#8325 Adds kubeapi linter to the project

[kkawka]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

It adds kube-api linter to the VPA.
It fixes some of the issue pointed by the linter.

Which issue(s) this PR fixes:

8325 - Add kube-api-linter to VPA project

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

N/A

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: kkawka / name: Kamil Kawka (0037665, 3c0e537, 50dc876, 77b273a, 9729f40, a52f7f0, d5b5e1b)

[k8s-ci-robot]

Hi @kkawka. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kkawka]

It is my first PR to the project. I'm open to any suggestions.

[kkawka]

I completed the CLA yesterday. I do not understand why it is still on red.

[adrianmoisey]

I completed the CLA yesterday. I do not understand why it is still on red.

I believe that https://linuxfoundation.atlassian.net/wiki/spaces/LP/pages/160923756/Missing+ID+on+Commit+but+I+have+an+agreement+on+file explains the issue

[kkawka]

I fix the CLA issue. The PR is ready for review

[adrianmoisey]

Thanks for the contribution.
I see this will apply the listing to both VPA and Cluster Autoscaler. I think these should be separate.
I don't know if the Cluster Autoscaler team wants this linting, and if they do they may not want the same ruleset.

The part I'm the most interested in is adding the linting to VPA only

[kkawka]

@adrianmoisey, thanks for your comment. What do you think I should do:

1. Keep it as it is and just move the kubelint config (golangci-kal.yml) to the VPA dir + remove cluster-autoscaler from the list of packages to scan.
2. Move the kubelint completely to the VPA—so move it under the vertical-pod-autoscaler/hack directory.

[adrianmoisey]

Heya,
I'd suggest #2 going forward

[kkawka]

@adrianmoisey updated

[adrianmoisey]

/ok-to-test

[adrianmoisey]

This doesn't work for me:

~/src/kubernetes/autoscaler/vertical-pod-autoscaler/hack (pr-8737)$ ./verify-kubelint.sh
verify-kubelint
creating custom golangci linter
Error: build process: clone golangci-lint: git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false -q https://github.com/golangci/golangci-lint.git: exit status 128
The command is terminated due to an error: build process: clone golangci-lint: git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false -q https://github.com/golangci/golangci-lint.git: exit status 128

I can't figure out why though, that clone works manually

[kkawka]

Did you run ./install-verify-tools.sh before ? It looks like it is an issue with the golangci-lint

I made a clean copy of the repo and I cannot reproduce it

➜  hack git:(pr-8737) ✗ pwd                 
/Users/kkawka/Repos/kkawka/autoscaler2/autoscaler/vertical-pod-autoscaler/hack
➜  hack git:(pr-8737) ./verify-kubelint.sh
verify-kubelint
creating custom golangci linter
INFO golangci-lint has version v2.5.0-custom-gcl-47DEQpj8HBSaTImW5JCeuQeRkm5NMpJWZG3hSuFU built with go1.25.1 from ? on 2025-12-02 21:48:40.927303 +0000 UTC 
INFO [config_reader] Used config file hack/tools/kube-api-linter/.golangci-kal.yml 
INFO maxprocs: Leaving GOMAXPROCS=10: CPU quota undefined 
INFO Loaded : kubeapilinter                       
INFO [goenv] Read go env for 24.4415ms: map[string]string{"GOCACHE":"/Users/kkawka/Library/Caches/go-build", "GOROOT":"/Users/kkawka/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.3.darwin-arm64"} 
INFO [lintersdb] Active 1 linters: [kubeapilinter] 
INFO [loader] Go packages loading at mode 8767 (deps|files|imports|name|types_sizes|compiled_files|exports_file) took 831.368583ms 
INFO [runner/filename_unadjuster] Pre-built 0 adjustments in 8.50625ms 
INFO [linters_context/goanalysis] analyzers took 0s with no stages 
INFO [runner/exclusion_paths] Skipped 0 issues by pattern ".*_test.go" 
INFO [runner/exclusion_rules] Skipped 0 issues by rules: [Path Except: "apis//*", Linters: "kubeapilinter"] 
INFO [runner] processing took 24.874µs with stages: exclusion_paths: 19.458µs, exclusion_rules: 3.5µs, max_same_issues: 875ns, nolint_filter: 250ns, path_absoluter: 209ns, max_from_linter: 83ns, severity-rules: 42ns, path_shortener: 42ns, path_prettifier: 42ns, source_code: 42ns, cgo: 42ns, path_relativity: 42ns, diff: 42ns, fixer: 41ns, filename_unadjuster: 41ns, max_per_file_from_linter: 41ns, sort_results: 41ns, invalid_issue: 41ns, generated_file_filter: 0s, uniq_by_line: 0s 
INFO [runner] linters took 400.0775ms with stages: goanalysis_metalinter: 399.984709ms 
0 issues.
INFO File cache stats: 0 entries of total size 0B 
INFO Memory: 14 samples, avg is 56.5MB, max is 88.5MB 
INFO Execution took 1.26541s        

[adrianmoisey]

Gotcha, thanks
Could this script be tweaked to not require calling another script first?

My preference is a standalone script that doesn't require a user to know that another script has to be run before.

Other than that, it worked as expected! Thanks!

[kkawka]

It can, just keep in mind golangci-lint is a dependency for a kube-api-linter.
Updated

[adrianmoisey]

Yup, that makes sense. Thanks!

[adrianmoisey]

/lgtm

This works locally, I also uncommented one of the linting tules and reran it, and got a screen full of warnings.

Thanks for handling this!

My suggestion to get these fixed, is to make a PR per linting rule (or batches of rules) for us to review and approve.
It's also possible that some of the rules need discussion to determine if we really want it.

cc @omerap12

[omerap12]

Are we sure this is ok?

1. This github actions is for the entire repo. I am not sure which go version does cluster-autoscaler use
2. Locally I get this:

ubuntu:~/autoscaler(pr-8737)$ curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.7.1
golangci/golangci-lint info checking GitHub for tag 'v2.7.1'
golangci/golangci-lint info found version: 2.7.1 for v2.7.1/linux/arm64
golangci/golangci-lint info installed /home/ubuntu/go/bin/golangci-lint
ubuntu:~/autoscaler(pr-8737)$ ./hack/install-verify-tools.sh 
go: finding module for package golang.org/x/tools/go/vcs
go: finding module for package github.com/kr/fs
go: finding module for package github.com/pmezard/go-difflib/difflib
go: finding module for package github.com/kr/pretty
go: found github.com/kr/fs in github.com/kr/fs v0.1.0
go: found github.com/kr/pretty in github.com/kr/pretty v0.3.1
go: found github.com/pmezard/go-difflib/difflib in github.com/pmezard/go-difflib v1.0.0
go: found golang.org/x/tools/go/vcs in golang.org/x/tools/go/vcs v0.1.0-deprecated
ubuntu:~/autoscaler(pr-8737)$  ./vertical-pod-autoscaler/hack/verify-kubelint.sh 
verify-kubelint
installing dependencies
creating custom golangci linter
INFO golangci-lint has version v2.5.0-custom-gcl-47DEQpj8HBSaTImW5JCeuQeRkm5NMpJWZG3hSuFU built with go1.24.7 from ? on 2025-12-05 09:59:57.074313026 +0000 UTC 
INFO [config_reader] Used config file hack/tools/kube-api-linter/.golangci-kal.yml 
Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25)
The command is terminated due to an error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25)

[kkawka]

with 1.24 the pipeline fails: https://github.com/kubernetes/autoscaler/actions/runs/19970789057/job/57274722659

[kkawka]

I'm not sure if it is possible to use go version lower than 1.25. golangci-lint started using 1.25 from version 2.4.0.
The kube-api-linter jumped straight from golangci-lint version 1.64 to 2.50.
There was a version in between that suppose to use golangci 2.0.2, but I do not know how find the artifact generated by that build.

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kkawka
Once this PR has been reviewed and has the lgtm label, please ask for approval from adrianmoisey. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment