Update k8s.io/client-go to v0.29.5

[andrzej-stencel]

This is a proposal to update the client-go dependency to a more recent version.

This is a breaking change, as it removes support for PodSecurityPolicy, which has been removed since Kubernetes v1.25.

I have upgraded to v0.29 as this is the latest version that supports Go 1.21 - client-go@v0.30 requires Go 1.22.

We can also upgrade to a version lower than v0.29 if that is needed by any of the downstream libraries depending on this package.

[cmacknz]

The two places that would use this are elastic-agent and beats, neither of which have any direct uses of PodSecurityPolicy in .go files. You should be good to proceed.

~/go/src/github.com/elastic/beats main
❯ rg 'PodSecurityPolicy' -l
metricbeat/module/kubernetes/apiserver/_meta/test/metrics.2.0
metricbeat/module/kubernetes/apiserver/_meta/test/metrics.2.0.expected
metricbeat/module/kubernetes/apiserver/_meta/testdata/docs.plain
metricbeat/module/kubernetes/apiserver/_meta/testdata/docs.plain-expected.json

~/go/src/github.com/elastic/elastic-agent main
❯ rg 'PodSecurityPolicy' -l
~/go/src/github.com/elastic/elastic-agent main

[cmacknz]

Actually doing a broader search directly in GitHub shows me that Cloudbeat is using kubernetes.PodSecurityPolicy directly so this update will create some work for them.

https://github.com/search?q=repo%3Aelastic%2Fcloudbeat%20PodSecurityPolicy&type=code

The two references are:
https://github.com/elastic/cloudbeat/blob/b6a55ec36074dd37802bb2f316d0f65d07d32ee6/internal/resources/fetching/fetchers/k8s/kube_provider.go#L138-L139

https://github.com/elastic/cloudbeat/blob/b6a55ec36074dd37802bb2f316d0f65d07d32ee6/internal/resources/fetching/fetchers/k8s/kube_fetcher.go#L64-L66

Given it is deprecated upstream I don't think they have a choice but to remove the references eventually but I'm not sure if this breaks anything for them now.

FYI @oren-zohar

[andrzej-stencel]

Thank you @cmacknz for finding these references. It looks like the Cloud beat indeed is referencing the PodSecurityPolicy type. I cannot find the information on which Kubernetes versions the Cloud beat supports. I don't think this is a blocker for this change in elastic-agent-autodiscover. The Cloud beat can keep using the 0.6.14 version of the elastic-agent-autodiscover for now, until it removes the references to PodSecurityPolicy.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 744e47e

History

• 💚 Build #196 succeeded 1cfff7c
• 💔 Build #195 failed 087272e