The Hitchhiker's Guide to Evaluating Dependency Updates to Kubernetes
Talkat KubeCon + CloudNativeCon + Open Source Summit China 2021 · on Friday, 2021-12-10· at 11:20· Kubecon + CloudNativeCon 演讲厅, 虚拟会议 (Virtual)·
summary
A CLI called depstat analyzes Go module trees and emits four dependency metrics: direct, transitive, total and max depth; it also emits a Graphviz DOT file to produce a DAG visualization. depstat runs as two Prow jobs for kubernetes: a periodic six-hour prow job that tracks historical changes and runtime (as a proxy for complexity), and a pre-submit job that runs on PRs touching go.mod/go.sum/vendor. Example outputs: a PR removing 16 dependencies, and per-PR diffs showing added/removed counts.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:51Overview
- 1:40What Are Dependencies?
- 2:34Go and Dependencies
- 3:09A Simple 'go.mod File
- 4:30Why Should You Care?
- 7:01The Problems
- 8:10depstat stats
- 10:12A Dependency Can Be Both Direct And Transitive
- 11:49depstat graph
- 13:47depstat cycles
- 14:34How do we use it?
related talks
30mSolid Modularization - Untangling the dependency graph
37mA Kubernetes Application End-to-End: DevStats
29mDependency Management: Where the Fork are We?
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
37mKeep Your Dependencies in Check
47mKubernetes Day 3: The State of Kubernetes Development Tooling
31mRenovate/Dependabot: How to Take Back Control of Dependency Updates
38mKnow thy neighbours: dependency management done right.