operator: return error for malformed key=value flag input#8560
Merged
simonpasquier merged 1 commit intoMay 11, 2026
Conversation
Map.Set() panics with an index-out-of-range error when a flag value does not contain "=" (e.g. --annotations "key"). Replace strings.Split with strings.Cut to validate the format and return a clear error instead of crashing. strings.Cut also correctly preserves values containing "=" which the previous code silently truncated. Signed-off-by: Sebastien Tardif <[email protected]>
simonpasquier
approved these changes
May 11, 2026
sdwilsh
pushed a commit
to sdwilsh/ansible-playbooks
that referenced
this pull request
Jul 22, 2026
…r to v0.92.1 (#1765) ##### [\`v0.92.1\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.1) - \[BUGFIX] Fix "namespace not found" errors when the operator watches monitoring and workload resources in different resources. [#8658](prometheus-operator/prometheus-operator#8658) --- ##### [\`v0.92.0\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.0) > \[!NOTE] > The `PrometheusTopologySharding` and `PrometheusShardRetentionPolicy` feature gates have been promoted to **Beta** in this release and are now enabled by default. See the [sharding documentation](https://prometheus-operator.dev/docs/platform/sharding/) for details. - \[CHANGE] Add URL validation for the `tokenUrl` field in OAuth2 configuration across all CRDs. [#8579](prometheus-operator/prometheus-operator#8579) - \[CHANGE] Add URL validation for the `url` field in `RemoteReadSpec` in `Prometheus` CRD. [#8596](prometheus-operator/prometheus-operator#8596) - \[FEATURE] Migrate retention options from CLI flags to the config file for `Prometheus` CRD (Prometheus >= v3 uses the config file; older versions continue to use CLI flags). [#8547](prometheus-operator/prometheus-operator#8547) - \[FEATURE] Add `staleSeriesCompactionThreshold` field to `TSDBSpec` in `Prometheus` and `PrometheusAgent` CRDs. [#8563](prometheus-operator/prometheus-operator#8563) - \[FEATURE] Add `labelNameUnderscoreSanitization` and `labelNamePreserveMultipleUnderscores` fields to `OTLPConfig` in `Prometheus` and `PrometheusAgent` CRDs. [#8562](prometheus-operator/prometheus-operator#8562) - \[FEATURE] Add `payload` field to Webhook receiver in `AlertmanagerConfig` CRD. [#8507](prometheus-operator/prometheus-operator#8507) - \[ENHANCEMENT] Use pod topology labels for zone sharding on Kubernetes >= 1.35 when the `PrometheusTopologySharding` feature gate is enabled (removes the need for `attachMetadata.node=true`). [#8564](prometheus-operator/prometheus-operator#8564) - \[ENHANCEMENT] Add validation for the Slack `update_message` field in Alertmanager configuration Secret. [#8556](prometheus-operator/prometheus-operator#8556) - \[BUGFIX] Validate target labels in `Probe` static configuration to prevent invalid Prometheus scrape configs. [#7901](prometheus-operator/prometheus-operator#7901) - \[BUGFIX] Fix goroutine leak and data race in `pollBasedListerWatcher`. [#8593](prometheus-operator/prometheus-operator#8593) - \[BUGFIX] Validate `ProxyConfig` in OAuth2 configuration. [#8610](prometheus-operator/prometheus-operator#8610) - \[BUGFIX] Fix SMTP smarthost format error handling in Alertmanager configuration. [#8586](prometheus-operator/prometheus-operator#8586) - \[BUGFIX] Fix missing `return` in admission webhook after marshal failure. [#8582](prometheus-operator/prometheus-operator#8582) - \[BUGFIX] Fix `FindOwner` to return `nil` on `meta.Accessor` error. [#8585](prometheus-operator/prometheus-operator#8585) - \[BUGFIX] Fix dropped gzip `Close` errors in `GzipConfig` and `GunzipConfig`. [#8573](prometheus-operator/prometheus-operator#8573) - \[BUGFIX] Fix panic on malformed key=value flag input (e.g. `--labels "key"`). [#8560](prometheus-operator/prometheus-operator#8560) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Map.Set()panics with an index-out-of-range error when a--annotationsor--labelsflag value does not contain=(e.g.--annotations "key"). Thestrings.Split(pair, "=")call returns a single-element slice, and the unconditionalpair[1]access panics, crashing the operator at startup.Replace
strings.Splitwithstrings.Cutto validate the format and return a clear error message instead of panicking.strings.Cutalso correctly preserves values containing=(e.g.key=val=uemaps toval=ue), which the previous code silently truncated.Introduced in #5683.
Type of change
BUGFIX(non-breaking change which fixes an issue)Verification
Added
TestMapSetInvalidcovering missing=and partially invalid input. Also added a test case for values containing=to verify correct handling. All existing tests continue to pass.