugin config file.
@@ -204,11 +216,11 @@ func (l *Loader) loadAndConfigurePlugin(
 	}
 	yaml, err := res.AsYAML()
 	if err != nil {
-		return nil, errors.Wrapf(err, "marshalling yaml from res %s", res.OrgId())
+		return nil, errors.WrapPrefixf(err, "marshalling yaml from res %s", res.OrgId())
 	}
 	err = c.Config(resmap.NewPluginHelpers(ldr, v, l.rf, l.pc), yaml)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "plugin %s fails configuration", res.OrgId())
 	}
 	return c, nil
@@ -226,17 +238,20 @@ func (l *Loader) makeBuiltinPlugin(r resid.Gvk) (resmap.Configurable, error) {
 }
 
 func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error) {
-	spec := fnplugin.GetFunctionSpec(res)
+	spec, err := fnplugin.GetFunctionSpec(res)
+	if err != nil {
+		return nil, fmt.Errorf("loader: %w", err)
+	}
 	if spec != nil {
 		// validation check that function mounts are under the current kustomization directory
 		for _, mount := range spec.Container.StorageMounts {
 			if filepath.IsAbs(mount.Src) {
-				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
-					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src))
+					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src)
 			}
 			if strings.HasPrefix(filepath.Clean(mount.Src), "../") {
-				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
-					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src))
+					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src)
 			}
 		}
 		return fnplugin.NewFnPlugin(&l.pc.FnpLoadingOptions), nil
@@ -292,11 +307,11 @@ func (l *Loader) loadGoPlugin(id resid.ResId, absPath string) (resmap.Configurab
 	log.Printf("Attempting plugin load from '%s'", absPath)
 	p, err := plugin.Open(absPath)
 	if err != nil {
-		return nil, errors.Wrapf(err, "plugin %s fails to load", absPath)
+		return nil, errors.WrapPrefixf(err, "plugin %s fails to load", absPath)
 	}
 	symbol, err := p.Lookup(konfig.PluginSymbol)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "plugin %s doesn't have symbol %s",
 			regId, konfig.PluginSymbol)
 	}

vendor/sigs.k8s.io/kustomize/api/internal/target/errmissingkustomization.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errMissingKustomization struct {
@@ -23,12 +23,8 @@ func (e *errMissingKustomization) Error() string {
 }
 
 func IsMissingKustomizationFileError(err error) bool {
-	_, ok := err.(*errMissingKustomization)
+	e := &errMissingKustomization{}
-	if ok {
+	return errors.As(err, &e)
-		return true
-	}
-	_, ok = errors.Cause(err).(*errMissingKustomization)
-	return ok
 }
 
 func NewErrMissingKustomization(p string) *errMissingKustomization {

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget.go

@@ -6,10 +6,9 @@ package target
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/builtins"
@@ -23,6 +22,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/yaml"
 )
@@ -44,32 +44,35 @@ func NewKustTarget(
 	validator ifc.Validator,
 	rFactory *resmap.Factory,
 	pLdr *loader.Loader) *KustTarget {
-	pLdrCopy := *pLdr
-	pLdrCopy.SetWorkDir(ldr.Root())
 	return &KustTarget{
 		ldr:       ldr,
 		validator: validator,
 		rFactory:  rFactory,
-		pLdr:      &pLdrCopy,
+		pLdr:      pLdr.LoaderWithWorkingDir(ldr.Root()),
 	}
 }
 
 // Load attempts to load the target's kustomization file.
 func (kt *KustTarget) Load() error {
-	content, kustFileName, err := loadKustFile(kt.ldr)
+	content, kustFileName, err := LoadKustFile(kt.ldr)
-	if err != nil {
-		return err
-	}
-	content, err = types.FixKustomizationPreUnmarshalling(content)
 	if err != nil {
 		return err
 	}
+
 	var k types.Kustomization
-	err = k.Unmarshal(content)
+	if err := k.Unmarshal(content); err != nil {
-	if err != nil {
 		return err
 	}
-	k.FixKustomizationPostUnmarshalling()
+
+	// show warning message when using deprecated fields.
+	if warningMessages := k.CheckDeprecatedFields(); warningMessages != nil {
+		for _, msg := range *warningMessages {
+			fmt.Fprintf(os.Stderr, "%v\n", msg)
+		}
+	}
+
+	k.FixKustomization()
+
 	errs := k.EnforceFields()
 	if len(errs) > 0 {
 		return fmt.Errorf(
@@ -89,7 +92,7 @@ func (kt *KustTarget) Kustomization() types.Kustomization {
 	return result
 }
 
-func loadKustFile(ldr ifc.Loader) ([]byte, string, error) {
+func LoadKustFile(ldr ifc.Loader) ([]byte, string, error) {
 	var content []byte
 	match := 0
 	var kustFileName string
@@ -150,6 +153,11 @@ func (kt *KustTarget) makeCustomizedResMap() (resmap.ResMap, error) {
 		return nil, err
 	}
 
+	err = kt.IgnoreLocal(ra)
+	if err != nil {
+		return nil, err
+	}
+
 	return ra.ResMap(), nil
 }
 
@@ -187,11 +195,11 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	resRa *accumulator.ResAccumulator, err error) {
 	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources)
 	if err != nil {
-		return nil, errors.Wrap(err, "accumulating resources")
+		return nil, errors.WrapPrefixf(err, "accumulating resources")
 	}
 	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components)
 	if err != nil {
-		return nil, errors.Wrap(err, "accumulating components")
+		return nil, errors.WrapPrefixf(err, "accumulating components")
 	}
 	tConfig, err := builtinconfig.MakeTransformerConfig(
 		kt.ldr, kt.kustomization.Configurations)
@@ -200,17 +208,17 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	}
 	err = ra.MergeConfig(tConfig)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging config %v", tConfig)
 	}
 	crdTc, err := accumulator.LoadConfigFromCRDs(kt.ldr, kt.kustomization.Crds)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "loading CRDs %v", kt.kustomization.Crds)
 	}
 	err = ra.MergeConfig(crdTc)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging CRDs %v", crdTc)
 	}
 	err = kt.runGenerators(ra)
@@ -227,13 +235,9 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	}
 	err = ra.MergeVars(kt.kustomization.Vars)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging vars %v", kt.kustomization.Vars)
 	}
-	err = kt.IgnoreLocal(ra)
-	if err != nil {
-		return nil, err
-	}
 	return ra, nil
 }
 
@@ -261,7 +265,7 @@ func (kt *KustTarget) runGenerators(
 
 	gs, err = kt.configureExternalGenerators()
 	if err != nil {
-		return errors.Wrap(err, "loading generator plugins")
+		return errors.WrapPrefixf(err, "loading generator plugins")
 	}
 	generators = append(generators, gs...)
 	for i, g := range generators {
@@ -272,12 +276,12 @@ func (kt *KustTarget) runGenerators(
 		if resMap != nil {
 			err = resMap.AddOriginAnnotation(generators[i].Origin)
 			if err != nil {
-				return errors.Wrapf(err, "adding origin annotations for generator %v", g)
+				return errors.WrapPrefixf(err, "adding origin annotations for generator %v", g)
 			}
 		}
 		err = ra.AbsorbAll(resMap)
 		if err != nil {
-			return errors.Wrapf(err, "merging from generator %v", g)
+			return errors.WrapPrefixf(err, "merging from generator %v", g)
 		}
 	}
 	return nil
@@ -304,7 +308,7 @@ func (kt *KustTarget) configureExternalGenerators() (
 			}
 		}
 		if err = ra.AppendAll(rm); err != nil {
-			return nil, errors.Wrapf(err, "configuring external generator")
+			return nil, errors.WrapPrefixf(err, "configuring external generator")
 		}
 	}
 	ra, err := kt.accumulateResources(ra, generatorPaths)
@@ -351,7 +355,7 @@ func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]*r
 		}
 
 		if err = ra.AppendAll(rm); err != nil {
-			return nil, errors.Wrapf(err, "configuring external transformer")
+			return nil, errors.WrapPrefixf(err, "configuring external transformer")
 		}
 	}
 	ra, err := kt.accumulateResources(ra, transformerPaths)
@@ -415,7 +419,7 @@ func (kt *KustTarget) accumulateResources(
 				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
 					return nil, errF
 				}
-				return nil, errors.Wrapf(
+				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
 			// store the origin, we'll need it later
@@ -432,7 +436,7 @@ func (kt *KustTarget) accumulateResources(
 				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
 					return nil, errF
 				}
-				return nil, errors.Wrapf(
+				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
 		}
@@ -474,7 +478,7 @@ func (kt *KustTarget) accumulateDirectory(
 	subKt := NewKustTarget(ldr, kt.validator, kt.rFactory, kt.pLdr)
 	err := subKt.Load()
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
@@ -509,12 +513,12 @@ func (kt *KustTarget) accumulateDirectory(
 		subRa, err = subKt.AccumulateTarget()
 	}
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "recursed accumulation of path '%s'", ldr.Root())
 	}
 	err = ra.MergeAccumulator(subRa)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "recursed merging from path '%s'", ldr.Root())
 	}
 	return ra, nil
@@ -524,21 +528,21 @@ func (kt *KustTarget) accumulateFile(
 	ra *accumulator.ResAccumulator, path string) error {
 	resources, err := kt.rFactory.FromFile(kt.ldr, path)
 	if err != nil {
-		return errors.Wrapf(err, "accumulating resources from '%s'", path)
+		return errors.WrapPrefixf(err, "accumulating resources from '%s'", path)
 	}
 	if kt.origin != nil {
 		originAnno, err := kt.origin.Append(path).String()
 		if err != nil {
-			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+			return errors.WrapPrefixf(err, "cannot add path annotation for '%s'", path)
 		}
 		err = resources.AnnotateAll(utils.OriginAnnotationKey, originAnno)
 		if err != nil || originAnno == "" {
-			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+			return errors.WrapPrefixf(err, "cannot add path annotation for '%s'", path)
 		}
 	}
 	err = ra.AppendAll(resources)
 	if err != nil {
-		return errors.Wrapf(err, "merging resources from '%s'", path)
+		return errors.WrapPrefixf(err, "merging resources from '%s'", path)
 	}
 	return nil
 }
@@ -549,7 +553,7 @@ func (kt *KustTarget) configureBuiltinPlugin(
 	if c != nil {
 		y, err = yaml.Marshal(c)
 		if err != nil {
-			return errors.Wrapf(
+			return errors.WrapPrefixf(
 				err, "builtin %s marshal", bpt)
 		}
 	}
@@ -558,7 +562,7 @@ func (kt *KustTarget) configureBuiltinPlugin(
 			kt.ldr, kt.validator, kt.rFactory, kt.pLdr.Config()),
 		y)
 	if err != nil {
-		return errors.Wrapf(
+		return errors.WrapPrefixf(
 			err, "trouble configuring builtin %s with config: `\n%s`", bpt, string(y))
 	}
 	return nil

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget_configplugin.go

@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"path/filepath"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -286,11 +286,11 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			if label.IncludeSelectors {
 				fss, err = fss.MergeAll(tc.CommonLabels)
 			} else {
-				// merge spec/template/metadata fieldSpec if includeTemplate flag is true
+				// merge spec/template/metadata fieldSpecs if includeTemplate flag is true
 				if label.IncludeTemplates {
-					fss, err = fss.MergeOne(types.FieldSpec{Path: "spec/template/metadata/labels", CreateIfNotPresent: false})
+					fss, err = fss.MergeAll(tc.TemplateLabels)
 					if err != nil {
-						return nil, errors.Wrap(err, "failed to merge template fieldSpec")
+						return nil, errors.WrapPrefixf(err, "failed to merge template fieldSpec")
 					}
 				}
 				// only add to metadata by default

vendor/sigs.k8s.io/kustomize/api/internal/utils/errtimeout.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errTimeOut struct {
@@ -24,13 +24,6 @@ func (e errTimeOut) Error() string {
 }
 
 func IsErrTimeout(err error) bool {
-	if err == nil {
+	e := &errTimeOut{}
-		return false
+	return errors.As(err, &e)
-	}
-	_, ok := err.(errTimeOut)
-	if ok {
-		return true
-	}
-	_, ok = errors.Cause(err).(errTimeOut)
-	return ok
 }

vendor/sigs.k8s.io/kustomize/api/internal/utils/makeResIds.go

@@ -35,7 +35,10 @@ func PrevIds(n *yaml.RNode) ([]resid.ResId, error) {
 	var ids []resid.ResId
 	// TODO: merge previous names and namespaces into one list of
 	//     pairs on one annotation so there is no chance of error
-	annotations := n.GetAnnotations()
+	annotations := n.GetAnnotations(
+		BuildAnnotationPreviousNames,
+		BuildAnnotationPreviousNamespaces,
+		BuildAnnotationPreviousKinds)
 	if _, ok := annotations[BuildAnnotationPreviousNames]; !ok {
 		return nil, nil
 	}
@@ -49,12 +52,10 @@ func PrevIds(n *yaml.RNode) ([]resid.ResId, error) {
 				"number of previous namespaces, " +
 				"number of previous kinds not equal")
 	}
+	apiVersion := n.GetApiVersion()
+	group, version := resid.ParseGroupVersion(apiVersion)
+	ids = make([]resid.ResId, 0, len(names))
 	for i := range names {
-		meta, err := n.GetMeta()
-		if err != nil {
-			return nil, err
-		}
-		group, version := resid.ParseGroupVersion(meta.APIVersion)
 		gvk := resid.Gvk{
 			Group:   group,
 			Version: version,

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/commonlabels.go

@@ -5,9 +5,6 @@ package builtinpluginconsts
 
 const commonLabelFieldSpecs = `
 commonLabels:
-- path: metadata/labels
-  create: true
-
 - path: spec/selector
   create: true
   version: v1
@@ -17,20 +14,10 @@ commonLabels:
   create: true
   version: v1
   kind: ReplicationController
-
-- path: spec/template/metadata/labels
-  create: true
-  version: v1
-  kind: ReplicationController
-
 - path: spec/selector/matchLabels
   create: true
   kind: Deployment
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: Deployment
-
 - path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
   create: false
   group: apps
@@ -60,28 +47,15 @@ commonLabels:
   create: true
   kind: ReplicaSet
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: ReplicaSet
-
 - path: spec/selector/matchLabels
   create: true
   kind: DaemonSet
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: DaemonSet
-
 - path: spec/selector/matchLabels
   create: true
   group: apps
   kind: StatefulSet
 
-- path: spec/template/metadata/labels
-  create: true
-  group: apps
-  kind: StatefulSet
-
 - path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
   create: false
   group: apps
@@ -107,36 +81,16 @@ commonLabels:
   group: apps
   kind: StatefulSet
 
-- path: spec/volumeClaimTemplates[]/metadata/labels
-  create: true
-  group: apps
-  kind: StatefulSet
-
 - path: spec/selector/matchLabels
   create: false
   group: batch
   kind: Job
 
-- path: spec/template/metadata/labels
-  create: true
-  group: batch
-  kind: Job
-
 - path: spec/jobTemplate/spec/selector/matchLabels
   create: false
   group: batch
   kind: CronJob
 
-- path: spec/jobTemplate/metadata/labels
-  create: true
-  group: batch
-  kind: CronJob
-
-- path: spec/jobTemplate/spec/template/metadata/labels
-  create: true
-  group: batch
-  kind: CronJob
-
 - path: spec/selector/matchLabels
   create: false
   group: policy
@@ -156,4 +110,4 @@ commonLabels:
   create: false
   group: networking.k8s.io
   kind: NetworkPolicy
-`
+` + metadataLabelsFieldSpecs

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/defaultconfig.go

@@ -13,6 +13,7 @@ func GetDefaultFieldSpecs() []byte {
 		[]byte(namePrefixFieldSpecs),
 		[]byte(nameSuffixFieldSpecs),
 		[]byte(commonLabelFieldSpecs),
+		[]byte(templateLabelFieldSpecs),
 		[]byte(commonAnnotationFieldSpecs),
 		[]byte(namespaceFieldSpecs),
 		[]byte(varReferenceFieldSpecs),
@@ -30,6 +31,7 @@ func GetDefaultFieldSpecsAsMap() map[string]string {
 	result["nameprefix"] = namePrefixFieldSpecs
 	result["namesuffix"] = nameSuffixFieldSpecs
 	result["commonlabels"] = commonLabelFieldSpecs
+	result["templatelabels"] = templateLabelFieldSpecs
 	result["commonannotations"] = commonAnnotationFieldSpecs
 	result["namespace"] = namespaceFieldSpecs
 	result["varreference"] = varReferenceFieldSpecs

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/metadatalabels.go

@@ -0,0 +1,51 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const metadataLabelsFieldSpecs = `
+- path: metadata/labels
+  create: true
+
+- path: spec/template/metadata/labels
+  create: true
+  version: v1
+  kind: ReplicationController
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: Deployment
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: ReplicaSet
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: DaemonSet
+
+- path: spec/template/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/volumeClaimTemplates[]/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: Job
+
+- path: spec/jobTemplate/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+`

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/templatelabels.go

@@ -0,0 +1,8 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const templateLabelFieldSpecs = `
+templateLabels:
+` + metadataLabelsFieldSpecs

vendor/sigs.k8s.io/kustomize/api/krusty/kustomizer.go

@@ -5,6 +5,7 @@ package krusty
 
 import (
 	"fmt"
+	"log"
 
 	"sigs.k8s.io/kustomize/api/internal/builtins"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
@@ -16,6 +17,7 @@ import (
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 )
@@ -89,12 +91,10 @@ func (b *Kustomizer) Run(
 	if err != nil {
 		return nil, err
 	}
-	if b.options.DoLegacyResourceSort {
+	err = b.applySortOrder(m, kt)
-		err = builtins.NewLegacyOrderTransformerPlugin().Transform(m)
 	if err != nil {
 		return nil, err
 	}
-	}
 	if b.options.AddManagedbyLabel || utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.ManagedByLabelOption) {
 		t := builtins.LabelTransformerPlugin{
 			Labels: map[string]string{
@@ -112,10 +112,52 @@ func (b *Kustomizer) Run(
 	}
 	m.RemoveBuildAnnotations()
 	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.OriginAnnotations) {
-		m.RemoveOriginAnnotations()
+		err = m.RemoveOriginAnnotations()
+		if err != nil {
+			return nil, errors.WrapPrefixf(err, "failed to clean up origin tracking annotations")
+		}
 	}
 	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.TransformerAnnotations) {
-		m.RemoveTransformerAnnotations()
+		err = m.RemoveTransformerAnnotations()
+		if err != nil {
+			return nil, errors.WrapPrefixf(err, "failed to clean up transformer annotations")
+		}
 	}
 	return m, nil
 }
+
+func (b *Kustomizer) applySortOrder(m resmap.ResMap, kt *target.KustTarget) error {
+	// Sort order can be defined in two places:
+	// - (new) kustomization file
+	// - (old) CLI flag
+	//
+	// We want the kustomization file to take precedence over the CLI flag.
+	// Eventually, we may want to move away from having a CLI flag altogether:
+	// https://github.com/kubernetes-sigs/kustomize/issues/3947
+
+	// Case 1: Sort order set in kustomization file.
+	if kt.Kustomization().SortOptions != nil {
+		// If set in CLI flag too, warn the user.
+		if b.options.Reorder != ReorderOptionUnspecified {
+			log.Println("Warning: Sorting order is set both in 'kustomization.yaml'" +
+				" ('sortOptions') and in a CLI flag ('--reorder'). Using the" +
+				" kustomization file over the CLI flag.")
+		}
+		pl := &builtins.SortOrderTransformerPlugin{
+			SortOptions: kt.Kustomization().SortOptions,
+		}
+		err := pl.Transform(m)
+		if err != nil {
+			return errors.Wrap(err)
+		}
+	} else if b.options.Reorder == ReorderOptionLegacy || b.options.Reorder == ReorderOptionUnspecified {
+		// Case 2: Sort order set in CLI flag only or not at all.
+		pl := &builtins.SortOrderTransformerPlugin{
+			SortOptions: &types.SortOptions{
+				Order: types.LegacySortOrder,
+			},
+		}
+		return errors.Wrap(pl.Transform(m))
+	}
+	return nil
+}

vendor/sigs.k8s.io/kustomize/api/krusty/options.go

@@ -8,6 +8,14 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
+type ReorderOption string
+
+const (
+	ReorderOptionLegacy      ReorderOption = "legacy"
+	ReorderOptionNone        ReorderOption = "none"
+	ReorderOptionUnspecified ReorderOption = "unspecified"
+)
+
 // Options holds high-level kustomize configuration options,
 // e.g. are plugins enabled, should the loader be restricted
 // to the kustomization root, etc.
@@ -16,7 +24,15 @@ type Options struct {
 	// per a particular sort order.  When false, don't do the
 	// sort, and instead respect the depth-first resource input
 	// order as specified by the kustomization file(s).
-	DoLegacyResourceSort bool
+
+	// Sort the resources before emitting them. Possible values:
+	// - "legacy": Use a fixed order that kustomize provides for backwards
+	//   compatibility.
+	// - "none": Respect the depth-first resource input order as specified by the
+	//   kustomization file.
+	// - "unspecified": The user didn't specify any preference. Kustomize will
+	//   select the appropriate default.
+	Reorder ReorderOption
 
 	// When true, a label
 	//     app.kubernetes.io/managed-by: kustomize-<version>
@@ -27,9 +43,6 @@ type Options struct {
 	// See type definition.
 	LoadRestrictions types.LoadRestrictions
 
-	// Create an inventory object for pruning.
-	DoPrune bool
-
 	// Options related to kustomize plugins.
 	PluginConfig *types.PluginConfig
 }
@@ -37,10 +50,9 @@ type Options struct {
 // MakeDefaultOptions returns a default instance of Options.
 func MakeDefaultOptions() *Options {
 	return &Options{
-		DoLegacyResourceSort: false,
+		Reorder:           ReorderOptionNone,
 		AddManagedbyLabel: false,
 		LoadRestrictions:  types.LoadRestrictionsRootOnly,
-		DoPrune:              false,
 		PluginConfig:      types.DisabledPluginConfig(),
 	}
 }

vendor/sigs.k8s.io/kustomize/api/kv/kv.go

@@ -7,15 +7,14 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"os"
-	"path"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/generators"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 var utf8bom = []byte{0xEF, 0xBB, 0xBF}
@@ -41,23 +40,23 @@ func (kvl *loader) Load(
 	args types.KvPairSources) (all []types.Pair, err error) {
 	pairs, err := kvl.keyValuesFromEnvFiles(args.EnvSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
+		return nil, errors.WrapPrefixf(err,
 			"env source files: %v",
-			args.EnvSources))
+			args.EnvSources)
 	}
 	all = append(all, pairs...)
 
 	pairs, err = keyValuesFromLiteralSources(args.LiteralSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
+		return nil, errors.WrapPrefixf(err,
-			"literal sources %v", args.LiteralSources))
+			"literal sources %v", args.LiteralSources)
 	}
 	all = append(all, pairs...)
 
 	pairs, err = kvl.keyValuesFromFileSources(args.FileSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
+		return nil, errors.WrapPrefixf(err,
-			"file sources: %v", args.FileSources))
+			"file sources: %v", args.FileSources)
 	}
 	return append(all, pairs...), nil
 }
@@ -77,7 +76,7 @@ func keyValuesFromLiteralSources(sources []string) ([]types.Pair, error) {
 func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
 	var kvs []types.Pair
 	for _, s := range sources {
-		k, fPath, err := parseFileSource(s)
+		k, fPath, err := generators.ParseFileSource(s)
 		if err != nil {
 			return nil, err
 		}
@@ -162,44 +161,13 @@ func (kvl *loader) keyValuesFromLine(line []byte, currentLine int) (types.Pair,
 	if len(data) == 2 {
 		kv.Value = data[1]
 	} else {
-		// No value (no `=` in the line) is a signal to obtain the value
+		// If there is no value (no `=` in the line), we set the value to an empty string
-		// from the environment. This behaviour was accidentally imported from kubectl code, and
+		kv.Value = ""
-		// will be removed in the next major release of Kustomize.
-		_, _ = fmt.Fprintln(os.Stderr, "WARNING: "+
-			"This Kustomization is relying on a bug that loads values from the environment "+
-			"when they are omitted from an env file. "+
-			"This behaviour will be removed in the next major release of Kustomize.")
-		kv.Value = os.Getenv(key)
 	}
 	kv.Key = key
 	return kv, nil
 }
 
-// ParseFileSource parses the source given.
-//
-//  Acceptable formats include:
-//   1.  source-path: the basename will become the key name
-//   2.  source-name=source-path: the source-name will become the key name and
-//       source-path is the path to the key file.
-//
-// Key names cannot include '='.
-func parseFileSource(source string) (keyName, filePath string, err error) {
-	numSeparators := strings.Count(source, "=")
-	switch {
-	case numSeparators == 0:
-		return path.Base(source), source, nil
-	case numSeparators == 1 && strings.HasPrefix(source, "="):
-		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
-	case numSeparators == 1 && strings.HasSuffix(source, "="):
-		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
-	case numSeparators > 1:
-		return "", "", errors.New("key names or file paths cannot contain '='")
-	default:
-		components := strings.Split(source, "=")
-		return components[0], components[1], nil
-	}
-}
-
 // ParseLiteralSource parses the source key=val pair into its component pieces.
 // This functionality is distinguished from strings.SplitN(source, "=", 2) since
 // it returns an error in the case of empty keys, values, or a missing equals sign.

vendor/sigs.k8s.io/kustomize/api/loader/fileloader.go

@@ -5,7 +5,7 @@ package loader
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"net/url"
@@ -18,6 +18,13 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+// IsRemoteFile returns whether path has a url scheme that kustomize allows for
+// remote files. See https://github.com/kubernetes-sigs/kustomize/blob/master/examples/remoteBuild.md
+func IsRemoteFile(path string) bool {
+	u, err := url.Parse(path)
+	return err == nil && (u.Scheme == "http" || u.Scheme == "https")
+}
+
 // fileLoader is a kustomization's interface to files.
 //
 // The directory in which a kustomization file sits
@@ -114,6 +121,15 @@ func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
 		RestrictionRootOnly, fSys, filesys.Separator)
 }
 
+// Repo returns the absolute path to the repo that contains Root if this fileLoader was created from a url
+// or the empty string otherwise.
+func (fl *fileLoader) Repo() string {
+	if fl.repoSpec != nil {
+		return fl.repoSpec.Dir.String()
+	}
+	return ""
+}
+
 // Root returns the absolute path that is prepended to any
 // relative paths used in Load.
 func (fl *fileLoader) Root() string {
@@ -206,6 +222,13 @@ func newLoaderAtGitClone(
 			"'%s' refers to file '%s'; expecting directory",
 			repoSpec.AbsPath(), f)
 	}
+	// Path in repo can contain symlinks that exit repo. We can only
+	// check for this after cloning repo.
+	if !root.HasPrefix(repoSpec.CloneDir()) {
+		_ = cleaner()
+		return nil, fmt.Errorf("%q refers to directory outside of repo %q", repoSpec.AbsPath(),
+			repoSpec.CloneDir())
+	}
 	return &fileLoader{
 		// Clones never allowed to escape root.
 		loadRestrictor: RestrictionRootOnly,
@@ -283,30 +306,8 @@ func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 // else an error. Relative paths are taken relative
 // to the root.
 func (fl *fileLoader) Load(path string) ([]byte, error) {
-	if u, err := url.Parse(path); err == nil && (u.Scheme == "http" || u.Scheme == "https") {
+	if IsRemoteFile(path) {
-		var hc *http.Client
+		return fl.httpClientGetContent(path)
-		if fl.http != nil {
-			hc = fl.http
-		} else {
-			hc = &http.Client{}
-		}
-		resp, err := hc.Get(path)
-		if err != nil {
-			return nil, err
-		}
-		defer resp.Body.Close()
-		if resp.StatusCode < 200 || resp.StatusCode > 299 {
-			_, err := git.NewRepoSpecFromURL(path)
-			if err == nil {
-				return nil, errors.Errorf("URL is a git repository")
-			}
-			return nil, fmt.Errorf("%w: status code %d (%s)", ErrHTTP, resp.StatusCode, http.StatusText(resp.StatusCode))
-		}
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return nil, err
-		}
-		return body, nil
 	}
 	if !filepath.IsAbs(path) {
 		path = fl.root.Join(path)
@@ -318,6 +319,30 @@ func (fl *fileLoader) Load(path string) ([]byte, error) {
 	return fl.fSys.ReadFile(path)
 }
 
+func (fl *fileLoader) httpClientGetContent(path string) ([]byte, error) {
+	var hc *http.Client
+	if fl.http != nil {
+		hc = fl.http
+	} else {
+		hc = &http.Client{}
+	}
+	resp, err := hc.Get(path)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	defer resp.Body.Close()
+	// response unsuccessful
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		_, err = git.NewRepoSpecFromURL(path)
+		if err == nil {
+			return nil, errors.Errorf("URL is a git repository")
+		}
+		return nil, fmt.Errorf("%w: status code %d (%s)", ErrHTTP, resp.StatusCode, http.StatusText(resp.StatusCode))
+	}
+	content, err := io.ReadAll(resp.Body)
+	return content, errors.Wrap(err)
+}
+
 // Cleanup runs the cleaner.
 func (fl *fileLoader) Cleanup() error {
 	return fl.cleaner()

vendor/sigs.k8s.io/kustomize/api/provenance/provenance.go

@@ -6,47 +6,63 @@ package provenance
 import (
 	"fmt"
 	"runtime"
+	"runtime/debug"
 	"strings"
 )
 
+// These variables are set at build time using ldflags.
+//
+//nolint:gochecknoglobals
 var (
-	version = "unknown"
+	// During a release, this will be set to the release tag, e.g. "kustomize/v4.5.7"
-	// sha1 from git, output of $(git rev-parse HEAD)
+	version = developmentVersion
-	gitCommit = "$Format:%H$"
 	// build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')
-	buildDate = "1970-01-01T00:00:00Z"
+	buildDate = "unknown"
-	goos      = runtime.GOOS
-	goarch    = runtime.GOARCH
 )
 
+// This default value, (devel), matches
+// the value debug.BuildInfo uses for an unset main module version.
+const developmentVersion = "(devel)"
+
 // Provenance holds information about the build of an executable.
 type Provenance struct {
 	// Version of the kustomize binary.
-	Version string `json:"version,omitempty"`
+	Version string `json:"version,omitempty" yaml:"version,omitempty"`
 	// GitCommit is a git commit
-	GitCommit string `json:"gitCommit,omitempty"`
+	GitCommit string `json:"gitCommit,omitempty" yaml:"gitCommit,omitempty"`
 	// BuildDate is date of the build.
-	BuildDate string `json:"buildDate,omitempty"`
+	BuildDate string `json:"buildDate,omitempty" yaml:"buildDate,omitempty"`
 	// GoOs holds OS name.
-	GoOs string `json:"goOs,omitempty"`
+	GoOs string `json:"goOs,omitempty" yaml:"goOs,omitempty"`
 	// GoArch holds architecture name.
-	GoArch string `json:"goArch,omitempty"`
+	GoArch string `json:"goArch,omitempty" yaml:"goArch,omitempty"`
+	// GoVersion holds Go version.
+	GoVersion string `json:"goVersion,omitempty" yaml:"goVersion,omitempty"`
 }
 
 // GetProvenance returns an instance of Provenance.
 func GetProvenance() Provenance {
-	return Provenance{
+	p := Provenance{
-		version,
+		BuildDate: buildDate,
-		gitCommit,
+		Version:   version,
-		buildDate,
+		GitCommit: "unknown",
-		goos,
+		GoOs:      runtime.GOOS,
-		goarch,
+		GoArch:    runtime.GOARCH,
+		GoVersion: runtime.Version(),
 	}
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return p
 	}
 
-// Full returns the full provenance stamp.
+	for _, setting := range info.Settings {
-func (v Provenance) Full() string {
+		// For now, the git commit is the only information of interest.
-	return fmt.Sprintf("%+v", v)
+		// We could consider adding other info such as the commit date in the future.
+		if setting.Key == "vcs.revision" {
+			p.GitCommit = setting.Value
+		}
+	}
+	return p
 }
 
 // Short returns the shortened provenance stamp.

vendor/sigs.k8s.io/kustomize/api/resmap/factory.go

@@ -4,11 +4,11 @@
 package resmap
 
 import (
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/kusterr"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -81,7 +81,7 @@ func (rmF *Factory) NewResMapFromConfigMapArgs(
 	for i := range argList {
 		res, err := rmF.resF.MakeConfigMap(kvLdr, &argList[i])
 		if err != nil {
-			return nil, errors.Wrap(err, "NewResMapFromConfigMapArgs")
+			return nil, errors.WrapPrefixf(err, "NewResMapFromConfigMapArgs")
 		}
 		resources = append(resources, res)
 	}
@@ -106,7 +106,7 @@ func (rmF *Factory) NewResMapFromSecretArgs(
 	for i := range argsList {
 		res, err := rmF.resF.MakeSecret(kvLdr, &argsList[i])
 		if err != nil {
-			return nil, errors.Wrap(err, "NewResMapFromSecretArgs")
+			return nil, errors.WrapPrefixf(err, "NewResMapFromSecretArgs")
 		}
 		resources = append(resources, res)
 	}

vendor/sigs.k8s.io/kustomize/api/resmap/idslice.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package resmap
-
-import (
-	"sort"
-
-	"sigs.k8s.io/kustomize/kyaml/resid"
-)
-
-// IdSlice implements the sort interface.
-type IdSlice []resid.ResId
-
-var _ sort.Interface = IdSlice{}
-
-func (a IdSlice) Len() int      { return len(a) }
-func (a IdSlice) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a IdSlice) Less(i, j int) bool {
-	if !a[i].Gvk.Equals(a[j].Gvk) {
-		return a[i].Gvk.IsLessThan(a[j].Gvk)
-	}
-	return a[i].LegacySortString() < a[j].LegacySortString()
-}

vendor/sigs.k8s.io/kustomize/api/resmap/reswrangler.go

@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/annotations"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
@@ -108,7 +108,7 @@ func (m *resWrangler) Replace(res *resource.Resource) (int, error) {
 	id := res.CurId()
 	i, err := m.GetIndexOfCurrentId(id)
 	if err != nil {
-		return -1, errors.Wrap(err, "in Replace")
+		return -1, errors.WrapPrefixf(err, "in Replace")
 	}
 	if i < 0 {
 		return -1, fmt.Errorf("cannot find resource with id %s to replace", id)
@@ -286,7 +286,7 @@ func (m *resWrangler) AsYaml() ([]byte, error) {
 		out, err := res.AsYAML()
 		if err != nil {
 			m, _ := res.Map()
-			return nil, errors.Wrapf(err, "%#v", m)
+			return nil, errors.WrapPrefixf(err, "%#v", m)
 		}
 		if firstObj {
 			firstObj = false

vendor/sigs.k8s.io/kustomize/api/resource/origin.go

@@ -52,7 +52,7 @@ func (origin *Origin) Append(path string) *Origin {
 	originCopy := origin.Copy()
 	repoSpec, err := git.NewRepoSpecFromURL(path)
 	if err == nil {
-		originCopy.Repo = repoSpec.Host + repoSpec.OrgRepo
+		originCopy.Repo = repoSpec.CloneSpec()
 		absPath := repoSpec.AbsPath()
 		path = absPath[strings.Index(absPath[1:], "/")+1:][1:]
 		originCopy.Path = ""

vendor/sigs.k8s.io/kustomize/api/resource/resource.go

@@ -164,10 +164,17 @@ func (r *Resource) CopyMergeMetaDataFieldsFrom(other *Resource) error {
 		mergeStringMaps(other.GetLabels(), r.GetLabels())); err != nil {
 		return fmt.Errorf("copyMerge cannot set labels - %w", err)
 	}
-	if err := r.SetAnnotations(
+
-		mergeStringMapsWithBuildAnnotations(other.GetAnnotations(), r.GetAnnotations())); err != nil {
+	ra := r.GetAnnotations()
+	_, enableNameSuffixHash := ra[utils.BuildAnnotationsGenAddHashSuffix]
+	merged := mergeStringMapsWithBuildAnnotations(other.GetAnnotations(), ra)
+	if !enableNameSuffixHash {
+		delete(merged, utils.BuildAnnotationsGenAddHashSuffix)
+	}
+	if err := r.SetAnnotations(merged); err != nil {
 		return fmt.Errorf("copyMerge cannot set annotations - %w", err)
 	}
+
 	if err := r.SetName(other.GetName()); err != nil {
 		return fmt.Errorf("copyMerge cannot set name - %w", err)
 	}

vendor/sigs.k8s.io/kustomize/api/types/erronlybuiltinpluginsallowed.go

@@ -6,7 +6,7 @@ package types
 import (
 	"fmt"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errOnlyBuiltinPluginsAllowed struct {
@@ -24,10 +24,6 @@ func NewErrOnlyBuiltinPluginsAllowed(n string) *errOnlyBuiltinPluginsAllowed {
 }
 
 func IsErrOnlyBuiltinPluginsAllowed(err error) bool {
-	_, ok := err.(*errOnlyBuiltinPluginsAllowed)
+	e := &errOnlyBuiltinPluginsAllowed{}
-	if ok {
+	return errors.As(err, &e)
-		return true
-	}
-	_, ok = errors.Cause(err).(*errOnlyBuiltinPluginsAllowed)
-	return ok
 }

vendor/sigs.k8s.io/kustomize/api/types/errunabletofind.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errUnableToFind struct {
@@ -31,10 +31,6 @@ func NewErrUnableToFind(w string, a []Pair) *errUnableToFind {
 }
 
 func IsErrUnableToFind(err error) bool {
-	_, ok := err.(*errUnableToFind)
+	e := &errUnableToFind{}
-	if ok {
+	return errors.As(err, &e)
-		return true
-	}
-	_, ok = errors.Cause(err).(*errUnableToFind)
-	return ok
 }

vendor/sigs.k8s.io/kustomize/api/types/fix.go

@@ -1,54 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-import (
-	"regexp"
-
-	"sigs.k8s.io/yaml"
-)
-
-// FixKustomizationPreUnmarshalling modifies the raw data
-// before marshalling - e.g. changes old field names to
-// new field names.
-func FixKustomizationPreUnmarshalling(data []byte) ([]byte, error) {
-	deprecatedFieldsMap := map[string]string{
-		"imageTags:": "images:",
-	}
-	for oldname, newname := range deprecatedFieldsMap {
-		pattern := regexp.MustCompile(oldname)
-		data = pattern.ReplaceAll(data, []byte(newname))
-	}
-	doLegacy, err := useLegacyPatch(data)
-	if err != nil {
-		return nil, err
-	}
-	if doLegacy {
-		pattern := regexp.MustCompile("patches:")
-		data = pattern.ReplaceAll(data, []byte("patchesStrategicMerge:"))
-	}
-	return data, nil
-}
-
-func useLegacyPatch(data []byte) (bool, error) {
-	found := false
-	var object map[string]interface{}
-	err := yaml.Unmarshal(data, &object)
-	if err != nil {
-		return false, err
-	}
-	if rawPatches, ok := object["patches"]; ok {
-		patches, ok := rawPatches.([]interface{})
-		if !ok {
-			return false, err
-		}
-		for _, p := range patches {
-			_, ok := p.(string)
-			if ok {
-				found = true
-			}
-		}
-	}
-	return found, nil
-}

vendor/sigs.k8s.io/kustomize/api/types/helmchartargs.go

@@ -3,6 +3,10 @@
 
 package types
 
+import "path/filepath"
+
+const HelmDefaultHome = "charts"
+
 type HelmGlobals struct {
 	// ChartHome is a file path, relative to the kustomization root,
 	// to a directory containing a subdirectory for each chart to be
@@ -55,7 +59,11 @@ type HelmChart struct {
 	// in the helm template
 	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 
-	// ValuesFile is local file path to a values file to use _instead of_
+	// AdditionalValuesFiles are local file paths to values files to be used in
+	// addition to either the default values file or the values specified in ValuesFile.
+	AdditionalValuesFiles []string `json:"additionalValuesFiles,omitempty" yaml:"additionalValuesFiles,omitempty"`
+
+	// ValuesFile is a local file path to a values file to use _instead of_
 	// the default values that accompanied the chart.
 	// The default values are in '{ChartHome}/{Name}/values.yaml'.
 	ValuesFile string `json:"valuesFile,omitempty" yaml:"valuesFile,omitempty"`
@@ -72,6 +80,19 @@ type HelmChart struct {
 	// IncludeCRDs specifies if Helm should also generate CustomResourceDefinitions.
 	// Defaults to 'false'.
 	IncludeCRDs bool `json:"includeCRDs,omitempty" yaml:"includeCRDs,omitempty"` //nolint: tagliatelle
+
+	// SkipHooks sets the --no-hooks flag when calling helm template. This prevents
+	// helm from erroneously rendering test templates.
+	SkipHooks bool `json:"skipHooks,omitempty" yaml:"skipHooks,omitempty"`
+
+	// ApiVersions is the kubernetes apiversions used for Capabilities.APIVersions
+	ApiVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
+
+	// NameTemplate is for specifying the name template used to name the release.
+	NameTemplate string `json:"nameTemplate,omitempty" yaml:"nameTemplate,omitempty"`
+
+	// SkipTests skips tests from templated output.
+	SkipTests bool `json:"skipTests,omitempty" yaml:"skipTests,omitempty"`
 }
 
 // HelmChartArgs contains arguments to helm.
@@ -120,3 +141,45 @@ func makeHelmChartFromHca(old *HelmChartArgs) (c HelmChart) {
 	c.ReleaseName = old.ReleaseName
 	return
 }
+
+func (h HelmChart) AsHelmArgs(absChartHome string) []string {
+	args := []string{"template"}
+	if h.ReleaseName != "" {
+		args = append(args, h.ReleaseName)
+	} else {
+		// AFAICT, this doesn't work as intended due to a bug in helm.
+		// See https://github.com/helm/helm/issues/6019
+		// I've tried placing the flag before and after the name argument.
+		args = append(args, "--generate-name")
+	}
+	if h.Name != "" {
+		args = append(args, filepath.Join(absChartHome, h.Name))
+	}
+	if h.Namespace != "" {
+		args = append(args, "--namespace", h.Namespace)
+	}
+	if h.NameTemplate != "" {
+		args = append(args, "--name-template", h.NameTemplate)
+	}
+
+	if h.ValuesFile != "" {
+		args = append(args, "-f", h.ValuesFile)
+	}
+	for _, valuesFile := range h.AdditionalValuesFiles {
+		args = append(args, "-f", valuesFile)
+	}
+
+	for _, apiVer := range h.ApiVersions {
+		args = append(args, "--api-versions", apiVer)
+	}
+	if h.IncludeCRDs {
+		args = append(args, "--include-crds")
+	}
+	if h.SkipTests {
+		args = append(args, "--skip-tests")
+	}
+	if h.SkipHooks {
+		args = append(args, "--no-hooks")
+	}
+	return args
+}

vendor/sigs.k8s.io/kustomize/api/types/inventory.go

@@ -1,16 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-// Inventory records all objects touched in a build operation.
-type Inventory struct {
-	Type      string   `json:"type,omitempty" yaml:"type,omitempty"`
-	ConfigMap NameArgs `json:"configMap,omitempty" yaml:"configMap,omitempty"`
-}
-
-// NameArgs holds both namespace and name.
-type NameArgs struct {
-	Name      string `json:"name,omitempty" yaml:"name,omitempty"`
-	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-}

vendor/sigs.k8s.io/kustomize/api/types/kustomization.go

@@ -8,6 +8,8 @@ import (
 	"encoding/json"
 	"fmt"
 
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/yaml"
 )
 
@@ -59,12 +61,14 @@ type Kustomization struct {
 	// CommonAnnotations to add to all objects.
 	CommonAnnotations map[string]string `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 
+	// Deprecated: Use the Patches field instead, which provides a superset of the functionality of PatchesStrategicMerge.
 	// PatchesStrategicMerge specifies the relative path to a file
 	// containing a strategic merge patch.  Format documented at
 	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md
 	// URLs and globs are not supported.
 	PatchesStrategicMerge []PatchStrategicMerge `json:"patchesStrategicMerge,omitempty" yaml:"patchesStrategicMerge,omitempty"`
 
+	// Deprecated: Use the Patches field instead, which provides a superset of the functionality of JSONPatches.
 	// JSONPatches is a list of JSONPatch for applying JSON patch.
 	// Format documented at https://tools.ietf.org/html/rfc6902
 	// and http://jsonpatch.com
@@ -80,6 +84,9 @@ type Kustomization struct {
 	// patch, but this operator is simpler to specify.
 	Images []Image `json:"images,omitempty" yaml:"images,omitempty"`
 
+	// Deprecated: Use the Images field instead.
+	ImageTags []Image `json:"imageTags,omitempty" yaml:"imageTags,omitempty"`
+
 	// Replacements is a list of replacements, which will copy nodes from a
 	// specified source to N specified targets.
 	Replacements []ReplacementField `json:"replacements,omitempty" yaml:"replacements,omitempty"`
@@ -88,6 +95,7 @@ type Kustomization struct {
 	// specification. This can also be done with a patch.
 	Replicas []Replica `json:"replicas,omitempty" yaml:"replicas,omitempty"`
 
+	// Deprecated: Vars will be removed in future release. Migrate to Replacements instead.
 	// Vars allow things modified by kustomize to be injected into a
 	// kubernetes object specification. A var is a name (e.g. FOO) associated
 	// with a field in a specific resource instance.  The field must
@@ -97,6 +105,9 @@ type Kustomization struct {
 	// value of the specified field has been determined.
 	Vars []Var `json:"vars,omitempty" yaml:"vars,omitempty"`
 
+	// SortOptions change the order that kustomize outputs resources.
+	SortOptions *SortOptions `json:"sortOptions,omitempty" yaml:"sortOptions,omitempty"`
+
 	//
 	// Operands - what kustomize operates on.
 	//
@@ -116,9 +127,7 @@ type Kustomization struct {
 	// CRDs themselves are not modified.
 	Crds []string `json:"crds,omitempty" yaml:"crds,omitempty"`
 
-	// Deprecated.
+	// Deprecated: Anything that would have been specified here should be specified in the Resources field instead.
-	// Anything that would have been specified here should
-	// be specified in the Resources field instead.
 	Bases []string `json:"bases,omitempty" yaml:"bases,omitempty"`
 
 	//
@@ -164,19 +173,46 @@ type Kustomization struct {
 	// Validators is a list of files containing validators
 	Validators []string `json:"validators,omitempty" yaml:"validators,omitempty"`
 
-	// Inventory appends an object that contains the record
-	// of all other objects, which can be used in apply, prune and delete
-	Inventory *Inventory `json:"inventory,omitempty" yaml:"inventory,omitempty"`
-
 	// BuildMetadata is a list of strings used to toggle different build options
 	BuildMetadata []string `json:"buildMetadata,omitempty" yaml:"buildMetadata,omitempty"`
 }
 
-// FixKustomizationPostUnmarshalling fixes things
+const (
+	deprecatedWarningToRunEditFix              = "Run 'kustomize edit fix' to update your Kustomization automatically."
+	deprecatedWarningToRunEditFixExperimential = "[EXPERIMENTAL] Run 'kustomize edit fix' to update your Kustomization automatically."
+	deprecatedBaseWarningMessage               = "# Warning: 'bases' is deprecated. Please use 'resources' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedImageTagsWarningMessage          = "# Warning: 'imageTags' is deprecated. Please use 'images' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedPatchesJson6902Message           = "# Warning: 'patchesJson6902' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedPatchesStrategicMergeMessage     = "# Warning: 'patchesStrategicMerge' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedVarsMessage                      = "# Warning: 'vars' is deprecated. Please use 'replacements' instead." + " " + deprecatedWarningToRunEditFixExperimential
+)
+
+// CheckDeprecatedFields check deprecated field is used or not.
+func (k *Kustomization) CheckDeprecatedFields() *[]string {
+	var warningMessages []string
+	if k.Bases != nil {
+		warningMessages = append(warningMessages, deprecatedBaseWarningMessage)
+	}
+	if k.ImageTags != nil {
+		warningMessages = append(warningMessages, deprecatedImageTagsWarningMessage)
+	}
+	if k.PatchesJson6902 != nil {
+		warningMessages = append(warningMessages, deprecatedPatchesJson6902Message)
+	}
+	if k.PatchesStrategicMerge != nil {
+		warningMessages = append(warningMessages, deprecatedPatchesStrategicMergeMessage)
+	}
+	if k.Vars != nil {
+		warningMessages = append(warningMessages, deprecatedVarsMessage)
+	}
+	return &warningMessages
+}
+
+// FixKustomization fixes things
 // like empty fields that should not be empty, or
 // moving content of deprecated fields to newer
 // fields.
-func (k *Kustomization) FixKustomizationPostUnmarshalling() {
+func (k *Kustomization) FixKustomization() {
 	if k.Kind == "" {
 		k.Kind = KustomizationKind
 	}
@@ -187,8 +223,15 @@ func (k *Kustomization) FixKustomizationPostUnmarshalling() {
 			k.APIVersion = KustomizationVersion
 		}
 	}
+
+	// 'bases' field was deprecated in favor of the 'resources' field.
 	k.Resources = append(k.Resources, k.Bases...)
 	k.Bases = nil
+
+	// 'imageTags' field was deprecated in favor of the 'images' field.
+	k.Images = append(k.Images, k.ImageTags...)
+	k.ImageTags = nil
+
 	for i, g := range k.ConfigMapGenerator {
 		if g.EnvSource != "" {
 			k.ConfigMapGenerator[i].EnvSources =
@@ -217,11 +260,25 @@ func (k *Kustomization) FixKustomizationPostUnmarshalling() {
 // FixKustomizationPreMarshalling fixes things
 // that should occur after the kustomization file
 // has been processed.
-func (k *Kustomization) FixKustomizationPreMarshalling() error {
+func (k *Kustomization) FixKustomizationPreMarshalling(fSys filesys.FileSystem) error {
 	// PatchesJson6902 should be under the Patches field.
 	k.Patches = append(k.Patches, k.PatchesJson6902...)
 	k.PatchesJson6902 = nil
 
+	if k.PatchesStrategicMerge != nil {
+		for _, patchStrategicMerge := range k.PatchesStrategicMerge {
+			// check this patch is file path select.
+			if _, err := fSys.ReadFile(string(patchStrategicMerge)); err == nil {
+				// path patch
+				k.Patches = append(k.Patches, Patch{Path: string(patchStrategicMerge)})
+			} else {
+				// inline string patch
+				k.Patches = append(k.Patches, Patch{Patch: string(patchStrategicMerge)})
+			}
+		}
+		k.PatchesStrategicMerge = nil
+	}
+
 	// this fix is not in FixKustomizationPostUnmarshalling because
 	// it will break some commands like `create` and `add`. those
 	// commands depend on 'commonLabels' field
@@ -258,16 +315,19 @@ func (k *Kustomization) EnforceFields() []string {
 
 // Unmarshal replace k with the content in YAML input y
 func (k *Kustomization) Unmarshal(y []byte) error {
+	// TODO: switch to strict decoding to catch duplicate keys.
+	// We can't do so until there is a yaml decoder that supports anchors AND case-insensitive keys.
+	// See https://github.com/kubernetes-sigs/kustomize/issues/5061
 	j, err := yaml.YAMLToJSON(y)
 	if err != nil {
-		return err
+		return errors.WrapPrefixf(err, "invalid Kustomization")
 	}
 	dec := json.NewDecoder(bytes.NewReader(j))
 	dec.DisallowUnknownFields()
 	var nk Kustomization
 	err = dec.Decode(&nk)
 	if err != nil {
-		return err
+		return errors.WrapPrefixf(err, "invalid Kustomization")
 	}
 	*k = nk
 	return nil

vendor/sigs.k8s.io/kustomize/api/types/sortoptions.go

@@ -0,0 +1,28 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package types
+
+// SortOptions defines the order that kustomize outputs resources.
+type SortOptions struct {
+	// Order selects the ordering strategy.
+	Order SortOrder `json:"order,omitempty" yaml:"order,omitempty"`
+	// LegacySortOptions tweaks the sorting for the "legacy" sort ordering
+	// strategy.
+	LegacySortOptions *LegacySortOptions `json:"legacySortOptions,omitempty" yaml:"legacySortOptions,omitempty"`
+}
+
+// SortOrder defines different ordering strategies.
+type SortOrder string
+
+const LegacySortOrder SortOrder = "legacy"
+const FIFOSortOrder SortOrder = "fifo"
+
+// LegacySortOptions define various options for tweaking the "legacy" ordering
+// strategy.
+type LegacySortOptions struct {
+	// OrderFirst selects the resource kinds to order first.
+	OrderFirst []string `json:"orderFirst" yaml:"orderFirst"`
+	// OrderLast selects the resource kinds to order last.
+	OrderLast []string `json:"orderLast" yaml:"orderLast"`
+}

vendor/sigs.k8s.io/kustomize/kustomize/v4/commands/build/reorderoutput.go

@@ -1,54 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package build
-
-import (
-	"fmt"
-
-	"github.com/spf13/pflag"
-)
-
-//go:generate stringer -type=reorderOutput
-type reorderOutput int
-
-const (
-	unspecified reorderOutput = iota
-	none
-	legacy
-)
-
-const flagReorderOutputName = "reorder"
-
-func AddFlagReorderOutput(set *pflag.FlagSet) {
-	set.StringVar(
-		&theFlags.reorderOutput, flagReorderOutputName,
-		legacy.String(),
-		"Reorder the resources just before output. "+
-			"Use '"+legacy.String()+"' to apply a legacy reordering "+
-			"(Namespaces first, Webhooks last, etc). "+
-			"Use '"+none.String()+"' to suppress a final reordering.")
-}
-
-func validateFlagReorderOutput() error {
-	switch theFlags.reorderOutput {
-	case none.String(), legacy.String():
-		return nil
-	default:
-		return fmt.Errorf(
-			"illegal flag value --%s %s; legal values: %v",
-			flagReorderOutputName, theFlags.reorderOutput,
-			[]string{legacy.String(), none.String()})
-	}
-}
-
-func getFlagReorderOutput() reorderOutput {
-	switch theFlags.reorderOutput {
-	case none.String():
-		return none
-	case legacy.String():
-		return legacy
-	default:
-		return unspecified
-	}
-}

vendor/sigs.k8s.io/kustomize/kustomize/v4/commands/build/reorderoutput_string.go

@@ -1,25 +0,0 @@
-// Code generated by "stringer -type=reorderOutput"; DO NOT EDIT.
-
-package build
-
-import "strconv"
-
-func _() {
-	// An "invalid array index" compiler error signifies that the constant values have changed.
-	// Re-run the stringer command to generate them again.
-	var x [1]struct{}
-	_ = x[unspecified-0]
-	_ = x[none-1]
-	_ = x[legacy-2]
-}
-
-const _reorderOutput_name = "unspecifiednonelegacy"
-
-var _reorderOutput_index = [...]uint8{0, 11, 15, 21}
-
-func (i reorderOutput) String() string {
-	if i < 0 || i >= reorderOutput(len(_reorderOutput_index)-1) {
-		return "reorderOutput(" + strconv.FormatInt(int64(i), 10) + ")"
-	}
-	return _reorderOutput_name[_reorderOutput_index[i]:_reorderOutput_index[i+1]]
-}

vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/build.go

@@ -6,8 +6,10 @@ package build
 import (
 	"fmt"
 	"io"
+	"log"
 
 	"github.com/spf13/cobra"
+	flag "github.com/spf13/pflag"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/krusty"
 	"sigs.k8s.io/kustomize/api/types"
@@ -42,7 +44,7 @@ func MakeHelp(pgmName, cmdName string) *Help {
 	fN := konfig.DefaultKustomizationFileName()
 	return &Help{
 		Use:   cmdName + " DIR",
-		Short: "Build a kustomization target from a directory or URL.",
+		Short: "Build a kustomization target from a directory or URL",
 		Long: fmt.Sprintf(`Build a set of KRM resources using a '%s' file.
 The DIR argument must be a path to a directory containing
 '%s', or a git repository URL with a path suffix
@@ -75,7 +77,7 @@ func NewCmdBuild(
 				return err
 			}
 			k := krusty.MakeKustomizer(
-				HonorKustomizeFlags(krusty.MakeDefaultOptions()),
+				HonorKustomizeFlags(krusty.MakeDefaultOptions(), cmd.Flags()),
 			)
 			m, err := k.Run(fSys, theArgs.kustomizationPath)
 			if err != nil {
@@ -104,8 +106,18 @@ func NewCmdBuild(
 	AddFlagEnablePlugins(cmd.Flags())
 	AddFlagReorderOutput(cmd.Flags())
 	AddFlagEnableManagedbyLabel(cmd.Flags())
-	cmd.Flags().MarkDeprecated(managedByFlag,
+	msg := "Error marking flag '%s' as deprecated: %v"
+	err := cmd.Flags().MarkDeprecated(flagReorderOutputName,
+		"use the new 'sortOptions' field in kustomization.yaml instead.")
+	if err != nil {
+		log.Fatalf(msg, flagReorderOutputName, err)
+	}
+	err = cmd.Flags().MarkDeprecated(managedByFlag,
 		"The flag `enable-managedby-label` has been deprecated. Use the `managedByLabel` option in the `buildMetadata` field instead.")
+	if err != nil {
+		log.Fatalf(msg, managedByFlag, err)
+	}
+
 	AddFlagEnableHelm(cmd.Flags())
 	return cmd
 }
@@ -130,8 +142,8 @@ func Validate(args []string) error {
 
 // HonorKustomizeFlags feeds command line data to the krusty options.
 // Flags and such are held in private package variables.
-func HonorKustomizeFlags(kOpts *krusty.Options) *krusty.Options {
+func HonorKustomizeFlags(kOpts *krusty.Options, flags *flag.FlagSet) *krusty.Options {
-	kOpts.DoLegacyResourceSort = getFlagReorderOutput() == legacy
+	kOpts.Reorder = getFlagReorderOutput(flags)
 	kOpts.LoadRestrictions = getFlagLoadRestrictorValue()
 	if theFlags.enable.plugins {
 		c := types.EnabledPluginConfig(types.BploUseStaticallyLinked)

vendor/sigs.k8s.io/kustomize/kustomize/v5/commands/build/reorderoutput.go

@@ -0,0 +1,50 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package build
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/kustomize/api/krusty"
+)
+
+const flagReorderOutputName = "reorder"
+
+func AddFlagReorderOutput(set *pflag.FlagSet) {
+	set.StringVar(
+		&theFlags.reorderOutput, flagReorderOutputName,
+		string(krusty.ReorderOptionLegacy),
+		"Reorder the resources just before output. Use '"+string(krusty.ReorderOptionLegacy)+"' to"+
+			" apply a legacy reordering (Namespaces first, Webhooks last, etc)."+
+			" Use '"+string(krusty.ReorderOptionNone)+"' to suppress a final reordering.")
+}
+
+func validateFlagReorderOutput() error {
+	switch theFlags.reorderOutput {
+	case string(krusty.ReorderOptionNone), string(krusty.ReorderOptionLegacy):
+		return nil
+	default:
+		return fmt.Errorf(
+			"illegal flag value --%s %s; legal values: %v",
+			flagReorderOutputName, theFlags.reorderOutput,
+			[]string{string(krusty.ReorderOptionLegacy), string(krusty.ReorderOptionNone)})
+	}
+}
+
+func getFlagReorderOutput(flags *flag.FlagSet) krusty.ReorderOption {
+	isReorderSet := flags.Changed(flagReorderOutputName)
+	if !isReorderSet {
+		return krusty.ReorderOptionUnspecified
+	}
+	switch theFlags.reorderOutput {
+	case string(krusty.ReorderOptionNone):
+		return krusty.ReorderOptionNone
+	case string(krusty.ReorderOptionLegacy):
+		return krusty.ReorderOptionLegacy
+	default:
+		return krusty.ReorderOptionUnspecified
+	}
+}

vendor/sigs.k8s.io/kustomize/kyaml/errors/errors.go

@@ -31,6 +31,16 @@ func Errorf(msg string, args ...interface{}) error {
 	return goerrors.Wrap(fmt.Errorf(msg, args...), 1)
 }
 
+// As finds the targeted error in any wrapped error.
+func As(err error, target interface{}) bool {
+	return goerrors.As(err, target)
+}
+
+// Is detects whether the error is equal to a given error.
+func Is(err error, target error) bool {
+	return goerrors.Is(err, target)
+}
+
 // GetStack returns a stack trace for the error if it has one
 func GetStack(err error) string {
 	if e, ok := err.(*goerrors.Error); ok {

vendor/sigs.k8s.io/kustomize/kyaml/filesys/confirmeddir.go

@@ -4,7 +4,7 @@
 package filesys
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 )
@@ -17,12 +17,12 @@ type ConfirmedDir string
 // The directory is cleaned, no symlinks, etc. so it's
 // returned as a ConfirmedDir.
 func NewTmpConfirmedDir() (ConfirmedDir, error) {
-	n, err := ioutil.TempDir("", "kustomize-")
+	n, err := os.MkdirTemp("", "kustomize-")
 	if err != nil {
 		return "", err
 	}
 
-	// In MacOs `ioutil.TempDir` creates a directory
+	// In MacOs `os.MkdirTemp` creates a directory
 	// with root in the `/var` folder, which is in turn
 	// a symlinked path to `/private/var`.
 	// Function `filepath.EvalSymlinks`is used to

vendor/sigs.k8s.io/kustomize/kyaml/filesys/fsondisk.go

@@ -5,7 +5,6 @@ package filesys
 
 import (
 	"fmt"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -125,12 +124,15 @@ func (fsOnDisk) ReadDir(name string) ([]string, error) {
 	return result, nil
 }
 
-// ReadFile delegates to ioutil.ReadFile.
+// ReadFile delegates to os.ReadFile.
-func (fsOnDisk) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(name) }
+func (fsOnDisk) ReadFile(name string) ([]byte, error) {
+	content, err := os.ReadFile(name)
+	return content, errors.Wrap(err)
+}
 
-// WriteFile delegates to ioutil.WriteFile with read/write permissions.
+// WriteFile delegates to os.WriteFile with read/write permissions.
 func (fsOnDisk) WriteFile(name string, c []byte) error {
-	return errors.Wrap(ioutil.WriteFile(name, c, 0666)) //nolint:gosec
+	return errors.Wrap(os.WriteFile(name, c, 0666)) //nolint:gosec
 }
 
 // Walk delegates to filepath.Walk.

vendor/sigs.k8s.io/kustomize/kyaml/filesys/util.go

@@ -87,13 +87,13 @@ func PathJoin(incoming []string) string {
 //
 // * An empty part results in no change.
 //
-// * Absolute paths get their leading '/' stripped, treated like
+//   - Absolute paths get their leading '/' stripped, treated like
 //     relative paths, and the leading '/' is re-added on output.
 //     The meaning of pos is intentionally the same in either absolute or
 //     relative paths; if it weren't, this function could convert absolute
 //     paths to relative paths, which is not desirable.
 //
-// * For robustness (liberal input, conservative output) Pos values that
+//   - For robustness (liberal input, conservative output) Pos values
 //     that are too small (large) to index the split filepath result in a
 //     prefix (postfix) rather than an error.  Use extreme position values
 //     to assure a prefix or postfix (e.g. 0 will always prefix, and

vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil/functiontypes.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"sigs.k8s.io/kustomize/kyaml/yaml"
+	k8syaml "sigs.k8s.io/yaml"
 )
 
 const (
@@ -200,50 +201,57 @@ func (s *StorageMount) String() string {
 //
 // The FunctionSpec is read from the resource metadata.annotation
 // "config.kubernetes.io/function"
-func GetFunctionSpec(n *yaml.RNode) *FunctionSpec {
+func GetFunctionSpec(n *yaml.RNode) (*FunctionSpec, error) {
 	meta, err := n.GetMeta()
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("failed to get ResourceMeta: %w", err)
 	}
-	if fn := getFunctionSpecFromAnnotation(n, meta); fn != nil {
+
-		return fn
+	fn, err := getFunctionSpecFromAnnotation(n, meta)
+	if err != nil {
+		return nil, err
+	}
+	if fn != nil {
+		return fn, nil
 	}
 
 	// legacy function specification for backwards compatibility
 	container := meta.Annotations["config.kubernetes.io/container"]
 	if container != "" {
-		return &FunctionSpec{Container: ContainerSpec{Image: container}}
+		return &FunctionSpec{Container: ContainerSpec{Image: container}}, nil
 	}
-	return nil
+	return nil, nil
 }
 
 // getFunctionSpecFromAnnotation parses the config function from an annotation
 // if it is found
-func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) *FunctionSpec {
+func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) (*FunctionSpec, error) {
 	var fs FunctionSpec
 	for _, s := range functionAnnotationKeys {
 		fn := meta.Annotations[s]
 		if fn != "" {
-			err := yaml.Unmarshal([]byte(fn), &fs)
+			if err := k8syaml.UnmarshalStrict([]byte(fn), &fs); err != nil {
-			if err != nil {
+				return nil, fmt.Errorf("%s unmarshal error: %w", s, err)
-				fmt.Fprintf(os.Stderr, "%v\n", err)
 			}
-			return &fs
+			return &fs, nil
 		}
 	}
 	n, err := n.Pipe(yaml.Lookup("metadata", "configFn"))
-	if err != nil || yaml.IsMissingOrNull(n) {
+	if err != nil {
-		return nil
+		return nil, fmt.Errorf("failed to look up metadata.configFn: %w", err)
+	}
+	if yaml.IsMissingOrNull(n) {
+		return nil, nil
 	}
 	s, err := n.String()
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "%v\n", err)
+		fmt.Fprintf(os.Stderr, "configFn parse error: %v\n", err)
+		return nil, fmt.Errorf("configFn parse error: %w", err)
 	}
-	err = yaml.Unmarshal([]byte(s), &fs)
+	if err := k8syaml.UnmarshalStrict([]byte(s), &fs); err != nil {
-	if err != nil {
+		return nil, fmt.Errorf("%s unmarshal error: %w", "configFn", err)
-		fmt.Fprintf(os.Stderr, "%v\n", err)
 	}
-	return &fs
+	return &fs, nil
 }
 
 func StringToStorageMount(s string) StorageMount {
@@ -288,7 +296,11 @@ type IsReconcilerFilter struct {
 func (c *IsReconcilerFilter) Filter(inputs []*yaml.RNode) ([]*yaml.RNode, error) {
 	var out []*yaml.RNode
 	for i := range inputs {
-		isFnResource := GetFunctionSpec(inputs[i]) != nil
+		functionSpec, err := GetFunctionSpec(inputs[i])
+		if err != nil {
+			return nil, err
+		}
+		isFnResource := functionSpec != nil
 		if isFnResource && !c.ExcludeReconcilers {
 			out = append(out, inputs[i])
 		}