{"record":{"id":"610e14ad81858222","repo":"thanos-io/thanos","slug":"error-enforcing-label","errorCode":null,"errorMessage":"error enforcing label","messagePattern":"error enforcing label","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tenancy/tenancy.go","lineNumber":158,"sourceCode":"\treturn md.Get(DefaultTenantHeader)[0], true\n}\n\nfunc EnforceQueryTenancy(tenantLabel string, tenant string, query string) (string, error) {\n\tlabelMatcher := &labels.Matcher{\n\t\tName:  tenantLabel,\n\t\tType:  labels.MatchEqual,\n\t\tValue: tenant,\n\t}\n\n\te := injectproxy.NewPromQLEnforcer(false, labelMatcher)\n\n\texpr, err := extpromql.ParseExpr(query)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"error parsing query string, when enforcing tenenacy\")\n\t}\n\n\tif err := e.EnforceNode(expr); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"error enforcing label\")\n\t}\n\n\treturn expr.String(), nil\n}\n\nfunc getLabelMatchers(formMatchers []string, tenant string, enforceTenancy bool, tenantLabel string) ([][]*labels.Matcher, error) {\n\ttenantLabelMatcher := &labels.Matcher{\n\t\tName:  tenantLabel,\n\t\tType:  labels.MatchEqual,\n\t\tValue: tenant,\n\t}\n\n\tmatcherSets := make([][]*labels.Matcher, 0, len(formMatchers))\n\n\t// If tenancy is enforced, but there are no matchers at all, add the tenant matcher\n\tif len(formMatchers) == 0 && enforceTenancy {\n\t\tvar matcher []*labels.Matcher\n\t\tmatcher = append(matcher, tenantLabelMatcher)","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tenancy/tenancy.go#L140-L176","documentation":"EnforceQueryTenancy wraps failures from the injectproxy PromQL enforcer's EnforceNode with this message. The query parsed successfully, but injecting the tenancy label matcher into the expression failed — some AST nodes cannot have the tenant label matcher added (e.g. unsupported expression shapes or selectors the enforcer cannot rewrite).","triggerScenarios":"EnforceQueryTenancy receives a syntactically valid query whose AST contains nodes the prom-label-proxy enforcer refuses, so e.EnforceNode(expr) returns an error.","commonSituations":"Advanced PromQL (nested subqueries, exotic function usage) not supported by the bundled enforcer version; version skew between Thanos and its prom-label-proxy dependency; queries without any selector the matcher can attach to.","solutions":["Inspect the wrapped inner error from EnforceNode for the specific unsupported node","Simplify the query (avoid exotic constructs) or split it into supported expressions","Upgrade Thanos/prom-label-proxy to a version supporting the query constructs used","Ensure queries contain at least one vector selector the tenant matcher can be injected into"],"exampleFix":"// before (construct enforcer cannot rewrite)\nsort_desc(rate(some_metric[5m] offset 1w))\n// after\nrate(some_metric[5m])","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go\nrewritten, err := EnforceQueryTenancy(query, tenant, enforce)\nif err != nil && strings.Contains(err.Error(), \"error enforcing label\") {\n    return \"\", fmt.Errorf(\"query not enforceable for tenancy: %w\", errors.Unwrap(err))\n}","preventionTips":["Keep Thanos/prom-label-proxy versions current for broader PromQL support","Restrict dashboards to query patterns known to be enforceable","Test complex queries against the tenant proxy before rolling them out"],"tags":["promql","tenancy","query-enforcement"],"backgroundTag":"unsupported-operation","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}