diff --git a/.golangci.yml b/.golangci.yml
index 7623b5b89..4b008d16d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -19,17 +19,17 @@ linters:
     - dogsled
     - dupl
     - durationcheck
-#    - errcheck # TODO: enable going forward
-#    - errname # TODO: enable going forward
-#    - errorlint # TODO: enable going forward
-#    - exhaustive # TODO: enable going forward
+    - errcheck
+    - errname
+    - errorlint
+    - exhaustive
 #    - exhaustivestruct
     - exportloopref
 #    - forbidigo
-#    - forcetypeassert # TODO: enable going forward
+    - forcetypeassert
 #    - funlen
 #    - gci
-#    - gochecknoglobals
+    - gochecknoglobals
     - gochecknoinits
 #    - gocognit
     - goconst
@@ -37,19 +37,19 @@ linters:
     - gocyclo
 #    - godot
 #    - godox
-#    - goerr113 # TODO: enable going forward
+    - goerr113
     - gofmt
 #    - gofumpt
     - goheader
     - goimports
-#    - gomnd
+    - gomnd
     - gomoddirectives
     - gomodguard
     - goprintffuncname
     - gosec
     - gosimple
     - govet
-#    - ifshort
+#    - ifshort # too many false positives
     - importas
     - ineffassign
 #    - ireturn
@@ -57,14 +57,14 @@ linters:
     - makezero
     - misspell
     - nakedret
-#    - nestif # TODO: enable going forward
-#    - nilerr # TODO: enable going forward
+    - nestif
+    - nilerr
 #    - nilnil
 #    - nlreturn
 #    - noctx
     - nolintlint
 #    - paralleltest
-#    - prealloc # TODO: enable going forward
+    - prealloc
     - predeclared
     - promlinter
     - revive
@@ -75,7 +75,7 @@ linters:
 #    - stylecheck
     - tagliatelle
     - tenv
-#    - testpackage # TODO: enable going forward
+    - testpackage
     - thelper
     - tparallel
     - typecheck
@@ -86,7 +86,7 @@ linters:
 #    - varnamelen
     - wastedassign
     - whitespace
-#    - wrapcheck # TODO: enable going forward
+    - wrapcheck
 #    - wsl
 
 linters-settings:
@@ -107,8 +107,12 @@ linters-settings:
   gosec:
     config:
       G306: "0644"
+  gomnd:
+     ignored-functions:
+     - ioutil.WriteFile
 
 issues:
+  new-from-rev: c94b5d8f2 # enables us to enforce a larger set of linters for new code than pass on existing code
   max-same-issues: 0
   exclude-rules:
     - linters:
diff --git a/api/filters/imagetag/legacy.go b/api/filters/imagetag/legacy.go
index 66dcfc8c7..d6f5b33f2 100644
--- a/api/filters/imagetag/legacy.go
+++ b/api/filters/imagetag/legacy.go
@@ -6,6 +6,7 @@ package imagetag
 import (
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
@@ -81,7 +82,7 @@ func (f findFieldsFilter) walk(node *yaml.RNode) error {
 			return nil
 		})
 	case yaml.SequenceNode:
-		return node.VisitElements(f.walk)
+		return errors.Wrap(node.VisitElements(f.walk))
 	}
 	return nil
 }
diff --git a/cmd/config/internal/commands/run-fns.go b/cmd/config/internal/commands/run-fns.go
index b2c0fcef3..ee9446881 100644
--- a/cmd/config/internal/commands/run-fns.go
+++ b/cmd/config/internal/commands/run-fns.go
@@ -140,13 +140,13 @@ func (r *RunFnRunner) getContainerFunctions(dataItems []string) (
 	// set the function annotation on the function config, so that it is parsed by RunFns
 	value, err := fnAnnotation.String()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 	err = res.PipeE(
 		yaml.LookupCreate(yaml.MappingNode, "metadata", "annotations"),
 		yaml.SetField(runtimeutil.FunctionAnnotationKey, yaml.NewScalarRNode(value)))
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 
 	return []*yaml.RNode{res}, nil
@@ -206,14 +206,14 @@ data: {}
 func fnAnnotationForExec(path string) (*yaml.RNode, error) {
 	fn, err := yaml.Parse(`exec: {}`)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 
 	err = fn.PipeE(
 		yaml.Lookup("exec"),
 		yaml.SetField("path", yaml.NewScalarRNode(path)))
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 	return fn, nil
 }
@@ -221,7 +221,7 @@ func fnAnnotationForExec(path string) (*yaml.RNode, error) {
 func fnAnnotationForStar(path string, url string, name string) (*yaml.RNode, error) {
 	fn, err := yaml.Parse(`starlark: {}`)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 
 	if path != "" {
@@ -229,7 +229,7 @@ func fnAnnotationForStar(path string, url string, name string) (*yaml.RNode, err
 			yaml.Lookup("starlark"),
 			yaml.SetField("path", yaml.NewScalarRNode(path)))
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err)
 		}
 	}
 	if url != "" {
@@ -237,14 +237,14 @@ func fnAnnotationForStar(path string, url string, name string) (*yaml.RNode, err
 			yaml.Lookup("starlark"),
 			yaml.SetField("url", yaml.NewScalarRNode(url)))
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err)
 		}
 	}
 	err = fn.PipeE(
 		yaml.Lookup("starlark"),
 		yaml.SetField("name", yaml.NewScalarRNode(name)))
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 	return fn, nil
 }
@@ -252,14 +252,14 @@ func fnAnnotationForStar(path string, url string, name string) (*yaml.RNode, err
 func fnAnnotationForImage(image string, enableNetwork bool) (*yaml.RNode, error) {
 	fn, err := yaml.Parse(`container: {}`)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 	// TODO: add support network, volumes, etc based on flag values
 	err = fn.PipeE(
 		yaml.Lookup("container"),
 		yaml.SetField("image", yaml.NewScalarRNode(image)))
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err)
 	}
 	if enableNetwork {
 		n := &yaml.Node{
@@ -271,7 +271,7 @@ func fnAnnotationForImage(image string, enableNetwork bool) (*yaml.RNode, error)
 			yaml.Lookup("container"),
 			yaml.SetField("network", yaml.NewRNode(n)))
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err)
 		}
 	}
 	return fn, nil
diff --git a/cmd/pluginator/internal/krmfunction/converter.go b/cmd/pluginator/internal/krmfunction/converter.go
index 3c5b74853..a10491dd0 100644
--- a/cmd/pluginator/internal/krmfunction/converter.go
+++ b/cmd/pluginator/internal/krmfunction/converter.go
@@ -156,7 +156,7 @@ func (c *Converter) mkDstDir() error {
 func (c *Converter) write(m map[string]string) error {
 	for k, v := range m {
 		p := filepath.Join(c.outputDir, k)
-		err := ioutil.WriteFile(p, []byte(v), 0644) //nolint:gosec
+		err := ioutil.WriteFile(p, []byte(v), 0644)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/pluginator/internal/krmfunction/converter_test.go b/cmd/pluginator/internal/krmfunction/converter_test.go
index 15558ec46..6755a84dc 100644
--- a/cmd/pluginator/internal/krmfunction/converter_test.go
+++ b/cmd/pluginator/internal/krmfunction/converter_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func makeTempDir(t *testing.T) string {
@@ -120,13 +121,14 @@ func TestTransformerConverter(t *testing.T) {
 	dir := makeTempDir(t)
 	defer os.RemoveAll(dir)
 
-	ioutil.WriteFile(filepath.Join(dir, "Plugin.go"), // nolint: gosec
+	err := ioutil.WriteFile(filepath.Join(dir, "Plugin.go"),
 		getTransformerCode(), 0644)
+	require.NoError(t, err)
 
 	c := NewConverter(filepath.Join(dir, "output"),
 		filepath.Join(dir, "Plugin.go"))
 
-	err := c.Convert()
+	err = c.Convert()
 	assert.NoError(t, err)
 
 	output := runKrmFunction(t, getTransformerInputResource(), filepath.Join(dir, "output"))
@@ -217,13 +219,14 @@ func TestGeneratorConverter(t *testing.T) {
 	dir := makeTempDir(t)
 	defer os.RemoveAll(dir)
 
-	ioutil.WriteFile(filepath.Join(dir, "Plugin.go"), // nolint: gosec
+	err := ioutil.WriteFile(filepath.Join(dir, "Plugin.go"),
 		getGeneratorCode(), 0644)
+	require.NoError(t, err)
 
 	c := NewConverter(filepath.Join(dir, "output"),
 		filepath.Join(dir, "Plugin.go"))
 
-	err := c.Convert()
+	err = c.Convert()
 	assert.NoError(t, err)
 	output := runKrmFunction(t, getGeneratorInputResource(), filepath.Join(dir, "output"))
 	assert.Equal(t, `apiVersion: config.kubernetes.io/v1
diff --git a/kyaml/filesys/fsondisk.go b/kyaml/filesys/fsondisk.go
index 22bb845ee..4808f8d2e 100644
--- a/kyaml/filesys/fsondisk.go
+++ b/kyaml/filesys/fsondisk.go
@@ -9,6 +9,8 @@ import (
 	"log"
 	"os"
 	"path/filepath"
+
+	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 var _ FileSystem = fsOnDisk{}
@@ -128,7 +130,7 @@ func (fsOnDisk) ReadFile(name string) ([]byte, error) { return ioutil.ReadFile(n
 
 // WriteFile delegates to ioutil.WriteFile with read/write permissions.
 func (fsOnDisk) WriteFile(name string, c []byte) error {
-	return ioutil.WriteFile(name, c, 0666) //nolint:gosec
+	return errors.Wrap(ioutil.WriteFile(name, c, 0666)) //nolint:gosec
 }
 
 // Walk delegates to filepath.Walk.
diff --git a/kyaml/openapi/openapi.go b/kyaml/openapi/openapi.go
index bc36766a1..b503b8899 100644
--- a/kyaml/openapi/openapi.go
+++ b/kyaml/openapi/openapi.go
@@ -317,7 +317,7 @@ func toTypeMeta(ext interface{}) (yaml.TypeMeta, bool) {
 	}
 
 	apiVersion := m[versionKey].(string)
-	if g := m[groupKey].(string); g != "" {
+	if g, ok := m[groupKey].(string); ok && g != "" {
 		apiVersion = g + "/" + apiVersion
 	}
 	return yaml.TypeMeta{Kind: m[kindKey].(string), APIVersion: apiVersion}, true