Some of the projects being used without an exception by CNCF projects (I may have missed some):

• github.com/hashicorp/go-getter (MPL)
  • https://github.com/kubernetes/minikube/blob/859325e4494ebd0dedf3dd8148460f8eedf5b594/go.mod#L27C2-L27C32
• github.com/hashicorp/go-msgpack (MIT license for this one)
  • https://github.com/kubernetes/kops/blob/73159cd6f50f72e004d972ce2ade21dcf40b7860/go.mod#L142
  • https://github.com/antrea-io/antrea/blob/f679100427d1b2ca2fb5be93c29181459e75b62e/go.mod#L152
• github.com/hashicorp/go-safetemp (MPL)
  • https://github.com/kubernetes/minikube/blob/859325e4494ebd0dedf3dd8148460f8eedf5b594/go.mod#L156
• github.com/hashicorp/memberlist (MPL)
  • https://github.com/kubernetes/kops/blob/73159cd6f50f72e004d972ce2ade21dcf40b7860/go.mod#L148
  • https://github.com/antrea-io/antrea/blob/f679100427d1b2ca2fb5be93c29181459e75b62e/go.mod#L32
  • https://github.com/cortexproject/cortex/blob/526a6d935a948119cf74033a9f79391786022222/go.mod#L33

The references are not exhaustive of course.