build: move e2e dependencies into e2e/go.mod

Several packages are only used while running the e2e suite. These
packages are less important to update, as the they can not influence the
final executable that is part of the Ceph-CSI container-image.

By moving these dependencies out of the main Ceph-CSI go.mod, it is
easier to identify if a reported CVE affects Ceph-CSI, or only the
testing (like most of the Kubernetes CVEs).

Signed-off-by: Niels de Vos <ndevos@ibm.com>

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/doc.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package fieldpath defines a way for referencing path elements (e.g., an
+// index in an array, or a key in a map). It provides types for arranging these
+// into paths for referencing nested fields, and for grouping those into sets,
+// for referencing multiple nested fields.
+package fieldpath

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/element.go

@@ -0,0 +1,317 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+)
+
+// PathElement describes how to select a child field given a containing object.
+type PathElement struct {
+	// Exactly one of the following fields should be non-nil.
+
+	// FieldName selects a single field from a map (reminder: this is also
+	// how structs are represented). The containing object must be a map.
+	FieldName *string
+
+	// Key selects the list element which has fields matching those given.
+	// The containing object must be an associative list with map typed
+	// elements. They are sorted alphabetically.
+	Key *value.FieldList
+
+	// Value selects the list element with the given value. The containing
+	// object must be an associative list with a primitive typed element
+	// (i.e., a set).
+	Value *value.Value
+
+	// Index selects a list element by its index number. The containing
+	// object must be an atomic list.
+	Index *int
+}
+
+// Less provides an order for path elements.
+func (e PathElement) Less(rhs PathElement) bool {
+	return e.Compare(rhs) < 0
+}
+
+// Compare provides an order for path elements.
+func (e PathElement) Compare(rhs PathElement) int {
+	if e.FieldName != nil {
+		if rhs.FieldName == nil {
+			return -1
+		}
+		return strings.Compare(*e.FieldName, *rhs.FieldName)
+	} else if rhs.FieldName != nil {
+		return 1
+	}
+
+	if e.Key != nil {
+		if rhs.Key == nil {
+			return -1
+		}
+		return e.Key.Compare(*rhs.Key)
+	} else if rhs.Key != nil {
+		return 1
+	}
+
+	if e.Value != nil {
+		if rhs.Value == nil {
+			return -1
+		}
+		return value.Compare(*e.Value, *rhs.Value)
+	} else if rhs.Value != nil {
+		return 1
+	}
+
+	if e.Index != nil {
+		if rhs.Index == nil {
+			return -1
+		}
+		if *e.Index < *rhs.Index {
+			return -1
+		} else if *e.Index == *rhs.Index {
+			return 0
+		}
+		return 1
+	} else if rhs.Index != nil {
+		return 1
+	}
+
+	return 0
+}
+
+// Equals returns true if both path elements are equal.
+func (e PathElement) Equals(rhs PathElement) bool {
+	if e.FieldName != nil {
+		if rhs.FieldName == nil {
+			return false
+		}
+		return *e.FieldName == *rhs.FieldName
+	} else if rhs.FieldName != nil {
+		return false
+	}
+	if e.Key != nil {
+		if rhs.Key == nil {
+			return false
+		}
+		return e.Key.Equals(*rhs.Key)
+	} else if rhs.Key != nil {
+		return false
+	}
+	if e.Value != nil {
+		if rhs.Value == nil {
+			return false
+		}
+		return value.Equals(*e.Value, *rhs.Value)
+	} else if rhs.Value != nil {
+		return false
+	}
+	if e.Index != nil {
+		if rhs.Index == nil {
+			return false
+		}
+		return *e.Index == *rhs.Index
+	} else if rhs.Index != nil {
+		return false
+	}
+	return true
+}
+
+// String presents the path element as a human-readable string.
+func (e PathElement) String() string {
+	switch {
+	case e.FieldName != nil:
+		return "." + *e.FieldName
+	case e.Key != nil:
+		strs := make([]string, len(*e.Key))
+		for i, k := range *e.Key {
+			strs[i] = fmt.Sprintf("%v=%v", k.Name, value.ToString(k.Value))
+		}
+		// Keys are supposed to be sorted.
+		return "[" + strings.Join(strs, ",") + "]"
+	case e.Value != nil:
+		return fmt.Sprintf("[=%v]", value.ToString(*e.Value))
+	case e.Index != nil:
+		return fmt.Sprintf("[%v]", *e.Index)
+	default:
+		return "{{invalid path element}}"
+	}
+}
+
+// KeyByFields is a helper function which constructs a key for an associative
+// list type. `nameValues` must have an even number of entries, alternating
+// names (type must be string) with values (type must be value.Value). If these
+// conditions are not met, KeyByFields will panic--it's intended for static
+// construction and shouldn't have user-produced values passed to it.
+func KeyByFields(nameValues ...interface{}) *value.FieldList {
+	if len(nameValues)%2 != 0 {
+		panic("must have a value for every name")
+	}
+	out := value.FieldList{}
+	for i := 0; i < len(nameValues)-1; i += 2 {
+		out = append(out, value.Field{Name: nameValues[i].(string), Value: value.NewValueInterface(nameValues[i+1])})
+	}
+	out.Sort()
+	return &out
+}
+
+// PathElementSet is a set of path elements.
+// TODO: serialize as a list.
+type PathElementSet struct {
+	members sortedPathElements
+}
+
+func MakePathElementSet(size int) PathElementSet {
+	return PathElementSet{
+		members: make(sortedPathElements, 0, size),
+	}
+}
+
+type sortedPathElements []PathElement
+
+// Implement the sort interface; this would permit bulk creation, which would
+// be faster than doing it one at a time via Insert.
+func (spe sortedPathElements) Len() int           { return len(spe) }
+func (spe sortedPathElements) Less(i, j int) bool { return spe[i].Less(spe[j]) }
+func (spe sortedPathElements) Swap(i, j int)      { spe[i], spe[j] = spe[j], spe[i] }
+
+// Insert adds pe to the set.
+func (s *PathElementSet) Insert(pe PathElement) {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].Less(pe)
+	})
+	if loc == len(s.members) {
+		s.members = append(s.members, pe)
+		return
+	}
+	if s.members[loc].Equals(pe) {
+		return
+	}
+	s.members = append(s.members, PathElement{})
+	copy(s.members[loc+1:], s.members[loc:])
+	s.members[loc] = pe
+}
+
+// Union returns a set containing elements that appear in either s or s2.
+func (s *PathElementSet) Union(s2 *PathElementSet) *PathElementSet {
+	out := &PathElementSet{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.members) {
+		if s.members[i].Less(s2.members[j]) {
+			out.members = append(out.members, s.members[i])
+			i++
+		} else {
+			out.members = append(out.members, s2.members[j])
+			if !s2.members[j].Less(s.members[i]) {
+				i++
+			}
+			j++
+		}
+	}
+
+	if i < len(s.members) {
+		out.members = append(out.members, s.members[i:]...)
+	}
+	if j < len(s2.members) {
+		out.members = append(out.members, s2.members[j:]...)
+	}
+	return out
+}
+
+// Intersection returns a set containing elements which appear in both s and s2.
+func (s *PathElementSet) Intersection(s2 *PathElementSet) *PathElementSet {
+	out := &PathElementSet{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.members) {
+		if s.members[i].Less(s2.members[j]) {
+			i++
+		} else {
+			if !s2.members[j].Less(s.members[i]) {
+				out.members = append(out.members, s.members[i])
+				i++
+			}
+			j++
+		}
+	}
+
+	return out
+}
+
+// Difference returns a set containing elements which appear in s but not in s2.
+func (s *PathElementSet) Difference(s2 *PathElementSet) *PathElementSet {
+	out := &PathElementSet{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.members) {
+		if s.members[i].Less(s2.members[j]) {
+			out.members = append(out.members, s.members[i])
+			i++
+		} else {
+			if !s2.members[j].Less(s.members[i]) {
+				i++
+			}
+			j++
+		}
+	}
+	if i < len(s.members) {
+		out.members = append(out.members, s.members[i:]...)
+	}
+	return out
+}
+
+// Size retuns the number of elements in the set.
+func (s *PathElementSet) Size() int { return len(s.members) }
+
+// Has returns true if pe is a member of the set.
+func (s *PathElementSet) Has(pe PathElement) bool {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].Less(pe)
+	})
+	if loc == len(s.members) {
+		return false
+	}
+	if s.members[loc].Equals(pe) {
+		return true
+	}
+	return false
+}
+
+// Equals returns true if s and s2 have exactly the same members.
+func (s *PathElementSet) Equals(s2 *PathElementSet) bool {
+	if len(s.members) != len(s2.members) {
+		return false
+	}
+	for k := range s.members {
+		if !s.members[k].Equals(s2.members[k]) {
+			return false
+		}
+	}
+	return true
+}
+
+// Iterate calls f for each PathElement in the set. The order is deterministic.
+func (s *PathElementSet) Iterate(f func(PathElement)) {
+	for _, pe := range s.members {
+		f(pe)
+	}
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/fromvalue.go

@@ -0,0 +1,134 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+)
+
+// SetFromValue creates a set containing every leaf field mentioned in v.
+func SetFromValue(v value.Value) *Set {
+	s := NewSet()
+
+	w := objectWalker{
+		path:      Path{},
+		value:     v,
+		allocator: value.NewFreelistAllocator(),
+		do:        func(p Path) { s.Insert(p) },
+	}
+
+	w.walk()
+	return s
+}
+
+type objectWalker struct {
+	path      Path
+	value     value.Value
+	allocator value.Allocator
+
+	do func(Path)
+}
+
+func (w *objectWalker) walk() {
+	switch {
+	case w.value.IsNull():
+	case w.value.IsFloat():
+	case w.value.IsInt():
+	case w.value.IsString():
+	case w.value.IsBool():
+		// All leaf fields handled the same way (after the switch
+		// statement).
+
+	// Descend
+	case w.value.IsList():
+		// If the list were atomic, we'd break here, but we don't have
+		// a schema, so we can't tell.
+		l := w.value.AsListUsing(w.allocator)
+		defer w.allocator.Free(l)
+		iter := l.RangeUsing(w.allocator)
+		defer w.allocator.Free(iter)
+		for iter.Next() {
+			i, value := iter.Item()
+			w2 := *w
+			w2.path = append(w.path, w.GuessBestListPathElement(i, value))
+			w2.value = value
+			w2.walk()
+		}
+		return
+	case w.value.IsMap():
+		// If the map/struct were atomic, we'd break here, but we don't
+		// have a schema, so we can't tell.
+
+		m := w.value.AsMapUsing(w.allocator)
+		defer w.allocator.Free(m)
+		m.IterateUsing(w.allocator, func(k string, val value.Value) bool {
+			w2 := *w
+			w2.path = append(w.path, PathElement{FieldName: &k})
+			w2.value = val
+			w2.walk()
+			return true
+		})
+		return
+	}
+
+	// Leaf fields get added to the set.
+	if len(w.path) > 0 {
+		w.do(w.path)
+	}
+}
+
+// AssociativeListCandidateFieldNames lists the field names which are
+// considered keys if found in a list element.
+var AssociativeListCandidateFieldNames = []string{
+	"key",
+	"id",
+	"name",
+}
+
+// GuessBestListPathElement guesses whether item is an associative list
+// element, which should be referenced by key(s), or if it is not and therefore
+// referencing by index is acceptable. Currently this is done by checking
+// whether item has any of the fields listed in
+// AssociativeListCandidateFieldNames which have scalar values.
+func (w *objectWalker) GuessBestListPathElement(index int, item value.Value) PathElement {
+	if !item.IsMap() {
+		// Non map items could be parts of sets or regular "atomic"
+		// lists. We won't try to guess whether something should be a
+		// set or not.
+		return PathElement{Index: &index}
+	}
+
+	m := item.AsMapUsing(w.allocator)
+	defer w.allocator.Free(m)
+	var keys value.FieldList
+	for _, name := range AssociativeListCandidateFieldNames {
+		f, ok := m.Get(name)
+		if !ok {
+			continue
+		}
+		// only accept primitive/scalar types as keys.
+		if f.IsNull() || f.IsMap() || f.IsList() {
+			continue
+		}
+		keys = append(keys, value.Field{Name: name, Value: f})
+	}
+	if len(keys) > 0 {
+		keys.Sort()
+		return PathElement{Key: &keys}
+	}
+	return PathElement{Index: &index}
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/managers.go

@@ -0,0 +1,144 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"fmt"
+	"strings"
+)
+
+// APIVersion describes the version of an object or of a fieldset.
+type APIVersion string
+
+type VersionedSet interface {
+	Set() *Set
+	APIVersion() APIVersion
+	Applied() bool
+}
+
+// VersionedSet associates a version to a set.
+type versionedSet struct {
+	set        *Set
+	apiVersion APIVersion
+	applied    bool
+}
+
+func NewVersionedSet(set *Set, apiVersion APIVersion, applied bool) VersionedSet {
+	return versionedSet{
+		set:        set,
+		apiVersion: apiVersion,
+		applied:    applied,
+	}
+}
+
+func (v versionedSet) Set() *Set {
+	return v.set
+}
+
+func (v versionedSet) APIVersion() APIVersion {
+	return v.apiVersion
+}
+
+func (v versionedSet) Applied() bool {
+	return v.applied
+}
+
+// ManagedFields is a map from manager to VersionedSet (what they own in
+// what version).
+type ManagedFields map[string]VersionedSet
+
+// Equals returns true if the two managedfields are the same, false
+// otherwise.
+func (lhs ManagedFields) Equals(rhs ManagedFields) bool {
+	if len(lhs) != len(rhs) {
+		return false
+	}
+
+	for manager, left := range lhs {
+		right, ok := rhs[manager]
+		if !ok {
+			return false
+		}
+		if left.APIVersion() != right.APIVersion() || left.Applied() != right.Applied() {
+			return false
+		}
+		if !left.Set().Equals(right.Set()) {
+			return false
+		}
+	}
+	return true
+}
+
+// Copy the list, this is mostly a shallow copy.
+func (lhs ManagedFields) Copy() ManagedFields {
+	copy := ManagedFields{}
+	for manager, set := range lhs {
+		copy[manager] = set
+	}
+	return copy
+}
+
+// Difference returns a symmetric difference between two Managers. If a
+// given user's entry has version X in lhs and version Y in rhs, then
+// the return value for that user will be from rhs. If the difference for
+// a user is an empty set, that user will not be inserted in the map.
+func (lhs ManagedFields) Difference(rhs ManagedFields) ManagedFields {
+	diff := ManagedFields{}
+
+	for manager, left := range lhs {
+		right, ok := rhs[manager]
+		if !ok {
+			if !left.Set().Empty() {
+				diff[manager] = left
+			}
+			continue
+		}
+
+		// If we have sets in both but their version
+		// differs, we don't even diff and keep the
+		// entire thing.
+		if left.APIVersion() != right.APIVersion() {
+			diff[manager] = right
+			continue
+		}
+
+		newSet := left.Set().Difference(right.Set()).Union(right.Set().Difference(left.Set()))
+		if !newSet.Empty() {
+			diff[manager] = NewVersionedSet(newSet, right.APIVersion(), false)
+		}
+	}
+
+	for manager, set := range rhs {
+		if _, ok := lhs[manager]; ok {
+			// Already done
+			continue
+		}
+		if !set.Set().Empty() {
+			diff[manager] = set
+		}
+	}
+
+	return diff
+}
+
+func (lhs ManagedFields) String() string {
+	s := strings.Builder{}
+	for k, v := range lhs {
+		fmt.Fprintf(&s, "%s:\n", k)
+		fmt.Fprintf(&s, "- Applied: %v\n", v.Applied())
+		fmt.Fprintf(&s, "- APIVersion: %v\n", v.APIVersion())
+		fmt.Fprintf(&s, "- Set: %v\n", v.Set())
+	}
+	return s.String()
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/path.go

@@ -0,0 +1,118 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"fmt"
+	"strings"
+
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+)
+
+// Path describes how to select a potentially deeply-nested child field given a
+// containing object.
+type Path []PathElement
+
+func (fp Path) String() string {
+	strs := make([]string, len(fp))
+	for i := range fp {
+		strs[i] = fp[i].String()
+	}
+	return strings.Join(strs, "")
+}
+
+// Equals returns true if the two paths are equivalent.
+func (fp Path) Equals(fp2 Path) bool {
+	if len(fp) != len(fp2) {
+		return false
+	}
+	for i := range fp {
+		if !fp[i].Equals(fp2[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// Less provides a lexical order for Paths.
+func (fp Path) Compare(rhs Path) int {
+	i := 0
+	for {
+		if i >= len(fp) && i >= len(rhs) {
+			// Paths are the same length and all items are equal.
+			return 0
+		}
+		if i >= len(fp) {
+			// LHS is shorter.
+			return -1
+		}
+		if i >= len(rhs) {
+			// RHS is shorter.
+			return 1
+		}
+		if c := fp[i].Compare(rhs[i]); c != 0 {
+			return c
+		}
+		// The items are equal; continue.
+		i++
+	}
+}
+
+func (fp Path) Copy() Path {
+	new := make(Path, len(fp))
+	copy(new, fp)
+	return new
+}
+
+// MakePath constructs a Path. The parts may be PathElements, ints, strings.
+func MakePath(parts ...interface{}) (Path, error) {
+	var fp Path
+	for _, p := range parts {
+		switch t := p.(type) {
+		case PathElement:
+			fp = append(fp, t)
+		case int:
+			// TODO: Understand schema and object and convert this to the
+			// FieldSpecifier below if appropriate.
+			fp = append(fp, PathElement{Index: &t})
+		case string:
+			fp = append(fp, PathElement{FieldName: &t})
+		case *value.FieldList:
+			if len(*t) == 0 {
+				return nil, fmt.Errorf("associative list key type path elements must have at least one key (got zero)")
+			}
+			fp = append(fp, PathElement{Key: t})
+		case value.Value:
+			// TODO: understand schema and verify that this is a set type
+			// TODO: make a copy of t
+			fp = append(fp, PathElement{Value: &t})
+		default:
+			return nil, fmt.Errorf("unable to make %#v into a path element", p)
+		}
+	}
+	return fp, nil
+}
+
+// MakePathOrDie panics if parts can't be turned into a path. Good for things
+// that are known at complie time.
+func MakePathOrDie(parts ...interface{}) Path {
+	fp, err := MakePath(parts...)
+	if err != nil {
+		panic(err)
+	}
+	return fp
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/pathelementmap.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"sort"
+
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+)
+
+// PathElementValueMap is a map from PathElement to value.Value.
+//
+// TODO(apelisse): We have multiple very similar implementation of this
+// for PathElementSet and SetNodeMap, so we could probably share the
+// code.
+type PathElementValueMap struct {
+	valueMap PathElementMap
+}
+
+func MakePathElementValueMap(size int) PathElementValueMap {
+	return PathElementValueMap{
+		valueMap: MakePathElementMap(size),
+	}
+}
+
+type sortedPathElementValues []pathElementValue
+
+// Implement the sort interface; this would permit bulk creation, which would
+// be faster than doing it one at a time via Insert.
+func (spev sortedPathElementValues) Len() int { return len(spev) }
+func (spev sortedPathElementValues) Less(i, j int) bool {
+	return spev[i].PathElement.Less(spev[j].PathElement)
+}
+func (spev sortedPathElementValues) Swap(i, j int) { spev[i], spev[j] = spev[j], spev[i] }
+
+// Insert adds the pathelement and associated value in the map.
+// If insert is called twice with the same PathElement, the value is replaced.
+func (s *PathElementValueMap) Insert(pe PathElement, v value.Value) {
+	s.valueMap.Insert(pe, v)
+}
+
+// Get retrieves the value associated with the given PathElement from the map.
+// (nil, false) is returned if there is no such PathElement.
+func (s *PathElementValueMap) Get(pe PathElement) (value.Value, bool) {
+	v, ok := s.valueMap.Get(pe)
+	if !ok {
+		return nil, false
+	}
+	return v.(value.Value), true
+}
+
+// PathElementValueMap is a map from PathElement to interface{}.
+type PathElementMap struct {
+	members sortedPathElementValues
+}
+
+type pathElementValue struct {
+	PathElement PathElement
+	Value       interface{}
+}
+
+func MakePathElementMap(size int) PathElementMap {
+	return PathElementMap{
+		members: make(sortedPathElementValues, 0, size),
+	}
+}
+
+// Insert adds the pathelement and associated value in the map.
+// If insert is called twice with the same PathElement, the value is replaced.
+func (s *PathElementMap) Insert(pe PathElement, v interface{}) {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].PathElement.Less(pe)
+	})
+	if loc == len(s.members) {
+		s.members = append(s.members, pathElementValue{pe, v})
+		return
+	}
+	if s.members[loc].PathElement.Equals(pe) {
+		s.members[loc].Value = v
+		return
+	}
+	s.members = append(s.members, pathElementValue{})
+	copy(s.members[loc+1:], s.members[loc:])
+	s.members[loc] = pathElementValue{pe, v}
+}
+
+// Get retrieves the value associated with the given PathElement from the map.
+// (nil, false) is returned if there is no such PathElement.
+func (s *PathElementMap) Get(pe PathElement) (interface{}, bool) {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].PathElement.Less(pe)
+	})
+	if loc == len(s.members) {
+		return nil, false
+	}
+	if s.members[loc].PathElement.Equals(pe) {
+		return s.members[loc].Value, true
+	}
+	return nil, false
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/serialize-pe.go

@@ -0,0 +1,168 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	jsoniter "github.com/json-iterator/go"
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+)
+
+var ErrUnknownPathElementType = errors.New("unknown path element type")
+
+const (
+	// Field indicates that the content of this path element is a field's name
+	peField = "f"
+
+	// Value indicates that the content of this path element is a field's value
+	peValue = "v"
+
+	// Index indicates that the content of this path element is an index in an array
+	peIndex = "i"
+
+	// Key indicates that the content of this path element is a key value map
+	peKey = "k"
+
+	// Separator separates the type of a path element from the contents
+	peSeparator = ":"
+)
+
+var (
+	peFieldSepBytes = []byte(peField + peSeparator)
+	peValueSepBytes = []byte(peValue + peSeparator)
+	peIndexSepBytes = []byte(peIndex + peSeparator)
+	peKeySepBytes   = []byte(peKey + peSeparator)
+	peSepBytes      = []byte(peSeparator)
+)
+
+// DeserializePathElement parses a serialized path element
+func DeserializePathElement(s string) (PathElement, error) {
+	b := []byte(s)
+	if len(b) < 2 {
+		return PathElement{}, errors.New("key must be 2 characters long:")
+	}
+	typeSep, b := b[:2], b[2:]
+	if typeSep[1] != peSepBytes[0] {
+		return PathElement{}, fmt.Errorf("missing colon: %v", s)
+	}
+	switch typeSep[0] {
+	case peFieldSepBytes[0]:
+		// Slice s rather than convert b, to save on
+		// allocations.
+		str := s[2:]
+		return PathElement{
+			FieldName: &str,
+		}, nil
+	case peValueSepBytes[0]:
+		iter := readPool.BorrowIterator(b)
+		defer readPool.ReturnIterator(iter)
+		v, err := value.ReadJSONIter(iter)
+		if err != nil {
+			return PathElement{}, err
+		}
+		return PathElement{Value: &v}, nil
+	case peKeySepBytes[0]:
+		iter := readPool.BorrowIterator(b)
+		defer readPool.ReturnIterator(iter)
+		fields := value.FieldList{}
+
+		iter.ReadObjectCB(func(iter *jsoniter.Iterator, key string) bool {
+			v, err := value.ReadJSONIter(iter)
+			if err != nil {
+				iter.Error = err
+				return false
+			}
+			fields = append(fields, value.Field{Name: key, Value: v})
+			return true
+		})
+		fields.Sort()
+		return PathElement{Key: &fields}, iter.Error
+	case peIndexSepBytes[0]:
+		i, err := strconv.Atoi(s[2:])
+		if err != nil {
+			return PathElement{}, err
+		}
+		return PathElement{
+			Index: &i,
+		}, nil
+	default:
+		return PathElement{}, ErrUnknownPathElementType
+	}
+}
+
+var (
+	readPool  = jsoniter.NewIterator(jsoniter.ConfigCompatibleWithStandardLibrary).Pool()
+	writePool = jsoniter.NewStream(jsoniter.ConfigCompatibleWithStandardLibrary, nil, 1024).Pool()
+)
+
+// SerializePathElement serializes a path element
+func SerializePathElement(pe PathElement) (string, error) {
+	buf := strings.Builder{}
+	err := serializePathElementToWriter(&buf, pe)
+	return buf.String(), err
+}
+
+func serializePathElementToWriter(w io.Writer, pe PathElement) error {
+	stream := writePool.BorrowStream(w)
+	defer writePool.ReturnStream(stream)
+	switch {
+	case pe.FieldName != nil:
+		if _, err := stream.Write(peFieldSepBytes); err != nil {
+			return err
+		}
+		stream.WriteRaw(*pe.FieldName)
+	case pe.Key != nil:
+		if _, err := stream.Write(peKeySepBytes); err != nil {
+			return err
+		}
+		stream.WriteObjectStart()
+
+		for i, field := range *pe.Key {
+			if i > 0 {
+				stream.WriteMore()
+			}
+			stream.WriteObjectField(field.Name)
+			value.WriteJSONStream(field.Value, stream)
+		}
+		stream.WriteObjectEnd()
+	case pe.Value != nil:
+		if _, err := stream.Write(peValueSepBytes); err != nil {
+			return err
+		}
+		value.WriteJSONStream(*pe.Value, stream)
+	case pe.Index != nil:
+		if _, err := stream.Write(peIndexSepBytes); err != nil {
+			return err
+		}
+		stream.WriteInt(*pe.Index)
+	default:
+		return errors.New("invalid PathElement")
+	}
+	b := stream.Buffer()
+	err := stream.Flush()
+	// Help jsoniter manage its buffers--without this, the next
+	// use of the stream is likely to require an allocation. Look
+	// at the jsoniter stream code to understand why. They were probably
+	// optimizing for folks using the buffer directly.
+	stream.SetBuffer(b[:0])
+	return err
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/serialize.go

@@ -0,0 +1,238 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"bytes"
+	"io"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+)
+
+func (s *Set) ToJSON() ([]byte, error) {
+	buf := bytes.Buffer{}
+	err := s.ToJSONStream(&buf)
+	if err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+func (s *Set) ToJSONStream(w io.Writer) error {
+	stream := writePool.BorrowStream(w)
+	defer writePool.ReturnStream(stream)
+
+	var r reusableBuilder
+
+	stream.WriteObjectStart()
+	err := s.emitContentsV1(false, stream, &r)
+	if err != nil {
+		return err
+	}
+	stream.WriteObjectEnd()
+	return stream.Flush()
+}
+
+func manageMemory(stream *jsoniter.Stream) error {
+	// Help jsoniter manage its buffers--without this, it does a bunch of
+	// alloctaions that are not necessary. They were probably optimizing
+	// for folks using the buffer directly.
+	b := stream.Buffer()
+	if len(b) > 4096 || cap(b)-len(b) < 2048 {
+		if err := stream.Flush(); err != nil {
+			return err
+		}
+		stream.SetBuffer(b[:0])
+	}
+	return nil
+}
+
+type reusableBuilder struct {
+	bytes.Buffer
+}
+
+func (r *reusableBuilder) unsafeString() string {
+	b := r.Bytes()
+	return *(*string)(unsafe.Pointer(&b))
+}
+
+func (r *reusableBuilder) reset() *bytes.Buffer {
+	r.Reset()
+	return &r.Buffer
+}
+
+func (s *Set) emitContentsV1(includeSelf bool, stream *jsoniter.Stream, r *reusableBuilder) error {
+	mi, ci := 0, 0
+	first := true
+	preWrite := func() {
+		if first {
+			first = false
+			return
+		}
+		stream.WriteMore()
+	}
+
+	if includeSelf && !(len(s.Members.members) == 0 && len(s.Children.members) == 0) {
+		preWrite()
+		stream.WriteObjectField(".")
+		stream.WriteEmptyObject()
+	}
+
+	for mi < len(s.Members.members) && ci < len(s.Children.members) {
+		mpe := s.Members.members[mi]
+		cpe := s.Children.members[ci].pathElement
+
+		if c := mpe.Compare(cpe); c < 0 {
+			preWrite()
+			if err := serializePathElementToWriter(r.reset(), mpe); err != nil {
+				return err
+			}
+			stream.WriteObjectField(r.unsafeString())
+			stream.WriteEmptyObject()
+			mi++
+		} else if c > 0 {
+			preWrite()
+			if err := serializePathElementToWriter(r.reset(), cpe); err != nil {
+				return err
+			}
+			stream.WriteObjectField(r.unsafeString())
+			stream.WriteObjectStart()
+			if err := s.Children.members[ci].set.emitContentsV1(false, stream, r); err != nil {
+				return err
+			}
+			stream.WriteObjectEnd()
+			ci++
+		} else {
+			preWrite()
+			if err := serializePathElementToWriter(r.reset(), cpe); err != nil {
+				return err
+			}
+			stream.WriteObjectField(r.unsafeString())
+			stream.WriteObjectStart()
+			if err := s.Children.members[ci].set.emitContentsV1(true, stream, r); err != nil {
+				return err
+			}
+			stream.WriteObjectEnd()
+			mi++
+			ci++
+		}
+	}
+
+	for mi < len(s.Members.members) {
+		mpe := s.Members.members[mi]
+
+		preWrite()
+		if err := serializePathElementToWriter(r.reset(), mpe); err != nil {
+			return err
+		}
+		stream.WriteObjectField(r.unsafeString())
+		stream.WriteEmptyObject()
+		mi++
+	}
+
+	for ci < len(s.Children.members) {
+		cpe := s.Children.members[ci].pathElement
+
+		preWrite()
+		if err := serializePathElementToWriter(r.reset(), cpe); err != nil {
+			return err
+		}
+		stream.WriteObjectField(r.unsafeString())
+		stream.WriteObjectStart()
+		if err := s.Children.members[ci].set.emitContentsV1(false, stream, r); err != nil {
+			return err
+		}
+		stream.WriteObjectEnd()
+		ci++
+	}
+
+	return manageMemory(stream)
+}
+
+// FromJSON clears s and reads a JSON formatted set structure.
+func (s *Set) FromJSON(r io.Reader) error {
+	// The iterator pool is completely useless for memory management, grrr.
+	iter := jsoniter.Parse(jsoniter.ConfigCompatibleWithStandardLibrary, r, 4096)
+
+	found, _ := readIterV1(iter)
+	if found == nil {
+		*s = Set{}
+	} else {
+		*s = *found
+	}
+	return iter.Error
+}
+
+// returns true if this subtree is also (or only) a member of parent; s is nil
+// if there are no further children.
+func readIterV1(iter *jsoniter.Iterator) (children *Set, isMember bool) {
+	iter.ReadMapCB(func(iter *jsoniter.Iterator, key string) bool {
+		if key == "." {
+			isMember = true
+			iter.Skip()
+			return true
+		}
+		pe, err := DeserializePathElement(key)
+		if err == ErrUnknownPathElementType {
+			// Ignore these-- a future version maybe knows what
+			// they are. We drop these completely rather than try
+			// to preserve things we don't understand.
+			iter.Skip()
+			return true
+		} else if err != nil {
+			iter.ReportError("parsing key as path element", err.Error())
+			iter.Skip()
+			return true
+		}
+		grandchildren, childIsMember := readIterV1(iter)
+		if childIsMember {
+			if children == nil {
+				children = &Set{}
+			}
+			m := &children.Members.members
+			// Since we expect that most of the time these will have been
+			// serialized in the right order, we just verify that and append.
+			appendOK := len(*m) == 0 || (*m)[len(*m)-1].Less(pe)
+			if appendOK {
+				*m = append(*m, pe)
+			} else {
+				children.Members.Insert(pe)
+			}
+		}
+		if grandchildren != nil {
+			if children == nil {
+				children = &Set{}
+			}
+			// Since we expect that most of the time these will have been
+			// serialized in the right order, we just verify that and append.
+			m := &children.Children.members
+			appendOK := len(*m) == 0 || (*m)[len(*m)-1].pathElement.Less(pe)
+			if appendOK {
+				*m = append(*m, setNode{pe, grandchildren})
+			} else {
+				*children.Children.Descend(pe) = *grandchildren
+			}
+		}
+		return true
+	})
+	if children == nil {
+		isMember = true
+	}
+
+	return children, isMember
+}

e2e/vendor/sigs.k8s.io/structured-merge-diff/v4/fieldpath/set.go

@@ -0,0 +1,782 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldpath
+
+import (
+	"fmt"
+	"sigs.k8s.io/structured-merge-diff/v4/value"
+	"sort"
+	"strings"
+
+	"sigs.k8s.io/structured-merge-diff/v4/schema"
+)
+
+// Set identifies a set of fields.
+type Set struct {
+	// Members lists fields that are part of the set.
+	// TODO: will be serialized as a list of path elements.
+	Members PathElementSet
+
+	// Children lists child fields which themselves have children that are
+	// members of the set. Appearance in this list does not imply membership.
+	// Note: this is a tree, not an arbitrary graph.
+	Children SetNodeMap
+}
+
+// NewSet makes a set from a list of paths.
+func NewSet(paths ...Path) *Set {
+	s := &Set{}
+	for _, p := range paths {
+		s.Insert(p)
+	}
+	return s
+}
+
+// Insert adds the field identified by `p` to the set. Important: parent fields
+// are NOT added to the set; if that is desired, they must be added separately.
+func (s *Set) Insert(p Path) {
+	if len(p) == 0 {
+		// Zero-length path identifies the entire object; we don't
+		// track top-level ownership.
+		return
+	}
+	for {
+		if len(p) == 1 {
+			s.Members.Insert(p[0])
+			return
+		}
+		s = s.Children.Descend(p[0])
+		p = p[1:]
+	}
+}
+
+// Union returns a Set containing elements which appear in either s or s2.
+func (s *Set) Union(s2 *Set) *Set {
+	return &Set{
+		Members:  *s.Members.Union(&s2.Members),
+		Children: *s.Children.Union(&s2.Children),
+	}
+}
+
+// Intersection returns a Set containing leaf elements which appear in both s
+// and s2. Intersection can be constructed from Union and Difference operations
+// (example in the tests) but it's much faster to do it in one pass.
+func (s *Set) Intersection(s2 *Set) *Set {
+	return &Set{
+		Members:  *s.Members.Intersection(&s2.Members),
+		Children: *s.Children.Intersection(&s2.Children),
+	}
+}
+
+// Difference returns a Set containing elements which:
+// * appear in s
+// * do not appear in s2
+//
+// In other words, for leaf fields, this acts like a regular set difference
+// operation. When non leaf fields are compared with leaf fields ("parents"
+// which contain "children"), the effect is:
+// * parent - child = parent
+// * child - parent = {empty set}
+func (s *Set) Difference(s2 *Set) *Set {
+	return &Set{
+		Members:  *s.Members.Difference(&s2.Members),
+		Children: *s.Children.Difference(s2),
+	}
+}
+
+// RecursiveDifference returns a Set containing elements which:
+// * appear in s
+// * do not appear in s2
+//
+// Compared to a regular difference,
+// this removes every field **and its children** from s that is contained in s2.
+//
+// For example, with s containing `a.b.c` and s2 containing `a.b`,
+// a RecursiveDifference will result in `a`, as the entire node `a.b` gets removed.
+func (s *Set) RecursiveDifference(s2 *Set) *Set {
+	return &Set{
+		Members:  *s.Members.Difference(&s2.Members),
+		Children: *s.Children.RecursiveDifference(s2),
+	}
+}
+
+// EnsureNamedFieldsAreMembers returns a Set that contains all the
+// fields in s, as well as all the named fields that are typically not
+// included. For example, a set made of "a.b.c" will end-up also owning
+// "a" if it's a named fields but not "a.b" if it's a map.
+func (s *Set) EnsureNamedFieldsAreMembers(sc *schema.Schema, tr schema.TypeRef) *Set {
+	members := PathElementSet{
+		members: make(sortedPathElements, 0, s.Members.Size()+len(s.Children.members)),
+	}
+	atom, _ := sc.Resolve(tr)
+	members.members = append(members.members, s.Members.members...)
+	for _, node := range s.Children.members {
+		// Only insert named fields.
+		if node.pathElement.FieldName != nil && atom.Map != nil {
+			if _, has := atom.Map.FindField(*node.pathElement.FieldName); has {
+				members.Insert(node.pathElement)
+			}
+		}
+	}
+	return &Set{
+		Members:  members,
+		Children: *s.Children.EnsureNamedFieldsAreMembers(sc, tr),
+	}
+}
+
+// MakePrefixMatcherOrDie is the same as PrefixMatcher except it panics if parts can't be
+// turned into a SetMatcher.
+func MakePrefixMatcherOrDie(parts ...interface{}) *SetMatcher {
+	result, err := PrefixMatcher(parts...)
+	if err != nil {
+		panic(err)
+	}
+	return result
+}
+
+// PrefixMatcher creates a SetMatcher that matches all field paths prefixed by the given list of matcher path parts.
+// The matcher parts may any of:
+//
+//   - PathElementMatcher - for wildcards, `MatchAnyPathElement()` can be used as well.
+//   - PathElement - for any path element
+//   - value.FieldList - for listMap keys
+//   - value.Value - for scalar list elements
+//   - string - For field names
+//   - int - for array indices
+func PrefixMatcher(parts ...interface{}) (*SetMatcher, error) {
+	current := MatchAnySet() // match all field path suffixes
+	for i := len(parts) - 1; i >= 0; i-- {
+		part := parts[i]
+		var pattern PathElementMatcher
+		switch t := part.(type) {
+		case PathElementMatcher:
+			// any path matcher, including wildcard
+			pattern = t
+		case PathElement:
+			// any path element
+			pattern = PathElementMatcher{PathElement: t}
+		case *value.FieldList:
+			// a listMap key
+			if len(*t) == 0 {
+				return nil, fmt.Errorf("associative list key type path elements must have at least one key (got zero)")
+			}
+			pattern = PathElementMatcher{PathElement: PathElement{Key: t}}
+		case value.Value:
+			// a scalar or set-type list element
+			pattern = PathElementMatcher{PathElement: PathElement{Value: &t}}
+		case string:
+			// a plain field name
+			pattern = PathElementMatcher{PathElement: PathElement{FieldName: &t}}
+		case int:
+			// a plain list index
+			pattern = PathElementMatcher{PathElement: PathElement{Index: &t}}
+		default:
+			return nil, fmt.Errorf("unexpected type %T", t)
+		}
+		current = &SetMatcher{
+			members: []*SetMemberMatcher{{
+				Path:  pattern,
+				Child: current,
+			}},
+		}
+	}
+	return current, nil
+}
+
+// MatchAnyPathElement returns a PathElementMatcher that matches any path element.
+func MatchAnyPathElement() PathElementMatcher {
+	return PathElementMatcher{Wildcard: true}
+}
+
+// MatchAnySet returns a SetMatcher that matches any set.
+func MatchAnySet() *SetMatcher {
+	return &SetMatcher{wildcard: true}
+}
+
+// NewSetMatcher returns a new SetMatcher.
+// Wildcard members take precedent over non-wildcard members;
+// all non-wildcard members are ignored if there is a wildcard members.
+func NewSetMatcher(wildcard bool, members ...*SetMemberMatcher) *SetMatcher {
+	sort.Sort(sortedMemberMatcher(members))
+	return &SetMatcher{wildcard: wildcard, members: members}
+}
+
+// SetMatcher defines a matcher that matches fields in a Set.
+// SetMatcher is structured much like a Set but with wildcard support.
+type SetMatcher struct {
+	// wildcard indicates that all members and children are included in the match.
+	// If set, the members field is ignored.
+	wildcard bool
+	// members provides patterns to match the members of a Set.
+	// Wildcard members are sorted before non-wildcards and take precedent over
+	// non-wildcard members.
+	members sortedMemberMatcher
+}
+
+type sortedMemberMatcher []*SetMemberMatcher
+
+func (s sortedMemberMatcher) Len() int           { return len(s) }
+func (s sortedMemberMatcher) Less(i, j int) bool { return s[i].Path.Less(s[j].Path) }
+func (s sortedMemberMatcher) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
+func (s sortedMemberMatcher) Find(p PathElementMatcher) (location int, ok bool) {
+	return sort.Find(len(s), func(i int) int {
+		return s[i].Path.Compare(p)
+	})
+}
+
+// Merge merges s and s2 and returns a SetMatcher that matches all field paths matched by either s or s2.
+// During the merge, members of s and s2 with the same PathElementMatcher merged into a single member
+// with the children of each merged by calling this function recursively.
+func (s *SetMatcher) Merge(s2 *SetMatcher) *SetMatcher {
+	if s.wildcard || s2.wildcard {
+		return NewSetMatcher(true)
+	}
+	merged := make(sortedMemberMatcher, len(s.members), len(s.members)+len(s2.members))
+	copy(merged, s.members)
+	for _, m := range s2.members {
+		if i, ok := s.members.Find(m.Path); ok {
+			// since merged is a shallow copy, do not modify elements in place
+			merged[i] = &SetMemberMatcher{
+				Path:  merged[i].Path,
+				Child: merged[i].Child.Merge(m.Child),
+			}
+		} else {
+			merged = append(merged, m)
+		}
+	}
+	return NewSetMatcher(false, merged...) // sort happens here
+}
+
+// SetMemberMatcher defines a matcher that matches the members of a Set.
+// SetMemberMatcher is structured much like the elements of a SetNodeMap, but
+// with wildcard support.
+type SetMemberMatcher struct {
+	// Path provides a matcher to match members of a Set.
+	// If Path is a wildcard, all members of a Set are included in the match.
+	// Otherwise, if any Path is Equal to a member of a Set, that member is
+	// included in the match and the children of that member are matched
+	// against the Child matcher.
+	Path PathElementMatcher
+
+	// Child provides a matcher to use for the children of matched members of a Set.
+	Child *SetMatcher
+}
+
+// PathElementMatcher defined a path matcher for a PathElement.
+type PathElementMatcher struct {
+	// Wildcard indicates that all PathElements are matched by this matcher.
+	// If set, PathElement is ignored.
+	Wildcard bool
+
+	// PathElement indicates that a PathElement is matched if it is Equal
+	// to this PathElement.
+	PathElement
+}
+
+func (p PathElementMatcher) Equals(p2 PathElementMatcher) bool {
+	return p.Wildcard != p2.Wildcard && p.PathElement.Equals(p2.PathElement)
+}
+
+func (p PathElementMatcher) Less(p2 PathElementMatcher) bool {
+	if p.Wildcard && !p2.Wildcard {
+		return true
+	} else if p2.Wildcard {
+		return false
+	}
+	return p.PathElement.Less(p2.PathElement)
+}
+
+func (p PathElementMatcher) Compare(p2 PathElementMatcher) int {
+	if p.Wildcard && !p2.Wildcard {
+		return -1
+	} else if p2.Wildcard {
+		return 1
+	}
+	return p.PathElement.Compare(p2.PathElement)
+}
+
+// FilterIncludeMatches returns a Set with only the field paths that match.
+func (s *Set) FilterIncludeMatches(pattern *SetMatcher) *Set {
+	if pattern.wildcard {
+		return s
+	}
+
+	members := PathElementSet{}
+	for _, m := range s.Members.members {
+		for _, pm := range pattern.members {
+			if pm.Path.Wildcard || pm.Path.PathElement.Equals(m) {
+				members.Insert(m)
+				break
+			}
+		}
+	}
+	return &Set{
+		Members:  members,
+		Children: *s.Children.FilterIncludeMatches(pattern),
+	}
+}
+
+// Size returns the number of members of the set.
+func (s *Set) Size() int {
+	return s.Members.Size() + s.Children.Size()
+}
+
+// Empty returns true if there are no members of the set. It is a separate
+// function from Size since it's common to check whether size > 0, and
+// potentially much faster to return as soon as a single element is found.
+func (s *Set) Empty() bool {
+	if s.Members.Size() > 0 {
+		return false
+	}
+	return s.Children.Empty()
+}
+
+// Has returns true if the field referenced by `p` is a member of the set.
+func (s *Set) Has(p Path) bool {
+	if len(p) == 0 {
+		// No one owns "the entire object"
+		return false
+	}
+	for {
+		if len(p) == 1 {
+			return s.Members.Has(p[0])
+		}
+		var ok bool
+		s, ok = s.Children.Get(p[0])
+		if !ok {
+			return false
+		}
+		p = p[1:]
+	}
+}
+
+// Equals returns true if s and s2 have exactly the same members.
+func (s *Set) Equals(s2 *Set) bool {
+	return s.Members.Equals(&s2.Members) && s.Children.Equals(&s2.Children)
+}
+
+// String returns the set one element per line.
+func (s *Set) String() string {
+	elements := []string{}
+	s.Iterate(func(p Path) {
+		elements = append(elements, p.String())
+	})
+	return strings.Join(elements, "\n")
+}
+
+// Iterate calls f once for each field that is a member of the set (preorder
+// DFS). The path passed to f will be reused so make a copy if you wish to keep
+// it.
+func (s *Set) Iterate(f func(Path)) {
+	s.iteratePrefix(Path{}, f)
+}
+
+func (s *Set) iteratePrefix(prefix Path, f func(Path)) {
+	s.Members.Iterate(func(pe PathElement) { f(append(prefix, pe)) })
+	s.Children.iteratePrefix(prefix, f)
+}
+
+// WithPrefix returns the subset of paths which begin with the given prefix,
+// with the prefix not included.
+func (s *Set) WithPrefix(pe PathElement) *Set {
+	subset, ok := s.Children.Get(pe)
+	if !ok {
+		return NewSet()
+	}
+	return subset
+}
+
+// Leaves returns a set containing only the leaf paths
+// of a set.
+func (s *Set) Leaves() *Set {
+	leaves := PathElementSet{}
+	im := 0
+	ic := 0
+
+	// any members that are not also children are leaves
+outer:
+	for im < len(s.Members.members) {
+		member := s.Members.members[im]
+
+		for ic < len(s.Children.members) {
+			d := member.Compare(s.Children.members[ic].pathElement)
+			if d == 0 {
+				ic++
+				im++
+				continue outer
+			} else if d < 0 {
+				break
+			} else /* if d > 0 */ {
+				ic++
+			}
+		}
+		leaves.members = append(leaves.members, member)
+		im++
+	}
+
+	return &Set{
+		Members:  leaves,
+		Children: *s.Children.Leaves(),
+	}
+}
+
+// setNode is a pair of PathElement / Set, for the purpose of expressing
+// nested set membership.
+type setNode struct {
+	pathElement PathElement
+	set         *Set
+}
+
+// SetNodeMap is a map of PathElement to subset.
+type SetNodeMap struct {
+	members sortedSetNode
+}
+
+type sortedSetNode []setNode
+
+// Implement the sort interface; this would permit bulk creation, which would
+// be faster than doing it one at a time via Insert.
+func (s sortedSetNode) Len() int           { return len(s) }
+func (s sortedSetNode) Less(i, j int) bool { return s[i].pathElement.Less(s[j].pathElement) }
+func (s sortedSetNode) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
+
+// Descend adds pe to the set if necessary, returning the associated subset.
+func (s *SetNodeMap) Descend(pe PathElement) *Set {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].pathElement.Less(pe)
+	})
+	if loc == len(s.members) {
+		s.members = append(s.members, setNode{pathElement: pe, set: &Set{}})
+		return s.members[loc].set
+	}
+	if s.members[loc].pathElement.Equals(pe) {
+		return s.members[loc].set
+	}
+	s.members = append(s.members, setNode{})
+	copy(s.members[loc+1:], s.members[loc:])
+	s.members[loc] = setNode{pathElement: pe, set: &Set{}}
+	return s.members[loc].set
+}
+
+// Size returns the sum of the number of members of all subsets.
+func (s *SetNodeMap) Size() int {
+	count := 0
+	for _, v := range s.members {
+		count += v.set.Size()
+	}
+	return count
+}
+
+// Empty returns false if there's at least one member in some child set.
+func (s *SetNodeMap) Empty() bool {
+	for _, n := range s.members {
+		if !n.set.Empty() {
+			return false
+		}
+	}
+	return true
+}
+
+// Get returns (the associated set, true) or (nil, false) if there is none.
+func (s *SetNodeMap) Get(pe PathElement) (*Set, bool) {
+	loc := sort.Search(len(s.members), func(i int) bool {
+		return !s.members[i].pathElement.Less(pe)
+	})
+	if loc == len(s.members) {
+		return nil, false
+	}
+	if s.members[loc].pathElement.Equals(pe) {
+		return s.members[loc].set, true
+	}
+	return nil, false
+}
+
+// Equals returns true if s and s2 have the same structure (same nested
+// child sets).
+func (s *SetNodeMap) Equals(s2 *SetNodeMap) bool {
+	if len(s.members) != len(s2.members) {
+		return false
+	}
+	for i := range s.members {
+		if !s.members[i].pathElement.Equals(s2.members[i].pathElement) {
+			return false
+		}
+		if !s.members[i].set.Equals(s2.members[i].set) {
+			return false
+		}
+	}
+	return true
+}
+
+// Union returns a SetNodeMap with members that appear in either s or s2.
+func (s *SetNodeMap) Union(s2 *SetNodeMap) *SetNodeMap {
+	out := &SetNodeMap{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.members) {
+		if s.members[i].pathElement.Less(s2.members[j].pathElement) {
+			out.members = append(out.members, s.members[i])
+			i++
+		} else {
+			if !s2.members[j].pathElement.Less(s.members[i].pathElement) {
+				out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: s.members[i].set.Union(s2.members[j].set)})
+				i++
+			} else {
+				out.members = append(out.members, s2.members[j])
+			}
+			j++
+		}
+	}
+
+	if i < len(s.members) {
+		out.members = append(out.members, s.members[i:]...)
+	}
+	if j < len(s2.members) {
+		out.members = append(out.members, s2.members[j:]...)
+	}
+	return out
+}
+
+// Intersection returns a SetNodeMap with members that appear in both s and s2.
+func (s *SetNodeMap) Intersection(s2 *SetNodeMap) *SetNodeMap {
+	out := &SetNodeMap{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.members) {
+		if s.members[i].pathElement.Less(s2.members[j].pathElement) {
+			i++
+		} else {
+			if !s2.members[j].pathElement.Less(s.members[i].pathElement) {
+				res := s.members[i].set.Intersection(s2.members[j].set)
+				if !res.Empty() {
+					out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: res})
+				}
+				i++
+			}
+			j++
+		}
+	}
+	return out
+}
+
+// Difference returns a SetNodeMap with members that appear in s but not in s2.
+func (s *SetNodeMap) Difference(s2 *Set) *SetNodeMap {
+	out := &SetNodeMap{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.Children.members) {
+		if s.members[i].pathElement.Less(s2.Children.members[j].pathElement) {
+			out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: s.members[i].set})
+			i++
+		} else {
+			if !s2.Children.members[j].pathElement.Less(s.members[i].pathElement) {
+
+				diff := s.members[i].set.Difference(s2.Children.members[j].set)
+				// We aren't permitted to add nodes with no elements.
+				if !diff.Empty() {
+					out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: diff})
+				}
+
+				i++
+			}
+			j++
+		}
+	}
+
+	if i < len(s.members) {
+		out.members = append(out.members, s.members[i:]...)
+	}
+	return out
+}
+
+// RecursiveDifference returns a SetNodeMap with members that appear in s but not in s2.
+//
+// Compared to a regular difference,
+// this removes every field **and its children** from s that is contained in s2.
+//
+// For example, with s containing `a.b.c` and s2 containing `a.b`,
+// a RecursiveDifference will result in `a`, as the entire node `a.b` gets removed.
+func (s *SetNodeMap) RecursiveDifference(s2 *Set) *SetNodeMap {
+	out := &SetNodeMap{}
+
+	i, j := 0, 0
+	for i < len(s.members) && j < len(s2.Children.members) {
+		if s.members[i].pathElement.Less(s2.Children.members[j].pathElement) {
+			if !s2.Members.Has(s.members[i].pathElement) {
+				out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: s.members[i].set})
+			}
+			i++
+		} else {
+			if !s2.Children.members[j].pathElement.Less(s.members[i].pathElement) {
+				if !s2.Members.Has(s.members[i].pathElement) {
+					diff := s.members[i].set.RecursiveDifference(s2.Children.members[j].set)
+					if !diff.Empty() {
+						out.members = append(out.members, setNode{pathElement: s.members[i].pathElement, set: diff})
+					}
+				}
+				i++
+			}
+			j++
+		}
+	}
+
+	if i < len(s.members) {
+		for _, c := range s.members[i:] {
+			if !s2.Members.Has(c.pathElement) {
+				out.members = append(out.members, c)
+			}
+		}
+	}
+
+	return out
+}
+
+// EnsureNamedFieldsAreMembers returns a set that contains all the named fields along with the leaves.
+func (s *SetNodeMap) EnsureNamedFieldsAreMembers(sc *schema.Schema, tr schema.TypeRef) *SetNodeMap {
+	out := make(sortedSetNode, 0, s.Size())
+	atom, _ := sc.Resolve(tr)
+	for _, member := range s.members {
+		tr := schema.TypeRef{}
+		if member.pathElement.FieldName != nil && atom.Map != nil {
+			tr = atom.Map.ElementType
+			if sf, ok := atom.Map.FindField(*member.pathElement.FieldName); ok {
+				tr = sf.Type
+			}
+		} else if member.pathElement.Key != nil && atom.List != nil {
+			tr = atom.List.ElementType
+		}
+		out = append(out, setNode{
+			pathElement: member.pathElement,
+			set:         member.set.EnsureNamedFieldsAreMembers(sc, tr),
+		})
+	}
+
+	return &SetNodeMap{
+		members: out,
+	}
+}
+
+// FilterIncludeMatches returns a SetNodeMap with only the field paths that match the matcher.
+func (s *SetNodeMap) FilterIncludeMatches(pattern *SetMatcher) *SetNodeMap {
+	if pattern.wildcard {
+		return s
+	}
+
+	var out sortedSetNode
+	for _, member := range s.members {
+		for _, c := range pattern.members {
+			if c.Path.Wildcard || c.Path.PathElement.Equals(member.pathElement) {
+				childSet := member.set.FilterIncludeMatches(c.Child)
+				if childSet.Size() > 0 {
+					out = append(out, setNode{
+						pathElement: member.pathElement,
+						set:         childSet,
+					})
+				}
+				break
+			}
+		}
+	}
+
+	return &SetNodeMap{
+		members: out,
+	}
+}
+
+// Iterate calls f for each PathElement in the set.
+func (s *SetNodeMap) Iterate(f func(PathElement)) {
+	for _, n := range s.members {
+		f(n.pathElement)
+	}
+}
+
+func (s *SetNodeMap) iteratePrefix(prefix Path, f func(Path)) {
+	for _, n := range s.members {
+		pe := n.pathElement
+		n.set.iteratePrefix(append(prefix, pe), f)
+	}
+}
+
+// Leaves returns a SetNodeMap containing
+// only setNodes with leaf PathElements.
+func (s *SetNodeMap) Leaves() *SetNodeMap {
+	out := &SetNodeMap{}
+	out.members = make(sortedSetNode, len(s.members))
+	for i, n := range s.members {
+		out.members[i] = setNode{
+			pathElement: n.pathElement,
+			set:         n.set.Leaves(),
+		}
+	}
+	return out
+}
+
+// Filter defines an interface for excluding field paths from a set.
+// NewExcludeSetFilter can be used to create a filter that removes
+// specific field paths and all of their children.
+// NewIncludeMatcherFilter can be used to create a filter that removes all fields except
+// the fields that match a field path matcher. PrefixMatcher and MakePrefixMatcherOrDie
+// can be used to define field path patterns.
+type Filter interface {
+	// Filter returns a filtered copy of the set.
+	Filter(*Set) *Set
+}
+
+// NewExcludeSetFilter returns a filter that removes field paths in the exclude set.
+func NewExcludeSetFilter(exclude *Set) Filter {
+	return excludeFilter{exclude}
+}
+
+// NewExcludeFilterSetMap converts a map of APIVersion to exclude set to a map of APIVersion to exclude filters.
+func NewExcludeFilterSetMap(resetFields map[APIVersion]*Set) map[APIVersion]Filter {
+	result := make(map[APIVersion]Filter)
+	for k, v := range resetFields {
+		result[k] = excludeFilter{v}
+	}
+	return result
+}
+
+type excludeFilter struct {
+	excludeSet *Set
+}
+
+func (t excludeFilter) Filter(set *Set) *Set {
+	return set.RecursiveDifference(t.excludeSet)
+}
+
+// NewIncludeMatcherFilter returns a filter that only includes field paths that match.
+// If no matchers are provided, the filter includes all field paths.
+// PrefixMatcher and MakePrefixMatcherOrDie can help create basic matcher.
+func NewIncludeMatcherFilter(matchers ...*SetMatcher) Filter {
+	if len(matchers) == 0 {
+		return includeMatcherFilter{&SetMatcher{wildcard: true}}
+	}
+	matcher := matchers[0]
+	for i := 1; i < len(matchers); i++ {
+		matcher = matcher.Merge(matchers[i])
+	}
+
+	return includeMatcherFilter{matcher}
+}
+
+type includeMatcherFilter struct {
+	matcher *SetMatcher
+}
+
+func (pf includeMatcherFilter) Filter(set *Set) *Set {
+	return set.FilterIncludeMatches(pf.matcher)
+}