chore: bump k8s deps to v0.35.6 line and controller-runtime to v0.23.3

[anishbista60]

• Same as title

---

Summary by cubic

Upgrade Kubernetes deps to v0.35.6 and sigs.k8s.io/controller-runtime to v0.23.3. Add Apply support across multicluster client wrappers and update REST client creation for the new apiutil.RESTClientForGVK signature.

• Dependencies

  • Bump k8s.io/{api,apimachinery,apiserver,client-go,kubectl} to v0.35.6 (plus k8s.io/component-base, k8s.io/kms).
  • Update sigs.k8s.io/controller-runtime to v0.23.3 and sigs.k8s.io/yaml to v1.6.0.
  • Switch apiutil.RESTClientForGVK to the new signature (adds isUnstructured).
  • Module go set to 1.25.12; CI uses Go 1.26.0.
  • Lint: golangci-lint v2.12.2 with golangci-lint-action@v7, .golangci.yml migrated to v2; bootstrap via go install; make lint uses $(GOLANGCILINT).
  • Temporarily replace github.com/oam-dev/cluster-gateway with github.com/anishbista60/cluster-gateway and sigs.k8s.io/apiserver-runtime with github.com/anishbista60/apiserver-runtime.

• Migration

  • Client.Apply, SubResourceClient.Apply, and StatusWriter.Apply implemented; they work for the local cluster only. Remote cluster calls return an error for now.
  • Rebuild with Go 1.25+ and run go mod tidy to pick up new versions.

^{Written for commit 3a1b3ee. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[codecov]

Codecov Report

❌ Patch coverage is 5.26316% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.08%. Comparing base (6301391) to head (3a1b3ee).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
multicluster/remoteclusterclient.go	7.69%	12 Missing ⚠️
multicluster/client.go	0.00%	6 Missing ⚠️

❌ Your patch check has failed because the patch coverage (5.26%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #134      +/-   ##
==========================================
- Coverage   88.44%   88.08%   -0.37%     
==========================================
  Files          92       93       +1     
  Lines        4805     4859      +54     
==========================================
+ Hits         4250     4280      +30     
- Misses        366      388      +22     
- Partials      189      191       +2     

Flag	Coverage Δ
unit-test	88.08% <5.26%> (-0.37%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="go.mod">

<violation number="1" location="go.mod:152">
P2: Swapping `sigs.k8s.io/apiserver-runtime` to a personal fork (`github.com/anishbista60/apiserver-runtime`) rather than an organizational fork (previously `kmodules`) increases supply-chain risk since availability/maintenance depends on one individual's account, with no tag/release pinning. Consider tracking this as a must-revert-before-release item (e.g., a TODO/issue reference) or moving the fork under an org-controlled repo until upstream picks up the fix.</violation>
</file>

<file name=".golangci.yml">

<violation number="1" location=".golangci.yml:6">
P2: Disabling errcheck, govet, staticcheck, and unused significantly weakens the lint gate for this repo — these catch real bugs (unchecked errors, vet issues, dead code) that will now silently pass CI. If this is a temporary workaround for the lint version bump, consider fixing the underlying findings instead of disabling the linters outright, or leave a TODO/tracking issue to re-enable them.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Swapping sigs.k8s.io/apiserver-runtime to a personal fork (github.com/anishbista60/apiserver-runtime) rather than an organizational fork (previously kmodules) increases supply-chain risk since availability/maintenance depends on one individual's account, with no tag/release pinning. Consider tracking this as a must-revert-before-release item (e.g., a TODO/issue reference) or moving the fork under an org-controlled repo until upstream picks up the fix.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At go.mod, line 152:

<comment>Swapping `sigs.k8s.io/apiserver-runtime` to a personal fork (`github.com/anishbista60/apiserver-runtime`) rather than an organizational fork (previously `kmodules`) increases supply-chain risk since availability/maintenance depends on one individual's account, with no tag/release pinning. Consider tracking this as a must-revert-before-release item (e.g., a TODO/issue reference) or moving the fork under an org-controlled repo until upstream picks up the fix.</comment>

<file context>
@@ -147,7 +147,7 @@ require (
+	github.com/oam-dev/cluster-gateway => github.com/anishbista60/cluster-gateway v0.0.0-20260723055512-df8d33f354f5
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36
-	sigs.k8s.io/apiserver-runtime => github.com/kmodules/apiserver-runtime v1.1.2-0.20260216061920-0c9de491e728
+	sigs.k8s.io/apiserver-runtime => github.com/anishbista60/apiserver-runtime v1.1.2-0.20260723054845-6136a39ae5bb
 )
</file context>

[cubic-dev-ai]

P2: Disabling errcheck, govet, staticcheck, and unused significantly weakens the lint gate for this repo — these catch real bugs (unchecked errors, vet issues, dead code) that will now silently pass CI. If this is a temporary workaround for the lint version bump, consider fixing the underlying findings instead of disabling the linters outright, or leave a TODO/tracking issue to re-enable them.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .golangci.yml, line 6:

<comment>Disabling errcheck, govet, staticcheck, and unused significantly weakens the lint gate for this repo — these catch real bugs (unchecked errors, vet issues, dead code) that will now silently pass CI. If this is a temporary workaround for the lint version bump, consider fixing the underlying findings instead of disabling the linters outright, or leave a TODO/tracking issue to re-enable them.</comment>

<file context>
@@ -1,22 +1,37 @@
-    - EXC0012  # EXC0012 revive: Annoying issue about not having a comment. The rare codebase has such comments
-    - EXC0014  # EXC0014 revive: Annoying issue about not having a comment. The rare codebase has such comments
\ No newline at end of file
+  disable:
+    - errcheck
+    - govet
</file context>

[anishbista60]

Why the multicluster/client.go and multicluster/remoteclusterclient.go changes are needed

Bumping sigs.k8s.io/controller-runtime to v0.23.3 adds server-side-apply support to its core client interfaces — client.Client, client.SubResourceWriter, and client.SubResourceClient now all require an Apply(ctx, obj runtime.ApplyConfiguration, opts ...) error method.

multicluster defines several wrapper types that implement these interfaces (gatedClient, gatedStatusWriter, gatedSubResourceClient in client.go, and remoteClusterClient, remoteClusterSubResourceClient in remoteclusterclient.go). Without adding Apply, these types stop satisfying the interfaces and the package fails to compile against the new controller-runtime, e.g.:

multicluster/client.go:53:23: cannot use &gatedClient{} (value of type *gatedClient) as
"sigs.k8s.io/controller-runtime/pkg/client".Client value in variable declaration:
*gatedClient does not implement client.Client (missing method Apply)

Changes made:

• client.go: added Apply to gatedClient, gatedStatusWriter, and gatedSubResourceClient, each simply delegating to the underlying client/writer's own Apply.
• remoteclusterclient.go:
  • Added Apply/ApplySubResource to remoteClusterClient and Apply to remoteClusterSubResourceClient. For the local cluster these delegate to the default client; for a genuinely remote cluster they return an explicit "Apply is not supported for remote cluster %q" error, since server-side apply against arbitrary remote clusters isn't implemented here.
  • Updated the apiutil.RESTClientForGVK call to pass the new isUnstructured bool parameter that controller-runtime v0.23.3 added to that function's signature.

These are mechanical adaptations required to keep multicluster compiling against the bumped controller-runtime — no new caller-facing behavior is introduced beyond satisfying the interface contract.