Missed k8s.io/kube-openapi/cmd/openapi-gen dependency on code-generator go.mod about kubernetes

[mauri870]

Using tags would be a way to have more reproducible builds, they still need to be tagged from time to time tho. That is still better than using @latest or micro managing commit revisions.

[mimowo]

Either that or we pin to a more recent commit, for example @835d969ad83a.

@mauri870 thanks for investigating.

Question, if we use @latest would this not cause problems in the future if we try to build a release branch from the past? Maybe this is not a big deal. OTOH if we hardcode a tag, it may create maintenance costs.

I'm wondering if there is a better way, say to version openapi-gen and use the corresponding tag, say 1.30.1?

[mauri870]

/assign

[mauri870]

I was able to reproduce, but just because I had an older version of kube-openapi in my GOPATH. Using the @latest prefix in the command fixed it.

$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen
../../gopath/pkg/mod/k8s.io/[email protected]/pkg/common/common.go:23:2: missing go.sum entry for module providing package github.com/emicklei/go-restful/v3 (imported by k8s.io/kube-openapi/pkg/common); to add:
        go get k8s.io/kube-openapi/pkg/[email protected]

$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen@latest
go: downloading k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a

$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen@latest

I think line https://github.com/kubernetes/code-generator/blob/master/kube_codegen.sh#L330C45-L330C64 needs to be

GO111MODULE=on go install $(printf "k8s.io/kube-openapi/cmd/%s@latest" "${BINS[@]}")

[mauri870]

Either that or we pin to a more recent commit, for example @835d969ad83a. For some reason if you ommit the version it is using a commit from Feb 27.

[mbobrovskyi]

I can do it.

[mbobrovskyi]

/cc @alculquicondor @mimowo @thockin

[neolit123]

GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen

/sig api-machinery

[mbobrovskyi]

Yeah, with latest works for me too.

[fedebongio]

Thanks @mauri870 and @mimowo for the research. Is either of you thinking on submitting a fix for this? Thanks!

[mauri870]

I can do it.

Thanks!

/assign mbobrovskyi

[BenTheElder]

Yes, please don't use @latest

Generally instead we'd control the version of a tool in the hack/tools module and install it from there (see e.g.

kubernetes/hack/verify-spelling.sh

Line 35 in eb68409

go -C "${KUBE_ROOT}/hack/tools" install github.com/client9/misspell/cmd/misspell

[BenTheElder]

kubernetes/hack/tools/go.mod

Line 8 in eb68409

github.com/client9/misspell v0.3.4

kubernetes/hack/tools/tools.go

Line 24 in eb68409

_ "github.com/client9/misspell/cmd/misspell"

This allows us to also gain go.sum for the package while not polluting the main module with dev-only dependencies.

[mbobrovskyi]

Not sure if we need to make another go.mod. Because it's not just a dev-only dependency. I propose to add it to tools.go of code-generator.

[mbobrovskyi]

This is about semversioning kubernetes/kube-openapi#421 (comment).

Note, and this is crucial for this repo, kube-openapi has a collection of very different functionality that is independently developed. Our go-openapi fork is very different from pkg/cached or pkg/builder. Semver for a collection repository like this is not a good strategy. We could apply semver to individual parts via nested go.mods. That would make a lot more sense.

[seans3]

/triage accepted