From 9756d92a9130454058d8c84ec82e5e9809dfd7b4 Mon Sep 17 00:00:00 2001
From: Jeong Jinwoo <jwjeong96@gmail.com>
Date: Fri, 11 Aug 2023 21:35:13 +0900
Subject: [PATCH 1/2] test: demonstrate reject not working on targets with
 changed id

---
 api/krusty/replacementtransformer_test.go | 68 +++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/api/krusty/replacementtransformer_test.go b/api/krusty/replacementtransformer_test.go
index 5f57082ec9..677b68e83a 100644
--- a/api/krusty/replacementtransformer_test.go
+++ b/api/krusty/replacementtransformer_test.go
@@ -546,3 +546,71 @@ metadata:
   name: red-dc6gc5btkc
 `)
 }
+
+func TestReplacementTransformerWithSuffixTransformerAndReject(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteK("base", `
+resources:
+  - app.yaml
+`)
+	th.WriteK("overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+nameSuffix: -dev
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: app-config
+    literals:
+      - name=something-else
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: app-config
+      fieldPath: data.name
+    targets:
+      - fieldPaths:
+          - spec.template.spec.containers.0.name
+        select:
+          kind: Deployment
+        reject:
+          - name: original-name
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name-dev
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: something-else
+---
+apiVersion: v1
+data:
+  name: something-else
+kind: ConfigMap
+metadata:
+  name: app-config-dev-97544dk6t8
+`)
+}

From 9f1d5acdc85d6d462fc6c730e9302c72d98f8f3e Mon Sep 17 00:00:00 2001
From: Jeong Jinwoo <jwjeong96@gmail.com>
Date: Fri, 11 Aug 2023 21:37:55 +0900
Subject: [PATCH 2/2] fix: check both prev and current ids for filtering reject
 targets

---
 api/filters/replacement/replacement.go    | 15 ++++++++++-----
 api/krusty/replacementtransformer_test.go |  2 +-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/api/filters/replacement/replacement.go b/api/filters/replacement/replacement.go
index d4fea260be..bea5690c40 100644
--- a/api/filters/replacement/replacement.go
+++ b/api/filters/replacement/replacement.go
@@ -126,8 +126,8 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 			}
 
 			// filter targets by matching resource IDs
-			for i, id := range ids {
-				if id.IsSelectedBy(selector.Select.ResId) && !rejectId(selector.Reject, &ids[i]) {
+			for _, id := range ids {
+				if id.IsSelectedBy(selector.Select.ResId) && !containsRejectId(selector.Reject, ids) {
 					err := copyValueToTarget(possibleTarget, value, selector)
 					if err != nil {
 						return nil, err
@@ -168,10 +168,15 @@ func matchesAnnoAndLabelSelector(n *yaml.RNode, selector *types.Selector) (bool,
 	return annoMatch && labelMatch, nil
 }
 
-func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
+func containsRejectId(rejects []*types.Selector, ids []resid.ResId) bool {
 	for _, r := range rejects {
-		if !r.ResId.IsEmpty() && id.IsSelectedBy(r.ResId) {
-			return true
+		if r.ResId.IsEmpty() {
+			continue
+		}
+		for _, id := range ids {
+			if id.IsSelectedBy(r.ResId) {
+				return true
+			}
 		}
 	}
 	return false
diff --git a/api/krusty/replacementtransformer_test.go b/api/krusty/replacementtransformer_test.go
index 677b68e83a..273246756b 100644
--- a/api/krusty/replacementtransformer_test.go
+++ b/api/krusty/replacementtransformer_test.go
@@ -604,7 +604,7 @@ spec:
     spec:
       containers:
       - image: app1:1.0
-        name: something-else
+        name: app
 ---
 apiVersion: v1
 data: