From 81b9ee72415f46b8e88bd2932fd7d62846a1beb7 Mon Sep 17 00:00:00 2001
From: csuzhangxc <csuzhangxc@gmail.com>
Date: Mon, 9 Nov 2026 09:51:00 +0800
Subject: [PATCH 1/5] fix(initializer): treat legacy template values as literal
 data

---
 .github/workflows/build-security.yaml |   2 +
 monitor/v2.1.10/init.sh               | 104 +++++++++-------
 monitor/v2.1.11/init.sh               | 104 +++++++++-------
 monitor/v2.1.12/init.sh               | 104 +++++++++-------
 monitor/v2.1.13/init.sh               | 104 +++++++++-------
 monitor/v2.1.14/init.sh               | 104 +++++++++-------
 monitor/v2.1.15/init.sh               | 104 +++++++++-------
 monitor/v2.1.16/init.sh               | 104 +++++++++-------
 monitor/v2.1.17/init.sh               | 104 +++++++++-------
 monitor/v2.1.18/init.sh               | 104 +++++++++-------
 monitor/v2.1.19/init.sh               | 104 +++++++++-------
 monitor/v2.1.8/init.sh                | 104 +++++++++-------
 monitor/v2.1.9/init.sh                | 104 +++++++++-------
 monitor/v3.0.0-beta.1/init.sh         | 104 +++++++++-------
 monitor/v3.0.0-beta/init.sh           | 104 +++++++++-------
 monitor/v3.0.0-rc.1/init.sh           | 104 +++++++++-------
 monitor/v3.0.0-rc.2/init.sh           | 104 +++++++++-------
 monitor/v3.0.0-rc.3/init.sh           | 104 +++++++++-------
 monitor/v3.0.0/init.sh                | 104 +++++++++-------
 monitor/v3.0.1/init.sh                | 104 +++++++++-------
 monitor/v3.0.11/init.sh               | 104 +++++++++-------
 monitor/v3.0.12/init.sh               | 104 +++++++++-------
 monitor/v3.0.2/init.sh                | 104 +++++++++-------
 monitor/v3.0.3/init.sh                | 104 +++++++++-------
 monitor/v3.0.4/init.sh                | 104 +++++++++-------
 monitor/v3.0.5-hotfix/init.sh         | 104 +++++++++-------
 monitor/v3.0.5/init.sh                | 104 +++++++++-------
 monitor/v3.0.6/init.sh                | 104 +++++++++-------
 monitor/v3.0.7/init.sh                | 104 +++++++++-------
 monitor/v3.0.8/init.sh                | 104 +++++++++-------
 monitor/v3.0.9/init.sh                | 104 +++++++++-------
 monitor/v3.1.0-beta.1/init.sh         | 104 +++++++++-------
 monitor/v3.1.0-beta.2/init.sh         | 104 +++++++++-------
 monitor/v3.1.0-beta/init.sh           | 104 +++++++++-------
 monitor/v4.0.0-beta.1/init.sh         | 104 +++++++++-------
 monitor/v4.0.0-beta.2/init.sh         | 104 +++++++++-------
 monitor/v4.0.0-beta/init.sh           | 104 +++++++++-------
 scripts/test_legacy_initializer.py    | 169 ++++++++++++++++++++++++++
 38 files changed, 2403 insertions(+), 1512 deletions(-)
 create mode 100644 scripts/test_legacy_initializer.py

diff --git a/.github/workflows/build-security.yaml b/.github/workflows/build-security.yaml
index 270213c7..73afcb87 100644
--- a/.github/workflows/build-security.yaml
+++ b/.github/workflows/build-security.yaml
@@ -9,6 +9,7 @@ on:
       - 'cmd/**'
       - 'platform-monitoring/operator/**'
       - 'monitor-snapshot/master/operator/**'
+      - 'monitor/v*/init.sh'
       - 'scripts/**'
       - 'go.mod'
       - 'go.sum'
@@ -32,6 +33,7 @@ jobs:
       - run: go test ./pkg/common
       - run: go test ./cmd/monitoring.go ./cmd/cli_test.go ./cmd/dm_rules_test.go ./cmd/persisted_rules_test.go
       - run: python3 -m unittest discover -s scripts -p 'test_build_security.py' -v
+      - run: python3 -m unittest discover -s scripts -p 'test_legacy_initializer.py' -v
 
   reloader:
     runs-on: ubuntu-latest
diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index 4632acef..b7cc69a4 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -1,92 +1,112 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Validate before deleting or copying any existing dashboards or rules.
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
+    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *'
+'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+    esac
+done
+if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Grafana and Prometheus output paths are required" >&2
+    exit 1
+fi
+
+if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
 else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
 fi
 
 # TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
+cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
+    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
+    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
     # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
+    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
     then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
+         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
+    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
+     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
new file mode 100644
index 00000000..0dbe1518
--- /dev/null
+++ b/scripts/test_legacy_initializer.py
@@ -0,0 +1,169 @@
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+INITIALIZERS = sorted((ROOT / "monitor").glob("v*/init.sh"))
+
+
+class LegacyInitializerTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.assets = self.root / "assets"
+        self.assets.mkdir()
+        self.env = dict(os.environ)
+        if sys.platform == "darwin":
+            sed = shutil.which("gsed")
+            if not sed:
+                self.skipTest("GNU sed is required on macOS; deployed images use BusyBox sed")
+            tools = self.root / "bin"
+            tools.mkdir()
+            (tools / "sed").symlink_to(sed)
+            self.env["PATH"] = f"{tools}:{self.env['PATH']}"
+        self.env.update(
+            TIDB_CLUSTER_NAME="test-cluster",
+            TIDB_CLUSTER_NAMESPACE="",
+            TIDB_VERSION="pingcap/tidb:v3.0.0",
+            GF_PROVISIONING_PATH=str(self.root / "grafana"),
+            PROM_CONFIG_PATH=str(self.root / "prometheus"),
+            GF_DATASOURCE_PATH="",
+            GF_K8S_PROMETHEUS_URL="",
+            GF_TIDB_PROMETHEUS_URL="",
+            PROM_PERSISTENT_DIR="",
+        )
+        self.titles = {
+            "tidb": "TiDB", "overview": "Overview", "pd": "PD",
+            "tikv_details": "TiKV-Details", "tikv_summary": "TiKV-Summary",
+            "tikv_trouble_shooting": "TiKV-Trouble-Shooting",
+            "binlog": "Binlog", "lightning": "Lightning",
+        }
+
+    def run_initializer(self, source, pull=False):
+        # Isolate only the image's /tmp assets; run the complete release script.
+        for path in self.assets.iterdir():
+            path.unlink()
+        for name, title in self.titles.items():
+            (self.assets / f"{name}.json").write_text(f"Test-Cluster-{title}\n")
+        if pull:
+            (self.assets / "tikv_pull.json").write_text("Test-Cluster-TiKV\n")
+        (self.assets / "pods.json").write_text("Test-Cluster-Pods-Info $namespace\n")
+        (self.assets / "nodes.json").write_text("nodes\n")
+        for name in ("cluster", "persistent"):
+            (self.assets / f"{name}.rules.yml").write_text("env: ENV_LABELS_ENV\n")
+        for name in ("k8s", "tidb-cluster"):
+            shutil.copyfile(source.parent / "datasources" / f"{name}-datasource.yaml",
+                            self.assets / f"{name}-datasource.yaml")
+        script = self.root / "init.sh"
+        script.write_text(source.read_text().replace("/tmp/", f"{self.assets}/"))
+        return subprocess.run(["sh", str(script)], env=self.env, cwd=self.root,
+                              capture_output=True, text=True, timeout=20)
+
+    def test_all_release_scripts_preserve_outputs(self):
+        self.assertEqual(len(INITIALIZERS), 36)
+        for source in INITIALIZERS:
+            for configured in (False, True):
+                with self.subTest(version=source.parent.name, configured=configured):
+                    self.env.update(GF_DATASOURCE_PATH="", PROM_PERSISTENT_DIR="")
+                    if configured:
+                        datasources = self.root / "datasources"
+                        datasources.mkdir(exist_ok=True)
+                        persistent = self.root / "store/latest-rules/tidb:v3.0.0"
+                        persistent.mkdir(parents=True, exist_ok=True)
+                        (persistent / "persistent.rules.yml").write_text("saved rules\n")
+                        self.env.update(
+                            GF_DATASOURCE_PATH=str(datasources),
+                            PROM_PERSISTENT_DIR=str(self.root / "store"),
+                            TIDB_CLUSTER_NAMESPACE="tenant-a",
+                            GF_K8S_PROMETHEUS_URL="http://k8s:9090",
+                            GF_TIDB_PROMETHEUS_URL="http://tidb:9090",
+                        )
+                    result = self.run_initializer(source, pull=configured)
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(result.stderr, "")
+                    dashboards = self.root / "grafana/dashboards"
+                    for name, title in self.titles.items():
+                        prefix = "Test-Cluster" if configured and name.startswith("tikv_") else "test-cluster"
+                        self.assertEqual((dashboards / f"{name}.json").read_text(), f"{prefix}-{title}\n")
+                    rules = self.root / "prometheus/rules"
+                    self.assertEqual((rules / "cluster.rules.yml").read_text(), "env: test-cluster\n")
+                    self.assertEqual((rules / "persistent.rules.yml").read_text(),
+                                     "saved rules\n" if configured else "env: test-cluster\n")
+                    if configured:
+                        self.assertEqual((dashboards / "tikv_pull.json").read_text(), "test-cluster-TiKV\n")
+                        self.assertEqual((dashboards / "pods.json").read_text(), "test-cluster-Pods-Info tenant-a\n")
+                        self.assertIn("url: http://k8s:9090", (datasources / "k8s-datasource.yaml").read_text())
+
+    def test_sed_arguments_cannot_write_another_file(self):
+        victim = self.root / "victim"
+        self.env["TIDB_CLUSTER_NAME"] = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
+        for source in INITIALIZERS:
+            with self.subTest(version=source.parent.name):
+                victim.write_text("untouched\n")
+                result = self.run_initializer(source)
+                self.assertEqual(victim.read_text(), "untouched\n")
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(result.stderr, "")
+
+    def test_replacements_and_paths_are_literal(self):
+        source = INITIALIZERS[0]
+        victim = self.root / "victim"
+        victim.write_text("untouched\n")
+        payload = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
+        for cluster in ("normal-cluster", payload, r"name&with|slash/and\backslash"):
+            with self.subTest(cluster=cluster):
+                self.env.update(TIDB_CLUSTER_NAME=cluster)
+                for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH", "GF_DATASOURCE_PATH", "PROM_PERSISTENT_DIR"):
+                    path = self.root / f"{key} with spaces"
+                    path.mkdir(exist_ok=True)
+                    self.env[key] = str(path)
+                persistent = Path(self.env["PROM_PERSISTENT_DIR"]) / "latest-rules/tidb:v3.0.0"
+                persistent.mkdir(parents=True, exist_ok=True)
+                (persistent / "persistent.rules.yml").write_text("saved rules\n")
+                url = r"https://metrics.example/query?one=1&two=2,three=3|four=\value"
+                self.env.update(GF_K8S_PROMETHEUS_URL=url, GF_TIDB_PROMETHEUS_URL=url)
+                result = self.run_initializer(source)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(result.stderr, "")
+                dashboards = Path(self.env["GF_PROVISIONING_PATH"]) / "dashboards"
+                self.assertEqual((dashboards / "tidb.json").read_text(), f"{cluster}-TiDB\n")
+                self.assertEqual((dashboards / "pods.json").read_text(), f"{cluster}-Pods-Info default\n")
+                rules = Path(self.env["PROM_CONFIG_PATH"]) / "rules"
+                self.assertEqual((rules / "cluster.rules.yml").read_text(), f"env: {cluster}\n")
+                self.assertEqual((rules / "persistent.rules.yml").read_text(), "saved rules\n")
+                for name in ("k8s", "tidb-cluster"):
+                    data = Path(self.env["GF_DATASOURCE_PATH"]) / f"{name}-datasource.yaml"
+                    self.assertIn(f"url: {url}", data.read_text())
+                self.assertEqual(victim.read_text(), "untouched\n")
+
+    def test_invalid_values_fail_before_modifying_output(self):
+        dashboard = self.root / "grafana/dashboards/existing.json"
+        dashboard.parent.mkdir(parents=True)
+        dashboard.write_text("keep\n")
+        for key in ("TIDB_CLUSTER_NAME", "TIDB_CLUSTER_NAMESPACE", "GF_K8S_PROMETHEUS_URL", "GF_TIDB_PROMETHEUS_URL"):
+            for value in ("first\nsecond", "first\rsecond"):
+                with self.subTest(key=key, value=value):
+                    original = self.env[key]
+                    self.env[key] = value
+                    result = self.run_initializer(INITIALIZERS[0])
+                    self.env[key] = original
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertEqual(dashboard.read_text(), "keep\n")
+        for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH"):
+            with self.subTest(key=key):
+                original = self.env[key]
+                self.env[key] = ""
+                result = self.run_initializer(INITIALIZERS[0])
+                self.env[key] = original
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual(dashboard.read_text(), "keep\n")
+
+
+if __name__ == "__main__":
+    unittest.main()

From 5e409214c798e7bbc7dc60725c974206d57baa2f Mon Sep 17 00:00:00 2001
From: csuzhangxc <csuzhangxc@gmail.com>
Date: Mon, 9 Nov 2026 10:03:06 +0800
Subject: [PATCH 2/5] fix(initializer): JSON-escape legacy dashboard titles

---
 .github/workflows/build-security.yaml |  1 +
 monitor/v2.1.10/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.11/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.12/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.13/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.14/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.15/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.16/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.17/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.18/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.19/init.sh               | 39 +++++++++++++++------
 monitor/v2.1.8/init.sh                | 39 +++++++++++++++------
 monitor/v2.1.9/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.0-beta.1/init.sh         | 39 +++++++++++++++------
 monitor/v3.0.0-beta/init.sh           | 39 +++++++++++++++------
 monitor/v3.0.0-rc.1/init.sh           | 39 +++++++++++++++------
 monitor/v3.0.0-rc.2/init.sh           | 39 +++++++++++++++------
 monitor/v3.0.0-rc.3/init.sh           | 39 +++++++++++++++------
 monitor/v3.0.0/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.1/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.11/init.sh               | 39 +++++++++++++++------
 monitor/v3.0.12/init.sh               | 39 +++++++++++++++------
 monitor/v3.0.2/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.3/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.4/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.5-hotfix/init.sh         | 39 +++++++++++++++------
 monitor/v3.0.5/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.6/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.7/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.8/init.sh                | 39 +++++++++++++++------
 monitor/v3.0.9/init.sh                | 39 +++++++++++++++------
 monitor/v3.1.0-beta.1/init.sh         | 39 +++++++++++++++------
 monitor/v3.1.0-beta.2/init.sh         | 39 +++++++++++++++------
 monitor/v3.1.0-beta/init.sh           | 39 +++++++++++++++------
 monitor/v4.0.0-beta.1/init.sh         | 39 +++++++++++++++------
 monitor/v4.0.0-beta.2/init.sh         | 39 +++++++++++++++------
 monitor/v4.0.0-beta/init.sh           | 39 +++++++++++++++------
 scripts/test_legacy_initializer.py    | 49 +++++++++++++++++++++------
 38 files changed, 1084 insertions(+), 370 deletions(-)

diff --git a/.github/workflows/build-security.yaml b/.github/workflows/build-security.yaml
index 73afcb87..52083209 100644
--- a/.github/workflows/build-security.yaml
+++ b/.github/workflows/build-security.yaml
@@ -10,6 +10,7 @@ on:
       - 'platform-monitoring/operator/**'
       - 'monitor-snapshot/master/operator/**'
       - 'monitor/v*/init.sh'
+      - 'monitor/v*/dashboards/*.json'
       - 'scripts/**'
       - 'go.mod'
       - 'go.sum'
diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index b7cc69a4..57c06fd4 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -6,6 +6,25 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
+# Encode JSON string contents before protecting them from sed interpretation.
+replace_dashboard_title() {
+    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+        BEGIN {
+            for (i = 1; i < 32; i++)
+                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes["\\"] = "\\\\"
+            escapes["\""] = "\\\""
+        }
+        {
+            for (i = 1; i <= length($0); i++) {
+                c = substr($0, i, 1)
+                printf "%s", (c in escapes ? escapes[c] : c)
+            }
+        }
+    ') || return 1
+    replace_template "$1" "$json_value" "$3"
+}
+
 # Validate before deleting or copying any existing dashboards or rules.
 for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
     "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
@@ -27,33 +46,33 @@ fi
 
 # TiDB dashboard
 cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
 # Overview dashboard
 cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
 # PD dashboard
 cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
 # TiKV dashboard
 cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
 if [ ! -f /tmp/tikv_pull.json ];then
-    replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
 else
-    replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
 fi
 
 # Binlog dashboard
 cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
 # Lighting
 cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
 
 # Rules
@@ -103,7 +122,7 @@ then
     else
          sed -i 's/$namespace/default/g' /tmp/pods.json
     fi
-    replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
     cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
 
     # nodes
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
index 0dbe1518..a769304d 100644
--- a/scripts/test_legacy_initializer.py
+++ b/scripts/test_legacy_initializer.py
@@ -1,3 +1,4 @@
+import json
 import os
 from pathlib import Path
 import shutil
@@ -45,16 +46,21 @@ def setUp(self):
             "binlog": "Binlog", "lightning": "Lightning",
         }
 
-    def run_initializer(self, source, pull=False):
+    def run_initializer(self, source, pull=False, real_dashboards=False):
         # Isolate only the image's /tmp assets; run the complete release script.
         for path in self.assets.iterdir():
             path.unlink()
         for name, title in self.titles.items():
-            (self.assets / f"{name}.json").write_text(f"Test-Cluster-{title}\n")
+            (self.assets / f"{name}.json").write_text(json.dumps({"title": f"Test-Cluster-{title}"}))
         if pull:
-            (self.assets / "tikv_pull.json").write_text("Test-Cluster-TiKV\n")
-        (self.assets / "pods.json").write_text("Test-Cluster-Pods-Info $namespace\n")
-        (self.assets / "nodes.json").write_text("nodes\n")
+            (self.assets / "tikv_pull.json").write_text(json.dumps({"title": "Test-Cluster-TiKV"}))
+        (self.assets / "pods.json").write_text(json.dumps({"title": "Test-Cluster-Pods-Info", "namespace": "$namespace"}))
+        (self.assets / "nodes.json").write_text(json.dumps({"title": "nodes"}))
+        if real_dashboards:
+            for path in self.assets.glob("*.json"):
+                path.unlink()
+            for path in (source.parent / "dashboards").glob("*.json"):
+                shutil.copyfile(path, self.assets / path.name)
         for name in ("cluster", "persistent"):
             (self.assets / f"{name}.rules.yml").write_text("env: ENV_LABELS_ENV\n")
         for name in ("k8s", "tidb-cluster"):
@@ -90,16 +96,39 @@ def test_all_release_scripts_preserve_outputs(self):
                     dashboards = self.root / "grafana/dashboards"
                     for name, title in self.titles.items():
                         prefix = "Test-Cluster" if configured and name.startswith("tikv_") else "test-cluster"
-                        self.assertEqual((dashboards / f"{name}.json").read_text(), f"{prefix}-{title}\n")
+                        self.assertEqual(json.loads((dashboards / f"{name}.json").read_text())["title"], f"{prefix}-{title}")
                     rules = self.root / "prometheus/rules"
                     self.assertEqual((rules / "cluster.rules.yml").read_text(), "env: test-cluster\n")
                     self.assertEqual((rules / "persistent.rules.yml").read_text(),
                                      "saved rules\n" if configured else "env: test-cluster\n")
                     if configured:
-                        self.assertEqual((dashboards / "tikv_pull.json").read_text(), "test-cluster-TiKV\n")
-                        self.assertEqual((dashboards / "pods.json").read_text(), "test-cluster-Pods-Info tenant-a\n")
+                        self.assertEqual(json.loads((dashboards / "tikv_pull.json").read_text())["title"], "test-cluster-TiKV")
+                        self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": "test-cluster-Pods-Info", "namespace": "tenant-a"})
                         self.assertIn("url: http://k8s:9090", (datasources / "k8s-datasource.yaml").read_text())
 
+    def test_real_dashboards_preserve_cluster_names(self):
+        datasources = self.root / "datasources"
+        datasources.mkdir()
+        self.env["GF_DATASOURCE_PATH"] = str(datasources)
+        controls = "".join(chr(i) for i in range(1, 32) if i not in (10, 13))
+        for source in INITIALIZERS:
+            for cluster in ("test-cluster", r"region\qa", r"region\new", 'region"qa',
+                            "region\\", "区域&qa|test", "region" + controls):
+                with self.subTest(version=source.parent.name, cluster=cluster):
+                    self.env["TIDB_CLUSTER_NAME"] = cluster
+                    result = self.run_initializer(source, real_dashboards=True)
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(result.stderr, "")
+                    for template in (source.parent / "dashboards").glob("*.json"):
+                        content = template.read_text()
+                        if template.name == "pods.json":
+                            content = content.replace("$namespace", "default")
+                        expected = json.loads(content)
+                        if expected["title"].startswith("Test-Cluster-"):
+                            expected["title"] = cluster + expected["title"][len("Test-Cluster"):]
+                        actual = json.loads((self.root / "grafana/dashboards" / template.name).read_text())
+                        self.assertEqual(actual, expected, template.name)
+
     def test_sed_arguments_cannot_write_another_file(self):
         victim = self.root / "victim"
         self.env["TIDB_CLUSTER_NAME"] = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
@@ -132,8 +161,8 @@ def test_replacements_and_paths_are_literal(self):
                 self.assertEqual(result.returncode, 0, result.stderr)
                 self.assertEqual(result.stderr, "")
                 dashboards = Path(self.env["GF_PROVISIONING_PATH"]) / "dashboards"
-                self.assertEqual((dashboards / "tidb.json").read_text(), f"{cluster}-TiDB\n")
-                self.assertEqual((dashboards / "pods.json").read_text(), f"{cluster}-Pods-Info default\n")
+                self.assertEqual(json.loads((dashboards / "tidb.json").read_text())["title"], f"{cluster}-TiDB")
+                self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": f"{cluster}-Pods-Info", "namespace": "default"})
                 rules = Path(self.env["PROM_CONFIG_PATH"]) / "rules"
                 self.assertEqual((rules / "cluster.rules.yml").read_text(), f"env: {cluster}\n")
                 self.assertEqual((rules / "persistent.rules.yml").read_text(), "saved rules\n")

From ad4be4a3e4228051ffbd048908baaa319228a659 Mon Sep 17 00:00:00 2001
From: csuzhangxc <csuzhangxc@gmail.com>
Date: Mon, 9 Nov 2026 10:21:44 +0800
Subject: [PATCH 3/5] fix(initializer): encode cluster names in rule YAML and
 descriptions

---
 .github/workflows/build-security.yaml |   7 +
 monitor/v2.1.10/init.sh               |  33 ++++-
 monitor/v2.1.11/init.sh               |  33 ++++-
 monitor/v2.1.12/init.sh               |  33 ++++-
 monitor/v2.1.13/init.sh               |  33 ++++-
 monitor/v2.1.14/init.sh               |  33 ++++-
 monitor/v2.1.15/init.sh               |  33 ++++-
 monitor/v2.1.16/init.sh               |  33 ++++-
 monitor/v2.1.17/init.sh               |  33 ++++-
 monitor/v2.1.18/init.sh               |  33 ++++-
 monitor/v2.1.19/init.sh               |  33 ++++-
 monitor/v2.1.8/init.sh                |  33 ++++-
 monitor/v2.1.9/init.sh                |  33 ++++-
 monitor/v3.0.0-beta.1/init.sh         |  33 ++++-
 monitor/v3.0.0-beta/init.sh           |  33 ++++-
 monitor/v3.0.0-rc.1/init.sh           |  33 ++++-
 monitor/v3.0.0-rc.2/init.sh           |  33 ++++-
 monitor/v3.0.0-rc.3/init.sh           |  33 ++++-
 monitor/v3.0.0/init.sh                |  33 ++++-
 monitor/v3.0.1/init.sh                |  33 ++++-
 monitor/v3.0.11/init.sh               |  33 ++++-
 monitor/v3.0.12/init.sh               |  33 ++++-
 monitor/v3.0.2/init.sh                |  33 ++++-
 monitor/v3.0.3/init.sh                |  33 ++++-
 monitor/v3.0.4/init.sh                |  33 ++++-
 monitor/v3.0.5-hotfix/init.sh         |  33 ++++-
 monitor/v3.0.5/init.sh                |  33 ++++-
 monitor/v3.0.6/init.sh                |  33 ++++-
 monitor/v3.0.7/init.sh                |  33 ++++-
 monitor/v3.0.8/init.sh                |  33 ++++-
 monitor/v3.0.9/init.sh                |  33 ++++-
 monitor/v3.1.0-beta.1/init.sh         |  33 ++++-
 monitor/v3.1.0-beta.2/init.sh         |  33 ++++-
 monitor/v3.1.0-beta/init.sh           |  33 ++++-
 monitor/v4.0.0-beta.1/init.sh         |  33 ++++-
 monitor/v4.0.0-beta.2/init.sh         |  33 ++++-
 monitor/v4.0.0-beta/init.sh           |  33 ++++-
 scripts/legacy_rules_test.go          | 179 ++++++++++++++++++++++++++
 scripts/test_legacy_initializer.py    |   6 +-
 39 files changed, 1197 insertions(+), 183 deletions(-)
 create mode 100644 scripts/legacy_rules_test.go

diff --git a/.github/workflows/build-security.yaml b/.github/workflows/build-security.yaml
index 52083209..44e394c9 100644
--- a/.github/workflows/build-security.yaml
+++ b/.github/workflows/build-security.yaml
@@ -11,6 +11,7 @@ on:
       - 'monitor-snapshot/master/operator/**'
       - 'monitor/v*/init.sh'
       - 'monitor/v*/dashboards/*.json'
+      - 'monitor/v*/rules/*.rules.yml'
       - 'scripts/**'
       - 'go.mod'
       - 'go.sum'
@@ -35,6 +36,12 @@ jobs:
       - run: go test ./cmd/monitoring.go ./cmd/cli_test.go ./cmd/dm_rules_test.go ./cmd/persisted_rules_test.go
       - run: python3 -m unittest discover -s scripts -p 'test_build_security.py' -v
       - run: python3 -m unittest discover -s scripts -p 'test_legacy_initializer.py' -v
+      - name: Check legacy rules with promtool 2.27.1
+        run: |
+          promtool_container=$(docker create prom/prometheus:v2.27.1)
+          trap 'docker rm "$promtool_container" >/dev/null' EXIT
+          docker cp "$promtool_container:/bin/promtool" "$RUNNER_TEMP/promtool"
+          PROMTOOL="$RUNNER_TEMP/promtool" go test ./scripts/legacy_rules_test.go
 
   reloader:
     runs-on: ubuntu-latest
diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index 57c06fd4..52d20927 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -6,22 +6,38 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# Encode JSON string contents before protecting them from sed interpretation.
-replace_dashboard_title() {
-    json_value=$(printf '%s' "$2" | LC_ALL=C awk '
+# JSON string contents also work inside YAML double-quoted scalars.
+json_string() {
+    printf '%s' "$1" | LC_ALL=C awk '
         BEGIN {
             for (i = 1; i < 32; i++)
                 escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c", 127)] = "\\u007f"
+            for (i = 128; i < 160; i++)
+                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
+            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
+            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
             escapes["\\"] = "\\\\"
             escapes["\""] = "\\\""
         }
         {
             for (i = 1; i <= length($0); i++) {
                 c = substr($0, i, 1)
+                if (substr($0, i, 2) in escapes) {
+                    c = substr($0, i, 2)
+                    i++
+                } else if (substr($0, i, 3) in escapes) {
+                    c = substr($0, i, 3)
+                    i += 2
+                }
                 printf "%s", (c in escapes ? escapes[c] : c)
             }
         }
-    ') || return 1
+    '
+}
+
+replace_dashboard_title() {
+    json_value=$(json_string "$2") || return 1
     replace_template "$1" "$json_value" "$3"
 }
 
@@ -76,6 +92,10 @@ replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning
 
 
 # Rules
+json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
+rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
+# A constant template preserves the name without relying on sample labels.env.
+rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -87,7 +107,10 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    replace_template 'ENV_LABELS_ENV' "${TIDB_CLUSTER_NAME}" "$file"
+    sed -i \
+        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
+        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
+        -- "$file"
 done
 
 # Copy Persistent rules to override raw files
diff --git a/scripts/legacy_rules_test.go b/scripts/legacy_rules_test.go
new file mode 100644
index 00000000..662b15b5
--- /dev/null
+++ b/scripts/legacy_rules_test.go
@@ -0,0 +1,179 @@
+package scripts
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"testing"
+	"text/template"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestLegacyInitializerRuleStrings(t *testing.T) {
+	releases, err := filepath.Glob("../monitor/v*/init.sh")
+	if err != nil || len(releases) != 36 {
+		t.Fatalf("release scripts: %d, %v", len(releases), err)
+	}
+	extraPath := ""
+	if runtime.GOOS == "darwin" {
+		sed, err := exec.LookPath("gsed")
+		if err != nil {
+			t.Skip("GNU sed is required on macOS")
+		}
+		bin := t.TempDir()
+		if err := os.Symlink(sed, filepath.Join(bin, "sed")); err != nil {
+			t.Fatal(err)
+		}
+		extraPath = bin + string(os.PathListSeparator)
+	}
+	for _, script := range releases {
+		names := []string{"test-cluster", "&"}
+		if filepath.Base(filepath.Dir(script)) == "v3.0.0" {
+			names = append(names, "team'qa", "region: qa", "*alias", "#comment", "true", "null", "123", "", "ENV_LABELS_ENV", `region\qa`, `region"qa`, "区域", "control\t\x01\x7f", "unicode\u0085\u009f\u2028\u2029", "description: 'cluster: ENV_LABELS_ENV")
+		}
+		for _, name := range names {
+			t.Run(filepath.Base(filepath.Dir(script))+"/"+name, func(t *testing.T) {
+				root, err := os.MkdirTemp("", "legacy-rules-")
+				if err != nil {
+					t.Fatal(err)
+				}
+				t.Cleanup(func() { os.RemoveAll(root) })
+				assets := filepath.Join(root, "assets")
+				if err := os.Mkdir(assets, 0755); err != nil {
+					t.Fatal(err)
+				}
+				for _, kind := range []string{"dashboards", "rules", "datasources"} {
+					files, err := filepath.Glob(filepath.Join(filepath.Dir(script), kind, "*"))
+					if err != nil {
+						t.Fatal(err)
+					}
+					for _, file := range files {
+						data, err := os.ReadFile(file)
+						if err != nil {
+							t.Fatal(err)
+						}
+						if err := os.WriteFile(filepath.Join(assets, filepath.Base(file)), data, 0600); err != nil {
+							t.Fatal(err)
+						}
+					}
+				}
+				data, err := os.ReadFile(script)
+				if err != nil {
+					t.Fatal(err)
+				}
+				run := filepath.Join(root, "init.sh")
+				if err := os.WriteFile(run, []byte(strings.ReplaceAll(string(data), "/tmp/", assets+"/")), 0600); err != nil {
+					t.Fatal(err)
+				}
+				cmd := exec.Command("sh", run)
+				cmd.Env = append(os.Environ(), "PATH="+extraPath+os.Getenv("PATH"), "TIDB_CLUSTER_NAME="+name,
+					"GF_PROVISIONING_PATH="+filepath.Join(root, "grafana"), "PROM_CONFIG_PATH="+filepath.Join(root, "prometheus"),
+					"GF_DATASOURCE_PATH=", "PROM_PERSISTENT_DIR=", "GF_K8S_PROMETHEUS_URL=", "GF_TIDB_PROMETHEUS_URL=", "TIDB_CLUSTER_NAMESPACE=")
+				if out, err := cmd.CombinedOutput(); err != nil {
+					t.Fatalf("initializer: %v\n%s", err, out)
+				}
+				rules, _ := filepath.Glob(filepath.Join(filepath.Dir(script), "rules", "*.rules.yml"))
+				for _, file := range rules {
+					originalData, err := os.ReadFile(file)
+					if err != nil {
+						t.Fatal(err)
+					}
+					generated := filepath.Join(root, "prometheus", "rules", filepath.Base(file))
+					actualData, err := os.ReadFile(generated)
+					if err != nil {
+						t.Fatal(err)
+					}
+					var want, got map[string]any
+					if err := yaml.Unmarshal(originalData, &want); err != nil {
+						t.Fatal(err)
+					}
+					if err := yaml.Unmarshal(actualData, &got); err != nil {
+						t.Fatalf("%s: %v", file, err)
+					}
+					for gi, g := range want["groups"].([]any) {
+						actualRules := got["groups"].([]any)[gi].(map[string]any)["rules"].([]any)
+						for ri, r := range g.(map[string]any)["rules"].([]any) {
+							rule := r.(map[string]any)
+							rule["labels"].(map[string]any)["env"] = name
+							annotations := rule["annotations"].(map[string]any)
+							description := annotations["description"].(string)
+							actualDescription := actualRules[ri].(map[string]any)["annotations"].(map[string]any)["description"].(string)
+							wantRendered := strings.ReplaceAll(renderRuleDescription(t, description, name), "ENV_LABELS_ENV", name)
+							if actual := renderRuleDescription(t, actualDescription, name); actual != wantRendered {
+								t.Fatalf("%s: annotation = %q, want %q", file, actual, wantRendered)
+							}
+							annotations["description"] = actualDescription
+						}
+					}
+					if !reflect.DeepEqual(got, want) {
+						t.Fatalf("%s: generated rules changed beyond env and its description reference", file)
+					}
+					if promtool := os.Getenv("PROMTOOL"); promtool != "" && filepath.Base(file) == "tidb.rules.yml" {
+						if out, err := exec.Command(promtool, "check", "rules", generated).CombinedOutput(); err != nil {
+							t.Fatalf("promtool: %v\n%s", err, out)
+						}
+						if filepath.Base(filepath.Dir(script)) == "v3.0.0" && (name == "test-cluster" || name == "&" || name == "team'qa") {
+							checkLegacyAlert(t, promtool, generated, name)
+						}
+					}
+				}
+			})
+		}
+	}
+}
+
+func checkLegacyAlert(t *testing.T, promtool, rules, name string) {
+	t.Helper()
+	data, err := yaml.Marshal(map[string]any{
+		"rule_files": []string{rules}, "evaluation_interval": "1m",
+		"tests": []any{map[string]any{
+			"interval": "1m",
+			"input_series": []any{map[string]any{
+				"series": `tidb_monitor_keep_alive_total{job="tidb",instance="node:4000"}`, "values": "0+0x10",
+			}},
+			"alert_rule_test": []any{map[string]any{
+				"eval_time": "10m", "alertname": "TiDB_monitor_keep_alive",
+				"exp_alerts": []any{map[string]any{
+					"exp_labels": map[string]string{
+						"env": name, "job": "tidb", "instance": "node:4000", "level": "emergency",
+						"expr": `increase(tidb_monitor_keep_alive_total{job="tidb"}[10m]) < 100`,
+					},
+					"exp_annotations": map[string]string{
+						"description": "cluster: " + name + ", instance: node:4000, values:0",
+						"summary":     "TiDB monitor_keep_alive error", "value": "0",
+					},
+				}},
+			}},
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(filepath.Dir(rules), "alert-test.yml")
+	if err := os.WriteFile(file, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if out, err := exec.Command(promtool, "test", "rules", file).CombinedOutput(); err != nil {
+		t.Fatalf("promtool alert evaluation: %v\n%s", err, out)
+	}
+}
+
+func renderRuleDescription(t *testing.T, value, name string) string {
+	t.Helper()
+	tpl, err := template.New("description").Parse("{{ $labels := .Labels }}{{ $value := .Value }}" + value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out bytes.Buffer
+	data := map[string]any{"Labels": map[string]string{"env": "sample-env", "instance": "node:4000", "type": "test"}, "Value": fmt.Sprint(1)}
+	if err := tpl.Execute(&out, data); err != nil {
+		t.Fatal(err)
+	}
+	return out.String()
+}
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
index a769304d..178e2db3 100644
--- a/scripts/test_legacy_initializer.py
+++ b/scripts/test_legacy_initializer.py
@@ -98,9 +98,9 @@ def test_all_release_scripts_preserve_outputs(self):
                         prefix = "Test-Cluster" if configured and name.startswith("tikv_") else "test-cluster"
                         self.assertEqual(json.loads((dashboards / f"{name}.json").read_text())["title"], f"{prefix}-{title}")
                     rules = self.root / "prometheus/rules"
-                    self.assertEqual((rules / "cluster.rules.yml").read_text(), "env: test-cluster\n")
+                    self.assertEqual((rules / "cluster.rules.yml").read_text(), 'env: "test-cluster"\n')
                     self.assertEqual((rules / "persistent.rules.yml").read_text(),
-                                     "saved rules\n" if configured else "env: test-cluster\n")
+                                     "saved rules\n" if configured else 'env: "test-cluster"\n')
                     if configured:
                         self.assertEqual(json.loads((dashboards / "tikv_pull.json").read_text())["title"], "test-cluster-TiKV")
                         self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": "test-cluster-Pods-Info", "namespace": "tenant-a"})
@@ -164,7 +164,7 @@ def test_replacements_and_paths_are_literal(self):
                 self.assertEqual(json.loads((dashboards / "tidb.json").read_text())["title"], f"{cluster}-TiDB")
                 self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": f"{cluster}-Pods-Info", "namespace": "default"})
                 rules = Path(self.env["PROM_CONFIG_PATH"]) / "rules"
-                self.assertEqual((rules / "cluster.rules.yml").read_text(), f"env: {cluster}\n")
+                self.assertEqual(json.loads((rules / "cluster.rules.yml").read_text().removeprefix("env: ")), cluster)
                 self.assertEqual((rules / "persistent.rules.yml").read_text(), "saved rules\n")
                 for name in ("k8s", "tidb-cluster"):
                     data = Path(self.env["GF_DATASOURCE_PATH"]) / f"{name}-datasource.yaml"

From 2b4f8c81b2c4529df303d7dc35426ee8ecaba1ff Mon Sep 17 00:00:00 2001
From: csuzhangxc <csuzhangxc@gmail.com>
Date: Mon, 9 Nov 2026 10:46:38 +0800
Subject: [PATCH 4/5] fix(initializer): narrow legacy injection fix to
 validated inputs

---
 .github/workflows/build-security.yaml |   7 +-
 monitor/v2.1.10/init.sh               | 151 +++++++-----------
 monitor/v2.1.11/init.sh               | 151 +++++++-----------
 monitor/v2.1.12/init.sh               | 151 +++++++-----------
 monitor/v2.1.13/init.sh               | 151 +++++++-----------
 monitor/v2.1.14/init.sh               | 151 +++++++-----------
 monitor/v2.1.15/init.sh               | 151 +++++++-----------
 monitor/v2.1.16/init.sh               | 151 +++++++-----------
 monitor/v2.1.17/init.sh               | 151 +++++++-----------
 monitor/v2.1.18/init.sh               | 151 +++++++-----------
 monitor/v2.1.19/init.sh               | 151 +++++++-----------
 monitor/v2.1.8/init.sh                | 151 +++++++-----------
 monitor/v2.1.9/init.sh                | 151 +++++++-----------
 monitor/v3.0.0-beta.1/init.sh         | 151 +++++++-----------
 monitor/v3.0.0-beta/init.sh           | 151 +++++++-----------
 monitor/v3.0.0-rc.1/init.sh           | 151 +++++++-----------
 monitor/v3.0.0-rc.2/init.sh           | 151 +++++++-----------
 monitor/v3.0.0-rc.3/init.sh           | 151 +++++++-----------
 monitor/v3.0.0/init.sh                | 151 +++++++-----------
 monitor/v3.0.1/init.sh                | 151 +++++++-----------
 monitor/v3.0.11/init.sh               | 151 +++++++-----------
 monitor/v3.0.12/init.sh               | 151 +++++++-----------
 monitor/v3.0.2/init.sh                | 151 +++++++-----------
 monitor/v3.0.3/init.sh                | 151 +++++++-----------
 monitor/v3.0.4/init.sh                | 151 +++++++-----------
 monitor/v3.0.5-hotfix/init.sh         | 151 +++++++-----------
 monitor/v3.0.5/init.sh                | 151 +++++++-----------
 monitor/v3.0.6/init.sh                | 151 +++++++-----------
 monitor/v3.0.7/init.sh                | 151 +++++++-----------
 monitor/v3.0.8/init.sh                | 151 +++++++-----------
 monitor/v3.0.9/init.sh                | 151 +++++++-----------
 monitor/v3.1.0-beta.1/init.sh         | 151 +++++++-----------
 monitor/v3.1.0-beta.2/init.sh         | 151 +++++++-----------
 monitor/v3.1.0-beta/init.sh           | 151 +++++++-----------
 monitor/v4.0.0-beta.1/init.sh         | 151 +++++++-----------
 monitor/v4.0.0-beta.2/init.sh         | 151 +++++++-----------
 monitor/v4.0.0-beta/init.sh           | 151 +++++++-----------
 scripts/legacy_rules_test.go          | 179 ---------------------
 scripts/test_legacy_initializer.py    | 220 ++++++++++----------------
 39 files changed, 2280 insertions(+), 3562 deletions(-)
 delete mode 100644 scripts/legacy_rules_test.go

diff --git a/.github/workflows/build-security.yaml b/.github/workflows/build-security.yaml
index 44e394c9..711fbbe3 100644
--- a/.github/workflows/build-security.yaml
+++ b/.github/workflows/build-security.yaml
@@ -12,6 +12,7 @@ on:
       - 'monitor/v*/init.sh'
       - 'monitor/v*/dashboards/*.json'
       - 'monitor/v*/rules/*.rules.yml'
+      - 'monitor/v*/datasources/*.yaml'
       - 'scripts/**'
       - 'go.mod'
       - 'go.sum'
@@ -36,12 +37,6 @@ jobs:
       - run: go test ./cmd/monitoring.go ./cmd/cli_test.go ./cmd/dm_rules_test.go ./cmd/persisted_rules_test.go
       - run: python3 -m unittest discover -s scripts -p 'test_build_security.py' -v
       - run: python3 -m unittest discover -s scripts -p 'test_legacy_initializer.py' -v
-      - name: Check legacy rules with promtool 2.27.1
-        run: |
-          promtool_container=$(docker create prom/prometheus:v2.27.1)
-          trap 'docker rm "$promtool_container" >/dev/null' EXIT
-          docker cp "$promtool_container:/bin/promtool" "$RUNNER_TEMP/promtool"
-          PROMTOOL="$RUNNER_TEMP/promtool" go test ./scripts/legacy_rules_test.go
 
   reloader:
     runs-on: ubuntu-latest
diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index 52d20927..b7bdccf6 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -6,96 +6,68 @@ replace_template() {
     sed -i "s|$1|$replacement|g" -- "$3"
 }
 
-# JSON string contents also work inside YAML double-quoted scalars.
-json_string() {
-    printf '%s' "$1" | LC_ALL=C awk '
-        BEGIN {
-            for (i = 1; i < 32; i++)
-                escapes[sprintf("%c", i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c", 127)] = "\\u007f"
-            for (i = 128; i < 160; i++)
-                escapes[sprintf("%c%c", 194, i)] = sprintf("\\u%04x", i)
-            escapes[sprintf("%c%c%c", 226, 128, 168)] = "\\u2028"
-            escapes[sprintf("%c%c%c", 226, 128, 169)] = "\\u2029"
-            escapes["\\"] = "\\\\"
-            escapes["\""] = "\\\""
-        }
-        {
-            for (i = 1; i <= length($0); i++) {
-                c = substr($0, i, 1)
-                if (substr($0, i, 2) in escapes) {
-                    c = substr($0, i, 2)
-                    i++
-                } else if (substr($0, i, 3) in escapes) {
-                    c = substr($0, i, 3)
-                    i += 2
-                }
-                printf "%s", (c in escapes ? escapes[c] : c)
-            }
-        }
-    '
-}
-
-replace_dashboard_title() {
-    json_value=$(json_string "$2") || return 1
-    replace_template "$1" "$json_value" "$3"
-}
-
-# Validate before deleting or copying any existing dashboards or rules.
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE" \
-    "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
     case "$value" in
-        *'
-'*|*"$(printf '\r')"*) echo "Initializer values must be single-line" >&2; exit 1;;
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-if [ -z "$GF_PROVISIONING_PATH" ] || [ -z "$PROM_CONFIG_PATH" ]; then
-    echo "Grafana and Prometheus output paths are required" >&2
+for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+    case "$value" in
+        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+    esac
+    case "$value" in
+        ''|http://?*|https://?*) ;;
+        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+    esac
+done
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
     exit 1
 fi
 
-if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
-    mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
-else
-    rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
-fi
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# TiDB dashboard
-cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# Overview dashboard
-cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# PD dashboard
-cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# TiKV dashboard
-cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
-if [ ! -f /tmp/tikv_pull.json ];then
-    replace_dashboard_title 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
-    replace_dashboard_title 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
-else
-    replace_dashboard_title 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
-fi
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Binlog dashboard
-cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
-# Lighting
-cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
-replace_dashboard_title 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
 
+fi
 
 # Rules
-json_cluster_name=$(json_string "$TIDB_CLUSTER_NAME") || exit 1
-rule_label=$(printf '%s' "$json_cluster_name" | sed 's/[\\&|]/\\&/g') || exit 1
-# A constant template preserves the name without relying on sample labels.env.
-rule_description=$(printf '%s' "$json_cluster_name" | sed "s/'/''/g" | sed 's/[\\&|]/\\&/g') || exit 1
 if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
     mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
@@ -107,10 +79,7 @@ echo "$META_VALUE"
 cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
 for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i \
-        -e "s|^\\([[:space:]]*env: \\)ENV_LABELS_ENV$|\\1\"$rule_label\"|" \
-        -e "s|^\\([[:space:]]*description: 'cluster: \\)ENV_LABELS_ENV,|\\1{{ \"$rule_description\" }},|" \
-        -- "$file"
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
@@ -138,17 +107,19 @@ then
     cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
     cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
 
-    # pods
-    if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
-    then
-         replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    replace_dashboard_title 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
-    cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
-
-    # nodes
-     cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
 fi
 
diff --git a/scripts/legacy_rules_test.go b/scripts/legacy_rules_test.go
deleted file mode 100644
index 662b15b5..00000000
--- a/scripts/legacy_rules_test.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package scripts
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"reflect"
-	"runtime"
-	"strings"
-	"testing"
-	"text/template"
-
-	"gopkg.in/yaml.v3"
-)
-
-func TestLegacyInitializerRuleStrings(t *testing.T) {
-	releases, err := filepath.Glob("../monitor/v*/init.sh")
-	if err != nil || len(releases) != 36 {
-		t.Fatalf("release scripts: %d, %v", len(releases), err)
-	}
-	extraPath := ""
-	if runtime.GOOS == "darwin" {
-		sed, err := exec.LookPath("gsed")
-		if err != nil {
-			t.Skip("GNU sed is required on macOS")
-		}
-		bin := t.TempDir()
-		if err := os.Symlink(sed, filepath.Join(bin, "sed")); err != nil {
-			t.Fatal(err)
-		}
-		extraPath = bin + string(os.PathListSeparator)
-	}
-	for _, script := range releases {
-		names := []string{"test-cluster", "&"}
-		if filepath.Base(filepath.Dir(script)) == "v3.0.0" {
-			names = append(names, "team'qa", "region: qa", "*alias", "#comment", "true", "null", "123", "", "ENV_LABELS_ENV", `region\qa`, `region"qa`, "区域", "control\t\x01\x7f", "unicode\u0085\u009f\u2028\u2029", "description: 'cluster: ENV_LABELS_ENV")
-		}
-		for _, name := range names {
-			t.Run(filepath.Base(filepath.Dir(script))+"/"+name, func(t *testing.T) {
-				root, err := os.MkdirTemp("", "legacy-rules-")
-				if err != nil {
-					t.Fatal(err)
-				}
-				t.Cleanup(func() { os.RemoveAll(root) })
-				assets := filepath.Join(root, "assets")
-				if err := os.Mkdir(assets, 0755); err != nil {
-					t.Fatal(err)
-				}
-				for _, kind := range []string{"dashboards", "rules", "datasources"} {
-					files, err := filepath.Glob(filepath.Join(filepath.Dir(script), kind, "*"))
-					if err != nil {
-						t.Fatal(err)
-					}
-					for _, file := range files {
-						data, err := os.ReadFile(file)
-						if err != nil {
-							t.Fatal(err)
-						}
-						if err := os.WriteFile(filepath.Join(assets, filepath.Base(file)), data, 0600); err != nil {
-							t.Fatal(err)
-						}
-					}
-				}
-				data, err := os.ReadFile(script)
-				if err != nil {
-					t.Fatal(err)
-				}
-				run := filepath.Join(root, "init.sh")
-				if err := os.WriteFile(run, []byte(strings.ReplaceAll(string(data), "/tmp/", assets+"/")), 0600); err != nil {
-					t.Fatal(err)
-				}
-				cmd := exec.Command("sh", run)
-				cmd.Env = append(os.Environ(), "PATH="+extraPath+os.Getenv("PATH"), "TIDB_CLUSTER_NAME="+name,
-					"GF_PROVISIONING_PATH="+filepath.Join(root, "grafana"), "PROM_CONFIG_PATH="+filepath.Join(root, "prometheus"),
-					"GF_DATASOURCE_PATH=", "PROM_PERSISTENT_DIR=", "GF_K8S_PROMETHEUS_URL=", "GF_TIDB_PROMETHEUS_URL=", "TIDB_CLUSTER_NAMESPACE=")
-				if out, err := cmd.CombinedOutput(); err != nil {
-					t.Fatalf("initializer: %v\n%s", err, out)
-				}
-				rules, _ := filepath.Glob(filepath.Join(filepath.Dir(script), "rules", "*.rules.yml"))
-				for _, file := range rules {
-					originalData, err := os.ReadFile(file)
-					if err != nil {
-						t.Fatal(err)
-					}
-					generated := filepath.Join(root, "prometheus", "rules", filepath.Base(file))
-					actualData, err := os.ReadFile(generated)
-					if err != nil {
-						t.Fatal(err)
-					}
-					var want, got map[string]any
-					if err := yaml.Unmarshal(originalData, &want); err != nil {
-						t.Fatal(err)
-					}
-					if err := yaml.Unmarshal(actualData, &got); err != nil {
-						t.Fatalf("%s: %v", file, err)
-					}
-					for gi, g := range want["groups"].([]any) {
-						actualRules := got["groups"].([]any)[gi].(map[string]any)["rules"].([]any)
-						for ri, r := range g.(map[string]any)["rules"].([]any) {
-							rule := r.(map[string]any)
-							rule["labels"].(map[string]any)["env"] = name
-							annotations := rule["annotations"].(map[string]any)
-							description := annotations["description"].(string)
-							actualDescription := actualRules[ri].(map[string]any)["annotations"].(map[string]any)["description"].(string)
-							wantRendered := strings.ReplaceAll(renderRuleDescription(t, description, name), "ENV_LABELS_ENV", name)
-							if actual := renderRuleDescription(t, actualDescription, name); actual != wantRendered {
-								t.Fatalf("%s: annotation = %q, want %q", file, actual, wantRendered)
-							}
-							annotations["description"] = actualDescription
-						}
-					}
-					if !reflect.DeepEqual(got, want) {
-						t.Fatalf("%s: generated rules changed beyond env and its description reference", file)
-					}
-					if promtool := os.Getenv("PROMTOOL"); promtool != "" && filepath.Base(file) == "tidb.rules.yml" {
-						if out, err := exec.Command(promtool, "check", "rules", generated).CombinedOutput(); err != nil {
-							t.Fatalf("promtool: %v\n%s", err, out)
-						}
-						if filepath.Base(filepath.Dir(script)) == "v3.0.0" && (name == "test-cluster" || name == "&" || name == "team'qa") {
-							checkLegacyAlert(t, promtool, generated, name)
-						}
-					}
-				}
-			})
-		}
-	}
-}
-
-func checkLegacyAlert(t *testing.T, promtool, rules, name string) {
-	t.Helper()
-	data, err := yaml.Marshal(map[string]any{
-		"rule_files": []string{rules}, "evaluation_interval": "1m",
-		"tests": []any{map[string]any{
-			"interval": "1m",
-			"input_series": []any{map[string]any{
-				"series": `tidb_monitor_keep_alive_total{job="tidb",instance="node:4000"}`, "values": "0+0x10",
-			}},
-			"alert_rule_test": []any{map[string]any{
-				"eval_time": "10m", "alertname": "TiDB_monitor_keep_alive",
-				"exp_alerts": []any{map[string]any{
-					"exp_labels": map[string]string{
-						"env": name, "job": "tidb", "instance": "node:4000", "level": "emergency",
-						"expr": `increase(tidb_monitor_keep_alive_total{job="tidb"}[10m]) < 100`,
-					},
-					"exp_annotations": map[string]string{
-						"description": "cluster: " + name + ", instance: node:4000, values:0",
-						"summary":     "TiDB monitor_keep_alive error", "value": "0",
-					},
-				}},
-			}},
-		}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := filepath.Join(filepath.Dir(rules), "alert-test.yml")
-	if err := os.WriteFile(file, data, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if out, err := exec.Command(promtool, "test", "rules", file).CombinedOutput(); err != nil {
-		t.Fatalf("promtool alert evaluation: %v\n%s", err, out)
-	}
-}
-
-func renderRuleDescription(t *testing.T, value, name string) string {
-	t.Helper()
-	tpl, err := template.New("description").Parse("{{ $labels := .Labels }}{{ $value := .Value }}" + value)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var out bytes.Buffer
-	data := map[string]any{"Labels": map[string]string{"env": "sample-env", "instance": "node:4000", "type": "test"}, "Value": fmt.Sprint(1)}
-	if err := tpl.Execute(&out, data); err != nil {
-		t.Fatal(err)
-	}
-	return out.String()
-}
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
index 178e2db3..71d060d5 100644
--- a/scripts/test_legacy_initializer.py
+++ b/scripts/test_legacy_initializer.py
@@ -29,169 +29,115 @@ def setUp(self):
             (tools / "sed").symlink_to(sed)
             self.env["PATH"] = f"{tools}:{self.env['PATH']}"
         self.env.update(
-            TIDB_CLUSTER_NAME="test-cluster",
-            TIDB_CLUSTER_NAMESPACE="",
+            TIDB_CLUSTER_NAME="test-cluster", TIDB_CLUSTER_NAMESPACE="",
             TIDB_VERSION="pingcap/tidb:v3.0.0",
             GF_PROVISIONING_PATH=str(self.root / "grafana"),
             PROM_CONFIG_PATH=str(self.root / "prometheus"),
-            GF_DATASOURCE_PATH="",
-            GF_K8S_PROMETHEUS_URL="",
-            GF_TIDB_PROMETHEUS_URL="",
-            PROM_PERSISTENT_DIR="",
+            GF_DATASOURCE_PATH="", GF_K8S_PROMETHEUS_URL="",
+            GF_TIDB_PROMETHEUS_URL="", PROM_PERSISTENT_DIR="",
         )
-        self.titles = {
-            "tidb": "TiDB", "overview": "Overview", "pd": "PD",
-            "tikv_details": "TiKV-Details", "tikv_summary": "TiKV-Summary",
-            "tikv_trouble_shooting": "TiKV-Trouble-Shooting",
-            "binlog": "Binlog", "lightning": "Lightning",
-        }
 
-    def run_initializer(self, source, pull=False, real_dashboards=False):
-        # Isolate only the image's /tmp assets; run the complete release script.
+    def run_initializer(self, source):
+        # Run the complete script against real release assets in an isolated tree.
         for path in self.assets.iterdir():
             path.unlink()
-        for name, title in self.titles.items():
-            (self.assets / f"{name}.json").write_text(json.dumps({"title": f"Test-Cluster-{title}"}))
-        if pull:
-            (self.assets / "tikv_pull.json").write_text(json.dumps({"title": "Test-Cluster-TiKV"}))
-        (self.assets / "pods.json").write_text(json.dumps({"title": "Test-Cluster-Pods-Info", "namespace": "$namespace"}))
-        (self.assets / "nodes.json").write_text(json.dumps({"title": "nodes"}))
-        if real_dashboards:
-            for path in self.assets.glob("*.json"):
-                path.unlink()
-            for path in (source.parent / "dashboards").glob("*.json"):
-                shutil.copyfile(path, self.assets / path.name)
-        for name in ("cluster", "persistent"):
-            (self.assets / f"{name}.rules.yml").write_text("env: ENV_LABELS_ENV\n")
-        for name in ("k8s", "tidb-cluster"):
-            shutil.copyfile(source.parent / "datasources" / f"{name}-datasource.yaml",
-                            self.assets / f"{name}-datasource.yaml")
+        for kind in ("dashboards", "rules", "datasources"):
+            for path in (source.parent / kind).iterdir():
+                if path.is_file():
+                    shutil.copyfile(path, self.assets / path.name)
         script = self.root / "init.sh"
         script.write_text(source.read_text().replace("/tmp/", f"{self.assets}/"))
         return subprocess.run(["sh", str(script)], env=self.env, cwd=self.root,
                               capture_output=True, text=True, timeout=20)
 
-    def test_all_release_scripts_preserve_outputs(self):
+    def test_all_releases_keep_existing_output_format(self):
         self.assertEqual(len(INITIALIZERS), 36)
-        for source in INITIALIZERS:
-            for configured in (False, True):
-                with self.subTest(version=source.parent.name, configured=configured):
-                    self.env.update(GF_DATASOURCE_PATH="", PROM_PERSISTENT_DIR="")
-                    if configured:
-                        datasources = self.root / "datasources"
-                        datasources.mkdir(exist_ok=True)
-                        persistent = self.root / "store/latest-rules/tidb:v3.0.0"
-                        persistent.mkdir(parents=True, exist_ok=True)
-                        (persistent / "persistent.rules.yml").write_text("saved rules\n")
-                        self.env.update(
-                            GF_DATASOURCE_PATH=str(datasources),
-                            PROM_PERSISTENT_DIR=str(self.root / "store"),
-                            TIDB_CLUSTER_NAMESPACE="tenant-a",
-                            GF_K8S_PROMETHEUS_URL="http://k8s:9090",
-                            GF_TIDB_PROMETHEUS_URL="http://tidb:9090",
-                        )
-                    result = self.run_initializer(source, pull=configured)
-                    self.assertEqual(result.returncode, 0, result.stderr)
-                    self.assertEqual(result.stderr, "")
-                    dashboards = self.root / "grafana/dashboards"
-                    for name, title in self.titles.items():
-                        prefix = "Test-Cluster" if configured and name.startswith("tikv_") else "test-cluster"
-                        self.assertEqual(json.loads((dashboards / f"{name}.json").read_text())["title"], f"{prefix}-{title}")
-                    rules = self.root / "prometheus/rules"
-                    self.assertEqual((rules / "cluster.rules.yml").read_text(), 'env: "test-cluster"\n')
-                    self.assertEqual((rules / "persistent.rules.yml").read_text(),
-                                     "saved rules\n" if configured else 'env: "test-cluster"\n')
-                    if configured:
-                        self.assertEqual(json.loads((dashboards / "tikv_pull.json").read_text())["title"], "test-cluster-TiKV")
-                        self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": "test-cluster-Pods-Info", "namespace": "tenant-a"})
-                        self.assertIn("url: http://k8s:9090", (datasources / "k8s-datasource.yaml").read_text())
-
-    def test_real_dashboards_preserve_cluster_names(self):
+        self.assertEqual(len({p.read_bytes() for p in INITIALIZERS}), 1)
         datasources = self.root / "datasources"
         datasources.mkdir()
-        self.env["GF_DATASOURCE_PATH"] = str(datasources)
-        controls = "".join(chr(i) for i in range(1, 32) if i not in (10, 13))
         for source in INITIALIZERS:
-            for cluster in ("test-cluster", r"region\qa", r"region\new", 'region"qa',
-                            "region\\", "区域&qa|test", "region" + controls):
-                with self.subTest(version=source.parent.name, cluster=cluster):
-                    self.env["TIDB_CLUSTER_NAME"] = cluster
-                    result = self.run_initializer(source, real_dashboards=True)
-                    self.assertEqual(result.returncode, 0, result.stderr)
-                    self.assertEqual(result.stderr, "")
-                    for template in (source.parent / "dashboards").glob("*.json"):
-                        content = template.read_text()
-                        if template.name == "pods.json":
-                            content = content.replace("$namespace", "default")
-                        expected = json.loads(content)
-                        if expected["title"].startswith("Test-Cluster-"):
-                            expected["title"] = cluster + expected["title"][len("Test-Cluster"):]
-                        actual = json.loads((self.root / "grafana/dashboards" / template.name).read_text())
-                        self.assertEqual(actual, expected, template.name)
+            for grafana, provision in ((False, False), (False, True), (True, False), (True, True)):
+                with self.subTest(version=source.parent.name, grafana=grafana, datasources=provision):
+                    dashboard_root = self.root / "grafana"
+                    shutil.rmtree(dashboard_root, ignore_errors=True)
+                    self.env.update(
+                        GF_PROVISIONING_PATH=str(dashboard_root) if grafana else "",
+                        GF_DATASOURCE_PATH=str(datasources) if provision else "",
+                    )
+                    result = self.run_initializer(source)
+                    self.assertEqual((result.returncode, result.stderr), (0, ""))
+                    for template in (source.parent / "rules").glob("*.rules.yml"):
+                        expected = template.read_text().replace("ENV_LABELS_ENV", "test-cluster")
+                        self.assertEqual((self.root / "prometheus/rules" / template.name).read_text(), expected)
+                    self.assertEqual(dashboard_root.exists(), grafana)
+                    if grafana:
+                        for template in (source.parent / "dashboards").glob("*.json"):
+                            if not provision and template.name in ("pods.json", "nodes.json"):
+                                continue
+                            expected = template.read_text().replace("Test-Cluster-", "test-cluster-")
+                            if template.name == "pods.json":
+                                expected = expected.replace("$namespace", "default")
+                            actual = (dashboard_root / "dashboards" / template.name).read_text()
+                            self.assertEqual(actual, expected)
+                            json.loads(actual)
+                    if provision:
+                        for template in (source.parent / "datasources").glob("*.yaml"):
+                            self.assertEqual((datasources / template.name).read_bytes(), template.read_bytes())
 
-    def test_sed_arguments_cannot_write_another_file(self):
+    def test_paths_urls_and_persisted_rules(self):
+        for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH", "GF_DATASOURCE_PATH", "PROM_PERSISTENT_DIR"):
+            path = self.root / f"{key} with spaces"
+            path.mkdir()
+            self.env[key] = str(path)
+        saved = Path(self.env["PROM_PERSISTENT_DIR"]) / "latest-rules/tidb:v3.0.0"
+        saved.mkdir(parents=True)
+        (saved / "tidb.rules.yml").write_text("saved rules\n")
         victim = self.root / "victim"
-        self.env["TIDB_CLUSTER_NAME"] = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
-        for source in INITIALIZERS:
-            with self.subTest(version=source.parent.name):
-                victim.write_text("untouched\n")
-                result = self.run_initializer(source)
-                self.assertEqual(victim.read_text(), "untouched\n")
-                self.assertEqual(result.returncode, 0, result.stderr)
-                self.assertEqual(result.stderr, "")
-
-    def test_replacements_and_paths_are_literal(self):
+        victim.write_text("untouched\n")
+        url = rf"https://metrics.example/query?a=1&b=2,three=3|four=\value;w{victim}"
+        self.env.update(GF_K8S_PROMETHEUS_URL=url, GF_TIDB_PROMETHEUS_URL=url, TIDB_CLUSTER_NAMESPACE="tenant-a")
         source = INITIALIZERS[0]
+        result = self.run_initializer(source)
+        self.assertEqual((result.returncode, result.stderr), (0, ""))
+        self.assertEqual(victim.read_text(), "untouched\n")
+        self.assertEqual((Path(self.env["PROM_CONFIG_PATH"]) / "rules/tidb.rules.yml").read_text(), "saved rules\n")
+        pods = Path(self.env["GF_PROVISIONING_PATH"]) / "dashboards/pods.json"
+        expected = (source.parent / "dashboards/pods.json").read_text().replace("Test-Cluster-", "test-cluster-").replace("$namespace", "tenant-a")
+        self.assertEqual(pods.read_text(), expected)
+        for name, original in (("k8s", "http://prometheus-k8s.monitoring.svc:9090"), ("tidb-cluster", "http://127.0.0.1:9090")):
+            filename = f"{name}-datasource.yaml"
+            expected = (source.parent / "datasources" / filename).read_text().replace(original, url)
+            self.assertEqual((Path(self.env["GF_DATASOURCE_PATH"]) / filename).read_text(), expected)
+
+    def test_unsafe_values_fail_before_any_output_changes(self):
+        existing = []
+        for relative in ("grafana/dashboards/existing.json", "prometheus/rules/existing.yml"):
+            path = self.root / relative
+            path.parent.mkdir(parents=True)
+            path.write_text("keep\n")
+            existing.append(path)
         victim = self.root / "victim"
         victim.write_text("untouched\n")
         payload = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
-        for cluster in ("normal-cluster", payload, r"name&with|slash/and\backslash"):
-            with self.subTest(cluster=cluster):
-                self.env.update(TIDB_CLUSTER_NAME=cluster)
-                for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH", "GF_DATASOURCE_PATH", "PROM_PERSISTENT_DIR"):
-                    path = self.root / f"{key} with spaces"
-                    path.mkdir(exist_ok=True)
-                    self.env[key] = str(path)
-                persistent = Path(self.env["PROM_PERSISTENT_DIR"]) / "latest-rules/tidb:v3.0.0"
-                persistent.mkdir(parents=True, exist_ok=True)
-                (persistent / "persistent.rules.yml").write_text("saved rules\n")
-                url = r"https://metrics.example/query?one=1&two=2,three=3|four=\value"
-                self.env.update(GF_K8S_PROMETHEUS_URL=url, GF_TIDB_PROMETHEUS_URL=url)
-                result = self.run_initializer(source)
-                self.assertEqual(result.returncode, 0, result.stderr)
-                self.assertEqual(result.stderr, "")
-                dashboards = Path(self.env["GF_PROVISIONING_PATH"]) / "dashboards"
-                self.assertEqual(json.loads((dashboards / "tidb.json").read_text())["title"], f"{cluster}-TiDB")
-                self.assertEqual(json.loads((dashboards / "pods.json").read_text()), {"title": f"{cluster}-Pods-Info", "namespace": "default"})
-                rules = Path(self.env["PROM_CONFIG_PATH"]) / "rules"
-                self.assertEqual(json.loads((rules / "cluster.rules.yml").read_text().removeprefix("env: ")), cluster)
-                self.assertEqual((rules / "persistent.rules.yml").read_text(), "saved rules\n")
-                for name in ("k8s", "tidb-cluster"):
-                    data = Path(self.env["GF_DATASOURCE_PATH"]) / f"{name}-datasource.yaml"
-                    self.assertIn(f"url: {url}", data.read_text())
-                self.assertEqual(victim.read_text(), "untouched\n")
-
-    def test_invalid_values_fail_before_modifying_output(self):
-        dashboard = self.root / "grafana/dashboards/existing.json"
-        dashboard.parent.mkdir(parents=True)
-        dashboard.write_text("keep\n")
-        for key in ("TIDB_CLUSTER_NAME", "TIDB_CLUSTER_NAMESPACE", "GF_K8S_PROMETHEUS_URL", "GF_TIDB_PROMETHEUS_URL"):
-            for value in ("first\nsecond", "first\rsecond"):
+        cases = {key: [payload, "&", "-", r"team\qa", 'team"qa', "team'qa", '{{ "other-cluster" }}', "team\nqa", "team\rqa", "team\tqa", "team\u0085qa"]
+                 for key in ("TIDB_CLUSTER_NAME", "TIDB_CLUSTER_NAMESPACE")}
+        for key in ("GF_K8S_PROMETHEUS_URL", "GF_TIDB_PROMETHEUS_URL"):
+            cases[key] = ["https://example.com" + c + "    jsonData: {tlsSkipVerify: true}" for c in ("\n", "\r", "\u0085", "\u2028", "\u2029")]
+            cases[key] += ["https://example.com\n", "https://example.com\t", "https://example.com:", "file:///tmp/rules", "https://"]
+        cases["PROM_CONFIG_PATH"] = [""]
+        for key, values in cases.items():
+            for value in values:
                 with self.subTest(key=key, value=value):
-                    original = self.env[key]
+                    old = self.env[key]
                     self.env[key] = value
                     result = self.run_initializer(INITIALIZERS[0])
-                    self.env[key] = original
+                    self.env[key] = old
                     self.assertNotEqual(result.returncode, 0)
-                    self.assertEqual(dashboard.read_text(), "keep\n")
-        for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH"):
-            with self.subTest(key=key):
-                original = self.env[key]
-                self.env[key] = ""
-                result = self.run_initializer(INITIALIZERS[0])
-                self.env[key] = original
-                self.assertNotEqual(result.returncode, 0)
-                self.assertEqual(dashboard.read_text(), "keep\n")
+                    for path in existing:
+                        self.assertEqual(path.read_text(), "keep\n")
+                    self.assertEqual(victim.read_text(), "untouched\n")
+                    self.assertEqual(sorted((self.root / "grafana/dashboards").iterdir()), existing[:1])
+                    self.assertEqual(sorted((self.root / "prometheus/rules").iterdir()), existing[1:])
 
 
 if __name__ == "__main__":

From 97c25d125d907a4ed75cd643dead1c9fc77d154a Mon Sep 17 00:00:00 2001
From: csuzhangxc <csuzhangxc@gmail.com>
Date: Mon, 9 Nov 2026 11:06:45 +0800
Subject: [PATCH 5/5] fix(initializer): validate only enabled optional inputs

---
 monitor/v2.1.10/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.11/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.12/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.13/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.14/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.15/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.16/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.17/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.18/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.19/init.sh            | 26 ++++++++++++++++----------
 monitor/v2.1.8/init.sh             | 26 ++++++++++++++++----------
 monitor/v2.1.9/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.0-beta.1/init.sh      | 26 ++++++++++++++++----------
 monitor/v3.0.0-beta/init.sh        | 26 ++++++++++++++++----------
 monitor/v3.0.0-rc.1/init.sh        | 26 ++++++++++++++++----------
 monitor/v3.0.0-rc.2/init.sh        | 26 ++++++++++++++++----------
 monitor/v3.0.0-rc.3/init.sh        | 26 ++++++++++++++++----------
 monitor/v3.0.0/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.1/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.11/init.sh            | 26 ++++++++++++++++----------
 monitor/v3.0.12/init.sh            | 26 ++++++++++++++++----------
 monitor/v3.0.2/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.3/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.4/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.5-hotfix/init.sh      | 26 ++++++++++++++++----------
 monitor/v3.0.5/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.6/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.7/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.8/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.0.9/init.sh             | 26 ++++++++++++++++----------
 monitor/v3.1.0-beta.1/init.sh      | 26 ++++++++++++++++----------
 monitor/v3.1.0-beta.2/init.sh      | 26 ++++++++++++++++----------
 monitor/v3.1.0-beta/init.sh        | 26 ++++++++++++++++----------
 monitor/v4.0.0-beta.1/init.sh      | 26 ++++++++++++++++----------
 monitor/v4.0.0-beta.2/init.sh      | 26 ++++++++++++++++----------
 monitor/v4.0.0-beta/init.sh        | 26 ++++++++++++++++----------
 scripts/test_legacy_initializer.py |  6 ++++++
 37 files changed, 582 insertions(+), 360 deletions(-)

diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index b7bdccf6..76e605cb 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -9,20 +9,26 @@ replace_template() {
 # Keep replacement values safe in the existing JSON, YAML and alert templates.
 LC_ALL=C
 export LC_ALL
-for value in "$TIDB_CLUSTER_NAME" "$TIDB_CLUSTER_NAMESPACE"; do
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
     case "$value" in
         -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
     esac
 done
-for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
-    case "$value" in
-        *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
-    esac
-    case "$value" in
-        ''|http://?*|https://?*) ;;
-        *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
-    esac
-done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
 if [ -z "$PROM_CONFIG_PATH" ]; then
     echo "Prometheus output path is required" >&2
     exit 1
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
index 71d060d5..6076f23e 100644
--- a/scripts/test_legacy_initializer.py
+++ b/scripts/test_legacy_initializer.py
@@ -63,6 +63,9 @@ def test_all_releases_keep_existing_output_format(self):
                     self.env.update(
                         GF_PROVISIONING_PATH=str(dashboard_root) if grafana else "",
                         GF_DATASOURCE_PATH=str(datasources) if provision else "",
+                        TIDB_CLUSTER_NAMESPACE="" if grafana and provision else r"unused\namespace",
+                        GF_K8S_PROMETHEUS_URL="" if provision else "prometheus-k8s.monitoring.svc:9090",
+                        GF_TIDB_PROMETHEUS_URL="" if provision else "https://example.com\u0085    jsonData: {tlsSkipVerify: true}",
                     )
                     result = self.run_initializer(source)
                     self.assertEqual((result.returncode, result.stderr), (0, ""))
@@ -110,6 +113,9 @@ def test_paths_urls_and_persisted_rules(self):
             self.assertEqual((Path(self.env["GF_DATASOURCE_PATH"]) / filename).read_text(), expected)
 
     def test_unsafe_values_fail_before_any_output_changes(self):
+        datasources = self.root / "datasources"
+        datasources.mkdir()
+        self.env["GF_DATASOURCE_PATH"] = str(datasources)
         existing = []
         for relative in ("grafana/dashboards/existing.json", "prometheus/rules/existing.yml"):
             path = self.root / relative