Summary

GzipConfig in pkg/operator/gzip_config.go uses defer buf.Close() on a gzip.Writer. Since Close() flushes buffered data and writes the mandatory gzip footer (CRC32 checksum + uncompressed size), discarding its error means a write failure during Close produces corrupted output that the caller cannot detect.

GunzipConfig in the same file never calls gzip.Reader.Close(). The Go standard library documentation states: "In order to verify the integrity of the data, the caller must call Close when finished reading."

Impact

Both Prometheus and Alertmanager config compression paths call GzipConfig:

• pkg/prometheus/common.go:136 (Prometheus config secret)
• pkg/alertmanager/operator.go:992 (Alertmanager config secret)

If Close() fails, the compressed config stored in the Kubernetes Secret is truncated (missing gzip footer). Prometheus/Alertmanager would fail to decompress the config on startup.

Suggested fix

• GzipConfig: Return buf.Close() directly instead of deferring it.
• GunzipConfig: Add reader.Close() after io.Copy and propagate its error.