Repository: kubernetes/kubernetes (language: go)

Issue:
Missed k8s.io/kube-openapi/cmd/openapi-gen dependency on code-generator go.mod
### What happened?

We're trying to upgrade `k8s.io/code-generator` to `v1.30.1`  (https://github.com/kubernetes-sigs/kueue/pull/2402) and found the issue on executing `kube::codegen::gen_openapi` (https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_kueue/2402/pull-kueue-verify-main/1800788997593632768). 

```
../kube-openapi@v0.0.0-20240228011516-70dd3763d340/pkg/common/common.go:23:2: missing go.sum entry for module providing package github.com/emicklei/go-restful/v3 (imported by k8s.io/kube-openapi/pkg/common); to add:
	go get k8s.io/kube-openapi/pkg/common@v0.0.0-20240228011516-70dd3763d340
```

The problem is that on go.mod (https://github.com/kubernetes/code-generator/blob/master/go.mod) missed `github.com/emicklei/go-restful/v3` dependency that not allow to install `k8s.io/kube-openapi` (https://github.com/kubernetes/code-generator/blob/master/kube_codegen.sh#L330C45-L330C64)

### What did you expect to happen?

No error

### How can we reproduce it (as minimally and precisely as possible)?

To reproduce the same what happening on https://github.com/kubernetes/code-generator/blob/master/kube_codegen.sh#L325-L330, just execute this command on code-generator folder:
```bash
GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen
```

### Anything else we need to know?

I think it's happens after this commit https://github.com/kubernetes/kubernetes/commit/1a4450f6ffdad44bfc12fae5911c93e3bd238f0f.

### Kubernetes version

<details>

```console
$ kubectl version
# paste output here
```

</details>


### Cloud provider

<details>

</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>



Discussion / hints:
/cc @alculquicondor @mimowo @thockin 
/assign
> GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen

/sig api-machinery

I was able to reproduce, but just because I had an older version of kube-openapi in my GOPATH. Using the `@latest` prefix in the command fixed it.

```
$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen
../../gopath/pkg/mod/k8s.io/kube-openapi@v0.0.0-20240228011516-70dd3763d340/pkg/common/common.go:23:2: missing go.sum entry for module providing package github.com/emicklei/go-restful/v3 (imported by k8s.io/kube-openapi/pkg/common); to add:
        go get k8s.io/kube-openapi/pkg/common@v0.0.0-20240228011516-70dd3763d340

$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen@latest
go: downloading k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a

$ GO111MODULE=on go install k8s.io/kube-openapi/cmd/openapi-gen@latest
```

I think line https://github.com/kubernetes/code-generator/blob/master/kube_codegen.sh#L330C45-L330C64 needs to be

```
GO111MODULE=on go install $(printf "k8s.io/kube-openapi/cmd/%s@latest" "${BINS[@]}")
```
Yeah, with `latest` works for me too.
Either that or we pin to a more recent commit, for example `@835d969ad83a`. For some reason if you ommit the version it is using a [commit ](https://github.com/kubernetes/kube-openapi/commit/70dd3763d340)from Feb 27.
> Either that or we pin to a more recent commit, for example `@835d969ad83a`. 

@mauri870 thanks for investigating.

Question, if we use `@latest` would this not cause problems in the future if we try to build a release branch from the past? Maybe this is not a big deal. OTOH if we hardcode a tag, it may create maintenance costs.

I'm wondering if there is a better way, say to version `openapi-gen` and use the corresponding tag, say `1.30.1`?

Using tags would be a way to have more reproducible builds, they still need to be tagged from time to time tho. That is still better than using `@latest` or micro managing commit revisions.
Thanks @mauri870 and @mimowo for the research. Is either of you thinking on submitting a fix for this? Thanks!
I can do it.
> I can do it.

Thanks!

/assign mbobrovskyi
Yes, please don't use `@latest`

Generally instead we'd control the version of a tool in the hack/tools module and install it from there (see e.g. https://github.com/kubernetes/kubernetes/blob/eb6840928df59bf8203b1eda839ccd3da68fb37d/hack/verify-spelling.sh#L35
https://github.com/kubernetes/kubernetes/blob/eb6840928df59bf8203b1eda839ccd3da68fb37d/hack/tools/go.mod#L8

https://github.com/kubernetes/kubernetes/blob/eb6840928df59bf8203b1eda839ccd3da68fb37d/hack/tools/tools.go#L24

This allows us to also gain go.sum for the package while not polluting the main module with dev-only dependencies.

Fix patch:
diff --git a/staging/src/k8s.io/code-generator/go.mod b/staging/src/k8s.io/code-generator/go.mod
index a45b5f2e28984..8859c3eaf2c49 100644
--- a/staging/src/k8s.io/code-generator/go.mod
+++ b/staging/src/k8s.io/code-generator/go.mod
@@ -20,6 +20,7 @@ require (
 )
 
 require (
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
diff --git a/staging/src/k8s.io/code-generator/go.sum b/staging/src/k8s.io/code-generator/go.sum
index 7f9849382b897..fc220ef1dee3f 100644
--- a/staging/src/k8s.io/code-generator/go.sum
+++ b/staging/src/k8s.io/code-generator/go.sum
@@ -6,7 +6,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/fxamacker/cbor/v2 v2.7.0-beta h1:m5bO941uTVpSms26QjzEJxUZaC3S/h1pSJexBCu4wAA=
 github.com/fxamacker/cbor/v2 v2.7.0-beta/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
diff --git a/staging/src/k8s.io/code-generator/tools.go b/staging/src/k8s.io/code-generator/tools.go
index d0e2c7764f2e7..4080b2c5907b3 100644
--- a/staging/src/k8s.io/code-generator/tools.go
+++ b/staging/src/k8s.io/code-generator/tools.go
@@ -31,4 +31,5 @@ import (
 	_ "k8s.io/code-generator/cmd/informer-gen"
 	_ "k8s.io/code-generator/cmd/lister-gen"
 	_ "k8s.io/code-generator/cmd/register-gen"
+	_ "k8s.io/kube-openapi/cmd/openapi-gen"
 )


Test patch: