chore: remove vendor (#4201)

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Author: sozercan

.github/workflows/license-lint.yaml

@@ -4,13 +4,11 @@ on:
     paths:
       - "go.mod"
       - "go.sum"
-      - "vendor/**"
       - "third_party/k8s.io/kubernetes/hack/verify-licenses.sh"
   pull_request:
     paths:
       - "go.mod"
       - "go.sum"
-      - "vendor/**"
       - "third_party/k8s.io/kubernetes/hack/verify-licenses.sh"
 
 permissions:

.gitignore

@@ -23,9 +23,7 @@ _dist
 config/overlays/dev/manager_image_patch.yaml
 config/overlays/dev_mutation/manager_image_patch.yaml
 
-# Kubernetes Generated files - skip generated files, except for vendored files
-
-!vendor/**/zz_generated.*
+# Kubernetes Generated files - skip generated files
 
 # editor and IDE paraphernalia
 .idea
@@ -350,9 +348,6 @@ __pycache__/
 *.odx.cs
 *.xsd.cs
 
-# always include vendor directory
-!/vendor/**
-
 # tilt
 tilt-settings.json
 .tiltbuild

AGENTS.md

@@ -15,7 +15,7 @@ Gatekeeper is a Kubernetes admission controller that provides policy-based gover
 
 **Repository Details:**
 - **Size & Type:** Large-scale Go project (~165k lines) focused on Kubernetes admission control and policy governance with extensive test coverage
-- **Primary Language:** Go 1.24+ with vendored dependencies
+- **Primary Language:** Go 1.24+ with Go modules
 - **Key Frameworks:** controller-runtime, OPA/Rego, Common Expression Language (CEL)
 - **Container Technology:** Docker with multi-stage builds using buildx
 - **Testing Stack:** Go test, BATS (Bash Automated Testing System), envtest for Kubernetes integration
@@ -100,7 +100,6 @@ Gatekeeper is a Kubernetes admission controller that provides policy-based gover
 │   ├── externaldata/                  # External data provider tests
 │   └── testutils/                     # Test utilities and helpers
 ├── third_party/                       # Third-party dependencies
-├── vendor/                            # Go vendor dependencies
 └── website/                           # Documentation website source
 ```
 
@@ -125,7 +124,6 @@ Gatekeeper is a Kubernetes admission controller that provides policy-based gover
 **Critical Prerequisites:**
 - **Always install Go 1.24.2 or later** - verified compatible version
 - **Docker with buildx support** - required for all builds
-- **vendor/ directory must be present** - run `go mod vendor` if missing
 
 **Essential Build Commands:**
 ```bash
@@ -146,14 +144,12 @@ make deploy               # Deploy to Kubernetes cluster
 **Critical Build Issues & Solutions:**
 - **Empty test files cause lint failures** - remove any empty `.go` files in `pkg/` directories
 - **Docker buildx required** - standard docker build will fail, must use buildx
-- **Vendor dependencies** - run `go mod vendor` before building if vendor/ missing
 - **Tool versions matter** - golangci-lint v2.3.0 specifically required
 
 **Development Environment Setup:**
 1. Install Go 1.24.2+ and Docker with buildx
 2. Clone with full dependency chain: `git clone --recurse-submodules`
-3. **Always run `go mod vendor` after fresh clone**
-4. **Always run `make lint` before committing** - catches common issues
+3. **Always run `make lint` before committing** - catches common issues
 5. Use `make native-test` for fast feedback during development
 
 ### Testing Strategy
@@ -312,7 +308,7 @@ When contributing to Gatekeeper, maintain clear and human-friendly communication
 **Common Validation Failures:**
 - **Lint failures:** Usually formatting or import issues, run `make lint` locally first
 - **Test timeouts:** E2E tests can timeout after 15 minutes, check cluster resources
-- **Build failures:** Often vendor/ or Docker buildx issues, ensure prerequisites met
+- **Build failures:** Often Docker buildx issues, ensure prerequisites met
 
 **Security & Performance Notes:**
 - **All admission webhook changes require security review** - validate input sanitization

Dockerfile

@@ -16,7 +16,10 @@ ENV GO111MODULE=on \
 WORKDIR /go/src/github.com/open-policy-agent/gatekeeper
 COPY . .
 
-RUN go build -mod vendor -a -ldflags "${LDFLAGS}" -o manager
+RUN \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -a -ldflags "${LDFLAGS}" -o manager
 
 FROM gcr.io/distroless/static-debian12@sha256:4b2a093ef4649bccd586625090a3c668b254cfe180dee54f4c94f3e9bd7e381e
 

Makefile

@@ -184,7 +184,7 @@ all: lint test manager
 native-test: envtest
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(KUBERNETES_VERSION) --bin-dir $(LOCALBIN) -p path)" \
 	GO111MODULE=on \
-	go test -mod vendor ./pkg/... ./apis/... ./cmd/gator/... -race -bench . -coverprofile cover.out
+	go test ./pkg/... ./apis/... ./cmd/gator/... -race -bench . -coverprofile cover.out
 
 .PHONY: benchmark-test
 benchmark-test:
@@ -327,19 +327,19 @@ e2e-reader-build-image:
 
 # Build manager binary
 manager: generate
-	GO111MODULE=on go build -mod vendor -o bin/manager -ldflags $(LDFLAGS)
+	GO111MODULE=on go build -o bin/manager -ldflags $(LDFLAGS)
 
 # Build manager binary
 manager-osx: generate
-	GO111MODULE=on go build -mod vendor -o bin/manager GOOS=darwin -ldflags $(LDFLAGS)
+	GO111MODULE=on go build -o bin/manager GOOS=darwin -ldflags $(LDFLAGS)
 
 # Run against the configured Kubernetes cluster in ~/.kube/config
 run: generate manifests
-	GO111MODULE=on go run -mod vendor ./main.go
+	GO111MODULE=on go run ./main.go
 
 # Install CRDs into a cluster
 install: manifests
-	docker run -v $(shell pwd)/config:/config -v $(shell pwd)/vendor:/vendor \
+	docker run -v $(shell pwd)/config:/config \
 		registry.k8s.io/kustomize/kustomize:v${KUSTOMIZE_VERSION} build \
 		/config/crd | kubectl apply -f -
 
@@ -351,7 +351,6 @@ ifeq ($(ENABLE_GENERATOR_EXPANSION),true)
 endif
 	docker run \
 		-v $(shell pwd)/config:/config \
-		-v $(shell pwd)/vendor:/vendor \
 		registry.k8s.io/kustomize/kustomize:v${KUSTOMIZE_VERSION} build \
 		/config/overlays/dev | kubectl apply -f -
 
@@ -364,6 +363,9 @@ manifests: __controller-gen
 		paths="./apis/..." \
 		paths="./pkg/..." \
 		output:crd:artifacts:config=config/crd/bases
+	@# Copy constraint template CRD from frameworks module
+	go mod download github.com/open-policy-agent/frameworks/constraint
+	cp $$(go list -m -f '{{.Dir}}' github.com/open-policy-agent/frameworks/constraint)/deploy/crds.yaml config/crd/bases/constrainttemplate-customresourcedefinition.yaml
 	./build/update-match-schema.sh
 	rm -rf manifest_staging
 	mkdir -p manifest_staging/deploy
@@ -547,7 +549,7 @@ promote-staging-manifest:
 
 # Delete gatekeeper from a cluster. Note this is not a complete uninstall, just a dev convenience
 uninstall:
-	docker run -v $(shell pwd)/config:/config -v $(shell pwd)/vendor:/vendor \
+	docker run -v $(shell pwd)/config:/config \
 		registry.k8s.io/kustomize/kustomize:v${KUSTOMIZE_VERSION} build \
 		/config/overlays/dev | kubectl delete -f -
 
@@ -585,11 +587,6 @@ envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
 $(ENVTEST): $(LOCALBIN)
 	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20250729155826-ada80794ea8f
 
-.PHONY: vendor
-vendor:
-	go mod vendor
-	go mod tidy
-
 .PHONY: gator
 gator: bin/gator-$(GOOS)-$(GOARCH)
 	mv bin/gator-$(GOOS)-$(GOARCH) bin/gator

Tiltfile

@@ -34,12 +34,12 @@ COPY bin/manager .
 def build_manager():
     cmd = [
         "make tilt-prepare",
-        "GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod vendor -a -o .tiltbuild/bin/manager",
+        "GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -o .tiltbuild/bin/manager",
     ]
     local_resource(
         "manager",
         cmd=";".join(cmd),
-        deps=["pkg", "third_party", "vendor",
+        deps=["pkg", "third_party",
               "apis", "go.mod", "go.sum", "main.go"],
         labels=["bin"],
     )
@@ -81,14 +81,14 @@ def build_crds():
 # deploy_gatekeeper defines the deploy process for the gatekeeper chart from manifest_staging/charts/gatekeeper.
 def deploy_gatekeeper():
     local("kubectl create namespace gatekeeper-system || true")
-    
+
     local_resource(
         name="generate-helm-values",
         cmd="cat tilt-settings.json | jq '.helm_values' > .tiltbuild/helm_values.generated.yaml",
         deps=["tilt-settings.json"],
         labels=["helm"],
     )
-    
+
     helm_values = settings.get("helm_values", {})
 
     k8s_yaml(helm(

apis/apis.go

@@ -13,9 +13,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Generate deepcopy for apis
-//go:generate go run ../../vendor/k8s.io/code-generator/cmd/deepcopy-gen/main.go -O zz_generated.deepcopy -i ./... -h ../../hack/boilerplate.go.txt
-
 // Package apis contains Kubernetes API groups.
 package apis
 

…t/frameworks/constraint/deploy/crds.yaml …nttemplate-customresourcedefinition.yamlvendor/github.com/open-policy-agent/frameworks/constraint/deploy/crds.yaml renamed to config/crd/bases/constrainttemplate-customresourcedefinition.yaml vendor/github.com/open-policy-agent/frameworks/constraint/deploy/crds.yaml renamed to config/crd/bases/constrainttemplate-customresourcedefinition.yaml

@@ -17,11 +17,9 @@ resources:
 - bases/status.gatekeeper.sh_connectionpodstatuses.yaml
 - bases/status.gatekeeper.sh_providerpodstatuses.yaml
 - bases/connection.gatekeeper.sh_connections.yaml
+- bases/constrainttemplate-customresourcedefinition.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
-bases:
-- ../../vendor/github.com/open-policy-agent/frameworks/constraint/deploy
-
 patches:
 - target:
     group: apiextensions.k8s.io

config/crd/kustomization.yaml

@@ -15,7 +15,10 @@ ENV GO111MODULE=on \
 COPY . /go/src/github.com/open-policy-agent/gatekeeper
 WORKDIR /go/src/github.com/open-policy-agent/gatekeeper/cmd/gator
 
-RUN go build -mod vendor -a -ldflags "${LDFLAGS}" -o /gator
+RUN \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -a -ldflags "${LDFLAGS}" -o /gator
 
 FROM --platform=$BUILDPLATFORM gcr.io/distroless/static-debian12@sha256:4b2a093ef4649bccd586625090a3c668b254cfe180dee54f4c94f3e9bd7e381e AS build
 USER 65532:65532