Add kube-api-linter module by inteon · Pull Request #541 · cert-manager/makefile-modules

inteon · 2026-02-09T14:06:45Z

Adds a kube-api-linter makefile module for linting Kubernetes API types with sigs.k8s.io/kube-api-linter.

How it works

The tools module gains a kube-api-linter tool: a custom golangci-lint binary with the kube-api-linter plugin compiled in, built with golangci-lint custom from a generated .custom-gcl.yaml. Its version stamp combines the golangci-lint and plugin versions, and both are managed by Renovate.
The new kube-api-linter module provides verify-kube-api-lint (wired into make verify) and fix-kube-api-lint. The linter runs once in the repository root, using the config file named by the required kube_api_linter_config variable.

Usage

Klone the kube-api-linter module, then set:

kube_api_linter_config := .golangci.kube-api-linter.yaml

with a golangci-lint v2 config enabling the kubeapilinter custom linter (see the e2e test-project for a minimal example).

Testing

The e2e test-project now includes the module, so CI builds the custom binary and runs verify-kube-api-lint on Linux and macOS. Also verified locally that the linter fails the build on a struct with a non-pointer +optional field.

with claude fable-5

cert-manager-prow · 2026-02-09T14:06:52Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joshvanl for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

erikgb · 2026-02-09T19:58:06Z

+## Verify all APIs using Kube API Linter
+## @category [shared] Generate/ Verify
+verify-kube-api-lint: | $(NEEDS_GO) $(NEEDS_GOLANGCI-LINT-KUBE) $(bin_dir)/scratch
+	@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \


Do we really need to find/loop here? The API types will typically reside in one Go module.

Done in 9640e26 — the loop is gone, the linter now runs once in the repository root. See #541 (comment) for the full summary.

with claude fable-5

erikgb · 2026-02-09T19:58:31Z

+## Fix all APIs using Kube API Linter
+## @category [shared] Generate/ Verify
+fix-kube-api-lint: | $(NEEDS_GO) $(NEEDS_GOLANGCI-LINT-KUBE) $(bin_dir)/scratch
+	@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \


Same as above, to reduce complexity.

Done in 9640e26 — the loop is gone, the linter now runs once in the repository root. See #541 (comment) for the full summary.

with claude fable-5

erikgb · 2026-02-09T20:00:08Z

+golangci_lint_version := v2.8.0
+# https://pkg.go.dev/sigs.k8s.io/kube-api-linter?tab=versions
+# renovate: datasource=go packageName=sigs.k8s.io/kube-api-linter
+golangci_lint_kube_version := v0.0.0-20260114104534-18147eee9c49


Wouldn't kube_api_linter_version be a better name for this variable? (And the same for similar/deduced variables)

Done in 9640e26 — renamed to kube_api_linter_version and renamed the tool itself to kube-api-linter, so the deduced variables follow (KUBE-API-LINTER_VERSION, NEEDS_KUBE-API-LINTER, …). See #541 (comment) for the full summary.

with claude fable-5

Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>

- Rename the tool to kube-api-linter and the variables to kube_api_linter_* to match the module name. - Run the linter once in the repository root instead of looping over every Go module; API types typically live in a single module. - Fail early if kube_api_linter_config is not set, matching the go module's golangci_lint_config guard. - Generate .custom-gcl.yaml with printf instead of a yq pipeline, dropping the yq dependency from the build recipe, and avoid eval clobbering the global golangci_lint_version variable. - Bump sigs.k8s.io/kube-api-linter to the latest snapshot, tested against golangci-lint v2.13.0. - Add the module to the e2e test project so CI builds the custom binary and runs verify-kube-api-lint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>

wallrj · 2026-08-21T10:54:06Z

Rebased onto main and pushed 9640e26 addressing @erikgb's review:

Dropped the find/loop from the verify and fix targets — the linter now runs once in the repository root, matching Erik's observation that API types typically live in one Go module.
Renamed the tool to kube-api-linter and the variables to kube_api_linter_version, kube_api_linter_config and kube_api_linter_timeout, so the deduced variables become NEEDS_KUBE-API-LINTER, KUBE-API-LINTER and KUBE-API-LINTER_VERSION.
Simplified the build recipe: .custom-gcl.yaml is now written with a single printf (no yq dependency), and the $(eval ...) calls that clobbered the global golangci_lint_version are gone — the recipe uses the globals directly. The --name/--destination flags do exist in golangci-lint v2.13.0 (custom.go#L48-L50) but the yaml alone is enough.
Bumped sigs.k8s.io/kube-api-linter to the latest snapshot and added the module to the e2e test project, so CI now builds the custom binary and runs verify-kube-api-lint.

Tested locally: the custom binary builds with golangci-lint v2.13.0, verify-kube-api-lint passes on a clean project, and correctly fails with a kubeapilinter finding when given a struct with a non-pointer +optional field.

with claude fable-5

inteon requested a review from erikgb February 9, 2026 14:06

cert-manager-prow Bot added the dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. label Feb 9, 2026

cert-manager-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 9, 2026

erikgb reviewed Feb 9, 2026

View reviewed changes

cert-manager-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 11, 2026

inteon and others added 2 commits August 21, 2026 11:45

add Kube API linter

945458e

Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>

wallrj force-pushed the add_kube_api_lint branch from 7b621f4 to 9640e26 Compare August 21, 2026 10:53

cert-manager-prow Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 21, 2026

wallrj changed the title ~~Add Kube API linter~~ Add kube-api-linter module Aug 21, 2026

This was referenced Aug 21, 2026

WIP: Trial kube-api-linter module from makefile-modules PR 541 cert-manager/approver-policy#994

Open

WIP: Trial kube-api-linter module from makefile-modules PR 541 cert-manager/trust-manager#1070

Open

Navigation Menu

Uh oh!

Add kube-api-linter module - #541

Add kube-api-linter module#541
inteon wants to merge 2 commits into
mainfrom
add_kube_api_lint

inteon commented Feb 9, 2026 •

edited by wallrj

Loading

Uh oh!

cert-manager-prow Bot commented Feb 9, 2026

Uh oh!

erikgb Feb 9, 2026

Uh oh!

wallrj Aug 21, 2026

Uh oh!

erikgb Feb 9, 2026

Uh oh!

wallrj Aug 21, 2026

Uh oh!

erikgb Feb 9, 2026

Uh oh!

wallrj Aug 21, 2026

Uh oh!

wallrj commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

inteon commented Feb 9, 2026 • edited by wallrj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works

Usage

Testing

Uh oh!

cert-manager-prow Bot commented Feb 9, 2026

Uh oh!

erikgb Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

wallrj Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

erikgb Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

wallrj Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

erikgb Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

wallrj Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

wallrj commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

inteon commented Feb 9, 2026 •

edited by wallrj

Loading