github.com/prometheus/common v0.48.0 is incompatible with Kubernetes

[twz123]

That dependency has been bumped in #2699. Upstream Kubernetes uses v0.44. In prometheus/common#576, which has been released as v0.48.0, a public symbol has been made private. That public symbol is being used in Kubernetes here: https://github.com/kubernetes/kubernetes/blob/f4e246bc93ffb68b33ed67c7896c379efa4207e7/staging/src/k8s.io/component-base/metrics/testutil/metrics.go#L73.

I can workaround that by adding to replace github.com/prometheus/common => github.com/prometheus/common v0.47.0 in go.mod. Is that something to be fixed here by downgrading the dependency or should I live with the replace directive?

[alvaroaleman]

@twz123 mind submitting a revert PR?

[twz123]

@twz123 mind submitting a revert PR?

Sure, I can do it on Tuesday, I guess.

[sbueringer]

Sound reasonable to me. I would take a closer look at your PR tomorrow

[sbueringer]

Thx for the fix!

I tried to reproduce by bumping Cluster API to controller-runtime main before the fix. Initially I didn't hit the error because bumping controller-runtime didn't bump github.com/prometheus/client_golang to v1.19.0 (same for prometheus/common) (I ran go get & go mod tidy).

But once I aligned/changed the version of github.com/prometheus/client_golang in my go.mod file manually to the one used in controller-runtime I got the same error.

I suspect the reason why it wasn't bumped in my case is because our code also has a direct dependency on github.com/prometheus/client_golang.

Anyway, makes sense to align these versions to k/k, we have to be more careful in the future.

Thx for testing/using controller-runtime main!