Update kubectl kustomize to kyaml/v0.13.6, cmd/config/v0.10.6, api/v0.11.4, kustomize/v4.5.4

vendor/modules.txt

@@ -2327,8 +2327,7 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
 # sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 => sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2
 sigs.k8s.io/json
 sigs.k8s.io/json/internal/golang/encoding/json
-# sigs.k8s.io/kustomize/api v0.10.1 => sigs.k8s.io/kustomize/api v0.10.1
-sigs.k8s.io/kustomize/api/builtins
+# sigs.k8s.io/kustomize/api v0.11.4 => sigs.k8s.io/kustomize/api v0.11.4
 sigs.k8s.io/kustomize/api/filters/annotations
 sigs.k8s.io/kustomize/api/filters/fieldspec
 sigs.k8s.io/kustomize/api/filters/filtersutil
@@ -2340,15 +2339,17 @@ sigs.k8s.io/kustomize/api/filters/nameref
 sigs.k8s.io/kustomize/api/filters/namespace
 sigs.k8s.io/kustomize/api/filters/patchjson6902
 sigs.k8s.io/kustomize/api/filters/patchstrategicmerge
-sigs.k8s.io/kustomize/api/filters/prefixsuffix
+sigs.k8s.io/kustomize/api/filters/prefix
 sigs.k8s.io/kustomize/api/filters/refvar
 sigs.k8s.io/kustomize/api/filters/replacement
 sigs.k8s.io/kustomize/api/filters/replicacount
+sigs.k8s.io/kustomize/api/filters/suffix
 sigs.k8s.io/kustomize/api/filters/valueadd
 sigs.k8s.io/kustomize/api/hasher
 sigs.k8s.io/kustomize/api/ifc
 sigs.k8s.io/kustomize/api/image
 sigs.k8s.io/kustomize/api/internal/accumulator
+sigs.k8s.io/kustomize/api/internal/builtins
 sigs.k8s.io/kustomize/api/internal/generators
 sigs.k8s.io/kustomize/api/internal/git
 sigs.k8s.io/kustomize/api/internal/kusterr
@@ -2371,9 +2372,9 @@ sigs.k8s.io/kustomize/api/provider
 sigs.k8s.io/kustomize/api/resmap
 sigs.k8s.io/kustomize/api/resource
 sigs.k8s.io/kustomize/api/types
-# sigs.k8s.io/kustomize/kustomize/v4 v4.4.1 => sigs.k8s.io/kustomize/kustomize/v4 v4.4.1
+# sigs.k8s.io/kustomize/kustomize/v4 v4.5.4 => sigs.k8s.io/kustomize/kustomize/v4 v4.5.4
 sigs.k8s.io/kustomize/kustomize/v4/commands/build
-# sigs.k8s.io/kustomize/kyaml v0.13.0 => sigs.k8s.io/kustomize/kyaml v0.13.0
+# sigs.k8s.io/kustomize/kyaml v0.13.6 => sigs.k8s.io/kustomize/kyaml v0.13.6
 sigs.k8s.io/kustomize/kyaml/comments
 sigs.k8s.io/kustomize/kyaml/errors
 sigs.k8s.io/kustomize/kyaml/ext
@@ -2762,9 +2763,9 @@ sigs.k8s.io/yaml
 # rsc.io/pdf => rsc.io/pdf v0.1.1
 # sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30
 # sigs.k8s.io/json => sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2
-# sigs.k8s.io/kustomize/api => sigs.k8s.io/kustomize/api v0.10.1
-# sigs.k8s.io/kustomize/cmd/config => sigs.k8s.io/kustomize/cmd/config v0.10.2
-# sigs.k8s.io/kustomize/kustomize/v4 => sigs.k8s.io/kustomize/kustomize/v4 v4.4.1
-# sigs.k8s.io/kustomize/kyaml => sigs.k8s.io/kustomize/kyaml v0.13.0
+# sigs.k8s.io/kustomize/api => sigs.k8s.io/kustomize/api v0.11.4
+# sigs.k8s.io/kustomize/cmd/config => sigs.k8s.io/kustomize/cmd/config v0.10.6
+# sigs.k8s.io/kustomize/kustomize/v4 => sigs.k8s.io/kustomize/kustomize/v4 v4.5.4
+# sigs.k8s.io/kustomize/kyaml => sigs.k8s.io/kustomize/kyaml v0.13.6
 # sigs.k8s.io/structured-merge-diff/v4 => sigs.k8s.io/structured-merge-diff/v4 v4.2.1
 # sigs.k8s.io/yaml => sigs.k8s.io/yaml v1.2.0

vendor/sigs.k8s.io/kustomize/api/filters/annotations/annotations.go

@@ -19,9 +19,17 @@ type Filter struct {
 
 	// FsSlice contains the FieldSpecs to locate the namespace field
 	FsSlice types.FsSlice
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (f *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	f.trackableSetter.WithMutationTracker(callback)
+}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	keys := yaml.SortedMapKeys(f.Annotations)
@@ -30,7 +38,7 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
 					FsSlice: f.FsSlice,
-					SetValue: filtersutil.SetEntry(
+					SetValue: f.trackableSetter.SetEntry(
 						k, f.Annotations[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Annotations are MappingNodes.
 					CreateTag:  yaml.NodeTagMap,

vendor/sigs.k8s.io/kustomize/api/filters/fieldspec/fieldspec.go

@@ -51,9 +51,8 @@ func (fltr Filter) Filter(obj *yaml.RNode) (*yaml.RNode, error) {
 	}
 	fltr.path = utils.PathSplitter(fltr.FieldSpec.Path, "/")
 	if err := fltr.filter(obj); err != nil {
-		s, _ := obj.String()
 		return nil, errors.WrapPrefixf(err,
-			"considering field '%s' of object\n%v", fltr.FieldSpec.Path, s)
+			"considering field '%s' of object %s", fltr.FieldSpec.Path, resid.FromRNode(obj))
 	}
 	return obj, nil
 }
@@ -138,6 +137,8 @@ func (fltr Filter) handleMap(obj *yaml.RNode) error {
 // seq calls filter on all sequence elements
 func (fltr Filter) handleSequence(obj *yaml.RNode) error {
 	if err := obj.VisitElements(func(node *yaml.RNode) error {
+		// set an accurate FieldPath for nested elements
+		node.AppendToFieldPath(obj.FieldPath()...)
 		// recurse on each element -- re-allocating a Filter is
 		// not strictly required, but is more consistent with field
 		// and less likely to have side effects

vendor/sigs.k8s.io/kustomize/api/filters/filtersutil/setters.go

@@ -21,9 +21,6 @@ func SetEntry(key, value, tag string) SetFn {
 		Value: value,
 		Tag:   tag,
 	}
-	if tag == yaml.NodeTagString && yaml.IsYaml1_1NonString(n) {
-		n.Style = yaml.DoubleQuotedStyle
-	}
 	return func(node *yaml.RNode) error {
 		return node.PipeE(yaml.FieldSetter{
 			Name:  key,
@@ -31,3 +28,39 @@ func SetEntry(key, value, tag string) SetFn {
 		})
 	}
 }
+
+type TrackableSetter struct {
+	// SetValueCallback will be invoked each time a field is set
+	setValueCallback func(key, value, tag string, node *yaml.RNode)
+}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (s *TrackableSetter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	s.setValueCallback = callback
+}
+
+// SetScalar returns a SetFn to set a scalar value
+// if a mutation tracker has been registered, the tracker will be invoked each
+// time a scalar is set
+func (s TrackableSetter) SetScalar(value string) SetFn {
+	origSetScalar := SetScalar(value)
+	return func(node *yaml.RNode) error {
+		if s.setValueCallback != nil {
+			s.setValueCallback("", value, "", node)
+		}
+		return origSetScalar(node)
+	}
+}
+
+// SetEntry returns a SetFn to set an entry in a map
+// if a mutation tracker has been registered, the tracker will be invoked each
+// time an entry is set
+func (s TrackableSetter) SetEntry(key, value, tag string) SetFn {
+	origSetEntry := SetEntry(key, value, tag)
+	return func(node *yaml.RNode) error {
+		if s.setValueCallback != nil {
+			s.setValueCallback(key, value, tag, node)
+		}
+		return origSetEntry(node)
+	}
+}

vendor/sigs.k8s.io/kustomize/api/filters/imagetag/imagetag.go

@@ -23,9 +23,17 @@ type Filter struct {
 	// FsSlice contains the FieldSpecs to locate an image field,
 	// e.g. Path: "spec/myContainers[]/image"
 	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (f *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	f.trackableSetter.WithMutationTracker(callback)
+}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	_, err := kio.FilterAll(yaml.FilterFunc(f.filter)).Filter(nodes)
@@ -40,8 +48,11 @@ func (f Filter) filter(node *yaml.RNode) (*yaml.RNode, error) {
 		return node, nil
 	}
 	if err := node.PipeE(fsslice.Filter{
-		FsSlice:  f.FsSlice,
-		SetValue: updateImageTagFn(f.ImageTag),
+		FsSlice: f.FsSlice,
+		SetValue: imageTagUpdater{
+			ImageTag:        f.ImageTag,
+			trackableSetter: f.trackableSetter,
+		}.SetImageValue,
 	}); err != nil {
 		return nil, err
 	}
@@ -59,11 +70,3 @@ func (f Filter) isOnDenyList(node *yaml.RNode) bool {
 	// https://github.com/kubernetes-sigs/kustomize/issues/890
 	return meta.Kind == `CustomResourceDefinition`
 }
-
-func updateImageTagFn(imageTag types.Image) filtersutil.SetFn {
-	return func(node *yaml.RNode) error {
-		return node.PipeE(imageTagUpdater{
-			ImageTag: imageTag,
-		})
-	}
-}

vendor/sigs.k8s.io/kustomize/api/filters/imagetag/updater.go

@@ -4,6 +4,7 @@
 package imagetag
 
 import (
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 	"sigs.k8s.io/kustomize/api/image"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -13,31 +14,53 @@ import (
 // that will update the value of the yaml node based on the provided
 // ImageTag if the current value matches the format of an image reference.
 type imageTagUpdater struct {
-	Kind     string      `yaml:"kind,omitempty"`
-	ImageTag types.Image `yaml:"imageTag,omitempty"`
+	Kind            string      `yaml:"kind,omitempty"`
+	ImageTag        types.Image `yaml:"imageTag,omitempty"`
+	trackableSetter filtersutil.TrackableSetter
 }
 
-func (u imageTagUpdater) Filter(rn *yaml.RNode) (*yaml.RNode, error) {
+func (u imageTagUpdater) SetImageValue(rn *yaml.RNode) error {
 	if err := yaml.ErrorIfInvalid(rn, yaml.ScalarNode); err != nil {
-		return nil, err
+		return err
 	}
 
 	value := rn.YNode().Value
 
 	if !image.IsImageMatched(value, u.ImageTag.Name) {
-		return rn, nil
+		return nil
 	}
 
-	name, tag := image.Split(value)
+	name, tag, digest := image.Split(value)
 	if u.ImageTag.NewName != "" {
 		name = u.ImageTag.NewName
 	}
-	if u.ImageTag.NewTag != "" {
-		tag = ":" + u.ImageTag.NewTag
-	}
-	if u.ImageTag.Digest != "" {
-		tag = "@" + u.ImageTag.Digest
+
+	// overriding tag or digest will replace both original tag and digest values
+	if u.ImageTag.NewTag != "" && u.ImageTag.Digest != "" {
+		tag = u.ImageTag.NewTag
+		digest = u.ImageTag.Digest
+	} else if u.ImageTag.NewTag != "" {
+		tag = u.ImageTag.NewTag
+		digest = ""
+	} else if u.ImageTag.Digest != "" {
+		tag = ""
+		digest = u.ImageTag.Digest
 	}
 
-	return rn.Pipe(yaml.FieldSetter{StringValue: name + tag})
+	// build final image name
+	if tag != "" {
+		name += ":" + tag
+	}
+	if digest != "" {
+		name += "@" + digest
+	}
+
+	return u.trackableSetter.SetScalar(name)(rn)
+}
+
+func (u imageTagUpdater) Filter(rn *yaml.RNode) (*yaml.RNode, error) {
+	if err := u.SetImageValue(rn); err != nil {
+		return nil, err
+	}
+	return rn, nil
 }

vendor/sigs.k8s.io/kustomize/api/filters/labels/labels.go

@@ -20,9 +20,17 @@ type Filter struct {
 
 	// FsSlice identifies the label fields.
 	FsSlice types.FsSlice
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (f *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	f.trackableSetter.WithMutationTracker(callback)
+}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	keys := yaml.SortedMapKeys(f.Labels)
@@ -31,7 +39,7 @@ func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 			for _, k := range keys {
 				if err := node.PipeE(fsslice.Filter{
 					FsSlice: f.FsSlice,
-					SetValue: filtersutil.SetEntry(
+					SetValue: f.trackableSetter.SetEntry(
 						k, f.Labels[k], yaml.NodeTagString),
 					CreateKind: yaml.MappingNode, // Labels are MappingNodes.
 					CreateTag:  yaml.NodeTagMap,

vendor/sigs.k8s.io/kustomize/api/filters/namespace/namespace.go

@@ -18,9 +18,17 @@ type Filter struct {
 
 	// FsSlice contains the FieldSpecs to locate the namespace field
 	FsSlice types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (ns *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	ns.trackableSetter.WithMutationTracker(callback)
+}
 
 func (ns Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(ns.run)).Filter(nodes)
@@ -44,7 +52,7 @@ func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 	// transformations based on data -- :)
 	err := node.PipeE(fsslice.Filter{
 		FsSlice:    ns.FsSlice,
-		SetValue:   filtersutil.SetScalar(ns.Namespace),
+		SetValue:   ns.trackableSetter.SetEntry("", ns.Namespace, yaml.NodeTagString),
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
 		CreateTag:  yaml.NodeTagString,
 	})
@@ -77,7 +85,7 @@ func (ns Filter) metaNamespaceHack(obj *yaml.RNode, gvk resid.Gvk) error {
 		FsSlice: []types.FieldSpec{
 			{Path: types.MetadataNamespacePath, CreateIfNotPresent: true},
 		},
-		SetValue:   filtersutil.SetScalar(ns.Namespace),
+		SetValue:   ns.trackableSetter.SetEntry("", ns.Namespace, yaml.NodeTagString),
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
 	}
 	_, err := f.Filter(obj)
@@ -123,11 +131,15 @@ func (ns Filter) roleBindingHack(obj *yaml.RNode, gvk resid.Gvk) error {
 		}
 
 		// set the namespace for the default account
-		v := yaml.NewScalarRNode(ns.Namespace)
-		return o.PipeE(
+		node, err := o.Pipe(
 			yaml.LookupCreate(yaml.ScalarNode, "namespace"),
-			yaml.FieldSetter{Value: v},
 		)
+		if err != nil {
+			return err
+		}
+
+		return ns.trackableSetter.SetEntry("", ns.Namespace, yaml.NodeTagString)(node)
+
 	})
 
 	return err

vendor/sigs.k8s.io/kustomize/api/filters/prefix/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package prefix contains a kio.Filter implementation of the kustomize
+// PrefixTransformer.
+package prefix

vendor/sigs.k8s.io/kustomize/api/filters/prefix/prefix.go

@@ -1,7 +1,7 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package prefixsuffix
+package prefix
 
 import (
 	"fmt"
@@ -13,15 +13,22 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// Filter applies resource name prefix's and suffix's using the fieldSpecs
+// Filter applies resource name prefix's using the fieldSpecs
 type Filter struct {
 	Prefix string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
-	Suffix string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
 
 	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (f *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	f.trackableSetter.WithMutationTracker(callback)
+}
 
 func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
@@ -38,6 +45,6 @@ func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 }
 
 func (f Filter) evaluateField(node *yaml.RNode) error {
-	return filtersutil.SetScalar(fmt.Sprintf(
-		"%s%s%s", f.Prefix, node.YNode().Value, f.Suffix))(node)
+	return f.trackableSetter.SetScalar(fmt.Sprintf(
+		"%s%s", f.Prefix, node.YNode().Value))(node)
 }

vendor/sigs.k8s.io/kustomize/api/filters/prefixsuffix/doc.go

@@ -1,6 +0,0 @@
-// Copyright 2020 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package prefixsuffix contains a kio.Filter implementation of the kustomize
-// PrefixSuffixTransformer.
-package prefixsuffix

vendor/sigs.k8s.io/kustomize/api/filters/replacement/replacement.go

@@ -119,13 +119,13 @@ func applyToNode(node *yaml.RNode, value *yaml.RNode, target *types.TargetSelect
 		if target.Options != nil && target.Options.Create {
 			t, err = node.Pipe(yaml.LookupCreate(value.YNode().Kind, fieldPath...))
 		} else {
-			t, err = node.Pipe(yaml.Lookup(fieldPath...))
+			t, err = node.Pipe(&yaml.PathMatcher{Path: fieldPath})
 		}
 		if err != nil {
 			return err
 		}
 		if t != nil {
-			if err = setTargetValue(target.Options, t, value); err != nil {
+			if err = applyToOneNode(target.Options, t, value); err != nil {
 				return err
 			}
 		}
@@ -133,6 +133,27 @@ func applyToNode(node *yaml.RNode, value *yaml.RNode, target *types.TargetSelect
 	return nil
 }
 
+func applyToOneNode(options *types.FieldOptions, t *yaml.RNode, value *yaml.RNode) error {
+	if len(t.YNode().Content) == 0 {
+		if err := setTargetValue(options, t, value); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	for _, scalarNode := range t.YNode().Content {
+		if options != nil && options.Create {
+			return fmt.Errorf("cannot use create option in a multi-value target")
+		}
+		rn := yaml.NewRNode(scalarNode)
+		if err := setTargetValue(options, rn, value); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 func setTargetValue(options *types.FieldOptions, t *yaml.RNode, value *yaml.RNode) error {
 	value = value.Copy()
 	if options != nil && options.Delimiter != "" {
@@ -152,7 +173,14 @@ func setTargetValue(options *types.FieldOptions, t *yaml.RNode, value *yaml.RNod
 		}
 		value.YNode().Value = strings.Join(tv, options.Delimiter)
 	}
-	t.SetYNode(value.YNode())
+
+	if t.YNode().Kind == yaml.ScalarNode {
+		// For scalar, only copy the value (leave any type intact to auto-convert int->string or string->int)
+		t.YNode().Value = value.YNode().Value
+	} else {
+		t.SetYNode(value.YNode())
+	}
+
 	return nil
 }
 
@@ -172,7 +200,7 @@ func getReplacement(nodes []*yaml.RNode, r *types.Replacement) (*yaml.RNode, err
 		return nil, err
 	}
 	if rn.IsNilOrEmpty() {
-		return nil, fmt.Errorf("fieldPath `%s` is missing for replacement source %s", r.Source.FieldPath, r.Source)
+		return nil, fmt.Errorf("fieldPath `%s` is missing for replacement source %s", r.Source.FieldPath, r.Source.ResId)
 	}
 
 	return getRefinedValue(r.Source.Options, rn)

vendor/sigs.k8s.io/kustomize/api/filters/replicacount/replicacount.go

@@ -14,9 +14,17 @@ import (
 type Filter struct {
 	Replica   types.Replica   `json:"replica,omitempty" yaml:"replica,omitempty"`
 	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+
+	trackableSetter filtersutil.TrackableSetter
 }
 
 var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (rc *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	rc.trackableSetter.WithMutationTracker(callback)
+}
 
 func (rc Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 	return kio.FilterAll(yaml.FilterFunc(rc.run)).Filter(nodes)
@@ -33,5 +41,5 @@ func (rc Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 }
 
 func (rc Filter) set(node *yaml.RNode) error {
-	return filtersutil.SetScalar(strconv.FormatInt(rc.Replica.Count, 10))(node)
+	return rc.trackableSetter.SetEntry("", strconv.FormatInt(rc.Replica.Count, 10), yaml.NodeTagInt)(node)
 }

vendor/sigs.k8s.io/kustomize/api/filters/suffix/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package suffix contains a kio.Filter implementation of the kustomize
+// SuffixTransformer.
+package suffix

vendor/sigs.k8s.io/kustomize/api/filters/suffix/suffix.go

@@ -0,0 +1,50 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package suffix
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/filters/fieldspec"
+	"sigs.k8s.io/kustomize/api/filters/filtersutil"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Filter applies resource name suffix's using the fieldSpecs
+type Filter struct {
+	Suffix string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+
+	FieldSpec types.FieldSpec `json:"fieldSpec,omitempty" yaml:"fieldSpec,omitempty"`
+
+	trackableSetter filtersutil.TrackableSetter
+}
+
+var _ kio.Filter = Filter{}
+var _ kio.TrackableFilter = &Filter{}
+
+// WithMutationTracker registers a callback which will be invoked each time a field is mutated
+func (f *Filter) WithMutationTracker(callback func(key, value, tag string, node *yaml.RNode)) {
+	f.trackableSetter.WithMutationTracker(callback)
+}
+
+func (f Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
+	return kio.FilterAll(yaml.FilterFunc(f.run)).Filter(nodes)
+}
+
+func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
+	err := node.PipeE(fieldspec.Filter{
+		FieldSpec:  f.FieldSpec,
+		SetValue:   f.evaluateField,
+		CreateKind: yaml.ScalarNode, // Name is a ScalarNode
+		CreateTag:  yaml.NodeTagString,
+	})
+	return node, err
+}
+
+func (f Filter) evaluateField(node *yaml.RNode) error {
+	return f.trackableSetter.SetScalar(fmt.Sprintf(
+		"%s%s", node.YNode().Value, f.Suffix))(node)
+}

vendor/sigs.k8s.io/kustomize/api/image/image.go

@@ -14,37 +14,53 @@ func IsImageMatched(s, t string) bool {
 	// Tag values are limited to [a-zA-Z0-9_.{}-].
 	// Some tools like Bazel rules_k8s allow tag patterns with {} characters.
 	// More info: https://github.com/bazelbuild/rules_k8s/pull/423
-	pattern, _ := regexp.Compile("^" + t + "(@sha256)?(:[a-zA-Z0-9_.{}-]*)?$")
+	pattern, _ := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@sha256:[a-zA-Z0-9_.{}-]*)?$")
 	return pattern.MatchString(s)
 }
 
 // Split separates and returns the name and tag parts
 // from the image string using either colon `:` or at `@` separators.
-// Note that the returned tag keeps its separator.
-func Split(imageName string) (name string, tag string) {
+// image reference pattern: [[host[:port]/]component/]component[:tag][@digest]
+func Split(imageName string) (name string, tag string, digest string) {
 	// check if image name contains a domain
 	// if domain is present, ignore domain and check for `:`
-	ic := -1
-	if slashIndex := strings.Index(imageName, "/"); slashIndex < 0 {
-		ic = strings.LastIndex(imageName, ":")
+	searchName := imageName
+	slashIndex := strings.Index(imageName, "/")
+	if slashIndex > 0 {
+		searchName = imageName[slashIndex:]
 	} else {
-		lastIc := strings.LastIndex(imageName[slashIndex:], ":")
-		// set ic only if `:` is present
-		if lastIc > 0 {
-			ic = slashIndex + lastIc
-		}
-	}
-	ia := strings.LastIndex(imageName, "@")
-	if ic < 0 && ia < 0 {
-		return imageName, ""
+		slashIndex = 0
 	}
 
-	i := ic
-	if ia > 0 {
-		i = ia
+	id := strings.Index(searchName, "@")
+	ic := strings.Index(searchName, ":")
+
+	// no tag or digest
+	if ic < 0 && id < 0 {
+		return imageName, "", ""
 	}
 
-	name = imageName[:i]
-	tag = imageName[i:]
-	return
+	// digest only
+	if id >= 0 && (id < ic || ic < 0) {
+		id += slashIndex
+		name = imageName[:id]
+		digest = strings.TrimPrefix(imageName[id:], "@")
+		return name, "", digest
+	}
+
+	// tag and digest
+	if id >= 0 && ic >= 0 {
+		id += slashIndex
+		ic += slashIndex
+		name = imageName[:ic]
+		tag = strings.TrimPrefix(imageName[ic:id], ":")
+		digest = strings.TrimPrefix(imageName[id:], "@")
+		return name, tag, digest
+	}
+
+	// tag only
+	ic += slashIndex
+	name = imageName[:ic]
+	tag = strings.TrimPrefix(imageName[ic:], ":")
+	return name, tag, ""
 }

vendor/sigs.k8s.io/kustomize/api/internal/accumulator/namereferencetransformer.go

@@ -52,7 +52,10 @@ func (t *nameReferenceTransformer) Transform(m resmap.ResMap) error {
 	fMap := t.determineFilters(m.Resources())
 	debug(fMap)
 	for r, fList := range fMap {
-		c := m.SubsetThatCouldBeReferencedByResource(r)
+		c, err := m.SubsetThatCouldBeReferencedByResource(r)
+		if err != nil {
+			return err
+		}
 		for _, f := range fList {
 			f.Referrer = r
 			f.ReferralCandidates = c

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PrefixTransformer.go

@@ -1,4 +1,4 @@
-// Code generated by pluginator on PrefixSuffixTransformer; DO NOT EDIT.
+// Code generated by pluginator on PrefixTransformer; DO NOT EDIT.
 // pluginator {unknown  1970-01-01T00:00:00Z  }
 
 package builtins
@@ -6,32 +6,29 @@ package builtins
 import (
 	"errors"
 
-	"sigs.k8s.io/kustomize/api/filters/prefixsuffix"
+	"sigs.k8s.io/kustomize/api/filters/prefix"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/resid"
-	"sigs.k8s.io/yaml"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// Add the given prefix and suffix to the field.
-type PrefixSuffixTransformerPlugin struct {
+// Add the given prefix to the field
+type PrefixTransformerPlugin struct {
 	Prefix     string        `json:"prefix,omitempty" yaml:"prefix,omitempty"`
-	Suffix     string        `json:"suffix,omitempty" yaml:"suffix,omitempty"`
 	FieldSpecs types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 }
 
-// A Gvk skip list for prefix/suffix modification.
-// hard coded for now - eventually should be part of config.
-var prefixSuffixFieldSpecsToSkip = types.FsSlice{
+// TODO: Make this gvk skip list part of the config.
+var prefixFieldSpecsToSkip = types.FsSlice{
 	{Gvk: resid.Gvk{Kind: "CustomResourceDefinition"}},
 	{Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"}},
 	{Gvk: resid.Gvk{Kind: "Namespace"}},
 }
 
-func (p *PrefixSuffixTransformerPlugin) Config(
+func (p *PrefixTransformerPlugin) Config(
 	_ *resmap.PluginHelpers, c []byte) (err error) {
 	p.Prefix = ""
-	p.Suffix = ""
 	p.FieldSpecs = nil
 	err = yaml.Unmarshal(c, p)
 	if err != nil {
@@ -43,10 +40,10 @@ func (p *PrefixSuffixTransformerPlugin) Config(
 	return
 }
 
-func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
-	// Even if both the Prefix and Suffix are empty we want
-	// to proceed with the transformation. This allows to add contextual
-	// information to the resources (AddNamePrefix and AddNameSuffix).
+func (p *PrefixTransformerPlugin) Transform(m resmap.ResMap) error {
+	// Even if the Prefix is empty we want to proceed with the
+	// transformation. This allows to add contextual information
+	// to the resources (AddNamePrefix).
 	for _, r := range m.Resources() {
 		// TODO: move this test into the filter (i.e. make a better filter)
 		if p.shouldSkip(r.OrgId()) {
@@ -61,21 +58,21 @@ func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
 				continue
 			}
 			// TODO: move this test into the filter.
-			if smellsLikeANameChange(&fs) {
+			if fs.Path == "metadata/name" {
 				// "metadata/name" is the only field.
-				// this will add a prefix and a suffix
-				// to the resource even if those are
-				// empty
+				// this will add a prefix to the resource
+				// even if it is empty
 
 				r.AddNamePrefix(p.Prefix)
-				r.AddNameSuffix(p.Suffix)
-				if p.Prefix != "" || p.Suffix != "" {
+				if p.Prefix != "" {
+					// TODO: There are multiple transformers that can change a resource's name, and each makes a call to
+					// StorePreviousID(). We should make it so that we only call StorePreviousID once per kustomization layer
+					// to avoid storing intermediate names between transformations, to prevent intermediate name conflicts.
 					r.StorePreviousId()
 				}
 			}
-			if err := r.ApplyFilter(prefixsuffix.Filter{
+			if err := r.ApplyFilter(prefix.Filter{
 				Prefix:    p.Prefix,
-				Suffix:    p.Suffix,
 				FieldSpec: fs,
 			}); err != nil {
 				return err
@@ -85,12 +82,8 @@ func (p *PrefixSuffixTransformerPlugin) Transform(m resmap.ResMap) error {
 	return nil
 }
 
-func smellsLikeANameChange(fs *types.FieldSpec) bool {
-	return fs.Path == "metadata/name"
-}
-
-func (p *PrefixSuffixTransformerPlugin) shouldSkip(id resid.ResId) bool {
-	for _, path := range prefixSuffixFieldSpecsToSkip {
+func (p *PrefixTransformerPlugin) shouldSkip(id resid.ResId) bool {
+	for _, path := range prefixFieldSpecsToSkip {
 		if id.IsSelected(&path.Gvk) {
 			return true
 		}
@@ -98,6 +91,6 @@ func (p *PrefixSuffixTransformerPlugin) shouldSkip(id resid.ResId) bool {
 	return false
 }
 
-func NewPrefixSuffixTransformerPlugin() resmap.TransformerPlugin {
-	return &PrefixSuffixTransformerPlugin{}
+func NewPrefixTransformerPlugin() resmap.TransformerPlugin {
+	return &PrefixTransformerPlugin{}
 }

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ReplacementTransformer.go

@@ -5,6 +5,7 @@ package builtins
 
 import (
 	"fmt"
+	"reflect"
 
 	"sigs.k8s.io/kustomize/api/filters/replacement"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -35,11 +36,29 @@ func (p *ReplacementTransformerPlugin) Config(
 			if err != nil {
 				return err
 			}
-			repl := types.Replacement{}
-			if err := yaml.Unmarshal(content, &repl); err != nil {
+			// find if the path contains a a list of replacements or a single replacement
+			var replacement interface{}
+			err = yaml.Unmarshal(content, &replacement)
+			if err != nil {
 				return err
 			}
-			p.Replacements = append(p.Replacements, repl)
+			items := reflect.ValueOf(replacement)
+			switch items.Kind() {
+			case reflect.Slice:
+				repl := []types.Replacement{}
+				if err := yaml.Unmarshal(content, &repl); err != nil {
+					return err
+				}
+				p.Replacements = append(p.Replacements, repl...)
+			case reflect.Map:
+				repl := types.Replacement{}
+				if err := yaml.Unmarshal(content, &repl); err != nil {
+					return err
+				}
+				p.Replacements = append(p.Replacements, repl)
+			default:
+				return fmt.Errorf("unsupported replacement type encountered within replacement path: %v", items.Kind())
+			}
 		} else {
 			// replacement information is already loaded
 			p.Replacements = append(p.Replacements, r.Replacement)

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SuffixTransformer.go

@@ -0,0 +1,96 @@
+// Code generated by pluginator on SuffixTransformer; DO NOT EDIT.
+// pluginator {unknown  1970-01-01T00:00:00Z  }
+
+package builtins
+
+import (
+	"errors"
+
+	"sigs.k8s.io/kustomize/api/filters/suffix"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// Add the given suffix to the field
+type SuffixTransformerPlugin struct {
+	Suffix     string        `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+	FieldSpecs types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+}
+
+// TODO: Make this gvk skip list part of the config.
+var suffixFieldSpecsToSkip = types.FsSlice{
+	{Gvk: resid.Gvk{Kind: "CustomResourceDefinition"}},
+	{Gvk: resid.Gvk{Group: "apiregistration.k8s.io", Kind: "APIService"}},
+	{Gvk: resid.Gvk{Kind: "Namespace"}},
+}
+
+func (p *SuffixTransformerPlugin) Config(
+	_ *resmap.PluginHelpers, c []byte) (err error) {
+	p.Suffix = ""
+	p.FieldSpecs = nil
+	err = yaml.Unmarshal(c, p)
+	if err != nil {
+		return
+	}
+	if p.FieldSpecs == nil {
+		return errors.New("fieldSpecs is not expected to be nil")
+	}
+	return
+}
+
+func (p *SuffixTransformerPlugin) Transform(m resmap.ResMap) error {
+	// Even if the Suffix is empty we want to proceed with the
+	// transformation. This allows to add contextual information
+	// to the resources (AddNameSuffix).
+	for _, r := range m.Resources() {
+		// TODO: move this test into the filter (i.e. make a better filter)
+		if p.shouldSkip(r.OrgId()) {
+			continue
+		}
+		id := r.OrgId()
+		// current default configuration contains
+		// only one entry: "metadata/name" with no GVK
+		for _, fs := range p.FieldSpecs {
+			// TODO: this is redundant to filter (but needed for now)
+			if !id.IsSelected(&fs.Gvk) {
+				continue
+			}
+			// TODO: move this test into the filter.
+			if fs.Path == "metadata/name" {
+				// "metadata/name" is the only field.
+				// this will add a suffix to the resource
+				// even if it is empty
+
+				r.AddNameSuffix(p.Suffix)
+				if p.Suffix != "" {
+					// TODO: There are multiple transformers that can change a resource's name, and each makes a call to
+					// StorePreviousID(). We should make it so that we only call StorePreviousID once per kustomization layer
+					// to avoid storing intermediate names between transformations, to prevent intermediate name conflicts.
+					r.StorePreviousId()
+				}
+			}
+			if err := r.ApplyFilter(suffix.Filter{
+				Suffix:    p.Suffix,
+				FieldSpec: fs,
+			}); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (p *SuffixTransformerPlugin) shouldSkip(id resid.ResId) bool {
+	for _, path := range suffixFieldSpecsToSkip {
+		if id.IsSelected(&path.Gvk) {
+			return true
+		}
+	}
+	return false
+}
+
+func NewSuffixTransformerPlugin() resmap.TransformerPlugin {
+	return &SuffixTransformerPlugin{}
+}

vendor/sigs.k8s.io/kustomize/api/internal/generators/utils.go

@@ -83,9 +83,15 @@ func setImmutable(
 		return nil
 	}
 	if opts.Immutable {
-		if _, err := rn.Pipe(yaml.SetField("immutable", yaml.NewScalarRNode("true"))); err != nil {
+		n := &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Value: "true",
+			Tag:   yaml.NodeTagBool,
+		}
+		if _, err := rn.Pipe(yaml.FieldSetter{Name: "immutable", Value: yaml.NewRNode(n)}); err != nil {
 			return err
 		}
 	}
+
 	return nil
 }

vendor/sigs.k8s.io/kustomize/api/internal/kusterr/yamlformaterror.go

@@ -19,6 +19,16 @@ func (e YamlFormatError) Error() string {
 	return fmt.Sprintf("YAML file [%s] encounters a format error.\n%s\n", e.Path, e.ErrorMsg)
 }
 
+// MalformedYamlError represents an error that occurred while trying to decode a given YAML.
+type MalformedYamlError struct {
+	Path     string
+	ErrorMsg string
+}
+
+func (e MalformedYamlError) Error() string {
+	return fmt.Sprintf("%s in File: %s", e.ErrorMsg, e.Path)
+}
+
 // Handler handles YamlFormatError
 func Handler(e error, path string) error {
 	if isYAMLSyntaxError(e) {
@@ -27,9 +37,19 @@ func Handler(e error, path string) error {
 			ErrorMsg: e.Error(),
 		}
 	}
+	if IsMalformedYAMLError(e) {
+		return MalformedYamlError{
+			Path:     path,
+			ErrorMsg: e.Error(),
+		}
+	}
 	return e
 }
 
 func isYAMLSyntaxError(e error) bool {
 	return strings.Contains(e.Error(), "error converting YAML to JSON") || strings.Contains(e.Error(), "error unmarshaling JSON")
 }
+
+func IsMalformedYAMLError(e error) bool {
+	return strings.Contains(e.Error(), "MalformedYAMLError")
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtinplugintype_string.go

@@ -21,16 +21,18 @@ func _() {
 	_ = x[PatchStrategicMergeTransformer-10]
 	_ = x[PatchTransformer-11]
 	_ = x[PrefixSuffixTransformer-12]
-	_ = x[ReplicaCountTransformer-13]
-	_ = x[SecretGenerator-14]
-	_ = x[ValueAddTransformer-15]
-	_ = x[HelmChartInflationGenerator-16]
-	_ = x[ReplacementTransformer-17]
+	_ = x[PrefixTransformer-13]
+	_ = x[SuffixTransformer-14]
+	_ = x[ReplicaCountTransformer-15]
+	_ = x[SecretGenerator-16]
+	_ = x[ValueAddTransformer-17]
+	_ = x[HelmChartInflationGenerator-18]
+	_ = x[ReplacementTransformer-19]
 }
 
-const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
 
-var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 137, 157, 181, 211, 227, 250, 273, 288, 307, 334, 356}
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 137, 157, 181, 211, 227, 250, 267, 284, 307, 322, 341, 368, 390}
 
 func (i BuiltinPluginType) String() string {
 	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtins.go

@@ -4,7 +4,7 @@
 package builtinhelpers
 
 import (
-	"sigs.k8s.io/kustomize/api/builtins"
+	"sigs.k8s.io/kustomize/api/internal/builtins"
 	"sigs.k8s.io/kustomize/api/resmap"
 )
 
@@ -25,6 +25,8 @@ const (
 	PatchStrategicMergeTransformer
 	PatchTransformer
 	PrefixSuffixTransformer
+	PrefixTransformer
+	SuffixTransformer
 	ReplicaCountTransformer
 	SecretGenerator
 	ValueAddTransformer
@@ -64,6 +66,35 @@ var GeneratorFactories = map[BuiltinPluginType]func() resmap.GeneratorPlugin{
 	HelmChartInflationGenerator: builtins.NewHelmChartInflationGeneratorPlugin,
 }
 
+type MultiTransformer struct {
+	transformers []resmap.TransformerPlugin
+}
+
+func (t *MultiTransformer) Transform(m resmap.ResMap) error {
+	for _, transformer := range t.transformers {
+		if err := transformer.Transform(m); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (t *MultiTransformer) Config(h *resmap.PluginHelpers, b []byte) error {
+	for _, transformer := range t.transformers {
+		if err := transformer.Config(h, b); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func NewMultiTransformer() resmap.TransformerPlugin {
+	return &MultiTransformer{[]resmap.TransformerPlugin{
+		builtins.NewPrefixTransformerPlugin(),
+		builtins.NewSuffixTransformerPlugin(),
+	}}
+}
+
 var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin{
 	AnnotationsTransformer:         builtins.NewAnnotationsTransformerPlugin,
 	HashTransformer:                builtins.NewHashTransformerPlugin,
@@ -74,7 +105,9 @@ var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin
 	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
 	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
 	PatchTransformer:               builtins.NewPatchTransformerPlugin,
-	PrefixSuffixTransformer:        builtins.NewPrefixSuffixTransformerPlugin,
+	PrefixSuffixTransformer:        NewMultiTransformer,
+	PrefixTransformer:              builtins.NewPrefixTransformerPlugin,
+	SuffixTransformer:              builtins.NewSuffixTransformerPlugin,
 	ReplacementTransformer:         builtins.NewReplacementTransformerPlugin,
 	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
 	ValueAddTransformer:            builtins.NewValueAddTransformerPlugin,

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/loader.go

@@ -53,14 +53,18 @@ func (l *Loader) SetWorkDir(wd string) {
 }
 
 func (l *Loader) LoadGenerators(
-	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]resmap.Generator, error) {
-	var result []resmap.Generator
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
+	result []*resmap.GeneratorWithProperties, err error) {
 	for _, res := range rm.Resources() {
 		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
 			return nil, err
 		}
-		result = append(result, g)
+		generatorOrigin, err := resource.OriginFromCustomPlugin(res)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, &resmap.GeneratorWithProperties{Generator: g, Origin: generatorOrigin})
 	}
 	return result, nil
 }
@@ -79,20 +83,24 @@ func (l *Loader) LoadGenerator(
 }
 
 func (l *Loader) LoadTransformers(
-	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]resmap.Transformer, error) {
-	var result []resmap.Transformer
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) ([]*resmap.TransformerWithProperties, error) {
+	var result []*resmap.TransformerWithProperties
 	for _, res := range rm.Resources() {
 		t, err := l.LoadTransformer(ldr, v, res)
 		if err != nil {
 			return nil, err
 		}
-		result = append(result, t)
+		transformerOrigin, err := resource.OriginFromCustomPlugin(res)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, &resmap.TransformerWithProperties{Transformer: t, Origin: transformerOrigin})
 	}
 	return result, nil
 }
 
 func (l *Loader) LoadTransformer(
-	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (resmap.Transformer, error) {
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource) (*resmap.TransformerWithProperties, error) {
 	c, err := l.loadAndConfigurePlugin(ldr, v, res)
 	if err != nil {
 		return nil, err
@@ -101,7 +109,7 @@ func (l *Loader) LoadTransformer(
 	if !ok {
 		return nil, fmt.Errorf("plugin %s not a transformer", res.OrgId())
 	}
-	return t, nil
+	return &resmap.TransformerWithProperties{Transformer: t}, nil
 }
 
 func relativePluginPath(id resid.ResId) string {

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget.go

@@ -11,14 +11,16 @@ import (
 
 	"github.com/pkg/errors"
 
-	"sigs.k8s.io/kustomize/api/builtins"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/internal/builtins"
+	"sigs.k8s.io/kustomize/api/internal/kusterr"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
+	load "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
@@ -29,10 +31,12 @@ import (
 // KustTarget encapsulates the entirety of a kustomization build.
 type KustTarget struct {
 	kustomization *types.Kustomization
+	kustFileName  string
 	ldr           ifc.Loader
 	validator     ifc.Validator
 	rFactory      *resmap.Factory
 	pLdr          *loader.Loader
+	origin        *resource.Origin
 }
 
 // NewKustTarget returns a new instance of KustTarget.
@@ -53,7 +57,7 @@ func NewKustTarget(
 
 // Load attempts to load the target's kustomization file.
 func (kt *KustTarget) Load() error {
-	content, err := loadKustFile(kt.ldr)
+	content, kustFileName, err := loadKustFile(kt.ldr)
 	if err != nil {
 		return err
 	}
@@ -74,6 +78,7 @@ func (kt *KustTarget) Load() error {
 				strings.Join(errs, "\n"), kt.ldr.Root())
 	}
 	kt.kustomization = &k
+	kt.kustFileName = kustFileName
 	return nil
 }
 
@@ -85,23 +90,25 @@ func (kt *KustTarget) Kustomization() types.Kustomization {
 	return result
 }
 
-func loadKustFile(ldr ifc.Loader) ([]byte, error) {
+func loadKustFile(ldr ifc.Loader) ([]byte, string, error) {
 	var content []byte
 	match := 0
+	var kustFileName string
 	for _, kf := range konfig.RecognizedKustomizationFileNames() {
 		c, err := ldr.Load(kf)
 		if err == nil {
 			match += 1
 			content = c
+			kustFileName = kf
 		}
 	}
 	switch match {
 	case 0:
-		return nil, NewErrMissingKustomization(ldr.Root())
+		return nil, "", NewErrMissingKustomization(ldr.Root())
 	case 1:
-		return content, nil
+		return content, kustFileName, nil
 	default:
-		return nil, fmt.Errorf(
+		return nil, "", fmt.Errorf(
 			"Found multiple kustomization files under: %s\n", ldr.Root())
 	}
 }
@@ -113,7 +120,12 @@ func (kt *KustTarget) MakeCustomizedResMap() (resmap.ResMap, error) {
 }
 
 func (kt *KustTarget) makeCustomizedResMap() (resmap.ResMap, error) {
-	ra, err := kt.AccumulateTarget(&resource.Origin{})
+	var origin *resource.Origin
+	if len(kt.kustomization.BuildMetadata) != 0 {
+		origin = &resource.Origin{}
+	}
+	kt.origin = origin
+	ra, err := kt.AccumulateTarget()
 	if err != nil {
 		return nil, err
 	}
@@ -165,20 +177,20 @@ func (kt *KustTarget) addHashesToNames(
 // through kustomization directories, it updates `origin.path`
 // accordingly. When a remote base is found, it updates `origin.repo`
 // and `origin.ref` accordingly.
-func (kt *KustTarget) AccumulateTarget(origin *resource.Origin) (
+func (kt *KustTarget) AccumulateTarget() (
 	ra *accumulator.ResAccumulator, err error) {
-	return kt.accumulateTarget(accumulator.MakeEmptyAccumulator(), origin)
+	return kt.accumulateTarget(accumulator.MakeEmptyAccumulator())
 }
 
 // ra should be empty when this KustTarget is a Kustomization, or the ra of the parent if this KustTarget is a Component
 // (or empty if the Component does not have a parent).
-func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator, origin *resource.Origin) (
+func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	resRa *accumulator.ResAccumulator, err error) {
-	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources, origin)
+	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources)
 	if err != nil {
 		return nil, errors.Wrap(err, "accumulating resources")
 	}
-	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components, origin)
+	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components)
 	if err != nil {
 		return nil, errors.Wrap(err, "accumulating components")
 	}
@@ -241,22 +253,29 @@ func (kt *KustTarget) IgnoreLocal(ra *accumulator.ResAccumulator) error {
 
 func (kt *KustTarget) runGenerators(
 	ra *accumulator.ResAccumulator) error {
-	var generators []resmap.Generator
+	var generators []*resmap.GeneratorWithProperties
 	gs, err := kt.configureBuiltinGenerators()
 	if err != nil {
 		return err
 	}
 	generators = append(generators, gs...)
+
 	gs, err = kt.configureExternalGenerators()
 	if err != nil {
 		return errors.Wrap(err, "loading generator plugins")
 	}
 	generators = append(generators, gs...)
-	for _, g := range generators {
+	for i, g := range generators {
 		resMap, err := g.Generate()
 		if err != nil {
 			return err
 		}
+		if resMap != nil {
+			err = resMap.AddOriginAnnotation(generators[i].Origin)
+			if err != nil {
+				return errors.Wrapf(err, "adding origin annotations for generator %v", g)
+			}
+		}
 		err = ra.AbsorbAll(resMap)
 		if err != nil {
 			return errors.Wrapf(err, "merging from generator %v", g)
@@ -265,7 +284,8 @@ func (kt *KustTarget) runGenerators(
 	return nil
 }
 
-func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error) {
+func (kt *KustTarget) configureExternalGenerators() (
+	[]*resmap.GeneratorWithProperties, error) {
 	ra := accumulator.MakeEmptyAccumulator()
 	var generatorPaths []string
 	for _, p := range kt.kustomization.Generators {
@@ -276,9 +296,17 @@ func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error)
 			generatorPaths = append(generatorPaths, p)
 			continue
 		}
+		// inline config, track the origin
+		if kt.origin != nil {
+			resources := rm.Resources()
+			for _, r := range resources {
+				r.SetOrigin(kt.origin.Append(kt.kustFileName))
+				rm.Replace(r)
+			}
+		}
 		ra.AppendAll(rm)
 	}
-	ra, err := kt.accumulateResources(ra, generatorPaths, &resource.Origin{})
+	ra, err := kt.accumulateResources(ra, generatorPaths)
 	if err != nil {
 		return nil, err
 	}
@@ -286,7 +314,7 @@ func (kt *KustTarget) configureExternalGenerators() ([]resmap.Generator, error)
 }
 
 func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
-	var r []resmap.Transformer
+	var r []*resmap.TransformerWithProperties
 	tConfig := ra.GetTransformerConfig()
 	lts, err := kt.configureBuiltinTransformers(tConfig)
 	if err != nil {
@@ -301,7 +329,7 @@ func (kt *KustTarget) runTransformers(ra *accumulator.ResAccumulator) error {
 	return ra.Transform(newMultiTransformer(r))
 }
 
-func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]resmap.Transformer, error) {
+func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]*resmap.TransformerWithProperties, error) {
 	ra := accumulator.MakeEmptyAccumulator()
 	var transformerPaths []string
 	for _, p := range transformers {
@@ -312,9 +340,17 @@ func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]re
 			transformerPaths = append(transformerPaths, p)
 			continue
 		}
+		// inline config, track the origin
+		if kt.origin != nil {
+			resources := rm.Resources()
+			for _, r := range resources {
+				r.SetOrigin(kt.origin.Append(kt.kustFileName))
+				rm.Replace(r)
+			}
+		}
 		ra.AppendAll(rm)
 	}
-	ra, err := kt.accumulateResources(ra, transformerPaths, &resource.Origin{})
+	ra, err := kt.accumulateResources(ra, transformerPaths)
 	if err != nil {
 		return nil, err
 	}
@@ -362,16 +398,32 @@ func (kt *KustTarget) removeValidatedByLabel(rm resmap.ResMap) error {
 // accumulateResources fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateResources(
-	ra *accumulator.ResAccumulator, paths []string, origin *resource.Origin) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {
 	for _, path := range paths {
 		// try loading resource as file then as base (directory or git repository)
-		if errF := kt.accumulateFile(ra, path, origin); errF != nil {
+		if errF := kt.accumulateFile(ra, path); errF != nil {
+			// not much we can do if the error is an HTTP error so we bail out
+			if errors.Is(errF, load.ErrorHTTP) {
+				return nil, errF
+			}
+			if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
+				return nil, errF
+			}
 			ldr, err := kt.ldr.New(path)
 			if err != nil {
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
 			}
-			ra, err = kt.accumulateDirectory(ra, ldr, origin.Append(path), false)
+			// store the origin, we'll need it later
+			origin := kt.origin.Copy()
+			if kt.origin != nil {
+				kt.origin = kt.origin.Append(path)
+				ra, err = kt.accumulateDirectory(ra, ldr, false)
+				// after we are done recursing through the directory, reset the origin
+				kt.origin = &origin
+			} else {
+				ra, err = kt.accumulateDirectory(ra, ldr, false)
+			}
 			if err != nil {
 				return nil, errors.Wrapf(
 					err, "accumulation err='%s'", errF.Error())
@@ -384,7 +436,7 @@ func (kt *KustTarget) accumulateResources(
 // accumulateResources fills the given resourceAccumulator
 // with resources read from the given list of paths.
 func (kt *KustTarget) accumulateComponents(
-	ra *accumulator.ResAccumulator, paths []string, origin *resource.Origin) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, paths []string) (*accumulator.ResAccumulator, error) {
 	for _, path := range paths {
 		// Components always refer to directories
 		ldr, errL := kt.ldr.New(path)
@@ -392,8 +444,16 @@ func (kt *KustTarget) accumulateComponents(
 			return nil, fmt.Errorf("loader.New %q", errL)
 		}
 		var errD error
-		origin.Path = filepath.Join(origin.Path, path)
-		ra, errD = kt.accumulateDirectory(ra, ldr, origin, true)
+		// store the origin, we'll need it later
+		origin := kt.origin.Copy()
+		if kt.origin != nil {
+			kt.origin = kt.origin.Append(path)
+			ra, errD = kt.accumulateDirectory(ra, ldr, true)
+			// after we are done recursing through the directory, reset the origin
+			kt.origin = &origin
+		} else {
+			ra, errD = kt.accumulateDirectory(ra, ldr, true)
+		}
 		if errD != nil {
 			return nil, fmt.Errorf("accumulateDirectory: %q", errD)
 		}
@@ -402,7 +462,7 @@ func (kt *KustTarget) accumulateComponents(
 }
 
 func (kt *KustTarget) accumulateDirectory(
-	ra *accumulator.ResAccumulator, ldr ifc.Loader, origin *resource.Origin, isComponent bool) (*accumulator.ResAccumulator, error) {
+	ra *accumulator.ResAccumulator, ldr ifc.Loader, isComponent bool) (*accumulator.ResAccumulator, error) {
 	defer ldr.Cleanup()
 	subKt := NewKustTarget(ldr, kt.validator, kt.rFactory, kt.pLdr)
 	err := subKt.Load()
@@ -411,6 +471,7 @@ func (kt *KustTarget) accumulateDirectory(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
+	subKt.origin = kt.origin
 	var bytes []byte
 	path := ldr.Root()
 	if openApiPath, exists := subKt.Kustomization().OpenAPI["path"]; exists {
@@ -434,12 +495,12 @@ func (kt *KustTarget) accumulateDirectory(
 	var subRa *accumulator.ResAccumulator
 	if isComponent {
 		// Components don't create a new accumulator: the kustomization directives are added to the current accumulator
-		subRa, err = subKt.accumulateTarget(ra, origin)
+		subRa, err = subKt.accumulateTarget(ra)
 		ra = accumulator.MakeEmptyAccumulator()
 	} else {
 		// Child Kustomizations create a new accumulator which resolves their kustomization directives, which will later
 		// be merged into the current accumulator.
-		subRa, err = subKt.AccumulateTarget(origin)
+		subRa, err = subKt.AccumulateTarget()
 	}
 	if err != nil {
 		return nil, errors.Wrapf(
@@ -454,17 +515,20 @@ func (kt *KustTarget) accumulateDirectory(
 }
 
 func (kt *KustTarget) accumulateFile(
-	ra *accumulator.ResAccumulator, path string, origin *resource.Origin) error {
+	ra *accumulator.ResAccumulator, path string) error {
 	resources, err := kt.rFactory.FromFile(kt.ldr, path)
 	if err != nil {
 		return errors.Wrapf(err, "accumulating resources from '%s'", path)
 	}
-	if utils.StringSliceContains(kt.kustomization.BuildMetadata, "originAnnotations") {
-		origin = origin.Append(path)
-		err = resources.AnnotateAll(utils.OriginAnnotation, origin.String())
+	if kt.origin != nil {
+		originAnno, err := kt.origin.Append(path).String()
 		if err != nil {
 			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
 		}
+		err = resources.AnnotateAll(utils.OriginAnnotationKey, originAnno)
+		if err != nil || originAnno == "" {
+			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+		}
 	}
 	err = ra.AppendAll(resources)
 	if err != nil {

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget_configplugin.go

@@ -5,11 +5,14 @@ package target
 
 import (
 	"fmt"
+	"path/filepath"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // Functions dedicated to configuring the builtin
@@ -28,7 +31,7 @@ import (
 // N plugin instances with differing configurations.
 
 func (kt *KustTarget) configureBuiltinGenerators() (
-	result []resmap.Generator, err error) {
+	result []*resmap.GeneratorWithProperties, err error) {
 	for _, bpt := range []builtinhelpers.BuiltinPluginType{
 		builtinhelpers.ConfigMapGenerator,
 		builtinhelpers.SecretGenerator,
@@ -39,19 +42,38 @@ func (kt *KustTarget) configureBuiltinGenerators() (
 		if err != nil {
 			return nil, err
 		}
-		result = append(result, r...)
+
+		var generatorOrigin *resource.Origin
+		if kt.origin != nil {
+			generatorOrigin = &resource.Origin{
+				Repo:         kt.origin.Repo,
+				Ref:          kt.origin.Ref,
+				ConfiguredIn: filepath.Join(kt.origin.Path, kt.kustFileName),
+				ConfiguredBy: yaml.ResourceIdentifier{
+					TypeMeta: yaml.TypeMeta{
+						APIVersion: "builtin",
+						Kind:       bpt.String(),
+					},
+				},
+			}
+		}
+
+		for i := range r {
+			result = append(result, &resmap.GeneratorWithProperties{Generator: r[i], Origin: generatorOrigin})
+		}
 	}
 	return result, nil
 }
 
 func (kt *KustTarget) configureBuiltinTransformers(
 	tc *builtinconfig.TransformerConfig) (
-	result []resmap.Transformer, err error) {
+	result []*resmap.TransformerWithProperties, err error) {
 	for _, bpt := range []builtinhelpers.BuiltinPluginType{
 		builtinhelpers.PatchStrategicMergeTransformer,
 		builtinhelpers.PatchTransformer,
 		builtinhelpers.NamespaceTransformer,
-		builtinhelpers.PrefixSuffixTransformer,
+		builtinhelpers.PrefixTransformer,
+		builtinhelpers.SuffixTransformer,
 		builtinhelpers.LabelTransformer,
 		builtinhelpers.AnnotationsTransformer,
 		builtinhelpers.PatchJson6902Transformer,
@@ -64,7 +86,23 @@ func (kt *KustTarget) configureBuiltinTransformers(
 		if err != nil {
 			return nil, err
 		}
-		result = append(result, r...)
+		var transformerOrigin *resource.Origin
+		if kt.origin != nil {
+			transformerOrigin = &resource.Origin{
+				Repo:         kt.origin.Repo,
+				Ref:          kt.origin.Ref,
+				ConfiguredIn: filepath.Join(kt.origin.Path, kt.kustFileName),
+				ConfiguredBy: yaml.ResourceIdentifier{
+					TypeMeta: yaml.TypeMeta{
+						APIVersion: "builtin",
+						Kind:       bpt.String(),
+					},
+				},
+			}
+		}
+		for i := range r {
+			result = append(result, &resmap.TransformerWithProperties{Transformer: r[i], Origin: transformerOrigin})
+		}
 	}
 	return result, nil
 }
@@ -147,6 +185,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 	builtinhelpers.NamespaceTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
+		if kt.kustomization.Namespace == "" {
+			return
+		}
 		var c struct {
 			types.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
 			FieldSpecs       []types.FieldSpec
@@ -230,6 +271,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 	builtinhelpers.LabelTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
+		if len(kt.kustomization.Labels) == 0 && len(kt.kustomization.CommonLabels) == 0 {
+			return
+		}
 		for _, label := range kt.kustomization.Labels {
 			var c struct {
 				Labels     map[string]string
@@ -272,6 +316,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 	builtinhelpers.AnnotationsTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
+		if len(kt.kustomization.CommonAnnotations) == 0 {
+			return
+		}
 		var c struct {
 			Annotations map[string]string
 			FieldSpecs  []types.FieldSpec
@@ -286,16 +333,17 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		result = append(result, p)
 		return
 	},
-	builtinhelpers.PrefixSuffixTransformer: func(
+	builtinhelpers.PrefixTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
+		if kt.kustomization.NamePrefix == "" {
+			return
+		}
 		var c struct {
-			Prefix     string
-			Suffix     string
-			FieldSpecs []types.FieldSpec
+			Prefix     string            `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+			FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
 		}
 		c.Prefix = kt.kustomization.NamePrefix
-		c.Suffix = kt.kustomization.NameSuffix
 		c.FieldSpecs = tc.NamePrefix
 		p := f()
 		err = kt.configureBuiltinPlugin(p, c, bpt)
@@ -305,6 +353,26 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 		result = append(result, p)
 		return
 	},
+	builtinhelpers.SuffixTransformer: func(
+		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
+		result []resmap.Transformer, err error) {
+		if kt.kustomization.NameSuffix == "" {
+			return
+		}
+		var c struct {
+			Suffix     string            `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+			FieldSpecs []types.FieldSpec `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+		}
+		c.Suffix = kt.kustomization.NameSuffix
+		c.FieldSpecs = tc.NameSuffix
+		p := f()
+		err = kt.configureBuiltinPlugin(p, c, bpt)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, p)
+		return
+	},
 	builtinhelpers.ImageTagTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, tc *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
@@ -327,6 +395,9 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 	builtinhelpers.ReplacementTransformer: func(
 		kt *KustTarget, bpt builtinhelpers.BuiltinPluginType, f tFactory, _ *builtinconfig.TransformerConfig) (
 		result []resmap.Transformer, err error) {
+		if len(kt.kustomization.Replacements) == 0 {
+			return
+		}
 		var c struct {
 			Replacements []types.ReplacementField
 		}

vendor/sigs.k8s.io/kustomize/api/internal/target/multitransformer.go

@@ -9,15 +9,15 @@ import (
 
 // multiTransformer contains a list of transformers.
 type multiTransformer struct {
-	transformers []resmap.Transformer
+	transformers []*resmap.TransformerWithProperties
 }
 
 var _ resmap.Transformer = &multiTransformer{}
 
 // newMultiTransformer constructs a multiTransformer.
-func newMultiTransformer(t []resmap.Transformer) resmap.Transformer {
+func newMultiTransformer(t []*resmap.TransformerWithProperties) resmap.Transformer {
 	r := &multiTransformer{
-		transformers: make([]resmap.Transformer, len(t)),
+		transformers: make([]*resmap.TransformerWithProperties, len(t)),
 	}
 	copy(r.transformers, t)
 	return r
@@ -30,6 +30,11 @@ func (o *multiTransformer) Transform(m resmap.ResMap) error {
 		if err := t.Transform(m); err != nil {
 			return err
 		}
+		if t.Origin != nil {
+			if err := m.AddTransformerAnnotation(t.Origin); err != nil {
+				return err
+			}
+		}
 		m.DropEmpties()
 	}
 	return nil

vendor/sigs.k8s.io/kustomize/api/internal/utils/annotations.go

@@ -3,6 +3,7 @@ package utils
 import "sigs.k8s.io/kustomize/api/konfig"
 
 const (
+	// build annotations
 	BuildAnnotationPreviousKinds      = konfig.ConfigAnnoDomain + "/previousKinds"
 	BuildAnnotationPreviousNames      = konfig.ConfigAnnoDomain + "/previousNames"
 	BuildAnnotationPrefixes           = konfig.ConfigAnnoDomain + "/prefixes"
@@ -17,7 +18,9 @@ const (
 	BuildAnnotationAllowNameChange = konfig.ConfigAnnoDomain + "/allowNameChange"
 	BuildAnnotationAllowKindChange = konfig.ConfigAnnoDomain + "/allowKindChange"
 
-	OriginAnnotation = "config.kubernetes.io/origin"
+	// for keeping track of origin and transformer data
+	OriginAnnotationKey      = "config.kubernetes.io/origin"
+	TransformerAnnotationKey = "alpha.config.kubernetes.io/transformations"
 
 	Enabled = "enabled"
 )

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/defaultconfig.go

@@ -11,6 +11,7 @@ import (
 func GetDefaultFieldSpecs() []byte {
 	configData := [][]byte{
 		[]byte(namePrefixFieldSpecs),
+		[]byte(nameSuffixFieldSpecs),
 		[]byte(commonLabelFieldSpecs),
 		[]byte(commonAnnotationFieldSpecs),
 		[]byte(namespaceFieldSpecs),
@@ -27,6 +28,7 @@ func GetDefaultFieldSpecs() []byte {
 func GetDefaultFieldSpecsAsMap() map[string]string {
 	result := make(map[string]string)
 	result["nameprefix"] = namePrefixFieldSpecs
+	result["namesuffix"] = nameSuffixFieldSpecs
 	result["commonlabels"] = commonLabelFieldSpecs
 	result["commonannotations"] = commonAnnotationFieldSpecs
 	result["namespace"] = namespaceFieldSpecs

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/namereference.go

@@ -3,6 +3,7 @@
 
 package builtinpluginconsts
 
+// LINT.IfChange
 const (
 	nameReferenceFieldSpecs = `
 nameReference:
@@ -49,6 +50,16 @@ nameReference:
     kind: Pod
   - path: template/spec/volumes/configMap/name
     kind: PodTemplate
+  - path: template/spec/containers/env/valueFrom/configMapKeyRef/name
+    kind: PodTemplate
+  - path: template/spec/initContainers/env/valueFrom/configMapKeyRef/name
+    kind: PodTemplate
+  - path: template/spec/containers/envFrom/configMapRef/name
+    kind: PodTemplate
+  - path: template/spec/initContainers/envFrom/configMapRef/name
+    kind: PodTemplate
+  - path: template/spec/volumes/projected/sources/configMap/name
+    kind: PodTemplate
   - path: spec/template/spec/volumes/configMap/name
     kind: Deployment
   - path: spec/template/spec/containers/env/valueFrom/configMapKeyRef/name
@@ -154,6 +165,20 @@ nameReference:
   - path: spec/volumes/projected/sources/secret/name
     version: v1
     kind: Pod
+  - path: template/spec/volumes/secret/secretName
+    kind: PodTemplate
+  - path: template/spec/containers/env/valueFrom/secretKeyRef/name
+    kind: PodTemplate
+  - path: template/spec/initContainers/env/valueFrom/secretKeyRef/name
+    kind: PodTemplate
+  - path: template/spec/containers/envFrom/secretRef/name
+    kind: PodTemplate
+  - path: template/spec/initContainers/envFrom/secretRef/name
+    kind: PodTemplate
+  - path: template/spec/imagePullSecrets/name
+    kind: PodTemplate
+  - path: template/spec/volumes/projected/sources/secret/name
+    kind: PodTemplate
   - path: spec/template/spec/volumes/secret/secretName
     kind: Deployment
   - path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
@@ -398,3 +423,5 @@ nameReference:
     kind: Ingress
 `
 )
+
+// LINT.ThenChange(/examples/transformerconfigs/README.md)

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/namesuffix.go

@@ -0,0 +1,11 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const (
+	nameSuffixFieldSpecs = `
+nameSuffix:
+- path: metadata/name
+`
+)

vendor/sigs.k8s.io/kustomize/api/krusty/kustomizer.go

@@ -7,9 +7,10 @@ import (
 	"fmt"
 	"path/filepath"
 
-	"sigs.k8s.io/kustomize/api/builtins"
+	"sigs.k8s.io/kustomize/api/internal/builtins"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
+	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
 	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provenance"
@@ -95,7 +96,7 @@ func (b *Kustomizer) Run(
 			return nil, err
 		}
 	}
-	if b.options.AddManagedbyLabel {
+	if b.options.AddManagedbyLabel || utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.ManagedByLabelOption) {
 		t := builtins.LabelTransformerPlugin{
 			Labels: map[string]string{
 				konfig.ManagedbyLabelKey: fmt.Sprintf("kustomize-%s", provenance.GetProvenance().Semver()),
@@ -111,5 +112,11 @@ func (b *Kustomizer) Run(
 		}
 	}
 	m.RemoveBuildAnnotations()
+	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.OriginAnnotations) {
+		m.RemoveOriginAnnotations()
+	}
+	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.TransformerAnnotations) {
+		m.RemoveTransformerAnnotations()
+	}
 	return m, nil
 }

vendor/sigs.k8s.io/kustomize/api/loader/errors.go

@@ -0,0 +1,5 @@
+package loader
+
+import "fmt"
+
+var ErrorHTTP = fmt.Errorf("HTTP Error")

vendor/sigs.k8s.io/kustomize/api/loader/fileloader.go

@@ -4,6 +4,7 @@
 package loader
 
 import (
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -158,8 +159,8 @@ func demandDirectoryRoot(
 	}
 	if f != "" {
 		return "", fmt.Errorf(
-			"got file '%s', but '%s' must be a directory to be a root",
-			f, path)
+			"'%s' must be a directory so that it can used as a build root",
+			path)
 	}
 	return d, nil
 }
@@ -298,7 +299,7 @@ func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 }
 
 // Load returns the content of file at the given path,
-// else an error.  Relative paths are taken relative
+// else an error. Relative paths are taken relative
 // to the root.
 func (fl *fileLoader) Load(path string) ([]byte, error) {
 	if u, err := url.Parse(path); err == nil && (u.Scheme == "http" || u.Scheme == "https") {
@@ -313,6 +314,13 @@ func (fl *fileLoader) Load(path string) ([]byte, error) {
 			return nil, err
 		}
 		defer resp.Body.Close()
+		if resp.StatusCode < 200 || resp.StatusCode > 299 {
+			_, err := git.NewRepoSpecFromUrl(path)
+			if err == nil {
+				return nil, errors.New("URL is a git repository")
+			}
+			return nil, fmt.Errorf("%w: status code %d (%s)", ErrorHTTP, resp.StatusCode, http.StatusText(resp.StatusCode))
+		}
 		body, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			return nil, err

vendor/sigs.k8s.io/kustomize/api/resmap/idslice.go

@@ -33,5 +33,5 @@ func (a IdSlice) Less(i, j int) bool {
 	if !a[i].Gvk.Equals(a[j].Gvk) {
 		return a[i].Gvk.IsLessThan(a[j].Gvk)
 	}
-	return a[i].String() < a[j].String()
+	return a[i].LegacySortString() < a[j].LegacySortString()
 }

vendor/sigs.k8s.io/kustomize/api/resmap/resmap.go

@@ -21,11 +21,25 @@ type Transformer interface {
 	Transform(m ResMap) error
 }
 
+// A TransformerWithProperties contains a Transformer and stores
+// some of its properties
+type TransformerWithProperties struct {
+	Transformer
+	Origin *resource.Origin
+}
+
 // A Generator creates an instance of ResMap.
 type Generator interface {
 	Generate() (ResMap, error)
 }
 
+// A GeneratorWithProperties contains a Generator and stores
+// some of its properties
+type GeneratorWithProperties struct {
+	Generator
+	Origin *resource.Origin
+}
+
 // Something that's configurable accepts an
 // instance of PluginHelpers and a raw config
 // object (YAML in []byte form).
@@ -136,6 +150,25 @@ type ResMap interface {
 	// self, then its behavior _cannot_ be merge or replace.
 	AbsorbAll(ResMap) error
 
+	// AddOriginAnnotation will add the provided origin as
+	// an origin annotation to all resources in the ResMap, if
+	// the origin is not nil.
+	AddOriginAnnotation(origin *resource.Origin) error
+
+	// RemoveOriginAnnotation will remove the origin annotation
+	// from all resources in the ResMap
+	RemoveOriginAnnotations() error
+
+	// AddTransformerAnnotation will add the provided origin as
+	// an origin annotation if the resource doesn't have one; a
+	// transformer annotation otherwise; to all resources in
+	// ResMap
+	AddTransformerAnnotation(origin *resource.Origin) error
+
+	// RemoveTransformerAnnotation will remove the transformer annotation
+	// from all resources in the ResMap
+	RemoveTransformerAnnotations() error
+
 	// AnnotateAll annotates all resources in the ResMap with
 	// the provided key value pair.
 	AnnotateAll(key string, value string) error
@@ -212,7 +245,7 @@ type ResMap interface {
 	// This is a filter; it excludes things that cannot be
 	// referenced by the resource, e.g. objects in other
 	// namespaces. Cluster wide objects are never excluded.
-	SubsetThatCouldBeReferencedByResource(*resource.Resource) ResMap
+	SubsetThatCouldBeReferencedByResource(*resource.Resource) (ResMap, error)
 
 	// DeAnchor replaces YAML aliases with structured data copied from anchors.
 	// This cannot be undone; if desired, call DeepCopy first.

vendor/sigs.k8s.io/kustomize/api/resmap/reswrangler.go

@@ -215,7 +215,7 @@ func (m *resWrangler) GetById(
 	if err != nil {
 		return nil, fmt.Errorf(
 			"%s; failed to find unique target for patch %s",
-			err.Error(), id.GvknString())
+			err.Error(), id.String())
 	}
 	return r, nil
 }
@@ -389,14 +389,17 @@ func (m *resWrangler) makeCopy(copier resCopier) ResMap {
 
 // SubsetThatCouldBeReferencedByResource implements ResMap.
 func (m *resWrangler) SubsetThatCouldBeReferencedByResource(
-	referrer *resource.Resource) ResMap {
+	referrer *resource.Resource) (ResMap, error) {
 	referrerId := referrer.CurId()
 	if referrerId.IsClusterScoped() {
 		// A cluster scoped resource can refer to anything.
-		return m
+		return m, nil
 	}
 	result := newOne()
-	roleBindingNamespaces := getNamespacesForRoleBinding(referrer)
+	roleBindingNamespaces, err := getNamespacesForRoleBinding(referrer)
+	if err != nil {
+		return nil, err
+	}
 	for _, possibleTarget := range m.rList {
 		id := possibleTarget.CurId()
 		if id.IsClusterScoped() {
@@ -416,32 +419,36 @@ func (m *resWrangler) SubsetThatCouldBeReferencedByResource(
 			result.append(possibleTarget)
 		}
 	}
-	return result
+	return result, nil
 }
 
 // getNamespacesForRoleBinding returns referenced ServiceAccount namespaces
 // if the resource is a RoleBinding
-func getNamespacesForRoleBinding(r *resource.Resource) map[string]bool {
+func getNamespacesForRoleBinding(r *resource.Resource) (map[string]bool, error) {
 	result := make(map[string]bool)
 	if r.GetKind() != "RoleBinding" {
-		return result
+		return result, nil
 	}
 	//nolint staticcheck
 	subjects, err := r.GetSlice("subjects")
 	if err != nil || subjects == nil {
-		return result
+		return result, nil
 	}
 	for _, s := range subjects {
 		subject := s.(map[string]interface{})
 		if ns, ok1 := subject["namespace"]; ok1 {
 			if kind, ok2 := subject["kind"]; ok2 {
 				if kind.(string) == "ServiceAccount" {
-					result[ns.(string)] = true
+					if n, ok3 := ns.(string); ok3 {
+						result[n] = true
+					} else {
+						return nil, errors.New(fmt.Sprintf("Invalid Input: namespace is blank for resource %q\n", r.CurId()))
+					}
 				}
 			}
 		}
 	}
-	return result
+	return result, nil
 }
 
 // AppendAll implements ResMap.
@@ -484,6 +491,69 @@ func (m *resWrangler) AbsorbAll(other ResMap) error {
 	return nil
 }
 
+// AddOriginAnnotation implements ResMap.
+func (m *resWrangler) AddOriginAnnotation(origin *resource.Origin) error {
+	if origin == nil {
+		return nil
+	}
+	for _, res := range m.rList {
+		or, err := res.GetOrigin()
+		if or != nil || err != nil {
+			// if any resources already have an origin annotation,
+			// skip it
+			continue
+		}
+		if err := res.SetOrigin(origin); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// RemoveOriginAnnotation implements ResMap
+func (m *resWrangler) RemoveOriginAnnotations() error {
+	for _, res := range m.rList {
+		if err := res.SetOrigin(nil); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AddTransformerAnnotation implements ResMap
+func (m *resWrangler) AddTransformerAnnotation(origin *resource.Origin) error {
+	for _, res := range m.rList {
+		or, err := res.GetOrigin()
+		if err != nil {
+			return err
+		}
+		if or == nil {
+			// the resource does not have an origin annotation, so
+			// we assume that the transformer generated the resource
+			// rather than modifying it
+			err = res.SetOrigin(origin)
+		} else {
+			// the resource already has an origin annotation, so we
+			// record the provided origin as a transformation
+			err = res.AddTransformation(origin)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// RemoveTransformerAnnotations implements ResMap
+func (m *resWrangler) RemoveTransformerAnnotations() error {
+	for _, res := range m.rList {
+		if err := res.ClearTransformations(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (m *resWrangler) appendReplaceOrMerge(res *resource.Resource) error {
 	id := res.CurId()
 	matches := m.GetMatchingResourcesByAnyId(id.Equals)
@@ -510,9 +580,18 @@ func (m *resWrangler) appendReplaceOrMerge(res *resource.Resource) error {
 		case types.BehaviorReplace:
 			res.CopyMergeMetaDataFieldsFrom(old)
 		case types.BehaviorMerge:
+			// ensure the origin annotation doesn't get overwritten
+			orig, err := old.GetOrigin()
+			if err != nil {
+				return err
+			}
 			res.CopyMergeMetaDataFieldsFrom(old)
 			res.MergeDataMapFrom(old)
 			res.MergeBinaryDataMapFrom(old)
+			if orig != nil {
+				res.SetOrigin(orig)
+			}
+
 		default:
 			return fmt.Errorf(
 				"id %#v exists; behavior must be merge or replace", id)

vendor/sigs.k8s.io/kustomize/api/resource/origin.go

@@ -8,26 +8,42 @@ import (
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/internal/git"
+	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-// Origin retains information about where resources in the output
-// of `kustomize build` originated from
+// Origin retains information about the origin of resources and transformer configs
+// that contributed to the output of `kustomize build`
 type Origin struct {
-	// Path is the path to the resource, rooted from the directory upon
-	// which `kustomize build` was invoked
-	Path string
+	// Path is the path to the resource. If a local resource, this path is
+	// rooted from the directory upon which `kustomize build` was invoked. If a
+	// remote resource, this path is rooted from the root of the remote repo.
+	Path string `json:"path,omitempty" yaml:"path,omitempty"`
 
-	// Repo is the remote repository that the resource originated from if it is
+	// Repo is the remote repository that the resource or transformer originated from if it is
 	// not from a local file
-	Repo string
+	Repo string `json:"repo,omitempty" yaml:"repo,omitempty"`
 
-	// Ref is the ref of the remote repository that the resource originated from
+	// Ref is the ref of the remote repository that the resource or transformer originated from
 	// if it is not from a local file
-	Ref string
+	Ref string `json:"ref,omitempty" yaml:"ref,omitempty"`
+
+	// The following fields only apply to resources that have been
+	// generated by fields other than the `resources` field, or to transformer
+	// configs.
+
+	// ConfiguredIn is the file path to the generator or transformer config that created the
+	// resource
+	ConfiguredIn string `json:"configuredIn,omitempty" yaml:"configuredIn,omitempty"`
+
+	// ConfiguredBy is the ObjectReference of the generator or transformer config
+	ConfiguredBy kyaml.ResourceIdentifier `json:"configuredBy,omitempty" yaml:"configuredBy,omitempty"`
 }
 
 // Copy returns a copy of origin
 func (origin *Origin) Copy() Origin {
+	if origin == nil {
+		return Origin{}
+	}
 	return *origin
 }
 
@@ -47,14 +63,44 @@ func (origin *Origin) Append(path string) *Origin {
 }
 
 // String returns a string version of origin
-func (origin *Origin) String() string {
-	var anno string
-	anno = anno + "path: " + origin.Path + "\n"
-	if origin.Repo != "" {
-		anno = anno + "repo: " + origin.Repo + "\n"
-	}
-	if origin.Ref != "" {
-		anno = anno + "ref: " + origin.Ref + "\n"
-	}
-	return anno
+func (origin *Origin) String() (string, error) {
+	anno, err := kyaml.Marshal(origin)
+	return string(anno), err
+}
+
+// Transformations is a list of Origin
+type Transformations []*Origin
+
+// String returns a string version of Transformations
+func (transformations *Transformations) String() (string, error) {
+	anno, err := kyaml.Marshal(transformations)
+	return string(anno), err
+}
+
+// OriginFromCustomPlugin takes a custom plugin defined as a resource
+// and returns an origin object to describe it
+func OriginFromCustomPlugin(res *Resource) (*Origin, error) {
+	origin, err := res.GetOrigin()
+	if err != nil {
+		return nil, err
+	}
+	var result *Origin
+	if origin != nil {
+		result = &Origin{
+			Repo:         origin.Repo,
+			Ref:          origin.Ref,
+			ConfiguredIn: origin.Path,
+			ConfiguredBy: kyaml.ResourceIdentifier{
+				TypeMeta: kyaml.TypeMeta{
+					APIVersion: res.GetApiVersion(),
+					Kind:       res.GetKind(),
+				},
+				NameMeta: kyaml.NameMeta{
+					Name:      res.GetName(),
+					Namespace: res.GetNamespace(),
+				},
+			},
+		}
+	}
+	return result, nil
 }

vendor/sigs.k8s.io/kustomize/api/resource/resource.go

@@ -42,9 +42,12 @@ var BuildAnnotations = []string{
 	kioutil.PathAnnotation,
 	kioutil.IndexAnnotation,
 	kioutil.SeqIndentAnnotation,
+	kioutil.IdAnnotation,
+	kioutil.InternalAnnotationsMigrationResourceIDAnnotation,
 
 	kioutil.LegacyPathAnnotation,
 	kioutil.LegacyIndexAnnotation,
+	kioutil.LegacyIdAnnotation,
 }
 
 func (r *Resource) ResetRNode(incoming *Resource) {
@@ -64,6 +67,70 @@ func (r *Resource) SetGvk(gvk resid.Gvk) {
 	r.SetApiVersion(gvk.ApiVersion())
 }
 
+func (r *Resource) GetOrigin() (*Origin, error) {
+	annotations := r.GetAnnotations()
+	originAnnotations, ok := annotations[utils.OriginAnnotationKey]
+	if !ok {
+		return nil, nil
+	}
+	var origin Origin
+	if err := yaml.Unmarshal([]byte(originAnnotations), &origin); err != nil {
+		return nil, err
+	}
+	return &origin, nil
+}
+
+func (r *Resource) SetOrigin(origin *Origin) error {
+	annotations := r.GetAnnotations()
+	if origin == nil {
+		delete(annotations, utils.OriginAnnotationKey)
+	} else {
+		originStr, err := origin.String()
+		if err != nil {
+			return err
+		}
+		annotations[utils.OriginAnnotationKey] = originStr
+	}
+	return r.SetAnnotations(annotations)
+}
+
+func (r *Resource) GetTransformations() (Transformations, error) {
+	annotations := r.GetAnnotations()
+	transformerAnnotations, ok := annotations[utils.TransformerAnnotationKey]
+	if !ok {
+		return nil, nil
+	}
+	var transformations Transformations
+	if err := yaml.Unmarshal([]byte(transformerAnnotations), &transformations); err != nil {
+		return nil, err
+	}
+	return transformations, nil
+}
+
+func (r *Resource) AddTransformation(origin *Origin) error {
+	annotations := r.GetAnnotations()
+	transformations, err := r.GetTransformations()
+	if err != nil {
+		return err
+	}
+	if transformations == nil {
+		transformations = Transformations{}
+	}
+	transformations = append(transformations, origin)
+	transformationStr, err := transformations.String()
+	if err != nil {
+		return err
+	}
+	annotations[utils.TransformerAnnotationKey] = transformationStr
+	return r.SetAnnotations(annotations)
+}
+
+func (r *Resource) ClearTransformations() error {
+	annotations := r.GetAnnotations()
+	delete(annotations, utils.TransformerAnnotationKey)
+	return r.SetAnnotations(annotations)
+}
+
 // ResCtx is an interface describing the contextual added
 // kept kustomize in the context of each Resource object.
 // Currently mainly the name prefix and name suffix are added.

vendor/sigs.k8s.io/kustomize/api/types/kustomization.go

@@ -17,8 +17,14 @@ const (
 	ComponentVersion      = "kustomize.config.k8s.io/v1alpha1"
 	ComponentKind         = "Component"
 	MetadataNamespacePath = "metadata/namespace"
+
+	OriginAnnotations      = "originAnnotations"
+	TransformerAnnotations = "transformerAnnotations"
+	ManagedByLabelOption   = "managedByLabel"
 )
 
+var BuildMetadataOptions = []string{OriginAnnotations, TransformerAnnotations, ManagedByLabelOption}
+
 // Kustomization holds the information needed to generate customized k8s api resources.
 type Kustomization struct {
 	TypeMeta `json:",inline" yaml:",inline"`
@@ -55,7 +61,7 @@ type Kustomization struct {
 
 	// PatchesStrategicMerge specifies the relative path to a file
 	// containing a strategic merge patch.  Format documented at
-	// https://github.com/kubernetes/community/blob/master/contributors/devel/strategic-merge-patch.md
+	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md
 	// URLs and globs are not supported.
 	PatchesStrategicMerge []PatchStrategicMerge `json:"patchesStrategicMerge,omitempty" yaml:"patchesStrategicMerge,omitempty"`
 

vendor/sigs.k8s.io/kustomize/kustomize/v4/commands/build/build.go

@@ -104,6 +104,8 @@ func NewCmdBuild(
 	AddFlagEnablePlugins(cmd.Flags())
 	AddFlagReorderOutput(cmd.Flags())
 	AddFlagEnableManagedbyLabel(cmd.Flags())
+	cmd.Flags().MarkDeprecated(managedByFlag,
+		"The flag `enable-managedby-label` has been deprecated. Use the `managedByLabel` option in the `buildMetadata` field instead.")
 	AddFlagEnableHelm(cmd.Flags())
 	return cmd
 }

vendor/sigs.k8s.io/kustomize/kustomize/v4/commands/build/flagaddmanagedby.go

@@ -10,10 +10,12 @@ import (
 	"sigs.k8s.io/kustomize/api/konfig"
 )
 
+const managedByFlag = "enable-managedby-label"
+
 func AddFlagEnableManagedbyLabel(set *pflag.FlagSet) {
 	set.BoolVar(
 		&theFlags.enable.managedByLabel,
-		"enable-managedby-label",
+		managedByFlag,
 		false,
 		`enable adding `+konfig.ManagedbyLabelKey)
 }

vendor/sigs.k8s.io/kustomize/kyaml/kio/byteio_reader.go

@@ -294,7 +294,7 @@ func (r *ByteReader) decode(originalYAML string, index int, decoder *yaml.Decode
 		return nil, io.EOF
 	}
 	if err != nil {
-		return nil, errors.Wrap(err)
+		return nil, errors.WrapPrefixf(err, "MalformedYAMLError")
 	}
 
 	if yaml.IsYNodeEmptyDoc(node) {

vendor/sigs.k8s.io/kustomize/kyaml/kio/kio.go

@@ -7,6 +7,7 @@ package kio
 
 import (
 	"fmt"
+	"strconv"
 
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
@@ -56,6 +57,13 @@ type Filter interface {
 	Filter([]*yaml.RNode) ([]*yaml.RNode, error)
 }
 
+// TrackableFilter is an extension of Filter which is also capable of tracking
+// which fields were mutated by the filter.
+type TrackableFilter interface {
+	Filter
+	WithMutationTracker(func(key, value, tag string, node *yaml.RNode))
+}
+
 // FilterFunc implements a Filter as a function.
 type FilterFunc func([]*yaml.RNode) ([]*yaml.RNode, error)
 
@@ -114,13 +122,11 @@ func (p Pipeline) ExecuteWithCallback(callback PipelineExecuteCallbackFunc) erro
 	}
 
 	// apply operations
-	var err error
 	for i := range p.Filters {
 		// Not all RNodes passed through kio.Pipeline have metadata nor should
 		// they all be required to.
-		var nodeAnnos map[string]map[string]string
-		nodeAnnos, err = storeInternalAnnotations(result)
-		if err != nil && err != yaml.ErrMissingMetadata {
+		nodeAnnos, err := PreprocessResourcesForInternalAnnotationMigration(result)
+		if err != nil {
 			return err
 		}
 
@@ -138,8 +144,8 @@ func (p Pipeline) ExecuteWithCallback(callback PipelineExecuteCallbackFunc) erro
 
 		// If either the internal annotations for path, index, and id OR the legacy
 		// annotations for path, index, and id are changed, we have to update the other.
-		err = reconcileInternalAnnotations(result, nodeAnnos)
-		if err != nil && err != yaml.ErrMissingMetadata {
+		err = ReconcileInternalAnnotations(result, nodeAnnos)
+		if err != nil {
 			return err
 		}
 	}
@@ -166,55 +172,49 @@ func FilterAll(filter yaml.Filter) Filter {
 	})
 }
 
-// Store the original path, index, and id annotations so that we can reconcile
-// it later. This is necessary because currently both internal-prefixed annotations
+// PreprocessResourcesForInternalAnnotationMigration returns a mapping from id to all
+// internal annotations, so that we can use it to reconcile the annotations
+// later. This is necessary because currently both internal-prefixed annotations
 // and legacy annotations are currently supported, and a change to one must be
-// reflected in the other.
-func storeInternalAnnotations(result []*yaml.RNode) (map[string]map[string]string, error) {
-	nodeAnnosMap := make(map[string]map[string]string)
-
+// reflected in the other if needed.
+func PreprocessResourcesForInternalAnnotationMigration(result []*yaml.RNode) (map[string]map[string]string, error) {
+	idToAnnosMap := make(map[string]map[string]string)
 	for i := range result {
-		if err := kioutil.CopyLegacyAnnotations(result[i]); err != nil {
-			return nil, err
-		}
-		meta, err := result[i].GetMeta()
+		idStr := strconv.Itoa(i)
+		err := result[i].PipeE(yaml.SetAnnotation(kioutil.InternalAnnotationsMigrationResourceIDAnnotation, idStr))
 		if err != nil {
 			return nil, err
 		}
-		if err := checkMismatchedAnnos(meta); err != nil {
+		idToAnnosMap[idStr] = kioutil.GetInternalAnnotations(result[i])
+		if err = kioutil.CopyLegacyAnnotations(result[i]); err != nil {
 			return nil, err
 		}
-
-		path := meta.Annotations[kioutil.PathAnnotation]
-		index := meta.Annotations[kioutil.IndexAnnotation]
-		id := meta.Annotations[kioutil.IdAnnotation]
-
-		if _, ok := nodeAnnosMap[path]; !ok {
-			nodeAnnosMap[path] = make(map[string]string)
+		meta, _ := result[i].GetMeta()
+		if err = checkMismatchedAnnos(meta.Annotations); err != nil {
+			return nil, err
 		}
-		nodeAnnosMap[path][index] = id
 	}
-	return nodeAnnosMap, nil
+	return idToAnnosMap, nil
 }
 
-func checkMismatchedAnnos(meta yaml.ResourceMeta) error {
-	path := meta.Annotations[kioutil.PathAnnotation]
-	index := meta.Annotations[kioutil.IndexAnnotation]
-	id := meta.Annotations[kioutil.IdAnnotation]
+func checkMismatchedAnnos(annotations map[string]string) error {
+	path := annotations[kioutil.PathAnnotation]
+	index := annotations[kioutil.IndexAnnotation]
+	id := annotations[kioutil.IdAnnotation]
 
-	legacyPath := meta.Annotations[kioutil.LegacyPathAnnotation]
-	legacyIndex := meta.Annotations[kioutil.LegacyIndexAnnotation]
-	legacyId := meta.Annotations[kioutil.LegacyIdAnnotation]
+	legacyPath := annotations[kioutil.LegacyPathAnnotation]
+	legacyIndex := annotations[kioutil.LegacyIndexAnnotation]
+	legacyId := annotations[kioutil.LegacyIdAnnotation]
 
 	// if prior to running the functions, the legacy and internal annotations differ,
 	// throw an error as we cannot infer the user's intent.
-	if path != legacyPath {
+	if path != "" && legacyPath != "" && path != legacyPath {
 		return fmt.Errorf("resource input to function has mismatched legacy and internal path annotations")
 	}
-	if index != legacyIndex {
+	if index != "" && legacyIndex != "" && index != legacyIndex {
 		return fmt.Errorf("resource input to function has mismatched legacy and internal index annotations")
 	}
-	if id != legacyId {
+	if id != "" && legacyId != "" && id != legacyId {
 		return fmt.Errorf("resource input to function has mismatched legacy and internal id annotations")
 	}
 	return nil
@@ -226,53 +226,115 @@ type nodeAnnotations struct {
 	id    string
 }
 
-func reconcileInternalAnnotations(result []*yaml.RNode, nodeAnnosMap map[string]map[string]string) error {
-	for _, node := range result {
-		meta, err := node.GetMeta()
-		if err != nil {
-			return err
-		}
+// ReconcileInternalAnnotations reconciles the annotation format for path, index and id annotations.
+// It will ensure the output annotation format matches the format in the input. e.g. if the input
+// format uses the legacy format and the output will be converted to the legacy format if it's not.
+func ReconcileInternalAnnotations(result []*yaml.RNode, nodeAnnosMap map[string]map[string]string) error {
+	useInternal, useLegacy, err := determineAnnotationsFormat(nodeAnnosMap)
+	if err != nil {
+		return err
+	}
+
+	for i := range result {
 		// if only one annotation is set, set the other.
-		err = missingInternalOrLegacyAnnotations(node, meta)
+		err = missingInternalOrLegacyAnnotations(result[i])
 		if err != nil {
 			return err
 		}
 		// we must check to see if the function changed either the new internal annotations
 		// or the old legacy annotations. If one is changed, the change must be reflected
 		// in the other.
-		err = checkAnnotationsAltered(node, meta, nodeAnnosMap)
+		err = checkAnnotationsAltered(result[i], nodeAnnosMap)
+		if err != nil {
+			return err
+		}
+		// We invoke determineAnnotationsFormat to find out if the original annotations
+		// use the internal or (and) the legacy format. We format the resources to
+		// make them consistent with original format.
+		err = formatInternalAnnotations(result[i], useInternal, useLegacy)
 		if err != nil {
 			return err
 		}
 		// if the annotations are still somehow out of sync, throw an error
-		meta, err = node.GetMeta()
+		meta, _ := result[i].GetMeta()
+		err = checkMismatchedAnnos(meta.Annotations)
 		if err != nil {
 			return err
 		}
-		err = checkMismatchedAnnos(meta)
-		if err != nil {
+
+		if _, err = result[i].Pipe(yaml.ClearAnnotation(kioutil.InternalAnnotationsMigrationResourceIDAnnotation)); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func missingInternalOrLegacyAnnotations(rn *yaml.RNode, meta yaml.ResourceMeta) error {
-	if err := missingInternalOrLegacyAnnotation(rn, meta, kioutil.PathAnnotation, kioutil.LegacyPathAnnotation); err != nil {
+// determineAnnotationsFormat determines if the resources are using one of the internal and legacy annotation format or both of them.
+func determineAnnotationsFormat(nodeAnnosMap map[string]map[string]string) (useInternal, useLegacy bool, err error) {
+	if len(nodeAnnosMap) == 0 {
+		return true, true, nil
+	}
+
+	var internal, legacy *bool
+	for _, annos := range nodeAnnosMap {
+		_, foundPath := annos[kioutil.PathAnnotation]
+		_, foundIndex := annos[kioutil.IndexAnnotation]
+		_, foundId := annos[kioutil.IdAnnotation]
+		_, foundLegacyPath := annos[kioutil.LegacyPathAnnotation]
+		_, foundLegacyIndex := annos[kioutil.LegacyIndexAnnotation]
+		_, foundLegacyId := annos[kioutil.LegacyIdAnnotation]
+
+		if !(foundPath || foundIndex || foundId || foundLegacyPath || foundLegacyIndex || foundLegacyId) {
+			continue
+		}
+
+		foundOneOf := foundPath || foundIndex || foundId
+		if internal == nil {
+			f := foundOneOf
+			internal = &f
+		}
+		if (foundOneOf && !*internal) || (!foundOneOf && *internal) {
+			err = fmt.Errorf("the annotation formatting in the input resources is not consistent")
+			return
+		}
+
+		foundOneOf = foundLegacyPath || foundLegacyIndex || foundLegacyId
+		if legacy == nil {
+			f := foundOneOf
+			legacy = &f
+		}
+		if (foundOneOf && !*legacy) || (!foundOneOf && *legacy) {
+			err = fmt.Errorf("the annotation formatting in the input resources is not consistent")
+			return
+		}
+	}
+	if internal != nil {
+		useInternal = *internal
+	}
+	if legacy != nil {
+		useLegacy = *legacy
+	}
+	return
+}
+
+func missingInternalOrLegacyAnnotations(rn *yaml.RNode) error {
+	if err := missingInternalOrLegacyAnnotation(rn, kioutil.PathAnnotation, kioutil.LegacyPathAnnotation); err != nil {
 		return err
 	}
-	if err := missingInternalOrLegacyAnnotation(rn, meta, kioutil.IndexAnnotation, kioutil.LegacyIndexAnnotation); err != nil {
+	if err := missingInternalOrLegacyAnnotation(rn, kioutil.IndexAnnotation, kioutil.LegacyIndexAnnotation); err != nil {
 		return err
 	}
-	if err := missingInternalOrLegacyAnnotation(rn, meta, kioutil.IdAnnotation, kioutil.LegacyIdAnnotation); err != nil {
+	if err := missingInternalOrLegacyAnnotation(rn, kioutil.IdAnnotation, kioutil.LegacyIdAnnotation); err != nil {
 		return err
 	}
 	return nil
 }
 
-func missingInternalOrLegacyAnnotation(rn *yaml.RNode, meta yaml.ResourceMeta, newKey string, legacyKey string) error {
-	value := meta.Annotations[newKey]
-	legacyValue := meta.Annotations[legacyKey]
+func missingInternalOrLegacyAnnotation(rn *yaml.RNode, newKey string, legacyKey string) error {
+	meta, _ := rn.GetMeta()
+	annotations := meta.Annotations
+	value := annotations[newKey]
+	legacyValue := annotations[legacyKey]
 
 	if value == "" && legacyValue == "" {
 		// do nothing
@@ -293,98 +355,88 @@ func missingInternalOrLegacyAnnotation(rn *yaml.RNode, meta yaml.ResourceMeta, n
 	return nil
 }
 
-func checkAnnotationsAltered(rn *yaml.RNode, meta yaml.ResourceMeta, nodeAnnosMap map[string]map[string]string) error {
+func checkAnnotationsAltered(rn *yaml.RNode, nodeAnnosMap map[string]map[string]string) error {
+	meta, _ := rn.GetMeta()
+	annotations := meta.Annotations
 	// get the resource's current path, index, and ids from the new annotations
 	internal := nodeAnnotations{
-		path:  meta.Annotations[kioutil.PathAnnotation],
-		index: meta.Annotations[kioutil.IndexAnnotation],
-		id:    meta.Annotations[kioutil.IdAnnotation],
+		path:  annotations[kioutil.PathAnnotation],
+		index: annotations[kioutil.IndexAnnotation],
+		id:    annotations[kioutil.IdAnnotation],
 	}
 
 	// get the resource's current path, index, and ids from the legacy annotations
 	legacy := nodeAnnotations{
-		path:  meta.Annotations[kioutil.LegacyPathAnnotation],
-		index: meta.Annotations[kioutil.LegacyIndexAnnotation],
-		id:    meta.Annotations[kioutil.LegacyIdAnnotation],
+		path:  annotations[kioutil.LegacyPathAnnotation],
+		index: annotations[kioutil.LegacyIndexAnnotation],
+		id:    annotations[kioutil.LegacyIdAnnotation],
 	}
 
-	if internal.path == legacy.path &&
-		internal.index == legacy.index &&
-		internal.id == legacy.id {
-		// none of the annotations differ, so no reconciliation is needed
+	rid := annotations[kioutil.InternalAnnotationsMigrationResourceIDAnnotation]
+	originalAnnotations, found := nodeAnnosMap[rid]
+	if !found {
 		return nil
 	}
-
-	// nodeAnnosMap is a map of structure path -> index -> id that stores
-	// all of the resources' path/index/id annotations prior to the functions
-	// being run. We use that to check whether the legacy or new internal
-	// annotations have been changed, and make sure the change is reflected
-	// in the other.
-
-	// first, check if the internal annotations are found in nodeAnnosMap
-	if indexIdMap, ok := nodeAnnosMap[internal.path]; ok {
-		if id, ok := indexIdMap[internal.index]; ok {
-			if id == internal.id {
-				// the internal annotations of the resource match the ones stored in
-				// nodeAnnosMap, so we should copy the legacy annotations to the
-				// internal ones
-				if err := updateAnnotations(rn, meta,
-					[]string{
-						kioutil.PathAnnotation,
-						kioutil.IndexAnnotation,
-						kioutil.IdAnnotation,
-					},
-					[]string{
-						legacy.path,
-						legacy.index,
-						legacy.id,
-					}); err != nil {
-					return err
-				}
+	originalPath, found := originalAnnotations[kioutil.PathAnnotation]
+	if !found {
+		originalPath = originalAnnotations[kioutil.LegacyPathAnnotation]
+	}
+	if originalPath != "" {
+		if originalPath != internal.path && originalPath != legacy.path && internal.path != legacy.path {
+			return fmt.Errorf("resource input to function has mismatched legacy and internal path annotations")
+		} else if originalPath != internal.path {
+			if _, err := rn.Pipe(yaml.SetAnnotation(kioutil.LegacyPathAnnotation, internal.path)); err != nil {
+				return err
+			}
+		} else if originalPath != legacy.path {
+			if _, err := rn.Pipe(yaml.SetAnnotation(kioutil.PathAnnotation, legacy.path)); err != nil {
+				return err
 			}
 		}
 	}
 
-	// check the opposite, to see if the legacy annotations are in nodeAnnosMap
-	if indexIdMap, ok := nodeAnnosMap[legacy.path]; ok {
-		if id, ok := indexIdMap[legacy.index]; ok {
-			if id == legacy.id {
-				// the legacy annotations of the resource match the ones stored in
-				// nodeAnnosMap, so we should copy the internal annotations to the
-				// legacy ones
-				if err := updateAnnotations(rn, meta,
-					[]string{
-						kioutil.LegacyPathAnnotation,
-						kioutil.LegacyIndexAnnotation,
-						kioutil.LegacyIdAnnotation,
-					},
-					[]string{
-						internal.path,
-						internal.index,
-						internal.id,
-					}); err != nil {
-					return err
-				}
+	originalIndex, found := originalAnnotations[kioutil.IndexAnnotation]
+	if !found {
+		originalIndex = originalAnnotations[kioutil.LegacyIndexAnnotation]
+	}
+	if originalIndex != "" {
+		if originalIndex != internal.index && originalIndex != legacy.index && internal.index != legacy.index {
+			return fmt.Errorf("resource input to function has mismatched legacy and internal index annotations")
+		} else if originalIndex != internal.index {
+			if _, err := rn.Pipe(yaml.SetAnnotation(kioutil.LegacyIndexAnnotation, internal.index)); err != nil {
+				return err
+			}
+		} else if originalIndex != legacy.index {
+			if _, err := rn.Pipe(yaml.SetAnnotation(kioutil.IndexAnnotation, legacy.index)); err != nil {
+				return err
 			}
 		}
 	}
 	return nil
 }
 
-func updateAnnotations(rn *yaml.RNode, meta yaml.ResourceMeta, keys []string, values []string) error {
-	if len(keys) != len(values) {
-		return fmt.Errorf("keys is not same length as values")
-	}
-	for i := range keys {
-		_, ok := meta.Annotations[keys[i]]
-		if values[i] == "" && !ok {
-			// don't set "" if annotation is not already there
-			continue
-		}
-		if err := rn.PipeE(yaml.SetAnnotation(keys[i], values[i])); err != nil {
+func formatInternalAnnotations(rn *yaml.RNode, useInternal, useLegacy bool) error {
+	if !useInternal {
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.IdAnnotation)); err != nil {
+			return err
+		}
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.PathAnnotation)); err != nil {
+			return err
+		}
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.IndexAnnotation)); err != nil {
+			return err
+		}
+	}
+	if !useLegacy {
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.LegacyIdAnnotation)); err != nil {
+			return err
+		}
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.LegacyPathAnnotation)); err != nil {
+			return err
+		}
+		if err := rn.PipeE(yaml.ClearAnnotation(kioutil.LegacyIndexAnnotation)); err != nil {
 			return err
 		}
-
 	}
 	return nil
 }

vendor/sigs.k8s.io/kustomize/kyaml/kio/kioutil/kioutil.go

@@ -41,21 +41,37 @@ const (
 
 	// Deprecated: use IdAnnotation instead.
 	LegacyIdAnnotation = "config.k8s.io/id"
+
+	// InternalAnnotationsMigrationResourceIDAnnotation is used to uniquely identify
+	// resources during round trip to and from a function execution. We will use it
+	// to track the internal annotations and reconcile them if needed.
+	InternalAnnotationsMigrationResourceIDAnnotation = internalPrefix + "annotations-migration-resource-id"
 )
 
 func GetFileAnnotations(rn *yaml.RNode) (string, string, error) {
-	if err := CopyLegacyAnnotations(rn); err != nil {
-		return "", "", err
+	rm, _ := rn.GetMeta()
+	annotations := rm.Annotations
+	path, found := annotations[PathAnnotation]
+	if !found {
+		path = annotations[LegacyPathAnnotation]
 	}
-	meta, err := rn.GetMeta()
-	if err != nil {
-		return "", "", err
+	index, found := annotations[IndexAnnotation]
+	if !found {
+		index = annotations[LegacyIndexAnnotation]
 	}
-	path := meta.Annotations[PathAnnotation]
-	index := meta.Annotations[IndexAnnotation]
 	return path, index, nil
 }
 
+func GetIdAnnotation(rn *yaml.RNode) string {
+	rm, _ := rn.GetMeta()
+	annotations := rm.Annotations
+	id, found := annotations[IdAnnotation]
+	if !found {
+		id = annotations[LegacyIdAnnotation]
+	}
+	return id
+}
+
 func CopyLegacyAnnotations(rn *yaml.RNode) error {
 	meta, err := rn.GetMeta()
 	if err != nil {
@@ -377,13 +393,16 @@ func ConfirmInternalAnnotationUnchanged(r1 *yaml.RNode, r2 *yaml.RNode, exclusio
 	return nil
 }
 
-// GetInternalAnnotations returns a map of all the annotations of the provided RNode that begin
-// with the prefix `internal.config.kubernetes.io`
+// GetInternalAnnotations returns a map of all the annotations of the provided
+// RNode that satisfies one of the following: 1) begin with the prefix
+// `internal.config.kubernetes.io` 2) is one of `config.kubernetes.io/path`,
+// `config.kubernetes.io/index` and `config.k8s.io/id`.
 func GetInternalAnnotations(rn *yaml.RNode) map[string]string {
-	annotations := rn.GetAnnotations()
+	meta, _ := rn.GetMeta()
+	annotations := meta.Annotations
 	result := make(map[string]string)
 	for k, v := range annotations {
-		if strings.HasPrefix(k, internalPrefix) {
+		if strings.HasPrefix(k, internalPrefix) || k == LegacyPathAnnotation || k == LegacyIndexAnnotation || k == LegacyIdAnnotation {
 			result[k] = v
 		}
 	}

vendor/sigs.k8s.io/kustomize/kyaml/resid/gvk.go

@@ -49,7 +49,7 @@ func ParseGroupVersion(apiVersion string) (group, version string) {
 // GvkFromString makes a Gvk from the output of Gvk.String().
 func GvkFromString(s string) Gvk {
 	values := strings.Split(s, fieldSep)
-	if len(values) != 3 {
+	if len(values) < 3 {
 		// ...then the string didn't come from Gvk.String().
 		return Gvk{
 			Group:   noGroup,
@@ -57,27 +57,27 @@ func GvkFromString(s string) Gvk {
 			Kind:    noKind,
 		}
 	}
-	g := values[0]
-	if g == noGroup {
-		g = ""
+	k := values[0]
+	if k == noKind {
+		k = ""
 	}
 	v := values[1]
 	if v == noVersion {
 		v = ""
 	}
-	k := values[2]
-	if k == noKind {
-		k = ""
+	g := strings.Join(values[2:], fieldSep)
+	if g == noGroup {
+		g = ""
 	}
 	return NewGvk(g, v, k)
 }
 
 // Values that are brief but meaningful in logs.
 const (
-	noGroup   = "~G"
-	noVersion = "~V"
-	noKind    = "~K"
-	fieldSep  = "_"
+	noGroup   = "[noGrp]"
+	noVersion = "[noVer]"
+	noKind    = "[noKind]"
+	fieldSep  = "."
 )
 
 // String returns a string representation of the GVK.
@@ -94,7 +94,30 @@ func (x Gvk) String() string {
 	if k == "" {
 		k = noKind
 	}
-	return strings.Join([]string{g, v, k}, fieldSep)
+	return strings.Join([]string{k, v, g}, fieldSep)
+}
+
+// legacySortString returns an older version of String() that LegacyOrderTransformer depends on
+// to keep its ordering stable across Kustomize versions
+func (x Gvk) legacySortString() string {
+	legacyNoGroup := "~G"
+	legacyNoVersion := "~V"
+	legacyNoKind := "~K"
+	legacyFieldSeparator := "_"
+
+	g := x.Group
+	if g == "" {
+		g = legacyNoGroup
+	}
+	v := x.Version
+	if v == "" {
+		v = legacyNoVersion
+	}
+	k := x.Kind
+	if k == "" {
+		k = legacyNoKind
+	}
+	return strings.Join([]string{g, v, k}, legacyFieldSeparator)
 }
 
 // ApiVersion returns the combination of Group and Version
@@ -109,7 +132,8 @@ func (x Gvk) ApiVersion() string {
 }
 
 // StringWoEmptyField returns a string representation of the GVK. Non-exist
-// fields will be omitted.
+// fields will be omitted. This is called when generating a filename for the
+// resource.
 func (x Gvk) StringWoEmptyField() string {
 	var s []string
 	if x.Group != "" {
@@ -121,7 +145,7 @@ func (x Gvk) StringWoEmptyField() string {
 	if x.Kind != "" {
 		s = append(s, x.Kind)
 	}
-	return strings.Join(s, fieldSep)
+	return strings.Join(s, "_")
 }
 
 // Equals returns true if the Gvk's have equal fields.
@@ -179,7 +203,7 @@ func (x Gvk) IsLessThan(o Gvk) bool {
 	if indexI != indexJ {
 		return indexI < indexJ
 	}
-	return x.String() < o.String()
+	return x.legacySortString() < o.legacySortString()
 }
 
 // IsSelected returns true if `selector` selects `x`; otherwise, false.

vendor/sigs.k8s.io/kustomize/kyaml/resid/resid.go

@@ -6,6 +6,8 @@ package resid
 import (
 	"reflect"
 	"strings"
+
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 // ResId is an identifier of a k8s resource object.
@@ -37,9 +39,9 @@ func NewResIdKindOnly(k string, n string) ResId {
 }
 
 const (
-	noNamespace          = "~X"
-	noName               = "~N"
-	separator            = "|"
+	noNamespace          = "[noNs]"
+	noName               = "[noName]"
+	separator            = "/"
 	TotallyNotANamespace = "_non_namespaceable_"
 	DefaultNamespace     = "default"
 )
@@ -55,31 +57,55 @@ func (id ResId) String() string {
 		nm = noName
 	}
 	return strings.Join(
-		[]string{id.Gvk.String(), ns, nm}, separator)
+		[]string{id.Gvk.String(), strings.Join([]string{nm, ns}, fieldSep)}, separator)
+}
+
+// LegacySortString returns an older version of String() that LegacyOrderTransformer depends on
+// to keep its ordering stable across Kustomize versions
+func (id ResId) LegacySortString() string {
+	legacyNoNamespace := "~X"
+	legacyNoName := "~N"
+	legacySeparator := "|"
+
+	ns := id.Namespace
+	if ns == "" {
+		ns = legacyNoNamespace
+	}
+	nm := id.Name
+	if nm == "" {
+		nm = legacyNoName
+	}
+	return strings.Join(
+		[]string{id.Gvk.String(), ns, nm}, legacySeparator)
 }
 
 func FromString(s string) ResId {
 	values := strings.Split(s, separator)
-	g := GvkFromString(values[0])
+	gvk := GvkFromString(values[0])
 
-	ns := values[1]
+	values = strings.Split(values[1], fieldSep)
+	last := len(values) - 1
+
+	ns := values[last]
 	if ns == noNamespace {
 		ns = ""
 	}
-	nm := values[2]
+	nm := strings.Join(values[:last], fieldSep)
 	if nm == noName {
 		nm = ""
 	}
 	return ResId{
-		Gvk:       g,
+		Gvk:       gvk,
 		Namespace: ns,
 		Name:      nm,
 	}
 }
 
-// GvknString of ResId based on GVK and name
-func (id ResId) GvknString() string {
-	return id.Gvk.String() + separator + id.Name
+// FromRNode returns the ResId for the RNode
+func FromRNode(rn *yaml.RNode) ResId {
+	group, version := ParseGroupVersion(rn.GetApiVersion())
+	return NewResIdWithNamespace(
+		Gvk{Group: group, Version: version, Kind: rn.GetKind()}, rn.GetName(), rn.GetNamespace())
 }
 
 // GvknEquals returns true if the other id matches

vendor/sigs.k8s.io/kustomize/kyaml/yaml/alias.go

@@ -93,3 +93,7 @@ var FoldedStyle yaml.Style = yaml.FoldedStyle
 var LiteralStyle yaml.Style = yaml.LiteralStyle
 var SingleQuotedStyle yaml.Style = yaml.SingleQuotedStyle
 var TaggedStyle yaml.Style = yaml.TaggedStyle
+
+const (
+	MergeTag = "!!merge"
+)

vendor/sigs.k8s.io/kustomize/kyaml/yaml/fns.go

@@ -612,6 +612,50 @@ func Set(value *RNode) FieldSetter {
 	return FieldSetter{Value: value}
 }
 
+// MapEntrySetter sets a map entry to a value. If it finds a key with the same
+// value, it will override both Key and Value RNodes, including style and any
+// other metadata. If it doesn't find the key, it will insert a new map entry.
+// It will set the field, even if it's empty or nil, unlike the FieldSetter.
+// This is useful for rebuilding some pre-existing RNode structure.
+type MapEntrySetter struct {
+	// Name is the name of the field or key to lookup in a MappingNode.
+	// If Name is unspecified, it will use the Key's Value
+	Name string `yaml:"name,omitempty"`
+
+	// Value is the value to set.
+	Value *RNode `yaml:"value,omitempty"`
+
+	// Key is the map key to set.
+	Key *RNode `yaml:"key,omitempty"`
+}
+
+func (s MapEntrySetter) Filter(rn *RNode) (*RNode, error) {
+	if rn == nil {
+		return nil, errors.Errorf("Can't set map entry on a nil RNode")
+	}
+	if err := ErrorIfInvalid(rn, yaml.MappingNode); err != nil {
+		return nil, err
+	}
+	if s.Name == "" {
+		s.Name = GetValue(s.Key)
+	}
+	for i := 0; i < len(rn.Content()); i = IncrementFieldIndex(i) {
+		isMatchingField := rn.Content()[i].Value == s.Name
+		if isMatchingField {
+			rn.Content()[i] = s.Key.YNode()
+			rn.Content()[i+1] = s.Value.YNode()
+			return rn, nil
+		}
+	}
+
+	// create the field
+	rn.YNode().Content = append(
+		rn.YNode().Content,
+		s.Key.YNode(),
+		s.Value.YNode())
+	return rn, nil
+}
+
 // FieldSetter sets a field or map entry to a value.
 type FieldSetter struct {
 	Kind string `yaml:"kind,omitempty"`
@@ -641,6 +685,12 @@ func (s FieldSetter) Filter(rn *RNode) (*RNode, error) {
 		s.Value = NewScalarRNode(s.StringValue)
 	}
 
+	// need to set style for strings not recognized by yaml 1.1 to quoted if not previously set
+	// TODO: fix in upstream yaml library so this can be handled with yaml SetString
+	if s.Value.IsStringValue() && !s.OverrideStyle && s.Value.YNode().Style == 0 && IsYaml1_1NonString(s.Value.YNode()) {
+		s.Value.YNode().Style = yaml.DoubleQuotedStyle
+	}
+
 	if s.Name == "" {
 		if err := ErrorIfInvalid(rn, yaml.ScalarNode); err != nil {
 			return rn, err
@@ -782,6 +832,19 @@ func IsListIndex(p string) bool {
 	return strings.HasPrefix(p, "[") && strings.HasSuffix(p, "]")
 }
 
+// IsIdxNumber returns true if p is an index number.
+// e.g. 1
+func IsIdxNumber(p string) bool {
+	idx, err := strconv.Atoi(p)
+	return err == nil && idx >= 0
+}
+
+// IsWildcard returns true if p is matching every elements.
+// e.g. "*"
+func IsWildcard(p string) bool {
+	return p == "*"
+}
+
 // SplitIndexNameValue splits a lookup part Val index into the field name
 // and field value to match.
 // e.g. splits [name=nginx] into (name, nginx)

vendor/sigs.k8s.io/kustomize/kyaml/yaml/match.go

@@ -5,6 +5,7 @@ package yaml
 
 import (
 	"regexp"
+	"strconv"
 	"strings"
 )
 
@@ -42,9 +43,10 @@ type PathMatcher struct {
 	// This is useful for if the nodes are to be printed in FlowStyle.
 	StripComments bool
 
-	val        *RNode
-	field      string
-	matchRegex string
+	val         *RNode
+	field       string
+	matchRegex  string
+	indexNumber int
 }
 
 func (p *PathMatcher) stripComments(n *Node) {
@@ -79,14 +81,49 @@ func (p *PathMatcher) filter(rn *RNode) (*RNode, error) {
 		return p.val, nil
 	}
 
+	if IsIdxNumber(p.Path[0]) {
+		return p.doIndexSeq(rn)
+	}
+
 	if IsListIndex(p.Path[0]) {
 		// match seq elements
 		return p.doSeq(rn)
 	}
+
+	if IsWildcard(p.Path[0]) {
+		// match every elements (*)
+		return p.doMatchEvery(rn)
+	}
 	// match a field
 	return p.doField(rn)
 }
 
+func (p *PathMatcher) doMatchEvery(rn *RNode) (*RNode, error) {
+
+	if err := rn.VisitElements(p.visitEveryElem); err != nil {
+		return nil, err
+	}
+
+	return p.val, nil
+}
+
+func (p *PathMatcher) visitEveryElem(elem *RNode) error {
+
+	fieldName := p.Path[0]
+	// recurse on the matching element
+	pm := &PathMatcher{Path: p.Path[1:]}
+	add, err := pm.filter(elem)
+	for k, v := range pm.Matches {
+		p.Matches[k] = v
+	}
+	if err != nil || add == nil {
+		return err
+	}
+	p.append(fieldName, add.Content()...)
+
+	return nil
+}
+
 func (p *PathMatcher) doField(rn *RNode) (*RNode, error) {
 	// lookup the field
 	field, err := rn.Pipe(Get(p.Path[0]))
@@ -102,6 +139,36 @@ func (p *PathMatcher) doField(rn *RNode) (*RNode, error) {
 	return p.val, err
 }
 
+// doIndexSeq iterates over a sequence and appends elements matching the index p.Val
+func (p *PathMatcher) doIndexSeq(rn *RNode) (*RNode, error) {
+	// parse to index number
+	idx, err := strconv.Atoi(p.Path[0])
+	if err != nil {
+		return nil, err
+	}
+	p.indexNumber = idx
+
+	elements, err := rn.Elements()
+	if err != nil {
+		return nil, err
+	}
+
+	// get target element
+	element := elements[idx]
+
+	// recurse on the matching element
+	pm := &PathMatcher{Path: p.Path[1:]}
+	add, err := pm.filter(element)
+	for k, v := range pm.Matches {
+		p.Matches[k] = v
+	}
+	if err != nil || add == nil {
+		return nil, err
+	}
+	p.append("", add.Content()...)
+	return p.val, nil
+}
+
 // doSeq iterates over a sequence and appends elements matching the path regex to p.Val
 func (p *PathMatcher) doSeq(rn *RNode) (*RNode, error) {
 	// parse the field + match pair

vendor/sigs.k8s.io/kustomize/kyaml/yaml/rnode.go

@@ -248,6 +248,11 @@ func (rn *RNode) IsNilOrEmpty() bool {
 		IsYNodeZero(rn.YNode())
 }
 
+// IsStringValue is true if the RNode is not nil and is scalar string node
+func (rn *RNode) IsStringValue() bool {
+	return !rn.IsNil() && IsYNodeString(rn.YNode())
+}
+
 // GetMeta returns the ResourceMeta for an RNode
 func (rn *RNode) GetMeta() (ResourceMeta, error) {
 	if IsMissingOrNull(rn) {
@@ -932,7 +937,17 @@ func deAnchor(yn *yaml.Node) (res *yaml.Node, err error) {
 		return yn, nil
 	case yaml.AliasNode:
 		return deAnchor(yn.Alias)
-	case yaml.DocumentNode, yaml.MappingNode, yaml.SequenceNode:
+	case yaml.MappingNode:
+		toMerge, err := removeMergeTags(yn)
+		if err != nil {
+			return nil, err
+		}
+		err = mergeAll(yn, toMerge)
+		if err != nil {
+			return nil, err
+		}
+		fallthrough
+	case yaml.DocumentNode, yaml.SequenceNode:
 		for i := range yn.Content {
 			yn.Content[i], err = deAnchor(yn.Content[i])
 			if err != nil {
@@ -945,6 +960,103 @@ func deAnchor(yn *yaml.Node) (res *yaml.Node, err error) {
 	}
 }
 
+// isMerge returns if the node is tagged with !!merge
+func isMerge(yn *yaml.Node) bool {
+	return yn.Tag == MergeTag
+}
+
+// findMergeValues receives either a MappingNode, a AliasNode or a potentially
+// mixed list of MappingNodes and AliasNodes. It returns a list of MappingNodes.
+func findMergeValues(yn *yaml.Node) ([]*yaml.Node, error) {
+	if yn == nil {
+		return []*yaml.Node{}, nil
+	}
+	switch yn.Kind {
+	case MappingNode:
+		return []*yaml.Node{yn}, nil
+	case AliasNode:
+		if yn.Alias != nil && yn.Alias.Kind != MappingNode {
+			return nil, errors.Errorf("invalid map merge: received alias for a non-map value")
+		}
+		return []*yaml.Node{yn.Alias}, nil
+	case SequenceNode:
+		mergeValues := []*yaml.Node{}
+		for i := 0; i < len(yn.Content); i++ {
+			if yn.Content[i].Kind == SequenceNode {
+				return nil, errors.Errorf("invalid map merge: received a nested sequence")
+			}
+			newMergeValues, err := findMergeValues(yn.Content[i])
+			if err != nil {
+				return nil, err
+			}
+			mergeValues = append(newMergeValues, mergeValues...)
+		}
+		return mergeValues, nil
+	default:
+		return nil, errors.Errorf("map merge requires map or sequence of maps as the value")
+	}
+}
+
+// getMergeTagValue receives a MappingNode yaml node, and it searches for
+// merge tagged keys and return its value yaml node. If the key is duplicated,
+// it fails.
+func getMergeTagValue(yn *yaml.Node) (*yaml.Node, error) {
+	var result *yaml.Node
+	for i := 0; i < len(yn.Content); i += 2 {
+		key := yn.Content[i]
+		value := yn.Content[i+1]
+		if isMerge(key) {
+			if result != nil {
+				return nil, fmt.Errorf("duplicate merge key")
+			}
+			result = value
+		}
+	}
+	return result, nil
+}
+
+// removeMergeTags removes all merge tags and returns a ordered list of yaml
+// nodes to merge and a error
+func removeMergeTags(yn *yaml.Node) ([]*yaml.Node, error) {
+	if yn == nil || yn.Content == nil {
+		return nil, nil
+	}
+	if yn.Kind != yaml.MappingNode {
+		return nil, nil
+	}
+	value, err := getMergeTagValue(yn)
+	if err != nil {
+		return nil, err
+	}
+	toMerge, err := findMergeValues(value)
+	if err != nil {
+		return nil, err
+	}
+	err = NewRNode(yn).PipeE(Clear("<<"))
+	if err != nil {
+		return nil, err
+	}
+	return toMerge, nil
+}
+
+func mergeAll(yn *yaml.Node, toMerge []*yaml.Node) error {
+	// We only need to start with a copy of the existing node because we need to
+	// maintain duplicated keys and style
+	rn := NewRNode(yn).Copy()
+	toMerge = append(toMerge, yn)
+	for i := range toMerge {
+		rnToMerge := NewRNode(toMerge[i]).Copy()
+		err := rnToMerge.VisitFields(func(node *MapNode) error {
+			return rn.PipeE(MapEntrySetter{Key: node.Key, Value: node.Value})
+		})
+		if err != nil {
+			return err
+		}
+	}
+	*yn = *rn.value
+	return nil
+}
+
 // GetValidatedMetadata returns metadata after subjecting it to some tests.
 func (rn *RNode) GetValidatedMetadata() (ResourceMeta, error) {
 	m, err := rn.GetMeta()
@@ -1063,7 +1175,6 @@ func checkKey(key string, elems []*Node) bool {
 	return count == len(elems)
 }
 
-// Deprecated: use pipes instead.
 // GetSlice returns the contents of the slice field at the given path.
 func (rn *RNode) GetSlice(path string) ([]interface{}, error) {
 	value, err := rn.GetFieldValue(path)
@@ -1076,7 +1187,6 @@ func (rn *RNode) GetSlice(path string) ([]interface{}, error) {
 	return nil, fmt.Errorf("node %s is not a slice", path)
 }
 
-// Deprecated: use pipes instead.
 // GetString returns the contents of the string field at the given path.
 func (rn *RNode) GetString(path string) (string, error) {
 	value, err := rn.GetFieldValue(path)
@@ -1089,7 +1199,6 @@ func (rn *RNode) GetString(path string) (string, error) {
 	return "", fmt.Errorf("node %s is not a string: %v", path, value)
 }
 
-// Deprecated: use slash paths instead.
 // GetFieldValue finds period delimited fields.
 // TODO: When doing kustomize var replacement, which is likely a
 // a primary use of this function and the reason it returns interface{}