What causes "invalid taint spec: %v" in kubernetes/kops?

Remove the extra '=' — keep the form key=value:Effect with exactly one '=' before the colon.

invalid taint spec: %v

Error message

invalid taint spec: %v

What it means

parseTaint splits a taint spec on ':' and, for two-part specs (key=value:effect), further splits the key part on '='. This error is thrown when the key segment contains more than one '=' (len(partsKV) > 2), i.e. something like 'key=a=b:NoSchedule'. Only a single key=value pair is supported before the effect.

Source

Thrown at pkg/model/awsmodel/spotinst.go:1147

		}
		taints = append(taints, taint)
	}

	return taints, nil
}

func parseTaint(taintSpec string) (*corev1.Taint, error) {
	var taint corev1.Taint

	parts := strings.Split(taintSpec, ":")
	switch len(parts) {
	case 1:
		taint.Key = parts[0]
	case 2:
		taint.Effect = corev1.TaintEffect(parts[1])
		partsKV := strings.Split(parts[0], "=")
		if len(partsKV) > 2 {
			return nil, fmt.Errorf("invalid taint spec: %v", taintSpec)
		}
		taint.Key = partsKV[0]
		if len(partsKV) == 2 {
			taint.Value = partsKV[1]
		}
	default:
		return nil, fmt.Errorf("invalid taint spec: %v", taintSpec)
	}

	return &taint, nil
}

func parseStringSlice(str string) ([]string, error) {
	v := strings.Split(str, ",")
	for i, s := range v {
		v[i] = strings.TrimSpace(s)
	}
	return v, nil

View on GitHub (pinned to 4c8573c808)

Solutions

Remove the extra '=' — keep the form key=value:Effect with exactly one '=' before the colon.
If the value must contain '=', note this parser does not support it; choose a value without '=' or encode it in a '='-free form.
Validate each taint spec against the regex key=value:Effect before adding it to the cluster spec.

Example fix

// before
spotinst/taints: "disk=ssd=true:NoSchedule"
// after
spotinst/taints: "disk=true:NoSchedule"

Defensive patterns

Strategy: validation

Validate before calling

func validTaintKV(spec string) bool {
	parts := strings.Split(spec, ":")
	if len(parts) != 2 { return false }
	return len(strings.Split(parts[0], "=")) <= 2
}
// validate each entry of the taints list before applying the spec

Try / catch

if _, err := parseTaints(specs); err != nil {
	return fmt.Errorf("taints invalid: %w", err)
}

Prevention

Keep taint specs in the exact form key=value:Effect with a single '='.
Never use values containing '=' (base64, JWTs) in taints.
Cross-check specs against `kubectl taint nodes` accepted syntax minus unsupported forms.
Add a CI lint step that regex-validates each taint entry.

When it happens

Trigger: parseTaints -> parseTaint receives a spec with an effect but the key portion contains two or more '=' characters, e.g. 'disk=ssd=true:NoSchedule' or a base64/URL value containing '=' placed in the key part.

Common situations: Users copy a kubectl-style taint but include an extra '=', or encode a value containing '=' (JWTs, base64) into the taint value without quoting/escaping.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bc2794f4ad6f49bd. Report an issue: GitHub.