vendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0

[milas]

Upgrade OpenTelemetry core libs to v1.19.0 and contrib (for gRPC tracing) to v0.45.0.

The OpenTelemetry internal module structure/dependency graph is rather complex, and recently some parts (e.g. metrics) have graduated to "stable" from "unstable", so this upgrade is important to unblock downstream projects to be able to use newer versions of the OpenTelemetry libraries, as they can cause compatibility issues due to internal/peer dependency changes otherwise.

Hopefully, future updates won't be as problematic, such that projects using containerd as a dependency will be able to use newer versions of the libraries in a compatible fashion.

See also:

• ci(deps): upgrade OpenTelemetry libraries to v1.19.0 / v0.45.0 moby/buildkit#4318

[k8s-ci-robot]

Hi @milas. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[thaJeztah]

Oh while I see you here; perhaps you know; I asked this question the other day; another dependency related to OTEL (at least, it was added as part of the initial OTEL bits I think);

Who’s familiar with the grpc-middleware dependency? I noticed they moved towards v2, and wondering if that’s a switch container should make for V2. Also noticed there’s a providers/prometheus module in that repository, and wondering how it relates to the github.com/grpc-ecosystem/go-grpc-prometheus module we’re currently using (admitted, I didn’t spend much time on looking what each of those did)

https://github.com/grpc-ecosystem/go-grpc-middleware/releases

[thaJeztah]

I see this is linked to moby/buildkit#4318

Note that containerd updates in main are for containerd v2.0 (so we can't consume main until the module is renamed); if we need this update in BuildKit (and if for that to work, containerd needs to be updated), your containerd PR has to be backported and accepted in the 1.7 release branch.

I see it's a rather large diff though, and includes an update to grpc; so for it to be backported to the 1.7 branch we must be sure it's backward compatible with older versions; e.g. both BuildKit v0.12 and BuildKit "master" (v0.13-dev) use the containerd 1.7 branch, so it needs to be compatible with both those versions.

[thaJeztah]

noticed that we were updating to a vulnerable version of grpc here, so left a quick comment so that we don't merge before that's addressed.

[milas]

@crazy-max Do you have a sense of whether this will be an issue?

I see it's a rather large diff though, and includes an update to grpc; so for it to be backported to the 1.7 branch we must be sure it's backward compatible with older versions; e.g. both BuildKit v0.12 and BuildKit "master" (v0.13-dev) use the containerd 1.7 branch, so it needs to be compatible with both those versions.

[crazy-max]

@crazy-max Do you have a sense of whether this will be an issue?

I see it's a rather large diff though, and includes an update to grpc; so for it to be backported to the 1.7 branch we must be sure it's backward compatible with older versions; e.g. both BuildKit v0.12 and BuildKit "master" (v0.13-dev) use the containerd 1.7 branch, so it needs to be compatible with both those versions.

I don't think gRPC 1.58.3 will cause an issue on BuildKit. I will push changes to moby/buildkit#4318 to make sure of it.

Maybe we could bump gRPC in a dedicated PR on containerd first?

[crazy-max]

@milas Opened moby/buildkit#4359 to check gRPC update. Also took a look at otel updates on BuildKit side but encounter schema conflicts linked to otel/sdk: moby/buildkit#4356

[thaJeztah]

@milas Opened moby/buildkit#4359 to check gRPC update. Also took a look at otel updates on BuildKit side but encounter schema conflicts linked to otel/sdk: moby/buildkit#4356

do we need a draft PR against the release/1.7 branch of containers to verify, or is updating in buildkit enough?

[crazy-max]

@milas Opened moby/buildkit#4359 to check gRPC update. Also took a look at otel updates on BuildKit side but encounter schema conflicts linked to otel/sdk: moby/buildkit#4356

do we need a draft PR against the release/1.7 branch of containers to verify, or is updating in buildkit enough?

I think best would be a gRPC update PR (similar to moby/buildkit#4359) before OTEL one to ensure there is no regression on containerd repo.

[thaJeztah]

🙈 needs a rebase (again) @milas

[milas]

Since #9281 was merged, it'd probably be good to get this in so that 1.7.x isn't on a newer version of OTel deps than 2.0.x.

And again, this bump is sorta important because some of the OTel components have now been 'stabilized' so by raising the limit here, we'll have many fewer problems with Go module MVS moving forward (I hope)

[thaJeztah]

LGTM if CI is happy :)