[Umbrella Issue] Replace google/gnostic import with google/gnostic-models

[Jefftree]

Currently, k/k and all dependencies depend on gnostic v0.5.7-v3refs because we did not want to capture the additional dependencies introduced with later versions of gnostic. We use gnostic for OpenAPI protobuf serialization/deserialization. Gnostic was split into multiple modules for better encapsulation, and the only component we require is the openapi protobuf encoding module which is under github.com/google/gnostic-models. We should update all references of that.

• Use gnostic-models over gnostic kube-openapi#402
• Update gnostic dependency with gnostic-models kubernetes-sigs/kustomize#5186
• Update gnostic library to point to gnostic-models #118384

Because module renames are backwards incompatible, our users are running into a upgrade issues. In order to upgrade properly, the three repos that were changed must be updated together: client-go 0.28, kube-openapi 20230601164746-7562a1006961 , kustomize 5.1.

Unfortunately since these three modules all follow different release cadences, a naive go get -u causes problems because client-go 0.28 is unreleased yet while the other modules are available. This creates issues such as: kubernetes/client-go#1266.

The workaround for go get -u is to pin kube-openapi to an earlier version for clients using a version of client-go <0.28. This is temporary until client-go 0.28 is released.

go mod edit --replace k8s.io/kube-openapi@v0.0.0-20230601164746-7562a1006961=k8s.io/kube-openapi@v0.0.0-20230606174411-725288a7abf1

Obviously the alpha version of client-go can also be used to mitigate this problem (k8s.io/client-go v0.28.0-alpha.2) but it's generally recommended to be on a stable version.

For larger projects like flux, other projects that depend on one of the three projects above are part of the imports, and the chain needs to be synced before an upgrade.

This includes:

• https://github.com/kubernetes-sigs/cli-utils
• https://github.com/kubernetes-sigs/controller-runtime
• https://github.com/sigstore/cosign
• https://github.com/kubernetes-sigs/cluster-api/

/sig api-machinery
/triage accepted

[stefanprodan]

Please add https://github.com/kubernetes-sigs/cli-utils to this list.

[stefanprodan]

After months we're still stuck with Flux on Kubernetes 1.27 while our deps cumulate CVEs that we can't fix, such as Cosign.

The only blocker left for us is cli-utils: kubernetes-sigs/cli-utils#625