[release-4.19] NO-ISSUE: Fix modified vendor/ and go.sum after vendoring

[adobes1]

Hermetic builds require that running go mod vendor produces no diff. Without this PR, multus-networkpolicy can't be built hermetically.

  2025-11-28 13:52:18,370 ERROR [mode:STRICT] vendor directory changed after vendoring:
  M	vendor/github.com/spf13/cobra/command.go
  2025-11-28 13:52:18,384 DEBUG Running `/usr/local/go/go1.20/bin/go clean -modcache`
  2025-11-28 13:52:19,669 ERROR PackageRejected: The content of the vendor directory is not consistent with go.mod. Please check the logs for more details.
  Error: PackageRejected: The content of the vendor directory is not consistent with go.mod. Please check the logs for more details.
    Please try running `go mod vendor` and committing the changes.

Changes in this PR are the result of running go mod tidy and go mod vendor

[openshift-ci-robot]

@adobes1: This pull request explicitly references no jira issue.

Details

In response to this:

Hermetic builds require that running go mod vendor produces no diff. Without this PR, multus-networkpolicy can't be built hermetically.

 2025-11-28 13:52:18,370 ERROR [mode:STRICT] vendor directory changed after vendoring:
 M	vendor/github.com/spf13/cobra/command.go
 2025-11-28 13:52:18,384 DEBUG Running `/usr/local/go/go1.20/bin/go clean -modcache`
 2025-11-28 13:52:19,669 ERROR PackageRejected: The content of the vendor directory is not consistent with go.mod. Please check the logs for more details.
 Error: PackageRejected: The content of the vendor directory is not consistent with go.mod. Please check the logs for more details.
   Please try running `go mod vendor` and committing the changes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[zeeke]

/lgtm
/approve
/label backport-risk-assessed

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adobes1, zeeke

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [zeeke]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adobes1]

/test okd-scos-images

[openshift-ci]

@adobes1: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[SchSeba]

/hold

just a small comment. feel free to remove the hold

[SchSeba]

I think this change is expected from u/s no?

[adobes1]

Thank you! I'm unfortunately not too familiar with upstream work. If I remember correctly, changes to go.sum (produced by go mod tidy) don't block hermetic builds, so I can remove it from the PR if you'd like. However, this would cause verify-deps to fail.

[SchSeba]

please run this on https://github.com/k8snetworkplumbingwg/multi-networkpolicy and open the PR.
after that we can cherry-pick the changes.

btw that is the case also for 4.20 and 4.21 no?

[adobes1]

@SchSeba Apologies for the delay. From what I can see, this issue affects only 4.19. 4.20 and 4.21 are OK.

I ran go mod tidy and go mod vendor on https://github.com/k8snetworkplumbingwg/multi-networkpolicy-iptables (I assume you meant this repo instead of https://github.com/k8snetworkplumbingwg/multi-networkpolicy, as that one doesn't appear to be actively used - though I tested both and neither had vendor changes). The only changes produced were to go.mod, not to vendor/.