Bump golangci-lint to 2.3.0 and fix issues

internal/controller/impersonatorconfig/impersonator_config_test.go

@@ -544,12 +544,13 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
 			expectedErrorRegex := "dial tcp .*: connect: connection refused"
 			expectedErrorRegexCompiled, err := regexp.Compile(expectedErrorRegex)
 			r.NoError(err)
+
+			dialer := tls.Dialer{}
 			assert.Eventually(t, func() bool {
-				_, err = tls.Dial(
+				_, err = dialer.DialContext(
+					context.Background(),
 					"tcp",
-					testServerAddr(),
-					&tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-				)
+					testServerAddr())
 				return err != nil && expectedErrorRegexCompiled.MatchString(err.Error())
 			}, 20*time.Second, 50*time.Millisecond)
 			r.Error(err)

internal/localuserauthenticator/localuserauthenticator.go

@@ -357,8 +357,8 @@ func run(ctx context.Context) error {
 	startControllers(ctx, dynamicCertProvider, client.Kubernetes, kubeInformers)
 	plog.Debug("controllers are ready")
 
-	//nolint:gosec // Intentionally binding to all network interfaces.
-	l, err := net.Listen("tcp", ":8443")
+	listenConfig := net.ListenConfig{}
+	l, err := listenConfig.Listen(context.Background(), "tcp", ":8443")
 	if err != nil {
 		return fmt.Errorf("cannot create listener: %w", err)
 	}

internal/localuserauthenticator/localuserauthenticator_test.go

@@ -97,7 +97,8 @@ func TestWebhook(t *testing.T) {
 	certProvider, caBundle, serverName := newCertProvider(t)
 	w := newWebhook(certProvider, secretInformer)
 
-	l, err := net.Listen("tcp", "127.0.0.1:0")
+	listenConfig := &net.ListenConfig{}
+	l, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 	defer func() { _ = l.Close() }()
 	require.NoError(t, w.start(ctx, l))

internal/supervisor/server/server.go

@@ -545,7 +545,8 @@ func runSupervisor(ctx context.Context, podInfo *downward.PodInfo, cfg *supervis
 	if e := cfg.Endpoints.HTTP; e.Network != supervisor.NetworkDisabled {
 		finishSetupPerms := maybeSetupUnixPerms(e, supervisorPod)
 
-		httpListener, err := net.Listen(e.Network, e.Address)
+		listenConfig := net.ListenConfig{}
+		httpListener, err := listenConfig.Listen(ctx, e.Network, e.Address)
 		if err != nil {
 			return fmt.Errorf("cannot create http listener with network %q and address %q: %w", e.Network, e.Address, err)
 		}

internal/testutil/tlsserver/tlsserver.go

@@ -36,7 +36,8 @@ const (
 func TestServerIPv6(t *testing.T, handler http.Handler, f func(*httptest.Server)) (*httptest.Server, []byte) {
 	t.Helper()
 
-	listener, err := net.Listen("tcp6", "[::1]:0")
+	listenConfig := net.ListenConfig{}
+	listener, err := listenConfig.Listen(t.Context(), "tcp6", "[::1]:0")
 	require.NoError(t, err, "TLSTestIPv6Server: failed to listen on a port")
 
 	server := &httptest.Server{
@@ -81,13 +82,14 @@ func TLSTestServerWithCert(t *testing.T, handler http.HandlerFunc, certificate *
 		ReadHeaderTimeout: 10 * time.Second,
 	}
 
-	l, err := net.Listen("tcp", "127.0.0.1:0")
+	listenConfig := net.ListenConfig{}
+	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
 	serverShutdownChan := make(chan error)
 	go func() {
 		// Empty certFile and keyFile will use certs from Server.TLSConfig.
-		serverShutdownChan <- server.ServeTLS(l, "", "")
+		serverShutdownChan <- server.ServeTLS(listener, "", "")
 	}()
 
 	t.Cleanup(func() {
@@ -99,7 +101,7 @@ func TLSTestServerWithCert(t *testing.T, handler http.HandlerFunc, certificate *
 		}
 	})
 
-	return l.Addr().String()
+	return listener.Addr().String()
 }
 
 // RecordTLSHello configures the server to record client TLS negotiation info onto each incoming request,

internal/upstreamldap/upstreamldap_test.go

@@ -2384,7 +2384,8 @@ func TestRealTLSDialing(t *testing.T) {
 	require.NoError(t, err)
 	testServerWithBadCertNameAddr := tlsserver.TLSTestServerWithCert(t, func(w http.ResponseWriter, r *http.Request) {}, cert)
 
-	unusedPortGrabbingListener, err := net.Listen("tcp", "127.0.0.1:0")
+	listenConfig := net.ListenConfig{}
+	unusedPortGrabbingListener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 	recentlyClaimedHostAndPort := unusedPortGrabbingListener.Addr().String()
 	require.NoError(t, unusedPortGrabbingListener.Close())