{"record":{"id":"ecb9514e8e005111","repo":"kubernetes/kops","slug":"invalid-taint-spec-v","errorCode":null,"errorMessage":"invalid taint spec: %v","messagePattern":"invalid taint spec: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apis/kops/util/taints.go","lineNumber":43,"sourceCode":"// it mimics the function from https://github.com/kubernetes/kubernetes/blob/master/pkg/util/taints/taints.go\n// but returns a map instead of a v1.Taint\nfunc ParseTaint(st string) (map[string]string, error) {\n\ttaint := make(map[string]string)\n\n\tvar key string\n\tvar value string\n\tvar effect string\n\n\tparts := strings.Split(st, \":\")\n\tswitch len(parts) {\n\tcase 1:\n\t\tkey = parts[0]\n\tcase 2:\n\t\teffect = parts[1]\n\n\t\tpartsKV := strings.Split(parts[0], \"=\")\n\t\tif len(partsKV) > 2 {\n\t\t\treturn taint, fmt.Errorf(\"invalid taint spec: %v\", st)\n\t\t}\n\t\tkey = partsKV[0]\n\t\tif len(partsKV) == 2 {\n\t\t\tvalue = partsKV[1]\n\t\t}\n\tdefault:\n\t\treturn taint, fmt.Errorf(\"invalid taint spec: %v\", st)\n\t}\n\n\ttaint[\"key\"] = key\n\ttaint[\"value\"] = value\n\ttaint[\"effect\"] = effect\n\n\treturn taint, nil\n}\n","sourceCodeStart":25,"sourceCodeEnd":59,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/apis/kops/util/taints.go#L25-L59","documentation":"ParseTaint in pkg/apis/kops/util/taints.go splits a taint string on \":\" and, when a colon-separated effect is present (2 parts), splits the key section on \"=\". If the key section contains more than one \"=\" (e.g. key=a=b:NoSchedule), it rejects the spec with \"invalid taint spec\" because a taint value may not contain '='.","triggerScenarios":"Passing a taint like \"key=val=ue:NoSchedule\" or \"k=v=w\" to ParseTaint — reached via instance group taints fields consumed by ValidateInstanceGroup, CloudTagsForInstanceGroup, or HCloudClusterConfig.","commonSituations":"Users copying Kubernetes taint syntax with base64 or URL-encoded values containing '='; typos where '=' is used instead of ':' as the key/value-effect separator, e.g. writing key=value:NoSchedule as key=value=NoSchedule... actually producing \"k=v=NoSchedule\" which has 2 colon-parts? No — \"key=value=NoSchedule\" has one ':' and key part \"key=value=NoSchedule\" split on '=' gives 3 parts, triggering this error.","solutions":["Remove any extra '=' from the taint: format must be key=value:Effect, key:Effect, or key with at most one '='.","If the value legitimately contains '=', switch the instance group to the structured taints field or escape/encode the value per Kubernetes taint rules.","Split the offending taint into multiple well-formed taints.","Run `kops validate` / kubectl-style parsing locally before applying the instance group."],"exampleFix":"// before\nspec:\n  taints:\n  - \"dedicated=team=blue:NoSchedule\"\n// after\nspec:\n  taints:\n  - \"dedicated=team-blue:NoSchedule\"","handlingStrategy":"validation","validationCode":"func validTaintKeyPart(t string) bool {\n\tkv := strings.Split(strings.SplitN(t, \":\", 2)[0], \"=\")\n\treturn len(kv) <= 2 && kv[0] != \"\"\n}\n// use before calling ParseTaint\nif !validTaintKeyPart(spec) {\n\treturn fmt.Errorf(\"taint %q must be key[=value]:Effect with at most one '='\", spec)\n}","typeGuard":null,"tryCatchPattern":"taint, err := ParseTaint(spec)\nif err != nil {\n\treturn fmt.Errorf(\"skipping malformed taint %q: %v\", spec, err)\n}","preventionTips":["Follow the key=value:Effect format strictly — at most one '=' and one ':'.","Never put raw '='-containing values (base64, URLs) in taint values without encoding.","Validate taints with ValidateInstanceGroup before applying instance group changes.","Keep taint values simple tokens; use node labels for complex metadata."],"tags":["taints","validation","instancegroup","config-parsing"],"backgroundTag":"invalid-taint-spec","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}