[Bug] Dependency github.com/openshift/api@v3.9.0+incompatible is missing

[smuda]

Describe the bug
When building from source and opting out of using proxy.golang.org (for example by setting GOPROXY=direct) there is an error of a missing revision:

go: github.com/openshift/api@v3.9.0+incompatible: reading github.com/openshift/api/go.mod at revision v3.9.0: unknown revision v3.9.0

Looking at github.com/openshift/api there are no tags at all which could probably explain the error. As building from source works when using proxy.golang.org I suppose there has been tags in the project previously which has been cached.

This could probably be fixed by using the release-3.9 branch instead:

go get github.com/openshift/api@release-3.9

or using a replace notation:

replace github.com/openshift/api v3.9.0+incompatible => github.com/openshift/api v0.0.0-20180801171038-322a19404e37

I'd be happy to create a PR.

(The usecase for opting out of using proxy.golang.org is building inside a restricted network environment, using athens proxy for fetching modules)

Version
v4.2.0

To Reproduce
Steps to reproduce the behavior:

1. Make sure you don't have dependency github.com/openshift/api downloaded, for example by running in a container.
2. GOPROXY=direct go mod download

go: github.com/openshift/api@v3.9.0+incompatible: reading github.com/openshift/api/go.mod at revision v3.9.0: unknown revision v3.9.0

Expected behavior
All modules should download.

Suspect component/Location where the bug might be occuring
go.mod, sort of... :-)

[smuda]

One easy way to test this is using the Dockerfile I've created in #707 and build the image:

DOCKER_BUILDKIT=1 docker build --build-arg GOPROXY=direct .

[pb82]

@smuda the openshift-api repository does not define any releases or tags. Is this working because the dependency is still cached somewhere? In that case yes, a workaround would be good. What would you suggest? The replace that you used seems to point to a tag that also needs to be cached?

[smuda]

@pb82 If I read stackoverflow correctly, there used to be tags in the openshift-api repository when the dependency was created and that tag has then been cached in proxy.golang.org which is normally used when resolving dependencies.

Looking at the release-3.9 branch, there is no go.mod but in the later 4.x branches there is. Perhaps the best way would be to reference a later branch? Openshift 4.10 was recently released and could be a good candidate?

$ go get github.com/openshift/api@release-4.10               
go get: upgraded github.com/go-logr/logr v0.4.0 => v1.2.0
go get: downgraded github.com/openshift/api v3.9.0+incompatible => v0.0.0-20220124143425-d74727069f6f
go get: upgraded k8s.io/api v0.20.2 => v0.23.0
go get: upgraded k8s.io/apimachinery v0.20.2 => v0.23.0

That however breaks a lot of stuff:

$ make
grafana-operator/bin/controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..."
../../../go/pkg/mod/sigs.k8s.io/controller-runtime@v0.8.3/pkg/client/patch.go:22:2: missing go.sum entry for module providing package github.com/evanphx/json-patch (imported by sigs.k8s.io/controller-runtime/pkg/client); to add:
	go get sigs.k8s.io/controller-runtime/pkg/client@v0.8.3
../../../go/pkg/mod/k8s.io/apimachinery@v0.23.0/pkg/util/strategicpatch/meta.go:26:2: missing go.sum entry for module providing package k8s.io/kube-openapi/pkg/util/proto (imported by k8s.io/apimachinery/pkg/util/strategicpatch); to add:
	go get k8s.io/apimachinery/pkg/util/strategicpatch@v0.23.0
../../../go/pkg/mod/k8s.io/client-go@v0.20.2/kubernetes/scheme/register.go:37:2: no required module provides package k8s.io/api/batch/v2alpha1; to add it:
	go get k8s.io/api/batch/v2alpha1
../../../go/pkg/mod/k8s.io/client-go@v0.20.2/kubernetes/scheme/register.go:43:2: no required module provides package k8s.io/api/discovery/v1alpha1; to add it:
	go get k8s.io/api/discovery/v1alpha1
../../../go/pkg/mod/golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0/ssh/terminal/util.go:20:2: missing go.sum entry for module providing package golang.org/x/sys/unix (imported by golang.org/x/crypto/ssh/terminal); to add:
	go get golang.org/x/crypto/ssh/terminal@v0.0.0-20201002170205-7f63de1d35b0
../../../go/pkg/mod/k8s.io/client-go@v0.20.2/discovery/discovery_client.go:29:2: missing go.sum entry for module providing package github.com/golang/protobuf/proto (imported by k8s.io/client-go/discovery); to add:
	go get k8s.io/client-go/discovery@v0.20.2
../../../go/pkg/mod/k8s.io/client-go@v0.20.2/discovery/discovery_client.go:30:2: missing go.sum entry for module providing package github.com/googleapis/gnostic/openapiv2 (imported by k8s.io/client-go/discovery); to add:
	go get k8s.io/client-go/discovery@v0.20.2
../../../go/pkg/mod/github.com/prometheus/client_golang@v1.7.1/prometheus/value.go:24:2: missing go.sum entry for module providing package github.com/golang/protobuf/ptypes (imported by github.com/prometheus/client_golang/prometheus); to add:
	go get github.com/prometheus/client_golang/prometheus@v1.7.1
../../../go/pkg/mod/github.com/prometheus/client_model@v0.2.0/go/metrics.pb.go:9:2: missing go.sum entry for module providing package github.com/golang/protobuf/ptypes/timestamp (imported by github.com/prometheus/client_model/go); to add:
	go get github.com/prometheus/client_model/go@v0.2.0
Error: not all generators ran successfully

I could put some time into resolving these issues, if you decide that's the route that is most useful.

[smuda]

I found issue 456 and issue 587 where they discuss adding tags which seems to have been used earlier. There are also a number of references to that issue where other projects (like grafana-operator) updates their go.mod to use a specific commit, probably using something like go get github.com/openshift/api@release-3.9.

I'm going to create a PR with that exact change.

[smuda]

@pb82 Would you be able to have a look at #724 and the blocking #725?