.github/dependabot.yaml

@@ -1,34 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: "gomod"
-    directory: "/"
-    labels: ["dependencies"]
-    schedule:
-      interval: "monthly"
-    groups:
-      go-deps:
-        patterns:
-          - "*"
-    allow:
-      - dependency-type: "direct"
-    ignore:
-      # Kubernetes deps are updated by fluxcd/pkg
-      - dependency-name: "k8s.io/*"
-      - dependency-name: "sigs.k8s.io/*"
-      # KMS SDKs are updated by SOPS
-      - dependency-name: "github.com/Azure/*"
-      - dependency-name: "github.com/aws/*"
-      - dependency-name: "github.com/hashicorp/vault/*"
-      # Flux APIs pkg are updated at release time
-      - dependency-name: "github.com/fluxcd/kustomize-controller/api"
-      - dependency-name: "github.com/fluxcd/source-controller/api"
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    labels: ["area/ci", "dependencies"]
-    groups:
-      ci:
-        patterns:
-          - "*"
-    schedule:
-      interval: "monthly"

.github/labels.yaml

@@ -1,40 +0,0 @@
-# Configuration file to declaratively configure labels
-# Ref: https://github.com/EndBug/label-sync#Config-files
-
-- name: area/kustomize
-  description: Kustomize related issues and pull requests
-  color: '#00e54d'
-- name: area/kstatus
-  description: Health checking related issues and pull requests
-  color: '#25D5CA'
-  aliases: ['area/health-checks']
-- name: area/sops
-  description: SOPS related issues and pull requests
-  color: '#FEE5D1'
-- name: area/server-side-apply
-  description: SSA related issues and pull requests
-  color: '#2819CB'
-- name: area/varsub
-  description: Post-build variable substitution related issues and pull requests
-  color: '#8D195D'
-- name: backport:release/v1.0.x
-  description: To be backported to release/v1.0.x
-  color: '#ffd700'
-- name: backport:release/v1.1.x
-  description: To be backported to release/v1.1.x
-  color: '#ffd700'
-- name: backport:release/v1.2.x
-  description: To be backported to release/v1.2.x
-  color: '#ffd700'
-- name: backport:release/v1.3.x
-  description: To be backported to release/v1.3.x
-  color: '#ffd700'
-- name: backport:release/v1.4.x
-  description: To be backported to release/v1.4.x
-  color: '#ffd700'
-- name: backport:release/v1.5.x
-  description: To be backported to release/v1.5.x
-  color: '#ffd700'
-- name: backport:release/v1.6.x
-  description: To be backported to release/v1.6.x
-  color: '#ffd700'

.github/workflows/backport.yaml

@@ -1,34 +0,0 @@
-name: backport
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-permissions:
-  contents: read
-
-jobs:
-  pull-request:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: github.event.pull_request.state == 'closed' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport:', github.event.label.name))
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - name: Create backport PRs
-        uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
-        # xref: https://github.com/korthout/backport-action#inputs
-        with:
-          # Use token to allow workflows to be triggered for the created PR
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          # Match labels with a pattern `backport:<target-branch>`
-          label_pattern: '^backport:([^ ]+)$'
-          # A bit shorter pull-request title than the default
-          pull_title: '[${target_branch}] ${pull_title}'
-          # Simpler PR description than default
-          pull_description: |-
-            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.

.github/workflows/cifuzz.yaml

@@ -12,13 +12,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Setup Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/checkout@v2
+    - name: Restore Go cache
+      uses: actions/cache@v1
       with:
-        go-version: 1.24.x
-        cache-dependency-path: |
-          **/go.sum
-          **/go.mod
+        path: /home/runner/work/_temp/_github_home/go/pkg/mod
+        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-go-
     - name: Smoke test Fuzzers
       run: make fuzz-smoketest

.github/workflows/e2e.yaml

@@ -4,25 +4,33 @@ on:
   pull_request:
   push:
     branches:
-      - 'main'
-      - 'release/**'
+      - main
 
 permissions:
   contents: read # for actions/checkout to fetch code
-
+  
 jobs:
   kind:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v3
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@v1
+      - name: Restore Go cache
+        uses: actions/cache@v3
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
       - name: Cache Docker layers
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@v3
         id: cache
         with:
           path: /tmp/.buildx-cache
@@ -30,20 +38,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-buildx-ghcache-
       - name: Setup Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.24.x
-          cache-dependency-path: |
-            **/go.sum
-            **/go.mod
+          go-version: 1.18.x
       - name: Setup Kubernetes
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: engineerd/setup-kind@v0.5.0
         with:
-          version: v0.20.0
-          cluster_name: kind
-          node_image: kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
+          version: v0.11.1
+          image: kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
       - name: Setup Kustomize
-        uses: fluxcd/pkg/actions/kustomize@main
+        uses: fluxcd/pkg//actions/kustomize@main
+      - name: Setup Kubectl
+        uses: fluxcd/pkg/actions/kubectl@main
+        with:
+          version: 1.21.2
       - name: Enable integration tests
         # Only run integration tests for main branch
         if: github.ref == 'refs/heads/main'
@@ -101,7 +109,7 @@ jobs:
       - name: Run tests for removing kubectl managed fields
         run: |
           kubectl create ns managed-fields
-          kustomize build github.com/stefanprodan/podinfo//kustomize?ref=6.3.5 > /tmp/podinfo.yaml
+          kustomize build github.com/stefanprodan/podinfo//kustomize?ref=6.0.0 > /tmp/podinfo.yaml
           kubectl -n managed-fields apply -f /tmp/podinfo.yaml
           kubectl -n managed-fields apply -f ./config/testdata/managed-fields
           kubectl -n managed-fields wait kustomization/podinfo --for=condition=ready --timeout=4m
@@ -153,6 +161,9 @@ jobs:
       - name: Debug failure
         if: failure()
         run: |
+          which kubectl
+          kubectl version
+          kustomize version
           kubectl -n kustomize-system get gitrepositories -oyaml
           kubectl -n kustomize-system get kustomizations -oyaml
           kubectl -n kustomize-system get all

.github/workflows/nightly.yml

@@ -9,22 +9,23 @@ env:
 
 permissions:
   contents: read # for actions/checkout to fetch code
-
+  
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v3
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@v2
         with:
           buildkitd-flags: "--debug"
       - name: Build multi-arch container image
-        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0
+        uses: docker/build-push-action@v3
         with:
           push: false
           builder: ${{ steps.buildx.outputs.name }}

.github/workflows/release.yml

@@ -11,25 +11,18 @@ on:
         required: true
 
 permissions:
-  contents: read
+  contents: write # needed to write releases
+  id-token: write # needed for keyless signing
+  packages: write # needed for ghcr access
 
 env:
   CONTROLLER: ${{ github.event.repository.name }}
 
 jobs:
-  release:
-    outputs:
-      hashes: ${{ steps.slsa.outputs.hashes }}
-      image_url: ${{ steps.slsa.outputs.image_url }}
-      image_digest: ${{ steps.slsa.outputs.image_digest }}
+  build-push:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write # for creating the GitHub release.
-      id-token: write # for creating OIDC tokens for signing.
-      packages: write # for pushing and signing container images.
     steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v3
       - name: Setup Kustomize
         uses: fluxcd/pkg/actions/kustomize@main
       - name: Prepare
@@ -39,27 +32,27 @@ jobs:
           if [[ $GITHUB_REF == refs/tags/* ]]; then
             VERSION=${GITHUB_REF/refs\/tags\//}
           fi
-          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
-          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+          echo ::set-output name=BUILD_DATE::$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+          echo ::set-output name=VERSION::${VERSION}
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@v2
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@v2
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: fluxcdbot
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Login to Docker Hub
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@v2
         with:
           username: fluxcdbot
           password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
       - name: Generate images meta
         id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        uses: docker/metadata-action@v4
         with:
           images: |
             fluxcd/${{ env.CONTROLLER }}
@@ -67,11 +60,8 @@ jobs:
           tags: |
             type=raw,value=${{ steps.prep.outputs.VERSION }}
       - name: Publish images
-        id: build-push
-        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0
+        uses: docker/build-push-action@v3
         with:
-          sbom: true
-          provenance: true
           push: true
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -79,82 +69,32 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+      - name: Check images
+        run: |
+          docker buildx imagetools inspect docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+          docker buildx imagetools inspect ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+          docker pull docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+          docker pull ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+      - uses: sigstore/cosign-installer@main
       - name: Sign images
         env:
           COSIGN_EXPERIMENTAL: 1
         run: |
-          cosign sign --yes fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
-          cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
+          cosign sign fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+          cosign sign ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
       - name: Generate release artifacts
         if: startsWith(github.ref, 'refs/tags/v')
         run: |
           mkdir -p config/release
           kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml
           kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml
-      - uses: anchore/sbom-action/download-syft@e11c554f704a0b820cbf8c51673f6945e0731532 # v0.20.0
+          echo '[CHANGELOG](https://github.com/fluxcd/${{ env.CONTROLLER }}/blob/main/CHANGELOG.md)' > ./config/release/notes.md
+      - uses: anchore/sbom-action/download-syft@v0
       - name: Create release and SBOM
-        id: run-goreleaser
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
+        uses: goreleaser/goreleaser-action@v3
         with:
           version: latest
-          args: release --clean --skip=validate
+          args: release --release-notes=config/release/notes.md --rm-dist --skip-validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Generate SLSA metadata
-        id: slsa
-        env:
-          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
-        run: |
-          hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join("  ") | sub("^sha256:";"")' | base64 -w0)
-          echo "hashes=$hashes" >> $GITHUB_OUTPUT
-          
-          image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
-          echo "image_url=$image_url" >> $GITHUB_OUTPUT
-          
-          image_digest=${{ steps.build-push.outputs.digest }}
-          echo "image_digest=$image_digest" >> $GITHUB_OUTPUT
-
-  release-provenance:
-    needs: [release]
-    permissions:
-      actions: read # for detecting the Github Actions environment.
-      id-token: write # for creating OIDC tokens for signing.
-      contents: write # for uploading attestations to GitHub releases.
-    if: startsWith(github.ref, 'refs/tags/v')
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
-    with:
-      provenance-name: "provenance.intoto.jsonl"
-      base64-subjects: "${{ needs.release.outputs.hashes }}"
-      upload-assets: true
-
-  dockerhub-provenance:
-    needs: [release]
-    permissions:
-      actions: read # for detecting the Github Actions environment.
-      id-token: write # for creating OIDC tokens for signing.
-      packages: write # for uploading attestations.
-    if: startsWith(github.ref, 'refs/tags/v')
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
-    with:
-      image: ${{ needs.release.outputs.image_url }}
-      digest: ${{ needs.release.outputs.image_digest }}
-      registry-username: fluxcdbot
-    secrets:
-      registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
-
-  ghcr-provenance:
-    needs: [release]
-    permissions:
-      actions: read # for detecting the Github Actions environment.
-      id-token: write # for creating OIDC tokens for signing.
-      packages: write # for uploading attestations.
-    if: startsWith(github.ref, 'refs/tags/v')
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
-    with:
-      image: ghcr.io/${{ needs.release.outputs.image_url }}
-      digest: ${{ needs.release.outputs.image_digest }}
-      registry-username: fluxcdbot
-    secrets:
-      registry-password: ${{ secrets.GHCR_TOKEN }}

.github/workflows/scan.yml

@@ -11,16 +11,15 @@ on:
 permissions:
   contents: read # for actions/checkout to fetch code
   security-events: write # for codeQL to write security events
-
+  
 jobs:
   fossa:
     name: FOSSA
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v3
       - name: Run FOSSA scan and upload build data
-        uses: fossa-contrib/fossa-action@3d2ef181b1820d6dcd1972f86a767d18167fa19b # v3.0.1
+        uses: fossa-contrib/fossa-action@v1
         with:
           # FOSSA Push-Only API Token
           fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
@@ -30,23 +29,13 @@ jobs:
     name: CodeQL
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Setup Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: 1.24.x
-          cache-dependency-path: |
-            **/go.sum
-            **/go.mod
+      - name: Checkout repository
+        uses: actions/checkout@v3
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/init@v2
         with:
           languages: go
-          # xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-          # xref: https://codeql.github.com/codeql-query-help/go/
-          queries: security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/autobuild@v2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/analyze@v2

.github/workflows/sync-labels.yaml

@@ -1,28 +0,0 @@
-name: sync-labels
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - .github/labels.yaml
-
-permissions:
-  contents: read
-
-jobs:
-  labels:
-    name: Run sync
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2.3.3
-        with:
-          # Configuration file
-          config-file: |
-            https://raw.githubusercontent.com/fluxcd/community/main/.github/standard-labels.yaml
-            .github/labels.yaml
-          # Strictly declarative
-          delete-other-labels: true

.gitignore

@@ -1,26 +1,22 @@
-# Binaries for programs and plugins.
+# Binaries for programs and plugins
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
 
-# Test binary, built with `go test -c`.
+# Test binary, built with `go test -c`
 *.test
 
-# Output of the go coverage tool.
+# Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 
-# Build tools downloaded at runtime.
+# Dependency directories (remove the comment below to include it)
+# vendor/
 bin/
-
-# Release manifests generated at runtime.
 config/release/
 config/crd/bases/ocirepositories.yaml
 config/crd/bases/gitrepositories.yaml
 config/crd/bases/buckets.yaml
 
 build/
-
-# CRDs for fuzzing tests.
-internal/controllers/testdata/crd

.goreleaser.yaml

@@ -4,26 +4,9 @@ builds:
   - skip: true
 
 release:
+  prerelease: "true"
   extra_files:
     - glob: config/release/*.yaml
-  prerelease: "auto"
-  header: |
-    ## Changelog
-
-    [{{.Tag}} changelog](https://github.com/fluxcd/{{.ProjectName}}/blob/{{.Tag}}/CHANGELOG.md)
-  footer: |
-    ## Container images
-    
-    - `docker.io/fluxcd/{{.ProjectName}}:{{.Tag}}`
-    - `ghcr.io/fluxcd/{{.ProjectName}}:{{.Tag}}`
-    
-    Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`.
-    
-    The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
-    To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/).
-
-changelog:
-  disable: true
 
 checksum:
   extra_files:
@@ -49,7 +32,6 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - sign-blob
-      - "--yes"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"
       - "${artifact}"

CHANGELOG.md

@@ -2,883 +2,6 @@
 
 All notable changes to this project are documented in this file.
 
-## 1.6.1
-
-**Release date:** 2025-07-08
-
-This patch release fixes a bug introduced in v1.6.0
-that causes SOPS decryption with US Government KMS
-keys to fail with the error:
-
-```
-STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
-request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
-lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host
-```
-
-Fixes:
-- Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition
-  [#1478](https://github.com/fluxcd/kustomize-controller/pull/1478)
-
-## 1.6.0
-
-**Release date:** 2025-05-28
-
-This minor release comes with various bug fixes and improvements.
-
-Kustomization API now supports object-level workload identity by setting
-`.spec.decryption.serviceAccountName` to the name of a service account
-in the same namespace that has been configured with appropriate cloud
-permissions. For this feature to work, the controller feature gate
-`ObjectLevelWorkloadIdentity` must be enabled. See a complete guide
-[here](https://fluxcd.io/flux/integrations/).
-
-Kustomization API now supports the value `WaitForTermination` for the
-`.spec.deletionPolicy` field. This instructs the controller to wait for the
-deletion of all resources managed by the Kustomization before allowing the
-Kustomization itself to be deleted. See docs
-[here](https://fluxcd.io/flux/components/kustomize/kustomizations/#deletion-policy).
-
-In addition, the Kubernetes dependencies have been updated to v1.33 and
-various other controller dependencies have been updated to their latest version.
-The controller is now built with Go 1.24.
-
-Fixes:
-- Fix performance regression due to using client without cache
-  [#1436](https://github.com/fluxcd/kustomize-controller/pull/1436)
-- Fix secret value showing up in logs
-  [#1372](https://github.com/fluxcd/kustomize-controller/pull/1372)
-
-Improvements:
-- [RFC-0010] Introduce KMS provider decryption with service account
-  [#1426](https://github.com/fluxcd/kustomize-controller/pull/1426)
-  [#1449](https://github.com/fluxcd/kustomize-controller/pull/1449)
-  [#1456](https://github.com/fluxcd/kustomize-controller/pull/1456)
-- Add `WaitForTermination` option to DeletionPolicy
-  [#1444](https://github.com/fluxcd/kustomize-controller/pull/1444)
-- Skip emitting events for suspended Kustomizations
-  [#1396](https://github.com/fluxcd/kustomize-controller/pull/1396)
-- Various dependency updates
-  [#1458](https://github.com/fluxcd/kustomize-controller/pull/1458)
-  [#1448](https://github.com/fluxcd/kustomize-controller/pull/1448)
-  [#1433](https://github.com/fluxcd/kustomize-controller/pull/1433)
-  [#1435](https://github.com/fluxcd/kustomize-controller/pull/1435)
-  [#1429](https://github.com/fluxcd/kustomize-controller/pull/1429)
-  [#1414](https://github.com/fluxcd/kustomize-controller/pull/1414)
-  [#1410](https://github.com/fluxcd/kustomize-controller/pull/1410)
-  [#1401](https://github.com/fluxcd/kustomize-controller/pull/1401)
-
-## 1.5.1
-
-**Release date:** 2025-02-25
-
-This patch release fixes a bug introduced in v1.5.0
-that was causing spurious logging for deprecated API versions
-and sometimes failures on health checks.
-
-In addition, all error logs resulting from SOPS decryption
-failures have been sanitised.
-
-Fixes:
-- Fix secret value showing up in logs
-  [#1372](https://github.com/fluxcd/kustomize-controller/pull/1372)
-- Use lazy restmapper vendored from controller-runtime v0.19
-  [#1377](https://github.com/fluxcd/kustomize-controller/pull/1377)
-
-## 1.5.0
-
-**Release date:** 2025-02-18
-
-This minor release comes with various bug fixes and improvements.
-
-The controller has been updated to Kustomize **v5.6**, please see the
-`kubernetes-sigs/kustomize` [changelog](https://github.com/kubernetes-sigs/kustomize/releases)
-for more details.
-
-The Kustomization API now supports custom health checks for Custom
-Resources through Common Expression Language (CEL) expressions.
-See [docs](https://fluxcd.io/flux/components/kustomize/kustomizations/#health-check-expressions).
-
-The controller now sends an origin revision from OCI artifact
-annotations to notification-controller on events, which is
-useful for updating commit statuses on the notification
-providers that support this feature.
-See [docs](https://fluxcd.io/flux/cheatsheets/oci-artifacts/#git-commit-status-updates).
-
-It is now also possible to control whether or not kustomize-controller
-will orphan resources when a Kustomization is deleted.
-See [docs](https://fluxcd.io/flux/components/kustomize/kustomizations/#deletion-policy).
-
-In addition, the Kubernetes dependencies have been updated to v1.32.1 and
-various other controller dependencies have been updated to their latest
-version.
-
-Fixes:
-- Clarify precedence in Kustomization substituteFrom
-  [#1301](https://github.com/fluxcd/kustomize-controller/pull/1301)
-- Remove deprecated object metrics from controllers
-  [#1305](https://github.com/fluxcd/kustomize-controller/pull/1305)
-
-Improvements:
-- Enable decryption of secrets generated by Kustomize components
-  [#1283](https://github.com/fluxcd/kustomize-controller/pull/1283)
-- Added decryption of Kustomize patches and refactor SOPS tests
-  [#1286](https://github.com/fluxcd/kustomize-controller/pull/1286)
-- Allow control of finalization garbage collection
-  [#1314](https://github.com/fluxcd/kustomize-controller/pull/1314)
-- Add OCI revision to events
-  [#1338](https://github.com/fluxcd/kustomize-controller/pull/1338)
-- [RFC-0009] Add CEL custom healthchecks
-  [#1344](https://github.com/fluxcd/kustomize-controller/pull/1344)
-- Add GroupChangeLog feature gate to fix es indexing cardinality
-  [#1361](https://github.com/fluxcd/kustomize-controller/pull/1361)
-- Various dependency updates
-  [#1302](https://github.com/fluxcd/kustomize-controller/pull/1302)
-  [#1304](https://github.com/fluxcd/kustomize-controller/pull/1304)
-  [#1310](https://github.com/fluxcd/kustomize-controller/pull/1310)
-  [#1313](https://github.com/fluxcd/kustomize-controller/pull/1313)
-  [#1318](https://github.com/fluxcd/kustomize-controller/pull/1318)
-  [#1320](https://github.com/fluxcd/kustomize-controller/pull/1320)
-  [#1330](https://github.com/fluxcd/kustomize-controller/pull/1330)
-  [#1348](https://github.com/fluxcd/kustomize-controller/pull/1348)
-  [#1352](https://github.com/fluxcd/kustomize-controller/pull/1352)
-  [#1354](https://github.com/fluxcd/kustomize-controller/pull/1354)
-  [#1359](https://github.com/fluxcd/kustomize-controller/pull/1359)
-  [#1362](https://github.com/fluxcd/kustomize-controller/pull/1362)
-  [#1364](https://github.com/fluxcd/kustomize-controller/pull/1364)
-  [#1358](https://github.com/fluxcd/kustomize-controller/pull/1358)
-
-## 1.4.0
-
-**Release date:** 2024-09-27
-
-This minor release comes with various bug fixes and improvements.
-
-kustomize-controller in [sharded
-deployment](https://fluxcd.io/flux/installation/configuration/sharding/)
-configuration now supports cross-shard dependency check. This allows a
-Kustomization to depend on other Kustomizations managed by different controller
-shards.
-
-In addition, the Kubernetes dependencies have been updated to v1.31.1 and
-various other controller dependencies have been updated to their latest version.
-The controller is now built with Go 1.23.
-
-Fixes:
-- Fix incorrect use of format strings with the conditions package.
-  [#1198](https://github.com/fluxcd/kustomize-controller/pull/1198)
-
-Improvements:
-- Update Bucket API to v1
-  [#1253](https://github.com/fluxcd/kustomize-controller/pull/1253)
-- Allow cross-shard dependency check
-  [#1248](https://github.com/fluxcd/kustomize-controller/pull/1248)
-- docs: Clarify .spec.decryption.secretRef usage
-  [#1242](https://github.com/fluxcd/kustomize-controller/pull/1242)
-- Build with Go 1.23
-  [#1230](https://github.com/fluxcd/kustomize-controller/pull/1230)
-- Various dependency updates
-  [#1165](https://github.com/fluxcd/kustomize-controller/pull/1165)
-  [#1181](https://github.com/fluxcd/kustomize-controller/pull/1181)
-  [#1212](https://github.com/fluxcd/kustomize-controller/pull/1212)
-  [#1228](https://github.com/fluxcd/kustomize-controller/pull/1228)
-  [#1229](https://github.com/fluxcd/kustomize-controller/pull/1229)
-  [#1233](https://github.com/fluxcd/kustomize-controller/pull/1233)
-  [#1239](https://github.com/fluxcd/kustomize-controller/pull/1239)
-  [#1240](https://github.com/fluxcd/kustomize-controller/pull/1240)
-  [#1243](https://github.com/fluxcd/kustomize-controller/pull/1243)
-  [#1249](https://github.com/fluxcd/kustomize-controller/pull/1249)
-  [#1250](https://github.com/fluxcd/kustomize-controller/pull/1250)
-  [#1251](https://github.com/fluxcd/kustomize-controller/pull/1251)
-
-## 1.3.0
-
-**Release date:** 2024-05-06
-
-This minor release comes with new features, improvements and bug fixes.
-
-The controller has been updated to Kustomize **v5.4**, please see the
-`kubernetes-sigs/kustomize` [changelog](https://github.com/kubernetes-sigs/kustomize/releases)
-for more details.
-
-The Flux `Kustomization` API gains two optional fields `.spec.namePrefix` and `.spec.nameSuffix`
-that can be used to specify a prefix and suffix to be added to the names
-of all managed resources.
-
-The controller now supports the `--feature-gates=StrictPostBuildSubstitutions=true`
-flag, when enabled the post-build substitutions will fail if a
-variable without a default value is declared in files but is
-missing from the input vars.
-
-When using variable substitution with values that are numbers or booleans,
-it is now possible to covert the values to strings, for more details see the 
-[post-build documentation](https://github.com/fluxcd/kustomize-controller/blob/release/v1.3.x/docs/spec/v1/kustomizations.md#post-build-substitution-of-numbers-and-booleans).
-
-In addition, the controller dependencies have been updated to Kubernetes v1.30
-and controller-runtime v0.18. Various other dependencies have also been updated to
-their latest version to patch upstream CVEs.
-
-Lastly, the controller is now built with Go 1.22.
-
-Improvements:
-- Implement name prefix/suffix transformers
-  [#1134](https://github.com/fluxcd/kustomize-controller/pull/1134)
-- Add `StrictPostBuildSubstitutions` feature flag
-  [#1130](https://github.com/fluxcd/kustomize-controller/pull/1130)
-- Document how to use numbers and booleans in post build substitutions
-  [#1129](https://github.com/fluxcd/kustomize-controller/pull/1129)
-- Remove deprecated aad pod identity from API docs
-  [#1152](https://github.com/fluxcd/kustomize-controller/pull/1152)
-- api: Refer condition type constants from `fluxcd/pkg/apis`
-  [#1144](https://github.com/fluxcd/kustomize-controller/pull/1144)
-- Update dependencies to Kustomize v5.4.0
-  [#1128](https://github.com/fluxcd/kustomize-controller/pull/1128)
-- Various dependency updates
-  [#1155](https://github.com/fluxcd/kustomize-controller/pull/1155)
-  [#1121](https://github.com/fluxcd/kustomize-controller/pull/1121)
-  [#1139](https://github.com/fluxcd/kustomize-controller/pull/1139)
-  [#1122](https://github.com/fluxcd/kustomize-controller/pull/1122)
-
-Fixes:
-- Fix requeue warning introduced by controller-runtime
-  [#1090](https://github.com/fluxcd/kustomize-controller/pull/1090)
-- Remove effectless statement
-  [#1091](https://github.com/fluxcd/kustomize-controller/pull/1091)
-- Remove `genclient:Namespaced` tag
-  [#1092](https://github.com/fluxcd/kustomize-controller/pull/1092)
-
-## 1.2.2
-
-**Release date:** 2024-02-01
-
-This patch release comes with various bug fixes and improvements.
-
-Reconciling empty directories and directories without Kubernetes manifests no
-longer results in an error. This regressing bug was introduced with the
-controller upgrade to Kustomize v5.3 and has been fixed in this patch release.
-
-The regression due to which the namespaced objects without a namespace specified
-resulted in `not found` error instead of `namespace not specified` has also been
-fixed. And the regression due to which Roles and ClusterRoles were reconciled
-over and over due to the normalization of Roles and ClusterRoles has also been
-fixed.
-
-In addition, the Kubernetes dependencies have been updated to v1.28.6. Various
-other dependencies have also been updated to their latest version to patch
-upstream CVEs.
-
-Lastly, the controller is now built with Go 1.21.
-
-Improvements:
-- Update Go to 1.21
-  [#1053](https://github.com/fluxcd/kustomize-controller/pull/1053)
-- Various dependency updates
-  [#1076](https://github.com/fluxcd/kustomize-controller/pull/1076)
-  [#1074](https://github.com/fluxcd/kustomize-controller/pull/1074)
-  [#1070](https://github.com/fluxcd/kustomize-controller/pull/1070)
-  [#1068](https://github.com/fluxcd/kustomize-controller/pull/1068)
-  [#1065](https://github.com/fluxcd/kustomize-controller/pull/1065)
-  [#1060](https://github.com/fluxcd/kustomize-controller/pull/1060)
-  [#1059](https://github.com/fluxcd/kustomize-controller/pull/1059)
-  [#1051](https://github.com/fluxcd/kustomize-controller/pull/1051)
-  [#1049](https://github.com/fluxcd/kustomize-controller/pull/1049)
-  [#1046](https://github.com/fluxcd/kustomize-controller/pull/1046)
-  [#1044](https://github.com/fluxcd/kustomize-controller/pull/1044)
-  [#1040](https://github.com/fluxcd/kustomize-controller/pull/1040)
-  [#1038](https://github.com/fluxcd/kustomize-controller/pull/1038)
-
-## 1.2.1
-
-**Release date:** 2023-12-14
-
-This patch release comes with improvements in logging to provide faster feedback
-on any HTTP errors encountered while fetching source artifacts.
-
-In addition, the status condition messages are now trimmed to respect the size
-limit defined by the API.
-
-Improvements:
-- Update runtime to v0.43.3
-  [#1031](https://github.com/fluxcd/kustomize-controller/pull/1031)
-- Log HTTP errors to provide faster feedback
-  [#1028](https://github.com/fluxcd/kustomize-controller/pull/1028)
-
-## 1.2.0
-
-**Release date:** 2023-12-11
-
-This minor release comes with performance improvements, bug fixes and several new features.
-
-The controller has been updated from Kustomize v5.0 to **v5.3**, please the see
-`kubernetes-sigs/kustomize` [changelog](https://github.com/kubernetes-sigs/kustomize/releases)
-for a more details.
-
-Starting with this version, the controller will automatically perform a cleanup of
-the Pods belonging to stale Kubernetes Jobs after a force apply.
-
-A new controller flag `--override-manager` has been added to extend the Field Managers disallow list.
-Using this flag, cluster administrators can configure the controller to undo changes
-made with Lens and other UI tools that directly modify Kubernetes objects on clusters.
-
-In addition, the controller dependencies have been updated, including an update to Kubernetes v1.28.
-The container base image has been updated to Alpine 3.19.
-
-Improvements:
-- Update source-controller to v1.2.2
-  [#1024](https://github.com/fluxcd/kustomize-controller/pull/1024)
-- build: update Alpine to 3.19
-  [#1023](https://github.com/fluxcd/kustomize-controller/pull/1023)
-- Update Kustomize to v5.3.0
-  [#1021](https://github.com/fluxcd/kustomize-controller/pull/1021)
-- Support additional Field Managers in the disallow list
-  [#1017](https://github.com/fluxcd/kustomize-controller/pull/1017)
-- Add test for Namespace custom resource
-  [#1016](https://github.com/fluxcd/kustomize-controller/pull/1016)
-- Update controller to Kubernetes v1.28.4
-  [#1014](https://github.com/fluxcd/kustomize-controller/pull/1014)
-- Disable status poller cache by default
-  [#1012](https://github.com/fluxcd/kustomize-controller/pull/1012)
-- Tweak permissions on various created files
-  [#1005](https://github.com/fluxcd/kustomize-controller/pull/1005)
-- Cleanup pods when recreating Kubernetes Jobs
-  [#997](https://github.com/fluxcd/kustomize-controller/pull/997)
-- Update SOPS to v3.8.1
-  [#995](https://github.com/fluxcd/kustomize-controller/pull/995)
-
-## 1.1.1
-
-**Release date:** 2023-10-11
-
-This patch release contains an improvement to retry the reconciliation of a
-`Kustomization` as soon as the source artifact is available in storage.
-Which is particularly useful when the source-controller has just been upgraded.
-
-In addition, the controller can now detect immutable field errors returned by the
-Google Cloud k8s-config-connector admission controller and recreate the GCP custom
-resources annotated with `kustomize.toolkit.fluxcd.io/force: Enabled`.
-
-Improvements:
-- Update `fluxcd/pkg` dependencies
-  [#983](https://github.com/fluxcd/kustomize-controller/pull/983)
-- Bump `github.com/cyphar/filepath-securejoi`n from 0.2.3 to 0.2.4
-  [#962](https://github.com/fluxcd/kustomize-controller/pull/962)
-
-Fixes:
-- fix: Retry when artifacts are available in storage
-  [#980](https://github.com/fluxcd/kustomize-controller/pull/980)
-- fix: Consistent artifact fetching retry timing
-  [#978](https://github.com/fluxcd/kustomize-controller/pull/978)
-
-## 1.1.0
-
-**Release date:** 2023-08-23
-
-This minor release comes with performance improvements, bug fixes and several new features.
-
-The apply behaviour has been extended with two policies `IfNotPresent` and `Ignore`.
-To change the apply behaviour for specific Kubernetes resources, you can annotate them with:
-
-| Annotation                          | Default    | Values                                                         | Role            |
-|-------------------------------------|------------|----------------------------------------------------------------|-----------------|
-| `kustomize.toolkit.fluxcd.io/ssa`   | `Override` | - `Override`<br/>- `Merge`<br/>- `IfNotPresent`<br/>- `Ignore` | Apply policy    |
-| `kustomize.toolkit.fluxcd.io/force` | `Disabled` | - `Enabled`<br/>- `Disabled`                                   | Recreate policy |
-| `kustomize.toolkit.fluxcd.io/prune` | `Enabled`  | - `Enabled`<br/>- `Disabled`                                   | Delete policy   |
-
-The `IfNotPresent` policy instructs the controller to only apply the Kubernetes resources if they are not present on the cluster.
-This policy can be used for Kubernetes `Secrets` and `ValidatingWebhookConfigurations` managed by cert-manager,
-where Flux creates the resources with fields that are later on mutated by other controllers.
-
-This version improves the health checking with fail-fast behaviour
-by detecting stalled Kubernetes rollouts.
-
-In addition, the controller now stops exporting an object's
-metrics as soon as the object has been deleted.
-
-Lastly, this release introduces two controller flags:
-
-- The `--concurrent-ssa` flag sets the number of concurrent server-side apply operations
-  performed by the controller. Defaults to 4 concurrent operations per reconciliation.
-- The `--interval-jitter-percentage` flag makes the
-  controller distribute the load more evenly when multiple objects are set up
-  with the same interval. The default of this flag is set to `5`, which means
-  that the interval will be jittered by a +/- 5% random value (e.g. if the
-  interval is 10 minutes, the actual reconciliation interval will be between 9.5
-  and 10.5 minutes).
-
-Improvements:
-- Add `--concurrent-ssa` flag
-  [#948](https://github.com/fluxcd/kustomize-controller/pull/948)
-- Add `IfNotPresent` and `Ignore` SSA policies
-  [#943](https://github.com/fluxcd/kustomize-controller/pull/943)
-- controller: jitter requeue interval
-  [#940](https://github.com/fluxcd/kustomize-controller/pull/940)
-- Enable fail-fast behavior for health checks
-  [#933](https://github.com/fluxcd/kustomize-controller/pull/933)
-- Bump `fluxcd/pkg/ssa` to improve immutable error detection
-  [#932](https://github.com/fluxcd/kustomize-controller/pull/932)
-- Update dependencies
-  [#939](https://github.com/fluxcd/kustomize-controller/pull/939)
-- Update Source API to v1.1.0
-  [#952](https://github.com/fluxcd/kustomize-controller/pull/952)
-
-Fixes:
-- Handle delete before adding finalizer
-  [#930](https://github.com/fluxcd/kustomize-controller/pull/930)
-- Delete stale metrics on object delete
-  [#944](https://github.com/fluxcd/kustomize-controller/pull/944)
-
-## 1.0.1
-
-**Release date:** 2023-07-10
-
-This is a patch release that fixes spurious events emitted for skipped resources.
-
-Fixes:
-- Exclude skipped resources from apply events
-  [#920](https://github.com/fluxcd/kustomize-controller/pull/920)
-
-## 1.0.0
-
-**Release date:** 2023-07-04
-
-This is the first stable release of the controller. From now on, this controller
-follows the [Flux 2 release cadence and support pledge](https://fluxcd.io/flux/releases/).
-
-Starting with this version, the build, release and provenance portions of the
-Flux project supply chain [provisionally meet SLSA Build Level 3](https://fluxcd.io/flux/security/slsa-assessment/).
-
-This release includes several bug fixes. In addition, dependencies have been updated
-to their latest version, including an update of Kubernetes to v1.27.3.
-
-For a comprehensive list of changes since `v0.35.x`, please refer to the
-changelog for [v1.0.0-rc.1](#100-rc1), [v1.0.0-rc.2](#100-rc2),
-[v1.0.0-rc.3](#100-rc3) and [`v1.0.0-rc.4](#100-rc4).
-
-Improvements:
-- Update dependencies
-  [#908](https://github.com/fluxcd/kustomize-controller/pull/908)
-- Align `go.mod` version with Kubernetes (Go 1.20)
-  [#900](https://github.com/fluxcd/kustomize-controller/pull/900)
-
-Fixes:
-- Use kustomization namespace for empty dependency source namespace
-  [#897](https://github.com/fluxcd/kustomize-controller/pull/897)
-- docs: Clarify that targetNamespace namespace can be part of resources
-  [#896](https://github.com/fluxcd/kustomize-controller/pull/896)
-
-## 1.0.0-rc.4
-
-**Release date:** 2023-05-29
-
-This release candidate comes with support for Kustomize v5.0.3.
-
-⚠️ Note that Kustomize v5 contains breaking changes, please consult their
-[changelog](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.0.0)
-for more details.
-
-In addition, the controller dependencies have been updated to
-Kubernetes v1.27.2 and controller-runtime v0.15.0.
-
-Improvements:
-- Update Kubernetes to v1.27 and Kustomize to v5
-  [#850](https://github.com/fluxcd/kustomize-controller/pull/850)
-- Update controller-runtime to v0.15.0
-  [#869](https://github.com/fluxcd/kustomize-controller/pull/869)
-- Update CA certificates
-  [#872](https://github.com/fluxcd/kustomize-controller/pull/872)
-- Update source-controller to v1.0.0-rc.4
-  [#873](https://github.com/fluxcd/kustomize-controller/pull/873)
-
-## 1.0.0-rc.3
-
-**Release date:** 2023-05-12
-
-This release candidate comes with improved error reporting for when
-the controller fails to fetch an artifact due to a checksum mismatch.
-
-In addition, the controller dependencies have been updated to patch
-CVE-2023-1732 and the base image has been updated to Alpine 3.18.
-
-Improvements:
-- Update Alpine to 3.18
-  [#855](https://github.com/fluxcd/kustomize-controller/pull/855)
-- Update dependencies
-  [#862](https://github.com/fluxcd/kustomize-controller/pull/862)
-- build(deps): bump github.com/cloudflare/circl from 1.1.0 to 1.3.3
-  [#860](https://github.com/fluxcd/kustomize-controller/pull/860)
-- docs: Clarify the Kustomize components relative paths requirement
-  [#861](https://github.com/fluxcd/kustomize-controller/pull/861)
-
-## 1.0.0-rc.2
-
-**Release date:** 2023-05-09
-
-This release candidate fixes secrets decryption when using Azure Key Vault.
-
-In addition, the controller dependencies have been updated to their latest
-versions.
-
-Improvements:
-- Fix SOPS azkv envCred
-  [#838](https://github.com/fluxcd/kustomize-controller/pull/838)
-- Update dependencies
-  [#853](https://github.com/fluxcd/kustomize-controller/pull/853)
-
-## 1.0.0-rc.1
-
-**Release date:** 2023-04-03
-
-This release candidate promotes the `Kustomization` API from `v1beta2` to `v1`.
-The controller now supports horizontal scaling using
-sharding based on a label selector.
-
-In addition, the controller now supports Workload Identity when
-decrypting secrets with SOPS and Azure Vault.
-
-### Highlights
-
-This release candidate requires the `GitRepository` API version `v1`,
-first shipped with [source-controller](https://github.com/fluxcd/source-controller)
-v1.0.0-rc.1.
-
-#### API changes
-
-The `Kustomization` kind was promoted from v1beta2 to v1 (GA) and deprecated fields were removed.
-
-A new optional field called `CommonMetadata` was added to the API
-for setting labels and/or annotations to all resources part of a Kustomization.
-The main difference to the Kustomize
-[commonLabels](https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/commonlabels/) and
-[commonAnnotations](https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/commonannotations/),
-is that the controller sets the labels and annotations only to the top level `metadata` field,
-without patching the Kubernetes Deployment `spec.template` or the Service `spec.selector`.
-
-The `kustomizations.kustomize.toolkit.fluxcd.io` CRD contains the following versions:
-- v1 (storage version)
-- v1beta2 (deprecated)
-- v1beta1 (deprecated)
-
-#### Upgrade procedure
-
-The `Kustomization` v1 API is backwards compatible with v1beta2, except for the following:
-- the deprecated field `.spec.validation` was removed
-- the deprecated field `.spec.patchesStrategicMerge` was removed (replaced by `.spec.patches`)
-- the deprecated field `.spec.patchesJson6902 ` was removed (replaced by `.spec.patches`)
-
-To upgrade from v1beta2, after deploying the new CRD and controller,
-set  `apiVersion: kustomize.toolkit.fluxcd.io/v1` in the YAML files that contain
-`Kustomization` definitions and remove the deprecated fields if any.
-Bumping the API version in manifests can be done gradually.
-It is advised to not delay this procedure as the beta versions will be removed after 6 months.
-
-#### Sharding
-
-Starting with this release, the controller can be configured with
-`--watch-label-selector`, after which only objects with this label will
-be reconciled by the controller.
-
-This allows for horizontal scaling, where kustomize-controller
-can be deployed multiple times with a unique label selector
-which is used as the sharding key.
-
-### Full changelog
-
-Improvements:
-- GA: Promote Kustomization API to `kustomize.toolkit.fluxcd.io/v1`
-  [#822](https://github.com/fluxcd/kustomize-controller/pull/822)
-- Add common labels and annotations patching capabilities
-  [#817](https://github.com/fluxcd/kustomize-controller/pull/817)
-- Add reconciler sharding capability based on label selector
-  [#821](https://github.com/fluxcd/kustomize-controller/pull/821)
-- Support Workload Identity for Azure Vault
-  [#813](https://github.com/fluxcd/kustomize-controller/pull/813)
-- Verify Digest of Artifact
-  [#818](https://github.com/fluxcd/kustomize-controller/pull/818)
-- Move `controllers` to `internal/controllers`
-  [#820](https://github.com/fluxcd/kustomize-controller/pull/820)
-- build(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5
-  [#824](https://github.com/fluxcd/kustomize-controller/pull/824)
-
-## 0.35.1
-
-**Release date:** 2023-03-20
-
-This prerelease comes with a fix to error reporting.
-The controller will now reveal validation errors when force applying
-resources with immutable field changes.
-
-In addition, the controller dependencies have been updated to their latest
-versions.
-
-Improvements:
-- Update dependencies
-  [#814](https://github.com/fluxcd/kustomize-controller/pull/814)
-
-## 0.35.0
-
-**Release date:** 2023-03-08
-
-This prerelease adds support for disabling the cache of the `kstatus` status
-poller, which is used to determine the health of the resources applied by the
-controller. To disable the cache, configure the Deployment of the controller
-with `--feature-gates=DisableStatusPollerCache=true`.
-
-This may have a positive impact on memory usage on large clusters with many
-objects, at the cost of an increased number of API calls.
-
-In addition, `klog` has been configured to log using the same logger as the
-rest of the controller (providing a consistent log format).
-
-Lastly, the controller is now built using Go `1.20`, and the dependencies have
-been updated to their latest versions.
-
-Improvements:
-- api: update description LastAppliedRevision
-  [#798](https://github.com/fluxcd/kustomize-controller/pull/798)
-- Update Go to 1.20
-  [#806](https://github.com/fluxcd/kustomize-controller/pull/806)
-- Update dependencies
-  [#807](https://github.com/fluxcd/kustomize-controller/pull/807)
-  [#811](https://github.com/fluxcd/kustomize-controller/pull/811)
-- Use `logger.SetLogger` to also configure `klog`
-  [#809](https://github.com/fluxcd/kustomize-controller/pull/809)
-
-## 0.34.0
-
-**Release date:** 2023-02-17
-
-This prerelease adds support for parsing the
-[RFC-0005](https://github.com/fluxcd/flux2/tree/main/rfcs/0005-artifact-revision-and-digest)
-revision format produced by source-controller `>=v0.35.0`.
-
-In addition, the controller dependencies have been updated to their latest
-versions.
-
-Improvements:
-- Support RFC-0005 revision format
-  [#793](https://github.com/fluxcd/kustomize-controller/pull/793)
-- Update dependencies
-  [#796](https://github.com/fluxcd/kustomize-controller/pull/796)
-
-## 0.33.0
-
-**Release date:** 2023-02-01
-
-This prerelease comes with support for recreating immutable resources (e.g. Kubernetes Jobs)
-by annotating or labeling them with `kustomize.toolkit.fluxcd.io/force: enabled`.
-
-The caching of Secret and ConfigMap resources has been disabled to improve memory usage.
-To opt-out from this behavior, start the controller with: `--feature-gates=CacheSecretsAndConfigMaps=true`.
-
-In addition, the controller dependencies have been updated to
-Kubernetes v1.26.1 and controller-runtime v0.14.2. The controller base image has 
-been updated to Alpine 3.17 (which contains CVE fixes for OS packages).
-
-Improvements:
-- Allow force apply to be configured in metadata
-  [#787](https://github.com/fluxcd/kustomize-controller/pull/787)
-- Disable caching of Secrets and ConfigMaps
-  [#789](https://github.com/fluxcd/kustomize-controller/pull/789)
-- build: Enable SBOM and SLSA Provenance
-  [#787](https://github.com/fluxcd/kustomize-controller/pull/788)
-- build: Update Alpine to 3.17
-  [#786](https://github.com/fluxcd/kustomize-controller/pull/786)
-- build: pdate source-controller/api to v0.34.0
-  [#790](https://github.com/fluxcd/kustomize-controller/pull/790)
-- build: Download CRD deps only when necessary
-  [#783](https://github.com/fluxcd/kustomize-controller/pull/783)
-- test: Enable kstatus checks
-  [#784](https://github.com/fluxcd/kustomize-controller/pull/784)
-
-## 0.32.0
-
-**Release date:** 2022-12-20
-
-This prerelease comes with experimental support for
-[Kustomize components](https://github.com/fluxcd/kustomize-controller/blob/v0.32.0/docs/spec/v1beta2/kustomization.md#components).
-
-In addition, the AWS and Google Cloud KMS dependencies have been updated
-to match the latest stable release from upstream.
-
-Improvements:
-- Add support for Kustomize components
-  [#754](https://github.com/fluxcd/kustomize-controller/pull/754)
-- Update dependencies
-  [#780](https://github.com/fluxcd/kustomize-controller/pull/780)
-- Document the behaviour of atomic fields with server-side apply
-  [#774](https://github.com/fluxcd/kustomize-controller/pull/774)
-- fuzz: Use build script from upstream and fix fuzzers
-  [#777](https://github.com/fluxcd/kustomize-controller/pull/777)
-- build: Fix cifuzz tests and improve fuzz tests' reliability
-  [#771](https://github.com/fluxcd/kustomize-controller/pull/771)
-- build: update dockertest to Go Mod compatible v3
-  [#776](https://github.com/fluxcd/kustomize-controller/pull/776)
-
-## 0.31.0
-
-**Release date:** 2022-11-18
-
-This prerelease comes with improvements to the manifests
-generation component. The Kustomize overlay build logic has been
-factored out into `github.com/fluxcd/pkg/kustomize` so that both
-the controller and the Flux CLI (`flux buid kustomization`)
-share the same code base.
-
-In addition, the controller dependencies have been updated to
-Kubernetes v1.25.4 and controller-runtime v0.13.1.
-The Azure Vault SDK used for secrets decryption has been updated
-to match the latest stable release from upstream.
-
-Improvements:
-- Refactor: Generate manifests with `flux/pkg/kustomize`
-  [#763](https://github.com/fluxcd/kustomize-controller/pull/763)
-- Update `keyvault/azkeys` Azure SDK to v0.9.0
-  [#759](https://github.com/fluxcd/kustomize-controller/pull/759)
-- Update Source API to v0.32.1
-  [#768](https://github.com/fluxcd/kustomize-controller/pull/768)
-- Update dependencies
-  [#767](https://github.com/fluxcd/kustomize-controller/pull/767)
-- Use Flux Event API v1beta1
-  [#758](https://github.com/fluxcd/kustomize-controller/pull/758)
-- build: Bump gpg to alpine's edge
-  [#760](https://github.com/fluxcd/kustomize-controller/pull/760)
-- build: Remove nsswitch.conf creation
-  [#765](https://github.com/fluxcd/kustomize-controller/pull/765)
-
-Fixes:
-- Don't override the reconcile error on status patching
-  [#761](https://github.com/fluxcd/kustomize-controller/pull/761)
-
-## 0.30.0
-
-**Release date:** 2022-10-21
-
-This prerelease comes with new status condition named `Reconciling` which improves
-the observability for the actions performed by the controller during a reconciliation run.
-The `Kustomization.status.conditions` have been aligned with Kubernetes
-standard conditions and kstatus.
-
-In addition, the controller memory usage was reduced by 90% when performing artifact
-operations and can now better handle the reconciliation of large sources in-parallel.
-
-Improvements:
-- Optimise the memory usage of artifact operations
-  [#747](https://github.com/fluxcd/kustomize-controller/pull/747)
-- Refactor: Adopt Flux runtime conditions and status standards
-  [#745](https://github.com/fluxcd/kustomize-controller/pull/745)
-- Refactor: Remove docs which overlap with Flux website
-  [#746](https://github.com/fluxcd/kustomize-controller/pull/746)
-- Refactor: Move inventory helpers to internal package
-  [#744](https://github.com/fluxcd/kustomize-controller/pull/744)
-- Refactor: Acquire artifacts with `fluxcd/pkg/http/fetch`
-  [#743](https://github.com/fluxcd/kustomize-controller/pull/743)
-- Refactor: Use impersonation from `fluxcd/pkg/runtime/client`
-  [#742](https://github.com/fluxcd/kustomize-controller/pull/742)
-- Refactor: Extract generator to internal package
-  [#740](https://github.com/fluxcd/kustomize-controller/pull/740)
-- Refactor: Extract decrytor to internal package
-  [#739](https://github.com/fluxcd/kustomize-controller/pull/739)
-- Support alternative kustomization file names
-  [#738](https://github.com/fluxcd/kustomize-controller/pull/738)
-- API: allow configuration of `h` unit for timeouts
-  [#749](https://github.com/fluxcd/kustomize-controller/pull/749)
-- Update dependencies
-  [#750](https://github.com/fluxcd/kustomize-controller/pull/750)
-
-## 0.29.0
-
-**Release date:** 2022-09-29
-
-This prerelease comes with strict validation rules for API fields which define a
-(time) duration. Effectively, this means values without a time unit (e.g. `ms`,
-`s`, `m`, `h`) will now be rejected by the API server. To stimulate sane
-configurations, the units `ns`, `us` and `µs` can no longer be configured, nor
-can `h` be set for fields defining a timeout value.
-
-In addition, the controller dependencies have been updated
-to Kubernetes controller-runtime v0.13.
-
-:warning: **Breaking changes:**
-- `.spec.interval` new validation pattern is `"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"`
-- `.spec.retryInterval` new validation pattern is `"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"`
-- `.spec.timeout` new validation pattern is `"^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"`
-
-Improvements:
-- api: add custom validation for v1.Duration types
-  [#731](https://github.com/fluxcd/kustomize-controller/pull/731)
-- Build with Go 1.19
-  [#733](https://github.com/fluxcd/kustomize-controller/pull/733)
-- Update dependencies
-  [#735](https://github.com/fluxcd/kustomize-controller/pull/735)
-
-Fixes:
-- Fix health checking for global objects
-  [#730](https://github.com/fluxcd/kustomize-controller/pull/730)
-
-## 0.28.0
-
-**Release date:** 2022-09-12
-
-This prerelease comes with improvements to reconciling Kubernetes class type objects,
-SOPS decryption and fuzzing. In addition, the controller dependencies have been updated
-to Kubernetes controller-runtime v0.12.
-
-:warning: **Breaking change:** The controller logs have been aligned
-with the Kubernetes structured logging. For more details on the new logging
-structure please see: [fluxcd/flux2#3051](https://github.com/fluxcd/flux2/issues/3051).
-
-Improvements:
-- Align controller logs to Kubernetes structured logging
-  [#718](https://github.com/fluxcd/kustomize-controller/pull/718)
-- Reconcile Kubernetes class type objects in a dedicated stage
-  [#720](https://github.com/fluxcd/kustomize-controller/pull/720)
-- Sort SOPS masterkeys so offline decrypt methods are tried first
-  [#726](https://github.com/fluxcd/kustomize-controller/pull/726)
-- SOPS: Update the AWS SDK for KMS
-  [#721](https://github.com/fluxcd/kustomize-controller/pull/721)
-- Refactor Fuzzers based on Go native fuzzing
-  [#723](https://github.com/fluxcd/kustomize-controller/pull/723)
-- Fuzz optimisations
-  [#722](https://github.com/fluxcd/kustomize-controller/pull/722)
-- Update dependencies
-  [#724](https://github.com/fluxcd/kustomize-controller/pull/724)
-
-## 0.27.1
-
-**Release date:** 2022-08-29
-
-This prerelease comes with panic recovery,
-to protect the controller from crashing when reconciliations lead to a crash.
-
-In addition, the controller dependencies have been updated to Kubernetes v1.25.0.
-
-Improvements:
-- Enable RecoverPanic option on reconciler
-  [#708](https://github.com/fluxcd/kustomize-controller/pull/708)
-- Update Kubernetes packages to v1.25.0
-  [#714](https://github.com/fluxcd/kustomize-controller/pull/714)
-- Add file path to sops decryption errors
-  [#706](https://github.com/fluxcd/kustomize-controller/pull/706)
-- Update doc on target namespace
-  [#712](https://github.com/fluxcd/kustomize-controller/pull/712)
-
-## 0.27.0
-
-**Release date:** 2022-08-08
-
-This prerelease comes with support for the `OCIRepository` source type.
-
-In addition, the controller has been updated to Kubernetes v1.24.3
-and Kustomize v4.5.7.
-
-Features:
-- Add support for OCIRepository sources
-  [#684](https://github.com/fluxcd/kustomize-controller/pull/684)
-
-Improvements:
-- Update dependencies
-  [#704](https://github.com/fluxcd/kustomize-controller/pull/704)
-
 ## 0.26.3
 
 **Release date:** 2022-07-13
@@ -2320,7 +1443,7 @@ using the [notification.fluxcd.io API](https://github.com/fluxcd/notification-co
 **Release date:** 2020-06-24
 
 This is the first prerelease ready for public testing. To get started
-testing, see the [GitOps Toolkit guide](https://fluxcd.io/flux/get-started/).
+testing, see the [GitOps Toolkit guide](https://fluxcd.io/docs/get-started/).
 
 ## 0.0.1-beta.2
 

DEVELOPMENT.md

@@ -1,6 +1,6 @@
 # Development
 
-> **Note:** Please take a look at <https://fluxcd.io/contributing/flux/>
+> **Note:** Please take a look at <https://fluxcd.io/docs/contributing/flux/>
 > to find out about how to contribute to Flux and how to interact with the
 > Flux Development team.
 
@@ -13,10 +13,19 @@ There are a number of dependencies required to be able to run the controller and
 - [Install Docker](https://docs.docker.com/engine/install/)
 - (Optional) [Install Kubebuilder](https://book.kubebuilder.io/quick-start.html#installation)
 
+In addition to the above, the following dependencies are also used by some of the `make` targets:
+
+- `controller-gen` (v0.7.0)
+- `gen-crd-api-reference-docs` (v0.3.0)
+- `setup-envtest` (latest)
+- `sops` (v3.7.2)
+
+If any of the above dependencies are not present on your system, the first invocation of a `make` target that requires them will install them.
+
 ## How to run the test suite
 
 Prerequisites:
-* Go >= 1.24
+* Go >= 1.18
 
 You can run the test suite by simply doing
 

Dockerfile

@@ -1,9 +1,9 @@
-ARG GO_VERSION=1.24
-ARG XX_VERSION=1.6.1
+ARG GO_VERSION=1.18
+ARG XX_VERSION=1.1.0
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine as builder
 
 # Copy the build utilities.
 COPY --from=xx / /
@@ -24,21 +24,23 @@ RUN go mod download
 
 # copy source code
 COPY main.go main.go
+COPY controllers/ controllers/
 COPY internal/ internal/
 
 # build
 ENV CGO_ENABLED=0
-RUN xx-go build -trimpath -a -o kustomize-controller main.go
+RUN xx-go build -a -o kustomize-controller main.go
 
-FROM alpine:3.21
+FROM alpine:3.16
 
-ARG TARGETPLATFORM
-
-RUN apk --no-cache add ca-certificates tini git openssh-client gnupg \
-  && update-ca-certificates
+RUN apk add --no-cache ca-certificates tini git openssh-client gnupg
 
 COPY --from=builder /workspace/kustomize-controller /usr/local/bin/
 
+# Create minimal nsswitch.conf file to prioritize the usage of /etc/hosts over DNS queries.
+# https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 USER 65534:65534
 
 ENV GNUPGHOME=/tmp

Makefile

@@ -5,16 +5,12 @@ CRD_OPTIONS ?= crd:crdVersions=v1
 SOURCE_VER ?= $(shell go list -m all | grep github.com/fluxcd/source-controller/api | awk '{print $$2}')
 
 # Use the same version of SOPS already referenced on go.mod
-SOPS_VER := $(shell go list -m all | grep github.com/getsops/sops | awk '{print $$2}')
+SOPS_VER := $(shell go list -m all | grep go.mozilla.org/sops | awk '{print $$2}')
 
 # Repository root based on Git metadata
 REPOSITORY_ROOT := $(shell git rev-parse --show-toplevel)
 BUILD_DIR := $(REPOSITORY_ROOT)/build
 
-# FUZZ_TIME defines the max amount of time, in Go Duration,
-# each fuzzer should run for.
-FUZZ_TIME ?= 1m
-
 # If gobin not set, create one on ./build and add to path.
 ifeq (,$(shell go env GOBIN))
 GOBIN=$(BUILD_DIR)/gobin
@@ -34,19 +30,6 @@ BUILD_PLATFORMS ?= linux/amd64
 # Architecture to use envtest with
 ENVTEST_ARCH ?= amd64
 
-# Paths to download the CRD dependencies at.
-GITREPO_CRD ?= config/crd/bases/gitrepositories.yaml
-BUCKET_CRD ?= config/crd/bases/buckets.yaml
-OCIREPO_CRD ?= config/crd/bases/ocirepositories.yaml
-
-# Keep a record of the version of the downloaded source CRDs. It is used to
-# detect and download new CRDs when the SOURCE_VER changes.
-SOURCE_CRD_VER=$(BUILD_DIR)/.src-crd-$(SOURCE_VER)
-
-# API (doc) generation utilities
-CONTROLLER_GEN_VERSION ?= v0.16.1
-GEN_API_REF_DOCS_VERSION ?= e327d0730470cbd61b06300f81c5fcf91c23c113
-
 all: manager
 
 # Download the envtest binaries to testbin
@@ -58,7 +41,7 @@ install-envtest: setup-envtest
 
 SOPS = $(GOBIN)/sops
 $(SOPS): ## Download latest sops binary if none is found.
-	$(call go-install-tool,$(SOPS),github.com/getsops/sops/v3/cmd/sops@$(SOPS_VER))
+	$(call go-install-tool,$(SOPS),go.mozilla.org/sops/v3/cmd/sops@$(SOPS_VER))
 
 # Run controller tests
 KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
@@ -73,29 +56,11 @@ manager: generate fmt vet
 run: generate fmt vet manifests
 	go run ./main.go --metrics-addr=:8089
 
-# Delete previously downloaded CRDs and record the new version of the source
-# CRDs.
-$(SOURCE_CRD_VER):
-	rm -f $(BUILD_DIR)/.src-crd*
-	$(MAKE) cleanup-crd-deps
-	if ! test -d "$(BUILD_DIR)"; then mkdir -p $(BUILD_DIR); fi
-	touch $(SOURCE_CRD_VER)
-
-$(GITREPO_CRD):
-	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml -o $(GITREPO_CRD)
-
-$(BUCKET_CRD):
-	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_buckets.yaml -o $(BUCKET_CRD)
-
-$(OCIREPO_CRD):
-	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_ocirepositories.yaml -o $(OCIREPO_CRD)
-
 # Download the CRDs the controller depends on
-download-crd-deps: $(SOURCE_CRD_VER) $(GITREPO_CRD) $(BUCKET_CRD) $(OCIREPO_CRD)
-
-# Delete the downloaded CRD dependencies.
-cleanup-crd-deps:
-	rm -f $(GITREPO_CRD) $(BUCKET_CRD) $(OCIREPO_CRD)
+download-crd-deps:
+	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml > config/crd/bases/gitrepositories.yaml
+	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_buckets.yaml > config/crd/bases/buckets.yaml
+	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_ocirepositories.yaml > config/crd/bases/ocirepositories.yaml
 
 # Install CRDs into a cluster
 install: manifests
@@ -131,12 +96,12 @@ manifests: controller-gen
 
 # Generate API reference documentation
 api-docs: gen-crd-api-reference-docs
-	$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v1 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/v1/kustomize.md
+	$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v1beta2 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/kustomize.md
 
 # Run go mod tidy
 tidy:
-	cd api; rm -f go.sum; go mod tidy -compat=1.24
-	rm -f go.sum; go mod tidy -compat=1.24
+	cd api; rm -f go.sum; go mod tidy -compat=1.18
+	rm -f go.sum; go mod tidy -compat=1.18
 
 # Run go fmt against code
 fmt:
@@ -171,13 +136,13 @@ docker-deploy:
 CONTROLLER_GEN = $(GOBIN)/controller-gen
 .PHONY: controller-gen
 controller-gen: ## Download controller-gen locally if necessary.
-	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_GEN_VERSION))
+	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.7.0)
 
 # Find or download gen-crd-api-reference-docs
 GEN_CRD_API_REFERENCE_DOCS = $(GOBIN)/gen-crd-api-reference-docs
 .PHONY: gen-crd-api-reference-docs
-gen-crd-api-reference-docs: ## Download gen-crd-api-reference-docs locally if necessary
-	$(call go-install-tool,$(GEN_CRD_API_REFERENCE_DOCS),github.com/ahmetb/gen-crd-api-reference-docs@$(GEN_API_REF_DOCS_VERSION))
+gen-crd-api-reference-docs:
+	$(call go-install-tool,$(GEN_CRD_API_REFERENCE_DOCS),github.com/ahmetb/gen-crd-api-reference-docs@v0.3.0)
 
 ENVTEST = $(GOBIN)/setup-envtest
 .PHONY: envtest
@@ -198,29 +163,21 @@ rm -rf $$TMP_DIR ;\
 }
 endef
 
-# Build fuzzers used by oss-fuzz.
+# Build fuzzers
 fuzz-build:
 	rm -rf $(BUILD_DIR)/fuzz/
 	mkdir -p $(BUILD_DIR)/fuzz/out/
 
-	docker build . --pull --tag local-fuzzing:latest -f tests/fuzz/Dockerfile.builder
+	docker build . --tag local-fuzzing:latest -f tests/fuzz/Dockerfile.builder
 	docker run --rm \
 		-e FUZZING_LANGUAGE=go -e SANITIZER=address \
 		-e CIFUZZ_DEBUG='True' -e OSS_FUZZ_PROJECT_NAME=fluxcd \
-		-v "$(shell go env GOMODCACHE):/root/go/pkg/mod" \
 		-v "$(BUILD_DIR)/fuzz/out":/out \
 		local-fuzzing:latest
 
-# Run each fuzzer once to ensure they will work when executed by oss-fuzz.
 fuzz-smoketest: fuzz-build
 	docker run --rm \
 		-v "$(BUILD_DIR)/fuzz/out":/out \
 		-v "$(shell pwd)/tests/fuzz/oss_fuzz_run.sh":/runner.sh \
 		local-fuzzing:latest \
 		bash -c "/runner.sh"
-
-# Run fuzz tests for the duration set in FUZZ_TIME.
-fuzz-native: 
-	KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) \
-	FUZZ_TIME=$(FUZZ_TIME) \
-		./tests/fuzz/native_go_run.sh

PROJECT

@@ -1,9 +1,6 @@
 domain: toolkit.fluxcd.io
 repo: github.com/fluxcd/kustomize-controller
 resources:
-- group: kustomize
-  kind: Kustomization
-  version: v1
 - group: kustomize
   kind: Kustomization
   version: v1beta2

README.md

@@ -6,50 +6,328 @@
 [![license](https://img.shields.io/github/license/fluxcd/kustomize-controller.svg)](https://github.com/fluxcd/kustomize-controller/blob/main/LICENSE)
 [![release](https://img.shields.io/github/release/fluxcd/kustomize-controller/all.svg)](https://github.com/fluxcd/kustomize-controller/releases)
 
-The kustomize-controller is a [Flux](https://github.com/fluxcd/flux2) component,
-specialized in running continuous delivery pipelines for infrastructure and workloads
+The kustomize-controller is a Kubernetes operator, specialized in running 
+continuous delivery pipelines for infrastructure and workloads
 defined with Kubernetes manifests and assembled with Kustomize.
 
-The cluster desired state is described through a Kubernetes Custom Resource named `Kustomization`.
-Based on the creation, mutation or removal of a `Kustomization` resource in the cluster,
-the controller performs actions to reconcile the cluster current state with the desired state.
-
 ![overview](docs/diagrams/kustomize-controller-overview.png)
 
-## Features
-
+Features:
 * watches for `Kustomization` objects
 * fetches artifacts produced by [source-controller](https://github.com/fluxcd/source-controller) from `Source` objects 
 * watches `Source` objects for revision changes 
 * generates the `kustomization.yaml` file if needed
-* generates Kubernetes manifests with Kustomize SDK
-* decrypts Kubernetes secrets with Mozilla SOPS and KMS
-* validates the generated manifests with Kubernetes server-side apply dry-run
-- detects drift between the desired and state and cluster state
-- corrects drift by patching objects with Kubernetes server-side apply
+* generates Kubernetes manifests with kustomize build
+* decrypts Kubernetes secrets with Mozilla SOPS
+* validates the build output with server-side apply dry-run
+* applies the generated manifests on the cluster
 * prunes the Kubernetes objects removed from source
 * checks the health of the deployed workloads
 * runs `Kustomizations` in a specific order, taking into account the depends-on relationship 
 * notifies whenever a `Kustomization` status changes
 
-## Specifications
-
-* [API](docs/spec/v1/README.md)
+Specifications:
+* [API](docs/spec/v1beta2/README.md)
 * [Controller](docs/spec/README.md)
 
-## Guides
+## Usage
 
-* [Get started with Flux](https://fluxcd.io/flux/get-started/)
-* [Setup Notifications](https://fluxcd.io/flux/guides/notifications/)
-* [Manage Kubernetes secrets with Flux and SOPS](https://fluxcd.io/flux/guides/mozilla-sops/)
-* [How to build, publish and consume OCI Artifacts with Flux](https://fluxcd.io/flux/cheatsheets/oci-artifacts/)
-* [Flux and Kustomize FAQ](https://fluxcd.io/flux/faq/#kustomize-questions)
+The kustomize-controller is part of a composable [GitOps toolkit](https://fluxcd.io/docs/components/)
+and depends on [source-controller](https://github.com/fluxcd/source-controller)
+to acquire the Kubernetes manifests from Git repositories and S3 compatible storage buckets.
 
-## Roadmap
+### Install the toolkit controllers
 
-The roadmap for the Flux family of projects can be found at <https://fluxcd.io/roadmap/>.
+Download the flux CLI:
 
-## Contributing
+```bash
+curl -s https://fluxcd.io/install.sh | sudo bash
+```
 
-This project is Apache 2.0 licensed and accepts contributions via GitHub pull requests.
-To start contributing please see the [development guide](DEVELOPMENT.md).
+Install the toolkit controllers in the `flux-system` namespace:
+
+```bash
+flux install
+```
+
+### Define a Git repository source
+
+Create a source object that points to a Git repository containing Kubernetes and Kustomize manifests:
+
+```yaml
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: podinfo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/stefanprodan/podinfo
+  ref:
+    branch: master
+```
+
+For private repositories, SSH or token based authentication can be
+[configured with Kubernetes secrets](https://github.com/fluxcd/source-controller/blob/master/docs/spec/v1beta1/gitrepositories.md).
+
+Save the above file and apply it on the cluster.
+You can wait for the source controller to assemble an artifact from the head of the repo master branch with:
+
+```bash
+kubectl -n flux-system wait gitrepository/podinfo --for=condition=ready
+```
+
+The source controller will check for new commits in the master branch every minute. You can force a git sync with:
+
+```bash
+kubectl -n flux-system annotate --overwrite gitrepository/podinfo reconcile.fluxcd.io/requestedAt="$(date +%s)"
+```
+
+### Define a kustomization
+
+Create a kustomization object that uses the git repository defined above:
+
+```yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: podinfo-dev
+  namespace: flux-system
+spec:
+  interval: 5m
+  path: "./deploy/overlays/dev/"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: podinfo
+  healthChecks:
+    - kind: Deployment
+      name: frontend
+      namespace: dev
+    - kind: Deployment
+      name: backend
+      namespace: dev
+  timeout: 80s
+```
+
+> **Note** that if your repository contains only plain Kubernetes manifests, the controller will
+> [automatically generate](docs/spec/v1beta1/kustomization.md#generate-kustomizationyaml)
+> a kustomization.yaml file inside the specified path.
+
+A detailed explanation of the Kustomization object and its fields
+can be found in the [specification doc](docs/spec/v1beta1/README.md). 
+
+Based on the above definition, the kustomize-controller fetches the Git repository content from source-controller,
+generates Kubernetes manifests by running kustomize build inside `./deploy/overlays/dev/`,
+and validates them with a dry-run apply. If the manifests pass validation, the controller will apply them 
+on the cluster and starts the health assessment of the deployed workload. If the health checks are passing, the
+Kustomization object status transitions to a ready state.
+
+![workflow](docs/diagrams/kustomize-controller-flow.png)
+
+You can wait for the kustomize controller to complete the deployment with:
+
+```bash
+kubectl -n flux-system wait kustomization/podinfo-dev --for=condition=ready
+```
+
+When the controller finishes the reconciliation, it will log the applied objects:
+
+```bash
+kubectl -n flux-system logs deploy/kustomize-controller | jq .
+```
+
+```json
+{
+  "level": "info",
+  "ts": "2020-09-17T07:27:11.921Z",
+  "logger": "controllers.Kustomization",
+  "msg": "Kustomization applied in 1.436096591s",
+  "kustomization": "flux-system/podinfo-dev",
+  "output": {
+    "namespace/dev": "created",
+    "service/dev/frontend": "created",
+    "deployment/dev/frontend": "created",
+    "horizontalpodautoscaler/dev/frontend": "created",
+    "service/dev/backend": "created",
+    "deployment/dev/backend": "created",
+    "horizontalpodautoscaler/dev/backend": "created"
+  }
+}
+```
+
+You can trigger a kustomization reconciliation any time with:
+
+```bash
+kubectl -n flux-system annotate --overwrite kustomization/podinfo-dev \
+fluxcd.io/reconcileAt="$(date +%s)"
+```
+
+When the source controller pulls a new Git revision, the kustomize controller will detect that the
+source revision changed, and will reconcile those changes right away.
+
+If the kustomization reconciliation fails, the controller sets the ready condition to `false` and logs the error:
+
+```yaml
+status:
+  conditions:
+  - lastTransitionTime: "2020-09-17T07:27:58Z"
+    message: 'namespaces dev not found'
+    reason: ReconciliationFailed
+    status: "False"
+    type: Ready
+``` 
+
+```json
+{
+  "kustomization": "flux-system/podinfo-dev",
+  "error": "Error when creating 'Service/dev/frontend': namespaces dev not found"
+}
+```
+
+### Control the execution order
+
+When running a kustomization, you may need to make sure other kustomizations have been 
+successfully applied beforehand. A kustomization can specify a list of dependencies with `spec.dependsOn`.
+When combined with health assessment, a kustomization will run after all its dependencies health checks are passing.
+
+For example, a service mesh proxy injector should be running before deploying applications inside the mesh:
+
+```yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: istio
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: "./istio/system/"
+  sourceRef:
+    kind: GitRepository
+    name: istio
+  healthChecks:
+    - kind: Deployment
+      name: istiod
+      namespace: istio-system
+  timeout: 2m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: podinfo-dev
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: istio
+  interval: 5m
+  path: "./deploy/overlays/dev/"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: podinfo
+```
+
+### Deploy releases to production
+
+For production deployments, instead of synchronizing with a branch you can use a semver range to target stable releases:
+
+```yaml
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: podinfo-releases
+  namespace: flux-system
+spec:
+  interval: 5m
+  url: https://github.com/stefanprodan/podinfo
+  ref:
+    semver: ">=4.0.0 <5.0.0"
+```
+
+With `ref.semver` we configure source controller to pull the Git tags and create an artifact from the most recent tag
+that matches the semver range.
+
+Create a production kustomization and reference the git source that follows the latest semver release:
+
+```yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: podinfo-production
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: "./deploy/overlays/production/"
+  sourceRef:
+    kind: GitRepository
+    name: podinfo-releases
+```
+
+Based on the above definition, the kustomize controller will apply the kustomization that matches the semver range
+set in the Git repository.
+
+### Configure alerting
+
+The kustomize controller emits Kubernetes events whenever a kustomization status changes.
+
+You can use the [notification-controller](https://github.com/fluxcd/notification-controller) to forward these events
+to Slack, Microsoft Teams, Discord or Rocket chart.
+
+Create a notification provider for Slack:
+
+```yaml
+apiVersion: notification.toolkit.fluxcd.io/v1beta1
+kind: Provider
+metadata:
+  name: slack
+  namespace: flux-system
+spec:
+  type: slack
+  channel: alerts
+  secretRef:
+    name: slack-url
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: slack-url
+  namespace: flux-system
+data:
+  address: <encoded-url>
+```
+
+Create an alert for a list of GitRepositories and Kustomizations:
+
+```yaml
+apiVersion: notification.toolkit.fluxcd.io/v1beta1
+kind: Alert
+metadata:
+  name: on-call
+  namespace: flux-system
+spec:
+  providerRef: 
+    name: slack
+  eventSeverity: info
+  eventSources:
+    - kind: GitRepository
+      name: podinfo-releases
+    - kind: Kustomization
+      name: podinfo-production
+```
+
+Multiple alerts can be used to send notifications to different channels or Slack organizations.
+
+The event severity can be set to `info` or `error`.
+When the severity is set to `error`, the controller will alert on any error encountered during the
+reconciliation process. This includes kustomize build and validation errors, apply errors and
+health check failures.
+
+![error alert](docs/diagrams/slack-error-alert.png)
+
+When the verbosity is set to `info`, the controller will alert if:
+* a Kubernetes object was created, updated or deleted
+* heath checks are passing
+* a dependency is delaying the execution
+* an error occurs
+
+![info alert](docs/diagrams/slack-info-alert.png)

api/go.mod

@@ -1,36 +1,36 @@
 module github.com/fluxcd/kustomize-controller/api
 
-go 1.24.0
+go 1.18
 
 require (
-	github.com/fluxcd/pkg/apis/kustomize v1.11.0
-	github.com/fluxcd/pkg/apis/meta v1.18.0
-	k8s.io/apiextensions-apiserver v0.33.2
-	k8s.io/apimachinery v0.33.2
-	sigs.k8s.io/controller-runtime v0.21.0
+	github.com/fluxcd/pkg/apis/kustomize v0.4.2
+	github.com/fluxcd/pkg/apis/meta v0.14.2
+	k8s.io/apiextensions-apiserver v0.24.3
+	k8s.io/apimachinery v0.24.3
+	sigs.k8s.io/controller-runtime v0.11.2
 )
 
 // Fix CVE-2022-28948
 replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1
 
 require (
-	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.2.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/net v0.41.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	github.com/onsi/gomega v1.18.1 // indirect
+	github.com/stretchr/testify v1.7.1 // indirect
+	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
+	golang.org/x/text v0.3.7 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
-	sigs.k8s.io/yaml v1.5.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/klog/v2 v2.60.1 // indirect
+	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
+	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )

api/go.sum

@@ -1,121 +1,925 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
+cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
+cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
+cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
+cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
+cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
+cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
+cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
+cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
+cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
+cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
+cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
+cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
+cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
+cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
+cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
+cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
+cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
+cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
+cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
+github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20210826220005-b48c857c3a0e/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
+github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
+github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fluxcd/pkg/apis/kustomize v1.11.0 h1:0IzDgxZkc4v+5SDNCvgZhfwfkdkQLPXCner7TNaJFWE=
-github.com/fluxcd/pkg/apis/kustomize v1.11.0/go.mod h1:j302mJGDww8cn9qvMsRQ0LJ1HPAPs/IlX7CSsoJV7BI=
-github.com/fluxcd/pkg/apis/meta v1.18.0 h1:ACHrMIjlcioE9GKS7NGk62KX4NshqNewr8sBwMcXABs=
-github.com/fluxcd/pkg/apis/meta v1.18.0/go.mod h1:97l3hTwBpJbXBY+wetNbqrUsvES8B1jGioKcBUxmqd8=
-github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
-github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
-github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fluxcd/pkg/apis/kustomize v0.4.2 h1:5mC/t+OndouK7poFaG4soWLqvHqOxJ3HCsbxu8qyt30=
+github.com/fluxcd/pkg/apis/kustomize v0.4.2/go.mod h1:y/TpJvnhR08BRt3E7oLpDPvx0/J/2AS8tOiAFJpctu8=
+github.com/fluxcd/pkg/apis/meta v0.14.2 h1:/Hf7I/Vz01vv3m7Qx7DtQvrzAL1oVt0MJcLb/I1Y1HE=
+github.com/fluxcd/pkg/apis/meta v0.14.2/go.mod h1:ijZ61VG/8T3U17gj0aFL3fdtZL+mulD6V8VrLLUCAgM=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
+github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
+github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
+github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.2 h1:ahHml/yUpnlb96Rp8HCvtYVPY8ZYpxq3g7UYchIYwbs=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/zapr v1.2.0/go.mod h1:Qa4Bsj2Vb+FAVeAKsLD8RLQ+YRJB8YDmOAKxaBQf7Ro=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
+github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
+github.com/google/cel-go v0.10.1/go.mod h1:U7ayypeSkw23szu4GaQTPJGx66c20mx8JklMSxrmI1w=
+github.com/google/cel-spec v0.6.0/go.mod h1:Nwjgxy5CbjlPrtCWjeDjUyKMl8w41YBYGjsyDdqk0xA=
+github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
+github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
+github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
+github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
+github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
+github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
+github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
+github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
-github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.18.1 h1:M1GfJqGRrBrrGGsbxzV5dqM2U2ApXefZCQpkukxYRLE=
+github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
+github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
+github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
+github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
+go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
+go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
+go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
+go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0=
+go.etcd.io/etcd/client/v3 v3.5.1/go.mod h1:OnjH4M8OnAotwaB2l9bVgZzRFKru7/ZMoS46OtKyd3Q=
+go.etcd.io/etcd/pkg/v3 v3.5.0/go.mod h1:UzJGatBQ1lXChBkQF0AuAtkRQMYnHubxAEYIrC3MSsE=
+go.etcd.io/etcd/raft/v3 v3.5.0/go.mod h1:UFOHSIvO/nKwd4lhkwabrTD3cqW5yVyYYf/KlD00Szc=
+go.etcd.io/etcd/server/v3 v3.5.0/go.mod h1:3Ah5ruV+M+7RZr0+Y/5mNLwC+eQlni+mQmOVdCRJoS4=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
+go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
+go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
+go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
+go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
+go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
+go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
+go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
+go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
+golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd h1:O7DYs+zxREGLKzKoMQrtrEacpb0ZVXA5rIwylE2Xchk=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220209214540-3681064d5158 h1:rm+CHSpPEEW2IsXUib1ThaHIjuBVZjxNgSKmBLFfD4c=
+golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
+golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
+google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
+google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
+google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
+google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201102152239-715cce707fb0/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.33.2 h1:YgwIS5jKfA+BZg//OQhkJNIfie/kmRsO0BmNaVSimvY=
-k8s.io/api v0.33.2/go.mod h1:fhrbphQJSM2cXzCWgqU29xLDuks4mu7ti9vveEnpSXs=
-k8s.io/apiextensions-apiserver v0.33.2 h1:6gnkIbngnaUflR3XwE1mCefN3YS8yTD631JXQhsU6M8=
-k8s.io/apiextensions-apiserver v0.33.2/go.mod h1:IvVanieYsEHJImTKXGP6XCOjTwv2LUMos0YWc9O+QP8=
-k8s.io/apimachinery v0.33.2 h1:IHFVhqg59mb8PJWTLi8m1mAoepkUNYmptHsV+Z1m5jY=
-k8s.io/apimachinery v0.33.2/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e h1:KqK5c/ghOm8xkHYhlodbp6i6+r+ChV2vuAuVRdFbLro=
-k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
-sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
+gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+k8s.io/api v0.24.3 h1:tt55QEmKd6L2k5DP6G/ZzdMQKvG5ro4H4teClqm0sTY=
+k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI=
+k8s.io/apiextensions-apiserver v0.24.3 h1:kyx+Tmro1qEsTUr07ZGQOfvTsF61yn+AxnxytBWq8As=
+k8s.io/apiextensions-apiserver v0.24.3/go.mod h1:cL0xkmUefpYM4f6IuOau+6NMFEIh6/7wXe/O4vPVJ8A=
+k8s.io/apimachinery v0.24.3 h1:hrFiNSA2cBZqllakVYyH/VyEh4B581bQRmqATJSeQTg=
+k8s.io/apimachinery v0.24.3/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
+k8s.io/apiserver v0.24.3/go.mod h1:aXfwtIn4U27B7lYs5f2BKgz6DRbgWy+HJeYReN1jLJ8=
+k8s.io/client-go v0.24.3/go.mod h1:AAovolf5Z9bY1wIg2FZ8LPQlEdKHjLI7ZD4rw920BJw=
+k8s.io/code-generator v0.24.3/go.mod h1:dpVhs00hTuTdTY6jvVxvTFCk6gSMrtfRydbhZwHI15w=
+k8s.io/component-base v0.24.3/go.mod h1:bqom2IWN9Lj+vwAkPNOv2TflsP1PeVDIwIN0lRthxYY=
+k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
+k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
+k8s.io/klog/v2 v2.60.1 h1:VW25q3bZx9uE3vvdL6M8ezOX79vA2Aq1nEWLqNQclHc=
+k8s.io/klog/v2 v2.60.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42/go.mod h1:Z/45zLw8lUo4wdiUkI+v/ImEGAvu3WatcZl3lPMR4Rk=
+k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 h1:HNSDgDCrr/6Ly3WEGKZftiE7IY19Vz2GdbOCyI4qqhc=
+k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30/go.mod h1:fEO7lRTdivWO2qYVCVG7dEADOMo/MLDCVr8So2g88Uw=
+sigs.k8s.io/controller-runtime v0.11.2 h1:H5GTxQl0Mc9UjRJhORusqfJCIjBO8UtUxGggCwL1rLA=
+sigs.k8s.io/controller-runtime v0.11.2/go.mod h1:P6QCzrEjLaZGqHsfd+os7JQ+WFZhvB8MRFsn4dWF7O4=
+sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 h1:kDi4JBNAsJWfz1aEXhO8Jg87JJaPNLh5tIzYHgStQ9Y=
+sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1 h1:bKCqE9GvQ5tiVHn5rfn1r+yao3aLQEaLzkkmAkf+A6Y=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

api/v1/doc.go

@@ -1,21 +0,0 @@
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package v1 contains API Schema definitions for the kustomize.toolkit.fluxcd.io
-// v1 API group.
-// +kubebuilder:object:generate=true
-// +groupName=kustomize.toolkit.fluxcd.io
-package v1

api/v1/groupversion_info.go

@@ -1,33 +0,0 @@
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"sigs.k8s.io/controller-runtime/pkg/scheme"
-)
-
-var (
-	// GroupVersion is group version used to register these objects.
-	GroupVersion = schema.GroupVersion{Group: "kustomize.toolkit.fluxcd.io", Version: "v1"}
-
-	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
-	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
-
-	// AddToScheme adds the types in this group-version to the given scheme.
-	AddToScheme = SchemeBuilder.AddToScheme
-)

api/v1/inventory_types.go

@@ -1,34 +0,0 @@
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-// ResourceInventory contains a list of Kubernetes resource object references
-// that have been applied by a Kustomization.
-type ResourceInventory struct {
-	// Entries of Kubernetes resource object references.
-	Entries []ResourceRef `json:"entries"`
-}
-
-// ResourceRef contains the information necessary to locate a resource within a cluster.
-type ResourceRef struct {
-	// ID is the string representation of the Kubernetes resource object's metadata,
-	// in the format '<namespace>_<name>_<group>_<kind>'.
-	ID string `json:"id"`
-
-	// Version is the API version of the Kubernetes resource object's kind.
-	Version string `json:"v"`
-}

api/v1/kustomization_types.go

@@ -1,391 +0,0 @@
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"time"
-
-	"github.com/fluxcd/pkg/apis/kustomize"
-	"github.com/fluxcd/pkg/apis/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-const (
-	KustomizationKind         = "Kustomization"
-	KustomizationFinalizer    = "finalizers.fluxcd.io"
-	MaxConditionMessageLength = 20000
-	EnabledValue              = "enabled"
-	DisabledValue             = "disabled"
-	MergeValue                = "Merge"
-	IfNotPresentValue         = "IfNotPresent"
-	IgnoreValue               = "Ignore"
-
-	DeletionPolicyMirrorPrune        = "MirrorPrune"
-	DeletionPolicyDelete             = "Delete"
-	DeletionPolicyWaitForTermination = "WaitForTermination"
-	DeletionPolicyOrphan             = "Orphan"
-)
-
-// KustomizationSpec defines the configuration to calculate the desired state
-// from a Source using Kustomize.
-type KustomizationSpec struct {
-	// CommonMetadata specifies the common labels and annotations that are
-	// applied to all resources. Any existing label or annotation will be
-	// overridden if its key matches a common one.
-	// +optional
-	CommonMetadata *CommonMetadata `json:"commonMetadata,omitempty"`
-
-	// DependsOn may contain a DependencyReference slice
-	// with references to Kustomization resources that must be ready before this
-	// Kustomization can be reconciled.
-	// +optional
-	DependsOn []DependencyReference `json:"dependsOn,omitempty"`
-
-	// Decrypt Kubernetes secrets before applying them on the cluster.
-	// +optional
-	Decryption *Decryption `json:"decryption,omitempty"`
-
-	// The interval at which to reconcile the Kustomization.
-	// This interval is approximate and may be subject to jitter to ensure
-	// efficient use of resources.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
-	// +required
-	Interval metav1.Duration `json:"interval"`
-
-	// The interval at which to retry a previously failed reconciliation.
-	// When not specified, the controller uses the KustomizationSpec.Interval
-	// value to retry failures.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
-	// +optional
-	RetryInterval *metav1.Duration `json:"retryInterval,omitempty"`
-
-	// The KubeConfig for reconciling the Kustomization on a remote cluster.
-	// When used in combination with KustomizationSpec.ServiceAccountName,
-	// forces the controller to act on behalf of that Service Account at the
-	// target cluster.
-	// If the --default-service-account flag is set, its value will be used as
-	// a controller level fallback for when KustomizationSpec.ServiceAccountName
-	// is empty.
-	// +optional
-	KubeConfig *meta.KubeConfigReference `json:"kubeConfig,omitempty"`
-
-	// Path to the directory containing the kustomization.yaml file, or the
-	// set of plain YAMLs a kustomization.yaml should be generated for.
-	// Defaults to 'None', which translates to the root path of the SourceRef.
-	// +optional
-	Path string `json:"path,omitempty"`
-
-	// PostBuild describes which actions to perform on the YAML manifest
-	// generated by building the kustomize overlay.
-	// +optional
-	PostBuild *PostBuild `json:"postBuild,omitempty"`
-
-	// Prune enables garbage collection.
-	// +required
-	Prune bool `json:"prune"`
-
-	// DeletionPolicy can be used to control garbage collection when this
-	// Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete',
-	// 'WaitForTermination', 'Orphan'). 'MirrorPrune' mirrors the Prune field
-	// (orphan if false, delete if true). Defaults to 'MirrorPrune'.
-	// +kubebuilder:validation:Enum=MirrorPrune;Delete;WaitForTermination;Orphan
-	// +optional
-	DeletionPolicy string `json:"deletionPolicy,omitempty"`
-
-	// A list of resources to be included in the health assessment.
-	// +optional
-	HealthChecks []meta.NamespacedObjectKindReference `json:"healthChecks,omitempty"`
-
-	// NamePrefix will prefix the names of all managed resources.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=200
-	// +kubebuilder:validation:Optional
-	// +optional
-	NamePrefix string `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
-
-	// NameSuffix will suffix the names of all managed resources.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=200
-	// +kubebuilder:validation:Optional
-	// +optional
-	NameSuffix string `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
-
-	// Strategic merge and JSON patches, defined as inline YAML objects,
-	// capable of targeting objects based on kind, label and annotation selectors.
-	// +optional
-	Patches []kustomize.Patch `json:"patches,omitempty"`
-
-	// Images is a list of (image name, new name, new tag or digest)
-	// for changing image names, tags or digests. This can also be achieved with a
-	// patch, but this operator is simpler to specify.
-	// +optional
-	Images []kustomize.Image `json:"images,omitempty"`
-
-	// The name of the Kubernetes service account to impersonate
-	// when reconciling this Kustomization.
-	// +optional
-	ServiceAccountName string `json:"serviceAccountName,omitempty"`
-
-	// Reference of the source where the kustomization file is.
-	// +required
-	SourceRef CrossNamespaceSourceReference `json:"sourceRef"`
-
-	// This flag tells the controller to suspend subsequent kustomize executions,
-	// it does not apply to already started executions. Defaults to false.
-	// +optional
-	Suspend bool `json:"suspend,omitempty"`
-
-	// TargetNamespace sets or overrides the namespace in the
-	// kustomization.yaml file.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=63
-	// +kubebuilder:validation:Optional
-	// +optional
-	TargetNamespace string `json:"targetNamespace,omitempty"`
-
-	// Timeout for validation, apply and health checking operations.
-	// Defaults to 'Interval' duration.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
-	// +optional
-	Timeout *metav1.Duration `json:"timeout,omitempty"`
-
-	// Force instructs the controller to recreate resources
-	// when patching fails due to an immutable field change.
-	// +kubebuilder:default:=false
-	// +optional
-	Force bool `json:"force,omitempty"`
-
-	// Wait instructs the controller to check the health of all the reconciled
-	// resources. When enabled, the HealthChecks are ignored. Defaults to false.
-	// +optional
-	Wait bool `json:"wait,omitempty"`
-
-	// Components specifies relative paths to specifications of other Components.
-	// +optional
-	Components []string `json:"components,omitempty"`
-
-	// HealthCheckExprs is a list of healthcheck expressions for evaluating the
-	// health of custom resources using Common Expression Language (CEL).
-	// The expressions are evaluated only when Wait or HealthChecks are specified.
-	// +optional
-	HealthCheckExprs []kustomize.CustomHealthCheck `json:"healthCheckExprs,omitempty"`
-}
-
-// CommonMetadata defines the common labels and annotations.
-type CommonMetadata struct {
-	// Annotations to be added to the object's metadata.
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Labels to be added to the object's metadata.
-	// +optional
-	Labels map[string]string `json:"labels,omitempty"`
-}
-
-// Decryption defines how decryption is handled for Kubernetes manifests.
-type Decryption struct {
-	// Provider is the name of the decryption engine.
-	// +kubebuilder:validation:Enum=sops
-	// +required
-	Provider string `json:"provider"`
-
-	// ServiceAccountName is the name of the service account used to
-	// authenticate with KMS services from cloud providers. If a
-	// static credential for a given cloud provider is defined
-	// inside the Secret referenced by SecretRef, that static
-	// credential takes priority.
-	// +optional
-	ServiceAccountName string `json:"serviceAccountName,omitempty"`
-
-	// The secret name containing the private OpenPGP keys used for decryption.
-	// A static credential for a cloud provider defined inside the Secret
-	// takes priority to secret-less authentication with the ServiceAccountName
-	// field.
-	// +optional
-	SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
-}
-
-// PostBuild describes which actions to perform on the YAML manifest
-// generated by building the kustomize overlay.
-type PostBuild struct {
-	// Substitute holds a map of key/value pairs.
-	// The variables defined in your YAML manifests that match any of the keys
-	// defined in the map will be substituted with the set value.
-	// Includes support for bash string replacement functions
-	// e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.
-	// +optional
-	Substitute map[string]string `json:"substitute,omitempty"`
-
-	// SubstituteFrom holds references to ConfigMaps and Secrets containing
-	// the variables and their values to be substituted in the YAML manifests.
-	// The ConfigMap and the Secret data keys represent the var names, and they
-	// must match the vars declared in the manifests for the substitution to
-	// happen.
-	// +optional
-	SubstituteFrom []SubstituteReference `json:"substituteFrom,omitempty"`
-}
-
-// SubstituteReference contains a reference to a resource containing
-// the variables name and value.
-type SubstituteReference struct {
-	// Kind of the values referent, valid values are ('Secret', 'ConfigMap').
-	// +kubebuilder:validation:Enum=Secret;ConfigMap
-	// +required
-	Kind string `json:"kind"`
-
-	// Name of the values referent. Should reside in the same namespace as the
-	// referring resource.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=253
-	// +required
-	Name string `json:"name"`
-
-	// Optional indicates whether the referenced resource must exist, or whether to
-	// tolerate its absence. If true and the referenced resource is absent, proceed
-	// as if the resource was present but empty, without any variables defined.
-	// +kubebuilder:default:=false
-	// +optional
-	Optional bool `json:"optional,omitempty"`
-}
-
-// KustomizationStatus defines the observed state of a kustomization.
-type KustomizationStatus struct {
-	meta.ReconcileRequestStatus `json:",inline"`
-
-	// ObservedGeneration is the last reconciled generation.
-	// +optional
-	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
-
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-
-	// The last successfully applied revision.
-	// Equals the Revision of the applied Artifact from the referenced Source.
-	// +optional
-	LastAppliedRevision string `json:"lastAppliedRevision,omitempty"`
-
-	// The last successfully applied origin revision.
-	// Equals the origin revision of the applied Artifact from the referenced Source.
-	// Usually present on the Metadata of the applied Artifact and depends on the
-	// Source type, e.g. for OCI it's the value associated with the key
-	// "org.opencontainers.image.revision".
-	// +optional
-	LastAppliedOriginRevision string `json:"lastAppliedOriginRevision,omitempty"`
-
-	// LastAttemptedRevision is the revision of the last reconciliation attempt.
-	// +optional
-	LastAttemptedRevision string `json:"lastAttemptedRevision,omitempty"`
-
-	// Inventory contains the list of Kubernetes resource object references that
-	// have been successfully applied.
-	// +optional
-	Inventory *ResourceInventory `json:"inventory,omitempty"`
-}
-
-// GetTimeout returns the timeout with default.
-func (in Kustomization) GetTimeout() time.Duration {
-	duration := in.Spec.Interval.Duration - 30*time.Second
-	if in.Spec.Timeout != nil {
-		duration = in.Spec.Timeout.Duration
-	}
-	if duration < 30*time.Second {
-		return 30 * time.Second
-	}
-	return duration
-}
-
-// GetRetryInterval returns the retry interval
-func (in Kustomization) GetRetryInterval() time.Duration {
-	if in.Spec.RetryInterval != nil {
-		return in.Spec.RetryInterval.Duration
-	}
-	return in.GetRequeueAfter()
-}
-
-// GetRequeueAfter returns the duration after which the Kustomization must be
-// reconciled again.
-func (in Kustomization) GetRequeueAfter() time.Duration {
-	return in.Spec.Interval.Duration
-}
-
-// GetDeletionPolicy returns the deletion policy and default value if not specified.
-func (in Kustomization) GetDeletionPolicy() string {
-	if in.Spec.DeletionPolicy == "" {
-		return DeletionPolicyMirrorPrune
-	}
-	return in.Spec.DeletionPolicy
-}
-
-// GetDependsOn returns the dependencies as a list of meta.NamespacedObjectReference.
-//
-// This function makes the Kustomization type conformant with the meta.ObjectWithDependencies interface
-// and allows the controller-runtime to index Kustomizations by their dependencies.
-func (in Kustomization) GetDependsOn() []meta.NamespacedObjectReference {
-	deps := make([]meta.NamespacedObjectReference, len(in.Spec.DependsOn))
-	for i := range in.Spec.DependsOn {
-		deps[i] = meta.NamespacedObjectReference{
-			Name:      in.Spec.DependsOn[i].Name,
-			Namespace: in.Spec.DependsOn[i].Namespace,
-		}
-	}
-	return deps
-}
-
-// GetConditions returns the status conditions of the object.
-func (in Kustomization) GetConditions() []metav1.Condition {
-	return in.Status.Conditions
-}
-
-// SetConditions sets the status conditions on the object.
-func (in *Kustomization) SetConditions(conditions []metav1.Condition) {
-	in.Status.Conditions = conditions
-}
-
-// +genclient
-// +kubebuilder:storageversion
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:shortName=ks
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
-
-// Kustomization is the Schema for the kustomizations API.
-type Kustomization struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec KustomizationSpec `json:"spec,omitempty"`
-	// +kubebuilder:default:={"observedGeneration":-1}
-	Status KustomizationStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// KustomizationList contains a list of kustomizations.
-type KustomizationList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Kustomization `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&Kustomization{}, &KustomizationList{})
-}

api/v1/reference_types.go

@@ -1,72 +0,0 @@
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-)
-
-// CrossNamespaceSourceReference contains enough information to let you locate the
-// typed Kubernetes resource object at cluster level.
-type CrossNamespaceSourceReference struct {
-	// API version of the referent.
-	// +optional
-	APIVersion string `json:"apiVersion,omitempty"`
-
-	// Kind of the referent.
-	// +kubebuilder:validation:Enum=OCIRepository;GitRepository;Bucket
-	// +required
-	Kind string `json:"kind"`
-
-	// Name of the referent.
-	// +required
-	Name string `json:"name"`
-
-	// Namespace of the referent, defaults to the namespace of the Kubernetes
-	// resource object that contains the reference.
-	// +optional
-	Namespace string `json:"namespace,omitempty"`
-}
-
-// String returns a string representation of the CrossNamespaceSourceReference
-// in the format "Kind/Name" or "Kind/Namespace/Name" if Namespace is set.
-func (s *CrossNamespaceSourceReference) String() string {
-	if s.Namespace != "" {
-		return fmt.Sprintf("%s/%s/%s", s.Kind, s.Namespace, s.Name)
-	}
-	return fmt.Sprintf("%s/%s", s.Kind, s.Name)
-}
-
-// DependencyReference defines a Kustomization dependency on another Kustomization resource.
-type DependencyReference struct {
-	// Name of the referent.
-	// +required
-	Name string `json:"name"`
-
-	// Namespace of the referent, defaults to the namespace of the Kustomization
-	// resource object that contains the reference.
-	// +optional
-	Namespace string `json:"namespace,omitempty"`
-
-	// ReadyExpr is a CEL expression that can be used to assess the readiness
-	// of a dependency. When specified, the built-in readiness check
-	// is replaced by the logic defined in the CEL expression.
-	// To make the CEL expression additive to the built-in readiness check,
-	// the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
-	// +optional
-	ReadyExpr string `json:"readyExpr,omitempty"`
-}

api/v1/zz_generated.deepcopy.go

@@ -1,350 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2023 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1
-
-import (
-	"github.com/fluxcd/pkg/apis/kustomize"
-	"github.com/fluxcd/pkg/apis/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CommonMetadata) DeepCopyInto(out *CommonMetadata) {
-	*out = *in
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CommonMetadata.
-func (in *CommonMetadata) DeepCopy() *CommonMetadata {
-	if in == nil {
-		return nil
-	}
-	out := new(CommonMetadata)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CrossNamespaceSourceReference) DeepCopyInto(out *CrossNamespaceSourceReference) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossNamespaceSourceReference.
-func (in *CrossNamespaceSourceReference) DeepCopy() *CrossNamespaceSourceReference {
-	if in == nil {
-		return nil
-	}
-	out := new(CrossNamespaceSourceReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Decryption) DeepCopyInto(out *Decryption) {
-	*out = *in
-	if in.SecretRef != nil {
-		in, out := &in.SecretRef, &out.SecretRef
-		*out = new(meta.LocalObjectReference)
-		**out = **in
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Decryption.
-func (in *Decryption) DeepCopy() *Decryption {
-	if in == nil {
-		return nil
-	}
-	out := new(Decryption)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DependencyReference) DeepCopyInto(out *DependencyReference) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DependencyReference.
-func (in *DependencyReference) DeepCopy() *DependencyReference {
-	if in == nil {
-		return nil
-	}
-	out := new(DependencyReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Kustomization) DeepCopyInto(out *Kustomization) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kustomization.
-func (in *Kustomization) DeepCopy() *Kustomization {
-	if in == nil {
-		return nil
-	}
-	out := new(Kustomization)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Kustomization) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KustomizationList) DeepCopyInto(out *KustomizationList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Kustomization, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KustomizationList.
-func (in *KustomizationList) DeepCopy() *KustomizationList {
-	if in == nil {
-		return nil
-	}
-	out := new(KustomizationList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *KustomizationList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
-	*out = *in
-	if in.CommonMetadata != nil {
-		in, out := &in.CommonMetadata, &out.CommonMetadata
-		*out = new(CommonMetadata)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]DependencyReference, len(*in))
-		copy(*out, *in)
-	}
-	if in.Decryption != nil {
-		in, out := &in.Decryption, &out.Decryption
-		*out = new(Decryption)
-		(*in).DeepCopyInto(*out)
-	}
-	out.Interval = in.Interval
-	if in.RetryInterval != nil {
-		in, out := &in.RetryInterval, &out.RetryInterval
-		*out = new(metav1.Duration)
-		**out = **in
-	}
-	if in.KubeConfig != nil {
-		in, out := &in.KubeConfig, &out.KubeConfig
-		*out = new(meta.KubeConfigReference)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.PostBuild != nil {
-		in, out := &in.PostBuild, &out.PostBuild
-		*out = new(PostBuild)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.HealthChecks != nil {
-		in, out := &in.HealthChecks, &out.HealthChecks
-		*out = make([]meta.NamespacedObjectKindReference, len(*in))
-		copy(*out, *in)
-	}
-	if in.Patches != nil {
-		in, out := &in.Patches, &out.Patches
-		*out = make([]kustomize.Patch, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Images != nil {
-		in, out := &in.Images, &out.Images
-		*out = make([]kustomize.Image, len(*in))
-		copy(*out, *in)
-	}
-	out.SourceRef = in.SourceRef
-	if in.Timeout != nil {
-		in, out := &in.Timeout, &out.Timeout
-		*out = new(metav1.Duration)
-		**out = **in
-	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.HealthCheckExprs != nil {
-		in, out := &in.HealthCheckExprs, &out.HealthCheckExprs
-		*out = make([]kustomize.CustomHealthCheck, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KustomizationSpec.
-func (in *KustomizationSpec) DeepCopy() *KustomizationSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(KustomizationSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KustomizationStatus) DeepCopyInto(out *KustomizationStatus) {
-	*out = *in
-	out.ReconcileRequestStatus = in.ReconcileRequestStatus
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Inventory != nil {
-		in, out := &in.Inventory, &out.Inventory
-		*out = new(ResourceInventory)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KustomizationStatus.
-func (in *KustomizationStatus) DeepCopy() *KustomizationStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(KustomizationStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PostBuild) DeepCopyInto(out *PostBuild) {
-	*out = *in
-	if in.Substitute != nil {
-		in, out := &in.Substitute, &out.Substitute
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.SubstituteFrom != nil {
-		in, out := &in.SubstituteFrom, &out.SubstituteFrom
-		*out = make([]SubstituteReference, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostBuild.
-func (in *PostBuild) DeepCopy() *PostBuild {
-	if in == nil {
-		return nil
-	}
-	out := new(PostBuild)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ResourceInventory) DeepCopyInto(out *ResourceInventory) {
-	*out = *in
-	if in.Entries != nil {
-		in, out := &in.Entries, &out.Entries
-		*out = make([]ResourceRef, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceInventory.
-func (in *ResourceInventory) DeepCopy() *ResourceInventory {
-	if in == nil {
-		return nil
-	}
-	out := new(ResourceInventory)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ResourceRef) DeepCopyInto(out *ResourceRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceRef.
-func (in *ResourceRef) DeepCopy() *ResourceRef {
-	if in == nil {
-		return nil
-	}
-	out := new(ResourceRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SubstituteReference) DeepCopyInto(out *SubstituteReference) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubstituteReference.
-func (in *SubstituteReference) DeepCopy() *SubstituteReference {
-	if in == nil {
-		return nil
-	}
-	out := new(SubstituteReference)
-	in.DeepCopyInto(out)
-	return out
-}

api/v1beta1/kustomization_types.go

@@ -20,6 +20,8 @@ import (
 	"time"
 
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 
@@ -229,6 +231,78 @@ type KustomizationStatus struct {
 	Snapshot *Snapshot `json:"snapshot,omitempty"`
 }
 
+// KustomizationProgressing resets the conditions of the given Kustomization to a single
+// ReadyCondition with status ConditionUnknown.
+func KustomizationProgressing(k Kustomization) Kustomization {
+	newCondition := metav1.Condition{
+		Type:    meta.ReadyCondition,
+		Status:  metav1.ConditionUnknown,
+		Reason:  meta.ProgressingReason,
+		Message: "reconciliation in progress",
+	}
+	apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+	return k
+}
+
+// SetKustomizationHealthiness sets the HealthyCondition status for a Kustomization.
+func SetKustomizationHealthiness(k *Kustomization, status metav1.ConditionStatus, reason, message string) {
+	switch len(k.Spec.HealthChecks) {
+	case 0:
+		apimeta.RemoveStatusCondition(k.GetStatusConditions(), HealthyCondition)
+	default:
+		newCondition := metav1.Condition{
+			Type:    HealthyCondition,
+			Status:  status,
+			Reason:  reason,
+			Message: trimString(message, MaxConditionMessageLength),
+		}
+		apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+	}
+}
+
+// SetKustomizeReadiness sets the ReadyCondition, ObservedGeneration, and LastAttemptedRevision,
+// on the Kustomization.
+func SetKustomizationReadiness(k *Kustomization, status metav1.ConditionStatus, reason, message string, revision string) {
+	newCondition := metav1.Condition{
+		Type:    meta.ReadyCondition,
+		Status:  status,
+		Reason:  reason,
+		Message: trimString(message, MaxConditionMessageLength),
+	}
+	apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+
+	k.Status.ObservedGeneration = k.Generation
+	k.Status.LastAttemptedRevision = revision
+}
+
+// KustomizationNotReady registers a failed apply attempt of the given Kustomization.
+func KustomizationNotReady(k Kustomization, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionFalse, reason, trimString(message, MaxConditionMessageLength), revision)
+	if revision != "" {
+		k.Status.LastAttemptedRevision = revision
+	}
+	return k
+}
+
+// KustomizationNotReady registers a failed apply attempt of the given Kustomization,
+// including a Snapshot.
+func KustomizationNotReadySnapshot(k Kustomization, snapshot *Snapshot, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionFalse, reason, trimString(message, MaxConditionMessageLength), revision)
+	SetKustomizationHealthiness(&k, metav1.ConditionFalse, reason, reason)
+	k.Status.Snapshot = snapshot
+	k.Status.LastAttemptedRevision = revision
+	return k
+}
+
+// KustomizationReady registers a successful apply attempt of the given Kustomization.
+func KustomizationReady(k Kustomization, snapshot *Snapshot, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionTrue, reason, trimString(message, MaxConditionMessageLength), revision)
+	SetKustomizationHealthiness(&k, metav1.ConditionTrue, reason, reason)
+	k.Status.Snapshot = snapshot
+	k.Status.LastAppliedRevision = revision
+	return k
+}
+
 // GetTimeout returns the timeout with default.
 func (in Kustomization) GetTimeout() time.Duration {
 	duration := in.Spec.Interval.Duration
@@ -271,13 +345,13 @@ const (
 )
 
 // +genclient
+// +genclient:Namespaced
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:shortName=ks
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
-// +kubebuilder:deprecatedversion:warning="v1beta1 Kustomization is deprecated, upgrade to v1"
 
 // Kustomization is the Schema for the kustomizations API.
 type Kustomization struct {

api/v1beta1/zz_generated.deepcopy.go

@@ -1,7 +1,8 @@
 //go:build !ignore_autogenerated
+// +build !ignore_autogenerated
 
 /*
-Copyright 2023 The Flux authors
+Copyright 2021 The Flux authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -175,9 +176,7 @@ func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
 	if in.Patches != nil {
 		in, out := &in.Patches, &out.Patches
 		*out = make([]kustomize.Patch, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
+		copy(*out, *in)
 	}
 	if in.PatchesStrategicMerge != nil {
 		in, out := &in.PatchesStrategicMerge, &out.PatchesStrategicMerge

api/v1beta2/condition_types.go

@@ -48,8 +48,4 @@ const (
 	// ReconciliationFailedReason represents the fact that
 	// the reconciliation failed.
 	ReconciliationFailedReason string = "ReconciliationFailed"
-
-	// ProgressingWithRetryReason represents the fact that
-	// the reconciliation encountered an error that will be retried.
-	ProgressingWithRetryReason string = "ProgressingWithRetry"
 )

api/v1beta2/kustomization_types.go

@@ -22,6 +22,7 @@ import (
 	"github.com/fluxcd/pkg/apis/kustomize"
 	"github.com/fluxcd/pkg/apis/meta"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -29,18 +30,12 @@ const (
 	KustomizationKind         = "Kustomization"
 	KustomizationFinalizer    = "finalizers.fluxcd.io"
 	MaxConditionMessageLength = 20000
-	EnabledValue              = "enabled"
 	DisabledValue             = "disabled"
 	MergeValue                = "merge"
 )
 
 // KustomizationSpec defines the configuration to calculate the desired state from a Source using Kustomize.
 type KustomizationSpec struct {
-	// CommonMetadata specifies the common labels and annotations that are applied to all resources.
-	// Any existing label or annotation will be overridden if its key matches a common one.
-	// +optional
-	CommonMetadata *CommonMetadata `json:"commonMetadata,omitempty"`
-
 	// DependsOn may contain a meta.NamespacedObjectReference slice
 	// with references to Kustomization resources that must be ready before this
 	// Kustomization can be reconciled.
@@ -52,16 +47,12 @@ type KustomizationSpec struct {
 	Decryption *Decryption `json:"decryption,omitempty"`
 
 	// The interval at which to reconcile the Kustomization.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
 	// +required
 	Interval metav1.Duration `json:"interval"`
 
 	// The interval at which to retry a previously failed reconciliation.
 	// When not specified, the controller uses the KustomizationSpec.Interval
 	// value to retry failures.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
 	// +optional
 	RetryInterval *metav1.Duration `json:"retryInterval,omitempty"`
 
@@ -73,7 +64,7 @@ type KustomizationSpec struct {
 	// a controller level fallback for when KustomizationSpec.ServiceAccountName
 	// is empty.
 	// +optional
-	KubeConfig *meta.KubeConfigReference `json:"kubeConfig,omitempty"`
+	KubeConfig *KubeConfig `json:"kubeConfig,omitempty"`
 
 	// Path to the directory containing the kustomization.yaml file, or the
 	// set of plain YAMLs a kustomization.yaml should be generated for.
@@ -139,8 +130,6 @@ type KustomizationSpec struct {
 
 	// Timeout for validation, apply and health checking operations.
 	// Defaults to 'Interval' duration.
-	// +kubebuilder:validation:Type=string
-	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
 	// +optional
 	Timeout *metav1.Duration `json:"timeout,omitempty"`
 
@@ -155,27 +144,12 @@ type KustomizationSpec struct {
 	// +optional
 	Wait bool `json:"wait,omitempty"`
 
-	// Components specifies relative paths to specifications of other Components.
-	// +optional
-	Components []string `json:"components,omitempty"`
-
 	// Deprecated: Not used in v1beta2.
 	// +kubebuilder:validation:Enum=none;client;server
 	// +optional
 	Validation string `json:"validation,omitempty"`
 }
 
-// CommonMetadata defines the common labels and annotations.
-type CommonMetadata struct {
-	// Annotations to be added to the object's metadata.
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Labels to be added to the object's metadata.
-	// +optional
-	Labels map[string]string `json:"labels,omitempty"`
-}
-
 // Decryption defines how decryption is handled for Kubernetes manifests.
 type Decryption struct {
 	// Provider is the name of the decryption engine.
@@ -188,6 +162,21 @@ type Decryption struct {
 	SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
 }
 
+// KubeConfig references a Kubernetes secret that contains a kubeconfig file.
+type KubeConfig struct {
+	// SecretRef holds the name of a secret that contains a key with
+	// the kubeconfig file as the value. If no key is set, the key will default
+	// to 'value'. The secret must be in the same namespace as
+	// the Kustomization.
+	// It is recommended that the kubeconfig is self-contained, and the secret
+	// is regularly updated if credentials such as a cloud-access-token expire.
+	// Cloud specific `cmd-path` auth helpers will not function without adding
+	// binaries and credentials to the Pod that is responsible for reconciling
+	// the Kustomization.
+	// +required
+	SecretRef meta.SecretKeyReference `json:"secretRef,omitempty"`
+}
+
 // PostBuild describes which actions to perform on the YAML manifest
 // generated by building the kustomize overlay.
 type PostBuild struct {
@@ -243,7 +232,7 @@ type KustomizationStatus struct {
 	Conditions []metav1.Condition `json:"conditions,omitempty"`
 
 	// The last successfully applied revision.
-	// Equals the Revision of the applied Artifact from the referenced Source.
+	// The revision format for Git sources is <branch|tag>/<commit-sha>.
 	// +optional
 	LastAppliedRevision string `json:"lastAppliedRevision,omitempty"`
 
@@ -256,6 +245,78 @@ type KustomizationStatus struct {
 	Inventory *ResourceInventory `json:"inventory,omitempty"`
 }
 
+// KustomizationProgressing resets the conditions of the given Kustomization to a single
+// ReadyCondition with status ConditionUnknown.
+func KustomizationProgressing(k Kustomization, message string) Kustomization {
+	newCondition := metav1.Condition{
+		Type:    meta.ReadyCondition,
+		Status:  metav1.ConditionUnknown,
+		Reason:  meta.ProgressingReason,
+		Message: trimString(message, MaxConditionMessageLength),
+	}
+	apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+	return k
+}
+
+// SetKustomizationHealthiness sets the HealthyCondition status for a Kustomization.
+func SetKustomizationHealthiness(k *Kustomization, status metav1.ConditionStatus, reason, message string) {
+	if !k.Spec.Wait && len(k.Spec.HealthChecks) == 0 {
+		apimeta.RemoveStatusCondition(k.GetStatusConditions(), HealthyCondition)
+	} else {
+		newCondition := metav1.Condition{
+			Type:    HealthyCondition,
+			Status:  status,
+			Reason:  reason,
+			Message: trimString(message, MaxConditionMessageLength),
+		}
+		apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+	}
+
+}
+
+// SetKustomizationReadiness sets the ReadyCondition, ObservedGeneration, and LastAttemptedRevision, on the Kustomization.
+func SetKustomizationReadiness(k *Kustomization, status metav1.ConditionStatus, reason, message string, revision string) {
+	newCondition := metav1.Condition{
+		Type:    meta.ReadyCondition,
+		Status:  status,
+		Reason:  reason,
+		Message: trimString(message, MaxConditionMessageLength),
+	}
+	apimeta.SetStatusCondition(k.GetStatusConditions(), newCondition)
+
+	k.Status.ObservedGeneration = k.Generation
+	k.Status.LastAttemptedRevision = revision
+}
+
+// KustomizationNotReady registers a failed apply attempt of the given Kustomization.
+func KustomizationNotReady(k Kustomization, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionFalse, reason, trimString(message, MaxConditionMessageLength), revision)
+	if revision != "" {
+		k.Status.LastAttemptedRevision = revision
+	}
+	return k
+}
+
+// KustomizationNotReadyInventory registers a failed apply attempt of the given Kustomization.
+func KustomizationNotReadyInventory(k Kustomization, inventory *ResourceInventory, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionFalse, reason, trimString(message, MaxConditionMessageLength), revision)
+	SetKustomizationHealthiness(&k, metav1.ConditionFalse, reason, reason)
+	if revision != "" {
+		k.Status.LastAttemptedRevision = revision
+	}
+	k.Status.Inventory = inventory
+	return k
+}
+
+// KustomizationReadyInventory registers a successful apply attempt of the given Kustomization.
+func KustomizationReadyInventory(k Kustomization, inventory *ResourceInventory, revision, reason, message string) Kustomization {
+	SetKustomizationReadiness(&k, metav1.ConditionTrue, reason, trimString(message, MaxConditionMessageLength), revision)
+	SetKustomizationHealthiness(&k, metav1.ConditionTrue, reason, reason)
+	k.Status.Inventory = inventory
+	k.Status.LastAppliedRevision = revision
+	return k
+}
+
 // GetTimeout returns the timeout with default.
 func (in Kustomization) GetTimeout() time.Duration {
 	duration := in.Spec.Interval.Duration - 30*time.Second
@@ -304,13 +365,14 @@ func (in *Kustomization) GetStatusConditions() *[]metav1.Condition {
 }
 
 // +genclient
+// +genclient:Namespaced
+// +kubebuilder:storageversion
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:shortName=ks
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
-// +kubebuilder:deprecatedversion:warning="v1beta2 Kustomization is deprecated, upgrade to v1"
 
 // Kustomization is the Schema for the kustomizations API.
 type Kustomization struct {
@@ -334,3 +396,11 @@ type KustomizationList struct {
 func init() {
 	SchemeBuilder.Register(&Kustomization{}, &KustomizationList{})
 }
+
+func trimString(str string, limit int) string {
+	if len(str) <= limit {
+		return str
+	}
+
+	return str[0:limit] + "..."
+}

api/v1beta2/zz_generated.deepcopy.go

@@ -1,7 +1,8 @@
 //go:build !ignore_autogenerated
+// +build !ignore_autogenerated
 
 /*
-Copyright 2023 The Flux authors
+Copyright 2021 The Flux authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -28,35 +29,6 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CommonMetadata) DeepCopyInto(out *CommonMetadata) {
-	*out = *in
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CommonMetadata.
-func (in *CommonMetadata) DeepCopy() *CommonMetadata {
-	if in == nil {
-		return nil
-	}
-	out := new(CommonMetadata)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CrossNamespaceSourceReference) DeepCopyInto(out *CrossNamespaceSourceReference) {
 	*out = *in
@@ -92,6 +64,22 @@ func (in *Decryption) DeepCopy() *Decryption {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubeConfig) DeepCopyInto(out *KubeConfig) {
+	*out = *in
+	out.SecretRef = in.SecretRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeConfig.
+func (in *KubeConfig) DeepCopy() *KubeConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(KubeConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Kustomization) DeepCopyInto(out *Kustomization) {
 	*out = *in
@@ -154,11 +142,6 @@ func (in *KustomizationList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
 	*out = *in
-	if in.CommonMetadata != nil {
-		in, out := &in.CommonMetadata, &out.CommonMetadata
-		*out = new(CommonMetadata)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.DependsOn != nil {
 		in, out := &in.DependsOn, &out.DependsOn
 		*out = make([]meta.NamespacedObjectReference, len(*in))
@@ -177,8 +160,8 @@ func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
 	}
 	if in.KubeConfig != nil {
 		in, out := &in.KubeConfig, &out.KubeConfig
-		*out = new(meta.KubeConfigReference)
-		(*in).DeepCopyInto(*out)
+		*out = new(KubeConfig)
+		**out = **in
 	}
 	if in.PostBuild != nil {
 		in, out := &in.PostBuild, &out.PostBuild
@@ -193,9 +176,7 @@ func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
 	if in.Patches != nil {
 		in, out := &in.Patches, &out.Patches
 		*out = make([]kustomize.Patch, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
+		copy(*out, *in)
 	}
 	if in.PatchesStrategicMerge != nil {
 		in, out := &in.PatchesStrategicMerge, &out.PatchesStrategicMerge
@@ -222,11 +203,6 @@ func (in *KustomizationSpec) DeepCopyInto(out *KustomizationSpec) {
 		*out = new(v1.Duration)
 		**out = **in
 	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KustomizationSpec.

config/default/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kustomize-system
 resources:
-- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.crds.yaml
-- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v0.26.0/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v0.26.0/source-controller.deployment.yaml
 - ../crd
 - ../rbac
 - ../manager

config/manager/kustomization.yaml

@@ -5,4 +5,4 @@ resources:
 images:
   - name: fluxcd/kustomize-controller
     newName: fluxcd/kustomize-controller
-    newTag: v1.6.0
+    newTag: v0.26.3

config/rbac/role.yaml

@@ -1,7 +1,9 @@
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  creationTimestamp: null
   name: manager-role
 rules:
 - apiGroups:
@@ -21,12 +23,6 @@ rules:
   verbs:
   - create
   - patch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts/token
-  verbs:
-  - create
 - apiGroups:
   - kustomize.toolkit.fluxcd.io
   resources:

config/samples/kustomize_v1beta1_kustomization.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: webapp-dev
@@ -12,7 +12,7 @@ spec:
   wait: true
   timeout: 2m
 ---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: webapp-production

config/samples/source_v1beta1_gitrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: webapp-latest
@@ -8,7 +8,7 @@ spec:
   ref:
     branch: master
 ---
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: webapp-releases

config/testdata/crds-crs/cert-manager.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: certs
@@ -8,7 +8,7 @@ spec:
   ref:
     tag: "v1.1.0"
 ---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: certs

config/testdata/dependencies/backend.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: backend
@@ -11,8 +11,9 @@ spec:
   sourceRef:
     kind: GitRepository
     name: webapp
+  validation: server
   healthChecks:
     - kind: Deployment
       name: backend
       namespace: webapp
-  timeout: 2m
+  timeout: 2m

config/testdata/dependencies/common.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: common
@@ -9,3 +9,4 @@ spec:
   sourceRef:
     kind: GitRepository
     name: webapp
+  validation: client

config/testdata/dependencies/frontend.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: frontend
@@ -12,8 +12,9 @@ spec:
   sourceRef:
     kind: GitRepository
     name: webapp
+  validation: server
   healthChecks:
     - kind: Deployment
       name: frontend
       namespace: webapp
-  timeout: 2m
+  timeout: 2m

config/testdata/dependencies/source.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: webapp
@@ -6,4 +6,4 @@ spec:
   interval: 10m
   url: https://github.com/stefanprodan/podinfo
   ref:
-    semver: ">=6.3.5"
+    semver: ">=3.2.3"

config/testdata/impersonation/test.yaml

@@ -33,7 +33,7 @@ subjects:
     name: gotk-reconciler
     namespace: impersonation
 ---
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: podinfo
@@ -42,9 +42,9 @@ spec:
   interval: 5m
   url: https://github.com/stefanprodan/podinfo
   ref:
-    tag: "6.3.5"
+    tag: "5.0.3"
 ---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: podinfo
@@ -60,7 +60,7 @@ spec:
     name: podinfo
   patches:
     - patch: |
-        apiVersion: autoscaling/v2
+        apiVersion: autoscaling/v2beta2
         kind: HorizontalPodAutoscaler
         metadata:
           name: podinfo

config/testdata/managed-fields/podinfo.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: podinfo
@@ -12,7 +12,7 @@ spec:
   timeout: 1m
   targetNamespace: managed-fields
 ---
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: podinfo
@@ -20,4 +20,4 @@ spec:
   interval: 5m
   url: https://github.com/stefanprodan/podinfo
   ref:
-    semver: "6.3.5"
+    semver: "6.0.0"

config/testdata/oci/podinfo.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: OCIRepository
 metadata:
   name: oci
@@ -7,9 +7,9 @@ spec:
   interval: 10m
   url: oci://ghcr.io/stefanprodan/manifests/podinfo
   ref:
-    tag: "6.3.5"
+    tag: "6.1.6"
 ---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
   name: oci
@@ -17,7 +17,7 @@ metadata:
 spec:
   targetNamespace: oci
   interval: 10m
-  path: "./"
+  path: "./kustomize"
   prune: true
   sourceRef:
     kind: OCIRepository
@@ -26,7 +26,7 @@ spec:
   timeout: 2m
   patches:
     - patch: |-
-        apiVersion: autoscaling/v2
+        apiVersion: autoscaling/v2beta2
         kind: HorizontalPodAutoscaler
         metadata:
           name: podinfo

config/testdata/overlays/production.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: webapp-production
@@ -9,6 +9,7 @@ spec:
   sourceRef:
     kind: GitRepository
     name: webapp-releases
+  validation: client
   healthChecks:
     - kind: Deployment
       name: backend
@@ -18,7 +19,7 @@ spec:
       namespace: production
   timeout: 2m
 ---
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: webapp-releases
@@ -26,4 +27,4 @@ spec:
   interval: 5m
   url: https://github.com/stefanprodan/podinfo
   ref:
-    semver: ">=6.3.5"
+    semver: ">=3.2.3"

config/testdata/overlays/staging.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: webapp-staging
@@ -9,6 +9,7 @@ spec:
   sourceRef:
     kind: GitRepository
     name: webapp-releases
+  validation: client
   healthChecks:
     - kind: Deployment
       name: backend
@@ -18,7 +19,7 @@ spec:
       namespace: staging
   timeout: 2m
 ---
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
   name: webapp-latest

config/testdata/status-defaults/empty-kustomization.yaml

@@ -1,4 +1,4 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization
 metadata:
   name: status-defaults

controllers/kustomization_acl_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -22,17 +22,16 @@ import (
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	apiacl "github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
 func TestKustomizationReconciler_NoCrossNamespaceRefs(t *testing.T) {
@@ -89,8 +88,8 @@ stringData:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -115,7 +114,7 @@ stringData:
 			return resultK.Status.LastAppliedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
 
-		g.Expect(readyCondition.Reason).To(Equal(meta.ReconciliationSucceededReason))
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationSucceededReason))
 	})
 
 	t.Run("fails to reconcile from cross-namespace source", func(t *testing.T) {

controllers/kustomization_decryptor.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package decryptor
+package controllers
 
 import (
 	"bytes"
@@ -29,25 +29,12 @@ import (
 	"sync"
 	"time"
 
-	gcpkmsapi "cloud.google.com/go/kms/apiv1"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
-	awssdk "github.com/aws/aws-sdk-go-v2/aws"
 	securejoin "github.com/cyphar/filepath-securejoin"
-	"github.com/fluxcd/pkg/auth"
-	"github.com/fluxcd/pkg/auth/aws"
-	"github.com/fluxcd/pkg/auth/azure"
-	"github.com/fluxcd/pkg/auth/gcp"
-	"github.com/fluxcd/pkg/cache"
-	"github.com/getsops/sops/v3"
-	"github.com/getsops/sops/v3/aes"
-	"github.com/getsops/sops/v3/age"
-	"github.com/getsops/sops/v3/cmd/sops/common"
-	"github.com/getsops/sops/v3/cmd/sops/formats"
-	"github.com/getsops/sops/v3/config"
-	"github.com/getsops/sops/v3/keyservice"
-	"github.com/getsops/sops/v3/pgp"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/google"
+	"go.mozilla.org/sops/v3"
+	"go.mozilla.org/sops/v3/aes"
+	"go.mozilla.org/sops/v3/cmd/sops/common"
+	"go.mozilla.org/sops/v3/cmd/sops/formats"
+	"go.mozilla.org/sops/v3/keyservice"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -58,11 +45,12 @@ import (
 	kustypes "sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
-	intcache "github.com/fluxcd/kustomize-controller/internal/cache"
-	intawskms "github.com/fluxcd/kustomize-controller/internal/sops/awskms"
-	intazkv "github.com/fluxcd/kustomize-controller/internal/sops/azkv"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	"github.com/fluxcd/kustomize-controller/internal/sops/age"
+	"github.com/fluxcd/kustomize-controller/internal/sops/awskms"
+	"github.com/fluxcd/kustomize-controller/internal/sops/azkv"
 	intkeyservice "github.com/fluxcd/kustomize-controller/internal/sops/keyservice"
+	"github.com/fluxcd/kustomize-controller/internal/sops/pgp"
 )
 
 const (
@@ -116,18 +104,19 @@ var (
 	}
 )
 
-// Decryptor performs decryption operations for a v1.Kustomization.
+// KustomizeDecryptor performs decryption operations for a
+// v1beta2.Kustomization.
 // The only supported decryption provider at present is
 // DecryptionProviderSOPS.
-type Decryptor struct {
+type KustomizeDecryptor struct {
 	// root is the root for file system operations. Any (relative) path or
 	// symlink is not allowed to traverse outside this path.
 	root string
 	// client is the Kubernetes client used to e.g. retrieve Secrets with.
 	client client.Client
-	// kustomization is the v1.Kustomization we are decrypting for.
-	// The v1.Decryption of the object is used to ImportKeys().
-	kustomization *kustomizev1.Kustomization
+	// kustomization is the v1beta2.Kustomization we are decrypting for.
+	// The v1beta2.Decryption of the object is used to ImportKeys().
+	kustomization kustomizev1.Kustomization
 	// maxFileSize is the max size in bytes a file is allowed to have to be
 	// decrypted. Defaults to maxEncryptedFileSize.
 	maxFileSize int64
@@ -136,8 +125,6 @@ type Decryptor struct {
 	// injected into most resources, causing the integrity check to fail.
 	// Mostly kept around for feature completeness and documentation purposes.
 	checkSopsMac bool
-	// tokenCache is the cache for token credentials.
-	tokenCache *cache.TokenCache
 
 	// gnuPGHome is the absolute path of the GnuPG home directory used to
 	// decrypt PGP data. When empty, the systems' GnuPG keyring is used.
@@ -148,44 +135,43 @@ type Decryptor struct {
 	// vaultToken is the Hashicorp Vault token used to authenticate towards
 	// any Vault server.
 	vaultToken string
-	// awsCredentialsProvider is the AWS credentials provider object used to authenticate
+	// awsCredsProvider is the AWS credentials provider object used to authenticate
 	// towards any AWS KMS.
-	awsCredentialsProvider func(region string) awssdk.CredentialsProvider
-	// azureTokenCredential is the Azure credential token used to authenticate towards
+	awsCredsProvider *awskms.CredsProvider
+	// azureToken is the Azure credential token used to authenticate towards
 	// any Azure Key Vault.
-	azureTokenCredential azcore.TokenCredential
-	// gcpTokenSource is the GCP token source used to authenticate towards
-	// any GCP KMS.
-	gcpTokenSource oauth2.TokenSource
+	azureToken *azkv.Token
+	// gcpCredsJSON is the JSON credential file of the service account used to
+	// authenticate towards any GCP KMS.
+	gcpCredsJSON []byte
 
 	// keyServices are the SOPS keyservice.KeyServiceClient's available to the
 	// decryptor.
 	keyServices      []keyservice.KeyServiceClient
 	localServiceOnce sync.Once
-
-	// sopsAgeSecret is the NamespacedName of the Secret containing
-	// a fallback SOPS age decryption key.
-	sopsAgeSecret *types.NamespacedName
 }
 
-// New creates a new Decryptor, with a temporary GnuPG
-// home directory to Decryptor.ImportKeys() into.
-func New(client client.Client, kustomization *kustomizev1.Kustomization, opts ...Option) (*Decryptor, func(), error) {
+// NewDecryptor creates a new KustomizeDecryptor for the given kustomization.
+// gnuPGHome can be empty, in which case the systems' keyring is used.
+func NewDecryptor(root string, client client.Client, kustomization kustomizev1.Kustomization, maxFileSize int64, gnuPGHome string) *KustomizeDecryptor {
+	return &KustomizeDecryptor{
+		root:          root,
+		client:        client,
+		kustomization: kustomization,
+		maxFileSize:   maxFileSize,
+		gnuPGHome:     pgp.GnuPGHome(gnuPGHome),
+	}
+}
+
+// NewTempDecryptor creates a new KustomizeDecryptor, with a temporary GnuPG
+// home directory to KustomizeDecryptor.ImportKeys() into.
+func NewTempDecryptor(root string, client client.Client, kustomization kustomizev1.Kustomization) (*KustomizeDecryptor, func(), error) {
 	gnuPGHome, err := pgp.NewGnuPGHome()
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot create decryptor: %w", err)
 	}
 	cleanup := func() { _ = os.RemoveAll(gnuPGHome.String()) }
-	d := &Decryptor{
-		client:        client,
-		kustomization: kustomization,
-		maxFileSize:   maxEncryptedFileSize,
-		gnuPGHome:     gnuPGHome,
-	}
-	for _, opt := range opts {
-		opt(d)
-	}
-	return d, cleanup, nil
+	return NewDecryptor(root, client, kustomization, maxEncryptedFileSize, gnuPGHome.String()), cleanup, nil
 }
 
 // IsEncryptedSecret checks if the given object is a Kubernetes Secret encrypted
@@ -200,51 +186,24 @@ func IsEncryptedSecret(object *unstructured.Unstructured) bool {
 }
 
 // ImportKeys imports the DecryptionProviderSOPS keys from the data values of
-// the Secret referenced in the Kustomization's v1.Decryption spec.
+// the Secret referenced in the Kustomization's v1beta2.Decryption spec.
 // It returns an error if the Secret cannot be retrieved, or if one of the
 // imports fails.
 // Imports do not have an effect after the first call to SopsDecryptWithFormat(),
 // which initializes and caches SOPS' (local) key service server.
-// For the import of PGP keys, the Decryptor must be configured with
+// For the import of PGP keys, the KustomizeDecryptor must be configured with
 // an absolute GnuPG home directory path.
-func (d *Decryptor) ImportKeys(ctx context.Context) error {
-	if d.kustomization.Spec.Decryption == nil ||
-		(d.kustomization.Spec.Decryption.SecretRef == nil && d.sopsAgeSecret == nil) {
+func (d *KustomizeDecryptor) ImportKeys(ctx context.Context) error {
+	if d.kustomization.Spec.Decryption == nil || d.kustomization.Spec.Decryption.SecretRef == nil {
 		return nil
 	}
 
 	provider := d.kustomization.Spec.Decryption.Provider
 	switch provider {
 	case DecryptionProviderSOPS:
-		secretRef := d.kustomization.Spec.Decryption.SecretRef
-
-		// We handle the SOPS age global decryption separately, as most of the other
-		// decryption providers already support global decryption in other ways, and
-		// we don't want to introduce duplicate methods of achieving the same.
-		// Furthermore, allowing e.g. cloud provider credentials to be fetched
-		// from this global secret would prevent workload identity from working.
-		if secretRef == nil && d.sopsAgeSecret != nil {
-			var secret corev1.Secret
-			if err := d.client.Get(ctx, *d.sopsAgeSecret, &secret); err != nil {
-				if apierrors.IsNotFound(err) {
-					return err
-				}
-				return fmt.Errorf("cannot get %s SOPS age decryption Secret '%s': %w", provider, *d.sopsAgeSecret, err)
-			}
-			for name, value := range secret.Data {
-				if filepath.Ext(name) == DecryptionAgeExt {
-					if err := d.ageIdentities.Import(string(value)); err != nil {
-						return fmt.Errorf("failed to import '%s' data from %s SOPS age decryption Secret '%s': %w",
-							name, provider, *d.sopsAgeSecret, err)
-					}
-				}
-			}
-			return nil
-		}
-
 		secretName := types.NamespacedName{
 			Namespace: d.kustomization.GetNamespace(),
-			Name:      secretRef.Name,
+			Name:      d.kustomization.Spec.Decryption.SecretRef.Name,
 		}
 
 		var secret corev1.Secret
@@ -267,6 +226,7 @@ func (d *Decryptor) ImportKeys(ctx context.Context) error {
 					return fmt.Errorf("failed to import '%s' data from %s decryption Secret '%s': %w", name, provider, secretName, err)
 				}
 			case filepath.Ext(DecryptionVaultTokenFileName):
+				// Make sure we have the absolute name
 				if name == DecryptionVaultTokenFileName {
 					token := string(value)
 					token = strings.Trim(strings.TrimSpace(token), "\n")
@@ -274,32 +234,24 @@ func (d *Decryptor) ImportKeys(ctx context.Context) error {
 				}
 			case filepath.Ext(DecryptionAWSKmsFile):
 				if name == DecryptionAWSKmsFile {
-					awsCreds, err := intawskms.LoadStaticCredentialsFromYAML(value)
-					if err != nil {
+					if d.awsCredsProvider, err = awskms.LoadCredsProviderFromYaml(value); err != nil {
 						return fmt.Errorf("failed to import '%s' data from %s decryption Secret '%s': %w", name, provider, secretName, err)
 					}
-					d.awsCredentialsProvider = func(string) awssdk.CredentialsProvider { return awsCreds }
 				}
 			case filepath.Ext(DecryptionAzureAuthFile):
+				// Make sure we have the absolute name
 				if name == DecryptionAzureAuthFile {
-					conf := intazkv.AADConfig{}
-					if err = intazkv.LoadAADConfigFromBytes(value, &conf); err != nil {
+					conf := azkv.AADConfig{}
+					if err = azkv.LoadAADConfigFromBytes(value, &conf); err != nil {
 						return fmt.Errorf("failed to import '%s' data from %s decryption Secret '%s': %w", name, provider, secretName, err)
 					}
-					azureToken, err := intazkv.TokenCredentialFromAADConfig(conf)
-					if err != nil {
+					if d.azureToken, err = azkv.TokenFromAADConfig(conf); err != nil {
 						return fmt.Errorf("failed to import '%s' data from %s decryption Secret '%s': %w", name, provider, secretName, err)
 					}
-					d.azureTokenCredential = azureToken
 				}
 			case filepath.Ext(DecryptionGCPCredsFile):
 				if name == DecryptionGCPCredsFile {
-					creds, err := google.CredentialsFromJSON(ctx,
-						bytes.Trim(value, "\n"), gcpkmsapi.DefaultAuthScopes()...)
-					if err != nil {
-						return fmt.Errorf("failed to import '%s' data from %s decryption Secret '%s': %w", name, provider, secretName, err)
-					}
-					d.gcpTokenSource = creds.TokenSource
+					d.gcpCredsJSON = bytes.Trim(value, "\n")
 				}
 			}
 		}
@@ -307,68 +259,11 @@ func (d *Decryptor) ImportKeys(ctx context.Context) error {
 	return nil
 }
 
-// SetAuthOptions sets the authentication options for secret-less authentication
-// with cloud providers.
-func (d *Decryptor) SetAuthOptions(ctx context.Context) {
-	if d.kustomization.Spec.Decryption == nil {
-		return
-	}
-
-	switch d.kustomization.Spec.Decryption.Provider {
-	case DecryptionProviderSOPS:
-		var opts []auth.Option
-
-		if d.kustomization.Spec.Decryption.ServiceAccountName != "" {
-			serviceAccount := types.NamespacedName{
-				Name:      d.kustomization.Spec.Decryption.ServiceAccountName,
-				Namespace: d.kustomization.GetNamespace(),
-			}
-			opts = append(opts, auth.WithServiceAccount(serviceAccount, d.client))
-		}
-
-		involvedObject := cache.InvolvedObject{
-			Kind:      kustomizev1.KustomizationKind,
-			Name:      d.kustomization.GetName(),
-			Namespace: d.kustomization.GetNamespace(),
-		}
-
-		if d.awsCredentialsProvider == nil {
-			awsOpts := opts
-			if d.tokenCache != nil {
-				involvedObject.Operation = intcache.OperationDecryptWithAWS
-				awsOpts = append(awsOpts, auth.WithCache(*d.tokenCache, involvedObject))
-			}
-			d.awsCredentialsProvider = func(region string) awssdk.CredentialsProvider {
-				awsOpts := append(awsOpts, auth.WithSTSRegion(region))
-				return aws.NewCredentialsProvider(ctx, awsOpts...)
-			}
-		}
-
-		if d.azureTokenCredential == nil {
-			azureOpts := opts
-			if d.tokenCache != nil {
-				involvedObject.Operation = intcache.OperationDecryptWithAzure
-				azureOpts = append(azureOpts, auth.WithCache(*d.tokenCache, involvedObject))
-			}
-			d.azureTokenCredential = azure.NewTokenCredential(ctx, azureOpts...)
-		}
-
-		if d.gcpTokenSource == nil {
-			gcpOpts := opts
-			if d.tokenCache != nil {
-				involvedObject.Operation = intcache.OperationDecryptWithGCP
-				gcpOpts = append(gcpOpts, auth.WithCache(*d.tokenCache, involvedObject))
-			}
-			d.gcpTokenSource = gcp.NewTokenSource(ctx, gcpOpts...)
-		}
-	}
-}
-
 // SopsDecryptWithFormat attempts to load a SOPS encrypted file using the store
 // for the input format, gathers the data key for it from the key service,
 // and then decrypts the file data with the retrieved data key.
 // It returns the decrypted bytes in the provided output format, or an error.
-func (d *Decryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat formats.Format) (_ []byte, err error) {
+func (d *KustomizeDecryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat formats.Format) (_ []byte, err error) {
 	defer func() {
 		// It was discovered that malicious input and/or output instructions can
 		// make SOPS panic. Recover from this panic and return as an error.
@@ -378,20 +273,20 @@ func (d *Decryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat
 		}
 	}()
 
-	store := common.StoreForFormat(inputFormat, config.NewStoresConfig())
+	store := common.StoreForFormat(inputFormat)
 
 	tree, err := store.LoadEncryptedFile(data)
 	if err != nil {
 		return nil, sopsUserErr(fmt.Sprintf("failed to load encrypted %s data", sopsFormatToString[inputFormat]), err)
 	}
 
-	metadataKey, err := tree.Metadata.GetDataKeyWithKeyServices(d.keyServiceServer(), sops.DefaultDecryptionOrder)
+	metadataKey, err := tree.Metadata.GetDataKeyWithKeyServices(d.keyServiceServer())
 	if err != nil {
 		return nil, sopsUserErr("cannot get sops data key", err)
 	}
 
 	cipher := aes.NewCipher()
-	mac, err := safeDecrypt(tree.Decrypt(metadataKey, cipher))
+	mac, err := tree.Decrypt(metadataKey, cipher)
 	if err != nil {
 		return nil, sopsUserErr("error decrypting sops tree", err)
 	}
@@ -400,12 +295,12 @@ func (d *Decryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat
 		// Compute the hash of the cleartext tree and compare it with
 		// the one that was stored in the document. If they match,
 		// integrity was preserved
-		// Ref: github.com/getsops/sops/v3/decrypt/decrypt.go
-		originalMac, err := safeDecrypt(cipher.Decrypt(
+		// Ref: go.mozilla.org/sops/v3/decrypt/decrypt.go
+		originalMac, err := cipher.Decrypt(
 			tree.Metadata.MessageAuthenticationCode,
 			metadataKey,
 			tree.Metadata.LastModified.Format(time.RFC3339),
-		))
+		)
 		if err != nil {
 			return nil, sopsUserErr("failed to verify sops data integrity", err)
 		}
@@ -418,7 +313,7 @@ func (d *Decryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat
 		}
 	}
 
-	outputStore := common.StoreForFormat(outputFormat, config.NewStoresConfig())
+	outputStore := common.StoreForFormat(outputFormat)
 	out, err := outputStore.EmitPlainFile(tree.Branches)
 	if err != nil {
 		return nil, sopsUserErr(fmt.Sprintf("failed to emit encrypted %s file as decrypted %s",
@@ -433,7 +328,7 @@ func (d *Decryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat
 // It has special support for Kubernetes Secrets with encrypted data entries
 // while decrypting with DecryptionProviderSOPS, to allow individual data entries
 // injected by e.g. a Kustomize secret generator to be decrypted
-func (d *Decryptor) DecryptResource(res *resource.Resource) (*resource.Resource, error) {
+func (d *KustomizeDecryptor) DecryptResource(res *resource.Resource) (*resource.Resource, error) {
 	if res == nil || d.kustomization.Spec.Decryption == nil || d.kustomization.Spec.Decryption.Provider == "" {
 		return nil, nil
 	}
@@ -491,28 +386,28 @@ func (d *Decryptor) DecryptResource(res *resource.Resource) (*resource.Resource,
 	return nil, nil
 }
 
-// DecryptSources attempts to decrypt all types.SecretArgs FileSources and
+// DecryptEnvSources attempts to decrypt all types.SecretArgs FileSources and
 // EnvSources a Kustomization file in the directory at the provided path refers
 // to, before walking recursively over all other resources it refers to.
 // It ignores resource references which refer to absolute or relative paths
 // outside the working directory of the decryptor, but returns any decryption
 // error.
-func (d *Decryptor) DecryptSources(path string) error {
+func (d *KustomizeDecryptor) DecryptEnvSources(path string) error {
 	if d.kustomization.Spec.Decryption == nil || d.kustomization.Spec.Decryption.Provider != DecryptionProviderSOPS {
 		return nil
 	}
 
 	decrypted, visited := make(map[string]struct{}, 0), make(map[string]struct{}, 0)
-	visit := d.decryptKustomizationSources(decrypted)
+	visit := d.decryptKustomizationEnvSources(decrypted)
 	return recurseKustomizationFiles(d.root, path, visit, visited)
 }
 
-// decryptKustomizationSources returns a visitKustomization implementation
+// decryptKustomizationEnvSources returns a visitKustomization implementation
 // which attempts to decrypt any EnvSources entry it finds in the Kustomization
 // file with which it is called.
 // After decrypting successfully, it adds the absolute path of the file to the
 // given map.
-func (d *Decryptor) decryptKustomizationSources(visited map[string]struct{}) visitKustomization {
+func (d *KustomizeDecryptor) decryptKustomizationEnvSources(visited map[string]struct{}) visitKustomization {
 	return func(root, path string, kus *kustypes.Kustomization) error {
 		visitRef := func(sourcePath string, format formats.Format) error {
 			if !filepath.IsAbs(sourcePath) {
@@ -525,19 +420,19 @@ func (d *Decryptor) decryptKustomizationSources(visited map[string]struct{}) vis
 			if _, ok := visited[absRef]; ok {
 				return nil
 			}
+
 			if err := d.sopsDecryptFile(absRef, format, format); err != nil {
 				return securePathErr(root, err)
 			}
+
 			// Explicitly set _after_ the decryption operation, this makes
 			// visited work as a list of actually decrypted files
 			visited[absRef] = struct{}{}
 			return nil
 		}
 
-		// Iterate over all SecretGenerator entries in the Kustomization file and attempt to decrypt their FileSources and EnvSources.
 		for _, gen := range kus.SecretGenerator {
 			for _, fileSrc := range gen.FileSources {
-				// Split the source path from any associated key, defaulting to the key if not specified.
 				parts := strings.SplitN(fileSrc, "=", 2)
 				key := parts[0]
 				var filePath string
@@ -546,36 +441,21 @@ func (d *Decryptor) decryptKustomizationSources(visited map[string]struct{}) vis
 				} else {
 					filePath = key
 				}
-				// Visit the file reference and attempt to decrypt it.
 				if err := visitRef(filePath, formatForPath(key)); err != nil {
 					return err
 				}
 			}
 			for _, envFile := range gen.EnvSources {
-				// Determine the format for the environment file, defaulting to Dotenv if not specified.
 				format := formatForPath(envFile)
 				if format == formats.Binary {
 					// Default to dotenv
 					format = formats.Dotenv
 				}
-				// Visit the environment file reference and attempt to decrypt it.
 				if err := visitRef(envFile, format); err != nil {
 					return err
 				}
 			}
 		}
-		// Iterate over all patches in the Kustomization file and attempt to decrypt their paths if they are encrypted.
-		for _, patch := range kus.Patches {
-			if patch.Path == "" {
-				continue
-			}
-			// Determine the format for the patch, defaulting to YAML if not specified.
-			format := formatForPath(patch.Path)
-			// Visit the patch reference and attempt to decrypt it.
-			if err := visitRef(patch.Path, format); err != nil {
-				return err
-			}
-		}
 		return nil
 	}
 }
@@ -589,7 +469,7 @@ func (d *Decryptor) decryptKustomizationSources(visited map[string]struct{}) vis
 // NB: The method only does the simple checks described above and does not
 // verify whether the path provided is inside the working directory. Boundary
 // enforcement is expected to have been done by the caller.
-func (d *Decryptor) sopsDecryptFile(path string, inputFormat, outputFormat formats.Format) error {
+func (d *KustomizeDecryptor) sopsDecryptFile(path string, inputFormat, outputFormat formats.Format) error {
 	fi, err := os.Lstat(path)
 	if err != nil {
 		return err
@@ -615,7 +495,7 @@ func (d *Decryptor) sopsDecryptFile(path string, inputFormat, outputFormat forma
 	if err != nil {
 		return err
 	}
-	err = os.WriteFile(path, out, 0o600)
+	err = os.WriteFile(path, out, 0o644)
 	if err != nil {
 		return fmt.Errorf("error writing sops decrypted %s data to %s file: %w",
 			sopsFormatToString[inputFormat], sopsFormatToString[outputFormat], err)
@@ -627,8 +507,8 @@ func (d *Decryptor) sopsDecryptFile(path string, inputFormat, outputFormat forma
 // for the input format, gathers the data key for it from the key service,
 // and then encrypt the file data with the retrieved data key.
 // It returns the encrypted bytes in the provided output format, or an error.
-func (d *Decryptor) sopsEncryptWithFormat(metadata sops.Metadata, data []byte, inputFormat, outputFormat formats.Format) ([]byte, error) {
-	store := common.StoreForFormat(inputFormat, config.NewStoresConfig())
+func (d *KustomizeDecryptor) sopsEncryptWithFormat(metadata sops.Metadata, data []byte, inputFormat, outputFormat formats.Format) ([]byte, error) {
+	store := common.StoreForFormat(inputFormat)
 
 	branches, err := store.LoadPlainFile(data)
 	if err != nil {
@@ -655,7 +535,7 @@ func (d *Decryptor) sopsEncryptWithFormat(metadata sops.Metadata, data []byte, i
 		return nil, sopsUserErr("cannot encrypt sops data tree", err)
 	}
 
-	outStore := common.StoreForFormat(outputFormat, config.NewStoresConfig())
+	outStore := common.StoreForFormat(outputFormat)
 	out, err := outStore.EmitEncryptedFile(tree)
 	if err != nil {
 		return nil, sopsUserErr("failed to emit sops encrypted file", err)
@@ -664,27 +544,29 @@ func (d *Decryptor) sopsEncryptWithFormat(metadata sops.Metadata, data []byte, i
 }
 
 // keyServiceServer returns the SOPS (local) key service clients used to serve
-// decryption requests. loadKeyServiceServer() is only configured on the first
+// decryption requests. loadKeyServiceServers() is only configured on the first
 // call.
-func (d *Decryptor) keyServiceServer() []keyservice.KeyServiceClient {
+func (d *KustomizeDecryptor) keyServiceServer() []keyservice.KeyServiceClient {
 	d.localServiceOnce.Do(func() {
-		d.loadKeyServiceServer()
+		d.loadKeyServiceServers()
 	})
 	return d.keyServices
 }
 
-// loadKeyServiceServer loads the SOPS (local) key service clients used to
-// serve decryption requests for the current set of Decryptor
+// loadKeyServiceServers loads the SOPS (local) key service clients used to
+// serve decryption requests for the current set of KustomizeDecryptor
 // credentials.
-func (d *Decryptor) loadKeyServiceServer() {
+func (d *KustomizeDecryptor) loadKeyServiceServers() {
 	serverOpts := []intkeyservice.ServerOption{
 		intkeyservice.WithGnuPGHome(d.gnuPGHome),
 		intkeyservice.WithVaultToken(d.vaultToken),
 		intkeyservice.WithAgeIdentities(d.ageIdentities),
-		intkeyservice.WithAWSCredentialsProvider{CredentialsProvider: d.awsCredentialsProvider},
-		intkeyservice.WithAzureTokenCredential{TokenCredential: d.azureTokenCredential},
-		intkeyservice.WithGCPTokenSource{TokenSource: d.gcpTokenSource},
+		intkeyservice.WithGCPCredsJSON(d.gcpCredsJSON),
 	}
+	if d.azureToken != nil {
+		serverOpts = append(serverOpts, intkeyservice.WithAzureToken{Token: d.azureToken})
+	}
+	serverOpts = append(serverOpts, intkeyservice.WithAWSKeys{CredsProvider: d.awsCredsProvider})
 	server := intkeyservice.NewServer(serverOpts...)
 	d.keyServices = append(make([]keyservice.KeyServiceClient, 0), keyservice.NewCustomLocalClient(server))
 }
@@ -739,7 +621,7 @@ func secureLoadKustomizationFile(root, path string) (*kustypes.Kustomization, er
 		},
 	}
 	if err := yaml.Unmarshal(data, &kus); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal kustomization file from '%s': %w", loadPath, err)
+		return nil, fmt.Errorf("failed to unmarshal kustomization file: %w", err)
 	}
 	return &kus, nil
 }
@@ -809,13 +691,9 @@ func recurseKustomizationFiles(root, path string, visit visitKustomization, visi
 		return err
 	}
 
-	// Components may contain resources as well, ...
-	// ...so we have to process both .resources and .components values
-	resources := append(kus.Resources, kus.Components...)
-
 	// Recurse over other resources in Kustomization,
 	// repeating the above logic per item
-	for _, res := range resources {
+	for _, res := range kus.Resources {
 		if !filepath.IsAbs(res) {
 			res = filepath.Join(path, res)
 		}
@@ -879,7 +757,7 @@ func stripRoot(root, path string) string {
 
 func sopsUserErr(msg string, err error) error {
 	if userErr, ok := err.(sops.UserError); ok {
-		err = errors.New(userErr.UserError())
+		err = fmt.Errorf(userErr.UserError())
 	}
 	return fmt.Errorf("%s: %w", msg, err)
 }
@@ -908,33 +786,3 @@ func detectFormatFromMarkerBytes(b []byte) formats.Format {
 	}
 	return unsupportedFormat
 }
-
-// safeDecrypt redacts secret values in sops error messages.
-func safeDecrypt[T any](mac T, err error) (T, error) {
-	const (
-		prefix = "Input string "
-		suffix = " does not match sops' data format"
-	)
-
-	if err == nil {
-		return mac, nil
-	}
-
-	var buf strings.Builder
-
-	e := err.Error()
-	prefIdx := strings.Index(e, prefix)
-	suffIdx := strings.Index(e, suffix)
-
-	var zero T
-	if prefIdx == -1 || suffIdx == -1 {
-		return zero, err
-	}
-
-	buf.WriteString(e[:prefIdx])
-	buf.WriteString(prefix)
-	buf.WriteString("<redacted>")
-	buf.WriteString(suffix)
-
-	return zero, errors.New(buf.String())
-}

controllers/kustomization_decryptor_test.go

@@ -14,16 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package decryptor
+package controllers
 
 import (
 	"bytes"
 	"context"
 	"encoding/base64"
-	"errors"
 	"fmt"
 	"io/fs"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -31,14 +31,18 @@ import (
 	"time"
 
 	extage "filippo.io/age"
-	"github.com/getsops/sops/v3"
-	"github.com/getsops/sops/v3/age"
-	"github.com/getsops/sops/v3/cmd/sops/formats"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	"github.com/hashicorp/vault/api"
 	. "github.com/onsi/gomega"
 	gt "github.com/onsi/gomega/types"
+	"go.mozilla.org/sops/v3"
+	sopsage "go.mozilla.org/sops/v3/age"
+	"go.mozilla.org/sops/v3/cmd/sops/formats"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/provider"
@@ -46,11 +50,204 @@ import (
 	kustypes "sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/yaml"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	"github.com/fluxcd/kustomize-controller/internal/sops/age"
 	"github.com/fluxcd/pkg/apis/meta"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
+func TestKustomizationReconciler_Decryptor(t *testing.T) {
+	g := NewWithT(t)
+
+	cli, err := api.NewClient(api.DefaultConfig())
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create vault client")
+
+	// create a master key on the vault transit engine
+	path, data := "sops/keys/firstkey", map[string]interface{}{"type": "rsa-4096"}
+	_, err = cli.Logical().Write(path, data)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to write key")
+
+	// encrypt the testdata vault secret
+	cmd := exec.Command("sops", "--hc-vault-transit", cli.Address()+"/v1/sops/keys/firstkey", "--encrypt", "--encrypted-regex", "^(data|stringData)$", "--in-place", "./testdata/sops/secret.vault.yaml")
+	err = cmd.Run()
+	g.Expect(err).NotTo(HaveOccurred(), "failed to encrypt file")
+
+	// defer the testdata vault secret decryption, to leave a clean testdata vault secret
+	defer func() {
+		cmd := exec.Command("sops", "--hc-vault-transit", cli.Address()+"/v1/sops/keys/firstkey", "--decrypt", "--encrypted-regex", "^(data|stringData)$", "--in-place", "./testdata/sops/secret.vault.yaml")
+		err = cmd.Run()
+	}()
+
+	id := "sops-" + randStringRunes(5)
+
+	err = createNamespace(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
+
+	err = createKubeConfigSecret(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
+
+	artifactName := "sops-" + randStringRunes(5)
+	artifactChecksum, err := createArtifact(testServer, "testdata/sops", artifactName)
+	g.Expect(err).ToNot(HaveOccurred())
+
+	overlayArtifactName := "sops-" + randStringRunes(5)
+	overlayChecksum, err := createArtifact(testServer, "testdata/test-dotenv", overlayArtifactName)
+	g.Expect(err).ToNot(HaveOccurred())
+
+	repositoryName := types.NamespacedName{
+		Name:      fmt.Sprintf("sops-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+
+	overlayRepositoryName := types.NamespacedName{
+		Name:      fmt.Sprintf("sops-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+
+	err = applyGitRepository(repositoryName, artifactName, "main/"+artifactChecksum)
+	g.Expect(err).NotTo(HaveOccurred())
+
+	err = applyGitRepository(overlayRepositoryName, overlayArtifactName, "main/"+overlayChecksum)
+	g.Expect(err).NotTo(HaveOccurred())
+
+	pgpKey, err := os.ReadFile("testdata/sops/pgp.asc")
+	g.Expect(err).ToNot(HaveOccurred())
+	ageKey, err := os.ReadFile("testdata/sops/age.txt")
+	g.Expect(err).ToNot(HaveOccurred())
+
+	sopsSecretKey := types.NamespacedName{
+		Name:      "sops-" + randStringRunes(5),
+		Namespace: id,
+	}
+
+	sopsSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      sopsSecretKey.Name,
+			Namespace: sopsSecretKey.Namespace,
+		},
+		StringData: map[string]string{
+			"pgp.asc":          string(pgpKey),
+			"age.agekey":       string(ageKey),
+			"sops.vault-token": "secret",
+		},
+	}
+
+	g.Expect(k8sClient.Create(context.Background(), sopsSecret)).To(Succeed())
+
+	kustomizationKey := types.NamespacedName{
+		Name:      fmt.Sprintf("sops-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+	kustomization := &kustomizev1.Kustomization{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      kustomizationKey.Name,
+			Namespace: kustomizationKey.Namespace,
+		},
+		Spec: kustomizev1.KustomizationSpec{
+			Interval: metav1.Duration{Duration: 2 * time.Minute},
+			Path:     "./",
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
+					Name: "kubeconfig",
+				},
+			},
+			SourceRef: kustomizev1.CrossNamespaceSourceReference{
+				Name:      repositoryName.Name,
+				Namespace: repositoryName.Namespace,
+				Kind:      sourcev1.GitRepositoryKind,
+			},
+			Decryption: &kustomizev1.Decryption{
+				Provider: "sops",
+				SecretRef: &meta.LocalObjectReference{
+					Name: sopsSecretKey.Name,
+				},
+			},
+			TargetNamespace: id,
+		},
+	}
+	g.Expect(k8sClient.Create(context.TODO(), kustomization)).To(Succeed())
+
+	g.Eventually(func() bool {
+		var obj kustomizev1.Kustomization
+		_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), &obj)
+		return obj.Status.LastAppliedRevision == "main/"+artifactChecksum
+	}, timeout, time.Second).Should(BeTrue())
+
+	overlayKustomizationName := fmt.Sprintf("sops-%s", randStringRunes(5))
+	overlayKs := kustomization.DeepCopy()
+	overlayKs.ResourceVersion = ""
+	overlayKs.Name = overlayKustomizationName
+	overlayKs.Spec.SourceRef.Name = overlayRepositoryName.Name
+	overlayKs.Spec.SourceRef.Namespace = overlayRepositoryName.Namespace
+	overlayKs.Spec.Path = "./testdata/test-dotenv/overlays"
+
+	g.Expect(k8sClient.Create(context.TODO(), overlayKs)).To(Succeed())
+
+	g.Eventually(func() bool {
+		var obj kustomizev1.Kustomization
+		_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(overlayKs), &obj)
+		return obj.Status.LastAppliedRevision == "main/"+overlayChecksum
+	}, timeout, time.Second).Should(BeTrue())
+
+	t.Run("decrypts SOPS secrets", func(t *testing.T) {
+		g := NewWithT(t)
+
+		var pgpSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-pgp", Namespace: id}, &pgpSecret)).To(Succeed())
+		g.Expect(pgpSecret.Data["secret"]).To(Equal([]byte(`my-sops-pgp-secret`)))
+
+		var ageSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-age", Namespace: id}, &ageSecret)).To(Succeed())
+		g.Expect(ageSecret.Data["secret"]).To(Equal([]byte(`my-sops-age-secret`)))
+
+		var daySecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-day", Namespace: id}, &daySecret)).To(Succeed())
+		g.Expect(string(daySecret.Data["secret"])).To(Equal("day=Tuesday\n"))
+
+		var yearSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-year", Namespace: id}, &yearSecret)).To(Succeed())
+		g.Expect(string(yearSecret.Data["year"])).To(Equal("2017"))
+
+		var unencryptedSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "unencrypted-sops-year", Namespace: id}, &unencryptedSecret)).To(Succeed())
+		g.Expect(string(unencryptedSecret.Data["year"])).To(Equal("2021"))
+
+		var year1Secret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-year1", Namespace: id}, &year1Secret)).To(Succeed())
+		g.Expect(string(year1Secret.Data["year"])).To(Equal("year1"))
+
+		var year2Secret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-year2", Namespace: id}, &year2Secret)).To(Succeed())
+		g.Expect(string(year2Secret.Data["year"])).To(Equal("year2"))
+
+		var encodedSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-month", Namespace: id}, &encodedSecret)).To(Succeed())
+		g.Expect(string(encodedSecret.Data["month.yaml"])).To(Equal("month: May\n"))
+
+		var hcvaultSecret corev1.Secret
+		g.Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "sops-hcvault", Namespace: id}, &hcvaultSecret)).To(Succeed())
+		g.Expect(string(hcvaultSecret.Data["secret"])).To(Equal("my-sops-vault-secret\n"))
+	})
+
+	t.Run("does not emit change events for identical secrets", func(t *testing.T) {
+		g := NewWithT(t)
+
+		resultK := &kustomizev1.Kustomization{}
+		revision := "v2.0.0"
+		err = applyGitRepository(repositoryName, artifactName, revision)
+		g.Expect(err).NotTo(HaveOccurred())
+
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			return resultK.Status.LastAttemptedRevision == revision
+		}, timeout, time.Second).Should(BeTrue())
+
+		events := getEvents(resultK.GetName(), map[string]string{"kustomize.toolkit.fluxcd.io/revision": revision})
+		g.Expect(len(events)).To(BeIdenticalTo(1))
+		g.Expect(events[0].Message).Should(ContainSubstring("Reconciliation finished"))
+		g.Expect(events[0].Message).ShouldNot(ContainSubstring("configured"))
+	})
+}
+
 func TestIsEncryptedSecret(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -72,14 +269,14 @@ func TestIsEncryptedSecret(t *testing.T) {
 	}
 }
 
-func TestDecryptor_ImportKeys(t *testing.T) {
+func TestKustomizeDecryptor_ImportKeys(t *testing.T) {
 	g := NewWithT(t)
 
 	const provider = "sops"
 
-	pgpKey, err := os.ReadFile("testdata/pgp.asc")
+	pgpKey, err := os.ReadFile("testdata/sops/pgp.asc")
 	g.Expect(err).ToNot(HaveOccurred())
-	ageKey, err := os.ReadFile("testdata/age.txt")
+	ageKey, err := os.ReadFile("testdata/sops/age.txt")
 	g.Expect(err).ToNot(HaveOccurred())
 
 	tests := []struct {
@@ -87,7 +284,7 @@ func TestDecryptor_ImportKeys(t *testing.T) {
 		decryption  *kustomizev1.Decryption
 		secret      *corev1.Secret
 		wantErr     bool
-		inspectFunc func(g *GomegaWithT, decryptor *Decryptor)
+		inspectFunc func(g *GomegaWithT, decryptor *KustomizeDecryptor)
 	}{
 		{
 			name: "PGP key",
@@ -143,7 +340,7 @@ func TestDecryptor_ImportKeys(t *testing.T) {
 					"age" + DecryptionAgeExt: ageKey,
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
 				g.Expect(decryptor.ageIdentities).To(HaveLen(1))
 			},
 		},
@@ -165,7 +362,7 @@ func TestDecryptor_ImportKeys(t *testing.T) {
 				},
 			},
 			wantErr: true,
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
 				g.Expect(decryptor.ageIdentities).To(HaveLen(0))
 			},
 		},
@@ -186,7 +383,7 @@ func TestDecryptor_ImportKeys(t *testing.T) {
 					DecryptionVaultTokenFileName: []byte("some-hcvault-token"),
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
 				g.Expect(decryptor.vaultToken).To(Equal("some-hcvault-token"))
 			},
 		},
@@ -209,8 +406,8 @@ aws_secret_access_key: test-secret
 aws_session_token: test-token`),
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
-				g.Expect(decryptor.awsCredentialsProvider).ToNot(BeNil())
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
+				g.Expect(decryptor.awsCredsProvider).ToNot(BeNil())
 			},
 		},
 		{
@@ -232,8 +429,8 @@ aws_session_token: test-token`),
 				   "type": "authorized_user"}`),
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
-				g.Expect(decryptor.gcpTokenSource).ToNot(BeNil())
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
+				g.Expect(decryptor.gcpCredsJSON).ToNot(BeNil())
 			},
 		},
 		{
@@ -255,8 +452,8 @@ clientId: some-client-id
 clientSecret: some-client-secret`),
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
-				g.Expect(decryptor.azureTokenCredential).ToNot(BeNil())
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
+				g.Expect(decryptor.azureToken).ToNot(BeNil())
 			},
 		},
 		{
@@ -277,8 +474,8 @@ clientSecret: some-client-secret`),
 				},
 			},
 			wantErr: true,
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
-				g.Expect(decryptor.azureTokenCredential).To(BeNil())
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
+				g.Expect(decryptor.azureToken).To(BeNil())
 			},
 		},
 		{
@@ -299,8 +496,8 @@ clientSecret: some-client-secret`),
 				},
 			},
 			wantErr: true,
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
-				g.Expect(decryptor.azureTokenCredential).To(BeNil())
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
+				g.Expect(decryptor.azureToken).To(BeNil())
 			},
 		},
 		{
@@ -321,7 +518,7 @@ clientSecret: some-client-secret`),
 					DecryptionVaultTokenFileName: []byte("some-hcvault-token"),
 				},
 			},
-			inspectFunc: func(g *GomegaWithT, decryptor *Decryptor) {
+			inspectFunc: func(g *GomegaWithT, decryptor *KustomizeDecryptor) {
 				g.Expect(decryptor.vaultToken).ToNot(BeEmpty())
 				g.Expect(decryptor.ageIdentities).To(HaveLen(1))
 			},
@@ -376,7 +573,7 @@ clientSecret: some-client-secret`),
 				},
 			}
 
-			d, cleanup, err := New(cb.Build(), &kustomization)
+			d, cleanup, err := NewTempDecryptor("", cb.Build(), kustomization)
 			g.Expect(err).ToNot(HaveOccurred())
 			t.Cleanup(cleanup)
 
@@ -393,77 +590,23 @@ clientSecret: some-client-secret`),
 	}
 }
 
-func TestDecryptor_SetAuthOptions(t *testing.T) {
-	t.Run("nil decryption settings", func(t *testing.T) {
-		g := NewWithT(t)
-
-		d := &Decryptor{
-			kustomization: &kustomizev1.Kustomization{},
-		}
-
-		d.SetAuthOptions(context.Background())
-
-		g.Expect(d.awsCredentialsProvider).To(BeNil())
-		g.Expect(d.azureTokenCredential).To(BeNil())
-		g.Expect(d.gcpTokenSource).To(BeNil())
-	})
-
-	t.Run("non-sops provider", func(t *testing.T) {
-		g := NewWithT(t)
-
-		d := &Decryptor{
-			kustomization: &kustomizev1.Kustomization{
-				Spec: kustomizev1.KustomizationSpec{
-					Decryption: &kustomizev1.Decryption{},
-				},
-			},
-		}
-
-		d.SetAuthOptions(context.Background())
-
-		g.Expect(d.awsCredentialsProvider).To(BeNil())
-		g.Expect(d.azureTokenCredential).To(BeNil())
-		g.Expect(d.gcpTokenSource).To(BeNil())
-	})
-
-	t.Run("sops provider", func(t *testing.T) {
-		g := NewWithT(t)
-
-		d := &Decryptor{
-			kustomization: &kustomizev1.Kustomization{
-				Spec: kustomizev1.KustomizationSpec{
-					Decryption: &kustomizev1.Decryption{
-						Provider: DecryptionProviderSOPS,
-					},
-				},
-			},
-		}
-
-		d.SetAuthOptions(context.Background())
-
-		g.Expect(d.awsCredentialsProvider).NotTo(BeNil())
-		g.Expect(d.azureTokenCredential).NotTo(BeNil())
-		g.Expect(d.gcpTokenSource).NotTo(BeNil())
-	})
-}
-
-func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
+func TestKustomizeDecryptor_SopsDecryptWithFormat(t *testing.T) {
 	t.Run("decrypt INI to INI", func(t *testing.T) {
 		g := NewWithT(t)
 
 		ageID, err := extage.GenerateX25519Identity()
 		g.Expect(err).ToNot(HaveOccurred())
 
-		kd := &Decryptor{
+		kd := &KustomizeDecryptor{
 			checkSopsMac:  true,
 			ageIdentities: age.ParsedIdentities{ageID},
 		}
 
 		format := formats.Ini
-		data := []byte("[config]\nkey = value\n")
+		data := []byte("[config]\nkey = value\n\n")
 		encData, err := kd.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, data, format, format)
 		g.Expect(err).ToNot(HaveOccurred())
@@ -481,7 +624,7 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		ageID, err := extage.GenerateX25519Identity()
 		g.Expect(err).ToNot(HaveOccurred())
 
-		kd := &Decryptor{
+		kd := &KustomizeDecryptor{
 			checkSopsMac:  true,
 			ageIdentities: age.ParsedIdentities{ageID},
 		}
@@ -490,13 +633,14 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		data := []byte("{\"key\": \"value\"}\n")
 		encData, err := kd.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, data, inputFormat, inputFormat)
 		g.Expect(err).ToNot(HaveOccurred())
 		g.Expect(bytes.Contains(encData, sopsFormatToMarkerBytes[inputFormat])).To(BeTrue())
 
 		out, err := kd.SopsDecryptWithFormat(encData, inputFormat, outputFormat)
+		t.Logf("%s", out)
 		g.Expect(err).ToNot(HaveOccurred())
 		g.Expect(out).To(Equal([]byte("key: value\n")))
 	})
@@ -505,7 +649,7 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		g := NewWithT(t)
 
 		format := formats.Json
-		data, err := (&Decryptor{}).SopsDecryptWithFormat([]byte("invalid json"), format, format)
+		data, err := (&KustomizeDecryptor{}).SopsDecryptWithFormat([]byte("invalid json"), format, format)
 		g.Expect(err).To(HaveOccurred())
 		g.Expect(err.Error()).To(ContainSubstring("failed to load encrypted JSON data"))
 		g.Expect(data).To(BeNil())
@@ -517,12 +661,12 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		ageID, err := extage.GenerateX25519Identity()
 		g.Expect(err).ToNot(HaveOccurred())
 
-		kd := &Decryptor{}
+		kd := &KustomizeDecryptor{}
 
 		format := formats.Binary
 		encData, err := kd.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, []byte("foo bar"), format, format)
 		g.Expect(err).ToNot(HaveOccurred())
@@ -540,7 +684,7 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		ageID, err := extage.GenerateX25519Identity()
 		g.Expect(err).ToNot(HaveOccurred())
 
-		kd := &Decryptor{
+		kd := &KustomizeDecryptor{
 			checkSopsMac:  true,
 			ageIdentities: age.ParsedIdentities{ageID},
 		}
@@ -549,7 +693,7 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 		data := []byte("key=value\n")
 		encData, err := kd.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, data, format, format)
 		g.Expect(err).ToNot(HaveOccurred())
@@ -568,13 +712,13 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) {
 	})
 }
 
-func TestDecryptor_DecryptResource(t *testing.T) {
+func TestKustomizeDecryptor_DecryptResource(t *testing.T) {
 	var (
-		resourceFactory  = provider.NewDefaultDepProvider().GetResourceFactory()
-		emptyResource, _ = resourceFactory.FromMap(map[string]interface{}{})
+		resourceFactory = provider.NewDefaultDepProvider().GetResourceFactory()
+		emptyResource   = resourceFactory.FromMap(map[string]interface{}{})
 	)
 
-	newSecretResource := func(namespace, name string, data map[string]interface{}) (*resource.Resource, error) {
+	newSecretResource := func(namespace, name string, data map[string]interface{}) *resource.Resource {
 		return resourceFactory.FromMap(map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Secret",
@@ -605,7 +749,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 			Provider: DecryptionProviderSOPS,
 		}
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kus)
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kus)
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -613,7 +757,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		g.Expect(err).ToNot(HaveOccurred())
 		d.ageIdentities = append(d.ageIdentities, ageID)
 
-		secret, _ := newSecretResource("test", "secret", map[string]interface{}{
+		secret := newSecretResource("test", "secret", map[string]interface{}{
 			"key": "value",
 		})
 		g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse())
@@ -624,7 +768,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		encData, err := d.sopsEncryptWithFormat(sops.Metadata{
 			EncryptedRegex: "^(data|stringData)$",
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, secretData, formats.Json, formats.Json)
 		g.Expect(err).ToNot(HaveOccurred())
@@ -646,7 +790,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 			Provider: DecryptionProviderSOPS,
 		}
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kus)
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kus)
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -654,15 +798,15 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		g.Expect(err).ToNot(HaveOccurred())
 		d.ageIdentities = append(d.ageIdentities, ageID)
 
-		plainData := []byte("[config]\napp = secret\n")
+		plainData := []byte("[config]\napp = secret\n\n")
 		encData, err := d.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, plainData, formats.Ini, formats.Yaml)
 		g.Expect(err).ToNot(HaveOccurred())
 
-		secret, _ := newSecretResource("test", "secret-data", map[string]interface{}{
+		secret := newSecretResource("test", "secret-data", map[string]interface{}{
 			"file.ini": base64.StdEncoding.EncodeToString(encData),
 		})
 		g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse())
@@ -681,7 +825,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 			Provider: DecryptionProviderSOPS,
 		}
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kus)
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kus)
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -692,12 +836,12 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		plainData := []byte("structured:\n    data:\n        key: value\n")
 		encData, err := d.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, plainData, formats.Yaml, formats.Yaml)
 		g.Expect(err).ToNot(HaveOccurred())
 
-		secret, _ := newSecretResource("test", "secret-data", map[string]interface{}{
+		secret := newSecretResource("test", "secret-data", map[string]interface{}{
 			"key.yaml": base64.StdEncoding.EncodeToString(encData),
 		})
 		g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse())
@@ -716,7 +860,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 			Provider: DecryptionProviderSOPS,
 		}
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kus)
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kus)
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -736,12 +880,12 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 }`)
 		encData, err := d.sopsEncryptWithFormat(sops.Metadata{
 			KeyGroups: []sops.KeyGroup{
-				{&age.MasterKey{Recipient: ageID.Recipient().String()}},
+				{&sopsage.MasterKey{Recipient: ageID.Recipient().String()}},
 			},
 		}, plainData, formats.Json, formats.Yaml)
 		g.Expect(err).ToNot(HaveOccurred())
 
-		secret, _ := resourceFactory.FromMap(map[string]interface{}{
+		secret := resourceFactory.FromMap(map[string]interface{}{
 			"apiVersion": "v1",
 			"kind":       "Secret",
 			"metadata": map[string]interface{}{
@@ -758,14 +902,13 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		got, err := d.DecryptResource(secret)
 		g.Expect(err).ToNot(HaveOccurred())
 		g.Expect(got).ToNot(BeNil())
-		plainDataWithTrailingNewline := append(plainData, '\n') // https://github.com/getsops/sops/issues/1825
-		g.Expect(got.GetDataMap()).To(HaveKeyWithValue(corev1.DockerConfigJsonKey, base64.StdEncoding.EncodeToString(plainDataWithTrailingNewline)))
+		g.Expect(got.GetDataMap()).To(HaveKeyWithValue(corev1.DockerConfigJsonKey, base64.StdEncoding.EncodeToString(plainData)))
 	})
 
 	t.Run("nil resource", func(t *testing.T) {
 		g := NewWithT(t)
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kustomization.DeepCopy())
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kustomization.DeepCopy())
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -777,7 +920,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 	t.Run("no decryption spec", func(t *testing.T) {
 		g := NewWithT(t)
 
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kustomization.DeepCopy())
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kustomization.DeepCopy())
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -793,7 +936,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 		kus.Spec.Decryption = &kustomizev1.Decryption{
 			Provider: "not-supported",
 		}
-		d, cleanup, err := New(fake.NewClientBuilder().Build(), kus)
+		d, cleanup, err := NewTempDecryptor("", fake.NewClientBuilder().Build(), *kus)
 		g.Expect(err).ToNot(HaveOccurred())
 		t.Cleanup(cleanup)
 
@@ -803,7 +946,7 @@ func TestDecryptor_DecryptResource(t *testing.T) {
 	})
 }
 
-func TestDecryptor_decryptKustomizationSources(t *testing.T) {
+func TestKustomizeDecryptor_decryptKustomizationEnvSources(t *testing.T) {
 	type file struct {
 		name           string
 		symlink        string
@@ -934,7 +1077,7 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) {
 			g.Expect(err).ToNot(HaveOccurred())
 			ageIdentities := age.ParsedIdentities{id}
 
-			d := &Decryptor{
+			d := &KustomizeDecryptor{
 				root:          root,
 				ageIdentities: ageIdentities,
 			}
@@ -956,17 +1099,17 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) {
 					}
 					data, err = d.sopsEncryptWithFormat(sops.Metadata{
 						KeyGroups: []sops.KeyGroup{
-							{&age.MasterKey{Recipient: id.Recipient().String()}},
+							{&sopsage.MasterKey{Recipient: id.Recipient().String()}},
 						},
 					}, f.data, format, format)
 					g.Expect(err).ToNot(HaveOccurred())
 					g.Expect(data).ToNot(Equal(f.data))
 				}
-				g.Expect(os.WriteFile(fPath, data, 0o600)).To(Succeed())
+				g.Expect(os.WriteFile(fPath, data, 0o644)).To(Succeed())
 			}
 
 			visited := make(map[string]struct{}, 0)
-			visit := d.decryptKustomizationSources(visited)
+			visit := d.decryptKustomizationEnvSources(visited)
 			kus := &kustypes.Kustomization{SecretGenerator: tt.secretGenerator}
 
 			err = visit(root, tt.path, kus)
@@ -1001,7 +1144,7 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) {
 	}
 }
 
-func TestDecryptor_decryptSopsFile(t *testing.T) {
+func TestKustomizeDecryptor_decryptSopsFile(t *testing.T) {
 	g := NewWithT(t)
 
 	id, err := extage.GenerateX25519Identity()
@@ -1079,7 +1222,7 @@ func TestDecryptor_decryptSopsFile(t *testing.T) {
 
 			tmpDir := t.TempDir()
 
-			d := &Decryptor{
+			d := &KustomizeDecryptor{
 				root:          tmpDir,
 				maxFileSize:   maxEncryptedFileSize,
 				ageIdentities: ageIdentities,
@@ -1098,7 +1241,7 @@ func TestDecryptor_decryptSopsFile(t *testing.T) {
 				if f.encrypt {
 					b, err := d.sopsEncryptWithFormat(sops.Metadata{
 						KeyGroups: []sops.KeyGroup{
-							{&age.MasterKey{Recipient: id.Recipient().String()}},
+							{&sopsage.MasterKey{Recipient: id.Recipient().String()}},
 						},
 					}, data, f.format, f.format)
 					g.Expect(err).ToNot(HaveOccurred())
@@ -1106,7 +1249,7 @@ func TestDecryptor_decryptSopsFile(t *testing.T) {
 					data = b
 				}
 				g.Expect(os.MkdirAll(filepath.Dir(fPath), 0o700)).To(Succeed())
-				g.Expect(os.WriteFile(fPath, data, 0o600)).To(Succeed())
+				g.Expect(os.WriteFile(fPath, data, 0o644)).To(Succeed())
 			}
 
 			path := filepath.Join(tmpDir, tt.path)
@@ -1131,7 +1274,7 @@ func TestDecryptor_decryptSopsFile(t *testing.T) {
 	}
 }
 
-func TestDecryptor_secureLoadKustomizationFile(t *testing.T) {
+func Test_secureLoadKustomizationFile(t *testing.T) {
 	kusType := kustypes.TypeMeta{
 		APIVersion: kustypes.KustomizationVersion,
 		Kind:       kustypes.KustomizationKind,
@@ -1220,7 +1363,7 @@ func TestDecryptor_secureLoadKustomizationFile(t *testing.T) {
 					continue
 				}
 				g.Expect(os.MkdirAll(filepath.Dir(fPath), 0o700)).To(Succeed())
-				g.Expect(os.WriteFile(fPath, f.data, 0o600)).To(Succeed())
+				g.Expect(os.WriteFile(fPath, f.data, 0o644)).To(Succeed())
 			}
 
 			root := filepath.Join(tmpDir, tt.rootSuffix)
@@ -1238,7 +1381,7 @@ func TestDecryptor_secureLoadKustomizationFile(t *testing.T) {
 	}
 }
 
-func TestDecryptor_recurseKustomizationFiles(t *testing.T) {
+func Test_recurseKustomizationFiles(t *testing.T) {
 	type kusNode struct {
 		path          string
 		symlink       string
@@ -1494,7 +1637,7 @@ func TestDecryptor_recurseKustomizationFiles(t *testing.T) {
 				b, err := yaml.Marshal(kus)
 				g.Expect(err).ToNot(HaveOccurred())
 				g.Expect(os.MkdirAll(filepath.Dir(path), 0o700)).To(Succeed())
-				g.Expect(os.WriteFile(path, b, 0o600))
+				g.Expect(os.WriteFile(path, b, 0o644))
 			}
 
 			visit := func(root, path string, kus *kustypes.Kustomization) error {
@@ -1539,22 +1682,22 @@ func TestDecryptor_recurseKustomizationFiles(t *testing.T) {
 	}
 }
 
-func TestDecryptor_isSOPSEncryptedResource(t *testing.T) {
+func Test_isSOPSEncryptedResource(t *testing.T) {
 	g := NewWithT(t)
 
 	resourceFactory := provider.NewDefaultDepProvider().GetResourceFactory()
-	encrypted, _ := resourceFactory.FromMap(map[string]interface{}{
+	encrypted := resourceFactory.FromMap(map[string]interface{}{
 		"sops": map[string]string{
 			"mac": "some mac value",
 		},
 	})
-	empty, _ := resourceFactory.FromMap(map[string]interface{}{})
+	empty := resourceFactory.FromMap(map[string]interface{}{})
 
 	g.Expect(isSOPSEncryptedResource(encrypted)).To(BeTrue())
 	g.Expect(isSOPSEncryptedResource(empty)).To(BeFalse())
 }
 
-func TestDecryptor_secureAbsPath(t *testing.T) {
+func Test_secureAbsPath(t *testing.T) {
 	tests := []struct {
 		name    string
 		root    string
@@ -1603,7 +1746,7 @@ func TestDecryptor_secureAbsPath(t *testing.T) {
 	}
 }
 
-func TestDecryptor_formatForPath(t *testing.T) {
+func Test_formatForPath(t *testing.T) {
 	tests := []struct {
 		name string
 		path string
@@ -1629,7 +1772,7 @@ func TestDecryptor_formatForPath(t *testing.T) {
 	}
 }
 
-func TestDecryptor_detectFormatFromMarkerBytes(t *testing.T) {
+func Test_detectFormatFromMarkerBytes(t *testing.T) {
 	tests := []struct {
 		name string
 		b    []byte
@@ -1654,54 +1797,3 @@ func TestDecryptor_detectFormatFromMarkerBytes(t *testing.T) {
 		})
 	}
 }
-
-func TestSafeDecrypt(t *testing.T) {
-	for _, tt := range []struct {
-		name        string
-		mac         string
-		err         string
-		expectedMac string
-		expectedErr string
-	}{
-		{
-			name:        "no error",
-			mac:         "some mac",
-			expectedMac: "some mac",
-		},
-		{
-			name:        "only prefix",
-			err:         "Input string was not in a correct format",
-			expectedErr: "Input string was not in a correct format",
-		},
-		{
-			name:        "only suffix",
-			err:         "The value does not match sops' data format",
-			expectedErr: "The value does not match sops' data format",
-		},
-		{
-			name:        "redacted value",
-			err:         "Input string 1234567897 does not match sops' data format",
-			expectedErr: "Input string <redacted> does not match sops' data format",
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-
-			var err error
-			if tt.err != "" {
-				err = errors.New(tt.err)
-			}
-
-			mac, err := safeDecrypt(tt.mac, err)
-
-			g.Expect(mac).To(Equal(tt.expectedMac))
-
-			if tt.expectedErr == "" {
-				g.Expect(err).To(Not(HaveOccurred()))
-			} else {
-				g.Expect(err).To(HaveOccurred())
-				g.Expect(err.Error()).To(Equal(tt.expectedErr))
-			}
-		})
-	}
-}

controllers/kustomization_dependson_test.go

@@ -0,0 +1,206 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fluxcd/pkg/apis/meta"
+	"github.com/fluxcd/pkg/testserver"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	. "github.com/onsi/gomega"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+)
+
+func TestKustomizationReconciler_DependsOn(t *testing.T) {
+	g := NewWithT(t)
+	id := "dep-" + randStringRunes(5)
+	revision := "v1.0.0"
+
+	err := createNamespace(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
+
+	err = createKubeConfigSecret(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
+
+	manifests := func(name string, data string) []testserver.File {
+		return []testserver.File{
+			{
+				Name: "config.yaml",
+				Body: fmt.Sprintf(`---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: %[1]s
+data:
+  key: "%[2]s"
+---
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+  name: "v2beta1-%[1]s"
+  namespace: "%[2]s"
+spec:
+  maxReplicas: 6
+  metrics:
+  - resource:
+      name: cpu
+      targetAverageUtilization: 80
+    type: Resource
+  - resource:
+      name: memory
+      targetAverageUtilization: 80
+    type: Resource
+  minReplicas: 2
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: test
+---
+apiVersion: autoscaling/v2beta2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: "v2beta2-%[1]s"
+  namespace: "%[2]s"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: test
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 50
+  - type: Pods
+    pods:
+      metric:
+        name: packets-per-second
+      target:
+        type: AverageValue
+        averageValue: 1k
+  - type: Object
+    object:
+      metric:
+        name: requests-per-second
+      describedObject:
+        apiVersion: networking.k8s.io/v1beta1
+        kind: Ingress
+        name: main-route
+      target:
+        type: Value
+        value: 10k
+`, name, data),
+			},
+		}
+	}
+
+	artifact, err := testServer.ArtifactFromFiles(manifests(id, id))
+	g.Expect(err).NotTo(HaveOccurred())
+
+	repositoryName := types.NamespacedName{
+		Name:      fmt.Sprintf("dep-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+
+	kustomizationKey := types.NamespacedName{
+		Name:      fmt.Sprintf("dep-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+	kustomization := &kustomizev1.Kustomization{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      kustomizationKey.Name,
+			Namespace: kustomizationKey.Namespace,
+		},
+		Spec: kustomizev1.KustomizationSpec{
+			Interval: metav1.Duration{Duration: reconciliationInterval},
+			Path:     "./",
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
+					Name: "kubeconfig",
+				},
+			},
+			SourceRef: kustomizev1.CrossNamespaceSourceReference{
+				Name:      repositoryName.Name,
+				Namespace: repositoryName.Namespace,
+				Kind:      sourcev1.GitRepositoryKind,
+			},
+			TargetNamespace: id,
+			Prune:           true,
+		},
+	}
+
+	g.Expect(k8sClient.Create(context.Background(), kustomization)).To(Succeed())
+
+	resultK := &kustomizev1.Kustomization{}
+
+	g.Eventually(func() bool {
+		_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+		return apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition) != nil
+	}, timeout, time.Second).Should(BeTrue())
+
+	t.Run("fails due to source not found", func(t *testing.T) {
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			ready := apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
+			return ready.Reason == kustomizev1.ArtifactFailedReason
+		}, timeout, time.Second).Should(BeTrue())
+	})
+
+	t.Run("reconciles when source is found", func(t *testing.T) {
+		err = applyGitRepository(repositoryName, artifact, revision)
+		g.Expect(err).NotTo(HaveOccurred())
+
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			ready := apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
+			return ready.Reason == kustomizev1.ReconciliationSucceededReason
+		}, timeout, time.Second).Should(BeTrue())
+	})
+
+	t.Run("fails due to dependency not found", func(t *testing.T) {
+		g.Eventually(func() error {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			resultK.Spec.DependsOn = []meta.NamespacedObjectReference{
+				{
+					Namespace: id,
+					Name:      "root",
+				},
+			}
+			return k8sClient.Update(context.Background(), resultK)
+		}, timeout, time.Second).Should(BeNil())
+
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			ready := apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
+			return ready.Reason == kustomizev1.DependencyNotReadyReason
+		}, timeout, time.Second).Should(BeTrue())
+	})
+}

controllers/kustomization_fetcher.go

@@ -0,0 +1,127 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"time"
+
+	"github.com/fluxcd/pkg/untar"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	"github.com/hashicorp/go-retryablehttp"
+)
+
+// ArtifactFetcher holds the HTTP client that reties with back off when
+// the artifact server is offline.
+type ArtifactFetcher struct {
+	httpClient *retryablehttp.Client
+}
+
+// ArtifactNotFoundError is an error type used to signal 404 HTTP status code responses.
+var ArtifactNotFoundError = errors.New("artifact not found")
+
+// NewArtifactFetcher configures the retryable http client used for fetching artifacts.
+// By default, it retries 10 times within a 3.5 minutes window.
+func NewArtifactFetcher(retries int) *ArtifactFetcher {
+	httpClient := retryablehttp.NewClient()
+	httpClient.RetryWaitMin = 5 * time.Second
+	httpClient.RetryWaitMax = 30 * time.Second
+	httpClient.RetryMax = retries
+	httpClient.Logger = nil
+
+	return &ArtifactFetcher{httpClient: httpClient}
+}
+
+// Fetch downloads, verifies and extracts the artifact content to the specified directory.
+// If the artifact server responds with 5xx errors, the download operation is retried.
+// If the artifact server responds with 404, the returned error is of type ArtifactNotFoundError.
+// If the artifact server is unavailable for more than 3 minutes, the returned error contains the original status code.
+func (r *ArtifactFetcher) Fetch(artifact *sourcev1.Artifact, dir string) error {
+	artifactURL := artifact.URL
+	if hostname := os.Getenv("SOURCE_CONTROLLER_LOCALHOST"); hostname != "" {
+		u, err := url.Parse(artifactURL)
+		if err != nil {
+			return err
+		}
+		u.Host = hostname
+		artifactURL = u.String()
+	}
+
+	req, err := retryablehttp.NewRequest(http.MethodGet, artifactURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create a new request: %w", err)
+	}
+
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to download artifact, error: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if code := resp.StatusCode; code != http.StatusOK {
+		if code == http.StatusNotFound {
+			return ArtifactNotFoundError
+		}
+		return fmt.Errorf("failed to download artifact from %s, status: %s", artifactURL, resp.Status)
+	}
+
+	var buf bytes.Buffer
+
+	// verify checksum matches origin
+	if err := r.Verify(artifact, &buf, resp.Body); err != nil {
+		return err
+	}
+
+	// extract
+	if _, err = untar.Untar(&buf, dir); err != nil {
+		return fmt.Errorf("failed to untar artifact, error: %w", err)
+	}
+
+	return nil
+}
+
+// Verify computes the checksum of the tarball and returns an error if the computed value
+// does not match the artifact advertised checksum.
+func (r *ArtifactFetcher) Verify(artifact *sourcev1.Artifact, buf *bytes.Buffer, reader io.Reader) error {
+	hasher := sha256.New()
+
+	// for backwards compatibility with source-controller v0.17.2 and older
+	if len(artifact.Checksum) == 40 {
+		hasher = sha1.New()
+	}
+
+	// compute checksum
+	mw := io.MultiWriter(hasher, buf)
+	if _, err := io.Copy(mw, reader); err != nil {
+		return err
+	}
+
+	if checksum := fmt.Sprintf("%x", hasher.Sum(nil)); checksum != artifact.Checksum {
+		return fmt.Errorf("failed to verify artifact: computed checksum '%s' doesn't match advertised '%s'",
+			checksum, artifact.Checksum)
+	}
+
+	return nil
+}

controllers/kustomization_fetcher_test.go

@@ -14,25 +14,24 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
 	"fmt"
-	"strings"
 	"testing"
 	"time"
 
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 )
 
 func TestKustomizationReconciler_ArtifactDownload(t *testing.T) {
@@ -85,8 +84,8 @@ stringData:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -136,8 +135,10 @@ stringData:
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
 			ready := apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
-			return strings.Contains(ready.Message, "artifact not found")
+			return ready.Reason == meta.ProgressingReason
 		}, timeout, time.Second).Should(BeTrue())
+
+		g.Expect(apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition).Message).To(ContainSubstring("artifact not found"))
 	})
 
 	t.Run("recovers after not found errors", func(t *testing.T) {

controllers/kustomization_force_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -22,17 +22,16 @@ import (
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
 func TestKustomizationReconciler_Force(t *testing.T) {
@@ -86,8 +85,8 @@ stringData:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -114,44 +113,41 @@ stringData:
 	resultK := &kustomizev1.Kustomization{}
 	resultSecret := &corev1.Secret{}
 
-	t.Run("creates immutable secret", func(t *testing.T) {
-		g.Eventually(func() bool {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return resultK.Status.LastAppliedRevision == revision
-		}, timeout, time.Second).Should(BeTrue())
-		logStatus(t, resultK)
+	g.Eventually(func() bool {
+		_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+		return resultK.Status.LastAppliedRevision == revision
+	}, timeout, time.Second).Should(BeTrue())
 
-		kstatusCheck.CheckErr(ctx, resultK)
+	t.Run("creates immutable secret", func(t *testing.T) {
 		g.Expect(k8sClient.Get(context.Background(), types.NamespacedName{Name: id, Namespace: id}, resultSecret)).Should(Succeed())
 	})
 
 	t.Run("fails to update immutable secret", func(t *testing.T) {
-		artifact, err = testServer.ArtifactFromFiles(manifests(id, randStringRunes(5)))
+		artifact, err := testServer.ArtifactFromFiles(manifests(id, randStringRunes(5)))
 		g.Expect(err).NotTo(HaveOccurred())
-		revision = "v2.0.0"
+		revision := "v2.0.0"
 		err = applyGitRepository(repositoryName, artifact, revision)
 		g.Expect(err).NotTo(HaveOccurred())
 
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return isReconcileFailure(resultK)
+			return resultK.Status.LastAttemptedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
-		logStatus(t, resultK)
 
-		kstatusCheck.CheckErr(ctx, resultK)
+		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.ReadyCondition)).To(BeFalse())
 
 		t.Run("emits validation error event", func(t *testing.T) {
 			events := getEvents(resultK.GetName(), map[string]string{"kustomize.toolkit.fluxcd.io/revision": revision})
 			g.Expect(len(events) > 0).To(BeTrue())
 			g.Expect(events[0].Type).To(BeIdenticalTo("Warning"))
-			g.Expect(events[0].Message).To(ContainSubstring("field is immutable"))
+			g.Expect(events[0].Message).To(ContainSubstring("invalid, error: secret is immutable"))
 		})
 	})
 
 	t.Run("recreates immutable secret", func(t *testing.T) {
-		artifact, err = testServer.ArtifactFromFiles(manifests(id, randStringRunes(5)))
+		artifact, err := testServer.ArtifactFromFiles(manifests(id, randStringRunes(5)))
 		g.Expect(err).NotTo(HaveOccurred())
-		revision = "v3.0.0"
+		revision := "v3.0.0"
 		err = applyGitRepository(repositoryName, artifact, revision)
 		g.Expect(err).NotTo(HaveOccurred())
 
@@ -163,12 +159,10 @@ stringData:
 
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return isReconcileSuccess(resultK)
+			return resultK.Status.LastAppliedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
-		logStatus(t, resultK)
 
-		kstatusCheck.CheckErr(ctx, resultK)
-
-		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.HealthyCondition)).To(BeTrue())
+		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.ReadyCondition)).To(BeTrue())
+		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, kustomizev1.HealthyCondition)).To(BeTrue())
 	})
 }

controllers/kustomization_generator.go

@@ -0,0 +1,288 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"sigs.k8s.io/kustomize/api/filesys"
+	"sigs.k8s.io/kustomize/api/konfig"
+	"sigs.k8s.io/kustomize/api/krusty"
+	"sigs.k8s.io/kustomize/api/provider"
+	"sigs.k8s.io/kustomize/api/resmap"
+	kustypes "sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/yaml"
+
+	"github.com/fluxcd/pkg/apis/kustomize"
+	securefs "github.com/fluxcd/pkg/kustomize/filesys"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+)
+
+type KustomizeGenerator struct {
+	root          string
+	kustomization kustomizev1.Kustomization
+}
+
+func NewGenerator(root string, kustomization kustomizev1.Kustomization) *KustomizeGenerator {
+	return &KustomizeGenerator{
+		root:          root,
+		kustomization: kustomization,
+	}
+}
+
+func (kg *KustomizeGenerator) WriteFile(dirPath string) error {
+	if err := kg.generateKustomization(dirPath); err != nil {
+		return err
+	}
+
+	kfile := filepath.Join(dirPath, konfig.DefaultKustomizationFileName())
+
+	data, err := os.ReadFile(kfile)
+	if err != nil {
+		return err
+	}
+
+	kus := kustypes.Kustomization{
+		TypeMeta: kustypes.TypeMeta{
+			APIVersion: kustypes.KustomizationVersion,
+			Kind:       kustypes.KustomizationKind,
+		},
+	}
+
+	if err := yaml.Unmarshal(data, &kus); err != nil {
+		return err
+	}
+
+	if kg.kustomization.Spec.TargetNamespace != "" {
+		kus.Namespace = kg.kustomization.Spec.TargetNamespace
+	}
+
+	for _, m := range kg.kustomization.Spec.Patches {
+		kus.Patches = append(kus.Patches, kustypes.Patch{
+			Patch:  m.Patch,
+			Target: adaptSelector(&m.Target),
+		})
+	}
+
+	for _, m := range kg.kustomization.Spec.PatchesStrategicMerge {
+		kus.PatchesStrategicMerge = append(kus.PatchesStrategicMerge, kustypes.PatchStrategicMerge(m.Raw))
+	}
+
+	for _, m := range kg.kustomization.Spec.PatchesJSON6902 {
+		patch, err := json.Marshal(m.Patch)
+		if err != nil {
+			return err
+		}
+		kus.PatchesJson6902 = append(kus.PatchesJson6902, kustypes.Patch{
+			Patch:  string(patch),
+			Target: adaptSelector(&m.Target),
+		})
+	}
+
+	for _, image := range kg.kustomization.Spec.Images {
+		newImage := kustypes.Image{
+			Name:    image.Name,
+			NewName: image.NewName,
+			NewTag:  image.NewTag,
+			Digest:  image.Digest,
+		}
+		if exists, index := checkKustomizeImageExists(kus.Images, image.Name); exists {
+			kus.Images[index] = newImage
+		} else {
+			kus.Images = append(kus.Images, newImage)
+		}
+	}
+
+	kd, err := yaml.Marshal(kus)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(kfile, kd, os.ModePerm)
+}
+
+func checkKustomizeImageExists(images []kustypes.Image, imageName string) (bool, int) {
+	for i, image := range images {
+		if imageName == image.Name {
+			return true, i
+		}
+	}
+
+	return false, -1
+}
+
+func (kg *KustomizeGenerator) generateKustomization(dirPath string) error {
+	fs, err := securefs.MakeFsOnDiskSecure(kg.root)
+	if err != nil {
+		return err
+	}
+
+	// Determine if there already is a Kustomization file at the root,
+	// as this means we do not have to generate one.
+	for _, kfilename := range konfig.RecognizedKustomizationFileNames() {
+		if kpath := filepath.Join(dirPath, kfilename); fs.Exists(kpath) && !fs.IsDir(kpath) {
+			return nil
+		}
+	}
+
+	scan := func(base string) ([]string, error) {
+		var paths []string
+		pvd := provider.NewDefaultDepProvider()
+		rf := pvd.GetResourceFactory()
+		err := fs.Walk(base, func(path string, info os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+			if path == base {
+				return nil
+			}
+			if info.IsDir() {
+				// If a sub-directory contains an existing kustomization file add the
+				// directory as a resource and do not decend into it.
+				for _, kfilename := range konfig.RecognizedKustomizationFileNames() {
+					if kpath := filepath.Join(path, kfilename); fs.Exists(kpath) && !fs.IsDir(kpath) {
+						paths = append(paths, path)
+						return filepath.SkipDir
+					}
+				}
+				return nil
+			}
+
+			extension := filepath.Ext(path)
+			if extension != ".yaml" && extension != ".yml" {
+				return nil
+			}
+
+			fContents, err := fs.ReadFile(path)
+			if err != nil {
+				return err
+			}
+
+			if _, err := rf.SliceFromBytes(fContents); err != nil {
+				return fmt.Errorf("failed to decode Kubernetes YAML from %s: %w", path, err)
+			}
+			paths = append(paths, path)
+			return nil
+		})
+		return paths, err
+	}
+
+	abs, err := filepath.Abs(dirPath)
+	if err != nil {
+		return err
+	}
+
+	files, err := scan(abs)
+	if err != nil {
+		return err
+	}
+
+	kfile := filepath.Join(dirPath, konfig.DefaultKustomizationFileName())
+	f, err := fs.Create(kfile)
+	if err != nil {
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+
+	kus := kustypes.Kustomization{
+		TypeMeta: kustypes.TypeMeta{
+			APIVersion: kustypes.KustomizationVersion,
+			Kind:       kustypes.KustomizationKind,
+		},
+	}
+
+	var resources []string
+	for _, file := range files {
+		resources = append(resources, strings.Replace(file, abs, ".", 1))
+	}
+
+	kus.Resources = resources
+	kd, err := yaml.Marshal(kus)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(kfile, kd, os.ModePerm)
+}
+
+func adaptSelector(selector *kustomize.Selector) (output *kustypes.Selector) {
+	if selector != nil {
+		output = &kustypes.Selector{}
+		output.Gvk.Group = selector.Group
+		output.Gvk.Kind = selector.Kind
+		output.Gvk.Version = selector.Version
+		output.Name = selector.Name
+		output.Namespace = selector.Namespace
+		output.LabelSelector = selector.LabelSelector
+		output.AnnotationSelector = selector.AnnotationSelector
+	}
+	return
+}
+
+// TODO: remove mutex when kustomize fixes the concurrent map read/write panic
+var kustomizeBuildMutex sync.Mutex
+
+// secureBuildKustomization wraps krusty.MakeKustomizer with the following settings:
+//  - secure on-disk FS denying operations outside root
+//  - load files from outside the kustomization dir path
+//    (but not outside root)
+//  - disable plugins except for the builtin ones
+func secureBuildKustomization(root, dirPath string, allowRemoteBases bool) (_ resmap.ResMap, err error) {
+	var fs filesys.FileSystem
+
+	// Create secure FS for root with or without remote base support
+	if allowRemoteBases {
+		fs, err = securefs.MakeFsOnDiskSecureBuild(root)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		fs, err = securefs.MakeFsOnDiskSecure(root)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Temporary workaround for concurrent map read and map write bug
+	// https://github.com/kubernetes-sigs/kustomize/issues/3659
+	kustomizeBuildMutex.Lock()
+	defer kustomizeBuildMutex.Unlock()
+
+	// Kustomize tends to panic in unpredicted ways due to (accidental)
+	// invalid object data; recover when this happens to ensure continuity of
+	// operations
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("recovered from kustomize build panic: %v", r)
+		}
+	}()
+
+	buildOptions := &krusty.Options{
+		LoadRestrictions: kustypes.LoadRestrictionsNone,
+		PluginConfig:     kustypes.DisabledPluginConfig(),
+	}
+
+	k := krusty.MakeKustomizer(buildOptions)
+	return k.Run(fs, dirPath)
+}

controllers/kustomization_generator_test.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func Test_secureBuildKustomization(t *testing.T) {
+	t.Run("remote build", func(t *testing.T) {
+		g := NewWithT(t)
+
+		_, err := secureBuildKustomization("testdata/remote", "testdata/remote", true)
+		g.Expect(err).ToNot(HaveOccurred())
+	})
+
+	t.Run("no remote build", func(t *testing.T) {
+		g := NewWithT(t)
+
+		_, err := secureBuildKustomization("testdata/remote", "testdata/remote", false)
+		g.Expect(err).To(HaveOccurred())
+	})
+}
+
+func Test_secureBuildKustomization_panic(t *testing.T) {
+	t.Run("build panic", func(t *testing.T) {
+		g := NewWithT(t)
+
+		_, err := secureBuildKustomization("testdata/panic", "testdata/panic", false)
+		g.Expect(err).To(HaveOccurred())
+		g.Expect(err.Error()).To(ContainSubstring("recovered from kustomize build panic"))
+		// Run again to ensure the lock is released
+		_, err = secureBuildKustomization("testdata/panic", "testdata/panic", false)
+		g.Expect(err).To(HaveOccurred())
+	})
+}
+
+func Test_secureBuildKustomization_rel_basedir(t *testing.T) {
+	g := NewWithT(t)
+
+	_, err := secureBuildKustomization("testdata/relbase", "testdata/relbase/clusters/staging/flux-system", false)
+	g.Expect(err).ToNot(HaveOccurred())
+}

controllers/kustomization_impersonation.go

@@ -0,0 +1,200 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"context"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	"sigs.k8s.io/cli-utils/pkg/kstatus/polling"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+
+	runtimeClient "github.com/fluxcd/pkg/runtime/client"
+)
+
+// KustomizeImpersonation holds the state for impersonating a service account.
+type KustomizeImpersonation struct {
+	client.Client
+	kustomization         kustomizev1.Kustomization
+	statusPoller          *polling.StatusPoller
+	defaultServiceAccount string
+	pollingOpts           polling.Options
+	kubeConfigOpts        runtimeClient.KubeConfigOptions
+}
+
+// NewKustomizeImpersonation creates a new KustomizeImpersonation.
+func NewKustomizeImpersonation(
+	kustomization kustomizev1.Kustomization,
+	kubeClient client.Client,
+	statusPoller *polling.StatusPoller,
+	defaultServiceAccount string,
+	kubeConfigOpts runtimeClient.KubeConfigOptions,
+	pollingOpts polling.Options) *KustomizeImpersonation {
+	return &KustomizeImpersonation{
+		defaultServiceAccount: defaultServiceAccount,
+		kustomization:         kustomization,
+		statusPoller:          statusPoller,
+		Client:                kubeClient,
+		kubeConfigOpts:        kubeConfigOpts,
+		pollingOpts:           pollingOpts,
+	}
+}
+
+// GetClient creates a controller-runtime client for talking to a Kubernetes API server.
+// If spec.KubeConfig is set, use the kubeconfig bytes from the Kubernetes secret.
+// Otherwise will assume running in cluster and use the cluster provided kubeconfig.
+// If a --default-service-account is set and no spec.ServiceAccountName, use the provided kubeconfig and impersonate the default SA.
+// If spec.ServiceAccountName is set, use the provided kubeconfig and impersonate the specified SA.
+func (ki *KustomizeImpersonation) GetClient(ctx context.Context) (client.Client, *polling.StatusPoller, error) {
+	switch {
+	case ki.kustomization.Spec.KubeConfig != nil:
+		return ki.clientForKubeConfig(ctx)
+	case ki.defaultServiceAccount != "" || ki.kustomization.Spec.ServiceAccountName != "":
+		return ki.clientForServiceAccountOrDefault()
+	default:
+		return ki.Client, ki.statusPoller, nil
+	}
+}
+
+// CanFinalize asserts if the given Kustomization can be finalized using impersonation.
+func (ki *KustomizeImpersonation) CanFinalize(ctx context.Context) bool {
+	name := ki.defaultServiceAccount
+	if sa := ki.kustomization.Spec.ServiceAccountName; sa != "" {
+		name = sa
+	}
+	if name == "" {
+		return true
+	}
+
+	sa := &corev1.ServiceAccount{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ServiceAccount",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: ki.kustomization.Namespace,
+		},
+	}
+	if err := ki.Client.Get(ctx, client.ObjectKeyFromObject(sa), sa); err != nil {
+		return false
+	}
+
+	return true
+}
+
+func (ki *KustomizeImpersonation) setImpersonationConfig(restConfig *rest.Config) {
+	name := ki.defaultServiceAccount
+	if sa := ki.kustomization.Spec.ServiceAccountName; sa != "" {
+		name = sa
+	}
+	if name != "" {
+		username := fmt.Sprintf("system:serviceaccount:%s:%s", ki.kustomization.GetNamespace(), name)
+		restConfig.Impersonate = rest.ImpersonationConfig{UserName: username}
+	}
+}
+
+func (ki *KustomizeImpersonation) clientForServiceAccountOrDefault() (client.Client, *polling.StatusPoller, error) {
+	restConfig, err := config.GetConfig()
+	if err != nil {
+		return nil, nil, err
+	}
+	ki.setImpersonationConfig(restConfig)
+
+	restMapper, err := apiutil.NewDynamicRESTMapper(restConfig)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	client, err := client.New(restConfig, client.Options{Mapper: restMapper})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	statusPoller := polling.NewStatusPoller(client, restMapper, ki.pollingOpts)
+	return client, statusPoller, err
+
+}
+
+func (ki *KustomizeImpersonation) clientForKubeConfig(ctx context.Context) (client.Client, *polling.StatusPoller, error) {
+	kubeConfigBytes, err := ki.getKubeConfig(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	restConfig, err := clientcmd.RESTConfigFromKubeConfig(kubeConfigBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	restConfig = runtimeClient.KubeConfig(restConfig, ki.kubeConfigOpts)
+	ki.setImpersonationConfig(restConfig)
+
+	restMapper, err := apiutil.NewDynamicRESTMapper(restConfig)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	client, err := client.New(restConfig, client.Options{Mapper: restMapper})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	statusPoller := polling.NewStatusPoller(client, restMapper, ki.pollingOpts)
+
+	return client, statusPoller, err
+}
+
+func (ki *KustomizeImpersonation) getKubeConfig(ctx context.Context) ([]byte, error) {
+	secretName := types.NamespacedName{
+		Namespace: ki.kustomization.GetNamespace(),
+		Name:      ki.kustomization.Spec.KubeConfig.SecretRef.Name,
+	}
+
+	var secret corev1.Secret
+	if err := ki.Get(ctx, secretName, &secret); err != nil {
+		return nil, fmt.Errorf("unable to read KubeConfig secret '%s' error: %w", secretName.String(), err)
+	}
+
+	var kubeConfig []byte
+	switch {
+	case ki.kustomization.Spec.KubeConfig.SecretRef.Key != "":
+		key := ki.kustomization.Spec.KubeConfig.SecretRef.Key
+		kubeConfig = secret.Data[key]
+		if kubeConfig == nil {
+			return nil, fmt.Errorf("KubeConfig secret '%s' does not contain a '%s' key with a kubeconfig", secretName, key)
+		}
+	case secret.Data["value"] != nil:
+		kubeConfig = secret.Data["value"]
+	case secret.Data["value.yaml"] != nil:
+		kubeConfig = secret.Data["value.yaml"]
+	default:
+		// User did not specify a key, and the 'value' key was not defined.
+		return nil, fmt.Errorf("KubeConfig secret '%s' does not contain a 'value' key with a kubeconfig", secretName)
+	}
+
+	return kubeConfig, nil
+}

controllers/kustomization_impersonation_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -22,9 +22,10 @@ import (
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -33,8 +34,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
 func TestKustomizationReconciler_Impersonation(t *testing.T) {
@@ -92,8 +91,8 @@ data:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: time.Minute},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -119,7 +118,7 @@ data:
 			return resultK.Status.LastAppliedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
 
-		g.Expect(readyCondition.Reason).To(Equal(meta.ReconciliationSucceededReason))
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationSucceededReason))
 	})
 
 	t.Run("fails to reconcile impersonating the default service account", func(t *testing.T) {
@@ -131,9 +130,10 @@ data:
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
 			readyCondition = apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
-			return readyCondition.Reason == meta.ReconciliationFailedReason
+			return apimeta.IsStatusConditionFalse(resultK.Status.Conditions, meta.ReadyCondition)
 		}, timeout, time.Second).Should(BeTrue())
 
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationFailedReason))
 		g.Expect(readyCondition.Message).To(ContainSubstring("system:serviceaccount:%s:default", id))
 	})
 
@@ -187,7 +187,7 @@ data:
 			return resultK.Status.LastAppliedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
 
-		g.Expect(readyCondition.Reason).To(Equal(meta.ReconciliationSucceededReason))
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationSucceededReason))
 	})
 
 	t.Run("can finalize impersonating service account", func(t *testing.T) {
@@ -260,8 +260,8 @@ data:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: time.Minute},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: secretName,
 					Key:  secretKey,
 				},
@@ -288,7 +288,7 @@ data:
 			return apimeta.IsStatusConditionFalse(resultK.Status.Conditions, meta.ReadyCondition)
 		}, timeout, time.Second).Should(BeTrue())
 
-		g.Expect(readyCondition.Reason).To(Equal(meta.ReconciliationFailedReason))
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationFailedReason))
 		g.Expect(readyCondition.Message).To(ContainSubstring(`Secret "%s" not found`, secretName))
 	})
 
@@ -314,7 +314,7 @@ data:
 			return resultK.Status.LastAppliedRevision == revision
 		}, timeout, time.Second).Should(BeTrue())
 
-		g.Expect(readyCondition.Reason).To(Equal(meta.ReconciliationSucceededReason))
+		g.Expect(readyCondition.Reason).To(Equal(kustomizev1.ReconciliationSucceededReason))
 	})
 
 }

controllers/kustomization_indexers.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"context"
+	"fmt"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	"github.com/fluxcd/pkg/runtime/dependency"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+)
+
+func (r *KustomizationReconciler) requestsForRevisionChangeOf(indexKey string) func(obj client.Object) []reconcile.Request {
+	return func(obj client.Object) []reconcile.Request {
+		repo, ok := obj.(interface {
+			GetArtifact() *sourcev1.Artifact
+		})
+		if !ok {
+			panic(fmt.Sprintf("Expected an object conformed with GetArtifact() method, but got a %T", obj))
+		}
+		// If we do not have an artifact, we have no requests to make
+		if repo.GetArtifact() == nil {
+			return nil
+		}
+
+		ctx := context.Background()
+		var list kustomizev1.KustomizationList
+		if err := r.List(ctx, &list, client.MatchingFields{
+			indexKey: client.ObjectKeyFromObject(obj).String(),
+		}); err != nil {
+			return nil
+		}
+		var dd []dependency.Dependent
+		for _, d := range list.Items {
+			// If the revision of the artifact equals to the last attempted revision,
+			// we should not make a request for this Kustomization
+			if repo.GetArtifact().Revision == d.Status.LastAttemptedRevision {
+				continue
+			}
+			dd = append(dd, d.DeepCopy())
+		}
+		sorted, err := dependency.Sort(dd)
+		if err != nil {
+			return nil
+		}
+		reqs := make([]reconcile.Request, len(sorted))
+		for i := range sorted {
+			reqs[i].NamespacedName.Name = sorted[i].Name
+			reqs[i].NamespacedName.Namespace = sorted[i].Namespace
+		}
+		return reqs
+	}
+}
+
+func (r *KustomizationReconciler) indexBy(kind string) func(o client.Object) []string {
+	return func(o client.Object) []string {
+		k, ok := o.(*kustomizev1.Kustomization)
+		if !ok {
+			panic(fmt.Sprintf("Expected a Kustomization, got %T", o))
+		}
+
+		if k.Spec.SourceRef.Kind == kind {
+			namespace := k.GetNamespace()
+			if k.Spec.SourceRef.Namespace != "" {
+				namespace = k.Spec.SourceRef.Namespace
+			}
+			return []string{fmt.Sprintf("%s/%s", namespace, k.Spec.SourceRef.Name)}
+		}
+
+		return nil
+	}
+}

controllers/kustomization_inventory.go

@@ -14,29 +14,28 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package inventory
+package controllers
 
 import (
 	"sort"
 
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
-	"github.com/fluxcd/cli-utils/pkg/object"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/ssa"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/cli-utils/pkg/object"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 )
 
-func New() *kustomizev1.ResourceInventory {
+func NewInventory() *kustomizev1.ResourceInventory {
 	return &kustomizev1.ResourceInventory{
 		Entries: []kustomizev1.ResourceRef{},
 	}
 }
 
-// AddChangeSet extracts the metadata from the given objects and adds it to the inventory.
-func AddChangeSet(inv *kustomizev1.ResourceInventory, set *ssa.ChangeSet) error {
+// AddObjectsToInventory extracts the metadata from the given objects and adds it to the inventory.
+func AddObjectsToInventory(inv *kustomizev1.ResourceInventory, set *ssa.ChangeSet) error {
 	if set == nil {
 		return nil
 	}
@@ -51,8 +50,8 @@ func AddChangeSet(inv *kustomizev1.ResourceInventory, set *ssa.ChangeSet) error
 	return nil
 }
 
-// List returns the inventory entries as unstructured.Unstructured objects.
-func List(inv *kustomizev1.ResourceInventory) ([]*unstructured.Unstructured, error) {
+// ListObjectsInInventory returns the inventory entries as unstructured.Unstructured objects.
+func ListObjectsInInventory(inv *kustomizev1.ResourceInventory) ([]*unstructured.Unstructured, error) {
 	objects := make([]*unstructured.Unstructured, 0)
 
 	if inv.Entries == nil {
@@ -80,8 +79,8 @@ func List(inv *kustomizev1.ResourceInventory) ([]*unstructured.Unstructured, err
 	return objects, nil
 }
 
-// ListMetadata returns the inventory entries as object.ObjMetadata objects.
-func ListMetadata(inv *kustomizev1.ResourceInventory) (object.ObjMetadataSet, error) {
+// ListMetaInInventory returns the inventory entries as object.ObjMetadata objects.
+func ListMetaInInventory(inv *kustomizev1.ResourceInventory) (object.ObjMetadataSet, error) {
 	var metas []object.ObjMetadata
 	for _, e := range inv.Entries {
 		m, err := object.ParseObjMetadata(e.ID)
@@ -94,8 +93,8 @@ func ListMetadata(inv *kustomizev1.ResourceInventory) (object.ObjMetadataSet, er
 	return metas, nil
 }
 
-// Diff returns the slice of objects that do not exist in the target inventory.
-func Diff(inv *kustomizev1.ResourceInventory, target *kustomizev1.ResourceInventory) ([]*unstructured.Unstructured, error) {
+// DiffInventory returns the slice of objects that do not exist in the target inventory.
+func DiffInventory(inv *kustomizev1.ResourceInventory, target *kustomizev1.ResourceInventory) ([]*unstructured.Unstructured, error) {
 	versionOf := func(i *kustomizev1.ResourceInventory, objMetadata object.ObjMetadata) string {
 		for _, entry := range i.Entries {
 			if entry.ID == objMetadata.String() {
@@ -106,12 +105,12 @@ func Diff(inv *kustomizev1.ResourceInventory, target *kustomizev1.ResourceInvent
 	}
 
 	objects := make([]*unstructured.Unstructured, 0)
-	aList, err := ListMetadata(inv)
+	aList, err := ListMetaInInventory(inv)
 	if err != nil {
 		return nil, err
 	}
 
-	bList, err := ListMetadata(target)
+	bList, err := ListMetaInInventory(target)
 	if err != nil {
 		return nil, err
 	}
@@ -137,8 +136,7 @@ func Diff(inv *kustomizev1.ResourceInventory, target *kustomizev1.ResourceInvent
 	return objects, nil
 }
 
-// ReferenceToObjMetadataSet transforms a NamespacedObjectKindReference to an ObjMetadataSet.
-func ReferenceToObjMetadataSet(cr []meta.NamespacedObjectKindReference) (object.ObjMetadataSet, error) {
+func referenceToObjMetadataSet(cr []meta.NamespacedObjectKindReference) (object.ObjMetadataSet, error) {
 	var objects []object.ObjMetadata
 
 	for _, c := range cr {

controllers/kustomization_inventory_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -25,18 +25,18 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/cli-utils/pkg/object"
 
-	"github.com/fluxcd/cli-utils/pkg/object"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 )
 
 func TestKustomizationReconciler_Inventory(t *testing.T) {
@@ -96,8 +96,8 @@ stringData:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: 2 * time.Minute},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},

controllers/kustomization_prune_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -22,17 +22,16 @@ import (
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
 func TestKustomizationReconciler_Prune(t *testing.T) {
@@ -98,8 +97,8 @@ data:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -226,8 +225,8 @@ data:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -307,20 +306,6 @@ kind: Kustomization
 
 		g.Expect(len(resultK.Status.Inventory.Entries)).Should(BeIdenticalTo(2))
 	})
-
-	t.Run("deletes suspended", func(t *testing.T) {
-		g.Eventually(func() error {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			resultK.Spec.Suspend = true
-			return k8sClient.Update(context.Background(), resultK)
-		}, timeout, time.Second).Should(BeNil())
-
-		g.Expect(k8sClient.Delete(context.Background(), kustomization)).To(Succeed())
-		g.Eventually(func() bool {
-			err = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), kustomization)
-			return apierrors.IsNotFound(err)
-		}, timeout, time.Second).Should(BeTrue())
-	})
 }
 
 func TestKustomizationReconciler_PruneSkipNotOwned(t *testing.T) {
@@ -384,8 +369,8 @@ data:
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},

controllers/kustomization_transformer_test.go

@@ -14,223 +14,27 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
-	"fmt"
 	"strings"
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/fluxcd/pkg/apis/kustomize"
 	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
-func TestKustomizationReconciler_CommonMetadata(t *testing.T) {
-	g := NewWithT(t)
-	id := "cm-" + randStringRunes(5)
-	revision := "v1.0.0"
-	resultK := &kustomizev1.Kustomization{}
-
-	err := createNamespace(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
-
-	err = createKubeConfigSecret(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
-
-	manifests := func(name string) []testserver.File {
-		return []testserver.File{
-			{
-				Name: "config.yaml",
-				Body: fmt.Sprintf(`---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: %[1]s
-  annotations:
-    tenant: test
-data:
-  key: val
-`, name),
-			},
-		}
-	}
-
-	artifact, err := testServer.ArtifactFromFiles(manifests(id))
-	g.Expect(err).NotTo(HaveOccurred())
-
-	repositoryName := types.NamespacedName{
-		Name:      fmt.Sprintf("cm-%s", randStringRunes(5)),
-		Namespace: id,
-	}
-
-	err = applyGitRepository(repositoryName, artifact, revision)
-	g.Expect(err).NotTo(HaveOccurred())
-
-	kustomizationKey := types.NamespacedName{
-		Name:      fmt.Sprintf("cm-%s", randStringRunes(5)),
-		Namespace: id,
-	}
-	kustomization := &kustomizev1.Kustomization{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      kustomizationKey.Name,
-			Namespace: kustomizationKey.Namespace,
-		},
-		Spec: kustomizev1.KustomizationSpec{
-			Interval: metav1.Duration{Duration: 2 * time.Minute},
-			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
-					Name: "kubeconfig",
-				},
-			},
-			SourceRef: kustomizev1.CrossNamespaceSourceReference{
-				Name:      repositoryName.Name,
-				Namespace: repositoryName.Namespace,
-				Kind:      sourcev1.GitRepositoryKind,
-			},
-			CommonMetadata: &kustomizev1.CommonMetadata{
-				Annotations: map[string]string{
-					"tenant": id,
-				},
-				Labels: map[string]string{
-					"tenant": id,
-				},
-			},
-			TargetNamespace: id,
-		},
-	}
-
-	g.Expect(k8sClient.Create(context.Background(), kustomization)).To(Succeed())
-
-	t.Run("sets labels and annotations", func(t *testing.T) {
-		g := NewWithT(t)
-		g.Eventually(func() bool {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return isReconcileSuccess(resultK)
-		}, timeout, time.Second).Should(BeTrue())
-		kstatusCheck.CheckErr(ctx, resultK)
-
-		var cm corev1.ConfigMap
-		g.Expect(k8sClient.Get(context.Background(), client.ObjectKey{Name: id, Namespace: id}, &cm)).To(Succeed())
-		g.Expect(cm.GetLabels()).To(HaveKeyWithValue("tenant", id))
-		g.Expect(cm.GetAnnotations()).To(HaveKeyWithValue("tenant", id))
-	})
-
-	t.Run("removes labels and annotations", func(t *testing.T) {
-		g := NewWithT(t)
-		resultK.Spec.CommonMetadata = nil
-		g.Expect(k8sClient.Update(context.Background(), resultK)).To(Succeed())
-
-		g.Eventually(func() bool {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return isReconcileSuccess(resultK)
-		}, timeout, time.Second).Should(BeTrue())
-		kstatusCheck.CheckErr(ctx, resultK)
-
-		var cm corev1.ConfigMap
-		g.Expect(k8sClient.Get(context.Background(), client.ObjectKey{Name: id, Namespace: id}, &cm)).To(Succeed())
-		g.Expect(cm.GetLabels()).ToNot(HaveKeyWithValue("tenant", id))
-		g.Expect(cm.GetAnnotations()).ToNot(HaveKeyWithValue("tenant", id))
-	})
-}
-
-func TestKustomizationReconciler_NamePrefixSuffix(t *testing.T) {
-	g := NewWithT(t)
-	id := "np-" + randStringRunes(5)
-	revision := "v1.0.0"
-	resultK := &kustomizev1.Kustomization{}
-
-	err := createNamespace(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
-
-	err = createKubeConfigSecret(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
-
-	manifests := func(name string) []testserver.File {
-		return []testserver.File{
-			{
-				Name: "config.yaml",
-				Body: fmt.Sprintf(`---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: %[1]s
-  annotations:
-    tenant: test
-data:
-  key: val
-`, name),
-			},
-		}
-	}
-
-	artifact, err := testServer.ArtifactFromFiles(manifests(id))
-	g.Expect(err).NotTo(HaveOccurred())
-
-	repositoryName := types.NamespacedName{
-		Name:      fmt.Sprintf("cm-%s", randStringRunes(5)),
-		Namespace: id,
-	}
-
-	err = applyGitRepository(repositoryName, artifact, revision)
-	g.Expect(err).NotTo(HaveOccurred())
-
-	kustomizationKey := types.NamespacedName{
-		Name:      fmt.Sprintf("cm-%s", randStringRunes(5)),
-		Namespace: id,
-	}
-	kustomization := &kustomizev1.Kustomization{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      kustomizationKey.Name,
-			Namespace: kustomizationKey.Namespace,
-		},
-		Spec: kustomizev1.KustomizationSpec{
-			Interval: metav1.Duration{Duration: 2 * time.Minute},
-			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
-					Name: "kubeconfig",
-				},
-			},
-			SourceRef: kustomizev1.CrossNamespaceSourceReference{
-				Name:      repositoryName.Name,
-				Namespace: repositoryName.Namespace,
-				Kind:      sourcev1.GitRepositoryKind,
-			},
-			NamePrefix:      "prefix-",
-			NameSuffix:      "-suffix",
-			TargetNamespace: id,
-		},
-	}
-
-	g.Expect(k8sClient.Create(context.Background(), kustomization)).To(Succeed())
-
-	t.Run("sets name prefix and suffix", func(t *testing.T) {
-		g := NewWithT(t)
-		g.Eventually(func() bool {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
-			return isReconcileSuccess(resultK)
-		}, timeout, time.Second).Should(BeTrue())
-		kstatusCheck.CheckErr(ctx, resultK)
-
-		name := fmt.Sprintf("prefix-%s-suffix", id)
-		var cm corev1.ConfigMap
-		g.Expect(k8sClient.Get(context.Background(), client.ObjectKey{Name: name, Namespace: id}, &cm)).To(Succeed())
-	})
-}
-
 func TestKustomizationReconciler_KustomizeTransformer(t *testing.T) {
 	g := NewWithT(t)
 	id := "transformers-" + randStringRunes(5)
@@ -246,7 +50,7 @@ func TestKustomizationReconciler_KustomizeTransformer(t *testing.T) {
 	g.Expect(err).NotTo(HaveOccurred())
 
 	artifactFile := "patch-" + randStringRunes(5)
-	artifactChecksum, err := testServer.ArtifactFromDir("testdata/transformers", artifactFile)
+	artifactChecksum, err := createArtifact(testServer, "testdata/transformers", artifactFile)
 	g.Expect(err).ToNot(HaveOccurred())
 
 	repositoryName := types.NamespacedName{
@@ -269,8 +73,8 @@ func TestKustomizationReconciler_KustomizeTransformer(t *testing.T) {
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -369,7 +173,7 @@ func TestKustomizationReconciler_KustomizeTransformerFiles(t *testing.T) {
 	g.Expect(err).NotTo(HaveOccurred())
 
 	artifactFile := "patch-" + randStringRunes(5)
-	artifactChecksum, err := testServer.ArtifactFromDir("testdata/file-transformer", artifactFile)
+	artifactChecksum, err := createArtifact(testServer, "testdata/file-transformer", artifactFile)
 	g.Expect(err).ToNot(HaveOccurred())
 
 	repositoryName := types.NamespacedName{
@@ -392,8 +196,8 @@ func TestKustomizationReconciler_KustomizeTransformerFiles(t *testing.T) {
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -488,7 +292,7 @@ func TestKustomizationReconciler_FluxTransformers(t *testing.T) {
 	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
 
 	artifactFile := "patch-" + randStringRunes(5)
-	artifactChecksum, err := testServer.ArtifactFromDir("testdata/patch", artifactFile)
+	artifactChecksum, err := createArtifact(testServer, "testdata/patch", artifactFile)
 	g.Expect(err).ToNot(HaveOccurred())
 
 	repositoryName := types.NamespacedName{
@@ -511,8 +315,8 @@ func TestKustomizationReconciler_FluxTransformers(t *testing.T) {
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: reconciliationInterval},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -540,14 +344,14 @@ func TestKustomizationReconciler_FluxTransformers(t *testing.T) {
   path: /metadata/labels/patch1
   value: inline-json
 						`,
-					Target: &kustomize.Selector{
+					Target: kustomize.Selector{
 						LabelSelector: "app=podinfo",
 					},
 				},
 				{
 					Patch: `
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Pod
 metadata:
   name: podinfo
   labels:
@@ -555,6 +359,25 @@ metadata:
 						`,
 				},
 			},
+			PatchesJSON6902: []kustomize.JSON6902Patch{
+				{
+					Patch: []kustomize.JSON6902{
+						{Op: "add", Path: "/metadata/labels/patch3", Value: &apiextensionsv1.JSON{Raw: []byte(`"json6902"`)}},
+						{Op: "replace", Path: "/spec/replicas", Value: &apiextensionsv1.JSON{Raw: []byte("2")}},
+					},
+					Target: kustomize.Selector{
+						Group:   "apps",
+						Version: "v1",
+						Kind:    "Deployment",
+						Name:    "podinfo",
+					},
+				},
+			},
+			PatchesStrategicMerge: []apiextensionsv1.JSON{
+				{
+					Raw: []byte(`{"kind":"Deployment","apiVersion":"apps/v1","metadata":{"name":"podinfo","labels":{"patch4":"strategic-merge"}}}`),
+				},
+			},
 		},
 	}
 
@@ -572,6 +395,9 @@ metadata:
 	t.Run("applies patches", func(t *testing.T) {
 		g.Expect(deployment.ObjectMeta.Labels["patch1"]).To(Equal("inline-json"))
 		g.Expect(deployment.ObjectMeta.Labels["patch2"]).To(Equal("inline-yaml"))
+		g.Expect(deployment.ObjectMeta.Labels["patch3"]).To(Equal("json6902"))
+		g.Expect(deployment.ObjectMeta.Labels["patch4"]).To(Equal("strategic-merge"))
+		g.Expect(*deployment.Spec.Replicas).To(Equal(int32(2)))
 		g.Expect(deployment.Spec.Template.Spec.Containers[0].Image).To(ContainSubstring("5.2.0"))
 		g.Expect(deployment.Spec.Template.Spec.Containers[1].Image).To(ContainSubstring("sha256:2832f53c577d44753e97b0ed5f00e7e3a06979c9fab77d0e78bdac4b612b14fb"))
 	})

controllers/kustomization_validation_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -22,14 +22,13 @@ import (
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/fluxcd/pkg/apis/meta"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
 func TestKustomizationReconciler_Validation(t *testing.T) {
@@ -44,11 +43,11 @@ func TestKustomizationReconciler_Validation(t *testing.T) {
 	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
 
 	artifactName := "val-" + randStringRunes(5)
-	artifactChecksum, err := testServer.ArtifactFromDir("testdata/invalid/plain", artifactName)
+	artifactChecksum, err := createArtifact(testServer, "testdata/invalid/plain", artifactName)
 	g.Expect(err).ToNot(HaveOccurred())
 
 	overlayArtifactName := "val-" + randStringRunes(5)
-	overlayChecksum, err := testServer.ArtifactFromDir("testdata/invalid/overlay", overlayArtifactName)
+	overlayChecksum, err := createArtifact(testServer, "testdata/invalid/overlay", overlayArtifactName)
 	g.Expect(err).ToNot(HaveOccurred())
 
 	repositoryName := types.NamespacedName{
@@ -79,8 +78,8 @@ func TestKustomizationReconciler_Validation(t *testing.T) {
 		Spec: kustomizev1.KustomizationSpec{
 			Interval: metav1.Duration{Duration: 2 * time.Minute},
 			Path:     "./",
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -120,7 +119,7 @@ func TestKustomizationReconciler_Validation(t *testing.T) {
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), &resultK)
 			for _, c := range resultK.Status.Conditions {
-				if c.Reason == meta.BuildFailedReason {
+				if c.Reason == kustomizev1.BuildFailedReason {
 					return true
 				}
 			}
@@ -133,7 +132,7 @@ func TestKustomizationReconciler_Validation(t *testing.T) {
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(overlayKs), &resultK)
 			for _, c := range resultK.Status.Conditions {
-				if c.Reason == meta.BuildFailedReason {
+				if c.Reason == kustomizev1.BuildFailedReason {
 					return true
 				}
 			}

controllers/kustomization_varsub.go

@@ -0,0 +1,109 @@
+package controllers
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/drone/envsubst"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/kustomize/api/resource"
+	"sigs.k8s.io/yaml"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+)
+
+// varsubRegex is the regular expression used to validate
+// the var names before substitution
+const varsubRegex = "^[_[:alpha:]][_[:alpha:][:digit:]]*$"
+
+// substituteVariables replaces the vars with their values in the specified resource.
+// If a resource is labeled or annotated with
+// 'kustomize.toolkit.fluxcd.io/substitute: disabled' the substitution is skipped.
+func substituteVariables(
+	ctx context.Context,
+	kubeClient client.Client,
+	kustomization kustomizev1.Kustomization,
+	res *resource.Resource) (*resource.Resource, error) {
+	resData, err := res.AsYAML()
+	if err != nil {
+		return nil, err
+	}
+
+	key := fmt.Sprintf("%s/substitute", kustomizev1.GroupVersion.Group)
+
+	if res.GetLabels()[key] == kustomizev1.DisabledValue || res.GetAnnotations()[key] == kustomizev1.DisabledValue {
+		return nil, nil
+	}
+
+	vars := make(map[string]string)
+
+	// load vars from ConfigMaps and Secrets data keys
+	for _, reference := range kustomization.Spec.PostBuild.SubstituteFrom {
+		namespacedName := types.NamespacedName{Namespace: kustomization.Namespace, Name: reference.Name}
+		switch reference.Kind {
+		case "ConfigMap":
+			resource := &corev1.ConfigMap{}
+			if err := kubeClient.Get(ctx, namespacedName, resource); err != nil {
+				if reference.Optional && apierrors.IsNotFound(err) {
+					continue
+				}
+				return nil, fmt.Errorf("substitute from 'ConfigMap/%s' error: %w", reference.Name, err)
+			}
+			for k, v := range resource.Data {
+				vars[k] = strings.ReplaceAll(v, "\n", "")
+			}
+		case "Secret":
+			resource := &corev1.Secret{}
+			if err := kubeClient.Get(ctx, namespacedName, resource); err != nil {
+				if reference.Optional && apierrors.IsNotFound(err) {
+					continue
+				}
+				return nil, fmt.Errorf("substitute from 'Secret/%s' error: %w", reference.Name, err)
+			}
+			for k, v := range resource.Data {
+				vars[k] = strings.ReplaceAll(string(v), "\n", "")
+			}
+		}
+	}
+
+	// load in-line vars (overrides the ones from resources)
+	if kustomization.Spec.PostBuild.Substitute != nil {
+		for k, v := range kustomization.Spec.PostBuild.Substitute {
+			vars[k] = strings.ReplaceAll(v, "\n", "")
+		}
+	}
+
+	// run bash variable substitutions
+	if len(vars) > 0 {
+		r, _ := regexp.Compile(varsubRegex)
+		for v := range vars {
+			if !r.MatchString(v) {
+				return nil, fmt.Errorf("'%s' var name is invalid, must match '%s'", v, varsubRegex)
+			}
+		}
+
+		output, err := envsubst.Eval(string(resData), func(s string) string {
+			return vars[s]
+		})
+		if err != nil {
+			return nil, fmt.Errorf("variable substitution failed: %w", err)
+		}
+
+		jsonData, err := yaml.YAMLToJSON([]byte(output))
+		if err != nil {
+			return nil, fmt.Errorf("YAMLToJSON: %w", err)
+		}
+
+		err = res.UnmarshalJSON(jsonData)
+		if err != nil {
+			return nil, fmt.Errorf("UnmarshalJSON: %w", err)
+		}
+	}
+
+	return res, nil
+}

controllers/kustomization_varsub_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"context"
@@ -23,7 +23,7 @@ import (
 
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
@@ -31,7 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
 )
 
 func TestKustomizationReconciler_Varsub(t *testing.T) {
@@ -119,8 +119,8 @@ stringData:
 			Namespace: id,
 		},
 		Spec: kustomizev1.KustomizationSpec{
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -164,7 +164,7 @@ stringData:
 		g.Eventually(func() bool {
 			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(inputK), resultK)
 			for _, c := range resultK.Status.Conditions {
-				if c.Reason == meta.ReconciliationSucceededReason {
+				if c.Reason == kustomizev1.ReconciliationSucceededReason {
 					return true
 				}
 			}
@@ -178,7 +178,7 @@ stringData:
 	t.Run("sets status", func(t *testing.T) {
 		g.Expect(resultK.Status.LastAppliedRevision).To(Equal(revision))
 		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.ReadyCondition)).To(BeTrue())
-		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.HealthyCondition)).To(BeTrue())
+		g.Expect(apimeta.IsStatusConditionTrue(resultK.Status.Conditions, kustomizev1.HealthyCondition)).To(BeTrue())
 	})
 
 	t.Run("replaces vars", func(t *testing.T) {
@@ -268,8 +268,8 @@ metadata:
 			Namespace: id,
 		},
 		Spec: kustomizev1.KustomizationSpec{
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
 					Name: "kubeconfig",
 				},
 			},
@@ -315,7 +315,7 @@ metadata:
 				resultK := &kustomizev1.Kustomization{}
 				_ = k8sClient.Get(ctx, client.ObjectKeyFromObject(inputK), resultK)
 				for _, c := range resultK.Status.Conditions {
-					if c.Reason == meta.ReconciliationSucceededReason {
+					if c.Reason == kustomizev1.ReconciliationSucceededReason {
 						return true
 					}
 				}
@@ -349,224 +349,3 @@ metadata:
 		g.Expect(resultSA.Labels["shape"]).To(Equal("square"))
 	})
 }
-
-func TestKustomizationReconciler_VarsubNumberBool(t *testing.T) {
-	ctx := context.Background()
-
-	g := NewWithT(t)
-	id := "vars-" + randStringRunes(5)
-	revision := "v1.0.0/" + randStringRunes(7)
-
-	err := createNamespace(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
-
-	err = createKubeConfigSecret(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
-
-	manifests := func(name string) []testserver.File {
-		return []testserver.File{
-			{
-				Name: "templates.yaml",
-				Body: fmt.Sprintf(`
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: %[1]s
-  namespace: %[1]s
-  labels:
-    id: ${numberStr}
-    enabled: ${booleanStr}
-  annotations:
-    id: ${q}${number}${q}
-    enabled: ${q}${boolean}${q}
-spec:
-  interval: ${number}m
-  url: https://host/repo
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: %[1]s
-  namespace: %[1]s
-data:
-  id: ${q}${number}${q}
-  text: |
-    This variable is escaped $${var}
-
-    Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus at
-    nisl sem. Nullam nec dui ipsum. Nam vehicula volutpat ipsum, ac fringilla
-    nisl convallis sed. Aliquam porttitor turpis finibus, finibus velit ut,
-    imperdiet mauris. Cras nec neque nulla. Maecenas semper nulla et elit
-    dictum sagittis. Quisque tincidunt non diam non ullamcorper. Curabitur
-    pretium urna odio, vitae ullamcorper purus mollis sit amet. Nam ac lectus
-    ac arcu varius feugiat id fringilla massa.
-
-    \?
-`, name),
-			},
-		}
-	}
-
-	artifact, err := testServer.ArtifactFromFiles(manifests(id))
-	g.Expect(err).NotTo(HaveOccurred())
-
-	repositoryName := types.NamespacedName{
-		Name:      randStringRunes(5),
-		Namespace: id,
-	}
-
-	err = applyGitRepository(repositoryName, artifact, revision)
-	g.Expect(err).NotTo(HaveOccurred())
-
-	inputK := &kustomizev1.Kustomization{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      id,
-			Namespace: id,
-		},
-		Spec: kustomizev1.KustomizationSpec{
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
-					Name: "kubeconfig",
-				},
-			},
-			Interval: metav1.Duration{Duration: reconciliationInterval},
-			Path:     "./",
-			Prune:    true,
-			SourceRef: kustomizev1.CrossNamespaceSourceReference{
-				Kind: sourcev1.GitRepositoryKind,
-				Name: repositoryName.Name,
-			},
-			PostBuild: &kustomizev1.PostBuild{
-				Substitute: map[string]string{
-					"q": `"`,
-
-					"numberStr":  "!!str 123",
-					"number":     "123",
-					"booleanStr": "!!str true",
-					"boolean":    "true",
-				},
-			},
-			Wait: false,
-		},
-	}
-	g.Expect(k8sClient.Create(ctx, inputK)).Should(Succeed())
-
-	g.Eventually(func() bool {
-		resultK := &kustomizev1.Kustomization{}
-		_ = k8sClient.Get(ctx, client.ObjectKeyFromObject(inputK), resultK)
-		for _, c := range resultK.Status.Conditions {
-			if c.Reason == meta.ReconciliationSucceededReason {
-				return true
-			}
-		}
-		return false
-	}, timeout, interval).Should(BeTrue())
-
-	resultRepo := &sourcev1.GitRepository{}
-	g.Expect(k8sClient.Get(ctx, types.NamespacedName{Name: id, Namespace: id}, resultRepo)).Should(Succeed())
-	g.Expect(resultRepo.Labels["id"]).To(Equal("123"))
-	g.Expect(resultRepo.Annotations["id"]).To(Equal("123"))
-	g.Expect(resultRepo.Labels["enabled"]).To(Equal("true"))
-	g.Expect(resultRepo.Annotations["enabled"]).To(Equal("true"))
-
-	resultCM := &corev1.ConfigMap{}
-	g.Expect(k8sClient.Get(ctx, types.NamespacedName{Name: id, Namespace: id}, resultCM)).Should(Succeed())
-	g.Expect(resultCM.Data["id"]).To(Equal("123"))
-	g.Expect(resultCM.Data["text"]).To(ContainSubstring(`${var}`))
-	g.Expect(resultCM.Data["text"]).ToNot(ContainSubstring(`$${var}`))
-	g.Expect(resultCM.Data["text"]).To(ContainSubstring(`\?`))
-}
-
-func TestKustomizationReconciler_VarsubStrict(t *testing.T) {
-	reconciler.StrictSubstitutions = true
-	defer func() {
-		reconciler.StrictSubstitutions = false
-	}()
-
-	ctx := context.Background()
-
-	g := NewWithT(t)
-	id := "vars-" + randStringRunes(5)
-	revision := "v1.0.0/" + randStringRunes(7)
-
-	err := createNamespace(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
-
-	err = createKubeConfigSecret(id)
-	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
-
-	manifests := func(name string) []testserver.File {
-		return []testserver.File{
-			{
-				Name: "service-account.yaml",
-				Body: fmt.Sprintf(`
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: %[1]s
-  namespace: %[1]s
-  labels:
-    default: ${default:=test}
-    missing: ${missing}
-`, name),
-			},
-		}
-	}
-
-	artifact, err := testServer.ArtifactFromFiles(manifests(id))
-	g.Expect(err).NotTo(HaveOccurred())
-
-	repositoryName := types.NamespacedName{
-		Name:      randStringRunes(5),
-		Namespace: id,
-	}
-
-	err = applyGitRepository(repositoryName, artifact, revision)
-	g.Expect(err).NotTo(HaveOccurred())
-
-	inputK := &kustomizev1.Kustomization{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      id,
-			Namespace: id,
-		},
-		Spec: kustomizev1.KustomizationSpec{
-			KubeConfig: &meta.KubeConfigReference{
-				SecretRef: &meta.SecretKeyReference{
-					Name: "kubeconfig",
-				},
-			},
-			Interval: metav1.Duration{Duration: reconciliationInterval},
-			Path:     "./",
-			Prune:    true,
-			SourceRef: kustomizev1.CrossNamespaceSourceReference{
-				Kind: sourcev1.GitRepositoryKind,
-				Name: repositoryName.Name,
-			},
-			PostBuild: &kustomizev1.PostBuild{
-				Substitute: map[string]string{
-					"test": "test",
-				},
-			},
-			Wait: true,
-		},
-	}
-	g.Expect(k8sClient.Create(ctx, inputK)).Should(Succeed())
-
-	var resultK kustomizev1.Kustomization
-	t.Run("fails to reconcile", func(t *testing.T) {
-		g.Eventually(func() bool {
-			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(inputK), &resultK)
-			for _, c := range resultK.Status.Conditions {
-				if c.Reason == meta.BuildFailedReason {
-					return true
-				}
-			}
-			return false
-		}, timeout, interval).Should(BeTrue())
-	})
-
-	ready := apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
-	g.Expect(ready.Message).To(ContainSubstring("variable not set"))
-	g.Expect(k8sClient.Delete(context.Background(), &resultK)).To(Succeed())
-}

controllers/kustomization_wait_test.go

@@ -0,0 +1,198 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fluxcd/pkg/apis/meta"
+	"github.com/fluxcd/pkg/testserver"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	. "github.com/onsi/gomega"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+)
+
+func TestKustomizationReconciler_HealthCheck(t *testing.T) {
+	g := NewWithT(t)
+	id := "wait-" + randStringRunes(5)
+	revision := "v1.0.0"
+
+	err := createNamespace(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create test namespace")
+
+	err = createKubeConfigSecret(id)
+	g.Expect(err).NotTo(HaveOccurred(), "failed to create kubeconfig secret")
+
+	manifests := func(name string, data string) []testserver.File {
+		return []testserver.File{
+			{
+				Name: "config.yaml",
+				Body: fmt.Sprintf(`---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: %[1]s
+data:
+  key: "%[2]s"
+`, name, data),
+			},
+		}
+	}
+
+	artifact, err := testServer.ArtifactFromFiles(manifests(id, id))
+	g.Expect(err).NotTo(HaveOccurred())
+
+	repositoryName := types.NamespacedName{
+		Name:      fmt.Sprintf("wait-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+
+	err = applyGitRepository(repositoryName, artifact, revision)
+	g.Expect(err).NotTo(HaveOccurred())
+
+	kustomizationKey := types.NamespacedName{
+		Name:      fmt.Sprintf("wait-%s", randStringRunes(5)),
+		Namespace: id,
+	}
+	kustomization := &kustomizev1.Kustomization{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      kustomizationKey.Name,
+			Namespace: kustomizationKey.Namespace,
+		},
+		Spec: kustomizev1.KustomizationSpec{
+			Interval: metav1.Duration{Duration: 2 * time.Minute},
+			Path:     "./",
+			KubeConfig: &kustomizev1.KubeConfig{
+				SecretRef: meta.SecretKeyReference{
+					Name: "kubeconfig",
+				},
+			},
+			SourceRef: kustomizev1.CrossNamespaceSourceReference{
+				Name:      repositoryName.Name,
+				Namespace: repositoryName.Namespace,
+				Kind:      sourcev1.GitRepositoryKind,
+			},
+			TargetNamespace: id,
+			Prune:           true,
+			Timeout:         &metav1.Duration{Duration: time.Second},
+			Wait:            true,
+		},
+	}
+
+	g.Expect(k8sClient.Create(context.Background(), kustomization)).To(Succeed())
+
+	resultK := &kustomizev1.Kustomization{}
+
+	g.Eventually(func() bool {
+		_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+		return resultK.Status.LastAppliedRevision == revision
+	}, timeout, time.Second).Should(BeTrue())
+
+	t.Run("reports healthy status", func(t *testing.T) {
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			ready := apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.ReadyCondition)
+			healthy := apimeta.IsStatusConditionTrue(resultK.Status.Conditions, kustomizev1.HealthyCondition)
+			return ready && healthy
+		}, timeout, time.Second).Should(BeTrue())
+	})
+
+	t.Run("reports unhealthy status", func(t *testing.T) {
+		reconcileRequestAt := metav1.Now().String()
+		g.Eventually(func() error {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			resultK.SetAnnotations(map[string]string{
+				meta.ReconcileRequestAnnotation: reconcileRequestAt,
+			})
+			resultK.Spec.Wait = false
+			resultK.Spec.HealthChecks = []meta.NamespacedObjectKindReference{
+				{
+					APIVersion: "v1",
+					Kind:       "ConfigMap",
+					Name:       "does-not-exists",
+					Namespace:  id,
+				},
+			}
+			return k8sClient.Update(context.Background(), resultK)
+		}, timeout, time.Second).Should(BeNil())
+
+		readyCondition := &metav1.Condition{}
+		healthyCondition := &metav1.Condition{}
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			readyCondition = apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
+			healthyCondition = apimeta.FindStatusCondition(resultK.Status.Conditions, kustomizev1.HealthyCondition)
+			return healthyCondition.Reason == meta.ProgressingReason
+		}, timeout, time.Second).Should(BeTrue())
+
+		expectedMessage := "running health checks"
+		g.Expect(readyCondition.Status).To(BeIdenticalTo(metav1.ConditionUnknown))
+		g.Expect(readyCondition.Message).To(ContainSubstring(expectedMessage))
+		g.Expect(healthyCondition.Status).To(BeIdenticalTo(metav1.ConditionUnknown))
+		g.Expect(healthyCondition.Message).To(ContainSubstring(expectedMessage))
+
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			readyCondition = apimeta.FindStatusCondition(resultK.Status.Conditions, meta.ReadyCondition)
+			healthyCondition = apimeta.FindStatusCondition(resultK.Status.Conditions, kustomizev1.HealthyCondition)
+			return healthyCondition.Reason == kustomizev1.HealthCheckFailedReason
+		}, time.Minute, time.Second).Should(BeTrue())
+
+		g.Expect(resultK.Status.LastHandledReconcileAt).To(BeIdenticalTo(reconcileRequestAt))
+		g.Expect(readyCondition.Status).To(BeIdenticalTo(metav1.ConditionFalse))
+		g.Expect(healthyCondition.Status).To(BeIdenticalTo(metav1.ConditionFalse))
+		g.Expect(healthyCondition.Message).To(BeIdenticalTo(kustomizev1.HealthCheckFailedReason))
+	})
+
+	t.Run("emits unhealthy event", func(t *testing.T) {
+		events := getEvents(resultK.GetName(), map[string]string{"kustomize.toolkit.fluxcd.io/revision": revision})
+		g.Expect(len(events) > 0).To(BeTrue())
+		g.Expect(events[len(events)-1].Type).To(BeIdenticalTo("Warning"))
+		g.Expect(events[len(events)-1].Message).To(ContainSubstring("does-not-exists"))
+	})
+
+	t.Run("recovers and reports healthy status", func(t *testing.T) {
+		g.Eventually(func() error {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			resultK.Spec.Wait = true
+			return k8sClient.Update(context.Background(), resultK)
+		}, timeout, time.Second).Should(BeNil())
+
+		g.Eventually(func() bool {
+			_ = k8sClient.Get(context.Background(), client.ObjectKeyFromObject(kustomization), resultK)
+			ready := apimeta.IsStatusConditionTrue(resultK.Status.Conditions, meta.ReadyCondition)
+			healthy := apimeta.IsStatusConditionTrue(resultK.Status.Conditions, kustomizev1.HealthyCondition)
+			return ready && healthy
+		}, timeout, time.Second).Should(BeTrue())
+	})
+
+	t.Run("emits recovery event", func(t *testing.T) {
+		expectedMessage := "Health check passed"
+		events := getEvents(resultK.GetName(), map[string]string{"kustomize.toolkit.fluxcd.io/revision": revision})
+		g.Expect(len(events) > 1).To(BeTrue())
+		g.Expect(events[len(events)-2].Type).To(BeIdenticalTo("Normal"))
+		g.Expect(events[len(events)-2].Message).To(ContainSubstring(expectedMessage))
+	})
+}

controllers/source_predicate.go

@@ -14,13 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 )
 
 type SourceRevisionChangePredicate struct {
@@ -47,7 +47,7 @@ func (SourceRevisionChangePredicate) Update(e event.UpdateEvent) bool {
 	}
 
 	if oldSource.GetArtifact() != nil && newSource.GetArtifact() != nil &&
-		!oldSource.GetArtifact().HasRevision(newSource.GetArtifact().Revision) {
+		oldSource.GetArtifact().Revision != newSource.GetArtifact().Revision {
 		return true
 	}
 

controllers/suite_test.go

@@ -14,20 +14,31 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package controller
+package controllers
 
 import (
+	"archive/tar"
+	"compress/gzip"
 	"context"
+	"crypto/sha1"
+	"crypto/sha256"
 	"fmt"
+	"io"
 	"math/rand"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	"github.com/fluxcd/pkg/apis/meta"
+	"github.com/fluxcd/pkg/runtime/controller"
+	"github.com/fluxcd/pkg/runtime/testenv"
+	"github.com/fluxcd/pkg/testserver"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 	"github.com/hashicorp/vault/api"
-	"github.com/opencontainers/go-digest"
-	"github.com/ory/dockertest/v3"
+	"github.com/ory/dockertest"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -37,56 +48,41 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 	controllerLog "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/yaml"
-
-	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/conditions"
-	kcheck "github.com/fluxcd/pkg/runtime/conditions/check"
-	"github.com/fluxcd/pkg/runtime/controller"
-	"github.com/fluxcd/pkg/runtime/metrics"
-	"github.com/fluxcd/pkg/runtime/testenv"
-	"github.com/fluxcd/pkg/testserver"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
-
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
 )
 
+func init() {
+	rand.Seed(time.Now().UnixNano())
+}
+
 const (
 	timeout                = time.Second * 30
 	interval               = time.Second * 1
 	reconciliationInterval = time.Second * 5
-	vaultVersion           = "1.13.2"
-	overrideManagerName    = "node-fetch"
-	sopsAgeSecret          = "sops-age-secret"
 )
 
+const vaultVersion = "1.2.2"
+
 var (
-	reconciler             *KustomizationReconciler
-	k8sClient              client.Client
-	testEnv                *testenv.Environment
-	testServer             *testserver.ArtifactServer
-	testMetricsH           controller.Metrics
-	ctx                    = ctrl.SetupSignalHandler()
-	kubeConfig             []byte
-	kstatusCheck           *kcheck.Checker
-	kstatusInProgressCheck *kcheck.Checker
-	debugMode              = os.Getenv("DEBUG_TEST") != ""
+	reconciler   *KustomizationReconciler
+	k8sClient    client.Client
+	testEnv      *testenv.Environment
+	testServer   *testserver.ArtifactServer
+	testMetricsH controller.Metrics
+	ctx          = ctrl.SetupSignalHandler()
+	kubeConfig   []byte
+	debugMode    = os.Getenv("DEBUG_TEST") != ""
 )
 
-func runInContext(registerControllers func(*testenv.Environment), run func() int) (code int) {
+func runInContext(registerControllers func(*testenv.Environment), run func() error, crdPath string) error {
 	var err error
-	utilruntime.Must(kustomizev1.AddToScheme(scheme.Scheme))
 	utilruntime.Must(sourcev1.AddToScheme(scheme.Scheme))
+	utilruntime.Must(kustomizev1.AddToScheme(scheme.Scheme))
 
 	if debugMode {
 		controllerLog.SetLogger(zap.New(zap.WriteTo(os.Stderr), zap.UseDevMode(false)))
 	}
 
-	testEnv = testenv.New(
-		testenv.WithCRDPath(filepath.Join("..", "..", "config", "crd", "bases")),
-		testenv.WithMaxConcurrentReconciles(4),
-	)
+	testEnv = testenv.New(testenv.WithCRDPath(crdPath))
 
 	testServer, err = testserver.NewTempArtifactServer()
 	if err != nil {
@@ -133,7 +129,7 @@ func runInContext(registerControllers func(*testenv.Environment), run func() int
 		pool.Purge(resource)
 	}()
 
-	code = run()
+	runErr := run()
 
 	if debugMode {
 		events := &corev1.EventList{}
@@ -156,41 +152,31 @@ func runInContext(registerControllers func(*testenv.Environment), run func() int
 		panic(fmt.Sprintf("Failed to remove storage server dir: %v", err))
 	}
 
-	return code
+	return runErr
 }
 
 func TestMain(m *testing.M) {
-	code := runInContext(func(testEnv *testenv.Environment) {
+	code := 0
+
+	runInContext(func(testEnv *testenv.Environment) {
 		controllerName := "kustomize-controller"
-		testMetricsH = controller.NewMetrics(testEnv, metrics.MustMakeRecorder(), kustomizev1.KustomizationFinalizer)
-		kstatusCheck = kcheck.NewChecker(testEnv.Client,
-			&kcheck.Conditions{
-				NegativePolarity: []string{meta.StalledCondition, meta.ReconcilingCondition},
-			})
-		// Disable fetch for the in-progress kstatus checker so that it can be
-		// asked to evaluate snapshot of an object. This is needed to prevent
-		// the object status from changing right before the checker fetches it
-		// for inspection.
-		kstatusInProgressCheck = kcheck.NewInProgressChecker(testEnv.Client)
-		kstatusInProgressCheck.DisableFetch = true
+		testMetricsH = controller.MustMakeMetrics(testEnv)
 		reconciler = &KustomizationReconciler{
-			ControllerName:          controllerName,
-			Client:                  testEnv,
-			Mapper:                  testEnv.GetRESTMapper(),
-			APIReader:               testEnv,
-			EventRecorder:           testEnv.GetEventRecorderFor(controllerName),
-			Metrics:                 testMetricsH,
-			ConcurrentSSA:           4,
-			DisallowedFieldManagers: []string{overrideManagerName},
-			SOPSAgeSecret:           sopsAgeSecret,
+			ControllerName:  controllerName,
+			Client:          testEnv,
+			EventRecorder:   testEnv.GetEventRecorderFor(controllerName),
+			MetricsRecorder: testMetricsH.MetricsRecorder,
 		}
-		if err := (reconciler).SetupWithManager(ctx, testEnv, KustomizationReconcilerOptions{
+		if err := (reconciler).SetupWithManager(testEnv, KustomizationReconcilerOptions{
+			MaxConcurrentReconciles:   4,
 			DependencyRequeueInterval: 2 * time.Second,
-			WatchConfigsPredicate:     predicate.Not(predicate.Funcs{}),
 		}); err != nil {
 			panic(fmt.Sprintf("Failed to start KustomizationReconciler: %v", err))
 		}
-	}, m.Run)
+	}, func() error {
+		code = m.Run()
+		return nil
+	}, filepath.Join("..", "config", "crd", "bases"))
 
 	os.Exit(code)
 }
@@ -205,39 +191,6 @@ func randStringRunes(n int) string {
 	return string(b)
 }
 
-func isReconcileRunning(k *kustomizev1.Kustomization) bool {
-	return conditions.IsReconciling(k) &&
-		conditions.GetReason(k, meta.ReconcilingCondition) != meta.ProgressingWithRetryReason
-}
-
-func isReconcileSuccess(k *kustomizev1.Kustomization) bool {
-	return conditions.IsReady(k) &&
-		conditions.GetObservedGeneration(k, meta.ReadyCondition) == k.Generation &&
-		k.Status.ObservedGeneration == k.Generation &&
-		k.Status.LastAppliedRevision == k.Status.LastAttemptedRevision
-}
-
-func isReconcileFailure(k *kustomizev1.Kustomization) bool {
-	if conditions.IsStalled(k) {
-		return true
-	}
-
-	isHandled := true
-	if v, ok := meta.ReconcileAnnotationValue(k.GetAnnotations()); ok {
-		isHandled = k.Status.LastHandledReconcileAt == v
-	}
-
-	return isHandled && conditions.IsReconciling(k) &&
-		conditions.IsFalse(k, meta.ReadyCondition) &&
-		conditions.GetObservedGeneration(k, meta.ReadyCondition) == k.Generation &&
-		conditions.GetReason(k, meta.ReconcilingCondition) == meta.ProgressingWithRetryReason
-}
-
-func logStatus(t *testing.T, k *kustomizev1.Kustomization) {
-	sts, _ := yaml.Marshal(k.Status)
-	t.Log(string(sts))
-}
-
 func getEvents(objName string, annotations map[string]string) []corev1.Event {
 	var result []corev1.Event
 	events := &corev1.EventList{}
@@ -279,29 +232,7 @@ func createKubeConfigSecret(namespace string) error {
 	return k8sClient.Create(context.Background(), secret)
 }
 
-type gitRepoOption func(*gitRepoOptions)
-
-type gitRepoOptions struct {
-	artifactMetadata map[string]string
-}
-
-func withGitRepoArtifactMetadata(k, v string) gitRepoOption {
-	return func(o *gitRepoOptions) {
-		if o.artifactMetadata == nil {
-			o.artifactMetadata = make(map[string]string)
-		}
-		o.artifactMetadata[k] = v
-	}
-}
-
-func applyGitRepository(objKey client.ObjectKey, artifactName string,
-	revision string, opts ...gitRepoOption) error {
-
-	var opt gitRepoOptions
-	for _, o := range opts {
-		o(&opt)
-	}
-
+func applyGitRepository(objKey client.ObjectKey, artifactName string, revision string) error {
 	repo := &sourcev1.GitRepository{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       sourcev1.GitRepositoryKind,
@@ -318,7 +249,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string,
 	}
 
 	b, _ := os.ReadFile(filepath.Join(testServer.Root(), artifactName))
-	dig := digest.SHA256.FromBytes(b)
+	checksum := fmt.Sprintf("%x", sha256.Sum256(b))
 
 	url := fmt.Sprintf("%s/%s", testServer.URL(), artifactName)
 
@@ -335,47 +266,128 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string,
 			Path:           url,
 			URL:            url,
 			Revision:       revision,
-			Digest:         dig.String(),
+			Checksum:       checksum,
 			LastUpdateTime: metav1.Now(),
-			Metadata:       opt.artifactMetadata,
 		},
 	}
 
-	patchOpts := []client.PatchOption{
+	opt := []client.PatchOption{
 		client.ForceOwnership,
 		client.FieldOwner("kustomize-controller"),
 	}
 
-	if err := k8sClient.Patch(context.Background(), repo, client.Apply, patchOpts...); err != nil {
+	if err := k8sClient.Patch(context.Background(), repo, client.Apply, opt...); err != nil {
 		return err
 	}
 
 	repo.ManagedFields = nil
 	repo.Status = status
-
-	statusOpts := &client.SubResourcePatchOptions{
-		PatchOptions: client.PatchOptions{
-			FieldManager: "source-controller",
-		},
-	}
-
-	if err := k8sClient.Status().Patch(context.Background(), repo, client.Apply, statusOpts); err != nil {
+	if err := k8sClient.Status().Patch(context.Background(), repo, client.Apply, opt...); err != nil {
 		return err
 	}
 	return nil
 }
 
+func createArtifact(artifactServer *testserver.ArtifactServer, fixture, path string) (string, error) {
+	if f, err := os.Stat(fixture); os.IsNotExist(err) || !f.IsDir() {
+		return "", fmt.Errorf("invalid fixture path: %s", fixture)
+	}
+	f, err := os.Create(filepath.Join(artifactServer.Root(), path))
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		if err != nil {
+			os.Remove(f.Name())
+		}
+	}()
+
+	h := sha1.New()
+
+	mw := io.MultiWriter(h, f)
+	gw := gzip.NewWriter(mw)
+	tw := tar.NewWriter(gw)
+
+	if err = filepath.Walk(fixture, func(p string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Ignore anything that is not a file (directories, symlinks)
+		if !fi.Mode().IsRegular() {
+			return nil
+		}
+
+		// Ignore dotfiles
+		if strings.HasPrefix(fi.Name(), ".") {
+			return nil
+		}
+
+		header, err := tar.FileInfoHeader(fi, p)
+		if err != nil {
+			return err
+		}
+		// The name needs to be modified to maintain directory structure
+		// as tar.FileInfoHeader only has access to the base name of the file.
+		// Ref: https://golang.org/src/archive/tar/common.go?#L626
+		relFilePath := p
+		if filepath.IsAbs(fixture) {
+			relFilePath, err = filepath.Rel(fixture, p)
+			if err != nil {
+				return err
+			}
+		}
+		header.Name = relFilePath
+
+		if err := tw.WriteHeader(header); err != nil {
+			return err
+		}
+
+		f, err := os.Open(p)
+		if err != nil {
+			f.Close()
+			return err
+		}
+		if _, err := io.Copy(tw, f); err != nil {
+			f.Close()
+			return err
+		}
+		return f.Close()
+	}); err != nil {
+		return "", err
+	}
+
+	if err := tw.Close(); err != nil {
+		gw.Close()
+		f.Close()
+		return "", err
+	}
+	if err := gw.Close(); err != nil {
+		f.Close()
+		return "", err
+	}
+	if err := f.Close(); err != nil {
+		return "", err
+	}
+
+	if err := os.Chmod(f.Name(), 0644); err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%x", h.Sum(nil)), nil
+}
+
 func createVaultTestInstance() (*dockertest.Pool, *dockertest.Resource, error) {
 	// uses a sensible default on windows (tcp/http) and linux/osx (socket)
 	pool, err := dockertest.NewPool("")
 	if err != nil {
-		return nil, nil, fmt.Errorf("could not connect to docker: %s", err)
+		return nil, nil, fmt.Errorf("Could not connect to docker: %s", err)
 	}
 
 	// pulls an image, creates a container based on it and runs it
 	resource, err := pool.Run("vault", vaultVersion, []string{"VAULT_DEV_ROOT_TOKEN_ID=secret"})
 	if err != nil {
-		return nil, nil, fmt.Errorf("could not start resource: %s", err)
+		return nil, nil, fmt.Errorf("Could not start resource: %s", err)
 	}
 
 	os.Setenv("VAULT_ADDR", fmt.Sprintf("http://127.0.0.1:%v", resource.GetPort("8200/tcp")))
@@ -384,24 +396,24 @@ func createVaultTestInstance() (*dockertest.Pool, *dockertest.Resource, error) {
 	if err := pool.Retry(func() error {
 		cli, err := api.NewClient(api.DefaultConfig())
 		if err != nil {
-			return fmt.Errorf("cannot create Vault Client: %w", err)
+			return fmt.Errorf("Cannot create Vault Client: %w", err)
 		}
 		status, err := cli.Sys().InitStatus()
 		if err != nil {
 			return err
 		}
 		if status != true {
-			return fmt.Errorf("vault not ready yet")
+			return fmt.Errorf("Vault not ready yet")
 		}
 		if err := cli.Sys().Mount("sops", &api.MountInput{
 			Type: "transit",
 		}); err != nil {
-			return fmt.Errorf("cannot create Vault Transit Engine: %w", err)
+			return fmt.Errorf("Cannot create Vault Transit Engine: %w", err)
 		}
 
 		return nil
 	}); err != nil {
-		return nil, nil, fmt.Errorf("could not connect to docker: %w", err)
+		return nil, nil, fmt.Errorf("Could not connect to docker: %w", err)
 	}
 
 	return pool, resource, nil

controllers/testdata/panic/kustomization.yaml

@@ -1,7 +1,7 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namePrefix: algo-
+namespace: test
+namePrefix: test
 resources:
-  - age.yaml
-  - pgp.yaml
-  - vault.yaml
+  - secret.age.yaml

controllers/testdata/panic/secret.age.yaml

@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:RwzrBF8wy16SpfbQoeADeKyz,iv:DuJce2Ebx1Y49DaLCOJ74OOkgiv21roxhz/sZqKCSSs=,tag:Gg9XHapZI5q+rvtgeY6nrg==,type:str]
+kind: ENC[AES256_GCM,data:RwzrBF8wy16SpfbQoeADeKyz,iv:DuJce2Ebx1Y49DaLCOJ74OOkgiv21roxhz/sZqKCSSs=,tag:Gg9XHapZI5q+rvtgeY6nrg==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:RwzrBF8wy16SpfbQoeADeKyz,iv:DuJce2Ebx1Y49DaLCOJ74OOkgiv21roxhz/sZqKCSSs=,tag:Gg9XHapZI5q+rvtgeY6nrg==,type:str]
+    namespace: ENC[AES256_GCM,data:RwzrBF8wy16SpfbQoeADeKyz,iv:DuJce2Ebx1Y49DaLCOJ74OOkgiv21roxhz/sZqKCSSs=,tag:Gg9XHapZI5q+rvtgeY6nrg==,type:str]
+stringData:
+    secret: ENC[AES256_GCM,data:RwzrBF8wy16SpfbQoeADeKyz,iv:DuJce2Ebx1Y49DaLCOJ74OOkgiv21roxhz/sZqKCSSs=,tag:Gg9XHapZI5q+rvtgeY6nrg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1l44xcng8dqj32nlv6d930qvvrny05hglzcv9qpc7kxjc6902ma4qufys29
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNeGduOFZjRWw2WTFQdWdu
+            OS83OEZaN1E1aU1zSThhMlNEZzd0aEYvdURFCnE3bmJ5c3J2cDNEbXhselFPVC9v
+            NFhMRjZjOHZOdEpoYjdiS0ZPd2pvN1kKLS0tIDZUVEFoblpDNWhnaWxYRTBjaktk
+            bHRXV0o1K2ZDNm5Mem5SdzNBMTNuNFUKylE2cRLqydjj6e4+4Giwn4y8mIPej+CM
+            Bab3UWiK1da2rFNTOEnoHl6QDAVxNrWdrrIa5k22SzApT88VtJ4xuQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2021-04-06T09:07:05Z"
+    mac: ENC[AES256_GCM,data:oaM8qFtEP8dOCd/Tr5yb08uetsnDtZO8o1rCayN53ncQ1HUAdhRBrFdmbYx1YTh1mwQVVN6sGYqFZU1LBMVv5pTqvpwd41biJZEg8NznXQWx0GA2Z6HOrblGhFZKrqky3P5xN+6j63zkJizXWgBMKzRvBnsVKxjZGr/lk1vVVv4=,iv:p4y9Fo3SArkEMuoK2d9sQYgNdc0iw/StFhg/5LnhcXM=,tag:61JGbnEw35tv6WnGj46JOw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.0

controllers/testdata/relbase/clusters/base/configmap.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm
+  namespace: foo
+data:
+  key: value

controllers/testdata/relbase/clusters/base/kustomization.yaml

@@ -1,4 +1,5 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- secret.yaml
+  - configmap.yaml

controllers/testdata/relbase/clusters/patches.yaml

@@ -1,6 +1,8 @@
+---
 apiVersion: v1
 kind: Secret
 metadata:
-    name: vault
+  name: secret
+  namespace: foo
 stringData:
-    key: value
+  bar: foo

controllers/testdata/relbase/clusters/staging/flux-system/kustomization.yaml

@@ -1,5 +1,8 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namePrefix: inside-
 resources:
   - secret.yaml
+  - ../../base
+patchesStrategicMerge:
+  - ../../patches.yaml

controllers/testdata/relbase/clusters/staging/flux-system/secret.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret
+  namespace: foo
+stringData:
+  foo: bar

controllers/testdata/remote/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github.com/fluxcd/kustomize-controller//config/crd?ref=main
+  - git::https://github.com/fluxcd/kustomize-controller//config/rbac?ref=main
+  - https://github.com/fluxcd/kustomize-controller//config/manager?ref=main

controllers/testdata/sops/.sops.yaml

@@ -0,0 +1,11 @@
+# creation rules are evaluated sequentially, the first match wins
+creation_rules:
+  # files using age
+  - path_regex: \.age.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1l44xcng8dqj32nlv6d930qvvrny05hglzcv9qpc7kxjc6902ma4qufys29
+  - path_regex: month.yaml$
+    pgp: 35C1A64CD7FC0AB6EB66756B2445463C3234ECE1
+  # fallback to PGP
+  - encrypted_regex: ^(data|stringData)$
+    pgp: 35C1A64CD7FC0AB6EB66756B2445463C3234ECE1