diff --git a/manifests/infrastructure-roles.yaml b/manifests/infrastructure-roles.yaml
index e2c6e885b..66236a1be 100644
--- a/manifests/infrastructure-roles.yaml
+++ b/manifests/infrastructure-roles.yaml
@@ -1,5 +1,9 @@
 apiVersion: v1
 data:
+  # required format (w/o quotes): 'propertyNumber: value'
+  # allowed properties: 'user', 'password', 'inrole'
+  # numbers >= 1 are mandatory
+  
   # robot_zmon_acid_monitoring
   user1: cm9ib3Rfem1vbl9hY2lkX21vbml0b3Jpbmc=
   # robot_zmon
diff --git a/pkg/controller/util.go b/pkg/controller/util.go
index 74f4855c2..806573df8 100644
--- a/pkg/controller/util.go
+++ b/pkg/controller/util.go
@@ -137,6 +137,8 @@ Users:
 					c.logger.Warningf("unknown key %q", p)
 				}
 			}
+
+			delete(data, key)
 		}
 
 		if t.Name != "" {
@@ -144,6 +146,12 @@ Users:
 		}
 	}
 
+	if len(data) != 0 {
+		c.logger.Warningf("%d unprocessed entries in the infrastructure roles' secret", len(data))
+		c.logger.Info(`infrastructure role entries should be in the {key}{id} format, where {key} can be either of "user", "password", "inrole" and the {id} a monotonically increasing integer starting with 1`)
+		c.logger.Debugf("unprocessed entries: %#v", data)
+	}
+
 	return result, nil
 }