diff --git a/channels/pkg/cmd/apply_channel.go b/channels/pkg/cmd/apply_channel.go
index 65174b737cafa..eab77718a0ec8 100644
--- a/channels/pkg/cmd/apply_channel.go
+++ b/channels/pkg/cmd/apply_channel.go
@@ -24,7 +24,6 @@ import (
 	"os"
 
 	"github.com/blang/semver/v4"
-	"github.com/cert-manager/cert-manager/pkg/client/clientset/versioned"
 	certmanager "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned"
 	"github.com/spf13/cobra"
 	"go.uber.org/multierr"
@@ -120,7 +119,7 @@ func RunApplyChannel(ctx context.Context, f *ChannelsFactory, out io.Writer, opt
 	return applyMenu(ctx, menu, f.VFSContext(), k8sClient, cmClient, dynamicClient, restMapper, options.Yes)
 }
 
-func applyMenu(ctx context.Context, menu *channels.AddonMenu, vfsContext *vfs.VFSContext, k8sClient kubernetes.Interface, cmClient versioned.Interface, dynamicClient dynamic.Interface, restMapper *restmapper.DeferredDiscoveryRESTMapper, apply bool) error {
+func applyMenu(ctx context.Context, menu *channels.AddonMenu, vfsContext *vfs.VFSContext, k8sClient kubernetes.Interface, cmClient certmanager.Interface, dynamicClient dynamic.Interface, restMapper *restmapper.DeferredDiscoveryRESTMapper, apply bool) error {
 	// channelVersions is the list of installed addons in the cluster.
 	// It is keyed by <namespace>:<addon name>.
 	channelVersions, err := getChannelVersions(ctx, k8sClient)
@@ -198,7 +197,7 @@ func applyMenu(ctx context.Context, menu *channels.AddonMenu, vfsContext *vfs.VF
 	return merr
 }
 
-func getUpdates(ctx context.Context, menu *channels.AddonMenu, k8sClient kubernetes.Interface, cmClient versioned.Interface, channelVersions map[string]*channels.ChannelVersion) ([]*channels.AddonUpdate, []*channels.Addon, error) {
+func getUpdates(ctx context.Context, menu *channels.AddonMenu, k8sClient kubernetes.Interface, cmClient certmanager.Interface, channelVersions map[string]*channels.ChannelVersion) ([]*channels.AddonUpdate, []*channels.Addon, error) {
 	var updates []*channels.AddonUpdate
 	var needUpdates []*channels.Addon
 	for _, addon := range menu.Addons {
diff --git a/cloudmock/openstack/mocknetworking/routers.go b/cloudmock/openstack/mocknetworking/routers.go
index 399d93da7dac9..1e86dd36810fe 100644
--- a/cloudmock/openstack/mocknetworking/routers.go
+++ b/cloudmock/openstack/mocknetworking/routers.go
@@ -181,7 +181,8 @@ func (m *MockClient) routerInterface(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		panic("error decoding create router interface request")
 	}
-	if parts[2] == "add_router_interface" {
+	switch parts[2] {
+	case "add_router_interface":
 		subnet := m.subnets[createInterface.SubnetID]
 		interfaces := m.routerInterfaces[routerID]
 		interfaces = append(interfaces, routers.InterfaceInfo{
@@ -201,7 +202,7 @@ func (m *MockClient) routerInterface(w http.ResponseWriter, r *http.Request) {
 			},
 		}
 		m.ports[port.ID] = port
-	} else if parts[2] == "remove_router_interface" {
+	case "remove_router_interface":
 		interfaces := make([]routers.InterfaceInfo, 0)
 		for _, i := range m.routerInterfaces[routerID] {
 			if i.SubnetID != createInterface.SubnetID {
@@ -209,7 +210,7 @@ func (m *MockClient) routerInterface(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 		m.routerInterfaces[routerID] = interfaces
-	} else {
+	default:
 		w.WriteHeader(http.StatusBadRequest)
 		return
 	}
diff --git a/cloudmock/scaleway/mockdns/api.go b/cloudmock/scaleway/mockdns/api.go
index 806be1144e61b..46d7b197b57c5 100644
--- a/cloudmock/scaleway/mockdns/api.go
+++ b/cloudmock/scaleway/mockdns/api.go
@@ -107,7 +107,7 @@ func (f *FakeDomainAPI) UpdateDNSZoneRecords(req *domain.UpdateDNSZoneRecordsReq
 					break
 				}
 			}
-			if found == false {
+			if !found {
 				return nil, fmt.Errorf("could not find record %s to delete", *change.Delete.ID)
 			}
 
diff --git a/cmd/kops-controller/pkg/server/server.go b/cmd/kops-controller/pkg/server/server.go
index 8f85e4efa7b26..f1609741bb021 100644
--- a/cmd/kops-controller/pkg/server/server.go
+++ b/cmd/kops-controller/pkg/server/server.go
@@ -161,7 +161,7 @@ func (s *Server) bootstrap(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		klog.Infof("bootstrap %s read err: %v", r.RemoteAddr, err)
 		w.WriteHeader(http.StatusBadRequest)
-		_, _ = w.Write([]byte(fmt.Sprintf("bootstrap %s failed to read body: %v", r.RemoteAddr, err)))
+		_, _ = fmt.Fprintf(w, "bootstrap %s failed to read body: %v", r.RemoteAddr, err)
 		return
 	}
 
@@ -208,7 +208,7 @@ func (s *Server) bootstrap(w http.ResponseWriter, r *http.Request) {
 	if err := json.Unmarshal(body, req); err != nil {
 		klog.Infof("bootstrap %s decode err: %v", r.RemoteAddr, err)
 		w.WriteHeader(http.StatusBadRequest)
-		_, _ = w.Write([]byte(fmt.Sprintf("failed to decode: %v", err)))
+		_, _ = fmt.Fprintf(w, "failed to decode: %v", err)
 		return
 	}
 
@@ -264,7 +264,7 @@ func (s *Server) bootstrap(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			klog.Infof("bootstrap %s cert %q issue err: %v", r.RemoteAddr, name, err)
 			w.WriteHeader(http.StatusBadRequest)
-			_, _ = w.Write([]byte(fmt.Sprintf("failed to issue %q: %v", name, err)))
+			_, _ = fmt.Fprintf(w, "failed to issue %q: %v", name, err)
 			return
 		}
 		resp.Certs[name] = cert
diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go
index 22ead7143ae4f..aff448a7f9b15 100644
--- a/cmd/kops/create_cluster.go
+++ b/cmd/kops/create_cluster.go
@@ -858,7 +858,7 @@ func parseCloudLabels(s string) (map[string]string, error) {
 	// Replace commas with newlines to allow a single pass with csv.Reader.
 	// We can't use csv.Reader for the initial split because it would see each key=value record as a single field
 	// and significantly complicates using quoted fields as keys or values.
-	records := strings.Replace(s, ",", "\n", -1)
+	records := strings.ReplaceAll(s, ",", "\n")
 
 	// Let the CSV library do the heavy-lifting in handling nested ='s
 	r := csv.NewReader(strings.NewReader(records))
diff --git a/cmd/kops/integration_test.go b/cmd/kops/integration_test.go
index 4c8d281d9c159..c4dbd2b6aa102 100644
--- a/cmd/kops/integration_test.go
+++ b/cmd/kops/integration_test.go
@@ -1605,7 +1605,7 @@ func (i *integrationTest) runTestTerraformAWS(t *testing.T) {
 			"aws_cloudwatch_event_rule_" + awsup.GetClusterName40(i.clusterName) + "-SpotInterruption_event_pattern",
 			"aws_cloudwatch_event_rule_" + awsup.GetClusterName40(i.clusterName) + "-InstanceStateChange_event_pattern",
 			"aws_cloudwatch_event_rule_" + awsup.GetClusterName40(i.clusterName) + "-InstanceScheduledChange_event_pattern",
-			"aws_sqs_queue_" + strings.Replace(i.clusterName, ".", "-", -1) + "-nth_policy",
+			"aws_sqs_queue_" + strings.ReplaceAll(i.clusterName, ".", "-") + "-nth_policy",
 		}...)
 	}
 	if i.nthRebalance {
@@ -1633,7 +1633,8 @@ func (i *integrationTest) runTestPhase(t *testing.T, phase cloudup.Phase) {
 
 	expectedFilenames := i.expectTerraformFilenames
 
-	if phase == cloudup.PhaseSecurity {
+	switch phase {
+	case cloudup.PhaseSecurity:
 		expectedFilenames = []string{
 			"aws_iam_role_masters." + i.clusterName + "_policy",
 			"aws_iam_role_nodes." + i.clusterName + "_policy",
@@ -1648,7 +1649,7 @@ func (i *integrationTest) runTestPhase(t *testing.T, phase cloudup.Phase) {
 				"aws_launch_template_bastion." + i.clusterName + "_user_data",
 			}...)
 		}
-	} else if phase == cloudup.PhaseCluster {
+	case cloudup.PhaseCluster:
 		expectedFilenames = []string{
 			"aws_launch_template_nodes." + i.clusterName + "_user_data",
 		}
diff --git a/cmd/kops/lifecycle_integration_test.go b/cmd/kops/lifecycle_integration_test.go
index 4198241c38d93..3242f44d79671 100644
--- a/cmd/kops/lifecycle_integration_test.go
+++ b/cmd/kops/lifecycle_integration_test.go
@@ -56,7 +56,7 @@ func (o *LifecycleTestOptions) AddDefaults() {
 		o.Version = "v1alpha2"
 	}
 	if o.ClusterName == "" {
-		o.ClusterName = strings.Replace(o.SrcDir, "_", "", -1) + ".example.com"
+		o.ClusterName = strings.ReplaceAll(o.SrcDir, "_", "") + ".example.com"
 	}
 
 	o.SrcDir = "../../tests/integration/update_cluster/" + o.SrcDir
diff --git a/cmd/kops/toolbox_instance-selector.go b/cmd/kops/toolbox_instance-selector.go
index d941af8cba809..601d0f94e25e5 100644
--- a/cmd/kops/toolbox_instance-selector.go
+++ b/cmd/kops/toolbox_instance-selector.go
@@ -520,7 +520,8 @@ func decorateWithMixedInstancesPolicy(instanceGroup *kops.InstanceGroup, usageCl
 	ig := instanceGroup
 	ig.Spec.MachineType = instanceSelections[0]
 
-	if usageClass == ec2types.UsageClassTypeSpot {
+	switch usageClass {
+	case ec2types.UsageClassTypeSpot:
 		ondemandBase := int64(0)
 		ondemandAboveBase := int64(0)
 		spotAllocationStrategy := "capacity-optimized"
@@ -530,11 +531,11 @@ func decorateWithMixedInstancesPolicy(instanceGroup *kops.InstanceGroup, usageCl
 			OnDemandAboveBase:      &ondemandAboveBase,
 			SpotAllocationStrategy: &spotAllocationStrategy,
 		}
-	} else if usageClass == ec2types.UsageClassTypeOnDemand {
+	case ec2types.UsageClassTypeOnDemand:
 		ig.Spec.MixedInstancesPolicy = &kops.MixedInstancesPolicySpec{
 			Instances: instanceSelections,
 		}
-	} else {
+	default:
 		return nil, fmt.Errorf("error node usage class not supported")
 	}
 
diff --git a/cmd/kops/validate_cluster.go b/cmd/kops/validate_cluster.go
index cc3e601e99bf8..0bbbebc085667 100644
--- a/cmd/kops/validate_cluster.go
+++ b/cmd/kops/validate_cluster.go
@@ -36,7 +36,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/klog/v2"
 	"k8s.io/kops/cmd/kops/util"
-	"k8s.io/kops/pkg/apis/kops"
 	kopsapi "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/validation"
 	"k8s.io/kops/util/pkg/tables"
@@ -63,7 +62,7 @@ var (
 
 type ValidateClusterOptions struct {
 	ClusterName        string
-	InstanceGroupRoles []kops.InstanceGroupRole
+	InstanceGroupRoles []kopsapi.InstanceGroupRole
 	output             string
 	wait               time.Duration
 	count              int
@@ -71,7 +70,7 @@ type ValidateClusterOptions struct {
 	kubeconfig         string
 
 	// filterInstanceGroups is a function that returns true if the instance group should be validated
-	filterInstanceGroups func(ig *kops.InstanceGroup) bool
+	filterInstanceGroups func(ig *kopsapi.InstanceGroup) bool
 
 	// filterPodsForValidation is a function that returns true if the pod should be validated
 	filterPodsForValidation func(pod *v1.Pod) bool
diff --git a/dns-controller/pkg/watchers/node.go b/dns-controller/pkg/watchers/node.go
index 6defca1717ab3..b48cfcfd5a1da 100644
--- a/dns-controller/pkg/watchers/node.go
+++ b/dns-controller/pkg/watchers/node.go
@@ -201,9 +201,10 @@ func (c *NodeController) updateNodeRecords(node *v1.Node) string {
 
 		for _, a := range node.Status.Addresses {
 			var roleType string
-			if a.Type == v1.NodeInternalIP {
+			switch a.Type {
+			case v1.NodeInternalIP:
 				roleType = dns.RoleTypeInternal
-			} else if a.Type == v1.NodeExternalIP {
+			case v1.NodeExternalIP:
 				roleType = dns.RoleTypeExternal
 			}
 			var recordType dns.RecordType = dns.RecordTypeA
diff --git a/dns-controller/pkg/watchers/service.go b/dns-controller/pkg/watchers/service.go
index af73973d84480..48c5c1a687cd1 100644
--- a/dns-controller/pkg/watchers/service.go
+++ b/dns-controller/pkg/watchers/service.go
@@ -152,7 +152,8 @@ func (c *ServiceController) updateServiceRecords(service *v1.Service) string {
 	if len(specExternal) != 0 || len(specInternal) != 0 {
 		var ingresses []dns.Record
 
-		if service.Spec.Type == v1.ServiceTypeLoadBalancer {
+		switch service.Spec.Type {
+		case v1.ServiceTypeLoadBalancer:
 			for i := range service.Status.LoadBalancer.Ingress {
 				ingress := &service.Status.LoadBalancer.Ingress[i]
 				if ingress.Hostname != "" {
@@ -175,7 +176,7 @@ func (c *ServiceController) updateServiceRecords(service *v1.Service) string {
 					klog.V(4).Infof("Found A record for service %s/%s: %q", service.Namespace, service.Name, ingress.IP)
 				}
 			}
-		} else if service.Spec.Type == v1.ServiceTypeNodePort {
+		case v1.ServiceTypeNodePort:
 			var roleType string
 			if len(specExternal) != 0 && len(specInternal) != 0 {
 				klog.Warningln("DNS Records not possible for both Internal and Externals IPs.")
@@ -190,7 +191,7 @@ func (c *ServiceController) updateServiceRecords(service *v1.Service) string {
 				Value:      dns.AliasForNodesInRole("node", roleType),
 			})
 			klog.V(4).Infof("Setting internal alias for NodePort service %s/%s", service.Namespace, service.Name)
-		} else {
+		default:
 			// TODO: Emit event so that users are informed of this
 			klog.V(2).Infof("Cannot expose service %s/%s of type %q", service.Namespace, service.Name, service.Spec.Type)
 		}
diff --git a/dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/managed_zones_service.go b/dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/managed_zones_service.go
index a21daa2702879..156f304d3f6ed 100644
--- a/dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/managed_zones_service.go
+++ b/dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/managed_zones_service.go
@@ -46,6 +46,6 @@ func (m *ManagedZonesService) List(project string) interfaces.ManagedZonesListCa
 }
 
 func (m *ManagedZonesService) NewManagedZone(dnsName string) interfaces.ManagedZone {
-	name := "x" + strings.Replace(string(uuid.NewUUID()), "-", "", -1)[0:30] // Unique name, strip out the "-" chars to shorten it, start with a lower case alpha, and truncate to Cloud DNS 32 character limit
+	name := "x" + strings.ReplaceAll(string(uuid.NewUUID()), "-", "")[0:30] // Unique name, strip out the "-" chars to shorten it, start with a lower case alpha, and truncate to Cloud DNS 32 character limit
 	return &ManagedZone{impl: &dns.ManagedZone{Name: name, Description: "Kubernetes Federated Service", DnsName: dnsName}}
 }
diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go
index c3c99fb72bbf3..3e28c6db015a6 100644
--- a/nodeup/pkg/model/kube_apiserver.go
+++ b/nodeup/pkg/model/kube_apiserver.go
@@ -795,7 +795,7 @@ func (b *KubeAPIServerBuilder) buildPod(ctx context.Context, kubeAPIServer *kops
 	}
 
 	for _, path := range b.SSLHostPaths() {
-		name := strings.Replace(path, "/", "", -1)
+		name := strings.ReplaceAll(path, "/", "")
 		kubemanifest.AddHostPathMapping(pod, container, name, path)
 	}
 
diff --git a/nodeup/pkg/model/kube_controller_manager.go b/nodeup/pkg/model/kube_controller_manager.go
index 0726f12a9cd77..412932460dce9 100644
--- a/nodeup/pkg/model/kube_controller_manager.go
+++ b/nodeup/pkg/model/kube_controller_manager.go
@@ -261,7 +261,7 @@ func (b *KubeControllerManagerBuilder) buildPod(kcm *kops.KubeControllerManagerC
 		container.Args = append(container.Args, sortedStrings(flags)...)
 	}
 	for _, path := range b.SSLHostPaths() {
-		name := strings.Replace(path, "/", "", -1)
+		name := strings.ReplaceAll(path, "/", "")
 		kubemanifest.AddHostPathMapping(pod, container, name, path)
 	}
 
diff --git a/nodeup/pkg/model/kubelet_test.go b/nodeup/pkg/model/kubelet_test.go
index 4648790ea8264..73a64ab1f1a40 100644
--- a/nodeup/pkg/model/kubelet_test.go
+++ b/nodeup/pkg/model/kubelet_test.go
@@ -101,8 +101,8 @@ func TestTaintsApplied(t *testing.T) {
 }
 
 func stringSlicesEqual(exp, other []string) bool {
-	sort.Sort(sort.StringSlice(exp))
-	sort.Sort(sort.StringSlice(other))
+	sort.Strings(exp)
+	sort.Strings(other)
 	if exp == nil && other != nil {
 		return false
 	}
diff --git a/pkg/apis/kops/validation/validation.go b/pkg/apis/kops/validation/validation.go
index eb6ecc7154485..876126e849997 100644
--- a/pkg/apis/kops/validation/validation.go
+++ b/pkg/apis/kops/validation/validation.go
@@ -1629,13 +1629,14 @@ func validateCalicoAutoDetectionMethod(fldPath *field.Path, runtime string, vers
 	case "can-reach":
 		destStr := method[1]
 		ip := netutils.ParseIPSloppy(destStr)
-		if version == ipv4.Version {
+		switch version {
+		case ipv4.Version:
 			if ip == nil || ip.To4() == nil {
 				return field.ErrorList{field.Invalid(fldPath, runtime, "must be a valid IPv4 address")}
 			} else {
 				return nil
 			}
-		} else if version == ipv6.Version {
+		case ipv6.Version:
 			if ip == nil || ip.To4() != nil {
 				return field.ErrorList{field.Invalid(fldPath, runtime, "must be a valid IPv6 address")}
 			} else {
diff --git a/pkg/applylib/mocks/mockkubeapiserver/putresource.go b/pkg/applylib/mocks/mockkubeapiserver/putresource.go
index 5a0512f326fbd..8dd60174df1ce 100644
--- a/pkg/applylib/mocks/mockkubeapiserver/putresource.go
+++ b/pkg/applylib/mocks/mockkubeapiserver/putresource.go
@@ -62,9 +62,10 @@ func (req *putResource) Run(s *MockKubeAPIServer) error {
 
 	var updated *unstructured.Unstructured
 
-	if req.SubResource == "" {
+	switch req.SubResource {
+	case "":
 		updated = body
-	} else if req.SubResource == "status" {
+	case "status":
 		updated = existing.DeepCopyObject().(*unstructured.Unstructured)
 		newStatus := body.Object["status"]
 		if newStatus == nil {
@@ -72,7 +73,7 @@ func (req *putResource) Run(s *MockKubeAPIServer) error {
 			return fmt.Errorf("status not specified on status subresource update")
 		}
 		updated.Object["status"] = newStatus
-	} else {
+	default:
 		// TODO: We need to implement put properly
 		return fmt.Errorf("unknown subresource %q", req.SubResource)
 	}
diff --git a/pkg/assets/builder.go b/pkg/assets/builder.go
index 0fd11d1a6f785..ae7b9f465237c 100644
--- a/pkg/assets/builder.go
+++ b/pkg/assets/builder.go
@@ -374,7 +374,7 @@ func NormalizeImage(a *AssetBuilder, image string) string {
 		if !strings.HasPrefix(normalized, registryMirror+"/") {
 			// We can't nest arbitrarily
 			// Some risk of collisions, but also -- and __ in the names appear to be blocked by docker hub
-			normalized = strings.Replace(normalized, "/", "-", -1)
+			normalized = strings.ReplaceAll(normalized, "/", "-")
 			normalized = registryMirror + "/" + normalized
 		}
 		image = normalized
diff --git a/pkg/client/simple/api/clientset.go b/pkg/client/simple/api/clientset.go
index 9ea74d191c272..19330ee6e8b65 100644
--- a/pkg/client/simple/api/clientset.go
+++ b/pkg/client/simple/api/clientset.go
@@ -196,6 +196,6 @@ func restNamespaceForClusterName(clusterName string) string {
 	// We are not allowed dots, so we map them to dashes
 	// This can conflict, but this will simply be a limitation that we pass on to the user
 	// i.e. it will not be possible to create a.b.example.com and a-b.example.com
-	namespace := strings.Replace(clusterName, ".", "-", -1)
+	namespace := strings.ReplaceAll(clusterName, ".", "-")
 	return namespace
 }
diff --git a/pkg/commands/toolbox_enroll.go b/pkg/commands/toolbox_enroll.go
index 2189822bdb8ee..02a82571687c7 100644
--- a/pkg/commands/toolbox_enroll.go
+++ b/pkg/commands/toolbox_enroll.go
@@ -118,10 +118,7 @@ func RunToolboxEnroll(ctx context.Context, f commandutils.Factory, out io.Writer
 		return err
 	}
 
-	sudo := true
-	if options.SSHUser == "root" {
-		sudo = false
-	}
+	sudo := options.SSHUser != "root"
 
 	sshTarget, err := NewSSHHost(ctx, options.Host, options.SSHPort, options.SSHUser, sudo)
 	if err != nil {
diff --git a/pkg/model/awsmodel/api_loadbalancer.go b/pkg/model/awsmodel/api_loadbalancer.go
index 04ab4b94e9238..e59d12da1f48b 100644
--- a/pkg/model/awsmodel/api_loadbalancer.go
+++ b/pkg/model/awsmodel/api_loadbalancer.go
@@ -607,7 +607,7 @@ func (a ByScoreDescending) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
 func (a ByScoreDescending) Less(i, j int) bool {
 	if a[i].score != a[j].score {
 		// ! to sort highest score first
-		return !(a[i].score < a[j].score)
+		return a[i].score >= a[j].score
 	}
 	// Use name to break ties consistently
 	return a[i].subnet.Name < a[j].subnet.Name
diff --git a/pkg/model/awsmodel/autoscalinggroup.go b/pkg/model/awsmodel/autoscalinggroup.go
index 154343c38a8b7..c4114fea16644 100644
--- a/pkg/model/awsmodel/autoscalinggroup.go
+++ b/pkg/model/awsmodel/autoscalinggroup.go
@@ -311,11 +311,12 @@ func (b *AutoscalingGroupModelBuilder) buildLaunchTemplateTask(c *fi.CloudupMode
 		lt.HTTPTokens = fi.PtrTo(ec2types.LaunchTemplateHttpTokensStateOptional)
 	}
 
-	if rootVolumeType == ec2types.VolumeTypeIo1 || rootVolumeType == ec2types.VolumeTypeIo2 {
+	switch rootVolumeType {
+	case ec2types.VolumeTypeIo1, ec2types.VolumeTypeIo2:
 		if ig.Spec.RootVolume == nil || fi.ValueOf(ig.Spec.RootVolume.IOPS) < 100 {
 			lt.RootVolumeIops = fi.PtrTo(int32(DefaultVolumeIonIops))
 		}
-	} else if rootVolumeType == ec2types.VolumeTypeGp3 {
+	case ec2types.VolumeTypeGp3:
 		if ig.Spec.RootVolume == nil || fi.ValueOf(ig.Spec.RootVolume.IOPS) < 3000 {
 			lt.RootVolumeIops = fi.PtrTo(int32(DefaultVolumeGp3Iops))
 		}
@@ -324,7 +325,7 @@ func (b *AutoscalingGroupModelBuilder) buildLaunchTemplateTask(c *fi.CloudupMode
 		} else {
 			lt.RootVolumeThroughput = fi.PtrTo(int32(fi.ValueOf(ig.Spec.RootVolume.Throughput)))
 		}
-	} else {
+	default:
 		lt.RootVolumeIops = nil
 	}
 
diff --git a/pkg/model/context.go b/pkg/model/context.go
index 0dd47fdbe4a30..90990d183a98f 100644
--- a/pkg/model/context.go
+++ b/pkg/model/context.go
@@ -265,7 +265,7 @@ func (b *KopsModelContext) CloudTags(name string, shared bool) map[string]string
 		}
 	case kops.CloudProviderScaleway:
 		for k, v := range b.Cluster.Spec.CloudLabels {
-			if k == scaleway.TagClusterName && shared == true {
+			if k == scaleway.TagClusterName && shared {
 				klog.V(4).Infof("Skipping %q tag for shared resource", scaleway.TagClusterName)
 				continue
 			}
diff --git a/pkg/model/domodel/network.go b/pkg/model/domodel/network.go
index 9384d32051b57..4b91c29eb8361 100644
--- a/pkg/model/domodel/network.go
+++ b/pkg/model/domodel/network.go
@@ -39,7 +39,7 @@ func (b *NetworkModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {
 		return nil
 	}
 
-	clusterName := strings.Replace(b.ClusterName(), ".", "-", -1)
+	clusterName := strings.ReplaceAll(b.ClusterName(), ".", "-")
 	vpcName := "vpc-" + clusterName
 
 	// Create a separate vpc for this cluster.
diff --git a/pkg/model/gcemodel/autoscalinggroup.go b/pkg/model/gcemodel/autoscalinggroup.go
index 20b8bd64e133f..1eeede68d1308 100644
--- a/pkg/model/gcemodel/autoscalinggroup.go
+++ b/pkg/model/gcemodel/autoscalinggroup.go
@@ -283,10 +283,7 @@ func (b *AutoscalingGroupModelBuilder) splitToZones(ig *kops.InstanceGroup) (map
 			totalSize += targetSizes[i]
 		}
 		i := 0
-		for {
-			if totalSize >= minSize {
-				break
-			}
+		for totalSize < minSize {
 			targetSizes[i]++
 			totalSize++
 
diff --git a/pkg/model/master_volumes.go b/pkg/model/master_volumes.go
index 7b60d1beeb0fc..587882c3ab2a1 100644
--- a/pkg/model/master_volumes.go
+++ b/pkg/model/master_volumes.go
@@ -287,7 +287,7 @@ func (b *MasterVolumeBuilder) addGCEVolume(c *fi.CloudupModelBuilderContext, pre
 	tags[gce.GceLabelNameEtcdClusterPrefix+etcd.Name] = gce.EncodeGCELabel(clusterSpec)
 
 	// GCE disk names must match the following regular expression: '[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?'
-	prefix = strings.Replace(prefix, ".", "-", -1)
+	prefix = strings.ReplaceAll(prefix, ".", "-")
 	if strings.IndexByte("0123456789-", prefix[0]) != -1 {
 		prefix = "d" + prefix
 	}
@@ -320,8 +320,6 @@ func (b *MasterVolumeBuilder) addHetznerVolume(c *fi.CloudupModelBuilderContext,
 		Labels:    tags,
 	}
 	c.AddTask(t)
-
-	return
 }
 
 func (b *MasterVolumeBuilder) addOpenstackVolume(c *fi.CloudupModelBuilderContext, name string, volumeSize int32, zone string, etcd kops.EtcdClusterSpec, m kops.EtcdMemberSpec, allMembers []string) error {
@@ -430,6 +428,4 @@ func (b *MasterVolumeBuilder) addScalewayVolume(c *fi.CloudupModelBuilderContext
 		Type:      fi.PtrTo(string(instance.VolumeVolumeTypeBSSD)),
 	}
 	c.AddTask(t)
-
-	return
 }
diff --git a/pkg/model/openstackmodel/firewall.go b/pkg/model/openstackmodel/firewall.go
index 5732425a666c8..246e9bc3bbc6b 100644
--- a/pkg/model/openstackmodel/firewall.go
+++ b/pkg/model/openstackmodel/firewall.go
@@ -706,10 +706,7 @@ func (b *FirewallModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {
 
 	sgMap := make(map[string]*openstacktasks.SecurityGroup)
 
-	useVIPACL := false
-	if b.UseLoadBalancerForAPI() && b.UseVIPACL() {
-		useVIPACL = true
-	}
+	useVIPACL := b.UseLoadBalancerForAPI() && b.UseVIPACL()
 	sg := &openstacktasks.SecurityGroup{
 		Name:             s(b.APIResourceName()),
 		Lifecycle:        b.Lifecycle,
@@ -729,11 +726,12 @@ func (b *FirewallModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {
 			Lifecycle:   b.Lifecycle,
 			RemoveGroup: false,
 		}
-		if role == kops.InstanceGroupRoleBastion {
+		switch role {
+		case kops.InstanceGroupRoleBastion:
 			sg.RemoveExtraRules = []string{"port=22"}
-		} else if role == kops.InstanceGroupRoleNode {
+		case kops.InstanceGroupRoleNode:
 			sg.RemoveExtraRules = []string{"port=22", "port=10250"}
-		} else if role == kops.InstanceGroupRoleControlPlane {
+		case kops.InstanceGroupRoleControlPlane:
 			sg.RemoveExtraRules = []string{"port=22", "port=443", "port=10250"}
 		}
 		c.AddTask(sg)
diff --git a/pkg/model/openstackmodel/network.go b/pkg/model/openstackmodel/network.go
index 29f8f05934462..6d397a9321d6c 100644
--- a/pkg/model/openstackmodel/network.go
+++ b/pkg/model/openstackmodel/network.go
@@ -53,12 +53,9 @@ func (b *NetworkModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {
 		c.AddTask(t)
 	}
 
-	needRouter := true
 	// Do not need router if there is no external network
-	if osSpec.Router == nil || osSpec.Router.ExternalNetwork == nil {
-		needRouter = false
-	}
-	routerName := strings.Replace(clusterName, ".", "-", -1)
+	needRouter := osSpec.Router != nil && osSpec.Router.ExternalNetwork != nil
+	routerName := strings.ReplaceAll(clusterName, ".", "-")
 	for _, sp := range b.Cluster.Spec.Networking.Subnets {
 		// assumes that we do not need to create routers if we use existing subnets
 		if sp.ID != "" {
diff --git a/pkg/model/openstackmodel/servergroup.go b/pkg/model/openstackmodel/servergroup.go
index 71df04841e6c5..488c10aae6c2e 100644
--- a/pkg/model/openstackmodel/servergroup.go
+++ b/pkg/model/openstackmodel/servergroup.go
@@ -88,7 +88,7 @@ func (b *ServerGroupModelBuilder) buildInstances(c *fi.CloudupModelBuilderContex
 		return err
 	}
 
-	sshKeyName := strings.Replace(sshKeyNameFull, ":", "_", -1)
+	sshKeyName := strings.ReplaceAll(sshKeyNameFull, ":", "_")
 
 	igMeta := make(map[string]string)
 	cloudTags, err := b.KopsModelContext.CloudTagsForInstanceGroup(ig)
@@ -145,8 +145,8 @@ func (b *ServerGroupModelBuilder) buildInstances(c *fi.CloudupModelBuilderContex
 	for i := int32(0); i < *ig.Spec.MinSize; i++ {
 		// FIXME: Must ensure 63 or less characters
 		// replace all dots and _ with -, this is needed to get external cloudprovider working
-		iName := strings.Replace(strings.ToLower(fmt.Sprintf("%s-%d.%s", ig.Name, i+1, b.ClusterName())), "_", "-", -1)
-		instanceName := fi.PtrTo(strings.Replace(iName, ".", "-", -1))
+		iName := strings.ReplaceAll(strings.ToLower(fmt.Sprintf("%s-%d.%s", ig.Name, i+1, b.ClusterName())), "_", "-")
+		instanceName := fi.PtrTo(strings.ReplaceAll(iName, ".", "-"))
 
 		var az *string
 		var subnets []*openstacktasks.Subnet
@@ -175,13 +175,13 @@ func (b *ServerGroupModelBuilder) buildInstances(c *fi.CloudupModelBuilderContex
 		}
 		// Create instance port task
 		portName := fmt.Sprintf("%s-%s", "port", *instanceName)
-		portTagKopsName := strings.Replace(
-			strings.Replace(
+		portTagKopsName := strings.ReplaceAll(
+			strings.ReplaceAll(
 				strings.ToLower(
 					fmt.Sprintf("port-%s-%d", ig.Name, i+1),
 				),
-				"_", "-", -1,
-			), ".", "-", -1,
+				"_", "-",
+			), ".", "-",
 		)
 		portTask := &openstacktasks.Port{
 			Name:              fi.PtrTo(portName),
diff --git a/pkg/model/resources/nodeup.go b/pkg/model/resources/nodeup.go
index df9aefe087c08..db98de43afc81 100644
--- a/pkg/model/resources/nodeup.go
+++ b/pkg/model/resources/nodeup.go
@@ -299,7 +299,7 @@ func AWSMultipartMIME(bootScript string, ig *kops.InstanceGroup) (string, error)
 			return "", err
 		}
 
-		writer.Write([]byte(fmt.Sprintf("Content-Type: multipart/mixed; boundary=\"%s\"\r\n", boundary)))
+		fmt.Fprintf(writer, "Content-Type: multipart/mixed; boundary=\"%s\"\r\n", boundary)
 		writer.Write([]byte("MIME-Version: 1.0\r\n\r\n"))
 
 		var err error
@@ -317,7 +317,7 @@ func AWSMultipartMIME(bootScript string, ig *kops.InstanceGroup) (string, error)
 			}
 		}
 
-		writer.Write([]byte(fmt.Sprintf("\r\n--%s--\r\n", boundary)))
+		fmt.Fprintf(writer, "\r\n--%s--\r\n", boundary)
 
 		writer.Flush()
 		mimeWriter.Close()
diff --git a/pkg/nodemodel/nodeupconfigbuilder.go b/pkg/nodemodel/nodeupconfigbuilder.go
index 13275c2206407..6c630f9af3db7 100644
--- a/pkg/nodemodel/nodeupconfigbuilder.go
+++ b/pkg/nodemodel/nodeupconfigbuilder.go
@@ -369,9 +369,7 @@ func (n *nodeUpConfigBuilder) BuildConfig(ig *kops.InstanceGroup, wellKnownAddre
 
 	case kops.CloudProviderDO, kops.CloudProviderScaleway, kops.CloudProviderAzure:
 		// Use any IP address that is found (including public ones)
-		for _, additionalIP := range wellKnownAddresses[wellknownservices.KubeAPIServer] {
-			controlPlaneIPs = append(controlPlaneIPs, additionalIP)
-		}
+		controlPlaneIPs = append(controlPlaneIPs, wellKnownAddresses[wellknownservices.KubeAPIServer]...)
 	}
 
 	if cluster.UsesNoneDNS() {
diff --git a/pkg/pki/privatekey.go b/pkg/pki/privatekey.go
index 492d8f1b84b9d..a3a094af88e4b 100644
--- a/pkg/pki/privatekey.go
+++ b/pkg/pki/privatekey.go
@@ -190,20 +190,21 @@ func parsePEMPrivateKey(pemData []byte) (crypto.Signer, error) {
 			return nil, fmt.Errorf("could not parse private key (unable to decode PEM)")
 		}
 
-		if block.Type == "RSA PRIVATE KEY" {
+		switch block.Type {
+		case "RSA PRIVATE KEY":
 			klog.V(10).Infof("Parsing pem block: %q", block.Type)
 			return x509.ParsePKCS1PrivateKey(block.Bytes)
-		} else if block.Type == "EC PRIVATE KEY" {
+		case "EC PRIVATE KEY":
 			klog.V(10).Infof("Parsing pem block: %q", block.Type)
 			return x509.ParseECPrivateKey(block.Bytes)
-		} else if block.Type == "PRIVATE KEY" {
+		case "PRIVATE KEY":
 			klog.V(10).Infof("Parsing pem block: %q", block.Type)
 			k, err := x509.ParsePKCS8PrivateKey(block.Bytes)
 			if err != nil {
 				return nil, err
 			}
 			return k.(crypto.Signer), nil
-		} else {
+		default:
 			klog.Infof("Ignoring unexpected PEM block: %q", block.Type)
 		}
 
diff --git a/pkg/pki/publickey.go b/pkg/pki/publickey.go
index 8e986ad479ac6..2154d129ace06 100644
--- a/pkg/pki/publickey.go
+++ b/pkg/pki/publickey.go
@@ -47,19 +47,20 @@ func parsePEMPublicKey(pemData []byte) (crypto.PublicKey, error) {
 			return nil, fmt.Errorf("could not parse private key")
 		}
 
-		if block.Type == "RSA PUBLIC KEY" {
+		switch block.Type {
+		case "RSA PUBLIC KEY":
 			k, err := x509.ParsePKCS1PublicKey(block.Bytes)
 			if err != nil {
 				return nil, err
 			}
 			return k, nil
-		} else if block.Type == "PUBLIC KEY" {
+		case "PUBLIC KEY":
 			k, err := x509.ParsePKIXPublicKey(block.Bytes)
 			if err != nil {
 				return nil, err
 			}
 			return k.(crypto.PublicKey), nil
-		} else {
+		default:
 			klog.Infof("Ignoring unexpected PEM block: %q", block.Type)
 		}
 
diff --git a/pkg/resources/digitalocean/resources.go b/pkg/resources/digitalocean/resources.go
index d9afb9463045e..e32319914313f 100644
--- a/pkg/resources/digitalocean/resources.go
+++ b/pkg/resources/digitalocean/resources.go
@@ -75,7 +75,7 @@ func listDroplets(cloud fi.Cloud, clusterName string) ([]*resources.Resource, er
 	c := cloud.(do.DOCloud)
 	var resourceTrackers []*resources.Resource
 
-	clusterTag := "KubernetesCluster:" + strings.Replace(clusterName, ".", "-", -1)
+	clusterTag := "KubernetesCluster:" + strings.ReplaceAll(clusterName, ".", "-")
 
 	droplets, err := c.GetAllDropletsByTag(clusterTag)
 	if err != nil {
@@ -102,7 +102,7 @@ func listVolumes(cloud fi.Cloud, clusterName string) ([]*resources.Resource, err
 	c := cloud.(do.DOCloud)
 	var resourceTrackers []*resources.Resource
 
-	volumeMatch := strings.Replace(clusterName, ".", "-", -1)
+	volumeMatch := strings.ReplaceAll(clusterName, ".", "-")
 
 	volumes, err := c.GetAllVolumesByRegion()
 	if err != nil {
@@ -220,7 +220,7 @@ func listLoadBalancers(cloud fi.Cloud, clusterName string) ([]*resources.Resourc
 	c := cloud.(do.DOCloud)
 	var resourceTrackers []*resources.Resource
 
-	clusterTag := "KubernetesCluster-Master:" + strings.Replace(clusterName, ".", "-", -1)
+	clusterTag := "KubernetesCluster-Master:" + strings.ReplaceAll(clusterName, ".", "-")
 
 	lbs, err := c.GetAllLoadBalancers()
 	if err != nil {
diff --git a/pkg/resources/openstack/lb.go b/pkg/resources/openstack/lb.go
index 7b47e8b5fbd68..ddefadbf64163 100644
--- a/pkg/resources/openstack/lb.go
+++ b/pkg/resources/openstack/lb.go
@@ -39,10 +39,7 @@ const (
 func (os *clusterDiscoveryOS) DeleteSubnetLBs(subnet subnets.Subnet) ([]*resources.Resource, error) {
 	var resourceTrackers []*resources.Resource
 
-	preExistingSubnet := false
-	if !strings.HasSuffix(subnet.Name, os.clusterName) {
-		preExistingSubnet = true
-	}
+	preExistingSubnet := !strings.HasSuffix(subnet.Name, os.clusterName)
 
 	opts := loadbalancers.ListOpts{
 		VipSubnetID: subnet.ID,
diff --git a/pkg/resources/openstack/network.go b/pkg/resources/openstack/network.go
index 7b5d74326cd29..732ce60fee5d6 100644
--- a/pkg/resources/openstack/network.go
+++ b/pkg/resources/openstack/network.go
@@ -39,7 +39,7 @@ const (
 
 func (os *clusterDiscoveryOS) ListNetwork() ([]*resources.Resource, error) {
 	var resourceTrackers []*resources.Resource
-	routerName := strings.Replace(os.clusterName, ".", "-", -1)
+	routerName := strings.ReplaceAll(os.clusterName, ".", "-")
 
 	projectNetworks, err := os.osCloud.ListNetworks(networks.ListOpts{})
 	if err != nil {
diff --git a/pkg/resources/openstack/ports.go b/pkg/resources/openstack/ports.go
index 19455bf7563f3..a50c6fb878369 100644
--- a/pkg/resources/openstack/ports.go
+++ b/pkg/resources/openstack/ports.go
@@ -39,10 +39,7 @@ func (os *clusterDiscoveryOS) ListPorts(network networks.Network) ([]*resources.
 		return nil, err
 	}
 
-	preExistingNet := true
-	if os.clusterName == network.Name {
-		preExistingNet = false
-	}
+	preExistingNet := os.clusterName != network.Name
 
 	filteredPorts := []ports.Port{}
 	if preExistingNet {
diff --git a/pkg/resources/openstack/sshkey.go b/pkg/resources/openstack/sshkey.go
index 0fb512b088cae..d500616fa2525 100644
--- a/pkg/resources/openstack/sshkey.go
+++ b/pkg/resources/openstack/sshkey.go
@@ -29,8 +29,8 @@ const (
 )
 
 func openstackKeyPairName(org string) string {
-	name := strings.Replace(org, ".", "-", -1)
-	name = strings.Replace(name, ":", "_", -1)
+	name := strings.ReplaceAll(org, ".", "-")
+	name = strings.ReplaceAll(name, ":", "_")
 	return name
 }
 
diff --git a/pkg/testutils/golden/compare.go b/pkg/testutils/golden/compare.go
index aa86406048763..896024249f5fc 100644
--- a/pkg/testutils/golden/compare.go
+++ b/pkg/testutils/golden/compare.go
@@ -53,8 +53,8 @@ func AssertMatchesFile(t *testing.T, actual string, p string) {
 	expected := strings.TrimSpace(string(expectedBytes))
 
 	// on windows, with git set to autocrlf, the reference files on disk have windows line endings
-	expected = strings.Replace(expected, "\r\n", "\n", -1)
-	actual = strings.Replace(actual, "\r\n", "\n", -1)
+	expected = strings.ReplaceAll(expected, "\r\n", "\n")
+	actual = strings.ReplaceAll(actual, "\r\n", "\n")
 
 	if actual == expected && err == nil {
 		return
diff --git a/protokube/pkg/gossip/dns/hosts/hosts.go b/protokube/pkg/gossip/dns/hosts/hosts.go
index 343fededb572d..fbeaa4dd2fc77 100644
--- a/protokube/pkg/gossip/dns/hosts/hosts.go
+++ b/protokube/pkg/gossip/dns/hosts/hosts.go
@@ -151,11 +151,7 @@ func UpdateHostsFileWithRecords(p string, mutator func(guarded []string) (*HostM
 	}
 
 	// Ensure a single blank line
-	for {
-		if len(out) == 0 {
-			break
-		}
-
+	for len(out) > 0 {
 		if out[len(out)-1] != "" {
 			break
 		}
diff --git a/protokube/pkg/gossip/do/seeds.go b/protokube/pkg/gossip/do/seeds.go
index c288aa78c3332..dd7c944176dbc 100644
--- a/protokube/pkg/gossip/do/seeds.go
+++ b/protokube/pkg/gossip/do/seeds.go
@@ -44,7 +44,7 @@ func (p *SeedProvider) GetSeeds() ([]string, error) {
 	for _, droplet := range droplets {
 		for _, dropTag := range droplet.Tags {
 			klog.V(4).Infof("Get Seeds - droplet found=%s,SeedProvider Tag=%s", dropTag, p.tag)
-			if strings.Contains(dropTag, strings.Replace(p.tag, ".", "-", -1)) {
+			if strings.Contains(dropTag, strings.ReplaceAll(p.tag, ".", "-")) {
 				klog.V(4).Infof("Tag matched for droplet tag =%s. Getting private IP", p.tag)
 				ip, err := droplet.PrivateIPv4()
 				if err == nil {
diff --git a/protokube/pkg/protokube/do_volume.go b/protokube/pkg/protokube/do_volume.go
index 9d2c32a1cf0af..48af95f193008 100644
--- a/protokube/pkg/protokube/do_volume.go
+++ b/protokube/pkg/protokube/do_volume.go
@@ -69,7 +69,7 @@ func GetClusterID() (string, error) {
 
 	for _, dropletTag := range dropletTags {
 		if strings.Contains(dropletTag, "KubernetesCluster:") {
-			clusterID = strings.Replace(dropletTag, ".", "-", -1)
+			clusterID = strings.ReplaceAll(dropletTag, ".", "-")
 
 			tokens := strings.Split(clusterID, ":")
 			if len(tokens) != 2 {
@@ -181,7 +181,7 @@ func (d *DOCloudProvider) getEtcdClusterSpec(vol godo.Volume) (*etcd.EtcdCluster
 
 func (d *DOCloudProvider) GossipSeeds() (gossip.SeedProvider, error) {
 	for _, dropletTag := range d.dropletTags {
-		if strings.Contains(dropletTag, strings.Replace(d.ClusterID, ".", "-", -1)) {
+		if strings.Contains(dropletTag, strings.ReplaceAll(d.ClusterID, ".", "-")) {
 			return gossipdo.NewSeedProvider(d.godoClient, dropletTag)
 		}
 	}
diff --git a/tests/integration/conversion/integration_test.go b/tests/integration/conversion/integration_test.go
index a540549c4a945..b768a7fa5b980 100644
--- a/tests/integration/conversion/integration_test.go
+++ b/tests/integration/conversion/integration_test.go
@@ -132,8 +132,8 @@ func runTest(t *testing.T, srcDir string, fromVersion string, toVersion string)
 		actualString := strings.TrimSpace(strings.Join(actual, "\n---\n\n"))
 		expectedString := strings.TrimSpace(string(expectedBytes))
 
-		actualString = strings.Replace(actualString, "\r", "", -1)
-		expectedString = strings.Replace(expectedString, "\r", "", -1)
+		actualString = strings.ReplaceAll(actualString, "\r", "")
+		expectedString = strings.ReplaceAll(expectedString, "\r", "")
 
 		if actualString != expectedString {
 			diffString := diff.FormatDiff(expectedString, actualString)
diff --git a/upup/pkg/fi/changes.go b/upup/pkg/fi/changes.go
index e876a16cc4dc7..1e45f8809302c 100644
--- a/upup/pkg/fi/changes.go
+++ b/upup/pkg/fi/changes.go
@@ -47,10 +47,7 @@ func BuildChanges(a, e, changes interface{}) bool {
 	}
 
 	va := reflect.ValueOf(a)
-	aIsNil := false
-	if va.IsNil() {
-		aIsNil = true
-	}
+	aIsNil := va.IsNil()
 	if !aIsNil {
 		va = va.Elem()
 
diff --git a/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go b/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go
index 84b7be45c78d7..c005c25763209 100644
--- a/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go
+++ b/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go
@@ -689,7 +689,7 @@ func (_ *NetworkLoadBalancer) RenderTerraform(t *terraform.TerraformTarget, a, e
 }
 
 func (e *NetworkLoadBalancer) TerraformName() string {
-	tfName := strings.Replace(fi.ValueOf(e.Name), ".", "-", -1)
+	tfName := strings.ReplaceAll(fi.ValueOf(e.Name), ".", "-")
 	return tfName
 }
 
diff --git a/upup/pkg/fi/cloudup/awstasks/sshkey.go b/upup/pkg/fi/cloudup/awstasks/sshkey.go
index 7ab194a6c8d69..a3bf99aface86 100644
--- a/upup/pkg/fi/cloudup/awstasks/sshkey.go
+++ b/upup/pkg/fi/cloudup/awstasks/sshkey.go
@@ -197,7 +197,7 @@ func (_ *SSHKey) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *SS
 	if e.IsExistingKey() {
 		return nil
 	}
-	tfName := strings.Replace(*e.Name, ":", "", -1)
+	tfName := strings.ReplaceAll(*e.Name, ":", "")
 	publicKey, err := t.AddFileResource("aws_key_pair", tfName, "public_key", e.PublicKey, false)
 	if err != nil {
 		return fmt.Errorf("error rendering PublicKey: %v", err)
@@ -225,7 +225,7 @@ func (e *SSHKey) TerraformLink() *terraformWriter.Literal {
 	if e.IsExistingKey() {
 		return terraformWriter.LiteralFromStringValue(*e.Name)
 	}
-	tfName := strings.Replace(*e.Name, ":", "", -1)
+	tfName := strings.ReplaceAll(*e.Name, ":", "")
 	return terraformWriter.LiteralProperty("aws_key_pair", tfName, "id")
 }
 
diff --git a/upup/pkg/fi/cloudup/awsup/aws_cloud.go b/upup/pkg/fi/cloudup/awsup/aws_cloud.go
index e384b022f84b2..1b8b98fe1ac2c 100644
--- a/upup/pkg/fi/cloudup/awsup/aws_cloud.go
+++ b/upup/pkg/fi/cloudup/awsup/aws_cloud.go
@@ -2184,13 +2184,14 @@ func findDNSName(cloud AWSCloud, cluster *kops.Cluster) (string, error) {
 	if cluster.Spec.API.LoadBalancer == nil {
 		return "", nil
 	}
-	if cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassClassic {
+	switch cluster.Spec.API.LoadBalancer.Class {
+	case kops.LoadBalancerClassClassic:
 		if lb, err := cloud.FindELBByNameTag(name); err != nil {
 			return "", fmt.Errorf("error looking for AWS ELB: %v", err)
 		} else if lb != nil {
 			return aws.ToString(lb.DNSName), nil
 		}
-	} else if cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork {
+	case kops.LoadBalancerClassNetwork:
 		allLoadBalancers, err := ListELBV2LoadBalancers(ctx, cloud)
 		if err != nil {
 			return "", fmt.Errorf("looking for AWS NLB: %w", err)
@@ -2406,7 +2407,7 @@ func GetInstanceCertificateNames(instances *ec2.DescribeInstancesOutput) (addrs
 		if iface.PrivateIpAddress != nil {
 			addrs = append(addrs, *iface.PrivateIpAddress)
 		}
-		if iface.Ipv6Addresses != nil && len(iface.Ipv6Addresses) > 0 {
+		if len(iface.Ipv6Addresses) > 0 {
 			addrs = append(addrs, *iface.Ipv6Addresses[0].Ipv6Address)
 		}
 		if iface.Association != nil && iface.Association.PublicIp != nil {
diff --git a/upup/pkg/fi/cloudup/awsup/aws_utils.go b/upup/pkg/fi/cloudup/awsup/aws_utils.go
index db9055de17521..4ecd738cd7991 100644
--- a/upup/pkg/fi/cloudup/awsup/aws_utils.go
+++ b/upup/pkg/fi/cloudup/awsup/aws_utils.go
@@ -25,7 +25,6 @@ import (
 	"sync"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	awsv2 "github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	autoscalingtypes "github.com/aws/aws-sdk-go-v2/service/autoscaling/types"
 	ec2 "github.com/aws/aws-sdk-go-v2/service/ec2"
@@ -75,7 +74,7 @@ func ValidateRegion(ctx context.Context, region string) error {
 	}
 
 	for _, r := range allRegions {
-		name := awsv2.ToString(r.RegionName)
+		name := aws.ToString(r.RegionName)
 		if name == region {
 			return nil
 		}
@@ -215,7 +214,7 @@ func GetClusterName40(cluster string) string {
 // GetResourceName32 will attempt to calculate a meaningful name for a resource given a prefix
 // Will never return a string longer than 32 chars
 func GetResourceName32(cluster string, prefix string) string {
-	s := prefix + "-" + strings.Replace(cluster, ".", "-", -1)
+	s := prefix + "-" + strings.ReplaceAll(cluster, ".", "-")
 
 	// We always compute the hash and add it, lest we trick users into assuming that we never do this
 	opt := truncate.TruncateStringOptions{
diff --git a/upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go b/upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go
index b016b8a69ac85..2beac1b219b85 100644
--- a/upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go
+++ b/upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go
@@ -89,10 +89,10 @@ func (nsg *NetworkSecurityGroup) Find(c *fi.CloudupContext) (*NetworkSecurityGro
 			DestinationAddressPrefix: rule.Properties.DestinationAddressPrefix,
 			DestinationPortRange:     rule.Properties.DestinationPortRange,
 		}
-		if rule.Properties.SourceAddressPrefixes != nil && len(rule.Properties.SourceAddressPrefixes) > 0 {
+		if len(rule.Properties.SourceAddressPrefixes) > 0 {
 			nsr.SourceAddressPrefixes = rule.Properties.SourceAddressPrefixes
 		}
-		if rule.Properties.SourceApplicationSecurityGroups != nil && len(rule.Properties.SourceApplicationSecurityGroups) > 0 {
+		if len(rule.Properties.SourceApplicationSecurityGroups) > 0 {
 			var sasgs []*string
 			for _, sasg := range rule.Properties.SourceApplicationSecurityGroups {
 				asg, err := azure.ParseApplicationSecurityGroupID(*sasg.ID)
@@ -105,10 +105,10 @@ func (nsg *NetworkSecurityGroup) Find(c *fi.CloudupContext) (*NetworkSecurityGro
 			}
 			nsr.SourceApplicationSecurityGroupNames = sasgs
 		}
-		if rule.Properties.DestinationAddressPrefixes != nil && len(rule.Properties.DestinationAddressPrefixes) > 0 {
+		if len(rule.Properties.DestinationAddressPrefixes) > 0 {
 			nsr.DestinationAddressPrefixes = rule.Properties.DestinationAddressPrefixes
 		}
-		if rule.Properties.DestinationApplicationSecurityGroups != nil && len(rule.Properties.DestinationApplicationSecurityGroups) > 0 {
+		if len(rule.Properties.DestinationApplicationSecurityGroups) > 0 {
 			var dasgs []*string
 			for _, dasg := range rule.Properties.DestinationApplicationSecurityGroups {
 				asg, err := azure.ParseApplicationSecurityGroupID(*dasg.ID)
diff --git a/upup/pkg/fi/cloudup/do/cloud.go b/upup/pkg/fi/cloudup/do/cloud.go
index 5e5e670a8ad2c..b06887fa7274d 100644
--- a/upup/pkg/fi/cloudup/do/cloud.go
+++ b/upup/pkg/fi/cloudup/do/cloud.go
@@ -295,7 +295,7 @@ func (c *doCloudImplementation) GetApiIngressStatus(cluster *kops.Cluster) ([]fi
 			return false, fmt.Errorf("LoadBalancers.List returned error: %v", err)
 		}
 
-		lbName := "api-" + strings.Replace(cluster.Name, ".", "-", -1)
+		lbName := "api-" + strings.ReplaceAll(cluster.Name, ".", "-")
 
 		for _, lb := range loadBalancers {
 			if lb.Name == lbName {
@@ -352,7 +352,7 @@ func findEtcdStatus(c *doCloudImplementation, cluster *kops.Cluster) ([]kops.Etc
 			klog.V(8).Infof("findEtcdStatus status (from cloud): checking if volume with tag %q belongs to cluster", myTag)
 			// check if volume belongs to this cluster.
 			// tag will be in the format "KubernetesCluster:dev5-k8s-local" (where clusterName is dev5.k8s.local)
-			clusterName := strings.Replace(cluster.Name, ".", "-", -1)
+			clusterName := strings.ReplaceAll(cluster.Name, ".", "-")
 			if strings.Contains(myTag, fmt.Sprintf("%s:%s", TagKubernetesClusterNamePrefix, clusterName)) {
 				klog.V(10).Infof("findEtcdStatus cluster comparison matched for tag: %v", myTag)
 				// this volume belongs to our cluster, add this to our etcdClusterSpec.
@@ -453,7 +453,7 @@ func findInstanceGroups(c *doCloudImplementation, clusterName string) ([]DOInsta
 	var result []DOInstanceGroup
 	instanceGroupMap := make(map[string][]string) // map of instance group name with droplet ids
 
-	clusterTag := "KubernetesCluster:" + strings.Replace(clusterName, ".", "-", -1)
+	clusterTag := "KubernetesCluster:" + strings.ReplaceAll(clusterName, ".", "-")
 	droplets, err := c.GetAllDropletsByTag(clusterTag)
 	if err != nil {
 		return nil, fmt.Errorf("get all droplets for tag %s returned error. Error=%v", clusterTag, err)
diff --git a/upup/pkg/fi/cloudup/do/utils.go b/upup/pkg/fi/cloudup/do/utils.go
index 31c9c53e1227d..839ee14f670ca 100644
--- a/upup/pkg/fi/cloudup/do/utils.go
+++ b/upup/pkg/fi/cloudup/do/utils.go
@@ -20,6 +20,6 @@ import "strings"
 
 func SafeClusterName(clusterName string) string {
 	// DO does not support . in tags / names
-	safeClusterName := strings.Replace(clusterName, ".", "-", -1)
+	safeClusterName := strings.ReplaceAll(clusterName, ".", "-")
 	return safeClusterName
 }
diff --git a/upup/pkg/fi/cloudup/dotasks/droplet.go b/upup/pkg/fi/cloudup/dotasks/droplet.go
index ec07da806e02a..e57955ad03300 100644
--- a/upup/pkg/fi/cloudup/dotasks/droplet.go
+++ b/upup/pkg/fi/cloudup/dotasks/droplet.go
@@ -26,7 +26,6 @@ import (
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup/do"
 	"k8s.io/kops/upup/pkg/fi/cloudup/terraform"
-	_ "k8s.io/kops/upup/pkg/fi/cloudup/terraform"
 	"k8s.io/kops/upup/pkg/fi/cloudup/terraformWriter"
 )
 
diff --git a/upup/pkg/fi/cloudup/dotasks/sshkey.go b/upup/pkg/fi/cloudup/dotasks/sshkey.go
index ad0e3ac46d903..4751bed13eef2 100644
--- a/upup/pkg/fi/cloudup/dotasks/sshkey.go
+++ b/upup/pkg/fi/cloudup/dotasks/sshkey.go
@@ -27,7 +27,6 @@ import (
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup/do"
 	"k8s.io/kops/upup/pkg/fi/cloudup/terraform"
-	_ "k8s.io/kops/upup/pkg/fi/cloudup/terraform"
 	"k8s.io/kops/upup/pkg/fi/cloudup/terraformWriter"
 )
 
@@ -172,7 +171,7 @@ func (_ *SSHKey) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *SS
 	if e.IsExistingKey() {
 		return nil
 	}
-	tfName := strings.Replace(*e.Name, ":", "", -1)
+	tfName := strings.ReplaceAll(*e.Name, ":", "")
 	publicKey, err := t.AddFileResource("digitalocean_ssh_key", tfName, "public_key", e.PublicKey, false)
 	if err != nil {
 		return fmt.Errorf("error rendering PublicKey: %v", err)
@@ -199,7 +198,7 @@ func (e *SSHKey) TerraformLink() *terraformWriter.Literal {
 	if e.IsExistingKey() {
 		return terraformWriter.LiteralFromStringValue(*e.Name)
 	}
-	tfName := strings.Replace(*e.Name, ":", "", -1)
+	tfName := strings.ReplaceAll(*e.Name, ":", "")
 	return terraformWriter.LiteralProperty("digitalocean_ssh_key", tfName, "id")
 }
 
diff --git a/upup/pkg/fi/cloudup/gce/labels.go b/upup/pkg/fi/cloudup/gce/labels.go
index 48e249b0d961f..2144903246d08 100644
--- a/upup/pkg/fi/cloudup/gce/labels.go
+++ b/upup/pkg/fi/cloudup/gce/labels.go
@@ -58,7 +58,7 @@ func EncodeGCELabel(s string) string {
 
 // DecodeGCELabel reverse EncodeGCELabel, taking the encoded RFC1035 compatible value back to a string
 func DecodeGCELabel(s string) (string, error) {
-	uriForm := strings.Replace(s, "-", "%", -1)
+	uriForm := strings.ReplaceAll(s, "-", "%")
 	v, err := url.QueryUnescape(uriForm)
 	if err != nil {
 		return "", fmt.Errorf("cannot decode GCE label: %q", s)
diff --git a/upup/pkg/fi/cloudup/gce/utils.go b/upup/pkg/fi/cloudup/gce/utils.go
index c59cb797b7793..a889fc02d25c2 100644
--- a/upup/pkg/fi/cloudup/gce/utils.go
+++ b/upup/pkg/fi/cloudup/gce/utils.go
@@ -58,7 +58,7 @@ func ClusterPrefixedName(objectName string, clusterName string, maxLength int) s
 	}
 
 	// GCE does not support . in tags / names
-	safeClusterName := strings.Replace(clusterName, ".", "-", -1)
+	safeClusterName := strings.ReplaceAll(clusterName, ".", "-")
 
 	opt := truncate.TruncateStringOptions{
 		MaxLength:     prefixLength,
@@ -79,7 +79,7 @@ func ClusterSuffixedName(objectName string, clusterName string, maxLength int) s
 	}
 
 	// GCE does not support . in tags / names
-	safeClusterName := strings.Replace(clusterName, ".", "-", -1)
+	safeClusterName := strings.ReplaceAll(clusterName, ".", "-")
 
 	opt := truncate.TruncateStringOptions{
 		MaxLength:     suffixLength,
@@ -95,7 +95,7 @@ func ClusterSuffixedName(objectName string, clusterName string, maxLength int) s
 // deprecated: prefer ClusterSuffixedName
 func SafeClusterName(clusterName string) string {
 	// GCE does not support . in tags / names
-	safeClusterName := strings.Replace(clusterName, ".", "-", -1)
+	safeClusterName := strings.ReplaceAll(clusterName, ".", "-")
 	return safeClusterName
 }
 
@@ -113,7 +113,7 @@ func LabelForCluster(clusterName string) Label {
 // SafeTruncatedClusterName returns a safe and truncated cluster name
 func SafeTruncatedClusterName(clusterName string, maxLength int) string {
 	// GCE does not support . in tags / names
-	safeClusterName := strings.Replace(clusterName, ".", "-", -1)
+	safeClusterName := strings.ReplaceAll(clusterName, ".", "-")
 
 	opt := truncate.TruncateStringOptions{
 		MaxLength:     maxLength,
diff --git a/upup/pkg/fi/cloudup/gcetasks/subnet.go b/upup/pkg/fi/cloudup/gcetasks/subnet.go
index 2508d8d809c18..93d30b6059aa7 100644
--- a/upup/pkg/fi/cloudup/gcetasks/subnet.go
+++ b/upup/pkg/fi/cloudup/gcetasks/subnet.go
@@ -195,7 +195,8 @@ func updateSecondaryRanges(cloud gce.GCECloud, op string, e *Subnet) error {
 	}
 
 	// Cannot add and remove ranges in the same call
-	if op == "add" {
+	switch op {
+	case "add":
 		patch := false
 		for k, v := range expectedRanges {
 			if actualRanges[k] != v {
@@ -211,7 +212,7 @@ func updateSecondaryRanges(cloud gce.GCECloud, op string, e *Subnet) error {
 		if !patch {
 			return nil
 		}
-	} else if op == "remove" {
+	case "remove":
 		patch := false
 		if len(actualRanges) != len(expectedRanges) {
 			patch = true
diff --git a/upup/pkg/fi/cloudup/openstack/instance.go b/upup/pkg/fi/cloudup/openstack/instance.go
index 36c051229b61d..492cb7571fa8f 100644
--- a/upup/pkg/fi/cloudup/openstack/instance.go
+++ b/upup/pkg/fi/cloudup/openstack/instance.go
@@ -66,10 +66,7 @@ func (c *openstackCloud) CreateInstance(opt servers.CreateOptsBuilder, scheduler
 }
 
 func IsPortInUse(err error) bool {
-	if gophercloud.ResponseCodeIs(err, http.StatusConflict) {
-		return true
-	}
-	return false
+	return gophercloud.ResponseCodeIs(err, http.StatusConflict)
 }
 
 // waitForStatusActive uses gopherclouds WaitFor() func to determine when the server becomes "ACTIVE".
diff --git a/upup/pkg/fi/cloudup/openstacktasks/lb.go b/upup/pkg/fi/cloudup/openstacktasks/lb.go
index 1e55fbecb3357..05d7c194a2b9e 100644
--- a/upup/pkg/fi/cloudup/openstacktasks/lb.go
+++ b/upup/pkg/fi/cloudup/openstacktasks/lb.go
@@ -72,11 +72,12 @@ func waitLoadbalancerActiveProvisioningStatus(client *gophercloud.ServiceClient,
 			return false, err
 		}
 		provisioningStatus = loadbalancer.ProvisioningStatus
-		if loadbalancer.ProvisioningStatus == activeStatus {
+		switch loadbalancer.ProvisioningStatus {
+		case activeStatus:
 			return true, nil
-		} else if loadbalancer.ProvisioningStatus == errorStatus {
+		case errorStatus:
 			return true, fmt.Errorf("loadbalancer has gone into ERROR state")
-		} else {
+		default:
 			klog.Infof("Waiting for Loadbalancer to be ACTIVE...")
 			return false, nil
 		}
@@ -115,11 +116,7 @@ func NewLBTaskFromCloud(cloud openstack.OpenstackCloud, lifecycle fi.Lifecycle,
 		return nil, err
 	}
 
-	secGroup := true
-	if find != nil && find.SecurityGroup == nil {
-		secGroup = false
-	}
-
+	secGroup := find == nil || find.SecurityGroup != nil
 	actual := &LB{
 		ID:        fi.PtrTo(lb.ID),
 		Name:      fi.PtrTo(lb.Name),
diff --git a/upup/pkg/fi/cloudup/openstacktasks/poolmonitor.go b/upup/pkg/fi/cloudup/openstacktasks/poolmonitor.go
index 6c1e9afbce437..c00a6af65c1ba 100644
--- a/upup/pkg/fi/cloudup/openstacktasks/poolmonitor.go
+++ b/upup/pkg/fi/cloudup/openstacktasks/poolmonitor.go
@@ -62,7 +62,7 @@ func (p *PoolMonitor) Find(context *fi.CloudupContext) (*PoolMonitor, error) {
 	if err != nil {
 		return nil, err
 	}
-	if rs == nil || len(rs) == 0 {
+	if len(rs) == 0 {
 		return nil, nil
 	} else if len(rs) != 1 {
 		return nil, fmt.Errorf("found multiple monitors with name: %s", fi.ValueOf(p.Name))
diff --git a/upup/pkg/fi/cloudup/openstacktasks/servergroup.go b/upup/pkg/fi/cloudup/openstacktasks/servergroup.go
index a74cd64642001..efd9bcdef1424 100644
--- a/upup/pkg/fi/cloudup/openstacktasks/servergroup.go
+++ b/upup/pkg/fi/cloudup/openstacktasks/servergroup.go
@@ -163,7 +163,7 @@ func (_ *ServerGroup) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, cha
 
 				for currentLastIndex > fi.ValueOf(maxSize) {
 					iName := strings.ToLower(fmt.Sprintf("%s-%d.%s", igName, currentLastIndex, fi.ValueOf(a.ClusterName)))
-					instanceName := strings.Replace(iName, ".", "-", -1)
+					instanceName := strings.ReplaceAll(iName, ".", "-")
 					opts := servers.ListOpts{
 						Name: fmt.Sprintf("^%s", igName),
 					}
diff --git a/upup/pkg/fi/cloudup/openstacktasks/sshkey.go b/upup/pkg/fi/cloudup/openstacktasks/sshkey.go
index d07d77bcdc951..1eba4cca7e958 100644
--- a/upup/pkg/fi/cloudup/openstacktasks/sshkey.go
+++ b/upup/pkg/fi/cloudup/openstacktasks/sshkey.go
@@ -108,8 +108,8 @@ func (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {
 }
 
 func openstackKeyPairName(org string) string {
-	name := strings.Replace(org, ".", "-", -1)
-	name = strings.Replace(name, ":", "_", -1)
+	name := strings.ReplaceAll(org, ".", "-")
+	name = strings.ReplaceAll(name, ":", "_")
 	return name
 }
 
diff --git a/upup/pkg/fi/cloudup/populate_instancegroup_spec.go b/upup/pkg/fi/cloudup/populate_instancegroup_spec.go
index 0fb8ef9068ca0..8193929e18152 100644
--- a/upup/pkg/fi/cloudup/populate_instancegroup_spec.go
+++ b/upup/pkg/fi/cloudup/populate_instancegroup_spec.go
@@ -192,14 +192,8 @@ func PopulateInstanceGroupSpec(cluster *kops.Cluster, input *kops.InstanceGroup,
 	}
 
 	hasGPU := false
-	clusterNvidia := false
-	if cluster.Spec.Containerd != nil && cluster.Spec.Containerd.NvidiaGPU != nil && fi.ValueOf(cluster.Spec.Containerd.NvidiaGPU.Enabled) {
-		clusterNvidia = true
-	}
-	igNvidia := false
-	if ig.Spec.Containerd != nil && ig.Spec.Containerd.NvidiaGPU != nil && fi.ValueOf(ig.Spec.Containerd.NvidiaGPU.Enabled) {
-		igNvidia = true
-	}
+	clusterNvidia := cluster.Spec.Containerd != nil && cluster.Spec.Containerd.NvidiaGPU != nil && fi.ValueOf(cluster.Spec.Containerd.NvidiaGPU.Enabled)
+	igNvidia := ig.Spec.Containerd != nil && ig.Spec.Containerd.NvidiaGPU != nil && fi.ValueOf(ig.Spec.Containerd.NvidiaGPU.Enabled)
 
 	switch cluster.GetCloudProvider() {
 	case kops.CloudProviderAWS:
diff --git a/upup/pkg/fi/cloudup/scalewaytasks/dns_record.go b/upup/pkg/fi/cloudup/scalewaytasks/dns_record.go
index 3a4543f9580a0..a696cce17f7aa 100644
--- a/upup/pkg/fi/cloudup/scalewaytasks/dns_record.go
+++ b/upup/pkg/fi/cloudup/scalewaytasks/dns_record.go
@@ -112,10 +112,8 @@ func (_ *DNSRecord) CheckChanges(actual, expected, changes *DNSRecord) error {
 }
 
 func (d *DNSRecord) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes *DNSRecord) error {
-	cloud := t.Cloud.(scaleway.ScwCloud)
-
 	if actual != nil {
-		recordUpdated, err := cloud.DomainService().UpdateDNSZoneRecords(&domain.UpdateDNSZoneRecordsRequest{
+		recordUpdated, err := t.Cloud.DomainService().UpdateDNSZoneRecords(&domain.UpdateDNSZoneRecordsRequest{
 			DNSZone: fi.ValueOf(actual.DNSZone),
 			Changes: []*domain.RecordChange{
 				{
@@ -138,7 +136,7 @@ func (d *DNSRecord) RenderScw(t *scaleway.ScwAPITarget, actual, expected, change
 		return nil
 	}
 
-	recordCreated, err := cloud.DomainService().UpdateDNSZoneRecords(&domain.UpdateDNSZoneRecordsRequest{
+	recordCreated, err := t.Cloud.DomainService().UpdateDNSZoneRecords(&domain.UpdateDNSZoneRecordsRequest{
 		DNSZone: fi.ValueOf(expected.DNSZone),
 		Changes: []*domain.RecordChange{
 			{
diff --git a/upup/pkg/fi/cloudup/scalewaytasks/instance.go b/upup/pkg/fi/cloudup/scalewaytasks/instance.go
index 70bff56ca8b0c..23080cc067796 100644
--- a/upup/pkg/fi/cloudup/scalewaytasks/instance.go
+++ b/upup/pkg/fi/cloudup/scalewaytasks/instance.go
@@ -92,7 +92,7 @@ func (s *Instance) Find(c *fi.CloudupContext) (*Instance, error) {
 				alreadyTagged = true
 			}
 		}
-		if alreadyTagged == true {
+		if alreadyTagged {
 			continue
 		}
 
@@ -107,7 +107,7 @@ func (s *Instance) Find(c *fi.CloudupContext) (*Instance, error) {
 		if err != nil {
 			return nil, fmt.Errorf("checking image differences in server %s (%s): %w", server.Name, server.ID, err)
 		}
-		if diff == true {
+		if diff {
 			needsUpdate = append(needsUpdate, server.ID)
 			continue
 		}
@@ -117,7 +117,7 @@ func (s *Instance) Find(c *fi.CloudupContext) (*Instance, error) {
 		if err != nil {
 			return nil, fmt.Errorf("checking user-data differences in server %s (%s): %w", server.Name, server.ID, err)
 		}
-		if diff == true {
+		if diff {
 			needsUpdate = append(needsUpdate, server.ID)
 		}
 	}
@@ -175,8 +175,7 @@ func (_ *Instance) CheckChanges(actual, expected, changes *Instance) error {
 }
 
 func (_ *Instance) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes *Instance) error {
-	cloud := t.Cloud.(scaleway.ScwCloud)
-	instanceService := cloud.InstanceService()
+	instanceService := t.Cloud.InstanceService()
 	zone := scw.Zone(fi.ValueOf(expected.Zone))
 
 	userData, err := fi.ResourceAsBytes(*expected.UserData)
@@ -216,7 +215,7 @@ func (_ *Instance) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes
 	// If newInstanceCount > 0, we need to create new instances for this group
 	for i := 0; i < newInstanceCount; i++ {
 		// We create a unique name for each server
-		uniqueName, err := uniqueName(cloud, scaleway.ClusterNameFromTags(expected.Tags), fi.ValueOf(expected.Name))
+		uniqueName, err := uniqueName(t.Cloud, scaleway.ClusterNameFromTags(expected.Tags), fi.ValueOf(expected.Name))
 		if err != nil {
 			return fmt.Errorf("error rendering server group %s: computing unique name for server: %w", fi.ValueOf(expected.Name), err)
 		}
@@ -288,14 +287,14 @@ func (_ *Instance) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes
 	// If newInstanceCount < 0, we need to delete instances of this group
 	if newInstanceCount < 0 {
 
-		igInstances, err := cloud.GetClusterServers(cloud.ClusterName(actual.Tags), actual.Name)
+		igInstances, err := t.Cloud.GetClusterServers(t.Cloud.ClusterName(actual.Tags), actual.Name)
 		if err != nil {
 			return fmt.Errorf("error deleting instance: %w", err)
 		}
 
 		for i := 0; i > newInstanceCount; i-- {
 			toDelete := igInstances[i*-1]
-			err = cloud.DeleteServer(toDelete)
+			err = t.Cloud.DeleteServer(toDelete)
 			if err != nil {
 				return fmt.Errorf("error deleting instance of group %s: %w", toDelete.Name, err)
 			}
@@ -457,7 +456,7 @@ func findFirstFreeIndex(existing []*instance.Server) int {
 				break
 			}
 		}
-		if found == false {
+		if !found {
 			return index
 		}
 	}
diff --git a/upup/pkg/fi/cloudup/scalewaytasks/sshkey.go b/upup/pkg/fi/cloudup/scalewaytasks/sshkey.go
index 78a82c7f75f31..e397b2609030c 100644
--- a/upup/pkg/fi/cloudup/scalewaytasks/sshkey.go
+++ b/upup/pkg/fi/cloudup/scalewaytasks/sshkey.go
@@ -114,8 +114,6 @@ func (*SSHKey) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes *SS
 		return nil
 	}
 
-	cloud := t.Cloud.(scaleway.ScwCloud)
-
 	name := fi.ValueOf(expected.Name)
 	if name == "" {
 		return fi.RequiredField("Name")
@@ -133,7 +131,7 @@ func (*SSHKey) RenderScw(t *scaleway.ScwAPITarget, actual, expected, changes *SS
 		keyArgs.PublicKey = d
 	}
 
-	key, err := cloud.IamService().CreateSSHKey(keyArgs)
+	key, err := t.Cloud.IamService().CreateSSHKey(keyArgs)
 	if err != nil {
 		return fmt.Errorf("error creating SSH keypair: %w", err)
 	}
diff --git a/upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go b/upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go
index 5c0b309225c7b..0784b61adb1b5 100644
--- a/upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go
+++ b/upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go
@@ -271,7 +271,7 @@ func (e *Elastigroup) Find(c *fi.CloudupContext) (*Elastigroup, error) {
 
 		// Tags.
 		{
-			if lc.Tags != nil && len(lc.Tags) > 0 {
+			if len(lc.Tags) > 0 {
 				actual.Tags = make(map[string]string)
 				for _, tag := range lc.Tags {
 					actual.Tags[fi.ValueOf(tag.Key)] = fi.ValueOf(tag.Value)
@@ -350,7 +350,7 @@ func (e *Elastigroup) Find(c *fi.CloudupContext) (*Elastigroup, error) {
 		{
 			associatePublicIP := false
 
-			if lc.NetworkInterfaces != nil && len(lc.NetworkInterfaces) > 0 {
+			if len(lc.NetworkInterfaces) > 0 {
 				for _, iface := range lc.NetworkInterfaces {
 					if fi.ValueOf(iface.AssociatePublicIPAddress) {
 						associatePublicIP = true
diff --git a/upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go b/upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go
index 82504ce65f242..775b4728f2610 100644
--- a/upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go
+++ b/upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go
@@ -160,7 +160,7 @@ func (o *LaunchSpec) Find(c *fi.CloudupContext) (*LaunchSpec, error) {
 	// Image.
 	{
 		//		convert spec from api that reply for multi arch data only in spec.images
-		if spec.Images != nil && len(spec.Images) > 1 {
+		if len(spec.Images) > 1 {
 			spec.SetImageId(fi.PtrTo(fi.ValueOf(spec.Images[0].ImageId)))
 			actual.OtherArchitectureImages = append(actual.OtherArchitectureImages, fi.ValueOf(spec.Images[1].ImageId))
 		}
diff --git a/upup/pkg/fi/cloudup/spotinsttasks/ocean.go b/upup/pkg/fi/cloudup/spotinsttasks/ocean.go
index e8a7b89feda34..e2da2cb5a63eb 100644
--- a/upup/pkg/fi/cloudup/spotinsttasks/ocean.go
+++ b/upup/pkg/fi/cloudup/spotinsttasks/ocean.go
@@ -230,7 +230,7 @@ func (o *Ocean) Find(c *fi.CloudupContext) (*Ocean, error) {
 
 		// Tags.
 		{
-			if lc.Tags != nil && len(lc.Tags) > 0 {
+			if len(lc.Tags) > 0 {
 				actual.Tags = make(map[string]string)
 				for _, tag := range lc.Tags {
 					actual.Tags[fi.ValueOf(tag.Key)] = fi.ValueOf(tag.Value)
diff --git a/upup/pkg/fi/cloudup/template_functions.go b/upup/pkg/fi/cloudup/template_functions.go
index 0ae70874b27d9..32627fdde4573 100644
--- a/upup/pkg/fi/cloudup/template_functions.go
+++ b/upup/pkg/fi/cloudup/template_functions.go
@@ -95,7 +95,7 @@ func (tf *TemplateFunctions) AddTo(dest template.FuncMap, secretStore fi.SecretS
 	dest["SharedVPC"] = tf.SharedVPC
 	// Remember that we may be on a different arch from the target.  Hard-code for now.
 	dest["replace"] = func(s, find, replace string) string {
-		return strings.Replace(s, find, replace, -1)
+		return strings.ReplaceAll(s, find, replace)
 	}
 	dest["joinHostPort"] = net.JoinHostPort
 
@@ -131,10 +131,7 @@ func (tf *TemplateFunctions) AddTo(dest template.FuncMap, secretStore fi.SecretS
 	}
 
 	dest["GossipEnabled"] = func() bool {
-		if cluster.UsesLegacyGossip() {
-			return true
-		}
-		return false
+		return cluster.UsesLegacyGossip()
 	}
 	dest["PublishesDNSRecords"] = func() bool {
 		return cluster.PublishesDNSRecords()
@@ -383,7 +380,7 @@ func (tf *TemplateFunctions) AddTo(dest template.FuncMap, secretStore fi.SecretS
 
 	if cluster.Spec.CloudProvider.AWS != nil && cluster.Spec.CloudProvider.AWS.NodeTerminationHandler != nil {
 		dest["DefaultQueueName"] = func() string {
-			s := strings.Replace(tf.ClusterName(), ".", "-", -1)
+			s := strings.ReplaceAll(tf.ClusterName(), ".", "-")
 			domain := ".amazonaws.com/"
 			if strings.Contains(tf.Region, "cn-") {
 				domain = ".amazonaws.com.cn/"
diff --git a/upup/pkg/fi/cloudup/terraform/target_hcl2.go b/upup/pkg/fi/cloudup/terraform/target_hcl2.go
index dbc3a07fe64cb..4c192d877eab6 100644
--- a/upup/pkg/fi/cloudup/terraform/target_hcl2.go
+++ b/upup/pkg/fi/cloudup/terraform/target_hcl2.go
@@ -108,7 +108,6 @@ func writeLocalsOutputs(buf *bytes.Buffer, outputs map[string]terraformWriter.Ou
 		toElement(&output{Value: locals[tfName]}).Write(buf, 0, fmt.Sprintf("output %q", tfName))
 		buf.WriteString("\n")
 	}
-	return
 }
 
 func (t *TerraformTarget) writeProviders(buf *bytes.Buffer) {
diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go
index 2c05b3fe63b70..168efd44c671c 100644
--- a/upup/pkg/fi/nodeup/command.go
+++ b/upup/pkg/fi/nodeup/command.go
@@ -241,7 +241,8 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 		return err
 	}
 
-	if bootConfig.CloudProvider == api.CloudProviderAWS {
+	switch bootConfig.CloudProvider {
+	case api.CloudProviderAWS:
 		instanceIDBytes, err := vfs.Context.ReadFile("metadata://aws/meta-data/instance-id")
 		if err != nil {
 			return fmt.Errorf("error reading instance-id from AWS metadata: %v", err)
@@ -276,7 +277,7 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 				modelContext.GPUVendor = architectures.GPUVendorNvidia
 			}
 		}
-	} else if bootConfig.CloudProvider == api.CloudProviderOpenstack {
+	case api.CloudProviderOpenstack:
 		// NvidiaGPU possible to enable only in instance group level in OpenStack. When we assume that GPU is supported
 		if nodeupConfig.NvidiaGPU != nil && fi.ValueOf(nodeupConfig.NvidiaGPU.Enabled) {
 			klog.Info("instance supports GPU acceleration")
diff --git a/upup/pkg/fi/nodeup/nodetasks/file.go b/upup/pkg/fi/nodeup/nodetasks/file.go
index 4d1fcf926be2e..b17008068a2d2 100644
--- a/upup/pkg/fi/nodeup/nodetasks/file.go
+++ b/upup/pkg/fi/nodeup/nodetasks/file.go
@@ -243,7 +243,8 @@ func (_ *File) RenderLocal(_ *local.LocalTarget, a, e, changes *File) error {
 	}
 
 	changed := false
-	if e.Type == FileType_Symlink {
+	switch e.Type {
+	case FileType_Symlink:
 		if changes.Symlink != nil {
 			// This will currently fail if the target already exists.
 			// That's probably a good thing for now ... it is hard to know what to do here!
@@ -254,7 +255,7 @@ func (_ *File) RenderLocal(_ *local.LocalTarget, a, e, changes *File) error {
 			}
 			changed = true
 		}
-	} else if e.Type == FileType_Directory {
+	case FileType_Directory:
 		if a == nil {
 			parent := filepath.Dir(strings.TrimSuffix(e.Path, "/"))
 			err := os.MkdirAll(parent, dirMode)
@@ -268,7 +269,7 @@ func (_ *File) RenderLocal(_ *local.LocalTarget, a, e, changes *File) error {
 			}
 			changed = true
 		}
-	} else if e.Type == FileType_File {
+	case FileType_File:
 		if changes.Contents != nil {
 			err = fi.WriteFile(e.Path, e.Contents, fileMode, dirMode, fi.ValueOf(e.Owner), fi.ValueOf(e.Group))
 			if err != nil {
@@ -276,7 +277,7 @@ func (_ *File) RenderLocal(_ *local.LocalTarget, a, e, changes *File) error {
 			}
 			changed = true
 		}
-	} else {
+	default:
 		return fmt.Errorf("File type=%q not valid/supported", e.Type)
 	}
 
diff --git a/upup/pkg/fi/nodeup/nodetasks/load_image.go b/upup/pkg/fi/nodeup/nodetasks/load_image.go
index bc13f3c340fb2..f27ff5757015d 100644
--- a/upup/pkg/fi/nodeup/nodetasks/load_image.go
+++ b/upup/pkg/fi/nodeup/nodetasks/load_image.go
@@ -142,8 +142,7 @@ func (_ *LoadImageTask) RenderLocal(t *local.LocalTarget, a, e, changes *LoadIma
 	}
 
 	// Load the container image
-	var args []string
-	args = []string{"ctr", "--namespace", "k8s.io", "images", "import", tarFile}
+	args := []string{"ctr", "--namespace", "k8s.io", "images", "import", tarFile}
 	human := strings.Join(args, " ")
 
 	klog.Infof("running command %s", human)
diff --git a/upup/pkg/fi/vfs_castore.go b/upup/pkg/fi/vfs_castore.go
index 44fb8f1579081..a4c4d815bc080 100644
--- a/upup/pkg/fi/vfs_castore.go
+++ b/upup/pkg/fi/vfs_castore.go
@@ -302,7 +302,7 @@ func (c *VFSCAStore) AddSSHPublicKey(ctx context.Context, pubkey []byte) error {
 
 func (c *VFSCAStore) buildSSHPublicKeyPath(id string) vfs.Path {
 	// id is fingerprint with colons, but we store without colons
-	id = strings.Replace(id, ":", "", -1)
+	id = strings.ReplaceAll(id, ":", "")
 	return c.basedir.Join("ssh", "public", "admin", id)
 }
 
diff --git a/util/pkg/text/text.go b/util/pkg/text/text.go
index d6ae4d5e6fb1b..ab17a85868a87 100644
--- a/util/pkg/text/text.go
+++ b/util/pkg/text/text.go
@@ -23,7 +23,7 @@ import (
 // SplitContentToSections splits content of a kops manifest into sections.
 func SplitContentToSections(content []byte) [][]byte {
 	// replace windows line endings with unix ones
-	normalized := bytes.Replace(content, []byte("\r\n"), []byte("\n"), -1)
+	normalized := bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
 
 	return bytes.Split(normalized, []byte("\n---\n"))
 }
diff --git a/util/pkg/vfs/s3fs.go b/util/pkg/vfs/s3fs.go
index e4865122497ee..9d5511e2a0f7a 100644
--- a/util/pkg/vfs/s3fs.go
+++ b/util/pkg/vfs/s3fs.go
@@ -696,7 +696,8 @@ func (p *S3Path) RenderTerraform(w *terraformWriter.TerraformWriter, name string
 	}
 
 	// render DO's terraform
-	if p.scheme == "do" {
+	switch p.scheme {
+	case "do":
 
 		content, err := w.AddFileBytes("digitalocean_spaces_bucket_object", name, "content", bytes, false)
 		if err != nil {
@@ -719,7 +720,7 @@ func (p *S3Path) RenderTerraform(w *terraformWriter.TerraformWriter, name string
 		return w.RenderResource("digitalocean_spaces_bucket_object", name, tf)
 
 		// render Scaleway's Terraform objects
-	} else if p.scheme == "scw" {
+	case "scw":
 
 		content, err := w.AddFileBytes("scaleway_object", name, "content", bytes, false)
 		if err != nil {
@@ -733,7 +734,7 @@ func (p *S3Path) RenderTerraform(w *terraformWriter.TerraformWriter, name string
 		}
 		return w.RenderResource("scaleway_object", name, tf)
 
-	} else {
+	default:
 		bucketDetails, err := p.getBucketDetails(ctx)
 		if err != nil {
 			return err