Repository: kubernetes
Issue: 🐘 Untangle genproto / cloud.google.com/go dependencies
Labels: priority/important-longterm,sig/architecture,lifecycle/frozen,area/code-organization,needs-triage

https://github.com/kubernetes/kubernetes/pull/113225 uncovered a coming snarl of dependencies between cloud.google.com/go and google.golang.org/genproto

Because several generic libraries use the cloud.google.com/go/compute/metadata package, the following chain makes it almost impossible to avoid adding all cloud.google.com/go submodules into the dependency graph for all downstream consumers:
 * {golang.org/x/oauth2, google.golang.org/api, google.golang.org/grpc} --> cloud.google.com/go/compute --> cloud.google.com/go --> google.golang.org/genproto --> cloud.google.com/go/*

It's possible we can avoid the updates that expanded these cross-references in the short-term with [judicious upstream changes back to older genproto versions](https://github.com/container-storage-interface/spec/commit/150c9d9ed3cb0cb4b9ea90e0a95888e5894eb038#r87961504), but we should get ahead of this if we want to avoid being forced to pull in these dependency graph increases in the future for a critical bugfix.


## Recommendations

### 1. Isolate cloud.google.com/go/compute/metadata

The cloud.google.com/go/compute/metadata package (https://github.com/googleapis/google-cloud-go/tree/main/compute/metadata) only uses stdlib dependencies, but lives inside cloud.google.com/go/compute, which has many other references (https://github.com/googleapis/google-cloud-go/blob/main/compute/go.mod)

1. Isolate cloud.google.com/go/compute/metadata to its own zero-dependency module
    - [x] https://github.com/googleapis/google-cloud-go/issues/6311 / https://pkg.go.dev/cloud.google.com/go/compute/metadata
    - [x] drop backreference to `cloud.google.com/go/compute` from https://github.com/googleapis/google-cloud-go/blob/main/compute/metadata/go.mod#L5 to reach zero-dependencies - https://github.com/googleapis/google-cloud-go/pull/9545
    - [x] tag a release of cloud.google.com/go/compute/metadata - [compute/metadata/v0.3.0](https://github.com/googleapis/google-cloud-go/blob/compute/metadata/v0.3.0/compute/metadata/go.mod)

2. Sweep dependencies using cloud.google.com/go/compute/metadata and update them to use the zero-dependency alternative

    - golang.org/x/oauth2 - [v0.20.0](https://github.com/golang/oauth2/blob/v0.20.0/go.mod)+
    - google.golang.org/api - [v0.174.0](https://github.com/googleapis/google-api-go-client/blob/v0.174.0/go.mod#L8)+
    - google.golang.org/grpc - [v1.65.0](https://github.com/grpc/grpc-go/blob/v1.65.0/go.mod#L22)+
    - github.com/google/cadvisor (transitive via golang.org/x/oauth2, google.golang.org/api, google.golang.org/grpc)
      - [x] https://github.com/google/cadvisor/pull/3622
      - [ ] tagged
    - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (transitive via golang.org/x/oauth2, google.golang.org/grpc)
      - [x] committed - https://github.com/open-telemetry/opentelemetry-go-contrib/pull/3968
      - [x] tagged

### 2. Prune use of cloud genproto packages in non-cloud.google.com modules

1. Update github.com/googleapis/gax-go/v2 test to not require the google.golang.org/genproto/googleapis/cloud/location package
    - [x] committed - https://github.com/googleapis/gax-go/pull/237
    - [x] tagged - https://github.com/googleapis/gax-go/releases/tag/v2.7.0
    - [x] https://github.com/googleapis/gax-go/issues/270
    - [x] tag release (>=v2.9.1)

### 3. Isolate generic genproto packages

- [x] make the types in the following generic packages available without dragging in all of cloud.google.com/go

    * google.golang.org/genproto/googleapis/api/...
    * google.golang.org/genproto/googleapis/bytestream
    * google.golang.org/genproto/googleapis/rpc/...

  - [x] Submodules created in https://github.com/googleapis/go-genproto/pull/1012
  - [x] Backreferences dropped in https://github.com/googleapis/go-genproto/pull/1087, https://github.com/googleapis/go-genproto/pull/1093


### 4. Drop use of `google.golang.org/genproto/protobuf/field_mask`

Update to use canonical `google.golang.org/protobuf/types/known/fieldmaskpb` package instead

- google.golang.org/genproto
  - [x] https://github.com/googleapis/go-genproto/issues/1008
- cloud.google.com/go
  - [x] https://github.com/googleapis/google-cloud-go/pull/7962
- github.com/grpc-ecosystem/grpc-gateway/v2
  - [x] https://github.com/grpc-ecosystem/grpc-gateway/pull/3317
- github.com/grpc-ecosystem/grpc-gateway
  - [x] https://github.com/kubernetes/kubernetes/pull/118119
  - [x] https://github.com/etcd-io/etcd/issues/14499 (used by go.etcd.io/etcd/api/v3 / go.etcd.io/etcd/server/v3)
    - [x] https://github.com/etcd-io/etcd/pull/16595
    - [ ] etcd client release (3.6)
    - [ ] update kubernetes to use etcd client 3.6+ - https://github.com/kubernetes/kubernetes/pull/128419


/priority important-longterm
/area code-organization
/sig architecture
/cc @dims
fyi @codyoss @bertinatto