CI check for undesired dependencies

[KnVerey]

kubernetes/kubernetes has a list of unacceptable dependencies that they check in CI. Since we are subject to the same requirements, we should add the same check. This would help us avoid surprises when we go to update kustomize in kubectl.

https://github.com/kubernetes/kubernetes/blob/e51fe4a61cca7f4a0875630da433f280b52c138a/hack/lint-dependencies.sh

We will need to think carefully about how to source the dependencies list itself. If we pick it up live, everyones PR will instantly start to fail if k/k adds something we already depend on to the list, which happened with a few archived packages recently. Do we want that?

[k8s-ci-robot]

@KnVerey: This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[natasha41575]

We will need to think carefully about how to source the dependencies list itself. If we pick it up live, everyones PR will instantly start to fail if k/k adds something we already depend on to the list, which happened with a few archived packages recently. Do we want that?

One option is to leave this CI check as optional. If we see it failing, we file an issue for the problematic dependency and mark that issue as release blocking.

[antoooks]

/assign

[antoooks]

The script on k/k checks 4 things:

1. undesired dependencies listed on unwanted-dependencies.json. I believe this file is updated manually and unless we have exactly the same blocked dependencies as k/k we have to maintain our own block list or create a merged list combining k/k's block list + ours.
2. outdated dependencies
3. non-canonical dependencies
4. unused dependencies

Should we cover all things for this issue or just the undesired dependencies? @natasha41575 @annasong20.

[koba1t]

I feel this problem is scoped in upgrading kustomize in Kubectl.
I think it is enough to check the dependencies list in the unwanted-dependencies.json file.

Kubectl is currently importing kustomize with go pkg. I feel we are not required to care about other dependency problems in Kubectl.

[antoooks]

@koba1t are you referring to k/k's unwanted-dependencies.json file or you agree that we should maintain our own?

[koba1t]

I think that is enough to refer to unwanted-dependencies.json in the k/k repo.

[koba1t]

/close

[k8s-ci-robot]

@koba1t: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.