{"record":{"id":"c4121cadf94d0708","repo":"k3s-io/k3s","slug":"toleration-with-empty-key-must-have-operator-exis","errorCode":null,"errorMessage":"toleration with empty key must have operator 'Exists'","messagePattern":"toleration with empty key must have operator 'Exists'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cloudprovider/servicelb.go","lineNumber":734,"sourceCode":"\t}\n\n\tfor i := range tolerations {\n\t\tif err := validateToleration(&tolerations[i]); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"validation failed for toleration %d: %v\", i, err)\n\t\t}\n\t}\n\n\treturn tolerations, nil\n}\n\n// validateToleration ensures a toleration has valid fields according to its operator.\nfunc validateToleration(toleration *core.Toleration) error {\n\tif toleration.Operator == \"\" {\n\t\ttoleration.Operator = core.TolerationOpEqual\n\t}\n\n\tif toleration.Key == \"\" && toleration.Operator != core.TolerationOpExists {\n\t\treturn errors.New(\"toleration with empty key must have operator 'Exists'\")\n\t}\n\n\tif toleration.Operator == core.TolerationOpExists && toleration.Value != \"\" {\n\t\treturn errors.New(\"toleration with operator 'Exists' must have an empty value\")\n\t}\n\n\treturn nil\n}\n\n// generateName generates a distinct name for the DaemonSet based on the service name and UID\nfunc generateName(svc *core.Service) string {\n\tname := svc.Name\n\t// ensure that the service name plus prefix and uuid aren't overly long, but\n\t// don't cut the service name at a trailing hyphen.\n\tif len(name) > 48 {\n\t\ttrimlen := 48\n\t\tfor name[trimlen-1] == '-' {\n\t\t\ttrimlen--","sourceCodeStart":716,"sourceCodeEnd":752,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/cloudprovider/servicelb.go#L716-L752","documentation":"validateToleration applies Kubernetes toleration semantics to tolerations k3s reads from the ServiceLB service annotation (servicelb.k3s.io/tolerations): the operator defaults to 'Equal', and a toleration with an empty key is only meaningful as 'tolerate everything' with operator 'Exists'. An empty key with operator Equal (explicit or defaulted) is rejected.","triggerScenarios":"Annotating a Service with `servicelb.k3s.io/tolerations: '[{\"key\":\"\",\"operator\":\"Equal\",\"effect\":\"NoSchedule\"}]'`, or omitting the operator on a toleration with no key, e.g. `[{\"effect\":\"NoSchedule\"}]`.","commonSituations":"Writing a catch-all toleration and forgetting that the operator must be Exists; JSON shorthand entries with only an effect field; generated annotations from templates that leave key empty.","solutions":["For a catch-all toleration set operator Exists: `{\"operator\":\"Exists\",\"effect\":\"NoSchedule\"}`","Otherwise provide a concrete key: `{\"key\":\"node-role.kubernetes.io/control-plane\",\"effect\":\"NoSchedule\"}`","Validate the annotation JSON against core.Toleration rules before applying the Service"],"exampleFix":"# before\nkubectl annotate svc my-svc servicelb.k3s.io/tolerations='[{\"key\":\"\",\"effect\":\"NoSchedule\"}]'\n\n# after\nkubectl annotate svc my-svc servicelb.k3s.io/tolerations='[{\"operator\":\"Exists\",\"effect\":\"NoSchedule\"}]'","handlingStrategy":"validation","validationCode":"// validate servicelb tolerations annotation before applying the Service\nfunc tolerationOK(t core.Toleration) bool {\n    op := t.Operator\n    if op == \"\" {\n        op = core.TolerationOpEqual\n    }\n    if t.Key == \"\" && op != core.TolerationOpExists {\n        return false // empty key requires Exists\n    }\n    if op == core.TolerationOpExists && t.Value != \"\" {\n        return false // Exists cannot carry a value\n    }\n    return true\n}","typeGuard":"func isValidServiceLBToleration(t core.Toleration) bool {\n    op := t.Operator\n    if op == \"\" { op = core.TolerationOpEqual }\n    return !((t.Key == \"\" && op != core.TolerationOpExists) || (op == core.TolerationOpExists && t.Value != \"\"))\n}","tryCatchPattern":null,"preventionTips":["Reuse upstream k8s toleration validation rules when templating annotations","For catch-all tolerations always write {\"operator\":\"Exists\"}\nUnit-test annotation templates against both validateToleration failure modes"],"tags":["servicelb","tolerations","kubernetes","validation"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}