Upgrade dependencies

[willbeason]

Run go get -u, upgrading many of our dependencies.

Fixes #1298 by upgrading opa to v0.29.4.

Note that due to vendoring github.com/bytecodealliance/wasmtime-go (transitively required via open-policy-agent/opa), we include several very large binary files (See: vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/libwasmtime.a). The open-policy-agent/opa library vendors this as well, so it seems fine.

We are unable to safely upgrade to k8s 1.21 libraries until controller-runtime has a stable v0.9.0 release. That can be done later.

Signed-off-by: Will Beason willbeason@google.com

[codecov-commenter]

Codecov Report

Merging #1335 (e75c763) into master (d00e886) will decrease coverage by 0.08%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1335      +/-   ##
==========================================
- Coverage   48.52%   48.44%   -0.09%     
==========================================
  Files          68       68              
  Lines        4913     4913              
==========================================
- Hits         2384     2380       -4     
- Misses       2179     2181       +2     
- Partials      350      352       +2     

Flag	Coverage Δ
unittests	48.44% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/controller/assign/assign_controller.go	48.33% <0.00%> (-1.67%)	⬇️
pkg/readiness/object_tracker.go	82.60% <0.00%> (-1.09%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d00e886...e75c763. Read the comment docs.

[maxsmythe]

LGTM

@shomron @ritazh @sozercan LGTY?

[sozercan]

Is there any way to exclude libwasmtime.a files? looks like they add ~175 MB

[sozercan]

LGTM. As discussed in the call yesterday, let's hold until v3.5 is cut

[maxsmythe]

+1 to excluding the wasm stuff if it's easy. We don't use it.

[willbeason]

How do we exclude the libwasmtime.a files? They're in vendor/

[shomron]

Lgtm. Not sure how we could exclude that large binary other than scripting it after we go mod vendor, or verifying with opa if it was included erroneously.

[ritazh]

@tsandall can you pls help confirm if the libwasmtime.a files were included in opa intentionally? Thanks!

[tsandall]

Yes, it's intentional. We (@willbeason and myself) chatted about this yesterday on the biweekly call. I'm not aware of a better solution at this point in time. If the wasmtime dependency ends up causing issues, let us know.