operator: fix dropped gzip Close errors in GzipConfig and GunzipConfig#8573
Merged
simonpasquier merged 2 commits intoMay 19, 2026
Merged
Conversation
GzipConfig uses defer to close the gzip.Writer, which silently discards the error from Close(). Since Close() flushes buffered data and writes the mandatory gzip footer (CRC32 checksum and uncompressed size), a failure here produces corrupted output that the caller cannot detect. Both Prometheus and Alertmanager config compression paths rely on this function. Fix by returning buf.Close() directly instead of deferring it. GunzipConfig never calls gzip.Reader.Close(). The Go standard library documentation states that callers must call Close when finished reading to verify data integrity. Add the missing Close call and propagate its error. Signed-off-by: Sebastien Tardif <[email protected]>
Signed-off-by: Sebastien Tardif <[email protected]>
simonpasquier
approved these changes
May 19, 2026
simonpasquier
left a comment
simonpasquier
left a comment
Contributor
There was a problem hiding this comment.
Thanks! I don't think that we had a real issue in practice because we're using https://pkg.go.dev/bytes#Buffer which returns only nil or io.EOF.
sdwilsh
pushed a commit
to sdwilsh/ansible-playbooks
that referenced
this pull request
Jul 22, 2026
…r to v0.92.1 (#1765) ##### [\`v0.92.1\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.1) - \[BUGFIX] Fix "namespace not found" errors when the operator watches monitoring and workload resources in different resources. [#8658](prometheus-operator/prometheus-operator#8658) --- ##### [\`v0.92.0\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.0) > \[!NOTE] > The `PrometheusTopologySharding` and `PrometheusShardRetentionPolicy` feature gates have been promoted to **Beta** in this release and are now enabled by default. See the [sharding documentation](https://prometheus-operator.dev/docs/platform/sharding/) for details. - \[CHANGE] Add URL validation for the `tokenUrl` field in OAuth2 configuration across all CRDs. [#8579](prometheus-operator/prometheus-operator#8579) - \[CHANGE] Add URL validation for the `url` field in `RemoteReadSpec` in `Prometheus` CRD. [#8596](prometheus-operator/prometheus-operator#8596) - \[FEATURE] Migrate retention options from CLI flags to the config file for `Prometheus` CRD (Prometheus >= v3 uses the config file; older versions continue to use CLI flags). [#8547](prometheus-operator/prometheus-operator#8547) - \[FEATURE] Add `staleSeriesCompactionThreshold` field to `TSDBSpec` in `Prometheus` and `PrometheusAgent` CRDs. [#8563](prometheus-operator/prometheus-operator#8563) - \[FEATURE] Add `labelNameUnderscoreSanitization` and `labelNamePreserveMultipleUnderscores` fields to `OTLPConfig` in `Prometheus` and `PrometheusAgent` CRDs. [#8562](prometheus-operator/prometheus-operator#8562) - \[FEATURE] Add `payload` field to Webhook receiver in `AlertmanagerConfig` CRD. [#8507](prometheus-operator/prometheus-operator#8507) - \[ENHANCEMENT] Use pod topology labels for zone sharding on Kubernetes >= 1.35 when the `PrometheusTopologySharding` feature gate is enabled (removes the need for `attachMetadata.node=true`). [#8564](prometheus-operator/prometheus-operator#8564) - \[ENHANCEMENT] Add validation for the Slack `update_message` field in Alertmanager configuration Secret. [#8556](prometheus-operator/prometheus-operator#8556) - \[BUGFIX] Validate target labels in `Probe` static configuration to prevent invalid Prometheus scrape configs. [#7901](prometheus-operator/prometheus-operator#7901) - \[BUGFIX] Fix goroutine leak and data race in `pollBasedListerWatcher`. [#8593](prometheus-operator/prometheus-operator#8593) - \[BUGFIX] Validate `ProxyConfig` in OAuth2 configuration. [#8610](prometheus-operator/prometheus-operator#8610) - \[BUGFIX] Fix SMTP smarthost format error handling in Alertmanager configuration. [#8586](prometheus-operator/prometheus-operator#8586) - \[BUGFIX] Fix missing `return` in admission webhook after marshal failure. [#8582](prometheus-operator/prometheus-operator#8582) - \[BUGFIX] Fix `FindOwner` to return `nil` on `meta.Accessor` error. [#8585](prometheus-operator/prometheus-operator#8585) - \[BUGFIX] Fix dropped gzip `Close` errors in `GzipConfig` and `GunzipConfig`. [#8573](prometheus-operator/prometheus-operator#8573) - \[BUGFIX] Fix panic on malformed key=value flag input (e.g. `--labels "key"`). [#8560](prometheus-operator/prometheus-operator#8560) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fix error handling in both gzip helper functions in
pkg/operator/gzip_config.go.Fixes #8572
Why
GzipConfig:
gzip.Writer.Close()flushes buffered data and writes the mandatory gzip footer (CRC32 checksum + uncompressed size). Usingdefer buf.Close()silently discards this error. If Close fails, the function returns nil (success) but the output is corrupted (missing footer).Both Prometheus and Alertmanager config compression paths rely on this:
pkg/prometheus/common.go:136pkg/alertmanager/operator.go:992GunzipConfig:
gzip.Reader.Close()is never called. The Go standard library documentation states: "In order to verify the integrity of the data, the caller must call Close when finished reading."How
GzipConfig: Returnbuf.Close()directly instead of deferring it.GunzipConfig: Addreader.Close()afterio.Copyand propagate its error.Verification
go build ./pkg/operator/... ./pkg/prometheus/... ./pkg/alertmanager/...passesgo test ./pkg/operator/...passesgo vet ./pkg/operator/...clean