Add constraint for go-open-service-broker-client (#1738)

* Add constraint for go-open-service-broker-client

Add a dep constraint for the osb-client in preparation for upcoming
breaking changes. The constraint is for 0.0.1 <= X < 0.1.0 (paches
only).

* Sync vendor after constraining go-open-service-broker-client

* Document how to update a dependency with dep

* Provide guidance on dependency versions

Gopkg.toml

@@ -69,6 +69,10 @@ required = [
   name = "k8s.io/code-generator"
   version = "kubernetes-1.9.1"
 
+[[constraint]]
+  name = "github.com/pmorie/go-open-service-broker-client"
+  version = "~0.0.1"
+
 [prune]
   non-go = true
   go-tests = true

docs/devguide.md

@@ -8,6 +8,7 @@ Table of Contents
 - [Building](#building)
 - [Testing](#testing)
 - [Advanced Build Steps](#advanced-build-steps)
+- [Dependency Management](#dependency-management)
 - [Deploying to Kubernetes](#deploying-to-kubernetes)
 - [Demo walkthrough](#demo-walkthrough)
 
@@ -297,6 +298,41 @@ If you choose third party resources storage, the helm chart will not launch an
 etcd server, but will instead instruct the API server to store all resources in
 the Kubernetes cluster as third party resources.
 
+## Dependency Management
+We use [dep](https://golang.github.io/dep) to manage our dependencies. We commit the resulting
+vendor directory to ensure repeatable builds and isolation from upstream source disruptions.
+Because vendor is committed, you do not need to interact with dep unless you are
+changing dependencies.
+
+* Gopkg.toml - the dep manifest, this is intended to be hand-edited and contains a set of
+constraints and other rules for dep to apply when selecting appropriate versions of dependencies.
+* Gopkg.lock - the dep lockfile, do not edit because it is a generated file.
+* vendor/ - the source of all of our dependencies. Commit changes to this directory in a 
+separate commit from any other changes (including to the Gopkg files) so that it's easier to 
+review your pull request.
+
+If you use VS Code, we recommend installing the [dep extension](https://marketplace.visualstudio.com/items?itemName=carolynvs.dep).
+It provides snippets and improved highlighting that makes it easier to work with dep.
+
+### Selecting the version for a dependency
+* Use released versions of a dependency, for example v1.2.3.
+* Use the master branch when a dependency does not tag releases, or we require an unreleased change.
+* Include an explanatory comment with a link to any relevant issues anytime a dependency is
+  pinned to a specific revision in Gopkg.toml.
+
+### Add a new dependency
+1. Run `dep ensure -add github.com/example/project/pkg/foo`. This adds a constraint to Gopkg.toml,
+and downloads the dependency to vendor/.
+1. Import the package in the code and use it.
+1. Run `dep ensure -v` to sync Gopkg.lock and vendor/ with your changes.
+
+### Change the version of a dependency
+1. Edit Gopkg.toml and update the version for the project. If the project is not in
+Gopkg.toml already, add a constraint for it and set the version.
+1. Run `dep ensure -v` to sync Gopkg.lock and vendor/ with the updated version.
+
+[Watch a screencast](https://youtu.be/yvL66s_hQ94)
+
 ## Demo walkthrough
 
 Check out the [introduction](./introduction.md) to get started with