switch to gopkg.in/yaml.v3

[BenTheElder]

https://github.com/kubernetes/test-infra/pull/33958/files#r1886682875

/priority backlog

we may also have to update dependency repos like sigs.k8s.io/prow

[BenTheElder]

/sig testing

[mkumatag]

/assign

[BenTheElder]

(#33979 (comment))

[mkumatag]

This is because of the following reason

$ go mod why -m gopkg.in/yaml.v3
# gopkg.in/yaml.v3
k8s.io/test-infra/experiment/coverage
github.com/go-openapi/spec    <====== (1)
github.com/go-openapi/swag
gopkg.in/yaml.v3

$ go mod why -m gopkg.in/yaml.v2
# gopkg.in/yaml.v2
k8s.io/test-infra/config/tests/mergelists
k8s.io/test-infra/config/tests/mergelists.test
github.com/GoogleCloudPlatform/testgrid/pkg/merger <====== (2)
gopkg.in/yaml.v2

(1) and (2) are imported modules that use these indirect dependencies. They are outside of the Kubernetes project, and we have minimal control over them.

[BenTheElder]

Testgrid is us and can be patched cc @michelle192837

(1) I'm less sure about. cc @pohly @jpbetz

[BenTheElder]

In kubernetes when we encounter this sort of issue we usually reach out to the intermediate projects to discuss. But I'm not sure if this is a reasonable ask in this case

[mkumatag]

Testgrid is us and can be patched cc @michelle192837

I see that they are using sigs.k8s.io/yaml module already, I can submit a PR to remove dependency from gopkg.in/yaml

https://github.com/GoogleCloudPlatform/testgrid/blob/3ad1f7c3c6a8b9085998213c1cc2cbd1eb80c3e4/go.mod#L33

[mkumatag]

Testgrid is us and can be patched cc @michelle192837

I see that they are using sigs.k8s.io/yaml module already, I can submit a PR to remove dependency from gopkg.in/yaml

https://github.com/GoogleCloudPlatform/testgrid/blob/3ad1f7c3c6a8b9085998213c1cc2cbd1eb80c3e4/go.mod#L33

submitted this PR in the testgrid - GoogleCloudPlatform/testgrid#1301

[pohly]

I don't think we need to be pedantic about this. Not depending on it in code that we as Kubernetes own should be good enough. We explicitly should not as other projects to use sigs.k8s.io/yaml.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[BenTheElder]

/lifecycle frozen