chore: bump go to 1.27.1, k8s deps to v0.37.1 and controller-runtime to v0.25.2

[roguepikachu]

Part of kubevela/kubevela#7238.

Go 1.25 went out of support when Go 1.27 was released, so the ecosystem bump now targets Go 1.27.1, k8s.io v0.37.x and controller-runtime v0.25.x. This builds on #176, which moved the apiserver to canonical k8s.io/apiserver at v0.35.6.

Dependency changes:

• go 1.25.13 to 1.27.1
• k8s.io/{api,apimachinery,apiserver,client-go,component-base,kube-aggregator,apiextensions-apiserver} v0.35.x to v0.37.1
• sigs.k8s.io/controller-runtime v0.23.3 to v0.25.2
• k8s.io/kube-openapi follows to v0.0.0-20260721132016-d427ff9ee9ad, and the Makefile's openapi-gen pin moves to the same revision so generated code matches the runtime library
• Code generators move to the k8s 0.37 line: client-gen v0.35.6 to v0.37.1, and controller-gen plus the go.mod sigs.k8s.io/controller-tools v0.17.3 to v0.22.0, kept aligned as in Replace apiserver runtime #176. controller-tools v0.22.0 brings newer ginkgo/gomega and some golang.org/x minor bumps through MVS

Code change:

• In k8s 1.37, GenericAPIServer.Authorizer is typed authorizer.UnconditionalAuthorizer. The full authorizer.Authorizer interface now also requires ConditionsAwareAuthorize and EvaluateConditions for conditional authorization. The pkg/util/loopback holder now stores and returns UnconditionalAuthorizer. Its only consumer, the proxy subresource in clustergateway_proxy.go, only calls Authorize, so behaviour does not change. The loopback test now uses an authorizer that implements only Authorize, which is the shape the generic server hands over. The test failed to compile before the change.

RBAC fix for k8s 1.36+ (found by the e2e run on the first commit):

• MutatingAdmissionPolicy is GA and on by default from k8s 1.36 (k8s.io/apiserver v0.37 feature gate default true). The generic apiserver's admission chain therefore starts informers on mutatingadmissionpolicies and mutatingadmissionpolicybindings. The gateway service account could not list or watch them, so the informers never synced, and every write through admission failed with 403 not yet ready to handle request. In e2e that showed up as the healthiness and health-probe specs failing while GET/LIST passed, and the OCM addon specs failing.
• Both resources are added (get/list/watch) to charts/cluster-gateway and charts/addon-manager cluster roles and to newAPFClusterRole in pkg/addon/controllers/installer.go. This mirrors how validating admission policies were added for k8s 1.30. A new unit test checks the addon cluster role covers every admission resource the default plugins watch.

Generated code:

• pkg/apis/generated/zz_generated.openapi.go is regenerated by make test with the new openapi-gen. It drops empty Default values on array items and adds the new metav1 ShardInfo model.
• cmd/apiserver/main.go changes only by go fmt alignment of one map key.
• The clientset is regenerated with client-gen v0.37.1. Discovery() now returns discovery.DiscoveryInterfaces, the same as client-go 0.37's own kubernetes.Clientset. It embeds DiscoveryInterface, so callers are unaffected. Only hand-written fakes of versioned.Interface would need the new signature, and none exist in this repo.
• The CRD is regenerated with controller-gen v0.22.0; only the version annotation changes. charts/addon-manager/crds/clustergatewayconfigurations.yaml is kept identical to hack/crd/bases/....

CI and images:

• GO_VERSION in ci.yaml and go-release.yml, plus both Dockerfiles, move to Go 1.27.1 (golang:1.27.1, golang:1.27.1-alpine)
• e2e: kind v0.32.0 to v0.33.0, node image kindest/node:v1.37.0 for both the standalone and OCM e2e jobs
• envtest assets 1.35.x to 1.37.x

Verified locally with go1.27.1:

• go build ./..., go vet ./...
• make test with envtest 1.37.0 assets passes (generate, generate-openapi, fmt, vet, manifests, go test ./pkg/...)

Once this merges, a release tag would unblock kubevela/pkg, which currently has to replace cluster-gateway with a fork. The last tag is v1.9.1, from May 2025.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.39%. Comparing base (8ff085a) to head (036a312).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #177      +/-   ##
==========================================
+ Coverage   32.15%   35.39%   +3.23%     
==========================================
  Files          43       43              
  Lines        2264     1992     -272     
==========================================
- Hits          728      705      -23     
+ Misses       1476     1287     -189     
+ Partials       60        0      -60     

Flag	Coverage Δ
unit-test	35.39% <100.00%> (+3.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

All reported issues were addressed across 11 files

<sub>Click Fix with cubic on a comment, or reply @cubic-dev-ai fix this, and cubic writes the fix.

Fix all with cubic | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Turn on auto-fix | Re-trigger cubic</sub>