Repository: envoyproxy/gateway

Issue:
Add kubeapi linter to make lint
*Description*:
>Describe the desired behavior, what scenario it enables and how it
would be used.

There's a new kubeapi linter tool https://github.com/kubernetes-sigs/kube-api-linter which enforces best practices, would be good to add this into the project so reduce best practice recommendation dependency from the reviewers

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.


Discussion:
@Sukuna0007Abhi: Can I work on this @arkodg @shiavm006: i would like to work on this issue 
can u assign i to me 
@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@fabian4: I am willing to take this if it is still open

Solution patch:
diff --git a/internal/cmd/certgen.go b/internal/cmd/certgen.go
index a9b6d3f11..04b365183 100644
--- a/internal/cmd/certgen.go
+++ b/internal/cmd/certgen.go
@@ -170,43 +170,43 @@ func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *c
 }
 
 // outputCertsForLocal outputs the provided certs to the local directory as files.
-func outputCertsForLocal(localPath string, certs *crypto.Certificates) (err error) {
+func outputCertsForLocal(localPath string, certs *crypto.Certificates) error {
 	egDir := path.Join(localPath, "envoy-gateway")
-	if err = file.WriteDir(certs.CACertificate, egDir, "ca.crt"); err != nil {
+	if err := file.WriteDir(certs.CACertificate, egDir, "ca.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyGatewayCertificate, egDir, "tls.crt"); err != nil {
+	if err := file.WriteDir(certs.EnvoyGatewayCertificate, egDir, "tls.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyGatewayPrivateKey, egDir, "tls.key"); err != nil {
+	if err := file.WriteDir(certs.EnvoyGatewayPrivateKey, egDir, "tls.key"); err != nil {
 		return err
 	}
 
 	envoyDir := path.Join(localPath, "envoy")
-	if err = file.WriteDir(certs.CACertificate, envoyDir, "ca.crt"); err != nil {
+	if err := file.WriteDir(certs.CACertificate, envoyDir, "ca.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyCertificate, envoyDir, "tls.crt"); err != nil {
+	if err := file.WriteDir(certs.EnvoyCertificate, envoyDir, "tls.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyPrivateKey, envoyDir, "tls.key"); err != nil {
+	if err := file.WriteDir(certs.EnvoyPrivateKey, envoyDir, "tls.key"); err != nil {
 		return err
 	}
 
 	rlDir := path.Join(localPath, "envoy-rate-limit")
-	if err = file.WriteDir(certs.CACertificate, rlDir, "ca.crt"); err != nil {
+	if err := file.WriteDir(certs.CACertificate, rlDir, "ca.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyRateLimitCertificate, rlDir, "tls.crt"); err != nil {
+	if err := file.WriteDir(certs.EnvoyRateLimitCertificate, rlDir, "tls.crt"); err != nil {
 		return err
 	}
-	if err = file.WriteDir(certs.EnvoyRateLimitPrivateKey, rlDir, "tls.key"); err != nil {
+	if err := file.WriteDir(certs.EnvoyRateLimitPrivateKey, rlDir, "tls.key"); err != nil {
 		return err
 	}
 
-	if err = file.WriteDir(certs.OIDCHMACSecret, path.Join(localPath, "envoy-oidc-hmac"), "hmac-secret"); err != nil {
+	if err := file.WriteDir(certs.OIDCHMACSecret, path.Join(localPath, "envoy-oidc-hmac"), "hmac-secret"); err != nil {
 		return err
 	}
 
-	return
+	return nil
 }
diff --git a/internal/filewatcher/filewatcher.go b/internal/filewatcher/filewatcher.go
index b7b5555ae..401bf9d39 100644
--- a/internal/filewatcher/filewatcher.go
+++ b/internal/filewatcher/filewatcher.go
@@ -175,12 +175,12 @@ func (fw *fileWatcher) findWorker(path string) (*workerState, string, error) {
 	return ws, cleanedPath, nil
 }
 
-func getPath(path string) (cleanedPath, parentPath string) {
-	cleanedPath = filepath.Clean(path)
-	parentPath, _ = filepath.Split(cleanedPath)
+func getPath(path string) (string, string) {
+	cleanedPath := filepath.Clean(path)
+	parentPath, _ := filepath.Split(cleanedPath)
 	if f, err := os.Lstat(cleanedPath); err == nil && f.IsDir() {
 		parentPath = cleanedPath
 	}
 
-	return
+	return cleanedPath, parentPath
 }
diff --git a/internal/gatewayapi/runner/runner.go b/internal/gatewayapi/runner/runner.go
index 4adc0b3a1..349dea8b2 100644
--- a/internal/gatewayapi/runner/runner.go
+++ b/internal/gatewayapi/runner/runner.go
@@ -78,7 +78,7 @@ func (r *Runner) Name() string {
 }
 
 // Start starts the gateway-api translator runner
-func (r *Runner) Start(ctx context.Context) (err error) {
+func (r *Runner) Start(ctx context.Context) error {
 	r.Logger = r.Logger.WithName(r.Name()).WithValues("runner", r.Name())
 
 	go r.startWasmCache(ctx)
@@ -88,7 +88,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 
 	go r.subscribeAndTranslate(c)
 	r.Logger.Info("started")
-	return
+	return nil
 }
 
 func (r *Runner) startWasmCache(ctx context.Context) {
@@ -362,18 +362,19 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 	r.Logger.Info("shutting down")
 }
 
-func (r *Runner) loadTLSConfig(ctx context.Context) (tlsConfig *tls.Config, salt []byte, err error) {
+func (r *Runner) loadTLSConfig(ctx context.Context) (*tls.Config, []byte, error) {
 	switch {
 	case r.EnvoyGateway.Provider.IsRunningOnKubernetes():
-		salt, err = hmac(ctx, r.ControllerNamespace)
+		salt, err := hmac(ctx, r.ControllerNamespace)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to get hmac secret: %w", err)
 		}
 
-		tlsConfig, err = crypto.LoadTLSConfig(serveTLSCertFilepath, serveTLSKeyFilepath, serveTLSCaFilepath)
+		tlsConfig, err := crypto.LoadTLSConfig(serveTLSCertFilepath, serveTLSKeyFilepath, serveTLSCaFilepath)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to create tls config: %w", err)
 		}
+		return tlsConfig, salt, nil
 
 	case r.EnvoyGateway.Provider.IsRunningOnHost():
 		// Get config
@@ -390,7 +391,7 @@ func (r *Runner) loadTLSConfig(ctx context.Context) (tlsConfig *tls.Config, salt
 
 		// Read HMAC secret
 		hmacPath := filepath.Join(paths.CertDir("envoy-oidc-hmac"), "hmac-secret")
-		salt, err = os.ReadFile(hmacPath)
+		salt, err := os.ReadFile(hmacPath)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to get hmac secret: %w", err)
 		}
@@ -400,15 +401,15 @@ func (r *Runner) loadTLSConfig(ctx context.Context) (tlsConfig *tls.Config, salt
 		keyPath := filepath.Join(certDir, "tls.key")
 		caPath := filepath.Join(certDir, "ca.crt")
 
-		tlsConfig, err = crypto.LoadTLSConfig(certPath, keyPath, caPath)
+		tlsConfig, err := crypto.LoadTLSConfig(certPath, keyPath, caPath)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to create tls config: %w", err)
 		}
+		return tlsConfig, salt, nil
 
 	default:
 		return nil, nil, fmt.Errorf("no valid tls certificates")
 	}
-	return
 }
 
 func unstructuredToPolicyStatus(policyStatus map[string]any) gwapiv1.PolicyStatus {
@@ -684,7 +685,7 @@ func (r *Runner) deleteKeys(kc *KeyCache) {
 
 // hmac returns the HMAC secret generated by the CertGen job.
 // hmac will be used as a hash salt to generate unguessable downloading paths for Wasm modules.
-func hmac(ctx context.Context, namespace string) (hmac []byte, err error) {
+func hmac(ctx context.Context, namespace string) ([]byte, error) {
 	// Get the HMAC secret.
 	// HMAC secret is generated by the CertGen job and stored in a secret
 	cfg, err := ctrl.GetConfig()
@@ -707,5 +708,5 @@ func hmac(ctx context.Context, namespace string) (hmac []byte, err error) {
 		return nil, fmt.Errorf(
 			"HMAC secret not found in secret %s/%s", namespace, hmacSecretName)
 	}
-	return
+	return hmac, err
 }
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index 5f24eee3e..b090b6cc7 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -347,7 +347,7 @@ func (t *Translator) GetRelevantGateways(resources *resource.Resources) (
 			status.SetGatewayClassAccepted(resources.GatewayClass,
 				false, string(gwapiv1.GatewayClassReasonInvalidParameters),
 				fmt.Sprintf("%s: %v", status.MsgGatewayClassInvalidParams, err))
-			return
+			return acceptedGateways, failedGateways
 		}
 
 		// TODO: remove this nil check after we update all the testdata.
@@ -413,7 +413,7 @@ func (t *Translator) GetRelevantGateways(resources *resource.Resources) (
 		gCtx.ResetListeners(resources, envoyproxyMap)
 		acceptedGateways = append(acceptedGateways, gCtx)
 	}
-	return
+	return acceptedGateways, failedGateways
 }
 
 func validateEnvoyProxy(ep *egv1a1.EnvoyProxy) error {
diff --git a/internal/globalratelimit/runner/runner.go b/internal/globalratelimit/runner/runner.go
index 3cd4a33ea..e91efaca7 100644
--- a/internal/globalratelimit/runner/runner.go
+++ b/internal/globalratelimit/runner/runner.go
@@ -72,7 +72,7 @@ func New(cfg *Config) *Runner {
 }
 
 // Start starts the infrastructure runner
-func (r *Runner) Start(ctx context.Context) (err error) {
+func (r *Runner) Start(ctx context.Context) error {
 	r.Logger = r.Logger.WithName(r.Name()).WithValues("runner", r.Name())
 
 	// Set up the gRPC server and register the xDS handler.
@@ -101,7 +101,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	go r.translateFromSubscription(ctx, c)
 
 	r.Logger.Info("started")
-	return
+	return err
 }
 
 func (r *Runner) serveXdsConfigServer(ctx context.Context) {
@@ -211,7 +211,7 @@ func (r *Runner) addNewSnapshot(ctx context.Context, resource types.XdsResources
 	return nil
 }
 
-func (r *Runner) loadTLSConfig() (tlsConfig *tls.Config, err error) {
+func (r *Runner) loadTLSConfig() (*tls.Config, error) {
 	var certPath, keyPath, caPath string
 
 	switch {
@@ -240,9 +240,9 @@ func (r *Runner) loadTLSConfig() (tlsConfig *tls.Config, err error) {
 		return nil, fmt.Errorf("no valid tls certificates")
 	}
 
-	tlsConfig, err = crypto.LoadTLSConfig(certPath, keyPath, caPath)
+	tlsConfig, err := crypto.LoadTLSConfig(certPath, keyPath, caPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create tls config: %w", err)
 	}
-	return
+	return tlsConfig, err
 }
diff --git a/internal/infrastructure/runner/runner.go b/internal/infrastructure/runner/runner.go
index 07a9de815..7db6428c0 100644
--- a/internal/infrastructure/runner/runner.go
+++ b/internal/infrastructure/runner/runner.go
@@ -99,7 +99,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 		// Since leader election is disabled subscribe to infraIR to initialize the infrastructure and Close when the context is done.
 		go subscribeInitInfraAndCloseInfraIRMessage()
 	}
-	return
+	return err
 }
 
 func (r *Runner) updateProxyInfraFromSubscription(ctx context.Context, sub <-chan watchable.Snapshot[string, *ir.Infra]) {
diff --git a/internal/kubernetes/client.go b/internal/kubernetes/client.go
index 1d9796b9c..86d0f0393 100644
--- a/internal/kubernetes/client.go
+++ b/internal/kubernetes/client.go
@@ -188,5 +188,5 @@ func (c *client) PodExec(namespacedName types.NamespacedName, container, command
 
 	stdout = stdoutBuf.String()
 	stderr = stderrBuf.String()
-	return
+	return stdout, stderr, err
 }
diff --git a/internal/message/types.go b/internal/message/types.go
index 1c0336785..f2ad704c8 100644
--- a/internal/message/types.go
+++ b/internal/message/types.go
@@ -85,6 +85,7 @@ type GatewayAPIStatuses struct {
 }
 
 func (s *GatewayAPIStatuses) Close() {
+	s.GatewayClassStatuses.Close()
 	s.GatewayStatuses.Close()
 	s.HTTPRouteStatuses.Close()
 	s.GRPCRouteStatuses.Close()
@@ -116,6 +117,7 @@ type ExtensionStatuses struct {
 
 func (p *PolicyStatuses) Close() {
 	p.ClientTrafficPolicyStatuses.Close()
+	p.BackendTrafficPolicyStatuses.Close()
 	p.SecurityPolicyStatuses.Close()
 	p.EnvoyPatchPolicyStatuses.Close()
 	p.BackendTLSPolicyStatuses.Close()
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index fac9d8d8b..c57a6411e 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -1470,7 +1470,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 	if r.isGatewayClassMerged(managedGC.Name) {
 		mergedGateways = true
 		// processGatewayClassParamsRef has been called for this GatewayClass, its EnvoyProxy should exist in resourceTree
-		r.processServiceClusterForGatewayClass(resourceTree.EnvoyProxyForGatewayClass, managedGC, resourceMap)
+		r.processServiceClusterForGatewayClass(ctx, resourceTree.EnvoyProxyForGatewayClass, managedGC, resourceMap)
 	}
 
 	for i := range gatewayList.Items {
@@ -1576,7 +1576,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 			if ep == nil && resourceTree.EnvoyProxyForGatewayClass != nil {
 				ep = resourceTree.EnvoyProxyForGatewayClass
 			}
-			r.processServiceClusterForGateway(ep, gtw, resourceMap)
+			r.processServiceClusterForGateway(ctx, ep, gtw, resourceMap)
 		}
 
 		if !resourceMap.allAssociatedGateways.Has(gtwNamespacedName) {
@@ -1589,7 +1589,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 }
 
 // Called on a GatewayClass when merged gateways mode is enabled for it.
-func (r *gatewayAPIReconciler) processServiceClusterForGatewayClass(ep *egv1a1.EnvoyProxy, gatewayClass *gwapiv1.GatewayClass, resourceMap *resourceMappings) {
+func (r *gatewayAPIReconciler) processServiceClusterForGatewayClass(ctx context.Context, ep *egv1a1.EnvoyProxy, gatewayClass *gwapiv1.GatewayClass, resourceMap *resourceMappings) {
 	// Skip processing if topology injector is disabled
 	if r.envoyGateway != nil && r.envoyGateway.TopologyInjectorDisabled() {
 		return
@@ -1605,11 +1605,11 @@ func (r *gatewayAPIReconciler) processServiceClusterForGatewayClass(ep *egv1a1.E
 		}
 	}
 
-	r.insertProxyServiceIfExists(proxySvcName, proxySvcNamespace, resourceMap)
+	r.insertProxyServiceIfExists(ctx, proxySvcName, proxySvcNamespace, resourceMap)
 }
 
 // Called on a Gateway when merged gateways mode is not enabled for its parent GatewayClass.
-func (r *gatewayAPIReconciler) processServiceClusterForGateway(ep *egv1a1.EnvoyProxy, gateway *gwapiv1.Gateway, resourceMap *resourceMappings) {
+func (r *gatewayAPIReconciler) processServiceClusterForGateway(ctx context.Context, ep *egv1a1.EnvoyProxy, gateway *gwapiv1.Gateway, resourceMap *resourceMappings) {
 	// Skip processing if topology injector is disabled
 	if r.envoyGateway != nil && r.envoyGateway.TopologyInjectorDisabled() {
 		return
@@ -1630,17 +1630,17 @@ func (r *gatewayAPIReconciler) processServiceClusterForGateway(ep *egv1a1.EnvoyP
 		}
 	}
 
-	r.insertProxyServiceIfExists(proxySvcName, proxySvcNamespace, resourceMap)
+	r.insertProxyServiceIfExists(ctx, proxySvcName, proxySvcNamespace, resourceMap)
 }
 
-func (r *gatewayAPIReconciler) insertProxyServiceIfExists(name, namespace string, resourceMap *resourceMappings) {
+func (r *gatewayAPIReconciler) insertProxyServiceIfExists(ctx context.Context, name, namespace string, resourceMap *resourceMappings) {
 	svcNN := types.NamespacedName{Name: name, Namespace: namespace}
 	svc := new(corev1.Service)
-	err := r.client.Get(context.Background(), svcNN, svc)
+	err := r.client.Get(ctx, svcNN, svc)
 	// Only insert if service exists
 	if err != nil {
 		if !kerrors.IsNotFound(err) {
-			r.log.Error(err, "failed to get proxy service", "namespace", namespace, "name", name)
+			r.log.Info("failed to get proxy service", "namespace", namespace, "name", name, "error", err)
 		}
 		return
 	}
diff --git a/internal/provider/runner/runner.go b/internal/provider/runner/runner.go
index 128184197..7376b5276 100644
--- a/internal/provider/runner/runner.go
+++ b/internal/provider/runner/runner.go
@@ -87,17 +87,16 @@ func (r *Runner) createKubernetesProvider(ctx context.Context) (*kubernetes.Prov
 	return p, err
 }
 
-func (r *Runner) createCustomResourceProvider(ctx context.Context) (p provider.Provider, err error) {
+func (r *Runner) createCustomResourceProvider(ctx context.Context) (provider.Provider, error) {
 	switch r.EnvoyGateway.Provider.Custom.Resource.Type {
 	case egv1a1.ResourceProviderTypeFile:
-		p, err = file.New(ctx, &r.Server, r.ProviderResources)
+		p, err := file.New(ctx, &r.Server, r.ProviderResources)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create provider %s: %w", egv1a1.ProviderTypeCustom, err)
 		}
+		return p, err
 
 	default:
 		return nil, fmt.Errorf("unsupported resource provider type")
 	}
-
-	return
 }
diff --git a/internal/utils/path/path.go b/internal/utils/path/path.go
index 587024315..ed524740b 100644
--- a/internal/utils/path/path.go
+++ b/internal/utils/path/path.go
@@ -26,8 +26,8 @@ func ValidateOutputPath(outputPath string) (string, error) {
 }
 
 // ListDirsAndFiles return a list of directories and files from a list of paths recursively.
-func ListDirsAndFiles(paths []string) (dirs, files sets.Set[string]) {
-	dirs, files = sets.New[string](), sets.New[string]()
+func ListDirsAndFiles(paths []string) (sets.Set[string], sets.Set[string]) {
+	dirs, files := sets.New[string](), sets.New[string]()
 	// Separate paths by whether is a directory or not.
 	paths = sets.NewString(paths...).UnsortedList()
 	for _, path := range paths {
@@ -54,7 +54,7 @@ func ListDirsAndFiles(paths []string) (dirs, files sets.Set[string]) {
 	}
 	files.Delete(ignoreFiles...)
 
-	return
+	return dirs, files
 }
 
 // GetParentDirs returns all the parent directories of given files.
diff --git a/internal/wasm/imagefetcher.go b/internal/wasm/imagefetcher.go
index cb4e2e8af..797d7216f 100644
--- a/internal/wasm/imagefetcher.go
+++ b/internal/wasm/imagefetcher.go
@@ -96,11 +96,11 @@ func NewImageFetcher(ctx context.Context, opt ImageFetcherOption, logger logging
 // PrepareFetch is the entrypoint for fetching Wasm binary from Wasm Image Specification compatible images.
 // Wasm binary is not fetched immediately, but returned by `binaryFetcher` function, which is returned by PrepareFetch.
 // By this way, we can have another chance to check cache with `actualDigest` without downloading the OCI image.
-func (o *ImageFetcher) PrepareFetch(url string) (binaryFetcher func() ([]byte, error), actualDigest string, err error) {
+func (o *ImageFetcher) PrepareFetch(url string) (func() ([]byte, error), string, error) {
 	ref, err := name.ParseReference(url)
 	if err != nil {
 		err = fmt.Errorf("could not parse url in image reference: %w", err)
-		return
+		return nil, "", err
 	}
 	o.logger.Info("fetching image", "image", ref.Context().RepositoryStr(),
 		"registry", ref.Context().RegistryStr(), "tag", ref.Identifier())
@@ -118,20 +118,20 @@ func (o *ImageFetcher) PrepareFetch(url string) (binaryFetcher func() ([]byte, e
 
 	if err != nil {
 		err = fmt.Errorf("could not fetch manifest: %w", err)
-		return
+		return nil, "", err
 	}
 
 	// Fetch image.
 	img, err := desc.Image()
 	if err != nil {
 		err = fmt.Errorf("could not fetch image: %w", err)
-		return
+		return nil, "", err
 	}
 
 	// Check Manifest's digest if expManifestDigest is not empty.
 	d, _ := img.Digest()
-	actualDigest = d.Hex
-	binaryFetcher = func() ([]byte, error) {
+	actualDigest := d.Hex
+	binaryFetcher := func() ([]byte, error) {
 		manifest, err := img.Manifest()
 		if err != nil {
 			return nil, fmt.Errorf("could not retrieve manifest: %w", err)
@@ -168,7 +168,7 @@ func (o *ImageFetcher) PrepareFetch(url string) (binaryFetcher func() ([]byte, e
 			),
 		)
 	}
-	return
+	return binaryFetcher, actualDigest, err
 }
 
 // extractDockerImage extracts the Wasm binary from the
diff --git a/internal/xds/runner/runner.go b/internal/xds/runner/runner.go
index 7c3bc69c3..a875d9d73 100644
--- a/internal/xds/runner/runner.go
+++ b/internal/xds/runner/runner.go
@@ -144,7 +144,7 @@ func getRandomMaxConnectionAge() time.Duration {
 func (r *Runner) Close() error { return nil }
 
 // Start starts the xds-server runner
-func (r *Runner) Start(ctx context.Context) (err error) {
+func (r *Runner) Start(ctx context.Context) error {
 	r.Logger = r.Logger.WithName(r.Name()).WithValues("runner", r.Name())
 	r.cache = cache.NewSnapshotCache(true, r.Logger)
 
@@ -214,7 +214,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	sub := r.XdsIR.Subscribe(ctx)
 	go r.translateFromSubscription(sub)
 	r.Logger.Info("started")
-	return
+	return err
 }
 
 func (r *Runner) serveXdsServer(ctx context.Context) {
@@ -310,6 +310,24 @@ func (r *Runner) translateFromSubscription(sub <-chan watchable.Snapshot[string,
 					return
 				}
 
+				// Update snapshot cache
+				if err == nil {
+					if result.XdsResources != nil {
+						if r.cache == nil {
+							r.Logger.Error(err, "failed to init snapshot cache")
+							errChan <- err
+						} else {
+							// Update snapshot cache
+							if err := r.cache.GenerateNewSnapshot(key, result.XdsResources); err != nil {
+								r.Logger.Error(err, "failed to generate a snapshot")
+								errChan <- err
+							}
+						}
+					} else {
+						r.Logger.Error(err, "skipped publishing xds resources")
+					}
+				}
+
 				// Get all status keys from watchable and save them in the map statusesToDelete.
 				// Iterating through result.EnvoyPatchPolicyStatuses, any valid keys will be removed from statusesToDelete.
 				// Remaining keys will be deleted from watchable before we exit this function.
@@ -335,24 +353,6 @@ func (r *Runner) translateFromSubscription(sub <-chan watchable.Snapshot[string,
 				// Discard the EnvoyPatchPolicyStatuses to reduce memory footprint
 				result.EnvoyPatchPolicyStatuses = nil
 
-				// Update snapshot cache
-				if err == nil {
-					if result.XdsResources != nil {
-						if r.cache == nil {
-							r.Logger.Error(err, "failed to init snapshot cache")
-							errChan <- err
-						} else {
-							// Update snapshot cache
-							if err := r.cache.GenerateNewSnapshot(key, result.XdsResources); err != nil {
-								r.Logger.Error(err, "failed to generate a snapshot")
-								errChan <- err
-							}
-						}
-					} else {
-						r.Logger.Error(err, "skipped publishing xds resources")
-					}
-				}
-
 				// Delete all the deletable status keys
 				for key := range statusesToDelete {
 					r.ProviderResources.EnvoyPatchPolicyStatuses.Delete(key)
@@ -363,7 +363,7 @@ func (r *Runner) translateFromSubscription(sub <-chan watchable.Snapshot[string,
 	r.Logger.Info("subscriber shutting down")
 }
 
-func (r *Runner) loadTLSConfig() (tlsConfig *tls.Config, err error) {
+func (r *Runner) loadTLSConfig() (*tls.Config, error) {
 	var certPath, keyPath, caPath string
 
 	// Use test-configurable paths if provided
@@ -400,9 +400,9 @@ func (r *Runner) loadTLSConfig() (tlsConfig *tls.Config, err error) {
 		}
 	}
 
-	tlsConfig, err = crypto.LoadTLSConfig(certPath, keyPath, caPath)
+	tlsConfig, err := crypto.LoadTLSConfig(certPath, keyPath, caPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create tls config: %w", err)
 	}
-	return
+	return tlsConfig, err
 }
diff --git a/internal/xds/translator/ratelimit.go b/internal/xds/translator/ratelimit.go
index 54257c48e..907e67dc8 100644
--- a/internal/xds/translator/ratelimit.go
+++ b/internal/xds/translator/ratelimit.go
@@ -298,7 +298,7 @@ func buildRouteRateLimits(route *ir.HTTPRoute) (rateLimits []*routev3.RateLimit,
 			}
 		}
 	}
-	return
+	return rateLimits, costSpecified
 }
 
 func buildHeaderMatchRateLimitActions(
diff --git a/tools/go.mod b/tools/go.mod
index f4f20d806..914d83847 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -342,7 +342,7 @@ require (
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	mvdan.cc/gofumpt v0.8.0 // indirect
+	mvdan.cc/gofumpt v0.9.1 // indirect
 	mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 // indirect
 	pluginrpc.com/pluginrpc v0.5.0 // indirect
 	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20250819114936-e4f9a2446c3d // indirect
diff --git a/tools/go.sum b/tools/go.sum
index d2d578067..c874f785f 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -895,6 +895,8 @@ k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 mvdan.cc/gofumpt v0.8.0 h1:nZUCeC2ViFaerTcYKstMmfysj6uhQrA2vJe+2vwGU6k=
 mvdan.cc/gofumpt v0.8.0/go.mod h1:vEYnSzyGPmjvFkqJWtXkh79UwPWP9/HMxQdGEXZHjpg=
+mvdan.cc/gofumpt v0.9.1 h1:p5YT2NfFWsYyTieYgwcQ8aKV3xRvFH4uuN/zB2gBbMQ=
+mvdan.cc/gofumpt v0.9.1/go.mod h1:3xYtNemnKiXaTh6R4VtlqDATFwBbdXI8lJvH/4qk7mw=
 mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 h1:WjUu4yQoT5BHT1w8Zu56SP8367OuBV5jvo+4Ulppyf8=
 mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4/go.mod h1:rthT7OuvRbaGcd5ginj6dA2oLE7YNlta9qhBNNdCaLE=
 pluginrpc.com/pluginrpc v0.5.0 h1:tOQj2D35hOmvHyPu8e7ohW2/QvAnEtKscy2IJYWQ2yo=



Test patch:
diff --git a/internal/gatewayapi/status/gateway_test.go b/internal/gatewayapi/status/gateway_test.go
index fb6fa0faa..b8d39da0d 100644
--- a/internal/gatewayapi/status/gateway_test.go
+++ b/internal/gatewayapi/status/gateway_test.go
@@ -171,7 +171,7 @@ func TestUpdateGatewayStatusProgrammedCondition(t *testing.T) {
 					for i := 0; i < 20; i++ {
 						addr.IPv4 = append(addr.IPv4, strconv.Itoa(i))
 					}
-					return
+					return addr
 				}(),
 				svc: &corev1.Service{
 					TypeMeta:   metav1.TypeMeta{},
@@ -192,7 +192,7 @@ func TestUpdateGatewayStatusProgrammedCondition(t *testing.T) {
 						Value: strconv.Itoa(i),
 					})
 				}
-				return
+				return addr
 			}(),
 		},
 		{
diff --git a/internal/provider/kubernetes/controller_test.go b/internal/provider/kubernetes/controller_test.go
index c3d29519b..8db0fa81e 100644
--- a/internal/provider/kubernetes/controller_test.go
+++ b/internal/provider/kubernetes/controller_test.go
@@ -1335,7 +1335,7 @@ func TestProcessServiceClusterForGatewayClass(t *testing.T) {
 				Build()
 			r.namespace = "envoy-gateway-system"
 
-			r.processServiceClusterForGatewayClass(tc.envoyProxy, tc.gatewayClass, resourceMap)
+			r.processServiceClusterForGatewayClass(context.Background(), tc.envoyProxy, tc.gatewayClass, resourceMap)
 
 			expectedRef := gwapiv1.BackendObjectReference{
 				Kind:      ptr.To(gwapiv1.Kind(resource.KindService)),
@@ -1517,7 +1517,7 @@ func TestProcessServiceClusterForGateway(t *testing.T) {
 				tc.envoyProxy = tc.gatewayClassEnvoyProxy
 			}
 
-			r.processServiceClusterForGateway(tc.envoyProxy, tc.gateway, resourceMap)
+			r.processServiceClusterForGateway(context.Background(), tc.envoyProxy, tc.gateway, resourceMap)
 
 			expectedRef := gwapiv1.BackendObjectReference{
 				Kind:      ptr.To(gwapiv1.Kind(resource.KindService)),
diff --git a/internal/wasm/cache_test.go b/internal/wasm/cache_test.go
index 5815d16d0..fb9ca6288 100644
--- a/internal/wasm/cache_test.go
+++ b/internal/wasm/cache_test.go
@@ -803,7 +803,7 @@ func TestWasmCache(t *testing.T) {
 	}
 }
 
-func setupOCIRegistry(t *testing.T, host string) (dockerImageDigest, invalidOCIImageDigest string) {
+func setupOCIRegistry(t *testing.T, host string) (string, string) {
 	// Push *compat* variant docker image (others are well tested in imagefetcher's test and the behavior is consistent).
 	ref := fmt.Sprintf("%s/test/valid/docker:v0.1.0", host)
 	binary := wasmHeader
@@ -845,7 +845,7 @@ func setupOCIRegistry(t *testing.T, host string) (dockerImageDigest, invalidOCII
 
 	// Calculate sum
 	d, _ := img.Digest()
-	dockerImageDigest = d.Hex
+	dockerImageDigest := d.Hex
 
 	// Finally push the invalid image.
 	ref = fmt.Sprintf("%s/test/invalid", host)
@@ -862,14 +862,14 @@ func setupOCIRegistry(t *testing.T, host string) (dockerImageDigest, invalidOCII
 	img2 = mutate.MediaType(img2, types.OCIManifestSchema1)
 
 	d, _ = img2.Digest()
-	invalidOCIImageDigest = d.Hex
+	invalidOCIImageDigest := d.Hex
 
 	// Push image to the registry.
 	err = crane.Push(img2, ref, fetchOpt)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return
+	return dockerImageDigest, invalidOCIImageDigest
 }
 
 func TestWasmCachePolicyChangesUsingHTTP(t *testing.T) {
diff --git a/test/benchmark/tests/scale_httproutes.go b/test/benchmark/tests/scale_httproutes.go
index 93d3a279a..5c8949178 100644
--- a/test/benchmark/tests/scale_httproutes.go
+++ b/test/benchmark/tests/scale_httproutes.go
@@ -154,7 +154,7 @@ var ScaleHTTPRoutes = suite.BenchmarkTest{
 			}
 		})
 
-		return
+		return reports
 	},
 }