fix: resolve all 117 golangci-lint issues in maas-controller

apply auto-fixes for 93 modernize (interface{} -> any) and gci
(import ordering) issues via golangci-lint --fix.

manually fix the remaining 24 issues:
- extract repeated cel sub-expressions into constants and helper
  functions (subscriptionCacheKeySelector, authzCacheKeySelector)
  to resolve 5 lll violations while reducing duplication
- add safe type assertion checks for errcheck violations in
  controller indexers and test helpers
- use require.True for type assertions in externalmodel tests
- check json.Marshal error returns for errchkjson compliance
- rename shadowed builtin variable max -> limit (predeclared)
- add ireturn exclusion for externalModelPredicate in .golangci.yml

no functional changes — all existing tests pass and cache key
isolation tests confirm cel expressions are byte-identical.

Signed-off-by: Chaitanya Kulkarni <ckulkarn@redhat.com>
Signed-off-by: Chaitanya Kulkarni <chkulkar@redhat.com>
Made-with: Cursor

Author: chaitanya1731

maas-controller/.golangci.yml

@@ -120,6 +120,9 @@ linters:
       - linters:
           - ireturn
         path: pkg/controller/maas/maassubscription_controller\.go
+      - linters:
+          - ireturn
+        path: pkg/reconciler/externalmodel/reconciler\.go
       - linters:
           - modernize
         text: "(omitzero|mapsloop|rangeint):"

maas-controller/cmd/manager/main.go

@@ -218,13 +218,13 @@ func main() {
 		os.Exit(1)
 	}
 	if err := (&maas.MaaSAuthPolicyReconciler{
-		Client:            mgr.GetClient(),
-		Scheme:            mgr.GetScheme(),
-		MaaSAPINamespace:  maasAPINamespace,
-		GatewayName:       gatewayName,
-		ClusterAudience:   clusterAudience,
-		MetadataCacheTTL:  metadataCacheTTL,
-		AuthzCacheTTL:     authzCacheTTL,
+		Client:           mgr.GetClient(),
+		Scheme:           mgr.GetScheme(),
+		MaaSAPINamespace: maasAPINamespace,
+		GatewayName:      gatewayName,
+		ClusterAudience:  clusterAudience,
+		MetadataCacheTTL: metadataCacheTTL,
+		AuthzCacheTTL:    authzCacheTTL,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "MaaSAuthPolicy")
 		os.Exit(1)

maas-controller/pkg/controller/maas/cross_namespace_test.go

@@ -360,7 +360,10 @@ func TestMaaSSubscriptionReconciler_CrossNamespace(t *testing.T) {
 		WithObjects(modelA, routeA, modelB, routeB, maasSub).
 		WithStatusSubresource(&maasv1alpha1.MaaSSubscription{}).
 		WithIndex(&maasv1alpha1.MaaSSubscription{}, "spec.modelRef", func(obj client.Object) []string {
-			sub := obj.(*maasv1alpha1.MaaSSubscription)
+			sub, ok := obj.(*maasv1alpha1.MaaSSubscription)
+			if !ok {
+				return nil
+			}
 			var refs []string
 			for _, modelRef := range sub.Spec.ModelRefs {
 				refs = append(refs, modelRef.Namespace+"/"+modelRef.Name)

maas-controller/pkg/controller/maas/maasauthpolicy_controller.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"testing"
 
-	maasv1alpha1 "github.com/opendatahub-io/models-as-a-service/maas-controller/api/maas/v1alpha1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -29,6 +28,8 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	maasv1alpha1 "github.com/opendatahub-io/models-as-a-service/maas-controller/api/maas/v1alpha1"
 )
 
 // newPreexistingAuthPolicy builds a Kuadrant AuthPolicy as an unstructured object
@@ -1140,11 +1141,11 @@ func TestMaaSAuthPolicyReconciler_NoIdentityHeadersUpstream(t *testing.T) {
 
 		// Verify essential fields for TRLP
 		requiredFields := []string{
-			"userid",                      // User identification
-			"groups",                      // User groups
-			"selected_subscription_key",   // Model-scoped subscription key for TRLP
-			"selected_subscription",       // Subscription name
-			"subscription_info",           // Full subscription object (includes labels, organizationId, costCenter, etc.)
+			"userid",                    // User identification
+			"groups",                    // User groups
+			"selected_subscription_key", // Model-scoped subscription key for TRLP
+			"selected_subscription",     // Subscription name
+			"subscription_info",         // Full subscription object (includes labels, organizationId, costCenter, etc.)
 		}
 
 		for _, field := range requiredFields {
@@ -1175,7 +1176,7 @@ func TestMaaSAuthPolicyReconciler_NoIdentityHeadersUpstream(t *testing.T) {
 			t.Error("filters.identity must include 'subscription_info' field (full object from subscription-select)")
 		} else {
 			// Verify it's an expression that returns the full object
-			subscriptionInfoMap, ok := subscriptionInfoField.(map[string]interface{})
+			subscriptionInfoMap, ok := subscriptionInfoField.(map[string]any)
 			if !ok {
 				t.Errorf("subscription_info should be a map, got %T", subscriptionInfoField)
 			} else {
@@ -1231,4 +1232,3 @@ func contains(s, substr string) bool {
 			return false
 		}())
 }
-

maas-controller/pkg/controller/maas/maasauthpolicy_controller_test.go

@@ -20,8 +20,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"sort"
 	"slices"
+	"sort"
 	"strings"
 
 	"github.com/go-logr/logr"
@@ -194,27 +194,27 @@ func (r *MaaSSubscriptionReconciler) reconcileTRLPForModel(ctx context.Context,
 		return fmt.Errorf("failed to fetch HTTPRoute %s/%s: %w", httpRouteNS, httpRouteName, err)
 	}
 
-	limitsMap := map[string]interface{}{}
+	limitsMap := map[string]any{}
 	var subNames []string
 
 	type subInfo struct {
 		sub   maasv1alpha1.MaaSSubscription
 		mRef  maasv1alpha1.ModelSubscriptionRef
-		rates []interface{}
+		rates []any
 	}
 	var subs []subInfo
 	for _, sub := range allSubs {
 		for _, mRef := range sub.Spec.ModelRefs {
 			if mRef.Namespace != modelNamespace || mRef.Name != modelName {
 				continue
 			}
-			var rates []interface{}
+			var rates []any
 			if len(mRef.TokenRateLimits) > 0 {
 				for _, trl := range mRef.TokenRateLimits {
-					rates = append(rates, map[string]interface{}{"limit": trl.Limit, "window": trl.Window})
+					rates = append(rates, map[string]any{"limit": trl.Limit, "window": trl.Window})
 				}
 			} else {
-				rates = append(rates, map[string]interface{}{"limit": int64(100), "window": "1m"})
+				rates = append(rates, map[string]any{"limit": int64(100), "window": "1m"})
 			}
 			subs = append(subs, subInfo{sub: sub, mRef: mRef, rates: rates})
 			break
@@ -241,15 +241,15 @@ func (r *MaaSSubscriptionReconciler) reconcileTRLPForModel(ctx context.Context,
 
 		// TRLP limit key must be safe for YAML (no slashes)
 		safeKey := strings.ReplaceAll(subRef, "/", "-")
-		limitsMap[fmt.Sprintf("%s-%s-tokens", safeKey, si.mRef.Name)] = map[string]interface{}{
+		limitsMap[fmt.Sprintf("%s-%s-tokens", safeKey, si.mRef.Name)] = map[string]any{
 			"rates": si.rates,
-			"when": []interface{}{
-				map[string]interface{}{
+			"when": []any{
+				map[string]any{
 					"predicate": fmt.Sprintf(`auth.identity.selected_subscription_key == "%s"`, modelScopedRef),
 				},
 			},
-			"counters": []interface{}{
-				map[string]interface{}{"expression": "auth.identity.userid"},
+			"counters": []any{
+				map[string]any{"expression": "auth.identity.userid"},
 			},
 		}
 	}
@@ -279,8 +279,8 @@ func (r *MaaSSubscriptionReconciler) reconcileTRLPForModel(ctx context.Context,
 		return fmt.Errorf("failed to set owner reference on TokenRateLimitPolicy %s/%s: %w", policy.GetNamespace(), policy.GetName(), err)
 	}
 
-	spec := map[string]interface{}{
-		"targetRef": map[string]interface{}{
+	spec := map[string]any{
+		"targetRef": map[string]any{
 			"group": "gateway.networking.k8s.io",
 			"kind":  "HTTPRoute",
 			"name":  httpRouteName,
@@ -609,7 +609,10 @@ func (r *MaaSSubscriptionReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		&maasv1alpha1.MaaSSubscription{},
 		modelRefIndexKey,
 		func(obj client.Object) []string {
-			sub := obj.(*maasv1alpha1.MaaSSubscription)
+			sub, ok := obj.(*maasv1alpha1.MaaSSubscription)
+			if !ok {
+				return nil
+			}
 			var refs []string
 			for _, modelRef := range sub.Spec.ModelRefs {
 				// Index value format: "namespace/name"

maas-controller/pkg/controller/maas/maassubscription_controller.go

@@ -39,7 +39,10 @@ import (
 // subscriptionModelRefIndexer is the field indexer function for MaaSSubscription.
 // Extracted as a helper to be reused across tests with fake clients.
 func subscriptionModelRefIndexer(obj client.Object) []string {
-	sub := obj.(*maasv1alpha1.MaaSSubscription)
+	sub, ok := obj.(*maasv1alpha1.MaaSSubscription)
+	if !ok {
+		return nil
+	}
 	var refs []string
 	for _, modelRef := range sub.Spec.ModelRefs {
 		refs = append(refs, modelRef.Namespace+"/"+modelRef.Name)

maas-controller/pkg/controller/maas/maassubscription_controller_test.go

@@ -295,7 +295,7 @@ func specFromExternalModel(extModel *maasv1alpha1.ExternalModel, model *maasv1al
 	if portStr, ok := ann[AnnPort]; ok {
 		p, err := strconv.ParseInt(portStr, 10, 32)
 		if err != nil {
-			return spec, fmt.Errorf("invalid port %q: %v", portStr, err)
+			return spec, fmt.Errorf("invalid port %q: %w", portStr, err)
 		}
 		if p < 1 || p > 65535 {
 			return spec, fmt.Errorf("port %d out of range (1-65535)", p)
@@ -306,14 +306,14 @@ func specFromExternalModel(extModel *maasv1alpha1.ExternalModel, model *maasv1al
 	if tlsStr, ok := ann[AnnTLS]; ok {
 		parsed, err := strconv.ParseBool(tlsStr)
 		if err != nil {
-			return spec, fmt.Errorf("invalid tls value %q: %v", tlsStr, err)
+			return spec, fmt.Errorf("invalid tls value %q: %w", tlsStr, err)
 		}
 		spec.TLS = parsed
 	}
 
 	if extraStr, ok := ann[AnnExtraHeaders]; ok && extraStr != "" {
 		spec.ExtraHeaders = map[string]string{}
-		for _, pair := range strings.Split(extraStr, ",") {
+		for pair := range strings.SplitSeq(extraStr, ",") {
 			kv := strings.SplitN(pair, "=", 2)
 			if len(kv) == 2 {
 				spec.ExtraHeaders[strings.TrimSpace(kv[0])] = strings.TrimSpace(kv[1])

maas-controller/pkg/reconciler/externalmodel/reconciler.go

@@ -54,12 +54,12 @@ func BuildServiceEntry(spec ExternalModelSpec, modelName, namespace string, labe
 	se.SetNamespace(namespace)
 	se.SetLabels(labels)
 
-	se.Object["spec"] = map[string]interface{}{
-		"hosts":      []interface{}{spec.Endpoint},
+	se.Object["spec"] = map[string]any{
+		"hosts":      []any{spec.Endpoint},
 		"location":   "MESH_EXTERNAL",
 		"resolution": "DNS",
-		"ports": []interface{}{
-			map[string]interface{}{
+		"ports": []any{
+			map[string]any{
 				"number":   int64(spec.Port),
 				"name":     portName,
 				"protocol": protocol,
@@ -81,16 +81,16 @@ func BuildDestinationRule(spec ExternalModelSpec, modelName, namespace string, l
 	dr.SetNamespace(namespace)
 	dr.SetLabels(labels)
 
-	tlsConfig := map[string]interface{}{
+	tlsConfig := map[string]any{
 		"mode": "SIMPLE",
 	}
 	if spec.TLSInsecureSkipVerify {
 		tlsConfig["insecureSkipVerify"] = true
 	}
 
-	dr.Object["spec"] = map[string]interface{}{
+	dr.Object["spec"] = map[string]any{
 		"host": spec.Endpoint,
-		"trafficPolicy": map[string]interface{}{
+		"trafficPolicy": map[string]any{
 			"tls": tlsConfig,
 		},
 	}

maas-controller/pkg/reconciler/externalmodel/resources.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestSanitize(t *testing.T) {
@@ -68,11 +69,16 @@ func TestBuildServiceEntry(t *testing.T) {
 	assert.Equal(t, ModelServiceEntryName("my-gpt4"), se.GetName())
 	assert.Equal(t, "llm", se.GetNamespace())
 
-	hosts := se.Object["spec"].(map[string]interface{})["hosts"].([]interface{})
+	seSpec, ok := se.Object["spec"].(map[string]any)
+	require.True(t, ok, "spec must be map[string]any")
+	hosts, ok := seSpec["hosts"].([]any)
+	require.True(t, ok, "hosts must be []any")
 	assert.Equal(t, "api.openai.com", hosts[0])
 
-	ports := se.Object["spec"].(map[string]interface{})["ports"].([]interface{})
-	port := ports[0].(map[string]interface{})
+	ports, ok := seSpec["ports"].([]any)
+	require.True(t, ok, "ports must be []any")
+	port, ok := ports[0].(map[string]any)
+	require.True(t, ok, "port must be map[string]any")
 	assert.Equal(t, "https", port["name"])
 	assert.Equal(t, "HTTPS", port["protocol"])
 }
@@ -87,9 +93,12 @@ func TestBuildServiceEntryNoTLS(t *testing.T) {
 	labels := commonLabels("test-model")
 
 	se := BuildServiceEntry(spec, "test-model", "llm", labels)
-	seSpec := se.Object["spec"].(map[string]interface{})
-	ports := seSpec["ports"].([]interface{})
-	port := ports[0].(map[string]interface{})
+	seSpec, ok := se.Object["spec"].(map[string]any)
+	require.True(t, ok, "spec must be map[string]any")
+	ports, ok := seSpec["ports"].([]any)
+	require.True(t, ok, "ports must be []any")
+	port, ok := ports[0].(map[string]any)
+	require.True(t, ok, "port must be map[string]any")
 	assert.Equal(t, "HTTP", port["protocol"])
 	assert.Equal(t, "http", port["name"])
 }
@@ -110,11 +119,15 @@ func TestBuildDestinationRule(t *testing.T) {
 	assert.Equal(t, ModelDestinationRuleName("my-gpt4"), dr.GetName())
 	assert.Equal(t, "llm", dr.GetNamespace())
 
-	drSpec := dr.Object["spec"].(map[string]interface{})
+	drSpec, ok := dr.Object["spec"].(map[string]any)
+	require.True(t, ok, "spec must be map[string]any")
 	assert.Equal(t, "api.openai.com", drSpec["host"])
 
 	// Default: no insecureSkipVerify key
-	tlsCfg := drSpec["trafficPolicy"].(map[string]interface{})["tls"].(map[string]interface{})
+	tp, ok := drSpec["trafficPolicy"].(map[string]any)
+	require.True(t, ok, "trafficPolicy must be map[string]any")
+	tlsCfg, ok := tp["tls"].(map[string]any)
+	require.True(t, ok, "tls must be map[string]any")
 	assert.Equal(t, "SIMPLE", tlsCfg["mode"])
 	_, hasInsecure := tlsCfg["insecureSkipVerify"]
 	assert.False(t, hasInsecure, "insecureSkipVerify should not be set by default")
@@ -132,10 +145,14 @@ func TestBuildDestinationRuleInsecureSkipVerify(t *testing.T) {
 
 	dr := BuildDestinationRule(spec, "simulator-model", "llm", labels)
 
-	drSpec := dr.Object["spec"].(map[string]interface{})
+	drSpec, ok := dr.Object["spec"].(map[string]any)
+	require.True(t, ok, "spec must be map[string]any")
 	assert.Equal(t, "3.150.113.9", drSpec["host"])
 
-	tlsCfg := drSpec["trafficPolicy"].(map[string]interface{})["tls"].(map[string]interface{})
+	tp, ok := drSpec["trafficPolicy"].(map[string]any)
+	require.True(t, ok, "trafficPolicy must be map[string]any")
+	tlsCfg, ok := tp["tls"].(map[string]any)
+	require.True(t, ok, "tls must be map[string]any")
 	assert.Equal(t, "SIMPLE", tlsCfg["mode"])
 	assert.Equal(t, true, tlsCfg["insecureSkipVerify"], "insecureSkipVerify must be true when opted in")
 }