diff --git a/provider/cmd/pulumi-gen-kubernetes/copy.go b/provider/cmd/pulumi-gen-kubernetes/copy.go
deleted file mode 100644
index 9c18a73884..0000000000
--- a/provider/cmd/pulumi-gen-kubernetes/copy.go
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2016-2019, Pulumi Corporation.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package main
-
-import (
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"path"
-)
-
-// CopyFile copies a single file from src to dst
-// From https://blog.depado.eu/post/copy-files-and-directories-in-go
-func CopyFile(src, dst string) error {
-	var err error
-	var srcfd *os.File
-	var dstfd *os.File
-	var srcinfo os.FileInfo
-
-	if srcfd, err = os.Open(src); err != nil {
-		return err
-	}
-	defer srcfd.Close()
-
-	if dstfd, err = os.Create(dst); err != nil {
-		return err
-	}
-	defer dstfd.Close()
-
-	if _, err = io.Copy(dstfd, srcfd); err != nil {
-		return err
-	}
-	if srcinfo, err = os.Stat(src); err != nil {
-		return err
-	}
-	return os.Chmod(dst, srcinfo.Mode())
-}
-
-// CopyDir copies a whole directory recursively
-// From https://blog.depado.eu/post/copy-files-and-directories-in-go
-func CopyDir(src string, dst string) error {
-	var err error
-	var fds []os.FileInfo
-	var srcinfo os.FileInfo
-
-	if srcinfo, err = os.Stat(src); err != nil {
-		return err
-	}
-
-	if err = os.MkdirAll(dst, srcinfo.Mode()); err != nil {
-		return err
-	}
-
-	if fds, err = ioutil.ReadDir(src); err != nil {
-		return err
-	}
-	for _, fd := range fds {
-		srcfp := path.Join(src, fd.Name())
-		dstfp := path.Join(dst, fd.Name())
-
-		if fd.IsDir() {
-			if err = CopyDir(srcfp, dstfp); err != nil {
-				fmt.Println(err)
-			}
-		} else {
-			if err = CopyFile(srcfp, dstfp); err != nil {
-				fmt.Println(err)
-			}
-		}
-	}
-	return nil
-}
diff --git a/provider/cmd/pulumi-gen-kubernetes/download.go b/provider/cmd/pulumi-gen-kubernetes/download.go
index 63dfca804e..54c0e7ad67 100644
--- a/provider/cmd/pulumi-gen-kubernetes/download.go
+++ b/provider/cmd/pulumi-gen-kubernetes/download.go
@@ -19,6 +19,8 @@ import (
 	"io"
 	"net/http"
 	"os"
+
+	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 )
 
 func DownloadFile(filepath string, url string) (err error) {
@@ -32,7 +34,7 @@ func DownloadFile(filepath string, url string) (err error) {
 	if err != nil {
 		return err
 	}
-	defer out.Close()
+	defer contract.IgnoreClose(out)
 
 	// Get the data
 	// nolint: gosec
@@ -40,7 +42,7 @@ func DownloadFile(filepath string, url string) (err error) {
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer contract.IgnoreClose(resp.Body)
 
 	// Check server response
 	if resp.StatusCode != http.StatusOK {
diff --git a/provider/cmd/pulumi-gen-kubernetes/main.go b/provider/cmd/pulumi-gen-kubernetes/main.go
index 8d704b7b63..644f897694 100644
--- a/provider/cmd/pulumi-gen-kubernetes/main.go
+++ b/provider/cmd/pulumi-gen-kubernetes/main.go
@@ -21,7 +21,6 @@ import (
 	"flag"
 	"fmt"
 	"go/format"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -109,7 +108,7 @@ func main() {
 
 func readSchema(schemaPath string, version string) *schema.Package {
 	// Read in, decode, and import the schema.
-	schemaBytes, err := ioutil.ReadFile(schemaPath)
+	schemaBytes, err := os.ReadFile(schemaPath)
 	if err != nil {
 		panic(err)
 	}
@@ -128,7 +127,7 @@ func readSchema(schemaPath string, version string) *schema.Package {
 }
 
 func generateSchema(swaggerPath string) schema.PackageSpec {
-	swagger, err := ioutil.ReadFile(swaggerPath)
+	swagger, err := os.ReadFile(swaggerPath)
 	if err != nil {
 		panic(err)
 	}
@@ -150,7 +149,7 @@ func generateSchema(swaggerPath string) schema.PackageSpec {
 		if err != nil {
 			panic(err)
 		}
-		legacySwagger, err := ioutil.ReadFile(legacySwaggerPath)
+		legacySwagger, err := os.ReadFile(legacySwaggerPath)
 		if err != nil {
 			panic(err)
 		}
@@ -331,7 +330,7 @@ func writeDotnetClient(pkg *schema.Package, outdir, templateDir string) {
 		if err = os.MkdirAll(filepath.Dir(path), 0755); err != nil {
 			panic(err)
 		}
-		err := ioutil.WriteFile(path, contents, 0644)
+		err := os.WriteFile(path, contents, 0644)
 		if err != nil {
 			panic(err)
 		}
@@ -409,7 +408,7 @@ func writeGoClient(pkg *schema.Package, outdir string, templateDir string) {
 }
 
 func mustLoadFile(path string) []byte {
-	b, err := ioutil.ReadFile(path)
+	b, err := os.ReadFile(path)
 	if err != nil {
 		panic(err)
 	}
@@ -453,7 +452,7 @@ func genK8sResourceTypes(pkg *schema.Package) {
 			continue
 		}
 		parts := strings.Split(resource.Token, ":")
-		contract.Assert(len(parts) == 3)
+		contract.Assertf(len(parts) == 3, "expected resource token to have three elements: %s", resource.Token)
 
 		groupVersion, kind := parts[1], parts[2]
 
@@ -491,7 +490,7 @@ func mustWriteFile(rootDir, filename string, contents []byte) {
 	if err := os.MkdirAll(filepath.Dir(outPath), 0755); err != nil {
 		panic(err)
 	}
-	err := ioutil.WriteFile(outPath, contents, 0644)
+	err := os.WriteFile(outPath, contents, 0644)
 	if err != nil {
 		panic(err)
 	}
diff --git a/provider/cmd/pulumi-resource-kubernetes/generate.go b/provider/cmd/pulumi-resource-kubernetes/generate.go
index 6f3d6f4945..d169c84339 100644
--- a/provider/cmd/pulumi-resource-kubernetes/generate.go
+++ b/provider/cmd/pulumi-resource-kubernetes/generate.go
@@ -19,7 +19,6 @@ package main
 
 import (
 	"encoding/json"
-	"io/ioutil"
 	"log"
 	"os"
 
@@ -32,7 +31,7 @@ func main() {
 		log.Fatal("version not found")
 	}
 
-	schemaContents, err := ioutil.ReadFile("./schema.json")
+	schemaContents, err := os.ReadFile("./schema.json")
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -49,7 +48,7 @@ func main() {
 		log.Fatalf("cannot reserialize schema: %v", err)
 	}
 
-	err = ioutil.WriteFile("./schema-embed.json", versionedContents, 0600)
+	err = os.WriteFile("./schema-embed.json", versionedContents, 0600)
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/provider/pkg/gen/_go-templates/yaml/yaml.tmpl b/provider/pkg/gen/_go-templates/yaml/yaml.tmpl
index ec3fe8471b..ce62549d42 100644
--- a/provider/pkg/gen/_go-templates/yaml/yaml.tmpl
+++ b/provider/pkg/gen/_go-templates/yaml/yaml.tmpl
@@ -19,9 +19,10 @@ package yaml
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"path/filepath"
 
 	"github.com/pkg/errors"
@@ -52,7 +53,7 @@ func parseDecodeYamlFiles(ctx *pulumi.Context, args *ConfigGroupArgs, glob bool,
 				return nil, errors.Wrapf(err, "fetching YAML over network")
 			}
 			defer resp.Body.Close()
-			yaml, err = ioutil.ReadAll(resp.Body)
+			yaml, err = io.ReadAll(resp.Body)
 			if err != nil {
 				return nil, errors.Wrapf(err, "reading YAML over network")
 			}
@@ -70,7 +71,7 @@ func parseDecodeYamlFiles(ctx *pulumi.Context, args *ConfigGroupArgs, glob bool,
 				files = []string{file}
 			}
 			for _, f := range files {
-				yaml, err = ioutil.ReadFile(f)
+				yaml, err = os.ReadFile(f)
 				if err != nil {
 					return nil, errors.Wrapf(err, "reading YAML file from disk")
 				}
diff --git a/provider/pkg/gen/examples/upstream/generate.go b/provider/pkg/gen/examples/upstream/generate.go
index 4675253839..496c8cc9da 100644
--- a/provider/pkg/gen/examples/upstream/generate.go
+++ b/provider/pkg/gen/examples/upstream/generate.go
@@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -25,7 +24,7 @@ func main() {
 
 	if !filepath.IsAbs(yamlPath) {
 		cwd, err := os.Getwd()
-		contract.AssertNoError(err)
+		contract.AssertNoErrorf(err, "unexpected error while fetching working directory")
 		yamlPath = filepath.Join(cwd, yamlPath)
 	}
 
@@ -100,7 +99,7 @@ func processYaml(path string, mdDir string) error {
 
 		description := example["description"].(string)
 		fmt.Fprintf(os.Stdout, "Processing %s\n", description)
-		dir, err := ioutil.TempDir("", "")
+		dir, err := os.MkdirTemp("", "")
 		if err != nil {
 			return err
 		}
@@ -119,7 +118,7 @@ func processYaml(path string, mdDir string) error {
 		if err = yaml.NewEncoder(src).Encode(example); err != nil {
 			return err
 		}
-		contract.AssertNoError(src.Close())
+		contract.AssertNoErrorf(src.Close(), "unexpected error while encoding YAML")
 
 		cmd := exec.Command("pulumi", "convert", "--language", "typescript", "--out",
 			filepath.Join(dir, "example-nodejs"))
@@ -129,7 +128,7 @@ func processYaml(path string, mdDir string) error {
 		if err = cmd.Run(); err != nil {
 			_, _ = fmt.Fprintf(os.Stderr, "convert nodejs failed, ignoring: %+v", err)
 		}
-		content, err := ioutil.ReadFile(filepath.Join(dir, "example-nodejs", "index.ts"))
+		content, err := os.ReadFile(filepath.Join(dir, "example-nodejs", "index.ts"))
 		if err != nil {
 			return err
 		}
@@ -143,7 +142,7 @@ func processYaml(path string, mdDir string) error {
 		if err := cmd.Run(); err != nil {
 			_, _ = fmt.Fprintf(os.Stderr, "convert python failed, ignoring: %+v", err)
 		}
-		content, err = ioutil.ReadFile(filepath.Join(dir, "example-py", "__main__.py"))
+		content, err = os.ReadFile(filepath.Join(dir, "example-py", "__main__.py"))
 		if err != nil {
 			return err
 		}
@@ -157,7 +156,7 @@ func processYaml(path string, mdDir string) error {
 		if err = cmd.Run(); err != nil {
 			_, _ = fmt.Fprintf(os.Stderr, "convert go failed, ignoring: %+v", err)
 		}
-		content, err = ioutil.ReadFile(filepath.Join(dir, "example-dotnet", "MyStack.cs"))
+		content, err = os.ReadFile(filepath.Join(dir, "example-dotnet", "MyStack.cs"))
 		if err != nil {
 			return err
 		}
@@ -171,7 +170,7 @@ func processYaml(path string, mdDir string) error {
 		if err = cmd.Run(); err != nil {
 			_, _ = fmt.Fprintf(os.Stderr, "convert go failed, ignoring: %+v", err)
 		}
-		content, err = ioutil.ReadFile(filepath.Join(dir, "example-go", "main.go"))
+		content, err = os.ReadFile(filepath.Join(dir, "example-go", "main.go"))
 		if err != nil {
 			return err
 		}
@@ -179,7 +178,7 @@ func processYaml(path string, mdDir string) error {
 
 		// TODO add java when convert supports it.
 
-		content, err = ioutil.ReadFile(filepath.Join(dir, "Pulumi.yaml"))
+		content, err = os.ReadFile(filepath.Join(dir, "Pulumi.yaml"))
 		if err != nil {
 			return err
 		}
@@ -187,7 +186,6 @@ func processYaml(path string, mdDir string) error {
 
 		exampleStrings = append(exampleStrings, markdownExample(description, typescript, python, csharp, golang, yaml))
 	}
-	contract.AssertNoError(err)
 	fmt.Fprintf(os.Stdout, "Writing %s\n", filepath.Join(mdDir, md))
 	f, err := os.OpenFile(filepath.Join(mdDir, md), os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0777)
 	if err != nil {
@@ -195,6 +193,6 @@ func processYaml(path string, mdDir string) error {
 	}
 	defer contract.IgnoreClose(f)
 	_, err = f.Write([]byte(markdownExamples(exampleStrings)))
-	contract.AssertNoError(err)
+	contract.AssertNoErrorf(err, "unexpected error while writing markdown examples")
 	return nil
 }
diff --git a/provider/pkg/gen/schema.go b/provider/pkg/gen/schema.go
index 8f4c15ddfc..0a8d5c4d37 100644
--- a/provider/pkg/gen/schema.go
+++ b/provider/pkg/gen/schema.go
@@ -271,7 +271,7 @@ func PulumiSchema(swagger map[string]interface{}) pschema.PackageSpec {
 
 				var propNames []string
 				for _, p := range kind.Properties() {
-					objectSpec.Properties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind)
+					objectSpec.Properties[p.name] = genPropertySpec(p, kind.kind)
 					propNames = append(propNames, p.name)
 				}
 				for _, p := range kind.RequiredInputProperties() {
@@ -312,7 +312,7 @@ func PulumiSchema(swagger map[string]interface{}) pschema.PackageSpec {
 
 					var propNames []string
 					for _, p := range kind.Properties() {
-						patchSpec.Properties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind+"Patch")
+						patchSpec.Properties[p.name] = genPropertySpec(p, kind.kind+"Patch")
 						propNames = append(propNames, p.name)
 					}
 
@@ -350,11 +350,11 @@ func PulumiSchema(swagger map[string]interface{}) pschema.PackageSpec {
 				}
 
 				for _, p := range kind.RequiredInputProperties() {
-					resourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind)
+					resourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.kind)
 					resourceSpec.RequiredInputs = append(resourceSpec.RequiredInputs, p.name)
 				}
 				for _, p := range kind.OptionalInputProperties() {
-					resourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind)
+					resourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.kind)
 				}
 
 				for _, t := range kind.Aliases() {
@@ -390,10 +390,10 @@ func PulumiSchema(swagger map[string]interface{}) pschema.PackageSpec {
 					}
 
 					for _, p := range kind.RequiredInputProperties() {
-						patchResourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind+"Patch")
+						patchResourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.kind+"Patch")
 					}
 					for _, p := range kind.OptionalInputProperties() {
-						patchResourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.apiVersion, kind.kind+"Patch")
+						patchResourceSpec.InputProperties[p.name] = genPropertySpec(p, kind.kind+"Patch")
 					}
 
 					for _, t := range kind.Aliases() {
@@ -539,10 +539,10 @@ If this is your first time using this package, these two resources may be helpfu
 	return pkg
 }
 
-func genPropertySpec(p Property, resourceGV string, resourceKind string) pschema.PropertySpec {
+func genPropertySpec(p Property, resourceKind string) pschema.PropertySpec {
 	var typ pschema.TypeSpec
 	err := json.Unmarshal([]byte(p.SchemaType()), &typ)
-	contract.Assert(err == nil)
+	contract.AssertNoErrorf(err, "unexpected error while unmarshalling JSON")
 
 	if strings.HasSuffix(resourceKind, "Patch") {
 		if len(typ.Ref) > 0 && !strings.Contains(typ.Ref, "pulumi.json#") {
@@ -612,6 +612,6 @@ func rawMessage(v interface{}) pschema.RawMessage {
 	encoder := json.NewEncoder(&out)
 	encoder.SetEscapeHTML(false)
 	err := encoder.Encode(v)
-	contract.Assert(err == nil)
+	contract.AssertNoErrorf(err, "unexpected error while encoding JSON")
 	return out.Bytes()
 }
diff --git a/provider/pkg/gen/typegen.go b/provider/pkg/gen/typegen.go
index 330c58710b..dafafc8e0b 100644
--- a/provider/pkg/gen/typegen.go
+++ b/provider/pkg/gen/typegen.go
@@ -21,7 +21,7 @@ import (
 	"regexp"
 	"strings"
 
-	linq "github.com/ahmetb/go-linq"
+	"github.com/ahmetb/go-linq"
 	pschema "github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -410,7 +410,7 @@ func makeSchemaTypeSpec(prop map[string]interface{}, canonicalGroups map[string]
 func makeSchemaType(prop map[string]interface{}, canonicalGroups map[string]string) string {
 	spec := makeSchemaTypeSpec(prop, canonicalGroups)
 	b, err := json.Marshal(spec)
-	contract.Assert(err == nil)
+	contract.AssertNoErrorf(err, "unexpected error while marshaling JSON")
 	return string(b)
 }
 
@@ -639,7 +639,7 @@ func createGroups(definitionsJSON map[string]interface{}) []GroupConfig {
 			schemaPkgName := func(gv string) string {
 				pkgName := strings.Replace(gv, ".k8s.io", "", -1)
 				parts := strings.Split(pkgName, "/")
-				contract.Assert(len(parts) == 2)
+				contract.Assertf(len(parts) == 2, "expected package name to have two parts: %s", pkgName)
 				g, v := parts[0], parts[1]
 				gParts := strings.Split(g, ".")
 				return fmt.Sprintf("%s/%s", gParts[0], v)
diff --git a/provider/pkg/gen/types.go b/provider/pkg/gen/types.go
index b352d7da00..fb39e1e45c 100644
--- a/provider/pkg/gen/types.go
+++ b/provider/pkg/gen/types.go
@@ -50,7 +50,7 @@ type TemplateResource struct {
 // rewritten to "", so resources in that Group look like "v1/Pod" rather than "core/v1/Pod".
 func (tr TemplateResource) GVK() string {
 	parts := strings.Split(tr.Token, ":")
-	contract.Assert(len(parts) == 3)
+	contract.Assertf(len(parts) == 3, "expected token to have three parts: %s", tr.Token)
 	gvk := parts[1] + "/" + parts[2]
 	return strings.TrimPrefix(gvk, "core/")
 }
@@ -118,7 +118,7 @@ type GroupVersion string
 // Example: apps/v1beta1 -> AppsV1B1
 func (gv GroupVersion) GVConstName() string {
 	parts := strings.Split(string(gv), "/")
-	contract.Assert(len(parts) == 2)
+	contract.Assertf(len(parts) == 2, "expected GroupVersion to have two parts: %s", gv)
 
 	group, version := parts[0], parts[1]
 	groupName := strings.Title(strings.SplitN(group, ".", 2)[0])
diff --git a/provider/pkg/metadata/naming.go b/provider/pkg/metadata/naming.go
index 07bd7d3fd2..ed5de80dc7 100644
--- a/provider/pkg/metadata/naming.go
+++ b/provider/pkg/metadata/naming.go
@@ -15,20 +15,15 @@
 package metadata
 
 import (
-	"math/rand"
-	"time"
-
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
-var dns1123Alphabet = []rune("abcdefghijklmnopqrstuvwxyz0123456789")
-
 // AssignNameIfAutonamable generates a name for an object. Uses DNS-1123-compliant characters.
 // All auto-named resources get the annotation `pulumi.com/autonamed` for tooling purposes.
 func AssignNameIfAutonamable(randomSeed []byte, obj *unstructured.Unstructured, propMap resource.PropertyMap, urn resource.URN) {
-	contract.Assert(urn.Name().String() != "")
+	contract.Assertf(urn.Name().String() != "", "expected non-empty name in URN: %s", urn)
 	// Check if the .metadata.name is set and is a computed value. If so, do not auto-name.
 	if md, ok := propMap["metadata"].V.(resource.PropertyMap); ok {
 		if name, ok := md["name"]; ok && name.IsComputed() {
@@ -39,7 +34,7 @@ func AssignNameIfAutonamable(randomSeed []byte, obj *unstructured.Unstructured,
 	if obj.GetName() == "" {
 		prefix := urn.Name().String() + "-"
 		autoname, err := resource.NewUniqueName(randomSeed, prefix, 0, 0, nil)
-		contract.AssertNoError(err)
+		contract.AssertNoErrorf(err, "unexpected error while creating NewUniqueName")
 		obj.SetName(autoname)
 		SetAnnotationTrue(obj, AnnotationAutonamed)
 	}
@@ -48,7 +43,7 @@ func AssignNameIfAutonamable(randomSeed []byte, obj *unstructured.Unstructured,
 // AdoptOldAutonameIfUnnamed checks if `newObj` has a name, and if not, "adopts" the name of `oldObj`
 // instead. If `oldObj` was autonamed, then we mark `newObj` as autonamed, too.
 func AdoptOldAutonameIfUnnamed(newObj, oldObj *unstructured.Unstructured) {
-	contract.Assert(oldObj.GetName() != "")
+	contract.Assertf(oldObj.GetName() != "", "expected nonempty name for object: %s", oldObj)
 	if newObj.GetName() == "" && IsAutonamed(oldObj) {
 		newObj.SetName(oldObj.GetName())
 		SetAnnotationTrue(newObj, AnnotationAutonamed)
@@ -58,17 +53,3 @@ func AdoptOldAutonameIfUnnamed(newObj, oldObj *unstructured.Unstructured) {
 func IsAutonamed(obj *unstructured.Unstructured) bool {
 	return IsAnnotationTrue(obj, AnnotationAutonamed)
 }
-
-func RandString(n int) string {
-	b := make([]rune, n)
-	for i := range b {
-		// nolint:gosec
-		b[i] = dns1123Alphabet[rand.Intn(len(dns1123Alphabet))]
-	}
-	return string(b)
-}
-
-// Seed RNG to get different random names at each suffix.
-func init() {
-	rand.Seed(time.Now().UTC().UnixNano())
-}
diff --git a/provider/pkg/provider/custom.go b/provider/pkg/provider/custom.go
index deb19924d6..eef58b8eff 100644
--- a/provider/pkg/provider/custom.go
+++ b/provider/pkg/provider/custom.go
@@ -4,6 +4,7 @@ package provider
 
 import (
 	"context"
+
 	"github.com/golang/protobuf/ptypes/empty"
 	pulumirpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 )
diff --git a/provider/pkg/provider/helm_release.go b/provider/pkg/provider/helm_release.go
index 1da25b4a24..3f03bbd1c6 100644
--- a/provider/pkg/provider/helm_release.go
+++ b/provider/pkg/provider/helm_release.go
@@ -633,7 +633,7 @@ func adoptOldNameIfUnnamed(new, old resource.PropertyMap) {
 	if _, ok := new["name"]; ok {
 		return
 	}
-	contract.Assert(old["name"].StringValue() != "")
+	contract.Assertf(old["name"].StringValue() != "", "expected 'name' value to be nonempty: %v", old)
 	new["name"] = old["name"]
 }
 
@@ -642,7 +642,7 @@ func assignNameIfAutonameable(pm resource.PropertyMap, urn resource.URN) {
 	if !ok || (name.IsString() && name.StringValue() == "") {
 		prefix := urn.Name().String() + "-"
 		autoname, err := resource.NewUniqueHex(prefix, 0, 0)
-		contract.AssertNoError(err)
+		contract.AssertNoErrorf(err, "unexpected error while executing NewUniqueHex")
 		pm["name"] = resource.NewStringProperty(autoname)
 	}
 }
@@ -966,7 +966,7 @@ func (r *helmReleaseProvider) Read(ctx context.Context, req *pulumirpc.ReadReque
 
 func (r *helmReleaseProvider) serializeImportInputs(release *Release) resource.PropertyMap {
 	inputs := resource.NewPropertyMap(release)
-	delete(inputs, resource.PropertyKey("status"))
+	delete(inputs, "status")
 	return inputs
 }
 
diff --git a/provider/pkg/provider/invoke_decode_yaml.go b/provider/pkg/provider/invoke_decode_yaml.go
index 0309db692d..7df0667a17 100644
--- a/provider/pkg/provider/invoke_decode_yaml.go
+++ b/provider/pkg/provider/invoke_decode_yaml.go
@@ -16,7 +16,6 @@ package provider
 
 import (
 	"io"
-	"io/ioutil"
 	"strings"
 
 	"github.com/pulumi/pulumi-kubernetes/provider/v3/pkg/clients"
@@ -29,7 +28,7 @@ import (
 func decodeYaml(text, defaultNamespace string, clientSet *clients.DynamicClientSet) ([]interface{}, error) {
 	var resources []unstructured.Unstructured
 
-	dec := yaml.NewYAMLOrJSONDecoder(ioutil.NopCloser(strings.NewReader(text)), 128)
+	dec := yaml.NewYAMLOrJSONDecoder(io.NopCloser(strings.NewReader(text)), 128)
 	for {
 		var value map[string]interface{}
 		if err := dec.Decode(&value); err != nil {
diff --git a/provider/pkg/provider/invoke_helm_template.go b/provider/pkg/provider/invoke_helm_template.go
index 7bdd903f8f..10645d847b 100644
--- a/provider/pkg/provider/invoke_helm_template.go
+++ b/provider/pkg/provider/invoke_helm_template.go
@@ -16,7 +16,6 @@ package provider
 
 import (
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -25,6 +24,7 @@ import (
 
 	pkgerrors "github.com/pkg/errors"
 	"github.com/pulumi/pulumi-kubernetes/provider/v3/pkg/clients"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 	logger "github.com/pulumi/pulumi/sdk/v3/go/common/util/logging"
 	"helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/chart/loader"
@@ -37,7 +37,7 @@ import (
 )
 
 // testHookAnnotation matches test-related Helm hook annotations (test, test-success, test-failure)
-var testHookAnnotation = regexp.MustCompile(`"?helm.sh\/hook"?:.*test`)
+var testHookAnnotation = regexp.MustCompile(`"?helm.sh/hook"?:.*test`)
 
 type HelmFetchOpts struct {
 	CAFile      string `json:"ca_file,omitempty"`
@@ -76,11 +76,11 @@ type HelmChartOpts struct {
 // helmTemplate performs Helm fetch/pull + template operations and returns the resulting YAML manifest based on the
 // provided chart options.
 func helmTemplate(opts HelmChartOpts, clientSet *clients.DynamicClientSet) (string, error) {
-	tempDir, err := ioutil.TempDir("", "helm")
+	tempDir, err := os.MkdirTemp("", "helm")
 	if err != nil {
 		return "", err
 	}
-	defer os.RemoveAll(tempDir)
+	defer contract.IgnoreError(os.RemoveAll(tempDir))
 	logger.V(9).Infof("Will download to: %q", tempDir)
 	chart := &chart{
 		opts:     opts,
diff --git a/provider/pkg/provider/invoke_kustomize.go b/provider/pkg/provider/invoke_kustomize.go
index 76fa5e624c..827a24d13a 100644
--- a/provider/pkg/provider/invoke_kustomize.go
+++ b/provider/pkg/provider/invoke_kustomize.go
@@ -15,11 +15,11 @@
 package provider
 
 import (
-	"io/ioutil"
 	"os"
 
 	"github.com/pkg/errors"
 	"github.com/pulumi/pulumi-kubernetes/provider/v3/pkg/clients"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/workspace"
 	"sigs.k8s.io/kustomize/api/krusty"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
@@ -36,10 +36,10 @@ func kustomizeDirectory(directory string, clientSet *clients.DynamicClientSet) (
 
 		// Create a temp dir.
 		var temp string
-		if temp, err = ioutil.TempDir("", "kustomize-"); err != nil {
+		if temp, err = os.MkdirTemp("", "kustomize-"); err != nil {
 			return nil, errors.Wrap(err, "failed to create temp directory for remote kustomize directory")
 		}
-		defer os.RemoveAll(temp)
+		defer contract.IgnoreError(os.RemoveAll(temp))
 
 		path, err = workspace.RetrieveGitFolder(directory, temp)
 		if err != nil {
diff --git a/provider/pkg/provider/manifest_json.go b/provider/pkg/provider/manifest_json.go
index 4a499baba5..dc38fcba32 100644
--- a/provider/pkg/provider/manifest_json.go
+++ b/provider/pkg/provider/manifest_json.go
@@ -4,10 +4,10 @@ package provider
 
 import (
 	"fmt"
-	"github.com/pulumi/pulumi/pkg/v3/codegen"
-	logger "github.com/pulumi/pulumi/sdk/v3/go/common/util/logging"
 	"strings"
 
+	"github.com/pulumi/pulumi/pkg/v3/codegen"
+	logger "github.com/pulumi/pulumi/sdk/v3/go/common/util/logging"
 	"golang.org/x/crypto/sha3"
 	"helm.sh/helm/v3/pkg/releaseutil"
 	corev1 "k8s.io/api/core/v1"
diff --git a/provider/pkg/provider/provider.go b/provider/pkg/provider/provider.go
index b56466120e..81fc8fa0bb 100644
--- a/provider/pkg/provider/provider.go
+++ b/provider/pkg/provider/provider.go
@@ -19,7 +19,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -623,7 +622,7 @@ func (k *kubeProvider) Configure(_ context.Context, req *pulumirpc.ConfigureRequ
 		// If the variable is a valid filepath, load the file and parse the contents as a k8s config.
 		_, err := os.Stat(pathOrContents)
 		if err == nil {
-			b, err := ioutil.ReadFile(pathOrContents)
+			b, err := os.ReadFile(pathOrContents)
 			if err != nil {
 				unreachableCluster(err)
 			} else {
@@ -1124,7 +1123,7 @@ func (k *kubeProvider) StreamInvoke(
 		if err != nil {
 			return err
 		}
-		defer podLogs.Close()
+		defer contract.IgnoreClose(podLogs)
 
 		//
 		// Enumerate logs by line. Send back to the user.
@@ -1320,7 +1319,7 @@ func (k *kubeProvider) Check(ctx context.Context, req *pulumirpc.CheckRequest) (
 	if len(oldInputs.Object) > 0 {
 		// NOTE: If old inputs exist, they have a name, either provided by the user or filled in with a
 		// previous run of `Check`.
-		contract.Assert(oldInputs.GetName() != "")
+		contract.Assertf(oldInputs.GetName() != "", "expected object name to be nonempty: %v", oldInputs)
 		metadata.AdoptOldAutonameIfUnnamed(newInputs, oldInputs)
 
 		// If the resource has existing state, we only set the "managed-by: pulumi" label if it is already present. This
@@ -2870,7 +2869,7 @@ func (k *kubeProvider) fieldManagerName(
 	// for those calls, but the field manager name should have already been filled in via Check so this case
 	// shouldn't actually get hit.
 	fieldManager, err := resource.NewUniqueName(randomSeed, prefix, 0, 0, nil)
-	contract.AssertNoError(err)
+	contract.AssertNoErrorf(err, "unexpected error while creating NewUniqueName")
 
 	return fieldManager
 }
@@ -3119,8 +3118,8 @@ func convertPatchToDiff(
 	patch, oldLiveState, newInputs, oldInputs map[string]interface{}, forceNewFields ...string,
 ) (map[string]*pulumirpc.PropertyDiff, error) {
 
-	contract.Require(len(patch) != 0, "len(patch) != 0")
-	contract.Require(oldLiveState != nil, "oldLiveState != nil")
+	contract.Requiref(len(patch) != 0, "patch", "expected len() != 0")
+	contract.Requiref(oldLiveState != nil, "oldLiveState", "expected != nil")
 
 	pc := &patchConverter{
 		forceNew: forceNewFields,
@@ -3430,7 +3429,7 @@ func renderYaml(resource *unstructured.Unstructured, yamlDirectory string) error
 	}
 
 	path := renderPathForResource(resource, yamlDirectory)
-	err = ioutil.WriteFile(path, yamlBytes, 0600)
+	err = os.WriteFile(path, yamlBytes, 0600)
 	if err != nil {
 		return pkgerrors.Wrapf(err, "failed to write YAML file: %q", path)
 	}
diff --git a/provider/pkg/watcher/watcher.go b/provider/pkg/watcher/watcher.go
index 96ccea8462..5d0ffc5ec2 100644
--- a/provider/pkg/watcher/watcher.go
+++ b/provider/pkg/watcher/watcher.go
@@ -203,7 +203,3 @@ func RetryableError(err error) *RetryError {
 	}
 	return &RetryError{Err: err, Retryable: true}
 }
-
-func init() {
-	rand.Seed(time.Now().UTC().UnixNano())
-}
diff --git a/sdk/go/kubernetes/yaml/yaml.go b/sdk/go/kubernetes/yaml/yaml.go
index bcf31bb74e..6958db4316 100644
--- a/sdk/go/kubernetes/yaml/yaml.go
+++ b/sdk/go/kubernetes/yaml/yaml.go
@@ -19,9 +19,10 @@ package yaml
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"path/filepath"
 
 	"github.com/pkg/errors"
@@ -108,7 +109,7 @@ func parseDecodeYamlFiles(ctx *pulumi.Context, args *ConfigGroupArgs, glob bool,
 				return nil, errors.Wrapf(err, "fetching YAML over network")
 			}
 			defer resp.Body.Close()
-			yaml, err = ioutil.ReadAll(resp.Body)
+			yaml, err = io.ReadAll(resp.Body)
 			if err != nil {
 				return nil, errors.Wrapf(err, "reading YAML over network")
 			}
@@ -126,7 +127,7 @@ func parseDecodeYamlFiles(ctx *pulumi.Context, args *ConfigGroupArgs, glob bool,
 				files = []string{file}
 			}
 			for _, f := range files {
-				yaml, err = ioutil.ReadFile(f)
+				yaml, err = os.ReadFile(f)
 				if err != nil {
 					return nil, errors.Wrapf(err, "reading YAML file from disk")
 				}