🌱 Import Boss API restrictions should be transitive

[JoelSpeed]

What this PR does / why we need it:
We need to make sure that the packages transitive dependencies also don't import controller runtime for proper cleanliness and to prevent regressions.

Part of #9011

cc @sbueringer

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign neolit123 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chrischdi]

Makes sense!

/lgtm

[killianmuldoon]

/area ci

Were you able to get the script to fail for transitive dependencies when using this? It doesn't seem to fail for me for the utils import in the addons/api/v1beta1 package

[chrischdi]

I'd still have expected that to fail for the ones whcih are not fixed?

/lgtm cancel

[JoelSpeed]

So i'm trying to test this, but I can't actually get the import-boss to fail on anything at the moment, which is worrying

/hold until I can work out how to get it to fail on importing a controller-runtime package

[killianmuldoon]

So i'm trying to test this, but I can't actually get the import-boss to fail on anything at the moment, which is worrying

I was about to ask this - I haven't actually reviewed any PRs with it until now.

[JoelSpeed]

So Import Boss, like most other gengo related projects, does not like relative paths, which is how we are configuring it right now.

When we pass --input-dirs, we currently use ./api as an example, you need to use sigs.k8s.io/cluster-api.api and use the proper go package name.

When it traverses the Universe of objects it discovers, it does a prefix match on the inputs, so only packages that it finds, which have an --input-dirs value as a prefix, are included in the files to be verified.

Currently it's comparing proper import paths with relative paths and nothing is actually being verified.

[chrischdi]

AFAIK we had it at least working at CAPV: There's an important caveat:

kubernetes-sigs/cluster-api-provider-vsphere#2338 (comment)

That was an important part when @sbueringer tested it afaik:

https://github.com/kubernetes-sigs/cluster-api-provider-vsphere/pull/2338/files#diff-ee660b3fcfaae1a793ded37f635b52c16dddbf9e279b2b6df4303922c5ce4093R52-R55

[JoelSpeed]

@chrischdi Can you get a positive failure on CAPV?
We have the unset GOPATH in the script for CAPI too

I just tried adding some debug logic to the skip and I don't think, even with the unset GOPATH it can be working

Skipping sigs.k8s.io/cluster-api/api/v1beta1 as it is not included in [./api/v1alpha4 ./api/v1beta1/index ./api/v1beta1]

The first string is the package name of a package we included in input dirs, but the logic here is causing it to skip the package

[JoelSpeed]

I've been playing with various combinations and stepping through import-boss with a debugger, I can see no way that this can possibly work with relative paths, every combination of GOPATH set/unset and relative and package names, always ends up with the package name being compared against the input dir string.

My conclusion so far is that you have to have import-boss inside GOPATH for it to work, I hope someone can prove me wrong 😓

[JoelSpeed]

/close

The transitive restrictions thing is for incoming imports, I'm not sure entirely what the use case is for that but it isn't going to help us here.

I think we could potentially use the incoming import thing to mark up other packages and prevent them from being imported into the API packages. Eg, we could prevent the util package being imported by putting a restriction on the util package

[k8s-ci-robot]

@JoelSpeed: Closed this PR.

In response to this:

/close

The transitive restrictions thing is for incoming imports, I'm not sure entirely what the use case is for that but it isn't going to help us here.

I think we could potentially use the incoming import thing to mark up other packages and prevent them from being imported into the API packages. Eg, we could prevent the util package being imported by putting a restriction on the util package

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sbueringer]

Sorry might have missed it. Not sure if you were able to make it fail now.

Once we used unset we were able to make it fail (in Prow and locally on macOS with M2 inside of the "regular" GOPATH location)

kubernetes-sigs/cluster-api-provider-vsphere#2344 (comment)

https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api-provider-vsphere/2344/pull-cluster-api-provider-vsphere-verify-main/1701512930987610112

Enforcing imports in source codes under the following directories: ./apis/v1alpha3,./apis/v1alpha4,./apis/v1beta1,./apis/vmware/v1beta1
E0912 08:35:45.985727   16631 main.go:41] Error: Failed executing generator: some packages had errors:
errors in package "./apis/v1beta1":
import sigs.k8s.io/controller-runtime/pkg/scheme has forbidden prefix sigs.k8s.io/controller-runtime
the following imports did not match any allowed prefix:
  sigs.k8s.io/controller-runtime/pkg/scheme
  sigs.k8s.io/controller-runtime/pkg/scheme
make: *** [Makefile:417: verify-import-restrictions] Error 1