diff --git a/build/common.sh b/build/common.sh
index bd6a01a2074..f846cfa510f 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -614,7 +614,7 @@ function kube::build::start_rsyncd_container() {
     -- /rsyncd.sh >/dev/null
 
   local mapped_port
-  if ! mapped_port=$("${DOCKER[@]}" port "${KUBE_RSYNC_CONTAINER_NAME}" ${KUBE_CONTAINER_RSYNC_PORT} 2> /dev/null | cut -d: -f 2) ; then
+  if ! mapped_port=$("${DOCKER[@]}" port "${KUBE_RSYNC_CONTAINER_NAME}" "${KUBE_CONTAINER_RSYNC_PORT}" 2> /dev/null | cut -d: -f 2) ; then
     kube::log::error "Could not get effective rsync port"
     return 1
   fi
@@ -630,7 +630,7 @@ function kube::build::start_rsyncd_container() {
   if kube::build::rsync_probe 127.0.0.1 "${mapped_port}"; then
     KUBE_RSYNC_ADDR="127.0.0.1:${mapped_port}"
     return 0
-  elif kube::build::rsync_probe "${container_ip}" ${KUBE_CONTAINER_RSYNC_PORT}; then
+  elif kube::build::rsync_probe "${container_ip}" "${KUBE_CONTAINER_RSYNC_PORT}"; then
     KUBE_RSYNC_ADDR="${container_ip}:${KUBE_CONTAINER_RSYNC_PORT}"
     return 0
   fi
diff --git a/cluster/gce/upgrade.sh b/cluster/gce/upgrade.sh
index 1f8629e990e..e30033de0f9 100755
--- a/cluster/gce/upgrade.sh
+++ b/cluster/gce/upgrade.sh
@@ -402,7 +402,7 @@ function do-node-upgrade() {
     if [[ "${set_instance_template_rc}" != 0 ]]; then
       echo "== FAILED to set-instance-template for ${group} to ${template_name} =="
       echo "${set_instance_template_out}"
-      return ${set_instance_template_rc}
+      return "${set_instance_template_rc}"
     fi
     instances=()
     while IFS='' read -r line; do instances+=("$line"); done < <(gcloud compute instance-groups managed list-instances "${group}" \
@@ -412,7 +412,7 @@ function do-node-upgrade() {
     if [[ "${list_instances_rc}" != 0 ]]; then
       echo "== FAILED to list instances in group ${group} =="
       echo "${instances[@]}"
-      return ${list_instances_rc}
+      return "${list_instances_rc}"
     fi
 
     process_count_left=${node_upgrade_parallelism}
diff --git a/cluster/gce/windows/smoke-test.sh b/cluster/gce/windows/smoke-test.sh
index cc4fbed5673..6d866a81886 100755
--- a/cluster/gce/windows/smoke-test.sh
+++ b/cluster/gce/windows/smoke-test.sh
@@ -139,15 +139,9 @@ EOF
   fi
 }
 
-# Returns the name of an arbitrary Linux webserver pod.
-function get_linux_webserver_pod_name {
-  $kubectl get pods -l app=$linux_webserver_pod_label \
-    -o jsonpath='{.items[0].metadata.name}'
-}
-
 # Returns the IP address of an arbitrary Linux webserver pod.
 function get_linux_webserver_pod_ip {
-  $kubectl get pods -l app=$linux_webserver_pod_label \
+  $kubectl get pods -l app="$linux_webserver_pod_label" \
     -o jsonpath='{.items[0].status.podIP}'
 }
 
@@ -194,7 +188,7 @@ EOF
   timeout=$linux_deployment_timeout
   while [[ $timeout -gt 0 ]]; do
     echo "Waiting for $linux_command_replicas Linux $linux_command_pod_label pods to become Ready"
-    statuses=$(${kubectl} get pods -l app=$linux_command_pod_label \
+    statuses=$(${kubectl} get pods -l app="$linux_command_pod_label" \
       -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}' \
       | grep "True" | wc -w)
     if [[ $statuses -eq $linux_command_replicas ]]; then
@@ -210,7 +204,7 @@ EOF
   else
     echo "ERROR: Not all $linux_command_pod_label pods became Ready"
     echo "kubectl get pods -l app=$linux_command_pod_label"
-    ${kubectl} get pods -l app=$linux_command_pod_label
+    ${kubectl} get pods -l app="$linux_command_pod_label"
     cleanup_deployments
     exit 1
   fi
@@ -218,16 +212,10 @@ EOF
 
 # Returns the name of an arbitrary Linux command pod.
 function get_linux_command_pod_name {
-  $kubectl get pods -l app=$linux_command_pod_label \
+  $kubectl get pods -l app="$linux_command_pod_label" \
     -o jsonpath='{.items[0].metadata.name}'
 }
 
-# Returns the IP address of an arbitrary Linux command pod.
-function get_linux_command_pod_ip {
-  $kubectl get pods -l app=$linux_command_pod_label \
-    -o jsonpath='{.items[0].status.podIP}'
-}
-
 # Installs test executables (ping, curl) in the Linux command pod.
 # NOTE: this assumes that there is only one Linux "command pod".
 # TODO(pjh): fix this.
@@ -318,18 +306,13 @@ EOF
   fi
 }
 
-function get_windows_webserver_pod_name {
-  $kubectl get pods -l app=$windows_webserver_pod_label \
-    -o jsonpath='{.items[0].metadata.name}'
-}
-
 function get_windows_webserver_pod_ip {
-  $kubectl get pods -l app=$windows_webserver_pod_label \
+  ${kubectl} get pods -l app="$windows_webserver_pod_label" \
     -o jsonpath='{.items[0].status.podIP}'
 }
 
 function undeploy_windows_webserver_pod {
-  ${kubectl} delete deployment $windows_webserver_deployment
+  ${kubectl} delete deployment "$windows_webserver_deployment"
 }
 
 windows_command_deployment=windows-powershell
@@ -399,17 +382,12 @@ EOF
 }
 
 function get_windows_command_pod_name {
-  $kubectl get pods -l app=$windows_command_pod_label \
+  $kubectl get pods -l app="$windows_command_pod_label" \
     -o jsonpath='{.items[0].metadata.name}'
 }
 
-function get_windows_command_pod_ip {
-  $kubectl get pods -l app=$windows_command_pod_label \
-    -o jsonpath='{.items[0].status.podIP}'
-}
-
 function undeploy_windows_command_pod {
-  ${kubectl} delete deployment $windows_command_deployment
+  ${kubectl} delete deployment "$windows_command_deployment"
 }
 
 function test_linux_node_to_linux_pod {
@@ -459,22 +437,6 @@ function test_linux_pod_to_windows_pod {
   fi
 }
 
-function test_linux_pod_to_internet {
-  echo "TEST: ${FUNCNAME[0]}"
-  local linux_command_pod
-  linux_command_pod="$(get_linux_command_pod_name)"
-  # A stable (hopefully) HTTP server provided by Cloudflare.
-  local internet_ip="1.1.1.1"
-
-  if ! $kubectl exec "$linux_command_pod" -- curl -s -m 20 \
-      "http://$internet_ip" > $output_file; then
-    cleanup_deployments
-    echo "Failing output: $(cat $output_file)"
-    echo "FAILED: ${FUNCNAME[0]}"
-    exit 1
-  fi
-}
-
 function test_linux_pod_to_k8s_service {
   echo "TEST: ${FUNCNAME[0]}"
   local linux_command_pod
diff --git a/hack/make-rules/test.sh b/hack/make-rules/test.sh
index 4aa72730d83..14d26328dfb 100755
--- a/hack/make-rules/test.sh
+++ b/hack/make-rules/test.sh
@@ -269,7 +269,7 @@ runTests() {
      | tee ${junit_filename_prefix:+"${junit_filename_prefix}.stdout"} \
      | grep --binary-files=text "${go_test_grep_pattern}" && rc=$? || rc=$?
     produceJUnitXMLReport "${junit_filename_prefix}"
-    return ${rc}
+    return "${rc}"
   fi
 
   kube::log::status "Running tests with code coverage ${KUBE_RACE:+"and with ${KUBE_RACE}"}"
@@ -340,7 +340,7 @@ runTests() {
   go tool cover -html="${COMBINED_COVER_PROFILE}" -o="${coverage_html_file}"
   kube::log::status "Combined coverage report: ${coverage_html_file}"
 
-  return ${test_result}
+  return "${test_result}"
 }
 
 reportCoverageToCoveralls() {
diff --git a/hack/make-rules/verify.sh b/hack/make-rules/verify.sh
index a322a165e71..a02d4cbcb8a 100755
--- a/hack/make-rules/verify.sh
+++ b/hack/make-rules/verify.sh
@@ -113,7 +113,7 @@ function is-explicitly-chosen {
   index=0
   for e in "${TARGET_LIST[@]}"; do
     if [[ "${e}" == "${name}" ]]; then
-      TARGET_LIST[${index}]=""
+      TARGET_LIST[index]=""
       return
     fi
     index=$((index + 1))
diff --git a/hack/verify-shellcheck.sh b/hack/verify-shellcheck.sh
index 5b93ef05e92..2b3ac3824a6 100755
--- a/hack/verify-shellcheck.sh
+++ b/hack/verify-shellcheck.sh
@@ -30,8 +30,8 @@ DOCKER="${DOCKER:-docker}"
 
 # required version for this script, if not installed on the host we will
 # use the official docker image instead. keep this in sync with SHELLCHECK_IMAGE
-SHELLCHECK_VERSION="0.8.0"
-SHELLCHECK_IMAGE="docker.io/koalaman/shellcheck-alpine:v0.8.0@sha256:f42fde76d2d14a645a848826e54a4d650150e151d9c81057c898da89a82c8a56"
+SHELLCHECK_VERSION="0.9.0"
+SHELLCHECK_IMAGE="docker.io/koalaman/shellcheck-alpine:v0.9.0@sha256:e19ed93c22423970d56568e171b4512c9244fc75dd9114045016b4a0073ac4b7"
 
 # disabled lints
 disabled=(
diff --git a/test/cmd/legacy-script.sh b/test/cmd/legacy-script.sh
index 7da61e79839..eb4f457dcb0 100755
--- a/test/cmd/legacy-script.sh
+++ b/test/cmd/legacy-script.sh
@@ -328,6 +328,17 @@ setup() {
   kube::log::status "Setup complete"
 }
 
+# Generate a random namespace name, based on the current time (to make
+# debugging slightly easier) and a random number. Don't use `date +%N`
+# because that doesn't work on OSX.
+create_and_use_new_namespace() {
+  local ns_name
+  ns_name="namespace-$(date +%s)-${RANDOM}"
+  kube::log::status "Creating namespace ${ns_name}"
+  kubectl create namespace "${ns_name}"
+  kubectl config set-context "${CONTEXT}" --namespace="${ns_name}"
+}
+
 # Runs all kubectl tests.
 # Requires an env var SUPPORTED_RESOURCES which is a comma separated list of
 # resources for which tests should be run.
@@ -341,17 +352,6 @@ runTests() {
   kube::log::status "Checking kubectl version"
   kubectl version
 
-  # Generate a random namespace name, based on the current time (to make
-  # debugging slightly easier) and a random number. Don't use `date +%N`
-  # because that doesn't work on OSX.
-  create_and_use_new_namespace() {
-    local ns_name
-    ns_name="namespace-$(date +%s)-${RANDOM}"
-    kube::log::status "Creating namespace ${ns_name}"
-    kubectl create namespace "${ns_name}"
-    kubectl config set-context "${CONTEXT}" --namespace="${ns_name}"
-  }
-
   kube_flags=( '-s' "https://127.0.0.1:${SECURE_API_PORT}" '--insecure-skip-tls-verify' )
 
   kube_flags_without_token=( "${kube_flags[@]}" )
diff --git a/test/conformance/image/run_e2e.sh b/test/conformance/image/run_e2e.sh
index fe9747a93b2..d324ae4d079 100755
--- a/test/conformance/image/run_e2e.sh
+++ b/test/conformance/image/run_e2e.sh
@@ -18,6 +18,7 @@ set -o nounset
 set -o pipefail
 
 # Shutdown the tests gracefully then save the results
+# shellcheck disable=SC2317 # false positive
 shutdown () {
     E2E_SUITE_PID=$(pgrep e2e.test)
     echo "sending TERM to ${E2E_SUITE_PID}"
@@ -41,7 +42,7 @@ saveResults() {
 if [[ -n ${E2E_USE_GO_RUNNER:-} ]]; then
     set -x
     /gorunner && ret=0 || ret=$?
-    exit ${ret}
+    exit "${ret}"
 fi
 
 # We get the TERM from kubernetes and handle it gracefully
@@ -74,4 +75,4 @@ set -x
 /usr/local/bin/ginkgo "${ginkgo_args[@]}" /usr/local/bin/e2e.test -- --disable-log-dump --repo-root=/kubernetes --provider="${E2E_PROVIDER}" --report-dir="${RESULTS_DIR}" --kubeconfig="${KUBECONFIG}" -v="${E2E_VERBOSITY}" > >(tee "${RESULTS_DIR}"/e2e.log) && ret=0 || ret=$?
 set +x
 saveResults
-exit ${ret}
+exit "${ret}"
diff --git a/test/kubemark/run-e2e-tests.sh b/test/kubemark/run-e2e-tests.sh
index f7e8f691cc7..50ef835a9b4 100755
--- a/test/kubemark/run-e2e-tests.sh
+++ b/test/kubemark/run-e2e-tests.sh
@@ -39,6 +39,6 @@ fi
 
 # Running locally.
 for ((i=0; i < ${#ARGS[@]}; i++)); do
-  ARGS[$i]="$(echo "${ARGS[$i]}" | sed -e 's/\[/\\\[/g' -e 's/\]/\\\]/g' )"
+  ARGS[i]="$(echo "${ARGS[$i]}" | sed -e 's/\[/\\\[/g' -e 's/\]/\\\]/g' )"
 done
 "${KUBE_ROOT}/hack/ginkgo-e2e.sh" "--e2e-verify-service-account=false" "--dump-logs-on-failure=false" "${ARGS[@]}"
diff --git a/third_party/forked/shell2junit/sh2ju.sh b/third_party/forked/shell2junit/sh2ju.sh
index 82d17f8b92c..0c48cb01d68 100755
--- a/third_party/forked/shell2junit/sh2ju.sh
+++ b/third_party/forked/shell2junit/sh2ju.sh
@@ -122,13 +122,13 @@ function juLog() {
   echo "+++ exit code: ${evErr}"        | tee -a ${outf}
 
   # set the appropriate error, based in the exit code and the regex
-  [[ ${evErr} != 0 ]] && err=1 || err=0
+  [[ ${evErr} -ne 0 ]] && err=1 || err=0
   out="$(${SED} -e 's/^\([^+]\)/| \1/g' "$outf")"
-  if [ ${err} = 0 ] && [ -n "${ereg:-}" ]; then
+  if [ "${err}" -eq 0 ] && [ -n "${ereg:-}" ]; then
       H=$(echo "${out}" | grep -E ${icase} "${ereg}")
       [[ -n "${H}" ]] && err=1
   fi
-  [[ ${err} != 0 ]] && echo "+++ error: ${err}"         | tee -a ${outf}
+  [[ ${err} -ne 0 ]] && echo "+++ error: ${err}"         | tee -a ${outf}
   rm -f ${outf}
 
   errMsg=$(cat ${errf})
@@ -142,7 +142,7 @@ function juLog() {
   # write the junit xml report
   ## failure tag
   local failure=""
-  if [[ ${err} != 0 ]]; then
+  if [[ ${err} -ne 0 ]]; then
       local failureMsg
       if [ -n "${failureRe}" ]; then
           failureMsg="$(echo "${errMsg}" | grep -e "${failureRe}" | ${SED} -e "s;${failureRe};;")"
@@ -195,5 +195,5 @@ EOF
 EOF
   fi
 
-  return ${err}
+  return "${err}"
 }