Description
AppSec WAF alerts cannot be persisted to LAPI when using external MySQL. Every POST /v1/alerts from the AppSec pod returns HTTP 500. The AppSec client retries in a loop (~1s).
The failure is in pkg/database/alerts.go → createAlertBatch(): pre-creating child rows (Event.CreateBulk, Meta.CreateBulk) and linking them via Alert.Create().AddEvents().AddMetas().Save() (or Alert.CreateBulk) triggers ent O2M constraint errors on MySQL.
The same payload works on SQLite (default LAPI DB with data PVC).
This reproduces on v1.7.8 (including build with #4438 transaction fix), on a fresh/empty MySQL database. Failed inserts roll back; alerts / events / meta stay empty until a workaround is applied.
Related: #4432, #4438 (PG deadlock / FlushOrphans race — fixed in 1.7.8, but this is a separate MySQL + O2M edge linking issue).
msg="while pushing to api : failed sending alert to LAPI: API error: machine \"crowdsec-appsec-676887bbd7-rvqn4\": saving alerts: bulk creating alert: ent: constraint failed: one of [55823 55824 55825 55826 55827 55821 55822] is already connected to a different alert_metas: unable to insert bulk"
Environment
| Component |
Value |
| Platform |
Kubernetes (AKS) |
| Helm chart |
crowdsec 0.24.0 |
| Image (broken) |
crowdsecurity/crowdsec:v1.7.8-63227459 |
| LAPI |
1 replica, external MySQL |
| AppSec |
enabled, :7422, Traefik bouncer plugin |
| Agent |
Traefik log acquisition |
Steps to reproduce
- Deploy CrowdSec Helm 0.24.0 with AppSec + LAPI on external MySQL (v1.7.8).
- Confirm LAPI reports db_mysql in cscli version.
- Trigger AppSec, e.g. GET http:///.env
- Observe LAPI POST /v1/alerts → 500 and AppSec error loop.
- Optional: truncate all CrowdSec tables, restart LAPI — failure still reproduces.
- Switch LAPI to SQLite (omit db_config, enable data PVC) — same trigger → 201, alerts persist
Description
AppSec WAF alerts cannot be persisted to LAPI when using external MySQL. Every POST /v1/alerts from the AppSec pod returns HTTP 500. The AppSec client retries in a loop (~1s).
The failure is in pkg/database/alerts.go → createAlertBatch(): pre-creating child rows (Event.CreateBulk, Meta.CreateBulk) and linking them via Alert.Create().AddEvents().AddMetas().Save() (or Alert.CreateBulk) triggers ent O2M constraint errors on MySQL.
The same payload works on SQLite (default LAPI DB with data PVC).
This reproduces on v1.7.8 (including build with #4438 transaction fix), on a fresh/empty MySQL database. Failed inserts roll back; alerts / events / meta stay empty until a workaround is applied.
Related: #4432, #4438 (PG deadlock / FlushOrphans race — fixed in 1.7.8, but this is a separate MySQL + O2M edge linking issue).
Environment
Steps to reproduce