kustomize/v5.0.0

🎉The Kustomize team is so excited to release version 5.0! 🎉

This release is packed with exciting features and improvements. The full list is below, but here are some of our favorites:

• kustomize localize: a brand new alpha command that localizes remote content. You’ll be able to build the localized kustomization without network access and performance delays! Please give it a try and let us know what you think in #4996. See more details in its entry under Features below.
• support for four new Helm fields, by popular request: additionalValuesFiles, skipTests, apiVersions and nameTemplate
• A new sortOptions kustomization field gives you fine-grained control over resource ordering in build output
• Significant performance improvements!

A HUGE thank you to everyone who contributed to this release! 🙇‍♀️

Breaking changes

• #4930: Remove deprecated alpha cfg and fn commands: kustomize fn sink, kustomize fn source, kustomize fn wrap, kustomize fn xargs, kustomize cfg annotate, kustomize cfg create-setter, kustomize cfg delete-setter, kustomize cfg delete-substitution, kustomize cfg create-substitution, kustomize cfg fmt, kustomize cfg init, kustomize cfg list-setters, kustomize cfg merge, kustomize cfg merge3, kustomize cfg set.
• #4983, #4954, #4922, #4900, #4885: Warning: We made major improvements to the maintainability of the URL-parsing code for remote URLs, fixing several bugs in the process. We have test coverage for backwards-compatibility with all documented supported URLs, but if you experience a regression with a remote URL, please file an issue.
  • #4985: If you previously included .git in an AWS or Azure URL, we will no longer automatically remove that suffix. You may need to add an extra / to replace the .git for the URL to properly resolve.
  • #4954: Drop support for using gh: as a host (e.g. gh:kubernetes-sigs/kustomize). We were unable to find any usage of or basis for this and believe it may have been targeting a custom gitconfig shorthand syntax.
• #4911: Drop support for a very old, legacy style of patches. patches used to be allowed to be used as an alias for patchesStrategicMerge in kustomize v3. You now have to use patchesStrategicMerge explicitly, or update to the new syntax supported by patches. See examples in the PR description of #4911.
• #4731: Remove a potential build-time side-effect in ConfigMapGenerator and SecretGenerator, which loaded values from the local environment under some circumstances, breaking kustomize build's side-effect-free promise. While this behavior was never intended, we deprecated it and are announcing it as a breaking change since it existed for a long time. See also the Eschewed Features documentation.
• #4929: Duplicate fields in Kustomization files will now result in an error instead of them silently being ignored in an undefined order. NOTE: This was reverted in release v5.0.1.

Deprecations

• #4723, #4923: We are deprecating the following kustomization fields. These fields will never be removed from the kustomize.config.k8s.io/v1beta1 Kustomization API, but they will not be included in the kustomize.config.k8s.io/v1 Kustomization API. When Kustomization v1 is available, we will announce the deprecation of the v1beta1 version. There will be at least two releases between deprecation and removal of Kustomization v1beta1 support from the kustomize CLI, and removal itself will happen in a future major version bump.
  • patchesStrategicMerge. Please use patches instead
  • patchesJson6902. Please use patches instead
  • vars. Please use replacements instead.
  • imageTags. This is an alias for images, please switch to images.
• #5000: The --short flag for kustomize version is deprecated.
• #4954: Deprecate RepoSpec git:: prefix, which is invalid. Kustomize currently strips it, but will stop doing so in a future release.

Features

• #4652: New kustomize localize command to download any remote content from your kustomization directory and create a new, localized copy with file paths to the local content replacing the URLs. Please leave your feedback here: #4996
• #4019: New kustomization field sortOptions, that lets you configure the sort order of resources.
• #4733: kustomize edit fix converts patchesStrategicMerge to patches
• #4947: Allow fieldspecs (used in advanced transformer configuration) to start with a slash.
• #5000: Output of kustomize version is improved. YAML and JSON formats are now available via the new --output flag.
• #4986: Repospec: support ssh urls with ssh certificates
• #4926, #4808: Support for more helm template args in the helmCharts field: additionalValuesFiles, skipTests, apiVersions and nameTemplate.
  #4886: Wildcard support for creation in ReplacementTransformer

Bug Fixes/performance improvements

• #4863: Fix RepoSpec query extraction
• #4985: Remove forced .git suffix in RepoSpec
  • Arbitrary git servers that do not follow the .git directory naming convention can now be used with Kustomize.
  • The .git suffix no longer incorrectly appears in origin annotations in some cases.
• #4791, #4944, #4809: Significant performance improvements from refactoring metadata handling in the api and kyaml modules
• #4789: Replacements now throw errors on invalid targets
• #4890: Fix null value handling when applying strategic merge patches. A null in the patch is a deletion directive, but a null in the target should be preserved.
• #4654: The working directory of exec KRM-style functions is now the kustomization root that called it. This fixes a bug where KRM exec function executables were looked up incorrectly in base/overlay contexts.
• #4751, #4805: When using labels.includeTemplates, create template/metadata if not present.
• #4834: Respect options.disableNameSuffixHash in configmap and secret generator in overlays
• #4919: Allow overriding of name suffix transformer default configuration
• #4895: Name references to local-only objects are now correctly resolved before the objects are removed from the set to be printed.

Dependencies

• #4877: Update minimum Go version to Go 1.19
• #4830: Update kyaml's dependency swag to v0.22.3
• #4960: Update sigs.k8s.io/yaml to v1.3.0
• #4965: Bump k8s.io/kube-openapi to remove archived dependency
• #4889: All module net and text dependent package CVE-2022-41717 and CVE-2022-32149 vulnerabilities
• #4970: Replace github/pkg/errors with sigs.k8s.io/kustomize/kyaml/errors

api/v0.13.1

#5023: Fix regression with scp-style urls with only one path element

kyaml/v0.14.0

Breaking changes

#4926: copyutils.CopyDir() now requires a FileSystem argument
#4019: remove Resid.LegacySortString()

Features

#4886: add creation support to PathMatcher filter
#4947: Allow fieldspecs (used in advanced transformer configuration) to start with a slash.

Bug fixes/performance improvements

#4944: Refactor mapping node traversal and optimize RNode.GetAnnotations and RNode.GetLabels
#4890: Fix null value handling when applying strategic merge patches. A null in the patch is a deletion directive, but a null in the target should be preserved.
#4967: fix data race when using openapi from multiple goroutines
#4990: Improve panic error message for invalid openapi schema file to include the parse error
#4806: runtimeutils.GetFunctionSpec throws error when resource metadata is not found
#4582: update openapi scripts to fetch protobuffer schemas

Dependencies

#4877: Update minimum Go version to Go 1.19
#4889: fix: all module net and text dependent package CVE-2022-41717 and CVE-2022-32149 vulnerabilities
#4965: Bump k8s.io/kube-openapi to remove archived dependency
#4960: Update sigs.k8s.io/yaml to v1.3.0
#4970: Replace github/pkg/errors with sigs.k8s.io/kustomize/kyaml/errors

cmd/config/v0.11.0

Breaking changes

#4930: remove deprecated cfg and fn commands

Dependencies

#4877: Update minimum Go version to Go 1.19
#4806: Update golangci-lint to v1.49.0
#4965: Bump k8s.io/kube-openapi to remove archived dependency
#4960: Update sigs.k8s.io/yaml to v1.3.0
#4830: update kyaml's dependency swag to v0.22.3
#4889: fix: all module net and text dependent package CVE-2022-41717 and CVE-2022-32149 vulnerabilities

api/v0.13.0

Breaking changes

• #4983, #4954, #4922, #4900, #4885: Warning: We made major improvements to the maintainability of the URL-parsing code for remote URLs, fixing several bugs in the process. We have test coverage for backwards-compatibility with all documented supported URLs, but if you experience a regression with a remote URL, please file an issue.
  • #4985: If you previously included .git in an AWS or Azure URL, we will no longer automatically remove that suffix.
  • #4954: Dropped support for using gh: as a host (e.g. gh:kubernetes-sigs/kustomize). We were unable to find any usage of or basis for this and believe it may have been targeting a custom gitconfig shorthand syntax.
• #4911: Drop support for a very old, legacy style of patches. patches used to be allowed to be used as an alias for patchesStrategicMerge in kustomize v3. You now have to use patchesStrategicMerge explicitly, or update to the new syntax supported by patches. See examples in the PR description of #4911.
• #4973: Remove long-ignored Inventory field from Kustomization type
• #4731: Remove a potential build-time side-effect in ConfigMapGenerator and SecretGenerator, which loaded values from the local environment under some circumstances, breaking kustomize build's side-effect-free promise. While this behavior was never intended, we deprecated it and are announcing it as a breaking change since it existed for a long time. See also the Eschewed Features documentation.
  #4929: Duplicate fields in Kustomization files will now result in an error instead of them silently being ignored in an undefined order.
• #4019: Removal of DoLegacyResourceSort.

Deprecations

• #4723, #4923: Deprecated fields: We are deprecating the following Kustomization fields. These fields will never be removed from the kustomize.config.k8s.io/v1beta1 Kustomization API, but they will not be included in the kustomize.config.k8s.io/v1 Kustomization API. When Kustomization v1 is available, we will announce the deprecation of the v1beta1 version. There will be at least two releases between deprecation and removal of Kustomization v1beta1 support from the kustomize CLI, and removal itself will happen in a future major version bump.
  • patchesStrategicMerge. Please use patches instead
  • patchesJson6902. Please use patches instead
  • vars. Please use replacements instead.
  • imageTags. This is an alias for images, please switch to images.
• #4954: Deprecate RepoSpec git:: prefix, which is invalid. Kustomize currently strips it, but will stop doing so in a future release.

Features

• #4019: New sortOptions kustomization field that lets you configure the sort order of resources.
• Introduce localizer package that contains kustomize localize command logic
• #4974: Introduce localizertest package with localizer test helpers
• #4986: Repospec: support ssh urls with ssh certificates
• #4926, #4808: Support for more helm template args in the helmCharts field: additionalValuesFiles, skipTests, apiVersions and skipTests.
• #4886: Wildcard support for creation in ReplacementTransformer
• #4652: Add Repo method to ifc.Loader interface
• #4856: Add IsRemoteFile function to loader package
• #4947: Allow fieldspecs (used in advanced transformer configuration) to start with a slash.
• #4978: Add HelmDefaultHome field storing name of default chart home directory
• #5000: Output of kustomize version is improved. YAML and JSON formats are now available via the new --output flag.

Bug Fixes/performance improvements

• #4863: Fix RepoSpec query extraction
• #4985: Remove forced .git suffix in RepoSpec
  • Arbitrary git servers that do not follow the .git directory naming convention can now be used with Kustomize.
  • The .git suffix no longer incorrectly appears in origin annotations in some cases.
• #4895: Name references to local-only objects are now correctly resolved before the objects are removed from the set to be printed.
• #4791, #4944, #4809: Significant performance improvements from refactoring metadata handling in the api and kyaml modules
• #4758: Emit a warning when using missing field in FunctionSpec
• #4789: Replacements now throw errors on invalid targets
• #4890: Fix null value handling when applying strategic merge patches. A null in the patch is a deletion directive, but a null in the target should be preserved.
• #4654: The working directory of exec KRM-style functions is now the kustomization root that called it. This fixes a bug where KRM exec function executables were looked up incorrectly in base/overlay contexts.
• #4751, #4805: When using labels.includeTemplates, create template/metadata if not present.
• #4834: Respect options.disableNameSuffixHash in configmap and secret generator in overlays
• #4919: Allow overriding of name suffix transformer default configuration

Dependencies

• #4960: Update sigs.k8s.io/yaml to v1.3.0
• #4877: Update minimum Go version to Go 1.19
• #4970: Replace github/pkg/errors with sigs.k8s.io/kustomize/kyaml/errors
• #4965: Bump k8s.io/kube-openapi to remove archived dependency
• #4889: fix: all module net and text dependent package CVE-2022-41717 and CVE-2022-32149 vulnerabilities
• #4830: update kyaml's dependency swag to v0.22.3

kyaml/v0.13.10

#4727: Improve invalid node kind errors
#4754: Stop using deprecated ioutil functions
#4758: Emit a warning when using missing field in FunctionSpec
#4764: Update internal go-yaml fork to v3.0.1, picking up bug fixes and a panic fix that has an associated CVE
#4806: update golangci-lint version to v1.49.0
#4820: preallocate memory for performance improvements
#4830: update kyaml's dependency swag to v0.22.3

kyaml/v0.13.9

#4742: prevent testing lib from being compiled in

kustomize/v4.5.7

Due to an oversight, kustomize v4.5.6 has the golang testing library compiled in unnecessarily. This is a rerelease with the same functionality, but without the unnecessary additional library compiled in.

Dependency changes

#4743: Pin to kyaml v0.13.9
#4744: pin to cmd/config 0.10.9
#4745: pin to api v0.12.1

cmd/config/v0.10.9

Dependency changes

#4743: Pin to kyaml v0.13.9

api/v0.12.1

Dependency changes

#4743: Pin to kyaml v0.13.9