regression: make $VERSION 3rd-party independant

[rexagod]

3rd-party dependencies cannot be installed pre-build since Makefile variables are initialized earlier than that. At the moment, this causes kube_state_metrics_build_info to have a labelset of {...,version="v"}.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rexagod

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rexagod]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

This issue is currently awaiting triage.

If kube-state-metrics contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rexagod]

Addressed in v2.14 by https://github.com/kubernetes/kube-state-metrics/pull/2456/files.

[rexagod]

@mrueg I'm opening this again as this seems to be a regression for air-tight builders that can only utilize /vendor's content, but not download, for instance, the contents of tools if they seemingly for a part of the production build pipeline (i.e., the lack of gomplate results in an empty -ldflag for version, which results in an empty version labelvalue).

I'd like to cut a 2.14.1 to address this for such builders, WDYT?

[mrueg]

I see two other options here:

a) add gomplate to your path in the build infra before the actual build
b) wait for go1.24 https://tip.golang.org/doc/go1.24#tools

Would those help?

[rexagod]

Thank you for looking into it, Manuel.

While the second approach sounds very cool, it can take a while for us to get there. The first one will require us to keep downstream assets (all tools binaries) and plug them into a $GOBIN or $PATH to pick them during make install-tools. I find myself leaning away from the multi-point complexity that this may introduce, in favor of making the production build process third-party dependency-free (except what's already in /vendor).

To correct myself, we don't necessarily need to cut a minor release for this, if this is something the wider community isn't facing (I can cherry-pick the commit to our midstream).