nameReference transformer is not updating fields in all configured resource kinds

Author: bodgitCreated Jan 2, 2024Updated Sep 17, 2026

Labelskind/buglifecycle/frozenneeds-triage

What happened?

I'm trying to configure the nameReference transformer so it updates the name references in a handful of additional resource kinds using additional configuration. For testing purposes I've configured the nameSuffix transformer to just add -FOOBAR to all of the resource names.

What did you expect to happen?

I would expect all of the configured references to be updated, but only the one referencing the secret name seems to take effect.

A picture paints a thousand words:

I can't see what I'm doing wrong, nor is there any sort of error or verbosity knob to tweak.

How can we reproduce it (as minimally and precisely as possible)?

yaml

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - resources.yaml

secretGenerator:
  - name: test
    files:
      - test.pem
    namespace: cert-manager

configurations:
  - kustomizeconfig.yaml

generatorOptions:
  disableNameSuffixHash: true

nameSuffix: -FOOBAR

yaml

# resources.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-test-sa
  namespace: external-secrets
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: secret-store
spec:
  provider:
    aws:
      service: SecretsManager
      region: eu-west-1
      auth:
        jwt:
          serviceAccountRef:
            name: my-test-sa
            namespace: external-secrets
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: vault
  namespace: cert-manager
spec:
  vault:
    caBundleSecretRef:
      name: test
      key: test.pem
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: cert-manager-vault-approle
  namespace: cert-manager
spec:
  secretStoreRef:
    name: secret-store
    kind: ClusterSecretStore

yaml

# kustomizeconfig.yaml
nameReference:
  - kind: Secret
    fieldSpecs:
      - kind: ClusterIssuer
        group: cert-manager.io
        path: spec/vault/caBundleSecretRef/name
  - kind: ServiceAccount
    fieldSpecs:
      - kind: ClusterSecretStore
        group: external-secrets.io
        path: spec/provider/aws/auth/jwt/serviceAccountRef/name
  - kind: ClusterSecretStore
    group: external-secrets.io
    fieldSpecs:
      - kind: ExternalSecret
        group: external-secrets.io
        path: spec/secretStoreRef/name

# test.pem
Cg==

Expected output

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-test-sa-FOOBAR
  namespace: external-secrets
---
apiVersion: v1
data:
  test.pem: Q2c9PQo=
kind: Secret
metadata:
  name: test-FOOBAR
  namespace: cert-manager
type: Opaque
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: vault-FOOBAR
  namespace: cert-manager
spec:
  vault:
    caBundleSecretRef:
      key: test.pem
      name: test-FOOBAR
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: secret-store-FOOBAR
spec:
  provider:
    aws:
      auth:
        jwt:
          serviceAccountRef:
            name: my-test-sa-FOOBAR
            namespace: external-secrets
      region: eu-west-1
      service: SecretsManager
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: cert-manager-vault-approle-FOOBAR
  namespace: cert-manager
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: secret-store-FOOBAR

Actual output

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-test-sa-FOOBAR
  namespace: external-secrets
---
apiVersion: v1
data:
  test.pem: Q2c9PQo=
kind: Secret
metadata:
  name: test-FOOBAR
  namespace: cert-manager
type: Opaque
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: vault-FOOBAR
  namespace: cert-manager
spec:
  vault:
    caBundleSecretRef:
      key: test.pem
      name: test-FOOBAR
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: secret-store-FOOBAR
spec:
  provider:
    aws:
      auth:
        jwt:
          serviceAccountRef:
            name: my-test-sa
            namespace: external-secrets
      region: eu-west-1
      service: SecretsManager
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: cert-manager-vault-approle-FOOBAR
  namespace: cert-manager
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: secret-store

Kustomize version

5.3.0

Operating system

Linux

Source: kubernetes-sigs/kustomize

View original on GitHub View discussion on GitHub