Generated by depstat — a Go dependency analysis tool from kubernetes-sigs. Analysis performed on commit
411c4499fa5(branchdump-from-utils, based onv1.36.0-alpha.1).
| Metric | Value |
|---|---|
| Direct Dependencies | 179 |
| Transitive Dependencies | 224 |
| Total Dependencies | 257 |
| Max Dependency Depth | 19 |
| Test-only Dependencies | 31 |
| Non-test Dependencies | 226 |
| Dependency Cycles | 19 |
| Archived Dependencies | 6 |
| Main Modules (go.work) | 32 (1 root + 31 staging) |
Key findings:
- Kubernetes has a large but well-managed dependency surface — 257 total deps across a 32-module monorepo with staging modules
- Depth of 19 is the deepest observed across similar projects (etcd: 12, containerd: 11), reflecting the layered architecture
- All 19 cycles are external — no internal (k8s.io ↔ k8s.io) cycles detected
- The v1.34.0 → v1.35.0 release saw a net +16 dependencies (+17 added, -1 removed, 69 version bumps)
- 6 archived dependencies remain, notably
github.com/json-iterator/goandgithub.com/pkg/errors - The
gopkg.in/yaml.v2dependency was finally removed in v1.35.0, replaced bygo.yaml.in/yaml/v2
Kubernetes is a 32-module monorepo using go.work for workspace management:
- Root module:
k8s.io/kubernetes - 31 staging modules:
k8s.io/api,k8s.io/apimachinery,k8s.io/apiserver,k8s.io/client-go, etc.
The staging modules are published as separate repositories but developed in-tree under staging/src/k8s.io/.
Direct Dependencies: 179
Transitive Dependencies: 224
Total Dependencies: 257
Max Depth: 19
Test-only Dependencies: 31
Non-test Dependencies: 226
Roughly 12% of dependencies are test-only, a healthy ratio indicating most deps are production-critical.
The graph shows the dense interconnection between staging modules (k8s.io/*) and the major external dependency clusters: etcd, gRPC, OpenTelemetry, Prometheus, and the Go standard library extensions.
19 cycles detected — all involving external dependencies:
| Cycle | Modules |
|---|---|
| protobuf | github.com/golang/protobuf ↔ google.golang.org/protobuf |
| ginkgo/gomega | github.com/onsi/ginkgo/v2 ↔ github.com/onsi/gomega |
| prometheus | github.com/prometheus/client_golang ↔ github.com/prometheus/common |
| testify | github.com/stretchr/objx ↔ github.com/stretchr/testify |
| OTel auto/sdk (5 cycles) | go.opentelemetry.io/auto/sdk ↔ otel ↔ otel/metric ↔ otel/trace |
| OTel core (3 cycles) | otel ↔ otel/metric ↔ otel/trace |
| OTel SDK | otel/sdk ↔ otel/sdk/metric |
| golang.org/x (5 cycles) | x/crypto ↔ x/net ↔ x/text ↔ x/tools ↔ x/mod |
| gRPC/genproto | google.golang.org/genproto/googleapis/api ↔ google.golang.org/grpc |
Notable: Zero internal cycles between k8s.io modules — the staging module hierarchy is clean.
6 archived dependencies found:
| Module | Version | Status |
|---|---|---|
github.com/flynn/go-shlex |
v0.0.0-20150515145356 | Archived |
github.com/google/btree |
v1.1.3 | Archived |
github.com/google/gofuzz |
v1.0.0 | Archived (superseded by sigs.k8s.io/randfill) |
github.com/json-iterator/go |
v1.1.12 | Archived |
github.com/kr/pty |
v1.1.1 | Archived (superseded by github.com/creack/pty) |
github.com/pkg/errors |
v0.9.1 | Archived (superseded by fmt.Errorf wrapping) |
11 modules were unresolvable (non-GitHub hosts: bitbucket.org, buf.build, cyphar.com, gonum.org, google.golang.org, gopkg.in).
Recommendations:
google/gofuzz→ already being replaced bysigs.k8s.io/randfilljson-iterator/go→ migrate toencoding/jsonorgo.yaml.in/yaml/v3pkg/errors→ usefmt.Errorfwith%wwrappingkr/pty→ already hasgithub.com/creack/ptyin the treeflynn/go-shlex→ considergo-shellwordsor stdlib alternatives
| Metric | v1.34.0 | v1.35.0 | Delta |
|---|---|---|---|
| Direct Deps | 183 | 187 | +4 |
| Transitive Deps | 212 | 228 | +16 |
| Total Deps | 250 | 266 | +16 |
| Max Depth | 18 | 19 | +1 |
| Module | Category |
|---|---|
cyphar.com/go-pathrs |
Container runtime (path resolution) |
github.com/Masterminds/semver/v3 |
Semantic versioning |
github.com/gkampitakis/ciinfo |
CI detection (test tooling) |
github.com/gkampitakis/go-diff |
Diff library (test tooling) |
github.com/gkampitakis/go-snaps |
Snapshot testing |
github.com/goccy/go-yaml |
YAML processing |
github.com/joshdk/go-junit |
JUnit report parsing |
github.com/maruel/natural |
Natural sort |
github.com/mfridman/tparse |
Test output parser |
github.com/moby/sys/atomicwriter |
Atomic file writes |
github.com/tidwall/gjson |
JSON path queries |
github.com/tidwall/match |
Pattern matching |
github.com/tidwall/pretty |
JSON formatting |
github.com/tidwall/sjson |
JSON mutations |
go.uber.org/automaxprocs |
GOMAXPROCS tuning |
golang.org/x/tools/go/expect |
Test expectations |
golang.org/x/tools/go/packages/packagestest |
Package testing |
| Module | Notes |
|---|---|
gopkg.in/yaml.v2 |
Replaced by go.yaml.in/yaml/v2 (fork with maintained module path) |
- Go: 1.24.0 → 1.25.0
- Docker: v26.1.4 → v28.2.2
- runc: v1.2.5 → v1.3.0
- etcd: v3.6.4 → v3.6.5
- gRPC: v1.72.1 → v1.72.2
- OTel: v1.35.0 → v1.36.0
- Prometheus client: v1.22.0 → v1.23.2
- AWS SDK: v1.30.1 → v1.36.3
- cobra: v1.9.1 → v1.10.0
gRPC is the most connected external dependency, used by 32 modules including 16 k8s.io staging modules and key external deps (etcd, OTel, containerd, konnectivity).
Key paths:
k8s.io/apiserver→go.etcd.io/etcd/client/v3→google.golang.org/grpck8s.io/cri-api→google.golang.org/grpc(CRI protocol)k8s.io/kms→google.golang.org/grpc(KMS protocol)k8s.io/component-base→google.golang.org/grpc(base infrastructure)
OTel is the second most connected dependency with 29 direct dependents — including 17 k8s.io modules. It enters primarily through gRPC (which depends on OTel for instrumentation) and through direct k8s.io tracing support.
Key paths:
k8s.io/apiserver→go.opentelemetry.io/otel(direct tracing)google.golang.org/grpc→go.opentelemetry.io/otel(gRPC instrumentation)k8s.io/component-base→go.opentelemetry.io/otel(base tracing)
Prometheus metrics is deeply embedded with 21 direct dependents — 15 k8s.io modules plus etcd, cadvisor, grpc-middleware, and konnectivity.
Key paths:
k8s.io/component-base→github.com/prometheus/client_golang(metrics framework)k8s.io/apiserver→github.com/prometheus/client_golang(API metrics)go.etcd.io/etcd/server/v3→github.com/prometheus/client_golang(etcd metrics)
CEL (Common Expression Language) is used for admission control validation and is depended on by 11 modules — 10 k8s.io modules plus grpc-middleware.
Key paths:
k8s.io/apiextensions-apiserver→github.com/google/cel-go(CRD validation)k8s.io/apiserver→github.com/google/cel-go(admission webhooks)k8s.io/kube-scheduler→github.com/google/cel-go(scheduling policies)
The etcd client is used by 9 modules — 7 k8s.io modules plus the etcd server itself.
Key paths:
k8s.io/apiserver→go.etcd.io/etcd/client/v3(storage backend)k8s.io/apiextensions-apiserver→go.etcd.io/etcd/client/v3(CRD storage)k8s.io/cloud-provider→go.etcd.io/etcd/client/v3(cloud integration)
- Replace
github.com/json-iterator/go— archived; standardencoding/jsonwith Go 1.24+ performance improvements is viable - Replace
github.com/pkg/errors— archived; usefmt.Errorf("%w", err)wrapping - Complete
google/gofuzz→sigs.k8s.io/randfillmigration — already in progress
- Monitor OTel cycle complexity — 9 of the 19 cycles involve OTel modules; upstream cleanup would benefit the ecosystem
- Track
gopkg.in/yaml.v2removal — successfully replaced in v1.35.0, confirm no regressions - Evaluate test tooling additions — v1.35.0 added 7+ test-related deps (gkampitakis/*, mfridman/tparse, joshdk/go-junit)
- Replace
github.com/flynn/go-shlex— archived, 2015-era code - Replace
github.com/kr/pty—github.com/creack/ptyis already in the dependency tree
All commands run from the Kubernetes checkout at commit 411c4499fa5:
# Statistics
depstat stats -d .
depstat stats -d . --split-test-only
depstat stats -d . --verbose
# Dependency graph
depstat graph -d . --svg > k8s-full-graph.svg
# Cycle detection
depstat cycles -d . --json
# Archived dependencies
GITHUB_TOKEN="$(gh auth token)" depstat archived -d . --json
# Version diff
depstat diff -d . v1.34.0 v1.35.0
depstat diff -d . v1.34.0 v1.35.0 --svg > k8s-diff-v134-v135.svg
# Why-traces (SVG)
depstat why -d . google.golang.org/grpc --svg --max-paths 50 > k8s-why-grpc.svg
depstat why -d . go.opentelemetry.io/otel --svg --max-paths 30 > k8s-why-otel.svg
depstat why -d . github.com/prometheus/client_golang --svg --max-paths 50 > k8s-why-client_golang.svg
depstat why -d . github.com/google/cel-go --svg --max-paths 50 > k8s-why-cel-go.svg
depstat why -d . go.etcd.io/etcd/client/v3 --svg --max-paths 50 > k8s-why-etcd-v3.svgTool version: depstat built from source at sigs.k8s.io/depstat.