Tending the Kubernetes Dependency Tree: Bonsai or Bonfire?
summary
Kubernetes reduces its dependency graph by about 30% in v1.34 and cuts vendor code from the 300–400 range down to ~247 by unraveling GenProto and other mega-libraries. The workflow uses depthstat and go mod vendor diffs to see what a bump actually pulls in, isolates test/tool deps into separate modules, applies a dependency verifier with a ratchet JSON to block new unwanted links, runs CI jobs that bump deps and build Go from master to catch breakage early, and fixes issues upstream (cAdvisor, containerd, GenProto).
AI-written summary · about
chapters (15)
- 0:00Kubernetes dependencies
- 1:46Bonsai to bonfire in deps
- 2:28Reviewing dependencies
- 7:27Dependency review checklist
- 9:13Building review muscle
- 10:18Isolating library and binary dependencies
- 12:06Test and tool deps
- 14:12Improving upstream deps
- 17:44Reducing deps by 30%
- 20:11Removing unwanted deps
- 23:22Early dep issue detection
- 25:09CI for dep updates
- 27:15Tracking deps over time
- 30:28Security and branch updates
- 31:32Conclusion
related talks
22mGo Large!
47mExploring a complex codebase with AI
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
26mUntangling the Monorepo: Moving to Go Modules
33mKeep your dependencies in check
20mOSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model
22mIt depends: A dialog about dependencies
31mIntro to Kubernetes Sig-Architecture Subprojects