Blueprint apply fails with values() must be called with at least one value #18

New Issue

MrUnknownDE · 2026-04-05T17:00:32+02:00

MrUnknownDE commented

2026-04-05 17:00:32 +02:00

Originally created by @MarekTran on 4/2/2026

Describe the Bug

Summary

Applying a Docker-label-derived blueprint against a self-hosted Pangolin control plane partially succeeds, creates some private resources successfully, and then fails with:

Blueprint applied with errors: Error: values() must be called with at least one value
Failed to update database from config: Error: values() must be called with at least one value

This appears to be an internal Pangolin bug rather than a user-input validation error.

What I was trying to do

I have a Docker Compose stack with:

nginx
minio
newt

The goal is to publish host-mode private resources into Pangolin for a machine client named dius-sock-proxy.

Initial validation errors

Before fixing the labels, Pangolin correctly returned validation errors such as:

Invalid input: expected string, received undefined at "private-resources.minio.site"
Invalid input: expected array, received string at "private-resources.minio.machines"
Invalid input: expected string, received number at "private-resources.nginx.tcp-ports"

Those were resolved by:

setting site
using machines[0]
ensuring tcp-ports is rendered as a string/range

So the final blueprint shape appears valid.

Rendered blueprint

This is the rendered blueprint as shown by Pangolin:

proxy-resources: {}
client-resources: {}
public-resources: {}
private-resources:
  nginx:
    alias: customer1-nginx.internal
    destination: nginx
    disable-icmp: false
    machines:
      - dius-sock-proxy
    mode: host
    name: customer1-nginx
    site: brilliant-scutigera-coleoptrata
    tcp-ports: 80-80
  minio-api:
    alias: minio.customer1.internal
    destination: minio
    disable-icmp: false
    machines:
      - dius-sock-proxy
    mode: host
    name: customer1-minio-api
    site: brilliant-scutigera-coleoptrata
    tcp-ports: "*"

Observed behavior

Pangolin partially applies the blueprint:

customer1-nginx private resource is created successfully
customer1-minio-api private resource is created successfully

But Pangolin still logs:

2026-04-02T14:10:05+00:00 [error]: Blueprint applied with errors: Error: values() must be called with at least one value
2026-04-02T14:10:05+00:00 [error]: Failed to update database from config: Error: values() must be called with at least one value

This leaves the blueprint apply in an error state even though the rendered blueprint is valid and the resources are being created.

Environment

OS Type & Version: Docker
Pangolin Version: 1.16.2
Gerbil Version: latest as of date
Traefik Version: 3.6.12.
Newt Version: v1.10.4
Olm Version: (if applicable)

To Reproduce

Minimal reproduction pattern

Create a site in Pangolin.
Create or reference a machine client named dius-sock-proxy.
Run newt against a Docker Compose stack with host-mode private resources similar to:

services:
  nginx:
    image: nginx:alpine
    labels:
      pangolin.private-resources.nginx.name: customer1-nginx
      pangolin.private-resources.nginx.alias: customer1-nginx.internal
      pangolin.private-resources.nginx.mode: host
      pangolin.private-resources.nginx.site: brilliant-scutigera-coleoptrata
      pangolin.private-resources.nginx.destination: nginx
      pangolin.private-resources.nginx.tcp-ports: 80-80
      pangolin.private-resources.nginx.disable-icmp: "false"
      pangolin.private-resources.nginx.machines[0]: dius-sock-proxy

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    labels:
      pangolin.private-resources.minio-api.name: customer1-minio-api
      pangolin.private-resources.minio-api.alias: minio.customer1.internal
      pangolin.private-resources.minio-api.mode: host
      pangolin.private-resources.minio-api.site: brilliant-scutigera-coleoptrata
      pangolin.private-resources.minio-api.destination: minio
      pangolin.private-resources.minio-api.tcp-ports: "*"
      pangolin.private-resources.minio-api.disable-icmp: "false"
      pangolin.private-resources.minio-api.machines[0]: dius-sock-proxy

Observe that the private resources are created, but Pangolin still emits:

values() must be called with at least one value

Extra note

I also saw a related unstable path when trying to model MinIO as multiple or explicit port resources. Some combinations produced different failures, but the key issue here is that even a valid rendered blueprint with successfully created resources can still end in this backend exception.

Expected Behavior

Expected behavior

If the blueprint is valid and resources are created successfully, Pangolin should:

complete the apply successfully, or
return a targeted validation error tied to a specific field/resource

It should not fail with an internal error like:

values() must be called with at least one value

Why this looks like a Pangolin bug

The earlier schema problems produced clear validation errors, which suggests validation is working.
After fixing those issues, Pangolin accepts the rendered structure and creates resources.
The remaining error is an internal backend exception, not a user-facing validation message.
The failure happens during or after blueprint reconciliation, even though at least part of the blueprint has already been persisted.

*Originally created by @MarekTran on 4/2/2026* ### Describe the Bug ## Summary Applying a Docker-label-derived blueprint against a self-hosted Pangolin control plane partially succeeds, creates some private resources successfully, and then fails with: ```text Blueprint applied with errors: Error: values() must be called with at least one value Failed to update database from config: Error: values() must be called with at least one value ``` This appears to be an internal Pangolin bug rather than a user-input validation error. ## What I was trying to do I have a Docker Compose stack with: - `nginx` - `minio` - `newt` The goal is to publish host-mode private resources into Pangolin for a machine client named `dius-sock-proxy`. ## Initial validation errors Before fixing the labels, Pangolin correctly returned validation errors such as: ```text Invalid input: expected string, received undefined at "private-resources.minio.site" Invalid input: expected array, received string at "private-resources.minio.machines" Invalid input: expected string, received number at "private-resources.nginx.tcp-ports" ``` Those were resolved by: - setting `site` - using `machines[0]` - ensuring `tcp-ports` is rendered as a string/range So the final blueprint shape appears valid. ## Rendered blueprint This is the rendered blueprint as shown by Pangolin: ```yaml proxy-resources: {} client-resources: {} public-resources: {} private-resources: nginx: alias: customer1-nginx.internal destination: nginx disable-icmp: false machines: - dius-sock-proxy mode: host name: customer1-nginx site: brilliant-scutigera-coleoptrata tcp-ports: 80-80 minio-api: alias: minio.customer1.internal destination: minio disable-icmp: false machines: - dius-sock-proxy mode: host name: customer1-minio-api site: brilliant-scutigera-coleoptrata tcp-ports: "*" ``` ## Observed behavior Pangolin partially applies the blueprint: - `customer1-nginx` private resource is created successfully - `customer1-minio-api` private resource is created successfully But Pangolin still logs: ```text 2026-04-02T14:10:05+00:00 [error]: Blueprint applied with errors: Error: values() must be called with at least one value 2026-04-02T14:10:05+00:00 [error]: Failed to update database from config: Error: values() must be called with at least one value ``` This leaves the blueprint apply in an error state even though the rendered blueprint is valid and the resources are being created. ### Environment - OS Type & Version: Docker - Pangolin Version: 1.16.2 - Gerbil Version: latest as of date - Traefik Version: 3.6.12. - Newt Version: v1.10.4 - Olm Version: (if applicable) ### To Reproduce ## Minimal reproduction pattern 1. Create a site in Pangolin. 2. Create or reference a machine client named `dius-sock-proxy`. 3. Run `newt` against a Docker Compose stack with host-mode private resources similar to: ```yaml services: nginx: image: nginx:alpine labels: pangolin.private-resources.nginx.name: customer1-nginx pangolin.private-resources.nginx.alias: customer1-nginx.internal pangolin.private-resources.nginx.mode: host pangolin.private-resources.nginx.site: brilliant-scutigera-coleoptrata pangolin.private-resources.nginx.destination: nginx pangolin.private-resources.nginx.tcp-ports: 80-80 pangolin.private-resources.nginx.disable-icmp: "false" pangolin.private-resources.nginx.machines[0]: dius-sock-proxy minio: image: minio/minio:latest command: server /data --console-address ":9001" labels: pangolin.private-resources.minio-api.name: customer1-minio-api pangolin.private-resources.minio-api.alias: minio.customer1.internal pangolin.private-resources.minio-api.mode: host pangolin.private-resources.minio-api.site: brilliant-scutigera-coleoptrata pangolin.private-resources.minio-api.destination: minio pangolin.private-resources.minio-api.tcp-ports: "*" pangolin.private-resources.minio-api.disable-icmp: "false" pangolin.private-resources.minio-api.machines[0]: dius-sock-proxy ``` 4. Observe that the private resources are created, but Pangolin still emits: ```text values() must be called with at least one value ``` ## Extra note I also saw a related unstable path when trying to model MinIO as multiple or explicit port resources. Some combinations produced different failures, but the key issue here is that even a valid rendered blueprint with successfully created resources can still end in this backend exception. ### Expected Behavior ## Expected behavior If the blueprint is valid and resources are created successfully, Pangolin should: - complete the apply successfully, or - return a targeted validation error tied to a specific field/resource It should not fail with an internal error like: ```text values() must be called with at least one value ``` ## Why this looks like a Pangolin bug - The earlier schema problems produced clear validation errors, which suggests validation is working. - After fixing those issues, Pangolin accepts the rendered structure and creates resources. - The remaining error is an internal backend exception, not a user-facing validation message. - The failure happens during or after blueprint reconciliation, even though at least part of the blueprint has already been persisted.

MrUnknownDE closed this issue

2026-04-05 17:00:32 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#18

Blueprint apply fails with values() must be called with at least one value #18