Update Protobuf dependencies for code generation (#6130)

This removes our direct dependency on github.com/golang/protobuf, which
has been superseded by google.golang.org/protobuf.

Some notable changes since the last time we updated:
* The versioning scheme for Protobuf has changed (see
  https://protobuf.dev/support/version-support/)
* The Golang gRPC code generator is now a standalone tool
  (protoc-gen-go-grpc) and is no longer included as a plugin in
  protoc-gen-go. With protoc-gen-go-grpc, the service implementations
  must embed the corresponding `Unimplemented<ServiceName>Server` for
  future compatibility (which we are now doing for `CNIServer`).

A new codegen image is released: antrea/codegen:kubernetes-1.29.2-build.0

New versions:
* protoc: v26.0
* protoc-gen-go: v1.33.0
* protoc-gen-go-grpc: v1.3.0

In our case, we don't have to worry about client-server compatibility,
given that antrea-cni (client) is always reinstalled by the antrea-agent
Pod. Even if it was a concern for us, there has been no change in the
Protobuf wire format.

Signed-off-by: Antonin Bas <[email protected]>

Author: antoninbas

build/images/codegen/Dockerfile

@@ -18,7 +18,7 @@ FROM ubuntu:22.04 as protoc
 RUN apt-get update && \
     apt-get install -y --no-install-recommends wget ca-certificates unzip
 
-RUN PROTOBUF_VERSION=3.0.2; ZIPNAME="protoc-${PROTOBUF_VERSION}-linux-x86_64.zip"; \
+RUN PROTOBUF_VERSION=26.0; ZIPNAME="protoc-${PROTOBUF_VERSION}-linux-x86_64.zip"; \
   mkdir /tmp/protoc && cd /tmp/protoc && \
   wget "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VERSION}/${ZIPNAME}" && \
   unzip "${ZIPNAME}" && \
@@ -47,7 +47,8 @@ RUN go install k8s.io/code-generator/cmd/client-gen@kubernetes-$K8S_VERSION && \
     go install k8s.io/code-generator/cmd/go-to-protobuf@kubernetes-$K8S_VERSION && \
     go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo@kubernetes-$K8S_VERSION && \
     go install go.uber.org/mock/[email protected] && \
-    go install github.com/golang/protobuf/[email protected] && \
+    go install google.golang.org/protobuf/cmd/[email protected] && \
+    go install google.golang.org/grpc/cmd/[email protected] && \
     go install golang.org/x/tools/cmd/goimports@latest && \
     go install sigs.k8s.io/controller-tools/cmd/[email protected]
 

build/images/codegen/README.md

@@ -16,10 +16,13 @@ docker push antrea/codegen:<TAG>
 The `docker push` command will fail if you do not have permission to push to the
 `antrea` Dockerhub repository.
 
+The image can only be built on an x86_64 machine (no arm support).
+
 Here is the table of codegen images that have been uploaded:
 
 | Tag                            | Change                                               |
 | :----------------------------- | ---------------------------------------------------- |
+| kubernetes-1.29.2-build.0      | Upgraded protoc (v26.0), protoc-gen-go (v1.33.0), protoc-gen-go-grpc (v1.3.0) |
 | kubernetes-1.29.2              | Upgraded K8s libraries to v1.29.2                    |
 | kubernetes-1.26.4-build.1      | Replace github.com/golang/mock with go.uber.org/mock |
 | kubernetes-1.26.4-build.0      | Upgraded Go to v1.21                                 |

docs/contributors/code-generation.md

@@ -2,8 +2,8 @@
 
 ## CNI
 
-Antrea uses [protoc](https://github.com/protocolbuffers/protobuf) and [protoc-gen-go](
-https://github.com/golang/protobuf) to generate CNI gRPC service code.
+Antrea uses [protoc](https://github.com/protocolbuffers/protobuf), [protoc-gen-go](https://github.com/protocolbuffers/protobuf-go)
+and [protoc-gen-go-grpc](https://github.com/grpc/grpc-go) to generate CNI gRPC service code.
 
 If you make any change to [cni.proto](../../pkg/apis/cni/v1beta1/cni.proto), you can
 re-generate the code by invoking `make codegen`.

go.mod

@@ -26,7 +26,6 @@ require (
 	github.com/gammazero/deque v0.1.2
 	github.com/go-logr/logr v1.4.1
 	github.com/gogo/protobuf v1.3.2
-	github.com/golang/protobuf v1.5.3
 	github.com/google/btree v1.1.2
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/memberlist v0.5.1
@@ -139,6 +138,7 @@ require (
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/cel-go v0.17.7 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect

hack/update-codegen-dockerized.sh

@@ -85,7 +85,7 @@ fi
 
 function generate_antrea_client_code {
   # Generate protobuf code for CNI gRPC service with protoc.
-  protoc --go_out=plugins=grpc:. pkg/apis/cni/v1beta1/cni.proto
+  protoc --go_out=. --go-grpc_out=. pkg/apis/cni/v1beta1/cni.proto
 
   # Generate clientset and apis code with K8s codegen tools.
   $GOPATH/bin/client-gen \

hack/update-codegen.sh

@@ -18,7 +18,7 @@ set -o errexit
 set -o pipefail
 
 ANTREA_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../" && pwd )"
-IMAGE_NAME="antrea/codegen:kubernetes-1.29.2"
+IMAGE_NAME="antrea/codegen:kubernetes-1.29.2-build.0"
 
 # Recent versions of Git will not access .git directories which are owned by
 # another user (as a security measure), unless the directories are explicitly

multicluster/hack/update-codegen.sh

@@ -18,7 +18,7 @@ set -o errexit
 set -o pipefail
 
 ANTREA_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../../" && pwd )"
-IMAGE_NAME="antrea/codegen:kubernetes-1.29.2"
+IMAGE_NAME="antrea/codegen:kubernetes-1.29.2-build.0"
 
 # Recent versions of Git will not access .git directories which are owned by
 # another user (as a security measure), unless the directories are explicitly

pkg/agent/cniserver/server.go

@@ -102,6 +102,11 @@ func (arbitrator *containerAccessArbitrator) unlockContainer(containerKey string
 }
 
 type CNIServer struct {
+	// CNIServer must embed UnimplementedCniServer. It is required by the code generated by
+	// protoc-gen-go-grpc (although it is possible to opt-out). It technically enables
+	// forward-compatibility when new methods are added to the gRPC service but are not
+	// implemented yet.
+	cnipb.UnimplementedCniServer
 	cniSocket          string
 	serverVersion      string
 	nodeConfig         *config.NodeConfig