What causes "invalid taint spec: %v" in kubernetes/kops?

Remove any extra '=' from the taint: format must be key=value:Effect, key:Effect, or key with at most one '='.

invalid taint spec: %v

Error message

invalid taint spec: %v

What it means

ParseTaint in pkg/apis/kops/util/taints.go splits a taint string on ":" and, when a colon-separated effect is present (2 parts), splits the key section on "=". If the key section contains more than one "=" (e.g. key=a=b:NoSchedule), it rejects the spec with "invalid taint spec" because a taint value may not contain '='.

Source

Thrown at pkg/apis/kops/util/taints.go:43

// it mimics the function from https://github.com/kubernetes/kubernetes/blob/master/pkg/util/taints/taints.go
// but returns a map instead of a v1.Taint
func ParseTaint(st string) (map[string]string, error) {
	taint := make(map[string]string)

	var key string
	var value string
	var effect string

	parts := strings.Split(st, ":")
	switch len(parts) {
	case 1:
		key = parts[0]
	case 2:
		effect = parts[1]

		partsKV := strings.Split(parts[0], "=")
		if len(partsKV) > 2 {
			return taint, fmt.Errorf("invalid taint spec: %v", st)
		}
		key = partsKV[0]
		if len(partsKV) == 2 {
			value = partsKV[1]
		}
	default:
		return taint, fmt.Errorf("invalid taint spec: %v", st)
	}

	taint["key"] = key
	taint["value"] = value
	taint["effect"] = effect

	return taint, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Remove any extra '=' from the taint: format must be key=value:Effect, key:Effect, or key with at most one '='.
If the value legitimately contains '=', switch the instance group to the structured taints field or escape/encode the value per Kubernetes taint rules.
Split the offending taint into multiple well-formed taints.
Run `kops validate` / kubectl-style parsing locally before applying the instance group.

Example fix

// before
spec:
  taints:
  - "dedicated=team=blue:NoSchedule"
// after
spec:
  taints:
  - "dedicated=team-blue:NoSchedule"

Defensive patterns

Strategy: validation

Validate before calling

func validTaintKeyPart(t string) bool {
	kv := strings.Split(strings.SplitN(t, ":", 2)[0], "=")
	return len(kv) <= 2 && kv[0] != ""
}
// use before calling ParseTaint
if !validTaintKeyPart(spec) {
	return fmt.Errorf("taint %q must be key[=value]:Effect with at most one '='", spec)
}

Try / catch

taint, err := ParseTaint(spec)
if err != nil {
	return fmt.Errorf("skipping malformed taint %q: %v", spec, err)
}

Prevention

Follow the key=value:Effect format strictly — at most one '=' and one ':'.
Never put raw '='-containing values (base64, URLs) in taint values without encoding.
Validate taints with ValidateInstanceGroup before applying instance group changes.
Keep taint values simple tokens; use node labels for complex metadata.

When it happens

Trigger: Passing a taint like "key=val=ue:NoSchedule" or "k=v=w" to ParseTaint — reached via instance group taints fields consumed by ValidateInstanceGroup, CloudTagsForInstanceGroup, or HCloudClusterConfig.

Common situations: Users copying Kubernetes taint syntax with base64 or URL-encoded values containing '='; typos where '=' is used instead of ':' as the key/value-effect separator, e.g. writing key=value:NoSchedule as key=value=NoSchedule... actually producing "k=v=NoSchedule" which has 2 colon-parts? No — "key=value=NoSchedule" has one ':' and key part "key=value=NoSchedule" split on '=' gives 3 parts, triggering this error.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ecb9514e8e005111. Report an issue: GitHub.