working commit

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/doc.go

@@ -0,0 +1,10 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package builtinconfig provides legacy methods for
+// configuring builtin plugins from a common config file.
+// As a user, its best to configure plugins individually
+// with plugin config files specified in the `transformers:`
+// or `generators:` field, than to use this legacy
+// configuration technique.
+package builtinconfig

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/loaddefaultconfig.go

@@ -0,0 +1,42 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/yaml"
+)
+
+// loadDefaultConfig returns a TranformerConfig
+// object from a list of files.
+func loadDefaultConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	result := &TransformerConfig{}
+	for _, path := range paths {
+		data, err := ldr.Load(path)
+		if err != nil {
+			return nil, err
+		}
+		t, err := makeTransformerConfigFromBytes(data)
+		if err != nil {
+			return nil, err
+		}
+		result, err = result.Merge(t)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+// makeTransformerConfigFromBytes returns a TransformerConfig object from bytes
+func makeTransformerConfigFromBytes(data []byte) (*TransformerConfig, error) {
+	var t TransformerConfig
+	err := yaml.UnmarshalStrict(data, &t)
+	if err != nil {
+		return nil, err
+	}
+	t.sortFields()
+	return &t, nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/namebackreferences.go

@@ -0,0 +1,112 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+// NameBackReferences is an association between a gvk.GVK (a ReferralTarget)
+// and a list of Referrers that could refer to it.
+//
+// It is used to handle name changes, and can be thought of as a
+// a contact list.  If you change your own contact info (name,
+// phone number, etc.), you must tell your contacts or they won't
+// know about the change.
+//
+// For example, ConfigMaps can be used by Pods and everything that
+// contains a Pod; Deployment, Job, StatefulSet, etc.
+// The ConfigMap is the ReferralTarget, the others are Referrers.
+//
+// If the name of a ConfigMap instance changed from 'alice' to 'bob',
+// one must
+//  - visit all objects that could refer to the ConfigMap (the Referrers)
+//  - see if they mention 'alice',
+//  - if so, change the Referrer's name reference to 'bob'.
+//
+// The NameBackReferences instance to aid in this could look like
+//   {
+//     kind: ConfigMap
+//     version: v1
+//     fieldSpecs:
+//     - kind: Pod
+//       version: v1
+//       path: spec/volumes/configMap/name
+//     - kind: Deployment
+//       path: spec/template/spec/volumes/configMap/name
+//     - kind: Job
+//       path: spec/template/spec/volumes/configMap/name
+//       (etc.)
+//   }
+type NameBackReferences struct {
+	resid.Gvk `json:",inline,omitempty" yaml:",inline,omitempty"`
+	// TODO: rename json 'fieldSpecs' to 'referrers' for clarity.
+	// This will, however, break anyone using a custom config.
+	Referrers types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	// Note: If any new pointer based members are added, DeepCopy needs to be updated
+}
+
+func (n NameBackReferences) String() string {
+	var r []string
+	for _, f := range n.Referrers {
+		r = append(r, f.String())
+	}
+	return n.Gvk.String() + ":  (\n" +
+		strings.Join(r, "\n") + "\n)"
+}
+
+type nbrSlice []NameBackReferences
+
+func (s nbrSlice) Len() int      { return len(s) }
+func (s nbrSlice) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+func (s nbrSlice) Less(i, j int) bool {
+	return s[i].Gvk.IsLessThan(s[j].Gvk)
+}
+
+// DeepCopy returns a new copy of nbrSlice
+func (s nbrSlice) DeepCopy() nbrSlice {
+	ret := make(nbrSlice, len(s))
+	copy(ret, s)
+	for i, slice := range ret {
+		ret[i].Referrers = slice.Referrers.DeepCopy()
+	}
+
+	return ret
+}
+
+func (s nbrSlice) mergeAll(o nbrSlice) (result nbrSlice, err error) {
+	result = s
+	for _, r := range o {
+		result, err = result.mergeOne(r)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+func (s nbrSlice) mergeOne(other NameBackReferences) (nbrSlice, error) {
+	var result nbrSlice
+	var err error
+	found := false
+	for _, c := range s {
+		if c.Gvk.Equals(other.Gvk) {
+			c.Referrers, err = c.Referrers.MergeAll(other.Referrers)
+			if err != nil {
+				return nil, err
+			}
+			found = true
+		}
+		result = append(result, c)
+	}
+
+	if !found {
+		result = append(result, other)
+	}
+	return result, nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig/transformerconfig.go

@@ -0,0 +1,202 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinconfig
+
+import (
+	"log"
+	"sort"
+	"sync"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/konfig/builtinpluginconsts"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+)
+
+// TransformerConfig holds the data needed to perform transformations.
+//
+//nolint:tagalign
+type TransformerConfig struct {
+	// if any fields are added, update the DeepCopy implementation
+	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
+	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
+	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+	CommonLabels      types.FsSlice `json:"commonLabels,omitempty" yaml:"commonLabels,omitempty"`
+	Labels            types.FsSlice `json:"labels,omitempty" yaml:"labels,omitempty"`
+	TemplateLabels    types.FsSlice `json:"templateLabels,omitempty" yaml:"templateLabels,omitempty"`
+	CommonAnnotations types.FsSlice `json:"commonAnnotations,omitempty" yaml:"commonAnnotations,omitempty"`
+	NameReference     nbrSlice      `json:"nameReference,omitempty" yaml:"nameReference,omitempty"`
+	VarReference      types.FsSlice `json:"varReference,omitempty" yaml:"varReference,omitempty"`
+	Images            types.FsSlice `json:"images,omitempty" yaml:"images,omitempty"`
+	Replicas          types.FsSlice `json:"replicas,omitempty" yaml:"replicas,omitempty"`
+}
+
+// MakeEmptyConfig returns an empty TransformerConfig object
+func MakeEmptyConfig() *TransformerConfig {
+	return &TransformerConfig{}
+}
+
+// DeepCopy returns a new copy of TransformerConfig
+func (t *TransformerConfig) DeepCopy() *TransformerConfig {
+	return &TransformerConfig{
+		NamePrefix:        t.NamePrefix.DeepCopy(),
+		NameSuffix:        t.NameSuffix.DeepCopy(),
+		NameSpace:         t.NameSpace.DeepCopy(),
+		CommonLabels:      t.CommonLabels.DeepCopy(),
+		Labels:            t.Labels.DeepCopy(),
+		TemplateLabels:    t.TemplateLabels.DeepCopy(),
+		CommonAnnotations: t.CommonAnnotations.DeepCopy(),
+		NameReference:     t.NameReference.DeepCopy(),
+		VarReference:      t.VarReference.DeepCopy(),
+		Images:            t.Images.DeepCopy(),
+		Replicas:          t.Replicas.DeepCopy(),
+	}
+}
+
+// the default transformer config is initialized by MakeDefaultConfig,
+// and must only be accessed via that function.
+var (
+	initDefaultConfig sync.Once          //nolint:gochecknoglobals
+	defaultConfig     *TransformerConfig //nolint:gochecknoglobals
+)
+
+// MakeDefaultConfig returns a default TransformerConfig.
+func MakeDefaultConfig() *TransformerConfig {
+	// parsing is expensive when having a large tree with many kustomization modules, so only do it once
+	initDefaultConfig.Do(func() {
+		var err error
+		defaultConfig, err = makeTransformerConfigFromBytes(
+			builtinpluginconsts.GetDefaultFieldSpecs())
+		if err != nil {
+			log.Fatalf("Unable to make default transformconfig: %v", err)
+		}
+	})
+
+	// return a copy to avoid any mutations to protect the reference copy
+	return defaultConfig.DeepCopy()
+}
+
+// MakeTransformerConfig returns a merger of custom config,
+// if any, with default config.
+func MakeTransformerConfig(
+	ldr ifc.Loader, paths []string) (*TransformerConfig, error) {
+	t1 := MakeDefaultConfig()
+	if len(paths) == 0 {
+		return t1, nil
+	}
+	t2, err := loadDefaultConfig(ldr, paths)
+	if err != nil {
+		return nil, err
+	}
+	return t1.Merge(t2)
+}
+
+// sortFields provides determinism in logging, tests, etc.
+func (t *TransformerConfig) sortFields() {
+	sort.Sort(t.NamePrefix)
+	sort.Sort(t.NameSuffix)
+	sort.Sort(t.NameSpace)
+	sort.Sort(t.CommonLabels)
+	sort.Sort(t.Labels)
+	sort.Sort(t.TemplateLabels)
+	sort.Sort(t.CommonAnnotations)
+	sort.Sort(t.NameReference)
+	sort.Sort(t.VarReference)
+	sort.Sort(t.Images)
+	sort.Sort(t.Replicas)
+}
+
+// AddPrefixFieldSpec adds a FieldSpec to NamePrefix
+func (t *TransformerConfig) AddPrefixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NamePrefix, err = t.NamePrefix.MergeOne(fs)
+	return err
+}
+
+// AddSuffixFieldSpec adds a FieldSpec to NameSuffix
+func (t *TransformerConfig) AddSuffixFieldSpec(fs types.FieldSpec) (err error) {
+	t.NameSuffix, err = t.NameSuffix.MergeOne(fs)
+	return err
+}
+
+// AddCommonLabelsFieldSpec adds a FieldSpec to CommonLabels
+func (t *TransformerConfig) AddCommonLabelsFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonLabels, err = t.CommonLabels.MergeOne(fs)
+	return err
+}
+
+// AddLabelsFieldSpec adds a FieldSpec to Labels
+func (t *TransformerConfig) AddLabelsFieldSpec(fs types.FieldSpec) (err error) {
+	t.Labels, err = t.Labels.MergeOne(fs)
+	return err //nolint:wrapcheck
+}
+
+// AddAnnotationFieldSpec adds a FieldSpec to CommonAnnotations
+func (t *TransformerConfig) AddAnnotationFieldSpec(fs types.FieldSpec) (err error) {
+	t.CommonAnnotations, err = t.CommonAnnotations.MergeOne(fs)
+	return err
+}
+
+// AddNamereferenceFieldSpec adds a NameBackReferences to NameReference
+func (t *TransformerConfig) AddNamereferenceFieldSpec(
+	nbrs NameBackReferences) (err error) {
+	t.NameReference, err = t.NameReference.mergeOne(nbrs)
+	return err
+}
+
+// Merge merges two TransformerConfigs objects into
+// a new TransformerConfig object
+func (t *TransformerConfig) Merge(input *TransformerConfig) (
+	merged *TransformerConfig, err error) {
+	if input == nil {
+		return t, nil
+	}
+	merged = &TransformerConfig{}
+	merged.NamePrefix, err = t.NamePrefix.MergeAll(input.NamePrefix)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge NamePrefix fieldSpec")
+	}
+	merged.NameSuffix, err = t.NameSuffix.MergeAll(input.NameSuffix)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSuffix fieldSpec")
+	}
+	merged.NameSpace, err = t.NameSpace.MergeAll(input.NameSpace)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge NameSpace fieldSpec")
+	}
+	merged.CommonAnnotations, err = t.CommonAnnotations.MergeAll(
+		input.CommonAnnotations)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonAnnotations fieldSpec")
+	}
+	merged.CommonLabels, err = t.CommonLabels.MergeAll(input.CommonLabels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge CommonLabels fieldSpec")
+	}
+	merged.Labels, err = t.Labels.MergeAll(input.Labels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge Labels fieldSpec")
+	}
+	merged.TemplateLabels, err = t.TemplateLabels.MergeAll(input.TemplateLabels)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge TemplateLabels fieldSpec")
+	}
+	merged.VarReference, err = t.VarReference.MergeAll(input.VarReference)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge VarReference fieldSpec")
+	}
+	merged.NameReference, err = t.NameReference.mergeAll(input.NameReference)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge NameReference fieldSpec")
+	}
+	merged.Images, err = t.Images.MergeAll(input.Images)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge Images fieldSpec")
+	}
+	merged.Replicas, err = t.Replicas.MergeAll(input.Replicas)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "failed to merge Replicas fieldSpec")
+	}
+	merged.sortFields()
+	return merged, nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtinplugintype_string.go

@@ -0,0 +1,41 @@
+// Code generated by "stringer -type=BuiltinPluginType"; DO NOT EDIT.
+
+package builtinhelpers
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Unknown-0]
+	_ = x[AnnotationsTransformer-1]
+	_ = x[ConfigMapGenerator-2]
+	_ = x[IAMPolicyGenerator-3]
+	_ = x[HashTransformer-4]
+	_ = x[ImageTagTransformer-5]
+	_ = x[LabelTransformer-6]
+	_ = x[NamespaceTransformer-7]
+	_ = x[PatchJson6902Transformer-8]
+	_ = x[PatchStrategicMergeTransformer-9]
+	_ = x[PatchTransformer-10]
+	_ = x[PrefixSuffixTransformer-11]
+	_ = x[PrefixTransformer-12]
+	_ = x[SuffixTransformer-13]
+	_ = x[ReplicaCountTransformer-14]
+	_ = x[SecretGenerator-15]
+	_ = x[ValueAddTransformer-16]
+	_ = x[HelmChartInflationGenerator-17]
+	_ = x[ReplacementTransformer-18]
+}
+
+const _BuiltinPluginType_name = "UnknownAnnotationsTransformerConfigMapGeneratorIAMPolicyGeneratorHashTransformerImageTagTransformerLabelTransformerNamespaceTransformerPatchJson6902TransformerPatchStrategicMergeTransformerPatchTransformerPrefixSuffixTransformerPrefixTransformerSuffixTransformerReplicaCountTransformerSecretGeneratorValueAddTransformerHelmChartInflationGeneratorReplacementTransformer"
+
+var _BuiltinPluginType_index = [...]uint16{0, 7, 29, 47, 65, 80, 99, 115, 135, 159, 189, 205, 228, 245, 262, 285, 300, 319, 346, 368}
+
+func (i BuiltinPluginType) String() string {
+	if i < 0 || i >= BuiltinPluginType(len(_BuiltinPluginType_index)-1) {
+		return "BuiltinPluginType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _BuiltinPluginType_name[_BuiltinPluginType_index[i]:_BuiltinPluginType_index[i+1]]
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers/builtins.go

@@ -0,0 +1,115 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinhelpers
+
+import (
+	"sigs.k8s.io/kustomize/api/internal/builtins"
+	"sigs.k8s.io/kustomize/api/resmap"
+)
+
+//go:generate stringer -type=BuiltinPluginType
+type BuiltinPluginType int
+
+const (
+	Unknown BuiltinPluginType = iota
+	AnnotationsTransformer
+	ConfigMapGenerator
+	IAMPolicyGenerator
+	HashTransformer
+	ImageTagTransformer
+	LabelTransformer
+	NamespaceTransformer
+	PatchJson6902Transformer
+	PatchStrategicMergeTransformer
+	PatchTransformer
+	PrefixSuffixTransformer
+	PrefixTransformer
+	SuffixTransformer
+	ReplicaCountTransformer
+	SecretGenerator
+	ValueAddTransformer
+	HelmChartInflationGenerator
+	ReplacementTransformer
+)
+
+var stringToBuiltinPluginTypeMap map[string]BuiltinPluginType
+
+func init() { //nolint:gochecknoinits
+	stringToBuiltinPluginTypeMap = makeStringToBuiltinPluginTypeMap()
+}
+
+func makeStringToBuiltinPluginTypeMap() (result map[string]BuiltinPluginType) {
+	result = make(map[string]BuiltinPluginType, 23)
+	for k := range GeneratorFactories {
+		result[k.String()] = k
+	}
+	for k := range TransformerFactories {
+		result[k.String()] = k
+	}
+	return
+}
+
+func GetBuiltinPluginType(n string) BuiltinPluginType {
+	result, ok := stringToBuiltinPluginTypeMap[n]
+	if ok {
+		return result
+	}
+	return Unknown
+}
+
+var GeneratorFactories = map[BuiltinPluginType]func() resmap.GeneratorPlugin{
+	ConfigMapGenerator:          builtins.NewConfigMapGeneratorPlugin,
+	IAMPolicyGenerator:          builtins.NewIAMPolicyGeneratorPlugin,
+	SecretGenerator:             builtins.NewSecretGeneratorPlugin,
+	HelmChartInflationGenerator: builtins.NewHelmChartInflationGeneratorPlugin,
+}
+
+type MultiTransformer struct {
+	transformers []resmap.TransformerPlugin
+}
+
+func (t *MultiTransformer) Transform(m resmap.ResMap) error {
+	for _, transformer := range t.transformers {
+		if err := transformer.Transform(m); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (t *MultiTransformer) Config(h *resmap.PluginHelpers, b []byte) error {
+	for _, transformer := range t.transformers {
+		if err := transformer.Config(h, b); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func NewMultiTransformer() resmap.TransformerPlugin {
+	return &MultiTransformer{[]resmap.TransformerPlugin{
+		builtins.NewPrefixTransformerPlugin(),
+		builtins.NewSuffixTransformerPlugin(),
+	}}
+}
+
+var TransformerFactories = map[BuiltinPluginType]func() resmap.TransformerPlugin{
+	AnnotationsTransformer:         builtins.NewAnnotationsTransformerPlugin,
+	HashTransformer:                builtins.NewHashTransformerPlugin,
+	ImageTagTransformer:            builtins.NewImageTagTransformerPlugin,
+	LabelTransformer:               builtins.NewLabelTransformerPlugin,
+	NamespaceTransformer:           builtins.NewNamespaceTransformerPlugin,
+	PatchJson6902Transformer:       builtins.NewPatchJson6902TransformerPlugin,
+	PatchStrategicMergeTransformer: builtins.NewPatchStrategicMergeTransformerPlugin,
+	PatchTransformer:               builtins.NewPatchTransformerPlugin,
+	PrefixSuffixTransformer:        NewMultiTransformer,
+	PrefixTransformer:              builtins.NewPrefixTransformerPlugin,
+	SuffixTransformer:              builtins.NewSuffixTransformerPlugin,
+	ReplacementTransformer:         builtins.NewReplacementTransformerPlugin,
+	ReplicaCountTransformer:        builtins.NewReplicaCountTransformerPlugin,
+	ValueAddTransformer:            builtins.NewValueAddTransformerPlugin,
+	// Do not wired SortOrderTransformer as a builtin plugin.
+	// We only want it to be available in the top-level kustomization.
+	// See: https://github.com/kubernetes-sigs/kustomize/issues/3913
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/execplugin/execplugin.go

@@ -0,0 +1,206 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	tmpConfigFilePrefix = "kust-plugin-config-"
+	maxArgStringLength  = 131071
+)
+
+// ExecPlugin record the name and args of an executable
+// It triggers the executable generator and transformer
+type ExecPlugin struct {
+	// absolute path of the executable
+	path string
+
+	// Optional command line arguments to the executable
+	// pulled from specially named fields in cfg.
+	// This is for executables that don't want to parse YAML.
+	args []string
+
+	// Plugin configuration data.
+	cfg []byte
+
+	// PluginHelpers
+	h *resmap.PluginHelpers
+}
+
+func NewExecPlugin(p string) *ExecPlugin {
+	return &ExecPlugin{path: p}
+}
+
+func (p *ExecPlugin) ErrIfNotExecutable() error {
+	f, err := os.Stat(p.path)
+	if err != nil {
+		return err
+	}
+	// In Windows, it is not possible to determine whether a
+	// file is executable through file mode.
+	// TODO: provide for setting the executable FileMode bit on Windows
+	// The (fs *fileStat) Mode() (m FileMode) {} function in
+	// https://golang.org/src/os/types_windows.go
+	// lacks the ability to set the FileMode executable bit in response
+	// to file data on Windows.
+	if f.Mode()&0111 == 0000 && runtime.GOOS != "windows" {
+		return fmt.Errorf("unexecutable plugin at: %s", p.path)
+	}
+	return nil
+}
+
+func (p *ExecPlugin) Path() string {
+	return p.path
+}
+
+func (p *ExecPlugin) Args() []string {
+	return p.args
+}
+
+func (p *ExecPlugin) Cfg() []byte {
+	return p.cfg
+}
+
+func (p *ExecPlugin) Config(h *resmap.PluginHelpers, config []byte) error {
+	p.h = h
+	p.cfg = config
+	return p.processOptionalArgsFields()
+}
+
+type argsConfig struct {
+	ArgsOneLiner string `json:"argsOneLiner,omitempty" yaml:"argsOneLiner,omitempty"`
+	ArgsFromFile string `json:"argsFromFile,omitempty" yaml:"argsFromFile,omitempty"`
+}
+
+func (p *ExecPlugin) processOptionalArgsFields() error {
+	var c argsConfig
+	err := yaml.Unmarshal(p.cfg, &c)
+	if err != nil {
+		return err
+	}
+	if c.ArgsOneLiner != "" {
+		argsTolenSlice, err := ShlexSplit(c.ArgsOneLiner)
+		if err != nil {
+			return fmt.Errorf("failed to parse argsOneLiner: %w", err)
+		}
+		p.args = argsTolenSlice
+	}
+	if c.ArgsFromFile != "" {
+		content, err := p.h.Loader().Load(c.ArgsFromFile)
+		if err != nil {
+			return err
+		}
+		for _, x := range strings.Split(string(content), "\n") {
+			x := strings.TrimLeft(x, " ")
+			if x != "" {
+				p.args = append(p.args, x)
+			}
+		}
+	}
+	return nil
+}
+
+func (p *ExecPlugin) Generate() (resmap.ResMap, error) {
+	output, err := p.invokePlugin(nil)
+	if err != nil {
+		return nil, err
+	}
+	rm, err := p.h.ResmapFactory().NewResMapFromBytes(output)
+	if err != nil {
+		return nil, err
+	}
+	return utils.UpdateResourceOptions(rm)
+}
+
+func (p *ExecPlugin) Transform(rm resmap.ResMap) error {
+	// add ResIds as annotations to all objects so that we can add them back
+	inputRM, err := utils.GetResMapWithIDAnnotation(rm)
+	if err != nil {
+		return err
+	}
+
+	// encode the ResMap so it can be fed to the plugin
+	resources, err := inputRM.AsYaml()
+	if err != nil {
+		return err
+	}
+
+	// invoke the plugin with resources as the input
+	output, err := p.invokePlugin(resources)
+	if err != nil {
+		return fmt.Errorf("%v %s", err, string(output))
+	}
+
+	// update the original ResMap based on the output
+	return utils.UpdateResMapValues(p.path, p.h, output, rm)
+}
+
+// invokePlugin writes plugin config to a temp file, then
+// passes the full temp file path as the first arg to a process
+// running the plugin binary.  Process output is returned.
+func (p *ExecPlugin) invokePlugin(input []byte) ([]byte, error) {
+	f, err := os.CreateTemp("", tmpConfigFilePrefix)
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "creating tmp plugin config file")
+	}
+	_, err = f.Write(p.cfg)
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "writing plugin config to %s", f.Name())
+	}
+	err = f.Close()
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "closing plugin config file %s", f.Name())
+	}
+	cmd := exec.Command(
+		p.path, append([]string{f.Name()}, p.args...)...)
+	cmd.Env = p.getEnv()
+	cmd.Stdin = bytes.NewReader(input)
+	var stdErr bytes.Buffer
+	cmd.Stderr = &stdErr
+	if _, err := os.Stat(p.h.Loader().Root()); err == nil {
+		cmd.Dir = p.h.Loader().Root()
+	}
+	result, err := cmd.Output()
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			fmt.Errorf("failure in plugin configured via %s; %w", f.Name(), err),
+			"%s", stdErr.String())
+	}
+	return result, os.Remove(f.Name())
+}
+
+func (p *ExecPlugin) getEnv() []string {
+	env := os.Environ()
+	pluginConfigString := "KUSTOMIZE_PLUGIN_CONFIG_STRING=" + string(p.cfg)
+	if len(pluginConfigString) <= maxArgStringLength {
+		env = append(env, pluginConfigString)
+	} else {
+		log.Printf("KUSTOMIZE_PLUGIN_CONFIG_STRING exceeds hard limit of %d characters, the environment variable "+
+			"will be omitted", maxArgStringLength)
+	}
+	pluginConfigRoot := "KUSTOMIZE_PLUGIN_CONFIG_ROOT=" + p.h.Loader().Root()
+	if len(pluginConfigRoot) <= maxArgStringLength {
+		env = append(env, pluginConfigRoot)
+	} else {
+		log.Printf("KUSTOMIZE_PLUGIN_CONFIG_ROOT exceeds hard limit of %d characters, the environment variable "+
+			"will be omitted", maxArgStringLength)
+	}
+	return env
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/execplugin/shlex.go

@@ -0,0 +1,62 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package execplugin
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// ShlexSplit splits a string into a slice of strings using shell-style rules for quoting and commenting
+// Similar to Python's shlex.split with comments enabled
+func ShlexSplit(s string) ([]string, error) {
+	return shlexSplit(s)
+}
+
+func shlexSplit(s string) ([]string, error) {
+	result := []string{}
+
+	// noQuote is used to track if we are not in a quoted
+	const noQuote = 0
+
+	var current strings.Builder
+	var quote rune = noQuote
+	var escaped bool
+
+	for _, r := range s {
+		switch {
+		case escaped:
+			current.WriteRune(r)
+			escaped = false
+		case r == '\\' && quote != '\'':
+			escaped = true
+		case (r == '\'' || r == '"') && quote == noQuote:
+			quote = r
+		case r == quote:
+			quote = noQuote
+		case r == '#' && quote == noQuote:
+			// Comment starts, ignore the rest of the line
+			if current.Len() > 0 {
+				result = append(result, current.String())
+			}
+			return result, nil
+		case unicode.IsSpace(r) && quote == noQuote:
+			if current.Len() > 0 {
+				result = append(result, current.String())
+				current.Reset()
+			}
+		default:
+			current.WriteRune(r)
+		}
+	}
+
+	if quote != noQuote {
+		return nil, fmt.Errorf("unclosed quote in string")
+	}
+	if current.Len() > 0 {
+		result = append(result, current.String())
+	}
+	return result, nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/fnplugin/fnplugin.go

@@ -0,0 +1,201 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package fnplugin
+
+import (
+	"bytes"
+	"fmt"
+
+	"sigs.k8s.io/kustomize/kyaml/errors"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
+	"sigs.k8s.io/kustomize/kyaml/runfn"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+// FnPlugin is the struct to hold function information
+type FnPlugin struct {
+	// Function runner
+	runFns runfn.RunFns
+
+	// Plugin configuration data.
+	cfg []byte
+
+	// Plugin name cache for error output
+	pluginName string
+
+	// PluginHelpers
+	h *resmap.PluginHelpers
+}
+
+func bytesToRNode(yml []byte) (*yaml.RNode, error) {
+	rnode, err := yaml.Parse(string(yml))
+	if err != nil {
+		return nil, err
+	}
+	return rnode, nil
+}
+
+func resourceToRNode(res *resource.Resource) (*yaml.RNode, error) {
+	yml, err := res.AsYAML()
+	if err != nil {
+		return nil, err
+	}
+
+	return bytesToRNode(yml)
+}
+
+// GetFunctionSpec return function spec is there is. Otherwise return nil
+func GetFunctionSpec(res *resource.Resource) (*runtimeutil.FunctionSpec, error) {
+	rnode, err := resourceToRNode(res)
+	if err != nil {
+		return nil, fmt.Errorf("could not convert resource to RNode: %w", err)
+	}
+	functionSpec, err := runtimeutil.GetFunctionSpec(rnode)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get FunctionSpec: %w", err)
+	}
+	return functionSpec, nil
+}
+
+func toStorageMounts(mounts []string) []runtimeutil.StorageMount {
+	var sms []runtimeutil.StorageMount
+	for _, mount := range mounts {
+		sms = append(sms, runtimeutil.StringToStorageMount(mount))
+	}
+	return sms
+}
+
+// NewFnPlugin creates a FnPlugin struct
+func NewFnPlugin(o *types.FnPluginLoadingOptions) *FnPlugin {
+	return &FnPlugin{
+		runFns: runfn.RunFns{
+			Functions:      []*yaml.RNode{},
+			Network:        o.Network,
+			EnableExec:     o.EnableExec,
+			StorageMounts:  toStorageMounts(o.Mounts),
+			Env:            o.Env,
+			AsCurrentUser:  o.AsCurrentUser,
+			WorkingDir:     o.WorkingDir,
+		},
+	}
+}
+
+// Cfg returns function config
+func (p *FnPlugin) Cfg() []byte {
+	return p.cfg
+}
+
+// Config is called by kustomize to pass-in config information
+func (p *FnPlugin) Config(h *resmap.PluginHelpers, config []byte) error {
+	p.h = h
+	p.cfg = config
+
+	fn, err := bytesToRNode(p.cfg)
+	if err != nil {
+		return err
+	}
+
+	meta, err := fn.GetMeta()
+	if err != nil {
+		return err
+	}
+
+	p.pluginName = fmt.Sprintf("api: %s, kind: %s, name: %s",
+		meta.APIVersion, meta.Kind, meta.Name)
+
+	return nil
+}
+
+// Generate is called when run as generator
+func (p *FnPlugin) Generate() (resmap.ResMap, error) {
+	output, err := p.invokePlugin(nil)
+	if err != nil {
+		return nil, err
+	}
+	rm, err := p.h.ResmapFactory().NewResMapFromBytes(output)
+	if err != nil {
+		return nil, err
+	}
+	return utils.UpdateResourceOptions(rm)
+}
+
+// Transform is called when run as transformer
+func (p *FnPlugin) Transform(rm resmap.ResMap) error {
+	// add ResIds as annotations to all objects so that we can add them back
+	inputRM, err := utils.GetResMapWithIDAnnotation(rm)
+	if err != nil {
+		return err
+	}
+
+	// encode the ResMap so it can be fed to the plugin
+	resources, err := inputRM.AsYaml()
+	if err != nil {
+		return err
+	}
+
+	// invoke the plugin with resources as the input
+	output, err := p.invokePlugin(resources)
+	if err != nil {
+		return fmt.Errorf("%v %s", err, string(output))
+	}
+
+	// update the original ResMap based on the output
+	return utils.UpdateResMapValues(p.pluginName, p.h, output, rm)
+}
+
+func injectAnnotation(input *yaml.RNode, k, v string) error {
+	err := input.PipeE(yaml.SetAnnotation(k, v))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// invokePlugin uses Function runner to run function as plugin
+func (p *FnPlugin) invokePlugin(input []byte) ([]byte, error) {
+	// get function config rnode
+	functionConfig, err := bytesToRNode(p.cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	// This annotation will let kustomize ingnore this item in output
+	err = injectAnnotation(functionConfig, "config.kubernetes.io/local-config", "true")
+	if err != nil {
+		return nil, err
+	}
+	// we need to add config as input for generators. Some of them don't work with FunctionConfig
+	// and in addition kio.Pipeline won't create anything if there are no objects
+	// see https://github.com/kubernetes-sigs/kustomize/blob/master/kyaml/kio/kio.go#L93
+	// Since we added `local-config` annotation so it will be ignored in generator output
+	// TODO(donnyxia): This is actually not used by generator and only used to bypass a kio limitation.
+	// Need better solution.
+	if input == nil {
+		yml, err := functionConfig.String()
+		if err != nil {
+			return nil, err
+		}
+		input = []byte(yml)
+	}
+
+	// Configure and Execute Fn. We don't need to convert resources to ResourceList here
+	// because function runtime will do that. See kyaml/fn/runtime/runtimeutil/runtimeutil.go
+	var ouputBuffer bytes.Buffer
+	p.runFns.Input = bytes.NewReader(input)
+	p.runFns.Functions = append(p.runFns.Functions, functionConfig)
+	p.runFns.Output = &ouputBuffer
+
+	err = p.runFns.Execute()
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "couldn't execute function")
+	}
+
+	return ouputBuffer.Bytes(), nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/load_go_plugin.go

@@ -0,0 +1,62 @@
+// Copyright 2024 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+//go:build !kustomize_disable_go_plugin_support
+
+package loader
+
+import (
+	"fmt"
+	"log"
+	"plugin"
+	"reflect"
+
+	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+// registry is a means to avoid trying to load the same .so file
+// into memory more than once, which results in an error.
+// Each test makes its own loader, and tries to load its own plugins,
+// but the loaded .so files are in shared memory, so one will get
+// "this plugin already loaded" errors if the registry is maintained
+// as a Loader instance variable.  So make it a package variable.
+var registry = make(map[string]resmap.Configurable) //nolint:gochecknoglobals
+
+func copyPlugin(c resmap.Configurable) resmap.Configurable {
+	indirect := reflect.Indirect(reflect.ValueOf(c))
+	newIndirect := reflect.New(indirect.Type())
+	newIndirect.Elem().Set(reflect.ValueOf(indirect.Interface()))
+	newNamed := newIndirect.Interface()
+	return newNamed.(resmap.Configurable) //nolint:forcetypeassert
+}
+
+func (l *Loader) loadGoPlugin(id resid.ResId, absPath string) (resmap.Configurable, error) {
+	regId := relativePluginPath(id)
+	if c, ok := registry[regId]; ok {
+		return copyPlugin(c), nil
+	}
+	if !utils.FileExists(absPath) {
+		return nil, fmt.Errorf(
+			"expected file with Go object code at: %s", absPath)
+	}
+	log.Printf("Attempting plugin load from %q", absPath)
+	p, err := plugin.Open(absPath)
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "plugin %s fails to load", absPath)
+	}
+	symbol, err := p.Lookup(konfig.PluginSymbol)
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "plugin %s doesn't have symbol %s",
+			regId, konfig.PluginSymbol)
+	}
+	c, ok := symbol.(resmap.Configurable)
+	if !ok {
+		return nil, fmt.Errorf("plugin %q not configurable", regId)
+	}
+	registry[regId] = c
+	return copyPlugin(c), nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/load_go_plugin_disabled.go

@@ -0,0 +1,25 @@
+// Copyright 2024 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// The build tag "kustomize_disable_go_plugin_support" is used to deactivate the
+// kustomize API's dependency on the "plugins" package. This is beneficial for
+// applications that need to embed it but do not have requirements for dynamic
+// Go plugins.
+// Including plugins as a dependency can lead to an increase in binary size due
+// to the population of ELF's sections such as .dynsym and .dynstr.
+// By utilizing this flag, applications have the flexibility to exclude the
+// import if they do not require support for dynamic Go plugins.
+//go:build kustomize_disable_go_plugin_support
+
+package loader
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+func (l *Loader) loadGoPlugin(_ resid.ResId, _ string) (resmap.Configurable, error) {
+	return nil, fmt.Errorf("plugin load is disabled")
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/loader/loader.go

@@ -0,0 +1,290 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package loader
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"sigs.k8s.io/kustomize/api/ifc"
+	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
+	"sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
+	"sigs.k8s.io/kustomize/api/internal/plugins/fnplugin"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+)
+
+// Loader loads plugins using a file loader (a different loader).
+type Loader struct {
+	pc *types.PluginConfig
+	rf *resmap.Factory
+	fs filesys.FileSystem
+
+	// absolutePluginHome caches the location of a valid plugin root directory.
+	// It should only be set once the directory's existence has been confirmed.
+	absolutePluginHome string
+}
+
+func NewLoader(
+	pc *types.PluginConfig, rf *resmap.Factory, fs filesys.FileSystem,
+) *Loader {
+	return &Loader{pc: pc, rf: rf, fs: fs}
+}
+
+// LoaderWithWorkingDir returns loader after setting its working directory.
+// NOTE: This is not really a new loader since some of the Loader struct fields are pointers.
+func (l *Loader) LoaderWithWorkingDir(wd string) *Loader {
+	lpc := &types.PluginConfig{
+		PluginRestrictions: l.pc.PluginRestrictions,
+		BpLoadingOptions:   l.pc.BpLoadingOptions,
+		FnpLoadingOptions:  l.pc.FnpLoadingOptions,
+		HelmConfig:         l.pc.HelmConfig,
+	}
+	lpc.FnpLoadingOptions.WorkingDir = wd
+	return &Loader{pc: lpc, rf: l.rf, fs: l.fs}
+}
+
+// Config provides the global (not plugin specific) PluginConfig data.
+func (l *Loader) Config() *types.PluginConfig {
+	return l.pc
+}
+
+func (l *Loader) LoadGenerators(
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap) (
+	result []*resmap.GeneratorWithProperties, err error,
+) {
+	for _, res := range rm.Resources() {
+		g, err := l.LoadGenerator(ldr, v, res)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load generator: %w", err)
+		}
+		generatorOrigin, err := resource.OriginFromCustomPlugin(res)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get origin from CustomPlugin: %w", err)
+		}
+		result = append(result, &resmap.GeneratorWithProperties{Generator: g, Origin: generatorOrigin})
+	}
+	return result, nil
+}
+
+func (l *Loader) LoadGenerator(
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (resmap.Generator, error) {
+	c, err := l.loadAndConfigurePlugin(ldr, v, res)
+	if err != nil {
+		return nil, err
+	}
+	g, ok := c.(resmap.Generator)
+	if !ok {
+		return nil, fmt.Errorf("plugin %s not a generator", res.OrgId())
+	}
+	return g, nil
+}
+
+func (l *Loader) LoadTransformers(
+	ldr ifc.Loader, v ifc.Validator, rm resmap.ResMap,
+) ([]*resmap.TransformerWithProperties, error) {
+	var result []*resmap.TransformerWithProperties
+	for _, res := range rm.Resources() {
+		t, err := l.LoadTransformer(ldr, v, res)
+		if err != nil {
+			return nil, err
+		}
+		transformerOrigin, err := resource.OriginFromCustomPlugin(res)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, &resmap.TransformerWithProperties{Transformer: t, Origin: transformerOrigin})
+	}
+	return result, nil
+}
+
+func (l *Loader) LoadTransformer(
+	ldr ifc.Loader, v ifc.Validator, res *resource.Resource,
+) (*resmap.TransformerWithProperties, error) {
+	c, err := l.loadAndConfigurePlugin(ldr, v, res)
+	if err != nil {
+		return nil, err
+	}
+	t, ok := c.(resmap.Transformer)
+	if !ok {
+		return nil, fmt.Errorf("plugin %s not a transformer", res.OrgId())
+	}
+	return &resmap.TransformerWithProperties{Transformer: t}, nil
+}
+
+func relativePluginPath(id resid.ResId) string {
+	return filepath.Join(
+		id.Group,
+		id.Version,
+		strings.ToLower(id.Kind))
+}
+
+func (l *Loader) AbsolutePluginPath(id resid.ResId) (string, error) {
+	pluginHome, err := l.absPluginHome()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(pluginHome, relativePluginPath(id), id.Kind), nil
+}
+
+// absPluginHome is the home of kustomize Exec and Go plugins.
+// Kustomize plugin configuration files are k8s-style objects
+// containing the fields 'apiVersion' and 'kind', e.g.
+//
+//	apiVersion: apps/v1
+//	kind: Deployment
+//
+// kustomize reads plugin configuration data from a file path
+// specified in the 'generators:' or 'transformers:' field of a
+// kustomization file.  For Exec and Go plugins, kustomize
+// uses this data to both locate the plugin and configure it.
+// Each Exec or Go plugin (its code, its tests, its supporting data
+// files, etc.) must be housed in its own directory at
+//
+//	${absPluginHome}/${pluginApiVersion}/LOWERCASE(${pluginKind})
+//
+// where
+//   - ${absPluginHome} is an absolute path, defined below.
+//   - ${pluginApiVersion} is taken from the plugin config file.
+//   - ${pluginKind} is taken from the plugin config file.
+func (l *Loader) absPluginHome() (string, error) {
+	// External plugins are disabled--return the dummy plugin root.
+	if l.pc.PluginRestrictions != types.PluginRestrictionsNone {
+		return konfig.NoPluginHomeSentinal, nil
+	}
+	// We've already determined plugin home--use the cached value.
+	if l.absolutePluginHome != "" {
+		return l.absolutePluginHome, nil
+	}
+
+	// Check default locations for a valid plugin root, and cache it if found.
+	dir, err := konfig.DefaultAbsPluginHome(l.fs)
+	if err != nil {
+		return "", err
+	}
+	l.absolutePluginHome = dir
+	return l.absolutePluginHome, nil
+}
+
+func isBuiltinPlugin(res *resource.Resource) bool {
+	// TODO: the special string should appear in Group, not Version.
+	return res.GetGvk().Group == "" &&
+		res.GetGvk().Version == konfig.BuiltinPluginApiVersion
+}
+
+func (l *Loader) loadAndConfigurePlugin(
+	ldr ifc.Loader,
+	v ifc.Validator,
+	res *resource.Resource,
+) (c resmap.Configurable, err error) {
+	if isBuiltinPlugin(res) {
+		switch l.pc.BpLoadingOptions {
+		case types.BploLoadFromFileSys:
+			c, err = l.loadPlugin(res)
+		case types.BploUseStaticallyLinked:
+			// Instead of looking for and loading a .so file,
+			// instantiate the plugin from a generated factory
+			// function (see "pluginator").  Being able to do this
+			// is what makes a plugin "builtin".
+			c, err = l.makeBuiltinPlugin(res.GetGvk())
+		default:
+			err = fmt.Errorf(
+				"unknown plugin loader behavior specified: %s %v", res.GetGvk().String(),
+				l.pc.BpLoadingOptions)
+		}
+	} else {
+		switch l.pc.PluginRestrictions {
+		case types.PluginRestrictionsNone:
+			c, err = l.loadPlugin(res)
+		case types.PluginRestrictionsBuiltinsOnly:
+			err = types.NewErrOnlyBuiltinPluginsAllowed(res.OrgId().Kind)
+		default:
+			err = fmt.Errorf(
+				"unknown plugin restriction specified: %v",
+				l.pc.PluginRestrictions)
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	yaml, err := res.AsYAML()
+	if err != nil {
+		return nil, errors.WrapPrefixf(err, "marshalling yaml from res %s", res.OrgId())
+	}
+	err = c.Config(resmap.NewPluginHelpers(ldr, v, l.rf, l.pc), yaml)
+	if err != nil {
+		return nil, errors.WrapPrefixf(
+			err, "plugin %s fails configuration", res.OrgId())
+	}
+	return c, nil
+}
+
+func (l *Loader) makeBuiltinPlugin(r resid.Gvk) (resmap.Configurable, error) {
+	bpt := builtinhelpers.GetBuiltinPluginType(r.Kind)
+	if f, ok := builtinhelpers.GeneratorFactories[bpt]; ok {
+		return f(), nil
+	}
+	if f, ok := builtinhelpers.TransformerFactories[bpt]; ok {
+		return f(), nil
+	}
+	return nil, errors.Errorf("unable to load builtin %s", r)
+}
+
+func (l *Loader) loadPlugin(res *resource.Resource) (resmap.Configurable, error) {
+	spec, err := fnplugin.GetFunctionSpec(res)
+	if err != nil {
+		return nil, fmt.Errorf("loader: %w", err)
+	}
+	if spec != nil {
+		// validation check that function mounts are under the current kustomization directory
+		for _, mount := range spec.Container.StorageMounts {
+			if filepath.IsAbs(mount.Src) {
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be relative to the current kustomization directory", res.OrgId(), mount.Src)
+			}
+			if strings.HasPrefix(filepath.Clean(mount.Src), "..") {
+				return nil, errors.Errorf("plugin %s with mount path '%s' is not permitted; "+
+					"mount paths must be under the current kustomization directory", res.OrgId(), mount.Src)
+			}
+		}
+		return fnplugin.NewFnPlugin(&l.pc.FnpLoadingOptions), nil
+	}
+	return l.loadExecOrGoPlugin(res.OrgId())
+}
+
+func (l *Loader) loadExecOrGoPlugin(resId resid.ResId) (resmap.Configurable, error) {
+	absPluginPath, err := l.AbsolutePluginPath(resId)
+	if err != nil {
+		return nil, err
+	}
+	// First try to load the plugin as an executable.
+	p := execplugin.NewExecPlugin(absPluginPath)
+	if err = p.ErrIfNotExecutable(); err == nil {
+		return p, nil
+	}
+	if !os.IsNotExist(err) {
+		// The file exists, but something else is wrong,
+		// likely it's not executable.
+		// Assume the user forgot to set the exec bit,
+		// and return an error, rather than adding ".so"
+		// to the name and attempting to load it as a Go
+		// plugin, which will likely fail and result
+		// in an obscure message.
+		return nil, err
+	}
+	// Failing the above, try loading it as a Go plugin.
+	c, err := l.loadGoPlugin(resId, absPluginPath+".so")
+	if err != nil {
+		return nil, err
+	}
+	return c, nil
+}

vendor/sigs.k8s.io/kustomize/api/internal/plugins/utils/utils.go

@@ -0,0 +1,240 @@
+// Copyright 2020 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"time"
+
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/resmap"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	idAnnotation       = "kustomize.config.k8s.io/id"
+	HashAnnotation     = "kustomize.config.k8s.io/needs-hash"
+	BehaviorAnnotation = "kustomize.config.k8s.io/behavior"
+)
+
+func GoBin() string {
+	return filepath.Join(runtime.GOROOT(), "bin", "go")
+}
+
+// DeterminePluginSrcRoot guesses where the user
+// has her ${g}/${v}/$lower(${k})/${k}.go files.
+func DeterminePluginSrcRoot(fSys filesys.FileSystem) (string, error) {
+	return konfig.FirstDirThatExistsElseError(
+		"plugin src root", fSys, []konfig.NotedFunc{
+			{
+				Note: "relative to unit test",
+				F: func() string {
+					return filepath.Clean(
+						filepath.Join(
+							os.Getenv("PWD"),
+							"..", "..",
+							konfig.RelPluginHome))
+				},
+			},
+			{
+				Note: "relative to unit test (internal pkg)",
+				F: func() string {
+					return filepath.Clean(
+						filepath.Join(
+							os.Getenv("PWD"),
+							"..", "..", "..", "..",
+							konfig.RelPluginHome))
+				},
+			},
+			{
+				Note: "relative to api package",
+				F: func() string {
+					return filepath.Clean(
+						filepath.Join(
+							os.Getenv("PWD"),
+							"..", "..", "..",
+							konfig.RelPluginHome))
+				},
+			},
+			{
+				Note: "old style $GOPATH",
+				F: func() string {
+					return filepath.Join(
+						os.Getenv("GOPATH"),
+						"src", konfig.DomainName,
+						konfig.ProgramName, konfig.RelPluginHome)
+				},
+			},
+			{
+				Note: "HOME with literal 'gopath'",
+				F: func() string {
+					return filepath.Join(
+						konfig.HomeDir(), "gopath",
+						"src", konfig.DomainName,
+						konfig.ProgramName, konfig.RelPluginHome)
+				},
+			},
+			{
+				Note: "home directory",
+				F: func() string {
+					return filepath.Join(
+						konfig.HomeDir(), konfig.DomainName,
+						konfig.ProgramName, konfig.RelPluginHome)
+				},
+			},
+		})
+}
+
+// FileYoungerThan returns true if the file both exists and has an
+// age is <= the Duration argument.
+func FileYoungerThan(path string, d time.Duration) bool {
+	fi, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false
+		}
+	}
+	return time.Since(fi.ModTime()) <= d
+}
+
+// FileModifiedAfter returns true if the file both exists and was
+// modified after the given time..
+func FileModifiedAfter(path string, t time.Time) bool {
+	fi, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false
+		}
+	}
+	return fi.ModTime().After(t)
+}
+
+func FileExists(path string) bool {
+	if _, err := os.Stat(path); err != nil {
+		if os.IsNotExist(err) {
+			return false
+		}
+	}
+	return true
+}
+
+// GetResMapWithIDAnnotation returns a new copy of the given ResMap with the ResIds annotated in each Resource
+func GetResMapWithIDAnnotation(rm resmap.ResMap) (resmap.ResMap, error) {
+	inputRM := rm.DeepCopy()
+	for _, r := range inputRM.Resources() {
+		idString, err := yaml.Marshal(r.CurId())
+		if err != nil {
+			return nil, err
+		}
+		annotations := r.GetAnnotations()
+		annotations[idAnnotation] = string(idString)
+		if err = r.SetAnnotations(annotations); err != nil {
+			return nil, err
+		}
+	}
+	return inputRM, nil
+}
+
+// UpdateResMapValues updates the Resource value in the given ResMap
+// with the emitted Resource values in output.
+func UpdateResMapValues(pluginName string, h *resmap.PluginHelpers, output []byte, rm resmap.ResMap) error {
+	mapFactory := h.ResmapFactory()
+	resFactory := mapFactory.RF()
+	resources, err := resFactory.SliceFromBytes(output)
+	if err != nil {
+		return err
+	}
+	// Don't use resources here, or error message will be unfriendly to plugin builders
+	newMap, err := mapFactory.NewResMapFromBytes([]byte{})
+	if err != nil {
+		return err
+	}
+
+	for _, r := range resources {
+		// stale--not manipulated by plugin transformers
+		if err = removeIDAnnotation(r); err != nil {
+			return err
+		}
+
+		// Add to the new map, checking for duplicates
+		if err := newMap.Append(r); err != nil {
+			prettyID, err := json.Marshal(r.CurId())
+			if err != nil {
+				prettyID = []byte(r.CurId().String())
+			}
+			return fmt.Errorf("plugin %s generated duplicate resource: %s", pluginName, prettyID)
+		}
+
+		// Add to or update the old map
+		oldIdx, err := rm.GetIndexOfCurrentId(r.CurId())
+		if err != nil {
+			return err
+		}
+		if oldIdx != -1 {
+			rm.GetByIndex(oldIdx).ResetRNode(r)
+		} else {
+			if err := rm.Append(r); err != nil {
+				return err
+			}
+		}
+	}
+
+	// Remove items the transformer deleted from the old map
+	for _, id := range rm.AllIds() {
+		newIdx, _ := newMap.GetIndexOfCurrentId(id)
+		if newIdx == -1 {
+			if err = rm.Remove(id); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func removeIDAnnotation(r *resource.Resource) error {
+	// remove the annotation set by Kustomize to track the resource
+	annotations := r.GetAnnotations()
+	delete(annotations, idAnnotation)
+	return r.SetAnnotations(annotations)
+}
+
+// UpdateResourceOptions updates the generator options for each resource in the
+// given ResMap based on plugin provided annotations.
+func UpdateResourceOptions(rm resmap.ResMap) (resmap.ResMap, error) {
+	for _, r := range rm.Resources() {
+		// Disable name hashing by default and require plugin to explicitly
+		// request it for each resource.
+		annotations := r.GetAnnotations()
+		behavior := annotations[BehaviorAnnotation]
+		var needsHash bool
+		if val, ok := annotations[HashAnnotation]; ok {
+			b, err := strconv.ParseBool(val)
+			if err != nil {
+				return nil, fmt.Errorf(
+					"the annotation %q contains an invalid value (%q)",
+					HashAnnotation, val)
+			}
+			needsHash = b
+		}
+		delete(annotations, HashAnnotation)
+		delete(annotations, BehaviorAnnotation)
+		if err := r.SetAnnotations(annotations); err != nil {
+			return nil, err
+		}
+		if needsHash {
+			r.EnableHashSuffix()
+		}
+		r.SetBehavior(types.NewGenerationBehavior(behavior))
+	}
+	return rm, nil
+}