diff --git a/build/codegen/codegen.sh b/build/codegen/codegen.sh
index e310db2c6..0e7380004 100755
--- a/build/codegen/codegen.sh
+++ b/build/codegen/codegen.sh
@@ -62,3 +62,6 @@ find "${scriptdir}/../../pkg/client" -name "*.go" -exec \
 find "${scriptdir}/../../pkg/client" -name "*.go" -exec \
     $SED 's/cephNFSs/cephNFSes/g' {} +
 find "${scriptdir}/../../pkg/client" -name "*.go.bak" -delete
+find "${scriptdir}/../../pkg/apis" -name "zz_generated.deepcopy.go" -exec \
+    $SED '/DO NOT EDIT./a // #nosec G601 Check for implicit memory aliasing of items from a range statement' {} +
+find "${scriptdir}/../../pkg/apis" -name "zz_generated.deepcopy.go.bak" -delete
diff --git a/pkg/apis/cassandra.rook.io/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/cassandra.rook.io/v1alpha1/zz_generated.deepcopy.go
index 731915d26..4aad13952 100644
--- a/pkg/apis/cassandra.rook.io/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/cassandra.rook.io/v1alpha1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1alpha1
 
diff --git a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
index c4de39f13..9330d6382 100644
--- a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1
 
diff --git a/pkg/apis/cockroachdb.rook.io/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/cockroachdb.rook.io/v1alpha1/zz_generated.deepcopy.go
index 9eda4448d..0baf5c416 100644
--- a/pkg/apis/cockroachdb.rook.io/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/cockroachdb.rook.io/v1alpha1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1alpha1
 
diff --git a/pkg/apis/edgefs.rook.io/v1/zz_generated.deepcopy.go b/pkg/apis/edgefs.rook.io/v1/zz_generated.deepcopy.go
index 51ca2f859..3e086725b 100644
--- a/pkg/apis/edgefs.rook.io/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/edgefs.rook.io/v1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1
 
diff --git a/pkg/apis/nfs.rook.io/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/nfs.rook.io/v1alpha1/zz_generated.deepcopy.go
index d13b29bcc..b552796d4 100644
--- a/pkg/apis/nfs.rook.io/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/nfs.rook.io/v1alpha1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1alpha1
 
diff --git a/pkg/apis/rook.io/v1/zz_generated.deepcopy.go b/pkg/apis/rook.io/v1/zz_generated.deepcopy.go
index bdfb1a66f..b9a5ab275 100644
--- a/pkg/apis/rook.io/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/rook.io/v1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1
 
diff --git a/pkg/apis/rook.io/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/rook.io/v1alpha2/zz_generated.deepcopy.go
index 6b225b362..41cf4dc20 100644
--- a/pkg/apis/rook.io/v1alpha2/zz_generated.deepcopy.go
+++ b/pkg/apis/rook.io/v1alpha2/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1alpha2
 
diff --git a/pkg/apis/yugabytedb.rook.io/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/yugabytedb.rook.io/v1alpha1/zz_generated.deepcopy.go
index 10220a7d5..f2860c4cc 100644
--- a/pkg/apis/yugabytedb.rook.io/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/yugabytedb.rook.io/v1alpha1/zz_generated.deepcopy.go
@@ -17,6 +17,7 @@ limitations under the License.
 */
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
+// #nosec G601 Check for implicit memory aliasing of items from a range statement
 
 package v1alpha1
 
diff --git a/pkg/operator/ceph/cluster/cluster.go b/pkg/operator/ceph/cluster/cluster.go
index 45b6e8a54..d79fe2280 100755
--- a/pkg/operator/ceph/cluster/cluster.go
+++ b/pkg/operator/ceph/cluster/cluster.go
@@ -283,7 +283,8 @@ func (c *cluster) notifyChildControllerOfUpgrade() error {
 			cephFilesystem.Labels = map[string]string{}
 		}
 		cephFilesystem.Labels["ceph_version"] = version
-		_, err := c.context.RookClientset.CephV1().CephFilesystems(c.Namespace).Update(&cephFilesystem)
+		localcephFilesystem := cephFilesystem
+		_, err := c.context.RookClientset.CephV1().CephFilesystems(c.Namespace).Update(&localcephFilesystem)
 		if err != nil {
 			return errors.Wrapf(err, "failed to update ceph filesystem CR %q with new label", cephFilesystem.Name)
 		}
@@ -298,7 +299,8 @@ func (c *cluster) notifyChildControllerOfUpgrade() error {
 			cephObjectStore.Labels = map[string]string{}
 		}
 		cephObjectStore.Labels["ceph_version"] = version
-		_, err := c.context.RookClientset.CephV1().CephObjectStores(c.Namespace).Update(&cephObjectStore)
+		localcephObjectStore := cephObjectStore
+		_, err := c.context.RookClientset.CephV1().CephObjectStores(c.Namespace).Update(&localcephObjectStore)
 		if err != nil {
 			return errors.Wrapf(err, "failed to update ceph object store CR %q with new label", cephObjectStore.Name)
 		}
@@ -313,7 +315,8 @@ func (c *cluster) notifyChildControllerOfUpgrade() error {
 			cephNFS.Labels = map[string]string{}
 		}
 		cephNFS.Labels["ceph_version"] = version
-		_, err := c.context.RookClientset.CephV1().CephNFSes(c.Namespace).Update(&cephNFS)
+		localcephNFS := cephNFS
+		_, err := c.context.RookClientset.CephV1().CephNFSes(c.Namespace).Update(&localcephNFS)
 		if err != nil {
 			return errors.Wrapf(err, "failed to update ceph nfs CR %q with new label", cephNFS.Name)
 		}
diff --git a/pkg/operator/ceph/cluster/osd/osd.go b/pkg/operator/ceph/cluster/osd/osd.go
index 0b453bf92..244dc2200 100644
--- a/pkg/operator/ceph/cluster/osd/osd.go
+++ b/pkg/operator/ceph/cluster/osd/osd.go
@@ -403,8 +403,8 @@ func (c *Cluster) startNodeDriveGroupProvisioners(config *provisionConfig) {
 			Name: normalizedHostname,
 		}
 		c.spec.Storage.Nodes = append(c.spec.Storage.Nodes, storageNode)
-
-		groups, err := DriveGroupsWithPlacementMatchingNode(sanitizedDGs, &n)
+		localnode := n
+		groups, err := DriveGroupsWithPlacementMatchingNode(sanitizedDGs, &localnode)
 		if err != nil {
 			config.addError("failed to determine drive groups with placement matching node %q (hostname: %q): %+v", n.Name, normalizedHostname, err)
 			continue
diff --git a/pkg/operator/ceph/cluster/osd/status.go b/pkg/operator/ceph/cluster/osd/status.go
index 2f4ca18d4..faa696170 100644
--- a/pkg/operator/ceph/cluster/osd/status.go
+++ b/pkg/operator/ceph/cluster/osd/status.go
@@ -143,8 +143,8 @@ func (c *Cluster) checkNodesCompleted(selector string, config *provisionConfig,
 			logger.Warningf("missing node label on configmap %s", configMap.Name)
 			continue
 		}
-
-		completed := c.handleStatusConfigMapStatus(node, config, &configMap, configOSDs)
+		localconfigMap := configMap
+		completed := c.handleStatusConfigMapStatus(node, config, &localconfigMap, configOSDs)
 		if !completed {
 			remainingNodes.Add(node)
 		}
diff --git a/pkg/operator/ceph/disruption/clusterdisruption/osd.go b/pkg/operator/ceph/disruption/clusterdisruption/osd.go
index 1b325c1c5..cb2acd12f 100644
--- a/pkg/operator/ceph/disruption/clusterdisruption/osd.go
+++ b/pkg/operator/ceph/disruption/clusterdisruption/osd.go
@@ -226,7 +226,8 @@ func (r *ReconcileClusterDisruption) reconcilePDBsForOSDs(
 		// refresh old canaries in draining failure domain
 		for _, drainingCanary := range drainingCanaryList.Items {
 			if time.Since(drainingCanary.GetCreationTimestamp().Time) > time.Minute && drainingCanary.Status.ReadyReplicas < 1 {
-				err := r.client.Delete(context.TODO(), &drainingCanary)
+				localdrainingCanary := drainingCanary
+				err := r.client.Delete(context.TODO(), &localdrainingCanary)
 				if err != nil {
 					logger.Warningf("could not delete canary deployment %q in namespace %q. %v", drainingCanary.GetName(), drainingCanary.GetNamespace(), err)
 				}
diff --git a/pkg/operator/ceph/file/filesystem.go b/pkg/operator/ceph/file/filesystem.go
index bc65831f5..e4d243da5 100644
--- a/pkg/operator/ceph/file/filesystem.go
+++ b/pkg/operator/ceph/file/filesystem.go
@@ -156,7 +156,8 @@ func validateFilesystem(context *clusterd.Context, clusterInfo *client.ClusterIn
 		return errors.Wrap(err, "invalid metadata pool")
 	}
 	for _, p := range f.Spec.DataPools {
-		if err := pool.ValidatePoolSpec(context, clusterInfo, &p); err != nil {
+		localpoolSpec := p
+		if err := pool.ValidatePoolSpec(context, clusterInfo, &localpoolSpec); err != nil {
 			return errors.Wrap(err, "Invalid data pool")
 		}
 	}
diff --git a/pkg/operator/ceph/file/mds/mds.go b/pkg/operator/ceph/file/mds/mds.go
index 214cbfca0..21f8eb7ee 100644
--- a/pkg/operator/ceph/file/mds/mds.go
+++ b/pkg/operator/ceph/file/mds/mds.go
@@ -237,7 +237,8 @@ func (c *Cluster) scaleDownDeployments(replicas int32, desiredDeployments map[st
 				)
 				break // stop trying to delete daemons, but continue to reporting any errors below
 			}
-			if err := deleteMdsDeployment(c.context, c.fs.Namespace, &d); err != nil {
+			localdeployment := d
+			if err := deleteMdsDeployment(c.context, c.fs.Namespace, &localdeployment); err != nil {
 				errCount++
 				logger.Errorf("error during deletion of extraneous mds deployments. %v", err)
 			}
diff --git a/pkg/operator/ceph/operator.go b/pkg/operator/ceph/operator.go
index 5d69217cd..aa2ffc75a 100644
--- a/pkg/operator/ceph/operator.go
+++ b/pkg/operator/ceph/operator.go
@@ -271,7 +271,8 @@ func getDeploymentOwnerReference(clientset kubernetes.Interface, namespace strin
 			}
 			for _, replicasetOwner := range replicaset.OwnerReferences {
 				if replicasetOwner.Kind == "Deployment" {
-					deploymentRef = &replicasetOwner
+					localreplicasetOwner := replicasetOwner
+					deploymentRef = &localreplicasetOwner
 				}
 			}
 		}
diff --git a/pkg/operator/ceph/test/containers.go b/pkg/operator/ceph/test/containers.go
index e8b909055..759fd1c70 100644
--- a/pkg/operator/ceph/test/containers.go
+++ b/pkg/operator/ceph/test/containers.go
@@ -91,7 +91,8 @@ func (ct *ContainersTester) AssertEnvVarsContainCephRequirements() {
 		if !isCephCommand(c.Command) {
 			continue // don't consider containers that aren't Ceph commands
 		}
-		assert.Subset(ct.t, varNames(&c), requiredEnvVars)
+		localcontainer := c
+		assert.Subset(ct.t, varNames(&localcontainer), requiredEnvVars)
 		for _, e := range c.Env {
 			// For the required env vars, make sure they are sourced as expected
 			switch e.Name {
@@ -139,7 +140,8 @@ func (ct *ContainersTester) AssertEnvVarsContainCephRequirements() {
 // the value.
 func (ct *ContainersTester) AssertArgReferencesMatchEnvVars() {
 	for _, c := range ct.containers {
-		assert.Subset(ct.t, varNames(&c), argEnvReferences(&c),
+		localcontainer := c
+		assert.Subset(ct.t, varNames(&localcontainer), argEnvReferences(&localcontainer),
 			"container: "+c.Name,
 			"references to env vars in args do not match env vars",
 			"args:", c.Args, "envs:", c.Env)
@@ -209,7 +211,8 @@ func varNames(c *v1.Container) []string {
 func (ct *ContainersTester) allNonrequiredArgEnvReferences() []string {
 	allSet := map[string]bool{}
 	for _, c := range ct.containers {
-		for _, r := range argEnvReferences(&c) {
+		localcontainer := c
+		for _, r := range argEnvReferences(&localcontainer) {
 			allSet[r] = true
 		}
 	}
@@ -228,7 +231,8 @@ func (ct *ContainersTester) allNonrequiredArgEnvReferences() []string {
 func (ct *ContainersTester) allNonrequiredVarNames() []string {
 	allSet := map[string]bool{}
 	for _, c := range ct.containers {
-		for _, v := range varNames(&c) {
+		localcontainer := c
+		for _, v := range varNames(&localcontainer) {
 			allSet[v] = true
 		}
 	}
diff --git a/pkg/operator/k8sutil/node.go b/pkg/operator/k8sutil/node.go
index 42e5f374b..cc30ab73a 100644
--- a/pkg/operator/k8sutil/node.go
+++ b/pkg/operator/k8sutil/node.go
@@ -201,7 +201,8 @@ func NodeIsTolerable(node v1.Node, tolerations []v1.Toleration, ignoreWellKnownT
 		}
 		isTolerated := false
 		for _, toleration := range tolerations {
-			if toleration.ToleratesTaint(&taint) {
+			localtaint := taint
+			if toleration.ToleratesTaint(&localtaint) {
 				isTolerated = true
 				break
 			}
diff --git a/pkg/operator/k8sutil/pod.go b/pkg/operator/k8sutil/pod.go
index c78cc4715..1eb9ac9d5 100644
--- a/pkg/operator/k8sutil/pod.go
+++ b/pkg/operator/k8sutil/pod.go
@@ -187,7 +187,8 @@ func GetMatchingContainer(containers []v1.Container, name string) (v1.Container,
 		// if there are multiple pods, we require the container to have the expected name
 		for _, container := range containers {
 			if container.Name == name {
-				result = &container
+				localcontainer := container
+				result = &localcontainer
 				break
 			}
 		}
diff --git a/pkg/operator/test/containers.go b/pkg/operator/test/containers.go
index f7254787e..b6123d0f1 100644
--- a/pkg/operator/test/containers.go
+++ b/pkg/operator/test/containers.go
@@ -55,7 +55,8 @@ func (ps *PodSpecTester) Containers() *ContainersTester {
 // the value.
 func (ct *ContainersTester) AssertArgReferencesMatchEnvVars() {
 	for _, c := range ct.containers {
-		assert.Subset(ct.t, varNames(&c), argEnvReferences(&c),
+		localcontainer := c
+		assert.Subset(ct.t, varNames(&localcontainer), argEnvReferences(&localcontainer),
 			"container: "+c.Name,
 			"references to env vars in args do not match env vars",
 			"args:", c.Args, "envs:", c.Env)
diff --git a/pkg/operator/test/volumes.go b/pkg/operator/test/volumes.go
index ebc9748d6..3b7d8bf1f 100644
--- a/pkg/operator/test/volumes.go
+++ b/pkg/operator/test/volumes.go
@@ -77,7 +77,8 @@ func VolumeMountExists(mountName string, mounts []v1.VolumeMount) error {
 func HumanReadableVolumes(volumes []v1.Volume) string {
 	stringVols := []string{}
 	for _, volume := range volumes {
-		stringVols = append(stringVols, HumanReadableVolume(&volume))
+		localvolume := volume
+		stringVols = append(stringVols, HumanReadableVolume(&localvolume))
 	}
 	return fmt.Sprintf("%v", stringVols)
 }
@@ -102,7 +103,8 @@ func HumanReadableVolume(v *v1.Volume) string {
 func HumanReadableVolumeMounts(mounts []v1.VolumeMount) string {
 	stringMounts := []string{}
 	for _, mount := range mounts {
-		stringMounts = append(stringMounts, HumanReadableVolumeMount(&mount))
+		localmount := mount
+		stringMounts = append(stringMounts, HumanReadableVolumeMount(&localmount))
 	}
 	return fmt.Sprintf("%v", stringMounts)
 }
@@ -154,9 +156,10 @@ func (d *VolumesAndMountsTestDefinition) TestMountsMatchVolumes(t *testing.T) {
 			fmt.Sprintf("%s mounts match volumes in %s", mountsSpec.Moniker, d.VolumesSpec.Moniker),
 			func(t *testing.T) {
 				for _, mount := range mountsSpec.Mounts {
+					localmount := mount
 					assert.Nil(t, VolumeExists(mount.Name, d.VolumesSpec.Volumes),
 						"%s volume mount %s does not have a corresponding %s volume to source it: %s",
-						mountsSpec.Moniker, HumanReadableVolumeMount(&mount),
+						mountsSpec.Moniker, HumanReadableVolumeMount(&localmount),
 						d.VolumesSpec.Moniker, HumanReadableVolumes(d.VolumesSpec.Volumes))
 				}
 			},
@@ -169,9 +172,10 @@ func (d *VolumesAndMountsTestDefinition) TestMountsMatchVolumes(t *testing.T) {
 		fmt.Sprintf("No extraneous %s volumes exist", d.VolumesSpec.Moniker),
 		func(t *testing.T) {
 			for _, volume := range d.VolumesSpec.Volumes {
+				localvolume := volume
 				assert.Nil(t, mountExistsInMountsSpecItems(volume.Name, d.MountsSpecItems),
 					"%s volume %s is not used by any volume mount: %v",
-					d.VolumesSpec.Moniker, HumanReadableVolume(&volume),
+					d.VolumesSpec.Moniker, HumanReadableVolume(&localvolume),
 					humanReadableMountsSpecItems(d.MountsSpecItems))
 			}
 		},