Repository navigation
[Tracking] Dashboard / UI issue triage #3828
Description
Scope
This issue is the single place to triage open Cozystack Console/dashboard work. The inventory was audited on 2026-08-14 by paginating all 416 open issues, all 174 open pull requests, every changed-file list, and cross-references from the resulting issues. It includes dashboard-owned work and cross-component defects whose body describes a concrete Console symptom or blocked Console workflow. Grafana dashboards, OpenSearch Dashboards, external application admin UIs, the website, and generic schema-backed application features are out of scope.
Definition of done
- Reproduce every live bug against the current in-tree Console or record why reproduction is blocked.
- Close confirmed duplicates and obsolete items left over from the standalone UI implementation.
- Give every retained issue an accurate kind, area, triage state, and priority.
- Link every active implementation PR and identify accepted issues that still have no owner or PR.
- Keep this inventory synchronized until every listed item is closed or moved to a more specific tracker.
Open pull requests
Direct fixes and implementations
- fix(dashboard): re-authenticate on 401 instead of failing silently #3115 — redirect to oauth2-proxy after an expired session; changes requested.
- refactor(dashboard): validate the schema form before page-level checks #3116 — run schema validation before page-level checks; approved but currently blocked.
- fix(release): publish rewritten packages during RC promotion #3795 — fixes the release-promotion defect behind the wrong version shown by Stable release ships the rc's packages OCI artifact — platformSourceRef points at an rc-built bundle, so the dashboard reports vX.Y.Z-rc.N on a stable install #3477.
- fix(mongodb): surface per-user credentials to the tenant #2860 — publishes MongoDB per-user credentials, addressing the second defect described in bug(mongodb): dashboard shows no usable MongoDB credentials on fresh install #2678; draft.
- feat(mongodb): add TLS support via PSMDB operator-managed certificates #2692 — changes MongoDB dashboard resource mapping and is cross-referenced from bug(mongodb): dashboard shows no usable MongoDB credentials on fresh install #2678; confirm the exact overlap during triage.
Mechanical PRs touching dashboard code
- chore(deps): update indirect go modules #3302 — Renovate update touching the dashboard token-proxy Go modules.
- chore(deps): update container image & action digests #3363 — Renovate digest update touching the Console and token-proxy container definitions.
Issues currently labeled area/dashboard
- Dashboard: no delete action for a tenant in the list, only reachable by cancelling its edit form #3822 — Dashboard has no discoverable tenant delete action.
- bug(apps): dashboard resource Roles grant list and watch under resourceNames, which never matches #3613 — dashboard resource Roles use
resourceNameswith list/watch. - docs(readme): replace stale UI screenshot with current dashboard on new logo #3484 — replace the stale README UI screenshot.
- [dashboard] Kubernetes app: clearing instanceType to size a node group by explicit resources silently fails to save #3135 — clearing Kubernetes
instanceTypesilently fails to save. - Console list views go permanently stale after a transient watch drop #3096 — Console list views remain stale after a watch drop.
- vm-instance renders both instancetype matcher and explicit domain resources — KubeVirt rejects the VM with a conflict error #2909 — VM form renders conflicting instancetype and explicit resources.
- chore(deps): refresh npm dependencies with published security fixes #3114 — refresh dashboard npm dependencies with published security fixes.
- Platform ingress-nginx uses default client-header buffers — large OIDC tokens cause HTTP 400 #2853 — platform ingress header buffers reject large OIDC tokens.
- VMInstance disk entry strange behaviour #2845 — VMInstance disk form behaves unexpectedly; needs information.
- App detail Services tab: show a connection FQDN with configurable domain suffix #3112 — show a connection FQDN on the application Services tab.
- Child tenants see no default VM images — picker reads cozy-public PVCs directly instead of via an Option source #3110 — child tenants see no default VM images.
- VM create form: cannot add a disk until the page is refreshed once #3109 — VM disk cannot be added until the page is refreshed; needs information.
- Cluster create form: cilium/coredns shown among toggleable addons without an enable toggle #3108 — mandatory Kubernetes addons appear as toggleable without a toggle.
- Dashboard 1.4.0 lacks of detailed information about services #2789 — dashboard service details regression.
- Capacity drill-down pages show a generic error instead of 403-specific copy #3107 — capacity pages show a generic error instead of 403-specific copy.
- Tenant picker shown on cluster-scoped /admin pages #3106 — tenant picker appears on cluster-scoped admin pages.
- humanizeBytes renders Ki-range sizes as raw bytes #3105 —
humanizeBytesrenders Ki-range values as raw bytes. - Surface underlying Pod and HelmRelease events in application detail view #3104 — surface Pod and HelmRelease events in application details.
- bug(mongodb): dashboard shows no usable MongoDB credentials on fresh install #2678 — MongoDB credentials are missing or unusable in the dashboard.
- immutable-paths: array reorder re-anchors source values to new indices #3103 — immutable array paths re-anchor after reorder.
- immutable-paths: overlay does not materialise an immutable leaf when its ancestor is missing #3102 — immutable leaf is not materialized when its ancestor is absent.
- immutable-paths: walker should descend into oneOf/anyOf/allOf branch properties #3101 — immutable-path walker misses schema composition branches.
- feat: surface backup state for managed applications (backend + console) #2609 — surface managed-application backup state in API and Console.
- fix(dashboard): ClusterRoleBinding incloud-web-cluster-view references non-existent namespace incloud-web #2174 — stale
incloud-webClusterRoleBinding namespace reference.
Additional Console-impacting issues without area/dashboard
- Tenant admins cannot upload images into VM disks (CDI upload forbidden by tenant RBAC) #3759 — tenant admins cannot upload VM disk images through the dashboard workflow.
- dashboard.xxx.xxx HTTPRoute
.status.parentsreportsHTTPRoute is not allowed to attach to this Gateway due to namespace selector restrictions#3721 — the dashboard HTTPRoute cannot attach to the configured Gateway. - helm lint cannot pass on any app chart: icon is a dashboard-relative path #3702 — app chart icons use dashboard-relative paths that make
helm lintfail. - Stable release ships the rc's packages OCI artifact — platformSourceRef points at an rc-built bundle, so the dashboard reports vX.Y.Z-rc.N on a stable install #3477 — stable installations display an RC version in the dashboard.
- Console nginx uses default client-header buffers — large OIDC tokens cause HTTP 400 #3113 — Console nginx rejects large OIDC headers.
- immutable-paths: walker should descend into oneOf/anyOf/allOf branch properties #3100 — open duplicate of immutable-paths: walker should descend into oneOf/anyOf/allOf branch properties #3101.
- bug(api): TenantSecrets API ignores labelSelector parameter #2527 — ignored TenantSecret label selectors make the UI show unrelated secrets.
- feat(dashboard): show tenant quota remaining in burstable and dedicated CPU views #2440 — show remaining burstable and dedicated CPU quota in the dashboard.
- bug(api): GET by name returns 404 for instances created with a different release prefix #2404 — instances remain in UI lists but cannot be opened, edited, or deleted after a prefix change.
- bug(api): discovery endpoint timeout due to HTTP/2 request queuing on aggregated API server #2324 — aggregated API timeouts cause intermittent dashboard failures and BFF restarts.
- Regular cleanup of orphaned resources for dashboard #1561 — stale dashboard-resource orphan cleanup design.
- Disconnected message on dashboard #609 — unclear dashboard error after the Keycloak session expires.
Related umbrella
#2733 tracks platform-wide error diagnostics; its concrete Console slice is already represented above by #3104 and should not be duplicated here.
Metadata
Metadata
Assignees
Labels
Issues or PRs related to the dashboard / UIA large development increment that brings definite value to Cozystack usersCategorizes issue or PR as related to cleanup of code, process, or technical debtGeneral backlog priority. Lower than priority/important-longtermIndicates an issue is ready to be actively worked on
Activity
myasnikovdaniil commentedon Aug 16, 2026
State, 2026-08-16
Worked the whole inventory. Nine of the listed issues needed no work at all, which is the headline: more than a third of this tracker was stale records rather than open defects.
Closed, already fixed or not reproducing. #3101 and #3103 are unreachable on the shipped schemas: all 134
oneOf/anyOf/allOfare the int-or-string scalar pair with noproperties, and none of the 16 shipped immutable paths contains a wildcard. #3104 is delivered byEventsTab.tsx, mounted atApplicationDetailPage.tsx:206, which correlates Pods by both the application and the Helm label, PVCs both ways, and the HelmRelease. #3110 was fixed bybb322138e, #2174 bybecf8d757, and #3114's 13 named packages are 9 absent from the vendored lockfile and 4 past every advisory. #3109 and #2845 do not reproduce: checked in a browser against a live cluster, the disks+ addadds exactly one row on a fresh load and the dropdown populates immediately when the tenant has a VMDisk, and removing an array row leaves the remaining values attached to their own rows.Fixed in #3837, six of them: #3105 Ki-range sizes, #3106 tenant picker on
/admin, #3107 403 on capacity drill-downs, #3102 immutable leaf under an absent ancestor, #3135 focus on a blocked submit, #3822 the tenant row not linking to its detail page.Worth recording from #3822, since the issue's framing was off: the tenant detail page exists and is complete, Delete and all six tabs included. Nothing in the list linked to it, because the name was plain text and the row's only link sat on the Edit button. Hence Edit then Cancel as the only way in.
Reclassified, not console work. #3112 is a platform feature: no chart publishes a DNS name for an exposed Service except opensearch, and that one uses the internal cluster domain, so showing
<service>.<host>would render a string that does not resolve. The suffix itself already exists and is already configurable, as the namespace labelnamespace.cozystack.io/hostset fromTenant.spec.hostin the tenant form. What is missing is publication, which is external-dns plus display rather than a UI change. #2909 is apackages/apps/vm-instancechart bug. #3096 is real and unfixed but lives inpackages/k8s-clientand needs a backoff design, so it wants its own pull request rather than the batch.Cross-component, still open and now with owners named. #3613 has one more instance, added there. #2853 needs
packages/system/ingress-nginxvalues and the console Containerfile's nginx heredoc, neither of which has header buffers. #2678 needspackages/apps/mongodbpluspackages/system/mongodb-rd, both defects reproduce. #2609 is backend before console. #3484 needs a live capture published to the website before the one-line README swap.New, found while working the list. The VMDisk form promises an in-page image upload that does not exist anywhere in the console. #3847 makes the promise true and hands over the
virtctlcommand instead, because the browser cannot reach the CDI upload proxy on a stock cluster: the apiserver'sservices/proxystripsAuthorizationand thecdi-uploadproxyingress usesssl-passthrough, so CDI's internal certificate reaches the browser untrusted and with no matching SAN. Both measured against a live cluster.Pull requests listed here. #3115 and #3116 are rebased onto current main and pushed, #3115 with its two review findings fixed. #3795 is pushed. #2860, #2692, #3302 and #3363 are untouched.
One architectural note that explains more than one entry above:
SchemaFormbindsui:field: SourceFieldto the parentsourceobject, and in RJSF aui:fieldon a parent replaces rendering of the whole subtree, so the nestedx-cozystack-optionswidget binding is silently dropped and a direct PVC read runs instead. The provider and the annotation both exist, so the mechanism looks wired and is not.fix(dashboard): small Console fixes from the #3828 triage (#3837)