regression: make $VERSION 3rd-party independant

[rexagod]

3rd-party dependencies cannot be installed pre-build since Makefile variables are initialized earlier than that. At the moment, this causes kube_state_metrics_build_info to have a labelset of {...,version="v"}.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rexagod

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rexagod]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

This issue is currently awaiting triage.

If kube-state-metrics contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rexagod]

Addressed in v2.14 by https://github.com/kubernetes/kube-state-metrics/pull/2456/files.

[rexagod]

@mrueg I'm opening this again as this seems to be a regression for air-tight builders that can only utilize /vendor's content, but not download, for instance, the contents of tools if they seemingly for a part of the production build pipeline (i.e., the lack of gomplate results in an empty -ldflag for version, which results in an empty version labelvalue).

I'd like to cut a 2.14.1 to address this for such builders, WDYT?

[mrueg]

I see two other options here:

a) add gomplate to your path in the build infra before the actual build
b) wait for go1.24 https://tip.golang.org/doc/go1.24#tools

Would those help?

[rexagod]

Thank you for looking into it, Manuel.

While the second approach sounds very cool, it can take a while for us to get there. The first one will require us to keep downstream assets (all tools binaries) and plug them into a $GOBIN or $PATH to pick them during make install-tools. I find myself leaning away from the multi-point complexity that this may introduce, in favor of making the production build process third-party dependency-free (except what's already in /vendor).

To correct myself, we don't necessarily need to cut a minor release for this, if this is something the wider community isn't facing (I can cherry-pick the commit to our midstream).

[rexagod]

Pinging @mrueg for another look here. 🙇🏼

[mrueg]

I really would like to get version information programmatically. Wouldn't it be possible for you to vendor the tools folder with it's go.mod file as well?

[rexagod]

Let me look into that. But I'm not sure what you mean by "getting the version information programmatically"? IIUC we do so right now as well (in this patch), without any third-party dependencies?

EDIT: Ah, I think you mean in a way that's supported by the templating library we use since the current approach assumes a ^version: \d.\d.\d-like expressions' presence in the configuration.

[rexagod]

Post-vendoring, we'll need to build the binaries from that, and add them to PATH. I'd prefer to keep that logic upstream, so air-tight builders and others can equally depend on that workflow without the need to resort to their own makeshift workarounds. However, this will require us to start vendoring in KSM, and modify the Dockerfile to build and use the vendored binary instead of make install-tools (or anything that makes a network request).

Personally, I'd wish to see the build process pure and independent of any non-go or non-core-utils binary, with all production dependencies defined in the root go.mod, while the nested ones may be used for other non-production purposes. Continuing my previous comment, I believe the ^version: \d.\d.\d assumption in this patch is a safe one, WDYT?

[rexagod]

CC'ing @mrueg for a consensus here. 🙇🏼