Change:
We have many "test only" packages through out the project, containing fixtures, helpers, utilities, etc... These test libraries are not intended for use in production binaries. They often lack rigorous review and sufficient testing for use in production binaries. We should make sure they don't accidentally get pulled in. Strawman proposal, test only packages must import "testing". Blank import is sufficient: Then write a presubmit that fails if we find symbol in the release binary. This approach is trivial and fairly effective although a more sophisticated approach could print a dep chain.
/assign
I hope I will be able to contribute once this gets marked as .
/triage accepted
I think that will be enough a new script or a check in the building scripts /cc since he has experience from the providerless building effort
I got what we want to achieve here but I'm little confused about: If I execute: after adding the import then only it is giving - what do we want to achieve by executing this command exactly? I got what it is doing. I've opened a thread in slack as well:
Hello! Is there anyone working on this issue at the moment? If not and the issue it's still relevant, I would like to work on it if possible. Thank you.
I opened a PR in the meantime, if it's not needed anymore, I can close it.

Discussion:
<ins> #!/usr/bin/env bash # Copyright 2023 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # #     http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # This script checks whether the testing.init symbol is present in any # of the release binaries and fails if it finds one. This check is needed # to avoid including test libraries in production binaries as they often lack # rigorous review and sufficient testing. # Usage: `hack/verify-test-code.sh`. set -o errexit set -o nounset set -o pipefail KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/.. source "${KUBE_ROOT}/hack/lib/init.sh" cd "${KUBE_ROOT}" RELEASE_BIN_PKGS=( "${KUBE_ROOT}/cmd/cloud-controller-manager" "${KUBE_ROOT}/cmd/kube-apiserver" "${KUBE_ROOT}/cmd/kube-controller-manager" "${KUBE_ROOT}/cmd/kube-proxy" "${KUBE_ROOT}/cmd/kube-scheduler" "${KUBE_ROOT}/cmd/kubectl" "${KUBE_ROOT}/cmd/kubectl-convert" "${KUBE_ROOT}/cmd/kubelet" ) pkgs_with_testing_import=() for file in "${RELEASE_BIN_PKGS[@]}" do if [ "$(go list -json "${file}" | jq 'any(.Deps[]; . == "testing")')" == "true" ] then pkgs_with_testing_import+=( "${file}" ) fi done if [ ${#pkgs_with_testing_import[@]} -ne 0 ]; then printf "%sn" "Testing package imported in:" for file in "${pkgs_with_testing_import[@]}"; do printf "t%sn" "${file}" done exit 1 fi exit 0 </ins>

"net/url" "reflect" "sync" <del> "testing" </del> "time" v1 "k8s.io/api/core/v1"

"k8s.io/kubernetes/pkg/volume" ) <ins> type TB interface { Errorf(format string, args ...any) } </ins> type FakePod struct { Pod       *kubecontainer.Pod NetnsPath string

// from container runtime. BlockImagePulls      bool imagePullTokenBucket chan bool <del> T                    *testing.T </del> <ins> T                    TB </ins> } const FakeHost = "localhost:12345"

import ( "fmt" "io" <del> "testing" </del> "github.com/prometheus/client_golang/prometheus/testutil"

"k8s.io/component-base/metrics/legacyregistry" ) <ins> type TB interface { Logf(format string, args ...any) Errorf(format string, args ...any) Fatalf(format string, args ...any) } </ins> // CollectAndCompare registers the provided Collector with a newly created // pedantic Registry. It then does the same as GatherAndCompare, gathering the // metrics from the pedantic Registry.

return metrics.NewKubeRegistry() } <del> func AssertVectorCount(t *testing.T, name string, labelFilter map[string]string, wantCount int) { </del> <ins> func AssertVectorCount(t TB, name string, labelFilter map[string]string, wantCount int) { </ins> metrics, err := legacyregistry.DefaultGatherer.Gather() if err != nil { t.Fatalf("Failed to gather metrics: %s", err)

} } <del> func AssertHistogramTotalCount(t *testing.T, name string, labelFilter map[string]string, wantCount int) { </del> <ins> func AssertHistogramTotalCount(t TB, name string, labelFilter map[string]string, wantCount int) { </ins> metrics, err := legacyregistry.DefaultGatherer.Gather() if err != nil { t.Fatalf("Failed to gather metrics: %s", err)