Tooling

The build, lint, codegen, and CI tooling that turns 12,000 Go files into a working release.

Make + hack

The root Makefile is a symlink to build/root/Makefile. The major targets:

Target	What it does
make / make all	Build every binary in cmd/ to _output/bin/
make WHAT=cmd/kubectl	Build a single binary
make test	Run the unit suite via hack/test-go.sh
make test-integration	Run integration tests under test/integration/
make verify	Run everything in hack/verify-*.sh
make update	Run everything in hack/update-*.sh (codegen, vendor, generated docs, etc.)
make quick-release	Cross-compile every supported platform inside Docker
make release-images	Build the container images
make clean	Remove _output/

Most of the work happens in hack/. The naming convention is:

• hack/verify-X.sh — read-only check, returns non-zero if X is wrong (used in CI gating)
• hack/update-X.sh — regenerate / fix X
• hack/local-up-cluster.sh — bring up an all-in-one cluster
• hack/lib/ — shared shell helpers
• hack/make-rules/ — make-rule shims

Codegen

The Kubernetes API surface is reflected into many generated artifacts. The generators live in staging/src/k8s.io/code-generator/cmd/:

Generator	Output
deepcopy-gen	zz_generated_deepcopy.go
defaulter-gen	zz_generated_defaults.go
conversion-gen	zz_generated_conversion.go
client-gen	typed clientsets in staging/src/k8s.io/client-go/kubernetes/
informer-gen	shared informer factories
lister-gen	typed listers
openapi-gen	OpenAPI Definitions for every API type
applyconfiguration-gen	apply-configuration types for server-side apply
prerelease-lifecycle-gen	introduced-deprecated-removed metadata

The umbrella runner is hack/update-codegen.sh. After changing any types.go in pkg/apis/ or staging/src/k8s.io/api/, run it.

Linters

• golangci-lint is the umbrella linter. Config lives in hack/golangci.yaml and hack/golangci-hints.yaml. Run via hack/verify-golangci-lint.sh.
• gofmt + goimports are enforced by hack/verify-gofmt.sh and hack/verify-imports.sh.
• boilerplate (Apache 2.0 license headers) is enforced by hack/verify-boilerplate.sh.
• module-graph checks that staging modules don't import each other in cycles. hack/module-graph.sh.
• api-rules verifies API-conventions compliance. hack/verify-api-conventions.sh, with rule files under api/api-rules/.
• kube-api-linter is a custom linter that enforces Kubernetes-specific API style. Plugin lives in hack/kube-api-linter/.

Vendor

Dependencies are vendored under vendor/ and committed. The flow is:

hack/pin-dependency.sh github.com/foo/bar v1.2.3   # bump pin in go.mod
hack/update-vendor.sh                               # refresh vendor/ from go.mod

hack/lint-dependencies.sh checks the dependency list against hack/unwanted-dependencies.json (a deny-list of packages the project chooses not to depend on).

OWNERS

Every directory may have an OWNERS file with the schema:

approvers:
  - alice
  - bob
reviewers:
  - charlie
labels:
  - sig/scheduling

The OWNERS_ALIASES file at the repo root defines named groups (e.g. sig-scheduling-approvers).

The Prow bot uses these to assign reviewers and to decide whether a PR has the right /lgtm and /approve to merge.

CI

The CI is operated by the Kubernetes test-infra org (kubernetes/test-infra). The Prow bot drives:

• Pre-submit jobs — unit, integration, e2e against kind, lint, verify, etc. Defined in kubernetes/test-infra/config/jobs/kubernetes/.
• Post-submit jobs — release-cutting, image publishing, version sync.
• Periodic jobs — full e2e, scalability, conformance, upgrade tests.
• Tide — the merge bot. It rebases and merges PRs whose labels match the merge rules.

The .github/ directory in this repo only contains GitHub workflow definitions for stale-issue management; the actual CI lives elsewhere.

Release tooling

Release scripts live under build/. The flow is roughly:

1. build/release.sh produces a tarball, container images, and signed manifests.
2. build/release-images.sh pushes images to registry.k8s.io.
3. kubernetes/sig-release repo's release-manager scripts cut tags, push to kubernetes/<staging-module> mirrors, and publish to GitHub Releases.

The staging/publishing/ directory carries the configuration that maps staging/src/k8s.io/<module>/ to its public mirror repo (e.g. kubernetes/api, kubernetes/client-go).