Critical: Vulnerability Scanner extension fails to install

[IsaSih]

Setup

• Rancher version: Rancher manager

Rancher v2.15.0-alpha13
Dashboard master 71063fd
Rancher CLI v2.15.0-rc.1

• Rancher UI Extensions: cert-manager installed and SUSE Vulnerability Scanner version 0.8.0
• Browser type & version: Version 149.0.7827.116 (Official Build) (arm64)

Describe the bug
The extension fails to download the supporting repositories. The installation wizard gets stuck in

To Reproduce
1- Install cert-manager from https://charts.jetstack.io
2- Install SUSE Vulnerability Scanner from
URL
https://github.com/neuvector/security-ui-exts.git
Branch
gh-pages
Commit
3dff5a4
3- By running the installation from the dashboard UI, Provide your AppCo credentials. the supporting repositories fail to install. The console shows a 409 error and the following log:

{
    "type": "error",
    "links": {},
    "code": "Conflict",
    "message": "Operation cannot be fulfilled on clusterrepos.catalog.cattle.io \"security-extension2\": the object has been modified; please apply your changes to the latest version and try again",
    "status": 409,
    "type": "error"
}

The installation wizard freezes in the Installation for CloudNativePG step. Please see screenshot for more details.

Result

Expected Result

Screenshots

Screen.Recording.2026-06-22.at.5.29.01.PM.mov

[github-actions]

🎯 Agentic Issue Triage

Summary: During installation of the SUSE Vulnerability Scanner extension, the installation wizard freezes because supporting clusterrepos.catalog.cattle.io resources fail to update with a HTTP 409 Conflict error — "the object has been modified; please apply your changes to the latest version and try again." The wizard gets stuck on the "Installation for CloudNativePG" step and never recovers.

---

🔍 Analysis

Root Cause

This is a Kubernetes optimistic concurrency conflict. When the extension installation wizard creates or updates a clusterrepos.catalog.cattle.io resource (e.g., security-extension2), Kubernetes rejects the write because the object's resourceVersion in the request is stale — another controller or reconciler has already modified it between the initial read and the write attempt.

The dashboard does have 409-conflict retry logic in the create-edit-view mixin (shell/mixins/create-edit-view/impl.js lines 171–183), but this retry logic:

• Only applies to the save() path in the CreateEditView mixin
• Is guarded to isEdit mode only (depth === 0 && this.isEdit)

The extension installation wizard likely uses a separate code path (catalog/repo provisioning during the install flow) that does not use this mixin and has no retry logic for 409 responses, causing the installation to fail silently and leave the wizard frozen.

Related issue

#10972 — Saving yaml does not resolve 409 errors documents a similar gap: the YAML editor's save path also lacks 409 retry/conflict resolution. This is a broader systemic issue where only CreateEditView handles 409s gracefully.

🐛 Reproduction Steps

1. Deploy Rancher v2.15.0-alpha13 (or latest master)
2. Install cert-manager from (charts.jetstack.io/redacted)
3. Add the SUSE Vulnerability Scanner extension:
   • URL: https://github.com/neuvector/security-ui-exts.git
   • Branch: gh-pages
   • Commit: 3dff5a4cc8938dc0559a1410c017f44a7ff6da06
4. Run the extension installation wizard and provide AppCo credentials
5. Observe the wizard freezes on the "Installation for CloudNativePG" step
6. Open browser DevTools → Network tab and note the 409 Conflict response on a PUT/PATCH to clusterrepos.catalog.cattle.io "security-extension2"

🛠️ Debugging Strategies

1. Browser DevTools: Open the Network tab before starting the install wizard. Filter for clusterrepos or catalog.cattle.io. Capture the full request/response for the 409 to see what resourceVersion is being sent vs. what the server expects.

2. Identify the code path: Search for where the extension install wizard provisions catalog repos. Likely in:

   • shell/pages/c/_cluster/uiplugins/ — the extensions UI pages
   • shell/dialog/InstallExtensionDialog.vue — the install dialog
   • shell/config/uiplugins.js — plugin config and catalog interaction
   • shell/plugins/plugin.js — plugin lifecycle including repo setup

3. Compare with the working path: The CreateEditView mixin (shell/mixins/create-edit-view/impl.js:116-183) correctly handles 409s by re-fetching the live resource, merging changes, and retrying. The fix should apply similar retry logic in the extension install flow.

4. Verify wizard state machine: Check whether the wizard's progress tracker is awaiting a resolved promise from the repo-creation step. A rejected promise that is caught but not propagated may explain why the UI freezes without an error.

5. kubectl check: After a failed install attempt, run:

   kubectl get clusterrepos -n cattle-system
   kubectl describe clusterrepo security-extension2

   to see whether the resource was partially created/modified.

📋 Suggested Sub-tasks / Checklist

• Identify the exact code path that provisions clusterrepos during the extension install wizard (likely shell/dialog/InstallExtensionDialog.vue or shell/config/uiplugins.js)
• Add 409 retry logic to the catalog repo creation/update step, similar to handleConflict in shell/mixins/create-edit-view/impl.js:116
• Ensure the wizard surfaces a meaningful error (not just a frozen UI) if retries are exhausted
• Verify fix also covers the case where the wizard is installing multiple supporting repos in parallel (race condition may trigger multiple 409s)
• Add/update unit tests to cover the 409-retry path in the extension install flow
• Consider whether the fix in Saving yaml does not resolve 409 errors dashboard#10972 (409 retry for YAML save) could be applied at a lower, shared utility level to benefit both flows

📚 Relevant Resources

• [Kubernetes optimistic concurrency / resourceVersion]((kubernetes.io/redacted) — explains why 409 Conflict occurs
• shell/mixins/create-edit-view/impl.js — existing 409 conflict handler
• Related open issue rancher/dashboard#10972 — YAML save does not handle 409
• NeuVector Security UI Extensions repo — the extension source being installed

Generated by Agentic Triage for issue #617 · ● 409.9K · ◷

[github-actions]

🤖 Issue grooming questions

Thanks for filing this bug with detailed environment info, a clear error message, and screenshots. Two items are needed before this can be triaged:

1. Expected Result

The "Expected Result" section is blank. Could you describe what a successful installation should look like? For example: does the extension install without errors, and do the supporting repositories get configured correctly?

2. Acceptance Criteria

Please add 1–3 testable acceptance criteria to the issue body that define what "fixed" looks like. For example:

• Installing SUSE Vulnerability Scanner 0.8.0 via the UI wizard completes without a 409 Conflict error.
• All required supporting repositories are created and available after the installation wizard completes.

This comment was generated automatically to help gather the information needed to groom this issue.

Generated by Daily Issue Grooming · ● 357.8K · ◷

[richard-cox]

@xingzhang-suse same with this one, could you assign or transfer? thanks

[xingzhang-suse]

@richard-cox This one is an known issue form using rancher/shell v3.0.12-rc.3.
I have fixed it in the code base.

I cannot transfer this case and assign it as well.
We need a supervisor who has admin permission for both dashboard and security-ui-exts

[github-actions]

🤖 Issue grooming questions

The environment details, reproduction steps, and error message (409 Conflict) are clearly documented — thank you. The comment activity noting a fix in the codebase is noted. However, the issue body still needs updating before this can be triaged:

1. Expected Result (still blank)

Please fill in the "Expected Result" field in the issue body describing what a successful installation should look like. For example: "The installation wizard completes successfully, all supporting repositories are configured, and the SUSE Vulnerability Scanner is available."

2. Acceptance Criteria

Please add 1–3 testable acceptance criteria to the issue body defining what "fixed" looks like. For example:

• Installing SUSE Vulnerability Scanner 0.8.0 via the UI wizard completes without a 409 Conflict error.
• All required supporting repositories are created and available after the installation wizard completes.
• The installation wizard does not freeze or display an indefinite loading state.

This comment was generated automatically to help gather the information needed to groom this issue.

Generated by Daily Issue Grooming · ● 552.7K · ◷

[xingzhang-suse]

There is not repo refresh conflict after fixing it

AppCo_installation.mov