Update Flux controllers to Kustomize v5.2

[stefanprodan]

We should update Flux from Kustomize v5.0.3 to v5.2.1 which comes with a major breaking change: Kustomize components are now applied after generators.

TODOs

Use kustomize/api@v0.15.0 and kustomize/kyaml@v0.15.0 in:

• fluxcd/pkg
• fluxcd/kustomize-controller
• fluxcd/helm-controller
• fluxcd/image-automation-controller
• fluxcd/flux2

Blockers

ℹ️ Fixed by hard forking Kubernetes cli-utils under https://github.com/fluxcd/cli-utils

As with every Kustomize API minor release, we can't upgrade right away. This time, the issue is that Kustomize has switched to google/gnostic-models while Kubernetes and controller-runtime are using google/gnostic, which are incompatible and make Flux panic:

panic: proto: file "extensions/extension.proto" is already registered
        previously from: "github.com/google/gnostic-models/extensions"
        currently from:  "github.com/google/gnostic/extensions"
See https://protobuf.dev/reference/go/faq#namespace-conflict


goroutine 1 [running]:
google.golang.org/protobuf/reflect/protoregistry.glob..func1({0x102cdd5a0?, 0xc000478050?}, {0x102cdd5a0?, 0xc000478090})
        /Users/stefanprodan/go/pkg/mod/google.golang.org/protobuf@v1.30.0/reflect/protoregistry/registry.go:56 +0x264
google.golang.org/protobuf/reflect/protoregistry.(*Files).RegisterFile(0xc0001b6450, {0x102cffca0?, 0xc0002d16c0?})
        /Users/stefanprodan/go/pkg/mod/google.golang.org/protobuf@v1.30.0/reflect/protoregistry/registry.go:130 +0x3d8
google.golang.org/protobuf/internal/filedesc.Builder.Build({{0x1029c13a6, 0x24}, {0x1039cc580, 0x282, 0x282}, 0x0, 0x4, 0x0, 0x0, {0x102ce2718, ...}, ...})
        /Users/stefanprodan/go/pkg/mod/google.golang.org/protobuf@v1.30.0/internal/filedesc/build.go:112 +0x22c
google.golang.org/protobuf/internal/filetype.Builder.Build({{{0x1029c13a6, 0x24}, {0x1039cc580, 0x282, 0x282}, 0x0, 0x4, 0x0, 0x0, {0x0, ...}, ...}, ...})
        /Users/stefanprodan/go/pkg/mod/google.golang.org/protobuf@v1.30.0/internal/filetype/build.go:138 +0x22c
github.com/google/gnostic/extensions.file_extensions_extension_proto_init()
        /Users/stefanprodan/go/pkg/mod/github.com/google/gnostic@v0.6.8/extensions/extension.pb.go:456 +0x1d8
github.com/google/gnostic/extensions.init.0()
        /Users/stefanprodan/go/pkg/mod/github.com/google/gnostic@v0.6.8/extensions/extension.pb.go:388 +0x24

Before we can update Kustomize, we need to wait for all our dependencies: Kubernetes, controller-runtime, Helm, Cosign, etc, to replace the usage of google/gnostic with google/gnostic-models. This will probably take many months 😢

Refs:

• Use gnostic-models over gnostic kubernetes/kube-openapi#402
• Import of gnostic-models and gnostic generated code leads to panic google/gnostic#397
• Update gnostic dependency with gnostic-models kubernetes-sigs/kustomize#5186
• [Umbrella Issue] Replace google/gnostic import with google/gnostic-models kubernetes/kubernetes#118340

[aryan9600]

this should be unblocked by the release of Kubernetes v1.28.0

[stefanprodan]

Kubernetes 1.28.0 is just one of many Flux dependencies that must move to gnostic-models.

Waiting on:

• https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
• https://github.com/helm/helm/releases/tag/v3.13.0
• Update gnostic dependency with gnostic-models kubernetes-sigs/cli-utils#625

After cli-utils has been migrated to gnostic-models, we need to reach to Cosign to do the switch.

[Ph0tonic]

Hi, where are we with this issue ? It seems that #3284 may be link to this one as we would need to update to kubernetes 1.28.

[stefanprodan]

@Ph0tonic see kubernetes/kubernetes#118340 (comment)

[stefanprodan]

We decided to hard fork sigs.k8s.io/cli-utils under https://github.com/fluxcd/cli-utils to unblock the Kubernetes v1.28 and Kustomize v5.2 update of the Flux controllers.

We'll ship Kustomize v5.2 with Flux v2.2.0.