Kustomize doesn't append nameSuffix from overlay when patch is applied in patchesJson6902 section in version 4.2.0

[Art3mK]

nameSuffix isn't applied to serviceAccountName for daemonset, if patch is specified in patchesJson6902 section, the same patch in section patches works fine.

See sample setup in https://github.com/Art3mK/kustomize-bug

Expected output

➜  kustomize build overlays/prod
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::12345678910:role/fluentd-cw-logs
  name: fluentd-sa-abc
  namespace: abc
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-abc
  namespace: abc
spec:
  template:
    spec:
      containers:
      - image: fluentd:latest
        name: fluentd
      serviceAccountName: fluentd-sa-abc

Actual output

➜  kustomize build overlays/prod
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::12345678910:role/fluentd-cw-logs
  name: fluentd-sa-abc
  namespace: abc
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-abc
  namespace: abc
spec:
  template:
    spec:
      containers:
      - image: fluentd:latest
        name: fluentd
      serviceAccountName: fluentd-sa # <- missing nameSuffix

Kustomize version

{Version:kustomize/v4.2.0 GitCommit:d53a2ad45d04b0264bcee9e19879437d851cb778 BuildDate:2021-07-01T00:44:28+01:00 GoOs:darwin GoArch:amd64}

Platform

macOs

Additional context

adding random suffix to target in patch results in correct template

➜  cat overlays/prod/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

bases:
  - "../../base"

namespace: abc
nameSuffix: -abc

# works fine with
#patches:
patchesJson6902:
  - path: patch-sa.yaml
    target:
      name: fluentd-sa-random # <- should give error, but it doesn't?
      kind: ServiceAccount
      version: v1
➜  kustomize build overlays/prod
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd-sa-abc
  namespace: abc
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-abc
  namespace: abc
spec:
  template:
    spec:
      containers:
      - image: fluentd:latest
        name: fluentd
      serviceAccountName: fluentd-sa-abc # <- lolwhut

[Serializator]

/assign @Serializator

[Serializator]

Just a status update since I assigned the issue to myself. I think to have found the problem and pushed the necessary change to my branch. I will create a pull request shortly. I only signed the CLA yesterday and I didn't know if creating a pull request right after would work.

[Serializator]

I created a pull request (#4266) in which a proposed a solution which I neglected to run tests on locally, which turned out to indicate that the proposed solution would introduce at least one regression.

I dove into the commit history and using bisect discovered out that this bug was introduced in a commit (bd4580d) that changed in-memory fields in the resource.Resource struct with annotations.

Commenting out the delete(...) calls in resource.(*Resource).RemoveIdAnnotations made clear that the actual problem is that these annotations are replaced with nothing, due to the patch "overriding" the /metadata/annotations path in some way. Thus the prefix and suffix are lost and not applied.

apiVersion: v1
kind: ServiceAccount
metadata:
    annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::12345678910:role/fluentd-cw-logs
    name: fluentd-sa-abc
    namespace: abc

"patches" uses a strategic merge, which properly merges the annotations from Kustomize and the ones defined within the patch itself.

apiVersion: v1
kind: ServiceAccount
metadata:
    annotations:
        config.kubernetes.io/originalName: fluentd-sa
        config.kubernetes.io/originalNs: default
        config.kubernetes.io/prefixes: null
        config.kubernetes.io/suffixes: -abc
        eks.amazonaws.com/role-arn: arn:aws:iam::12345678910:role/fluentd-cw-logs
    name: fluentd-sa-abc
    namespace: abc