go.mod: include indirect dependencies

[AkihiroSuda]

Bump up the go.mod format so as to help analyzing all the dependencies

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AkihiroSuda
Once this PR has been reviewed and has the lgtm label, please assign aojea for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[stmcginnis]

Makes sense if we are bumping up the minimum go version. But that has intentionally been kept back. I would defer to @BenTheElder on whether that is something we want right now or not.

[AkihiroSuda]

@BenTheElder Could you take a look?

[BenTheElder]

we've intentionally held this back, people go get / go install kind and use systems with outdated go and we have no particular need for latest go features in the core tool

[BenTheElder]

we've been hacking on bumping it to 1.17 for related reasons but not as far as 1.21 currently #3335

[BenTheElder]

I've been waiting for @aojea to take another review pass at #3335, but if we wanted to land a more targeted change, just bumping to 1.17 here will accomplish the same thing with less impact.

[AkihiroSuda]

They mustn’t use Go 1.20, as it has reached EOL and no longer receives security fixes.

[BenTheElder]

That's their choice, the kind binary is not particularly sensitive to these as a local non-networked CLI. We document that 1.16+ is required to install currently and have no use case for newer go features for the core project.

Being able to go install on e.g., debian stable, without issues, is something we do not want to break lightly.

[BenTheElder]

And again, to get the module pruning, you only need to increase this to 1.17

[BenTheElder]

We don't break users without a good reason, lots of new k8s users are installing the kind CLI via their system go and it works fine.

similarly we still have limited support for kubernetes versions that kubernetes no longer supports (e.g. so lagging users can test before/after updating), it would be easier to force only current versions but it has value to users not to and the burden is not too high

[AkihiroSuda]

Sure, closing this for now