[Nikshay1]

Description

kpt live init no longer fails when the package contains a YAML file that is a bare sequence instead of a KRM resource, such as a JSON 6902 patch used by kustomize.

The namespace for the inventory object was found with config.FindNamespace from cli-utils. It reads the package with a kio.LocalPackageReader that does not set WrapBareSeqNode, so a bare sequence makes the read fail:

$ kpt pkg get https://github.com/kptdev/kpt.git/package-examples/kustomize
$ echo '- foo' > kustomize/overlays/dev/foo.yaml
$ kpt live init kustomize/overlays/dev/
Error: .../kustomize/overlays/dev/foo.yaml: wrong node kind: expected MappingNode but got SequenceNode

This PR replaces that call with a kpt-local findNamespace in commands/live/init/cmdliveinit.go. It is the cli-utils logic with two differences:

• the package is read with WrapBareSeqNode: true, as the other readers in kpt do (for example pkg/live/rgpath.go);
• bare sequences are skipped when checking whether all the resources are in the same namespace, because they are not resources.

With the change, the command above prints:

initializing "resourcegroup.yaml" data (namespace: default)...success

Everything that worked before behaves the same: the --namespace flag still takes precedence, cluster-scoped and local-config resources are still ignored, and the namespace of the kubeconfig context is still the fallback. The klog.V(6) messages of the cli-utils implementation are kept.

Motivation

Kustomize overlays often contain JSON 6902 patch files, and the kustomize example documents running kpt live init on an overlay directory. The only workaround was to pass --namespace.

The cause is in cli-utils, whose allInSameNamespace is the same on its master branch today, so I fixed it in kpt instead of waiting for a cli-utils release.

Fixes #4789

Notes for reviewers

• Scope. Only bare sequences are skipped. A YAML mapping that is not a KRM resource (for example a Helm values.yaml) never failed, and it still makes the detection fall back to the namespace of the context, as before. There is a test that pins this. I can change it to skip those files too if you prefer that.
• Empty sequences and kpt live init shouldn't reformat all yaml files #4791. A file containing only [] is rewritten as bareSeqNodeWrappingKey: [] by the attribution step at the end of live init. This already happens on main when --namespace is passed, and it does not happen with KRM_DISABLE_ATTRIBUTION=1. It comes from the attribution step rewriting every file in the package, which is kpt live init shouldn't reformat all yaml files #4791. I plan to send a separate PR for kpt live init shouldn't reformat all yaml files #4791, so I did not change it here.
• fix(live): make inventory ID and name deterministic in live init #4788 also changes cmdliveinit.go and its test, in different places. I put the new TestCmd_Run case at the end of the table to avoid a conflict.

Testing

• New TestFindNamespace table for the namespace logic that kpt now owns, including bare sequence files, a bare sequence document next to a resource in the same file, and a package with only a bare sequence file.
• New TestCmd_Run case that runs the command on a package with a ConfigMap and a JSON 6902 patch.
• The bare sequence cases fail without the fix with the error from the issue.
• Locally, with Go 1.26.5: go test ./commands/live/init/, go vet, gofmt, go mod tidy (no changes) and golangci-lint v2.11.4 on the package all pass. I could not run the tests that need Docker on my machine.

AI usage

I have used AI in the creation of this PR.

I have used the following AI tools:

• Claude Code (Claude Opus 5.5) to analyse the cause, and to write findNamespace, allInSameNamespace and the tests
• Codex (gpt-6.1-sol) to review the change

[netlify]

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	a703d46
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/6ae5c9a0e505a321d18a09ee
😎 Deploy Preview	https://deploy-preview-4795--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🟡 Changes recommended

The newly successful path can corrupt empty sequence patches during attribution.

1 open finding

• Attribution corrupts empty JSON 6902 patches · New

What changed in this PR

Adds local namespace detection so kpt live init accepts packages containing bare YAML sequences.

Changes:

• Reads packages with bare-sequence wrapping enabled.
• Skips bare sequences during namespace inference.
• Adds namespace and command-level regression tests.

File	Description
commands/​live/​init/​cmdliveinit.go	Implements bare-sequence-aware namespace detection.
commands/​live/​init/​cmdliveinit_test.go	Tests namespace inference with non-KRM YAML.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mozesl-nokia]

Let's try to avoid adding new klog logs, I think we want to eliminate klog from this repo and use slog instead.

[Nikshay1]

Removed in c7e1def. They were debug traces copied from cli-utils' FindNamespace, so I dropped them instead of moving them to slog.

[Nikshay1]

Thanks @liamfallon! The build-test-docker failure looks like the same maintenance.lock flake that hit #4802. Could someone re-run it? Happy to open an issue for the flake if that helps.

[Catalin-Stratulat-Ericsson]

this PR to me seems identical in nature to #4812.
both #4790 & #4789 seem to be describing and asking for a fix on the same fundamental problem which is that init is

1. returning an incorrect error about namespace instead of node.
2. allowing the init command to get as deep as it does given the fact that it has non krm files present. (if non krm files are present and not .krmignored the function should not be allowed to get this deep in my opinion it should return a similar error to render stating for the user to either ignore said files or delete them or that they are malformed.)

all the .krmignore based logic in all kpt commands are being restructured by myself at the moment as discussed in #4790 to have identical functionality in all places and operate as intended.

[Nikshay1]

Thanks @Catalin-Stratulat-Ericsson! I think they're a bit different. #4812 makes the error clearer, but live init still fails. This one skips bare-sequence files, such as kustomize JSON 6902 patches, so live init works, which is what jonenst asked for. Happy to wait for your .krmignore rework and adjust this to fit it, whatever you and @liamfallon prefer.

[Catalin-Stratulat-Ericsson]

ok i might have misread it at a glance @Nikshay1 apologies for that on my end for the overreaction.
the main point i was trying to address regarding the example given in those issues should never get that far in an ideal world in my opinion (with the exception of kustomization files)

the init in this scenario should have a check before operating if resources are non krm like how fn render does. Especially since it already checks if there is anything in the ".krmignore" that it should exclude from its resource list.

im not in disagreement that this fix needs to go in but yes if we could please wait a little before merging this in it would save me a few headaches :D ive seen quite a few PR's in the last week touching the .krmignore stuff.

i could write an issue to clarify what i plan on changing for clarity. but thank you very much for your flexibility. i should have the PR up in a day or 2 max. id love your review on it actually to make sure its properly solving the underlying problems as you are working around similar issues with this PR :)

[Nikshay1]

Hehe, no worries at all! I'll move this to draft until your PR is in, and I'd be glad to review it when it's ready :P.

[liamfallon]

See also #2445

[Nikshay1]

See also #2445

oh nice, hadn’t seen that one. makes sense, I guess that’s partly why the patch files end up in packages, since kpt doesn’t have its own patch function yet. btw, if y’all ever decide to build one i’m in!

[Nikshay1]

rebased onto main, sorry it took a while!

one heads-up about #4812. its TestCmd_Run_FindNamespaceError used - foo to make the namespace lookup fail, and that's a bare sequence. this PR makes bare sequences ok, so the test stopped getting an error and failed. I switched its fixture to kind: [, which fails to parse. the error wrapping from #4812 is the same and both of its assertions still pass. happy to do it another way if you'd prefer!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud