feat: kubesphere 4.0 (#6115)

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

---------

Signed-off-by: ci-bot <ci-bot@kubesphere.io>
Co-authored-by: ks-ci-bot <ks-ci-bot@example.com>
Co-authored-by: joyceliu <joyceliu@yunify.com>

vendor/sigs.k8s.io/kustomize/api/filters/nameref/nameref.go

@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/fieldspec"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -64,7 +64,7 @@ func (f Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		FieldSpec: f.NameFieldToUpdate,
 		SetValue:  f.set,
 	}); err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "updating name reference in '%s' field of '%s'",
 			f.NameFieldToUpdate.Path, f.Referrer.CurId().String())
 	}
@@ -104,7 +104,7 @@ func (f Filter) setMapping(node *yaml.RNode) error {
 	}
 	nameNode, err := node.Pipe(yaml.FieldMatcher{Name: "name"})
 	if err != nil {
-		return errors.Wrap(err, "trying to match 'name' field")
+		return errors.WrapPrefixf(err, "trying to match 'name' field")
 	}
 	if nameNode == nil {
 		// This is a _configuration_ error; the field path
@@ -153,7 +153,7 @@ func (f Filter) filterMapCandidatesByNamespace(
 	node *yaml.RNode) ([]*resource.Resource, error) {
 	namespaceNode, err := node.Pipe(yaml.FieldMatcher{Name: "namespace"})
 	if err != nil {
-		return nil, errors.Wrap(err, "trying to match 'namespace' field")
+		return nil, errors.WrapPrefixf(err, "trying to match 'namespace' field")
 	}
 	if namespaceNode == nil {
 		return f.ReferralCandidates.Resources(), nil

vendor/sigs.k8s.io/kustomize/api/filters/namespace/namespace.go

@@ -56,9 +56,11 @@ func (ns Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 
 // Run runs the filter on a single node rather than a slice
 func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
-	// Special handling for metadata.namespace -- :(
+	// Special handling for metadata.namespace and metadata.name -- :(
 	// never let SetEntry handle metadata.namespace--it will incorrectly include cluster-scoped resources
-	ns.FsSlice = ns.removeMetaNamespaceFieldSpecs(ns.FsSlice)
+	// only update metadata.name if api version is expected one--so-as it leaves other resources of kind namespace alone
+	apiVersion := node.GetApiVersion()
+	ns.FsSlice = ns.removeUnneededMetaFieldSpecs(apiVersion, ns.FsSlice)
 	gvk := resid.GvkFromNode(node)
 	if err := ns.metaNamespaceHack(node, gvk); err != nil {
 		return nil, err
@@ -79,7 +81,11 @@ func (ns Filter) run(node *yaml.RNode) (*yaml.RNode, error) {
 		CreateKind: yaml.ScalarNode, // Namespace is a ScalarNode
 		CreateTag:  yaml.NodeTagString,
 	})
-	return node, err
+	invalidKindErr := &yaml.InvalidNodeKindError{}
+	if err != nil && errors.As(err, &invalidKindErr) && invalidKindErr.ActualNodeKind() != yaml.ScalarNode {
+		return nil, errors.WrapPrefixf(err, "namespace field specs must target scalar nodes")
+	}
+	return node, errors.WrapPrefixf(err, "namespace transformation failed")
 }
 
 // metaNamespaceHack is a hack for implementing the namespace transform
@@ -174,8 +180,7 @@ func setNamespaceField(node *yaml.RNode, setter filtersutil.SetFn) error {
 func (ns Filter) removeRoleBindingSubjectFieldSpecs(fs types.FsSlice) types.FsSlice {
 	var val types.FsSlice
 	for i := range fs {
-		if isRoleBinding(fs[i].Kind) &&
-			(fs[i].Path == subjectsNamespacePath || fs[i].Path == subjectsField) {
+		if isRoleBinding(fs[i].Kind) && fs[i].Path == subjectsNamespacePath {
 			continue
 		}
 		val = append(val, fs[i])
@@ -183,12 +188,15 @@ func (ns Filter) removeRoleBindingSubjectFieldSpecs(fs types.FsSlice) types.FsSl
 	return val
 }
 
-func (ns Filter) removeMetaNamespaceFieldSpecs(fs types.FsSlice) types.FsSlice {
+func (ns Filter) removeUnneededMetaFieldSpecs(apiVersion string, fs types.FsSlice) types.FsSlice {
 	var val types.FsSlice
 	for i := range fs {
 		if fs[i].Path == types.MetadataNamespacePath {
 			continue
 		}
+		if apiVersion != types.MetadataNamespaceApiVersion && fs[i].Path == types.MetadataNamePath {
+			continue
+		}
 		val = append(val, fs[i])
 	}
 	return val

vendor/sigs.k8s.io/kustomize/api/filters/replacement/replacement.go

@@ -4,13 +4,13 @@
 package replacement
 
 import (
-	"errors"
 	"fmt"
 	"strings"
 
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml_utils "sigs.k8s.io/kustomize/kyaml/utils"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -105,7 +105,7 @@ func getRefinedValue(options *types.FieldOptions, rn *yaml.RNode) (*yaml.RNode,
 func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []*types.TargetSelector) ([]*yaml.RNode, error) {
 	for _, selector := range targetSelectors {
 		if selector.Select == nil {
-			return nil, errors.New("target must specify resources to select")
+			return nil, errors.Errorf("target must specify resources to select")
 		}
 		if len(selector.FieldPaths) == 0 {
 			selector.FieldPaths = []string{types.DefaultReplacementFieldPath}
@@ -179,29 +179,22 @@ func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
 
 func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.TargetSelector) error {
 	for _, fp := range selector.FieldPaths {
-		fieldPath := kyaml_utils.SmarterPathSplitter(fp, ".")
-		create, err := shouldCreateField(selector.Options, fieldPath)
-		if err != nil {
-			return err
+		createKind := yaml.Kind(0) // do not create
+		if selector.Options != nil && selector.Options.Create {
+			createKind = value.YNode().Kind
 		}
-
-		var targetFields []*yaml.RNode
-		if create {
-			createdField, createErr := target.Pipe(yaml.LookupCreate(value.YNode().Kind, fieldPath...))
-			if createErr != nil {
-				return fmt.Errorf("error creating replacement node: %w", createErr)
-			}
-			targetFields = append(targetFields, createdField)
-		} else {
-			// may return multiple fields, always wrapped in a sequence node
-			foundFieldSequence, lookupErr := target.Pipe(&yaml.PathMatcher{Path: fieldPath})
-			if lookupErr != nil {
-				return fmt.Errorf("error finding field in replacement target: %w", lookupErr)
-			}
-			targetFields, err = foundFieldSequence.Elements()
-			if err != nil {
-				return fmt.Errorf("error fetching elements in replacement target: %w", err)
-			}
+		targetFieldList, err := target.Pipe(&yaml.PathMatcher{
+			Path:   kyaml_utils.SmarterPathSplitter(fp, "."),
+			Create: createKind})
+		if err != nil {
+			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+		}
+		targetFields, err := targetFieldList.Elements()
+		if err != nil {
+			return errors.WrapPrefixf(err, fieldRetrievalError(fp, createKind != 0))
+		}
+		if len(targetFields) == 0 {
+			return errors.Errorf(fieldRetrievalError(fp, createKind != 0))
 		}
 
 		for _, t := range targetFields {
@@ -209,11 +202,17 @@ func copyValueToTarget(target *yaml.RNode, value *yaml.RNode, selector *types.Ta
 				return err
 			}
 		}
-
 	}
 	return nil
 }
 
+func fieldRetrievalError(fieldPath string, isCreate bool) string {
+	if isCreate {
+		return fmt.Sprintf("unable to find or create field %q in replacement target", fieldPath)
+	}
+	return fmt.Sprintf("unable to find field %q in replacement target", fieldPath)
+}
+
 func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *yaml.RNode) error {
 	value = value.Copy()
 	if options != nil && options.Delimiter != "" {
@@ -243,16 +242,3 @@ func setFieldValue(options *types.FieldOptions, targetField *yaml.RNode, value *
 
 	return nil
 }
-
-func shouldCreateField(options *types.FieldOptions, fieldPath []string) (bool, error) {
-	if options == nil || !options.Create {
-		return false, nil
-	}
-	// create option is not supported in a wildcard matching
-	for _, f := range fieldPath {
-		if f == "*" {
-			return false, fmt.Errorf("cannot support create option in a multi-value target")
-		}
-	}
-	return true, nil
-}

vendor/sigs.k8s.io/kustomize/api/ifc/ifc.go

@@ -28,12 +28,20 @@ type KvLoader interface {
 
 // Loader interface exposes methods to read bytes.
 type Loader interface {
+
+	// Repo returns the repo location if this Loader was created from a url
+	// or the empty string otherwise.
+	Repo() string
+
 	// Root returns the root location for this Loader.
 	Root() string
+
 	// New returns Loader located at newRoot.
 	New(newRoot string) (Loader, error)
+
 	// Load returns the bytes read from the location or an error.
 	Load(location string) ([]byte, error)
+
 	// Cleanup cleans the loader
 	Cleanup() error
 }

vendor/sigs.k8s.io/kustomize/api/internal/accumulator/loadconfigfromcrds.go

@@ -7,11 +7,11 @@ import (
 	"encoding/json"
 	"strings"
 
-	"github.com/pkg/errors"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	"sigs.k8s.io/yaml"
@@ -39,7 +39,7 @@ func LoadConfigFromCRDs(
 		}
 		m, err := makeNameToApiMap(content)
 		if err != nil {
-			return nil, errors.Wrapf(err, "unable to parse open API definition from '%s'", path)
+			return nil, errors.WrapPrefixf(err, "unable to parse open API definition from '%s'", path)
 		}
 		otherTc, err := makeConfigFromApiMap(m)
 		if err != nil {

vendor/sigs.k8s.io/kustomize/api/internal/accumulator/resaccumulator.go

@@ -170,9 +170,10 @@ func (ra *ResAccumulator) FixBackReferences() (err error) {
 
 // Intersection drops the resources which "other" does not have.
 func (ra *ResAccumulator) Intersection(other resmap.ResMap) error {
+	otherIds := other.AllIds()
 	for _, curId := range ra.resMap.AllIds() {
 		toDelete := true
-		for _, otherId := range other.AllIds() {
+		for _, otherId := range otherIds {
 			if otherId == curId {
 				toDelete = false
 				break

vendor/sigs.k8s.io/kustomize/api/internal/builtins/AnnotationsTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on AnnotationsTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ConfigMapGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ConfigMapGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/HashTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on HashTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/HelmChartInflationGenerator.go

@@ -1,12 +1,11 @@
 // Code generated by pluginator on HelmChartInflationGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -14,14 +13,14 @@ import (
 	"strings"
 
 	"github.com/imdario/mergo"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/yaml"
 )
 
-// HelmChartInflationGeneratorPlugin is a plugin to generate resources
-// from a remote or local helm chart.
+// Generate resources from a remote or local helm chart.
 type HelmChartInflationGeneratorPlugin struct {
 	h *resmap.PluginHelpers
 	types.HelmGlobals
@@ -29,8 +28,6 @@ type HelmChartInflationGeneratorPlugin struct {
 	tmpDir string
 }
 
-var KustomizePlugin HelmChartInflationGeneratorPlugin
-
 const (
 	valuesMergeOptionMerge    = "merge"
 	valuesMergeOptionOverride = "override"
@@ -73,7 +70,7 @@ func (p *HelmChartInflationGeneratorPlugin) establishTmpDir() (err error) {
 		// already done.
 		return nil
 	}
-	p.tmpDir, err = ioutil.TempDir("", "kustomize-helm-")
+	p.tmpDir, err = os.MkdirTemp("", "kustomize-helm-")
 	return err
 }
 
@@ -87,15 +84,23 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// the loader root (unless root restrictions are
 	// disabled, in which case this can be an absolute path).
 	if p.ChartHome == "" {
-		p.ChartHome = "charts"
+		p.ChartHome = types.HelmDefaultHome
 	}
 
-	// The ValuesFile may be consulted by the plugin, so it must
+	// The ValuesFile(s) may be consulted by the plugin, so it must
 	// be under the loader root (unless root restrictions are
 	// disabled).
 	if p.ValuesFile == "" {
 		p.ValuesFile = filepath.Join(p.ChartHome, p.Name, "values.yaml")
 	}
+	for i, file := range p.AdditionalValuesFiles {
+		// use Load() to enforce root restrictions
+		if _, err := p.h.Loader().Load(file); err != nil {
+			return errors.WrapPrefixf(err, "could not load additionalValuesFile")
+		}
+		// the additional values filepaths must be relative to the kust root
+		p.AdditionalValuesFiles[i] = filepath.Join(p.h.Loader().Root(), file)
+	}
 
 	if err = p.errIfIllegalValuesMerge(); err != nil {
 		return err
@@ -104,7 +109,7 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// ConfigHome is not loaded by the plugin, and can be located anywhere.
 	if p.ConfigHome == "" {
 		if err = p.establishTmpDir(); err != nil {
-			return errors.Wrap(
+			return errors.WrapPrefixf(
 				err, "unable to create tmp dir for HELM_CONFIG_HOME")
 		}
 		p.ConfigHome = filepath.Join(p.tmpDir, "helm")
@@ -148,10 +153,10 @@ func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
 	err := cmd.Run()
 	if err != nil {
 		helm := p.h.GeneralConfig().HelmConfig.Command
-		err = errors.Wrap(
+		err = errors.WrapPrefixf(
 			fmt.Errorf(
-				"unable to run: '%s %s' with env=%s (is '%s' installed?)",
-				helm, strings.Join(args, " "), env, helm),
+				"unable to run: '%s %s' with env=%s (is '%s' installed?): %w",
+				helm, strings.Join(args, " "), env, helm, err),
 			stderr.String(),
 		)
 	}
@@ -211,7 +216,7 @@ func (p *HelmChartInflationGeneratorPlugin) writeValuesBytes(
 		return "", fmt.Errorf("cannot create tmp dir to write helm values")
 	}
 	path := filepath.Join(p.tmpDir, p.Name+"-kustomize-values.yaml")
-	return path, ioutil.WriteFile(path, b, 0644)
+	return path, errors.WrapPrefixf(os.WriteFile(path, b, 0644), "failed to write values file")
 }
 
 func (p *HelmChartInflationGeneratorPlugin) cleanup() {
@@ -244,46 +249,31 @@ func (p *HelmChartInflationGeneratorPlugin) Generate() (rm resmap.ResMap, err er
 		return nil, err
 	}
 	var stdout []byte
-	stdout, err = p.runHelmCommand(p.templateCommand())
+	stdout, err = p.runHelmCommand(p.AsHelmArgs(p.absChartHome()))
 	if err != nil {
 		return nil, err
 	}
 
-	rm, err = p.h.ResmapFactory().NewResMapFromBytes(stdout)
-	if err == nil {
+	rm, resMapErr := p.h.ResmapFactory().NewResMapFromBytes(stdout)
+	if resMapErr == nil {
 		return rm, nil
 	}
 	// try to remove the contents before first "---" because
 	// helm may produce messages to stdout before it
-	stdoutStr := string(stdout)
-	if idx := strings.Index(stdoutStr, "---"); idx != -1 {
-		return p.h.ResmapFactory().NewResMapFromBytes([]byte(stdoutStr[idx:]))
+	r := &kio.ByteReader{Reader: bytes.NewBufferString(string(stdout)), OmitReaderAnnotations: true}
+	nodes, err := r.Read()
+	if err != nil {
+		return nil, fmt.Errorf("error reading helm output: %w", err)
 	}
-	return nil, err
-}
 
-func (p *HelmChartInflationGeneratorPlugin) templateCommand() []string {
-	args := []string{"template"}
-	if p.ReleaseName != "" {
-		args = append(args, p.ReleaseName)
+	if len(nodes) != 0 {
+		rm, err = p.h.ResmapFactory().NewResMapFromRNodeSlice(nodes)
+		if err != nil {
+			return nil, fmt.Errorf("could not parse rnode slice into resource map: %w", err)
+		}
+		return rm, nil
 	}
-	if p.Namespace != "" {
-		args = append(args, "--namespace", p.Namespace)
-	}
-	args = append(args, filepath.Join(p.absChartHome(), p.Name))
-	if p.ValuesFile != "" {
-		args = append(args, "--values", p.ValuesFile)
-	}
-	if p.ReleaseName == "" {
-		// AFAICT, this doesn't work as intended due to a bug in helm.
-		// See https://github.com/helm/helm/issues/6019
-		// I've tried placing the flag before and after the name argument.
-		args = append(args, "--generate-name")
-	}
-	if p.IncludeCRDs {
-		args = append(args, "--include-crds")
-	}
-	return args
+	return nil, fmt.Errorf("could not parse bytes into resource map: %w", resMapErr)
 }
 
 func (p *HelmChartInflationGeneratorPlugin) pullCommand() []string {

vendor/sigs.k8s.io/kustomize/api/internal/builtins/IAMPolicyGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on IAMPolicyGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ImageTagTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ImageTagTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/LabelTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on LabelTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/LegacyOrderTransformer.go

@@ -1,46 +0,0 @@
-// Code generated by pluginator on LegacyOrderTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
-
-package builtins
-
-import (
-	"sort"
-
-	"github.com/pkg/errors"
-	"sigs.k8s.io/kustomize/api/resmap"
-	"sigs.k8s.io/kustomize/api/resource"
-)
-
-// Sort the resources using an ordering defined in the Gvk class.
-// This puts cluster-wide basic resources with no
-// dependencies (like Namespace, StorageClass, etc.)
-// first, and resources with a high number of dependencies
-// (like ValidatingWebhookConfiguration) last.
-type LegacyOrderTransformerPlugin struct{}
-
-// Nothing needed for configuration.
-func (p *LegacyOrderTransformerPlugin) Config(
-	_ *resmap.PluginHelpers, _ []byte) (err error) {
-	return nil
-}
-
-func (p *LegacyOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
-	resources := make([]*resource.Resource, m.Size())
-	ids := m.AllIds()
-	sort.Sort(resmap.IdSlice(ids))
-	for i, id := range ids {
-		resources[i], err = m.GetByCurrentId(id)
-		if err != nil {
-			return errors.Wrap(err, "expected match for sorting")
-		}
-	}
-	m.Clear()
-	for _, r := range resources {
-		m.Append(r)
-	}
-	return nil
-}
-
-func NewLegacyOrderTransformerPlugin() resmap.TransformerPlugin {
-	return &LegacyOrderTransformerPlugin{}
-}

vendor/sigs.k8s.io/kustomize/api/internal/builtins/NamespaceTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on NamespaceTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchJson6902Transformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchJson6902Transformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 
@@ -7,11 +7,11 @@ import (
 	"fmt"
 
 	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/yaml"
 )
@@ -61,7 +61,7 @@ func (p *PatchJson6902TransformerPlugin) Config(
 	}
 	p.decodedPatch, err = jsonpatch.DecodePatch([]byte(p.JsonOp))
 	if err != nil {
-		return errors.Wrapf(err, "decoding %s", p.JsonOp)
+		return errors.WrapPrefixf(err, "decoding %s", p.JsonOp)
 	}
 	if len(p.decodedPatch) == 0 {
 		return fmt.Errorf(

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchStrategicMergeTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchStrategicMergeTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PatchTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PatchTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/PrefixTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on PrefixTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ReplacementTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ReplacementTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ReplicaCountTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ReplicaCountTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SecretGenerator.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on SecretGenerator; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SortOrderTransformer.go

@@ -0,0 +1,244 @@
+// Code generated by pluginator on SortOrderTransformer; DO NOT EDIT.
+// pluginator {(devel)  unknown   }
+
+package builtins
+
+import (
+	"sort"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+	"sigs.k8s.io/yaml"
+)
+
+// Sort the resources using a customizable ordering based of Kind.
+// Defaults to the ordering of the GVK struct, which puts cluster-wide basic
+// resources with no dependencies (like Namespace, StorageClass, etc.) first,
+// and resources with a high number of dependencies
+// (like ValidatingWebhookConfiguration) last.
+type SortOrderTransformerPlugin struct {
+	SortOptions *types.SortOptions `json:"sortOptions,omitempty" yaml:"sortOptions,omitempty"`
+}
+
+func (p *SortOrderTransformerPlugin) Config(
+	_ *resmap.PluginHelpers, c []byte) error {
+	return errors.WrapPrefixf(yaml.Unmarshal(c, p), "Failed to unmarshal SortOrderTransformer config")
+}
+
+func (p *SortOrderTransformerPlugin) applyDefaults() {
+	// Default to FIFO sort, aka no-op.
+	if p.SortOptions == nil {
+		p.SortOptions = &types.SortOptions{
+			Order: types.FIFOSortOrder,
+		}
+	}
+
+	// If legacy sort is selected and no options are given, default to
+	// hardcoded order.
+	if p.SortOptions.Order == types.LegacySortOrder && p.SortOptions.LegacySortOptions == nil {
+		p.SortOptions.LegacySortOptions = &types.LegacySortOptions{
+			OrderFirst: defaultOrderFirst,
+			OrderLast:  defaultOrderLast,
+		}
+	}
+}
+
+func (p *SortOrderTransformerPlugin) validate() error {
+	// Check valid values for SortOrder
+	if p.SortOptions.Order != types.FIFOSortOrder && p.SortOptions.Order != types.LegacySortOrder {
+		return errors.Errorf("the field 'sortOptions.order' must be one of [%s, %s]",
+			types.FIFOSortOrder, types.LegacySortOrder)
+	}
+
+	// Validate that the only options set are the ones corresponding to the
+	// selected sort order.
+	if p.SortOptions.Order == types.FIFOSortOrder &&
+		p.SortOptions.LegacySortOptions != nil {
+		return errors.Errorf("the field 'sortOptions.legacySortOptions' is"+
+			" set but the selected sort order is '%v', not 'legacy'",
+			p.SortOptions.Order)
+	}
+	return nil
+}
+
+func (p *SortOrderTransformerPlugin) Transform(m resmap.ResMap) (err error) {
+	p.applyDefaults()
+	err = p.validate()
+	if err != nil {
+		return err
+	}
+
+	// Sort
+	if p.SortOptions.Order == types.LegacySortOrder {
+		s := newLegacyIDSorter(m.AllIds(), p.SortOptions.LegacySortOptions)
+		sort.Sort(s)
+		err = applyOrdering(m, s.resids)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// applyOrdering takes resources (given in ResMap) and a desired ordering given
+// as a sequence of ResIds, and updates the ResMap's resources to match the
+// ordering.
+func applyOrdering(m resmap.ResMap, ordering []resid.ResId) error {
+	var err error
+	resources := make([]*resource.Resource, m.Size())
+	// Clear and refill with the correct order
+	for i, id := range ordering {
+		resources[i], err = m.GetByCurrentId(id)
+		if err != nil {
+			return errors.WrapPrefixf(err, "expected match for sorting")
+		}
+	}
+	m.Clear()
+	for _, r := range resources {
+		err = m.Append(r)
+		if err != nil {
+			return errors.WrapPrefixf(err, "SortOrderTransformer: Failed to append to resources")
+		}
+	}
+	return nil
+}
+
+// Code for legacy sorting.
+// Legacy sorting is a "fixed" order sorting maintained for backwards
+// compatibility.
+
+// legacyIDSorter sorts resources based on two priority lists:
+// - orderFirst: Resources that should be placed in the start, in the given order.
+// - orderLast: Resources that should be placed in the end, in the given order.
+type legacyIDSorter struct {
+	// resids only stores the metadata of the object. This is an optimization as
+	// it's expensive to compute these again and again during ordering.
+	resids     []resid.ResId
+	typeOrders map[string]int
+}
+
+func newLegacyIDSorter(
+	resids []resid.ResId,
+	options *types.LegacySortOptions) *legacyIDSorter {
+	// Precalculate a resource ranking based on the priority lists.
+	var typeOrders = func() map[string]int {
+		m := map[string]int{}
+		for i, n := range options.OrderFirst {
+			m[n] = -len(options.OrderFirst) + i
+		}
+		for i, n := range options.OrderLast {
+			m[n] = 1 + i
+		}
+		return m
+	}()
+	return &legacyIDSorter{
+		resids:     resids,
+		typeOrders: typeOrders,
+	}
+}
+
+var _ sort.Interface = legacyIDSorter{}
+
+func (a legacyIDSorter) Len() int { return len(a.resids) }
+func (a legacyIDSorter) Swap(i, j int) {
+	a.resids[i], a.resids[j] = a.resids[j], a.resids[i]
+}
+func (a legacyIDSorter) Less(i, j int) bool {
+	if !a.resids[i].Gvk.Equals(a.resids[j].Gvk) {
+		return gvkLessThan(a.resids[i].Gvk, a.resids[j].Gvk, a.typeOrders)
+	}
+	return legacyResIDSortString(a.resids[i]) < legacyResIDSortString(a.resids[j])
+}
+
+func gvkLessThan(gvk1, gvk2 resid.Gvk, typeOrders map[string]int) bool {
+	index1 := typeOrders[gvk1.Kind]
+	index2 := typeOrders[gvk2.Kind]
+	if index1 != index2 {
+		return index1 < index2
+	}
+	return legacyGVKSortString(gvk1) < legacyGVKSortString(gvk2)
+}
+
+// legacyGVKSortString returns a string representation of given GVK used for
+// stable sorting.
+func legacyGVKSortString(x resid.Gvk) string {
+	legacyNoGroup := "~G"
+	legacyNoVersion := "~V"
+	legacyNoKind := "~K"
+	legacyFieldSeparator := "_"
+
+	g := x.Group
+	if g == "" {
+		g = legacyNoGroup
+	}
+	v := x.Version
+	if v == "" {
+		v = legacyNoVersion
+	}
+	k := x.Kind
+	if k == "" {
+		k = legacyNoKind
+	}
+	return strings.Join([]string{g, v, k}, legacyFieldSeparator)
+}
+
+// legacyResIDSortString returns a string representation of given ResID used for
+// stable sorting.
+func legacyResIDSortString(id resid.ResId) string {
+	legacyNoNamespace := "~X"
+	legacyNoName := "~N"
+	legacySeparator := "|"
+
+	ns := id.Namespace
+	if ns == "" {
+		ns = legacyNoNamespace
+	}
+	nm := id.Name
+	if nm == "" {
+		nm = legacyNoName
+	}
+	return strings.Join(
+		[]string{id.Gvk.String(), ns, nm}, legacySeparator)
+}
+
+// DO NOT CHANGE!
+// Final legacy ordering provided as a default by kustomize.
+// Originally an attempt to apply resources in the correct order, an effort
+// which later proved impossible as not all types are known beforehand.
+// See: https://github.com/kubernetes-sigs/kustomize/issues/3913
+var defaultOrderFirst = []string{ //nolint:gochecknoglobals
+	"Namespace",
+	"ResourceQuota",
+	"StorageClass",
+	"CustomResourceDefinition",
+	"ServiceAccount",
+	"PodSecurityPolicy",
+	"Role",
+	"ClusterRole",
+	"RoleBinding",
+	"ClusterRoleBinding",
+	"ConfigMap",
+	"Secret",
+	"Endpoints",
+	"Service",
+	"LimitRange",
+	"PriorityClass",
+	"PersistentVolume",
+	"PersistentVolumeClaim",
+	"Deployment",
+	"StatefulSet",
+	"CronJob",
+	"PodDisruptionBudget",
+}
+var defaultOrderLast = []string{ //nolint:gochecknoglobals
+	"MutatingWebhookConfiguration",
+	"ValidatingWebhookConfiguration",
+}
+
+func NewSortOrderTransformerPlugin() resmap.TransformerPlugin {
+	return &SortOrderTransformerPlugin{}
+}

vendor/sigs.k8s.io/kustomize/api/internal/builtins/SuffixTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on SuffixTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/builtins/ValueAddTransformer.go

@@ -1,5 +1,5 @@
 // Code generated by pluginator on ValueAddTransformer; DO NOT EDIT.
-// pluginator {unknown  1970-01-01T00:00:00Z  }
+// pluginator {(devel)  unknown   }
 
 package builtins
 

vendor/sigs.k8s.io/kustomize/api/internal/generators/utils.go

@@ -5,6 +5,8 @@ package generators
 
 import (
 	"fmt"
+	"path"
+	"strings"
 
 	"github.com/go-errors/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
@@ -95,3 +97,28 @@ func setImmutable(
 
 	return nil
 }
+
+// ParseFileSource parses the source given.
+//
+// Acceptable formats include:
+//  1. source-path: the basename will become the key name
+//  2. source-name=source-path: the source-name will become the key name and
+//     source-path is the path to the key file.
+//
+// Key names cannot include '='.
+func ParseFileSource(source string) (keyName, filePath string, err error) {
+	numSeparators := strings.Count(source, "=")
+	switch {
+	case numSeparators == 0:
+		return path.Base(source), source, nil
+	case numSeparators == 1 && strings.HasPrefix(source, "="):
+		return "", "", errors.Errorf("missing key name for file path %q in source %q", strings.TrimPrefix(source, "="), source)
+	case numSeparators == 1 && strings.HasSuffix(source, "="):
+		return "", "", errors.Errorf("missing file path for key name %q in source %q", strings.TrimSuffix(source, "="), source)
+	case numSeparators > 1:
+		return "", "", errors.Errorf("source %q key name or file path contains '='", source)
+	default:
+		components := strings.Split(source, "=")
+		return components[0], components[1], nil
+	}
+}

vendor/sigs.k8s.io/kustomize/api/internal/git/cloner.go

@@ -22,15 +22,11 @@ func ClonerUsingGitExec(repoSpec *RepoSpec) error {
 	if err = r.run("init"); err != nil {
 		return err
 	}
-	if err = r.run(
-		"remote", "add", "origin", repoSpec.CloneSpec()); err != nil {
-		return err
-	}
 	ref := "HEAD"
 	if repoSpec.Ref != "" {
 		ref = repoSpec.Ref
 	}
-	if err = r.run("fetch", "--depth=1", "origin", ref); err != nil {
+	if err = r.run("fetch", "--depth=1", repoSpec.CloneSpec(), ref); err != nil {
 		return err
 	}
 	if err = r.run("checkout", "FETCH_HEAD"); err != nil {

vendor/sigs.k8s.io/kustomize/api/internal/git/gitrunner.go

@@ -7,8 +7,8 @@ import (
 	"os/exec"
 	"time"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/utils"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
@@ -24,7 +24,7 @@ type gitRunner struct {
 func newCmdRunner(timeout time.Duration) (*gitRunner, error) {
 	gitProgram, err := exec.LookPath("git")
 	if err != nil {
-		return nil, errors.Wrap(err, "no 'git' program on path")
+		return nil, errors.WrapPrefixf(err, "no 'git' program on path")
 	}
 	dir, err := filesys.NewTmpConfirmedDir()
 	if err != nil {
@@ -46,9 +46,9 @@ func (r gitRunner) run(args ...string) error {
 		cmd.String(),
 		r.duration,
 		func() error {
-			_, err := cmd.CombinedOutput()
+			out, err := cmd.CombinedOutput()
 			if err != nil {
-				return errors.Wrapf(err, "git cmd = '%s'", cmd.String())
+				return errors.WrapPrefixf(err, "failed to run '%s': %s", cmd.String(), string(out))
 			}
 			return err
 		})

vendor/sigs.k8s.io/kustomize/api/internal/git/repospec.go

@@ -5,12 +5,15 @@ package git
 
 import (
 	"fmt"
+	"log"
 	"net/url"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
@@ -27,26 +30,23 @@ type RepoSpec struct {
 	// TODO(monopole): Drop raw, use processed fields instead.
 	raw string
 
-	// Host, e.g. github.com
+	// Host, e.g. https://github.com/
 	Host string
 
-	// orgRepo name (organization/repoName),
+	// RepoPath name (Path to repository),
 	// e.g. kubernetes-sigs/kustomize
-	OrgRepo string
+	RepoPath string
 
-	// Dir where the orgRepo is cloned to.
+	// Dir is where the repository is cloned to.
 	Dir filesys.ConfirmedDir
 
 	// Relative path in the repository, and in the cloneDir,
 	// to a Kustomization.
-	Path string
+	KustRootPath string
 
 	// Branch or tag reference.
 	Ref string
 
-	// e.g. .git or empty in case of _git is present
-	GitSuffix string
-
 	// Submodules indicates whether or not to clone git submodules.
 	Submodules bool
 
@@ -56,10 +56,7 @@ type RepoSpec struct {
 
 // CloneSpec returns a string suitable for "git clone {spec}".
 func (x *RepoSpec) CloneSpec() string {
-	if isAzureHost(x.Host) || isAWSHost(x.Host) {
-		return x.Host + x.OrgRepo
-	}
-	return x.Host + x.OrgRepo + x.GitSuffix
+	return x.Host + x.RepoPath
 }
 
 func (x *RepoSpec) CloneDir() filesys.ConfirmedDir {
@@ -71,81 +68,140 @@ func (x *RepoSpec) Raw() string {
 }
 
 func (x *RepoSpec) AbsPath() string {
-	return x.Dir.Join(x.Path)
+	return x.Dir.Join(x.KustRootPath)
 }
 
 func (x *RepoSpec) Cleaner(fSys filesys.FileSystem) func() error {
 	return func() error { return fSys.RemoveAll(x.Dir.String()) }
 }
 
+const (
+	refQuery         = "?ref="
+	gitSuffix        = ".git"
+	gitRootDelimiter = "_git/"
+	pathSeparator    = "/" // do not use filepath.Separator, as this is a URL
+)
+
 // NewRepoSpecFromURL parses git-like urls.
 // From strings like git@github.com:someOrg/someRepo.git or
 // https://github.com/someOrg/someRepo?ref=someHash, extract
-// the parts.
+// the different parts of URL, set into a RepoSpec object and return RepoSpec object.
+// It MUST return an error if the input is not a git-like URL, as this is used by some code paths
+// to distinguish between local and remote paths.
+//
+// In particular, NewRepoSpecFromURL separates the URL used to clone the repo from the
+// elements Kustomize uses for other purposes (e.g. query params that turn into args, and
+// the path to the kustomization root within the repo).
 func NewRepoSpecFromURL(n string) (*RepoSpec, error) {
+	repoSpec := &RepoSpec{raw: n, Dir: notCloned, Timeout: defaultTimeout, Submodules: defaultSubmodules}
 	if filepath.IsAbs(n) {
 		return nil, fmt.Errorf("uri looks like abs path: %s", n)
 	}
-	host, orgRepo, path, gitRef, gitSubmodules, suffix, gitTimeout := parseGitURL(n)
-	if orgRepo == "" {
-		return nil, fmt.Errorf("url lacks orgRepo: %s", n)
+
+	// Parse the query first. This is safe because according to rfc3986 "?" is only allowed in the
+	// query and is not recognized %-encoded.
+	// Note that parseQuery returns default values for empty parameters.
+	n, query, _ := strings.Cut(n, "?")
+	repoSpec.Ref, repoSpec.Timeout, repoSpec.Submodules = parseQuery(query)
+
+	var err error
+
+	// Parse the host (e.g. scheme, username, domain) segment.
+	repoSpec.Host, n, err = extractHost(n)
+	if err != nil {
+		return nil, err
 	}
-	if host == "" {
-		return nil, fmt.Errorf("url lacks host: %s", n)
+
+	// In some cases, we're given a path to a git repo + a path to the kustomization root within
+	// that repo. We need to split them so that we can ultimately give the repo only to the cloner.
+	repoSpec.RepoPath, repoSpec.KustRootPath, err = parsePathParts(n, defaultRepoPathLength(repoSpec.Host))
+	if err != nil {
+		return nil, err
 	}
-	return &RepoSpec{
-		raw: n, Host: host, OrgRepo: orgRepo,
-		Dir: notCloned, Path: path, Ref: gitRef, GitSuffix: suffix,
-		Submodules: gitSubmodules, Timeout: gitTimeout}, nil
+
+	return repoSpec, nil
 }
 
-const (
-	refQuery     = "?ref="
-	gitSuffix    = ".git"
-	gitDelimiter = "_git/"
-)
+const allSegments = -999999
+const orgRepoSegments = 2
 
-// From strings like git@github.com:someOrg/someRepo.git or
-// https://github.com/someOrg/someRepo?ref=someHash, extract
-// the parts.
-func parseGitURL(n string) (
-	host string, orgRepo string, path string, gitRef string, gitSubmodules bool, gitSuff string, gitTimeout time.Duration) {
-	if strings.Contains(n, gitDelimiter) {
-		index := strings.Index(n, gitDelimiter)
-		// Adding _git/ to host
-		host = normalizeGitHostSpec(n[:index+len(gitDelimiter)])
-		orgRepo = strings.Split(strings.Split(n[index+len(gitDelimiter):], "/")[0], "?")[0]
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n[index+len(gitDelimiter)+len(orgRepo):])
-		return
+func defaultRepoPathLength(host string) int {
+	if strings.HasPrefix(host, fileScheme) {
+		return allSegments
 	}
-	host, n = parseHostSpec(n)
-	gitSuff = gitSuffix
-	if strings.Contains(n, gitSuffix) {
-		index := strings.Index(n, gitSuffix)
-		orgRepo = n[0:index]
-		n = n[index+len(gitSuffix):]
-		if len(n) > 0 && n[0] == '/' {
-			n = n[1:]
-		}
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
-		return
+	return orgRepoSegments
+}
+
+// parsePathParts splits the repo path that will ultimately be passed to git to clone the
+// repo from the kustomization root path, which Kustomize will execute the build in after the repo
+// is cloned.
+//
+// We first try to do this based on explicit markers in the URL (e.g. _git, .git or //).
+// If none are present, we try to apply a historical default repo path length that is derived from
+// Github URLs. If there aren't enough segments, we have historically considered the URL invalid.
+func parsePathParts(n string, defaultSegmentLength int) (string, string, error) {
+	repoPath, kustRootPath, success := tryExplicitMarkerSplit(n)
+	if !success {
+		repoPath, kustRootPath, success = tryDefaultLengthSplit(n, defaultSegmentLength)
 	}
 
-	i := strings.Index(n, "/")
-	if i < 1 {
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
-		return
+	// Validate the result
+	if !success || len(repoPath) == 0 {
+		return "", "", fmt.Errorf("failed to parse repo path segment")
 	}
-	j := strings.Index(n[i+1:], "/")
-	if j >= 0 {
-		j += i + 1
-		orgRepo = n[:j]
-		path, gitRef, gitTimeout, gitSubmodules = peelQuery(n[j+1:])
-		return
+	if kustRootPathExitsRepo(kustRootPath) {
+		return "", "", fmt.Errorf("url path exits repo: %s", n)
 	}
-	path = ""
-	orgRepo, gitRef, gitTimeout, gitSubmodules = peelQuery(n)
-	return host, orgRepo, path, gitRef, gitSubmodules, gitSuff, gitTimeout
+
+	return repoPath, strings.TrimPrefix(kustRootPath, pathSeparator), nil
+}
+
+func tryExplicitMarkerSplit(n string) (string, string, bool) {
+	// Look for the _git delimiter, which by convention is expected to be ONE directory above the repo root.
+	// If found, split on the NEXT path element, which is the repo root.
+	// Example: https://username@dev.azure.com/org/project/_git/repo/path/to/kustomization/root
+	if gitRootIdx := strings.Index(n, gitRootDelimiter); gitRootIdx >= 0 {
+		gitRootPath := n[:gitRootIdx+len(gitRootDelimiter)]
+		subpathSegments := strings.Split(n[gitRootIdx+len(gitRootDelimiter):], pathSeparator)
+		return gitRootPath + subpathSegments[0], strings.Join(subpathSegments[1:], pathSeparator), true
+
+		// Look for a double-slash in the path, which if present separates the repo root from the kust path.
+		// It is a convention, not a real path element, so do not preserve it in the returned value.
+		// Example: https://github.com/org/repo//path/to/kustomozation/root
+	} else if repoRootIdx := strings.Index(n, "//"); repoRootIdx >= 0 {
+		return n[:repoRootIdx], n[repoRootIdx+2:], true
+
+		// Look for .git in the path, which if present is part of the directory name of the git repo.
+		// This means we want to grab everything up to and including that suffix
+		// Example: https://github.com/org/repo.git/path/to/kustomozation/root
+	} else if gitSuffixIdx := strings.Index(n, gitSuffix); gitSuffixIdx >= 0 {
+		upToGitSuffix := n[:gitSuffixIdx+len(gitSuffix)]
+		afterGitSuffix := n[gitSuffixIdx+len(gitSuffix):]
+		return upToGitSuffix, afterGitSuffix, true
+	}
+	return "", "", false
+}
+
+func tryDefaultLengthSplit(n string, defaultSegmentLength int) (string, string, bool) {
+	// If the default is to take all segments, do so.
+	if defaultSegmentLength == allSegments {
+		return n, "", true
+
+		// If the default is N segments, make sure we have at least that many and take them if so.
+		// If we have less than N, we have historically considered the URL invalid.
+	} else if segments := strings.Split(n, pathSeparator); len(segments) >= defaultSegmentLength {
+		firstNSegments := strings.Join(segments[:defaultSegmentLength], pathSeparator)
+		rest := strings.Join(segments[defaultSegmentLength:], pathSeparator)
+		return firstNSegments, rest, true
+	}
+	return "", "", false
+}
+
+func kustRootPathExitsRepo(kustRootPath string) bool {
+	cleanedPath := filepath.Clean(strings.TrimPrefix(kustRootPath, string(filepath.Separator)))
+	pathElements := strings.Split(cleanedPath, string(filepath.Separator))
+	return len(pathElements) > 0 &&
+		pathElements[0] == filesys.ParentDir
 }
 
 // Clone git submodules by default.
@@ -154,14 +210,12 @@ const defaultSubmodules = true
 // Arbitrary, but non-infinite, timeout for running commands.
 const defaultTimeout = 27 * time.Second
 
-func peelQuery(arg string) (string, string, time.Duration, bool) {
-	// Parse the given arg into a URL. In the event of a parse failure, return
-	// our defaults.
-	parsed, err := url.Parse(arg)
+func parseQuery(query string) (string, time.Duration, bool) {
+	values, err := url.ParseQuery(query)
+	// in event of parse failure, return defaults
 	if err != nil {
-		return arg, "", defaultTimeout, defaultSubmodules
+		return "", defaultTimeout, defaultSubmodules
 	}
-	values := parsed.Query()
 
 	// ref is the desired git ref to target. Can be specified by in a git URL
 	// with ?ref=<string> or ?version=<string>, although ref takes precedence.
@@ -192,76 +246,142 @@ func peelQuery(arg string) (string, string, time.Duration, bool) {
 		}
 	}
 
-	return parsed.Path, ref, duration, submodules
+	return ref, duration, submodules
 }
 
-func parseHostSpec(n string) (string, string) {
-	var host string
-	// Start accumulating the host part.
-	for _, p := range []string{
-		// Order matters here.
-		"git::", "gh:", "ssh://", "https://", "http://",
-		"git@", "github.com:", "github.com/"} {
-		if len(p) < len(n) && strings.ToLower(n[:len(p)]) == p {
-			n = n[len(p):]
-			host += p
+func extractHost(n string) (string, string, error) {
+	n = ignoreForcedGitProtocol(n)
+	scheme, n := extractScheme(n)
+	username, n := extractUsername(n)
+	stdGithub := isStandardGithubHost(n)
+	acceptSCP := acceptSCPStyle(scheme, username, stdGithub)
+
+	// Validate the username and scheme before attempting host/path parsing, because if the parsing
+	// so far has not succeeded, we will not be able to extract the host and path correctly.
+	if err := validateScheme(scheme, acceptSCP); err != nil {
+		return "", "", err
+	}
+
+	// Now that we have extracted a valid scheme+username, we can parse host itself.
+
+	// The file protocol specifies an absolute path to a local git repo.
+	// Everything after the scheme (including any 'username' we found) is actually part of that path.
+	if scheme == fileScheme {
+		return scheme, username + n, nil
+	}
+	var host, rest = n, ""
+	if sepIndex := findPathSeparator(n, acceptSCP); sepIndex >= 0 {
+		host, rest = n[:sepIndex+1], n[sepIndex+1:]
+	}
+
+	// Github URLs are strictly normalized in a way that may discard scheme and username components.
+	if stdGithub {
+		scheme, username, host = normalizeGithubHostParts(scheme, username)
+	}
+
+	// Host is required, so do not concat the scheme and username if we didn't find one.
+	if host == "" {
+		return "", "", errors.Errorf("failed to parse host segment")
+	}
+	return scheme + username + host, rest, nil
+}
+
+// ignoreForcedGitProtocol strips the "git::" prefix from URLs.
+// We used to use go-getter to handle our urls: https://github.com/hashicorp/go-getter.
+// The git:: prefix signaled go-getter to use the git protocol to fetch the url's contents.
+// We silently strip this prefix to allow these go-getter-style urls to continue to work,
+// although the git protocol (which is insecure and unsupported on many platforms, including Github)
+// will not actually be used as intended.
+func ignoreForcedGitProtocol(n string) string {
+	n, found := trimPrefixIgnoreCase(n, "git::")
+	if found {
+		log.Println("Warning: Forcing the git protocol using the 'git::' URL prefix is not supported. " +
+			"Kustomize currently strips this invalid prefix, but will stop doing so in a future release. " +
+			"Please remove the 'git::' prefix from your configuration.")
+	}
+	return n
+}
+
+// acceptSCPStyle returns true if the scheme and username indicate potential use of an SCP-style URL.
+// With this style, the scheme is not explicit and the path is delimited by a colon.
+// Strictly speaking the username is optional in SCP-like syntax, but Kustomize has always
+// required it for non-Github URLs.
+// Example: user@host.xz:path/to/repo.git/
+func acceptSCPStyle(scheme, username string, isGithubURL bool) bool {
+	return scheme == "" && (username != "" || isGithubURL)
+}
+
+func validateScheme(scheme string, acceptSCPStyle bool) error {
+	// see https://git-scm.com/docs/git-fetch#_git_urls for info relevant to these validations
+	switch scheme {
+	case "":
+		// Empty scheme is only ok if it's a Github URL or if it looks like SCP-style syntax
+		if !acceptSCPStyle {
+			return fmt.Errorf("failed to parse scheme")
+		}
+	case sshScheme, fileScheme, httpsScheme, httpScheme:
+		// These are all supported schemes
+	default:
+		// At time of writing, we should never end up here because we do not parse out
+		// unsupported schemes to begin with.
+		return fmt.Errorf("unsupported scheme %q", scheme)
+	}
+	return nil
+}
+
+const fileScheme = "file://"
+const httpScheme = "http://"
+const httpsScheme = "https://"
+const sshScheme = "ssh://"
+
+func extractScheme(s string) (string, string) {
+	for _, prefix := range []string{sshScheme, httpsScheme, httpScheme, fileScheme} {
+		if rest, found := trimPrefixIgnoreCase(s, prefix); found {
+			return prefix, rest
 		}
 	}
-	if host == "git@" {
-		i := strings.Index(n, "/")
-		if i > -1 {
-			host += n[:i+1]
-			n = n[i+1:]
-		} else {
-			i = strings.Index(n, ":")
-			if i > -1 {
-				host += n[:i+1]
-				n = n[i+1:]
-			}
-		}
-		return host, n
-	}
+	return "", s
+}
 
-	// If host is a http(s) or ssh URL, grab the domain part.
-	for _, p := range []string{
-		"ssh://", "https://", "http://"} {
-		if strings.HasSuffix(host, p) {
-			i := strings.Index(n, "/")
-			if i > -1 {
-				host += n[0 : i+1]
-				n = n[i+1:]
-			}
-			break
+func extractUsername(s string) (string, string) {
+	var userRegexp = regexp.MustCompile(`^([a-zA-Z][a-zA-Z0-9-]*)@`)
+	if m := userRegexp.FindStringSubmatch(s); m != nil {
+		username := m[1] + "@"
+		return username, s[len(username):]
+	}
+	return "", s
+}
+
+func isStandardGithubHost(s string) bool {
+	lowerCased := strings.ToLower(s)
+	return strings.HasPrefix(lowerCased, "github.com/") ||
+		strings.HasPrefix(lowerCased, "github.com:")
+}
+
+// trimPrefixIgnoreCase returns the rest of s and true if prefix, ignoring case, prefixes s.
+// Otherwise, trimPrefixIgnoreCase returns s and false.
+func trimPrefixIgnoreCase(s, prefix string) (string, bool) {
+	if len(prefix) <= len(s) && strings.ToLower(s[:len(prefix)]) == prefix {
+		return s[len(prefix):], true
+	}
+	return s, false
+}
+
+func findPathSeparator(hostPath string, acceptSCP bool) int {
+	sepIndex := strings.Index(hostPath, pathSeparator)
+	if acceptSCP {
+		colonIndex := strings.Index(hostPath, ":")
+		// The colon acts as a delimiter in scp-style ssh URLs only if not prefixed by '/'.
+		if sepIndex == -1 || (colonIndex > 0 && colonIndex < sepIndex) {
+			sepIndex = colonIndex
 		}
 	}
-
-	return normalizeGitHostSpec(host), n
+	return sepIndex
 }
 
-func normalizeGitHostSpec(host string) string {
-	s := strings.ToLower(host)
-	if strings.Contains(s, "github.com") {
-		if strings.Contains(s, "git@") || strings.Contains(s, "ssh:") {
-			host = "git@github.com:"
-		} else {
-			host = "https://github.com/"
-		}
+func normalizeGithubHostParts(scheme, username string) (string, string, string) {
+	if strings.HasPrefix(scheme, sshScheme) || username != "" {
+		return "", username, "github.com:"
 	}
-	if strings.HasPrefix(s, "git::") {
-		host = strings.TrimPrefix(s, "git::")
-	}
-	return host
-}
-
-// The format of Azure repo URL is documented
-// https://docs.microsoft.com/en-us/azure/devops/repos/git/clone?view=vsts&tabs=visual-studio#clone_url
-func isAzureHost(host string) bool {
-	return strings.Contains(host, "dev.azure.com") ||
-		strings.Contains(host, "visualstudio.com")
-}
-
-// The format of AWS repo URL is documented
-// https://docs.aws.amazon.com/codecommit/latest/userguide/regions.html
-func isAWSHost(host string) bool {
-	return strings.Contains(host, "amazonaws.com")
+	return httpsScheme, "", "github.com/"
 }

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/namebackreferences.go

@@ -22,7 +22,7 @@ import (
 // contains a Pod; Deployment, Job, StatefulSet, etc.
 // The ConfigMap is the ReferralTarget, the others are Referrers.
 //
-// If the the name of a ConfigMap instance changed from 'alice' to 'bob',
+// If the name of a ConfigMap instance changed from 'alice' to 'bob',
 // one must
 //  - visit all objects that could refer to the ConfigMap (the Referrers)
 //  - see if they mention 'alice',

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/transformerconfig.go

@@ -10,6 +10,7 @@ import (
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 // TransformerConfig holds the data needed to perform transformations.
@@ -18,6 +19,7 @@ type TransformerConfig struct {
 	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
 	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
 	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
 	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
@@ -58,8 +60,10 @@ func MakeTransformerConfig(
 // sortFields provides determinism in logging, tests, etc.
 func (t *TransformerConfig) sortFields() {
 	sort.Sort(t.NamePrefix)
+	sort.Sort(t.NameSuffix)
 	sort.Sort(t.NameSpace)
 	sort.Sort(t.CommonLabels)
+	sort.Sort(t.TemplateLabels)
 	sort.Sort(t.CommonAnnotations)
 	sort.Sort(t.NameReference)
 	sort.Sort(t.VarReference)
@@ -108,40 +112,44 @@ func (t *TransformerConfig) Merge(input *TransformerConfig) (
 	merged = &TransformerConfig{}
 	merged.NamePrefix, err = t.NamePrefix.MergeAll(input.NamePrefix)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NamePrefix fieldSpec")
 	}
 	merged.NameSuffix, err = t.NameSuffix.MergeAll(input.NameSuffix)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSuffix fieldSpec")
 	}
 	merged.NameSpace, err = t.NameSpace.MergeAll(input.NameSpace)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSpace fieldSpec")
 	}
 	merged.CommonAnnotations, err = t.CommonAnnotations.MergeAll(
 		input.CommonAnnotations)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonAnnotations fieldSpec")
 	}
 	merged.CommonLabels, err = t.CommonLabels.MergeAll(input.CommonLabels)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonLabels fieldSpec")
+	}
+	merged.TemplateLabels, err = t.TemplateLabels.MergeAll(input.TemplateLabels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")
 	}
 	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge VarReference fieldSpec")
 	}
 	merged.NameReference, err = t.NameReference.mergeAll(input.NameReference)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge NameReference fieldSpec")
 	}
 	merged.Images, err = t.Images.MergeAll(input.Images)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge Images fieldSpec")
 	}
 	merged.Replicas, err = t.Replicas.MergeAll(input.Replicas)
 	if err != nil {
-		return nil, err
+		return nil, errors.WrapPrefixf(err, "failed to merge Replicas fieldSpec")
 	}
 	merged.sortFields()
 	return merged, nil

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtinplugintype_string.go

@@ -15,24 +15,23 @@ func _() {
 	_ = x[HashTransformer-4]
 	_ = x[ImageTagTransformer-5]
 	_ = x[LabelTransformer-6]
-	_ = x[LegacyOrderTransformer-7]
-	_ = x[NamespaceTransformer-8]
-	_ = x[PatchJson6902Transformer-9]
-	_ = x[PatchStrategicMergeTransformer-10]
-	_ = x[PatchTransformer-11]
-	_ = x[PrefixSuffixTransformer-12]
-	_ = x[PrefixTransformer-13]
-	_ = x[SuffixTransformer-14]
-	_ = x[ReplicaCountTransformer-15]
-	_ = x[SecretGenerator-16]
-	_ = x[ValueAddTransformer-17]
-	_ = x[HelmChartInflationGenerator-18]
-	_ = x[ReplacementTransformer-19]
+	_ = x[NamespaceTransformer-7]
+	_ = x[PatchJson6902Transformer-8]
+	_ = x[PatchStrategicMergeTransformer-9]
+	_ = x[PatchTransformer-10]
+	_ = x[PrefixSuffixTransformer-11]
+	_ = x[PrefixTransformer-12]
+	_ = x[SuffixTransformer-13]
+	_ = x[ReplicaCountTransformer-14]
+	_ = x[SecretGenerator-15]
+	_ = x[ValueAddTransformer-16]
+	_ = x[HelmChartInflationGenerator-17]
+	_ = x[ReplacementTransformer-18]
 }
 
-const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerLegacyOrderTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
 
-var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 137, 157, 181, 211, 227, 250, 267, 284, 307, 322, 341, 368, 390}
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 135, 159, 189, 205, 228, 245, 262, 285, 300, 319, 346, 368}
 
 func (i BuiltinPluginType) String() string {
 	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtins.go

@@ -19,7 +19,6 @@ const (
 	HashTransformer
 	ImageTagTransformer
 	LabelTransformer
-	LegacyOrderTransformer
 	NamespaceTransformer
 	PatchJson6902Transformer
 	PatchStrategicMergeTransformer
@@ -100,7 +99,6 @@ var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin
 	HashTransformer:                builtins.NewHashTransformerPlugin,
 	ImageTagTransformer:            builtins.NewImageTagTransformerPlugin,
 	LabelTransformer:               builtins.NewLabelTransformerPlugin,
-	LegacyOrderTransformer:         builtins.NewLegacyOrderTransformerPlugin,
 	NamespaceTransformer:           builtins.NewNamespaceTransformerPlugin,
 	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
 	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
@@ -111,4 +109,7 @@ var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin
 	ReplacementTransformer:         builtins.NewReplacementTransformerPlugin,
 	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
 	ValueAddTransformer:            builtins.NewValueAddTransformerPlugin,
+	// Do not wired SortOrderTransformer as a builtin plugin.
+	// We only want it to be available in the top-level kustomization.
+	// See: https://github.com/kubernetes-sigs/kustomize/issues/3913
 }

vendor/sigs.k8s.io/kustomize/api/internal/plugins/execplugin/execplugin.go

@@ -6,7 +6,6 @@ package execplugin
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"runtime"
@@ -14,9 +13,9 @@ import (
 
 	"github.com/google/shlex"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/yaml"
 )
 
@@ -150,19 +149,19 @@ func (p *ExecPlugin) Transform(rm resmap.ResMap) error {
 // passes the full temp file path as the first arg to a process
 // running the plugin binary.  Process output is returned.
 func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
-	f, err := ioutil.TempFile("", tmpConfigFilePrefix)
+	f, err := os.CreateTemp("", tmpConfigFilePrefix)
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "creating tmp plugin config file")
 	}
 	_, err = f.Write(p.cfg)
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "writing plugin config to "+f.Name())
 	}
 	err = f.Close()
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "closing plugin config file "+f.Name())
 	}
 	//nolint:gosec
@@ -176,7 +175,7 @@ func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
 	}
 	result, err := cmd.Output()
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "failure in plugin configured via %s; %v",
 			f.Name(), err.Error())
 	}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/fnplugin/fnplugin.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"fmt"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
 	"sigs.k8s.io/kustomize/api/resmap"
@@ -51,13 +51,16 @@ func resourceToRNode(res *resource.Resource) (*yaml.RNode, error) {
 }
 
 // GetFunctionSpec return function spec is there is. Otherwise return nil
-func GetFunctionSpec(res *resource.Resource) *runtimeutil.FunctionSpec {
+func GetFunctionSpec(res *resource.Resource) (*runtimeutil.FunctionSpec, error) {
 	rnode, err := resourceToRNode(res)
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("could not convert resource to RNode: %w", err)
 	}
-
-	return runtimeutil.GetFunctionSpec(rnode)
+	functionSpec, err := runtimeutil.GetFunctionSpec(rnode)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get FunctionSpec: %w", err)
+	}
+	return functionSpec, nil
 }
 
 func toStorageMounts(mounts []string) []runtimeutil.StorageMount {
@@ -191,7 +194,7 @@ func (p *FnPlugin) invokePlugin(input []byte) ([]byte, error) {
 
 	err = p.runFns.Execute()
 	if err != nil {
-		return nil, errors.Wrap(
+		return nil, errors.WrapPrefixf(
 			err, "couldn't execute function")
 	}
 

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/loader.go

@@ -12,7 +12,6 @@ import (
 	"reflect"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
@@ -22,6 +21,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 )
@@ -42,27 +42,35 @@ func NewLoader(
 	return &Loader{pc: pc, rf: rf, fs: fs}
 }
 
+// LoaderWithWorkingDir returns loader after setting its working directory.
+// NOTE: This is not really a new loader since some of the Loader struct fields are pointers.
+func (l *Loader) LoaderWithWorkingDir(wd string) *Loader {
+	lpc := &types.PluginConfig{
+		PluginRestrictions: l.pc.PluginRestrictions,
+		BpLoadingOptions:   l.pc.BpLoadingOptions,
+		FnpLoadingOptions:  l.pc.FnpLoadingOptions,
+		HelmConfig:         l.pc.HelmConfig,
+	}
+	lpc.FnpLoadingOptions.WorkingDir = wd
+	return &Loader{pc: lpc, rf: l.rf, fs: l.fs}
+}
+
 // Config provides the global (not plugin specific) PluginConfig data.
 func (l *Loader) Config() *types.PluginConfig {
 	return l.pc
 }
 
-// SetWorkDir sets the working directory for this loader's plugins
-func (l *Loader) SetWorkDir(wd string) {
-	l.pc.FnpLoadingOptions.WorkingDir = wd
-}
-
 func (l *Loader) LoadGenerators(
 	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
 	result []*resmap.GeneratorWithProperties, err error) {
 	for _, res := range rm.Resources() {
 		g, err := l.LoadGenerator(ldr, v, res)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to load generator: %w", err)
 		}
 		generatorOrigin, err := resource.OriginFromCustomPlugin(res)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to get origin from CustomPlugin: %w", err)
 		}
 		result = append(result, &resmap.GeneratorWithProperties{Generator: g, Origin: generatorOrigin})
 	}
@@ -130,15 +138,19 @@ func (l *Loader) AbsolutePluginPath(id resid.ResId) (string, error) {
 // absPluginHome is the home of kustomize Exec and Go plugins.
 // Kustomize plugin configuration files are k8s-style objects
 // containing the fields 'apiVersion' and 'kind', e.g.
-//   apiVersion: apps/v1
-//   kind: Deployment
+//
+//	apiVersion: apps/v1
+//	kind: Deployment
+//
 // kustomize reads plugin configuration data from a file path
 // specified in the 'generators:' or 'transformers:' field of a
 // kustomization file.  For Exec and Go plugins, kustomize
 // uses this data to both locate the plugin and configure it.
 // Each Exec or Go plugin (its code, its tests, its supporting data
 // files, etc.) must be housed in its own directory at
-//   ${absPluginHome}/${pluginApiVersion}/LOWERCASE(${pluginKind})
+//
+//	${absPluginHome}/${pluginApiVersion}/LOWERCASE(${pluginKind})
+//
 // where
 //   - ${absPluginHome} is an absolute path, defined below.
 //   - ${pluginApiVersion} is taken from the plugin config file.
@@ -204,11 +216,11 @@ func (l *Loader) loadAndConfigurePlugin(
 	}
 	yaml, err := res.AsYAML()
 	if err != nil {
-		return nil, errors.Wrapf(err, "marshalling yaml from res %s", res.OrgId())
+		return nil, errors.WrapPrefixf(err, "marshalling yaml from res %s", res.OrgId())
 	}
 	err = c.Config(resmap.NewPluginHelpers(ldr, v, l.rf, l.pc), yaml)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "plugin %s fails configuration", res.OrgId())
 	}
 	return c, nil
@@ -226,17 +238,20 @@ func (l *Loader) makeBuiltinPlugin(r resid.Gvk) (resmap.Configurable, error) {
 }
 
 func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error) {
-	spec := fnplugin.GetFunctionSpec(res)
+	spec, err := fnplugin.GetFunctionSpec(res)
+	if err != nil {
+		return nil, fmt.Errorf("loader: %w", err)
+	}
 	if spec != nil {
 		// validation check that function mounts are under the current kustomization directory
 		for _, mount := range spec.Container.StorageMounts {
 			if filepath.IsAbs(mount.Src) {
-				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
-					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src))
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src)
 			}
 			if strings.HasPrefix(filepath.Clean(mount.Src), "../") {
-				return nil, errors.New(fmt.Sprintf("plugin %s with mount path '%s' is not permitted; "+
-					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src))
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src)
 			}
 		}
 		return fnplugin.NewFnPlugin(&l.pc.FnpLoadingOptions), nil
@@ -292,11 +307,11 @@ func (l *Loader) loadGoPlugin(id resid.ResId, absPath string) (resmap.Configurab
 	log.Printf("Attempting plugin load from '%s'", absPath)
 	p, err := plugin.Open(absPath)
 	if err != nil {
-		return nil, errors.Wrapf(err, "plugin %s fails to load", absPath)
+		return nil, errors.WrapPrefixf(err, "plugin %s fails to load", absPath)
 	}
 	symbol, err := p.Lookup(konfig.PluginSymbol)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "plugin %s doesn't have symbol %s",
 			regId, konfig.PluginSymbol)
 	}

vendor/sigs.k8s.io/kustomize/api/internal/target/errmissingkustomization.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errMissingKustomization struct {
@@ -23,12 +23,8 @@ func (e *errMissingKustomization) Error() string {
 }
 
 func IsMissingKustomizationFileError(err error) bool {
-	_, ok := err.(*errMissingKustomization)
-	if ok {
-		return true
-	}
-	_, ok = errors.Cause(err).(*errMissingKustomization)
-	return ok
+	e := &errMissingKustomization{}
+	return errors.As(err, &e)
 }
 
 func NewErrMissingKustomization(p string) *errMissingKustomization {

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget.go

@@ -6,10 +6,9 @@ package target
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/builtins"
@@ -23,6 +22,7 @@ import (
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 	"sigs.k8s.io/yaml"
 )
@@ -44,32 +44,40 @@ func NewKustTarget(
 	validator ifc.Validator,
 	rFactory *resmap.Factory,
 	pLdr *loader.Loader) *KustTarget {
-	pLdrCopy := *pLdr
-	pLdrCopy.SetWorkDir(ldr.Root())
 	return &KustTarget{
 		ldr:       ldr,
 		validator: validator,
 		rFactory:  rFactory,
-		pLdr:      &pLdrCopy,
+		pLdr:      pLdr.LoaderWithWorkingDir(ldr.Root()),
 	}
 }
 
 // Load attempts to load the target's kustomization file.
 func (kt *KustTarget) Load() error {
-	content, kustFileName, err := loadKustFile(kt.ldr)
-	if err != nil {
-		return err
-	}
-	content, err = types.FixKustomizationPreUnmarshalling(content)
+	content, kustFileName, err := LoadKustFile(kt.ldr)
 	if err != nil {
 		return err
 	}
+
 	var k types.Kustomization
-	err = k.Unmarshal(content)
-	if err != nil {
+	if err := k.Unmarshal(content); err != nil {
 		return err
 	}
-	k.FixKustomizationPostUnmarshalling()
+
+	// show warning message when using deprecated fields.
+	if warningMessages := k.CheckDeprecatedFields(); warningMessages != nil {
+		for _, msg := range *warningMessages {
+			fmt.Fprintf(os.Stderr, "%v\n", msg)
+		}
+	}
+
+	k.FixKustomization()
+
+	// check that Kustomization is empty
+	if err := k.CheckEmpty(); err != nil {
+		return err
+	}
+
 	errs := k.EnforceFields()
 	if len(errs) > 0 {
 		return fmt.Errorf(
@@ -89,7 +97,7 @@ func (kt *KustTarget) Kustomization() types.Kustomization {
 	return result
 }
 
-func loadKustFile(ldr ifc.Loader) ([]byte, string, error) {
+func LoadKustFile(ldr ifc.Loader) ([]byte, string, error) {
 	var content []byte
 	match := 0
 	var kustFileName string
@@ -150,6 +158,11 @@ func (kt *KustTarget) makeCustomizedResMap() (resmap.ResMap, error) {
 		return nil, err
 	}
 
+	err = kt.IgnoreLocal(ra)
+	if err != nil {
+		return nil, err
+	}
+
 	return ra.ResMap(), nil
 }
 
@@ -187,11 +200,11 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	resRa *accumulator.ResAccumulator, err error) {
 	ra, err = kt.accumulateResources(ra, kt.kustomization.Resources)
 	if err != nil {
-		return nil, errors.Wrap(err, "accumulating resources")
+		return nil, errors.WrapPrefixf(err, "accumulating resources")
 	}
 	ra, err = kt.accumulateComponents(ra, kt.kustomization.Components)
 	if err != nil {
-		return nil, errors.Wrap(err, "accumulating components")
+		return nil, errors.WrapPrefixf(err, "accumulating components")
 	}
 	tConfig, err := builtinconfig.MakeTransformerConfig(
 		kt.ldr, kt.kustomization.Configurations)
@@ -200,17 +213,17 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	}
 	err = ra.MergeConfig(tConfig)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging config %v", tConfig)
 	}
 	crdTc, err := accumulator.LoadConfigFromCRDs(kt.ldr, kt.kustomization.Crds)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "loading CRDs %v", kt.kustomization.Crds)
 	}
 	err = ra.MergeConfig(crdTc)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging CRDs %v", crdTc)
 	}
 	err = kt.runGenerators(ra)
@@ -227,13 +240,9 @@ func (kt *KustTarget) accumulateTarget(ra *accumulator.ResAccumulator) (
 	}
 	err = ra.MergeVars(kt.kustomization.Vars)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "merging vars %v", kt.kustomization.Vars)
 	}
-	err = kt.IgnoreLocal(ra)
-	if err != nil {
-		return nil, err
-	}
 	return ra, nil
 }
 
@@ -261,7 +270,7 @@ func (kt *KustTarget) runGenerators(
 
 	gs, err = kt.configureExternalGenerators()
 	if err != nil {
-		return errors.Wrap(err, "loading generator plugins")
+		return errors.WrapPrefixf(err, "loading generator plugins")
 	}
 	generators = append(generators, gs...)
 	for i, g := range generators {
@@ -272,12 +281,12 @@ func (kt *KustTarget) runGenerators(
 		if resMap != nil {
 			err = resMap.AddOriginAnnotation(generators[i].Origin)
 			if err != nil {
-				return errors.Wrapf(err, "adding origin annotations for generator %v", g)
+				return errors.WrapPrefixf(err, "adding origin annotations for generator %v", g)
 			}
 		}
 		err = ra.AbsorbAll(resMap)
 		if err != nil {
-			return errors.Wrapf(err, "merging from generator %v", g)
+			return errors.WrapPrefixf(err, "merging from generator %v", g)
 		}
 	}
 	return nil
@@ -304,7 +313,7 @@ func (kt *KustTarget) configureExternalGenerators() (
 			}
 		}
 		if err = ra.AppendAll(rm); err != nil {
-			return nil, errors.Wrapf(err, "configuring external generator")
+			return nil, errors.WrapPrefixf(err, "configuring external generator")
 		}
 	}
 	ra, err := kt.accumulateResources(ra, generatorPaths)
@@ -351,7 +360,7 @@ func (kt *KustTarget) configureExternalTransformers(transformers []string) ([]*r
 		}
 
 		if err = ra.AppendAll(rm); err != nil {
-			return nil, errors.Wrapf(err, "configuring external transformer")
+			return nil, errors.WrapPrefixf(err, "configuring external transformer")
 		}
 	}
 	ra, err := kt.accumulateResources(ra, transformerPaths)
@@ -415,7 +424,7 @@ func (kt *KustTarget) accumulateResources(
 				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
 					return nil, errF
 				}
-				return nil, errors.Wrapf(
+				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
 			// store the origin, we'll need it later
@@ -432,7 +441,7 @@ func (kt *KustTarget) accumulateResources(
 				if kusterr.IsMalformedYAMLError(errF) { // Some error occurred while tyring to decode YAML file
 					return nil, errF
 				}
-				return nil, errors.Wrapf(
+				return nil, errors.WrapPrefixf(
 					err, "accumulation err='%s'", errF.Error())
 			}
 		}
@@ -474,7 +483,7 @@ func (kt *KustTarget) accumulateDirectory(
 	subKt := NewKustTarget(ldr, kt.validator, kt.rFactory, kt.pLdr)
 	err := subKt.Load()
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "couldn't make target for path '%s'", ldr.Root())
 	}
 	subKt.kustomization.BuildMetadata = kt.kustomization.BuildMetadata
@@ -509,12 +518,12 @@ func (kt *KustTarget) accumulateDirectory(
 		subRa, err = subKt.AccumulateTarget()
 	}
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "recursed accumulation of path '%s'", ldr.Root())
 	}
 	err = ra.MergeAccumulator(subRa)
 	if err != nil {
-		return nil, errors.Wrapf(
+		return nil, errors.WrapPrefixf(
 			err, "recursed merging from path '%s'", ldr.Root())
 	}
 	return ra, nil
@@ -524,21 +533,21 @@ func (kt *KustTarget) accumulateFile(
 	ra *accumulator.ResAccumulator, path string) error {
 	resources, err := kt.rFactory.FromFile(kt.ldr, path)
 	if err != nil {
-		return errors.Wrapf(err, "accumulating resources from '%s'", path)
+		return errors.WrapPrefixf(err, "accumulating resources from '%s'", path)
 	}
 	if kt.origin != nil {
 		originAnno, err := kt.origin.Append(path).String()
 		if err != nil {
-			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+			return errors.WrapPrefixf(err, "cannot add path annotation for '%s'", path)
 		}
 		err = resources.AnnotateAll(utils.OriginAnnotationKey, originAnno)
 		if err != nil || originAnno == "" {
-			return errors.Wrapf(err, "cannot add path annotation for '%s'", path)
+			return errors.WrapPrefixf(err, "cannot add path annotation for '%s'", path)
 		}
 	}
 	err = ra.AppendAll(resources)
 	if err != nil {
-		return errors.Wrapf(err, "merging resources from '%s'", path)
+		return errors.WrapPrefixf(err, "merging resources from '%s'", path)
 	}
 	return nil
 }
@@ -549,7 +558,7 @@ func (kt *KustTarget) configureBuiltinPlugin(
 	if c != nil {
 		y, err = yaml.Marshal(c)
 		if err != nil {
-			return errors.Wrapf(
+			return errors.WrapPrefixf(
 				err, "builtin %s marshal", bpt)
 		}
 	}
@@ -558,7 +567,7 @@ func (kt *KustTarget) configureBuiltinPlugin(
 			kt.ldr, kt.validator, kt.rFactory, kt.pLdr.Config()),
 		y)
 	if err != nil {
-		return errors.Wrapf(
+		return errors.WrapPrefixf(
 			err, "trouble configuring builtin %s with config: `\n%s`", bpt, string(y))
 	}
 	return nil

vendor/sigs.k8s.io/kustomize/api/internal/target/kusttarget_configplugin.go

@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"path/filepath"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -286,11 +286,11 @@ var transformerConfigurators = map[builtinhelpers.BuiltinPluginType]func(
 			if label.IncludeSelectors {
 				fss, err = fss.MergeAll(tc.CommonLabels)
 			} else {
-				// merge spec/template/metadata fieldSpec if includeTemplate flag is true
+				// merge spec/template/metadata fieldSpecs if includeTemplate flag is true
 				if label.IncludeTemplates {
-					fss, err = fss.MergeOne(types.FieldSpec{Path: "spec/template/metadata/labels", CreateIfNotPresent: false})
+					fss, err = fss.MergeAll(tc.TemplateLabels)
 					if err != nil {
-						return nil, errors.Wrap(err, "failed to merge template fieldSpec")
+						return nil, errors.WrapPrefixf(err, "failed to merge template fieldSpec")
 					}
 				}
 				// only add to metadata by default

vendor/sigs.k8s.io/kustomize/api/internal/utils/errtimeout.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errTimeOut struct {
@@ -24,13 +24,6 @@ func (e errTimeOut) Error() string {
 }
 
 func IsErrTimeout(err error) bool {
-	if err == nil {
-		return false
-	}
-	_, ok := err.(errTimeOut)
-	if ok {
-		return true
-	}
-	_, ok = errors.Cause(err).(errTimeOut)
-	return ok
+	e := &errTimeOut{}
+	return errors.As(err, &e)
 }

vendor/sigs.k8s.io/kustomize/api/internal/utils/makeResIds.go

@@ -35,7 +35,10 @@ func PrevIds(n *yaml.RNode) ([]resid.ResId, error) {
 	var ids []resid.ResId
 	// TODO: merge previous names and namespaces into one list of
 	//     pairs on one annotation so there is no chance of error
-	annotations := n.GetAnnotations()
+	annotations := n.GetAnnotations(
+		BuildAnnotationPreviousNames,
+		BuildAnnotationPreviousNamespaces,
+		BuildAnnotationPreviousKinds)
 	if _, ok := annotations[BuildAnnotationPreviousNames]; !ok {
 		return nil, nil
 	}
@@ -49,12 +52,10 @@ func PrevIds(n *yaml.RNode) ([]resid.ResId, error) {
 				"number of previous namespaces, " +
 				"number of previous kinds not equal")
 	}
+	apiVersion := n.GetApiVersion()
+	group, version := resid.ParseGroupVersion(apiVersion)
+	ids = make([]resid.ResId, 0, len(names))
 	for i := range names {
-		meta, err := n.GetMeta()
-		if err != nil {
-			return nil, err
-		}
-		group, version := resid.ParseGroupVersion(meta.APIVersion)
 		gvk := resid.Gvk{
 			Group:   group,
 			Version: version,

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/commonlabels.go

@@ -5,9 +5,6 @@ package builtinpluginconsts
 
 const commonLabelFieldSpecs = `
 commonLabels:
-- path: metadata/labels
-  create: true
-
 - path: spec/selector
   create: true
   version: v1
@@ -17,20 +14,10 @@ commonLabels:
   create: true
   version: v1
   kind: ReplicationController
-
-- path: spec/template/metadata/labels
-  create: true
-  version: v1
-  kind: ReplicationController
-
 - path: spec/selector/matchLabels
   create: true
   kind: Deployment
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: Deployment
-
 - path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
   create: false
   group: apps
@@ -60,28 +47,15 @@ commonLabels:
   create: true
   kind: ReplicaSet
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: ReplicaSet
-
 - path: spec/selector/matchLabels
   create: true
   kind: DaemonSet
 
-- path: spec/template/metadata/labels
-  create: true
-  kind: DaemonSet
-
 - path: spec/selector/matchLabels
   create: true
   group: apps
   kind: StatefulSet
 
-- path: spec/template/metadata/labels
-  create: true
-  group: apps
-  kind: StatefulSet
-
 - path: spec/template/spec/affinity/podAffinity/preferredDuringSchedulingIgnoredDuringExecution/podAffinityTerm/labelSelector/matchLabels
   create: false
   group: apps
@@ -107,36 +81,16 @@ commonLabels:
   group: apps
   kind: StatefulSet
 
-- path: spec/volumeClaimTemplates[]/metadata/labels
-  create: true
-  group: apps
-  kind: StatefulSet
-
 - path: spec/selector/matchLabels
   create: false
   group: batch
   kind: Job
 
-- path: spec/template/metadata/labels
-  create: true
-  group: batch
-  kind: Job
-
 - path: spec/jobTemplate/spec/selector/matchLabels
   create: false
   group: batch
   kind: CronJob
 
-- path: spec/jobTemplate/metadata/labels
-  create: true
-  group: batch
-  kind: CronJob
-
-- path: spec/jobTemplate/spec/template/metadata/labels
-  create: true
-  group: batch
-  kind: CronJob
-
 - path: spec/selector/matchLabels
   create: false
   group: policy
@@ -156,4 +110,4 @@ commonLabels:
   create: false
   group: networking.k8s.io
   kind: NetworkPolicy
-`
+` + metadataLabelsFieldSpecs

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/defaultconfig.go

@@ -13,6 +13,7 @@ func GetDefaultFieldSpecs() []byte {
 		[]byte(namePrefixFieldSpecs),
 		[]byte(nameSuffixFieldSpecs),
 		[]byte(commonLabelFieldSpecs),
+		[]byte(templateLabelFieldSpecs),
 		[]byte(commonAnnotationFieldSpecs),
 		[]byte(namespaceFieldSpecs),
 		[]byte(varReferenceFieldSpecs),
@@ -30,6 +31,7 @@ func GetDefaultFieldSpecsAsMap() map[string]string {
 	result["nameprefix"] = namePrefixFieldSpecs
 	result["namesuffix"] = nameSuffixFieldSpecs
 	result["commonlabels"] = commonLabelFieldSpecs
+	result["templatelabels"] = templateLabelFieldSpecs
 	result["commonannotations"] = commonAnnotationFieldSpecs
 	result["namespace"] = namespaceFieldSpecs
 	result["varreference"] = varReferenceFieldSpecs

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/metadatalabels.go

@@ -0,0 +1,51 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const metadataLabelsFieldSpecs = `
+- path: metadata/labels
+  create: true
+
+- path: spec/template/metadata/labels
+  create: true
+  version: v1
+  kind: ReplicationController
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: Deployment
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: ReplicaSet
+
+- path: spec/template/metadata/labels
+  create: true
+  kind: DaemonSet
+
+- path: spec/template/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/volumeClaimTemplates[]/metadata/labels
+  create: true
+  group: apps
+  kind: StatefulSet
+
+- path: spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: Job
+
+- path: spec/jobTemplate/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+
+- path: spec/jobTemplate/spec/template/metadata/labels
+  create: true
+  group: batch
+  kind: CronJob
+`

vendor/sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts/templatelabels.go

@@ -0,0 +1,8 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinpluginconsts
+
+const templateLabelFieldSpecs = `
+templateLabels:
+` + metadataLabelsFieldSpecs

vendor/sigs.k8s.io/kustomize/api/krusty/kustomizer.go

@@ -5,6 +5,7 @@ package krusty
 
 import (
 	"fmt"
+	"log"
 
 	"sigs.k8s.io/kustomize/api/internal/builtins"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
@@ -16,6 +17,7 @@ import (
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/openapi"
 )
@@ -89,11 +91,9 @@ func (b *Kustomizer) Run(
 	if err != nil {
 		return nil, err
 	}
-	if b.options.DoLegacyResourceSort {
-		err = builtins.NewLegacyOrderTransformerPlugin().Transform(m)
-		if err != nil {
-			return nil, err
-		}
+	err = b.applySortOrder(m, kt)
+	if err != nil {
+		return nil, err
 	}
 	if b.options.AddManagedbyLabel || utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.ManagedByLabelOption) {
 		t := builtins.LabelTransformerPlugin{
@@ -112,10 +112,52 @@ func (b *Kustomizer) Run(
 	}
 	m.RemoveBuildAnnotations()
 	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.OriginAnnotations) {
-		m.RemoveOriginAnnotations()
+		err = m.RemoveOriginAnnotations()
+		if err != nil {
+			return nil, errors.WrapPrefixf(err, "failed to clean up origin tracking annotations")
+		}
 	}
 	if !utils.StringSliceContains(kt.Kustomization().BuildMetadata, types.TransformerAnnotations) {
-		m.RemoveTransformerAnnotations()
+		err = m.RemoveTransformerAnnotations()
+		if err != nil {
+			return nil, errors.WrapPrefixf(err, "failed to clean up transformer annotations")
+		}
 	}
 	return m, nil
 }
+
+func (b *Kustomizer) applySortOrder(m resmap.ResMap, kt *target.KustTarget) error {
+	// Sort order can be defined in two places:
+	// - (new) kustomization file
+	// - (old) CLI flag
+	//
+	// We want the kustomization file to take precedence over the CLI flag.
+	// Eventually, we may want to move away from having a CLI flag altogether:
+	// https://github.com/kubernetes-sigs/kustomize/issues/3947
+
+	// Case 1: Sort order set in kustomization file.
+	if kt.Kustomization().SortOptions != nil {
+		// If set in CLI flag too, warn the user.
+		if b.options.Reorder != ReorderOptionUnspecified {
+			log.Println("Warning: Sorting order is set both in 'kustomization.yaml'" +
+				" ('sortOptions') and in a CLI flag ('--reorder'). Using the" +
+				" kustomization file over the CLI flag.")
+		}
+		pl := &builtins.SortOrderTransformerPlugin{
+			SortOptions: kt.Kustomization().SortOptions,
+		}
+		err := pl.Transform(m)
+		if err != nil {
+			return errors.Wrap(err)
+		}
+	} else if b.options.Reorder == ReorderOptionLegacy || b.options.Reorder == ReorderOptionUnspecified {
+		// Case 2: Sort order set in CLI flag only or not at all.
+		pl := &builtins.SortOrderTransformerPlugin{
+			SortOptions: &types.SortOptions{
+				Order: types.LegacySortOrder,
+			},
+		}
+		return errors.Wrap(pl.Transform(m))
+	}
+	return nil
+}

vendor/sigs.k8s.io/kustomize/api/krusty/options.go

@@ -8,6 +8,14 @@ import (
 	"sigs.k8s.io/kustomize/api/types"
 )
 
+type ReorderOption string
+
+const (
+	ReorderOptionLegacy      ReorderOption = "legacy"
+	ReorderOptionNone        ReorderOption = "none"
+	ReorderOptionUnspecified ReorderOption = "unspecified"
+)
+
 // Options holds high-level kustomize configuration options,
 // e.g. are plugins enabled, should the loader be restricted
 // to the kustomization root, etc.
@@ -16,7 +24,15 @@ type Options struct {
 	// per a particular sort order.  When false, don't do the
 	// sort, and instead respect the depth-first resource input
 	// order as specified by the kustomization file(s).
-	DoLegacyResourceSort bool
+
+	// Sort the resources before emitting them. Possible values:
+	// - "legacy": Use a fixed order that kustomize provides for backwards
+	//   compatibility.
+	// - "none": Respect the depth-first resource input order as specified by the
+	//   kustomization file.
+	// - "unspecified": The user didn't specify any preference. Kustomize will
+	//   select the appropriate default.
+	Reorder ReorderOption
 
 	// When true, a label
 	//     app.kubernetes.io/managed-by: kustomize-<version>
@@ -27,9 +43,6 @@ type Options struct {
 	// See type definition.
 	LoadRestrictions types.LoadRestrictions
 
-	// Create an inventory object for pruning.
-	DoPrune bool
-
 	// Options related to kustomize plugins.
 	PluginConfig *types.PluginConfig
 }
@@ -37,11 +50,10 @@ type Options struct {
 // MakeDefaultOptions returns a default instance of Options.
 func MakeDefaultOptions() *Options {
 	return &Options{
-		DoLegacyResourceSort: false,
-		AddManagedbyLabel:    false,
-		LoadRestrictions:     types.LoadRestrictionsRootOnly,
-		DoPrune:              false,
-		PluginConfig:         types.DisabledPluginConfig(),
+		Reorder:           ReorderOptionNone,
+		AddManagedbyLabel: false,
+		LoadRestrictions:  types.LoadRestrictionsRootOnly,
+		PluginConfig:      types.DisabledPluginConfig(),
 	}
 }
 

vendor/sigs.k8s.io/kustomize/api/kv/kv.go

@@ -7,15 +7,14 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"os"
-	"path"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/generators"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 var utf8bom = []byte{0xEF, 0xBB, 0xBF}
@@ -41,23 +40,23 @@ func (kvl *loader) Load(
 	args types.KvPairSources) (all []types.Pair, err error) {
 	pairs, err := kvl.keyValuesFromEnvFiles(args.EnvSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
+		return nil, errors.WrapPrefixf(err,
 			"env source files: %v",
-			args.EnvSources))
+			args.EnvSources)
 	}
 	all = append(all, pairs...)
 
 	pairs, err = keyValuesFromLiteralSources(args.LiteralSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
-			"literal sources %v", args.LiteralSources))
+		return nil, errors.WrapPrefixf(err,
+			"literal sources %v", args.LiteralSources)
 	}
 	all = append(all, pairs...)
 
 	pairs, err = kvl.keyValuesFromFileSources(args.FileSources)
 	if err != nil {
-		return nil, errors.Wrap(err, fmt.Sprintf(
-			"file sources: %v", args.FileSources))
+		return nil, errors.WrapPrefixf(err,
+			"file sources: %v", args.FileSources)
 	}
 	return append(all, pairs...), nil
 }
@@ -77,7 +76,7 @@ func keyValuesFromLiteralSources(sources []string) ([]types.Pair, error) {
 func (kvl *loader) keyValuesFromFileSources(sources []string) ([]types.Pair, error) {
 	var kvs []types.Pair
 	for _, s := range sources {
-		k, fPath, err := parseFileSource(s)
+		k, fPath, err := generators.ParseFileSource(s)
 		if err != nil {
 			return nil, err
 		}
@@ -162,44 +161,13 @@ func (kvl *loader) keyValuesFromLine(line []byte, currentLine int) (types.Pair,
 	if len(data) == 2 {
 		kv.Value = data[1]
 	} else {
-		// No value (no `=` in the line) is a signal to obtain the value
-		// from the environment. This behaviour was accidentally imported from kubectl code, and
-		// will be removed in the next major release of Kustomize.
-		_, _ = fmt.Fprintln(os.Stderr, "WARNING: "+
-			"This Kustomization is relying on a bug that loads values from the environment "+
-			"when they are omitted from an env file. "+
-			"This behaviour will be removed in the next major release of Kustomize.")
-		kv.Value = os.Getenv(key)
+		// If there is no value (no `=` in the line), we set the value to an empty string
+		kv.Value = ""
 	}
 	kv.Key = key
 	return kv, nil
 }
 
-// ParseFileSource parses the source given.
-//
-//  Acceptable formats include:
-//   1.  source-path: the basename will become the key name
-//   2.  source-name=source-path: the source-name will become the key name and
-//       source-path is the path to the key file.
-//
-// Key names cannot include '='.
-func parseFileSource(source string) (keyName, filePath string, err error) {
-	numSeparators := strings.Count(source, "=")
-	switch {
-	case numSeparators == 0:
-		return path.Base(source), source, nil
-	case numSeparators == 1 && strings.HasPrefix(source, "="):
-		return "", "", fmt.Errorf("key name for file path %v missing", strings.TrimPrefix(source, "="))
-	case numSeparators == 1 && strings.HasSuffix(source, "="):
-		return "", "", fmt.Errorf("file path for key name %v missing", strings.TrimSuffix(source, "="))
-	case numSeparators > 1:
-		return "", "", errors.New("key names or file paths cannot contain '='")
-	default:
-		components := strings.Split(source, "=")
-		return components[0], components[1], nil
-	}
-}
-
 // ParseLiteralSource parses the source key=val pair into its component pieces.
 // This functionality is distinguished from strings.SplitN(source, "=", 2) since
 // it returns an error in the case of empty keys, values, or a missing equals sign.
@@ -219,7 +187,7 @@ func parseLiteralSource(source string) (keyName, value string, err error) {
 // removeQuotes removes the surrounding quotes from the provided string only if it is surrounded on both sides
 // rather than blindly trimming all quotation marks on either side.
 func removeQuotes(str string) string {
-	if len(str) == 0 || str[0] != str[len(str)-1] {
+	if len(str) < 2 || str[0] != str[len(str)-1] {
 		return str
 	}
 	if str[0] == '"' || str[0] == '\'' {

vendor/sigs.k8s.io/kustomize/api/loader/fileloader.go

@@ -5,7 +5,7 @@ package loader
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"net/url"
@@ -18,6 +18,13 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+// IsRemoteFile returns whether path has a url scheme that kustomize allows for
+// remote files. See https://github.com/kubernetes-sigs/kustomize/blob/master/examples/remoteBuild.md
+func IsRemoteFile(path string) bool {
+	u, err := url.Parse(path)
+	return err == nil && (u.Scheme == "http" || u.Scheme == "https")
+}
+
 // fileLoader is a kustomization's interface to files.
 //
 // The directory in which a kustomization file sits
@@ -114,6 +121,15 @@ func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
 		RestrictionRootOnly, fSys, filesys.Separator)
 }
 
+// Repo returns the absolute path to the repo that contains Root if this fileLoader was created from a url
+// or the empty string otherwise.
+func (fl *fileLoader) Repo() string {
+	if fl.repoSpec != nil {
+		return fl.repoSpec.Dir.String()
+	}
+	return ""
+}
+
 // Root returns the absolute path that is prepended to any
 // relative paths used in Load.
 func (fl *fileLoader) Root() string {
@@ -206,6 +222,13 @@ func newLoaderAtGitClone(
 			"'%s' refers to file '%s'; expecting directory",
 			repoSpec.AbsPath(), f)
 	}
+	// Path in repo can contain symlinks that exit repo. We can only
+	// check for this after cloning repo.
+	if !root.HasPrefix(repoSpec.CloneDir()) {
+		_ = cleaner()
+		return nil, fmt.Errorf("%q refers to directory outside of repo %q", repoSpec.AbsPath(),
+			repoSpec.CloneDir())
+	}
 	return &fileLoader{
 		// Clones never allowed to escape root.
 		loadRestrictor: RestrictionRootOnly,
@@ -283,30 +306,8 @@ func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 // else an error. Relative paths are taken relative
 // to the root.
 func (fl *fileLoader) Load(path string) ([]byte, error) {
-	if u, err := url.Parse(path); err == nil && (u.Scheme == "http" || u.Scheme == "https") {
-		var hc *http.Client
-		if fl.http != nil {
-			hc = fl.http
-		} else {
-			hc = &http.Client{}
-		}
-		resp, err := hc.Get(path)
-		if err != nil {
-			return nil, err
-		}
-		defer resp.Body.Close()
-		if resp.StatusCode < 200 || resp.StatusCode > 299 {
-			_, err := git.NewRepoSpecFromURL(path)
-			if err == nil {
-				return nil, errors.Errorf("URL is a git repository")
-			}
-			return nil, fmt.Errorf("%w: status code %d (%s)", ErrHTTP, resp.StatusCode, http.StatusText(resp.StatusCode))
-		}
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return nil, err
-		}
-		return body, nil
+	if IsRemoteFile(path) {
+		return fl.httpClientGetContent(path)
 	}
 	if !filepath.IsAbs(path) {
 		path = fl.root.Join(path)
@@ -318,6 +319,30 @@ func (fl *fileLoader) Load(path string) ([]byte, error) {
 	return fl.fSys.ReadFile(path)
 }
 
+func (fl *fileLoader) httpClientGetContent(path string) ([]byte, error) {
+	var hc *http.Client
+	if fl.http != nil {
+		hc = fl.http
+	} else {
+		hc = &http.Client{}
+	}
+	resp, err := hc.Get(path)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	defer resp.Body.Close()
+	// response unsuccessful
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		_, err = git.NewRepoSpecFromURL(path)
+		if err == nil {
+			return nil, errors.Errorf("URL is a git repository")
+		}
+		return nil, fmt.Errorf("%w: status code %d (%s)", ErrHTTP, resp.StatusCode, http.StatusText(resp.StatusCode))
+	}
+	content, err := io.ReadAll(resp.Body)
+	return content, errors.Wrap(err)
+}
+
 // Cleanup runs the cleaner.
 func (fl *fileLoader) Cleanup() error {
 	return fl.cleaner()

vendor/sigs.k8s.io/kustomize/api/provenance/provenance.go

@@ -6,47 +6,63 @@ package provenance
 import (
 	"fmt"
 	"runtime"
+	"runtime/debug"
 	"strings"
 )
 
+// These variables are set at build time using ldflags.
+//
+//nolint:gochecknoglobals
 var (
-	version = "unknown"
-	// sha1 from git, output of $(git rev-parse HEAD)
-	gitCommit = "$Format:%H$"
+	// During a release, this will be set to the release tag, e.g. "kustomize/v4.5.7"
+	version = developmentVersion
 	// build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')
-	buildDate = "1970-01-01T00:00:00Z"
-	goos      = runtime.GOOS
-	goarch    = runtime.GOARCH
+	buildDate = "unknown"
 )
 
+// This default value, (devel), matches
+// the value debug.BuildInfo uses for an unset main module version.
+const developmentVersion = "(devel)"
+
 // Provenance holds information about the build of an executable.
 type Provenance struct {
 	// Version of the kustomize binary.
-	Version string `json:"version,omitempty"`
+	Version string `json:"version,omitempty" yaml:"version,omitempty"`
 	// GitCommit is a git commit
-	GitCommit string `json:"gitCommit,omitempty"`
+	GitCommit string `json:"gitCommit,omitempty" yaml:"gitCommit,omitempty"`
 	// BuildDate is date of the build.
-	BuildDate string `json:"buildDate,omitempty"`
+	BuildDate string `json:"buildDate,omitempty" yaml:"buildDate,omitempty"`
 	// GoOs holds OS name.
-	GoOs string `json:"goOs,omitempty"`
+	GoOs string `json:"goOs,omitempty" yaml:"goOs,omitempty"`
 	// GoArch holds architecture name.
-	GoArch string `json:"goArch,omitempty"`
+	GoArch string `json:"goArch,omitempty" yaml:"goArch,omitempty"`
+	// GoVersion holds Go version.
+	GoVersion string `json:"goVersion,omitempty" yaml:"goVersion,omitempty"`
 }
 
 // GetProvenance returns an instance of Provenance.
 func GetProvenance() Provenance {
-	return Provenance{
-		version,
-		gitCommit,
-		buildDate,
-		goos,
-		goarch,
+	p := Provenance{
+		BuildDate: buildDate,
+		Version:   version,
+		GitCommit: "unknown",
+		GoOs:      runtime.GOOS,
+		GoArch:    runtime.GOARCH,
+		GoVersion: runtime.Version(),
+	}
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return p
 	}
-}
 
-// Full returns the full provenance stamp.
-func (v Provenance) Full() string {
-	return fmt.Sprintf("%+v", v)
+	for _, setting := range info.Settings {
+		// For now, the git commit is the only information of interest.
+		// We could consider adding other info such as the commit date in the future.
+		if setting.Key == "vcs.revision" {
+			p.GitCommit = setting.Value
+		}
+	}
+	return p
 }
 
 // Short returns the shortened provenance stamp.

vendor/sigs.k8s.io/kustomize/api/resmap/factory.go

@@ -4,11 +4,11 @@
 package resmap
 
 import (
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/kusterr"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -81,7 +81,7 @@ func (rmF *Factory) NewResMapFromConfigMapArgs(
 	for i := range argList {
 		res, err := rmF.resF.MakeConfigMap(kvLdr, &argList[i])
 		if err != nil {
-			return nil, errors.Wrap(err, "NewResMapFromConfigMapArgs")
+			return nil, errors.WrapPrefixf(err, "NewResMapFromConfigMapArgs")
 		}
 		resources = append(resources, res)
 	}
@@ -106,7 +106,7 @@ func (rmF *Factory) NewResMapFromSecretArgs(
 	for i := range argsList {
 		res, err := rmF.resF.MakeSecret(kvLdr, &argsList[i])
 		if err != nil {
-			return nil, errors.Wrap(err, "NewResMapFromSecretArgs")
+			return nil, errors.WrapPrefixf(err, "NewResMapFromSecretArgs")
 		}
 		resources = append(resources, res)
 	}

vendor/sigs.k8s.io/kustomize/api/resmap/idslice.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package resmap
-
-import (
-	"sort"
-
-	"sigs.k8s.io/kustomize/kyaml/resid"
-)
-
-// IdSlice implements the sort interface.
-type IdSlice []resid.ResId
-
-var _ sort.Interface = IdSlice{}
-
-func (a IdSlice) Len() int      { return len(a) }
-func (a IdSlice) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a IdSlice) Less(i, j int) bool {
-	if !a[i].Gvk.Equals(a[j].Gvk) {
-		return a[i].Gvk.IsLessThan(a[j].Gvk)
-	}
-	return a[i].LegacySortString() < a[j].LegacySortString()
-}

vendor/sigs.k8s.io/kustomize/api/resmap/reswrangler.go

@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/kustomize/api/filters/annotations"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/resid"
 	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
@@ -108,7 +108,7 @@ func (m *resWrangler) Replace(res *resource.Resource) (int, error) {
 	id := res.CurId()
 	i, err := m.GetIndexOfCurrentId(id)
 	if err != nil {
-		return -1, errors.Wrap(err, "in Replace")
+		return -1, errors.WrapPrefixf(err, "in Replace")
 	}
 	if i < 0 {
 		return -1, fmt.Errorf("cannot find resource with id %s to replace", id)
@@ -286,7 +286,7 @@ func (m *resWrangler) AsYaml() ([]byte, error) {
 		out, err := res.AsYAML()
 		if err != nil {
 			m, _ := res.Map()
-			return nil, errors.Wrapf(err, "%#v", m)
+			return nil, errors.WrapPrefixf(err, "%#v", m)
 		}
 		if firstObj {
 			firstObj = false

vendor/sigs.k8s.io/kustomize/api/resource/origin.go

@@ -52,7 +52,7 @@ func (origin *Origin) Append(path string) *Origin {
 	originCopy := origin.Copy()
 	repoSpec, err := git.NewRepoSpecFromURL(path)
 	if err == nil {
-		originCopy.Repo = repoSpec.Host + repoSpec.OrgRepo
+		originCopy.Repo = repoSpec.CloneSpec()
 		absPath := repoSpec.AbsPath()
 		path = absPath[strings.Index(absPath[1:], "/")+1:][1:]
 		originCopy.Path = ""

vendor/sigs.k8s.io/kustomize/api/resource/resource.go

@@ -164,10 +164,17 @@ func (r *Resource) CopyMergeMetaDataFieldsFrom(other *Resource) error {
 		mergeStringMaps(other.GetLabels(), r.GetLabels())); err != nil {
 		return fmt.Errorf("copyMerge cannot set labels - %w", err)
 	}
-	if err := r.SetAnnotations(
-		mergeStringMapsWithBuildAnnotations(other.GetAnnotations(), r.GetAnnotations())); err != nil {
+
+	ra := r.GetAnnotations()
+	_, enableNameSuffixHash := ra[utils.BuildAnnotationsGenAddHashSuffix]
+	merged := mergeStringMapsWithBuildAnnotations(other.GetAnnotations(), ra)
+	if !enableNameSuffixHash {
+		delete(merged, utils.BuildAnnotationsGenAddHashSuffix)
+	}
+	if err := r.SetAnnotations(merged); err != nil {
 		return fmt.Errorf("copyMerge cannot set annotations - %w", err)
 	}
+
 	if err := r.SetName(other.GetName()); err != nil {
 		return fmt.Errorf("copyMerge cannot set name - %w", err)
 	}

vendor/sigs.k8s.io/kustomize/api/types/erronlybuiltinpluginsallowed.go

@@ -6,7 +6,7 @@ package types
 import (
 	"fmt"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errOnlyBuiltinPluginsAllowed struct {
@@ -24,10 +24,6 @@ func NewErrOnlyBuiltinPluginsAllowed(n string) *errOnlyBuiltinPluginsAllowed {
 }
 
 func IsErrOnlyBuiltinPluginsAllowed(err error) bool {
-	_, ok := err.(*errOnlyBuiltinPluginsAllowed)
-	if ok {
-		return true
-	}
-	_, ok = errors.Cause(err).(*errOnlyBuiltinPluginsAllowed)
-	return ok
+	e := &errOnlyBuiltinPluginsAllowed{}
+	return errors.As(err, &e)
 }

vendor/sigs.k8s.io/kustomize/api/types/errunabletofind.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 type errUnableToFind struct {
@@ -31,10 +31,6 @@ func NewErrUnableToFind(w string, a []Pair) *errUnableToFind {
 }
 
 func IsErrUnableToFind(err error) bool {
-	_, ok := err.(*errUnableToFind)
-	if ok {
-		return true
-	}
-	_, ok = errors.Cause(err).(*errUnableToFind)
-	return ok
+	e := &errUnableToFind{}
+	return errors.As(err, &e)
 }

vendor/sigs.k8s.io/kustomize/api/types/fix.go

@@ -1,54 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-import (
-	"regexp"
-
-	"sigs.k8s.io/yaml"
-)
-
-// FixKustomizationPreUnmarshalling modifies the raw data
-// before marshalling - e.g. changes old field names to
-// new field names.
-func FixKustomizationPreUnmarshalling(data []byte) ([]byte, error) {
-	deprecatedFieldsMap := map[string]string{
-		"imageTags:": "images:",
-	}
-	for oldname, newname := range deprecatedFieldsMap {
-		pattern := regexp.MustCompile(oldname)
-		data = pattern.ReplaceAll(data, []byte(newname))
-	}
-	doLegacy, err := useLegacyPatch(data)
-	if err != nil {
-		return nil, err
-	}
-	if doLegacy {
-		pattern := regexp.MustCompile("patches:")
-		data = pattern.ReplaceAll(data, []byte("patchesStrategicMerge:"))
-	}
-	return data, nil
-}
-
-func useLegacyPatch(data []byte) (bool, error) {
-	found := false
-	var object map[string]interface{}
-	err := yaml.Unmarshal(data, &object)
-	if err != nil {
-		return false, err
-	}
-	if rawPatches, ok := object["patches"]; ok {
-		patches, ok := rawPatches.([]interface{})
-		if !ok {
-			return false, err
-		}
-		for _, p := range patches {
-			_, ok := p.(string)
-			if ok {
-				found = true
-			}
-		}
-	}
-	return found, nil
-}

vendor/sigs.k8s.io/kustomize/api/types/helmchartargs.go

@@ -3,6 +3,10 @@
 
 package types
 
+import "path/filepath"
+
+const HelmDefaultHome = "charts"
+
 type HelmGlobals struct {
 	// ChartHome is a file path, relative to the kustomization root,
 	// to a directory containing a subdirectory for each chart to be
@@ -55,7 +59,11 @@ type HelmChart struct {
 	// in the helm template
 	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 
-	// ValuesFile is local file path to a values file to use _instead of_
+	// AdditionalValuesFiles are local file paths to values files to be used in
+	// addition to either the default values file or the values specified in ValuesFile.
+	AdditionalValuesFiles []string `json:"additionalValuesFiles,omitempty" yaml:"additionalValuesFiles,omitempty"`
+
+	// ValuesFile is a local file path to a values file to use _instead of_
 	// the default values that accompanied the chart.
 	// The default values are in '{ChartHome}/{Name}/values.yaml'.
 	ValuesFile string `json:"valuesFile,omitempty" yaml:"valuesFile,omitempty"`
@@ -71,7 +79,20 @@ type HelmChart struct {
 
 	// IncludeCRDs specifies if Helm should also generate CustomResourceDefinitions.
 	// Defaults to 'false'.
-	IncludeCRDs bool `json:"includeCRDs,omitempty" yaml:"includeCRDs,omitempty"` // nolint: tagliatelle
+	IncludeCRDs bool `json:"includeCRDs,omitempty" yaml:"includeCRDs,omitempty"` //nolint: tagliatelle
+
+	// SkipHooks sets the --no-hooks flag when calling helm template. This prevents
+	// helm from erroneously rendering test templates.
+	SkipHooks bool `json:"skipHooks,omitempty" yaml:"skipHooks,omitempty"`
+
+	// ApiVersions is the kubernetes apiversions used for Capabilities.APIVersions
+	ApiVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
+
+	// NameTemplate is for specifying the name template used to name the release.
+	NameTemplate string `json:"nameTemplate,omitempty" yaml:"nameTemplate,omitempty"`
+
+	// SkipTests skips tests from templated output.
+	SkipTests bool `json:"skipTests,omitempty" yaml:"skipTests,omitempty"`
 }
 
 // HelmChartArgs contains arguments to helm.
@@ -120,3 +141,45 @@ func makeHelmChartFromHca(old *HelmChartArgs) (c HelmChart) {
 	c.ReleaseName = old.ReleaseName
 	return
 }
+
+func (h HelmChart) AsHelmArgs(absChartHome string) []string {
+	args := []string{"template"}
+	if h.ReleaseName != "" {
+		args = append(args, h.ReleaseName)
+	} else {
+		// AFAICT, this doesn't work as intended due to a bug in helm.
+		// See https://github.com/helm/helm/issues/6019
+		// I've tried placing the flag before and after the name argument.
+		args = append(args, "--generate-name")
+	}
+	if h.Name != "" {
+		args = append(args, filepath.Join(absChartHome, h.Name))
+	}
+	if h.Namespace != "" {
+		args = append(args, "--namespace", h.Namespace)
+	}
+	if h.NameTemplate != "" {
+		args = append(args, "--name-template", h.NameTemplate)
+	}
+
+	if h.ValuesFile != "" {
+		args = append(args, "-f", h.ValuesFile)
+	}
+	for _, valuesFile := range h.AdditionalValuesFiles {
+		args = append(args, "-f", valuesFile)
+	}
+
+	for _, apiVer := range h.ApiVersions {
+		args = append(args, "--api-versions", apiVer)
+	}
+	if h.IncludeCRDs {
+		args = append(args, "--include-crds")
+	}
+	if h.SkipTests {
+		args = append(args, "--skip-tests")
+	}
+	if h.SkipHooks {
+		args = append(args, "--no-hooks")
+	}
+	return args
+}

vendor/sigs.k8s.io/kustomize/api/types/inventory.go

@@ -1,16 +0,0 @@
-// Copyright 2019 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-// Inventory records all objects touched in a build operation.
-type Inventory struct {
-	Type      string   `json:"type,omitempty" yaml:"type,omitempty"`
-	ConfigMap NameArgs `json:"configMap,omitempty" yaml:"configMap,omitempty"`
-}
-
-// NameArgs holds both namespace and name.
-type NameArgs struct {
-	Name      string `json:"name,omitempty" yaml:"name,omitempty"`
-	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-}

vendor/sigs.k8s.io/kustomize/api/types/kustomization.go

@@ -7,16 +7,21 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"reflect"
 
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/yaml"
 )
 
 const (
-	KustomizationVersion  = "kustomize.config.k8s.io/v1beta1"
-	KustomizationKind     = "Kustomization"
-	ComponentVersion      = "kustomize.config.k8s.io/v1alpha1"
-	ComponentKind         = "Component"
-	MetadataNamespacePath = "metadata/namespace"
+	KustomizationVersion        = "kustomize.config.k8s.io/v1beta1"
+	KustomizationKind           = "Kustomization"
+	ComponentVersion            = "kustomize.config.k8s.io/v1alpha1"
+	ComponentKind               = "Component"
+	MetadataNamespacePath       = "metadata/namespace"
+	MetadataNamespaceApiVersion = "v1"
+	MetadataNamePath            = "metadata/name"
 
 	OriginAnnotations      = "originAnnotations"
 	TransformerAnnotations = "transformerAnnotations"
@@ -59,12 +64,14 @@ type Kustomization struct {
 	// CommonAnnotations to add to all objects.
 	CommonAnnotations map[string]string `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
 
+	// Deprecated: Use the Patches field instead, which provides a superset of the functionality of PatchesStrategicMerge.
 	// PatchesStrategicMerge specifies the relative path to a file
 	// containing a strategic merge patch.  Format documented at
 	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md
 	// URLs and globs are not supported.
 	PatchesStrategicMerge []PatchStrategicMerge `json:"patchesStrategicMerge,omitempty" yaml:"patchesStrategicMerge,omitempty"`
 
+	// Deprecated: Use the Patches field instead, which provides a superset of the functionality of JSONPatches.
 	// JSONPatches is a list of JSONPatch for applying JSON patch.
 	// Format documented at https://tools.ietf.org/html/rfc6902
 	// and http://jsonpatch.com
@@ -80,6 +87,9 @@ type Kustomization struct {
 	// patch, but this operator is simpler to specify.
 	Images []Image `json:"images,omitempty" yaml:"images,omitempty"`
 
+	// Deprecated: Use the Images field instead.
+	ImageTags []Image `json:"imageTags,omitempty" yaml:"imageTags,omitempty"`
+
 	// Replacements is a list of replacements, which will copy nodes from a
 	// specified source to N specified targets.
 	Replacements []ReplacementField `json:"replacements,omitempty" yaml:"replacements,omitempty"`
@@ -88,6 +98,7 @@ type Kustomization struct {
 	// specification. This can also be done with a patch.
 	Replicas []Replica `json:"replicas,omitempty" yaml:"replicas,omitempty"`
 
+	// Deprecated: Vars will be removed in future release. Migrate to Replacements instead.
 	// Vars allow things modified by kustomize to be injected into a
 	// kubernetes object specification. A var is a name (e.g. FOO) associated
 	// with a field in a specific resource instance.  The field must
@@ -97,6 +108,9 @@ type Kustomization struct {
 	// value of the specified field has been determined.
 	Vars []Var `json:"vars,omitempty" yaml:"vars,omitempty"`
 
+	// SortOptions change the order that kustomize outputs resources.
+	SortOptions *SortOptions `json:"sortOptions,omitempty" yaml:"sortOptions,omitempty"`
+
 	//
 	// Operands - what kustomize operates on.
 	//
@@ -116,9 +130,7 @@ type Kustomization struct {
 	// CRDs themselves are not modified.
 	Crds []string `json:"crds,omitempty" yaml:"crds,omitempty"`
 
-	// Deprecated.
-	// Anything that would have been specified here should
-	// be specified in the Resources field instead.
+	// Deprecated: Anything that would have been specified here should be specified in the Resources field instead.
 	Bases []string `json:"bases,omitempty" yaml:"bases,omitempty"`
 
 	//
@@ -164,19 +176,46 @@ type Kustomization struct {
 	// Validators is a list of files containing validators
 	Validators []string `json:"validators,omitempty" yaml:"validators,omitempty"`
 
-	// Inventory appends an object that contains the record
-	// of all other objects, which can be used in apply, prune and delete
-	Inventory *Inventory `json:"inventory,omitempty" yaml:"inventory,omitempty"`
-
 	// BuildMetadata is a list of strings used to toggle different build options
 	BuildMetadata []string `json:"buildMetadata,omitempty" yaml:"buildMetadata,omitempty"`
 }
 
-// FixKustomizationPostUnmarshalling fixes things
+const (
+	deprecatedWarningToRunEditFix              = "Run 'kustomize edit fix' to update your Kustomization automatically."
+	deprecatedWarningToRunEditFixExperimential = "[EXPERIMENTAL] Run 'kustomize edit fix' to update your Kustomization automatically."
+	deprecatedBaseWarningMessage               = "# Warning: 'bases' is deprecated. Please use 'resources' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedImageTagsWarningMessage          = "# Warning: 'imageTags' is deprecated. Please use 'images' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedPatchesJson6902Message           = "# Warning: 'patchesJson6902' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedPatchesStrategicMergeMessage     = "# Warning: 'patchesStrategicMerge' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
+	deprecatedVarsMessage                      = "# Warning: 'vars' is deprecated. Please use 'replacements' instead." + " " + deprecatedWarningToRunEditFixExperimential
+)
+
+// CheckDeprecatedFields check deprecated field is used or not.
+func (k *Kustomization) CheckDeprecatedFields() *[]string {
+	var warningMessages []string
+	if k.Bases != nil {
+		warningMessages = append(warningMessages, deprecatedBaseWarningMessage)
+	}
+	if k.ImageTags != nil {
+		warningMessages = append(warningMessages, deprecatedImageTagsWarningMessage)
+	}
+	if k.PatchesJson6902 != nil {
+		warningMessages = append(warningMessages, deprecatedPatchesJson6902Message)
+	}
+	if k.PatchesStrategicMerge != nil {
+		warningMessages = append(warningMessages, deprecatedPatchesStrategicMergeMessage)
+	}
+	if k.Vars != nil {
+		warningMessages = append(warningMessages, deprecatedVarsMessage)
+	}
+	return &warningMessages
+}
+
+// FixKustomization fixes things
 // like empty fields that should not be empty, or
 // moving content of deprecated fields to newer
 // fields.
-func (k *Kustomization) FixKustomizationPostUnmarshalling() {
+func (k *Kustomization) FixKustomization() {
 	if k.Kind == "" {
 		k.Kind = KustomizationKind
 	}
@@ -187,8 +226,15 @@ func (k *Kustomization) FixKustomizationPostUnmarshalling() {
 			k.APIVersion = KustomizationVersion
 		}
 	}
+
+	// 'bases' field was deprecated in favor of the 'resources' field.
 	k.Resources = append(k.Resources, k.Bases...)
 	k.Bases = nil
+
+	// 'imageTags' field was deprecated in favor of the 'images' field.
+	k.Images = append(k.Images, k.ImageTags...)
+	k.ImageTags = nil
+
 	for i, g := range k.ConfigMapGenerator {
 		if g.EnvSource != "" {
 			k.ConfigMapGenerator[i].EnvSources =
@@ -217,11 +263,25 @@ func (k *Kustomization) FixKustomizationPostUnmarshalling() {
 // FixKustomizationPreMarshalling fixes things
 // that should occur after the kustomization file
 // has been processed.
-func (k *Kustomization) FixKustomizationPreMarshalling() error {
+func (k *Kustomization) FixKustomizationPreMarshalling(fSys filesys.FileSystem) error {
 	// PatchesJson6902 should be under the Patches field.
 	k.Patches = append(k.Patches, k.PatchesJson6902...)
 	k.PatchesJson6902 = nil
 
+	if k.PatchesStrategicMerge != nil {
+		for _, patchStrategicMerge := range k.PatchesStrategicMerge {
+			// check this patch is file path select.
+			if _, err := fSys.ReadFile(string(patchStrategicMerge)); err == nil {
+				// path patch
+				k.Patches = append(k.Patches, Patch{Path: string(patchStrategicMerge)})
+			} else {
+				// inline string patch
+				k.Patches = append(k.Patches, Patch{Patch: string(patchStrategicMerge)})
+			}
+		}
+		k.PatchesStrategicMerge = nil
+	}
+
 	// this fix is not in FixKustomizationPostUnmarshalling because
 	// it will break some commands like `create` and `add`. those
 	// commands depend on 'commonLabels' field
@@ -241,6 +301,20 @@ func (k *Kustomization) FixKustomizationPreMarshalling() error {
 	return nil
 }
 
+func (k *Kustomization) CheckEmpty() error {
+	// generate empty Kustomization
+	emptyKustomization := &Kustomization{}
+
+	// k.TypeMeta is metadata. It Isn't related to whether empty or not.
+	emptyKustomization.TypeMeta = k.TypeMeta
+
+	if reflect.DeepEqual(k, emptyKustomization) {
+		return fmt.Errorf("kustomization.yaml is empty")
+	}
+
+	return nil
+}
+
 func (k *Kustomization) EnforceFields() []string {
 	var errs []string
 	if k.Kind != "" && k.Kind != KustomizationKind && k.Kind != ComponentKind {
@@ -258,16 +332,19 @@ func (k *Kustomization) EnforceFields() []string {
 
 // Unmarshal replace k with the content in YAML input y
 func (k *Kustomization) Unmarshal(y []byte) error {
+	// TODO: switch to strict decoding to catch duplicate keys.
+	// We can't do so until there is a yaml decoder that supports anchors AND case-insensitive keys.
+	// See https://github.com/kubernetes-sigs/kustomize/issues/5061
 	j, err := yaml.YAMLToJSON(y)
 	if err != nil {
-		return err
+		return errors.WrapPrefixf(err, "invalid Kustomization")
 	}
 	dec := json.NewDecoder(bytes.NewReader(j))
 	dec.DisallowUnknownFields()
 	var nk Kustomization
 	err = dec.Decode(&nk)
 	if err != nil {
-		return err
+		return errors.WrapPrefixf(err, "invalid Kustomization")
 	}
 	*k = nk
 	return nil

vendor/sigs.k8s.io/kustomize/api/types/sortoptions.go

@@ -0,0 +1,28 @@
+// Copyright 2021 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package types
+
+// SortOptions defines the order that kustomize outputs resources.
+type SortOptions struct {
+	// Order selects the ordering strategy.
+	Order SortOrder `json:"order,omitempty" yaml:"order,omitempty"`
+	// LegacySortOptions tweaks the sorting for the "legacy" sort ordering
+	// strategy.
+	LegacySortOptions *LegacySortOptions `json:"legacySortOptions,omitempty" yaml:"legacySortOptions,omitempty"`
+}
+
+// SortOrder defines different ordering strategies.
+type SortOrder string
+
+const LegacySortOrder SortOrder = "legacy"
+const FIFOSortOrder SortOrder = "fifo"
+
+// LegacySortOptions define various options for tweaking the "legacy" ordering
+// strategy.
+type LegacySortOptions struct {
+	// OrderFirst selects the resource kinds to order first.
+	OrderFirst []string `json:"orderFirst" yaml:"orderFirst"`
+	// OrderLast selects the resource kinds to order last.
+	OrderLast []string `json:"orderLast" yaml:"orderLast"`
+}

vendor/sigs.k8s.io/kustomize/kyaml/errors/errors.go

@@ -31,6 +31,16 @@ func Errorf(msg string, args ...interface{}) error {
 	return goerrors.Wrap(fmt.Errorf(msg, args...), 1)
 }
 
+// As finds the targeted error in any wrapped error.
+func As(err error, target interface{}) bool {
+	return goerrors.As(err, target)
+}
+
+// Is detects whether the error is equal to a given error.
+func Is(err error, target error) bool {
+	return goerrors.Is(err, target)
+}
+
 // GetStack returns a stack trace for the error if it has one
 func GetStack(err error) string {
 	if e, ok := err.(*goerrors.Error); ok {

vendor/sigs.k8s.io/kustomize/kyaml/filesys/confirmeddir.go

@@ -4,7 +4,7 @@
 package filesys
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 )
@@ -17,12 +17,12 @@ type ConfirmedDir string
 // The directory is cleaned, no symlinks, etc. so it's
 // returned as a ConfirmedDir.
 func NewTmpConfirmedDir() (ConfirmedDir, error) {
-	n, err := ioutil.TempDir("", "kustomize-")
+	n, err := os.MkdirTemp("", "kustomize-")
 	if err != nil {
 		return "", err
 	}
 
-	// In MacOs `ioutil.TempDir` creates a directory
+	// In MacOs `os.MkdirTemp` creates a directory
 	// with root in the `/var` folder, which is in turn
 	// a symlinked path to `/private/var`.
 	// Function `filepath.EvalSymlinks`is used to

vendor/sigs.k8s.io/kustomize/kyaml/filesys/fsondisk.go

@@ -5,7 +5,6 @@ package filesys
 
 import (
 	"fmt"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -125,12 +124,15 @@ func (fsOnDisk) ReadDir(name string) ([]string, error) {
 	return result, nil
 }
 
-// ReadFile delegates to ioutil.ReadFile.
-func (fsOnDisk) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(name) }
+// ReadFile delegates to os.ReadFile.
+func (fsOnDisk) ReadFile(name string) ([]byte, error) {
+	content, err := os.ReadFile(name)
+	return content, errors.Wrap(err)
+}
 
-// WriteFile delegates to ioutil.WriteFile with read/write permissions.
+// WriteFile delegates to os.WriteFile with read/write permissions.
 func (fsOnDisk) WriteFile(name string, c []byte) error {
-	return errors.Wrap(ioutil.WriteFile(name, c, 0666)) //nolint:gosec
+	return errors.Wrap(os.WriteFile(name, c, 0666)) //nolint:gosec
 }
 
 // Walk delegates to filepath.Walk.

vendor/sigs.k8s.io/kustomize/kyaml/filesys/util.go

@@ -74,30 +74,30 @@ func PathJoin(incoming []string) string {
 //
 // E.g. if part == 'PEACH'
 //
-//                  OLD : NEW                    : POS
-//      --------------------------------------------------------
-//              {empty} : PEACH                  : irrelevant
-//                    / : /PEACH                 : irrelevant
-//                  pie : PEACH/pie              : 0 (or negative)
-//                 /pie : /PEACH/pie             : 0 (or negative)
-//                  raw : raw/PEACH              : 1 (or larger)
-//                 /raw : /raw/PEACH             : 1 (or larger)
-//      a/nice/warm/pie : a/nice/warm/PEACH/pie  : 3
-//     /a/nice/warm/pie : /a/nice/warm/PEACH/pie : 3
+//	             OLD : NEW                    : POS
+//	 --------------------------------------------------------
+//	         {empty} : PEACH                  : irrelevant
+//	               / : /PEACH                 : irrelevant
+//	             pie : PEACH/pie              : 0 (or negative)
+//	            /pie : /PEACH/pie             : 0 (or negative)
+//	             raw : raw/PEACH              : 1 (or larger)
+//	            /raw : /raw/PEACH             : 1 (or larger)
+//	 a/nice/warm/pie : a/nice/warm/PEACH/pie  : 3
+//	/a/nice/warm/pie : /a/nice/warm/PEACH/pie : 3
 //
 // * An empty part results in no change.
 //
-// * Absolute paths get their leading '/' stripped, treated like
-//   relative paths, and the leading '/' is re-added on output.
-//   The meaning of pos is intentionally the same in either absolute or
-//   relative paths; if it weren't, this function could convert absolute
-//   paths to relative paths, which is not desirable.
+//   - Absolute paths get their leading '/' stripped, treated like
+//     relative paths, and the leading '/' is re-added on output.
+//     The meaning of pos is intentionally the same in either absolute or
+//     relative paths; if it weren't, this function could convert absolute
+//     paths to relative paths, which is not desirable.
 //
-// * For robustness (liberal input, conservative output) Pos values that
-//   that are too small (large) to index the split filepath result in a
-//   prefix (postfix) rather than an error.  Use extreme position values
-//   to assure a prefix or postfix (e.g. 0 will always prefix, and
-//   9999 will presumably always postfix).
+//   - For robustness (liberal input, conservative output) Pos values
+//     that are too small (large) to index the split filepath result in a
+//     prefix (postfix) rather than an error.  Use extreme position values
+//     to assure a prefix or postfix (e.g. 0 will always prefix, and
+//     9999 will presumably always postfix).
 func InsertPathPart(path string, pos int, part string) string {
 	if part == "" {
 		return path
@@ -121,7 +121,7 @@ func InsertPathPart(path string, pos int, part string) string {
 	result := make([]string, len(parts)+1)
 	copy(result, parts[0:pos])
 	result[pos] = part
-	return PathJoin(append(result, parts[pos:]...)) // nolint: makezero
+	return PathJoin(append(result, parts[pos:]...)) //nolint: makezero
 }
 
 func IsHiddenFilePath(pattern string) bool {

vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/exec/exec.go

@@ -34,7 +34,7 @@ func (c *Filter) Filter(nodes []*yaml.RNode) ([]*yaml.RNode, error) {
 }
 
 func (c *Filter) Run(reader io.Reader, writer io.Writer) error {
-	cmd := exec.Command(c.Path, c.Args...) // nolint:gosec
+	cmd := exec.Command(c.Path, c.Args...) //nolint:gosec
 	cmd.Stdin = reader
 	cmd.Stdout = writer
 	cmd.Stderr = os.Stderr

vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil/functiontypes.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"sigs.k8s.io/kustomize/kyaml/yaml"
+	k8syaml "sigs.k8s.io/yaml"
 )
 
 const (
@@ -200,50 +201,57 @@ func (s *StorageMount) String() string {
 //
 // The FunctionSpec is read from the resource metadata.annotation
 // "config.kubernetes.io/function"
-func GetFunctionSpec(n *yaml.RNode) *FunctionSpec {
+func GetFunctionSpec(n *yaml.RNode) (*FunctionSpec, error) {
 	meta, err := n.GetMeta()
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("failed to get ResourceMeta: %w", err)
 	}
-	if fn := getFunctionSpecFromAnnotation(n, meta); fn != nil {
-		return fn
+
+	fn, err := getFunctionSpecFromAnnotation(n, meta)
+	if err != nil {
+		return nil, err
+	}
+	if fn != nil {
+		return fn, nil
 	}
 
 	// legacy function specification for backwards compatibility
 	container := meta.Annotations["config.kubernetes.io/container"]
 	if container != "" {
-		return &FunctionSpec{Container: ContainerSpec{Image: container}}
+		return &FunctionSpec{Container: ContainerSpec{Image: container}}, nil
 	}
-	return nil
+	return nil, nil
 }
 
 // getFunctionSpecFromAnnotation parses the config function from an annotation
 // if it is found
-func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) *FunctionSpec {
+func getFunctionSpecFromAnnotation(n *yaml.RNode, meta yaml.ResourceMeta) (*FunctionSpec, error) {
 	var fs FunctionSpec
 	for _, s := range functionAnnotationKeys {
 		fn := meta.Annotations[s]
 		if fn != "" {
-			err := yaml.Unmarshal([]byte(fn), &fs)
-			if err != nil {
-				fmt.Fprintf(os.Stderr, "%v\n", err)
+			if err := k8syaml.UnmarshalStrict([]byte(fn), &fs); err != nil {
+				return nil, fmt.Errorf("%s unmarshal error: %w", s, err)
 			}
-			return &fs
+			return &fs, nil
 		}
 	}
 	n, err := n.Pipe(yaml.Lookup("metadata", "configFn"))
-	if err != nil || yaml.IsMissingOrNull(n) {
-		return nil
+	if err != nil {
+		return nil, fmt.Errorf("failed to look up metadata.configFn: %w", err)
+	}
+	if yaml.IsMissingOrNull(n) {
+		return nil, nil
 	}
 	s, err := n.String()
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "%v\n", err)
+		fmt.Fprintf(os.Stderr, "configFn parse error: %v\n", err)
+		return nil, fmt.Errorf("configFn parse error: %w", err)
 	}
-	err = yaml.Unmarshal([]byte(s), &fs)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%v\n", err)
+	if err := k8syaml.UnmarshalStrict([]byte(s), &fs); err != nil {
+		return nil, fmt.Errorf("%s unmarshal error: %w", "configFn", err)
 	}
-	return &fs
+	return &fs, nil
 }
 
 func StringToStorageMount(s string) StorageMount {
@@ -288,7 +296,11 @@ type IsReconcilerFilter struct {
 func (c *IsReconcilerFilter) Filter(inputs []*yaml.RNode) ([]*yaml.RNode, error) {
 	var out []*yaml.RNode
 	for i := range inputs {
-		isFnResource := GetFunctionSpec(inputs[i]) != nil
+		functionSpec, err := GetFunctionSpec(inputs[i])
+		if err != nil {
+			return nil, err
+		}
+		isFnResource := functionSpec != nil
 		if isFnResource && !c.ExcludeReconcilers {
 			out = append(out, inputs[i])
 		}

vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil/runtimeutil.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
+	"os"
 	"path"
 	"strings"
 
@@ -268,7 +268,7 @@ func (c *FunctionFilter) doResults(r *kio.ByteReader) error {
 		if err != nil {
 			return err
 		}
-		err = ioutil.WriteFile(c.ResultsFile, []byte(results), 0600)
+		err = os.WriteFile(c.ResultsFile, []byte(results), 0600)
 		if err != nil {
 			return err
 		}

vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark/starlark.go

@@ -7,8 +7,8 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
+	"os"
 
 	"go.starlark.net/starlark"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -57,7 +57,7 @@ func (sf *Filter) setup() error {
 
 	// read the program from a file
 	if sf.Path != "" {
-		b, err := ioutil.ReadFile(sf.Path)
+		b, err := os.ReadFile(sf.Path)
 		if err != nil {
 			return err
 		}
@@ -72,7 +72,7 @@ func (sf *Filter) setup() error {
 				return err
 			}
 			defer resp.Body.Close()
-			b, err := ioutil.ReadAll(resp.Body)
+			b, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return err
 			}

vendor/sigs.k8s.io/kustomize/kyaml/internal/forked/github.com/go-yaml/yaml/decode.go

@@ -100,7 +100,10 @@ func (p *parser) peek() yaml_event_type_t {
 	if p.event.typ != yaml_NO_EVENT {
 		return p.event.typ
 	}
-	if !yaml_parser_parse(&p.parser, &p.event) {
+	// It's curious choice from the underlying API to generally return a
+	// positive result on success, but on this case return true in an error
+	// scenario. This was the source of bugs in the past (issue #666).
+	if !yaml_parser_parse(&p.parser, &p.event) || p.parser.error != yaml_NO_ERROR {
 		p.fail()
 	}
 	return p.event.typ
@@ -320,6 +323,8 @@ type decoder struct {
 	decodeCount int
 	aliasCount  int
 	aliasDepth  int
+
+	mergedFields map[interface{}]bool
 }
 
 var (
@@ -808,6 +813,11 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 		}
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+
+	var mergeNode *Node
+
 	mapIsNew := false
 	if out.IsNil() {
 		out.Set(reflect.MakeMap(outt))
@@ -815,11 +825,18 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 	}
 	for i := 0; i < l; i += 2 {
 		if isMerge(n.Content[i]) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		k := reflect.New(kt).Elem()
 		if d.unmarshal(n.Content[i], k) {
+			if mergedFields != nil {
+				ki := k.Interface()
+				if mergedFields[ki] {
+					continue
+				}
+				mergedFields[ki] = true
+			}
 			kkind := k.Kind()
 			if kkind == reflect.Interface {
 				kkind = k.Elem().Kind()
@@ -833,6 +850,12 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 			}
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
+
 	d.stringMapType = stringMapType
 	d.generalMapType = generalMapType
 	return true
@@ -844,7 +867,8 @@ func isStringMap(n *Node) bool {
 	}
 	l := len(n.Content)
 	for i := 0; i < l; i += 2 {
-		if n.Content[i].ShortTag() != strTag {
+		shortTag := n.Content[i].ShortTag()
+		if shortTag != strTag && shortTag != mergeTag {
 			return false
 		}
 	}
@@ -861,7 +885,6 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	var elemType reflect.Type
 	if sinfo.InlineMap != -1 {
 		inlineMap = out.Field(sinfo.InlineMap)
-		inlineMap.Set(reflect.New(inlineMap.Type()).Elem())
 		elemType = inlineMap.Type().Elem()
 	}
 
@@ -870,6 +893,9 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 		d.prepare(n, field)
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+	var mergeNode *Node
 	var doneFields []bool
 	if d.uniqueKeys {
 		doneFields = make([]bool, len(sinfo.FieldsList))
@@ -879,13 +905,20 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	for i := 0; i < l; i += 2 {
 		ni := n.Content[i]
 		if isMerge(ni) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		if !d.unmarshal(ni, name) {
 			continue
 		}
-		if info, ok := sinfo.FieldsMap[name.String()]; ok {
+		sname := name.String()
+		if mergedFields != nil {
+			if mergedFields[sname] {
+				continue
+			}
+			mergedFields[sname] = true
+		}
+		if info, ok := sinfo.FieldsMap[sname]; ok {
 			if d.uniqueKeys {
 				if doneFields[info.Id] {
 					d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s already set in type %s", ni.Line, name.String(), out.Type()))
@@ -911,6 +944,11 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 			d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s not found in type %s", ni.Line, name.String(), out.Type()))
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
 	return true
 }
 
@@ -918,19 +956,29 @@ func failWantMap() {
 	failf("map merge requires map or sequence of maps as the value")
 }
 
-func (d *decoder) merge(n *Node, out reflect.Value) {
-	switch n.Kind {
+func (d *decoder) merge(parent *Node, merge *Node, out reflect.Value) {
+	mergedFields := d.mergedFields
+	if mergedFields == nil {
+		d.mergedFields = make(map[interface{}]bool)
+		for i := 0; i < len(parent.Content); i += 2 {
+			k := reflect.New(ifaceType).Elem()
+			if d.unmarshal(parent.Content[i], k) {
+				d.mergedFields[k.Interface()] = true
+			}
+		}
+	}
+
+	switch merge.Kind {
 	case MappingNode:
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case AliasNode:
-		if n.Alias != nil && n.Alias.Kind != MappingNode {
+		if merge.Alias != nil && merge.Alias.Kind != MappingNode {
 			failWantMap()
 		}
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case SequenceNode:
-		// Step backwards as earlier nodes take precedence.
-		for i := len(n.Content) - 1; i >= 0; i-- {
-			ni := n.Content[i]
+		for i := 0; i < len(merge.Content); i++ {
+			ni := merge.Content[i]
 			if ni.Kind == AliasNode {
 				if ni.Alias != nil && ni.Alias.Kind != MappingNode {
 					failWantMap()
@@ -943,6 +991,8 @@ func (d *decoder) merge(n *Node, out reflect.Value) {
 	default:
 		failWantMap()
 	}
+
+	d.mergedFields = mergedFields
 }
 
 func isMerge(n *Node) bool {

vendor/sigs.k8s.io/kustomize/kyaml/internal/forked/github.com/go-yaml/yaml/parserc.go

@@ -687,6 +687,9 @@ func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, i
 func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}
@@ -786,7 +789,7 @@ func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
 	}
 
 	token := peek_token(parser)
-	if token.typ != yaml_BLOCK_SEQUENCE_START_TOKEN && token.typ != yaml_BLOCK_MAPPING_START_TOKEN {
+	if token == nil || token.typ != yaml_BLOCK_SEQUENCE_START_TOKEN && token.typ != yaml_BLOCK_MAPPING_START_TOKEN {
 		return
 	}
 
@@ -813,6 +816,9 @@ func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
 func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}
@@ -922,6 +928,9 @@ func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_ev
 func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}

vendor/sigs.k8s.io/kustomize/kyaml/internal/forked/github.com/qri-io/starlib/util/util.go

@@ -25,9 +25,9 @@ package util
 import (
 	"fmt"
 
-	"github.com/pkg/errors"
 	"go.starlark.net/starlark"
 	"go.starlark.net/starlarkstruct"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 // // asString unquotes a starlark string value
@@ -44,6 +44,7 @@ func IsEmptyString(s starlark.String) bool {
 }
 
 // Unmarshal decodes a starlark.Value into it's golang counterpart
+//
 //nolint:nakedret
 func Unmarshal(x starlark.Value) (val interface{}, err error) {
 	switch v := x.(type) {
@@ -161,7 +162,7 @@ func Unmarshal(x starlark.Value) (val interface{}, err error) {
 		if _var, ok := v.Constructor().(Unmarshaler); ok {
 			err = _var.UnmarshalStarlark(x)
 			if err != nil {
-				err = errors.Wrapf(err, "failed marshal %q to Starlark object", v.Constructor().Type())
+				err = errors.WrapPrefixf(err, "failed marshal %q to Starlark object", v.Constructor().Type())
 				return
 			}
 			val = _var
@@ -176,6 +177,7 @@ func Unmarshal(x starlark.Value) (val interface{}, err error) {
 }
 
 // Marshal turns go values into starlark types
+//
 //nolint:nakedret
 func Marshal(data interface{}) (v starlark.Value, err error) {
 	switch x := data.(type) {

vendor/sigs.k8s.io/kustomize/kyaml/kio/byteio_writer.go

@@ -45,7 +45,7 @@ type ByteWriter struct {
 	// WrappingAPIVersion is the apiVersion for WrappingKind
 	WrappingAPIVersion string
 
-	// Sort if set, will cause ByteWriter to sort the the nodes before writing them.
+	// Sort if set, will cause ByteWriter to sort the nodes before writing them.
 	Sort bool
 }
 

vendor/sigs.k8s.io/kustomize/kyaml/openapi/Makefile

@@ -5,8 +5,8 @@ MYGOBIN = $(shell go env GOBIN)
 ifeq ($(MYGOBIN),)
 MYGOBIN = $(shell go env GOPATH)/bin
 endif
-API_VERSION := "v1.21.2"
 KIND_VERSION := "v0.11.1"
+API_VERSION ?= "v1.21.2"
 
 .PHONY: all
 all: \
@@ -28,7 +28,7 @@ nuke: clean
 	rm -r kubernetesapi/*
 
 $(MYGOBIN)/go-bindata:
-	go install github.com/go-bindata/go-bindata/v3/go-bindata
+	go install github.com/go-bindata/go-bindata/v3/go-bindata@latest
 
 $(MYGOBIN)/kind:
 	( \
@@ -40,22 +40,22 @@ $(MYGOBIN)/kind:
 		rm -rf $$d; \
 	)
 
+.PHONY: kubernetesapi/openapiinfo.go
+kubernetesapi/openapiinfo.go:
+	./scripts/makeOpenApiInfoDotGo.sh
+
 kustomizationapi/swagger.go: $(MYGOBIN)/go-bindata kustomizationapi/swagger.json
 	$(MYGOBIN)/go-bindata \
 		--pkg kustomizationapi \
 		-o kustomizationapi/swagger.go \
 		kustomizationapi/swagger.json
 
-.PHONY: kubernetesapi/openapiinfo.go
-kubernetesapi/openapiinfo.go:
-	./scripts/makeOpenApiInfoDotGo.sh
-
-.PHONY: kubernetesapi/swagger.json
-kubernetesapi/swagger.json: $(MYGOBIN)/kind $(MYGOBIN)/kustomize
+.PHONY: kubernetesapi/swagger.pb
+kubernetesapi/swagger.pb: $(MYGOBIN)/kind $(MYGOBIN)/kustomize
 	./scripts/fetchSchemaFromCluster.sh $(API_VERSION)
 
 .PHONY: kubernetesapi/swagger.go
-kubernetesapi/swagger.go: $(MYGOBIN)/go-bindata kubernetesapi/swagger.json
+kubernetesapi/swagger.go: $(MYGOBIN)/go-bindata kubernetesapi/swagger.pb
 	./scripts/generateSwaggerDotGo.sh $(API_VERSION)
 
 $(MYGOBIN)/kustomize:

vendor/sigs.k8s.io/kustomize/kyaml/openapi/README.md

@@ -22,22 +22,31 @@ make nuke
 
 The compiled-in schema version should maximize API availability with respect to all actively supported Kubernetes versions. For example, while 1.20, 1.21 and 1.22 are the actively supported versions, 1.21 is the best choice. This is because 1.21 introduces at least one new API and does not remove any, while 1.22 removes a large set of long-deprecated APIs that are still supported in 1.20/1.21.
 
-### Update the built-in schema to a new version
+### Generating additional schema
 
-In the Makefile in this directory, update the `API_VERSION` to your desired version.
+If you'd like to change the default schema version, then in the Makefile in this directory, update the `API_VERSION` to your desired version.
 
 You may need to update the version of Kind these scripts use by changing `KIND_VERSION` in the Makefile in this directory. You can find compatibility information in the [kind release notes](https://github.com/kubernetes-sigs/kind/releases).
 
-In this directory, fetch the openapi schema and generate the 
-corresponding swagger.go for the kubernetes api: 
+In this directory, fetch the openapi schema, generate the
+corresponding swagger.go for the kubernetes api, and update `kubernetesapi/openapiinfo.go`:
 
 ```
 make all
 ```
 
-The above command will update the [OpenAPI schema] and the [Kustomization schema]. It will
-create a directory kubernetesapi/v1212 and store the resulting
-swagger.json and swagger.go files there.
+If you want to run the steps individually instead of using `make all`, you can run
+the following commands:
+
+```
+make kustomizationapi/swagger.go
+make kubernetesapi/swagger.go
+make kubernetesapi/openapiinfo.go
+```
+
+You can optionally delete the old `swagger.pb` and `swagger.go` files if we no longer need to support that kubernetes version of
+openapi data. Make sure you rerun `make kubernetesapi/openapiinfo.go` after deleting any old schemas.
+
 
 #### Precomputations
 
@@ -55,25 +64,6 @@ make prow-presubmit-check >& /tmp/k.txt; echo $?
 
 The exit code should be zero; if not, examine `/tmp/k.txt`.
 
-## Generating additional schemas
-
-Instead of replacing the default version, you can specify a desired version as part of the make invocation:
-
-```
-rm kubernetesapi/swagger.go
-make kubernetesapi/swagger.go API_VERSION=v1.21.2
-```
-
-While the above commands generate the swagger.go files, they
-do not make them available for use nor do they update the
-info field reported by `kustomize openapi info`. To make the
-newly fetched schema and swagger.go available:
-
-```
-rm kubernetesapi/openapiinfo.go
-make kubernetesapi/openapiinfo.go
-```
-
 ## Partial regeneration
 
 You can also regenerate the kubernetes api schemas specifically with:
@@ -87,8 +77,8 @@ To fetch the schema without generating the swagger.go, you can
 run:
 
 ```
-rm kubernetesapi/swagger.json
-make kubernetesapi/swagger.json
+rm kubernetesapi/swagger.pb
+make kubernetesapi/swagger.pb
 ```
 
 Note that generating the swagger.go will re-fetch the schema.

vendor/sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/openapiinfo.go

@@ -6,13 +6,13 @@
 package kubernetesapi
 
 import (
-	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1212"
+	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1_21_2"
 )
 
 const Info = "{title:Kubernetes,version:v1.21.2}"
 
 var OpenAPIMustAsset = map[string]func(string) []byte{
-	"v1212": v1212.MustAsset,
+	"v1.21.2": v1_21_2.MustAsset,
 }
 
-const DefaultOpenAPI = "v1212"
+const DefaultOpenAPI = "v1.21.2"

vendor/sigs.k8s.io/kustomize/kyaml/openapi/kustomizationapi/swagger.go

@@ -11,7 +11,6 @@ import (
 	"compress/gzip"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -215,7 +214,7 @@ func RestoreAsset(dir, name string) error {
 	if err != nil {
 		return err
 	}
-	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
+	err = os.WriteFile(_filePath(dir, name), data, info.Mode())
 	if err != nil {
 		return err
 	}

vendor/sigs.k8s.io/kustomize/kyaml/openapi/openapi.go

@@ -6,12 +6,13 @@ package openapi
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
+	"sync"
 
-	openapi_v2 "github.com/google/gnostic/openapiv2"
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
 	"google.golang.org/protobuf/proto"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 	"sigs.k8s.io/kustomize/kyaml/errors"
@@ -21,14 +22,27 @@ import (
 	k8syaml "sigs.k8s.io/yaml"
 )
 
-// globalSchema contains global state information about the openapi
-var globalSchema openapiData
+var (
+	// schemaLock is the lock for schema related globals.
+	//
+	// NOTE: This lock helps with preventing panics that might occur due to the data
+	// race that concurrent access on this variable might cause but it doesn't
+	// fully fix the issue described in https://github.com/kubernetes-sigs/kustomize/issues/4824.
+	// For instance concurrently running goroutines where each of them calls SetSchema()
+	// and/or GetSchemaVersion might end up received nil errors (success) whereas the
+	// seconds one would overwrite the global variable that has been written by the
+	// first one.
+	schemaLock sync.RWMutex //nolint:gochecknoglobals
 
-// kubernetesOpenAPIVersion specifies which builtin kubernetes schema to use
-var kubernetesOpenAPIVersion string
+	// kubernetesOpenAPIVersion specifies which builtin kubernetes schema to use.
+	kubernetesOpenAPIVersion string //nolint:gochecknoglobals
 
-// customSchemaFile stores the custom OpenApi schema if it is provided
-var customSchema []byte
+	// globalSchema contains global state information about the openapi
+	globalSchema openapiData //nolint:gochecknoglobals
+
+	// customSchemaFile stores the custom OpenApi schema if it is provided
+	customSchema []byte //nolint:gochecknoglobals
+)
 
 // openapiData contains the parsed openapi state.  this is in a struct rather than
 // a list of vars so that it can be reset from tests.
@@ -104,7 +118,7 @@ var precomputedIsNamespaceScoped = map[yaml.TypeMeta]bool{
 	{APIVersion: "node.k8s.io/v1beta1", Kind: "RuntimeClass"}:                                    false,
 	{APIVersion: "policy/v1", Kind: "PodDisruptionBudget"}:                                       true,
 	{APIVersion: "policy/v1beta1", Kind: "PodDisruptionBudget"}:                                  true,
-	{APIVersion: "policy/v1beta1", Kind: "PodSecurityPolicy"}:                                    false,
+	{APIVersion: "policy/v1beta1", Kind: "PodSecurityPolicy"}:                                    false, // remove after openapi upgrades to v1.25.
 	{APIVersion: "rbac.authorization.k8s.io/v1", Kind: "ClusterRole"}:                            false,
 	{APIVersion: "rbac.authorization.k8s.io/v1", Kind: "ClusterRoleBinding"}:                     false,
 	{APIVersion: "rbac.authorization.k8s.io/v1", Kind: "Role"}:                                   true,
@@ -220,7 +234,7 @@ func definitionRefsFromRNode(object *yaml.RNode) ([]string, error) {
 
 // parseOpenAPI reads openAPIPath yaml and converts it to RNode
 func parseOpenAPI(openAPIPath string) (*yaml.RNode, error) {
-	b, err := ioutil.ReadFile(openAPIPath)
+	b, err := os.ReadFile(openAPIPath)
 	if err != nil {
 		return nil, err
 	}
@@ -278,9 +292,12 @@ func AddSchema(s []byte) error {
 
 // ResetOpenAPI resets the openapi data to empty
 func ResetOpenAPI() {
+	schemaLock.Lock()
+	defer schemaLock.Unlock()
+
 	globalSchema = openapiData{}
-	kubernetesOpenAPIVersion = ""
 	customSchema = nil
+	kubernetesOpenAPIVersion = ""
 }
 
 // AddDefinitions adds the definitions to the global schema.
@@ -400,7 +417,7 @@ func SuppressBuiltInSchemaUse() {
 
 // Elements returns the Schema for the elements of an array.
 func (rs *ResourceSchema) Elements() *ResourceSchema {
-	// load the schema from swagger.json
+	// load the schema from swagger files
 	initSchema()
 
 	if len(rs.Schema.Type) != 1 || rs.Schema.Type[0] != "array" {
@@ -446,7 +463,7 @@ func (rs *ResourceSchema) Lookup(path ...string) *ResourceSchema {
 
 // Field returns the Schema for a field.
 func (rs *ResourceSchema) Field(field string) *ResourceSchema {
-	// load the schema from swagger.json
+	// load the schema from swagger files
 	initSchema()
 
 	// locate the Schema
@@ -459,7 +476,7 @@ func (rs *ResourceSchema) Field(field string) *ResourceSchema {
 		// (the key doesn't matter, they all have the same value type)
 		s = *rs.Schema.AdditionalProperties.Schema
 	default:
-		// no Schema found from either swagger.json or line comments
+		// no Schema found from either swagger files or line comments
 		return nil
 	}
 
@@ -545,24 +562,28 @@ const (
 	groupKey = "group"
 	// versionKey is the key to lookup the version from the GVK extension
 	versionKey = "version"
-	// kindKey is the the to lookup the kind from the GVK extension
+	// kindKey is the to lookup the kind from the GVK extension
 	kindKey = "kind"
 )
 
 // SetSchema sets the kubernetes OpenAPI schema version to use
 func SetSchema(openAPIField map[string]string, schema []byte, reset bool) error {
+	schemaLock.Lock()
+	defer schemaLock.Unlock()
+
 	// this should only be set once
 	schemaIsSet := (kubernetesOpenAPIVersion != "") || customSchema != nil
 	if schemaIsSet && !reset {
 		return nil
 	}
 
-	version, exists := openAPIField["version"]
-	if exists && schema != nil {
-		return fmt.Errorf("builtin version and custom schema provided, cannot use both")
-	}
+	version, versionProvided := openAPIField["version"]
 
-	if schema != nil { // use custom schema
+	// use custom schema
+	if schema != nil {
+		if versionProvided {
+			return fmt.Errorf("builtin version and custom schema provided, cannot use both")
+		}
 		customSchema = schema
 		kubernetesOpenAPIVersion = "custom"
 		// if the schema is changed, initSchema should parse the new schema
@@ -571,13 +592,14 @@ func SetSchema(openAPIField map[string]string, schema []byte, reset bool) error
 	}
 
 	// use builtin version
-	kubernetesOpenAPIVersion = strings.ReplaceAll(version, ".", "")
+	kubernetesOpenAPIVersion = version
 	if kubernetesOpenAPIVersion == "" {
 		return nil
 	}
 	if _, ok := kubernetesapi.OpenAPIMustAsset[kubernetesOpenAPIVersion]; !ok {
 		return fmt.Errorf("the specified OpenAPI version is not built in")
 	}
+
 	customSchema = nil
 	// if the schema is changed, initSchema should parse the new schema
 	globalSchema.schemaInit = false
@@ -586,6 +608,9 @@ func SetSchema(openAPIField map[string]string, schema []byte, reset bool) error
 
 // GetSchemaVersion returns what kubernetes OpenAPI version is being used
 func GetSchemaVersion() string {
+	schemaLock.RLock()
+	defer schemaLock.RUnlock()
+
 	switch {
 	case kubernetesOpenAPIVersion == "" && customSchema == nil:
 		return kubernetesOpenAPIDefaultVersion
@@ -598,6 +623,9 @@ func GetSchemaVersion() string {
 
 // initSchema parses the json schema
 func initSchema() {
+	schemaLock.Lock()
+	defer schemaLock.Unlock()
+
 	if globalSchema.schemaInit {
 		return
 	}
@@ -607,7 +635,7 @@ func initSchema() {
 	if customSchema != nil {
 		err := parse(customSchema, JsonOrYaml)
 		if err != nil {
-			panic("invalid schema file")
+			panic(fmt.Errorf("invalid schema file: %w", err))
 		}
 	} else {
 		if kubernetesOpenAPIVersion == "" {
@@ -629,11 +657,10 @@ func parseBuiltinSchema(version string) {
 		// don't parse the built in schema
 		return
 	}
-
 	// parse the swagger, this should never fail
 	assetName := filepath.Join(
 		"kubernetesapi",
-		version,
+		strings.ReplaceAll(version, ".", "_"),
 		"swagger.pb")
 
 	if err := parse(kubernetesapi.OpenAPIMustAsset[version](assetName), Proto); err != nil {

vendor/sigs.k8s.io/kustomize/kyaml/resid/gvk.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Gvk identifies a Kubernetes API type.
-// https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+// https://git.k8s.io/design-proposals-archive/api-machinery/api-group.md
 type Gvk struct {
 	Group   string `json:"group,omitempty" yaml:"group,omitempty"`
 	Version string `json:"version,omitempty" yaml:"version,omitempty"`
@@ -97,38 +97,35 @@ func (x Gvk) String() string {
 	return strings.Join([]string{k, v, g}, fieldSep)
 }
 
-// legacySortString returns an older version of String() that LegacyOrderTransformer depends on
-// to keep its ordering stable across Kustomize versions
-func (x Gvk) legacySortString() string {
-	legacyNoGroup := "~G"
-	legacyNoVersion := "~V"
-	legacyNoKind := "~K"
-	legacyFieldSeparator := "_"
+// stableSortString returns a GVK representation that ensures determinism and
+// backwards-compatibility in testing, logging, ...
+func (x Gvk) stableSortString() string {
+	stableNoGroup := "~G"
+	stableNoVersion := "~V"
+	stableNoKind := "~K"
+	stableFieldSeparator := "_"
 
 	g := x.Group
 	if g == "" {
-		g = legacyNoGroup
+		g = stableNoGroup
 	}
 	v := x.Version
 	if v == "" {
-		v = legacyNoVersion
+		v = stableNoVersion
 	}
 	k := x.Kind
 	if k == "" {
-		k = legacyNoKind
+		k = stableNoKind
 	}
-	return strings.Join([]string{g, v, k}, legacyFieldSeparator)
+	return strings.Join([]string{g, v, k}, stableFieldSeparator)
 }
 
 // ApiVersion returns the combination of Group and Version
 func (x Gvk) ApiVersion() string {
-	var sb strings.Builder
 	if x.Group != "" {
-		sb.WriteString(x.Group)
-		sb.WriteString("/")
+		return x.Group + "/" + x.Version
 	}
-	sb.WriteString(x.Version)
-	return sb.String()
+	return x.Version
 }
 
 // StringWoEmptyField returns a string representation of the GVK. Non-exist
@@ -203,7 +200,7 @@ func (x Gvk) IsLessThan(o Gvk) bool {
 	if indexI != indexJ {
 		return indexI < indexJ
 	}
-	return x.legacySortString() < o.legacySortString()
+	return x.stableSortString() < o.stableSortString()
 }
 
 // IsSelected returns true if `selector` selects `x`; otherwise, false.

vendor/sigs.k8s.io/kustomize/kyaml/resid/resid.go

@@ -60,25 +60,6 @@ func (id ResId) String() string {
 		[]string{id.Gvk.String(), strings.Join([]string{nm, ns}, fieldSep)}, separator)
 }
 
-// LegacySortString returns an older version of String() that LegacyOrderTransformer depends on
-// to keep its ordering stable across Kustomize versions
-func (id ResId) LegacySortString() string {
-	legacyNoNamespace := "~X"
-	legacyNoName := "~N"
-	legacySeparator := "|"
-
-	ns := id.Namespace
-	if ns == "" {
-		ns = legacyNoNamespace
-	}
-	nm := id.Name
-	if nm == "" {
-		nm = legacyNoName
-	}
-	return strings.Join(
-		[]string{id.Gvk.String(), ns, nm}, legacySeparator)
-}
-
 func FromString(s string) ResId {
 	values := strings.Split(s, separator)
 	gvk := GvkFromString(values[0])

vendor/sigs.k8s.io/kustomize/kyaml/runfn/runfn.go

@@ -308,7 +308,10 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
 	var fltrs []kio.Filter
 	for i := range fns {
 		api := fns[i]
-		spec := runtimeutil.GetFunctionSpec(api)
+		spec, err := runtimeutil.GetFunctionSpec(api)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get FunctionSpec: %w", err)
+		}
 		if spec == nil {
 			// resource doesn't have function spec
 			continue

vendor/sigs.k8s.io/kustomize/kyaml/sets/string.go

@@ -10,7 +10,7 @@ func (s String) Len() int {
 }
 
 func (s String) List() []string {
-	var val []string
+	val := make([]string, 0, len(s))
 	for k := range s {
 		val = append(val, k)
 	}

vendor/sigs.k8s.io/kustomize/kyaml/utils/pathsplitter.go

@@ -11,6 +11,13 @@ import "strings"
 func PathSplitter(path string, delimiter string) []string {
 	ps := strings.Split(path, delimiter)
 	var res []string
+
+	// allow path to start with forward slash
+	// i.e. /a/b/c
+	if len(ps) > 1 && ps[0] == "" {
+		ps = ps[1:]
+	}
+
 	res = append(res, ps[0])
 	for i := 1; i < len(ps); i++ {
 		last := len(res) - 1

vendor/sigs.k8s.io/kustomize/kyaml/yaml/alias.go

@@ -87,6 +87,16 @@ var MappingNode yaml.Kind = yaml.MappingNode
 var ScalarNode yaml.Kind = yaml.ScalarNode
 var SequenceNode yaml.Kind = yaml.SequenceNode
 
+func nodeKindString(k yaml.Kind) string {
+	return map[yaml.Kind]string{
+		yaml.SequenceNode: "SequenceNode",
+		yaml.MappingNode:  "MappingNode",
+		yaml.ScalarNode:   "ScalarNode",
+		yaml.DocumentNode: "DocumentNode",
+		yaml.AliasNode:    "AliasNode",
+	}[k]
+}
+
 var DoubleQuotedStyle yaml.Style = yaml.DoubleQuotedStyle
 var FlowStyle yaml.Style = yaml.FlowStyle
 var FoldedStyle yaml.Style = yaml.FoldedStyle

vendor/sigs.k8s.io/kustomize/kyaml/yaml/filters.go

@@ -68,7 +68,7 @@ func (y *YFilter) UnmarshalYAML(unmarshal func(interface{}) error) error {
 type YFilters []YFilter
 
 func (y YFilters) Filters() []Filter {
-	var f []Filter
+	f := make([]Filter, 0, len(y))
 	for i := range y {
 		f = append(f, y[i].Filter)
 	}

vendor/sigs.k8s.io/kustomize/kyaml/yaml/fns.go

@@ -197,36 +197,37 @@ func (c FieldClearer) Filter(rn *RNode) (*RNode, error) {
 		return nil, err
 	}
 
-	for i := 0; i < len(rn.Content()); i += 2 {
-		// if name matches, remove these 2 elements from the list because
-		// they are treated as a fieldName/fieldValue pair.
-		if rn.Content()[i].Value == c.Name {
-			if c.IfEmpty {
-				if len(rn.Content()[i+1].Content) > 0 {
-					continue
-				}
-			}
-
-			// save the item we are about to remove
-			removed := NewRNode(rn.Content()[i+1])
-			if len(rn.YNode().Content) > i+2 {
-				l := len(rn.YNode().Content)
-				// remove from the middle of the list
-				rn.YNode().Content = rn.Content()[:i]
-				rn.YNode().Content = append(
-					rn.YNode().Content,
-					rn.Content()[i+2:l]...)
-			} else {
-				// remove from the end of the list
-				rn.YNode().Content = rn.Content()[:i]
-			}
-
-			// return the removed field name and value
-			return removed, nil
+	var removed *RNode
+	visitFieldsWhileTrue(rn.Content(), func(key, value *yaml.Node, keyIndex int) bool {
+		if key.Value != c.Name {
+			return true
 		}
-	}
-	// nothing removed
-	return nil, nil
+
+		// the name matches: remove these 2 elements from the list because
+		// they are treated as a fieldName/fieldValue pair.
+		if c.IfEmpty {
+			if len(value.Content) > 0 {
+				return true
+			}
+		}
+
+		// save the item we are about to remove
+		removed = NewRNode(value)
+		if len(rn.YNode().Content) > keyIndex+2 {
+			l := len(rn.YNode().Content)
+			// remove from the middle of the list
+			rn.YNode().Content = rn.Content()[:keyIndex]
+			rn.YNode().Content = append(
+				rn.YNode().Content,
+				rn.Content()[keyIndex+2:l]...)
+		} else {
+			// remove from the end of the list
+			rn.YNode().Content = rn.Content()[:keyIndex]
+		}
+		return false
+	})
+
+	return removed, nil
 }
 
 func MatchElement(field, value string) ElementMatcher {
@@ -402,14 +403,15 @@ func (f FieldMatcher) Filter(rn *RNode) (*RNode, error) {
 		return nil, err
 	}
 
-	for i := 0; i < len(rn.Content()); i = IncrementFieldIndex(i) {
-		isMatchingField := rn.Content()[i].Value == f.Name
-		if isMatchingField {
-			requireMatchFieldValue := f.Value != nil
-			if !requireMatchFieldValue || rn.Content()[i+1].Value == f.Value.YNode().Value {
-				return NewRNode(rn.Content()[i+1]), nil
-			}
+	var returnNode *RNode
+	requireMatchFieldValue := f.Value != nil
+	visitMappingNodeFields(rn.Content(), func(key, value *yaml.Node) {
+		if !requireMatchFieldValue || value.Value == f.Value.YNode().Value {
+			returnNode = NewRNode(value)
 		}
+	}, f.Name)
+	if returnNode != nil {
+		return returnNode, nil
 	}
 
 	if f.Create != nil {
@@ -550,7 +552,7 @@ func (l PathGetter) getFilter(part, nextPart string, fieldPath *[]string) (Filte
 	default:
 		// mapping node
 		*fieldPath = append(*fieldPath, part)
-		return l.fieldFilter(part, l.getKind(nextPart))
+		return l.fieldFilter(part, getPathPartKind(nextPart, l.Create))
 	}
 }
 
@@ -590,15 +592,18 @@ func (l PathGetter) fieldFilter(
 	return FieldMatcher{Name: name, Create: &RNode{value: &yaml.Node{Kind: kind, Style: l.Style}}}, nil
 }
 
-func (l PathGetter) getKind(nextPart string) yaml.Kind {
+func getPathPartKind(nextPart string, defaultKind yaml.Kind) yaml.Kind {
 	if IsListIndex(nextPart) {
 		// if nextPart is of the form [a=b], then it is an index into a Sequence
 		// so the current part must be a SequenceNode
 		return yaml.SequenceNode
 	}
+	if IsIdxNumber(nextPart) {
+		return yaml.SequenceNode
+	}
 	if nextPart == "" {
-		// final name in the path, use the l.Create defined Kind
-		return l.Create
+		// final name in the path, use the default kind provided
+		return defaultKind
 	}
 
 	// non-sequence intermediate Node
@@ -640,13 +645,19 @@ func (s MapEntrySetter) Filter(rn *RNode) (*RNode, error) {
 	if s.Name == "" {
 		s.Name = GetValue(s.Key)
 	}
-	for i := 0; i < len(rn.Content()); i = IncrementFieldIndex(i) {
-		isMatchingField := rn.Content()[i].Value == s.Name
-		if isMatchingField {
-			rn.Content()[i] = s.Key.YNode()
-			rn.Content()[i+1] = s.Value.YNode()
-			return rn, nil
+
+	content := rn.Content()
+	fieldStillNotFound := true
+	visitFieldsWhileTrue(content, func(key, value *yaml.Node, keyIndex int) bool {
+		if key.Value == s.Name {
+			content[keyIndex] = s.Key.YNode()
+			content[keyIndex+1] = s.Value.YNode()
+			fieldStillNotFound = false
 		}
+		return fieldStillNotFound
+	})
+	if !fieldStillNotFound {
+		return rn, nil
 	}
 
 	// create the field
@@ -794,12 +805,22 @@ func ErrorIfAnyInvalidAndNonNull(kind yaml.Kind, rn ...*RNode) error {
 	return nil
 }
 
-var nodeTypeIndex = map[yaml.Kind]string{
-	yaml.SequenceNode: "SequenceNode",
-	yaml.MappingNode:  "MappingNode",
-	yaml.ScalarNode:   "ScalarNode",
-	yaml.DocumentNode: "DocumentNode",
-	yaml.AliasNode:    "AliasNode",
+type InvalidNodeKindError struct {
+	expectedKind yaml.Kind
+	node         *RNode
+}
+
+func (e *InvalidNodeKindError) Error() string {
+	msg := fmt.Sprintf("wrong node kind: expected %s but got %s",
+		nodeKindString(e.expectedKind), nodeKindString(e.node.YNode().Kind))
+	if content, err := e.node.String(); err == nil {
+		msg += fmt.Sprintf(": node contents:\n%s", content)
+	}
+	return msg
+}
+
+func (e *InvalidNodeKindError) ActualNodeKind() Kind {
+	return e.node.YNode().Kind
 }
 
 func ErrorIfInvalid(rn *RNode, kind yaml.Kind) error {
@@ -809,11 +830,7 @@ func ErrorIfInvalid(rn *RNode, kind yaml.Kind) error {
 	}
 
 	if rn.YNode().Kind != kind {
-		s, _ := rn.String()
-		return errors.Errorf(
-			"wrong Node Kind for %s expected: %v was %v: value: {%s}",
-			strings.Join(rn.FieldPath(), "."),
-			nodeTypeIndex[kind], nodeTypeIndex[rn.YNode().Kind], strings.TrimSpace(s))
+		return &InvalidNodeKindError{node: rn, expectedKind: kind}
 	}
 
 	if kind == yaml.MappingNode {
@@ -859,9 +876,3 @@ func SplitIndexNameValue(p string) (string, string, error) {
 	}
 	return parts[0], parts[1], nil
 }
-
-// IncrementFieldIndex increments i to point to the next field name element in
-// a slice of Contents.
-func IncrementFieldIndex(i int) int {
-	return i + 2
-}

vendor/sigs.k8s.io/kustomize/kyaml/yaml/match.go

@@ -4,9 +4,13 @@
 package yaml
 
 import (
+	"fmt"
 	"regexp"
 	"strconv"
 	"strings"
+
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/internal/forked/github.com/go-yaml/yaml"
 )
 
 // PathMatcher returns all RNodes matching the path wrapped in a SequenceNode.
@@ -21,7 +25,7 @@ type PathMatcher struct {
 	// Each path part may be one of:
 	// * FieldMatcher -- e.g. "spec"
 	// * Map Key -- e.g. "app.k8s.io/version"
-	// * List Entry -- e.g. "[name=nginx]" or "[=-jar]"
+	// * List Entry -- e.g. "[name=nginx]" or "[=-jar]" or "0"
 	//
 	// Map Keys and Fields are equivalent.
 	// See FieldMatcher for more on Fields and Map Keys.
@@ -43,10 +47,18 @@ type PathMatcher struct {
 	// This is useful for if the nodes are to be printed in FlowStyle.
 	StripComments bool
 
-	val         *RNode
-	field       string
-	matchRegex  string
-	indexNumber int
+	// Create will cause missing path parts to be created as they are walked.
+	//
+	// * The leaf Node (final path) will be created with a Kind matching Create
+	// * Intermediary Nodes will be created as either a MappingNodes or
+	//   SequenceNodes as appropriate for each's Path location.
+	// * Nodes identified by an index will only be created if the index indicates
+	//   an append operation (i.e. index=len(list))
+	Create yaml.Kind `yaml:"create,omitempty"`
+
+	val        *RNode
+	field      string
+	matchRegex string
 }
 
 func (p *PathMatcher) stripComments(n *Node) {
@@ -109,7 +121,7 @@ func (p *PathMatcher) doMatchEvery(rn *RNode) (*RNode, error) {
 func (p *PathMatcher) visitEveryElem(elem *RNode) error {
 	fieldName := p.Path[0]
 	// recurse on the matching element
-	pm := &PathMatcher{Path: p.Path[1:]}
+	pm := &PathMatcher{Path: p.Path[1:], Create: p.Create}
 	add, err := pm.filter(elem)
 	for k, v := range pm.Matches {
 		p.Matches[k] = v
@@ -125,13 +137,25 @@ func (p *PathMatcher) visitEveryElem(elem *RNode) error {
 func (p *PathMatcher) doField(rn *RNode) (*RNode, error) {
 	// lookup the field
 	field, err := rn.Pipe(Get(p.Path[0]))
-	if err != nil || field == nil {
-		// if the field doesn't exist, return nil
+	if err != nil || (!IsCreate(p.Create) && field == nil) {
 		return nil, err
 	}
 
+	if IsCreate(p.Create) && field == nil {
+		var nextPart string
+		if len(p.Path) > 1 {
+			nextPart = p.Path[1]
+		}
+		nextPartKind := getPathPartKind(nextPart, p.Create)
+		field = &RNode{value: &yaml.Node{Kind: nextPartKind}}
+		err := rn.PipeE(SetField(p.Path[0], field))
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// recurse on the field, removing the first element of the path
-	pm := &PathMatcher{Path: p.Path[1:]}
+	pm := &PathMatcher{Path: p.Path[1:], Create: p.Create}
 	p.val, err = pm.filter(field)
 	p.Matches = pm.Matches
 	return p.val, err
@@ -144,18 +168,33 @@ func (p *PathMatcher) doIndexSeq(rn *RNode) (*RNode, error) {
 	if err != nil {
 		return nil, err
 	}
-	p.indexNumber = idx
 
 	elements, err := rn.Elements()
 	if err != nil {
 		return nil, err
 	}
 
+	if len(elements) == idx && IsCreate(p.Create) {
+		var nextPart string
+		if len(p.Path) > 1 {
+			nextPart = p.Path[1]
+		}
+		elem := &yaml.Node{Kind: getPathPartKind(nextPart, p.Create)}
+		err = rn.PipeE(Append(elem))
+		if err != nil {
+			return nil, errors.WrapPrefixf(err, "failed to append element for %q", p.Path[0])
+		}
+		elements = append(elements, NewRNode(elem))
+	}
+
+	if len(elements) < idx+1 {
+		return nil, fmt.Errorf("index %d specified but only %d elements found", idx, len(elements))
+	}
 	// get target element
 	element := elements[idx]
 
 	// recurse on the matching element
-	pm := &PathMatcher{Path: p.Path[1:]}
+	pm := &PathMatcher{Path: p.Path[1:], Create: p.Create}
 	add, err := pm.filter(element)
 	for k, v := range pm.Matches {
 		p.Matches[k] = v
@@ -176,16 +215,39 @@ func (p *PathMatcher) doSeq(rn *RNode) (*RNode, error) {
 		return nil, err
 	}
 
-	if p.field == "" {
+	primitiveElement := len(p.field) == 0
+	if primitiveElement {
 		err = rn.VisitElements(p.visitPrimitiveElem)
 	} else {
 		err = rn.VisitElements(p.visitElem)
 	}
-	if err != nil || p.val == nil || len(p.val.YNode().Content) == 0 {
+	if err != nil {
 		return nil, err
 	}
+	if !p.val.IsNil() && len(p.val.YNode().Content) == 0 {
+		p.val = nil
+	}
 
-	return p.val, nil
+	if !IsCreate(p.Create) || p.val != nil {
+		return p.val, nil
+	}
+
+	var elem *yaml.Node
+	valueNode := NewScalarRNode(p.matchRegex).YNode()
+	if primitiveElement {
+		elem = valueNode
+	} else {
+		elem = &yaml.Node{
+			Kind:    yaml.MappingNode,
+			Content: []*yaml.Node{{Kind: yaml.ScalarNode, Value: p.field}, valueNode},
+		}
+	}
+	err = rn.PipeE(Append(elem))
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to create element for %q", p.Path[0])
+	}
+	// re-do the sequence search; this time we'll find the element we just created
+	return p.doSeq(rn)
 }
 
 func (p *PathMatcher) visitPrimitiveElem(elem *RNode) error {
@@ -228,7 +290,7 @@ func (p *PathMatcher) visitElem(elem *RNode) error {
 	}
 
 	// recurse on the matching element
-	pm := &PathMatcher{Path: p.Path[1:]}
+	pm := &PathMatcher{Path: p.Path[1:], Create: p.Create}
 	add, err := pm.filter(elem)
 	for k, v := range pm.Matches {
 		p.Matches[k] = v

vendor/sigs.k8s.io/kustomize/kyaml/yaml/merge2/merge2.go

@@ -1,7 +1,7 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-// Package merge contains libraries for merging fields from one RNode to another
+// Package merge2 contains libraries for merging fields from one RNode to another
 // RNode
 package merge2
 
@@ -20,7 +20,7 @@ func Merge(src, dest *yaml.RNode, mergeOptions yaml.MergeOptions) (*yaml.RNode,
 	}.Walk()
 }
 
-// Merge parses the arguments, and merges fields from srcStr into destStr.
+// MergeStrings parses the arguments, and merges fields from srcStr into destStr.
 func MergeStrings(srcStr, destStr string, infer bool, mergeOptions yaml.MergeOptions) (string, error) {
 	src, err := yaml.Parse(srcStr)
 	if err != nil {
@@ -64,6 +64,12 @@ func (m Merger) VisitMap(nodes walk.Sources, s *openapi.ResourceSchema) (*yaml.R
 			return walk.ClearNode, nil
 		}
 
+		// If Origin is missing, preserve explicitly set null in Dest ("null", "~", etc)
+		if nodes.Origin().IsNil() && !nodes.Dest().IsNil() && len(nodes.Dest().YNode().Value) > 0 {
+			// Return a new node so that it won't have a "!!null" tag and therefore won't be cleared.
+			return yaml.NewScalarRNode(nodes.Dest().YNode().Value), nil
+		}
+
 		return nodes.Origin(), nil
 	}
 	if nodes.Origin().IsTaggedNull() {

vendor/sigs.k8s.io/kustomize/kyaml/yaml/rnode.go

@@ -6,8 +6,8 @@ package yaml
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"log"
+	"os"
 	"regexp"
 	"strconv"
 	"strings"
@@ -53,7 +53,7 @@ func Parse(value string) (*RNode, error) {
 // ReadFile parses a single Resource from a yaml file.
 // To parse multiple resources, consider a kio.ByteReader
 func ReadFile(path string) (*RNode, error) {
-	b, err := ioutil.ReadFile(path)
+	b, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -66,7 +66,7 @@ func WriteFile(node *RNode, path string) error {
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, []byte(out), 0600)
+	return errors.WrapPrefixf(os.WriteFile(path, []byte(out), 0600), "writing RNode to file")
 }
 
 // UpdateFile reads the file at path, applies the filter to it, and write the result back.
@@ -242,11 +242,7 @@ func (rn *RNode) IsTaggedNull() bool {
 // IsNilOrEmpty is true if the node is nil,
 // has no YNode, or has YNode that appears empty.
 func (rn *RNode) IsNilOrEmpty() bool {
-	return rn.IsNil() ||
-		IsYNodeTaggedNull(rn.YNode()) ||
-		IsYNodeEmptyMap(rn.YNode()) ||
-		IsYNodeEmptySeq(rn.YNode()) ||
-		IsYNodeZero(rn.YNode())
+	return rn.IsNil() || IsYNodeNilOrEmpty(rn.YNode())
 }
 
 // IsStringValue is true if the RNode is not nil and is scalar string node
@@ -420,12 +416,11 @@ func (rn *RNode) SetApiVersion(av string) {
 // given field, so this function cannot be used to make distinctions
 // between these cases.
 func (rn *RNode) getMapFieldValue(field string) *yaml.Node {
-	for i := 0; i < len(rn.Content()); i = IncrementFieldIndex(i) {
-		if rn.Content()[i].Value == field {
-			return rn.Content()[i+1]
-		}
-	}
-	return nil
+	var result *yaml.Node
+	visitMappingNodeFields(rn.Content(), func(key, value *yaml.Node) {
+		result = value
+	}, field)
+	return result
 }
 
 // GetName returns the name, or empty string if
@@ -440,31 +435,33 @@ func (rn *RNode) getMetaStringField(fName string) string {
 	if md == nil {
 		return ""
 	}
-	f := md.Field(fName)
-	if f.IsNilOrEmpty() {
-		return ""
-	}
-	return GetValue(f.Value)
+	var result string
+	visitMappingNodeFields(md.Content, func(key, value *yaml.Node) {
+		if !IsYNodeNilOrEmpty(value) {
+			result = value.Value
+		}
+	}, fName)
+	return result
 }
 
-// getMetaData returns the RNode holding the value of the metadata field.
+// getMetaData returns the *yaml.Node of the metadata field.
 // Return nil if field not found (no error).
-func (rn *RNode) getMetaData() *RNode {
+func (rn *RNode) getMetaData() *yaml.Node {
 	if IsMissingOrNull(rn) {
 		return nil
 	}
-	var n *RNode
+	content := rn.Content()
 	if rn.YNode().Kind == DocumentNode {
 		// get the content if this is the document node
-		n = NewRNode(rn.Content()[0])
-	} else {
-		n = rn
+		content = content[0].Content
 	}
-	mf := n.Field(MetadataField)
-	if mf.IsNilOrEmpty() {
-		return nil
-	}
-	return mf.Value
+	var mf *yaml.Node
+	visitMappingNodeFields(content, func(key, value *yaml.Node) {
+		if !IsYNodeNilOrEmpty(value) {
+			mf = value
+		}
+	}, MetadataField)
+	return mf
 }
 
 // SetName sets the metadata name field.
@@ -496,14 +493,14 @@ func (rn *RNode) SetNamespace(ns string) error {
 }
 
 // GetAnnotations gets the metadata annotations field.
-// If the field is missing, returns an empty map.
+// If the annotations field is missing, returns an empty map.
 // Use another method to check for missing metadata.
-func (rn *RNode) GetAnnotations() map[string]string {
-	meta := rn.getMetaData()
-	if meta == nil {
-		return make(map[string]string)
-	}
-	return rn.getMapFromMeta(meta, AnnotationsField)
+// If specific annotations are provided, then the map is
+// restricted to only those entries with keys that match
+// one of the specific annotations. If no annotations are
+// provided, then the map will contain all entries.
+func (rn *RNode) GetAnnotations(annotations ...string) map[string]string {
+	return rn.getMapFromMeta(AnnotationsField, annotations...)
 }
 
 // SetAnnotations tries to set the metadata annotations field.
@@ -512,24 +509,45 @@ func (rn *RNode) SetAnnotations(m map[string]string) error {
 }
 
 // GetLabels gets the metadata labels field.
-// If the field is missing, returns an empty map.
+// If the labels field is missing, returns an empty map.
 // Use another method to check for missing metadata.
-func (rn *RNode) GetLabels() map[string]string {
+// If specific labels are provided, then the map is
+// restricted to only those entries with keys that match
+// one of the specific labels. If no labels are
+// provided, then the map will contain all entries.
+func (rn *RNode) GetLabels(labels ...string) map[string]string {
+	return rn.getMapFromMeta(LabelsField, labels...)
+}
+
+// getMapFromMeta returns a map, sometimes empty, from the fName
+// field in the node's metadata field.
+// If specific fields are provided, then the map is
+// restricted to only those entries with keys that match
+// one of the specific fields. If no fields are
+// provided, then the map will contain all entries.
+func (rn *RNode) getMapFromMeta(fName string, fields ...string) map[string]string {
 	meta := rn.getMetaData()
 	if meta == nil {
 		return make(map[string]string)
 	}
-	return rn.getMapFromMeta(meta, LabelsField)
-}
 
-// getMapFromMeta returns map, sometimes empty, from metadata.
-func (rn *RNode) getMapFromMeta(meta *RNode, fName string) map[string]string {
-	result := make(map[string]string)
-	if f := meta.Field(fName); !f.IsNilOrEmpty() {
-		_ = f.Value.VisitFields(func(node *MapNode) error {
-			result[GetValue(node.Key)] = GetValue(node.Value)
-			return nil
-		})
+	var result map[string]string
+
+	visitMappingNodeFields(meta.Content, func(_, fNameValue *yaml.Node) {
+		// fName is found in metadata; create the map from its content
+		expectedSize := len(fields)
+		if expectedSize == 0 {
+			expectedSize = len(fNameValue.Content) / 2 //nolint: gomnd
+		}
+		result = make(map[string]string, expectedSize)
+
+		visitMappingNodeFields(fNameValue.Content, func(key, value *yaml.Node) {
+			result[key.Value] = value.Value
+		}, fields...)
+	}, fName)
+
+	if result == nil {
+		return make(map[string]string)
 	}
 	return result
 }
@@ -696,9 +714,9 @@ func (rn *RNode) Fields() ([]string, error) {
 		return nil, errors.Wrap(err)
 	}
 	var fields []string
-	for i := 0; i < len(rn.Content()); i += 2 {
-		fields = append(fields, rn.Content()[i].Value)
-	}
+	visitMappingNodeFields(rn.Content(), func(key, value *yaml.Node) {
+		fields = append(fields, key.Value)
+	})
 	return fields, nil
 }
 
@@ -709,13 +727,12 @@ func (rn *RNode) FieldRNodes() ([]*RNode, error) {
 		return nil, errors.Wrap(err)
 	}
 	var fields []*RNode
-	for i := 0; i < len(rn.Content()); i += 2 {
-		yNode := rn.Content()[i]
+	visitMappingNodeFields(rn.Content(), func(key, value *yaml.Node) {
 		// for each key node in the input mapping node contents create equivalent rNode
 		rNode := &RNode{}
-		rNode.SetYNode(yNode)
+		rNode.SetYNode(key)
 		fields = append(fields, rNode)
-	}
+	})
 	return fields, nil
 }
 
@@ -725,13 +742,11 @@ func (rn *RNode) Field(field string) *MapNode {
 	if rn.YNode().Kind != yaml.MappingNode {
 		return nil
 	}
-	for i := 0; i < len(rn.Content()); i = IncrementFieldIndex(i) {
-		isMatchingField := rn.Content()[i].Value == field
-		if isMatchingField {
-			return &MapNode{Key: NewRNode(rn.Content()[i]), Value: NewRNode(rn.Content()[i+1])}
-		}
-	}
-	return nil
+	var result *MapNode
+	visitMappingNodeFields(rn.Content(), func(key, value *yaml.Node) {
+		result = &MapNode{Key: NewRNode(key), Value: NewRNode(value)}
+	}, field)
+	return result
 }
 
 // VisitFields calls fn for each field in the RNode.
@@ -752,6 +767,59 @@ func (rn *RNode) VisitFields(fn func(node *MapNode) error) error {
 	return nil
 }
 
+// visitMappingNodeFields calls fn for fields in the content, in content order.
+// The caller is responsible to ensure the node is a mapping node. If fieldNames
+// are specified, then fn is called only for the fields that match the given
+// fieldNames.
+func visitMappingNodeFields(content []*yaml.Node, fn func(key, value *yaml.Node), fieldNames ...string) {
+	switch len(fieldNames) {
+	case 0: // visit all fields
+		visitFieldsWhileTrue(content, func(key, value *yaml.Node, _ int) bool {
+			fn(key, value)
+			return true
+		})
+	case 1: // visit single field
+		visitFieldsWhileTrue(content, func(key, value *yaml.Node, _ int) bool {
+			if key == nil {
+				return true
+			}
+			if fieldNames[0] == key.Value {
+				fn(key, value)
+				return false
+			}
+			return true
+		})
+	default: // visit specified fields
+		fieldsStillToVisit := make(map[string]bool, len(fieldNames))
+		for _, fieldName := range fieldNames {
+			fieldsStillToVisit[fieldName] = true
+		}
+		visitFieldsWhileTrue(content, func(key, value *yaml.Node, _ int) bool {
+			if key == nil {
+				return true
+			}
+			if fieldsStillToVisit[key.Value] {
+				fn(key, value)
+				delete(fieldsStillToVisit, key.Value)
+			}
+			return len(fieldsStillToVisit) > 0
+		})
+	}
+}
+
+// visitFieldsWhileTrue calls fn for the fields in content, in content order,
+// until either fn returns false or all fields have been visited. The caller
+// should ensure that content is from a mapping node, or fits the same expected
+// pattern (consecutive key/value entries in the slice).
+func visitFieldsWhileTrue(content []*yaml.Node, fn func(key, value *yaml.Node, keyIndex int) bool) {
+	for i := 0; i < len(content); i += 2 {
+		continueVisiting := fn(content[i], content[i+1], i)
+		if !continueVisiting {
+			return
+		}
+	}
+}
+
 // Elements returns the list of elements in the RNode.
 // Returns an error for non-SequenceNodes.
 func (rn *RNode) Elements() ([]*RNode, error) {
@@ -937,7 +1005,11 @@ func deAnchor(yn *yaml.Node) (res *yaml.Node, err error) {
 	case yaml.ScalarNode:
 		return yn, nil
 	case yaml.AliasNode:
-		return deAnchor(yn.Alias)
+		result, err := deAnchor(yn.Alias)
+		if err != nil {
+			return nil, err
+		}
+		return CopyYNode(result), nil
 	case yaml.MappingNode:
 		toMerge, err := removeMergeTags(yn)
 		if err != nil {
@@ -1003,17 +1075,19 @@ func findMergeValues(yn *yaml.Node) ([]*yaml.Node, error) {
 // it fails.
 func getMergeTagValue(yn *yaml.Node) (*yaml.Node, error) {
 	var result *yaml.Node
-	for i := 0; i < len(yn.Content); i += 2 {
-		key := yn.Content[i]
-		value := yn.Content[i+1]
+	var err error
+	visitFieldsWhileTrue(yn.Content, func(key, value *yaml.Node, _ int) bool {
 		if isMerge(key) {
 			if result != nil {
-				return nil, fmt.Errorf("duplicate merge key")
+				err = fmt.Errorf("duplicate merge key")
+				result = nil
+				return false
 			}
 			result = value
 		}
-	}
-	return result, nil
+		return true
+	})
+	return result, err
 }
 
 // removeMergeTags removes all merge tags and returns a ordered list of yaml

vendor/sigs.k8s.io/kustomize/kyaml/yaml/types.go

@@ -39,11 +39,20 @@ func IsYNodeEmptyMap(n *yaml.Node) bool {
 	return n != nil && n.Kind == yaml.MappingNode && len(n.Content) == 0
 }
 
-// IsYNodeEmptyMap is true if the Node is a non-nil empty sequence.
+// IsYNodeEmptySeq is true if the Node is a non-nil empty sequence.
 func IsYNodeEmptySeq(n *yaml.Node) bool {
 	return n != nil && n.Kind == yaml.SequenceNode && len(n.Content) == 0
 }
 
+// IsYNodeNilOrEmpty is true if the Node is nil or appears empty.
+func IsYNodeNilOrEmpty(n *yaml.Node) bool {
+	return n == nil ||
+		IsYNodeTaggedNull(n) ||
+		IsYNodeEmptyMap(n) ||
+		IsYNodeEmptySeq(n) ||
+		IsYNodeZero(n)
+}
+
 // IsYNodeEmptyDoc is true if the node is a Document with no content.
 // E.g.: "---\n---"
 func IsYNodeEmptyDoc(n *yaml.Node) bool {
@@ -238,3 +247,53 @@ type MergeOptions struct {
 	// source list to destination or append.
 	ListIncreaseDirection MergeOptionsListIncreaseDirection
 }
+
+// Since ObjectMeta and TypeMeta are stable, we manually create DeepCopy funcs for ResourceMeta and ObjectMeta.
+// For TypeMeta and NameMeta no DeepCopy funcs are required, as they only contain basic types.
+
+// DeepCopyInto copies the receiver, writing into out. in must be non-nil.
+func (in *ObjectMeta) DeepCopyInto(out *ObjectMeta) {
+	*out = *in
+	out.NameMeta = in.NameMeta
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy copies the receiver, creating a new ObjectMeta.
+func (in *ObjectMeta) DeepCopy() *ObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto copies the receiver, writing into out. in must be non-nil.
+func (in *ResourceMeta) DeepCopyInto(out *ResourceMeta) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+}
+
+// DeepCopy copies the receiver, creating a new ResourceMeta.
+func (in *ResourceMeta) DeepCopy() *ResourceMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceMeta)
+	in.DeepCopyInto(out)
+	return out
+}

vendor/sigs.k8s.io/kustomize/kyaml/yaml/walk/associative_sequence.go

@@ -217,7 +217,7 @@ func (l *Walker) setAssociativeSequenceElements(valuesList [][]string, keys []st
 
 		// Add the val to the sequence. val will replace the item in the sequence if
 		// there is an item that matches all key-value pairs. Otherwise val will be appended
-		// the the sequence.
+		// the sequence.
 		_, err = itemsToBeAdded.Pipe(yaml.ElementSetter{
 			Element: val.YNode(),
 			Keys:    validKeys,