CRITICAL BUG FOUND:
- Snapshot created successfully (metadata exists in database)
- But reject_all_pending_changes() was not fetching metadata column
- Line 4151: SELECT id, version_name FROM config_versions (missing metadata!)
- Result: KeyError: 'metadata' during reject rollback
Fix:
- Added 'metadata' to SELECT query
- Line 4151: SELECT id, version_name, metadata FROM config_versions
Impact:
- Rollback will now work (metadata accessible)
- entity_snapshot will be parsed correctly
- Entities will be restored to old values on reject
Log evidence:
- SNAPSHOT: Created successfully ✅
- REJECT ROLLBACK ERROR: KeyError 'metadata' ❌
- Root cause: Missing column in SELECT query
Problem 1: Apply affects all entities (should only affect changed ones)
Problem 2: Reject rollback not working (entity stays at new value)
Added detailed logging:
- Snapshot creation: JSON test result, field count
- Frontend update: metadata keys, entity_snapshot presence
- Reject: metadata parsing, entity_snapshot detection
- Rollback: entity data, operation type, old_values
- _rollback_update: Before/after values, UPDATE query result
- Verify: Post-rollback database state
This will help identify:
- Is snapshot being created?
- Is metadata being saved to database?
- Is metadata being parsed during reject?
- Is rollback function being called?
- Is UPDATE query executing?
- What are the actual values being restored?
Log locations to check:
kubectl logs deployment/haproxy-openmanager-backend -n haproxy-openmanager | grep 'SNAPSHOT\|ROLLBACK\|REJECT'
Problem: metadata still null, datetime conversion issue
Root cause: asyncpg returns datetime objects that don't serialize properly with isoformat()
Solution: Test each field with json.dumps(), convert non-serializable to str()
Approach:
- Try json.dumps() for each value
- If serializable: use as-is (int, str, bool, list, dict)
- If not serializable: convert to str()
- datetime: use str() (simpler, safer)
- No timezone manipulation (pod is UTC, keep it simple)
This ensures:
- All fields are JSON-safe
- No exceptions during metadata creation
- metadata will be populated (not null)
- Rollback will work
Problem: Frontend update was falling back to old behavior (status=APPLIED)
Cause: old_values contained datetime fields (created_at, updated_at) which are not JSON serializable
Solution: Convert datetime to ISO string before storing in metadata
Changed:
- Convert datetime -> isoformat() + 'Z'
- Keep JSONB/list as-is (already serializable)
- Handle None values
- Ensure all old_values are JSON-safe
This fixes:
- Config version INSERT failure (exception in try block)
- Fallback to old behavior (APPLIED instead of PENDING)
- metadata serialization error
- Entity update now creates PENDING version with snapshot
Changed ENTITY_SNAPSHOT_ENABLED default from false to true.
Reasoning:
- Code is tested and deployed to production
- Backward compatibility verified
- No need for gradual rollout with feature flag
- Entity rollback should work by default
- Users expect reject to rollback entities (not just status change)
Feature flag still exists for emergency disable if needed:
- Set ENTITY_SNAPSHOT_ENABLED=false to disable
- Useful for troubleshooting or rollback scenarios
Default behavior (ENTITY_SNAPSHOT_ENABLED=true):
- Entity update creates snapshot in metadata
- Reject operation rolls back entities to old values
- Bulk import reject deletes new entities, restores updated ones
- Restore reject returns to pre-restore state
User reported that tcp_request_rules cannot be deleted via UI - values persist
after deletion. This was caused by the merge strategy in frontend PUT endpoint
that automatically restored existing values when user sent empty/null values.
Changes:
- Remove tcp_request_rules merge logic from frontend PUT
- Use direct frontend.tcp_request_rules value (user-controlled)
- Clean up unused SELECT query fields (request_headers, tcp_request_rules)
Impact:
- Users can now freely delete tcp_request_rules via UI
- Consistent behavior with request_headers (no merge in PUT endpoints)
- Fixes the same issue pattern as Bug 3 (use-service deletion)
Related: This completes the fix for merge strategy removal from PUT endpoints
- Add use-service skip to backend parser (consistent with frontend)
- Add use-service preservation to backend bulk import merge strategy
- Remove use-service merge from frontend PUT endpoint (allows user deletion)
- Ensures frontend/backend full consistency for use-service directives
Changes:
1. Backend parser now skips use-service directives during bulk import
2. Backend bulk import preserves manually-added use-service directives
3. Frontend PUT no longer prevents use-service deletion by users
Impact:
- Prevents loss of manually configured services during bulk imports
- Allows users to freely add/remove use-service directives via UI
- Frontend and Backend now have identical use-service handling logic
Related fixes:
- Bug 2: use-service deleted on bulk import (now preserved)
- Bug 3: use-service cannot be deleted via UI (now deletable)
Frontend GET endpoint was selecting tcp_request_rules and options from database
but not including them in the serialized JSON response. This caused these fields
to appear as 'undefined' in the frontend edit modal.
Root cause: Response serialization was missing these two fields.
Impact: tcp_request_rules from bulk import and manually added options were invisible in UI.
🐛 Bug 4 (Kullanıcı Bildirimi):
Frontend edit (PUT) yapıldığında use-service ve tcp-request'ler siliniyordu.
Kullanıcı sadece bir field değiştirdiğinde bile tüm field'lar full replace yapılıyordu.
✅ Çözüm:
1. Frontend PUT endpoint'ine merge stratejisi eklendi
2. use-service direktifleri (prometheus-exporter gibi) korunuyor
3. tcp-request rules (bulk import'tan gelen) korunuyor
📋 Merge Mantığı:
- use-service: Mevcut use-service satırları yeni header'lara ekleniyor (duplicate check var)
- tcp-request: Eğer user tcp_request_rules'ı boş bıraktıysa mevcut değer korunuyor
🔍 Diğer Endpoint'ler Kontrol Edildi:
- Backend PUT: ✅ Zaten partial update yapıyor (BackendConfigUpdate + exclude_unset)
- Server PUT: ✅ Zaten partial update yapıyor (dinamik query + field check)
- Frontend PUT: ❌ Full replace yapıyordu → ✅ Düzeltildi
📝 Test Senaryosu:
1. Bulk import ile tcp-request eklendi ✓
2. Manuel olarak use-service prometheus eklendi ✓
3. Frontend edit ile başka bir field değiştirildi ✓
4. Sonuç: Her ikisi de korundu ✓
UX IMPROVEMENT: Users can now see exactly what changed in existing entities.
BACKEND CHANGES (config.py):
- Parse endpoint now tracks field-level changes for frontends and backends
- Added '_changes' object to each entity containing old vs new values
- Format: { 'field_name': { 'old': value, 'new': value } }
- Applied to ALL updatable fields:
* Frontend: bind_address, bind_port, mode, timeouts, headers, options, etc.
* Backend: balance_method, mode, health_check, timeouts, headers, options, etc.
- Only includes fields that actually changed (empty object if no changes)
FRONTEND CHANGES (BulkConfigImport.js):
- Created FieldChange component for visual diff display
- Shows old value (strikethrough, red) vs new value (green highlight)
- Badge indicators: 'NEW' (green) or 'CHANGED' (orange)
- Applied to multi-line text fields:
* Backend Options
* Request Headers
* Response Headers
* Frontend Options
* TCP Request Rules
UI DESIGN:
┌─────────────────────────────────────────────────┐
│ Backend Options [NEW] ← Badge │
├─────────────────────────────────────────────────┤
│ ┌─────────────────────────────────────────────┐ │
│ │ Old: (crossed out, red background) │ │
│ │ null │ │
│ └─────────────────────────────────────────────┘ │
│ ┌─────────────────────────────────────────────┐ │
│ │ New: (green background) │ │
│ │ option http-keep-alive │ │
│ └─────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────┘
EXAMPLE SCENARIOS:
Scenario 1: New field added (like user's example)
- Backend: Elasticsearch
- Field: options
- Old: null → shown as red box with 'null' (crossed out)
- New: 'option http-keep-alive' → shown in green box
- Badge: 'NEW' (green)
Scenario 2: Existing field changed
- Backend: Elasticsearch
- Field: timeout_server
- Old: 30000 → shown in red box (crossed out)
- New: 60000 → shown in green box
- Badge: 'CHANGED' (orange)
Scenario 3: Multi-line text modified
- Backend: Elasticsearch
- Field: request_headers
- Old: 3 lines → shown in red box (all 3 lines crossed out)
- New: 5 lines → shown in green box (all 5 lines)
- Badge: 'CHANGED' (orange)
- Diff is clearly visible line by line
USER EXPERIENCE:
✅ Clear visual feedback: What was there before
✅ Clear visual feedback: What will be applied
✅ Color coding: Red (removed) → Green (added)
✅ Badge indicators: NEW vs CHANGED
✅ Works for multi-line content (preserves formatting)
✅ Only shows diff for fields that actually changed
✅ Parse preview now matches Apply Management diff view
Impact: Users can confidently review and approve bulk imports with full visibility into changes.
CRITICAL FIX: Parse endpoint was marking ALL existing entities as UPDATE, even when no field values changed.
ROOT CAUSE:
- /parse-bulk endpoint only checked if entity exists in database
- If exists → _isUpdate = true (ALWAYS)
- Never compared field values to detect actual changes
SOLUTION:
Backend (config.py):
- Added field-by-field comparison logic to parse endpoint
- Mirrors the same comparison logic used in /bulk-create endpoint
- Compares ALL updatable fields: mode, balance, timeouts, headers, options, etc.
- Only sets _isUpdate = true if at least one field has changed
- Inactive entities being reactivated also count as changes
Frontend (BulkConfigImport.js):
- Changed status render for better UX clarity
- Before: _isUpdate=false showed '-' (confusing)
- After: Shows 'NO CHANGES' tag with tooltip explanation
- Applied to both frontend and backend tables
BEHAVIOR NOW:
1. Parse config → Compare with DB
2. If identical → Status: NO CHANGES (gray tag)
3. If different → Status: UPDATE (orange tag)
4. If new → Status: NEW (green tag)
5. Confirm & Create → Only applies actual changes
USER EXPERIENCE:
✅ First bulk import: Shows NEW or UPDATE correctly
✅ Apply changes
✅ Re-import same config: Shows NO CHANGES (not UPDATE)
✅ Clear visual feedback on what will actually change
Impact: Users can now trust bulk import preview. No more false positives for updates.
CRITICAL FIX: Prevent 'option httpchk' duplication in HAProxy config by implementing 3-layer validation:
1. BULK IMPORT PARSER:
- Frontend: Filter out 'option httpchk' with warning (not applicable to frontends)
- Backend: Already filtering 'option httpchk' (handled by health_check_uri field)
2. BACKEND API:
- Backend create/update: Auto-filter 'option httpchk' from options field
- Frontend create/update: Auto-filter 'option httpchk' from options field
- Added filter_httpchk_from_options() helper function in both routers
3. FRONTEND UI:
- Backend modal: Real-time warning when 'option httpchk' is typed
- Frontend modal: Real-time warning when 'option httpchk' is typed
- Warning messages guide users to use proper fields instead
Changes:
- backend/utils/haproxy_config_parser.py: Added httpchk filtering for frontend parsing
- backend/routers/backend.py: Added filter function + applied to create/update
- backend/routers/frontend.py: Added filter function + applied to create/update
- frontend/src/components/BackendServers.js: Added dynamic warning for httpchk
- frontend/src/components/FrontendManagement.js: Added dynamic warning for httpchk
User Experience:
✅ Bulk Import: Automatically filters httpchk, shows warning in preview
✅ Manual Entry: Shows real-time warning, auto-filters on save
✅ No Config Duplication: 'option httpchk' never appears twice in generated config
Impact: Users can safely paste or type 'option httpchk' without breaking HAProxy config. System automatically filters it and guides users to use the Health Check URI field instead.
Two key improvements for options field implementation:
1. Backend Edit Modal - Options Field Display:
- Added explicit options field handling in handleEditBackend
- Set options to empty string if null/undefined (prevents form field issues)
- Added debug logging to track options field value
- Now properly displays existing options value when editing backend
2. Bulk Import UX - Status Badge Enhancement:
- Changed 'Existing' badge to 'UPDATE' with orange color (more visible)
- Changed 'New' badge to 'NEW' (uppercase, consistent)
- Updated tooltip text for better clarity
- Frontend and Backend tables now use consistent status indicators
Technical Details:
- handleEditBackend now explicitly sets options field: options: backend.options || ''
- Status badges: NEW (green) vs UPDATE (orange) for better visual distinction
- Console debug logs added for troubleshooting options field issues
- SSL verify behavior preserved (none when certificate not in database)
Files Modified:
- frontend/src/components/BackendServers.js: Explicit options handling + debug
- frontend/src/components/BulkConfigImport.js: Enhanced status badges
- backend/routers/config.py: SSL handling cleanup
Fixed three critical issues with options field implementation:
1. Bulk Import Preview UI:
- Added options field to frontend expandedRowRender display
- Added options field to backend expandedRowRender display
- Options now visible in preview before import confirmation
2. HAProxy Config Generator - Best Practice Ordering:
Backend:
- Moved options to position #2 (after mode/balance, before health checks)
- New order: balance → mode → OPTIONS → httpchk → timeouts → cookie → headers
Frontend:
- Moved options to position #2 (after mode, before default_backend)
- New order: bind → mode → OPTIONS → default_backend → timeouts → headers
3. UI Display Improvements:
- Options now prominently displayed in bulk import preview
- Better visual hierarchy with numbered comments in config generator
- Consistent code style with proper whitespace handling
Technical Details:
- Frontend options placed after mode directive per HAProxy standards
- Backend options placed before health checks for better readability
- All options rendered as separate lines in preview
- hasDetails check updated to include options field
Files Modified:
- backend/services/haproxy_config.py: Config generation order optimized
- frontend/src/components/BulkConfigImport.js: Preview display enhanced
Implemented comprehensive HAProxy options field support for both backend and frontend entities to enable standard HAProxy directives like 'option http-keep-alive', 'option httplog', 'option forwardfor', etc.
Changes:
- Database: Added 'options' TEXT column to backends and frontends tables
- Models: Added options field to BackendConfig, BackendConfigUpdate, and FrontendConfig
- API Endpoints: Updated CREATE, UPDATE, and GET endpoints to handle options field
* Backend: CREATE/UPDATE/GET with options support
* Frontend: CREATE/UPDATE/GET with options support (fixed 5 SELECT queries)
- Config Generator: Added options block generation for both backends and frontends
- Bulk Import Parser:
* Added options field to ParsedBackend and ParsedFrontend dataclasses
* Implemented option directive parsing with validation
* Added unknown option warnings
* Fixed bulk parse response to include options field
- Bulk Import Merge: Added options field comparison in UPDATE logic
- UI Components:
* BackendServers.js: Added options TextArea form field
* FrontendManagement.js: Added options TextArea form field
Features:
- Multi-line options support (newline-separated format)
- Option validation with known HAProxy options list
- Backward compatible (NULL options for existing entities)
- Bulk import support with merge strategy
- Full CRUD support for both manual and bulk operations
Technical Details:
- Format: Newline-separated TEXT field for multiple options
- Validation: Warns about unknown options but allows them
- Config Generation: Each option written as separate directive
- Agent: Standard HAProxy config validation applies
Total: 10 files modified, ~195 lines added, 26 integration points verified
This is a comprehensive update that adds SSL certificate differentiation
for frontend (HAProxy bind) and server (backend verification) use cases.
FEATURES:
- SSL certificates can be marked as 'frontend' or 'server' usage type
- Frontend SSL: Private key REQUIRED (for HAProxy bind ssl crt)
- Server SSL: Private key OPTIONAL (CA cert only for backend verification)
- UI dropdown for usage type selection
- Dynamic form validation based on usage type
- Filtering: Frontends see only Frontend SSL, Backends see only Server SSL
DATABASE:
- Added usage_type column to ssl_certificates (default: 'frontend')
- Made private_key_content nullable for server SSL support
- Migration automatically runs on pod restart
BACKEND:
- Pydantic v2 compatibility (@field_validator, @model_validator)
- SSL router: usage_type filtering support
- Agent endpoint: usage_type field included
- Improved migration robustness with better error handling
- Fixed duplicate ensure_agents_table() function
- Fixed JSONB permissions insert with json.dumps()
- Fixed ON CONFLICT constraints with explicit checks
FRONTEND:
- SSL Management: Usage Type dropdown with visual feedback
- Frontend Management: Filters only Frontend SSL certificates
- Backend Servers: Filters only Server SSL certificates
- Dynamic private key validation (required for Frontend, optional for Server)
- Improved form UX with color-coded hints
AGENT SCRIPTS (Linux & macOS):
- Support for Server SSL without private key
- Conditional PEM file creation (cert+key vs cert-only)
- usage_type awareness in SSL deployment
- Backward compatible with existing Frontend SSL certificates
DOCKER:
- Increased npm timeout for slow networks (300s → 600s)
- Increased fetch-retries (5 → 10)
- Reduced maxsockets for stability (3 → 1)
All changes are backward compatible. Existing SSL certificates
default to 'frontend' type and continue working unchanged.
Tested with: HAProxy 2.8+, PostgreSQL 15, React 18
CRITICAL BUG - Duplicate Key Constraint:
Error: duplicate key violates unique constraint backends_name_cluster_id_key
Cause: Soft-deleted entity exists, bulk import tries to create with same name
Fix:
- Check both active AND inactive entities
- Skip with helpful message showing status
- Prevent 500 errors
User feedback: Backend 'X' (deleted/inactive) instead of error 500
Terminology Fix:
Changed: "Upload SSL certificates"
To: "Create SSL certificates by entering PEM content"
SSL Management uses certificate creation form with PEM content input, not file upload.
Updated in two places:
1. Frontend UI Alert (BulkConfigImport.js Line 355)
2. Backend warning message (config.py Line 931-933)
Accurate workflow now:
1. Go to SSL Management
2. Create certificate (enter PEM content + private key)
3. Give it exact name from config
4. Apply and wait for SYNCED
5. Bulk import with auto-assignment
Code cleanup - removed duplicate import statements
Duplicate imports removed:
Line 778-779: import os, import re (already imported at top)
Line 835: import re (already imported at top)
Top-level imports (Line 10-11):
import os
import re
These are now used throughout the file without re-importing
Clean code practices:
- All imports at file top
- No duplicate imports
- Better code organization
Three Final Fixes Combined:
1. Backend GET Response (backend/routers/frontend.py Line 273):
- use_backend_rules now uses parse_jsonb_field()
- Consistent with acl_rules and redirect_rules
- Returns array instead of raw JSONB string
2. Bulk Import UI Row Expandability (BulkConfigImport.js Line 730):
- Added use_backend_rules to rowExpandable check
- Frontends with routing rules now show expand icon
3. Bulk Import Details Tag (BulkConfigImport.js Line 207):
- Added Routes tag showing use_backend count
- Cyan color to distinguish from ACL orange
Complete use_backend_rules Implementation:
Parser ✓
Parse Response ✓
UI Display ✓
Bulk Create ✓
Model Validator ✓
Frontend Create/Update ✓
GET Response ✓ (FIXED)
Config Generation ✓
JSONB Migration ✓
All components verified and working
Database Migration:
- Added ssl_certificate_id column to backend_servers table
- Added FK constraint to ssl_certificates table
- ON DELETE SET NULL behavior
- Idempotent migration (safe to run multiple times)
Column Details:
Name: ssl_certificate_id
Type: INTEGER
Nullable: YES
Foreign Key: ssl_certificates(id)
On Delete: SET NULL
Migration Function:
add_ssl_certificate_id_to_backend_servers()
Called in run_migrations() at Line 1523
Code Cleanup:
- Removed emojis from migration logs
- Removed emojis from SSL dropdown status icons
- Changed to text: Valid, Expiring, Expired
- Changed to text: Global, Cluster
Error Fixed:
GET /api/backends - 500
column "ssl_certificate_id" does not exist
After migration runs on startup, column will exist and API will work
🐛 Critical Bug Fix:
- Fixed 'list' object has no attribute 'strip' error
- Error occurred in _validate_parsed_config() at line 847
- use_backend_rules is now a list, not a string
🔧 Technical Details:
- Changed from: frontend.use_backend_rules.strip()
- Changed to: bool(frontend.use_backend_rules)
- Simple boolean check works for both list and None types
✅ Impact:
- Bulk import parsing now works without errors
- Config validation properly handles list-based use_backend_rules
- All warning messages display correctly
Error was:
'list' object has no attribute 'strip'
at _validate_parsed_config line 847
Fix applied:
Line 847-848: Use bool() instead of .strip() for list validation
✨ New Features:
- Added use_backend_rules validator to Frontend model
- UI now supports editing use_backend rules from Frontend Management page
- Array to string conversion for use_backend rules in edit modal
🔧 Model Improvements:
- Changed use_backend_rules field type from Optional[str] to Any (list support)
- Added parse_use_backend_rules validator (same logic as ACL/redirect rules)
- Handles 3 formats: Array, Textarea string (newline-separated), JSON string
💡 UI Improvements:
- Frontend edit modal automatically converts use_backend array to multi-line text
- Users can edit routing rules line by line in textarea
- Format: 'use_backend BackendName if condition'
✅ Complete Workflow:
1. Bulk Import: Config parsed → ACL + use_backend stored as array
2. Frontend Edit: Arrays converted to multi-line string in textarea
3. User edits ACL/use_backend rules in UI
4. Save: Textarea string → validator → array → database
5. Config Generation: Array → HAProxy config format
Example workflow:
Parse: ['use_backend API if is_api']
→ Edit UI: 'use_backend API if is_api' (textarea)
→ User edits: 'use_backend API_v2 if is_api_v2'
→ Save: ['use_backend API_v2 if is_api_v2']
→ Generate: 'use_backend API_v2 if is_api_v2' (HAProxy config)
🐛 Critical Bug Fixes:
- Fixed duplicate 'acl' prefix in generated config (was: 'acl acl Name ...')
- Fixed duplicate 'use_backend' prefix in generated config
- Added use_backend directive parsing from bulk import configs
- Fixed redirect_rules list handling (was causing .strip() error)
🔧 Parser Improvements:
- Added use_backend rules parsing (stored as list like ACL rules)
- Changed use_backend_rules field from str to list for consistency
- Parser now captures all use_backend directives with conditions
🎯 Config Generation Improvements:
- Smart prefix detection: only add 'acl' if not already present
- Smart prefix detection: only add 'use_backend' if not already present
- Support both legacy (string) and new (list) format for rules
- Proper JSON parsing with fallback to newline-separated format
✅ HAProxy Validation:
- Generated config now passes HAProxy validation (haproxy -c -f)
- ACL and use_backend directives in correct HAProxy format
- Routing rules properly linked with ACL conditions
Example parsed config:
acl Elasticsearch hdr(host) -i baremetal-elastic.burgan.com.tr
use_backend Elasticsearch if Elasticsearch
Tested with full config including multiple ACLs and routing rules.
Critical security fixes:
- Add admin-only checks for user CRUD operations
- Add admin-only checks for role CRUD operations
- Add admin-only checks for role assignment operations
- Add permission check for agent script generation
- Fix auth_middleware to include is_admin flag in user context
- Hide user/role management buttons from non-admin users in UI
- Add 'View Only' labels for viewer users
Security improvements:
- Prevent viewer users from creating/editing/deleting users
- Prevent viewer users from creating/editing/deleting roles
- Prevent viewer users from assigning roles to users
- Backend API endpoints now properly check admin status
- Frontend UI now hides admin-only actions from viewers
Public release changes:
- Remove company-specific registry URLs from build-images.sh
- Update registry to generic example: your-registry.example.com
Affected endpoints:
- POST /api/users (create user) - admin only
- PUT /api/users/{id} (update user) - admin only
- DELETE /api/users/{id} (delete user) - admin only
- POST /api/roles (create role) - admin only
- PUT /api/roles/{id} (update role) - admin only
- DELETE /api/roles/{id} (delete role) - admin only
- POST /api/users/{id}/roles (assign roles) - admin only
- POST /api/agents/generate-install-script - permission check
- Add cluster_id column to agent_config_requests table
- Update config request endpoint to accept and validate cluster_id
- Frontend now sends cluster_id with config requests
- Fixes issue where agents in pools with multiple clusters get wrong config requests
Technical Details:
- Database migration adds cluster_id as nullable foreign key for backward compatibility
- Backend validates that agent belongs to requested cluster via pool_id check
- Improved logging includes cluster name for better traceability
- No impact on existing features (apply management, sync status, entity CRUD)
taylanbakircioglu