This PR bumps the vendored kustomize stack used by kubectl (kustomize/v5 5.7.1 → 5.8.1, api 0.20.1 → 0.21.1, kyaml 0.20.1 → 0.21.1) and removes the unwanted github.com/pkg/errors dependency by pulling in json-patch v4.13.0. The vendor tree updates include namespace propagation fixes for Helm charts, structured-data replacement improvements, regex-based replacement selectors, Helm v4 compatibility, and a number of error-handling adjustments. hack/unwanted-dependencies.json drops the pkg/errors entry now that it is no longer required. Go toolchain metadata in vendor/modules.txt moves these modules to go 1.24.0, but the repo remains at go 1.25.0 so no toolchain mismatch is introduced.
| Dependency | Old | New | Notes |
|---|---|---|---|
| sigs.k8s.io/kustomize/kustomize/v5 | v5.7.1 | v5.8.1 | kubectl kustomize engine update |
| sigs.k8s.io/kustomize/api | v0.20.1 | v0.21.1 | includes PatchArgs + replacements updates |
| sigs.k8s.io/kustomize/kyaml | v0.20.1 | v0.21.1 | structured data path matching + nil-safety |
| sigs.k8s.io/kustomize/cmd/config | v0.20.1 | v0.21.1 | indirect through api |
| gopkg.in/evanphx/json-patch.v4 | v4.12.0 (transitive) | v4.13.0 (transitive) | removes pkg/errors |
| github.com/pkg/errors | present (transitive) | removed | removed from unwanted deps list |
Minimum Go versions advertised in vendor/modules.txt for kustomize/api, kyaml, kustomize/v5 change from go 1.22.7 to 1.24.0.
kustomize/v5.8.1
- Release notes highlight: fix namespace propagation regression in v5.8.0, Helm v4 support, allow empty patch files, and upgrade json-patch to drop pkg/errors. (Release
kustomize/v5.8.1) - Commit scan
kustomize/v5.7.1..kustomize/v5.8.1shows:- Namespace propagation fixes for Helm charts in nested kustomizations (#6031/#6027).
- Helm v4 support alongside v3 (helm version check relaxed; Helm-generated resources annotated).
- Regex support for replacement selectors and structured data replacements.
- PatchArgs option struct for patches (replaces map[string]bool).
- URL validation before HTTP GET in loader.
- Kyaml nil-safety improvements for RNode accessors.
api/v0.21.1
- Release notes mirror kustomize: allow empty patches, Helm v4 support, namespace propagation fix, json-patch bump. (Release
api/v0.21.1)
kyaml/v0.21.1
- Release notes empty; upstream commit scan shows changes landed via v0.21.0/v0.21.1 tag bumps including structured data path matching and nil-safety fixes.
cmd/config/v0.21.1
- Release notes only mention kyaml bump.
types.Patch.Optionschanges frommap[string]boolto*PatchArgs(fields:allowNameChange,allowKindChange). Any consumers reading raw options maps must adjust; serialization changes from map to object.- Replacement target selectors now use regex-capable selectors (
TargetSelectorRegex), and structured data paths inside scalar JSON/YAML are supported for replacements. - Helm chart inflation now supports helm v4 and annotates generated resources with
kustomize.toolkit.fluxcd.io/helm-generate(viakonfig.HelmGeneratedAnnotation). - Kyaml
PathMatchernow descends into scalar JSON/YAML when additional path segments exist. - Kyaml
RNodeaccessors (Content,Field,Element,MarshalJSON) are now nil-safe. - Minor error-wrapping changes across kyaml and kustomize, and plugin mount path validation rejects any
..prefix rather than only../.
No exported symbols were removed, but the Patch options type change is a behavioral/API compatibility shift for YAML/JSON config.
- Helm namespace propagation: overlays with
namespacenow propagate into Helm charts in nested bases (only when chart namespace empty). Fixes previous propagation regressions; affects users relying on Helm charts in kustomizations. - Helm v4 support:
helm version --shortand version check accept major 3 or 4; Helm-generated resources are annotated. - Replacements structured data: replacements can target nested fields inside JSON/YAML stored in scalar strings, including regex selectors; previously would error or ignore.
- Patch options: patch
optionsare now explicit fields; behavior forallowNameChange/allowKindChangeunchanged but parsing changes. - URL fetch: loader validates URL with
url.ParseRequestURIbeforehttp.Get, reducing potential infinite loops / malformed URL issues. - Plugin mount path:
..in mount path now rejected even without trailing slash. - nil-safety: kyaml accessors avoid panics, which changes failure mode from panic to nil/
nullJSON.
- Direct kustomize usage is in kubectl (
staging/src/k8s.io/kubectl/pkg/cmd/kustomize/kustomize.go) and cli-runtime kustomize visitor. The version bump aligns vendored libraries with kubectl’s kustomize binary. - Patch options change is internal to kustomize configuration files (
kustomization.yaml) not Go code; no Kubernetes Go code referencestypes.Patchfrom kustomize. - Helm namespace propagation changes affect users running
kubectl kustomizeandkubectl apply -kwith Helm charts in bases; expected improvement and regression fix. - Structured data replacements (JSON-in-YAML) can now work in kustomize-driven manifests used by kubectl.
- Removal of pkg/errors from unwanted dependencies list matches the json-patch bump; no remaining references in go.mod/go.sum for core modules.
| Risk | Description | Likelihood | Severity | Affected code |
|---|---|---|---|---|
| Compile-time breakage | PatchOptions type change could affect downstream kustomize consumers, but kubectl only uses config files | Low | Medium | kustomize API consumers, external tooling |
| Runtime behavior change | Helm namespace propagation change may alter rendered manifests in nested bases | Medium | Medium | kubectl kustomize/apply -k |
| Runtime behavior change | Structured data replacements might now mutate JSON/YAML scalar values (new capability) | Medium | Low | kustomize replacements |
| Security/robustness | URL validation + nil-safety reduces crashes; low risk | Low | Low | kustomize loader/kyaml |
| Performance regression | Extra parsing for structured data paths could add overhead on replacements | Low | Low | replacements in kustomize |
| Downstream impact | Config schema change for patch options (map → object) | Medium | Medium | downstream kustomize configs/tools |
| Toolchain mismatch | Vendor metadata bumps go version to 1.24.0 but repo uses 1.25.0 | Low | Low | build metadata |
Safe with caveats. The update is largely additive and fixes known regressions (Helm namespace propagation, Helm v4 support, URL validation) while removing an unwanted dependency. The main caveat is the Patch options schema change (map → PatchArgs object) and the new structured-data replacement behavior, which could affect downstream kustomize configs and output. For kubectl usage, the changes are expected to be improvements, but reviewers should be aware of potential manifest diffs for Helm and replacement-heavy kustomizations.