Replacements Transformer: Replace All Instances does not work with create:True

[vsabella]

When attempting this replacement with wildcard * it fails with
kustomize v4.5.4

Error: accumulating components: 
accumulateDirectory: "recursed accumulation of path '/envoyfilter-transformer/istio-1.12': 

accumulating components: accumulateDirectory: \"recursed accumulation of path '/envoyfilter-transformer/base': 
  wrong Node Kind for spec.configPatches expected: MappingNode was SequenceNode: value: 

apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
replacements:
  - source:
      kind: ConfigMap
      name: istio-version
      fieldPath: data.ISTIO_REGEX
    targets:
      - select:
          kind: EnvoyFilter
        fieldPaths:
          - spec.configPatches.*.match.proxy.proxyVersion
          #- spec.configPatches.0.match.proxy.proxyVersion

        options:
          create: true

---
# https://docs.fastly.com/signalsciences/install-guides/kubernetes/kubernetes-istio/
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: axon-sigsci
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_FIRST
        value:
          name: my.ext_authz
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz"
            transport_api_version: V3
            failure_mode_allow: true
            with_request_body:
              max_request_bytes: 16384
              allow_partial_message: true
            grpc_service:
              envoy_grpc:
                cluster_name: my-cluster
    - applyTo: CLUSTER
      patch:
        operation: ADD
        value:
          name: my-cluster
          type: STRICT_DNS
          connect_timeout: 0.5s
          http2_protocol_options: {}
          load_assignment:
            cluster_name: my-cluster
            endpoints:
              - lb_endpoints:
                  - endpoint:
                      address:
                        socket_address:
                          address: my-address
                          port_value: 1234

[natasha41575]

It makes sense to me in a lot of cases for the wildcard match to work with create: true. The example provided in this issue is a valid use case.

Implementation is a separate discussion, there may be some nitty gritty details with the way PathMatcher is currently implemented that could make this very difficult to do, but from the user perspective I agree that this is a desirable feature.

@koba1t would you be able to improve the error message, to something like wildcard match in replacements cannot be used with create: true option? I think we should at least do that, and then we can revisit implementation of the support later.

/triage accepted
/kind feature

[koba1t]

hi @natasha41575.
I fix the error message on #4577.
Could you check it?

And I'm watching your PR(#4574).
May I help you with your work?

[natasha41575]

hi @natasha41575.
I fix the error message on #4577.
Could you check it?

And I'm watching your PR(#4574).
May I help you with your work?

Thanks! Your PR covers what I was trying to fix with mine, so let's go with yours.

[natasha41575]

The error message is now improved.

If in the future we want to support using create: true with the wildcard match, I am open to accepting that, so I will leave this issue open in case someone wants to contribute it.

/lifecycle frozen

[KnVerey]

/assign