kubernetes/kops · error

parsing taints for instance group %q: %w

Error message

parsing taints for instance group %q: %w

What it means

HCloudClusterConfig parses each entry of ig.Spec.Taints using util.ParseTaint to build corev1.Taint values. If a taint string is malformed, ParseTaint errors and this wrapper reports it with the instance group name.

Source

Thrown at upup/pkg/fi/cloudup/template_functions.go:1215

		if !ok {
			return "", fmt.Errorf("server group task for instance group %q has unexpected type %T", ig.Name, task)
		}

		nodeLabels, err := nodelabels.BuildNodeLabels(tf.Cluster, ig)
		if err != nil {
			return "", fmt.Errorf("building node labels for instance group %q: %w", ig.Name, err)
		}

		userDataBytes, err := fi.ResourceAsBytes(serverGroup.UserData)
		if err != nil {
			return "", fmt.Errorf("reading user-data for instance group %q: %w", ig.Name, err)
		}

		var taints []corev1.Taint
		for _, taintSpec := range ig.Spec.Taints {
			parsed, err := util.ParseTaint(taintSpec)
			if err != nil {
				return "", fmt.Errorf("parsing taints for instance group %q: %w", ig.Name, err)
			}
			taints = append(taints, corev1.Taint{
				Key:    parsed["key"],
				Value:  parsed["value"],
				Effect: corev1.TaintEffect(parsed["effect"]),
			})
		}

		// Copy the server labels and add the user-data hash.
		serverLabels := make(map[string]string, len(serverGroup.Labels)+1)
		for key, value := range serverGroup.Labels {
			serverLabels[key] = value
		}
		serverLabels[hetzner.TagKubernetesInstanceUserData] = hetznertasks.SafeBytesHash(userDataBytes)

		config.NodeConfigs[ig.Name] = hcloudNodeConfig{
			CloudInit:    string(userDataBytes),
			Labels:       nodeLabels,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the taint string in ig.Spec.Taints to the canonical key=value:Effect form, e.g. dedicated=foo:NoSchedule.
2. Validate effects are one of NoSchedule, PreferNoSchedule, NoExecute.
3. Run a spec validation / kops toolbox before applying.

Example fix

// before (cluster.yaml)
taints:
  - dedicated=gpu
// after
taints:
  - dedicated=gpu:NoSchedule

// Go: validate taints before template execution
for _, t := range ig.Spec.Taints {
    parts := strings.Split(t, ":")
    if len(parts) != 2 || !strings.Contains(parts[0], "=") {
        return fmt.Errorf("ig %q: taint %q must be key=value:Effect", ig.Name, t)
    }
    switch corev1.TaintEffect(parts[1]) {
    case corev1.TaintEffectNoSchedule, corev1.TaintEffectPreferNoSchedule, corev1.TaintEffectNoExecute:
    default:
        return fmt.Errorf("ig %q: taint %q has invalid effect %q", ig.Name, t, parts[1])
    }
}

When it happens

Trigger: An instance group spec contains a taint string not in key=value:effect format (e.g. missing '=', missing ':effect', empty effect, extra separators).

Common situations: Hand-edited cluster.yaml taints with typos like "dedicated=true" (missing :effect) or "key=value:NoSchdule" (misspelled effect); copy-pasting taints between tools with different syntaxes.

Related errors

• failed to convert network ID %q to int: %w
• failed to get private networks from hetzner cloud metadata:
• failed to convert private networks to object: %w
• taints: %w
• failed to build manifest path. Path was empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5678b7b593324af5. Report an issue: GitHub.