# golangci-lint is used in Kubernetes with different configurations that # enable an increasing amount of checks: # - golangci.yaml is the most permissive configuration. All existing code # passed. # - golangci-hints.yaml adds checks for code patterns where developer # and reviewer may decide whether findings should get addressed before # merging. Beware that the golangci-lint output includes also the # issues that must be fixed and doesn't indicate how severe each issue # is (https://gophers.slack.com/archives/CS0TBRKPC/p1685721815275349). # # All three flavors are generated from golangci.yaml.in with # hack/update-golangci-lint-config.sh. run: timeout: 30m # The default is relative to the configuration, which is confusing because # then all paths start with ../ to move out of the "hack" directory. # `gomod` mirrors the current behavior of `golangci-lint.sh` changing into # the root of the repository. Because we are operating in a workspace, # the module picked by `gomod` is the main one relative-path-mode: gomod version: "2" formatters: exclusions: paths: - third_party output: formats: text: path: stderr issues: max-issues-per-linter: 0 max-same-issues: 0 linters: exclusions: paths: - third_party # Log a warning if an exclusion rule is unused. # # Uncomment when investigating whether the configuration can be simplified, # but beware that golangci-lint then needs to be invoked for the entire # repository. Invoking it for individual packages may trigger these warning # when the rules are only needed elsewhere. # # warn-unused: true # Excluding configuration per-path, per-linter, per-text and per-source. rules: # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1507012435 - linters: - gocritic text: "ifElseChain: rewrite if-else to switch statement" # Only packages listed here opt into the strict "exported symbols must be documented". # # Exclude texts from https://github.com/golangci/golangci-lint/blob/ab3c3cd69e602ff53bb4c3e2c188f0caeb80305d/pkg/config/issues.go#L11-L103 - linters: - revive - staticcheck text: comment on exported (method|function|type|const)|should have( a package)? comment|comment should be of the form|comment on exported (method|function|type|const)|should have( a package)? comment|comment should be of the form|exported (.+) should have comment( \(or a comment on this block\))? or be unexported|package comment should be of the form "(.+)...|comment on exported (.+) should be of the form "(.+)...|should have a package comment path-except: cmd/kubeadm # The unused linter that comes from staticcheck currently does not handle types which implement # a generic interface. The linter incorrectly reports the implementations of unexported # interface methods as unused. See https://github.com/dominikh/go-tools/issues/1294. # Rather than exporting the interface methods, which makes the error go away but changes the # semantics of the code, we ignore this error for affected files. # This can be removed when the staticcheck implementation of this rule is fixed, which may # depend on https://github.com/golang/go/issues/63982. - linters: - unused path: staging/src/k8s.io/client-go/util/workqueue/metrics.go # SSA Extract calls are allowed in tests. - linters: - forbidigo text: should not be used because managedFields was removed path: _test.go$ # Adding unversioned feature gates is allowed in tests - linters: - forbidigo text: should not use Add, use AddVersioned instead path: _test.go$ # The Kubernetes naming convention for conversion functions uses underscores # and intentionally deviates from normal Go conventions to make those function # names more readable. Same for SetDefaults_*. # # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1507028627 # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1514201592 - linters: - staticcheck - revive text: "(ST1003: should not use underscores in Go names; func ([cC]onvert_.*_To_.*|[sS]etDefaults_)|exported: exported function (Convert|SetDefaults)_.* should be of the form)" # The generated swagger docs also don't follow the naming convention. - linters: - staticcheck text: "ST1003: should not use underscores in Go names" path: types_swagger_doc_generated.go$ # TODO(https://github.com/kubernetes/kubernetes/issues/131475): Remove these excluded directories and fix findings. Due to large amount of findings in different components # with different owners it's hard to fix everything in a single pr. This will therefore be done in multiple prs. - path: (pkg/volume/*|test/*|azure/*|pkg/cmd/wait*|request/bearertoken/*|metrics/*|filters/*) linters: - gocritic # Some of these seem legitimate, maybe better fix code (https://github.com/kubernetes/kubernetes/issues/130449). - linters: - govet text: "lostcancel|printf" - linters: - ginkgolinter text: "wrong error assertion. Consider using `gomega.(Eventually|Consistently)|wrong comparison assertion|wrong length assertion" - linters: - gocritic text: "wrapperFunc: use strings.ReplaceAll|should rewrite switch statement to if statement" # Kube-API-Linter should only be run on the API definitions - linters: - kubeapilinter path-except: staging/src/k8s.io/api/.* # Exceptions for kube-api-linter. # Exceptions are used for kube-api-linter to ignore existing issues that cannot be fixed without breaking changes. # Pre-existing issues from the conditions linter # Conditions generally should be a metav1.Condition, and should not use custom condition types. - text: "Conditions field in StorageVersionStatus|StatefulSetStatus|DeploymentStatus|DaemonSetStatus|ReplicaSetStatus|HorizontalPodAutoscalerStatus|JobStatus|CertificateSigningRequestStatus|PersistentVolumeClaimStatus|ReplicationControllerStatus|ServiceStatus|NodeStatus|NamespaceStatus|ComponentStatus|PodStatus|FlowSchemaStatus|PriorityLevelConfigurationStatus|FlowSchemaStatus|PriorityLevelConfigurationStatus|PodDisruptionBudgetStatus|AllocatedDeviceStatus|Endpoint|StatefulSetStatus|DeploymentStatus|DaemonSetStatus|ReplicaSetStatus|HorizontalPodAutoscalerStatus|JobStatus|CertificateSigningRequestStatus|PersistentVolumeClaimStatus|ReplicationControllerStatus|ServiceStatus|NodeStatus|NamespaceStatus|ComponentStatus|PodStatus|FlowSchemaStatus|PriorityLevelConfigurationStatus|FlowSchemaStatus|PriorityLevelConfigurationStatus|PodDisruptionBudgetStatus|AllocatedDeviceStatus|Endpoint|StorageVersionMigrationStatus must be a slice of metav1.Condition" path: "staging/src/k8s.io/api/" # Conditions should have patch strategy markers, but changing these after shipping a client is a breaking change. # Clients would treat these as atomic, when the patch strategy should be merge. - text: "Conditions field in ValidatingAdmissionPolicyStatus is missing the following markers: patchStrategy=merge, patchMergeKey=type" path: "staging/src/k8s.io/api/admissionregistration/" - text: "Conditions field in ValidatingAdmissionPolicyStatus has incorrect tags, should be: `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,3,rep,name=conditions\"`" path: "staging/src/k8s.io/api/admissionregistration/" - text: "Conditions field in PodDisruptionBudgetStatus has incorrect tags, should be: `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`" path: "staging/src/k8s.io/api/policy/" - text: "Conditions field in AllocatedDeviceStatus is missing the following markers: patchStrategy=merge, patchMergeKey=type" path: "staging/src/k8s.io/api/resource/" - text: "Conditions field in AllocatedDeviceStatus has incorrect tags, should be: `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,5,rep,name=conditions\"`" path: "staging/src/k8s.io/api/resource/" # Pre-existing issues from the conflictmarkers linter # The Error field in some older API types is marked as both optional and required. # This is incorrect, but cannot be changed without breaking changes. - text: "field PortStatus.Error has conflicting markers: optional_vs_required: {\\[optional\\], \\[kubebuilder:validation:Required\\]}. fields cannot be both optional and required" path: "staging/src/k8s.io/api/core/v1/types.go" - text: "field IngressPortStatus.Error has conflicting markers: optional_vs_required: {\\[optional\\], \\[kubebuilder:validation:Required\\]}. fields cannot be both optional and required" path: "staging/src/k8s.io/api/extensions/v1beta1/types.go" - text: "field IngressPortStatus.Error has conflicting markers: optional_vs_required: {\\[optional\\], \\[kubebuilder:validation:Required\\]}. fields cannot be both optional and required" path: "staging/src/k8s.io/api/networking/v1/types.go" - text: "field IngressPortStatus.Error has conflicting markers: optional_vs_required: {\\[optional\\], \\[kubebuilder:validation:Required\\]}. fields cannot be both optional and required" path: "staging/src/k8s.io/api/networking/v1beta1/types.go" default: none enable: # please keep this alphabetized - depguard - forbidigo - ginkgolinter - gocritic - govet - ineffassign - kubeapilinter - logcheck - revive - sorted - staticcheck - testifylint - unused settings: # please keep this alphabetized custom: logcheck: # Installed there by hack/verify-golangci-lint.sh. path: _output/local/bin/logcheck.so description: structured logging checker original-url: k8s.io/logtools/logcheck settings: config: | # hack/logcheck.conf contains regular expressions that are matched against /, # for example k8s.io/cmd/kube-scheduler/app/config/config.go. # # By default, structured logging call parameters are checked, but usage of # those calls is not required. That is changed on a per-file basis. # # Remember to clean the golangci-lint cache when changing the configuration and # running the verify-golangci-lint.sh script multiple times, otherwise # golangci-lint will report stale results: # _output/local/bin/golangci-lint cache clean # At this point we don't enforce the usage structured logging calls except in # those packages that were migrated. This disables the check for other files. -structured .* # Now enable it again for migrated packages. structured k8s.io/kubernetes/pkg/kubelet/.* structured k8s.io/kubernetes/pkg/proxy/.* structured k8s.io/kms/.* structured k8s.io/apiserver/pkg/storage/value/.* structured k8s.io/apiserver/pkg/server/options/encryptionconfig/.* structured k8s.io/kubernetes/pkg/credentialprovider/plugin/.* # The following packages have been migrated to contextual logging. # Packages matched here do not have to be listed above because # "contextual" implies "structured". contextual k8s.io/api/.* contextual k8s.io/apimachinery/pkg/util/runtime/.* contextual k8s.io/client-go/metadata/.* contextual k8s.io/client-go/rest/.* contextual k8s.io/client-go/tools/cache/.* contextual k8s.io/client-go/tools/events/.* contextual k8s.io/client-go/tools/record/.* contextual k8s.io/component-helpers/.* contextual k8s.io/cri-api/.* contextual k8s.io/cri-client/.* contextual k8s.io/csi-translation-lib/.* contextual k8s.io/dynamic-resource-allocation/.* contextual k8s.io/endpointslice/.* contextual k8s.io/kms/.* contextual k8s.io/kube-controller-manager/.* contextual k8s.io/kube-proxy/.* contextual k8s.io/kube-scheduler/.* contextual k8s.io/sample-apiserver/.* contextual k8s.io/sample-cli-plugin/.* contextual k8s.io/sample-controller/.* contextual k8s.io/kubernetes/cmd/kube-proxy/.* contextual k8s.io/kubernetes/cmd/kube-scheduler/.* contextual k8s.io/kubernetes/cmd/kubelet/.* contextual k8s.io/kubernetes/pkg/api/.* contextual k8s.io/kubernetes/pkg/apis/.* contextual k8s.io/kubernetes/pkg/capabilities/.* contextual k8s.io/kubernetes/pkg/client/.* contextual k8s.io/kubernetes/pkg/cluster/.* contextual k8s.io/kubernetes/pkg/controller/.* contextual k8s.io/kubernetes/pkg/features/.* contextual k8s.io/kubernetes/pkg/fieldpath/.* contextual k8s.io/kubernetes/pkg/generated/.* contextual k8s.io/kubernetes/pkg/printers/.* contextual k8s.io/kubernetes/pkg/quota/.* contextual k8s.io/kubernetes/pkg/scheduler/.* contextual k8s.io/kubernetes/pkg/security/.* contextual k8s.io/kubernetes/pkg/securitycontext/.* contextual k8s.io/kubernetes/test/e2e/dra/.* contextual k8s.io/kubernetes/pkg/kubelet/certificate/.* contextual k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/.* contextual k8s.io/kubernetes/pkg/kubelet/cm/dra/.* contextual k8s.io/kubernetes/pkg/kubelet/cm/cpumanager/.* contextual k8s.io/kubernetes/pkg/kubelet/cm/memorymanager/.* contextual k8s.io/kubernetes/pkg/kubelet/cm/topologymanager/.* contextual k8s.io/kubernetes/pkg/kubelet/lifecycle/.* contextual k8s.io/kubernetes/pkg/kubelet/pleg/.* contextual k8s.io/kubernetes/pkg/kubelet/clustertrustbundle/.* contextual k8s.io/kubernetes/pkg/kubelet/token/.* contextual k8s.io/kubernetes/pkg/kubelet/cadvisor/.* contextual k8s.io/kubernetes/pkg/kubelet/config/.* contextual k8s.io/kubernetes/pkg/kubelet/oom/.* contextual k8s.io/kubernetes/pkg/kubelet/server/.* contextual k8s.io/kubernetes/pkg/kubelet/status/.* contextual k8s.io/kubernetes/pkg/kubelet/sysctl/.* contextual k8s.io/kubernetes/pkg/kubelet/winstats/.* contextual k8s.io/kubernetes/pkg/kubelet/apis/.* contextual k8s.io/kubernetes/pkg/kubelet/kubeletconfig/.* contextual k8s.io/kubernetes/pkg/kubelet/kuberuntime/.* contextual k8s.io/kubernetes/pkg/kubelet/nodeshutdown/.* contextual k8s.io/kubernetes/pkg/kubelet/pod/.* contextual k8s.io/kubernetes/pkg/kubelet/preemption/.* contextual k8s.io/kubernetes/pkg/kubelet/volumemanager/.* contextual k8s.io/kubernetes/pkg/kubelet/util/.* contextual k8s.io/kubernetes/pkg/kubelet/logs/.* contextual k8s.io/kubernetes/test/images/sample-device-plugin/.* # As long as contextual logging is alpha or beta, all WithName, WithValues, # NewContext calls have to go through klog. Once it is GA, we can lift # this restriction. Whether we then do a global search/replace remains # to be decided. with-helpers .* sorted: # Installed there by hack/verify-golangci-lint.sh. path: _output/local/bin/sorted.so description: check if feature gates are sorted original-url: k8s.io/kubernetes/hack/tools/golangci-lint/sorted settings: files: - cmd/kubeadm/app/features/features.go - pkg/features/kube_features.go - staging/src/k8s.io/apiserver/pkg/features/kube_features.go - staging/src/k8s.io/client-go/features/known_features.go - staging/src/k8s.io/controller-manager/pkg/features/kube_features.go - staging/src/k8s.io/apiextensions-apiserver/pkg/features/kube_features.go - test/e2e/feature/feature.go - test/e2e/environment/environment.go kubeapilinter: path: _output/local/bin/kube-api-linter.so description: kube-api-linter and lints Kube like APIs based on API conventions and best practices. original-url: sigs.k8s.io/kube-api-linter settings: linters: disable: - '*' enable: # - "commentstart" # Ensure comments start with the serialized version of the field name. - "conditions" # Ensure conditions have the correct json tags and markers. - "conflictingmarkers" # Detect mutually exclusive markers on the same field. # - "integers" # Ensure only int32 and int64 are used for integers. # - "jsontags" # Ensure every field has a json tag. # - "maxlength" # Ensure all strings and arrays have maximum lengths/maximum items. ONLY for CRDs until declarative markers exist in core types. # - "nobools" # Bools do not evolve over time, should use enums instead. # - "nofloats" # Ensure floats are not used. # - "nomaps" # Ensure maps are not used, unless they are `map[string]string` (for labels/annotations/etc). # - "nophase" # Ensure field names do not have the word "phase" in them. # - "notimestamp" # Ensure fields are not named "timestamp", prefer "time". # - "optionalfields" # Ensure fields marked optional have omitempty and pointers. # - "optionalorrequired" # Every field should be marked as `+optional` xor `+required`. # - "requiredfields" # Required fields should only be pointers when required based on the validity of the zero value, they should always have `omitempty`. - "ssatags" # Ensure lists have a listType tag. # - "uniquemarkers" # Ensure markers are not duplicated across field and type definitions. lintersConfig: conditions: isFirstField: Ignore usePatchStrategy: SuggestFix useProtobuf: SuggestFix conflictingmarkers: conflicts: - name: "optional_vs_required" sets: - ["k8s:optional", "optional", "kubebuilder:validation:Optional"] - ["k8s:required", "required", "kubebuilder:validation:Required"] description: "fields cannot be both optional and required" - name: "required_vs_default" sets: - ["k8s:required", "required", "kubebuilder:validation:Required"] - ["default"] description: "fields with default values are always optional" # jsonTags: # jsonTagRegex: "^[a-z][a-z0-9]*(?:[A-Z][a-z0-9]*)*$" # The default regex is appropriate for our use case. # nomaps: # policy: AllowStringToStringMaps # Determines how the linter should handle maps of basic types. Maps of objects are always disallowed. # optionalFields: # policy: AllowOptionalFields # Determines how the linter should handle optional fields.optionalfields: # pointers: # preference: Always | WhenRequired # Whether to always require pointers, or only when required. Defaults to `Always`. # policy: SuggestFix | Warn # The policy for pointers in optional fields. Defaults to `SuggestFix`. # omitempty: # policy: SuggestFix | Warn | Ignore # The policy for omitempty in optional fields. Defaults to `SuggestFix`. # omitzero: # policy: SuggestFix | Warn | Forbid # The policy for omitzero in optional fields. Defaults to `SuggestFix`. # optionalOrRequired: # preferredOptionalMarker: optional # The preferred optional marker to use, fixes will suggest to use this marker. Defaults to `optional`. # preferredRequiredMarker: required # The preferred required marker to use, fixes will suggest to use this marker. Defaults to `required`. # policy: AllowOptionalFields # Determines how the linter should handle optional fields. # requiredFields: # pointers: # policy: SuggestFix | Warn # The policy for pointers in required fields. Defaults to `SuggestFix`. # omitempty: # policy: SuggestFix | Warn | Ignore # The policy for omitempty in required fields. Defaults to `SuggestFix`. # omitzero: # policy: SuggestFix | Warn | Forbid # The policy for omitzero in required fields. Defaults to `SuggestFix`. ssatags: listTypeSetUsage: Ignore # The policy for listType=set usage on object arrays. Defaults to `Warn`. # uniquemarkers: # customMarkers: # - identifier: custom:SomeCustomMarker # attributes: # - fruit depguard: rules: go-cmp: files: - $all - "!$test" - "!**/test/**" - "!**/testing/**" - "!**/apitesting/**" deny: - pkg: "github.com/google/go-cmp/cmp" desc: "cmp is allowed only in test files" - pkg: "html/template" desc: "template is allowed only in test files as it disables dead code elimination" forbidigo: analyze-types: true forbid: - pattern: md5\.* # https://github.com/kubernetes/kubernetes/issues/129652 msg: md5 is oudated, insecure, prefer a secure hash (such as sha256) or a non-cryptographic hash - pattern: ^managedfields\.ExtractInto$ pkg: ^k8s\.io/apimachinery/pkg/util/managedfields$ msg: should not be used because managedFields was removed - pattern: \.Extract pkg: ^k8s\.io/client-go/applyconfigurations/ msg: should not be used because managedFields was removed - pattern: \.Add$ pkg: ^k8s\.io/component-base/featuregate$ msg: should not use Add, use AddVersioned instead gocritic: enabled-checks: # These are in addition to the default checks - see https://golangci-lint.run/docs/linters/configuration/#gocritic - boolExprSimplify - equalFold disabled-checks: # This disables checks that are enabled by default (this can be combined with enabled-checks, contrary to the docs) - appendAssign - assignOp # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1507008918 - captLocal - commentFormatting - deprecatedComment - elseif # The following have few (single-digit) occurrences left in k/k and wouldn't be too onerous to enable - exitAfterDefer - regexpMust - sloppyLen - typeSwitchVar - underef - unslice - valSwap revive: # Only these rules are enabled. rules: - name: exported arguments: - disableStutteringCheck staticcheck: checks: - "all" - "-QF1008" # Omit embedded fields from selector expression - "-QF1001" # Apply De Morgan’s law - "-QF1002" # Convert untagged switch to tagged switch - "-QF1003" # Convert if/else-if chain to tagged switch - "-QF1004" # Use strings.ReplaceAll instead of strings.Replace with n == -1 - "-QF1006" # Lift if+break into loop condition - "-QF1007" # Merge conditional assignment into variable declaration - "-QF1008" # Omit embedded fields from selector expression - "-QF1009" # Use time.Time.Equal instead of == operator - "-QF1011" # Omit redundant type from variable declaration - "-QF1012" # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) - "-S1000" # Use plain channel send or receive instead of single-case select - "-S1002" # Omit comparison with boolean constant - "-S1003" # Replace call to strings.Index with strings.Contains - "-S1004" # Replace call to bytes.Compare with bytes.Equal - "-S1005" # Drop unnecessary use of the blank identifier - "-S1006" # Use for { ... } for infinite loops - "-S1007" # Simplify regular expression by using raw string literal - "-S1008" # Simplify returning boolean expression - "-S1009" # Omit redundant nil check on slices, maps, and channels - "-S1011" # Use a single append to concatenate two slices - "-S1012" # Replace time.Now().Sub(x) with time.Since(x) - "-S1016" # Use a type conversion instead of manually copying struct fields - "-S1017" # Replace manual trimming with strings.TrimPrefix - "-S1019" # Simplify make call by omitting redundant arguments - "-S1021" # Merge variable declaration and assignment - "-S1023" # Omit redundant control flow - "-S1024" # Replace x.Sub(time.Now()) with time.Until(x) - "-S1025" # Don’t use fmt.Sprintf("%s", x) unnecessarily - "-S1028" # Simplify error construction with fmt.Errorf - "-S1030" # Use bytes.Buffer.String or bytes.Buffer.Bytes - "-S1034" # Use result of type assertion to simplify cases - "-S1036" # Unnecessary guard around map access - "-S1038" # Unnecessarily complex way of printing formatted string - "-S1039" # Unnecessary use of fmt.Sprint - "-S1040" # Type assertion to current type - "-SA1006" # Printf with dynamic first argument and no further arguments - "-SA1019" # Using a deprecated function, variable, constant or field - "-SA2002" # Called testing.T.FailNow or SkipNow in a goroutine, which isn’t allowed - "-SA4006" # A value assigned to a variable is never read before being overwritten. Forgotten error check or dead code? - "-SA4011" # ineffective break statement. Did you mean to break out of the outer loop? - "-ST1000" # Incorrect or missing package comment - "-ST1001" # Dot imports are discouraged - "-ST1003" # Poorly chosen identifier - "-ST1005" # Incorrectly formatted error string - "-ST1006" # Poorly chosen receiver name - "-ST1008" # A function’s error value should be its last return value - "-ST1011" # Poorly chosen name for variable of type time.Duration - "-ST1012" # Poorly chosen name for error variable - "-ST1013" # Should use constants for HTTP error codes, not magic numbers - "-ST1016" # Use consistent method receiver names - "-ST1017" # Don’t use Yoda conditions - "-ST1020" # The documentation of an exported function should start with the function’s name - "-ST1023" # Redundant type in variable declaration testifylint: enable-all: true disable: - empty - encoded-compare - equal-values - error-nil - expected-actual - float-compare - formatter - len - useless-assert - require-error