sync: menu catalog seeding, nginx startup fixes, env var namespacing, image bumps (iam 0.6.3 / web-console 0.6.5) - #200
Merged
Merged
Conversation
GRAFANA_API_KEY, OPENAI_API_KEY, OLLAMA_BASE_URL and UID/GID were read straight from the host environment, so any same-named variable on the operator's shell leaked into the containers (UID is even a bash builtin, so it always leaked). Rename the host-side variables to MC_OBSERVABILITY_*/MC_DATA_MANAGER_* and map them onto the env keys the images actually read, which stay unchanged. MODE and DEFAULT_LANGUAGE were confirmed dead (no consumer) and are left for a separate cleanup.
… format string fmt.Printf was called with the value concatenated onto the format string, so the %s verb was never filled and any % in the data was misinterpreted. This also failed go vet (non-constant format string), blocking the feature gate for every change in the repository.
The latest console menu schema defaults framework_service to mc-web-console-front, so iframe menus resolve their host from the service URL registry under that name. The post-init script never registered it, leaving every iframe menu with 'service URL not found' on a fresh install. Register the internal URL and update it to the public front URL alongside the other -fe entries. The post-init container only loads conf/mc-iam-manager/.env, so the front port/public host are added to that env template (same convention as the other iframe proxy entries) with a script-side fallback.
…rvice fix(setup): register mc-web-console-front service URL in post-init
fix(env): namespace host-side variables that lacked a framework prefix
mc-iam-manager가 이제 메뉴 등록(POST /api/setup/initial-menus) 내부에서
역할-메뉴 권한 시딩까지 서버 측에서 체이닝하므로, 설치 스크립트가 별도로
initial-role-menu-permission-yaml을 호출할 필요가 없어졌다.
1_setup_auto.sh의 auto_setup()에서 Step 4-1(init_menu_permissions 호출)을
제거해 설치 흐름을 11단계로 축소했다. init_menu_permissions() 함수 자체는
수동 재시딩용으로 유지한다.
1_setup_manual.sh의 옵션 4)도 init_menu 단독 호출로 축소했다. 독립
옵션 4a)(권한만 재시딩)는 escape hatch로 그대로 유지한다.
README.md/README_kr.md의 설치 스텝 수 안내("8-step"/"8단계")가 이미
실제 스텝 수와 어긋나 있던 기존 드리프트를 11로 맞춰 함께 정정했다
(이번 변경으로 인한 회귀가 아니라 기존 문서 드리프트 수정).
feat: add local menu resource yaml for self mode (USE_IAM=false)
fix: drop redundant client-side menu permission seeding step
chore: remove dead selfiammenu.yaml copy from mc-web-console conf
mc-infra-manager(tumblebug)가 mc-infra-connector(spider)를 호출할 때 TB_SPIDER_USERNAME/TB_SPIDER_PASSWORD가 설정되지 않아 spider REST API 호출이 401로 실패하던 문제. mc-infra-connector에 이미 쓰이고 있는 MC_INFRA_CONNECTOR_API_USERNAME/PASSWORD를 그대로 재사용해 매핑을 추가.
fix: docker-compose.yaml 에 mc-infra-manager param 매핑 보완
… to 0.13.2 and drop dead K8s remote-cmd/file-transfer operations ADMINCLI-TECH-013
- docs/running-on-instance.md 전면 재작성: 이미 삭제된 mc-iam-manager 개별 init 스크립트(initauto.sh/add_demo_user.sh) 흐름을 현재 installAll.sh 흐름(clone → .env.setup 복사 → installAll.sh → mcc infra info)으로 교체, 옛 파일명/env변수 표기/포트(5005)/버전 핀/기본 계정 정정 - README.md:20 안내 링크 수정 (mc-admin-cli-infra.md → running-on-instance.md, 잘못된 문서를 가리키고 있었음) WIP: README.md Step 5 (d) "11-step setup" 항목에 메뉴 카탈로그 등록· role-menu 권한 시딩이 포함된다는 설명 보강은 아직 미완료
The 11-step setup verification section explained how to check the post-initial logs but never said what the steps actually register. Note that Step 4 registers the menu catalog and seeds role-menu permissions in one chained server-side call.
docs: running-on-instance.md 현행화 + README 현행화
./mcc --version has never worked - Cobra only registers --version when the root command's Version field is set, and it wasn't, so the flag simply didn't exist (docs telling users to run it as a smoke test always failed with "unknown flag"). Pull the version from the VCS info Go embeds automatically for any build done inside a git checkout (default since Go 1.18, no ldflags or build script changes needed) - the short commit hash, plus "-dirty" if the working tree had uncommitted changes at build time. Falls back to "dev" when build info isn't available (e.g. go run).
feat(cli): mcc --version command 보완
…32-sync fix: sync mc-infra-manager api.yaml version stamps to 0.13.2, drop dead K8s ops
…console canonical api.yaml mc-admin-cli's bundled conf/docker/conf/mc-web-console/api/conf/api.yaml (mounted into the running mc-web-console-api container) had fallen drastically behind mc-web-console's own conf/api.yaml for the mc-infra-manager service: only 195 of 339 operations were present, missing commonly-used ones like CreateVNet, DeleteVNet, GetAllInfra, PostInfra, PutSecurityGroup, etc. This caused live 404s (confirmed: CreateVNet). mc-iam-manager's serviceActions registry fallback could not rescue these calls either, since it only knows cb-tumblebug's raw swagger operationIds (e.g. PostVNet), not mc-web-console's curated aliases (e.g. CreateVNet). mc-iam-manager block was also stale (133 vs 140 ops) and synced in the same pass. Other services (mc-infra-connector, mc-web-console, mc-observability, mc-application-manager, mc-workflow-manager, mc-cost-optimizer, mc-data-manager) were already within 0-1 operations of current and left untouched. Only the serviceActions.mc-infra-manager / serviceActions.mc-iam-manager blocks were replaced; the services.* section (deployment-specific baseurl/auth) is unchanged. Verified: POST /api/mc-infra-manager/CreateVNet now resolves and reaches the tumblebug backend (previously a routing 404) against the local v0.13.2 stack. ADMINCLI-TECH-016
…erviceactions-sync fix: sync mc-infra-manager/mc-iam-manager serviceActions from mc-web-console canonical api.yaml
The menu seed came from the raw GitHub URL of mc-web-console's main branch, while every image is pinned by tag and every other subsystem config is a copy under conf/docker/conf/<framework>/. That made installs non-reproducible (whatever main held that day) and impossible offline, and the post-init script's wget of that URL produced an unused menu.yaml. - docker-compose(.mini).yaml: mount the existing bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml read-only into mc-iam-manager at /app/asset/menu/webconsole_menu_resources.yaml - MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml in .env.setup (both) and the tracked conf/mc-iam-manager/.env; the raw URL stays as a commented option - 1_setup_auto.sh / 1_setup_manual.sh: stop fetching menu.yaml (IAM reads the seed itself); only spider-check when the env is a URL; log IAM's skipped=true (menus seeded once at install); manual option 4b forces a re-seed via ?force=true with a confirmation - drop the orphan conf/docker/menu.yaml and the menu.yaml entries in .gitignore / cleanAll.sh - refresh bundled copies: menu catalog from mc-web-console develop 3a015768 (61 menus), permission.yaml from mc-iam-manager fix/iam-permission-yaml-canonical-ids, InitialMenus description in the three api.yaml copies - README / running-on-instance.md: seed-once model and .env migration note
…an-install crash loop On a fresh install the IAM/KC proxy blocks resolved their upstream hostnames at config-parse time, so nginx died with [emerg] host not found before the mc-iam-manager container existed. Switch the four static proxy_pass directives to the resolver + variable pattern already used by the other server blocks so nginx starts regardless of container startup order. The /auth/ block drops its literal URI: with a variable proxy_pass a literal URI replaces the entire request path, which would break /auth/realms/* subpaths (also fixed in the local template where this latent defect already existed).
…p deadlock mc-iam-manager waited for mc-iam-manager-nginx (service_started) while nginx itself could not start until the mc-iam-manager DNS name existed, leaving both stuck on a fresh install. The IAM manager has no startup dependency on nginx (Keycloak and its own healthcheck are reached directly), and the standalone mc-iam-manager repository already runs with this dependency removed.
Uses the /nginx-health endpoint already served by the templates so a crash-looping or misconfigured nginx is visible in compose ps instead of reporting plain Up. No service depends on nginx being healthy, so startup ordering is unaffected.
…eset
The dev/prod preset scripts gained this substitution earlier but the
local script was missed, leaving a literal ${MC_OBSERVABILITY_FRONT_PORT}
listen directive in the generated nginx.conf and failing nginx startup
in local mode.
The prod preset read MC_IAM_MANAGER_DOMAIN but never applied it to the generated nginx.conf. This was a no-op while the template hardcoded the container hostname; with the resolver/variable pattern the token must be substituted or nginx fails to parse the config.
nginx was only ever started as a side effect of mc-iam-manager's compose dependency. With that dependency removed, no wave listed nginx, so a fresh install brought up the IAM manager without its public-domain endpoints and it never became healthy. List nginx in wave 1 ahead of the IAM manager.
fix(compose): break mc-iam-manager <-> nginx clean-install startup deadlock
Follows the m-cmp/mc-iam-manager v0.6.3 release (2026-09-09). Both the full and mini compose files are updated.
chore: bump mc-iam-manager, mc-web-console-api/front to 0.6.3
…dled-copy feat(menu): seed mc-iam-manager from the bundled menu catalog copy
chore: mc-iam-manager 이미지 0.6.3으로 bump
chore: bump mc-web-console-api/front to 0.6.5
Member
|
PTAL @dogfootman |
Resolve conflict in conf/docker/conf/mc-iam-manager/permission.yaml by keeping the develop version: it already grants mcworkflows/mceventlistener (m-cmp#199) and aligns all menu ids with webconsole_menu_resources.yaml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs 22 commits accumulated on
MZC-CSC:developsince #192. Groups below are ordered by impact.Menu catalog seeding
The menu catalog is now seeded from a bundled copy rather than fetched from a raw GitHub URL at install time.
conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yamlis mounted read-only intomc-iam-managerand read once at first install. Later menu edits live in the IAM database; re-seeding requires an explicit force.MC_WEB_CONSOLE_MENUYAMLnow defaults to that bundled path. The previous raw URL is kept commented out for anyone who wants remote seeding.conf/docker/menu.yaml(417 lines) and the deadselfiammenu.yamlcopy; adds a local menu resource yaml for self mode (USE_IAM=false).mc-infra-manager/mc-iam-managerserviceActions from the canonicalmc-web-consoleapi.yaml.This removes the install-time dependency on
raw.githubusercontent.comand keeps the console and IAM menu definitions from drifting apart.nginx startup deadlock on clean install
A clean install could deadlock or crash-loop because
mc-iam-managerandmc-iam-manager-nginxwaited on each other.mc-iam-manager→mc-iam-manager-nginxdependency and start nginx explicitly in wave 1 ofinstallAll.sh.nginx.template.conf, so nginx no longer fails to start when an upstream container is not yet up.mc-iam-manager-nginx.MC_IAM_MANAGER_DOMAIN(prod) andMC_OBSERVABILITY_FRONT_PORT(local).Environment variable namespacing
Several host-side variables had no framework prefix and could be shadowed by the host environment during compose interpolation. Most notably
UID, which is a reserved shell variable and would silently leak into themc-data-managervolume chown.UID/GID→MC_DATA_MANAGER_UID/MC_DATA_MANAGER_GIDGRAFANA_API_KEY→MC_OBSERVABILITY_GRAFANA_API_KEYOPENAI_API_KEY→MC_OBSERVABILITY_OPENAI_API_KEYOLLAMA_BASE_URL→MC_OBSERVABILITY_OLLAMA_BASE_URLThe container-side keys are unchanged;
docker-compose.yamlmaps the prefixed host variables onto them.Other fixes
TB_SPIDER_USERNAME/TB_SPIDER_PASSWORD) tomc-infra-manager, which previously failed to authenticate againstmc-infra-connector.mc-web-console-frontservice URL in post-init.Versionflag to the CLI root command (src/cmd/root.go).api.yamlversion stamps formc-infra-manager/mc-infra-connectorto 0.13.2 and drop the dead K8s remote-cmd / file-transfer operations.Image bumps
cloudbaristaorg/mc-iam-managercloudbaristaorg/mc-web-console-apicloudbaristaorg/mc-web-console-frontNo other image tags are touched by this PR —
mainis already ahead ofdevelopon cb-spider, cb-tumblebug, cost-optimizer, observability, application-manager and workflow-manager, and those lines are left as they are onmain.Docs
docs/running-on-instance.mdand fixes broken README links.