Kustomize Stores Its Builtin OpenAPI Bundle as Plain JSON

kustomize builds Kubernetes manifests from a base and overlays. Seven commits on master record the library modules at v0.21.3 and store the built in OpenAPI bundle as plain JSON, replacing the gzip artifact. The diff is 292 files and 20,867 insertions, and almost all of those lines are one indented schema file.

The schema fix changes the runtime artifact from kubernetes-openapi-union-v1.21.2.bundle-v1.json.gz to kubernetes-openapi-union-v1.21.2.bundle-v1.json. The gzip file was 129,457 bytes. The JSON file is 1,112,546 bytes across 20,331 lines. go:embed in kyaml/openapi/builtin_schema.go places that text in every binary that imports kyaml/openapi, including the kustomize CLI. The embedded blob grows by 983,089 bytes.

//go:embed kubernetesapi/data/kubernetes-openapi-union-v1.21.2.bundle-v1.json
var builtinKubernetesOpenAPIBundle []byte

decodeBuiltinBundle in kyaml/openapi/openapi.go used to open a gzip reader, decode one JSON value, and read to EOF so the checksum was checked. The generator test also required a zero modification time and an empty gzip name and comment. The function now hands the embed bytes to json.NewDecoder. A second JSON value or trailing junk still fails the load. The tests drop the invalid gzip case, the flipped checksum case, the header checks, and the compress/gzip import.

kyaml/openapi/cmd/openapi-bundle writes the file with json.MarshalIndent, a two space indent, and a trailing newline. The write lands in a temp file at mode 0644, then os.Rename replaces the destination. The README states why: plain text so reviewers can read the schema and the diff. Output must stay byte for byte reproducible. TestGeneratedBundleIsCurrentAndDeterministic enforces that, with one exception. On Windows it still compares two fresh generations with each other, and it skips the compare against the checked in file, because Git may check text out with CRLF. The path has no .gitattributes rule forcing LF. JSON semantics survive the carriage returns. The bytes differ from the LF file the generator writes.

writeGzip remains for the compiler flag -legacy-proto-output. The protobuf source kubernetesapi/v1_21_2/swagger.pb.gz stays compressed. The README records its uncompressed SHA-256 as 5d171b55e9601912807a870d73ffe70bb306f5889a00e76986042a0f2d7b6bc2.

DefaultOpenAPI is still v1.21.2. The comment beside it calls this the initial artifact format migration, so the constant is unchanged on purpose. BuiltinSchemaInfo, the string kustomize openapi info prints, is still {title:Kubernetes,version:v1.21.2}.

The bundle test still requires 618 definitions and 275 resources. API paths remain compiler inputs and stay out of the embed. parseBuiltinBundle fills the same GVK index and the same namespace scope map: namespaced, cluster scoped, or skipped when scope is unknown.

Kinds added after Kubernetes 1.21 stay outside this bundle. CRDs and newer built in fields still depend on a schema supplied by the caller. Reviewers get a readable diff. The git tree and the linked binary carry the indented text. The commit records no timings. The decoder now tokenizes indented JSON, where the old path inflated 129,457 bytes and parsed a compact document.

On 8 October the repo walked its module ladder and returned master to local checkouts. From the kyaml pin to the unpin is about 40 minutes.

The kyaml update moves sigs.k8s.io/kustomize/kyaml from v0.21.2 to v0.21.3 in 33 go.mod files and deletes the local replace lines. The list covers api, cmd/config, cmd/depprobcheck, cmd/pluginator, the CLI module, built in plugins such as annotationstransformer, and the example plugins in the tree.

The cmd/config update touches only the CLI module. kustomize/go.mod requires sigs.k8s.io/kustomize/cmd/config v0.21.3 and drops replace sigs.k8s.io/kustomize/cmd/config => ../cmd/config.

The api update sets sigs.k8s.io/kustomize/api to v0.21.3 in 31 go.mod files and removes those replaces.

The unpin commit restores development mode. LATEST_RELEASE in the Makefile moves from v5.8.2 to v5.8.3. Require lines stay on v0.21.3. replace lines point at sibling directories again, in 33 modules. The CLI module is the one that wires all three:

replace sigs.k8s.io/kustomize/api => ../api

replace sigs.k8s.io/kustomize/cmd/config => ../cmd/config

replace sigs.k8s.io/kustomize/kyaml => ../kyaml

A build inside this tree follows the replaces and compiles the siblings. A downstream module that requires v0.21.3 resolves the version recorded while those replaces were absent. v5.8.3 is the CLI marker on module path sigs.k8s.io/kustomize/kustomize/v5. The libraries stay on the v0.21.3 line.

The x/sys bump on 11 October takes golang.org/x/sys from v0.48.0 to v0.49.0 in 43 go.mod files, 86 files once sums are included. kyaml/go.mod requires it directly. The other 42 modules keep the // indirect mark. The only Go import is golang.org/x/sys/windows in kyaml/filesys/fsondisk_windows.go, and that file sits outside the diff. The Windows filesystem helper compiles against v0.49.0. The message is the Dependabot template and names no call site edit.

The docs lockfile bump on 8 October edits site/package-lock.json alone. source-map-js moves from 1.2.1 to 1.2.2, marked "dev": true, and Dependabot classifies it as indirect. A docs site install picks up the tarball. The CLI build leaves it untouched.

The format migration is the opening move. DefaultOpenAPI is still v1.21.2, so the OpenAPI change that matters next is a newer Kubernetes protobuf checked in beside this JSON. Until that lands, kustomize openapi info keeps reporting v1.21.2, and fields introduced later still need an external schema.

The bundle is text, and the path has no .gitattributes eol rule. A Windows checkout with core.autocrlf can skip the byte compare in the determinism test and can turn a regeneration into a full file diff. Pin LF on kubernetes-openapi-union-v1.21.2.bundle-v1.json before the next make -C kyaml/openapi generate from a Windows tree.

Master is in development mode again. Read the replace block in kustomize/go.mod before treating a master checkout as the v0.21.3 modules a downstream build fetches. LATEST_RELEASE=v5.8.3 in the Makefile is the CLI marker, a different number from the v0.21.3 library modules.