switch to gopkg.in/yaml.v3

[BenTheElder]

https://github.com/kubernetes/test-infra/pull/33958/files#r1886682875

/priority backlog

we may also have to update dependency repos like sigs.k8s.io/prow

[BenTheElder]

/sig testing

[mkumatag]

/assign

[BenTheElder]

(#33979 (comment))

[mkumatag]

This is because of the following reason

$ go mod why -m gopkg.in/yaml.v3
# gopkg.in/yaml.v3
k8s.io/test-infra/experiment/coverage
github.com/go-openapi/spec    <====== (1)
github.com/go-openapi/swag
gopkg.in/yaml.v3

$ go mod why -m gopkg.in/yaml.v2
# gopkg.in/yaml.v2
k8s.io/test-infra/config/tests/mergelists
k8s.io/test-infra/config/tests/mergelists.test
github.com/GoogleCloudPlatform/testgrid/pkg/merger <====== (2)
gopkg.in/yaml.v2

(1) and (2) are imported modules that use these indirect dependencies. They are outside of the Kubernetes project, and we have minimal control over them.

[BenTheElder]

Testgrid is us and can be patched cc @michelle192837

(1) I'm less sure about. cc @pohly @jpbetz

[BenTheElder]

In kubernetes when we encounter this sort of issue we usually reach out to the intermediate projects to discuss. But I'm not sure if this is a reasonable ask in this case

[mkumatag]

Testgrid is us and can be patched cc @michelle192837

I see that they are using sigs.k8s.io/yaml module already, I can submit a PR to remove dependency from gopkg.in/yaml

https://github.com/GoogleCloudPlatform/testgrid/blob/3ad1f7c3c6a8b9085998213c1cc2cbd1eb80c3e4/go.mod#L33

[mkumatag]

Testgrid is us and can be patched cc @michelle192837

I see that they are using sigs.k8s.io/yaml module already, I can submit a PR to remove dependency from gopkg.in/yaml

https://github.com/GoogleCloudPlatform/testgrid/blob/3ad1f7c3c6a8b9085998213c1cc2cbd1eb80c3e4/go.mod#L33

submitted this PR in the testgrid - GoogleCloudPlatform/testgrid#1301

[pohly]

I don't think we need to be pedantic about this. Not depending on it in code that we as Kubernetes own should be good enough. We explicitly should not as other projects to use sigs.k8s.io/yaml.