diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 71e4fab6ff..68d20180a2 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,16 +1,11 @@
 *                                       @percona/pmm-review-be
-/build/                                 @atymchuk @percona/pmm-review-be
-/admin/                                 @percona/pmm-review-be
 /agent/agents/postgres/                 @JiriCtvrtka @percona/pmm-review-be
 /agent/runner/                          @artemgavrilov @percona/pmm-review-be
 /api/                                   @BupycHuk @percona/pmm-review-be
-/docs/api/                              @atymchuk @percona/pmm-review-be
 /managed/services/checks/               @idoqo @percona/pmm-review-be
-/managed/                               @percona/pmm-review-be
 /managed/services/dbaas                 @gen1us2k @recharte @percona/pmm-review-be
 /managed/services/management/dbaas      @gen1us2k @recharte @percona/pmm-review-be
 /update/                                @BupycHuk @talhabinrizwan @percona/pmm-review-be
-/api-tests/                             @percona/pmm-review-be
 **/go.mod                               @percona/pmm-review-dependency @percona/pmm-review-be
 **/Dockerfile                           @percona/pmm-review-dependency @percona/pmm-review-be
 /cli-tests/package.json                 @percona/pmm-review-dependency @yurkovychv
diff --git a/.golangci.yml b/.golangci.yml
index ff07ed391b..9ba704817d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -7,19 +7,19 @@ linters-settings:
     max-complexity: 30
 
   depguard:
-    list-type: blacklist
-    include-go-root: true
-    packages:
-      # use "github.com/pkg/errors" instead
-      - errors
-      # use "github.com/golang/protobuf/proto" instead
-      - github.com/gogo/protobuf/proto
-      # use only forked parser
-      - github.com/percona/go-mysql/log/slow
-      # use "github.com/percona-platform/saas" instead
-      - github.com/percona-platform/platform
-      # use "gopkg.in/yaml.v3" instead
-      - gopkg.in/yaml.v2
+    rules:
+      main:
+        deny:
+          - pkg: "errors"
+            desc: use "github.com/pkg/errors" instead
+          - pkg: "github.com/gogo/protobuf/proto"
+            desc: use "github.com/golang/protobuf/proto" instead
+          - pkg: "github.com/percona/go-mysql/log/slow"
+            desc: only use the forked parser
+          - pkg: "github.com/percona-platform/platform"
+            desc: use "github.com/percona-platform/saas" instead
+          - pkg: "gopkg.in/yaml.v2"
+            desc: use "gopkg.in/yaml.v3" instead
 
   gci:
     sections:
@@ -103,8 +103,12 @@ linters:
     - maligned         # deprecated
     - nlreturn         # too annoying
     - nosnakecase      # deprecated
+    - rowserrcheck     # disabled because of generics
     - scopelint        # too many false positives
+    - structcheck      # replaced by unused
+    - varcheck         # replaced by unused
     - varnamelen       # useless
+    - wastedassign     # disabled because of generics
     - wrapcheck        # we do not use wrapping everywhere
     - wsl              # too annoying
 
diff --git a/agent/runner/jobs/pbm_helpers.go b/agent/runner/jobs/pbm_helpers.go
index 09e9c4006b..0ede95084a 100644
--- a/agent/runner/jobs/pbm_helpers.go
+++ b/agent/runner/jobs/pbm_helpers.go
@@ -279,7 +279,7 @@ func waitForPBMBackup(ctx context.Context, l logrus.FieldLogger, dbURL *string,
 				return nil
 			case "canceled":
 				return errors.New("backup was canceled")
-			case "error": //nolint:goconst
+			case "error":
 				return errors.New(info.Error)
 			}
 
diff --git a/managed/services/agents/grpc/agent_server.go b/managed/services/agents/grpc/agent_server.go
index da6e23502d..69eced0a99 100644
--- a/managed/services/agents/grpc/agent_server.go
+++ b/managed/services/agents/grpc/agent_server.go
@@ -40,7 +40,7 @@ func (s *agentServer) Connect(stream agentpb.Agent_ConnectServer) error {
 	return s.handler.Run(stream)
 }
 
-// check interfaces
+// check interfaces.
 var (
 	_ agentpb.AgentServer = (*agentServer)(nil)
 )
diff --git a/managed/services/agents/log_level.go b/managed/services/agents/log_level.go
index a7cc24c273..2b33b472f8 100644
--- a/managed/services/agents/log_level.go
+++ b/managed/services/agents/log_level.go
@@ -22,11 +22,11 @@ import (
 	"github.com/percona/pmm/version"
 )
 
-// Log level available in exporters with pmm 2.28
+// Log level available in exporters with pmm 2.28.
 var exporterLogLevelCommandVersion = version.MustParse("2.27.99")
 
 // withLogLevel - append CLI args --log.level
-// mysqld_exporter, node_exporter and postgres_exporter don't support --log.level=fatal
+// mysqld_exporter, node_exporter and postgres_exporter don't support --log.level=fatal.
 func withLogLevel(args []string, logLevel *string, pmmAgentVersion *version.Parsed, supportLogLevelFatal bool) []string {
 	level := pointer.GetString(logLevel)
 
diff --git a/managed/services/backup/backup_service.go b/managed/services/backup/backup_service.go
index e23cab52d2..2e730b366b 100644
--- a/managed/services/backup/backup_service.go
+++ b/managed/services/backup/backup_service.go
@@ -607,7 +607,7 @@ func checkArtifactMode(artifact *models.Artifact, pitrTimestamp time.Time) error
 	return nil
 }
 
-// inTimeSpan checks whether given time is in the given range
+// inTimeSpan checks whether given time is in the given range.
 func inTimeSpan(start, end, check time.Time) bool {
 	if start.Before(end) {
 		return !check.Before(start) && !check.After(end)
diff --git a/managed/services/backup/compatibility_service.go b/managed/services/backup/compatibility_service.go
index 04796cee20..1e6c70c3ba 100644
--- a/managed/services/backup/compatibility_service.go
+++ b/managed/services/backup/compatibility_service.go
@@ -246,7 +246,7 @@ func (s *CompatibilityService) CheckArtifactCompatibility(artifactID, targetDBVe
 	return s.artifactCompatibility(artifactModel, serviceModel, targetDBVersion)
 }
 
-// artifactCompatibility contains logic for CheckArtifactCompatibility
+// artifactCompatibility contains logic for CheckArtifactCompatibility.
 func (s *CompatibilityService) artifactCompatibility(artifactModel *models.Artifact, serviceModel *models.Service, targetDBVersion string) error {
 	var err error
 	if artifactModel.DBVersion != "" && artifactModel.DBVersion != targetDBVersion {
diff --git a/managed/services/backup/pitr_timerange_service.go b/managed/services/backup/pitr_timerange_service.go
index 000ca1c22c..84050aa139 100644
--- a/managed/services/backup/pitr_timerange_service.go
+++ b/managed/services/backup/pitr_timerange_service.go
@@ -37,7 +37,7 @@ const (
 
 var errUnsupportedLocation = errors.New("unsupported location config")
 
-// PBMPITRService helps to perform PITR chunks lookup in a backup storage
+// PBMPITRService helps to perform PITR chunks lookup in a backup storage.
 type PBMPITRService struct {
 	l *logrus.Entry
 }
@@ -49,7 +49,7 @@ func NewPBMPITRService() *PBMPITRService {
 	}
 }
 
-// oplogChunk is index metadata for the oplog chunks
+// oplogChunk is index metadata for the oplog chunks.
 type oplogChunk struct {
 	RS          string              `bson:"rs"`
 	FName       string              `bson:"fname"`
@@ -59,7 +59,7 @@ type oplogChunk struct {
 	size        int64               `bson:"-"`
 }
 
-// Timeline is an internal representation of a PITR Timeline
+// Timeline is an internal representation of a PITR Timeline.
 type Timeline struct {
 	ReplicaSet string `json:"replica_set"`
 	Start      uint32 `json:"start"`
@@ -79,7 +79,7 @@ func (x gaps) Less(i, j int) bool {
 }
 func (x gaps) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
 
-// compressionType is the type of compression used for PITR oplog
+// compressionType is the type of compression used for PITR oplog.
 type compressionType string
 
 const (
@@ -91,7 +91,7 @@ const (
 	compressionTypeZstandard compressionType = "zstd"
 )
 
-// file return compression alg based on given file extension
+// file return compression alg based on given file extension.
 func file(ext string) compressionType {
 	switch ext {
 	case "gz":
@@ -190,7 +190,7 @@ func trimTimelines(timelines []Timeline) {
 // current format is 20200715155939-0.20200715160029-1.oplog.snappy
 // (https://github.com/percona/percona-backup-mongodb/wiki/PITR:-storage-layout)
 //
-// !!! Should be agreed with pbm/pitr.chunkPath()
+// !!! Should be agreed with pbm/pitr.chunkPath().
 func pitrMetaFromFileName(prefix, f string) *oplogChunk {
 	ppath := strings.Split(f, "/")
 	if len(ppath) < 2 {
@@ -251,7 +251,7 @@ func getTimelines(slices []*oplogChunk) []Timeline {
 	var timelines []Timeline
 	var prevEnd primitive.Timestamp
 	for _, s := range slices {
-		if prevEnd.T != 0 && primitive.CompareTimestamp(prevEnd, s.StartTS) == -1 {
+		if prevEnd.T != 0 && prevEnd.Compare(s.StartTS) == -1 {
 			timelines = append(timelines, tl)
 			tl = Timeline{}
 		}
@@ -269,7 +269,7 @@ func getTimelines(slices []*oplogChunk) []Timeline {
 }
 
 // mergeTimelines merges overlapping sets on timelines
-// it presumes timelines are sorted and don't start from 0
+// it presumes timelines are sorted and don't start from 0.
 func mergeTimelines(timelines ...[]Timeline) []Timeline {
 	// fast paths
 	if len(timelines) == 0 {
diff --git a/managed/services/dbaas/kubernetes/client/client.go b/managed/services/dbaas/kubernetes/client/client.go
index 83c6c12499..832023e00b 100644
--- a/managed/services/dbaas/kubernetes/client/client.go
+++ b/managed/services/dbaas/kubernetes/client/client.go
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// Package client TODO
+// Package client TODO.
 package client
 
 import (
@@ -107,7 +107,7 @@ type Client struct {
 	namespace        string
 }
 
-// SortableEvents implements sort.Interface for []api.Event based on the Timestamp field
+// SortableEvents implements sort.Interface for []api.Event based on the Timestamp field.
 type SortableEvents []corev1.Event
 
 func (list SortableEvents) Len() int {
@@ -192,7 +192,7 @@ func NewFromInCluster() (*Client, error) {
 }
 
 // NewFromKubeConfigString creates a new client for the given config string.
-// It's intended for clients that expect to be running outside of a cluster
+// It's intended for clients that expect to be running outside of a cluster.
 func NewFromKubeConfigString(kubeconfig string) (*Client, error) {
 	config, err := clientcmd.BuildConfigFromKubeconfigGetter("", NewConfigGetter(kubeconfig).loadFromString)
 	if err != nil {
@@ -235,7 +235,7 @@ func (c *Client) setup() error {
 	return c.initOperatorClients()
 }
 
-// Initializes clients for operators
+// Initializes clients for operators.
 func (c *Client) initOperatorClients() error {
 	dbClusterClient, err := database.NewForConfig(c.restConfig)
 	if err != nil {
@@ -246,7 +246,7 @@ func (c *Client) initOperatorClients() error {
 	return err
 }
 
-// GetSecretsForServiceAccount returns secret by given service account name
+// GetSecretsForServiceAccount returns secret by given service account name.
 func (c *Client) GetSecretsForServiceAccount(ctx context.Context, accountName string) (*corev1.Secret, error) {
 	serviceAccount, err := c.clientset.CoreV1().ServiceAccounts(c.namespace).Get(ctx, accountName, metav1.GetOptions{})
 	if err != nil {
@@ -263,7 +263,7 @@ func (c *Client) GetSecretsForServiceAccount(ctx context.Context, accountName st
 		metav1.GetOptions{})
 }
 
-// GenerateKubeConfig generates kubeconfig
+// GenerateKubeConfig generates kubeconfig.
 func (c *Client) GenerateKubeConfig(secret *corev1.Secret) ([]byte, error) {
 	conf := &Config{
 		Kind:           configKind,
@@ -301,7 +301,7 @@ func (c *Client) GenerateKubeConfig(secret *corev1.Secret) ([]byte, error) {
 	return c.marshalKubeConfig(conf)
 }
 
-// GetServerVersion returns server version
+// GetServerVersion returns server version.
 func (c *Client) GetServerVersion() (*version.Info, error) {
 	return c.clientset.Discovery().ServerVersion()
 }
@@ -320,27 +320,27 @@ func (c *Client) GetDatabaseCluster(ctx context.Context, name string) (*dbaasv1.
 	return cluster, nil
 }
 
-// GetStorageClasses returns all storage classes available in the cluster
+// GetStorageClasses returns all storage classes available in the cluster.
 func (c *Client) GetStorageClasses(ctx context.Context) (*storagev1.StorageClassList, error) {
 	return c.clientset.StorageV1().StorageClasses().List(ctx, metav1.ListOptions{})
 }
 
-// GetDeployment returns deployment by name
+// GetDeployment returns deployment by name.
 func (c *Client) GetDeployment(ctx context.Context, name string) (*appsv1.Deployment, error) {
 	return c.clientset.AppsV1().Deployments(c.namespace).Get(ctx, name, metav1.GetOptions{})
 }
 
-// GetSecret returns secret by name
+// GetSecret returns secret by name.
 func (c *Client) GetSecret(ctx context.Context, name string) (*corev1.Secret, error) {
 	return c.clientset.CoreV1().Secrets(c.namespace).Get(ctx, name, metav1.GetOptions{})
 }
 
-// ListSecrets returns secrets
+// ListSecrets returns secrets.
 func (c *Client) ListSecrets(ctx context.Context) (*corev1.SecretList, error) {
 	return c.clientset.CoreV1().Secrets(c.namespace).List(ctx, metav1.ListOptions{})
 }
 
-// DeleteObject deletes object from the k8s cluster
+// DeleteObject deletes object from the k8s cluster.
 func (c *Client) DeleteObject(obj runtime.Object) error {
 	groupResources, err := restmapper.GetAPIGroupResources(c.clientset.Discovery())
 	if err != nil {
@@ -459,12 +459,12 @@ func (c *Client) marshalKubeConfig(conf *Config) ([]byte, error) {
 	return yaml.Marshal(jsonObj)
 }
 
-// GetPersistentVolumes returns Persistent Volumes available in the cluster
+// GetPersistentVolumes returns Persistent Volumes available in the cluster.
 func (c *Client) GetPersistentVolumes(ctx context.Context) (*corev1.PersistentVolumeList, error) {
 	return c.clientset.CoreV1().PersistentVolumes().List(ctx, metav1.ListOptions{})
 }
 
-// GetPods returns list of pods
+// GetPods returns list of pods.
 func (c *Client) GetPods(ctx context.Context, namespace string, labelSelector *metav1.LabelSelector) (*corev1.PodList, error) {
 	options := metav1.ListOptions{}
 	if labelSelector != nil && (labelSelector.MatchLabels != nil || labelSelector.MatchExpressions != nil) {
@@ -474,12 +474,12 @@ func (c *Client) GetPods(ctx context.Context, namespace string, labelSelector *m
 	return c.clientset.CoreV1().Pods(namespace).List(ctx, options)
 }
 
-// GetNodes returns list of nodes
+// GetNodes returns list of nodes.
 func (c *Client) GetNodes(ctx context.Context) (*corev1.NodeList, error) {
 	return c.clientset.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
 }
 
-// GetLogs returns logs for pod
+// GetLogs returns logs for pod.
 func (c *Client) GetLogs(ctx context.Context, pod, container string) (string, error) {
 	defaultLogLines := int64(3000)
 	options := &corev1.PodLogOptions{}
@@ -671,7 +671,7 @@ func translateTimestampSince(timestamp metav1.Time) string {
 }
 
 // ApplyFile accepts manifest file contents, parses into []runtime.Object
-// and applies them against the cluster
+// and applies them against the cluster.
 func (c *Client) ApplyFile(fileBytes []byte) error {
 	objs, err := c.getObjects(fileBytes)
 	if err != nil {
diff --git a/managed/services/dbaas/kubernetes/client/kubeclient_interface.go b/managed/services/dbaas/kubernetes/client/kubeclient_interface.go
index e64a80225e..4a258117c6 100644
--- a/managed/services/dbaas/kubernetes/client/kubeclient_interface.go
+++ b/managed/services/dbaas/kubernetes/client/kubeclient_interface.go
@@ -23,38 +23,38 @@ import (
 
 // KubeClientConnector ...
 type KubeClientConnector interface {
-	// GetSecretsForServiceAccount returns secret by given service account name
+	// GetSecretsForServiceAccount returns secret by given service account name.
 	GetSecretsForServiceAccount(ctx context.Context, accountName string) (*corev1.Secret, error)
-	// GenerateKubeConfig generates kubeconfig
+	// GenerateKubeConfig generates kubeconfig.
 	GenerateKubeConfig(secret *corev1.Secret) ([]byte, error)
-	// GetServerVersion returns server version
+	// GetServerVersion returns server version.
 	GetServerVersion() (*version.Info, error)
 	// ListDatabaseClusters returns list of managed PCX clusters.
 	ListDatabaseClusters(ctx context.Context) (*dbaasv1.DatabaseClusterList, error)
 	// GetDatabaseCluster returns PXC clusters by provided name.
 	GetDatabaseCluster(ctx context.Context, name string) (*dbaasv1.DatabaseCluster, error)
-	// GetStorageClasses returns all storage classes available in the cluster
+	// GetStorageClasses returns all storage classes available in the cluster.
 	GetStorageClasses(ctx context.Context) (*storagev1.StorageClassList, error)
-	// GetDeployment returns deployment by name
+	// GetDeployment returns deployment by name.
 	GetDeployment(ctx context.Context, name string) (*appsv1.Deployment, error)
-	// GetSecret returns secret by name
+	// GetSecret returns secret by name.
 	GetSecret(ctx context.Context, name string) (*corev1.Secret, error)
-	// ListSecrets returns secrets
+	// ListSecrets returns secrets.
 	ListSecrets(ctx context.Context) (*corev1.SecretList, error)
-	// DeleteObject deletes object from the k8s cluster
+	// DeleteObject deletes object from the k8s cluster.
 	DeleteObject(obj runtime.Object) error
 	ApplyObject(obj runtime.Object) error
-	// GetPersistentVolumes returns Persistent Volumes available in the cluster
+	// GetPersistentVolumes returns Persistent Volumes available in the cluster.
 	GetPersistentVolumes(ctx context.Context) (*corev1.PersistentVolumeList, error)
-	// GetPods returns list of pods
+	// GetPods returns list of pods.
 	GetPods(ctx context.Context, namespace string, labelSelector *metav1.LabelSelector) (*corev1.PodList, error)
-	// GetNodes returns list of nodes
+	// GetNodes returns list of nodes.
 	GetNodes(ctx context.Context) (*corev1.NodeList, error)
-	// GetLogs returns logs for pod
+	// GetLogs returns logs for pod.
 	GetLogs(ctx context.Context, pod, container string) (string, error)
 	GetEvents(ctx context.Context, name string) (string, error)
 	// ApplyFile accepts manifest file contents, parses into []runtime.Object
-	// and applies them against the cluster
+	// and applies them against the cluster.
 	ApplyFile(fileBytes []byte) error
 	// DoCSVWait waits until for a CSV to be applied.
 	DoCSVWait(ctx context.Context, key types.NamespacedName) error
diff --git a/managed/services/dbaas/kubernetes/kubernetes.go b/managed/services/dbaas/kubernetes/kubernetes.go
index 9582a2c76a..207bff645a 100644
--- a/managed/services/dbaas/kubernetes/kubernetes.go
+++ b/managed/services/dbaas/kubernetes/kubernetes.go
@@ -185,7 +185,7 @@ func NewEmpty() *Kubernetes {
 	}
 }
 
-// SetKubeconfig changes kubeconfig for active client
+// SetKubeconfig changes kubeconfig for active client.
 func (k *Kubernetes) SetKubeconfig(kubeconfig string) error {
 	k.lock.Lock()
 	defer k.lock.Unlock()
@@ -231,7 +231,7 @@ func (k *Kubernetes) GetDatabaseCluster(ctx context.Context, name string) (*dbaa
 	return k.client.GetDatabaseCluster(ctx, name)
 }
 
-// RestartDatabaseCluster restarts database cluster
+// RestartDatabaseCluster restarts database cluster.
 func (k *Kubernetes) RestartDatabaseCluster(ctx context.Context, name string) error {
 	k.lock.Lock()
 	defer k.lock.Unlock()
@@ -255,7 +255,7 @@ func (k *Kubernetes) PatchDatabaseCluster(cluster *dbaasv1.DatabaseCluster) erro
 	return k.client.ApplyObject(cluster)
 }
 
-// CreateDatabaseCluster creates database cluster
+// CreateDatabaseCluster creates database cluster.
 func (k *Kubernetes) CreateDatabaseCluster(cluster *dbaasv1.DatabaseCluster) error {
 	k.lock.Lock()
 	defer k.lock.Unlock()
@@ -266,7 +266,7 @@ func (k *Kubernetes) CreateDatabaseCluster(cluster *dbaasv1.DatabaseCluster) err
 	return k.client.ApplyObject(cluster)
 }
 
-// DeleteDatabaseCluster deletes database cluster
+// DeleteDatabaseCluster deletes database cluster.
 func (k *Kubernetes) DeleteDatabaseCluster(ctx context.Context, name string) error {
 	k.lock.Lock()
 	defer k.lock.Unlock()
@@ -279,7 +279,7 @@ func (k *Kubernetes) DeleteDatabaseCluster(ctx context.Context, name string) err
 	return k.client.DeleteObject(cluster)
 }
 
-// GetDefaultStorageClassName returns first storageClassName from kubernetes cluster
+// GetDefaultStorageClassName returns first storageClassName from kubernetes cluster.
 func (k *Kubernetes) GetDefaultStorageClassName(ctx context.Context) (string, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
@@ -293,7 +293,7 @@ func (k *Kubernetes) GetDefaultStorageClassName(ctx context.Context) (string, er
 	return "", errors.New("no storage classes available")
 }
 
-// GetClusterType tries to guess the underlying kubernetes cluster based on storage class
+// GetClusterType tries to guess the underlying kubernetes cluster based on storage class.
 func (k *Kubernetes) GetClusterType(ctx context.Context) (ClusterType, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
@@ -314,7 +314,7 @@ func (k *Kubernetes) GetClusterType(ctx context.Context) (ClusterType, error) {
 	return ClusterTypeGeneric, nil
 }
 
-// getOperatorVersion parses operator version from operator deployment
+// getOperatorVersion parses operator version from operator deployment.
 func (k *Kubernetes) getOperatorVersion(ctx context.Context, deploymentName, containerName string) (string, error) {
 	deployment, err := k.client.GetDeployment(ctx, deploymentName)
 	if err != nil {
@@ -328,7 +328,7 @@ func (k *Kubernetes) getOperatorVersion(ctx context.Context, deploymentName, con
 	return "", errors.New("unknown version of operator")
 }
 
-// GetPSMDBOperatorVersion parses PSMDB operator version from operator deployment
+// GetPSMDBOperatorVersion parses PSMDB operator version from operator deployment.
 func (k *Kubernetes) GetPSMDBOperatorVersion(ctx context.Context) (string, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
@@ -342,21 +342,21 @@ func (k *Kubernetes) GetPXCOperatorVersion(ctx context.Context) (string, error)
 	return k.getOperatorVersion(ctx, pxcDeploymentName, pxcOperatorContainerName)
 }
 
-// GetDBaaSOperatorVersion parses DBaaS operator version from operator deployment
+// GetDBaaSOperatorVersion parses DBaaS operator version from operator deployment.
 func (k *Kubernetes) GetDBaaSOperatorVersion(ctx context.Context) (string, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
 	return k.getOperatorVersion(ctx, dbaasDeploymentName, dbaasOperatorContainerName)
 }
 
-// GetSecret returns secret by name
+// GetSecret returns secret by name.
 func (k *Kubernetes) GetSecret(ctx context.Context, name string) (*corev1.Secret, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
 	return k.client.GetSecret(ctx, name)
 }
 
-// ListSecrets returns secret by name
+// ListSecrets returns secret by name.
 func (k *Kubernetes) ListSecrets(ctx context.Context) (*corev1.SecretList, error) {
 	k.lock.RLock()
 	defer k.lock.RUnlock()
@@ -912,7 +912,7 @@ func (k *Kubernetes) UpgradeOperator(ctx context.Context, namespace, name string
 	return err
 }
 
-// GetServerVersion returns server version
+// GetServerVersion returns server version.
 func (k *Kubernetes) GetServerVersion() (*version.Info, error) {
 	return k.client.GetServerVersion()
 }
diff --git a/managed/services/management/backup/backups_service.go b/managed/services/management/backup/backups_service.go
index ff7e48fa93..73601293fc 100644
--- a/managed/services/management/backup/backups_service.go
+++ b/managed/services/management/backup/backups_service.go
@@ -660,7 +660,6 @@ func convertError(e error) error {
 
 	var code backuppb.ErrorCode
 	switch {
-
 	case errors.Is(e, backup.ErrXtrabackupNotInstalled):
 		code = backuppb.ErrorCode_ERROR_CODE_XTRABACKUP_NOT_INSTALLED
 	case errors.Is(e, backup.ErrInvalidXtrabackup):
diff --git a/managed/services/management/grpc/actions_server.go b/managed/services/management/grpc/actions_server.go
index cfcfdac444..b1c2ba947a 100644
--- a/managed/services/management/grpc/actions_server.go
+++ b/managed/services/management/grpc/actions_server.go
@@ -340,7 +340,7 @@ func (s *actionsServer) StartPostgreSQLShowIndexAction(ctx context.Context, req
 	}, nil
 }
 
-// StartMongoDBExplainAction starts MongoDB Explain action
+// StartMongoDBExplainAction starts MongoDB Explain action.
 func (s *actionsServer) StartMongoDBExplainAction(ctx context.Context, req *managementpb.StartMongoDBExplainActionRequest) (
 	*managementpb.StartMongoDBExplainActionResponse, error,
 ) {
diff --git a/managed/services/management/grpc/mongodb_server.go b/managed/services/management/grpc/mongodb_server.go
index 8836f2f230..201b04fd10 100644
--- a/managed/services/management/grpc/mongodb_server.go
+++ b/managed/services/management/grpc/mongodb_server.go
@@ -22,7 +22,7 @@ import (
 	"github.com/percona/pmm/managed/services/management"
 )
 
-// TODO merge into ../mongodb.go
+// TODO merge into ../mongodb.go.
 type mongoDBServer struct {
 	svc *management.MongoDBService
 
diff --git a/managed/services/management/grpc/mysql_server.go b/managed/services/management/grpc/mysql_server.go
index 43048d48cc..6753a6c4db 100644
--- a/managed/services/management/grpc/mysql_server.go
+++ b/managed/services/management/grpc/mysql_server.go
@@ -22,7 +22,7 @@ import (
 	"github.com/percona/pmm/managed/services/management"
 )
 
-// TODO merge into ../mysql.go
+// TODO merge into ../mysql.go.
 type mySQLServer struct {
 	svc *management.MySQLService
 
diff --git a/managed/services/management/grpc/node_server.go b/managed/services/management/grpc/node_server.go
index e8922fc62c..1191ee3081 100644
--- a/managed/services/management/grpc/node_server.go
+++ b/managed/services/management/grpc/node_server.go
@@ -22,7 +22,7 @@ import (
 	"github.com/percona/pmm/managed/services/management"
 )
 
-// TODO merge into ../node.go
+// TODO merge into ../node.go.
 type nodeServer struct {
 	svc *management.NodeService
 
diff --git a/managed/services/management/grpc/postgresql_server.go b/managed/services/management/grpc/postgresql_server.go
index 80aa8de52a..2908045b4c 100644
--- a/managed/services/management/grpc/postgresql_server.go
+++ b/managed/services/management/grpc/postgresql_server.go
@@ -22,7 +22,7 @@ import (
 	"github.com/percona/pmm/managed/services/management"
 )
 
-// TODO merge into ../postgresql.go
+// TODO merge into ../postgresql.go.
 type postgreSQLServer struct {
 	svc *management.PostgreSQLService
 
diff --git a/managed/services/management/grpc/proxysql_server.go b/managed/services/management/grpc/proxysql_server.go
index d548cb62bc..7e8456fbca 100644
--- a/managed/services/management/grpc/proxysql_server.go
+++ b/managed/services/management/grpc/proxysql_server.go
@@ -22,7 +22,7 @@ import (
 	"github.com/percona/pmm/managed/services/management"
 )
 
-// TODO merge into ../proxysql.go
+// TODO merge into ../proxysql.go.
 type proxySQLServer struct {
 	svc *management.ProxySQLService
 
diff --git a/managed/services/management/ia/rules_service.go b/managed/services/management/ia/rules_service.go
index e6034cce40..9b196d21e0 100644
--- a/managed/services/management/ia/rules_service.go
+++ b/managed/services/management/ia/rules_service.go
@@ -374,7 +374,7 @@ func (s *RulesService) CreateAlertRule(ctx context.Context, req *iav1beta1.Creat
 		return nil, err
 	}
 
-	if req.TemplateName != "" {
+	if req.TemplateName != "" { //nolint:nestif
 		template, ok := s.templates.GetTemplates()[req.TemplateName]
 		if !ok {
 			return nil, status.Errorf(codes.NotFound, "Unknown template %s.", req.TemplateName)
diff --git a/managed/services/telemetry/telemetry.go b/managed/services/telemetry/telemetry.go
index 867f31f211..99b491b0e9 100644
--- a/managed/services/telemetry/telemetry.go
+++ b/managed/services/telemetry/telemetry.go
@@ -169,7 +169,7 @@ func (s *Service) DistributionMethod() serverpb.DistributionMethod {
 func (s *Service) processSendCh(ctx context.Context) {
 	var reportsBufSync sync.Mutex
 	var reportsBuf []*pmmv1.ServerMetric
-	var sendCtx context.Context
+	var sendCtx context.Context //nolint:contextcheck
 	var cancel context.CancelFunc
 
 	for {
diff --git a/update/ansible/playbook/tasks/roles/clickhouse/tasks/main.yml b/update/ansible/playbook/tasks/roles/clickhouse/tasks/main.yml
index 2fb89b954b..a6e441b4b0 100644
--- a/update/ansible/playbook/tasks/roles/clickhouse/tasks/main.yml
+++ b/update/ansible/playbook/tasks/roles/clickhouse/tasks/main.yml
@@ -1,6 +1,8 @@
 ---
 - name: Stop and remove clickhouse before update | EL7
-  when: ansible_distribution == 'CentOS' and ansible_distribution_major_version == '7'
+  when:
+    - ansible_distribution == 'CentOS'
+    - ansible_distribution_major_version == '7'
   command: supervisorctl {{ item }} clickhouse
   changed_when: True
   loop:
@@ -13,7 +15,11 @@
   register: supervisord_socket
 
 - name: Stop and remove clickhouse before update | EL9
-  when: supervisord_socket.stat.exists and (ansible_distribution == 'OracleLinux' or ansible_distribution == 'AlmaLinux') and ansible_distribution_major_version == '9'
+  when:
+    - supervisord_socket.stat.exists
+    - ansible_distribution == 'OracleLinux' or ansible_distribution == 'AlmaLinux'
+    - ansible_distribution_major_version == '9'
+    - not ansible_check_mode
   command: /usr/local/bin/supervisorctl {{ item }} clickhouse
   become: true
   loop: