Merge pull request #123529 from thockin/go-workspaces

Go workspaces for k/k and k/staging/*

.gitignore

@@ -1,7 +1,3 @@
-# gopls gets indigestion without go.work, CI gets indigestion WITH go.work
-/go.work
-/go.work.sum
-
 # OSX leaves these everywhere on SMB shares
 ._*
 

LICENSES/vendor/k8s.io/gengo/v2/LICENSE

@@ -1,4 +1,4 @@
-= vendor/k8s.io/gengo licensed under: =
+= vendor/k8s.io/gengo/v2 licensed under: =
 
 
                                  Apache License
@@ -203,4 +203,4 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
-= vendor/k8s.io/gengo/LICENSE ad09685d909e7a9f763d2bb62d4bd6fb
+= vendor/k8s.io/gengo/v2/LICENSE ad09685d909e7a9f763d2bb62d4bd6fb

README.md

@@ -43,8 +43,6 @@ If you want to build Kubernetes right away there are two options:
 ##### You have a working [Go environment].
 
 ```
-mkdir -p $GOPATH/src/k8s.io
-cd $GOPATH/src/k8s.io
 git clone https://github.com/kubernetes/kubernetes
 cd kubernetes
 make

api/openapi-spec/swagger.json

@@ -1449,7 +1449,8 @@
       "required": [
         "type",
         "status",
-        "reason"
+        "reason",
+        "message"
       ],
       "type": "object"
     },
@@ -13477,6 +13478,9 @@
           "description": "ParentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object."
         }
       },
+      "required": [
+        "parentRef"
+      ],
       "type": "object"
     },
     "io.k8s.api.networking.v1alpha1.ParentReference": {
@@ -13499,6 +13503,10 @@
           "type": "string"
         }
       },
+      "required": [
+        "resource",
+        "name"
+      ],
       "type": "object"
     },
     "io.k8s.api.networking.v1alpha1.ServiceCIDR": {

api/openapi-spec/v3/apis__internal.apiserver.k8s.io__v1alpha1_openapi.json

@@ -124,7 +124,8 @@
         "required": [
           "type",
           "status",
-          "reason"
+          "reason",
+          "message"
         ],
         "type": "object"
       },

api/openapi-spec/v3/apis__networking.k8s.io__v1alpha1_openapi.json

@@ -97,6 +97,9 @@
             "description": "ParentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object."
           }
         },
+        "required": [
+          "parentRef"
+        ],
         "type": "object"
       },
       "io.k8s.api.networking.v1alpha1.ParentReference": {
@@ -119,6 +122,10 @@
             "type": "string"
           }
         },
+        "required": [
+          "resource",
+          "name"
+        ],
         "type": "object"
       },
       "io.k8s.api.networking.v1alpha1.ServiceCIDR": {

build/common.sh

@@ -81,6 +81,7 @@ readonly LOCAL_OUTPUT_IMAGE_STAGING="${LOCAL_OUTPUT_ROOT}/images"
 # This is a symlink to binaries for "this platform" (e.g. build tools).
 readonly THIS_PLATFORM_BIN="${LOCAL_OUTPUT_ROOT}/bin"
 
+readonly KUBE_GO_PACKAGE=k8s.io/kubernetes
 readonly REMOTE_ROOT="/go/src/${KUBE_GO_PACKAGE}"
 readonly REMOTE_OUTPUT_ROOT="${REMOTE_ROOT}/_output"
 readonly REMOTE_OUTPUT_SUBPATH="${REMOTE_OUTPUT_ROOT}/dockerized"

build/root/Makefile

@@ -48,7 +48,6 @@ MAKEFLAGS += --warn-undefined-variables
 .EXPORT_ALL_VARIABLES:
 OUT_DIR ?= _output
 BIN_DIR := $(OUT_DIR)/bin
-PRJ_SRC_PATH := k8s.io/kubernetes
 
 ifdef KUBE_GOFLAGS
 $(info KUBE_GOFLAGS is now deprecated. Please use GOFLAGS instead.)
@@ -67,9 +66,9 @@ define ALL_HELP_INFO
 # Build code.
 #
 # Args:
-#   WHAT: Directory names to build.  If any of these directories has a 'main'
+#   WHAT: Directory or Go package names to build.  If any of these directories
-#     package, the build will produce executable files under $(OUT_DIR)/bin.
+#   has a 'main' package, the build will produce executable files under
-#     If not specified, "everything" will be built.
+#   $(OUT_DIR)/bin.  If not specified, "everything" will be built.
 #     "vendor/<module>/<path>" is accepted as alias for "<module>/<path>".
 #     "ginkgo" is an alias for the ginkgo CLI.
 #   GOFLAGS: Extra flags to pass to 'go' when building.
@@ -83,9 +82,9 @@ define ALL_HELP_INFO
 #   make all
 #   make all WHAT=cmd/kubelet GOFLAGS=-v
 #   make all DBG=1
-#     Note: Specify DBG=1 for building unstripped binaries, which allows you to use code debugging
+#     Note: Specify DBG=1 for building unstripped binaries, which allows you to
-#           tools like delve. When DBG is unspecified, it defaults to "-s -w" which strips debug
+#     use code debugging tools like delve. When DBG is unspecified, it defaults
-#           information.
+#     to "-s -w" which strips debug information.
 endef
 .PHONY: all
 ifeq ($(PRINT_HELP),y)

build/tools.go

@@ -23,12 +23,10 @@ package tools
 import (
 	// build script dependencies
 	_ "github.com/onsi/ginkgo/v2/ginkgo"
+	_ "k8s.io/code-generator/cmd/deepcopy-gen"
+	_ "k8s.io/code-generator/cmd/defaulter-gen"
 	_ "k8s.io/code-generator/cmd/go-to-protobuf"
 	_ "k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo"
-	_ "k8s.io/gengo/examples/deepcopy-gen/generators"
-	_ "k8s.io/gengo/examples/defaulter-gen/generators"
-	_ "k8s.io/gengo/examples/import-boss/generators"
-	_ "k8s.io/gengo/examples/set-gen/generators"
 	_ "k8s.io/kube-openapi/cmd/openapi-gen"
 
 	// submodule test dependencies

cmd/import-boss/README.md

@@ -0,0 +1,104 @@
+## Purpose
+
+`import-boss` enforces optional import restrictions between packages.  This is
+useful to manage the dependency graph within a large repository, such as
+[kubernetes](https://github.com/kubernetes/kubernetes).
+
+## How does it work?
+
+When a package is verified, `import-boss` looks for a file called
+`.import-restrictions` in the same directory and all parent directories, up to
+the module root (defined by the presence of a go.mod file).  These files
+contain rules which are evaluated against each dependency of the package in
+question.
+
+Evaluation starts with the rules file closest to the package.  If that file
+makes a determination to allow or forbid the import, evaluation is done.  If
+the import does not match any rule, the next-closest rules file is consulted,
+and so forth.  If the rules files are exhausted and no determination has been
+made, the import will be flagged as an error.
+
+### What are rules files?
+
+A rules file is a JSON or YAML document with two top-level keys, both optional:
+* `Rules`
+* `InverseRules`
+
+### What are Rules?
+
+A `rule` defines a policy to be enforced on packages which are depended on by
+the package in question.  It consists of three parts:
+  - A `SelectorRegexp`, to select the import paths that the rule applies to.
+  - A list of `AllowedPrefixes`
+  - A list of `ForbiddenPrefixes`
+
+An import is allowed if it matches at least one allowed prefix and does not
+match any forbidden prefixes.
+
+Rules also have a boolean `Transitive` option. When this option is true, the
+rule is applied to transitive imports.
+
+Example:
+
+```json
+{
+  "Rules": [
+    {
+      "SelectorRegexp": "example[.]com",
+      "AllowedPrefixes": [
+        "example.com/project/package",
+        "example.com/other/package"
+      ],
+      "ForbiddenPrefixes": [
+        "example.com/legacy/package"
+      ]
+    },
+    {
+      "SelectorRegexp": "^unsafe$",
+      "AllowedPrefixes": [],
+      "ForbiddenPrefixes": [ "" ],
+      "Transitive": true
+    }
+  ]
+}
+```
+
+The `SelectorRegexp` specifies that this rule applies only to imports which
+match that regex.
+
+Note: an empty list (`[]`) matches nothing, and an empty string (`""`) is a
+prefix of everything.
+
+### What are InverseRules?
+
+In contrast to rules, which are defined in terms of "things this package
+depends on", inverse rules are defined in terms of "things which import this
+package".  This allows for fine-grained import restrictions for "semi-private
+packages" which are more sophisticated than Go's `internal` convention.
+
+If inverse rules are found, then all known imports of the package are checked
+against each such rule, in the same fashion as regular rules.  Note that this
+can only handle known imports, which is defined as any package which is also
+being considered by this `import-boss` run.  For most repositories, `./...` will
+suffice.
+
+Example:
+
+```yaml
+inverseRules:
+  - selectorRegexp: example[.]com
+    allowedPrefixes:
+      - example.com/this-same-repo
+      - example.com/close-friend/legacy
+    forbiddenPrefixes:
+      - example.com/other-project
+  - selectorRegexp: example[.]com
+    transitive: true
+    forbiddenPrefixes:
+      - example.com/other-team
+```
+
+## How do I run import-boss?
+
+For most scenarios, simply running `import-boss ./...` will work.  For projects
+which use Go workspaces, this can even span multiple modules.

cmd/import-boss/main.go

@@ -0,0 +1,585 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// import-boss enforces import restrictions in a given repository.
+package main
+
+import (
+	"flag"
+	"os"
+
+	"errors"
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/spf13/pflag"
+	"golang.org/x/tools/go/packages"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	rulesFileName = ".import-restrictions"
+	goModFile     = "go.mod"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	pkgs, err := loadPkgs(pflag.Args()...)
+	if err != nil {
+		klog.Errorf("failed to load packages: %v", err)
+	}
+
+	pkgs = massage(pkgs)
+	boss := newBoss(pkgs)
+
+	var allErrs []error
+	for _, pkg := range pkgs {
+		if pkgErrs := boss.Verify(pkg); pkgErrs != nil {
+			allErrs = append(allErrs, pkgErrs...)
+		}
+	}
+
+	fail := false
+	for _, err := range allErrs {
+		if lister, ok := err.(interface{ Unwrap() []error }); ok {
+			for _, err := range lister.Unwrap() {
+				fmt.Printf("ERROR: %v\n", err)
+			}
+		} else {
+			fmt.Printf("ERROR: %v\n", err)
+		}
+		fail = true
+	}
+
+	if fail {
+		os.Exit(1)
+	}
+
+	klog.V(2).Info("Completed successfully.")
+}
+
+func loadPkgs(patterns ...string) ([]*packages.Package, error) {
+	cfg := packages.Config{
+		Mode: packages.NeedName | packages.NeedFiles | packages.NeedImports |
+			packages.NeedDeps | packages.NeedModule,
+		Tests: true,
+	}
+
+	klog.V(1).Infof("loading: %v", patterns)
+	tBefore := time.Now()
+	pkgs, err := packages.Load(&cfg, patterns...)
+	if err != nil {
+		return nil, err
+	}
+	klog.V(2).Infof("loaded %d pkg(s) in %v", len(pkgs), time.Since(tBefore))
+
+	var allErrs []error
+	for _, pkg := range pkgs {
+		var errs []error
+		for _, e := range pkg.Errors {
+			if e.Kind == packages.ListError || e.Kind == packages.ParseError {
+				errs = append(errs, e)
+			}
+		}
+		if len(errs) > 0 {
+			allErrs = append(allErrs, fmt.Errorf("error(s) in %q: %w", pkg.PkgPath, errors.Join(errs...)))
+		}
+	}
+	if len(allErrs) > 0 {
+		return nil, errors.Join(allErrs...)
+	}
+
+	return pkgs, nil
+}
+
+func massage(in []*packages.Package) []*packages.Package {
+	out := []*packages.Package{}
+
+	for _, pkg := range in {
+		klog.V(2).Infof("considering pkg: %q", pkg.PkgPath)
+
+		// Discard packages which represent the <pkg>.test result.  They don't seem
+		// to hold any interesting source info.
+		if strings.HasSuffix(pkg.PkgPath, ".test") {
+			klog.V(3).Infof("ignoring testbin pkg: %q", pkg.PkgPath)
+			continue
+		}
+
+		// Packages which end in "_test" have tests which use the special "_test"
+		// package suffix.  Packages which have test files must be tests.  Don't
+		// ask me, this is what packages.Load produces.
+		if strings.HasSuffix(pkg.PkgPath, "_test") || hasTestFiles(pkg.GoFiles) {
+			// NOTE: This syntax can be undone with unmassage().
+			pkg.PkgPath = strings.TrimSuffix(pkg.PkgPath, "_test") + " ((tests:" + pkg.Name + "))"
+			klog.V(3).Infof("renamed to: %q", pkg.PkgPath)
+		}
+		out = append(out, pkg)
+	}
+
+	return out
+}
+
+func unmassage(str string) string {
+	idx := strings.LastIndex(str, " ((")
+	if idx == -1 {
+		return str
+	}
+	return str[0:idx]
+}
+
+type ImportBoss struct {
+	// incomingImports holds all the packages importing the key.
+	incomingImports map[string][]string
+
+	// transitiveIncomingImports holds the transitive closure of
+	// incomingImports.
+	transitiveIncomingImports map[string][]string
+}
+
+func newBoss(pkgs []*packages.Package) *ImportBoss {
+	boss := &ImportBoss{
+		incomingImports:           map[string][]string{},
+		transitiveIncomingImports: map[string][]string{},
+	}
+
+	for _, pkg := range pkgs {
+		// Accumulate imports
+		for imp := range pkg.Imports {
+			boss.incomingImports[imp] = append(boss.incomingImports[imp], pkg.PkgPath)
+		}
+	}
+
+	boss.transitiveIncomingImports = transitiveClosure(boss.incomingImports)
+
+	return boss
+}
+
+func hasTestFiles(files []string) bool {
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			return true
+		}
+	}
+	return false
+}
+
+func (boss *ImportBoss) Verify(pkg *packages.Package) []error {
+	pkgDir := packageDir(pkg)
+	if pkgDir == "" {
+		// This Package has no usable files, e.g. only tests, which are modelled in
+		// a distinct Package.
+		return nil
+	}
+
+	restrictionFiles, err := recursiveRead(filepath.Join(pkgDir, rulesFileName))
+	if err != nil {
+		return []error{fmt.Errorf("error finding rules file: %w", err)}
+	}
+	if len(restrictionFiles) == 0 {
+		return nil
+	}
+
+	klog.V(2).Infof("verifying pkg %q (%s)", pkg.PkgPath, pkgDir)
+	var errs []error
+	errs = append(errs, boss.verifyRules(pkg, restrictionFiles)...)
+	errs = append(errs, boss.verifyInverseRules(pkg, restrictionFiles)...)
+	return errs
+}
+
+// packageDir tries to figure out the directory of the specified package.
+func packageDir(pkg *packages.Package) string {
+	if len(pkg.GoFiles) > 0 {
+		return filepath.Dir(pkg.GoFiles[0])
+	}
+	if len(pkg.IgnoredFiles) > 0 {
+		return filepath.Dir(pkg.IgnoredFiles[0])
+	}
+	return ""
+}
+
+type FileFormat struct {
+	Rules        []Rule
+	InverseRules []Rule
+
+	path string
+}
+
+// A single import restriction rule.
+type Rule struct {
+	// All import paths that match this regexp...
+	SelectorRegexp string
+	// ... must have one of these prefixes ...
+	AllowedPrefixes []string
+	// ... and must not have one of these prefixes.
+	ForbiddenPrefixes []string
+	// True if the rule is to be applied to transitive imports.
+	Transitive bool
+}
+
+// Disposition represents a decision or non-decision.
+type Disposition int
+
+const (
+	// DepForbidden means the dependency was explicitly forbidden by a rule.
+	DepForbidden Disposition = iota
+	// DepAllowed means the dependency was explicitly allowed by a rule.
+	DepAllowed
+	// DepAllowed means the dependency did not match any rule.
+	DepUnknown
+)
+
+// Evaluate considers this rule and decides if this dependency is allowed.
+func (r Rule) Evaluate(imp string) Disposition {
+	// To pass, an import muct be allowed and not forbidden.
+	// Check forbidden first.
+	for _, forbidden := range r.ForbiddenPrefixes {
+		klog.V(5).Infof("checking %q against forbidden prefix %q", imp, forbidden)
+		if hasPathPrefix(imp, forbidden) {
+			klog.V(5).Infof("this import of %q is forbidden", imp)
+			return DepForbidden
+		}
+	}
+	for _, allowed := range r.AllowedPrefixes {
+		klog.V(5).Infof("checking %q against allowed prefix %q", imp, allowed)
+		if hasPathPrefix(imp, allowed) {
+			klog.V(5).Infof("this import of %q is allowed", imp)
+			return DepAllowed
+		}
+	}
+	return DepUnknown
+}
+
+// recursiveRead collects all '.import-restriction' files, between the current directory,
+// and the module root.
+func recursiveRead(path string) ([]*FileFormat, error) {
+	restrictionFiles := make([]*FileFormat, 0)
+
+	for {
+		if _, err := os.Stat(path); err == nil {
+			rules, err := readFile(path)
+			if err != nil {
+				return nil, err
+			}
+
+			restrictionFiles = append(restrictionFiles, rules)
+		}
+
+		nextPath, removedDir := removeLastDir(path)
+		if nextPath == path || isGoModRoot(path) || removedDir == "src" {
+			break
+		}
+
+		path = nextPath
+	}
+
+	return restrictionFiles, nil
+}
+
+func readFile(path string) (*FileFormat, error) {
+	currentBytes, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't read %v: %w", path, err)
+	}
+
+	var current FileFormat
+	err = yaml.Unmarshal(currentBytes, &current)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't unmarshal %v: %w", path, err)
+	}
+	current.path = path
+	return &current, nil
+}
+
+// isGoModRoot checks if a directory is the root directory for a package
+// by checking for the existence of a 'go.mod' file in that directory.
+func isGoModRoot(path string) bool {
+	_, err := os.Stat(filepath.Join(filepath.Dir(path), goModFile))
+	return err == nil
+}
+
+// removeLastDir removes the last directory, but leaves the file name
+// unchanged. It returns the new path and the removed directory. So:
+// "a/b/c/file" -> ("a/b/file", "c")
+func removeLastDir(path string) (newPath, removedDir string) {
+	dir, file := filepath.Split(path)
+	dir = strings.TrimSuffix(dir, string(filepath.Separator))
+	return filepath.Join(filepath.Dir(dir), file), filepath.Base(dir)
+}
+
+func (boss *ImportBoss) verifyRules(pkg *packages.Package, restrictionFiles []*FileFormat) []error {
+	klog.V(3).Infof("verifying pkg %q rules", pkg.PkgPath)
+
+	// compile all Selector regex in all restriction files
+	selectors := make([][]*regexp.Regexp, len(restrictionFiles))
+	for i, restrictionFile := range restrictionFiles {
+		for _, r := range restrictionFile.Rules {
+			re, err := regexp.Compile(r.SelectorRegexp)
+			if err != nil {
+				return []error{
+					fmt.Errorf("regexp `%s` in file %q doesn't compile: %w", r.SelectorRegexp, restrictionFile.path, err),
+				}
+			}
+
+			selectors[i] = append(selectors[i], re)
+		}
+	}
+
+	realPkgPath := unmassage(pkg.PkgPath)
+
+	direct, indirect := transitiveImports(pkg)
+	isDirect := map[string]bool{}
+	for _, imp := range direct {
+		isDirect[imp] = true
+	}
+	relate := func(imp string) string {
+		if isDirect[imp] {
+			return "->"
+		}
+		return "-->"
+	}
+
+	var errs []error
+	for _, imp := range uniq(direct, indirect) {
+		if unmassage(imp) == realPkgPath {
+			// Tests in package "foo_test" depend on the test package for
+			// "foo" (if both exist in a giver directory).
+			continue
+		}
+		klog.V(4).Infof("considering import %q %s %q", pkg.PkgPath, relate(imp), imp)
+		matched := false
+		decided := false
+		for i, file := range restrictionFiles {
+			klog.V(4).Infof("rules file %s", file.path)
+			for j, rule := range file.Rules {
+				if !rule.Transitive && !isDirect[imp] {
+					continue
+				}
+				matching := selectors[i][j].MatchString(imp)
+				if !matching {
+					continue
+				}
+				matched = true
+				klog.V(6).Infof("selector %v matches %q", rule.SelectorRegexp, imp)
+
+				disp := rule.Evaluate(imp)
+				if disp == DepAllowed {
+					decided = true
+					break // no further rules, next file
+				} else if disp == DepForbidden {
+					errs = append(errs, fmt.Errorf("%q %s %q is forbidden by %s", pkg.PkgPath, relate(imp), imp, file.path))
+					decided = true
+					break // no further rules, next file
+				}
+			}
+			if decided {
+				break // no further files, next import
+			}
+		}
+		if matched && !decided {
+			klog.V(5).Infof("%q %s %q did not match any rule", pkg, relate(imp), imp)
+			errs = append(errs, fmt.Errorf("%q %s %q did not match any rule", pkg.PkgPath, relate(imp), imp))
+		}
+	}
+
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return nil
+}
+
+func uniq(slices ...[]string) []string {
+	m := map[string]bool{}
+	for _, sl := range slices {
+		for _, str := range sl {
+			m[str] = true
+		}
+	}
+	ret := []string{}
+	for str := range m {
+		ret = append(ret, str)
+	}
+	sort.Strings(ret)
+	return ret
+}
+
+func hasPathPrefix(path, prefix string) bool {
+	if prefix == "" || path == prefix {
+		return true
+	}
+	if !strings.HasSuffix(path, string(filepath.Separator)) {
+		prefix += string(filepath.Separator)
+	}
+	return strings.HasPrefix(path, prefix)
+}
+
+func transitiveImports(pkg *packages.Package) ([]string, []string) {
+	direct := []string{}
+	indirect := []string{}
+	seen := map[string]bool{}
+	for _, imp := range pkg.Imports {
+		direct = append(direct, imp.PkgPath)
+		dfsImports(&indirect, seen, imp)
+	}
+	return direct, indirect
+}
+
+func dfsImports(dest *[]string, seen map[string]bool, p *packages.Package) {
+	for _, p2 := range p.Imports {
+		if seen[p2.PkgPath] {
+			continue
+		}
+		seen[p2.PkgPath] = true
+		*dest = append(*dest, p2.PkgPath)
+		dfsImports(dest, seen, p2)
+	}
+}
+
+// verifyInverseRules checks that all packages that import a package are allowed to import it.
+func (boss *ImportBoss) verifyInverseRules(pkg *packages.Package, restrictionFiles []*FileFormat) []error {
+	klog.V(3).Infof("verifying pkg %q inverse-rules", pkg.PkgPath)
+
+	// compile all Selector regex in all restriction files
+	selectors := make([][]*regexp.Regexp, len(restrictionFiles))
+	for i, restrictionFile := range restrictionFiles {
+		for _, r := range restrictionFile.InverseRules {
+			re, err := regexp.Compile(r.SelectorRegexp)
+			if err != nil {
+				return []error{
+					fmt.Errorf("regexp `%s` in file %q doesn't compile: %w", r.SelectorRegexp, restrictionFile.path, err),
+				}
+			}
+
+			selectors[i] = append(selectors[i], re)
+		}
+	}
+
+	realPkgPath := unmassage(pkg.PkgPath)
+
+	isDirect := map[string]bool{}
+	for _, imp := range boss.incomingImports[pkg.PkgPath] {
+		isDirect[imp] = true
+	}
+	relate := func(imp string) string {
+		if isDirect[imp] {
+			return "<-"
+		}
+		return "<--"
+	}
+
+	var errs []error
+	for _, imp := range boss.transitiveIncomingImports[pkg.PkgPath] {
+		if unmassage(imp) == realPkgPath {
+			// Tests in package "foo_test" depend on the test package for
+			// "foo" (if both exist in a giver directory).
+			continue
+		}
+		klog.V(4).Infof("considering import %q %s %q", pkg.PkgPath, relate(imp), imp)
+		matched := false
+		decided := false
+		for i, file := range restrictionFiles {
+			klog.V(4).Infof("rules file %s", file.path)
+			for j, rule := range file.InverseRules {
+				if !rule.Transitive && !isDirect[imp] {
+					continue
+				}
+				matching := selectors[i][j].MatchString(imp)
+				if !matching {
+					continue
+				}
+				matched = true
+				klog.V(6).Infof("selector %v matches %q", rule.SelectorRegexp, imp)
+
+				disp := rule.Evaluate(imp)
+				if disp == DepAllowed {
+					decided = true
+					break // no further rules, next file
+				} else if disp == DepForbidden {
+					errs = append(errs, fmt.Errorf("%q %s %q is forbidden by %s", pkg.PkgPath, relate(imp), imp, file.path))
+					decided = true
+					break // no further rules, next file
+				}
+			}
+			if decided {
+				break // no further files, next import
+			}
+		}
+		if matched && !decided {
+			klog.V(5).Infof("%q %s %q did not match any rule", pkg.PkgPath, relate(imp), imp)
+			errs = append(errs, fmt.Errorf("%q %s %q did not match any rule", pkg.PkgPath, relate(imp), imp))
+		}
+	}
+
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return nil
+}
+
+func transitiveClosure(in map[string][]string) map[string][]string {
+	type edge struct {
+		from string
+		to   string
+	}
+
+	adj := make(map[edge]bool)
+	imports := make(map[string]struct{})
+	for from, tos := range in {
+		for _, to := range tos {
+			adj[edge{from, to}] = true
+			imports[to] = struct{}{}
+		}
+	}
+
+	// Warshal's algorithm
+	for k := range in {
+		for i := range in {
+			if !adj[edge{i, k}] {
+				continue
+			}
+			for j := range imports {
+				if adj[edge{i, j}] {
+					continue
+				}
+				if adj[edge{k, j}] {
+					adj[edge{i, j}] = true
+				}
+			}
+		}
+	}
+
+	out := make(map[string][]string, len(in))
+	for i := range in {
+		for j := range imports {
+			if adj[edge{i, j}] {
+				out[i] = append(out[i], j)
+			}
+		}
+
+		sort.Strings(out[i])
+	}
+
+	return out
+}

cmd/import-boss/main_test.go

@@ -0,0 +1,322 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"golang.org/x/tools/go/packages"
+)
+
+func TestRemoveLastDir(t *testing.T) {
+	table := map[string]struct{ newPath, removedDir string }{
+		"a/b/c": {"a/c", "b"},
+	}
+	for slashInput, expect := range table {
+		input := filepath.FromSlash(slashInput)
+
+		gotPath, gotRemoved := removeLastDir(input)
+		if e, a := filepath.FromSlash(expect.newPath), gotPath; e != a {
+			t.Errorf("%v: wanted %v, got %v", input, e, a)
+		}
+		if e, a := filepath.FromSlash(expect.removedDir), gotRemoved; e != a {
+			t.Errorf("%v: wanted %v, got %v", input, e, a)
+		}
+	}
+}
+
+func TestTransitiveClosure(t *testing.T) {
+	cases := []struct {
+		name     string
+		in       map[string][]string
+		expected map[string][]string
+	}{
+		{
+			name: "no transition",
+			in: map[string][]string{
+				"a": {"b"},
+				"c": {"d"},
+			},
+			expected: map[string][]string{
+				"a": {"b"},
+				"c": {"d"},
+			},
+		},
+		{
+			name: "simple",
+			in: map[string][]string{
+				"a": {"b"},
+				"b": {"c"},
+				"c": {"d"},
+			},
+			expected: map[string][]string{
+				"a": {"b", "c", "d"},
+				"b": {"c", "d"},
+				"c": {"d"},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			out := transitiveClosure(c.in)
+			if !reflect.DeepEqual(c.expected, out) {
+				t.Errorf("expected: %#v, got %#v", c.expected, out)
+			}
+		})
+	}
+}
+
+func TestHasTestFiles(t *testing.T) {
+	cases := []struct {
+		input  []string
+		expect bool
+	}{{
+		input:  nil,
+		expect: false,
+	}, {
+		input:  []string{},
+		expect: false,
+	}, {
+		input:  []string{"foo.go"},
+		expect: false,
+	}, {
+		input:  []string{"foo.go", "bar.go"},
+		expect: false,
+	}, {
+		input:  []string{"foo_test.go"},
+		expect: true,
+	}, {
+		input:  []string{"foo.go", "foo_test.go"},
+		expect: true,
+	}, {
+		input:  []string{"foo.go", "foo_test.go", "bar.go", "bar_test.go"},
+		expect: true,
+	}}
+
+	for _, tc := range cases {
+		ret := hasTestFiles(tc.input)
+		if ret != tc.expect {
+			t.Errorf("expected %v, got %v: %q", tc.expect, ret, tc.input)
+		}
+	}
+}
+
+func TestPackageDir(t *testing.T) {
+	cases := []struct {
+		input  *packages.Package
+		expect string
+	}{{
+		input: &packages.Package{
+			PkgPath:      "example.com/foo/bar/qux",
+			GoFiles:      []string{"/src/prj/file.go"},
+			IgnoredFiles: []string{"/otherdir/file.go"},
+		},
+		expect: "/src/prj",
+	}, {
+		input: &packages.Package{
+			PkgPath:      "example.com/foo/bar/qux",
+			IgnoredFiles: []string{"/src/prj/file.go"},
+		},
+		expect: "/src/prj",
+	}, {
+		input: &packages.Package{
+			PkgPath: "example.com/foo/bar/qux",
+		},
+		expect: "",
+	}}
+
+	for i, tc := range cases {
+		ret := packageDir(tc.input)
+		if ret != tc.expect {
+			t.Errorf("[%d] expected %v, got %v: %q", i, tc.expect, ret, tc.input)
+		}
+	}
+}
+
+func TestHasPathPrefix(t *testing.T) {
+	cases := []struct {
+		base   string
+		pfx    string
+		expect bool
+	}{{
+		base:   "",
+		pfx:    "",
+		expect: true,
+	}, {
+		base:   "/foo/bar",
+		pfx:    "",
+		expect: true,
+	}, {
+		base:   "",
+		pfx:    "/foo",
+		expect: false,
+	}, {
+		base:   "/foo",
+		pfx:    "/foo",
+		expect: true,
+	}, {
+		base:   "/foo/bar",
+		pfx:    "/foo",
+		expect: true,
+	}, {
+		base:   "/foobar/qux",
+		pfx:    "/foo",
+		expect: false,
+	}, {
+		base:   "/foo/bar/bat/qux/zrb",
+		pfx:    "/foo/bar/bat",
+		expect: true,
+	}}
+
+	for _, tc := range cases {
+		ret := hasPathPrefix(tc.base, tc.pfx)
+		if ret != tc.expect {
+			t.Errorf("expected %v, got %v: (%q, %q)", tc.expect, ret, tc.base, tc.pfx)
+		}
+	}
+}
+
+func checkAllErrorStrings(t *testing.T, errs []error, expect []string) {
+	t.Helper()
+	if len(errs) != len(expect) {
+		t.Fatalf("expected %d errors, got %d: %q", len(expect), len(errs), errs)
+	}
+
+	for _, str := range expect {
+		found := false
+		for _, err := range errs {
+			if strings.HasPrefix(err.Error(), str) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("did not find error %q", str)
+			t.Logf("\tseek: %s\n\t  in:", str)
+			for _, err := range errs {
+				t.Logf("\t      %s", err.Error())
+			}
+		}
+	}
+}
+
+func TestSimpleForward(t *testing.T) {
+	pkgs, err := loadPkgs("./testdata/simple-fwd/aaa")
+	if err != nil {
+		t.Fatalf("unexpected failure: %v", err)
+	}
+	if len(pkgs) != 1 {
+		t.Fatalf("expected 1 pkg result, got %d", len(pkgs))
+	}
+	if pkgs[0].PkgPath != "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/aaa" {
+		t.Fatalf("wrong PkgPath: %q", pkgs[0].PkgPath)
+	}
+
+	boss := newBoss(pkgs)
+	errs := boss.Verify(pkgs[0])
+
+	expect := []string{
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f1" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither" did not match any rule`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n1" did not match any rule`,
+	}
+
+	checkAllErrorStrings(t, errs, expect)
+}
+
+func TestNestedForward(t *testing.T) {
+	pkgs, err := loadPkgs("./testdata/nested-fwd/aaa")
+	if err != nil {
+		t.Fatalf("unexpected failure: %v", err)
+	}
+	if len(pkgs) != 1 {
+		t.Fatalf("expected 1 pkg result, got %d", len(pkgs))
+	}
+	if pkgs[0].PkgPath != "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/aaa" {
+		t.Fatalf("wrong PkgPath: %q", pkgs[0].PkgPath)
+	}
+
+	boss := newBoss(pkgs)
+	errs := boss.Verify(pkgs[0])
+
+	expect := []string{
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-sub" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/aaa" -> "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/neither/n1" did not match any rule`,
+	}
+
+	checkAllErrorStrings(t, errs, expect)
+}
+
+func TestInverse(t *testing.T) {
+	pkgs, err := loadPkgs("./testdata/inverse/...")
+	if err != nil {
+		t.Fatalf("unexpected failure: %v", err)
+	}
+	if len(pkgs) != 10 {
+		t.Fatalf("expected 10 pkg results, got %d", len(pkgs))
+	}
+
+	boss := newBoss(pkgs)
+
+	var errs []error
+	for _, pkg := range pkgs {
+		errs = append(errs, boss.Verify(pkg)...)
+	}
+
+	expect := []string{
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden" <- "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/aaa" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f1" <- "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/aaa" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a2" <- "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed" did not match any rule`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f2" <- "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed" did not match any rule`,
+	}
+
+	checkAllErrorStrings(t, errs, expect)
+}
+
+func TestTransitive(t *testing.T) {
+	pkgs, err := loadPkgs("./testdata/transitive/...")
+	if err != nil {
+		t.Fatalf("unexpected failure: %v", err)
+	}
+	if len(pkgs) != 10 {
+		t.Fatalf("expected 10 pkg results, got %d", len(pkgs))
+	}
+
+	boss := newBoss(pkgs)
+
+	var errs []error
+	for _, pkg := range pkgs {
+		errs = append(errs, boss.Verify(pkg)...)
+	}
+
+	expect := []string{
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden" <- "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/aaa" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f1" <- "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/aaa" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f2" <-- "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/aaa" is forbidden`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a2" <- "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed" did not match any rule`,
+		`"k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f2" <- "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed" did not match any rule`,
+	}
+
+	checkAllErrorStrings(t, errs, expect)
+}

cmd/import-boss/testdata/inverse/aaa/file.go

@@ -0,0 +1,12 @@
+package aaa
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither/n1"
+)
+
+var X = "aaa"

cmd/import-boss/testdata/inverse/allowed/.import-restrictions

@@ -0,0 +1,4 @@
+inverseRules:
+  - selectorRegexp: k8s[.]io
+    allowedPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/inverse/aaa

cmd/import-boss/testdata/inverse/allowed/a1/file.go

@@ -0,0 +1,3 @@
+package a1
+
+var X = "a1"

cmd/import-boss/testdata/inverse/allowed/a2/file.go

@@ -0,0 +1,3 @@
+package a2
+
+var X = "a2"

cmd/import-boss/testdata/inverse/allowed/file.go

@@ -0,0 +1,9 @@
+package allowed
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither/n2"
+)
+
+var X = "allowed"

cmd/import-boss/testdata/inverse/forbidden/.import-restrictions

@@ -0,0 +1,4 @@
+inverseRules:
+  - selectorRegexp: k8s[.]io
+    forbiddenPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/inverse/aaa

cmd/import-boss/testdata/inverse/forbidden/f1/file.go

@@ -0,0 +1,3 @@
+package f1
+
+var X = "f1"

cmd/import-boss/testdata/inverse/forbidden/f2/file.go

@@ -0,0 +1,3 @@
+package f2
+
+var X = "f2"

cmd/import-boss/testdata/inverse/forbidden/file.go

@@ -0,0 +1,3 @@
+package forbidden
+
+var X = "forbidden"

cmd/import-boss/testdata/inverse/neither/file.go

@@ -0,0 +1,3 @@
+package neither
+
+var X = "neither"

cmd/import-boss/testdata/inverse/neither/n1/file.go

@@ -0,0 +1,3 @@
+package n1
+
+var X = "n1"

cmd/import-boss/testdata/inverse/neither/n2/file.go

@@ -0,0 +1,3 @@
+package n2
+
+var X = "n2"

cmd/import-boss/testdata/nested-fwd/.import-restrictions

@@ -0,0 +1,8 @@
+rules:
+  - selectorRegexp: k8s[.]io
+    allowedPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-root
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both
+    forbiddenPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both

cmd/import-boss/testdata/nested-fwd/aaa/.import-restrictions

@@ -0,0 +1,9 @@
+rules:
+  - selectorRegexp: k8s[.]io
+    allowedPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/bbb
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-sub
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both
+    forbiddenPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-sub
+      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both

cmd/import-boss/testdata/nested-fwd/aaa/file.go

@@ -0,0 +1,14 @@
+package aaa
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-root"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-sub"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/bbb"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-sub"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/neither/n1"
+)
+
+var X = "aaa"

cmd/import-boss/testdata/nested-fwd/allowed-by-both/file.go

@@ -0,0 +1,3 @@
+package allowedbyboth
+
+var X = "allowedbyboth"

cmd/import-boss/testdata/nested-fwd/allowed-by-root/file.go

@@ -0,0 +1,3 @@
+package allowedbyroot
+
+var X = "allowedbyroot"

cmd/import-boss/testdata/nested-fwd/allowed-by-sub/file.go

@@ -0,0 +1,3 @@
+package allowedbysub
+
+var X = "allowedbysub"

cmd/import-boss/testdata/nested-fwd/bbb/file.go

@@ -0,0 +1,13 @@
+package bbb
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-root"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-sub"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-sub"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/neither/n2"
+)
+
+var X = "bbb"

cmd/import-boss/testdata/nested-fwd/forbidden-by-both/file.go

@@ -0,0 +1,3 @@
+package forbiddenbyboth
+
+var X = "forbiddenbyboth"

cmd/import-boss/testdata/nested-fwd/forbidden-by-root/file.go

@@ -0,0 +1,3 @@
+package forbiddenbyroot
+
+var X = "forbiddenbyroot"

cmd/import-boss/testdata/nested-fwd/forbidden-by-sub/file.go

@@ -0,0 +1,3 @@
+package forbiddenbysub
+
+var X = "forbiddenbysub"

cmd/import-boss/testdata/nested-fwd/neither/n1/file.go

@@ -0,0 +1,3 @@
+package n1
+
+var X = "n1"

cmd/import-boss/testdata/nested-fwd/neither/n2/file.go

@@ -0,0 +1,3 @@
+package n2
+
+var X = "n2"

cmd/import-boss/testdata/simple-fwd/aaa/.import-restrictions

@@ -0,0 +1,6 @@
+rules:
+  - selectorRegexp: k8s[.]io
+    allowedPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed
+    forbiddenPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden

cmd/import-boss/testdata/simple-fwd/aaa/file.go

@@ -0,0 +1,12 @@
+package aaa
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed/a1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n1"
+)
+
+var X = "aaa"

cmd/import-boss/testdata/simple-fwd/allowed/a1/file.go

@@ -0,0 +1,3 @@
+package a1
+
+var X = "a1"

cmd/import-boss/testdata/simple-fwd/allowed/a2/file.go

@@ -0,0 +1,3 @@
+package a2
+
+var X = "a2"

cmd/import-boss/testdata/simple-fwd/allowed/file.go

@@ -0,0 +1,9 @@
+package allowed
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed/a2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n2"
+)
+
+var X = "allowed"

cmd/import-boss/testdata/simple-fwd/forbidden/f1/file.go

@@ -0,0 +1,3 @@
+package f1
+
+var X = "f1"

cmd/import-boss/testdata/simple-fwd/forbidden/f2/file.go

@@ -0,0 +1,3 @@
+package f2
+
+var X = "f2"

cmd/import-boss/testdata/simple-fwd/forbidden/file.go

@@ -0,0 +1,3 @@
+package forbidden
+
+var X = "forbidden"

cmd/import-boss/testdata/simple-fwd/neither/file.go

@@ -0,0 +1,3 @@
+package neither
+
+var X = "neither"

cmd/import-boss/testdata/simple-fwd/neither/n1/file.go

@@ -0,0 +1,3 @@
+package n1
+
+var X = "n1"

cmd/import-boss/testdata/simple-fwd/neither/n2/file.go

@@ -0,0 +1,3 @@
+package n2
+
+var X = "n2"

cmd/import-boss/testdata/transitive/aaa/file.go

@@ -0,0 +1,12 @@
+package aaa
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f1"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither/n1"
+)
+
+var X = "aaa"

cmd/import-boss/testdata/transitive/allowed/.import-restrictions

@@ -0,0 +1,5 @@
+inverseRules:
+  - selectorRegexp: k8s[.]io
+    allowedPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/transitive/aaa
+    transitive: true

cmd/import-boss/testdata/transitive/allowed/a1/file.go

@@ -0,0 +1,3 @@
+package a1
+
+var X = "a1"

cmd/import-boss/testdata/transitive/allowed/a2/file.go

@@ -0,0 +1,3 @@
+package a2
+
+var X = "a2"

cmd/import-boss/testdata/transitive/allowed/file.go

@@ -0,0 +1,9 @@
+package allowed
+
+import (
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f2"
+	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither/n2"
+)
+
+var X = "allowed"

cmd/import-boss/testdata/transitive/forbidden/.import-restrictions

@@ -0,0 +1,5 @@
+inverseRules:
+  - selectorRegexp: k8s[.]io
+    forbiddenPrefixes:
+      - k8s.io/kubernetes/cmd/import-boss/testdata/transitive/aaa
+    transitive: true

cmd/import-boss/testdata/transitive/forbidden/f1/file.go

@@ -0,0 +1,3 @@
+package f1
+
+var X = "f1"

cmd/import-boss/testdata/transitive/forbidden/f2/file.go

@@ -0,0 +1,3 @@
+package f2
+
+var X = "f2"

cmd/import-boss/testdata/transitive/forbidden/file.go

@@ -0,0 +1,3 @@
+package forbidden
+
+var X = "forbidden"

cmd/import-boss/testdata/transitive/neither/file.go

@@ -0,0 +1,3 @@
+package neither
+
+var X = "neither"

cmd/import-boss/testdata/transitive/neither/n1/file.go

@@ -0,0 +1,3 @@
+package n1
+
+var X = "n1"

cmd/import-boss/testdata/transitive/neither/n2/file.go

@@ -0,0 +1,3 @@
+package n2
+
+var X = "n2"

cmd/importverifier/importverifier.go

@@ -33,7 +33,7 @@ import (
 // Package is a subset of cmd/go.Package
 type Package struct {
 	Dir          string   `yaml:",omitempty"` // directory containing package sources
-	ImportPath   string   `yaml:",omitempty"` // import path of package in dir
+	ImportPath   string   `yaml:",omitempty"` // import path of package
 	Imports      []string `yaml:",omitempty"` // import paths used by this package
 	TestImports  []string `yaml:",omitempty"` // imports from TestGoFiles
 	XTestImports []string `yaml:",omitempty"` // imports from XTestGoFiles
@@ -42,19 +42,18 @@ type Package struct {
 // ImportRestriction describes a set of allowable import
 // trees for a tree of source code
 type ImportRestriction struct {
-	// BaseDir is the root of the package tree that is
+	// BaseDir is the root of a package tree that is restricted by this
-	// restricted by this configuration, given as a
+	// configuration, given as a relative path from the root of the repository.
-	// relative path from the root of the repository
+	// This is a directory which `go list` might not consider a package (if it
+	// has not .go files)
 	BaseDir string `yaml:"baseImportPath"`
-	// IgnoredSubTrees are roots of sub-trees of the
+	// IgnoredSubTrees are roots of sub-trees of the BaseDir for which we do
-	// BaseDir for which we do not want to enforce
+	// not want to enforce any import restrictions whatsoever, given as
-	// any import restrictions whatsoever, given as
+	// relative paths from the root of the repository.
-	// relative paths from the root of the repository
 	IgnoredSubTrees []string `yaml:"ignoredSubTrees,omitempty"`
-	// AllowedImports are roots of package trees that
+	// AllowedImports are roots of package trees that are allowed to be
-	// are allowed to be imported from the BaseDir,
+	// imported from the BaseDir, given as paths that would be used in a Go
-	// given as paths that would be used in a Go
+	// import statement.
-	// import statement
 	AllowedImports []string `yaml:"allowedImports"`
 	// ExcludeTests will skip checking test dependencies.
 	ExcludeTests bool `yaml:"excludeTests"`
@@ -126,9 +125,8 @@ func (i *ImportRestriction) forbiddenImportsFor(pkg Package) []string {
 		imports = append(imports, append(pkg.TestImports, pkg.XTestImports...)...)
 	}
 	for _, imp := range imports {
-		path := extractVendorPath(imp)
+		if i.isForbidden(imp) {
-		if i.isForbidden(path) {
+			forbiddenImportSet[imp] = struct{}{}
-			forbiddenImportSet[path] = struct{}{}
 		}
 	}
 
@@ -139,16 +137,6 @@ func (i *ImportRestriction) forbiddenImportsFor(pkg Package) []string {
 	return forbiddenImports
 }
 
-// extractVendorPath removes a vendor prefix if one exists
-func extractVendorPath(path string) string {
-	vendorPath := "/vendor/"
-	if !strings.Contains(path, vendorPath) {
-		return path
-	}
-
-	return path[strings.Index(path, vendorPath)+len(vendorPath):]
-}
-
 // isForbidden determines if an import is forbidden,
 // which is true when the import is:
 //   - of a package under the rootPackage
@@ -171,7 +159,7 @@ var rootPackage string
 
 func main() {
 	if len(os.Args) != 3 {
-		log.Fatalf("Usage: %s ROOT RESTRICTIONS.yaml", os.Args[0])
+		log.Fatalf("Usage: %s <root> <restrictions.yaml>", os.Args[0])
 	}
 
 	rootPackage = os.Args[1]
@@ -183,15 +171,24 @@ func main() {
 
 	foundForbiddenImports := false
 	for _, restriction := range importRestrictions {
-		log.Printf("Inspecting imports under %s...\n", restriction.BaseDir)
+		baseDir := restriction.BaseDir
-		packages, err := resolvePackageTree(restriction.BaseDir)
+		if filepath.IsAbs(baseDir) {
+			log.Fatalf("%q appears to be an absolute path", baseDir)
+		}
+		if !strings.HasPrefix(baseDir, "./") {
+			baseDir = "./" + baseDir
+		}
+		baseDir = strings.TrimRight(baseDir, "/")
+		log.Printf("Inspecting imports under %s/...\n", baseDir)
+
+		packages, err := resolvePackageTree(baseDir)
 		if err != nil {
 			log.Fatalf("Failed to resolve package tree: %v", err)
 		} else if len(packages) == 0 {
-			log.Fatalf("Found no packages under tree %s", restriction.BaseDir)
+			log.Fatalf("Found no packages under tree %s", baseDir)
 		}
 
-		log.Printf("- validating imports for %d packages in the tree", len(packages))
+		log.Printf("- validating imports for %d packages", len(packages))
 		restrictionViolated := false
 		for _, pkg := range packages {
 			if forbidden, err := restriction.ForbiddenImportsFor(pkg); err != nil {
@@ -229,25 +226,9 @@ func loadImportRestrictions(configFile string) ([]ImportRestriction, error) {
 }
 
 func resolvePackageTree(treeBase string) ([]Package, error) {
-	// try resolving with $cwd
-	packages, err := resolvePackageTreeInDir("", treeBase)
-	if err != nil || len(packages) == 0 {
-		// if that fails or finds no packages, resolve under ./vendor/$treeBase
-		stagingPackages, stagingErr := resolvePackageTreeInDir(filepath.Join("./vendor", treeBase), treeBase)
-		if stagingErr == nil && len(stagingPackages) > 0 {
-			// if that succeeds, return
-			return stagingPackages, stagingErr
-		}
-	}
-	// otherwise, return original packages and error
-	return packages, err
-}
-
-func resolvePackageTreeInDir(dir string, treeBase string) ([]Package, error) {
 	cmd := "go"
-	args := []string{"list", "-json", fmt.Sprintf("%s...", treeBase)}
+	args := []string{"list", "-json", fmt.Sprintf("%s/...", treeBase)}
 	c := exec.Command(cmd, args...)
-	c.Dir = dir
 	stdout, err := c.Output()
 	if err != nil {
 		var message string

cmd/preferredimports/preferredimports.go

@@ -200,10 +200,6 @@ func (c *collector) handlePath(path string, info os.FileInfo, err error) error {
 	if info.IsDir() {
 		// Ignore hidden directories (.git, .cache, etc)
 		if len(path) > 1 && path[0] == '.' ||
-			// Staging code is symlinked from vendor/k8s.io, and uses import
-			// paths as if it were inside of vendor/. It fails typechecking
-			// inside of staging/, but works when typechecked as part of vendor/.
-			path == "staging" ||
 			// OS-specific vendor code tends to be imported by OS-specific
 			// packages. We recursively typecheck imported vendored packages for
 			// each OS, but don't typecheck everything for every OS.

go.mod

@@ -6,7 +6,7 @@
 
 module k8s.io/kubernetes
 
-go 1.21
+go 1.22.0
 
 require (
 	bitbucket.org/bertimus9/systemstat v0.5.0
@@ -74,13 +74,13 @@ require (
 	go.uber.org/goleak v1.3.0
 	go.uber.org/zap v1.26.0
 	golang.org/x/crypto v0.19.0
-	golang.org/x/net v0.19.0
+	golang.org/x/net v0.21.0
 	golang.org/x/oauth2 v0.10.0
-	golang.org/x/sync v0.5.0
+	golang.org/x/sync v0.6.0
 	golang.org/x/sys v0.17.0
 	golang.org/x/term v0.17.0
 	golang.org/x/time v0.3.0
-	golang.org/x/tools v0.16.1
+	golang.org/x/tools v0.18.0
 	google.golang.org/api v0.126.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d
 	google.golang.org/grpc v1.58.3
@@ -104,12 +104,11 @@ require (
 	k8s.io/csi-translation-lib v0.0.0
 	k8s.io/dynamic-resource-allocation v0.0.0
 	k8s.io/endpointslice v0.0.0
-	k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01
 	k8s.io/klog/v2 v2.120.1
 	k8s.io/kms v0.0.0
 	k8s.io/kube-aggregator v0.0.0
 	k8s.io/kube-controller-manager v0.0.0
-	k8s.io/kube-openapi v0.0.0-20231113174909-778a5567bc1e
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
 	k8s.io/kube-proxy v0.0.0
 	k8s.io/kube-scheduler v0.0.0
 	k8s.io/kubectl v0.0.0
@@ -220,7 +219,7 @@ require (
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
-	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/mod v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
@@ -229,6 +228,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect

go.sum

@@ -352,7 +352,6 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -450,7 +449,6 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -558,7 +556,6 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -865,8 +862,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -909,8 +906,8 @@ golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLd
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -940,8 +937,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1006,6 +1003,7 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
@@ -1063,7 +1061,6 @@ golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjs
 golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
 golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -1083,8 +1080,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
+golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
-golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1242,7 +1239,6 @@ google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
@@ -1277,14 +1273,13 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 h1:pWEwq4Asjm4vjW7vcsmijwBhOr1/shsbSYiWXmNGlks=
+k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 h1:NGrVE502P0s0/1hudf8zjgwki1X/TByhmAoILTarmzo=
-k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20231113174909-778a5567bc1e h1:snPmy96t93RredGRjKfMFt+gvxuVAncqSAyBveJtr4Q=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
-k8s.io/kube-openapi v0.0.0-20231113174909-778a5567bc1e/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
 k8s.io/system-validators v1.8.0 h1:tq05tdO9zdJZnNF3SXrq6LE7Knc/KfJm5wk68467JDg=
 k8s.io/system-validators v1.8.0/go.mod h1:gP1Ky+R9wtrSiFbrpEPwWMeYz9yqyy1S/KOh0Vci7WI=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
@@ -1307,6 +1302,5 @@ sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 h1:W6cLQc5pnqM
 sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3/go.mod h1:JWP1Fj0VWGHyw3YUPjXSQnRnrwezrZSrApfX5S0nIag=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

go.work

@@ -0,0 +1,35 @@
+go 1.22.0
+
+use (
+	.
+	./staging/src/k8s.io/api
+	./staging/src/k8s.io/apiextensions-apiserver
+	./staging/src/k8s.io/apimachinery
+	./staging/src/k8s.io/apiserver
+	./staging/src/k8s.io/cli-runtime
+	./staging/src/k8s.io/client-go
+	./staging/src/k8s.io/cloud-provider
+	./staging/src/k8s.io/cluster-bootstrap
+	./staging/src/k8s.io/code-generator
+	./staging/src/k8s.io/component-base
+	./staging/src/k8s.io/component-helpers
+	./staging/src/k8s.io/controller-manager
+	./staging/src/k8s.io/cri-api
+	./staging/src/k8s.io/csi-translation-lib
+	./staging/src/k8s.io/dynamic-resource-allocation
+	./staging/src/k8s.io/endpointslice
+	./staging/src/k8s.io/kms
+	./staging/src/k8s.io/kube-aggregator
+	./staging/src/k8s.io/kube-controller-manager
+	./staging/src/k8s.io/kube-proxy
+	./staging/src/k8s.io/kube-scheduler
+	./staging/src/k8s.io/kubectl
+	./staging/src/k8s.io/kubelet
+	./staging/src/k8s.io/legacy-cloud-providers
+	./staging/src/k8s.io/metrics
+	./staging/src/k8s.io/mount-utils
+	./staging/src/k8s.io/pod-security-admission
+	./staging/src/k8s.io/sample-apiserver
+	./staging/src/k8s.io/sample-cli-plugin
+	./staging/src/k8s.io/sample-controller
+)

go.work.sum

@@ -0,0 +1,249 @@
+bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898 h1:SC+c6A1qTFstO9qmB86mPV2IpYme/2ZoEQ0hrP+wo+Q=
+cloud.google.com/go/accessapproval v1.7.1 h1:/5YjNhR6lzCvmJZAnByYkfEgWjfAKwYP6nkuTk6nKFE=
+cloud.google.com/go/accesscontextmanager v1.8.1 h1:WIAt9lW9AXtqw/bnvrEUaE8VG/7bAAeMzRCBGMkc4+w=
+cloud.google.com/go/aiplatform v1.48.0 h1:M5davZWCTzE043rJCn+ZLW6hSxfG1KAx4vJTtas2/ec=
+cloud.google.com/go/analytics v0.21.3 h1:TFBC1ZAqX9/jL56GEXdLrVe5vT3I22bDVWyDwZX4IEg=
+cloud.google.com/go/apigateway v1.6.1 h1:aBSwCQPcp9rZ0zVEUeJbR623palnqtvxJlUyvzsKGQc=
+cloud.google.com/go/apigeeconnect v1.6.1 h1:6u/jj0P2c3Mcm+H9qLsXI7gYcTiG9ueyQL3n6vCmFJM=
+cloud.google.com/go/apigeeregistry v0.7.1 h1:hgq0ANLDx7t2FDZDJQrCMtCtddR/pjCqVuvQWGrQbXw=
+cloud.google.com/go/appengine v1.8.1 h1:J+aaUZ6IbTpBegXbmEsh8qZZy864ZVnOoWyfa1XSNbI=
+cloud.google.com/go/area120 v0.8.1 h1:wiOq3KDpdqXmaHzvZwKdpoM+3lDcqsI2Lwhyac7stss=
+cloud.google.com/go/artifactregistry v1.14.1 h1:k6hNqab2CubhWlGcSzunJ7kfxC7UzpAfQ1UPb9PDCKI=
+cloud.google.com/go/asset v1.14.1 h1:vlHdznX70eYW4V1y1PxocvF6tEwxJTTarwIGwOhFF3U=
+cloud.google.com/go/assuredworkloads v1.11.1 h1:yaO0kwS+SnhVSTF7BqTyVGt3DTocI6Jqo+S3hHmCwNk=
+cloud.google.com/go/automl v1.13.1 h1:iP9iQurb0qbz+YOOMfKSEjhONA/WcoOIjt6/m+6pIgo=
+cloud.google.com/go/baremetalsolution v1.1.1 h1:0Ge9PQAy6cZ1tRrkc44UVgYV15nw2TVnzJzYsMHXF+E=
+cloud.google.com/go/batch v1.3.1 h1:uE0Q//W7FOGPjf7nuPiP0zoE8wOT3ngoIO2HIet0ilY=
+cloud.google.com/go/beyondcorp v1.0.0 h1:VPg+fZXULQjs8LiMeWdLaB5oe8G9sEoZ0I0j6IMiG1Q=
+cloud.google.com/go/bigquery v1.53.0 h1:K3wLbjbnSlxhuG5q4pntHv5AEbQM1QqHKGYgwFIqOTg=
+cloud.google.com/go/billing v1.16.0 h1:1iktEAIZ2uA6KpebC235zi/rCXDdDYQ0bTXTNetSL80=
+cloud.google.com/go/binaryauthorization v1.6.1 h1:cAkOhf1ic92zEN4U1zRoSupTmwmxHfklcp1X7CCBKvE=
+cloud.google.com/go/certificatemanager v1.7.1 h1:uKsohpE0hiobx1Eak9jNcPCznwfB6gvyQCcS28Ah9E8=
+cloud.google.com/go/channel v1.16.0 h1:dqRkK2k7Ll/HHeYGxv18RrfhozNxuTJRkspW0iaFZoY=
+cloud.google.com/go/cloudbuild v1.13.0 h1:YBbAWcvE4x6xPWTyS+OU4eiUpz5rCS3VCM/aqmfddPA=
+cloud.google.com/go/clouddms v1.6.1 h1:rjR1nV6oVf2aNNB7B5uz1PDIlBjlOiBgR+q5n7bbB7M=
+cloud.google.com/go/cloudtasks v1.12.1 h1:cMh9Q6dkvh+Ry5LAPbD/U2aw6KAqdiU6FttwhbTo69w=
+cloud.google.com/go/contactcenterinsights v1.10.0 h1:YR2aPedGVQPpFBZXJnPkqRj8M//8veIZZH5ZvICoXnI=
+cloud.google.com/go/container v1.24.0 h1:N51t/cgQJFqDD/W7Mb+IvmAPHrf8AbPx7Bb7aF4lROE=
+cloud.google.com/go/containeranalysis v0.10.1 h1:SM/ibWHWp4TYyJMwrILtcBtYKObyupwOVeceI9pNblw=
+cloud.google.com/go/datacatalog v1.16.0 h1:qVeQcw1Cz93/cGu2E7TYUPh8Lz5dn5Ws2siIuQ17Vng=
+cloud.google.com/go/dataflow v0.9.1 h1:VzG2tqsk/HbmOtq/XSfdF4cBvUWRK+S+oL9k4eWkENQ=
+cloud.google.com/go/dataform v0.8.1 h1:xcWso0hKOoxeW72AjBSIp/UfkvpqHNzzS0/oygHlcqY=
+cloud.google.com/go/datafusion v1.7.1 h1:eX9CZoyhKQW6g1Xj7+RONeDj1mV8KQDKEB9KLELX9/8=
+cloud.google.com/go/datalabeling v0.8.1 h1:zxsCD/BLKXhNuRssen8lVXChUj8VxF3ofN06JfdWOXw=
+cloud.google.com/go/dataplex v1.9.0 h1:yoBWuuUZklYp7nx26evIhzq8+i/nvKYuZr1jka9EqLs=
+cloud.google.com/go/dataproc/v2 v2.0.1 h1:4OpSiPMMGV3XmtPqskBU/RwYpj3yMFjtMLj/exi425Q=
+cloud.google.com/go/dataqna v0.8.1 h1:ITpUJep04hC9V7C+gcK390HO++xesQFSUJ7S4nSnF3U=
+cloud.google.com/go/datastore v1.13.0 h1:ktbC66bOQB3HJPQe8qNI1/aiQ77PMu7hD4mzE6uxe3w=
+cloud.google.com/go/datastream v1.10.0 h1:ra/+jMv36zTAGPfi8TRne1hXme+UsKtdcK4j6bnqQiw=
+cloud.google.com/go/deploy v1.13.0 h1:A+w/xpWgz99EYzB6e31gMGAI/P5jTZ2UO7veQK5jQ8o=
+cloud.google.com/go/dialogflow v1.40.0 h1:sCJbaXt6ogSbxWQnERKAzos57f02PP6WkGbOZvXUdwc=
+cloud.google.com/go/dlp v1.10.1 h1:tF3wsJ2QulRhRLWPzWVkeDz3FkOGVoMl6cmDUHtfYxw=
+cloud.google.com/go/documentai v1.22.0 h1:dW8ex9yb3oT9s1yD2+yLcU8Zq15AquRZ+wd0U+TkxFw=
+cloud.google.com/go/domains v0.9.1 h1:rqz6KY7mEg7Zs/69U6m6LMbB7PxFDWmT3QWNXIqhHm0=
+cloud.google.com/go/edgecontainer v1.1.1 h1:zhHWnLzg6AqzE+I3gzJqiIwHfjEBhWctNQEzqb+FaRo=
+cloud.google.com/go/errorreporting v0.3.0 h1:kj1XEWMu8P0qlLhm3FwcaFsUvXChV/OraZwA70trRR0=
+cloud.google.com/go/essentialcontacts v1.6.2 h1:OEJ0MLXXCW/tX1fkxzEZOsv/wRfyFsvDVNaHWBAvoV0=
+cloud.google.com/go/eventarc v1.13.0 h1:xIP3XZi0Xawx8DEfh++mE2lrIi5kQmCr/KcWhJ1q0J4=
+cloud.google.com/go/filestore v1.7.1 h1:Eiz8xZzMJc5ppBWkuaod/PUdUZGCFR8ku0uS+Ah2fRw=
+cloud.google.com/go/firestore v1.11.0 h1:PPgtwcYUOXV2jFe1bV3nda3RCrOa8cvBjTOn2MQVfW8=
+cloud.google.com/go/functions v1.15.1 h1:LtAyqvO1TFmNLcROzHZhV0agEJfBi+zfMZsF4RT/a7U=
+cloud.google.com/go/gkebackup v1.3.0 h1:lgyrpdhtJKV7l1GM15YFt+OCyHMxsQZuSydyNmS0Pxo=
+cloud.google.com/go/gkeconnect v0.8.1 h1:a1ckRvVznnuvDWESM2zZDzSVFvggeBaVY5+BVB8tbT0=
+cloud.google.com/go/gkehub v0.14.1 h1:2BLSb8i+Co1P05IYCKATXy5yaaIw/ZqGvVSBTLdzCQo=
+cloud.google.com/go/gkemulticloud v1.0.0 h1:MluqhtPVZReoriP5+adGIw+ij/RIeRik8KApCW2WMTw=
+cloud.google.com/go/gsuiteaddons v1.6.1 h1:mi9jxZpzVjLQibTS/XfPZvl+Jr6D5Bs8pGqUjllRb00=
+cloud.google.com/go/iam v1.1.1 h1:lW7fzj15aVIXYHREOqjRBV9PsH0Z6u8Y46a1YGvQP4Y=
+cloud.google.com/go/iap v1.8.1 h1:X1tcp+EoJ/LGX6cUPt3W2D4H2Kbqq0pLAsldnsCjLlE=
+cloud.google.com/go/ids v1.4.1 h1:khXYmSoDDhWGEVxHl4c4IgbwSRR+qE/L4hzP3vaU9Hc=
+cloud.google.com/go/iot v1.7.1 h1:yrH0OSmicD5bqGBoMlWG8UltzdLkYzNUwNVUVz7OT54=
+cloud.google.com/go/kms v1.15.0 h1:xYl5WEaSekKYN5gGRyhjvZKM22GVBBCzegGNVPy+aIs=
+cloud.google.com/go/language v1.10.1 h1:3MXeGEv8AlX+O2LyV4pO4NGpodanc26AmXwOuipEym0=
+cloud.google.com/go/lifesciences v0.9.1 h1:axkANGx1wiBXHiPcJZAE+TDjjYoJRIDzbHC/WYllCBU=
+cloud.google.com/go/logging v1.7.0 h1:CJYxlNNNNAMkHp9em/YEXcfJg+rPDg7YfwoRpMU+t5I=
+cloud.google.com/go/longrunning v0.5.1 h1:Fr7TXftcqTudoyRJa113hyaqlGdiBQkp0Gq7tErFDWI=
+cloud.google.com/go/managedidentities v1.6.1 h1:2/qZuOeLgUHorSdxSQGtnOu9xQkBn37+j+oZQv/KHJY=
+cloud.google.com/go/maps v1.4.0 h1:PdfgpBLhAoSzZrQXP+/zBc78fIPLZSJp5y8+qSMn2UU=
+cloud.google.com/go/mediatranslation v0.8.1 h1:50cF7c1l3BanfKrpnTCaTvhf+Fo6kdF21DG0byG7gYU=
+cloud.google.com/go/memcache v1.10.1 h1:7lkLsF0QF+Mre0O/NvkD9Q5utUNwtzvIYjrOLOs0HO0=
+cloud.google.com/go/metastore v1.12.0 h1:+9DsxUOHvsqvC0ylrRc/JwzbXJaaBpfIK3tX0Lx8Tcc=
+cloud.google.com/go/monitoring v1.15.1 h1:65JhLMd+JiYnXr6j5Z63dUYCuOg770p8a/VC+gil/58=
+cloud.google.com/go/networkconnectivity v1.12.1 h1:LnrYM6lBEeTq+9f2lR4DjBhv31EROSAQi/P5W4Q0AEc=
+cloud.google.com/go/networkmanagement v1.8.0 h1:/3xP37eMxnyvkfLrsm1nv1b2FbMMSAEAOlECTvoeCq4=
+cloud.google.com/go/networksecurity v0.9.1 h1:TBLEkMp3AE+6IV/wbIGRNTxnqLXHCTEQWoxRVC18TzY=
+cloud.google.com/go/notebooks v1.9.1 h1:CUqMNEtv4EHFnbogV+yGHQH5iAQLmijOx191innpOcs=
+cloud.google.com/go/optimization v1.4.1 h1:pEwOAmO00mxdbesCRSsfj8Sd4rKY9kBrYW7Vd3Pq7cA=
+cloud.google.com/go/orchestration v1.8.1 h1:KmN18kE/xa1n91cM5jhCh7s1/UfIguSCisw7nTMUzgE=
+cloud.google.com/go/orgpolicy v1.11.1 h1:I/7dHICQkNwym9erHqmlb50LRU588NPCvkfIY0Bx9jI=
+cloud.google.com/go/osconfig v1.12.1 h1:dgyEHdfqML6cUW6/MkihNdTVc0INQst0qSE8Ou1ub9c=
+cloud.google.com/go/oslogin v1.10.1 h1:LdSuG3xBYu2Sgr3jTUULL1XCl5QBx6xwzGqzoDUw1j0=
+cloud.google.com/go/phishingprotection v0.8.1 h1:aK/lNmSd1vtbft/vLe2g7edXK72sIQbqr2QyrZN/iME=
+cloud.google.com/go/policytroubleshooter v1.8.0 h1:XTMHy31yFmXgQg57CB3w9YQX8US7irxDX0Fl0VwlZyY=
+cloud.google.com/go/privatecatalog v0.9.1 h1:B/18xGo+E0EMS9LOEQ0zXz7F2asMgmVgTYGSI89MHOA=
+cloud.google.com/go/pubsub v1.33.0 h1:6SPCPvWav64tj0sVX/+npCBKhUi/UjJehy9op/V3p2g=
+cloud.google.com/go/pubsublite v1.8.1 h1:pX+idpWMIH30/K7c0epN6V703xpIcMXWRjKJsz0tYGY=
+cloud.google.com/go/recaptchaenterprise/v2 v2.7.2 h1:IGkbudobsTXAwmkEYOzPCQPApUCsN4Gbq3ndGVhHQpI=
+cloud.google.com/go/recommendationengine v0.8.1 h1:nMr1OEVHuDambRn+/y4RmNAmnR/pXCuHtH0Y4tCgGRQ=
+cloud.google.com/go/recommender v1.10.1 h1:UKp94UH5/Lv2WXSQe9+FttqV07x/2p1hFTMMYVFtilg=
+cloud.google.com/go/redis v1.13.1 h1:YrjQnCC7ydk+k30op7DSjSHw1yAYhqYXFcOq1bSXRYA=
+cloud.google.com/go/resourcemanager v1.9.1 h1:QIAMfndPOHR6yTmMUB0ZN+HSeRmPjR/21Smq5/xwghI=
+cloud.google.com/go/resourcesettings v1.6.1 h1:Fdyq418U69LhvNPFdlEO29w+DRRjwDA4/pFamm4ksAg=
+cloud.google.com/go/retail v1.14.1 h1:gYBrb9u/Hc5s5lUTFXX1Vsbc/9BEvgtioY6ZKaK0DK8=
+cloud.google.com/go/run v1.2.0 h1:kHeIG8q+N6Zv0nDkBjSOYfK2eWqa5FnaiDPH/7/HirE=
+cloud.google.com/go/scheduler v1.10.1 h1:yoZbZR8880KgPGLmACOMCiY2tPk+iX4V/dkxqTirlz8=
+cloud.google.com/go/secretmanager v1.11.1 h1:cLTCwAjFh9fKvU6F13Y4L9vPcx9yiWPyWXE4+zkuEQs=
+cloud.google.com/go/security v1.15.1 h1:jR3itwycg/TgGA0uIgTItcVhA55hKWiNJxaNNpQJaZE=
+cloud.google.com/go/securitycenter v1.23.0 h1:XOGJ9OpnDtqg8izd7gYk/XUhj8ytjIalyjjsR6oyG0M=
+cloud.google.com/go/servicedirectory v1.11.0 h1:pBWpjCFVGWkzVTkqN3TBBIqNSoSHY86/6RL0soSQ4z8=
+cloud.google.com/go/shell v1.7.1 h1:aHbwH9LSqs4r2rbay9f6fKEls61TAjT63jSyglsw7sI=
+cloud.google.com/go/spanner v1.47.0 h1:aqiMP8dhsEXgn9K5EZBWxPG7dxIiyM2VaikqeU4iteg=
+cloud.google.com/go/speech v1.19.0 h1:MCagaq8ObV2tr1kZJcJYgXYbIn8Ai5rp42tyGYw9rls=
+cloud.google.com/go/storage v1.10.0 h1:STgFzyU5/8miMl0//zKh2aQeTyeaUH3WN9bSUiJ09bA=
+cloud.google.com/go/storagetransfer v1.10.0 h1:+ZLkeXx0K0Pk5XdDmG0MnUVqIR18lllsihU/yq39I8Q=
+cloud.google.com/go/talent v1.6.2 h1:j46ZgD6N2YdpFPux9mc7OAf4YK3tiBCsbLKc8rQx+bU=
+cloud.google.com/go/texttospeech v1.7.1 h1:S/pR/GZT9p15R7Y2dk2OXD/3AufTct/NSxT4a7nxByw=
+cloud.google.com/go/tpu v1.6.1 h1:kQf1jgPY04UJBYYjNUO+3GrZtIb57MfGAW2bwgLbR3A=
+cloud.google.com/go/trace v1.10.1 h1:EwGdOLCNfYOOPtgqo+D2sDLZmRCEO1AagRTJCU6ztdg=
+cloud.google.com/go/translate v1.8.2 h1:PQHamiOzlehqLBJMnM72lXk/OsMQewZB12BKJ8zXrU0=
+cloud.google.com/go/video v1.19.0 h1:BRyyS+wU+Do6VOXnb8WfPr42ZXti9hzmLKLUCkggeK4=
+cloud.google.com/go/videointelligence v1.11.1 h1:MBMWnkQ78GQnRz5lfdTAbBq/8QMCF3wahgtHh3s/J+k=
+cloud.google.com/go/vision/v2 v2.7.2 h1:ccK6/YgPfGHR/CyESz1mvIbsht5Y2xRsWCPqmTNydEw=
+cloud.google.com/go/vmmigration v1.7.1 h1:gnjIclgqbEMc+cF5IJuPxp53wjBIlqZ8h9hE8Rkwp7A=
+cloud.google.com/go/vmwareengine v1.0.0 h1:qsJ0CPlOQu/3MFBGklu752v3AkD+Pdu091UmXJ+EjTA=
+cloud.google.com/go/vpcaccess v1.7.1 h1:ram0GzjNWElmbxXMIzeOZUkQ9J8ZAahD6V8ilPGqX0Y=
+cloud.google.com/go/webrisk v1.9.1 h1:Ssy3MkOMOnyRV5H2bkMQ13Umv7CwB/kugo3qkAX83Fk=
+cloud.google.com/go/websecurityscanner v1.6.1 h1:CfEF/vZ+xXyAR3zC9iaC/QRdf1MEgS20r5UR17Q4gOg=
+cloud.google.com/go/workflows v1.11.1 h1:2akeQ/PgtRhrNuD/n1WvJd5zb7YyuDZrlOanBj2ihPg=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9 h1:VpgP7xuJadIUuKccphEpTJnWhS2jkQyMt6Y7pJCD7fY=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802 h1:1BDTz0u9nC3//pOCMdNH+CiXJVYJh5UQNCOBG7jbELc=
+github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
+github.com/alecthomas/kingpin/v2 v2.3.2 h1:H0aULhgmSzN8xQ3nX1uxtdlTHYoPLu5AhHxWrKI6ocU=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
+github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6 h1:G1bPvciwNyF7IUmKXNt9Ak3m6u9DE1rF+RmtIkBpVdA=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da h1:8GUt8eRujhVEGZFFEjBj46YV4rDjvGrNxb0KMWYkL2I=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 h1:BUAU3CGlLvorLI26FmByPp2eC2qla6E1Tw+scpcg/to=
+github.com/aws/aws-sdk-go v1.35.24 h1:U3GNTg8+7xSM6OAJ8zksiSM4bRqxBWmVwwehvOSNG3A=
+github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
+github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c h1:+0HFd5KSZ/mm3JmhmrDukiId5iR6w4+BdFtfSy4yWIc=
+github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
+github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
+github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
+github.com/containerd/containerd v1.4.9 h1:JIw9mjVw4LsGmnA/Bqg9j9e+XB7soOJufrKUpA6n2Ns=
+github.com/containerd/continuity v0.1.0 h1:UFRRY5JemiAhPZrr/uE0n8fMTLcZsUvySPr1+D7pgr8=
+github.com/containerd/fifo v1.0.0 h1:6PirWBr9/L7GDamKr+XM0IeUFXu5mf3M/BPpH9gaLBU=
+github.com/containerd/go-runc v1.0.0 h1:oU+lLv1ULm5taqgV/CJivypVODI4SUz1znWjv3nNYS0=
+github.com/coreos/bbolt v1.3.2 h1:wZwiHHUieZCquLkDL0B8UhzreNWsPHooDAG3q34zk0s=
+github.com/coreos/etcd v3.3.13+incompatible h1:8F3hqu9fGYLBifCmRCJsicFqDx/D68Rt3q1JMazcgBQ=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f h1:lBNOc5arjvs8E5mO2tbpBpLoyyu8B6e44T7hJy6potg=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954 h1:RMLoZVzv4GliuWafOuPuQDKSm1SJph7uCRnnS61JAn4=
+github.com/envoyproxy/go-control-plane v0.11.1 h1:wSUXTlLfiAQRWs2F+p+EKOY9rUyis1MyGqJ2DIk5HpM=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1 h1:QbL/5oDUmRBzO9/Z7Seo6zf912W/a6Sr4Eu0G/3Jho0=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4 h1:WtGNWLvXpe6ZudgnXrq0barxBImvnnJoMEhXAzcbM0I=
+github.com/go-kit/kit v0.9.0 h1:wDJmvq38kDhkVxi50ni9ykkdUr1PKgqKOoi01fa0Mdk=
+github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
+github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
+github.com/gogo/googleapis v1.4.1 h1:1Yx4Myt7BxzvUr5ldGSbwYiZG6t9wGBZ+8/fX3Wvtq0=
+github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
+github.com/golangplus/bytes v1.0.0 h1:YQKBijBVMsBxIiXT4IEhlKR2zHohjEqPole4umyDX+c=
+github.com/golangplus/fmt v1.0.0 h1:FnUKtw86lXIPfBMc3FimNF3+ABcV+aH5F17OOitTN+E=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/google/martian/v3 v3.2.1 h1:d8MncMlErDFTwQGBK1xhv026j9kqhvw1Qv9IbWT1VLQ=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
+github.com/hashicorp/consul/api v1.1.0 h1:BNQPM9ytxj6jbjjdRPioQ94T6YXriSopn0i8COv6SRA=
+github.com/hashicorp/consul/sdk v0.1.1 h1:LnuDWGNsoajlhGyHJvuWW6FVqRl8JOTPqS6CPTsYjhY=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
+github.com/hashicorp/go-immutable-radix v1.0.0 h1:AKDB1HM5PWEA7i4nhcpwOrO2byshxBjXVn/J/3+z5/0=
+github.com/hashicorp/go-msgpack v0.5.3 h1:zKjpN5BK/P5lMYrLmBHdBULWbJ0XpYR+7NGzqkZzoD4=
+github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
+github.com/hashicorp/go-rootcerts v1.0.0 h1:Rqb66Oo1X/eSV1x66xbDccZjhJigjg0+e82kpwzSwCI=
+github.com/hashicorp/go-sockaddr v1.0.0 h1:GeH6tui99pF4NJgfnhp+L6+FfobzVW3Ah46sLo0ICXs=
+github.com/hashicorp/go-syslog v1.0.0 h1:KaodqZuhUoZereWVIYmpUgZysurB1kBLX2j0MwMrUAE=
+github.com/hashicorp/go-uuid v1.0.1 h1:fv1ep09latC32wFoVwnqcnKJGnMSdBanPczbHAYm1BE=
+github.com/hashicorp/go.net v0.0.1 h1:sNCoNyDEvN1xa+X0baata4RdcpKwcMS6DH+xwfqPgjw=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
+github.com/hashicorp/mdns v1.0.0 h1:WhIgCr5a7AaVH6jPUwjtRuuE7/RDufnUvzIr48smyxs=
+github.com/hashicorp/memberlist v0.1.3 h1:EmmoJme1matNzb+hMpDuR/0sbJSUisxyqBGG676r31M=
+github.com/hashicorp/serf v0.8.2 h1:YZ7UKsJv+hKjqGVUUbtE3HNj79Eln2oQ75tniF6iPt0=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639 h1:mV02weKRL81bEnm8A0HT1/CAelMQDBuQIfLw8n+d6xI=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
+github.com/jstemmer/go-junit-report v0.9.1 h1:6QPYqodiu3GuPL+7mfx+NwDdp2eTkp9IfEUpgAwUN0o=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/kisielk/errcheck v1.5.0 h1:e8esj/e4R+SAOwFwN+n3zr0nYeCyeweozKfO23MvHzY=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY=
+github.com/kr/pty v1.1.1 h1:VkoXIwSboBpnk99O/KFauAEILuNHv5DVFKZMBN/gUgw=
+github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
+github.com/miekg/dns v1.0.14 h1:9jZdLNd/P4+SfEJ0TNyxYpsK8N4GtfylBLqtbYN1sbA=
+github.com/mitchellh/cli v1.0.0 h1:iGBIsUe3+HZ/AD/Vd7DErOt5sU9fa8Uj7A2s1aggv1Y=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/gox v0.4.0 h1:lfGJxY7ToLJQjHHwi0EX6uYBdK78egf954SQl13PQJc=
+github.com/mitchellh/iochan v1.0.0 h1:C+X3KsSTLFVBr/tK1eYN/vs4rJcvsiLU338UhYPJWeY=
+github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
+github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c h1:Lgl0gzECD8GnQ5QCWA8o6BtfL6mDH5rQgM4/fX3avOs=
+github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
+github.com/posener/complete v1.1.1 h1:ccV59UEOTzVDnDUEFdT95ZzHVZ+5+158q8+SJb2QV5w=
+github.com/prometheus/tsdb v0.7.1 h1:YZcsG11NqnK4czYLrWd9mpEuAJIHVQLwdrleYfszMAA=
+github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f h1:UFr9zpz4xgTnIE5yIMtWAMngCdZ9p/+q6lTbgelo80M=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
+github.com/spf13/afero v1.1.2 h1:m8/z1t7/fwjysjQRYbP0RD+bUIF/8tJwPdEZsI83ACI=
+github.com/spf13/cast v1.3.0 h1:oget//CVOEoFewqQxwr0Ej5yjygnqGkvggSE/gB35Q8=
+github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
+github.com/spf13/viper v1.7.0 h1:xVKxvI7ouOI5I+U9s2eeiUfMaWBVoXA3AWskkrqK0VM=
+github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
+github.com/ugorji/go v1.1.4 h1:j4s+tAvLfL3bZyefP2SEWmhBzmuIlH/eqNuPdFPgngw=
+github.com/urfave/cli v1.22.2 h1:gsqYFH8bb9ekPA12kRo0hfjngWQjkJPlN9R0N78BoUo=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77 h1:ESFSdwYZvkeru3RtdrYueztKhOBCSAAzS4Gf+k0tEow=
+github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
+go.etcd.io/gofail v0.1.0 h1:XItAMIhOojXFQMgrxjnd2EIIHun/d5qL0Pf7FzVTkFg=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b h1:+qEpEAPhDZ1o0x3tHzZTQDArnOixOzGD9HUJfcg0mb4=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
+golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808 h1:+Kc94D8UVEVxJnLXp/+FMfqQARZtWHfVrcRtcG8aT3g=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc h1:g3hIDl0jRNd9PPTs2uBzYuaD5mQuwOkZY0vSc0LR32o=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQfGwJD30Nv2jfUgzb5UcE=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
+gopkg.in/ini.v1 v1.51.0 h1:AQvPpx3LzTDM0AjnIRlVFwFFGC+npRopjZxLJj6gdno=
+gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
+honnef.co/go/tools v0.0.1-2020.1.4 h1:UoveltGrhghAA7ePc+e+QYDHXrBps2PqFZiHkGR/xK8=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/quote/v3 v3.1.0 h1:9JKUTTIUgS6kzR9mK1YuGKv6Nl+DijDNIc0ghT58FaY=
+rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=
+sigs.k8s.io/kustomize/cmd/config v0.11.2 h1:YyoHHbxxsLUts/gWLGgIQkdT82ekp3zautbpcml54vc=

hack/_update-generated-protobuf-dockerized.sh

@@ -30,18 +30,19 @@ source "${KUBE_ROOT}/hack/lib/protoc.sh"
 kube::protoc::check_protoc
 kube::golang::setup_env
 
-GO111MODULE=on GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf
+GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf
-GO111MODULE=on GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo
+GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo
-
-gotoprotobuf=$(kube::util::find-binary "go-to-protobuf")
 
 # requires the 'proto' tag to build (will remove when ready)
 # searches for the protoc-gen-gogo extension in the output directory
 # satisfies import of github.com/gogo/protobuf/gogoproto/gogo.proto and the
 # core Google protobuf types
 PATH="${KUBE_ROOT}/_output/bin:${PATH}" \
-  "${gotoprotobuf}" \
+  go-to-protobuf \
-  --proto-import="${KUBE_ROOT}/vendor" \
+  -v "${KUBE_VERBOSE}" \
+  --go-header-file "${KUBE_ROOT}/hack/boilerplate/boilerplate.generatego.txt" \
+  --output-dir="${KUBE_ROOT}/staging/src" \
+  --proto-import="${KUBE_ROOT}/staging/src" \
+  --proto-import="${KUBE_ROOT}/vendor" `# required for gogo.proto` \
   --proto-import="${KUBE_ROOT}/third_party/protobuf" \
-  --packages="$(IFS=, ; echo "$*")" \
+  --packages="$(IFS=, ; echo "$*")"
-  --go-header-file "${KUBE_ROOT}/hack/boilerplate/boilerplate.generatego.txt"

hack/boilerplate/boilerplate.py

@@ -147,11 +147,11 @@ def file_extension(filename):
 
 skipped_names = [
     "third_party",
-    "_gopath",
     "_output",
     ".git",
     "cluster/env.sh",
     "vendor",
+    "testdata",
     "test/e2e/generated/bindata.go",
     "hack/boilerplate/test",
     "staging/src/k8s.io/kubectl/pkg/generated/bindata.go",

hack/lib/golang.sh

@@ -16,8 +16,6 @@
 
 # shellcheck disable=SC2034 # Variables sourced in other scripts.
 
-# The golang package that we are building.
-readonly KUBE_GO_PACKAGE=k8s.io/kubernetes
 readonly KUBE_GOPATH="${KUBE_GOPATH:-"${KUBE_OUTPUT}/go"}"
 export KUBE_GOPATH
 
@@ -76,9 +74,9 @@ kube::golang::server_targets() {
     cmd/kubelet
     cmd/kubeadm
     cmd/kube-scheduler
-    vendor/k8s.io/component-base/logs/kube-log-runner
+    staging/src/k8s.io/component-base/logs/kube-log-runner
-    vendor/k8s.io/kube-aggregator
+    staging/src/k8s.io/kube-aggregator
-    vendor/k8s.io/apiextensions-apiserver
+    staging/src/k8s.io/apiextensions-apiserver
     cluster/gce/gci/mounter
   )
   echo "${targets[@]}"
@@ -126,7 +124,7 @@ kube::golang::node_targets() {
     cmd/kube-proxy
     cmd/kubeadm
     cmd/kubelet
-    vendor/k8s.io/component-base/logs/kube-log-runner
+    staging/src/k8s.io/component-base/logs/kube-log-runner
   )
   echo "${targets[@]}"
 }
@@ -318,7 +316,7 @@ readonly KUBE_ALL_TARGETS=(
 )
 readonly KUBE_ALL_BINARIES=("${KUBE_ALL_TARGETS[@]##*/}")
 
-readonly KUBE_STATIC_LIBRARIES=(
+readonly KUBE_STATIC_BINARIES=(
   apiextensions-apiserver
   kube-aggregator
   kube-apiserver
@@ -344,16 +342,16 @@ readonly KUBE_COVERAGE_INSTRUMENTED_PACKAGES=(
 
 # KUBE_CGO_OVERRIDES is a space-separated list of binaries which should be built
 # with CGO enabled, assuming CGO is supported on the target platform.
-# This overrides any entry in KUBE_STATIC_LIBRARIES.
+# This overrides any entry in KUBE_STATIC_BINARIES.
 IFS=" " read -ra KUBE_CGO_OVERRIDES_LIST <<< "${KUBE_CGO_OVERRIDES:-}"
 readonly KUBE_CGO_OVERRIDES_LIST
 # KUBE_STATIC_OVERRIDES is a space-separated list of binaries which should be
 # built with CGO disabled. This is in addition to the list in
-# KUBE_STATIC_LIBRARIES.
+# KUBE_STATIC_BINARIES.
 IFS=" " read -ra KUBE_STATIC_OVERRIDES_LIST <<< "${KUBE_STATIC_OVERRIDES:-}"
 readonly KUBE_STATIC_OVERRIDES_LIST
 
-kube::golang::is_statically_linked_library() {
+kube::golang::is_statically_linked() {
   local e
   # Explicitly enable cgo when building kubectl for darwin from darwin.
   [[ "$(go env GOHOSTOS)" == "darwin" && "$(go env GOOS)" == "darwin" &&
@@ -361,16 +359,18 @@ kube::golang::is_statically_linked_library() {
   if [[ -n "${KUBE_CGO_OVERRIDES_LIST:+x}" ]]; then
     for e in "${KUBE_CGO_OVERRIDES_LIST[@]}"; do [[ "${1}" == *"/${e}" ]] && return 1; done;
   fi
-  for e in "${KUBE_STATIC_LIBRARIES[@]}"; do [[ "${1}" == *"/${e}" ]] && return 0; done;
+  for e in "${KUBE_STATIC_BINARIES[@]}"; do [[ "${1}" == *"/${e}" ]] && return 0; done;
   if [[ -n "${KUBE_STATIC_OVERRIDES_LIST:+x}" ]]; then
     for e in "${KUBE_STATIC_OVERRIDES_LIST[@]}"; do [[ "${1}" == *"/${e}" ]] && return 0; done;
   fi
   return 1;
 }
 
-# kube::binaries_from_targets take a list of build targets and return the
+# kube::golang::best_guess_go_targets takes a list of build targets, which might
-# full go package to be built
+# be Go-style names (e.g. example.com/foo/bar or ./foo/bar) or just local paths
-kube::golang::binaries_from_targets() {
+# (e.g. foo/bar) and produces a respective list (on stdout) of our best guess at
+# Go target names.
+kube::golang::best_guess_go_targets() {
   local target
   for target; do
     if [ "${target}" = "ginkgo" ] ||
@@ -380,17 +380,72 @@ kube::golang::binaries_from_targets() {
       # "ginkgo" is the one that is documented in the Makefile. The others
       # are for backwards compatibility.
       echo "github.com/onsi/ginkgo/v2/ginkgo"
-    elif [[ "${target}" =~ ^([[:alnum:]]+".")+[[:alnum:]]+"/" ]]; then
+      continue
-      # If the target starts with what looks like a domain name, assume it has a
-      # fully-qualified package name rather than one that needs the Kubernetes
-      # package prepended.
-      echo "${target}"
-    elif [[ "${target}" =~ ^vendor/ ]]; then
-      # Strip vendor/ prefix, since we're building in gomodule mode.
-      echo "${target#"vendor/"}"
-    else
-      echo "${KUBE_GO_PACKAGE}/${target}"
     fi
+
+    if [[ "${target}" =~ ^([[:alnum:]]+".")+[[:alnum:]]+"/" ]]; then
+      # If the target starts with what looks like a domain name, assume it has a
+      # fully-qualified Go package name.
+      echo "${target}"
+      continue
+    fi
+
+    if [[ "${target}" =~ ^vendor/ ]]; then
+      # Strip vendor/ prefix, since we're building in gomodule mode.  This is
+      # for backwards compatibility.
+      echo "${target#"vendor/"}"
+      continue
+    fi
+
+    # If the target starts with "./", assume it is a local path which qualifies
+    # as a Go target name.
+    if [[ "${target}" =~ ^\./ ]]; then
+      echo "${target}"
+      continue
+    fi
+
+    # Otherwise assume it's a relative path (e.g. foo/bar or foo/bar/bar.test).
+    # We probably SHOULDN'T accept this, but we did in the past and it would be
+    # rude to break things if we don't NEED to.  We can't really test if it
+    # exists or not, because the last element might be an output file (e.g.
+    # bar.test) or even "...".
+    echo "./${target}"
+  done
+}
+
+# kube::golang::normalize_go_targets takes a list of build targets, which might
+# be Go-style names (e.g. example.com/foo/bar or ./foo/bar) or just local paths
+# (e.g. foo/bar) and produces a respective list (on stdout) of Go package
+# names.
+#
+# If this cannot find (go list -find -e) one or more inputs, it will emit the
+# them on stdout, so callers can at least get a useful error.
+kube::golang::normalize_go_targets() {
+  local targets=()
+  kube::util::read-array targets < <(kube::golang::best_guess_go_targets "$@")
+  kube::util::read-array targets < <(kube::golang::dedup "${targets[@]}")
+  set -- "${targets[@]}"
+
+  for target; do
+    if [[ "${target}" =~ ".test"$ ]]; then
+      local dir
+      dir="$(dirname "${target}")"
+      local tst
+      tst="$(basename "${target}")"
+      local pkg
+      pkg="$(go list -find -e "${dir}")"
+      echo "${pkg}/${tst}"
+      continue
+    fi
+    if [[ "${target}" =~ "/..."$ ]]; then
+      local dir
+      dir="$(dirname "${target}")"
+      local pkg
+      pkg="$(go list -find -e "${dir}")"
+      echo "${pkg}/..."
+      continue
+    fi
+    go list -find -e "${target}"
   done
 }
 
@@ -446,25 +501,11 @@ kube::golang::set_platform_envs() {
   fi
 }
 
-# Create the GOPATH tree under $KUBE_OUTPUT
-kube::golang::create_gopath_tree() {
-  local go_pkg_dir="${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}"
-  local go_pkg_basedir
-  go_pkg_basedir=$(dirname "${go_pkg_dir}")
-
-  mkdir -p "${go_pkg_basedir}"
-
-  # TODO: This symlink should be relative.
-  if [[ ! -e "${go_pkg_dir}" || "$(readlink "${go_pkg_dir}")" != "${KUBE_ROOT}" ]]; then
-    ln -snf "${KUBE_ROOT}" "${go_pkg_dir}"
-  fi
-}
-
 # Ensure the go tool exists and is a viable version.
 # Inputs:
 #   env-var GO_VERSION is the desired go version to use, downloading it if needed (defaults to content of .go-version)
 #   env-var FORCE_HOST_GO set to a non-empty value uses the go version in the $PATH and skips ensuring $GO_VERSION is used
-kube::golang::verify_go_version() {
+kube::golang::internal::verify_go_version() {
   # default GO_VERSION to content of .go-version
   GO_VERSION="${GO_VERSION:-"$(cat "${KUBE_ROOT}/.go-version")"}"
   if [ "${GOTOOLCHAIN:-auto}" != 'auto' ]; then
@@ -515,20 +556,14 @@ EOF
 # Outputs:
 #   env-var GOPATH points to our local output dir
 #   env-var GOBIN is unset (we want binaries in a predictable place)
-#   env-var GO15VENDOREXPERIMENT=1
+#   env-var PATH includes the local GOPATH
-#   current directory is within GOPATH
 kube::golang::setup_env() {
-  kube::golang::verify_go_version
-
-  # Set up GOPATH.  We have tools which depend on being in a GOPATH (see
-  # hack/run-in-gopath.sh).
-  #
   # Even in module mode, we need to set GOPATH for `go build` and `go install`
   # to work.  We build various tools (usually via `go install`) from a lot of
   # scripts.
-  #   * We can't set GOBIN because that does not work on cross-compiles.
+  #   * We can't just set GOBIN because that does not work on cross-compiles.
-  #   * We could use `go build -o <something>`, but it's subtle when it comes
+  #   * We could always use `go build -o <something>`, but it's subtle wrt
-  #     to cross-compiles and whether the <something> is a file or a directory,
+  #     cross-compiles and whether the <something> is a file or a directory,
   #     and EVERY caller has to get it *just* right.
   #   * We could leave GOPATH alone and let `go install` write binaries
   #     wherever the user's GOPATH says (or doesn't say).
@@ -536,10 +571,6 @@ kube::golang::setup_env() {
   # Instead we set it to a phony local path and process the results ourselves.
   # In particular, GOPATH[0]/bin will be used for `go install`, with
   # cross-compiles adding an extra directory under that.
-  #
-  # Eventually, when we no longer rely on run-in-gopath.sh we may be able to
-  # simplify this some.
-  kube::golang::create_gopath_tree
   export GOPATH="${KUBE_GOPATH}"
 
   # If these are not set, set them now.  This ensures that any subsequent
@@ -550,23 +581,17 @@ kube::golang::setup_env() {
   # Make sure our own Go binaries are in PATH.
   export PATH="${KUBE_GOPATH}/bin:${PATH}"
 
-  # Change directories so that we are within the GOPATH.  Some tools get really
-  # upset if this is not true.  We use a whole fake GOPATH here to collect the
-  # resultant binaries.
-  local subdir
-  subdir=$(kube::realpath . | sed "s|${KUBE_ROOT}||")
-  cd "${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}/${subdir}" || return 1
-
-  # Set GOROOT so binaries that parse code can work properly.
-  GOROOT=$(go env GOROOT)
-  export GOROOT
-
   # Unset GOBIN in case it already exists in the current session.
   # Cross-compiles will not work with it set.
   unset GOBIN
 
-  # This seems to matter to some tools
+  # Turn on modules and workspaces (both are default-on).
-  export GO15VENDOREXPERIMENT=1
+  unset GO111MODULE
+  unset GOWORK
+
+  # This may try to download our specific Go version.  Do it last so it uses
+  # the above-configured environment.
+  kube::golang::internal::verify_go_version
 }
 
 kube::golang::setup_gomaxprocs() {
@@ -576,7 +601,7 @@ kube::golang::setup_gomaxprocs() {
     if ! command -v ncpu >/dev/null 2>&1; then
       # shellcheck disable=SC2164
       pushd "${KUBE_ROOT}/hack/tools" >/dev/null
-      GO111MODULE=on go install ./ncpu || echo "Will not automatically set GOMAXPROCS"
+      go install ./ncpu || echo "Will not automatically set GOMAXPROCS"
       # shellcheck disable=SC2164
       popd >/dev/null
     fi
@@ -589,10 +614,10 @@ kube::golang::setup_gomaxprocs() {
 }
 
 # This will take binaries from $GOPATH/bin and copy them to the appropriate
-# place in ${KUBE_OUTPUT_BINDIR}
+# place in ${KUBE_OUTPUT_BIN}
 #
 # Ideally this wouldn't be necessary and we could just set GOBIN to
-# KUBE_OUTPUT_BINDIR but that won't work in the face of cross compilation.  'go
+# KUBE_OUTPUT_BIN but that won't work in the face of cross compilation.  'go
 # install' will place binaries that match the host platform directly in $GOBIN
 # while placing cross compiled binaries into `platform_arch` subdirs.  This
 # complicates pretty much everything else we do around packaging and such.
@@ -610,14 +635,14 @@ kube::golang::place_bins() {
     if [[ "${platform}" == "${host_platform}" ]]; then
       platform_src=""
       rm -f "${THIS_PLATFORM_BIN}"
-      ln -s "${KUBE_OUTPUT_BINPATH}/${platform}" "${THIS_PLATFORM_BIN}"
+      ln -s "${KUBE_OUTPUT_BIN}/${platform}" "${THIS_PLATFORM_BIN}"
     fi
 
     local full_binpath_src="${KUBE_GOPATH}/bin${platform_src}"
     if [[ -d "${full_binpath_src}" ]]; then
-      mkdir -p "${KUBE_OUTPUT_BINPATH}/${platform}"
+      mkdir -p "${KUBE_OUTPUT_BIN}/${platform}"
       find "${full_binpath_src}" -maxdepth 1 -type f -exec \
-        rsync -pc {} "${KUBE_OUTPUT_BINPATH}/${platform}" \;
+        rsync -pc {} "${KUBE_OUTPUT_BIN}/${platform}" \;
     fi
   done
 }
@@ -660,7 +685,8 @@ kube::golang::is_instrumented_package() {
 # Echos the path to a dummy test used for coverage information.
 kube::golang::path_for_coverage_dummy_test() {
   local package="$1"
-  local path="${KUBE_GOPATH}/src/${package}"
+  local path
+  path=$(go list -find -f '{{.Dir}}' "${package}")
   local name
   name=$(basename "${package}")
   echo "${path}/zz_generated_${name}_test.go"
@@ -727,7 +753,7 @@ kube::golang::build_some_binaries() {
 
         go test -c -o "$(kube::golang::outfile_for_binary "${package}" "${platform}")" \
           -covermode count \
-          -coverpkg k8s.io/...,k8s.io/kubernetes/vendor/k8s.io/... \
+          -coverpkg k8s.io/... \
           "${build_args[@]}" \
           -tags coverage \
           "${package}"
@@ -737,14 +763,14 @@ kube::golang::build_some_binaries() {
     done
     if [[ "${#uncovered[@]}" != 0 ]]; then
       V=2 kube::log::info "Building ${uncovered[*]} without coverage..."
-      GO111MODULE=on GOPROXY=off go install "${build_args[@]}" "${uncovered[@]}"
+      GOPROXY=off go install "${build_args[@]}" "${uncovered[@]}"
     else
       V=2 kube::log::info "Nothing to build without coverage."
-     fi
+    fi
-   else
+  else
     V=2 kube::log::info "Coverage is disabled."
-    GO111MODULE=on GOPROXY=off go install "${build_args[@]}" "$@"
+    GOPROXY=off go install "${build_args[@]}" "$@"
-   fi
+  fi
 }
 
 # Args:
@@ -763,14 +789,14 @@ kube::golang::build_binaries_for_platform() {
     if [[ "${binary}" =~ ".test"$ ]]; then
       tests+=("${binary}")
       kube::log::info "    ${binary} (test)"
-    elif kube::golang::is_statically_linked_library "${binary}"; then
+    elif kube::golang::is_statically_linked "${binary}"; then
       statics+=("${binary}")
       kube::log::info "    ${binary} (static)"
     else
       nonstatics+=("${binary}")
       kube::log::info "    ${binary} (non-static)"
     fi
-  done
+   done
 
   V=2 kube::log::info "Env for ${platform}: GOOS=${GOOS-} GOARCH=${GOARCH-} GOROOT=${GOROOT-} CGO_ENABLED=${CGO_ENABLED-} CC=${CC-}"
   V=3 kube::log::info "Building binaries with GCFLAGS=${gogcflags} LDFLAGS=${goldflags}"
@@ -892,18 +918,20 @@ kube::golang::build_binaries() {
       fi
     done
 
-    if [[ ${#targets[@]} -eq 0 ]]; then
-      targets=("${KUBE_ALL_TARGETS[@]}")
-    fi
-
     local -a platforms
     IFS=" " read -ra platforms <<< "${KUBE_BUILD_PLATFORMS:-}"
     if [[ ${#platforms[@]} -eq 0 ]]; then
       platforms=("${host_platform}")
     fi
 
+    if [[ ${#targets[@]} -eq 0 ]]; then
+      targets=("${KUBE_ALL_TARGETS[@]}")
+    fi
+    kube::util::read-array targets < <(kube::golang::dedup "${targets[@]}")
+
     local -a binaries
-    while IFS="" read -r binary; do binaries+=("$binary"); done < <(kube::golang::binaries_from_targets "${targets[@]}")
+    kube::util::read-array binaries < <(kube::golang::normalize_go_targets "${targets[@]}")
+    kube::util::read-array binaries < <(kube::golang::dedup "${binaries[@]}")
 
     local parallel=false
     if [[ ${#platforms[@]} -gt 1 ]]; then

hack/lib/init.sh

@@ -25,12 +25,6 @@ set -o pipefail
 # https://github.com/kubernetes/kubernetes/issues/52255
 unset CDPATH
 
-# Until all GOPATH references are removed from all build scripts as well,
-# explicitly disable module mode to avoid picking up user-set GO111MODULE preferences.
-# As individual scripts (like hack/update-vendor.sh) make use of go modules,
-# they can explicitly set GO111MODULE=on
-export GO111MODULE=off
-
 # FIXME(dims): Note that here we assume that if GOFLAGS are already set we
 # leave them as-is and not try to add providerless to it. So if you
 # really need to set your own GOFLAGS, ensure you add "providerless" explicitly
@@ -41,9 +35,21 @@ fi
 # The root of the build/dist directory
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 
-KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
+# Where output goes.  We should avoid redefining these anywhere else.
-KUBE_OUTPUT="${KUBE_ROOT}/${KUBE_OUTPUT_SUBPATH}"
+#
-KUBE_OUTPUT_BINPATH="${KUBE_OUTPUT}/bin"
+# KUBE_OUTPUT: the root directory (absolute) where this build should drop any
+#     files (subdirs are encouraged).
+# KUBE_OUTPUT_BIN: the directory in which compiled binaries will be placed,
+#     under OS/ARCH specific subdirs
+# THIS_PLATFORM_BIN: a symlink to the output directory for binaries built for
+#     the current host platform (e.g. build/test tools).
+#
+# Compat: The KUBE_OUTPUT_SUBPATH variable is sometimes passed in by callers.
+# If it is specified, we'll use it in KUBE_OUTPUT.
+_KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
+export KUBE_OUTPUT="${KUBE_ROOT}/${_KUBE_OUTPUT_SUBPATH}"
+export KUBE_OUTPUT_BIN="${KUBE_OUTPUT}/bin"
+export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
 
 # This controls rsync compression. Set to a value > 0 to enable rsync
 # compression for build container
@@ -53,9 +59,6 @@ KUBE_RSYNC_COMPRESS="${KUBE_RSYNC_COMPRESS:-0}"
 # the connections to localhost in scripts will time out
 export no_proxy="127.0.0.1,localhost${no_proxy:+,${no_proxy}}"
 
-# This is a symlink to binaries for "this platform", e.g. build tools.
-export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
-
 source "${KUBE_ROOT}/hack/lib/util.sh"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
 
@@ -66,9 +69,6 @@ source "${KUBE_ROOT}/hack/lib/version.sh"
 source "${KUBE_ROOT}/hack/lib/golang.sh"
 source "${KUBE_ROOT}/hack/lib/etcd.sh"
 
-KUBE_OUTPUT_HOSTBIN="${KUBE_OUTPUT_BINPATH}/$(kube::util::host_platform)"
-export KUBE_OUTPUT_HOSTBIN
-
 # list of all available group versions.  This should be used when generated code
 # or when starting an API server that you want to have everything.
 # most preferred version for a group should appear first

hack/lib/protoc.sh

@@ -32,7 +32,7 @@ PROTOC_VERSION=23.4
 # $1: Full path to the directory where the api.proto file is
 function kube::protoc::generate_proto() {
   kube::golang::setup_env
-  GO111MODULE=on GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo
+  GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo
 
   kube::protoc::check_protoc
 
@@ -84,7 +84,7 @@ function kube::protoc::format() {
   cat hack/boilerplate/boilerplate.generatego.txt "${package}/api.pb.go" > tmpfile && mv tmpfile "${package}/api.pb.go"
 
   # Run gofmt to clean up the generated code.
-  kube::golang::verify_go_version
+  kube::golang::setup_env
   gofmt -s -w "${package}/api.pb.go"
 }
 

hack/lib/util.sh

@@ -243,59 +243,6 @@ kube::util::find-binary() {
   kube::util::find-binary-for-platform "$1" "$(kube::util::host_platform)"
 }
 
-# Run all known doc generators (today gendocs and genman for kubectl)
-# $1 is the directory to put those generated documents
-kube::util::gen-docs() {
-  local dest="$1"
-
-  # Find binary
-  gendocs=$(kube::util::find-binary "gendocs")
-  genkubedocs=$(kube::util::find-binary "genkubedocs")
-  genman=$(kube::util::find-binary "genman")
-  genyaml=$(kube::util::find-binary "genyaml")
-
-  mkdir -p "${dest}/docs/user-guide/kubectl/"
-  "${gendocs}" "${dest}/docs/user-guide/kubectl/"
-  mkdir -p "${dest}/docs/admin/"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-apiserver"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-controller-manager"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-proxy"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-scheduler"
-  "${genkubedocs}" "${dest}/docs/admin/" "kubelet"
-  "${genkubedocs}" "${dest}/docs/admin/" "kubeadm"
-
-  mkdir -p "${dest}/docs/man/man1/"
-  "${genman}" "${dest}/docs/man/man1/" "kube-apiserver"
-  "${genman}" "${dest}/docs/man/man1/" "kube-controller-manager"
-  "${genman}" "${dest}/docs/man/man1/" "kube-proxy"
-  "${genman}" "${dest}/docs/man/man1/" "kube-scheduler"
-  "${genman}" "${dest}/docs/man/man1/" "kubelet"
-  "${genman}" "${dest}/docs/man/man1/" "kubectl"
-  "${genman}" "${dest}/docs/man/man1/" "kubeadm"
-
-  mkdir -p "${dest}/docs/yaml/kubectl/"
-  "${genyaml}" "${dest}/docs/yaml/kubectl/"
-
-  # create the list of generated files
-  pushd "${dest}" > /dev/null || return 1
-  touch docs/.generated_docs
-  find . -type f | cut -sd / -f 2- | LC_ALL=C sort > docs/.generated_docs
-  popd > /dev/null || return 1
-}
-
-# Removes previously generated docs-- we don't want to check them in. $KUBE_ROOT
-# must be set.
-kube::util::remove-gen-docs() {
-  if [ -e "${KUBE_ROOT}/docs/.generated_docs" ]; then
-    # remove all of the old docs; we don't want to check them in.
-    while read -r file; do
-      rm "${KUBE_ROOT}/${file}" 2>/dev/null || true
-    done <"${KUBE_ROOT}/docs/.generated_docs"
-    # The docs/.generated_docs file lists itself, so we don't need to explicitly
-    # delete it.
-  fi
-}
-
 # Takes a group/version and returns the path to its location on disk, sans
 # "pkg". E.g.:
 # * default behavior: extensions/v1beta1 -> apis/extensions/v1beta1
@@ -322,14 +269,14 @@ kube::util::group-version-to-pkg-path() {
     # Change "foo.bar.k8s.io/v1" -> "foo/v1" notation.
     local simple_gv="${group_version/.*k8s.io/}"
     if [[ "${api}" = "${simple_gv}" ]]; then
-      echo "vendor/k8s.io/api/${simple_gv}"
+      echo "staging/src/k8s.io/api/${simple_gv}"
       return
     fi
   done
 
   # "v1" is the API GroupVersion
   if [[ "${group_version}" == "v1" ]]; then
-    echo "vendor/k8s.io/api/core/v1"
+    echo "staging/src/k8s.io/api/core/v1"
     return
   fi
 
@@ -342,13 +289,13 @@ kube::util::group-version-to-pkg-path() {
       echo "pkg/apis/core"
       ;;
     meta/v1)
-      echo "vendor/k8s.io/apimachinery/pkg/apis/meta/v1"
+      echo "staging/src/k8s.io/apimachinery/pkg/apis/meta/v1"
       ;;
     meta/v1beta1)
-      echo "vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+      echo "staging/src/k8s.io/apimachinery/pkg/apis/meta/v1beta1"
       ;;
     internal.apiserver.k8s.io/v1alpha1)
-      echo "vendor/k8s.io/api/apiserverinternal/v1alpha1"
+      echo "staging/src/k8s.io/api/apiserverinternal/v1alpha1"
       ;;
     *.k8s.io)
       echo "pkg/apis/${group_version%.*k8s.io}"
@@ -832,8 +779,8 @@ function kube::util::md5() {
 # kube::util::read-array
 # Reads in stdin and adds it line by line to the array provided. This can be
 # used instead of "mapfile -t", and is bash 3 compatible.  If the named array
-# exists and is an array, it will be used.  Otherwise it will be unset and
+# exists and is an array, it will be overwritten.  Otherwise it will be unset
-# recreated.
+# and recreated.
 #
 # Assumed vars:
 #   $1 (name of array to create/modify)

hack/lib/version.sh

@@ -156,8 +156,6 @@ kube::version::ldflags() {
     local key=${1}
     local val=${2}
     ldflags+=(
-      "-X '${KUBE_GO_PACKAGE}/vendor/k8s.io/client-go/pkg/version.${key}=${val}'"
-      "-X '${KUBE_GO_PACKAGE}/vendor/k8s.io/component-base/version.${key}=${val}'"
       "-X 'k8s.io/client-go/pkg/version.${key}=${val}'"
       "-X 'k8s.io/component-base/version.${key}=${val}'"
     )

hack/lint-dependencies.sh

@@ -25,19 +25,20 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-# Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=-mod=mod
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run with \$GOPROXY=off"
   exit 1
 fi
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 kube::util::require-jq
 
+# Set the Go environment, otherwise we get "can't compute 'all' using the
+# vendor directory".
+export GOWORK=off
+export GOFLAGS=-mod=mod
+
 # let us log all errors before we exit
 rc=0
 
@@ -86,7 +87,7 @@ unused=$(comm -23 \
 if [[ -n "${unused}" ]]; then
   echo ""
   echo "Use the given commands to remove pinned module versions that aren't actually used:"
-  echo "${unused}" | xargs -L 1 echo 'GO111MODULE=on go mod edit -dropreplace'
+  echo "${unused}" | xargs -L 1 echo 'go mod edit -dropreplace'
 fi
 
 if [[ -n "${unused}${outdated}${noncanonical}" ]]; then

hack/make-rules/test-cmd.sh

@@ -64,7 +64,7 @@ function run_kube_apiserver() {
   # Enable features
   ENABLE_FEATURE_GATES=""
 
-  "${KUBE_OUTPUT_HOSTBIN}/kube-apiserver" \
+  "${THIS_PLATFORM_BIN}/kube-apiserver" \
     --bind-address="127.0.0.1" \
     --authorization-mode="${AUTHORIZATION_MODE}" \
     --secure-port="${SECURE_API_PORT}" \
@@ -119,7 +119,7 @@ current-context: local-context
 EOF
 
   kube::log::status "Starting controller-manager"
-  "${KUBE_OUTPUT_HOSTBIN}/kube-controller-manager" \
+  "${THIS_PLATFORM_BIN}/kube-controller-manager" \
     --kube-api-content-type="${KUBE_TEST_API_TYPE-}" \
     --cluster-signing-cert-file=hack/testdata/ca/ca.crt \
     --cluster-signing-key-file=hack/testdata/ca/ca.key \

hack/make-rules/test-integration.sh

@@ -46,11 +46,12 @@ KUBE_TEST_VMODULE=${KUBE_TEST_VMODULE:-""}
 kube::test::find_integration_test_dirs() {
   (
     cd "${KUBE_ROOT}"
-    find test/integration/ -name '*_test.go' -print0 \
+    # The "./" syntax here produces Go-compatible package names.
-      | xargs -0n1 dirname | sed "s|^|${KUBE_GO_PACKAGE}/|" \
+    find ./test/integration/ -name '*_test.go' -print0 \
+      | xargs -0n1 dirname \
       | LC_ALL=C sort -u
-    find vendor/k8s.io/apiextensions-apiserver/test/integration/ -name '*_test.go' -print0 \
+    find ./staging/src/k8s.io/apiextensions-apiserver/test/integration/ -name '*_test.go' -print0 \
-      | xargs -0n1 dirname | sed "s|^|${KUBE_GO_PACKAGE}/|" \
+      | xargs -0n1 dirname \
       | LC_ALL=C sort -u
   )
 }

hack/make-rules/test.sh

@@ -39,10 +39,8 @@ kube::test::find_dirs() {
         \( \
           -path './_artifacts/*' \
           -o -path './_output/*' \
-          -o -path './_gopath/*' \
           -o -path './cmd/kubeadm/test/*' \
           -o -path './contrib/podex/*' \
-          -o -path './output/*' \
           -o -path './release/*' \
           -o -path './target/*' \
           -o -path './test/e2e/e2e_test.go' \
@@ -53,9 +51,9 @@ kube::test::find_dirs() {
           -o -path './staging/*' \
           -o -path './vendor/*' \
         \) -prune \
-      \) -name '*_test.go' -print0 | xargs -0n1 dirname | sed "s|^\./|${KUBE_GO_PACKAGE}/|" | LC_ALL=C sort -u
+      \) -name '*_test.go' -print0 | xargs -0n1 dirname | LC_ALL=C sort -u
 
-    find ./staging -name '*_test.go' -not -path '*/test/integration/*' -prune -print0 | xargs -0n1 dirname | sed 's|^\./staging/src/|./vendor/|' | LC_ALL=C sort -u
+    find ./staging -name '*_test.go' -not -path '*/test/integration/*' -prune -print0 | xargs -0n1 dirname | LC_ALL=C sort -u
   )
 }
 
@@ -165,7 +163,7 @@ for arg; do
   fi
 done
 if [[ ${#testcases[@]} -eq 0 ]]; then
-  while IFS='' read -r line; do testcases+=("$line"); done < <(kube::test::find_dirs)
+  kube::util::read-array testcases < <(kube::test::find_dirs)
 fi
 set -- "${testcases[@]+${testcases[@]}}"
 
@@ -182,46 +180,6 @@ junitFilenamePrefix() {
   echo "${KUBE_JUNIT_REPORT_DIR}/junit_$(kube::util::sortable_date)"
 }
 
-verifyAndSuggestPackagePath() {
-  local specified_package_path="$1"
-  local alternative_package_path="$2"
-  local original_package_path="$3"
-  local suggestion_package_path="$4"
-
-  if [[ "${specified_package_path}" =~ '/...'$ ]]; then
-    specified_package_path=${specified_package_path::-4}
-  fi
-
-  if ! [ -d "${specified_package_path}" ]; then
-    # Because k8s sets a localized $GOPATH for testing, seeing the actual
-    # directory can be confusing. Instead, just show $GOPATH if it exists in the
-    # $specified_package_path.
-    local printable_package_path
-    printable_package_path=${specified_package_path//${GOPATH}/\$\{GOPATH\}}
-    kube::log::error "specified test path '${printable_package_path}' does not exist"
-
-    if [ -d "${alternative_package_path}" ]; then
-      kube::log::info "try changing \"${original_package_path}\" to \"${suggestion_package_path}\""
-    fi
-    exit 1
-  fi
-}
-
-verifyPathsToPackagesUnderTest() {
-  local packages_under_test=("$@")
-
-  for package_path in "${packages_under_test[@]}"; do
-    local local_package_path="${package_path}"
-    local go_package_path="${GOPATH}/src/${package_path}"
-
-    if [[ "${package_path:0:2}" == "./" ]] ; then
-      verifyAndSuggestPackagePath "${local_package_path}" "${go_package_path}" "${package_path}" "${package_path:2}"
-    else
-      verifyAndSuggestPackagePath "${go_package_path}" "${local_package_path}" "${package_path}" "./${package_path}"
-    fi
-  done
-}
-
 produceJUnitXMLReport() {
   local -r junit_filename_prefix=$1
   if [[ -z "${junit_filename_prefix}" ]]; then
@@ -234,7 +192,7 @@ produceJUnitXMLReport() {
   if ! command -v gotestsum >/dev/null 2>&1; then
     kube::log::status "gotestsum not found; installing from hack/tools"
     pushd "${KUBE_ROOT}/hack/tools" >/dev/null
-      GO111MODULE=on go install gotest.tools/gotestsum
+      go install gotest.tools/gotestsum
     popd >/dev/null
   fi
   gotestsum --junitfile "${junit_xml_filename}" --raw-command cat "${junit_filename_prefix}"*.stdout
@@ -245,7 +203,7 @@ produceJUnitXMLReport() {
   if ! command -v prune-junit-xml >/dev/null 2>&1; then
     kube::log::status "prune-junit-xml not found; installing from hack/tools"
     pushd "${KUBE_ROOT}/cmd/prune-junit-xml" >/dev/null
-      GO111MODULE=on go install .
+      go install .
     popd >/dev/null
   fi
   prune-junit-xml "${junit_xml_filename}"
@@ -257,14 +215,17 @@ runTests() {
   local junit_filename_prefix
   junit_filename_prefix=$(junitFilenamePrefix)
 
-  verifyPathsToPackagesUnderTest "$@"
+  # Try to normalize input names.
+  local -a targets
+  kube::util::read-array targets < <(kube::golang::normalize_go_targets "$@")
 
   # If we're not collecting coverage, run all requested tests with one 'go test'
   # command, which is much faster.
   if [[ ! ${KUBE_COVER} =~ ^[yY]$ ]]; then
     kube::log::status "Running tests without code coverage ${KUBE_RACE:+"and with ${KUBE_RACE}"}"
+    # shellcheck disable=SC2031
     go test "${goflags[@]:+${goflags[@]}}" \
-     "${KUBE_TIMEOUT}" "${@}" \
+     "${KUBE_TIMEOUT}" "${targets[@]}" \
      "${testargs[@]:+${testargs[@]}}" \
      | tee ${junit_filename_prefix:+"${junit_filename_prefix}.stdout"} \
      | grep --binary-files=text "${go_test_grep_pattern}" && rc=$? || rc=$?
@@ -294,18 +255,7 @@ runTests() {
   # we spawn a subshell for each PARALLEL process, redirecting the output to
   # separate files.
 
-  # ignore paths:
-  # vendor/k8s.io/code-generator/cmd/generator: is fragile when run under coverage, so ignore it for now.
-  #                            https://github.com/kubernetes/kubernetes/issues/24967
-  # vendor/k8s.io/client-go/1.4/rest: causes cover internal errors
-  #                            https://github.com/golang/go/issues/16540
-  cover_ignore_dirs="vendor/k8s.io/code-generator/cmd/generator|vendor/k8s.io/client-go/1.4/rest"
-  for path in ${cover_ignore_dirs//|/ }; do
-      echo -e "skipped\tk8s.io/kubernetes/${path}"
-  done
-
   printf "%s\n" "${@}" \
-    | grep -Ev ${cover_ignore_dirs} \
     | xargs -I{} -n 1 -P "${KUBE_COVERPROCS}" \
     bash -c "set -o pipefail; _pkg=\"\$0\"; _pkg_out=\${_pkg//\//_}; \
       go test ${goflags[*]:+${goflags[*]}} \

hack/make-rules/update.sh

@@ -36,6 +36,7 @@ if ! ${ALL} ; then
 fi
 
 BASH_TARGETS=(
+	update-go-workspace
 	update-codegen
 	update-generated-api-compatibility-data
 	update-generated-docs

hack/pin-dependency.sh

@@ -25,19 +25,19 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-# Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=-mod=mod
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run with \$GOPROXY=off"
   exit 1
 fi
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 kube::util::require-jq
 
+# Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
+export GOWORK=off
+export GOFLAGS=-mod=mod
+
 dep="${1:-}"
 sha="${2:-}"
 

hack/tools/go.work

@@ -0,0 +1,6 @@
+// This is a hack, but it prevents go from climbing further and trying to
+// reconcile the various deps across the "real" modules and this one.
+
+go 1.22.0
+
+use .

hack/tools/go.work.sum

@@ -0,0 +1,197 @@
+cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
+cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
+cloud.google.com/go/bigquery v1.8.0 h1:PQcPefKFdaIzjQFbiyOgAqyx8q5djaE7x9Sqe712DPA=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/datastore v1.1.0 h1:/May9ojXjRkPBNVrq+oWLqmWCkr4OU5uRY29bu0mRyQ=
+cloud.google.com/go/firestore v1.6.1 h1:8rBq3zRjnHx8UtBvaOWqBB1xq9jH6/wltfQLlTMh2Fw=
+cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/pubsub v1.3.1 h1:ukjixP1wl0LpnZ6LWtZJ0mX5tBmjp1f8Sqer8Z2OMUU=
+cloud.google.com/go/storage v1.35.1 h1:B59ahL//eDfx2IIKFBeT5Atm9wnNmj3+8xG/W4WB//w=
+cloud.google.com/go/storage v1.35.1/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9 h1:VpgP7xuJadIUuKccphEpTJnWhS2jkQyMt6Y7pJCD7fY=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802 h1:1BDTz0u9nC3//pOCMdNH+CiXJVYJh5UQNCOBG7jbELc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
+github.com/armon/go-metrics v0.3.10 h1:FR+drcQStOe+32sYyJYyZ7FIdgoGGBnwLl+flodp8Uo=
+github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
+github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f h1:WBZRG4aNOuI15bLRrCgN8fCq8E5Xuty6jGbmSNEvSsU=
+github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+github.com/cristalhq/acmd v0.11.2 h1:ITIWtBRiYbmzk+i8xQgH2RzfCVMII+dOd0CtGWVIhaU=
+github.com/cristalhq/acmd v0.11.2/go.mod h1:LG5oa43pE/BbxtfMoImHCQN++0Su7dzipdgBjMCBVDQ=
+github.com/envoyproxy/go-control-plane v0.9.4 h1:rEvIZUSZ3fx39WIi3JkQqQBitGwpELBIYWeBVh6wn+E=
+github.com/envoyproxy/protoc-gen-validate v0.1.0 h1:EQciDnbrYxy13PgWoY8AqoxGiPrpgBZ1R8UNe3ddc+A=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1 h1:QbL/5oDUmRBzO9/Z7Seo6zf912W/a6Sr4Eu0G/3Jho0=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4 h1:WtGNWLvXpe6ZudgnXrq0barxBImvnnJoMEhXAzcbM0I=
+github.com/go-kit/kit v0.9.0 h1:wDJmvq38kDhkVxi50ni9ykkdUr1PKgqKOoi01fa0Mdk=
+github.com/go-kit/log v0.1.0 h1:DGJh0Sm43HbOeYDNnVZFl8BvcYVvjD5bqYJvp0REbwQ=
+github.com/go-logfmt/logfmt v0.5.0 h1:TrB8swr/68K7m9CcGut2g3UOihhbcbiMAYiuTXdEih4=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/google/martian/v3 v3.0.0 h1:pMen7vLs8nvgEYhywH3KDWJIJTeEr2ULsVWHWYHQyBs=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
+github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
+github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720 h1:zC34cGQu69FG7qzJ3WiKW244WfhDC3xxYMeNOX2gtUQ=
+github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
+github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
+github.com/hashicorp/consul/api v1.12.0 h1:k3y1FYv6nuKyNTqj6w9gXOx5r5CfLj/k/euUeBXj1OY=
+github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.2.0 h1:La19f8d7WIlm4ogzNHB0JGqs5AUDAZ2UfCY4sJXcJdM=
+github.com/hashicorp/go-hclog v1.2.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
+github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
+github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/serf v0.9.7 h1:hkdgbqizGQHuU5IPqYM1JdSMV8nKfpuOnZYXssk9muY=
+github.com/hashicorp/serf v0.9.7/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6 h1:UDMh68UUwekSh5iP2OMhRRZJiiBccgV7axzUG8vi56c=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.4.3 h1:cxFyXhxlvAifxnkKKdlxv8XqUf59tDlYjnV5YYfsJJY=
+github.com/jackc/pgx/v5 v5.4.3/go.mod h1:Ig06C2Vu0t5qXC60W8sqIthScaEnFvojjj9dSljmHRA=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/jstemmer/go-junit-report v0.9.1 h1:6QPYqodiu3GuPL+7mfx+NwDdp2eTkp9IfEUpgAwUN0o=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY=
+github.com/kr/pty v1.1.1 h1:VkoXIwSboBpnk99O/KFauAEILuNHv5DVFKZMBN/gUgw=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
+github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
+github.com/mgechev/dots v0.0.0-20210922191527-e955255bf517 h1:zpIH83+oKzcpryru8ceC6BxnoG8TBrhgAvRg8obzup0=
+github.com/mgechev/dots v0.0.0-20210922191527-e955255bf517/go.mod h1:KQ7+USdGKfpPjXk4Ga+5XxQM4Lm4e3gAogrreFAYpOg=
+github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
+github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/mozilla/tls-observatory v0.0.0-20210609171429-7bc42856d2e5 h1:0KqC6/sLy7fDpBdybhVkkv4Yz+PmB7c9Dz9z3dLW804=
+github.com/mozilla/tls-observatory v0.0.0-20210609171429-7bc42856d2e5/go.mod h1:FUqVoUPHSEdDR0MnFM3Dh8AU0pZHLXUD127SAJGER/s=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
+github.com/otiai10/curr v1.0.0 h1:TJIWdbX0B+kpNagQrjgq8bCMrbhiuX73M2XwgtDMoOI=
+github.com/otiai10/mint v1.3.1 h1:BCmzIS3n71sGfHB5NMNDB3lHYPz8fWSkCAErHed//qc=
+github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d h1:CdDQnGF8Nq9ocOS/xlSptM1N3BbrA6/kmaep5ggwaIA=
+github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
+github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
+github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/go-ruleguard/rules v0.0.0-20211022131956-028d6511ab71 h1:CNooiryw5aisadVfzneSZPswRWvnVW8hF1bS/vo8ReI=
+github.com/quasilyte/go-ruleguard/rules v0.0.0-20211022131956-028d6511ab71/go.mod h1:4cgAphtvu7Ftv7vOT2ZOYhC6CvBxZixcasr8qIOTA50=
+github.com/remyoudompheng/go-dbus v0.0.0-20121104212943-b7232d34b1d5 h1:CvqZS4QYHBRvx7AeFdimd16HCbLlYsvQMcKDACpJW/c=
+github.com/remyoudompheng/go-dbus v0.0.0-20121104212943-b7232d34b1d5/go.mod h1:+u151txRmLpwxBmpYn9z3d1sdJdjRPQpsXuYeY9jNls=
+github.com/remyoudompheng/go-liblzma v0.0.0-20190506200333-81bf2d431b96 h1:J8J/cgLDRuqXJnwIrRDBvtl+LLsdg7De74znW/BRRq4=
+github.com/remyoudompheng/go-liblzma v0.0.0-20190506200333-81bf2d431b96/go.mod h1:90HvCY7+oHHUKkbeMCiHt1WuFR2/hPJ9QrljDG+v6ls=
+github.com/remyoudompheng/go-misc v0.0.0-20190427085024-2d6ac652a50e h1:eTWZyPUnHcuGRDiryS/l2I7FfKjbU3IBx3IjqHPxuKU=
+github.com/remyoudompheng/go-misc v0.0.0-20190427085024-2d6ac652a50e/go.mod h1:80FQABjoFzZ2M5uEa6FUaJYEmqU2UOKojlFVak1UAwI=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/sagikazarmark/crypt v0.6.0 h1:REOEXCs/NFY/1jOCEouMuT4zEniE5YoXbvpC5X/TLF8=
+github.com/sagikazarmark/crypt v0.6.0/go.mod h1:U8+INwJo3nBv1m6A/8OBXAq7Jnpspk5AxSgDyEQcea8=
+github.com/shirou/gopsutil/v3 v3.24.1 h1:R3t6ondCEvmARp3wxODhXMTLC/klMa87h2PHUw5m7QI=
+github.com/shirou/gopsutil/v3 v3.24.1/go.mod h1:UU7a2MSBQa+kW1uuDq8DeEBS8kmrnQwsv2b5O513rwU=
+github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
+github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
+github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e h1:MZM7FHLqUHYI0Y/mQAt3d2aYa0SiNms/hFqC9qJYolM=
+github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041 h1:llrF3Fs4018ePo4+G/HV/uQUqEI1HMDjCeOf2V6puPc=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
+github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
+github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
+github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+github.com/valyala/quicktemplate v1.7.0 h1:LUPTJmlVcb46OOUY3IeD9DojFpAVbsG+5WFTcjMJzCM=
+github.com/valyala/quicktemplate v1.7.0/go.mod h1:sqKJnoaOF88V07vkO+9FL8fb9uZg/VPSJnLYn+LmLk8=
+github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=
+github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
+github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
+github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
+github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.etcd.io/etcd/api/v3 v3.5.4 h1:OHVyt3TopwtUQ2GKdd5wu3PmmipR4FTwCqoEjSyRdIc=
+go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
+go.etcd.io/etcd/client/pkg/v3 v3.5.4 h1:lrneYvz923dvC14R54XcA7FXoZ3mlGZAgmwhfm7HqOg=
+go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v2 v2.305.4 h1:Dcx3/MYyfKcPNLpR4VVQUP5KgYrBeJtktBwEKkw08Ao=
+go.etcd.io/etcd/client/v2 v2.305.4/go.mod h1:Ud+VUwIi9/uQHOMA+4ekToJ12lTxlv0zB/+DHwTGEbU=
+go.etcd.io/etcd/client/v3 v3.5.4 h1:p83BUL3tAYS0OT/r0qglgc3M1JjhM0diV8DSWAhVXv4=
+go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b h1:+qEpEAPhDZ1o0x3tHzZTQDArnOixOzGD9HUJfcg0mb4=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808 h1:+Kc94D8UVEVxJnLXp/+FMfqQARZtWHfVrcRtcG8aT3g=
+golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+google.golang.org/api v0.152.0 h1:t0r1vPnfMc260S2Ci+en7kfCZaLOPs5KI0sVV/6jZrY=
+google.golang.org/api v0.152.0/go.mod h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
+google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f/go.mod h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
+k8s.io/klog/v2 v2.0.0 h1:Foj74zO6RbjjP4hBEKjnYtjjAhGg4jNynUdYF6fJrok=
+k8s.io/utils v0.0.0-20210802155522-efc7438f0176 h1:Mx0aa+SUAcNRQbs5jUzV8lkDlGFU8laZsY9jrcVX5SY=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/quote/v3 v3.1.0 h1:9JKUTTIUgS6kzR9mK1YuGKv6Nl+DijDNIc0ghT58FaY=
+rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=

hack/update-codegen.sh

@@ -35,7 +35,6 @@ UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-}"
 API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${KUBE_ROOT}/api/api-rules"}"
 
 OUT_DIR="_output"
-PRJ_SRC_PATH="k8s.io/kubernetes"
 BOILERPLATE_FILENAME="hack/boilerplate/boilerplate.generatego.txt"
 APPLYCONFIG_PKG="k8s.io/client-go/applyconfigurations"
 
@@ -49,11 +48,20 @@ if [[ "${DBG_CODEGEN}" == 1 ]]; then
     kube::log::status "DBG: starting generated_files"
 fi
 
+# Generate a list of directories we don't want to play in.
+DIRS_TO_AVOID=()
+kube::util::read-array DIRS_TO_AVOID < <(
+    git ls-files -cmo --exclude-standard -- ':!:vendor/*' ':(glob)*/**/go.work' \
+        | while read -r F; do \
+            echo ':!:'"$(dirname "${F}")"; \
+        done
+    )
+
 function git_find() {
     # Similar to find but faster and easier to understand.  We want to include
     # modified and untracked files because this might be running against code
     # which is not tracked by git yet.
-    git ls-files -cmo --exclude-standard ':!:vendor/*' "$@"
+    git ls-files -cmo --exclude-standard ':!:vendor/*' "${DIRS_TO_AVOID[@]}" "$@"
 }
 
 function git_grep() {
@@ -61,17 +69,11 @@ function git_grep() {
     # running against code which is not tracked by git yet.
     # We need vendor exclusion added at the end since it has to be part of
     # the pathspecs which are specified last.
-    git grep --untracked "$@" ':!:vendor/*'
+    git grep --untracked "$@" ':!:vendor/*' "${DIRS_TO_AVOID[@]}"
 }
 
 # Generate a list of all files that have a `+k8s:` comment-tag.  This will be
 # used to derive lists of files/dirs for generation tools.
-#
-# We want to include the "special" vendor directories which are actually part
-# of the Kubernetes source tree (staging/*) but we need them to be named as
-# their vendor/* equivalents.  We do not want all of vendor nor
-# hack/tools/vendor nor even all of vendor/k8s.io - just the subset that lives
-# in staging.
 if [[ "${DBG_CODEGEN}" == 1 ]]; then
     kube::log::status "DBG: finding all +k8s: tags"
 fi
@@ -82,7 +84,6 @@ kube::util::read-array ALL_K8S_TAG_FILES < <(
         -- \
         ':!:*/testdata/*'              `# not under any testdata` \
         ':(glob)**/*.go'               `# in any *.go file` \
-        | sed 's|^staging/src|vendor|' `# see comments above` \
     )
 if [[ "${DBG_CODEGEN}" == 1 ]]; then
     kube::log::status "DBG: found ${#ALL_K8S_TAG_FILES[@]} +k8s: tagged files"
@@ -125,10 +126,10 @@ function codegen::protobuf() {
         | xargs -0 rm -f
 
     if kube::protoc::check_protoc >/dev/null; then
-      hack/update-generated-protobuf-dockerized.sh "${apis[@]}"
+      hack/_update-generated-protobuf-dockerized.sh "${apis[@]}"
     else
       kube::log::status "protoc ${PROTOC_VERSION} not found (can install with hack/install-protoc.sh); generating containerized..."
-      build/run.sh hack/update-generated-protobuf-dockerized.sh "${apis[@]}"
+      build/run.sh hack/_update-generated-protobuf-dockerized.sh "${apis[@]}"
     fi
 }
 
@@ -144,15 +145,11 @@ function codegen::protobuf() {
 #               scheme
 function codegen::deepcopy() {
     # Build the tool.
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/deepcopy-gen
 
     # The result file, in each pkg, of deep-copy generation.
-    local output_file="${GENERATED_FILE_PREFIX}deepcopy"
+    local output_file="${GENERATED_FILE_PREFIX}deepcopy.go"
-
-    # The tool used to generate deep copies.
-    local gen_deepcopy_bin
-    gen_deepcopy_bin="$(kube::util::find-binary "deepcopy-gen")"
 
     # Find all the directories that request deep-copy generation.
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -169,26 +166,25 @@ function codegen::deepcopy() {
 
     local tag_pkgs=()
     for dir in "${tag_dirs[@]}"; do
-        tag_pkgs+=("${PRJ_SRC_PATH}/$dir")
+        tag_pkgs+=("./$dir")
     done
 
     kube::log::status "Generating deepcopy code for ${#tag_pkgs[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${gen_deepcopy_bin} for:"
+        kube::log::status "DBG: running deepcopy-gen for:"
         for dir in "${tag_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
     fi
 
-    git_find -z ':(glob)**'/"${output_file}.go" | xargs -0 rm -f
+    git_find -z ':(glob)**'/"${output_file}" | xargs -0 rm -f
 
-    ./hack/run-in-gopath.sh "${gen_deepcopy_bin}" \
+    deepcopy-gen \
-        --v "${KUBE_VERBOSE}" \
+        -v "${KUBE_VERBOSE}" \
-        --logtostderr \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-file-base "${output_file}" \
+        --output-file "${output_file}" \
-        --bounding-dirs "${PRJ_SRC_PATH},k8s.io/api" \
+        --bounding-dirs "k8s.io/kubernetes,k8s.io/api" \
-        $(printf -- " -i %s" "${tag_pkgs[@]}") \
+        "${tag_pkgs[@]}" \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -201,17 +197,13 @@ function codegen::deepcopy() {
 # $2: Path to the directory where types.go for that group version exists. This
 # is the directory where the file will be generated.
 function gen_types_swagger_doc() {
-    # The tool used to generate swagger code.
-    local swagger_bin
-    swagger_bin="$(kube::util::find-binary "genswaggertypedocs")"
-
     local group_version="$1"
     local gv_dir="$2"
     local tmpfile
     tmpfile="${TMPDIR:-/tmp}/types_swagger_doc_generated.$(date +%s).go"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${swagger_bin} for ${group_version} at ${gv_dir}"
+        kube::log::status "DBG: running genswaggertypedocs for ${group_version} at ${gv_dir}"
     fi
 
     {
@@ -236,7 +228,7 @@ function gen_types_swagger_doc() {
 EOF
     } > "${tmpfile}"
 
-    "${swagger_bin}" \
+    genswaggertypedocs \
         -s \
         "${gv_dir}/types.go" \
         -f - \
@@ -254,7 +246,7 @@ EOF
 # first in the case of regenerating everything.
 function codegen::swagger() {
     # Build the tool
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         ./cmd/genswaggertypedocs
 
     local group_versions=()
@@ -277,15 +269,11 @@ function codegen::swagger() {
 #     // +k8s:prerelease-lifecycle-gen=true
 function codegen::prerelease() {
     # Build the tool.
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/prerelease-lifecycle-gen
 
     # The result file, in each pkg, of prerelease-lifecycle generation.
-    local output_file="${GENERATED_FILE_PREFIX}prerelease-lifecycle"
+    local output_file="${GENERATED_FILE_PREFIX}prerelease-lifecycle.go"
-
-    # The tool used to generate prerelease-lifecycle code.
-    local gen_prerelease_bin
-    gen_prerelease_bin="$(kube::util::find-binary "prerelease-lifecycle-gen")"
 
     # Find all the directories that request prerelease-lifecycle generation.
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -302,25 +290,24 @@ function codegen::prerelease() {
 
     local tag_pkgs=()
     for dir in "${tag_dirs[@]}"; do
-        tag_pkgs+=("${PRJ_SRC_PATH}/$dir")
+        tag_pkgs+=("./$dir")
     done
 
     kube::log::status "Generating prerelease-lifecycle code for ${#tag_pkgs[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${gen_prerelease_bin} for:"
+        kube::log::status "DBG: running prerelease-lifecycle-gen for:"
         for dir in "${tag_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
     fi
 
-    git_find -z ':(glob)**'/"${output_file}.go" | xargs -0 rm -f
+    git_find -z ':(glob)**'/"${output_file}" | xargs -0 rm -f
 
-    ./hack/run-in-gopath.sh "${gen_prerelease_bin}" \
+    prerelease-lifecycle-gen \
-        --v "${KUBE_VERBOSE}" \
+        -v "${KUBE_VERBOSE}" \
-        --logtostderr \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-file-base "${output_file}" \
+        --output-file "${output_file}" \
-        $(printf -- " -i %s" "${tag_pkgs[@]}") \
+        "${tag_pkgs[@]}" \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -346,15 +333,11 @@ function codegen::prerelease() {
 #                  for having a defaulter generated
 function codegen::defaults() {
     # Build the tool.
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/defaulter-gen
 
     # The result file, in each pkg, of defaulter generation.
-    local output_file="${GENERATED_FILE_PREFIX}defaults"
+    local output_file="${GENERATED_FILE_PREFIX}defaults.go"
-
-    # The tool used to generate defaulters.
-    local gen_defaulter_bin
-    gen_defaulter_bin="$(kube::util::find-binary "defaulter-gen")"
 
     # All directories that request any form of defaulter generation.
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -371,26 +354,24 @@ function codegen::defaults() {
 
     local tag_pkgs=()
     for dir in "${tag_dirs[@]}"; do
-        tag_pkgs+=("${PRJ_SRC_PATH}/$dir")
+        tag_pkgs+=("./$dir")
     done
 
     kube::log::status "Generating defaulter code for ${#tag_pkgs[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${gen_defaulter_bin} for:"
+        kube::log::status "DBG: running defaulter-gen for:"
         for dir in "${tag_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
     fi
 
-    git_find -z ':(glob)**'/"${output_file}.go" | xargs -0 rm -f
+    git_find -z ':(glob)**'/"${output_file}" | xargs -0 rm -f
 
-    ./hack/run-in-gopath.sh "${gen_defaulter_bin}" \
+    defaulter-gen \
-        --v "${KUBE_VERBOSE}" \
+        -v "${KUBE_VERBOSE}" \
-        --logtostderr \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-file-base "${output_file}" \
+        --output-file "${output_file}" \
-        $(printf -- " --extra-peer-dirs %s" "${tag_pkgs[@]}") \
+        "${tag_pkgs[@]}" \
-        $(printf -- " -i %s" "${tag_pkgs[@]}") \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -421,15 +402,11 @@ function codegen::defaults() {
 # IDL.
 function codegen::conversions() {
     # Build the tool.
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/conversion-gen
 
     # The result file, in each pkg, of conversion generation.
-    local output_file="${GENERATED_FILE_PREFIX}conversion"
+    local output_file="${GENERATED_FILE_PREFIX}conversion.go"
-
-    # The tool used to generate conversions.
-    local gen_conversion_bin
-    gen_conversion_bin="$(kube::util::find-binary "conversion-gen")"
 
     # All directories that request any form of conversion generation.
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -446,7 +423,7 @@ function codegen::conversions() {
 
     local tag_pkgs=()
     for dir in "${tag_dirs[@]}"; do
-        tag_pkgs+=("${PRJ_SRC_PATH}/$dir")
+        tag_pkgs+=("./$dir")
     done
 
     local extra_peer_pkgs=(
@@ -457,22 +434,20 @@ function codegen::conversions() {
 
     kube::log::status "Generating conversion code for ${#tag_pkgs[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${gen_conversion_bin} for:"
+        kube::log::status "DBG: running conversion-gen for:"
         for dir in "${tag_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
     fi
 
-    git_find -z ':(glob)**'/"${output_file}.go" | xargs -0 rm -f
+    git_find -z ':(glob)**'/"${output_file}" | xargs -0 rm -f
 
-    ./hack/run-in-gopath.sh "${gen_conversion_bin}" \
+    conversion-gen \
-        --v "${KUBE_VERBOSE}" \
+        -v "${KUBE_VERBOSE}" \
-        --logtostderr \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-file-base "${output_file}" \
+        --output-file "${output_file}" \
         $(printf -- " --extra-peer-dirs %s" "${extra_peer_pkgs[@]}") \
-        $(printf -- " --extra-dirs %s" "${tag_pkgs[@]}") \
+        "${tag_pkgs[@]}" \
-        $(printf -- " -i %s" "${tag_pkgs[@]}") \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -505,17 +480,14 @@ function k8s_tag_files_except() {
 #     // +k8s:openapi-gen=true
 function codegen::openapi() {
     # Build the tool.
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
-        k8s.io/code-generator/cmd/openapi-gen
+        k8s.io/kube-openapi/cmd/openapi-gen
 
     # The result file, in each pkg, of open-api generation.
-    local output_file="${GENERATED_FILE_PREFIX}openapi"
+    local output_file="${GENERATED_FILE_PREFIX}openapi.go"
-
-    # The tool used to generate open apis.
-    local gen_openapi_bin
-    gen_openapi_bin="$(kube::util::find-binary "openapi-gen")"
 
     local output_dir="pkg/generated/openapi"
+    local output_pkg="k8s.io/kubernetes/${output_dir}"
     local known_violations_file="${API_KNOWN_VIOLATIONS_DIR}/violation_exceptions.list"
 
     local report_file="${OUT_DIR}/api_violations.report"
@@ -532,8 +504,8 @@ function codegen::openapi() {
     local tag_files=()
     kube::util::read-array tag_files < <(
         k8s_tag_files_except \
-            vendor/k8s.io/code-generator \
+            staging/src/k8s.io/code-generator \
-            vendor/k8s.io/sample-apiserver
+            staging/src/k8s.io/sample-apiserver
         )
 
     local tag_dirs=()
@@ -548,27 +520,27 @@ function codegen::openapi() {
 
     local tag_pkgs=()
     for dir in "${tag_dirs[@]}"; do
-        tag_pkgs+=("${PRJ_SRC_PATH}/$dir")
+        tag_pkgs+=("./$dir")
     done
 
     kube::log::status "Generating openapi code"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${gen_openapi_bin} for:"
+        kube::log::status "DBG: running openapi-gen for:"
         for dir in "${tag_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
     fi
 
-    git_find -z ':(glob)pkg/generated/**'/"${output_file}.go" | xargs -0 rm -f
+    git_find -z ':(glob)pkg/generated/**'/"${output_file}" | xargs -0 rm -f
 
-    ./hack/run-in-gopath.sh "${gen_openapi_bin}" \
+    openapi-gen \
-        --v "${KUBE_VERBOSE}" \
+        -v "${KUBE_VERBOSE}" \
-        --logtostderr \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-file-base "${output_file}" \
+        --output-file "${output_file}" \
-        --output-package "${PRJ_SRC_PATH}/${output_dir}" \
+        --output-dir "${output_dir}" \
+        --output-pkg "${output_pkg}" \
         --report-filename "${report_file}" \
-        $(printf -- " -i %s" "${tag_pkgs[@]}") \
+        "${tag_pkgs[@]}" \
         "$@"
 
     touch "${report_file}"
@@ -585,15 +557,10 @@ function codegen::openapi() {
 }
 
 function codegen::applyconfigs() {
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/kubernetes/pkg/generated/openapi/cmd/models-schema \
         k8s.io/code-generator/cmd/applyconfiguration-gen
 
-    local modelsschema
-    modelsschema=$(kube::util::find-binary "models-schema")
-    local applyconfigurationgen
-    applyconfigurationgen=$(kube::util::find-binary "applyconfiguration-gen")
-
     local ext_apis=()
     kube::util::read-array ext_apis < <(
         cd "${KUBE_ROOT}/staging/src"
@@ -604,7 +571,7 @@ function codegen::applyconfigs() {
 
     kube::log::status "Generating apply-config code for ${#ext_apis[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${applyconfigurationgen} for:"
+        kube::log::status "DBG: running applyconfiguration-gen for:"
         for api in "${ext_apis[@]}"; do
             kube::log::status "DBG:     $api"
         done
@@ -617,12 +584,13 @@ function codegen::applyconfigs() {
         || true) \
         | xargs -0 rm -f
 
-    "${applyconfigurationgen}" \
+    applyconfiguration-gen \
-        --openapi-schema <("${modelsschema}") \
+        -v "${KUBE_VERBOSE}" \
+        --openapi-schema <(models-schema) \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-base "${KUBE_ROOT}/vendor" \
+        --output-dir "${KUBE_ROOT}/staging/src/${APPLYCONFIG_PKG}" \
-        --output-package "${APPLYCONFIG_PKG}" \
+        --output-pkg "${APPLYCONFIG_PKG}" \
-        $(printf -- " --input-dirs %s" "${ext_apis[@]}") \
+        "${ext_apis[@]}" \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -631,12 +599,9 @@ function codegen::applyconfigs() {
 }
 
 function codegen::clients() {
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/client-gen
 
-    local clientgen
-    clientgen=$(kube::util::find-binary "client-gen")
-
     IFS=" " read -r -a group_versions <<< "${KUBE_AVAILABLE_GROUP_VERSIONS}"
     local gv_dirs=()
     for gv in "${group_versions[@]}"; do
@@ -644,7 +609,7 @@ function codegen::clients() {
         local api_dir
         api_dir=$(kube::util::group-version-to-pkg-path "${gv}")
         local nopkg_dir=${api_dir#pkg/}
-        nopkg_dir=${nopkg_dir#vendor/k8s.io/api/}
+        nopkg_dir=${nopkg_dir#staging/src/k8s.io/api/}
         local pkg_dir=${nopkg_dir#apis/}
 
         # skip groups that aren't being served, clients for these don't matter
@@ -657,7 +622,7 @@ function codegen::clients() {
 
     kube::log::status "Generating client code for ${#gv_dirs[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${clientgen} for:"
+        kube::log::status "DBG: running client-gen for:"
         for dir in "${gv_dirs[@]}"; do
             kube::log::status "DBG:     $dir"
         done
@@ -670,10 +635,11 @@ function codegen::clients() {
         || true) \
         | xargs -0 rm -f
 
-    "${clientgen}" \
+    client-gen \
+        -v "${KUBE_VERBOSE}" \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-base "${KUBE_ROOT}/vendor" \
+        --output-dir "${KUBE_ROOT}/staging/src/k8s.io/client-go" \
-        --output-package="k8s.io/client-go" \
+        --output-pkg="k8s.io/client-go" \
         --clientset-name="kubernetes" \
         --input-base="k8s.io/api" \
         --apply-configuration-package "${APPLYCONFIG_PKG}" \
@@ -686,12 +652,9 @@ function codegen::clients() {
 }
 
 function codegen::listers() {
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/lister-gen
 
-    local listergen
-    listergen=$(kube::util::find-binary "lister-gen")
-
     local ext_apis=()
     kube::util::read-array ext_apis < <(
         cd "${KUBE_ROOT}/staging/src"
@@ -701,7 +664,7 @@ function codegen::listers() {
 
     kube::log::status "Generating lister code for ${#ext_apis[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${listergen} for:"
+        kube::log::status "DBG: running lister-gen for:"
         for api in "${ext_apis[@]}"; do
             kube::log::status "DBG:     $api"
         done
@@ -714,11 +677,12 @@ function codegen::listers() {
         || true) \
         | xargs -0 rm -f
 
-    "${listergen}" \
+    lister-gen \
+        -v "${KUBE_VERBOSE}" \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-base "${KUBE_ROOT}/vendor" \
+        --output-dir "${KUBE_ROOT}/staging/src/k8s.io/client-go/listers" \
-        --output-package "k8s.io/client-go/listers" \
+        --output-pkg "k8s.io/client-go/listers" \
-        $(printf -- " --input-dirs %s" "${ext_apis[@]}") \
+        "${ext_apis[@]}" \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -727,12 +691,9 @@ function codegen::listers() {
 }
 
 function codegen::informers() {
-    GO111MODULE=on GOPROXY=off go install \
+    GOPROXY=off go install \
         k8s.io/code-generator/cmd/informer-gen
 
-    local informergen
-    informergen=$(kube::util::find-binary "informer-gen")
-
     local ext_apis=()
     kube::util::read-array ext_apis < <(
         cd "${KUBE_ROOT}/staging/src"
@@ -742,7 +703,7 @@ function codegen::informers() {
 
     kube::log::status "Generating informer code for ${#ext_apis[@]} targets"
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
-        kube::log::status "DBG: running ${informergen} for:"
+        kube::log::status "DBG: running informer-gen for:"
         for api in "${ext_apis[@]}"; do
             kube::log::status "DBG:     $api"
         done
@@ -755,14 +716,15 @@ function codegen::informers() {
         || true) \
         | xargs -0 rm -f
 
-    "${informergen}" \
+    informer-gen \
+        -v "${KUBE_VERBOSE}" \
         --go-header-file "${BOILERPLATE_FILENAME}" \
-        --output-base "${KUBE_ROOT}/vendor" \
+        --output-dir "${KUBE_ROOT}/staging/src/k8s.io/client-go/informers" \
-        --output-package "k8s.io/client-go/informers" \
+        --output-pkg "k8s.io/client-go/informers" \
         --single-directory \
-        --versioned-clientset-package k8s.io/client-go/kubernetes \
+        --versioned-clientset-package "k8s.io/client-go/kubernetes" \
-        --listers-package k8s.io/client-go/listers \
+        --listers-package "k8s.io/client-go/listers" \
-        $(printf -- " --input-dirs %s" "${ext_apis[@]}") \
+        "${ext_apis[@]}" \
         "$@"
 
     if [[ "${DBG_CODEGEN}" == 1 ]]; then
@@ -779,17 +741,17 @@ function indent() {
 function codegen::subprojects() {
     # Call generation on sub-projects.
     local subs=(
-        vendor/k8s.io/code-generator/examples
+        staging/src/k8s.io/code-generator/examples
-        vendor/k8s.io/kube-aggregator
+        staging/src/k8s.io/kube-aggregator
-        vendor/k8s.io/sample-apiserver
+        staging/src/k8s.io/sample-apiserver
-        vendor/k8s.io/sample-controller
+        staging/src/k8s.io/sample-controller
-        vendor/k8s.io/metrics
+        staging/src/k8s.io/metrics
-        vendor/k8s.io/apiextensions-apiserver
+        staging/src/k8s.io/apiextensions-apiserver
-        vendor/k8s.io/apiextensions-apiserver/examples/client-go
+        staging/src/k8s.io/apiextensions-apiserver/examples/client-go
     )
 
     local codegen
-    codegen="$(pwd)/vendor/k8s.io/code-generator"
+    codegen="${KUBE_ROOT}/staging/src/k8s.io/code-generator"
     for sub in "${subs[@]}"; do
         kube::log::status "Generating code for subproject ${sub}"
         pushd "${sub}" >/dev/null
@@ -834,13 +796,13 @@ function codegen::protobindings() {
     done
 
     if kube::protoc::check_protoc >/dev/null; then
-      hack/update-generated-proto-bindings-dockerized.sh "${apis[@]}"
+      hack/_update-generated-proto-bindings-dockerized.sh "${apis[@]}"
     else
       kube::log::status "protoc ${PROTOC_VERSION} not found (can install with hack/install-protoc.sh); generating containerized..."
       # NOTE: All output from this script needs to be copied back to the calling
       # source tree.  This is managed in kube::build::copy_output in build/common.sh.
       # If the output set is changed update that function.
-      build/run.sh hack/update-generated-proto-bindings-dockerized.sh "${apis[@]}"
+      build/run.sh hack/_update-generated-proto-bindings-dockerized.sh "${apis[@]}"
     fi
 }
 

hack/update-generated-api-compatibility-data.sh

@@ -23,9 +23,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
 
-# run in module mode to match test command in readme.md
-export GO111MODULE=on
-
 # Nuke old files so we don't accidentally carry stuff forward.
 rm -f staging/src/k8s.io/api/testdata/HEAD/*.{yaml,json,pb}
 rm -f staging/src/k8s.io/apiextensions-apiserver/pkg/apis/testdata/HEAD/*.{yaml,json,pb}

hack/update-generated-docs.sh

@@ -26,21 +26,69 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-
-BINS=(
-	cmd/gendocs
-	cmd/genkubedocs
-	cmd/genman
-	cmd/genyaml
-)
-make -C "${KUBE_ROOT}" WHAT="${BINS[*]}"
-
 kube::util::ensure-temp-dir
 
-kube::util::gen-docs "${KUBE_TEMP}"
+BINS=(
+	./cmd/gendocs
+	./cmd/genkubedocs
+	./cmd/genman
+	./cmd/genyaml
+)
+GOPROXY=off go install "${BINS[@]}"
 
-# remove all of the old docs
+# Run all doc generators.
-kube::util::remove-gen-docs
+# $1 is the directory to put those generated documents
+generate_docs() {
+  local dest="$1"
+
+  mkdir -p "${dest}/docs/user-guide/kubectl/"
+  gendocs "${dest}/docs/user-guide/kubectl/"
+
+  mkdir -p "${dest}/docs/admin/"
+  genkubedocs "${dest}/docs/admin/" "kube-apiserver"
+  genkubedocs "${dest}/docs/admin/" "kube-controller-manager"
+  genkubedocs "${dest}/docs/admin/" "kube-proxy"
+  genkubedocs "${dest}/docs/admin/" "kube-scheduler"
+  genkubedocs "${dest}/docs/admin/" "kubelet"
+  genkubedocs "${dest}/docs/admin/" "kubeadm"
+
+  mkdir -p "${dest}/docs/man/man1/"
+  genman "${dest}/docs/man/man1/" "kube-apiserver"
+  genman "${dest}/docs/man/man1/" "kube-controller-manager"
+  genman "${dest}/docs/man/man1/" "kube-proxy"
+  genman "${dest}/docs/man/man1/" "kube-scheduler"
+  genman "${dest}/docs/man/man1/" "kubelet"
+  genman "${dest}/docs/man/man1/" "kubectl"
+  genman "${dest}/docs/man/man1/" "kubeadm"
+
+  mkdir -p "${dest}/docs/yaml/kubectl/"
+  genyaml "${dest}/docs/yaml/kubectl/"
+
+  # create the list of generated files
+  pushd "${dest}" > /dev/null || return 1
+  touch docs/.generated_docs
+  find . -type f | cut -sd / -f 2- | LC_ALL=C sort > docs/.generated_docs
+  popd > /dev/null || return 1
+}
+
+# Removes previously generated docs-- we don't want to check them in. $KUBE_ROOT
+# must be set.
+remove_generated_docs() {
+  if [ -e "${KUBE_ROOT}/docs/.generated_docs" ]; then
+    # remove all of the old docs; we don't want to check them in.
+    while read -r file; do
+      rm "${KUBE_ROOT}/${file}" 2>/dev/null || true
+    done <"${KUBE_ROOT}/docs/.generated_docs"
+    # The docs/.generated_docs file lists itself, so we don't need to explicitly
+    # delete it.
+  fi
+}
+
+# generate into KUBE_TMP
+generate_docs "${KUBE_TEMP}"
+
+# remove all of the existing docs in KUBE_ROOT
+remove_generated_docs
 
 # Copy fresh docs into the repo.
 # the shopt is so that we get docs/.generated_docs from the glob.

hack/update-go-workspace.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Copyright 2022 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script generates go.work so that it includes all Go packages
+# in this repo, with a few exceptions.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Go tools really don't like it if you have a symlink in `pwd`.
+cd "$(pwd -P)"
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
+
+cd "${KUBE_ROOT}"
+
+# Avoid issues and remove the workspace files.
+rm -f go.work go.work.sum
+
+# Generate the workspace.
+go work init
+go work edit -use .
+git ls-files -z ':(glob)./staging/src/k8s.io/*/go.mod' \
+    | xargs -0 -n1 dirname -z \
+    | xargs -0 -n1 go work edit -use
+go mod download # generate go.work.sum

hack/update-gofmt.sh

@@ -23,7 +23,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
@@ -36,6 +36,7 @@ function git_find() {
         ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
         ':!:third_party/*'   `# catches third_party/...` \
         ':!:*/third_party/*' `# catches third_party/...` \
+        ':!:*/testdata/*'    `# catches any subdir/testdata/...` \
         ':(glob)**/*.go' \
         "$@"
 }

hack/update-import-aliases.sh

@@ -25,7 +25,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 

hack/update-internal-modules.sh

@@ -29,16 +29,13 @@ MODULES=(
     staging/src/k8s.io/kms/internal/plugins/_mock
 )
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run hack/update-internal-modules.sh with \$GOPROXY=off"
   exit 1
 fi
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 for mod in "${MODULES[@]}"; do
   pushd "${KUBE_ROOT}/${mod}" >/dev/null

hack/update-kustomize.sh

@@ -18,8 +18,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-source hack/lib/util.sh
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
 
+kube::golang::setup_env
 kube::util::require-jq
 kube::util::ensure_clean_working_dir
 
@@ -62,9 +64,11 @@ git add .
 git commit -a -m "Update kubectl kustomize to kyaml/$LATEST_KYAML, cmd/config/$LATEST_CONFIG, api/$LATEST_API, kustomize/$LATEST_KUSTOMIZE"
 
 echo -e "\n${color_blue:?}Verifying kubectl kustomize version${color_norm:?}"
-make WHAT=cmd/kubectl
+# We use `make` here intead of `go install` to ensure that all of the
+# linker-defined values are set.
+make -C "${KUBE_ROOT}" WHAT=./cmd/kubectl
 
-if [[ $(_output/bin/kubectl version --client -o json | jq -r '.kustomizeVersion') != "$LATEST_KUSTOMIZE" ]]; then
+if [[ $(kubectl version --client -o json | jq -r '.kustomizeVersion') != "$LATEST_KUSTOMIZE" ]]; then
   echo -e "${color_red:?}Unexpected kubectl kustomize version${color_norm:?}"
   exit 1
 fi

hack/update-mocks.sh

@@ -23,10 +23,7 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
 
-kube::golang::verify_go_version
 kube::golang::setup_env
 
 echo 'installing mockgen'
@@ -34,17 +31,15 @@ pushd "${KUBE_ROOT}/hack/tools" >/dev/null
   go install github.com/golang/mock/mockgen
 popd >/dev/null
 
-function git_find() {
+function git_grep() {
-  # Similar to find but faster and easier to understand.  We want to include
+  git grep --untracked --exclude-standard \
-  # modified and untracked files because this might be running against code
+      "$@" \
-  # which is not tracked by git yet.
-  git ls-files -cmo --exclude-standard \
       ':!:vendor/*'        `# catches vendor/...` \
       ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
       ':!:third_party/*'   `# catches third_party/...` \
       ':!:*/third_party/*' `# catches third_party/...` \
-      ':!:*/testdata/*' \
+      ':!:*/testdata/*'    `# catches any testdata` \
-      "$@"
+      ':(glob)**/*.go'
 }
 
 cd "${KUBE_ROOT}"
@@ -55,19 +50,12 @@ GENERATED_MOCK_FILE_REGEX="^// Code generated by MockGen. DO NOT EDIT.$"
 tmp=$(mktemp)
 kube::util::trap_add "rm -f ${tmp:?}" EXIT
 
-# We use this pattern here rather than `git grep` because we don't really want
+git_grep -l -z "${GENERATED_MOCK_FILE_REGEX}" | xargs -0 rm -f
-# to encode the pathspec list in multiple places and anything more complicated
-# just isn't worth the effort.
-git_find -z ':(glob)**/*.go' \
-    | { xargs -0 grep -l --null "${GENERATED_MOCK_FILE_REGEX}" || true; } \
-    | xargs -0 rm -f
 
 echo 'executing go generate command on below files'
 
-git_find -z ':(glob)**/*.go' | while read -r -d $'\0' file; do
+git_grep -l -z "//go:generate mockgen" | while read -r -d $'\0' file; do
-  test -f "$file" || continue
+  echo "- ${file}"
-  grep -q "//go:generate mockgen" "$file" || continue
-
   temp_file_name="$(kube::realpath "$(mktemp -t "$(basename "$0").XXXXXX")")"
 
   # search for build tag used in file
@@ -82,7 +70,9 @@ git_find -z ':(glob)**/*.go' | while read -r -d $'\0' file; do
     BUILD_TAG_FILE=$temp_file_name go generate -v "$file"
   else
     # if no +build tag is defined in interface file
-    go generate -v "$file"
+    # NOTE: This works around a bug in `go generate` with workspaces, which
+    # should be fixed in Go 1.22.1.
+    go -C "$(dirname "$file")" generate "$(basename "$file")"
   fi
 done
 

hack/update-netparse-cve.sh

@@ -28,15 +28,12 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 # Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
+export GOBIN="${KUBE_OUTPUT_BIN}"
 PATH="${GOBIN}:${PATH}"
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-
 # Install golangci-lint
 echo 'installing net parser converter'
 pushd "${KUBE_ROOT}/hack/tools" >/dev/null
@@ -53,7 +50,8 @@ function git_find() {
         ':!:vendor/*'        `# catches vendor/...` \
         ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
         ':!:third_party/*'   `# catches third_party/...` \
-        ':!:*/third_party/*' `# catches third_party/...` \
+        ':!:*/third_party/*' `# catches any subdir/third_party/...` \
+        ':!:*/testdata/*'    `# catches any subdir/testdata/...` \
         ':(glob)**/*.go' \
         "$@"
 }

hack/update-openapi-spec.sh

@@ -30,6 +30,8 @@ kube::util::require-jq
 kube::golang::setup_env
 kube::etcd::install
 
+# We need to call `make` here because that includes all of the compile and link
+# flags that we use for a production build, which we need for this script.
 make -C "${KUBE_ROOT}" WHAT=cmd/kube-apiserver
 
 function cleanup()
@@ -70,7 +72,7 @@ fi
 # Start kube-apiserver
 # omit enums from static openapi snapshots used to generate clients until #109177 is resolved
 kube::log::status "Starting kube-apiserver"
-"${KUBE_OUTPUT_HOSTBIN}/kube-apiserver" \
+kube-apiserver \
   --bind-address="${API_HOST}" \
   --secure-port="${API_PORT}" \
   --etcd-servers="http://${ETCD_HOST}:${ETCD_PORT}" \

hack/update-vanity-imports.sh

@@ -27,7 +27,7 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 kube::golang::verify_go_version
 
 pushd "${KUBE_ROOT}/hack/tools" >/dev/null
-    GO111MODULE=on go install github.com/jcchavezs/porto/cmd/porto
+    go install github.com/jcchavezs/porto/cmd/porto
 popd >/dev/null
 
 porto --restrict-to-dirs="staging" --restrict-to-files="doc\\.go$" -w "${KUBE_ROOT}"

hack/update-vendor-licenses.sh

@@ -135,7 +135,8 @@ process_content () {
 #############################################################################
 
 # use modules, and use module info rather than the vendor dir for computing dependencies
-export GO111MODULE=on
+kube::golang::setup_env
+export GOWORK=off
 export GOFLAGS=-mod=mod
 
 # Check bash version

hack/update-vendor.sh

@@ -24,9 +24,12 @@ cd "$(pwd -P)"
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
+# Get all the default Go environment.
+kube::golang::setup_env
+
 # Turn off workspaces until we are ready for them later
 export GOWORK=off
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
+# Explicitly opt into go modules
 export GO111MODULE=on
 # Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
 export GOFLAGS=-mod=mod
@@ -39,7 +42,6 @@ if [[ "${GOPROXY:-}" == "off" ]]; then
   exit 1
 fi
 
-kube::golang::verify_go_version
 kube::util::require-jq
 
 TMP_DIR="${TMP_DIR:-$(mktemp -d /tmp/update-vendor.XXXX)}"
@@ -53,6 +55,7 @@ exec 22>&2            # Real stderr, use this explicitly
 exec 1>"${LOG_FILE}"  # Automatic stdout
 exec 2>&1             # Automatic stderr
 set -x                # Trace this script to stderr
+go env                # For the log
 
 function finish {
   ret=$?
@@ -403,15 +406,12 @@ hack/update-internal-modules.sh
 
 
 # Phase 8: rebuild vendor directory
-kube::log::status "vendor: running 'go mod vendor'" >&11
+(
-go mod vendor
+  kube::log::status "vendor: running 'go work vendor'" >&11
-
+  unset GOWORK
-# create a symlink in vendor directory pointing to the staging components.
+  unset GOFLAGS
-# This lets other packages and tools use the local staging components as if they were vendored.
+  go work vendor
-for repo in $(kube::util::list_staging_repos); do
+)
-  rm -fr "${KUBE_ROOT}/vendor/k8s.io/${repo}"
-  ln -s "../../staging/src/k8s.io/${repo}" "${KUBE_ROOT}/vendor/k8s.io/${repo}"
-done
 
 kube::log::status "vendor: updating vendor/LICENSES" >&11
 hack/update-vendor-licenses.sh

hack/update-yamlfmt.sh

@@ -28,10 +28,8 @@ cd "${KUBE_ROOT}"
 find_files() {
   find . -not \( \
       \( \
-        -wholename './output' \
+        -wholename './.git' \
-        -o -wholename './.git' \
         -o -wholename './_output' \
-        -o -wholename './_gopath' \
         -o -wholename './release' \
         -o -wholename './target' \
         -o -wholename '*/vendor/*' \
@@ -39,5 +37,4 @@ find_files() {
     \) -name 'OWNERS*'
 }
 
-export GO111MODULE=on
 find_files | xargs go run cmd/yamlfmt/yamlfmt.go

hack/verify-api-groups.sh

@@ -69,7 +69,7 @@ groups_without_codegen=(
 	"imagepolicy"
 	"admission"
 )
-client_gen_file="${KUBE_ROOT}/vendor/k8s.io/code-generator/cmd/client-gen/main.go"
+client_gen_file="${KUBE_ROOT}/staging/src/k8s.io/code-generator/cmd/client-gen/main.go"
 
 for group_dirname in "${group_dirnames[@]}"; do
 	if ! grep -q "${group_dirname}/" "${client_gen_file}" ; then

hack/verify-cli-conventions.sh

@@ -27,14 +27,9 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
 
-BINS=(
+GOPROXY=off go install ./cmd/clicheck
-	cmd/clicheck
-)
-make -C "${KUBE_ROOT}" WHAT="${BINS[*]}"
 
-clicheck=$(kube::util::find-binary "clicheck")
+if ! output=$(clicheck 2>&1)
-
-if ! output=$($clicheck 2>&1)
 then
 	echo "$output"
 	echo

hack/verify-conformance-requirements.sh

@@ -26,13 +26,13 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
 errors=()
 # Check conformance tests follow the requirements as https://git.k8s.io/community/contributors/devel/sig-architecture/conformance-tests.md#conformance-test-requirements
-if ! failedLint=$(GO111MODULE=on GOPROXY=off go run hack/conformance/check_conformance_test_requirements.go "${KUBE_ROOT}"/test/e2e/)
+if ! failedLint=$(GOPROXY=off go run hack/conformance/check_conformance_test_requirements.go "${KUBE_ROOT}"/test/e2e/)
 then
   errors+=( "${failedLint}" )
 fi

hack/verify-description.sh

@@ -28,19 +28,13 @@ source "${KUBE_ROOT}/hack/lib/util.sh"
 
 kube::golang::setup_env
 
-make -C "${KUBE_ROOT}" WHAT=cmd/genswaggertypedocs
+GOPROXY=off go install ./cmd/genswaggertypedocs
-
-# Find binary
-genswaggertypedocs=$(kube::util::find-binary "genswaggertypedocs")
-
-result=0
 
 find_files() {
   find . -not \( \
       \( \
-        -wholename './output' \
+        -wholename '.git' \
         -o -wholename './_output' \
-        -o -wholename './_gopath' \
         -o -wholename './release' \
         -o -wholename './target' \
         -o -wholename '*/third_party/*' \
@@ -70,10 +64,11 @@ kube::util::check-file-in-alphabetical-order "${failure_file}"
 failing_files=()
 while IFS='' read -r line; do failing_files+=("$line"); done < <(cat "$failure_file")
 
+result=0
 for file in $versioned_api_files; do
   if ! kube::util::array_contains "$file" "${failing_files[@]}"; then
     gen_swagger_result=0
-    $genswaggertypedocs -v -s "${file}" -f - || gen_swagger_result=$?
+    genswaggertypedocs -v -s "${file}" -f - || gen_swagger_result=$?
     if [[ "${gen_swagger_result}" -ne 0 ]]; then
       echo "API file: ${file} is missing: ${gen_swagger_result} descriptions"
       result=1