admission: add missing return after http.Error on marshal failure#8582
Merged
simonpasquier merged 1 commit intoMay 21, 2026
Merged
Conversation
When json.Marshal fails in serveAdmission, the handler calls http.Error but does not return, causing execution to fall through to w.Write with nil bytes on an already-committed response. Add return after the http.Error call and move the debug log after the error check so it doesn't log nil response bytes on failure. Signed-off-by: Sebastien Tardif <[email protected]>
simonpasquier
enabled auto-merge
May 21, 2026 14:56
simonpasquier
merged commit May 21, 2026
75553fe
into
prometheus-operator:main
21 of 22 checks passed
sdwilsh
pushed a commit
to sdwilsh/ansible-playbooks
that referenced
this pull request
Jul 22, 2026
…r to v0.92.1 (#1765) ##### [\`v0.92.1\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.1) - \[BUGFIX] Fix "namespace not found" errors when the operator watches monitoring and workload resources in different resources. [#8658](prometheus-operator/prometheus-operator#8658) --- ##### [\`v0.92.0\`](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.92.0) > \[!NOTE] > The `PrometheusTopologySharding` and `PrometheusShardRetentionPolicy` feature gates have been promoted to **Beta** in this release and are now enabled by default. See the [sharding documentation](https://prometheus-operator.dev/docs/platform/sharding/) for details. - \[CHANGE] Add URL validation for the `tokenUrl` field in OAuth2 configuration across all CRDs. [#8579](prometheus-operator/prometheus-operator#8579) - \[CHANGE] Add URL validation for the `url` field in `RemoteReadSpec` in `Prometheus` CRD. [#8596](prometheus-operator/prometheus-operator#8596) - \[FEATURE] Migrate retention options from CLI flags to the config file for `Prometheus` CRD (Prometheus >= v3 uses the config file; older versions continue to use CLI flags). [#8547](prometheus-operator/prometheus-operator#8547) - \[FEATURE] Add `staleSeriesCompactionThreshold` field to `TSDBSpec` in `Prometheus` and `PrometheusAgent` CRDs. [#8563](prometheus-operator/prometheus-operator#8563) - \[FEATURE] Add `labelNameUnderscoreSanitization` and `labelNamePreserveMultipleUnderscores` fields to `OTLPConfig` in `Prometheus` and `PrometheusAgent` CRDs. [#8562](prometheus-operator/prometheus-operator#8562) - \[FEATURE] Add `payload` field to Webhook receiver in `AlertmanagerConfig` CRD. [#8507](prometheus-operator/prometheus-operator#8507) - \[ENHANCEMENT] Use pod topology labels for zone sharding on Kubernetes >= 1.35 when the `PrometheusTopologySharding` feature gate is enabled (removes the need for `attachMetadata.node=true`). [#8564](prometheus-operator/prometheus-operator#8564) - \[ENHANCEMENT] Add validation for the Slack `update_message` field in Alertmanager configuration Secret. [#8556](prometheus-operator/prometheus-operator#8556) - \[BUGFIX] Validate target labels in `Probe` static configuration to prevent invalid Prometheus scrape configs. [#7901](prometheus-operator/prometheus-operator#7901) - \[BUGFIX] Fix goroutine leak and data race in `pollBasedListerWatcher`. [#8593](prometheus-operator/prometheus-operator#8593) - \[BUGFIX] Validate `ProxyConfig` in OAuth2 configuration. [#8610](prometheus-operator/prometheus-operator#8610) - \[BUGFIX] Fix SMTP smarthost format error handling in Alertmanager configuration. [#8586](prometheus-operator/prometheus-operator#8586) - \[BUGFIX] Fix missing `return` in admission webhook after marshal failure. [#8582](prometheus-operator/prometheus-operator#8582) - \[BUGFIX] Fix `FindOwner` to return `nil` on `meta.Accessor` error. [#8585](prometheus-operator/prometheus-operator#8585) - \[BUGFIX] Fix dropped gzip `Close` errors in `GzipConfig` and `GunzipConfig`. [#8573](prometheus-operator/prometheus-operator#8573) - \[BUGFIX] Fix panic on malformed key=value flag input (e.g. `--labels "key"`). [#8560](prometheus-operator/prometheus-operator#8560) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
In
pkg/admission/admission.go, functionserveAdmission: whenjson.Marshal(responseAdmissionReview)fails,http.Erroris called but execution falls through tow.Write(respBytes)with nil bytes on an already-committed response. This triggers Go's "http: superfluous response.WriteHeader call" warning and writes corrupted output.The two earlier error handlers (empty body, wrong content-type) both correctly
return. This was the only path missing it.Fix:
returnafter thehttp.Errorcall on the marshal error pathrespBytesis validAI Disclosure
Developed with AI assistance (Grok by xAI) in a human-in-the-loop workflow. All code reviewed and verified by the human author.
Signed-off-by: Sebastien Tardif [email protected]