Proposal: Switch to dep for dependency management

[arschles]

dep is the "official experimental" dependency management tool for Go. I believe we should switch from using glide to vendor our dependencies to this tool.

From experience, the major benefit dep has over glide is that its usage is declarative. You run dep ensure and the tool does roughly the following:

• looks at your imports
• based on your imports, adds all the packages you need
• based on your imports, removes all the packages you don't need
• updates the dependencies file (Gopkg.toml), the lock file (Gopkg.lock), and the vendor directory as needed

The result is that we would no longer need to run glide get to manually add new dependencies. We've also had to do various manual tasks to manage our vendor directory. For example, we've had to rm -rf vendor and then re-run glide install to get a "clean" vendor directory. Dep provides the tools so we don't have to do that anymore.

[carolynvs]

I'd be happy to provide assistance on this one, or help answer dep questions.

Disclaimer: I am a maintainer for dep and am actively working on features to make dep better for kubernetes libraries. 😇

[pmorie]

This seems to be where things are headed in the k8s community. I have heard good things about dep's dependency pruning capabilities and have found adding dependencies or updating a subset of dependencies to be extremely painful with glide. @carolynvs if you have the cycles, you're welcome to do this IMO

[MHBauer]

I want to see dep as soon as possible as widely as possible. It does seem like it will be the go official tool.

As long as I have the ability to check out and build, I am happy. I have not run anything glide related in quite a while.

@nilebox probably has done the most dependency probing and updating.

[carolynvs]

Sweet! I'll work on this next week.