Repository navigation
VR reports a load balancer change as applied when haproxy.cfg cannot be replaced #14633
Description
problem
When a virtual router can't replace /etc/haproxy/haproxy.cfg, it still reports a load balancer config change as applied.
CsLoadBalancer.process() (systemvm/debian/opt/cloud/bin/cs/CsLoadBalancer.py) writes the new config to haproxy.cfg.new, checks it with haproxy -c, and then installs it with CsHelper.copy(). CsHelper.copy() catches the IOError, logs Could not copy /etc/haproxy/haproxy.cfg.new to /etc/haproxy/haproxy.cfg, and returns. The router then reloads HAProxy, which reads the old file, and the config run ends successfully.
The management server therefore gets a successful answer, records the change as applied, and doesn't roll it back, while the router keeps serving the old configuration. A config that fails haproxy -c already makes the apply fail, so only this path is silent.
versions
4.22 (the code is the same on main).
The steps to reproduce the bug
- Create a load balancer rule on an isolated network or VPC served by a virtual router.
- On the router, make the config file unwritable, for example
chattr +i /etc/haproxy/haproxy.cfg. - Change the rule, for example
updateLoadBalancerRule algorithm=leastconn, or add a rule. - The API call succeeds and
listLoadBalancerRulesshows the new values. The router's/var/log/cloud.loghasCould not copy /etc/haproxy/haproxy.cfg.new to /etc/haproxy/haproxy.cfg, and/etc/haproxy/haproxy.cfgstill has the old config.
What to do about it?
Fail the apply when the new config can't be installed, the same way as when it fails haproxy -c, so that the management server sees the failure and rolls back.
Activity
github-actions commentedon Nov 10, 2026
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
🎯 Triage report
When the VR cannot replace
/etc/haproxy/haproxy.cfg,CsHelper.copy()logs the error and returns, so the config run succeeds. The management server records the change as applied, and the router keeps serving the old configuration. A config that failshaproxy -calready fails the apply, so only this path is silent.📊 Assessment
CsLoadBalancerandCsHelperon the VRhaproxy -cdoes🔗 Similar issues
haproxy_check.pydoes not validate SSL config correctly💡 Notes and suggestions
chattr +i /etc/haproxy/haproxy.cfgon the router, change a rule, then check/var/log/cloud.logon the router.CsHelper.copy()may fail silently in the same way. Worth checking.Add this agentic workflow to your repo
To install this agentic workflow, run