Generate go.work files

This creates go.work and enables Go Workspaces.  This is a file that
includes info on k/k and all the staging modules.

This depends on go 1.22 and setting FORCE_HOST_GO=true (for kube
scripts, which try to be hermetic).

Make this part of the normal update/verify sequence.

The top-level go.work file contains no replace statements. Instead, the
replace statements in the individual go.mod files are used. For this to
work, replace statements in the individual go.mod files have to be
consistent.

hack/tools has different dependencies and can't be in the main
workspace, so this adds a go.work just for that.  Without this, go tries
to consider all deps in all modules and pick one that works for all.
This is problematic because there are so many of them that it is
difficult to manage.

For example k/k depends on an older version of a lib that gloangci-lint
needs (transitively) and it breaks.

This also updates vendor (needed to make gotip happy), and removes
vendor'ed symlinks.  This breaks a LOT of our build tools, which will be
fixed subsequently.

Result: `go` commands work across modules:

Before:
```
$ go list ./pkg/proxy/iptables/ ./staging/src/k8s.io/api/core/v1/
main module (k8s.io/kubernetes) does not contain package k8s.io/kubernetes/staging/src/k8s.io/api/core/v1

$ go build ./pkg/proxy/iptables/ ./staging/src/k8s.io/api
main module (k8s.io/kubernetes) does not contain package k8s.io/kubernetes/staging/src/k8s.io/api

$ go test ./pkg/proxy/iptables/ ./staging/src/k8s.io/api
main module (k8s.io/kubernetes) does not contain package k8s.io/kubernetes/staging/src/k8s.io/api
```

After:
```
$ export PATH="$(gotip env GOROOT)/bin:$PATH

$ go list ./pkg/proxy/iptables/ ./staging/src/k8s.io/api/core/v1/
k8s.io/kubernetes/pkg/proxy/iptables
k8s.io/api/core/v1

$ go build ./pkg/proxy/iptables/ ./staging/src/k8s.io/api

$ go test ./pkg/proxy/iptables/ ./staging/src/k8s.io/api
ok  	k8s.io/kubernetes/pkg/proxy/iptables	0.360s
ok  	k8s.io/api	2.302s
```

Result: `make` fails:

```
$ export PATH="$(gotip env GOROOT)/bin:$PATH
$ export FORCE_HOST_GO=true

$ make
+++ [1211 10:54:03] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kube-proxy (static)
    k8s.io/kubernetes/cmd/kube-apiserver (static)
    k8s.io/kubernetes/cmd/kube-controller-manager (static)
    k8s.io/kubernetes/cmd/kubelet (non-static)
    k8s.io/kubernetes/cmd/kubeadm (static)
    k8s.io/kubernetes/cmd/kube-scheduler (static)
    k8s.io/component-base/logs/kube-log-runner (static)
    k8s.io/kube-aggregator (static)
    k8s.io/apiextensions-apiserver (static)
    k8s.io/kubernetes/cluster/gce/gci/mounter (static)
    k8s.io/kubernetes/cmd/kubectl (static)
    k8s.io/kubernetes/cmd/kubectl-convert (static)
    github.com/onsi/ginkgo/v2/ginkgo (non-static)
    k8s.io/kubernetes/test/e2e/e2e.test (test)
    k8s.io/kubernetes/test/conformance/image/go-runner (non-static)
    k8s.io/kubernetes/cmd/kubemark (static)
    github.com/onsi/ginkgo/v2/ginkgo (non-static)
    k8s.io/kubernetes/test/e2e_node/e2e_node.test (test)
test/e2e/e2e.go:35:2: cannot find package "k8s.io/api/apps/v1" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/api/apps/v1 (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/api/apps/v1 (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/api/apps/v1 (from $GOPATH)
test/e2e/e2e.go:36:2: cannot find package "k8s.io/api/core/v1" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/api/core/v1 (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/api/core/v1 (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/api/core/v1 (from $GOPATH)
	... more ...
	... more ...
	... more ...
!!! [1211 10:57:12] Call tree:
!!! [1211 10:57:12]  1: /home/thockin/src/kubernetes/hack/lib/golang.sh:958 kube::golang::build_binaries_for_platform(...)
!!! [1211 10:57:12]  2: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 10:57:12] Call tree:
!!! [1211 10:57:12]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 10:57:12] Call tree:
!!! [1211 10:57:12]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [Makefile:96: all] Error 1
```

Again, this requires go 1.22 (e.g. gotip), as go 1.21.x does not have
`go work vendor` support.

TO REPEAT:
    ( \
      export PATH="$(gotip env GOROOT)/bin:$PATH"; \
      export FORCE_HOST_GO=true; \
      ./hack/update-go-workspace.sh; \
      ./hack/update-vendor.sh; \
      ./hack/update-go-workspace.sh; \
    )

.gitignore

@@ -1,7 +1,3 @@
-# gopls gets indigestion without go.work, CI gets indigestion WITH go.work
-/go.work
-/go.work.sum
-
 # OSX leaves these everywhere on SMB shares
 ._*
 

go.work

@@ -0,0 +1,35 @@
+go 1.22
+
+use (
+	.
+	./staging/src/k8s.io/api
+	./staging/src/k8s.io/apiextensions-apiserver
+	./staging/src/k8s.io/apimachinery
+	./staging/src/k8s.io/apiserver
+	./staging/src/k8s.io/cli-runtime
+	./staging/src/k8s.io/client-go
+	./staging/src/k8s.io/cloud-provider
+	./staging/src/k8s.io/cluster-bootstrap
+	./staging/src/k8s.io/code-generator
+	./staging/src/k8s.io/component-base
+	./staging/src/k8s.io/component-helpers
+	./staging/src/k8s.io/controller-manager
+	./staging/src/k8s.io/cri-api
+	./staging/src/k8s.io/csi-translation-lib
+	./staging/src/k8s.io/dynamic-resource-allocation
+	./staging/src/k8s.io/endpointslice
+	./staging/src/k8s.io/kms
+	./staging/src/k8s.io/kube-aggregator
+	./staging/src/k8s.io/kube-controller-manager
+	./staging/src/k8s.io/kube-proxy
+	./staging/src/k8s.io/kube-scheduler
+	./staging/src/k8s.io/kubectl
+	./staging/src/k8s.io/kubelet
+	./staging/src/k8s.io/legacy-cloud-providers
+	./staging/src/k8s.io/metrics
+	./staging/src/k8s.io/mount-utils
+	./staging/src/k8s.io/pod-security-admission
+	./staging/src/k8s.io/sample-apiserver
+	./staging/src/k8s.io/sample-cli-plugin
+	./staging/src/k8s.io/sample-controller
+)

hack/make-rules/update.sh

@@ -36,6 +36,7 @@ if ! ${ALL} ; then
 fi
 
 BASH_TARGETS=(
+	update-go-workspace
 	update-codegen
 	update-generated-api-compatibility-data
 	update-generated-docs

hack/tools/go.work

@@ -0,0 +1,6 @@
+// This is a hack, but it prevents go from climbing further and trying to
+// reconcile the various deps across the "real" modules and this one.
+
+go 1.22
+
+use .

hack/update-go-workspace.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+
+# Copyright 2022 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script generates go.work so that it includes all Go packages
+# in this repo, with a few exceptions.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Go tools really don't like it if you have a symlink in `pwd`.
+cd "$(pwd -P)"
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
+export GO111MODULE=on # TODO(thockin): remove this when it's the default
+
+cd "${KUBE_ROOT}"
+
+function fix_go_version_line() {
+    # Change the `go` line back to "X.Y" instead of "X.Y.Z".
+    sed -i 's/^\(go [0-9]\+\.[0-9]\+\)\.[0-9]\+$/\1/' "$1"
+}
+
+# First nuke the top-level workspace files.  We have to do this for a few
+# steps.  They will be recreated later.
+rm -f go.work go.work.sum
+
+# Treat hack/tools as a distinct workspace, to prevent tooling from trying to
+# merge deps between it and the top-level workspace.  This block has to go
+# first because `go work` doesn't know how to deal with nested workspaces
+# ("go: .../go.work already exists").
+# https://github.com/golang/go/issues/53938
+(
+    cd hack/tools
+    rm -f go.work go.work.sum
+    go work init .
+    fix_go_version_line go.work
+    X=$(cat go.work)
+    cat > go.work << __EOF__
+// This is a hack, but it prevents go from climbing further and trying to
+// reconcile the various deps across the "real" modules and this one.
+
+$X
+__EOF__
+    go mod download # generate go.work.sum
+)
+
+# Generate the top-level workspace.
+go work init
+go work edit -use .
+git ls-files -z ':(glob)./staging/src/k8s.io/*/go.mod' \
+    | xargs -0 -n1 dirname -z \
+    | xargs -0 -n1 go work edit -use
+fix_go_version_line go.work
+go mod download # generate go.work.sum

hack/update-vendor.sh

@@ -24,6 +24,10 @@ cd "$(pwd -P)"
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
+# Get all the default Go environment.
+kube::golang::setup_env
+kube::golang::verify_go_version
+
 # Turn off workspaces until we are ready for them later
 export GOWORK=off
 # Explicitly opt into go modules, even though we're inside a GOPATH directory
@@ -39,7 +43,6 @@ if [[ "${GOPROXY:-}" == "off" ]]; then
   exit 1
 fi
 
-kube::golang::verify_go_version
 kube::util::require-jq
 
 TMP_DIR="${TMP_DIR:-$(mktemp -d /tmp/update-vendor.XXXX)}"
@@ -403,15 +406,12 @@ hack/update-internal-modules.sh
 
 
 # Phase 8: rebuild vendor directory
-kube::log::status "vendor: running 'go mod vendor'" >&11
-go mod vendor
-
-# create a symlink in vendor directory pointing to the staging components.
-# This lets other packages and tools use the local staging components as if they were vendored.
-for repo in $(kube::util::list_staging_repos); do
-  rm -fr "${KUBE_ROOT}/vendor/k8s.io/${repo}"
-  ln -s "../../staging/src/k8s.io/${repo}" "${KUBE_ROOT}/vendor/k8s.io/${repo}"
-done
+(
+  kube::log::status "vendor: running 'go work vendor'" >&11
+  unset GOWORK
+  unset GOFLAGS
+  go work vendor
+)
 
 kube::log::status "vendor: updating vendor/LICENSES" >&11
 hack/update-vendor-licenses.sh

hack/verify-go-workspace.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script checks whether the OWNERS files need to be formatted or not by
+# `yamlfmt`. Run `hack/update-yamlfmt.sh` to actually format sources.
+#
+# Usage: `hack/verify-go-workspace.sh`.
+
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/verify-generated.sh"
+
+export GO111MODULE=on # TODO(thockin): remove this when init.sh stops disabling it
+kube::verify::generated "Go workspace files need to be updated" "Please run 'hack/update-go-workspace.sh'" hack/update-go-workspace.sh