Replacements takes secret name without a random suffix

[vlasov-y]

What happened?

Replacements set wrong secret name to target key, it does not contain a random suffix.

What did you expect to happen?

Secret name from secret object and in replaced paths matches.

How can we reproduce it (as minimally and precisely as possible)?

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - service.yaml
secretGenerator:
  - name: data
    envs:
      - data.env
replacements:
  - source:
      kind: Secret
    targets:
      - select:
          kind: Service
        fieldPaths:
          - metadata.annotations.secretName
        options:
          create: true

# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: http
    protocol: TCP
    name: http

# data.env
a=b

Expected output

apiVersion: v1
data:
  a: Yg==
kind: Secret
metadata:
  name: data-k695gkmbtk
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    secretName: data-k695gkmbtk
  name: nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  type: ClusterIP

Actual output

apiVersion: v1
data:
  a: Yg==
kind: Secret
metadata:
  name: data-k695gkmbtk
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    secretName: data # <-- here it is
  name: nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  type: ClusterIP

Kustomize version

v5.5.0

Operating system

Linux

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[vkukk]

Not sure if the bug I encountered is identical, but it's pretty similar.

kubectl version
Client Version: v1.30.8
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.5

kustomizaton.yaml

replacements:
- source:
    kind: Secret
    name: pulp-ca-ca-cert-tls
    namespace: pulp
  targets:
  - select:
      kind: Ingress
      name: pulp-private-ingress
    fieldPaths:
      - metadata.annotations.[nginx.ingress.kubernetes.io/auth-tls-secret]
    options:
      delimiter: "/"
      index: 1

ingress-private.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pulp-private-ingress
  namespace: pulp
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-secret: "pulp/pulp-ca-ca-cert-tls"

kubectl kustomize .
No change in annotation nginx.ingress.kubernetes.io/auth-tls-secret: "pulp/pulp-ca-ca-cert-tls"

Expected output:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pulp-private-ingress
  namespace: pulp
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-secret: "pulp/pulp-ca-ca-cert-tls-gf2dhht27f"

When removing namespace prefix "pulp/" from annotation, the replacement works.