@@ -7,6 +7,19 @@ default_language_version:
   node: system
 
 repos:
+  # The word lists live in a per-repo `typos.toml`, which is not templated.
+  # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
+  # A templated config can currently not be extended locally.
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
 
@@ -12,7 +12,7 @@ You need:
 * kubectl
 * optional: Helm
 
-Resource sizing depends on cluster type(s), usage and scope, but as a starting point the following resources are recommended as a minium requirement for this operator:
+Resource sizing depends on cluster type(s), usage and scope, but as a starting point the following resources are recommended as a minimum requirement for this operator:
 
 * 0.2 cores (e.g. i5 or similar)
 * 256MB RAM
 
@@ -35,7 +35,7 @@ This creates an internal topology label by combining the values of the `topology
 In order to enable gathering this information the Hadoop images contain the {hdfs-topology-provider}[hdfs-topology-provider] on the classpath, which can be configured to read labels from Kubernetes objects.
 
 The operator deploys ClusterRoles and ServicesAccounts with the relevant RBAC rules to allow the Hadoop Pod to access the necessary Kubernetes objects.
-Topologies and other metadata such as Node- and Pod-IPs and endpoints are held in separate caches so that they can be refeshed independently of one another.
+Topologies and other metadata such as Node- and Pod-IPs and endpoints are held in separate caches so that they can be refreshed independently of one another.
 The {hdfs-topology-provider}[hdfs-topology-provider] is namespace-scoped and pods in the active namespace are watched so that changes can be propagated to the internal cache to minimise cache misses.
 
 NOTE: Rack awareness may not work as expected on clusters such as `kind` or `k3s` that configure IP-masquerading differently to production-ready distributions.
@@ -39,7 +39,7 @@ metadata:
   name: secret-operator-keytab
 data:
 {% if test_scenario['values']['kerberos-backend'] == 'mit' %}
-  # To create keytab. When promted enter password asdf
+  # To create keytab. When prompted enter password asdf
   # cat | ktutil << 'EOF'
   # list
   # add_entry -password -p stackable-secret-operator@CLUSTER.LOCAL -k 1 -e aes256-cts-hmac-sha384-192
 
@@ -81,7 +81,7 @@ spec:
             hdfsStorageType: Disk
           ssd:
             capacity: 1Gi
-            # storageClass: premium # We can't set the storage class in itegration tests, as we don't know which ones are available
+            # storageClass: premium # We can't set the storage class in integration tests, as we don't know which ones are available
             count: 1
             hdfsStorageType: SSD
 {% endif %}
 
@@ -33,7 +33,7 @@ metadata:
   name: secret-operator-keytab
 data:
 {% if test_scenario['values']['kerberos-backend'] == 'mit' %}
-  # To create keytab. When promted enter password asdf
+  # To create keytab. When prompted enter password asdf
   # cat | ktutil << 'EOF'
   # list
   # add_entry -password -p stackable-secret-operator@CLUSTER.LOCAL -k 1 -e aes256-cts-hmac-sha384-192
 
@@ -0,0 +1,42 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # Ignore `.git`, which the above `ignore-hidden = false` would otherwise pull in.
+    ".git/",
+    # Generated by crate2nix (`make regenerate-nix`). Already skipped by the prek
+    # top-level `exclude`; listed here so a bare `typos` run agrees.
+    "Cargo.nix",
+    # Generated by `make regenerate-charts` from the Rust doc comments, which are
+    # checked at their source. The rest is Kubernetes' own schema documentation.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:ignore-block-start` suppresses nothing.
+#
+# Use one of the following when the word is correct at one place but would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:ignore-block-start / typos:ignore-block-end   around a block
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-start\b|<!--[ \t]*typos:ignore-block-start\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-start\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-start\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-end\b|<!--[ \t]*typos:ignore-block-end\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-end\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-end\b[^\n]*?#\})',
+]
+
+# Before adding an entry in here, consider an in-place marker instead.
+# Every entry below gets a one-line comment saying what the word is.
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"