`flux build --ignore-paths` only filters root resources, leaking ignored files in bases and sub-directories

Describe the bug

When running flux build kustomization --ignore-paths <pattern>, files matching the ignore pattern (e.g. **/*.enc.yaml or **/secrets/*.yaml) are not ignored if they reside in a base directory referenced by an overlay (e.g. resources: [- ../../base]) or in subdirectories discovered during multi-directory builds.

Instead, native kustomize.Build resolves the relative paths and pulls the supposedly-ignored files into the build output. If these files are encrypted SOPS files or non-standard manifests, the build fails downstream in ssautil.ReadObjects with errors like:

✗ kustomize build failed: error unmarshaling JSON: while decoding JSON: Object 'Kind' is missing in ...

Steps to reproduce

1. Create a directory structure with a base and an overlay:

repro/
├── base/
│   ├── configmap.yaml
│   ├── secret.enc.yaml     # File intended to be ignored
│   └── kustomization.yaml
└── overlay/
    └── kustomization.yaml

1. Manifest contents:

• base/configmap.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
data:
  key: value

• base/secret.enc.yaml:

apiVersion: ENC[AES256_GCM,data:foo]
kind: ENC[AES256_GCM,data:bar]

• base/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ./configmap.yaml
  - ./secret.enc.yaml

• overlay/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base

1. Run flux build on the overlay while explicitly ignoring *.enc.yaml:

flux build kustomization test \
  --path ./overlay \
  --kustomization-file <(echo '
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: test
  namespace: flux-system
spec:
  interval: 1m
  path: ./overlay
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
') \
  --ignore-paths "**/*.enc.yaml"

Outcome:

• Running directly against ./base: --ignore-paths "**/*.enc.yaml" works (it strips secret.enc.yaml from base/kustomization.yaml.resources).
• Running against ./overlay: --ignore-paths "**/*.enc.yaml" fails. Native Kustomize follows ../base, reads secret.enc.yaml, and outputs it.

Expected behavior

--ignore-paths is documented as taking patterns following .gitignore format. Any file matching the ignore pattern across the repository/build tree should be excluded from the build, regardless of whether it is referenced directly in the root kustomization.yaml or imported indirectly via resources: [- ../../base].

OS / Distro

macOS

Flux version

v2.9.4

Flux check

► checking prerequisites
✔ Kubernetes 1.36.1-aliyun.1 >=1.33.0-0
► checking controllers
✔ helm-controller: deployment ready
✔ image-automation-controller: deployment ready
✔ image-reflector-controller: deployment ready
✔ kustomize-controller: deployment ready
✔ notification-controller: deployment ready
✔ source-controller: deployment ready
► checking crds
✔ all checks passed

Additional context

Root Cause in Code

1. In fluxcd/flux2/internal/build/build.go:

ignoreList := strings.Join(b.ignore, "\n")
gen := kustomize.NewGeneratorWithIgnore("", ignoreList, unstructured.Unstructured{Object: data})
buildFS, buildDir, action, er := b.generate(*k, b.resourcesPath)
...
m, err = b.do(ctx, *k, buildFS, buildDir) // Calls kustomize.Build(fs, dirPath)

1. In fluxcd/pkg/kustomize/kustomize_generator.go:

if g.filter {
    if err := filterKsWithIgnoreFiles(&kus, dirPath, ignorePatterns, ignoreDomain); err != nil {
        return nil, "", action, err
    }
}

1. In fluxcd/pkg/kustomize/filters.go, filterSlice only inspects and mutates the resources: and components: slices of the single kustomization.yaml at the root dirPath.
2. Once kustomize.Build starts, Kustomize's internal loader directly reads the filesystem. Because the ignore filter was only applied to the root YAML slice and not to the underlying filesys.FileSystem wrapper, native Kustomize loads any referenced base directory directly from disk without ignore filtering.

Suggested Fix

Instead of only trimming the root kustypes.Kustomization.Resources slice in kustomize_generator.go, apply the ignore filter at the filesys.FileSystem layer (e.g. decorating filesys.FileSystem in inMemoryFsBackend / onDiskFsBackend so that fs.ReadFile, fs.Exists, and directory walkers treat ignored paths as non-existent).

Code of Conduct

• I agree to follow this project's Code of Conduct