From fd2a473f575814394272dcb458c3df3248bb01cc Mon Sep 17 00:00:00 2001 From: yh-noh Date: Tue, 11 Aug 2026 09:52:53 +0900 Subject: [PATCH 01/22] fix(env): namespace host-side variables that lacked a framework prefix GRAFANA_API_KEY, OPENAI_API_KEY, OLLAMA_BASE_URL and UID/GID were read straight from the host environment, so any same-named variable on the operator's shell leaked into the containers (UID is even a bash builtin, so it always leaked). Rename the host-side variables to MC_OBSERVABILITY_*/MC_DATA_MANAGER_* and map them onto the env keys the images actually read, which stay unchanged. MODE and DEFAULT_LANGUAGE were confirmed dead (no consumer) and are left for a separate cleanup. --- conf/docker/.env.setup | 13 +++++++++++++ conf/docker/docker-compose.yaml | 8 ++++---- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup index 66ae37a..b330ad4 100644 --- a/conf/docker/.env.setup +++ b/conf/docker/.env.setup @@ -272,6 +272,11 @@ MC_DATA_MANAGER_MYSQL_DATABASE=mcmp MC_DATA_MANAGER_MYSQL_USER=mcmp MC_DATA_MANAGER_MYSQL_PASSWORD=mcmp MC_DATA_MANAGER_MYSQL_ROOT_PASSWORD=mcmp +# Host uid/gid used to chown the data-manager volume at init. +# Named with the framework prefix so the shell's reserved UID variable +# can never leak into the compose interpolation by accident. +MC_DATA_MANAGER_UID=0 +MC_DATA_MANAGER_GID=0 # MC-OBSERVABILITY MC_OBSERVABILITY_MARIADB_ROOT_PASSWORD=qwe1212!Q @@ -289,6 +294,14 @@ MC_OBSERVABILITY_MCP_GRAFANA_PORT=8000 MC_OBSERVABILITY_MCP_MARIA_PORT=8001 MC_OBSERVABILITY_MCP_INFLUX_PORT=8002 +# Host-side names for values the observability images read under their own +# fixed env keys (GRAFANA_API_KEY / OPENAI_API_KEY / OLLAMA_BASE_URL). +# docker-compose.yaml maps these prefixed variables onto those keys so the +# generic names never collide with the host environment. +MC_OBSERVABILITY_GRAFANA_API_KEY= +MC_OBSERVABILITY_OPENAI_API_KEY= +MC_OBSERVABILITY_OLLAMA_BASE_URL=http://210.207.104.224:11434 + # MC-WEB-CONSOLE MC_WEB_CONSOLE_POSTGRES_DB=mcwebconsoledbdev MC_WEB_CONSOLE_POSTGRES_USER=mcwebadmin diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index bc6680f..8b46ac8 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -1010,7 +1010,7 @@ services: mc-data-manager-init-volumes: image: busybox:stable container_name: mc-data-manager-init-volumes - command: ["sh", "-c", "chown -R ${UID:-0}:${GID:-0} /app/data"] + command: ["sh", "-c", "chown -R ${MC_DATA_MANAGER_UID:-0}:${MC_DATA_MANAGER_GID:-0} /app/data"] volumes: - ./conf/mc-data-manager/data:/app/data/ user: root @@ -1618,7 +1618,7 @@ services: protocol: tcp environment: - TZ=Asia/Seoul - - OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://210.207.104.224:11434} + - OLLAMA_BASE_URL=${MC_OBSERVABILITY_OLLAMA_BASE_URL:-http://210.207.104.224:11434} volumes: - shared_logs:/mc-insight/log:rw depends_on: @@ -1703,7 +1703,7 @@ services: condition: service_healthy environment: - GRAFANA_URL=http://mc-observability-grafana:3000 - - GRAFANA_API_KEY=${GRAFANA_API_KEY:-} + - GRAFANA_API_KEY=${MC_OBSERVABILITY_GRAFANA_API_KEY:-} entrypoint: ["/bin/bash", "/app/docker-entrypoint.sh"] command: ["/bin/bash", "-c", "chmod +x /app/docker-entrypoint.sh"] volumes: @@ -1734,7 +1734,7 @@ services: - DB_NAME=mc_observability - MCP_READ_ONLY=true - MCP_MAX_POOL_SIZE=10 - - OPENAI_API_KEY=${OPENAI_API_KEY:-} + - OPENAI_API_KEY=${MC_OBSERVABILITY_OPENAI_API_KEY:-} mc-observability-mcp-influx: image: cloudbaristaorg/mc-observability-mcp-influxdb:0.6.0 From 522adbb7d1a2e4fadcef9ed6a122899079f76ca0 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Mon, 10 Aug 2026 17:06:23 +0900 Subject: [PATCH 02/22] fix(cli): pass verbose Printf arguments instead of concatenating into format string fmt.Printf was called with the value concatenated onto the format string, so the %s verb was never filled and any % in the data was misinterpreted. This also failed go vet (non-constant format string), blocking the feature gate for every change in the repository. --- src/cmd/apicall/root.go | 4 ++-- src/cmd/rest/root.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cmd/apicall/root.go b/src/cmd/apicall/root.go index 47b60cd..02458ab 100644 --- a/src/cmd/apicall/root.go +++ b/src/cmd/apicall/root.go @@ -348,7 +348,7 @@ func SetAuth() { func SetReqData() error { if inputFileData != "" { if isVerbose { - fmt.Printf("use [%s] data file\n" + inputFileData) + fmt.Printf("use [%s] data file\n", inputFileData) } // 파일에서 데이터 읽기 @@ -359,7 +359,7 @@ func SetReqData() error { req.SetBody(data) } else { if isVerbose { - fmt.Printf("request data : %s\n" + sendData) + fmt.Printf("request data : %s\n", sendData) } req.SetBody(sendData) } diff --git a/src/cmd/rest/root.go b/src/cmd/rest/root.go index be679ce..a8f79c3 100644 --- a/src/cmd/rest/root.go +++ b/src/cmd/rest/root.go @@ -116,7 +116,7 @@ func SetHeaders() { func SetReqData() error { if inputFileData != "" { if isVerbose { - fmt.Printf("use [%s] data file\n" + inputFileData) + fmt.Printf("use [%s] data file\n", inputFileData) } // 파일에서 데이터 읽기 @@ -127,7 +127,7 @@ func SetReqData() error { req.SetBody(data) } else { if isVerbose { - fmt.Printf("request data : %s\n" + sendData) + fmt.Printf("request data : %s\n", sendData) } req.SetBody(sendData) } From 1258e0ff3dfe489306ac356ca1b9f592af9af25a Mon Sep 17 00:00:00 2001 From: yh-noh Date: Mon, 10 Aug 2026 17:06:23 +0900 Subject: [PATCH 03/22] fix(setup): register mc-web-console-front service URL in post-init The latest console menu schema defaults framework_service to mc-web-console-front, so iframe menus resolve their host from the service URL registry under that name. The post-init script never registered it, leaving every iframe menu with 'service URL not found' on a fresh install. Register the internal URL and update it to the public front URL alongside the other -fe entries. The post-init container only loads conf/mc-iam-manager/.env, so the front port/public host are added to that env template (same convention as the other iframe proxy entries) with a script-side fallback. --- conf/docker/conf/mc-iam-manager/.env.setup | 2 ++ .../conf/mc-iam-manager/1_setup_auto.sh | 34 +++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/conf/docker/conf/mc-iam-manager/.env.setup b/conf/docker/conf/mc-iam-manager/.env.setup index a80df35..6ebd2ae 100644 --- a/conf/docker/conf/mc-iam-manager/.env.setup +++ b/conf/docker/conf/mc-iam-manager/.env.setup @@ -101,3 +101,5 @@ MC_APPLICATION_MANAGER_PROXY_PORT=18084 MC_APPLICATION_MANAGER_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_APPLICATION_MANAGER_PROXY_PORT} MC_OBSERVABILITY_FRONT_PROXY_PORT=18081 MC_OBSERVABILITY_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_OBSERVABILITY_FRONT_PROXY_PORT} +MC_WEB_CONSOLE_FRONT_PORT=3001 +MC_WEB_CONSOLE_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_WEB_CONSOLE_FRONT_PORT} diff --git a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh index ca207be..deb987b 100755 --- a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh +++ b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh @@ -695,6 +695,40 @@ update_public_service_urls() { return 1 fi + # mc-web-console-front: the console's own public URL. The menu schema defaults + # framework_service to this name (mcmp_menus), so iframe menus resolve their + # host through it and fail with "service URL not found" if it is missing. + local console_front_port="${MC_WEB_CONSOLE_FRONT_PORT:-3001}" + local console_front_public_url="${MC_WEB_CONSOLE_FRONT_PUBLIC_HOST:-${public_scheme}://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${console_front_port}}" + reg_body=$(printf '{"name":"mc-web-console-front","version":"v0.0.1","baseUrl":"http://mc-web-console-front:%s","authType":"none","authUser":"","authPass":"","isActive":true}' "${console_front_port}") + reg_resp=$(curl -s -w "HTTPSTATUS:%{http_code}" -X POST \ + --header "Authorization: Bearer $MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" \ + --header 'Content-Type: application/json' \ + --data "$reg_body" \ + "$MC_IAM_MANAGER_HOST/api/mcmp-apis") + reg_code=$(echo $reg_resp | tr -d '\n' | sed -e 's/.*HTTPSTATUS://') + if [ "$reg_code" = "201" ]; then + echo " ✓ mc-web-console-front registered" + elif [ "$reg_code" = "409" ]; then + echo " ✓ mc-web-console-front already registered" + else + echo " ✗ Failed to register mc-web-console-front (HTTP $reg_code)" + return 1 + fi + response=$(curl -s -w "HTTPSTATUS:%{http_code}" -X PUT \ + --header "Authorization: Bearer $MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" \ + --header 'Content-Type: application/json' \ + --data "{\"base_url\": \"${console_front_public_url}\"}" \ + "$MC_IAM_MANAGER_HOST/api/mcmp-apis/name/mc-web-console-front") + http_code=$(echo $response | tr -d '\n' | sed -e 's/.*HTTPSTATUS://') + response_body=$(echo $response | sed -e 's/HTTPSTATUS\:.*//g') + if [ "$http_code" = "200" ]; then + echo " ✓ Updated mc-web-console-front baseurl: ${console_front_public_url}" + else + echo " ✗ Failed to update mc-web-console-front (HTTP $http_code): $response_body" + return 1 + fi + echo "Public service URL update completed" return 0 } From e9d4986cad16f6499c0d02c83aaf976e310a4ef4 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 26 Aug 2026 05:13:05 +0000 Subject: [PATCH 04/22] chore: remove dead selfiammenu.yaml copy from mc-web-console conf --- .../mc-web-console/api/conf/selfiammenu.yaml | 30 ------------------- 1 file changed, 30 deletions(-) delete mode 100644 conf/docker/conf/mc-web-console/api/conf/selfiammenu.yaml diff --git a/conf/docker/conf/mc-web-console/api/conf/selfiammenu.yaml b/conf/docker/conf/mc-web-console/api/conf/selfiammenu.yaml deleted file mode 100644 index 642ee39..0000000 --- a/conf/docker/conf/mc-web-console/api/conf/selfiammenu.yaml +++ /dev/null @@ -1,30 +0,0 @@ -menus: - - id: depth1 - parentmenuid: "" - displayname: depth1 - isaction: "false" - priority: "0" - - - id: depth2 - parentmenuid: depth1 - displayname: depth2 - isaction: "false" - priority: "0" - - - id: depth3 - parentmenuid: depth2 - displayname: depth3 - isaction: "false" - priority: "0" - - - id: menu1 - parentmenuid: depth3 - displayname: menu1 - isaction: "true" - priority: "0" - - - id: menu2 - parentmenuid: depth3 - displayname: menu2 - isaction: "true" - priority: "1" \ No newline at end of file From 35fe875c577530afbcef2774f244130d3fd0eef8 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 26 Aug 2026 06:20:17 +0000 Subject: [PATCH 05/22] fix: drop redundant client-side menu permission seeding step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mc-iam-manager가 이제 메뉴 등록(POST /api/setup/initial-menus) 내부에서 역할-메뉴 권한 시딩까지 서버 측에서 체이닝하므로, 설치 스크립트가 별도로 initial-role-menu-permission-yaml을 호출할 필요가 없어졌다. 1_setup_auto.sh의 auto_setup()에서 Step 4-1(init_menu_permissions 호출)을 제거해 설치 흐름을 11단계로 축소했다. init_menu_permissions() 함수 자체는 수동 재시딩용으로 유지한다. 1_setup_manual.sh의 옵션 4)도 init_menu 단독 호출로 축소했다. 독립 옵션 4a)(권한만 재시딩)는 escape hatch로 그대로 유지한다. README.md/README_kr.md의 설치 스텝 수 안내("8-step"/"8단계")가 이미 실제 스텝 수와 어긋나 있던 기존 드리프트를 11로 맞춰 함께 정정했다 (이번 변경으로 인한 회귀가 아니라 기존 문서 드리프트 수정). --- README.md | 4 ++-- README_kr.md | 4 ++-- conf/docker/conf/mc-iam-manager/1_setup_auto.sh | 15 +++++---------- conf/docker/conf/mc-iam-manager/1_setup_manual.sh | 11 +++++++---- 4 files changed, 16 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index c09b960..9861361 100644 --- a/README.md +++ b/README.md @@ -196,7 +196,7 @@ curl -k https:///auth/realms/mciam/.well-known/openid-configuration | gr ``` Expected: `"issuer": "https:///auth/realms/mciam"` — must start with `https://` and include `/auth/`. -**(d) mc-iam-manager-post-initial 8-step setup:** +**(d) mc-iam-manager-post-initial 11-step setup:** ```shell docker logs mc-iam-manager-post-initial | tail -5 ``` @@ -449,7 +449,7 @@ cd bin && ./mcc infra info docker rm mc-iam-manager-post-initial 2>/dev/null ./mcc infra run -s mc-iam-manager-post-initial docker logs -f mc-iam-manager-post-initial -# Each of the 8 setup steps should finish with ✓ +# Each of the 11 setup steps should finish with ✓ # 3. Verify curl -s http://localhost:5000/readyz | jq . diff --git a/README_kr.md b/README_kr.md index 7a18173..d3a1515 100644 --- a/README_kr.md +++ b/README_kr.md @@ -177,7 +177,7 @@ curl -k https:///auth/realms/mciam/.well-known/openid-configuration | gr ``` 기대 응답: `"issuer": "https:///auth/realms/mciam"` — 반드시 `https://`로 시작하고 `/auth/`가 포함되어야 합니다. -**(d) mc-iam-manager-post-initial 8단계 설정 완료 확인:** +**(d) mc-iam-manager-post-initial 11단계 설정 완료 확인:** ```shell docker logs mc-iam-manager-post-initial | tail -5 ``` @@ -425,7 +425,7 @@ cd bin && ./mcc infra info docker rm mc-iam-manager-post-initial 2>/dev/null ./mcc infra run -s mc-iam-manager-post-initial docker logs -f mc-iam-manager-post-initial -# 8단계 각각이 ✓ 로 완료되어야 합니다 +# 11단계 각각이 ✓ 로 완료되어야 합니다 # 3. 헬스 상태 확인 curl -s http://localhost:5000/readyz | jq . diff --git a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh index deb987b..151d62f 100755 --- a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh +++ b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh @@ -43,15 +43,6 @@ auto_setup() { fi echo "✓ Menu data initialized successfully" - # 4-1. Role-menu permissions from YAML (after menus; fail-fast if IAM lacks YAML API) - echo "Step 4-1: Initializing role-menu permissions from YAML..." - init_menu_permissions - if [ $? -ne 0 ]; then - echo "ERROR: Role-menu permission (YAML) initialization failed" - return 1 - fi - echo "✓ Role-menu permissions initialized successfully" - # 5. API resource data initialization echo "Step 5: Initializing API resources..." init_api_resources @@ -288,6 +279,8 @@ init_predefined_roles() { return 0 } +# IAM now chains role-menu permission seeding onto POST /api/setup/initial-menus +# server-side, so auto_setup no longer calls init_menu_permissions separately. init_menu() { echo "Initializing menu data..." wget -q -O ./menu.yaml "$MC_WEB_CONSOLE_MENUYAML" @@ -321,7 +314,9 @@ init_menu() { return 0 } -# Seed role-menu mappings via YAML API. +# Manual re-seed only — auto_setup no longer calls this (init_menu chains it +# server-side). Use this to re-seed role-menu permissions without re-running +# the whole menu setup. # Always call without filePath: IAM resolvePermissionSeedPath uses # MC_WEB_CONSOLE_MENU_PERMISSIONS (if set and .yaml/.yml) or mounted # /app/asset/menu/permission.yaml. Do not pass post-init ./permission.yaml diff --git a/conf/docker/conf/mc-iam-manager/1_setup_manual.sh b/conf/docker/conf/mc-iam-manager/1_setup_manual.sh index 7bc2217..74a2f0b 100755 --- a/conf/docker/conf/mc-iam-manager/1_setup_manual.sh +++ b/conf/docker/conf/mc-iam-manager/1_setup_manual.sh @@ -81,6 +81,8 @@ init_predefined_roles() { echo "Platform roles initialized" } +# IAM now chains role-menu permission seeding onto POST /api/setup/initial-menus +# server-side, so option 4) below no longer calls init_menu_permissions separately. init_menu() { echo "Initializing menu data..." wget -q -O ./menu.yaml "$MC_WEB_CONSOLE_MENUYAML" @@ -92,8 +94,10 @@ init_menu() { echo "Menu data initialized" } -# Seed role-menu mappings via YAML API (no filePath — IAM uses -# MC_WEB_CONSOLE_MENU_PERMISSIONS or mounted asset/menu/permission.yaml). +# Manual re-seed only (option 4a below) — option 4) no longer calls this +# (init_menu chains it server-side). Seed role-menu mappings via YAML API +# (no filePath — IAM uses MC_WEB_CONSOLE_MENU_PERMISSIONS or mounted +# asset/menu/permission.yaml). init_menu_permissions() { echo "Initializing role-menu permissions from YAML..." @@ -260,7 +264,7 @@ while true; do echo "1. Init Platform And PlatformAdmin" echo "2. PlatformAdmin Login" echo "3. Init Role Data" - echo "4. Init Menu Data (+ role-menu YAML permissions)" + echo "4. Init Menu Data (role-menu YAML permissions chained server-side)" echo "4a. Init Menu Role Permissions (YAML) (re-seed only)" echo "5. Init API Resource Data" echo "6. Init Cloud Resource Data" @@ -297,7 +301,6 @@ while true; do echo "Current token value: '$MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN'" else init_menu - init_menu_permissions fi ;; 4a) From 74a35f564c74015a4cdfd788b0e99e535b253646 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 26 Aug 2026 06:44:07 +0000 Subject: [PATCH 06/22] feat: add local menu resource yaml for self mode (USE_IAM=false) --- .../api/conf/webconsole_menu_resources.yaml | 472 ++++++++++++++++++ 1 file changed, 472 insertions(+) create mode 100644 conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml diff --git a/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml b/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml new file mode 100644 index 0000000..7928f1e --- /dev/null +++ b/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml @@ -0,0 +1,472 @@ +menus: + + - id: settings + parentid: home + displayname: Settings + restype: menu + isaction: false + priority: 4 + menunumber: 1200 + + - id: accountnaccess + parentid: settings + displayname: Account & Access + restype: menu + isaction: false + priority: 2 + menunumber: 1201 + + - id: organizations + parentid: accountnaccess + displayname: Organizations + restype: menu + isaction: false + priority: 2 + menunumber: 1205 + + - id: companyinfo + parentid: organizations + displayname: Company Info + restype: menu + isaction: false + priority: 2 + menunumber: 1212 + + - id: users + parentid: organizations + displayname: Users + restype: menu + isaction: true + priority: 2 + menunumber: 1220 + + - id: groups + parentid: organizations + displayname: Groups + restype: menu + isaction: true + priority: 2 + menunumber: 1225 + + - id: approvals + parentid: organizations + displayname: Approvals + restype: menu + isaction: true + priority: 2 + menunumber: 1230 + + - id: accesscontrols + parentid: organizations + displayname: Access Controls + restype: menu + isaction: false + priority: 2 + menunumber: 1240 + + - id: menus + parentid: organizations + displayname: Menus + restype: menu + isaction: true + priority: 2 + menunumber: 1250 + + - id: environment + parentid: settings + displayname: Environment + restype: menu + isaction: false + priority: 2 + menunumber: 1301 + + - id: cloudsps + parentid: environment + displayname: Cloud SPs + restype: menu + isaction: false + priority: 2 + menunumber: 1305 + + - id: cloudoverview + parentid: cloudsps + displayname: Cloud Overview + restype: menu + isaction: true + priority: 2 + menunumber: 1310 + + - id: credentials + parentid: cloudsps + displayname: Credentials + restype: menu + isaction: true + priority: 2 + menunumber: 1320 + + - id: connections + parentid: cloudsps + displayname: Connections + restype: menu + isaction: true + priority: 2 + menunumber: 1330 + + - id: cspaccounts + parentid: cloudsps + displayname: CSP Accounts + restype: menu + isaction: false + priority: 2 + menunumber: 1360 + + - id: cloudresources + parentid: environment + displayname: Cloud Resources + restype: menu + isaction: false + priority: 2 + menunumber: 1405 + + - id: serverspecs + parentid: cloudresources + displayname: Specs + restype: menu + isaction: true + priority: 2 + menunumber: 1410 + + - id: serverimages + parentid: cloudresources + displayname: Images + restype: menu + isaction: true + priority: 2 + menunumber: 1420 + + - id: networks + parentid: cloudresources + displayname: Networks + restype: menu + isaction: true + priority: 2 + menunumber: 1510 + + - id: securitygroups + parentid: cloudresources + displayname: Security Groups + restype: menu + isaction: true + priority: 2 + menunumber: 1520 + + - id: myimages + parentid: cloudresources + displayname: MyImages + restype: menu + isaction: true + priority: 2 + menunumber: 1530 + + - id: disks + parentid: cloudresources + displayname: Disks + restype: menu + isaction: true + priority: 2 + menunumber: 1540 + + - id: sshkeys + parentid: cloudresources + displayname: SSH Keys + restype: menu + isaction: true + priority: 2 + menunumber: 1550 + + - id: nlbs + parentid: cloudresources + displayname: NLB + restype: menu + isaction: true + priority: 2 + menunumber: 1555 + + - id: resourcesync + parentid: cloudresources + displayname: Resource Sync + restype: menu + isaction: true + priority: 3 + menunumber: 1595 + + - id: cloudrescatalogs + parentid: environment + displayname: Cloud Res Catalogs + restype: menu + isaction: false + priority: 2 + menunumber: 1560 + + - id: workspacessettings + parentid: environment + displayname: Workspaces Settings + restype: menu + isaction: false + priority: 2 + menunumber: 1660 + + - id: allocatedprojects + parentid: workspacessettings + displayname: Allocated Projects + restype: menu + isaction: false + priority: 2 + menunumber: 1665 + + - id: sharemembers + parentid: workspacessettings + displayname: Share Members + restype: menu + isaction: false + priority: 2 + menunumber: 1666 + + - id: allocaterolesws + parentid: workspacessettings + displayname: Access Controls + restype: menu + isaction: false + priority: 2 + menunumber: 1667 + + - id: operations + parentid: home + displayname: Operations + restype: menu + isaction: false + priority: 2 + menunumber: 1700 + + - id: manage + parentid: operations + displayname: Manage + restype: menu + isaction: false + priority: 2 + menunumber: 1701 + + - id: workspaces + parentid: manage + displayname: Workspaces + restype: menu + isaction: true + priority: 2 + menunumber: 1710 + + - id: projects + parentid: workspaces + displayname: Projects + restype: menu + isaction: false + priority: 2 + menunumber: 1720 + + - id: members + parentid: workspaces + displayname: Members + restype: menu + isaction: false + priority: 2 + menunumber: 1730 + + - id: roles + parentid: workspaces + displayname: Roles + restype: menu + isaction: true + priority: 2 + menunumber: 1740 + + - id: csproles + parentid: workspaces + displayname: CSP Roles + restype: menu + isaction: true + priority: 2 + menunumber: 1741 + + - id: projectboard + parentid: workspaces + displayname: Project board + restype: menu + isaction: false + priority: 2 + menunumber: 1728 + + - id: workloads + parentid: manage + displayname: Workloads + restype: menu + isaction: false + priority: 2 + menunumber: 1750 + + - id: mciworkloads + parentid: workloads + displayname: Infra Workloads + restype: menu + isaction: true + priority: 2 + menunumber: 1760 + + - id: pmkworkloads + parentid: workloads + displayname: K8s Workloads + restype: menu + isaction: true + priority: 2 + menunumber: 1790 + + - id: workflows + parentid: manage + displayname: Workflows + restype: menu + isaction: true + priority: 2 + menunumber: 1998 + viewtype: iframe + frameworkservice: mc-workflow-manager-fe + path: /web/workflow/list + + - id: swcatalogs + parentid: manage + displayname: SW Catalogs + restype: menu + isaction: true + priority: 2 + menunumber: 1998 + viewtype: iframe + frameworkservice: mc-application-manager-fe + path: /web/softwareCatalog + + - id: datamigrations + parentid: manage + displayname: Data Migrations + restype: menu + isaction: true + priority: 2 + menunumber: 1998 + viewtype: iframe + frameworkservice: mc-data-manager-fe + path: / + + - id: analytics + parentid: operations + displayname: Analytics + restype: menu + isaction: false + priority: 3 + menunumber: 1901 + + # - id: monitorings + # parentid: analytics + # displayname: Monitorings + # restype: menu + # isaction: false + # priority: 2 + # menunumber: 1905 + + # - id: mcismonitoring + # parentid: monitorings + # displayname: MCIs Monitoring + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1910 + + # - id: 3rdpartymonitoring + # parentid: monitorings + # displayname: 3rd party Monitoring + # restype: menu + # isaction: false + # priority: 2 + # menunumber: 1930 + + # - id: monitoringconfig + # parentid: monitorings + # displayname: Monitoring Config + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1940 + + # - id: eventsntraces + # parentid: analytics + # displayname: Events & Traces + # restype: menu + # isaction: false + # priority: 2 + # menunumber: 1950 + + # - id: alarmshistory + # parentid: eventsntraces + # displayname: Alarms History + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1960 + + # - id: thresholdconfig + # parentid: eventsntraces + # displayname: Threshold Config + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1970 + + # - id: logmanage + # parentid: eventsntraces + # displayname: Log Manage + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1980 + + # - id: logconfig + # parentid: eventsntraces + # displayname: Log Config + # restype: menu + # isaction: true + # priority: 2 + # menunumber: 1990 + + # - id: eventtrace + # parentid: eventsntraces + # displayname: Event Trace + # restype: menu + # isaction: false + # priority: 2 + # menunumber: 1996 + + - id: costanalysis + parentid: analytics + displayname: Cost Analysis + restype: menu + isaction: true + priority: 2 + menunumber: 1998 + viewtype: iframe + frameworkservice: mc-cost-optimizer-fe + path: / + + - id: observability + parentid: analytics + displayname: Monitorings + restype: menu + isaction: true + priority: 3 + menunumber: 1999 + viewtype: iframe + frameworkservice: mc-observability-fe + path: / From f8eb16716e327b9db89684bcc54e3b647e4f7302 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Mon, 31 Aug 2026 04:26:17 +0000 Subject: [PATCH 07/22] fix: pass spider auth credentials to mc-infra-manager MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mc-infra-manager(tumblebug)가 mc-infra-connector(spider)를 호출할 때 TB_SPIDER_USERNAME/TB_SPIDER_PASSWORD가 설정되지 않아 spider REST API 호출이 401로 실패하던 문제. mc-infra-connector에 이미 쓰이고 있는 MC_INFRA_CONNECTOR_API_USERNAME/PASSWORD를 그대로 재사용해 매핑을 추가. --- conf/docker/docker-compose.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index 523e9ef..1390da4 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -88,6 +88,8 @@ services: environment: # - TB_ROOT_PATH=/app - TB_SPIDER_REST_URL=${MC_INFRA_CONNECTOR_REST_URL:-http://mc-infra-connector:1024/spider} + - TB_SPIDER_USERNAME=${MC_INFRA_CONNECTOR_API_USERNAME:-default} + - TB_SPIDER_PASSWORD=${MC_INFRA_CONNECTOR_API_PASSWORD:-default} - TB_ETCD_ENDPOINTS=http://mc-infra-manager-etcd:2379 - TB_TERRARIUM_REST_URL=http://mc-terrarium:8055/terrarium - TB_TERRARIUM_API_USERNAME=${MC_INFRA_MANAGER_TERRARIUM_API_USERNAME:-} From d0d9239e9e01fc79c4c4c4fbd5d3ca53bd54aa67 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Tue, 1 Sep 2026 07:17:21 +0000 Subject: [PATCH 08/22] fix: sync mc-infra-manager/mc-infra-connector api.yaml version stamps to 0.13.2 and drop dead K8s remote-cmd/file-transfer operations ADMINCLI-TECH-013 --- conf/api.yaml | 24 ++----------------- conf/docker/api.yaml | 24 ++----------------- .../conf/mc-web-console/api/conf/api.yaml | 8 ++----- 3 files changed, 6 insertions(+), 50 deletions(-) diff --git a/conf/api.yaml b/conf/api.yaml index 1ad9c32..67f1692 100644 --- a/conf/api.yaml +++ b/conf/api.yaml @@ -3,7 +3,7 @@ services: mc-infra-connector: - version: 0.12.18 + version: 0.13.2 baseurl: http://mc-infra-connector:1024/spider auth: type: basic @@ -17,7 +17,7 @@ services: type: bearer mc-infra-manager: - version: 0.12.9 + version: 0.13.2 baseurl: http://mc-infra-manager:1323/tumblebug auth: type: basic @@ -2831,16 +2831,6 @@ serviceActions: method: post resourcePath: /ns/{nsId}/buildAgnosticImage description: Creates an MCI infrastructure, executes post-deployment commands, creates snapshots from each subgroup, and optionally cleans up the MCI. This is a complete workflow for building CSP-agnostic custom images. - PostCmdK8sCluster: - method: post - resourcePath: /ns/{nsId}/cmd/k8sCluster/{k8sClusterId} - description: 'Send a command to specified Container in K8sCluster - - [note] This feature is not intended for general use - - This API is provided as an exceptional and limited function for specific purposes such as migration. - - Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.' PostCmdInfra: method: post @@ -2867,16 +2857,6 @@ serviceActions: description: 'Download a file from a specific VM in MCI via SCP through bastion host. The file size should be less than 200MB.' - PostFileToK8sCluster: - method: post - resourcePath: /ns/{nsId}/transferFile/k8sCluster/{k8sClusterId} - description: 'Transfer a file to specified Container in K8sCluster. The tar command is required in the container. - - [note] This feature is not intended for general use - - This API is provided as an exceptional and limited function for specific purposes such as migration. - - Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.' PostFileToInfra: method: post diff --git a/conf/docker/api.yaml b/conf/docker/api.yaml index 1ad9c32..67f1692 100644 --- a/conf/docker/api.yaml +++ b/conf/docker/api.yaml @@ -3,7 +3,7 @@ services: mc-infra-connector: - version: 0.12.18 + version: 0.13.2 baseurl: http://mc-infra-connector:1024/spider auth: type: basic @@ -17,7 +17,7 @@ services: type: bearer mc-infra-manager: - version: 0.12.9 + version: 0.13.2 baseurl: http://mc-infra-manager:1323/tumblebug auth: type: basic @@ -2831,16 +2831,6 @@ serviceActions: method: post resourcePath: /ns/{nsId}/buildAgnosticImage description: Creates an MCI infrastructure, executes post-deployment commands, creates snapshots from each subgroup, and optionally cleans up the MCI. This is a complete workflow for building CSP-agnostic custom images. - PostCmdK8sCluster: - method: post - resourcePath: /ns/{nsId}/cmd/k8sCluster/{k8sClusterId} - description: 'Send a command to specified Container in K8sCluster - - [note] This feature is not intended for general use - - This API is provided as an exceptional and limited function for specific purposes such as migration. - - Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.' PostCmdInfra: method: post @@ -2867,16 +2857,6 @@ serviceActions: description: 'Download a file from a specific VM in MCI via SCP through bastion host. The file size should be less than 200MB.' - PostFileToK8sCluster: - method: post - resourcePath: /ns/{nsId}/transferFile/k8sCluster/{k8sClusterId} - description: 'Transfer a file to specified Container in K8sCluster. The tar command is required in the container. - - [note] This feature is not intended for general use - - This API is provided as an exceptional and limited function for specific purposes such as migration. - - Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.' PostFileToInfra: method: post diff --git a/conf/docker/conf/mc-web-console/api/conf/api.yaml b/conf/docker/conf/mc-web-console/api/conf/api.yaml index 942b4de..21d088c 100644 --- a/conf/docker/conf/mc-web-console/api/conf/api.yaml +++ b/conf/docker/conf/mc-web-console/api/conf/api.yaml @@ -3,7 +3,7 @@ services: mc-infra-connector: - version: 0.12.14 + version: 0.13.2 baseurl: http://mc-infra-connector:1024/spider auth: type: basic @@ -17,7 +17,7 @@ services: type: bearer mc-infra-manager: - version: 0.12.6 + version: 0.13.2 baseurl: http://mc-infra-manager:1323/tumblebug auth: type: basic @@ -1982,10 +1982,6 @@ serviceActions: method: post resourcePath: /ns/{nsId}/sharedResource description: "Create shared resources for MC-Infra" - Postclusterremotecmd: - method: post - resourcePath: /ns/{nsId}/cmd/k8sCluster/{k8sClusterId} - description: "Send a command to specified Cluster" Postmcidynamicreview: method: post resourcePath: /ns/{nsId}/mciDynamicReview From b006ad6027f6b3b27bd1565ea4dc783374a2d095 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 2 Sep 2026 15:10:41 +0900 Subject: [PATCH 09/22] =?UTF-8?q?docs:=20running-on-instance.md=20?= =?UTF-8?q?=ED=98=84=ED=96=89=ED=99=94=20+=20README=20=EB=A7=81=ED=81=AC?= =?UTF-8?q?=20=EC=98=A4=EB=A5=98=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - docs/running-on-instance.md 전면 재작성: 이미 삭제된 mc-iam-manager 개별 init 스크립트(initauto.sh/add_demo_user.sh) 흐름을 현재 installAll.sh 흐름(clone → .env.setup 복사 → installAll.sh → mcc infra info)으로 교체, 옛 파일명/env변수 표기/포트(5005)/버전 핀/기본 계정 정정 - README.md:20 안내 링크 수정 (mc-admin-cli-infra.md → running-on-instance.md, 잘못된 문서를 가리키고 있었음) WIP: README.md Step 5 (d) "11-step setup" 항목에 메뉴 카탈로그 등록· role-menu 권한 시딩이 포함된다는 설명 보강은 아직 미완료 --- README.md | 2 +- docs/running-on-instance.md | 123 +++++++++--------------------------- 2 files changed, 31 insertions(+), 94 deletions(-) diff --git a/README.md b/README.md index 9861361..f3a26c4 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ If you have any difficulties in using mcc, please let us know. - Management tool that supports the installation, execution, status information provision, termination, and API calls of the M-CMP system. - Currently, infra subcommand is only support docker compose base infra install and management. - [infra subcommand](./docs/mc-admin-cli-infra.md) -- If you want to checkout how to run the whole subsystem on the single instance on CSP Instance, see [this document](./docs/mc-admin-cli-infra.md). +- If you want to checkout how to run the whole subsystem on the single instance on CSP Instance, see [this document](./docs/running-on-instance.md). ## Development & Test Environment - Go 1.25.0 (minimum required version) diff --git a/docs/running-on-instance.md b/docs/running-on-instance.md index 3b2bd45..88ff8e9 100644 --- a/docs/running-on-instance.md +++ b/docs/running-on-instance.md @@ -8,7 +8,7 @@ This guide covers the necessary preparations for deploying the MCMP platform on ## ✅ Prerequisites -Ensure you have **sudo** privileges and access to the **VM instance** where you intend to set up the MCMP platform. The guide covers installing Docker, setting up necessary directories, cloning repositories, and initializing credentials and IAM (Identity and Access Management). +Ensure you have **sudo** privileges and access to the **VM instance** where you intend to set up the MCMP platform. The guide covers installing Docker, cloning `mc-admin-cli`, and running `installAll.sh` — the unified installer for the whole platform (mc-infra-manager/cb-tumblebug, mc-iam-manager, mc-web-console, and the rest of the microservices). To enable full functionality, open your firewall or security group to allow all traffic. @@ -37,7 +37,7 @@ To run the entire platform on a single instance using mc-admin-cli, the followin The following instructions **should be executed on the provisioned VM.** -> If the key pair is correctly stored on your local host, you can connect to the instance via SSH. Otherwise, you may use the web terminal provided by AWS or other cloud consoles to establish an SSH connection and access the instance’s terminal before proceeding with the next steps. +> If the key pair is correctly stored on your local host, you can connect to the instance via SSH. Otherwise, you may use the web terminal provided by AWS or other cloud consoles to establish an SSH connection and access the instance's terminal before proceeding with the next steps. ```bash ssh -i @ @@ -67,132 +67,69 @@ docker ps # Verifies Docker installation by listing running containers
-## Step 2: Create Required Directories and Credentials File - -Set up a working directory and initialize the necessary credentials configuration: +## Step 2: Create a Working Directory ```bash mkdir -p ~/workspace -mkdir -p ~/.cloud-barista +cd ~/workspace ```
-## Step 3: Clone Required Git Repositories - -Navigate to the workspace directory and clone the necessary repositories: +## Step 3: Clone mc-admin-cli -```bash -cd ~/workspace -git clone --branch v0.10.0 https://github.com/cloud-barista/cb-tumblebug.git -git clone --branch v0.3.2 https://github.com/m-cmp/mc-admin-cli.git -git clone --branch v0.3.0 https://github.com/m-cmp/mc-iam-manager.git -``` +`mc-admin-cli` is the **unified installer** for the whole MCMP platform — you do not clone `mc-iam-manager` or `cb-tumblebug` separately. `installAll.sh` brings every subsystem up as containers via its bundled `docker-compose.yaml`. -## Step 4: Run mc-admin-cli - -Execute `mc-admin-cli` to initialize the MCMP infrastructure: +For stable deployment, clone a specific [released version](https://github.com/m-cmp/mc-admin-cli/releases): ```bash -cd ~/workspace/mc-admin-cli/bin -./mcc infra run -d +git clone https://github.com/m-cmp/mc-admin-cli.git -b v0.5.0 +cd mc-admin-cli/bin +./mcc --version # optional: confirm the pre-built binary runs on this OS ``` -Wait for Services to Initialize -Allow some time for all services to start and reach a healthy state. You may verify health checks for each service if required. -**It will take approximately 5 mins.** - -> ❗Following Two steps (step 5 and 6) is crutial steps for using MCMP normally. - -## ❗ Step 5: Initialize Credentials ⭐ - -If you're setting up a new instance of Tumblebug, follow these initialization steps (otherwise, skip this section if you already have Tumblebug set up). +If `./mcc --version` fails with a `GLIBC` version error (e.g. on Ubuntu 20.04), rebuild from source as a static binary — see the main [README's "Build a Static Binary" section](https://github.com/m-cmp/mc-admin-cli#build-a-static-binary). -For more information, refer to the [Tumblebug initialization guide.](https://github.com/cloud-barista/cb-tumblebug?tab=readme-ov-file#3-initialize-cb-tumblebug-to-configure-multi-cloud-info) - -## ❗ Step 6: Initialize MC-IAM-MANAGER ⭐ - -Install jq, a lightweight JSON processor, and set up IAM configurations: +## Step 4: Configure Environment ```bash -sudo apt-get install -y jq +cd ~/workspace/mc-admin-cli/conf/docker/conf/mc-iam-manager +cp .env.setup .env +# Edit .env — set the platform admin ID/password and any other REQUIRE-marked values ``` -### Configure MC-IAM-MANAGER Environment Variables - -Edit .env to configure IAM service properties: +## Step 5: Run installAll.sh ```bash -cd ~/workspace/mc-iam-manager/scripts/init -cp .env.initsample .env -sed -i 's|MCIAMMANAGER_HOST=https://MCIAMMANAGER_HOST|MCIAMMANAGER_HOST=http://127.0.0.1:5005|' .env -sed -i 's|MCIAMMANAGER_PLATFORMADMIN_ID=|MCIAMMANAGER_PLATFORMADMIN_ID=mcmpadmin|' .env -sed -i 's|MCIAMMANAGER_PLATFORMADMIN_PASSWORD=|MCIAMMANAGER_PLATFORMADMIN_PASSWORD=mcmpAdminPassword#@!|' .env +cd ~/workspace/mc-admin-cli/bin +./installAll.sh ``` -### Finalize MC-IAM-MANAGER Initialization +`installAll.sh` prompts interactively for deployment mode and domain (see the main [README's Quick Guide](https://github.com/m-cmp/mc-admin-cli#quick-guide) for the Mode A/Mode B distinction and non-interactive flags), generates TLS certs and nginx config, then starts every container — including `mc-iam-manager-post-initial`, a one-shot setup container that seeds Keycloak realms/roles, registers the platform's menu catalog (mc-web-console's `conf/webconsole_menu_resources.yaml`, fetched via `MC_WEB_CONSOLE_MENUYAML`), and seeds role-menu permissions (mc-iam-manager's `asset/menu/permission.yaml`). This container exiting with code `0` is expected, not a failure. + +Allow a few minutes for every container to reach a healthy state. -Execute the IAM auto-initialization script: +## Step 6: Verify Startup ```bash -./initauto.sh -f - - -# Login successful. -# Role created successfully: admin -# First Role ID saved as ROLE_ID: d291b29a-2d36-41e7-b50d-cac7df88dde3 -# Role created successfully: operator -# Role created successfully: viewer -# Role created successfully: billadmin -# Role created successfully: billviewer -# Downloaded mcwebconsoleMenu.yaml successfully. -# Uploaded mcwebconsoleMenu.yaml successfully. -# Downloaded permission.csv successfully. -# Uploaded permission.csv successfully. -# {"id":"95d97e4e-5882-4782-b6ce-d17bf949a43f","name":"workspace1","description":"workspace1 desc","created_at":"2024-10-31T07:27:36.533011Z","updated_at":"2024-10-31T07:27:36.533011Z"} 200 -# Workspace created successfully. ID: 95d97e4e-5882-4782-b6ce-d17bf949a43f -# {"id":"ed17c0a7-2317-40c3-b4f1-6b7f224fc681","ns_id":"project1","name":"project1","description":"project1 desc","created_at":"2024-10-31T07:27:36.572527Z","updated_at":"2024-10-31T07:27:36.572527Z"} 200 -# Project created successfully. ID: ed17c0a7-2317-40c3-b4f1-6b7f224fc681 -# {"workspace":{"id":"95d97e4e-5882-4782-b6ce-d17bf949a43f","name":"workspace1","description":"workspace1 desc","created_at":"2024-10-31T07:27:36.533011Z","updated_at":"2024-10-31T07:27:36.533011Z"},"projects":[{"id":"ed17c0a7-2317-40c3-b4f1-6b7f224fc681","ns_id":"project1","name":"project1","description":"project1 desc","created_at":"2024-10-31T07:27:36.572527Z","updated_at":"2024-10-31T07:27:36.572527Z"}]} 200 -# Project Worksapce mapping created successfully. -# User role assigned to workspace successfully +cd ~/workspace/mc-admin-cli/bin +./mcc infra info ``` -### Add user for Console user +Confirm no container shows `unhealthy` (`mc-iam-manager-post-initial` showing `Exited (0)` is expected). See the main README's Step 5 "Verify Startup" for the full set of readyz/health checks, and its Troubleshooting section if `mc-iam-manager` stays unhealthy. -Execute the IAM auto-add-user script: - -```bash -./add_demo_user.sh -f - -# Login successful. -# {"id":"eric","password":"changeMe!","firstName":"Eric","lastName":"Schmidt","email":"eric@mcmpemail.com","description":"ericDesc"} {"id":"elon","password":"changeMe!","firstName":"Elon","lastName":"Musk","email":"elon@mcmpemail.com","description":"elonDesc"} {"id":"jeffrey","password":"changeMe!","firstName":"Jeffrey","lastName":"PrestonBezos","email":"jeffrey@mcmpemail.com","description":"jeffreyDesc"} {"id":"gates","password":"changeMe!","firstName":"Bill","lastName":"Gates","email":"gates@mcmpemail.com","description":"gatesDesc"} -# {"id":"eric","password":"changeMe!","firstName":"Eric","lastName":"Schmidt","email":"eric@mcmpemail.com","description":"ericDesc"} -# User created successfully: eric -# User activated successfully: eric -# {"id":"elon","password":"changeMe!","firstName":"Elon","lastName":"Musk","email":"elon@mcmpemail.com","description":"elonDesc"} -# User created successfully: elon -# User activated successfully: elon -# {"id":"jeffrey","password":"changeMe!","firstName":"Jeffrey","lastName":"PrestonBezos","email":"jeffrey@mcmpemail.com","description":"jeffreyDesc"} -# User created successfully: jeffrey -# User activated successfully: jeffrey -# {"id":"gates","password":"changeMe!","firstName":"Bill","lastName":"Gates","email":"gates@mcmpemail.com","description":"gatesDesc"} -# User created successfully: gates -# User activated successfully: gates -``` +If you're setting up a new instance of Tumblebug, also follow the [Tumblebug initialization guide](https://github.com/cloud-barista/cb-tumblebug?tab=readme-ov-file#3-initialize-cb-tumblebug-to-configure-multi-cloud-info). ## Step 7: Access the MCMP Platform -Upon successful initialization, access the MCMP platform via: - ```bash -http://{vm-public-ip}:3001 +https://{vm-public-ip}:3001 ``` -#### - initial id: mcmpadmin +#### - initial id: mcmp -#### - initial password: mcmpAdminPassword#@! +#### - initial password: mcmp_password -Replace {vm-public-ip} with the actual public IP of your VM instance. +Replace `{vm-public-ip}` with the actual public IP (or domain) of your VM instance. Use **https**; a browser certificate warning is expected in Mode A (self-signed) and can be accepted/continued through. This completes the setup. You are now ready to manage multi-cloud services using MCMP on your instance. Happy managing! From b3fba3187f5703fd6a7deed3fa90d3f4a8a1b2b8 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 2 Sep 2026 06:32:39 +0000 Subject: [PATCH 10/22] docs: describe menu catalog + role-menu permission seeding in Step 5 (d) The 11-step setup verification section explained how to check the post-initial logs but never said what the steps actually register. Note that Step 4 registers the menu catalog and seeds role-menu permissions in one chained server-side call. --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index f3a26c4..653bd80 100644 --- a/README.md +++ b/README.md @@ -197,6 +197,9 @@ curl -k https:///auth/realms/mciam/.well-known/openid-configuration | gr Expected: `"issuer": "https:///auth/realms/mciam"` — must start with `https://` and include `/auth/`. **(d) mc-iam-manager-post-initial 11-step setup:** + +Among other things, these steps register the platform's menu catalog (from mc-web-console's canonical menu yaml) and seed role-menu permissions — both chained into a single server-side call, so a single step covers both. + ```shell docker logs mc-iam-manager-post-initial | tail -5 ``` From b1b4dbbf5ea86a1460b7be0f510648e7d747eb4d Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 2 Sep 2026 07:58:28 +0000 Subject: [PATCH 11/22] feat(cli): register a Version flag on the root command ./mcc --version has never worked - Cobra only registers --version when the root command's Version field is set, and it wasn't, so the flag simply didn't exist (docs telling users to run it as a smoke test always failed with "unknown flag"). Pull the version from the VCS info Go embeds automatically for any build done inside a git checkout (default since Go 1.18, no ldflags or build script changes needed) - the short commit hash, plus "-dirty" if the working tree had uncommitted changes at build time. Falls back to "dev" when build info isn't available (e.g. go run). --- src/cmd/root.go | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/cmd/root.go b/src/cmd/root.go index 2b4485f..760a5d3 100644 --- a/src/cmd/root.go +++ b/src/cmd/root.go @@ -3,6 +3,7 @@ package cmd import ( "fmt" "os" + "runtime/debug" "github.com/spf13/cobra" @@ -17,10 +18,40 @@ var RootCmd = &cobra.Command{ Use: "mcc", Short: "A tool to operate M-CMP system", Long: `The mcc is a tool to operate M-CMP system.`, + Version: buildVersion(), CompletionOptions: cobra.CompletionOptions{HiddenDefaultCmd: true}, //completion 옵션 출력 제거 // Uncomment the following line if your bare application } +// buildVersion reads the VCS revision Go embeds automatically when building +// from within a git checkout (default since Go 1.18, no ldflags required). +func buildVersion() string { + info, ok := debug.ReadBuildInfo() + if !ok { + return "dev" + } + var revision string + var dirty bool + for _, s := range info.Settings { + switch s.Key { + case "vcs.revision": + revision = s.Value + case "vcs.modified": + dirty = s.Value == "true" + } + } + if revision == "" { + return "dev" + } + if len(revision) > 12 { + revision = revision[:12] + } + if dirty { + revision += "-dirty" + } + return revision +} + // Execute adds all child commands to the root command and sets flags appropriately. // This is called by main.main(). It only needs to happen once to the rootCmd. func Execute() { From 22c083c8015070558153be51800aa56c935f74b8 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 4 Sep 2026 01:15:06 +0000 Subject: [PATCH 12/22] fix: sync mc-infra-manager/mc-iam-manager serviceActions from mc-web-console canonical api.yaml mc-admin-cli's bundled conf/docker/conf/mc-web-console/api/conf/api.yaml (mounted into the running mc-web-console-api container) had fallen drastically behind mc-web-console's own conf/api.yaml for the mc-infra-manager service: only 195 of 339 operations were present, missing commonly-used ones like CreateVNet, DeleteVNet, GetAllInfra, PostInfra, PutSecurityGroup, etc. This caused live 404s (confirmed: CreateVNet). mc-iam-manager's serviceActions registry fallback could not rescue these calls either, since it only knows cb-tumblebug's raw swagger operationIds (e.g. PostVNet), not mc-web-console's curated aliases (e.g. CreateVNet). mc-iam-manager block was also stale (133 vs 140 ops) and synced in the same pass. Other services (mc-infra-connector, mc-web-console, mc-observability, mc-application-manager, mc-workflow-manager, mc-cost-optimizer, mc-data-manager) were already within 0-1 operations of current and left untouched. Only the serviceActions.mc-infra-manager / serviceActions.mc-iam-manager blocks were replaced; the services.* section (deployment-specific baseurl/auth) is unchanged. Verified: POST /api/mc-infra-manager/CreateVNet now resolves and reaches the tumblebug backend (previously a routing 404) against the local v0.13.2 stack. ADMINCLI-TECH-016 --- .../conf/mc-web-console/api/conf/api.yaml | 4475 +++++++++++++---- 1 file changed, 3597 insertions(+), 878 deletions(-) diff --git a/conf/docker/conf/mc-web-console/api/conf/api.yaml b/conf/docker/conf/mc-web-console/api/conf/api.yaml index 21d088c..eb41d60 100644 --- a/conf/docker/conf/mc-web-console/api/conf/api.yaml +++ b/conf/docker/conf/mc-web-console/api/conf/api.yaml @@ -696,59 +696,107 @@ serviceActions: UpdateFrameworkService: method: put resourcePath: /api/mcmp-apis/name/{serviceName} - description: "프레임워크 서비스 BaseURL 수정." - mciamCheckHealth: - method: get - resourcePath: /readyz - description: "mc-iam-manager 헬스체크." + description: "프레임워크 서비스 BaseURL 수정. body: {BaseURL: string}" Searchrolesbyname: method: get resourcePath: /api/role/name/{roleName} - description: "role 검색" + description: role 검색 Logout: method: post resourcePath: /api/auth/logout - description: "AccessToken및 RefreshToken을 받아 해당 토큰 파기" + description: AccessToken및 RefreshToken을 받아 해당 토큰 파기 Deleteresourcepermissionpolicesbyoperationid: method: delete resourcePath: /api/permission/framewrok/{framework}/operationid/{operationid}/remove - description: "권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다." + description: 권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다. listProjects: method: post resourcePath: /api/projects/list - description: "project 목록 조회" + description: project 목록 조회 createProject: method: post resourcePath: /api/projects - description: "project 생성" + description: project 생성 Getresources: method: get resourcePath: /api/resource - description: "리소스의 정보를 검색합니다." + description: 리소스의 정보를 검색합니다. Createresource: method: post resourcePath: /api/resource - description: "리소스를 생성합니다." + description: 리소스를 생성합니다. Getrolelist: method: post resourcePath: /api/roles/list - description: "role 전체 목록 조회" + description: role 전체 목록 조회 Getrolescsproles: method: get resourcePath: /api/roles/csp-roles/id/{roleId} - description: "role별 CSP role 목록 조회" + description: role별 CSP role 목록 조회 listCSPRoles: method: post resourcePath: /api/roles/csp/list description: "CSP에 정의된 역할 목록 조회" + GetCspRoleById: + method: get + resourcePath: /api/roles/csp/id/{roleId} + description: "CSP Role 단건 조회" + CreateCspRole: + method: post + resourcePath: /api/roles/csp + description: "CSP Role 생성" + DeleteCspRole: + method: delete + resourcePath: /api/roles/csp/id/{roleId} + description: "CSP Role 삭제" + UpdateCspRole: + method: put + resourcePath: /api/roles/csp/id/{roleId} + description: "CSP Role 수정" + listCspPolicies: + method: post + resourcePath: /api/csp-policies/list + description: "CSP Policy 목록 조회" + GetCspPolicyById: + method: get + resourcePath: /api/csp-policies/id/{policyId} + description: "CSP Policy 단건 조회" + CreateCspPolicy: + method: post + resourcePath: /api/csp-policies + description: "CSP Policy 생성" + UpdateCspPolicy: + method: put + resourcePath: /api/csp-policies/id/{policyId} + description: "CSP Policy 수정" + DeleteCspPolicy: + method: delete + resourcePath: /api/csp-policies/id/{policyId} + description: "CSP Policy 삭제" + GetPoliciesByRoleId: + method: get + resourcePath: /api/csp-policies/role/{roleId} + description: "CSP Role에 연결된 Policy 목록 조회" + AttachPolicyToRole: + method: post + resourcePath: /api/csp-policies/attach + description: "CSP Policy를 Role에 연결" + DetachPolicyFromRole: + method: post + resourcePath: /api/csp-policies/detach + description: "CSP Policy를 Role에서 해제" + SyncCspPolicies: + method: post + resourcePath: /api/csp-policies/sync + description: "CSP Policy 동기화" Createrole: method: post resourcePath: /api/roles - description: "role 생성" + description: role 생성 Updaterole: method: put resourcePath: /api/roles/id/{roleId} - description: "role 수정" + description: role 수정 Syncrolelistwithkeycloak: method: get resourcePath: /api/tool/keycloak/role/sync @@ -756,127 +804,135 @@ serviceActions: Searchworkspacesbyname: method: get resourcePath: /api/ws/workspace/{workspaceName} - description: "workspace 검색" + description: workspace 검색 Readyz: method: get resourcePath: /readyz - description: "mc-iam-manager가 정상적으로 작동중인지 단순 확인합니다." + description: mc-iam-manager가 정상적으로 작동중인지 단순 확인합니다. Getwpmappinglistorderbyworkspace: method: get resourcePath: /api/wsprj - description: "workspace - projects mapping workspace 기준 모든 목록 조회" + description: workspace - projects mapping workspace 기준 모든 목록 조회 Createwpmapping: method: post resourcePath: /api/wsprj - description: "workspace - projects mapping 생성" + description: workspace - projects mapping 생성 addProjectToWorkspace: method: post resourcePath: /api/workspaces/assign/projects - description: "workspace에 project 등록" + description: workspace에 project 등록 Getworkspaceuserrolemappinglistbyworkspaceid: method: get resourcePath: /api/wsuserrole/workspace/id/{workspaceId} - description: "workspace - user - role mapping 목록 workspace 기준 조회" + description: workspace - user - role mapping 목록 workspace 기준 조회 + Signup: + method: post + resourcePath: /api/auth/signup + description: 신규 사용자 회원가입 (관리자 승인 후 로그인 가능) Login: method: post resourcePath: /api/auth/login - description: "ID/Password를 받아 JWT 세션 토큰을 반환" + description: ID/Password를 받아 JWT 세션 토큰을 반환 Gettokeninfo: method: get resourcePath: /api/auth/tokeninfo - description: "유저 정보 조회" + description: 유저 정보 조회 Getcurrentpermissioncsv: method: get resourcePath: /api/permission/file/framework/{framework} - description: "현재 권한을 CSV 형태로 가져옵니다." + description: 현재 권한을 CSV 형태로 가져옵니다. Importpermissionbycsv: method: post resourcePath: /api/permission/file/framework/{framework} - description: "CSV 기반으로 권한을 업데이트 합니다." - Getprojectbyid: + description: CSV 기반으로 권한을 업데이트 합니다. + getProjectByID: method: get - resourcePath: /api/prj/project/id/{projectId} - description: "project 단건 조회" - Updateprojectbyid: + resourcePath: /api/projects/id/{projectId} + description: project 단건 조회 + updateProject: method: put - resourcePath: /api/prj/project/id/{projectId} - description: "project 수정" - Deleteprojectbyid: + resourcePath: /api/projects/id/{projectId} + description: project 수정 + deleteProject: method: delete - resourcePath: /api/prj/project/id/{projectId} - description: "project 삭제" + resourcePath: /api/projects/id/{projectId} + description: project 삭제 + getProjectWorkspaces: + method: get + resourcePath: /api/projects/id/{projectId}/workspaces + description: project 기준 배정된 workspace 목록 조회 deleteWorkspace: method: delete resourcePath: /api/workspaces/id/{workspaceId} - description: "workspace 삭제" + description: workspace 삭제 getWorkspaceByID: method: get resourcePath: /api/workspaces/id/{workspaceId} - description: "workspace 단건 조회" + description: workspace 단건 조회 updateWorkspace: method: put resourcePath: /api/workspaces/id/{workspaceId} - description: "workspace 수정" + description: workspace 수정 Getcerts: method: get resourcePath: /api/auth/certs - description: "유저 토큰의 사용가능 유무" + description: 유저 토큰의 사용가능 유무 Authgetuservalidate: method: get resourcePath: /api/auth/validate - description: "유저 토큰의 사용가능 유무" + description: 유저 토큰의 사용가능 유무 Getpermission: method: get resourcePath: /api/permission/framewrok/{framework}/operationid/{operationid} - description: "권한을 검색합니다." + description: 권한을 검색합니다. Updateresourcepermissionbyoperationid: method: put resourcePath: /api/permission/framewrok/{framework}/operationid/{operationid} - description: "권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다." + description: 권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다. Activeuser: method: post resourcePath: /api/user/active - description: "권한 있는 사용자가 해당 유저를 활성화합니다." + description: 권한 있는 사용자가 해당 유저를 활성화합니다. Getworkspaceuserrolemappinglistorderbyworkspace: method: get resourcePath: /api/wsuserrole - description: "workspace - user - role mapping 목록 workspace 기준 전체 조회" + description: workspace - user - role mapping 목록 workspace 기준 전체 조회 Createworkspaceuserrolemappingbyname: method: post resourcePath: /api/wsuserrole - description: "workspace - user - role mapping 생성" + description: workspace - user - role mapping 생성 Getallavailablemenus: method: post resourcePath: /api/users/menus/list - description: "해당 프레임워크 사용자에게 할당된 메뉴 리스트를 반환합니다." + description: 해당 프레임워크 사용자에게 할당된 메뉴 리스트를 반환합니다. Getmappedmenusbyrolelist: method: post resourcePath: /api/menus/platform-roles/list - description: "해당 프레임워크 역할에 할당된 메뉴 리스트를 반환합니다." + description: 해당 프레임워크 역할에 할당된 메뉴 리스트를 반환합니다. Deleteuser: method: delete resourcePath: /api/users/id/{userId} - description: "사용자를 삭제합니다." + description: 사용자를 삭제합니다. Updateuser: method: put resourcePath: /api/users/id/{userId} - description: "사용자 정보를 업데이트 합니다." + description: 사용자 정보를 업데이트 합니다. Createworkspace: method: post resourcePath: /api/workspaces - description: "workspace 생성" + description: workspace 생성 listWorkspaces: method: post resourcePath: /api/workspaces/list - description: "workspace 목록 조회" + description: workspace 목록 조회 listMciamPermissions: method: post resourcePath: /api/permissions/mciam/list - description: "모든 권한을 가져옵니다." + description: 모든 권한을 가져옵니다. listUsersAndRolesByWorkspaces: method: post resourcePath: /api/workspaces/id/{workspaceId}/users/list - description: "workspace 목록 조회" + description: workspace 목록 조회 getWorkspaceProjectsByWorkspaceId: method: get resourcePath: /api/workspaces/id/{workspaceId}/projects/list @@ -889,61 +945,79 @@ serviceActions: getTempCredentialProviders: method: get resourcePath: /api/auth/temp-credential-csps - description: "임시 자격 증명을 지원하는 CSP 목록 조회" + description: 임시 자격 증명을 지원하는 CSP 목록 조회 Appendresourcepermissionpolicesbyoperationid: method: put resourcePath: /api/permission/framewrok/{framework}/operationid/{operationid}/append - description: "권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다." + description: 권한을 OperationId를 기반으로 리소스 권한을 업데이트합니다. Updateresource: method: put resourcePath: /api/resource/id/{id} - description: "리소스를 업데이트 합니다." + description: 리소스를 업데이트 합니다. Deleteresource: method: delete resourcePath: /api/resource/id/{id} - description: "리소스를 삭제합니다." + description: 리소스를 삭제합니다. Getmenuresources: method: post - # method: get - # resourcePath: /api/resource/menus resourcePath: /api/menus/list - description: "메뉴 리소스를 검색합니다." + description: 메뉴 리소스를 검색합니다. + Listmenustree: + method: post + resourcePath: /api/menus/menus-tree/list + description: List all menus as tree structure (Admin only) + Createmenu: + method: post + resourcePath: /api/menus + description: Create a new menu + Getmenubyid: + method: get + resourcePath: /api/menus/id/{menuId} + description: Get menu details by ID + Updatemenu: + method: put + resourcePath: /api/menus/id/{menuId} + description: Update menu details + Deletemenu: + method: delete + resourcePath: /api/menus/id/{menuId} + description: Delete a menu Getallpermissions: method: get resourcePath: /api/ticket - description: "사용자는 uma_protection Role 을 가져야 한다." + description: 사용자는 uma_protection Role 을 가져야 한다. Getpermissionticket: method: post resourcePath: /api/ticket - description: "사용자는 uma_protection Role 을 가져야 한다." + description: 사용자는 uma_protection Role 을 가져야 한다. getProjectsByWorkspaceId: method: get resourcePath: /api/workspaces/id/{workspaceId}/projects/list - description: "workspace - projects mapping workspace 기준 목록 조회" - listUserWorkspaces: - method: post - resourcePath: /api/users/workspaces/list - description: "workspace - user - role mapping 목록 user 기준 조회" + description: workspace - projects mapping workspace 기준 목록 조회 listUserProjectsByWorkspace: method: get resourcePath: /api/users/workspaces/id/{workspaceId}/projects/list - description: "workspace - user - role mapping 목록 workspaceId 기준 project 조회 (platformAdmin은 소속 무관 조회 가능)" + description: workspace - projects mapping, 로그인 사용자 본인 소속 workspace만 조회 + listUserWorkspaces: + method: post + resourcePath: /api/users/workspaces/list + description: workspace - user - role mapping 목록 user 기준 조회 Deleteworkspaceuserrolemapping: method: delete resourcePath: /api/wsuserrole/workspace/id/{workspaceId}/user/id/{userId} - description: "workspace - user - role mapping 목록 workspace 와 user 로 mapping 삭제" + description: workspace - user - role mapping 목록 workspace 와 user 로 mapping 삭제 Loginrefresh: method: post resourcePath: /api/auth/refresh - description: "refresh_token과 기존 JWT를 받아, 새로운 JWT 토큰 발급" + description: refresh_token과 기존 JWT를 받아, 새로운 JWT 토큰 발급 Getuserinfo: method: get resourcePath: /api/auth/userinfo - description: "유저 정보 조회" + description: 유저 정보 조회 Updateuseinfonotuse: method: put resourcePath: /api/auth/userinfo - description: "유저 정보 조회" + description: 유저 정보 조회 Createapiresourcesbyapiyaml: method: post resourcePath: /api/resource/file/framework/{framework} @@ -951,7 +1025,7 @@ serviceActions: Resetresource: method: delete resourcePath: /api/resource/reset - description: "모든 리소스를 삭제합니다." + description: 모든 리소스를 삭제합니다. Syncprojectlistwithmcinfra: method: get resourcePath: /api/tool/mcinfra/sync @@ -959,239 +1033,191 @@ serviceActions: Getdependentpermissionsbypolicyid: method: get resourcePath: /api/permission/policyid/{policyid} - description: "권한을 검색합니다." + description: 권한을 검색합니다. Searchprojectsbyname: method: get resourcePath: /api/prj/project/{projectName} - description: "project 목록 검색" + description: project 목록 검색 Resetmenuresource: method: delete resourcePath: /api/resource/reset/menu - description: "모든 메뉴 리소스를 삭제합니다." + description: 모든 메뉴 리소스를 삭제합니다. Deleterolebyid: method: delete resourcePath: /api/roles/id/{roleId} - description: "role 삭제" + description: role 삭제 Getrolebyid: method: get resourcePath: /api/role/id/{roleId} - description: "role 단건 조회" + description: role 단건 조회 Updaterolebyid: method: put resourcePath: /api/role/id/{roleId} - description: "role 수정" + description: role 수정 Getrolebypolicyidnotuse: method: get resourcePath: /api/role/policyid/{policyid} - description: "role 단건 조회" + description: role 단건 조회 Createmenuresourcesbymenuyaml: method: post resourcePath: /api/resource/file/framework/{framework}/menu - description: "mc-web-console 등 menu yaml을 사용해서 메뉴 리소스를 등록합니다." + description: mc-web-console 등 menu yaml을 사용해서 메뉴 리소스를 등록합니다. Listusers: method: post resourcepath: /api/users/list - description: "사용자 목록 조회" + description: 사용자 목록 조회 getUserByID: method: get resourcePath: /api/users/id/{userId} - description: "사용자 단건 조회 by id" + description: 사용자 단건 조회 by id Getuserbyname: method: get resourcePath: /api/users/name/{username} - description: "사용자 단건 조회 by name" + description: 사용자 단건 조회 by name Getuserworkspacesbyuserid: method: get resourcePath: /api/users/id/{userId}/workspaces/list - description: "특정 사용자의 워크스페이스 목록조회" + description: 특정 사용자의 워크스페이스 목록조회 Createuser: method: post resourcePath: /api/users - description: "유저를 등록합니다." + description: 유저를 등록합니다. Deactiveuser: method: post resourcePath: /api/user/deactive - description: "권한 있는 사용자가 해당 유저를 비활성화합니다." + description: 권한 있는 사용자가 해당 유저를 비활성화합니다. removeWorkspaceFromProject: method: delete resourcePath: /api/projects/unassign/workspaces - description: "Workspace에서 Project 할당 해제" + description: Workspace에서 Project 할당 해제 assignPlatformRole: method: post resourcePath: /api/roles/assign/platform-role - description: "Platform Role 할당" + description: Platform Role 할당 removePlatformRole: method: delete resourcePath: /api/roles/unassign/platform-role - description: "사용자에게서 Platform Role 제거" - listPlatformRoles: - method: post - resourcePath: /api/roles/platform-roles/list - description: "Platform Role 목록 조회" - AssignRoleToUser: - method: post - resourcePath: /api/roles/assign/platform-role - description: "사용자에게 플랫폼 역할을 할당합니다." - Signup: - method: post - resourcePath: /api/auth/signup - description: "신규 사용자 회원가입 (관리자 승인 후 로그인 가능)" - GetCspRoleById: - method: get - resourcePath: /api/roles/csp/id/{roleId} - description: "CSP Role 단건 조회" - CreateCspRole: - method: post - resourcePath: /api/roles/csp - description: "CSP Role 생성" - DeleteCspRole: - method: delete - resourcePath: /api/roles/csp/id/{roleId} - description: "CSP Role 삭제" - listCspPolicies: - method: post - resourcePath: /api/csp-policies/list - description: "CSP Policy 목록 조회" - GetCspPolicyById: - method: get - resourcePath: /api/csp-policies/id/{policyId} - description: "CSP Policy 단건 조회" - CreateCspPolicy: - method: post - resourcePath: /api/csp-policies - description: "CSP Policy 생성" - UpdateCspPolicy: - method: put - resourcePath: /api/csp-policies/id/{policyId} - description: "CSP Policy 수정" - DeleteCspPolicy: - method: delete - resourcePath: /api/csp-policies/id/{policyId} - description: "CSP Policy 삭제" - GetPoliciesByRoleId: - method: get - resourcePath: /api/csp-policies/role/{roleId} - description: "CSP Role에 연결된 Policy 목록 조회" - AttachPolicyToRole: - method: post - resourcePath: /api/csp-policies/attach - description: "CSP Policy를 Role에 연결" - DetachPolicyFromRole: - method: post - resourcePath: /api/csp-policies/detach - description: "CSP Policy를 Role에서 해제" - SyncCspPolicies: + description: 사용자에게서 Platform Role 제거 + assignWorkspaceRole: method: post - resourcePath: /api/csp-policies/sync - description: "CSP Policy 동기화" - Listmenustree: - method: post - resourcePath: /api/menus/menus-tree/list - description: "List all menus as tree structure (Admin only)" - Createmenu: - method: post - resourcePath: /api/menus - description: "Create a new menu" - Getmenubyid: - method: get - resourcePath: /api/menus/id/{menuId} - description: "Get menu details by ID" - Updatemenu: - method: put - resourcePath: /api/menus/id/{menuId} - description: "Update menu details" - Deletemenu: + resourcePath: /api/roles/assign/workspace-role + description: Workspace Role 할당 + removeWorkspaceRole: method: delete - resourcePath: /api/menus/id/{menuId} - description: "Delete a menu" + resourcePath: /api/roles/unassign/workspace-role + description: 사용자에게서 Workspace Role 제거 UpdateUserStatus: method: post resourcePath: /api/users/id/{userId}/status - description: "사용자 승인/비활성화 (enabled true/false)" + description: 사용자 승인/비활성화 (enabled true/false) ResetUserPassword: method: put resourcePath: /api/users/id/{userId}/password - description: "관리자가 사용자 비밀번호 재설정" + description: 관리자가 사용자 비밀번호 재설정 ChangeMyPassword: method: put resourcePath: /api/users/me/password - description: "사용자 본인 비밀번호 변경" + description: 사용자 본인 비밀번호 변경 Createorganization: method: post resourcePath: /api/organizations - description: "그룹 생성" + description: 그룹 생성 Getorganizations: method: get resourcePath: /api/organizations - description: "그룹 목록/트리 조회 (query: tree=true면 중첩 구조)" + description: '그룹 목록/트리 조회 (query: tree=true면 중첩 구조)' Getorganizationbyid: method: get resourcePath: /api/organizations/id/{organizationId} - description: "그룹 단건 조회 by ID" + description: 그룹 단건 조회 by ID Getorganizationbycode: method: get resourcePath: /api/organizations/code/{code} - description: "그룹 단건 조회 by code" + description: 그룹 단건 조회 by code Updateorganization: method: put resourcePath: /api/organizations/id/{organizationId} - description: "그룹 수정 (부모 변경 시 하위 코드 자동 재생성)" + description: 그룹 수정 (부모 변경 시 하위 코드 자동 재생성) Deleteorganization: method: delete resourcePath: /api/organizations/id/{organizationId} - description: "그룹 삭제 (하위 그룹·소속 사용자 있으면 400)" + description: 그룹 삭제 (하위 그룹·소속 사용자 있으면 400) Getorganizationusers: method: get resourcePath: /api/organizations/id/{organizationId}/users - description: "그룹 소속 사용자 목록" + description: 그룹 소속 사용자 목록 Assignuserorganizations: method: post resourcePath: /api/users/id/{userId}/organizations - description: "사용자 그룹 할당 (다중)" - assignGroupUsers: - method: post - resourcePath: /api/groups/id/{groupId}/users - description: "그룹에 사용자 일괄 할당 (group 입장)" + description: 사용자 그룹 할당 (다중) Getuserorganizations: method: get resourcePath: /api/users/id/{userId}/organizations - description: "사용자 소속 그룹 목록" + description: 사용자 소속 그룹 목록 Removeuserorganization: method: delete resourcePath: /api/users/id/{userId}/organizations/{organizationId} - description: "사용자 그룹 제거" + description: 사용자 그룹 제거 + assignGroupPlatformRole: + method: post + resourcePath: /api/groups/id/{groupId}/platform-roles + description: 그룹에 Platform Role 할당 + getGroupPlatformRoles: + method: get + resourcePath: /api/groups/id/{groupId}/platform-roles + description: 그룹의 Platform Role 목록 조회 + getCompany: + method: get + resourcePath: /api/company + description: 플랫폼 회사 정보 조회 (싱글톤) + createCompany: + method: post + resourcePath: /api/company + description: 플랫폼 회사 정보 생성 (싱글톤, platformAdmin) + updateCompany: + method: put + resourcePath: /api/company + description: 플랫폼 회사 이름/설명 수정 (platformAdmin) + deactivateCompany: + method: delete + resourcePath: /api/company + description: 플랫폼 회사 비활성화 (platformAdmin, 멱등) + activateCompany: + method: post + resourcePath: /api/company/activate + description: 플랫폼 회사 활성화 (platformAdmin, 멱등) listCspAccounts: method: post resourcePath: /api/csp-accounts/list - description: "CSP 계정 목록 조회 (필터: csp_type)" + description: 'CSP 계정 목록 조회 (필터: csp_type)' createCspAccount: method: post resourcePath: /api/csp-accounts - description: "CSP 계정 등록" + description: CSP 계정 등록 getCspAccountByID: method: get resourcePath: /api/csp-accounts/id/{accountId} - description: "CSP 계정 단건 조회 by ID" + description: CSP 계정 단건 조회 by ID updateCspAccount: method: put resourcePath: /api/csp-accounts/id/{accountId} - description: "CSP 계정 수정" + description: CSP 계정 수정 deleteCspAccount: method: delete resourcePath: /api/csp-accounts/id/{accountId} - description: "CSP 계정 삭제" + description: CSP 계정 삭제 validateCspAccount: method: post resourcePath: /api/csp-accounts/id/{accountId}/validate - description: "CSP 계정 자격증명 유효성 검증" + description: CSP 계정 자격증명 유효성 검증 activateCspAccount: method: post resourcePath: /api/csp-accounts/id/{accountId}/activate - description: "CSP 계정 활성화" + description: CSP 계정 활성화 deactivateCspAccount: method: post resourcePath: /api/csp-accounts/id/{accountId}/deactivate - description: "CSP 계정 비활성화" + description: CSP 계정 비활성화 GetProjectSyncDiff: method: get resourcePath: /api/setup/projects/sync-diff @@ -1203,749 +1229,3278 @@ serviceActions: listMenus: method: post resourcePath: /api/menus/list - description: "메뉴 목록 조회 (전체)" + description: "메뉴 목록 조회 (전체). FR-CLOUD-ADMIN-006-08 Setup Status — 메뉴 등록 건수 산출." InitialMenus: method: post resourcePath: /api/setup/initial-menus - description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일)" + description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync." SyncMcmpApis: method: post resourcePath: /api/setup/sync-mcmp-apis - description: "api.yaml 기반 mcmpApi 카탈로그 재동기화 (1_setup_auto.sh init_api_resources와 동일)" + description: "api.yaml 기반 mcmpApi 카탈로그 재동기화 (1_setup_auto.sh init_api_resources와 동일). FR-006-08 Re-sync." syncProjects: method: post resourcePath: /api/setup/sync-projects - description: "mc-infra-manager의 namespace 목록을 가져와 project 테이블과 동기화" - + description: "mc-infra-manager의 namespace 목록을 가져와 project 테이블과 동기화 (1_setup_auto.sh sync_projects와 동일). FR-006-08 Re-sync." mc-infra-manager: - GetCredentialHolderList: - method: get - resourcePath: /credentialHolder - description: "List all credential holders derived from registered connection configs." - GetAssetsSummary: - method: get - resourcePath: /assetsSummary - description: "Returns CSP-wise summary of specs and images in DB for a namespace." + GetInfraReadyzInit: + method: put + resourcePath: /readyz/init + description: "mc-infra-manager 초기화. credential valid 선행 필요. image/spec 등 초기 데이터 로드." Lookupspeclist: method: post resourcePath: /lookupSpecs description: "Lookup spec list" - Getlatencybenchmark: + AddNLBNodes: + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId}/node + description: Add nodes to NLB + AnalyzeProvisioningRisk: method: get - resourcePath: /ns/{nsId}/benchmarkLatency/mci/{mciId} - description: "Run MCI benchmark for network latency" - Getallsecuritygroup: + resourcePath: /provisioning/risk/{specId} + description: 'Evaluate the likelihood of provisioning failure based on historical data for a specific VM specification and image combination. + + This endpoint provides intelligent risk assessment to help prevent deployment failures: + + + **Risk Analysis Factors:** + + - Historical failure rate for the VM specification + + - Image-specific compatibility with the spec + + - Recent failure patterns and trends + + - Cross-reference of spec+image combination success rates + + + **Risk Levels:** + + - `high`: Very likely to fail (>80% failure rate or image-specific failures) + + - `medium`: Moderate risk (50-80% failure rate or mixed results) + + - `low`: Low risk (<50% failure rate or no previous failures) + + - `unknown`: Insufficient data for analysis + + + **Recommended Actions by Risk Level:** + + - **High Risk**: Consider alternative specs or images, verify CSP quotas and permissions + + - **Medium Risk**: Proceed with caution, have backup plans ready + + - **Low Risk**: Safe to proceed with normal deployment + + + **Integration Points:** + + - Automatically called during MCI review process + + - Can be used in CI/CD pipelines for deployment validation + + - Helpful for capacity planning and resource selection' + AnalyzeProvisioningRiskDetailed: method: get - resourcePath: /ns/{nsId}/resources/securityGroup - description: "List all Security Groups or Security Groups' ID" - Postsecuritygroup: - method: post - resourcePath: /ns/{nsId}/resources/securityGroup - description: "Create Security Group" - Delallsecuritygroup: - method: delete - resourcePath: /ns/{nsId}/resources/securityGroup - description: "Delete all Security Groups" - Postconfig: - method: post - resourcePath: /config - description: "Create or Update config (TB_SPIDER_REST_URL, TB_DRAGONFLY_REST_URL, ...)" - Initallconfig: + resourcePath: /provisioning/risk/detailed + description: 'Provides comprehensive risk analysis with separate assessments for VM specification and image risks, plus actionable recommendations. + + This endpoint offers enhanced risk analysis by separating spec-level and image-level risk factors: + + + **Risk Analysis Breakdown:** + + - **Spec Risk**: Analyzes whether the VM specification itself has compatibility or resource issues + + - **Image Risk**: Evaluates the track record of the specific image with this spec + + - **Overall Risk**: Combines both factors to determine the primary risk source + + - **Recommendations**: Provides actionable guidance based on risk analysis + + + **Spec Risk Factors:** + + - Number of different images that failed with this spec (indicates spec-level issues) + + - Overall failure rate across all images + + - Success/failure ratio with various images + + + **Image Risk Factors:** + + - Previous success/failure history of this specific image with this spec + + - Whether this is a new, untested combination + + + **Recommendation Types:** + + - Change VM specification (when spec is the primary risk factor) + + - Try different image (when image is the primary risk factor) + + - Monitor deployment closely (for new combinations or medium risk) + + - Proceed with confidence (for low-risk combinations)' + BulkDeleteGlobalDnsRecord: method: delete - resourcePath: /config - description: "Init all configs" - Getallconfig: - method: get - resourcePath: /config - description: "List all configs" - Inspectresources: - method: post - resourcePath: /inspectResources - description: "Inspect Resources (vNet, securityGroup, sshKey, vm) registered in CB-Tumblebug, CB-Spider, CSP" - Postk8sclusterdynamiccheckrequest: + resourcePath: /resources/globalDns/records + description: 'Delete multiple DNS records from Route53 in a single request. + + Records are grouped by domain and submitted as a single ChangeBatch per domain for efficiency.' + CancelExecutionTask: method: post - resourcePath: /k8sClusterDynamicCheckRequest - description: "Check available ConnectionConfig list before create K8sCluster Dynamically from common spec and image" - Deldatadisk: - method: delete - resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} - description: "Delete Data Disk" - Getdatadisk: + resourcePath: /ns/{nsId}/cmd/infra/{infraId}/task/{taskId}/cancel + description: Cancel a running execution task by task ID. This will send a cancellation signal to the task and update the VM command status. + CheckHTTPVersion: method: get - resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} - description: "Get Data Disk" - Putdatadisk: - method: put - resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} - description: "Upsize Data Disk" - Putsshkey: - method: put - resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} - description: "Update SSH Key" - Delsshkey: - method: delete - resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} - description: "Delete SSH Key" - Getsshkey: + resourcePath: /httpVersion + description: Checks and logs the HTTP version of the incoming request to the server console. + CheckK8sNodeGroupsOnK8sCreation: method: get - resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} - description: "Get SSH Key" - Getns: + resourcePath: /checkK8sNodeGroupsOnK8sCreation + description: Check whether nodegroups are required during the K8sCluster creation + CheckK8sNodeImageDesignation: method: get - resourcePath: /ns/{nsId} - description: "Get namespace" - Putns: - method: put - resourcePath: /ns/{nsId} - description: "Update namespace" - Delns: - method: delete - resourcePath: /ns/{nsId} - description: "Delete namespace" - Checkresource: + resourcePath: /checkK8sNodeImageDesignation + description: Check whether node image designation is possible to create a K8sCluster + CheckObjectStorage: + method: head + resourcePath: /ns/{nsId}/resources/objectStorage/{osId} + description: Check existence of an object storage (bucket) + CheckResource: method: get resourcePath: /ns/{nsId}/checkResource/{resourceType}/{resourceId} - description: "Check resources' existence" - Getallnlb: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/nlb - description: "List all NLBs or NLBs' ID" - Postnlb: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/nlb - description: "Create NLB" - Delallnlb: + description: Check resources' existence + ClearAllNodeCommandStatus: method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/nlb - description: "Delete all NLBs" - Registercspnativeresources: - method: post - resourcePath: /registerCspResources - description: "Register CSP Native Resources (vNet, securityGroup, sshKey, vm) to CB-Tumblebug" - Getcontrolmci: - method: get - resourcePath: /ns/{nsId}/control/mci/{mciId} - description: "Control the lifecycle of MCI (refine, suspend, resume, reboot, terminate)" - Getmonitordata: - method: get - resourcePath: /ns/{nsId}/monitoring/mci/{mciId}/metric/{metric} - description: "Get monitoring data of specified MCI for specified monitoring metric (cpu, memory, disk, network)" - Postobjectstorage: - method: post - resourcePath: /ns/{nsId}/resources/objectStorage - description: "Create a Object Storages\n\nSupported CSPs: AWS, Azure\n- Note - `connectionName` example: aws-ap-northeast-2, azure-koreacentral\n\n- Note - Please check the `requiredCSPResource` property which includes CSP specific values.\n\n- Note - You can find the API usage examples on this link, https://github.com/cloud-barista/mc-terrarium/discussions/117\n" - Getallobjectstorage: - method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/commandStatusAll + description: Delete all command status records for a node + ComplementSshKeyRemoteCommand: + method: put + resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId}/complement + description: Update username and privateKey to enable remote command execution on registered VMs + CreateObjectStorage: + method: put resourcePath: /ns/{nsId}/resources/objectStorage - description: "Get all Object Storages (TBD)" - Postutiltovalidatenetwork: - method: post - resourcePath: /util/net/validate - description: "Validate a hierarchical configuration of a VPC network or multi-cloud network consisting of multiple VPC networks" - Getavailablek8snodeimage: - method: get - resourcePath: /availableK8sNodeImage - description: "(UNDER DEVELOPMENT!!!) Get available kubernetes cluster node image" - Getk8sclusterinfo: - method: get - resourcePath: /k8sClusterInfo - description: "Get kubernetes cluster information" - Loadassets: - method: get - resourcePath: /loadAssets - description: "Load Common Resources from internal asset files (Spec, Image)" - Getcontrolmcivm: - method: get - resourcePath: /ns/{nsId}/control/mci/{mciId}/vm/{vmId} - description: "Control the lifecycle of VM (suspend, resume, reboot, terminate)" - Delallvnet: - method: delete - resourcePath: /ns/{nsId}/resources/vNet - description: "Delete all VNets" - Getallvnet: - method: get - resourcePath: /ns/{nsId}/resources/vNet - description: "List all VNets or VNets' ID" - Postvnet: + description: Create an object storage (bucket) + CreateObjectStorageLagacy: + method: put + resourcePath: /resources/objectStorage/{objectStorageName} + description: '(To be deprecated) Create an object storage (bucket) + + + **Important Notes:** + + - The `objectStorageName` must be globally unique across all existing buckets in the S3 compatible storage. + + - The bucket namespace is shared by all users of the system.' + CreateOrUpdateLabel: + method: put + resourcePath: /label/{labelType}/{uid} + description: Create or update a label for a resource identified by its uid + CreateSharedResource: method: post + resourcePath: /ns/{nsId}/sharedResource + description: Create shared resources for MC-Infra + DelAllCustomImage: + method: delete + resourcePath: /ns/{nsId}/resources/customImage + description: Delete all customImages + DelAllDataDisk: + method: delete + resourcePath: /ns/{nsId}/resources/dataDisk + description: Delete all Data Disks + DelAllImage: + method: delete + resourcePath: /ns/{nsId}/resources/image + description: Delete all images + DelAllInfra: + + method: delete + resourcePath: /ns/{nsId}/infra + description: Delete all MCIs + DelAllInfraPolicy: + + method: delete + resourcePath: /ns/{nsId}/policy/infra + description: Delete all MCI policies + DelAllNLB: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/nlb + description: Delete all NLBs + DelAllNs: + method: delete + resourcePath: /ns + description: Delete all namespaces + DelAllSecurityGroup: + method: delete + resourcePath: /ns/{nsId}/resources/securityGroup + description: Delete all Security Groups + DelAllSharedResources: + method: delete + resourcePath: /ns/{nsId}/sharedResources + description: Delete all Default Resource Objects in the given namespace + DelAllSshKey: + method: delete + resourcePath: /ns/{nsId}/resources/sshKey + description: Delete all SSH Keys + DelAllVNet: + method: delete resourcePath: /ns/{nsId}/resources/vNet - description: "Create a new VNet" - Postmcivmsnapshot: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId}/snapshot - description: "Snapshot VM and create a Custom Image Object using the Snapshot" - Getregion: - method: get - resourcePath: /provider/{providerName}/region/{regionName} - description: "Get registered region info" - Postmcidynamiccheckrequest: - method: post - resourcePath: /mciDynamicCheckRequest - description: "Check available ConnectionConfig list before create MCI Dynamically from common spec and image" - Postfiletomci: - method: post - resourcePath: /ns/{nsId}/transferFile/mci/{mciId} - description: "Transfer a file to specified MCI to the specified path.\nThe file size should be less than 10MB.\nNot for gerneral file transfer but for specific purpose (small configuration files)." - Getbenchmark: - method: post - resourcePath: /ns/{nsId}/benchmark/mci/{mciId} - description: "Run MCI benchmark for a single performance metric and return results" - Getnlb: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/nlb/{nlbId} - description: "Get NLB" - Delnlb: + description: Delete all VNets + DelCustomImage: method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/nlb/{nlbId} - description: "Delete NLB" - Postregistersubnet: - method: post - resourcePath: /ns/{nsId}/registerCspResource/vNet/{vNetId}/subnet - description: "Register Subnet, which was created in CSP" - Fetchimages: - method: post - resourcePath: /ns/{nsId}/resources/fetchImages - description: "Fetch images" - Getobjectstorage: - method: get - resourcePath: /ns/{nsId}/resources/objectStorage/{objectStorageId} - description: "Get resource info of a Object Storage" - Deleteobjectstorage: + resourcePath: /ns/{nsId}/resources/customImage/{customImageId} + description: Delete customImage + DelDataDisk: method: delete - resourcePath: /ns/{nsId}/resources/objectStorage/{objectStorageId} - description: "Delete a Object Storage" - Removelabel: + resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} + description: Delete Data Disk + DelFirewallRules: method: delete - resourcePath: /label/{labelType}/{uid}/{key} - description: "Remove a label from a resource identified by its uid" - Getbastionnodes: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{targetVmId}/bastion - description: "Get bastion nodes for a VM" - Getspec: - method: get - resourcePath: /ns/{nsId}/resources/spec/{specId} - description: "Get spec" - Putspec: - method: put - resourcePath: /ns/{nsId}/resources/spec/{specId} - description: "Update spec" - Delspec: + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId}/rules + description: 'Delete specific FirewallRules: Remove specified rules from the Security Group while keeping other existing rules. + + This API will remove only the specified rules from the Security Group, leaving all other rules intact. + + + Usage: + + Use this API to remove specific firewall rules from a Security Group. Only the rules matching the provided criteria will be deleted. + + - Rules that exactly match the provided Direction, Protocol, Port, and CIDR will be removed. + + - All other existing rules will remain unchanged. + + + Notes: + + - "Ports" field supports single port ("22"), port range ("80-100"), and multiple ports/ranges ("22,80-100,443"). + + - "Protocol" can be TCP, UDP, ICMP, ALL, etc. (as supported by the cloud provider). + + - "Direction" must be either "inbound" or "outbound". + + - "CIDR" is the allowed IP range.' + DelImage: + method: delete + resourcePath: /ns/{nsId}/resources/image/{imageId} + description: Delete image + DelInfra: + + method: delete + resourcePath: /ns/{nsId}/infra/{infraId} + description: Delete MCI + DelInfraPolicy: + + method: delete + resourcePath: /ns/{nsId}/policy/infra/{infraId} + description: Delete MCI Policy + DelInfraNode: + + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId} + description: Delete VM in specified MCI + DelNLB: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId} + description: Delete NLB + DelNs: + method: delete + resourcePath: /ns/{nsId} + description: Delete namespace + DelSecurityGroup: + method: delete + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId} + description: Delete Security Group + DelSpec: method: delete resourcePath: /ns/{nsId}/resources/spec/{specId} - description: "Delete spec" - Getsqldb: - method: get - resourcePath: /ns/{nsId}/resources/sqlDb/{sqlDbId} - description: "Get resource info of a SQL datatbase" - Deletesqldb: + description: Delete spec + DelSshKey: method: delete - resourcePath: /ns/{nsId}/resources/sqlDb/{sqlDbId} - description: "Delete a SQL datatbase" - Getvnet: - method: get - resourcePath: /ns/{nsId}/resources/vNet/{vNetId} - description: "Get VNet" - Delvnet: + resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} + description: Delete SSH Key + DelSubnet: + method: delete + resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet/{subnetId} + description: 'Delete Subnet + + - refine: delete a subnet `object` if there''s no resource on CSP or no inforamation on Spider + + - force: force: delete a subnet `resource` on a CSP regardless of the current resource status (e.g., attempt to delete even if in use)' + DelVNet: method: delete resourcePath: /ns/{nsId}/resources/vNet/{vNetId} - description: "Delete VNet\n- withsubnets: delete VNet and its subnets\n- refine: delete information of VNet and its subnets if there's no info/resource in Spider/CSP\n- force: delete VNet and its subnets regardless of the status of info/resource in Spider/CSP" - Testjwtauth: - method: get - resourcePath: /auth/test - description: "Test JWT authentication" - Getpublickeyforcredentialencryption: - method: get - resourcePath: /credential/publicKey - description: "Generates an RSA key pair using a 4096-bit key size with the RSA algorithm. The public key is generated using the RSA algorithm with OAEP padding and SHA-256 as the hash function. This key is used to encrypt an AES key that will be used for hybrid encryption of credentials." - Recommendk8snode: - method: post - resourcePath: /k8sClusterRecommendNode - description: "Recommend K8sCluster's Node plan (filter and priority) Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1234" - Postmcivm: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/vm - description: "Create and add homogeneous VMs(subGroup) to a specified MCI (Set subGroupSize for multiple VMs)" - Postspec: - method: post - resourcePath: /ns/{nsId}/resources/spec - description: "Register spec" - Delallsharedresources: + description: 'Delete VNet + + - withsubnets: delete VNet and its subnets + + - refine: delete information of VNet and its subnets if there''s no info/resource in Spider/CSP + + - force: delete VNet and its subnets regardless of the status of info/resource in Spider/CSP' + DeleteAllK8sCluster: method: delete - resourcePath: /ns/{nsId}/sharedResources - description: "Delete all Default Resource Objects in the given namespace" - Getrequiredk8ssubnetcount: - method: get - resourcePath: /requiredK8sSubnetCount - description: "Get the required subnet count to create a K8sCluster" - Checkk8snodegroupsonk8screation: - method: get - resourcePath: /checkK8sNodeGroupsOnK8sCreation - description: "Check whether nodegroups are required during the K8sCluster creation" - Getmcigroupids: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/subgroup - description: "List SubGroup IDs in a specified MCI" - Putvmdatadisk: - method: put - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId}/dataDisk - description: "Attach/Detach available dataDisk" - Postvmdatadisk: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId}/dataDisk - description: "Provisioning (Create and attach) dataDisk" - Getvmdatadisk: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId}/dataDisk - description: "Get available dataDisks for a VM" - Getsitetositevpn: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vpn/{vpnId} - description: "Get resource info of a site-to-site VPN (Currently, GCP-AWS is supported)" - Putsitetositevpn: - method: put - resourcePath: /ns/{nsId}/mci/{mciId}/vpn/{vpnId} - description: "(To be provided) Update a site-to-site VPN" - Deletesitetositevpn: + resourcePath: /ns/{nsId}/k8sCluster + description: Delete all K8sClusters + DeleteAllInfraDynamicTemplate: + method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/vpn/{vpnId} - description: "Delete a site-to-site VPN (Currently, GCP-AWS is supported)" - Getcustomimage: - method: get - resourcePath: /ns/{nsId}/resources/customImage/{customImageId} - description: "Get customImage" - Delcustomimage: + resourcePath: /ns/{nsId}/template/infra + description: Delete all MCI Dynamic Templates in a namespace. + DeleteAllRequests: method: delete - resourcePath: /ns/{nsId}/resources/customImage/{customImageId} - description: "Delete customImage" - Getallrequests: - method: get resourcePath: /requests - description: "Get details of all requests with optional filters." - Deleteallrequests: + description: Delete details of all requests + DeleteAllSecurityGroupTemplate: method: delete - resourcePath: /requests - description: "Delete details of all requests" - Getcloudinfo: - method: get - resourcePath: /cloudInfo - description: "Get cloud information" - Getconnconfiglist: - method: get - resourcePath: /connConfig - description: "List all registered ConnConfig" - Deletederegistervnet: + resourcePath: /ns/{nsId}/template/securityGroup + description: Delete all SecurityGroup Templates in a namespace. + DeleteAllVNetTemplate: method: delete - resourcePath: /ns/{nsId}/deregisterCspResource/vNet/{vNetId} - description: "Deregister the VNet, which was created in CSP" - Putsetk8snodegroupautoscaling: - method: put - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName}/onAutoscaling - description: "Set a K8sNodeGroup's Autoscaling On/Off" - Getallcustomimage: - method: get - resourcePath: /ns/{nsId}/resources/customImage - description: "List all customImages or customImages' ID" - Postcustomimage: - method: post - resourcePath: /ns/{nsId}/resources/customImage - description: "Register existing Custom Image in a CSP (option=register)" - Delallcustomimage: + resourcePath: /ns/{nsId}/template/vNet + description: Delete all vNet Templates in a namespace. + DeleteDataObject: method: delete - resourcePath: /ns/{nsId}/resources/customImage - description: "Delete all customImages" - Filterspecsbyrange: - method: post - resourcePath: /ns/{nsId}/resources/filterSpecsByRange - description: "Filter specs by range" - Postsystemmci: - method: post - resourcePath: /systemMci - description: "Create System MCI Dynamically for Special Purpose" - Lookupspec: - method: post - resourcePath: /lookupSpec - description: "Lookup spec" - Postk8snodegroup: - method: post - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup - description: "Add a K8sNodeGroup" - Getnlbhealth: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/nlb/{nlbId}/healthz - description: "Get NLB Health" - Postmcisubgroupscaleout: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/subgroup/{subgroupId} - description: "ScaleOut subGroup in specified MCI" - Getmcigroupvms: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/subgroup/{subgroupId} - description: "List VMs with a SubGroup label in a specified MCI" - Deletederegistersubnet: + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/object/{objectKey} + description: Delete an object from an object storage (bucket) + DeleteDataObjectLagacy: method: delete - resourcePath: /ns/{nsId}/deregisterCspResource/vNet/{vNetId}/subnet/{subnetId} - description: "Deregister Subnet, which was created in CSP" - Putchangek8snodegroupautoscalesize: - method: put - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName}/autoscaleSize - description: "Change a K8sNodeGroup's Autoscale Size" - Getallmcipolicy: - method: get - resourcePath: /ns/{nsId}/policy/mci - description: "List all MCI policies" - Delallmcipolicy: + resourcePath: /resources/objectStorage/{objectStorageName}/{objectKey} + description: (To be deprecated) Delete an object from a bucket + DeleteDeregisterSubnet: method: delete - resourcePath: /ns/{nsId}/policy/mci - description: "Delete all MCI policies" - Postimage: - method: post - resourcePath: /ns/{nsId}/resources/image - description: "Register image" - Delallimage: + resourcePath: /ns/{nsId}/deregisterResource/vNet/{vNetId}/subnet/{subnetId} + description: Deregister Subnet, which was created in CSP + DeleteDeregisterVNet: method: delete - resourcePath: /ns/{nsId}/resources/image - description: "Delete all images" - Getallimage: - method: get - resourcePath: /ns/{nsId}/resources/image - description: "List all images or images' ID" - Postsubnet: - method: post - resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet - description: "Create Subnet" - Getallsubnet: - method: get - resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet - description: "List all subnets" - Putupgradek8scluster: - method: put - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/upgrade - description: "Upgrade a K8sCluster's version" - Getmcivm: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId} - description: "Get VM in specified MCI" - Delmcivm: + resourcePath: /ns/{nsId}/deregisterResource/vNet/{vNetId} + description: Deregister the VNet, which was created in CSP + DeleteGlobalDnsRecord: method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{vmId} - description: "Delete VM in specified MCI" - Postinstallmonitoragenttomci: - method: post - resourcePath: /ns/{nsId}/monitoring/install/mci/{mciId} - description: "Install monitoring agent (CB-Dragonfly agent) to MCI" - Getobject: - method: get - resourcePath: /object - description: "Get value of an object" - Deleteobject: + resourcePath: /resources/globalDns/record + description: 'Delete DNS record(s) from Route53. If setIdentifier is provided, deletes only that specific record. + + If setIdentifier is empty, deletes all records matching the name and type.' + DeleteK8sCluster: method: delete - resourcePath: /object - description: "Delete an object" - Getavailablek8sclusterversion: - method: get - resourcePath: /availableK8sVersion - description: "Get available kubernetes cluster version" - Lookupimage: - method: post - resourcePath: /lookupImage - description: "Lookup image" - Postregistervnet: - method: post - resourcePath: /ns/{nsId}/registerCspResource/vNet - description: "Register the VNet, which was created in CSP" - Getallsshkey: - method: get - resourcePath: /ns/{nsId}/resources/sshKey - description: "List all SSH Keys or SSH Keys' ID" - Postsshkey: - method: post - resourcePath: /ns/{nsId}/resources/sshKey - description: "Create SSH Key" - Delallsshkey: + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId} + description: Delete K8sCluster + DeleteK8sNodeGroup: method: delete - resourcePath: /ns/{nsId}/resources/sshKey - description: "Delete all SSH Keys" - Getproviderlist: - method: get - resourcePath: /provider - description: "List all registered Providers" - Checkk8snodeimagedesignation: - method: get - resourcePath: /checkK8sNodeImageDesignation - description: "Check whether node image designation is possible to create a K8sCluster" - Getconfig: - method: get - resourcePath: /config/{configId} - description: "Get config" - Initconfig: + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName} + description: Remove a K8sNodeGroup + DeleteInfraDynamicTemplate: + method: delete - resourcePath: /config/{configId} - description: "Init config" - Registercredential: - method: post - resourcePath: /credential - description: "This API registers credential information using hybrid encryption. The process involves compressing and encrypting sensitive data with AES-256, encrypting the AES key with a 4096-bit RSA public key (retrieved via `GET /credential/publicKey`), and using OAEP padding with SHA-256. All values, including the AES key, must be base64 encoded before sending, and the public key token ID must be included in the request." - Getcontrolk8scluster: - method: get - resourcePath: /ns/{nsId}/control/k8sCluster/{k8sClusterId} - description: "Control the creation of K8sCluster (continue, withdraw)" - PostMciSubGroupDynamic: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/subGroupDynamic - description: "Dynamically add new virtual machines to an existing MCI using common specifications and automated resource management" - Postutiltodesignnetwork: - method: post - resourcePath: /util/net/design - description: "Design a hierarchical network configuration of a VPC network or multi-cloud network consisting of multiple VPC networks" - Retrieveregionlistfromcsp: - method: get - resourcePath: /regionFromCsp - description: "RetrieveR all region lists from CSPs" - Postteststreamresponse: + resourcePath: /ns/{nsId}/template/infra/{templateId} + description: Delete a specific MCI Dynamic Template. + DeleteMultipleDataObjectsLagacy: method: post - resourcePath: /testStreamResponse - description: "Receives a number and streams the decrementing number every second until zero" - Removebastionnodes: + resourcePath: /resources/objectStorage/{objectStorageName} + description: '(To be deprecated) `Delete` multiple objects from a bucket + + + **Important Notes:** + + - The request body must contain the list of objects to delete in XML format + + - The `delete` query parameter must be set to `true` + + + **Request Body Example:** + + ```xml + + + + + + + + test-object1.txt + + + + + + test-object2.txt + + + + + + ``` + + + **Actual XML Response Example:** + + ```xml + + + + + + + + test-object1.txt + + + + + + test-object2.txt + + + + + + ```' + DeleteObject: method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/bastion/{bastionVmId} - description: "Remove a bastion VM from all vNets" - Addnlbvms: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/nlb/{nlbId}/vm - description: "Add VMs to NLB" - Removenlbvms: + resourcePath: /object + description: Delete an object + DeleteObjectStorageCORS: method: delete - resourcePath: /ns/{nsId}/mci/{mciId}/nlb/{nlbId}/vm - description: "Delete VMs from NLB" - Getallsitetositevpn: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vpn - description: "Get all site-to-site VPNs" - Postsitetositevpn: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/vpn - description: "Create a site-to-site VPN\n\nThe supported CSP sets are as follows:\n\n- GCP and AWS (Note: It will take about `15 minutes`.)\n\n- GCP and Azure (Note: It will take about `30 minutes`.)" - Delfirewallrules: + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/cors + description: Delete all CORS rules of an object storage (bucket) + DeleteObjectStorageCORSLagacy: method: delete - resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId}/rules - description: "Delete FirewallRules" - Postfirewallrules: - method: post - resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId}/rules - description: "Create FirewallRules" - Getobjects: - method: get - resourcePath: /objects - description: "List all objects for a given key" - Deleteobjects: + resourcePath: /resources/objectStorage/{objectStorageName}/cors + description: (To be deprecated) Delete CORS configuration of an object storage (bucket) + DeleteObjectStorageLagacy: + method: delete + resourcePath: /resources/objectStorage/{objectStorageName} + description: (To be deprecated) Delete an object storage (bucket) + DeleteObjects: method: delete resourcePath: /objects - description: "Delete child objects along with the given object" - Getallbenchmark: - method: post - resourcePath: /ns/{nsId}/benchmarkAll/mci/{mciId} - description: "Run MCI benchmark for all performance metrics and return results" - Postmci: - method: post - resourcePath: /ns/{nsId}/mci - description: "Create MCI" - Delallmci: + description: Delete child objects along with the given object + DeleteProvisioningLog: method: delete - resourcePath: /ns/{nsId}/mci - description: "Delete all MCIs" - GetAllMci: - method: get - resourcePath: /ns/{nsId}/mci - description: "List all MCIs or MCIs' ID" - Postregistercspnativevm: - method: post - resourcePath: /ns/{nsId}/registerCspVm - description: "Register existing VM in a CSP to Cloud-Barista MCI" - Getallsqldb: - method: get - resourcePath: /ns/{nsId}/resources/sqlDb - description: "Get all SQL Databases (TBD)" - Postsqldb: - method: post - resourcePath: /ns/{nsId}/resources/sqlDb - description: "Create a SQL Databases\n\nSupported CSPs: AWS, Azure, GCP, NCP\n- Note - `connectionName` example: aws-ap-northeast-2, azure-koreacentral, gcp-asia-northeast3, ncpvpc-kr\n\n- Note - Please check the `requiredCSPResource` property which includes CSP specific values.\n\n- Note - You can find the API usage examples on this link, https://github.com/cloud-barista/mc-terrarium/discussions/110\n" - Postk8sclusterdynamic: - method: post - resourcePath: /ns/{nsId}/k8sClusterDynamic - description: "Create K8sCluster Dynamically from common spec and image" - Putmonitoragentstatusinstalled: + resourcePath: /provisioning/log/{specId} + description: 'Remove all provisioning history data for a specific VM specification. + + This operation permanently deletes historical failure and success records: + + + **Warning**: This action is irreversible and will remove: + + - All failure and success statistics + + - Historical error messages and troubleshooting data + + - Risk analysis baseline for future deployments + + - Failure pattern analysis data + + + **When to Use:** + + - **Data Cleanup**: Remove outdated or irrelevant provisioning history + + - **Fresh Start**: Clear history after infrastructure changes that resolve previous issues + + - **Privacy Compliance**: Remove logs containing sensitive error information + + - **Storage Management**: Clean up logs to manage kvstore space + + + **Impact on System:** + + - Future risk analysis for this spec will have no historical baseline + + - MCI review process will not show historical warnings for this spec + + - Provisioning reliability metrics will be reset to zero' + DeleteRequest: + method: delete + resourcePath: /request/{reqId} + description: Delete details of a specific request + DeleteScheduleRegisterCspResources: + method: delete + resourcePath: /registerCspResources/schedule/{jobId} + description: 'Stop and permanently delete a scheduled CSP resource registration job + + + **Warning:** This operation is irreversible! + + - Job will be stopped immediately + + - All job data and execution history will be deleted + + - Cannot be recovered after deletion + + + **Alternatives:** + + - To temporarily stop: Use `/pause` endpoint instead + + - To keep history: Set `enabled: false` via PUT endpoint' + DeleteScheduleRegisterCspResourcesAll: + method: delete + resourcePath: /registerCspResources/schedule + description: '⚠️ **DANGER: This operation deletes ALL scheduled jobs in the system!** + + + **⚠️ CRITICAL WARNINGS:** + + - This will PERMANENTLY DELETE **ALL** scheduled jobs across all namespaces + + - All job execution history will be lost + + - This operation is IRREVERSIBLE and cannot be undone + + - Use with EXTREME CAUTION in production environments + + + **Use Cases:** + + - Cleaning up test/development environments + + - Emergency shutdown of all scheduled operations + + - System maintenance or reset + + + **Safer Alternatives:** + + - Delete individual jobs: Use `DELETE /registerCspResources/schedule/{jobId}` + + - Temporarily stop all jobs: Pause each job individually via `/pause` endpoint + + - Disable without deleting: Update each job with `enabled: false` + + + **Response Information:** + + - Returns the count of deleted jobs + + - Returns 200 even if no jobs were found (count will be 0)' + DeleteSecurityGroupTemplate: + method: delete + resourcePath: /ns/{nsId}/template/securityGroup/{templateId} + description: Delete a specific SecurityGroup Template. + DeleteSiteToSiteVpn: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/vpn/{vpnId} + description: 'Delete a site-to-site VPN + + + - Note: A one-time retry is performed to handle transient failures caused by CSP-internal timing issues between dependent resources. + + ' + DeleteSqlDb: + method: delete + resourcePath: /ns/{nsId}/resources/sqlDb/{sqlDbId} + description: Delete a SQL datatbase + DeleteVNetTemplate: + method: delete + resourcePath: /ns/{nsId}/template/vNet/{templateId} + description: Delete a specific vNet Template. + DeleteVersionedObject: + method: delete + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/versions/{objectKey} + description: 'Delete a specific version of an object in an object storage (bucket) + + + **Note: ** + + - If no version is specified, we will define how it behaves and update it when necessary. + + ' + DeleteVersionedObjectLagacy: + method: delete + resourcePath: /resources/objectStorage/{objectStorageName}/versions/{objectKey} + description: (To be deprecated) Delete a specific version of an object in an object storage (bucket) + DeleteNodeCommandStatus: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/commandStatus/{index} + description: Delete a specific command status record by index for a node + DeleteNodeCommandStatusByCriteria: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/commandStatus + description: Delete multiple command status records for a node based on filtering criteria + DeleteNodeSshHostKey: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/sshHostKey + description: Reset the stored SSH host key for a specific node. This should be used when the node's host key has legitimately changed (e.g., after node recreation) and you trust the new key. The next SSH connection will store the new host key (TOFU). + DeregisterCustomImage: + method: delete + resourcePath: /ns/{nsId}/deregisterResource/customImage/{customImageId} + description: Deregister customImage from Spider and TB without deleting the actual CSP resource + DeregisterDataDisk: + method: delete + resourcePath: /ns/{nsId}/deregisterResource/dataDisk/{dataDiskId} + description: Deregister Data Disk from Spider and TB without deleting the actual CSP resource + DeregisterInfraNode: + + method: delete + resourcePath: /ns/{nsId}/deregisterResource/infra/{infraId}/node/{nodeId} + description: Deregister VM from Spider and TB without deleting the actual CSP resource + DeregisterSecurityGroup: + method: delete + resourcePath: /ns/{nsId}/deregisterResource/securityGroup/{securityGroupId} + description: Deregister Security Group from Spider and TB without deleting the actual CSP resource + DeregisterSshKey: + method: delete + resourcePath: /ns/{nsId}/deregisterResource/sshKey/{sshKeyId} + description: Deregister SSH Key from Spider and TB without deleting the actual CSP resource + ExistObjectStorageLagacy: + method: head + resourcePath: /resources/objectStorage/{objectStorageName} + description: (To be deprecated) Check existence of an object storage (bucket) + FetchImages: + method: post + resourcePath: /fetchImages + description: 'Fetch images waiting for completion. + + + **Provider Selection Options:** + + - `targetProviders`: Specify exact providers to fetch (e.g., ["aws", "gcp"]). When set, only these providers are processed and `excludedProviders` is ignored. + + - `excludedProviders`: Specify providers to skip (e.g., ["azure"]). Only used when `targetProviders` is not set. + + - `regionAgnosticProviders`: Providers where images are shared across regions (e.g., ["gcp", "tencent"]). Only one region will be fetched per provider. + + + **Note:** `regionAgnosticProviders` should only contain providers that are also in `targetProviders` (or not excluded).' + FetchImagesAsync: + method: post + resourcePath: /fetchImagesAsync + description: 'Fetch images in the background without waiting for completion. + + + **Provider Selection Options:** + + - `targetProviders`: Specify exact providers to fetch (e.g., ["aws", "gcp"]). When set, only these providers are processed and `excludedProviders` is ignored. + + - `excludedProviders`: Specify providers to skip (e.g., ["azure"]). Only used when `targetProviders` is not set. + + - `regionAgnosticProviders`: Providers where images are shared across regions (e.g., ["gcp", "tencent"]). Only one region will be fetched per provider. + + + **Note:** `regionAgnosticProviders` should only contain providers that are also in `targetProviders` (or not excluded).' + FetchPrice: + method: post + resourcePath: /fetchPrice + description: Fetch price from all CSP connections and update the price information for associated specs in the system. + FetchSpecs: + method: post + resourcePath: /fetchSpecs + description: 'Fetch specs from CSPs and register them in the system. + + + **Provider Selection Options:** + + - `targetProviders`: Specify exact providers to fetch (e.g., ["aws", "gcp"]). When set, only these providers are processed and `excludedProviders` is ignored. + + - `excludedProviders`: Specify providers to skip (e.g., ["azure"]). Only used when `targetProviders` is not set. + + - `regionAgnosticProviders`: Providers where specs are shared across regions (e.g., ["gcp", "tencent"]). Only one region will be fetched per provider. + + + **Note:** `regionAgnosticProviders` should only contain providers that are also in `targetProviders` (or not excluded).' + FilterSpecsByRange: + method: post + resourcePath: /ns/{nsId}/resources/filterSpecsByRange + description: Filter specs by range. Use limit field to control the maximum number of results. If limit is 0 or not specified, returns all matching results. + ForwardAnyReqToAny: + method: post + resourcePath: /forward/{path} + description: Forward any (GET) request to CB-Spider + GeneratePresignedDownloadURLLagacy: + method: get + resourcePath: /resources/objectStorage/presigned/download/{objectStorageName}/{objectKey} + description: '(To be deprecated) Generate a presigned URL for downloading an object from a bucket + + + **Important Notes:** + + - The actual response will be XML format with root element `PresignedURLResult` + + - The `expires` query parameter specifies the expiration time in seconds for the presigned URL (default: 3600 seconds) + + - The generated presigned URL can be used to download the object directly without further authentication + + + **Actual XML Response Example:** + + ```xml + + + + + + https://globally-unique-bucket-hctdx3.s3.dualstack.ap-southeast-2.amazonaws.com/test-file.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA***EXAMPLE%2F20250904%2Fap-southeast-2%2Fs3%2Faws4_request&X-Amz-Date=20250904T061448Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=***-signature + + 3600 + + GET + + + + ```' + GeneratePresignedURL: + method: post + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/object/{objectKey}/presignedUrl + description: 'Generate a presigned URL for uploading or downloading an object to an object storage (bucket) + + + **Important Notes:** + + - The generated presigned URL can be used to upload the object directly without further authentication + + - The expiration time is specified in seconds (default: 3600 seconds) + + + **Example Usage: Upload** + + ```bash + + # Using the presigned URL to upload a file + + curl -i -H "Content-Type: text/plain" -X PUT "" --data-binary "@local-file.txt" + + ``` + + + **Example Usage: download** + + ```bash + + # Using the presigned URL to download a file + + curl -X GET "" -o downloaded-file.txt + + ```' + GeneratePresignedUploadURLLagacy: + method: get + resourcePath: /resources/objectStorage/presigned/upload/{objectStorageName}/{objectKey} + description: '(To be deprecated) Generate a presigned URL for uploading an object to a bucket + + + **Important Notes:** + + - The actual response will be XML format with root element `PresignedURLResult` + + - The `expires` query parameter specifies the expiration time in seconds for the presigned URL (default: 3600 seconds) + + - The generated presigned URL can be used to upload the object directly without further authentication + + + **Actual XML Response Example:** + + ```xml + + + + + + https://globally-unique-bucket-hctdx3.s3.dualstack.ap-southeast-2.amazonaws.com/test-file.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA***EXAMPLE%2F20250904%2Fap-southeast-2%2Fs3%2Faws4_request&X-Amz-Date=20250904T061448Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=***-signature + + 3600 + + PUT + + + + ```' + GetAllBenchmark: + method: post + resourcePath: /ns/{nsId}/benchmarkAll/infra/{infraId} + description: Run MCI benchmark for all performance metrics and return results + GetAllConfig: + method: get + resourcePath: /config + description: List all configs + GetAllCustomImage: + method: get + resourcePath: /ns/{nsId}/resources/customImage + description: List all customImages or customImages' ID + GetAllDataDisk: + method: get + resourcePath: /ns/{nsId}/resources/dataDisk + description: List all Data Disks or Data Disks' ID + GetAllImage: + method: get + resourcePath: /ns/{nsId}/resources/image + description: List all images or images' ID + GetAllK8sCluster: + method: get + resourcePath: /ns/{nsId}/k8sCluster + description: List all K8sClusters or K8sClusters' ID + GetAllInfra: + + method: get + resourcePath: /ns/{nsId}/infra + description: List all MCIs or MCIs' ID + GetAllInfraDynamicTemplate: + + method: get + resourcePath: /ns/{nsId}/template/infra + description: 'List all MCI Dynamic Templates in a namespace. + + Optionally filter by keyword matching against template name or description (case-insensitive).' + GetAllInfraPolicy: + + method: get + resourcePath: /ns/{nsId}/policy/infra + description: List all MCI policies + GetAllNLB: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/nlb + description: List all NLBs or NLBs' ID + GetAllNLBInNs: + method: get + resourcePath: /ns/{nsId}/resources/nlb + description: List all NLBs in a namespace (each item carries infraId) + GetAllNs: + method: get + resourcePath: /ns + description: List all namespaces or namespaces' ID + GetAllRequests: + method: get + resourcePath: /requests + description: Get details of all requests with optional filters. + GetAllSecurityGroup: + method: get + resourcePath: /ns/{nsId}/resources/securityGroup + description: List all Security Groups or Security Groups' ID + GetAllSecurityGroupTemplate: + method: get + resourcePath: /ns/{nsId}/template/securityGroup + description: 'List all SecurityGroup Templates in a namespace. + + Optionally filter by keyword matching against template name or description (case-insensitive).' + GetAllSiteToSiteVpn: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/vpn + description: Get all site-to-site VPNs + GetAllSqlDb: + method: get + resourcePath: /ns/{nsId}/resources/sqlDb + description: Get all SQL Databases (TBD) + GetAllSshKey: + method: get + resourcePath: /ns/{nsId}/resources/sshKey + description: List all SSH Keys or SSH Keys' ID + GetAllSubnet: + method: get + resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet + description: List all subnets + GetAllVNet: + method: get + resourcePath: /ns/{nsId}/resources/vNet + description: List all VNets or VNets' ID + GetAllVNetTemplate: + method: get + resourcePath: /ns/{nsId}/template/vNet + description: 'List all vNet Templates in a namespace. + + Optionally filter by keyword matching against template name or description (case-insensitive).' + GetAvailableK8sNodeImage: + method: get + resourcePath: /availableK8sNodeImage + description: (UNDER DEVELOPMENT!!!) Get available kubernetes cluster node image + GetAvailableK8sVersion: + method: get + resourcePath: /availableK8sVersion + description: Get available kubernetes cluster version + GetAvailableRegionZonesForSpec: + method: post + resourcePath: /availableRegionZonesForSpec + description: Query the availability of a specific spec across all regions/zones + GetAvailableRegionZonesForSpecList: + method: post + resourcePath: /availableRegionZonesForSpecList + description: Query the availability for multiple specs in parallel and return batch results + GetAvailableZonesForSpec: + method: get + resourcePath: /availableZonesForSpec + description: Query verified zones for a spec based on connection configs. Returns zones that are both verified and available for the specified spec. For Alibaba Cloud, additional CSP API filtering is applied. + GetBastionNodes: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{targetVmId}/bastion + description: Get bastion nodes for a VM + GetBenchmark: + method: post + resourcePath: /ns/{nsId}/benchmark/infra/{infraId} + description: Run MCI benchmark for a single performance metric and return results + GetCloudInfo: + method: get + resourcePath: /cloudInfo + description: Get cloud information + GetCmdInfraStream: + + method: get + resourcePath: /ns/{nsId}/stream/cmd/infra/{infraId} + description: 'Subscribe to Server-Sent Events (SSE) for real-time command execution logs. + + Use the xRequestId returned from POST /ns/{nsId}/cmd/mci/{mciId}?async=true to connect. + + Events: CommandStatus (status transitions), CommandLog (stdout/stderr lines), CommandDone (terminal).' + GetConfig: + method: get + resourcePath: /config/{configId} + description: Get config + GetConnConfig: + method: get + resourcePath: /connConfig/{connConfigName} + description: Get registered ConnConfig info + GetConnConfigList: + method: get + resourcePath: /connConfig + description: List all registered ConnConfig + FilterConnConfigByCredentialHolder: + method: get + resourcePath: /connConfig + description: Filter connection configs by credential holder name (queryParams.filterCredentialHolder) + GetControlK8sCluster: + method: get + resourcePath: /ns/{nsId}/control/k8sCluster/{k8sClusterId} + description: Control the creation of K8sCluster (continue, withdraw) + GetControlInfra: + + method: get + resourcePath: /ns/{nsId}/control/infra/{infraId} + description: Control the lifecycle of MCI (refine, suspend, resume, reboot, terminate) + GetControlInfraNode: + + method: get + resourcePath: /ns/{nsId}/control/infra/{infraId}/node/{nodeId} + description: Control the lifecycle of VM (suspend, resume, reboot, terminate) + GetCredentialHolder: + method: get + resourcePath: /credentialHolder/{holderId} + description: Get credential holder info derived from registered connection configs. + GetCredentialHolderList: + method: get + resourcePath: /credentialHolder + description: 'List all credential holders derived from registered connection configs. + + Each holder includes associated providers, connection counts, and verification status.' + GetCustomImage: + method: get + resourcePath: /ns/{nsId}/resources/customImage/{customImageId} + description: Get customImage + GetDataDisk: + method: get + resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} + description: Get Data Disk + GetDataObjectInfo: + method: head + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/object/{objectKey} + description: 'Get object info from an object storage (bucket) + + + **Important Notes:** + + - This API retrieves the metadata of an object without downloading the actual content + + - Returns metadata in response headers (Content-Length, Content-Type, ETag, Last-Modified)' + GetDataObjectInfoLagacy: + method: head + resourcePath: /resources/objectStorage/{objectStorageName}/{objectKey} + description: '(To be deprecated) Get an object info from a bucket + + + **Important Notes:** + + - The generated `Download file` link in Swagger UI may not work because this API get the object metadata only.' + GetExecutionTask: + method: get + resourcePath: /ns/{nsId}/cmd/infra/{infraId}/task/{taskId} + description: Get detailed information about a specific execution task by taskId + GetFetchImagesAsyncResult: + method: get + resourcePath: /fetchImagesResult + description: Get detailed results from the last asynchronous image fetch operation + GetGlobalDnsRecord: + method: get + resourcePath: /resources/globalDns/record + description: Get DNS records for a domain from Route53. Includes routing policy and geoproximity info. + GetHostedZones: + method: get + resourcePath: /resources/globalDns/hostedZone + description: List all hosted zones available in Route53 + GetImage: + method: get + resourcePath: /ns/{nsId}/resources/image/{imageId} + description: GetImage returns an image object if there are matched images for the given namespace and imageKey(imageId) + GetK8sCluster: + method: get + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId} + description: Get K8sCluster + GetK8sClusterInfo: + method: get + resourcePath: /k8sClusterInfo + description: Get kubernetes cluster information + GetK8sClusterKubeconfig: + method: get + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/kubeconfig + description: Get a kubeconfig for the specified K8sCluster using CSP-native auth plugins (e.g., aws-iam-authenticator for EKS, gke-gcloud-auth-plugin for GKE). + GetK8sClusterToken: + method: get + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/token + description: 'Get an access token for the specified K8sCluster. + + Only applicable to CSPs that use exec-based authentication (e.g., GCP GKE, AWS EKS).' + GetLabels: + method: get + resourcePath: /label/{labelType}/{uid} + description: Get labels for a resource identified by its uid + GetLatencyBenchmark: + method: get + resourcePath: /ns/{nsId}/benchmarkLatency/infra/{infraId} + description: Run MCI benchmark for network latency + GetInfra: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId} + description: 'Get MCI object (option: status, accessInfo, vmId)' + GetInfraAssociatedResources: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/associatedResources + description: Get associated resource ID list for a given MCI (VNet, Subnet, SecurityGroup, SSHKey, etc.) + GetInfraDynamicTemplate: + + method: get + resourcePath: /ns/{nsId}/template/infra/{templateId} + description: Retrieve a specific MCI Dynamic Template by ID. + GetInfraExecutionTasks: + + method: get + resourcePath: /ns/{nsId}/cmd/infra/{infraId}/task + description: List all running and completed execution tasks for a specific MCI. These tasks can be cancelled if still in progress. The task list is based on persistent VM command status records. + GetInfraGroupIds: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/nodegroup + description: List SubGroup IDs in a specified MCI + GetInfraGroupNodes: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/nodegroup/{nodegroupId} + description: List VMs with a SubGroup label in a specified MCI + GetInfraHandlingCommandCount: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/handlingCount + description: Get the number of commands currently in 'Handling' status for all VMs in an MCI. Returns per-VM counts and total count. + GetInfraPolicy: + + method: get + resourcePath: /ns/{nsId}/policy/infra/{infraId} + description: Get MCI Policy + GetInfraReqFromInfra: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/configCopy + description: 'Reconstruct an MCI dynamic creation request body from an existing MCI''s information. + + Returns a dynamic request format where networking resources (vNet, subnet, SG, sshKey) + + are auto-created, making it easy to clone or recreate a similar MCI configuration. + + + **Template Option:** + + When the `template` query parameter is provided, the extracted configuration is + + saved as a reusable MCI Dynamic Template with the given name.' + GetInfraNode: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId} + description: Get VM in specified MCI + GetMonitorData: + method: get + resourcePath: /ns/{nsId}/monitoring/infra/{infraId}/metric/{metric} + description: Get monitoring data of specified MCI for specified monitoring metric (cpu, memory, disk, network) + GetNLB: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId} + description: Get NLB + GetNLBHealth: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId}/healthz + description: Get NLB Health + GetNLBSupport: + method: get + resourcePath: /nlb/support + description: Get per-CSP support for custom NLB health checker fields + GetNodeDataDisk: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/dataDisk + description: Get available dataDisks for a Node + GetNs: + method: get + resourcePath: /ns/{nsId} + description: Get namespace + GetObject: + method: get + resourcePath: /object + description: Get value of an object + GetObjectStorage: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId} + description: Get details of an object storage (bucket) + GetObjectStorageCORS: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/cors + description: Get CORS configuration of an object storage (bucket) + GetObjectStorageCORSLagacy: + method: get + resourcePath: /resources/objectStorage/{objectStorageName}/cors + description: '(To be deprecated) Get CORS configuration of an object storage (bucket) + + + **Important Notes:** + + - The actual response will be XML format with root element `CORSConfiguration` + + + **Actual XML Response Example:** + + ```xml + + + + + + + + * + + GET + + PUT + + POST + + DELETE + + * + + ETag + + x-amz-server-side-encryption + + x-amz-request-id + + x-amz-id-2 + + 3000 + + + + + + ``` + + + **Error Response Example (if CORS not configured):** + + ```xml + + + + + + NoSuchCORSConfiguration + + The CORS configuration does not exist + + /example-bucket + + 656c76696e6727732072657175657374 + + + + ```' + GetObjectStorageLagacy: + method: get + resourcePath: /resources/objectStorage/{objectStorageName} + description: '(To be deprecated) Get details of an object storage (bucket) + + + **Important Notes:** + + - The actual response will be XML format with root element `ListBucketResult` + + + **Actual XML Response Example:** + + ```xml + + + + + + spider-test-bucket + + + + + + 1000 + + false + + + + ```' + GetObjectStorageLocation: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/location + description: Get the location of an object storage (bucket) + GetObjectStorageLocationLagacy: + method: get + resourcePath: /resources/objectStorage/{objectStorageName}/location + description: '(To be deprecated) Get the location of an object storage (bucket) + + + **Important Notes:** + + - The actual response will be XML format with root element `LocationConstraint` + + + **Actual XML Response Example:** + + ```xml + + + + ap-northeast-2 + + ```' + GetObjectStorageSupport: + method: get + resourcePath: /objectStorage/support + description: 'Get CSP support information for object storage features (CORS, Versioning) + + If cspType query parameter is provided, returns support information for that specific CSP + + If cspType is not provided, returns support information for all CSPs' + GetObjectStorageVersioning: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/versioning + description: Get versioning configuration of an object storage (bucket) + GetObjectStorageVersioningLagacy: + method: get + resourcePath: /resources/objectStorage/{objectStorageName}/versioning + description: '(To be deprecated) Get versioning status of an object storage (bucket) + + + **Important Notes:** + + - The actual response will be XML format with root element `VersioningConfiguration` + + + **Actual XML Response Example:** + + ```xml + + + + + + Enabled + + + + ```' + GetObjects: + method: get + resourcePath: /objects + description: List all objects for a given key + GetProviderList: + method: get + resourcePath: /provider + description: List all registered Providers + GetProvisioningLog: + method: get + resourcePath: /provisioning/log/{specId} + description: 'Retrieve detailed provisioning history for a specific VM specification including success/failure patterns and risk analysis. + + This endpoint provides comprehensive insights into provisioning reliability: + + + **Historical Data Includes:** + + - Success and failure counts with timestamps + + - CSP-specific error messages and failure patterns + + - Image compatibility tracking across different attempts + + - Failure rate analysis and risk assessment + + - Regional and provider-specific reliability metrics + + + **Use Cases:** + + - **Pre-deployment Risk Assessment**: Check if a spec has historical failures before creating MCI + + - **Troubleshooting**: Analyze failure patterns to identify root causes + + - **Capacity Planning**: Understand reliability patterns for different specs and regions + + - **Cost Optimization**: Avoid specs with high failure rates that waste resources + + + **Response Details:** + + - `failureCount`: Total number of provisioning failures + + - `successCount`: Number of successes (only tracked after failures occur) + + - `failureImages`: List of CSP images that failed with this spec + + - `successImages`: List of CSP images that succeeded with this spec + + - `failureMessages`: Detailed error messages from CSP + + - `lastUpdated`: Timestamp of most recent provisioning attempt' + GetPublicKeyForCredentialEncryption: + method: get + resourcePath: /credential/publicKey + description: Generates an RSA key pair using a 4096-bit key size with the RSA algorithm. The public key is generated using the RSA algorithm with OAEP padding and SHA-256 as the hash function. This key is used to encrypt an AES key that will be used for hybrid encryption of credentials. + GetReadyz: + method: get + resourcePath: /readyz + description: Check Tumblebug is ready. Returns ready status and initialization status. + GetRegion: + method: get + resourcePath: /provider/{providerName}/region/{regionName} + description: Get registered region info + GetRegions: + method: get + resourcePath: /provider/{providerName}/region + description: Get registered region info + GetRequest: + method: get + resourcePath: /request/{reqId} + description: Get details of a specific request + GetRequestStatusOfSiteToSiteVpn: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/vpn/{vpnId}/request/{requestId} + description: Check the status of a specific request by its ID + GetRequiredK8sSubnetCount: + method: get + resourcePath: /requiredK8sSubnetCount + description: Get the required subnet count to create a K8sCluster + GetResourcesByLabelSelector: + method: get + resourcePath: /resources/{labelType} + description: 'Get resources based on a label selector. The label selector supports the following operators: + + - `=` : Selects resources where the label key equals the specified value (e.g., `env=production`). + + - `!=` : Selects resources where the label key does not equal the specified value (e.g., `tier!=frontend`). + + - `in` : Selects resources where the label key is in the specified set of values (e.g., `region in (us-west, us-east)`). + + - `notin` : Selects resources where the label key is not in the specified set of values (e.g., `env notin (production, staging)`). + + - `exists` : Selects resources where the label key exists (e.g., `env exists`). + + - `!exists` : Selects resources where the label key does not exist (e.g., `env !exists`).' + GetScheduleRegisterCspResourcesList: + method: get + resourcePath: /registerCspResources/schedule + description: Get a list of all scheduled CSP resource registration jobs (jobs are not scoped to namespaces) + GetScheduleRegisterCspResourcesStatus: + method: get + resourcePath: /registerCspResources/schedule/{jobId} + description: 'Get the current status of a specific scheduled CSP resource registration job + + + **Response Fields Explanation:** + + - `status`: Current job state (Scheduled/Executing/Stopped) + + - `enabled`: Whether job is active (can be paused with false) + + - `executionCount`: Total number of executions attempted + + - `successCount`: Number of successful executions + + - `failureCount`: Number of failed executions + + - `consecutiveFailures`: Current streak of failures (resets on success) + + - `autoDisabled`: True if job was auto-disabled due to 5+ consecutive failures + + - `lastExecutedAt`: Timestamp of most recent execution + + - `nextExecutionAt`: Scheduled time for next execution + + - `lastError`: Error message from most recent failure (empty if success) + + - `lastResult`: Result message from most recent execution + + + **Monitoring Recommendations:** + + - Check `consecutiveFailures` - alert if >= 3 + + - Monitor `autoDisabled` - requires manual intervention if true + + - Compare `successCount` vs `failureCount` for reliability metrics' + GetSecurityGroup: + method: get + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId} + description: Get Security Group + GetSecurityGroupTemplate: + method: get + resourcePath: /ns/{nsId}/template/securityGroup/{templateId} + description: Retrieve a specific SecurityGroup Template by ID. + GetSiteToSiteVpn: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/vpn/{vpnId} + description: Get resource info of a site-to-site VPN + GetSitesInInfra: + + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/site + description: Get sites in MCI + GetSpec: + method: get + resourcePath: /ns/{nsId}/resources/spec/{specId} + description: Get spec + GetSqlDb: + method: get + resourcePath: /ns/{nsId}/resources/sqlDb/{sqlDbId} + description: Get resource info of a SQL datatbase + GetSshKey: + method: get + resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} + description: Get SSH Key + GetSubnet: + method: get + resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet/{subnetId} + description: Get Subnet + GetSystemLabelInfo: + method: get + resourcePath: /labelInfo + description: Return LabelTypes and system defined label keys with example + GetVNet: + method: get + resourcePath: /ns/{nsId}/resources/vNet/{vNetId} + description: Get VNet + GetVNetTemplate: + method: get + resourcePath: /ns/{nsId}/template/vNet/{templateId} + description: Retrieve a specific vNet Template by ID. + GetNodeCommandStatus: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/commandStatus/{index} + description: Get a specific command status record by index for a node + GetNodeHandlingCommandCount: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/handlingCount + description: Get the number of commands currently in 'Handling' status for a specific node. Optimized for frequent polling. + GetNodeSshHostKey: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/sshHostKey + description: Get the stored SSH host key information for a specific node. This is used for TOFU (Trust On First Use) verification. + InitAllConfig: + method: delete + resourcePath: /config + description: Init all configs + InitConfig: + method: delete + resourcePath: /config/{configId} + description: Init config + InspectResources: + method: post + resourcePath: /inspectResources + description: Inspect Resources (vNet, securityGroup, sshKey, vm) registered in CB-Tumblebug, CB-Spider, CSP + InspectResourcesOverview: + method: get + resourcePath: /inspectResourcesOverview + description: Inspect Resources Overview (vNet, securityGroup, sshKey, vm) registered in CB-Tumblebug and CSP for all connections + ListDataObjects: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/object + description: List all objects in an object storage (bucket) + ListObjectStorages: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage + description: Get the list of object storages (buckets) + ListObjectStoragesLagacy: + method: get + resourcePath: /resources/objectStorage + description: '(To be deprecated) Get the list of all object storages (buckets) + + + **Important Notes:** + + - The actual response will be XML format with root element `ListAllMyBucketsResult` + + - The response includes xmlns attribute: `xmlns="http://s3.amazonaws.com/doc/2006-03-01/"` + + - Swagger UI may show `resource.ListAllMyBucketsResult` due to rendering limitations + + + **Actual XML Response Example:** + + ```xml + + + + + + + + aws-ap-northeast-2 + + aws-ap-northeast-2 + + + + + + + + + + ```' + ListObjectVersions: + method: get + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/versions + description: List all versions of objects in an object storage (bucket) + ListObjectVersionsLagacy: + method: get + resourcePath: /resources/objectStorage/{objectStorageName}/versions + description: '(To be deprecated) List object versions in an object storage (bucket) + + + **Important Notes:** + + - The actual response will be XML format with root element `ListVersionsResult` + + + **Actual XML Response Example:** + + ```xml + + + + + + spider-test-bucket + + + + + + + + + + + + 1000 + + false + + + + test-file.txt + + yb4PgjnFVD2LfRZHXBjjsHBkQRHlu.TZ + + true + + 2025-09-04T04:24:12Z + + 23228a38faecd0591107818c7281cece + + 23 + + STANDARD + + + + aws-config01 + + aws-config01 + + + + + + + + ```' + ListNodeCommandStatus: + method: get + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/commandStatus + description: List command status records for a node with various filtering options + GetAssetsSummary: + method: get + resourcePath: /assetsSummary + description: "Returns CSP-wise summary of specs and images in DB for a namespace, + including priced/unpriced spec counts. (CB-TB v0.12.6+). Used by FR-006-08 + Setup Status > loadAssets card. query: nsId (default=system)." + LoadAssets: + method: get + resourcePath: /loadAssets + description: Load Common Resources from internal asset files (Spec, Image). By default, Azure images are excluded for faster initialization. Use includeAzure=true to fetch Azure images (may take 40+ minutes). + LookupImage: + method: post + resourcePath: /lookupImage + description: Lookup image (for debugging purposes) + LookupImageList: + method: post + resourcePath: /lookupImages + description: Lookup image list (for debugging purposes) + LookupSpec: + method: post + resourcePath: /lookupSpec + description: Lookup spec (for debugging purposes) + LookupSpecList: + method: post + resourcePath: /lookupSpecs + description: Lookup spec list (for debugging purposes) + MergeCSPResourceLabel: + method: put + resourcePath: /mergeCSPLabel/{labelType}/{uid} + description: Fetch the labels in the CSP and merge them with the existing labels + PostBuildAgnosticImage: + method: post + resourcePath: /ns/{nsId}/buildAgnosticImage + description: Creates an MCI infrastructure, executes post-deployment commands, creates snapshots from each subgroup, and optionally cleans up the MCI. This is a complete workflow for building CSP-agnostic custom images. + PostCmdInfra: + + method: post + resourcePath: /ns/{nsId}/cmd/infra/{infraId} + description: 'Send a command to specified MCI. Use query parameters to target specific subGroup or VM. + + When async=true, returns immediately with xRequestId and streams results via SSE at GET /stream/ns/{nsId}/cmd/mci/{mciId}?xRequestId={xRequestId}' + PostConfig: + method: post + resourcePath: /config + description: Create or Update config (TB_SPIDER_REST_URL, TB_DRAGONFLY_REST_URL, ...) + PostCustomImage: + method: post + resourcePath: /ns/{nsId}/resources/customImage + description: Register existing Custom Image in a CSP (option=register) + PostDataDisk: + method: post + resourcePath: /ns/{nsId}/resources/dataDisk + description: Create Data Disk + PostDownloadFileFromInfraNode: + + method: post + resourcePath: /ns/{nsId}/downloadFile/infra/{infraId}/node/{nodeId} + description: 'Download a file from a specific VM in MCI via SCP through bastion host. + + The file size should be less than 200MB.' + PostFileToInfra: + + method: post + resourcePath: /ns/{nsId}/transferFile/infra/{infraId} + description: 'Transfer a file to specified MCI to the specified path. + + The file size should be less than 10MB. + + Not for gerneral file transfer but for specific purpose (small configuration files).' + PostFirewallRules: + method: post + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId}/rules + description: 'Add new FirewallRules: Add the provided firewall rules to the existing rules in the Security Group. + + This API will only add new rules without deleting or modifying existing ones. + + If a rule with identical properties already exists, it will be skipped to avoid duplicates. + + + Usage: + + Use this API to add new firewall rules to a Security Group while preserving existing rules. + + - Only new rules that don''t already exist will be added. + + - Existing rules remain unchanged. + + - If an identical rule already exists, it will be skipped. + + + Notes: + + - "Ports" field supports single port ("22"), port range ("80-100"), and multiple ports/ranges ("22,80-100,443"). + + - The valid port number range is 0 to 65535 (inclusive). + + - "Protocol" can be TCP, UDP, ICMP, ALL, etc. (as supported by the cloud provider). + + - "Direction" must be either "inbound" or "outbound". + + - "CIDR" is the allowed IP range.' + PostImage: + method: post + resourcePath: /ns/{nsId}/resources/image + description: Register image + PostInstallBenchmarkAgentToInfra: + + method: post + resourcePath: /ns/{nsId}/installBenchmarkAgent/infra/{infraId} + description: Install the benchmark agent to specified MCI + PostInstallMonitorAgentToInfra: + + method: post + resourcePath: /ns/{nsId}/monitoring/install/infra/{infraId} + description: Install monitoring agent (CB-Dragonfly agent) to MCI + PostK8sCluster: + method: post + resourcePath: /ns/{nsId}/k8sCluster + description: Create K8sCluster
Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1614 + PostK8sClusterDynamic: + method: post + resourcePath: /ns/{nsId}/k8sClusterDynamic + description: Create K8sCluster Dynamically from common spec and image + PostK8sClusterDynamicCheckRequest: + method: post + resourcePath: /k8sClusterDynamicCheckRequest + description: Check available ConnectionConfig list before create K8sCluster Dynamically from common spec and image + PostK8sMultiClusterDynamic: + method: post + resourcePath: /ns/{nsId}/k8sMultiClusterDynamic + description: '(PoC API. For developers only, and do not use in production.) + + Create multiple K8sClusters in parallel from common spec and image. + + If namePrefix is provided, cluster names will be auto-generated as ''{namePrefix}-{csp}-{number}'' (e.g., ''across-aws-1'', ''across-alibaba-2''). + + + If namePrefix is not provided, each cluster must have a name specified. + + + **Example request body:** + + ```json + + { + + "namePrefix": "across", + + "clusters": [ + + { + + "imageId": "default", + + "specId": "aws+eu-west-2+t3a.xlarge" + + }, + + { + + "nodeGroupName": "ng-1", + + "imageId": "default", + + "specId": "azure+germanywestcentral+standard_b4ms" + + }, + + { + + "nodeGroupName": "ng-1", + + "imageId": "https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/images/ubuntu-minimal-2204-jammy-v20251120", + + "specId": "gcp+europe-west9+e2-highmem-4" + + } + + ] + + } + + ```' + PostK8sNodeGroup: + method: post + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup + description: Add a K8sNodeGroup + PostK8sNodeGroupDynamic: + method: post + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroupDynamic + description: Create K8sNodeGroup Dynamically from common spec and image + PostMcNLB: + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/mcSwNlb + description: Create a special purpose MCI for NLB and depoly and setting SW NLB + PostInfra: + + method: post + resourcePath: /ns/{nsId}/infra + description: 'Create MCI with detailed VM specifications and resource configuration. + + This endpoint creates a complete multi-cloud infrastructure by: + + 1. **VM Provisioning**: Creates VMs across multiple cloud providers using predefined specs and images + + 2. **Resource Management**: Automatically handles VPC/VNet, security groups, SSH keys, and network configuration + + 3. **Status Tracking**: Monitors VM creation progress and handles failures based on policy settings + + 4. **Post-Deployment**: Optionally installs monitoring agents and executes custom commands + + + **Key Features:** + + - Multi-cloud VM deployment with heterogeneous configurations + + - Automatic resource dependency management (VPC → Security Group → VM) + + - Built-in failure handling with configurable policies (continue/rollback/refine) + + - Optional CB-Dragonfly monitoring agent installation + + - Post-deployment command execution support + + - Real-time status updates and progress tracking + + + **VM Lifecycle:** + + 1. Creating → Running (successful deployment) + + 2. Creating → Failed (deployment error, handled by failure policy) + + 3. Running → Terminated (manual or policy-driven cleanup) + + + **Failure Policies:** + + - `continue`: Keep successful VMs, mark failed ones for later refinement + + - `rollback`: Delete entire MCI if any VM fails (all-or-nothing) + + - `refine`: Automatically clean up failed VMs, keep successful ones + + + **Resource Requirements:** + + - Valid VM specifications (must exist in system namespace) + + - Valid images (must be available in target CSP regions) + + - Sufficient CSP quotas and permissions + + - Network connectivity between components' + PostInfraDynamic: + + method: post + resourcePath: /ns/{nsId}/infraDynamic + description: 'Create multi-cloud infrastructure dynamically using common specifications and images with automatic resource discovery and optimization. + + This is the **recommended approach** for MCI creation, providing simplified configuration with powerful automation: + + + **Dynamic Resource Creation:** + + 1. **Automatic Resource Discovery**: Validates and selects optimal VM specifications and images from common namespace + + 2. **Intelligent Network Setup**: Creates VNets, subnets, security groups, and SSH keys automatically per provider + + 3. **Cross-Cloud Orchestration**: Coordinates VM provisioning across multiple cloud providers simultaneously + + 4. **Dependency Management**: Handles resource creation order and inter-dependencies automatically + + 5. **Failure Recovery**: Implements configurable failure policies for robust deployment + + + **Key Advantages Over Static MCI:** + + - **Simplified Configuration**: Use common spec/image IDs instead of provider-specific resources + + - **Automatic Resource Management**: No need to pre-create VNets, security groups, or SSH keys + + - **Multi-Cloud Optimization**: Intelligent placement and configuration across providers + + - **Built-in Best Practices**: Security groups, network isolation, and access controls applied automatically + + - **Scalable Architecture**: Supports large-scale deployments with optimized resource utilization + + + **Configuration Process:** + + 1. **Resource Discovery**: Use `/recommendSpec` to find suitable VM specifications + + 2. **Image Selection**: Use system namespace to discover compatible images + + 3. **Request Validation**: Use `/mciDynamicCheckRequest` to validate configuration before deployment + + 4. **Optional Preview**: Use `/mciDynamicReview` to estimate costs and review configuration + + 5. **Deployment**: Submit MCI dynamic request with failure policy and deployment options + + + **Failure Policies (PolicyOnPartialFailure):** + + - **`continue`** (default): Create MCI with successful VMs, failed VMs remain for manual refinement + + - **`rollback`**: Delete entire MCI if any VM fails (all-or-nothing deployment) + + - **`refine`**: Automatically clean up failed VMs, keep successful ones (recommended for large deployments) + + + **Deployment Options:** + + - **`hold`**: Create MCI object but hold VM provisioning for manual approval + + - **Normal**: Proceed with immediate VM provisioning after resource creation + + + **Multi-Cloud Example Configuration:** + + ```json + + { + + "name": "multi-cloud-web-tier", + + "description": "Web application across AWS, Azure, and GCP", + + "policyOnPartialFailure": "refine", + + "vm": [ + + { + + "name": "aws-web-servers", + + "subGroupSize": "3", + + "specId": "aws+us-east-1+t3.medium", + + "imageId": "ami-0abcdef1234567890", + + "rootDiskSize": "100", + + "label": {"tier": "web", "provider": "aws"} + + }, + + { + + "name": "azure-api-servers", + + "subGroupSize": "2", + + "specId": "azure+eastus+Standard_B2s", + + "imageId": "Canonical:0001-com-ubuntu-server-jammy:22_04-lts", + + "label": {"tier": "api", "provider": "azure"} + + } + + ] + + } + + ``` + + + **Performance Considerations:** + + - VM provisioning occurs in parallel across providers + + - Network resources are created concurrently where possible + + - Large deployments (>10 VMs) automatically use optimized batching + + - Built-in rate limiting prevents CSP API throttling + + + **Monitoring and Post-Deployment:** + + - Optional CB-Dragonfly monitoring agent installation + + - Custom post-deployment command execution + + - Real-time status tracking and progress updates + + - Automatic resource labeling and metadata management' + PostInfraDynamicCheckRequest: + + method: post + resourcePath: /infraDynamicCheckRequest + description: '**⚠️ DEPRECATED: This endpoint is deprecated and will be removed in a future version. Please use `/mciDynamicReview` instead for comprehensive validation and cost estimation.** + + + Validate resource availability and discover optimal connection configurations before creating MCI dynamically. + + This endpoint provides comprehensive resource validation and connection discovery for MCI planning: + + + **Resource Validation Process:** + + 1. **Specification Analysis**: Validates that requested common specs exist and are accessible + + 2. **Provider Discovery**: Identifies available cloud providers and regions for each specification + + 3. **Connectivity Assessment**: Tests connection configurations and CSP API accessibility + + 4. **Quota Verification**: Checks available quotas and resource limits where possible + + 5. **Compatibility Matrix**: Generates matrix of viable spec-provider-region combinations + + + **Connection Configuration Discovery:** + + - **Available Providers**: Lists all configured cloud providers (AWS, Azure, GCP, etc.) + + - **Active Regions**: Shows available regions per provider with connectivity status + + - **Specification Mapping**: Maps common specs to provider-specific instance types + + - **Image Compatibility**: Validates image availability across different providers/regions + + - **Network Capabilities**: Identifies supported network features and configurations + + + **Pre-Deployment Validation:** + + - **Resource Existence**: Confirms all specified resources exist in system namespace + + - **Permission Verification**: Validates CSP credentials and required permissions + + - **API Connectivity**: Tests connection to CSP APIs and service endpoints + + - **Dependency Resolution**: Identifies any missing dependencies or prerequisites + + + **Optimization Recommendations:** + + - **Cost-Effective Regions**: Suggests regions with lower pricing for specified resources + + - **Performance Optimization**: Recommends regions with better network performance + + - **Availability Zone**: Identifies optimal AZ distribution for high availability + + - **Resource Bundling**: Suggests efficient resource combinations and groupings + + + **Output Information:** + + - **Connection Candidates**: List of viable connection configurations + + - **Provider Capabilities**: Detailed capabilities matrix per provider + + - **Resource Status**: Real-time availability status for each requested resource + + - **Recommendation Summary**: Actionable recommendations for optimal deployment + + + **Use Cases:** + + - Pre-validate MCI configuration before expensive deployment operations + + - Discover optimal provider/region combinations for cost or performance + + - Troubleshoot resource availability issues during MCI planning + + - Generate connection configuration templates for standardized deployments + + - Assess infrastructure capacity and planning constraints + + + **Integration Workflow:** + + 1. Use this endpoint to validate and discover connection options + + 2. Review recommendations and adjust specifications if needed + + 3. Use `/mciDynamicReview` for detailed cost estimation and final validation + + 4. Proceed with `/mciDynamic` using validated configuration' + PostInfraDynamicFromTemplate: + + method: post + resourcePath: /ns/{nsId}/infra/template/{templateId} + description: 'Create a new MCI by applying an MCI Dynamic Template. + + The template provides the base VM configuration, and the apply request + + allows overriding the MCI name and description. + + + **Override Behavior (Phase 1):** + + - `name` (required): Name for the new MCI + + - `description` (optional): Overrides the template''s description + + - All other configuration (specs, images, subgroups) comes from the template' + PostInfraDynamicReview: + + method: post + resourcePath: /ns/{nsId}/infraDynamicReview + description: 'Review and validate MCI dynamic request comprehensively before actual provisioning. + + This endpoint performs comprehensive validation of MCI dynamic creation requests without actually creating resources. + + It checks resource availability, validates specifications and images, estimates costs, and provides detailed recommendations. + + + **Key Features:** + + - Validates all VM specifications and images against CSP availability + + - Provides cost estimation (including partial estimates when some costs are unknown) + + - Identifies potential configuration issues and warnings + + - Recommends optimization strategies + + - Shows provider and region distribution + + - Non-invasive validation (no resources are created) + + + **Review Status:** + + - `Ready`: All VMs can be created successfully + + - `Warning`: VMs can be created but with configuration warnings + + - `Error`: Critical errors prevent MCI creation + + + **Use Cases:** + + - Pre-validation before expensive MCI creation + + - Cost estimation and planning + + - Configuration optimization + + - Multi-cloud resource planning' + PostInfraDynamicNodeGroupNodeReview: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/nodeGroupDynamicReview + description: 'Review and validate a VM dynamic addition request for an existing MCI before actual provisioning. + + This endpoint provides comprehensive validation for adding new VMs to existing MCIs without actually creating resources. + + It checks resource availability, validates specifications and images, estimates costs, and provides detailed recommendations. + + + **Key Features:** + + - Validates VM specification and image against CSP availability + + - Checks compatibility with existing MCI configuration + + - Provides cost estimation for the new VM addition + + - Identifies potential configuration issues and warnings + + - Recommends optimization strategies + + - Non-invasive validation (no resources are created) + + + **Review Status:** + + - `Ready`: VM can be added successfully + + - `Warning`: VM can be added but with configuration warnings + + - `Error`: Critical errors prevent VM addition + + + **MCI Integration Validation:** + + - Ensures target MCI exists and is in a compatible state + + - Validates network integration possibilities + + - Checks resource naming conflicts + + - Verifies security group and SSH key compatibility + + + **Use Cases:** + + - Pre-validation before expensive VM addition operations + + - Cost estimation for scaling decisions + + - Configuration optimization before deployment + + - Risk assessment for VM addition to existing infrastructure' + PostInfraDynamicTemplate: + + method: post + resourcePath: /ns/{nsId}/template/infra + description: 'Create a reusable MCI Dynamic Template. Templates store MCI dynamic creation + + request configurations that can be applied later to create MCIs with consistent settings. + + + **Template Contents:** + + - VM specifications (specId, imageId) for each subgroup + + - Subgroup sizing and naming + + - Network and disk configuration + + - Post-deployment commands + + - Monitoring agent options + + + Templates can be created manually or extracted from existing MCIs.' + PostInfraPolicy: + + method: post + resourcePath: /ns/{nsId}/policy/infra/{infraId} + description: Create MCI Automation policy + PostInfraSnapshot: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/snapshot + description: Create snapshots for the first running VM in each subgroup of an MCI in parallel + PostInfraNodeGroupDynamic: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/nodeGroupDynamic + description: 'Dynamically add new virtual machines to an existing MCI using common specifications and automated resource management. + + This endpoint provides elastic scaling capabilities for running MCIs: + + + **Dynamic VM Addition Process:** + + 1. **MCI Validation**: Verifies target MCI exists and is in a valid state for expansion + + 2. **Resource Discovery**: Resolves common spec and image to provider-specific resources + + 3. **Network Integration**: Automatically configures new VMs to use existing MCI network resources + + 4. **Subgroup Management**: Creates new subgroups or expands existing ones based on configuration + + 5. **Status Synchronization**: Updates MCI status and metadata to reflect new VM additions + + + **Integration with Existing Infrastructure:** + + - **Network Reuse**: New VMs automatically join existing VNets and security groups + + - **SSH Key Sharing**: Uses existing SSH keys for consistent access management + + - **Monitoring Integration**: New VMs inherit monitoring configuration from parent MCI + + - **Label Propagation**: Applies MCI-level labels and policies to new VMs + + - **Resource Consistency**: Maintains naming conventions and resource organization + + + **Scaling Scenarios:** + + - **Horizontal Scaling**: Add more instances to handle increased workload + + - **Multi-Region Expansion**: Deploy VMs in new regions while maintaining MCI cohesion + + - **Provider Diversification**: Add VMs from different cloud providers for redundancy + + - **Workload Specialization**: Deploy VMs with different specifications for specific tasks + + + **Configuration Requirements:** + + - `specId`: Must specify valid VM specification from system namespace + + - `imageId`: Must specify valid image compatible with target provider/region + + - `name`: Becomes subgroup name; VMs will be named with sequential suffixes + + - `subGroupSize`: Number of identical VMs to create (default: 1) + + + **Network and Security:** + + - New VMs automatically inherit security group rules from existing MCI + + - Network connectivity to existing VMs is established automatically + + - Firewall rules and access policies are applied consistently + + - SSH access is configured using existing key pairs + + + **Example Use Cases:** + + - Scale out web tier during traffic spikes + + - Add GPU instances for machine learning workloads + + - Deploy edge nodes in additional geographic regions + + - Add specialized storage or database nodes to existing application stack + + + **Post-Addition Operations:** + + - New VMs are immediately available for standard MCI operations + + - Can be individually managed or grouped with existing subgroups + + - Monitoring and logging are automatically configured + + - Application deployment and configuration management can proceed immediately' + PostInfraNodeGroupScaleOut: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/nodegroup/{nodegroupId} + description: 'Horizontally scale an existing VM subgroup by adding more identical instances for increased capacity. + + This endpoint provides elastic scaling capabilities for running application tiers: + + + **Scale-Out Process:** + + 1. **SubGroup Validation**: Verifies target subgroup exists and is in scalable state + + 2. **Template Replication**: Uses existing VM configuration as template for new instances + + 3. **Resource Allocation**: Ensures sufficient CSP quotas and network resources + + 4. **Parallel Deployment**: Deploys multiple new VMs simultaneously for faster scaling + + 5. **Integration**: Seamlessly integrates new VMs into existing subgroup and MCI + + + **Configuration Inheritance:** + + - **VM Specifications**: New VMs inherit exact specifications from existing subgroup members + + - **Network Settings**: Automatically placed in same VNet, subnet, and security groups + + - **SSH Keys**: Use same SSH key pairs for consistent access management + + - **Monitoring**: Inherit monitoring agent configuration and policies + + - **Labels and Metadata**: Propagate all labels and metadata from parent subgroup + + + **Scaling Scenarios:** + + - **Traffic Spikes**: Quickly add capacity during high-demand periods + + - **Seasonal Scaling**: Scale out for predictable demand increases + + - **Performance Optimization**: Add instances to reduce per-VM resource utilization + + - **Geographic Expansion**: Scale existing workloads to handle broader user base + + - **Fault Tolerance**: Increase redundancy by adding more instances + + + **Intelligent Scaling:** + + - **Sequential Naming**: New VMs follow established naming pattern (e.g., web-4, web-5, web-6) + + - **Load Distribution**: New VMs are distributed optimally across availability zones + + - **Resource Efficiency**: Reuses existing network and security infrastructure + + - **Minimal Disruption**: Scaling occurs without affecting existing VM operations + + - **Consistent Configuration**: Ensures all VMs in subgroup remain homogeneous + + + **Operational Benefits:** + + - **Zero Downtime**: Existing VMs continue running during scale-out operation + + - **Immediate Availability**: New VMs are ready for traffic as soon as deployment completes + + - **Unified Management**: All VMs (old and new) managed through single subgroup + + - **Policy Consistency**: All scaling and management policies apply uniformly + + - **Monitoring Integration**: New VMs automatically included in existing monitoring dashboards + + + **Scale-Out Considerations:** + + - **CSP Quotas**: Verifies sufficient instance, network, and storage quotas + + - **Region Capacity**: Ensures target region has capacity for requested instance types + + - **Network Limits**: Validates that VNet can accommodate additional VMs + + - **Cost Impact**: Additional VMs incur proportional CSP billing costs + + - **Application Readiness**: Applications should be designed to handle additional instances + + + **Post-Scale Operations:** + + - New VMs immediately participate in subgroup operations + + - Can be individually managed while maintaining subgroup membership + + - Support for further scaling operations (scale-out or scale-in) + + - Ready for application deployment and load balancer integration + + + **Best Practices:** + + - Monitor application performance before and after scaling + + - Ensure load balancers are configured to include new instances + + - Verify application clustering and session management handle new instances + + - Consider database connection limits and other resource constraints' + PostInfraNode: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/node + description: 'Create and add a group of identical virtual machines (subgroup) to an existing MCI using detailed specifications. + + This endpoint provides precise control over VM configuration and placement within existing infrastructure: + + + **SubGroup Creation Process:** + + 1. **MCI Integration**: Validates target MCI exists and can accommodate new VMs + + 2. **Resource Validation**: Verifies all specified resources (specs, images, networks) exist and are accessible + + 3. **Homogeneous Deployment**: Creates multiple identical VMs with consistent configuration + + 4. **Network Integration**: Integrates new VMs with existing MCI networking and security policies + + 5. **Group Management**: Establishes subgroup for collective management and operations + + + **Detailed Configuration Control:** + + - **Specific Resource References**: Uses exact resource IDs rather than common specifications + + - **Network Placement**: Precise control over VNet, subnet, and security group assignment + + - **Storage Configuration**: Detailed disk configuration including type, size, and performance tiers + + - **Instance Customization**: Full control over VM specifications, images, and metadata + + - **Security Settings**: Explicit security group and SSH key configuration + + + **SubGroup Benefits:** + + - **Collective Operations**: Perform operations on entire subgroup simultaneously + + - **Homogeneous Scaling**: All VMs in subgroup share identical configuration + + - **Simplified Management**: Single configuration template for multiple VMs + + - **Consistent Naming**: Automatic sequential naming (e.g., web-1, web-2, web-3) + + - **Group Policies**: Apply scaling, monitoring, and lifecycle policies at subgroup level + + + **Use Cases:** + + - **Application Tiers**: Deploy multiple instances of web servers, application servers, or databases + + - **Load Distribution**: Create multiple identical VMs for load balancing scenarios + + - **High Availability**: Deploy redundant instances across availability zones + + - **Batch Processing**: Create worker nodes for distributed computing workloads + + - **Development Environments**: Provision identical development or testing instances + + + **Configuration Requirements:** + + - **Resource IDs**: Must specify exact resource identifiers (not common specs) + + - **Network Configuration**: VNet, subnet, and security group must exist and be compatible + + - **SSH Keys**: Must specify valid SSH key pairs for access management + + - **Image Compatibility**: Specified image must be available in target region + + - **Quota Validation**: Sufficient CSP quotas must be available for all requested VMs + + + **SubGroup Size Considerations:** + + - **Small Groups (1-5 VMs)**: Fast deployment, minimal resource contention + + - **Medium Groups (6-20 VMs)**: Optimized parallel deployment with resource batching + + - **Large Groups (21+ VMs)**: Advanced deployment strategies to avoid CSP rate limits + + - **Resource Limits**: Respects CSP quotas and CB-Tumblebug configuration limits + + + **Post-Deployment Integration:** + + - SubGroup becomes integral part of parent MCI + + - All VMs inherit MCI-level monitoring and management policies + + - Can be scaled out further or individual VMs can be managed separately + + - Supports all standard CB-Tumblebug VM lifecycle operations' + PostInfraNodeSnapshot: + + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/snapshot + description: Snapshot VM and create a Custom Image Object using the Snapshot + PostNLB: + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/nlb + description: Create NLB + PostNodeDataDisk: + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/dataDisk + description: Provisioning (Create and attach) dataDisk + PostNs: + method: post + resourcePath: /ns + description: Create namespace + PostRegisterCSPNativeNode: + method: post + resourcePath: /ns/{nsId}/registerCspNode + description: 'Import and register pre-existing virtual machines from cloud service providers into CB-Tumblebug management. + + This endpoint allows you to bring existing CSP resources under CB-Tumblebug control without recreating them: + + + **Registration Process:** + + 1. **Discovery**: Validates that the specified VM exists in the target CSP + + 2. **Metadata Import**: Retrieves VM configuration, network settings, and current status + + 3. **Resource Mapping**: Creates CB-Tumblebug resource objects that reference the existing CSP resources + + 4. **Status Synchronization**: Aligns CB-Tumblebug status with actual CSP VM state + + 5. **Management Integration**: Enables CB-Tumblebug operations on the registered VMs + + + **Supported VM States:** + + - Running VMs (most common use case) + + - Stopped VMs (will be registered with current state) + + - VMs with attached storage and network interfaces + + + **Resource Compatibility:** + + - VM must exist in a supported CSP (AWS, Azure, GCP, etc.) + + - Network resources (VPC, subnets, security groups) will be discovered and mapped + + - Storage volumes and attached disks will be registered automatically + + - SSH keys and security configurations will be imported + + + **Post-Registration Capabilities:** + + - Standard CB-Tumblebug VM lifecycle operations (start, stop, terminate) + + - Monitoring agent installation (if CB-Dragonfly is configured) + + - Command execution and automation + + - Integration with other CB-Tumblebug MCIs + + + **Important Notes:** + + - Registration does not modify the existing VM configuration + + - Original CSP billing and resource management still applies + + - CB-Tumblebug provides additional management layer and automation + + - Ensure proper CSP credentials and permissions are configured' + PostRegisterSubnet: + method: post + resourcePath: /ns/{nsId}/registerCspResource/vNet/{vNetId}/subnet + description: Register Subnet, which was created in CSP + PostRegisterVNet: + method: post + resourcePath: /ns/{nsId}/registerCspResource/vNet + description: Register the VNet, which was created in CSP + PostScheduleRegisterCspResources: + method: post + resourcePath: /registerCspResources/schedule + description: 'Create a scheduled job to periodically register CSP-native resources (vNet, securityGroup, sshKey, vm) into CB-Tumblebug + + + **Resource Registration Behavior:** + + This job registers CSP-native resources based on the `connectionName` field: + + - If `connectionName` is specified: Registers resources from the **specified connection only** + + - If `connectionName` is empty or omitted: Registers resources from **all available connections** + + + **Usage Examples:** + + - Single connection: `{"jobType": "registerCspResources", "nsId": "default", "intervalSeconds": 60, "connectionName": "aws-ap-northeast-2", "mciNamePrefix": "mci-01"}` + + - All connections: `{"jobType": "registerCspResources", "nsId": "default", "intervalSeconds": 60, "connectionName": "", "mciNamePrefix": "mci-all"}` or `{"jobType": "registerCspResources", "nsId": "default", "intervalSeconds": 60, "mciNamePrefix": "mci-all"}` + + + **Job Status Values:** + + - `Scheduled`: Job is scheduled and waiting for the next execution time + + - `Executing`: Job is currently running the task + + - `Stopped`: Job has been stopped and deleted + + + **Job Lifecycle:** + + 1. Create job (this API) → Status: `Scheduled`, **executes immediately** + + 2. First execution starts → Status: `Executing` + + 3. Execution completes → Status: `Scheduled` (waits for interval) + + 4. After interval → Status: `Executing` (cycles back to step 3) + + 5. Pause job → `enabled: false`, Status: `Scheduled` (no execution) + + 6. Resume job → `enabled: true`, Status: `Scheduled` (resumes execution) + + 7. Delete job → Status: `Stopped`, job removed permanently + + + **Failure Handling:** + + - Tracks `successCount`, `failureCount`, `consecutiveFailures` + + - Auto-disables after 5 consecutive failures (`autoDisabled: true`) + + - Auto-recovers when next execution succeeds + + + **Timeout Protection:** + + - Default execution timeout: 30 minutes + + - Jobs exceeding timeout are marked as failed + + - Server restart during execution marks job as interrupted + + + **Duplicate Prevention:** + + - System checks for existing jobs with same configuration + + - Configuration uniqueness based on: jobType + nsId + connectionName + mciNamePrefix + option + mciFlag + + - Returns 409 Conflict if duplicate job exists with existing job ID' + PostSecurityGroup: + method: post + resourcePath: /ns/{nsId}/resources/securityGroup + description: Create Security Group + PostSecurityGroupFromTemplate: + method: post + resourcePath: /ns/{nsId}/resources/securityGroup/template/{templateId} + description: 'Create a new SecurityGroup by applying a SecurityGroup Template. + + The template provides the base SecurityGroup configuration (connectionName, vNetId, firewallRules), + + and the apply request allows overriding the SecurityGroup name and description. + + + **Override Behavior (Phase 1):** + + - `name` (required): Name for the new SecurityGroup + + - `description` (optional): Overrides the template''s description + + - All other configuration (connectionName, vNetId, firewallRules) comes from the template' + PostSecurityGroupTemplate: + method: post + resourcePath: /ns/{nsId}/template/securityGroup + description: 'Create a reusable SecurityGroup Template. Templates store SecurityGroup creation + + request configurations that can be applied later to create SecurityGroups with consistent settings. + + + **Template Contents:** + + - Connection name (cloud provider and region) + + - vNet ID for the security group + + - Firewall rules (ports, protocol, direction, CIDR) + + - Description + + + Templates can be created manually with desired SecurityGroup configurations.' + PostSiteToSiteVpn: + method: post + resourcePath: /ns/{nsId}/infra/{infraId}/vpn + description: 'Create a site-to-site VPN + + + The supported CSP sets are as follows: + + + - AWS and one of CSPs in Azure, GCP, Alibaba, Tencent, and IBM + + + - Note: It will take about `15 ~ 45 minutes`. + + + - Note: A one-time retry is performed to handle transient failures caused by CSP-internal timing issues between dependent resources. + + ' + PostSpec: + method: post + resourcePath: /ns/{nsId}/resources/spec + description: Register spec + PostSpecImagePairReview: + method: post + resourcePath: /specImagePairReview + description: 'Validate whether a spec and image pair is compatible for VM provisioning. + + This lightweight API checks: + + - Spec availability in DB and CSP + + - Image availability in DB and CSP (auto-registers if found in CSP but not in DB) + + - Cost estimation based on spec + + + **Use Cases:** + + - Quick validation before VM creation + + - Pre-check for dynamic provisioning + + - Verify custom image IDs entered by user' + PostSqlDb: + method: post + resourcePath: /ns/{nsId}/resources/sqlDb + description: 'Create a SQL Databases + + + Supported CSPs: AWS, Azure, GCP, NCP + + - Note - `connectionName` example: aws-ap-northeast-2, azure-koreacentral, gcp-asia-northeast3, ncp-kr + + + - Note - Please check the `requiredCSPResource` property which includes CSP specific values. + + + - Note - You can find the API usage examples on this link, https://github.com/cloud-barista/mc-terrarium/discussions/110 + + ' + PostSshKey: + method: post + resourcePath: /ns/{nsId}/resources/sshKey + description: Create SSH Key + PostSubnet: + method: post + resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet + description: Create Subnet + PostSystemInfra: + + method: post + resourcePath: /systemInfra + description: 'Create specialized MCI instances for CB-Tumblebug system operations and infrastructure probing. + + This endpoint provisions system-level infrastructure that supports CB-Tumblebug''s internal functions: + + + **System MCI Types:** + + - `probe`: Creates lightweight VMs for network connectivity testing and CSP capability discovery + + - `monitor`: Deploys monitoring infrastructure for system health and performance tracking + + - `test`: Provisions test environments for validating CSP integrations and features + + + **Probe MCI Features:** + + - **Connectivity Testing**: Validates network paths between different CSP regions + + - **Latency Measurement**: Measures inter-region and inter-provider network performance + + - **Feature Discovery**: Tests CSP-specific capabilities and service availability + + - **Resource Validation**: Verifies that CB-Tumblebug can successfully provision resources + + + **System Namespace:** + + - All system MCIs are created in the special `system` namespace + + - Isolated from user workloads and regular MCI operations + + - Managed automatically by CB-Tumblebug internal processes + + - May be used for background maintenance and monitoring tasks + + + **Automatic Configuration:** + + - Uses optimized VM specifications for system tasks (typically minimal resources) + + - Automatically selects appropriate regions and providers based on probe requirements + + - Configures necessary network access and security policies + + - Deploys with minimal attack surface and security hardening + + + **Lifecycle Management:** + + - System MCIs may be automatically created, updated, or destroyed by CB-Tumblebug + + - Typically short-lived for specific system tasks + + - Resource cleanup is handled automatically + + - Status and results are logged for system administrators + + + **Use Cases:** + + - Infrastructure health checks and validation + + - Performance benchmarking across cloud providers + + - Automated testing of new CSP integrations + + - Network topology discovery and optimization' + PostTestStreamResponse: + method: post + resourcePath: /testStreamResponse + description: Receives a number and streams the decrementing number every second until zero + PostUtilToDesignNetwork: + method: post + resourcePath: /util/net/design + description: Design a hierarchical network configuration of a VPC network or multi-cloud network consisting of multiple VPC networks + PostUtilToDesignVNet: + method: post + resourcePath: /util/vNet/design + description: Design VNet and subnets based on user-friendly properties + PostUtilToValidateNetwork: + method: post + resourcePath: /util/net/validate + description: Validate a hierarchical configuration of a VPC network or multi-cloud network consisting of multiple VPC networks + PostVNet: + method: post + resourcePath: /ns/{nsId}/resources/vNet + description: Create a new VNet + PostVNetFromTemplate: + method: post + resourcePath: /ns/{nsId}/resources/vNet/template/{templateId} + description: 'Create a new vNet by applying a vNet Template. + + The template provides the base vNet configuration (connectionName, cidrBlock, subnets), + + and the apply request allows overriding the vNet name and description. + + + **Override Behavior (Phase 1):** + + - `name` (required): Name for the new vNet + + - `description` (optional): Overrides the template''s description + + - All other configuration (connectionName, cidrBlock, subnets) comes from the template' + PostVNetTemplate: + method: post + resourcePath: /ns/{nsId}/template/vNet + description: 'Create a reusable vNet Template. Templates store vNet creation + + request configurations that can be applied later to create vNets with consistent settings. + + + **Template Contents:** + + - Connection name (cloud provider and region) + + - CIDR block configuration + + - Subnet definitions (names, CIDR blocks, zones) + + - Description + + + Templates can be created manually with desired vNet configurations.' + PutChangeK8sNodeGroupAutoscaleSize: + method: put + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName}/autoscaleSize + description: Change a K8sNodeGroup's Autoscale Size + PutDataDisk: + method: put + resourcePath: /ns/{nsId}/resources/dataDisk/{dataDiskId} + description: Upsize Data Disk + PutGlobalDnsRecord: + method: put + resourcePath: /resources/globalDns/record + description: 'Update (UPSERT) a DNS record for a domain in Route53. + + Supports two routing policies: "simple" (default) and "geoproximity" (location-based). + + Choose exactly one IP source method in ''setBy'': + + 1. MCI ID (mciId): Fetch Public IPs of all VMs in the MCI. + + 2. Label Selector (labelSelector): Fetch IPs of matching resources. + + 3. Manual IP Values (values): Manually provide IP addresses (simple routing only).' + PutImage: + method: put + resourcePath: /ns/{nsId}/resources/image/{imageId} + description: Update image + PutInfraAssociatedSecurityGroups: + + method: put + resourcePath: /ns/{nsId}/infra/{infraId}/associatedSecurityGroups + description: 'Update all Security Groups associated with a given MCI. The firewall rules of all Security Groups will be synchronized to match the requested set. + + Update all Security Groups associated with a given MCI. The firewall rules of all associated Security Groups will be synchronized to match the requested set. + + + This API will add missing rules and delete extra rules so that each Security Group''s rules become identical to the requested set. + + Only firewall rules are updated; other metadata (name, description, etc.) is not changed. + + + Usage: + + Use this API to update (synchronize) the firewall rules of all Security Groups associated with the specified MCI. The rules in the request body will become the only rules in each Security Group after the operation. + + - All existing rules not present in the request will be deleted. + + - All rules in the request that do not exist will be added. + + - If a rule exists but differs in CIDR or port range, it will be replaced. + + - Special protocols (ICMP, etc.) are handled in the same way. + + + Notes: + + - "Ports" field supports single port ("22"), port range ("80-100"), and multiple ports/ranges ("22,80-100,443"). + + - The valid port number range is 0 to 65535 (inclusive). + + - "Protocol" can be TCP, UDP, ICMP, etc. (as supported by the cloud provider). + + - "Direction" must be either "inbound" or "outbound". + + - "CIDR" is the allowed IP range. + + - All existing rules not in the request (including default ICMP, etc.) will be deleted. + + - Metadata (name, description, etc.) is not changed.' + PutInfraDynamicTemplate: + method: put - resourcePath: /ns/{nsId}/monitoring/status/mci/{mciId}/vm/{vmId} - description: "Set monitoring agent (CB-Dragonfly agent) installation status installed (for Windows VM only)" - Postinstallbenchmarkagenttomci: - method: post - resourcePath: /ns/{nsId}/installBenchmarkAgent/mci/{mciId} - description: "Install the benchmark agent to specified MCI" - Getk8scluster: - method: get - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId} - description: "Get K8sCluster" - Deletek8scluster: - method: delete - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId} - description: "Delete K8sCluster" - Getimage: - method: get - resourcePath: /ns/{nsId}/resources/image/{imageId} - description: "GetImage returns an image object if there are matched images for the given namespace and imageKey(Id, CspResourceName, GuestOS,...)" - Putimage: + resourcePath: /ns/{nsId}/template/infra/{templateId} + description: Update an existing MCI Dynamic Template. + PutMonitorAgentStatusInstalled: method: put - resourcePath: /ns/{nsId}/resources/image/{imageId} - description: "Update image" - Delimage: - method: delete - resourcePath: /ns/{nsId}/resources/image/{imageId} - description: "Delete image" - Getsubnet: - method: get - resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet/{subnetId} - description: "Get Subnet" - Delsubnet: - method: delete - resourcePath: /ns/{nsId}/resources/vNet/{vNetId}/subnet/{subnetId} - description: "Delete Subnet\n- refine: delete a subnet `object` if there's no resource on CSP or no inforamation on Spider\n- force: force: delete a subnet `resource` on a CSP regardless of the current resource status (e.g., attempt to delete even if in use)" - Getregions: - method: get - resourcePath: /provider/{providerName}/region - description: "Get registered region info" - Postcmdmci: - method: post - resourcePath: /ns/{nsId}/cmd/mci/{mciId} - description: "Send a command to specified MCI" - Fetchspecs: - method: post - resourcePath: /ns/{nsId}/resources/fetchSpecs - description: "Fetch specs" - Searchimage: - method: post - resourcePath: /ns/{nsId}/resources/searchImage - description: "Search image" - Getresourcesbylabelselector: - method: get - resourcePath: /resources/{labelType} - description: "Get resources based on a label selector. The label selector supports the following operators:\n- `=` : Selects resources where the label key equals the specified value (e.g., `env=production`).\n- `!=` : Selects resources where the label key does not equal the specified value (e.g., `tier!=frontend`).\n- `in` : Selects resources where the label key is in the specified set of values (e.g., `region in (us-west, us-east)`).\n- `notin` : Selects resources where the label key is not in the specified set of values (e.g., `env notin (production, staging)`).\n- `exists` : Selects resources where the label key exists (e.g., `env exists`).\n- `!exists` : Selects resources where the label key does not exist (e.g., `env !exists`)." - Getlabels: - method: get - resourcePath: /label/{labelType}/{uid} - description: "Get labels for a resource identified by its uid" - Createorupdatelabel: + resourcePath: /ns/{nsId}/monitoring/status/infra/{infraId}/node/{nodeId} + description: Set monitoring agent (CB-Dragonfly agent) installation status installed (for Windows VM only) + PutNodeDataDisk: method: put - resourcePath: /label/{labelType}/{uid} - description: "Create or update a label for a resource identified by its uid" - Lookupimagelist: + resourcePath: /ns/{nsId}/infra/{infraId}/node/{nodeId}/dataDisk + description: Attach/Detach available dataDisk + PutNs: + method: put + resourcePath: /ns/{nsId} + description: Update namespace + PutScheduleRegisterCspResources: + method: put + resourcePath: /registerCspResources/schedule/{jobId} + description: 'Update the configuration of a scheduled CSP resource registration job (interval, enabled status) + + + **Updatable Fields:** + + - `intervalSeconds`: Change execution frequency (minimum 10 seconds) + + - `enabled`: Enable (true) or disable (false) the job + + + **Usage Examples:** + + - Change interval: `{"intervalSeconds": 30}` (30 seconds) + + - Pause job: `{"enabled": false}` + + - Resume job: `{"enabled": true}` + + - Change both: `{"intervalSeconds": 10, "enabled": true}` + + + **Note:** For simpler pause/resume operations, consider using dedicated `/pause` and `/resume` endpoints' + PutScheduleRegisterCspResourcesPause: + method: put + resourcePath: /registerCspResources/schedule/{jobId}/pause + description: 'Temporarily pause a scheduled job without deleting it. The job can be resumed later. + + This sets enabled=false and preserves all job state and execution history.' + PutScheduleRegisterCspResourcesResume: + method: put + resourcePath: /registerCspResources/schedule/{jobId}/resume + description: 'Resume a previously paused scheduled job to continue periodic execution. + + This sets enabled=true and restarts the job scheduler.' + PutSecurityGroup: + method: put + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId} + description: 'Update Security Group: Synchronize the firewall rules of the specified Security Group to match the requested list exactly. + + This API will add missing rules and delete extra rules so that the Security Group''s rules become identical to the requested set. + + Only firewall rules are updated; other metadata (name, description, etc.) is not changed. + + + Usage: + + Use this API to update (synchronize) the firewall rules of a Security Group. The rules in the request body will become the only rules in the Security Group after the operation. + + - All existing rules not present in the request will be deleted. + + - All rules in the request that do not exist will be added. + + - If a rule exists but differs in CIDR or port range, it will be replaced. + + - Special protocols (ICMP, etc.) are handled in the same way. + + + Notes: + + - "Ports" field supports single port ("22"), port range ("80-100"), and multiple ports/ranges ("22,80-100,443"). + + - The valid port number range is 0 to 65535 (inclusive). + + - "Protocol" can be TCP, UDP, ICMP, etc. (as supported by the cloud provider). + + - "Direction" must be either "inbound" or "outbound". + + - "CIDR" is the allowed IP range. + + - All existing rules not in the request (including default ICMP, etc.) will be deleted. + + - Metadata (name, description, etc.) is not changed.' + PutSecurityGroupTemplate: + method: put + resourcePath: /ns/{nsId}/template/securityGroup/{templateId} + description: Update an existing SecurityGroup Template. + PutSetK8sNodeGroupAutoscaling: + method: put + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName}/onAutoscaling + description: Set a K8sNodeGroup's Autoscaling On/Off + PutSpec: + method: put + resourcePath: /ns/{nsId}/resources/spec/{specId} + description: Update spec + PutSshKey: + method: put + resourcePath: /ns/{nsId}/resources/sshKey/{sshKeyId} + description: Update SSH Key + PutUpgradeK8sCluster: + method: put + resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/upgrade + description: Upgrade a K8sCluster's version + PutVNetTemplate: + method: put + resourcePath: /ns/{nsId}/template/vNet/{templateId} + description: Update an existing vNet Template. + RecommendK8sNode: method: post - resourcePath: /lookupImages - description: "Lookup image list" + resourcePath: /k8sClusterRecommendNode + description: Recommend K8sCluster's Node plan (filter and priority) Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1234 RecommendSpec: method: post resourcePath: /recommendSpec - description: "Recommend MCI plan (filter and priority) Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1234" - Getallns: - method: get - resourcePath: /ns - description: "List all namespaces or namespaces' ID" - Postns: + description: 'Recommend specs for configuring an infrastructure (filter and priority) + + Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1234 + + Get available options by /recommendSpecOptions for filtering and prioritizing + specs in RecommendSpec API' + requestCoerce: + limit: int + RecommendSpecOptions: + method: get + resourcePath: /recommendSpecOptions + description: Get available options for filtering and prioritizing specs in RecommendSpec API + RecordProvisioningEvent: + method: post + resourcePath: /provisioning/event + description: 'Manually record a provisioning success or failure event for historical tracking and analysis. + + This endpoint allows external systems or manual processes to contribute to provisioning history: + + + **Use Cases:** + + - **External Provisioning Tools**: Record events from non-CB-Tumblebug provisioning systems + + - **Manual Testing**: Log results from manual deployment tests + + - **Migration**: Import historical data from other systems + + - **Integration**: Connect with CI/CD pipelines for comprehensive tracking + + + **Event Types:** + + - **Success Events**: Only recorded if previous failures exist for the spec + + - **Failure Events**: Always recorded to build failure pattern database + + + **Data Quality:** + + - Provide accurate timestamps for proper chronological analysis + + - Include detailed error messages for failure events + + - Use consistent spec ID and image name formats + + + **Impact on System:** + + - Contributes to risk analysis algorithms + + - Affects future MCI review recommendations + + - Builds historical baseline for reliability metrics' + RegisterCredential: method: post - resourcePath: /ns - description: "Create namespace" - Delallns: - method: delete - resourcePath: /ns - description: "Delete all namespaces" - Forwardanyreqtoany: + resourcePath: /credential + description: This API registers credential information using hybrid encryption. The process involves compressing and encrypting sensitive data with AES-256, encrypting the AES key with a 4096-bit RSA public key (retrieved via `GET /credential/publicKey`), and using OAEP padding with SHA-256. All values, including the AES key, must be base64 encoded before sending, and the public key token ID must be included in the request. + RegisterCspNativeResources: method: post - resourcePath: /forward/{path} - description: "Forward any (GET) request to CB-Spider" - Checkhttpversion: - method: get - resourcePath: /httpVersion - description: "Checks and logs the HTTP version of the incoming request to the server console." - Postk8scluster: + resourcePath: /registerCspResources + description: 'Register CSP Native Resources (vNet, securityGroup, sshKey, vm) to CB-Tumblebug. + + + **New filtering approach (recommended):** + + - Provider only: Registers resources from all connections of the specified provider + + - Provider + Region: Registers resources from all zones within the region + + - Provider + Region + Zone: Registers resources from specific zone + + - All empty: Registers resources from **all available connections** + + + **Backward compatibility:** + + - `connectionName` is still supported but deprecated. Use provider/region/zone instead. + + + **Usage Examples:** + + - All AWS: `{"provider": "aws", "nsId": "default"}` + + - AWS Seoul region: `{"provider": "aws", "region": "ap-northeast-2", "nsId": "default"}` + + - AWS Seoul zone 2a: `{"provider": "aws", "region": "ap-northeast-2", "zone": "ap-northeast-2a", "nsId": "default"}` + + - All connections: `{"nsId": "default", "mciNamePrefix": "mci-all"}` + + - Single connection (deprecated): `{"connectionName": "aws-ap-northeast-2", "nsId": "default"}`' + RegisterCspNativeResourcesAll: method: post - resourcePath: /ns/{nsId}/k8sCluster - description: "Create K8sCluster
Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1614" - Deleteallk8scluster: + resourcePath: /registerCspResourcesAll + description: '**DEPRECATED**: This endpoint is deprecated. Please use `/registerCspResources` with empty `connectionName` instead. + + + This endpoint now redirects to `/registerCspResources` for unified API behavior. + + + **Migration Guide:** + + - Old: `POST /registerCspResourcesAll` with `{"nsId": "default", "mciNamePrefix": "mci-all"}` + + - New: `POST /registerCspResources` with `{"connectionName": "", "nsId": "default", "mciNamePrefix": "mci-all"}`' + RemoveBastionNodes: method: delete - resourcePath: /ns/{nsId}/k8sCluster - description: "Delete all K8sClusters" - Getallk8scluster: - method: get - resourcePath: /ns/{nsId}/k8sCluster - description: "List all K8sClusters or K8sClusters' ID" - Postk8snodegroupdynamic: - method: post - resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroupDynamic - description: "Create K8sNodeGroup Dynamically from common spec and image" - Getrequest: - method: get - resourcePath: /request/{reqId} - description: "Get details of a specific request" - Deleterequest: + resourcePath: /ns/{nsId}/infra/{infraId}/bastion/{bastionVmId} + description: Remove a bastion VM from all vNets + RemoveBastionNodesWithInfra: + method: delete - resourcePath: /request/{reqId} - description: "Delete details of a specific request" - Getconnconfig: - method: get - resourcePath: /connConfig/{connConfigName} - description: "Get registered ConnConfig info" - Getsystemlabelinfo: - method: get - resourcePath: /labelInfo - description: "Return LabelTypes and system defined label keys with example" - Postmcnlb: - method: post - resourcePath: /ns/{nsId}/mci/{mciId}/mcSwNlb - description: "Create a special purpose MCI for NLB and depoly and setting SW NLB" - Getmcipolicy: - method: get - resourcePath: /ns/{nsId}/policy/mci/{mciId} - description: "Get MCI Policy" - Postmcipolicy: - method: post - resourcePath: /ns/{nsId}/policy/mci/{mciId} - description: "Create MCI Automation policy" - Delmcipolicy: + resourcePath: /ns/{nsId}/infra/{infraId}/bastion/{bastionMciId}/{bastionVmId} + description: Remove a specific cross-MCI bastion from all vNets of the target MCI + RemoveBastionNodesWithNs: method: delete - resourcePath: /ns/{nsId}/policy/mci/{mciId} - description: "Delete MCI Policy" - Postutiltodesignvnet: - method: post - resourcePath: /util/vNet/design - description: "Design VNet and subnets based on user-friendly properties" - Registercspnativeresourcesall: - method: post - resourcePath: /registerCspResourcesAll - description: "Register CSP Native Resources (vNet, securityGroup, sshKey, vm) from all Clouds to CB-Tumblebug" - Delmci: + resourcePath: /ns/{nsId}/infra/{infraId}/bastion/{bastionNsId}/{bastionMciId}/{bastionVmId} + description: Remove a specific cross-namespace bastion from all vNets of the target MCI + RemoveLabel: method: delete - resourcePath: /ns/{nsId}/mci/{mciId} - description: "Delete MCI" - Getmci: - method: get - resourcePath: /ns/{nsId}/mci/{mciId} - description: "Get MCI object (option: status, accessInfo, vmId)" - Getrequeststatusofsitetositevpn: + resourcePath: /label/{labelType}/{uid}/{key} + description: Remove a label from a resource identified by its uid + RemoveNLBNodes: + method: delete + resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId}/node + description: Delete nodes from NLB + RestDeleteObjectStorage: + method: delete + resourcePath: /ns/{nsId}/resources/objectStorage/{osId} + description: Delete an object storage (bucket) + RetrieveRegionListFromCsp: method: get - resourcePath: /ns/{nsId}/mci/{mciId}/vpn/{vpnId}/request/{requestId} - description: "Check the status of a specific request by its ID" - Getreadyz: + resourcePath: /regionFromCsp + description: RetrieveR all region lists from CSPs + SearchImage: + method: post + resourcePath: /ns/{nsId}/resources/searchImage + description: Search image + SearchImageOptions: method: get - resourcePath: /readyz - description: "Check Tumblebug is ready" - Setbastionnodes: + resourcePath: /ns/{nsId}/resources/searchImageOptions + description: Get all available options for image search fields + SetBastionNodes: method: put - resourcePath: /ns/{nsId}/mci/{mciId}/vm/{targetVmId}/bastion/{bastionVmId} + resourcePath: /ns/{nsId}/infra/{infraId}/node/{targetVmId}/bastion/{bastionVmId} description: "Set bastion nodes for a VM" - Postmcidynamic: - method: post - resourcePath: /ns/{nsId}/mciDynamic - description: "Create MCI Dynamically from common spec and image" Inspectresourcesoverview: method: get resourcePath: /inspectResourcesOverview @@ -1962,10 +4517,6 @@ serviceActions: method: delete resourcePath: /ns/{nsId}/k8sCluster/{k8sClusterId}/k8sNodeGroup/{k8sNodeGroupName} description: "Remove a K8sNodeGroup" - Getsitesinmci: - method: get - resourcePath: /ns/{nsId}/mci/{mciId}/site - description: "Get sites in MCI" Getalldatadisk: method: get resourcePath: /ns/{nsId}/resources/dataDisk @@ -1982,23 +4533,191 @@ serviceActions: method: post resourcePath: /ns/{nsId}/sharedResource description: "Create shared resources for MC-Infra" - Postmcidynamicreview: + ListVNet: + method: get + resourcePath: /ns/{nsId}/resources/vNet + description: "List all VNets in a namespace" + CreateVNet: + method: post + resourcePath: /ns/{nsId}/resources/vNet + description: "Create VNet" + DeleteVNet: + method: delete + resourcePath: /ns/{nsId}/resources/vNet/{vNetId} + description: "Delete VNet" + ListSecurityGroup: + method: get + resourcePath: /ns/{nsId}/resources/securityGroup + description: "List all Security Groups in a namespace" + CreateSecurityGroup: + method: post + resourcePath: /ns/{nsId}/resources/securityGroup + description: "Create Security Group" + DeleteSecurityGroup: + method: delete + resourcePath: /ns/{nsId}/resources/securityGroup/{securityGroupId} + description: "Delete Security Group" + ListSSHKey: + method: get + resourcePath: /ns/{nsId}/resources/sshKey + description: "List all SSH Keys in a namespace" + CreateSSHKey: method: post - resourcePath: /ns/{nsId}/mciDynamicReview - description: "Create MCI Dynamically from common spec and image" - Postinfradynamicreview: + resourcePath: /ns/{nsId}/resources/sshKey + description: "Create SSH Key" + ListImage: + method: get + resourcePath: /ns/{nsId}/resources/image + description: "List all images in a namespace" + RegisterImage: method: post - resourcePath: /ns/{nsId}/infraDynamicReview - description: "Review and validate Infra dynamic request comprehensively before actual provisioning" - Postmcivmdynamic: + resourcePath: /ns/{nsId}/resources/image + description: "Register image in a namespace" + DeleteImage: + method: delete + resourcePath: /ns/{nsId}/resources/image/{imageId} + description: "Delete image" + ListSpec: + method: post + resourcePath: /ns/{nsId}/resources/filterSpecsByRange + description: "List all specs in a namespace" + RegisterSpec: + method: post + resourcePath: /ns/{nsId}/resources/spec + description: "Register spec in a namespace" + DeleteSpec: + method: delete + resourcePath: /ns/{nsId}/resources/spec/{specId} + description: "Delete spec" + SetBastionNodesWithInfra: + + method: put + resourcePath: /ns/{nsId}/infra/{infraId}/node/{targetVmId}/bastion/{bastionMciId}/{bastionVmId} + description: Set bastion nodes for a target VM, specifying a bastion VM that belongs to a different MCI within the same namespace (cross-MCI bastion). This allows, for example, an AWS VM to serve as a bastion for an OpenStack VM. + SetBastionNodesWithNs: + method: put + resourcePath: /ns/{nsId}/infra/{infraId}/node/{targetVmId}/bastion/{bastionNsId}/{bastionMciId}/{bastionVmId} + description: Set bastion nodes for a target VM, specifying a bastion VM that belongs to a different namespace and MCI (cross-namespace bastion). This allows, for example, a VM in a shared-services namespace to act as a bastion for VMs in other namespaces. + SetObjectStorageCORS: + method: put + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/cors + description: Set CORS configuration of an object storage (bucket) + SetObjectStorageCORSLagacy: + method: put + resourcePath: /resources/objectStorage/{objectStorageName}/cors + description: '(To be deprecated) Set CORS configuration of an object storage (bucket) + + + **Important Notes:** + + - The CORS configuration must be provided in the request body in XML format. + + - The actual request body should have root element `CORSConfiguration` + + + **Actual XML Request Body Example:** + + ```xml + + + + + + + + https://example.com + + https://app.example.com + + GET + + PUT + + Content-Type + + Authorization + + ETag + + 1800 + + + + + + * + + GET + + 300 + + + + + + ```' + SetObjectStorageVersioning: + method: put + resourcePath: /ns/{nsId}/resources/objectStorage/{osId}/versioning + description: 'Set versioning configuration of an object storage (bucket) + + + **Note: ** + + - Versioning options: "Enabled", "Suspended", "Unversioned" + + ' + SetObjectStorageVersioningLagacy: + method: put + resourcePath: /resources/objectStorage/{objectStorageName}/versioning + description: '(To be deprecated) Set versioning status of an object storage (bucket) + + + **Important Notes:** + + - The request body must be XML format with root element `VersioningConfiguration` + + - The `Status` field can be either `Enabled` or `Suspended` + + + **Request Body Example:** + + ```xml + + + + + + Enabled + + + + ```' + SetSystemInitialized: + method: put + resourcePath: /readyz/init + description: Set the system initialization status to true. Called by init.py after completing initialization. + TestJWTAuth: + method: get + resourcePath: /auth/test + description: Test JWT authentication + UnsetSystemInitialized: + method: delete + resourcePath: /readyz/init + description: Reset the system initialization status to false. Useful for re-initialization scenarios. + UpdateExistingSpecListByAvailableRegionZones: method: post - resourcePath: /ns/{nsId}/mci/{mciId}/vmDynamic - description: "Create VM Dynamically and add it to MCI" - Recommendvm: + resourcePath: /ns/{nsId}/updateExistingSpecListByAvailableRegionZones + description: Query all specs for a specific provider across all regions, check their availability, and remove specs that are not available in their respective regions + UpdateImagesFromAsset: method: post - resourcePath: /mciRecommendVm - description: "Recommend MCI plan (filter and priority) Find details from https://github.com/cloud-barista/cb-tumblebug/discussions/1234" + resourcePath: /updateImagesFromAsset + description: Update image information based on the cloudimage.csv asset file + PostFileAndCmdToInfra: + method: post + resourcePath: /ns/{nsId}/transferFileAndCmd/infra/{infraId} + description: 'Transfer a file and execute commands on all nodes in the Infra. (v0.12.9 갱신: /ns/{nsId}/mci/{mciId}/fileAndCmd → /ns/{nsId}/transferFileAndCmd/infra/{infraId})' mc-web-console: getSetupYamlCheck: method: get From 0363b6b5c43d9620629f14b5aebe25b58f2bca44 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 4 Sep 2026 06:02:51 +0000 Subject: [PATCH 13/22] feat(menu): seed mc-iam-manager from the bundled menu catalog copy The menu seed came from the raw GitHub URL of mc-web-console's main branch, while every image is pinned by tag and every other subsystem config is a copy under conf/docker/conf//. That made installs non-reproducible (whatever main held that day) and impossible offline, and the post-init script's wget of that URL produced an unused menu.yaml. - docker-compose(.mini).yaml: mount the existing bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml read-only into mc-iam-manager at /app/asset/menu/webconsole_menu_resources.yaml - MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml in .env.setup (both) and the tracked conf/mc-iam-manager/.env; the raw URL stays as a commented option - 1_setup_auto.sh / 1_setup_manual.sh: stop fetching menu.yaml (IAM reads the seed itself); only spider-check when the env is a URL; log IAM's skipped=true (menus seeded once at install); manual option 4b forces a re-seed via ?force=true with a confirmation - drop the orphan conf/docker/menu.yaml and the menu.yaml entries in .gitignore / cleanAll.sh - refresh bundled copies: menu catalog from mc-web-console develop 3a015768 (61 menus), permission.yaml from mc-iam-manager fix/iam-permission-yaml-canonical-ids, InitialMenus description in the three api.yaml copies - README / running-on-instance.md: seed-once model and .env migration note --- .gitignore | 1 - README.md | 2 +- bin/cleanAll.sh | 1 - conf/api.yaml | 2 +- conf/docker/.env.setup | 8 +- conf/docker/api.yaml | 2 +- conf/docker/conf/mc-iam-manager/.env | 7 +- conf/docker/conf/mc-iam-manager/.env.setup | 9 +- .../conf/mc-iam-manager/1_setup_auto.sh | 39 +- .../conf/mc-iam-manager/1_setup_manual.sh | 48 +- .../conf/mc-iam-manager/permission.yaml | 125 +++-- .../conf/mc-web-console/api/conf/api.yaml | 2 +- .../api/conf/webconsole_menu_resources.yaml | 520 ++++++++++-------- conf/docker/docker-compose.mini.yaml | 5 + conf/docker/docker-compose.yaml | 5 + conf/docker/menu.yaml | 417 -------------- docs/running-on-instance.md | 4 +- 17 files changed, 484 insertions(+), 713 deletions(-) delete mode 100644 conf/docker/menu.yaml diff --git a/.gitignore b/.gitignore index 5012546..bee1483 100644 --- a/.gitignore +++ b/.gitignore @@ -67,7 +67,6 @@ bin/profile.json conf/docker/conf/mc-data-manager/data/var/run/data-manager/profile/profile.json conf/docker/conf/mc-data-manager/data/var/log/ -conf/docker/conf/mc-iam-manager/menu.yaml conf/docker/conf/mc-iam-manager/nginx.conf conf/docker/conf/mc-iam-manager/api.yaml diff --git a/README.md b/README.md index 653bd80..1aa663e 100644 --- a/README.md +++ b/README.md @@ -198,7 +198,7 @@ Expected: `"issuer": "https:///auth/realms/mciam"` — must start with ` **(d) mc-iam-manager-post-initial 11-step setup:** -Among other things, these steps register the platform's menu catalog (from mc-web-console's canonical menu yaml) and seed role-menu permissions — both chained into a single server-side call, so a single step covers both. +Among other things, these steps seed the platform's menu catalog and role-menu permissions — both chained into a single server-side call, so a single step covers both. The seeds are the bundled copies `conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml` (a copy of mc-web-console's canonical catalog) and `conf/docker/conf/mc-iam-manager/permission.yaml`, mounted read-only into the mc-iam-manager container. They are read **once, at first install**: re-running post-init skips the menu step when menus already exist (`skipped: true` in its log), and later menu / role-menu changes are made in the console (Menus, Roles screens) and live in the IAM DB. To overwrite from the yaml again, use the console's Setup Status "Force re-seed ▶ Menu" or `1_setup_manual.sh` option 4b (role mappings are backed up first). When the bundled copies are updated in this repo (new console release), existing installs pick them up only through such a forced re-seed. ```shell docker logs mc-iam-manager-post-initial | tail -5 diff --git a/bin/cleanAll.sh b/bin/cleanAll.sh index 1315485..a529662 100755 --- a/bin/cleanAll.sh +++ b/bin/cleanAll.sh @@ -168,7 +168,6 @@ echo echo "Deleting mc-iam-manager configuration files..." files_to_delete=( "../conf/docker/conf/mc-iam-manager/api.yaml" - "../conf/docker/conf/mc-iam-manager/menu.yaml" "../conf/docker/conf/mc-iam-manager/nginx.conf" ) diff --git a/conf/api.yaml b/conf/api.yaml index 67f1692..db48e4a 100644 --- a/conf/api.yaml +++ b/conf/api.yaml @@ -1195,7 +1195,7 @@ serviceActions: InitialMenus: method: post resourcePath: /api/setup/initial-menus - description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync." + description: "메뉴 카탈로그 yaml 시딩 (1_setup_auto.sh init_menu와 동일). 메뉴가 이미 있으면 skip(200, skipped=true); queryParams force=true면 역할-메뉴 매핑 백업 후 덮어씀. FR-006-08 Force re-seed." SyncMcmpApis: method: post resourcePath: /api/setup/sync-mcmp-apis diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup index b330ad4..c2edd0d 100644 --- a/conf/docker/.env.setup +++ b/conf/docker/.env.setup @@ -78,7 +78,13 @@ MODE=standalone # [standalone|docker] both are same. MC_IAM_MANAGER_USE_TICKET_VALID=true # [true|false] MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml -MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml +# Menu catalog seed. Default: bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml, +# mounted read-only into mc-iam-manager at this path and read ONCE at first install (later menu +# changes live in the IAM DB; re-seed only via force). Set a raw URL instead to seed from a remote file. +# Note: mc-web-console-api reads this value only for the Setup Status "Seed source" display; +# the value mc-iam-manager actually uses comes from conf/mc-iam-manager/.env. +MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml +#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml # YAML role-menu permission seed (path or remote URL); IAM env_file prefers conf/mc-iam-manager/.env MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml diff --git a/conf/docker/api.yaml b/conf/docker/api.yaml index 67f1692..db48e4a 100644 --- a/conf/docker/api.yaml +++ b/conf/docker/api.yaml @@ -1195,7 +1195,7 @@ serviceActions: InitialMenus: method: post resourcePath: /api/setup/initial-menus - description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync." + description: "메뉴 카탈로그 yaml 시딩 (1_setup_auto.sh init_menu와 동일). 메뉴가 이미 있으면 skip(200, skipped=true); queryParams force=true면 역할-메뉴 매핑 백업 후 덮어씀. FR-006-08 Force re-seed." SyncMcmpApis: method: post resourcePath: /api/setup/sync-mcmp-apis diff --git a/conf/docker/conf/mc-iam-manager/.env b/conf/docker/conf/mc-iam-manager/.env index 7a53f7b..21b385d 100644 --- a/conf/docker/conf/mc-iam-manager/.env +++ b/conf/docker/conf/mc-iam-manager/.env @@ -17,7 +17,12 @@ MODE=standalone # [standalone|docker] both are same. MC_IAM_MANAGER_USE_TICKET_VALID=true # [true|false] MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml -MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml +# Menu catalog seed (path relative to the IAM container's /app, or a remote URL). +# Default: bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml mounted by +# docker-compose. Read ONCE at first install — afterwards menus/role-menu mappings are edited in the +# IAM DB; initial-menus skips when menus exist unless ?force=true (backs up role mappings first). +MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml +#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml # YAML role-menu permission seed (path or remote URL). # Default: conf bundle + compose mount at /app/asset/menu/permission.yaml MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml diff --git a/conf/docker/conf/mc-iam-manager/.env.setup b/conf/docker/conf/mc-iam-manager/.env.setup index 6ebd2ae..89cfdbc 100644 --- a/conf/docker/conf/mc-iam-manager/.env.setup +++ b/conf/docker/conf/mc-iam-manager/.env.setup @@ -3,6 +3,8 @@ ## Generated from .env.setup — be sure to change passwords and secrets in production ## permission.yaml: conf bundle + compose mount to /app/asset/menu/permission.yaml, ## or set MC_WEB_CONSOLE_MENU_PERMISSIONS to a path or remote YAML URL +## menu catalog: conf/mc-web-console/api/conf/webconsole_menu_resources.yaml bundle + compose mount +## to /app/asset/menu/webconsole_menu_resources.yaml (MC_WEB_CONSOLE_MENUYAML), seeded once at install # Basic service configuration # MC_IAM_MANAGER_DOMAIN: Internal Docker container name — differs from PUBLIC_DOMAIN, do not change @@ -17,7 +19,12 @@ MODE=standalone MC_IAM_MANAGER_USE_TICKET_VALID=true MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml -MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml +# Menu catalog seed (path relative to the IAM container's /app, or a remote URL). +# Default: bundled copy mounted by docker-compose. Read ONCE at first install — afterwards menus and +# role-menu mappings are edited in the IAM DB; POST /api/setup/initial-menus skips when menus exist +# unless ?force=true (backs up role mappings first). Set a raw URL only to seed from a remote file. +MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml +#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml # YAML role-menu permission seed (path or remote URL). # Default: conf bundle + compose mount at /app/asset/menu/permission.yaml MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml diff --git a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh index 151d62f..0bf73fd 100755 --- a/conf/docker/conf/mc-iam-manager/1_setup_auto.sh +++ b/conf/docker/conf/mc-iam-manager/1_setup_auto.sh @@ -281,35 +281,50 @@ init_predefined_roles() { # IAM now chains role-menu permission seeding onto POST /api/setup/initial-menus # server-side, so auto_setup no longer calls init_menu_permissions separately. +# The seed file is resolved by IAM itself from its own MC_WEB_CONSOLE_MENUYAML +# (default: the bundled copy mounted at /app/asset/menu/webconsole_menu_resources.yaml; +# a URL is downloaded server-side). Nothing is fetched here. +# IAM seeds menus once: if menus already exist it answers 200 with skipped=true, +# so re-running post-init is idempotent and never overwrites DB-edited menus. init_menu() { echo "Initializing menu data..." - wget -q -O ./menu.yaml "$MC_WEB_CONSOLE_MENUYAML" - - # Check if wget succeeded - if [ $? -ne 0 ]; then - echo "ERROR: Failed to download menu.yaml" - return 1 - fi - + case "$MC_WEB_CONSOLE_MENUYAML" in + http://*|https://*) + # Remote seed: fail fast here with a clear message instead of a vague IAM fallback + if ! wget -q --spider "$MC_WEB_CONSOLE_MENUYAML"; then + echo "ERROR: MC_WEB_CONSOLE_MENUYAML is not reachable: $MC_WEB_CONSOLE_MENUYAML" + return 1 + fi + ;; + *) + echo "Menu seed source: local file in IAM container ($MC_WEB_CONSOLE_MENUYAML)" + ;; + esac + response=$(curl -s -X POST \ --header "Authorization: Bearer $MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" \ --header 'Content-Type: application/json' \ "$MC_IAM_MANAGER_HOST/api/setup/initial-menus") - + # Validate response if [ $? -ne 0 ]; then echo "ERROR: Failed to initialize menu data" return 1 fi - + echo "Menu initialization response: $response" - + # Check success if echo "$response" | jq -e '.error' > /dev/null 2>&1; then echo "ERROR: Menu initialization failed" return 1 fi - + + if [ "$(echo "$response" | jq -r '.skipped // false' 2>/dev/null)" = "true" ]; then + echo "Menus already seeded ($(echo "$response" | jq -r '.existingMenuCount // "?"') found) — skipped. Use 1_setup_manual.sh option 4b to force a re-seed." + return 0 + fi + echo "Menu data initialized" return 0 } diff --git a/conf/docker/conf/mc-iam-manager/1_setup_manual.sh b/conf/docker/conf/mc-iam-manager/1_setup_manual.sh index 74a2f0b..7affbde 100755 --- a/conf/docker/conf/mc-iam-manager/1_setup_manual.sh +++ b/conf/docker/conf/mc-iam-manager/1_setup_manual.sh @@ -83,15 +83,46 @@ init_predefined_roles() { # IAM now chains role-menu permission seeding onto POST /api/setup/initial-menus # server-side, so option 4) below no longer calls init_menu_permissions separately. +# IAM resolves the seed file itself from its own MC_WEB_CONSOLE_MENUYAML (default: the +# bundled copy mounted into the container). Seeds once: if menus already exist it +# answers skipped=true — use option 4b to force a re-seed. init_menu() { echo "Initializing menu data..." - wget -q -O ./menu.yaml "$MC_WEB_CONSOLE_MENUYAML" response=$(curl -s -X POST \ --header "Authorization: Bearer $MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" \ --header 'Content-Type: application/json' \ "$MC_IAM_MANAGER_HOST/api/setup/initial-menus") echo "Menu initialization response: $response" - echo "Menu data initialized" + if [ "$(echo "$response" | jq -r '.skipped // false' 2>/dev/null)" = "true" ]; then + echo "Menus already seeded — skipped (option 4b forces a re-seed)" + else + echo "Menu data initialized" + fi +} + +# Force re-seed (option 4b): overwrites menus from the seed yaml even if menus exist. +# IAM backs up the current role-menu mappings to asset/menu/backups/ first and +# returns backupPath; DB-edited menus/mappings are overwritten by the yaml. +force_reseed_menu() { + echo "This will OVERWRITE menus (and re-apply permission.yaml) from the seed yaml." + echo "Menus/role-menu mappings edited in the DB will be lost (role mappings are backed up first)." + read -p "Type 'yes' to continue: " confirm + if [ "$confirm" != "yes" ]; then + echo "Cancelled." + return 0 + fi + response=$(curl -s -X POST \ + --header "Authorization: Bearer $MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" \ + --header 'Content-Type: application/json' \ + "$MC_IAM_MANAGER_HOST/api/setup/initial-menus?force=true") + echo "Force re-seed response: $response" + if echo "$response" | jq -e '.error' > /dev/null 2>&1; then + echo "ERROR: Force re-seed failed" + return 1 + fi + echo "Role permission backup: $(echo "$response" | jq -r '.backupPath // "(none)"')" + echo "Orphan menus (in DB, not in yaml): $(echo "$response" | jq -r '(.orphanMenusDetected // []) | join(", ")')" + echo "Missing permission menu ids: $(echo "$response" | jq -r '(.missingPermissionMenuIDs // []) | join(", ")')" } # Manual re-seed only (option 4a below) — option 4) no longer calls this @@ -264,8 +295,9 @@ while true; do echo "1. Init Platform And PlatformAdmin" echo "2. PlatformAdmin Login" echo "3. Init Role Data" - echo "4. Init Menu Data (role-menu YAML permissions chained server-side)" - echo "4a. Init Menu Role Permissions (YAML) (re-seed only)" + echo "4. Init Menu Data (first install; skips if menus exist; role-menu YAML permissions chained server-side)" + echo "4a. Init Menu Role Permissions (YAML) (additive re-seed only)" + echo "4b. Force re-seed Menu Data (overwrites DB-edited menus; role mappings backed up first)" echo "5. Init API Resource Data" echo "6. Init Cloud Resource Data" echo "7. Map API-Cloud Resources" @@ -311,6 +343,14 @@ while true; do init_menu_permissions fi ;; + 4b) + if [ -z "$MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" ]; then + echo "Please login first (option 2)" + echo "Current token value: '$MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN'" + else + force_reseed_menu + fi + ;; 5) if [ -z "$MC_IAM_MANAGER_PLATFORMADMIN_ACCESSTOKEN" ]; then echo "Please login first (option 2)" diff --git a/conf/docker/conf/mc-iam-manager/permission.yaml b/conf/docker/conf/mc-iam-manager/permission.yaml index a8c21f4..2245413 100644 --- a/conf/docker/conf/mc-iam-manager/permission.yaml +++ b/conf/docker/conf/mc-iam-manager/permission.yaml @@ -1,33 +1,18 @@ # asset/menu/permission.yaml # Role-centric permissions: permissions → role → menus | operations | csps -# - menus: mcmp_menus.id 목록 (역할별 접근 가능 메뉴) +# - menus: mcmp_menus.id 목록 (역할별 접근 가능 메뉴). 컨테이너(비-action) 메뉴도 +# 포함해야 사이드바 트리가 끊기지 않는다. # - operations: (reserved) framework/API operation 권한 ID — 향후 시드 # - csps: (reserved) CSP 관련 권한/역할 키 — 향후 시드 -# Source: permission.csv invert + remote menu ID remaps (2026-07-15) +# Menu ids must exist in mc-web-console conf/webconsole_menu_resources.yaml +# (the canonical catalog); unknown ids are skipped at seed time and reported +# as missingPermissionMenuIDs. +# Aligned to catalog revision: mc-web-console develop 3a015768 (61 menus) # Bundled for admin-cli: compose mounts to /app/asset/menu/permission.yaml permissions: - role: admin menus: - - operations - - manage - - workspaces - - projects - - projectboard - - members - - roles - - csproles - - workloads - - infraworkloads - - k8sworkloads - - workflows - - swcatalogs - - mcdatamanager - - datamigrations - - generateobjectstorage - - generaterdb - - analytics - - costanalysis - - observability + # Settings - settings - accountnaccess - organizations @@ -40,30 +25,57 @@ permissions: - environment - cloudsps - cloudoverview - - regions + - credentials - connections - clouddrivers - - credentials - cspaccounts - cloudresources - serverspecs - - specs - - images - serverimages - networks - securitygroups - - securitys - myimages - - disks - sshkeys - - csp - - cspschedule + - disks + - nlbs - resourcesync - - cloudrescatalogs - - workspacessettings - - allocatedprojects - - sharemembers - - allocaterolesws + # Operations > Manage + - operations + - manage + - workspaces + - projects + - roles + - csproles + - workloads + - infraworkloads + - k8sworkloads + - workflows + - mcworkflows + - mceventlistener + - applications + - swcatalogs + - appstatus + - apprepository + - mcdatamanager + - mcdatagenerate + - mcdatamigration + - mcdatabackup + - mcdatarestore + - mcdatalogmanager + # Operations > Analytics + - analytics + - costanalysis + - costdashboard + - billingreport + - costalarm + - budget + - mcobservability + - mco11ymonitorings + - mc011ylogs + - mc011yconfig + - mc011yinsight + - mc011yalerts + - mc011ytracing operations: [] csps: [] @@ -75,6 +87,10 @@ permissions: - infraworkloads - analytics - costanalysis + - costdashboard + - billingreport + - costalarm + - budget operations: [] csps: [] @@ -83,6 +99,8 @@ permissions: - operations - analytics - costanalysis + - costdashboard + - billingreport operations: [] csps: [] @@ -94,27 +112,35 @@ permissions: - infraworkloads - k8sworkloads - workflows + - mcworkflows + - mceventlistener + - applications - swcatalogs + - appstatus + - apprepository - mcdatamanager - - datamigrations - - generateobjectstorage - - generaterdb + - mcdatagenerate + - mcdatamigration + - mcdatabackup + - mcdatarestore + - mcdatalogmanager - analytics - - observability + - mcobservability + - mco11ymonitorings + - mc011ylogs + - mc011yconfig + - mc011yinsight + - mc011yalerts + - mc011ytracing - settings - environment - cloudsps - cloudoverview - - regions - cloudresources - - specs - - images - networks - - securitys - myimages - - disks - sshkeys - - cloudrescatalogs + - disks operations: [] csps: [] @@ -122,9 +148,10 @@ permissions: menus: - operations - analytics - - observability - - settings - - environment - - cloudrescatalogs + - mcobservability + - mco11ymonitorings + - mc011ylogs + - mc011yinsight + - mc011ytracing operations: [] csps: [] diff --git a/conf/docker/conf/mc-web-console/api/conf/api.yaml b/conf/docker/conf/mc-web-console/api/conf/api.yaml index eb41d60..853a4b0 100644 --- a/conf/docker/conf/mc-web-console/api/conf/api.yaml +++ b/conf/docker/conf/mc-web-console/api/conf/api.yaml @@ -1233,7 +1233,7 @@ serviceActions: InitialMenus: method: post resourcePath: /api/setup/initial-menus - description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync." + description: "메뉴 카탈로그 yaml 시딩 (1_setup_auto.sh init_menu와 동일). 메뉴가 이미 있으면 skip(200, skipped=true); queryParams force=true면 역할-메뉴 매핑 백업 후 덮어씀. FR-006-08 Force re-seed." SyncMcmpApis: method: post resourcePath: /api/setup/sync-mcmp-apis diff --git a/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml b/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml index 7928f1e..21bc940 100644 --- a/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml +++ b/conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml @@ -1,36 +1,35 @@ menus: - - id: settings parentid: home displayname: Settings restype: menu isaction: false - priority: 4 - menunumber: 1200 + priority: 2 + menunumber: 1000 - id: accountnaccess parentid: settings displayname: Account & Access restype: menu isaction: false - priority: 2 - menunumber: 1201 + priority: 1 + menunumber: 1100 - id: organizations parentid: accountnaccess displayname: Organizations restype: menu isaction: false - priority: 2 - menunumber: 1205 + priority: 1 + menunumber: 1101 - id: companyinfo parentid: organizations displayname: Company Info restype: menu - isaction: false - priority: 2 - menunumber: 1212 + isaction: true + priority: 1 + menunumber: 1102 - id: users parentid: organizations @@ -38,39 +37,40 @@ menus: restype: menu isaction: true priority: 2 - menunumber: 1220 + menunumber: 1103 - id: groups parentid: organizations displayname: Groups restype: menu isaction: true - priority: 2 - menunumber: 1225 + priority: 3 + menunumber: 1104 - id: approvals parentid: organizations displayname: Approvals restype: menu isaction: true - priority: 2 - menunumber: 1230 + priority: 4 + menunumber: 1105 + icon: approvals - id: accesscontrols parentid: organizations displayname: Access Controls restype: menu isaction: false - priority: 2 - menunumber: 1240 + priority: 5 + menunumber: 1106 - id: menus parentid: organizations displayname: Menus restype: menu isaction: true - priority: 2 - menunumber: 1250 + priority: 6 + menunumber: 1107 - id: environment parentid: settings @@ -78,23 +78,23 @@ menus: restype: menu isaction: false priority: 2 - menunumber: 1301 + menunumber: 1200 - id: cloudsps parentid: environment displayname: Cloud SPs restype: menu isaction: false - priority: 2 - menunumber: 1305 + priority: 1 + menunumber: 1201 - id: cloudoverview parentid: cloudsps displayname: Cloud Overview restype: menu isaction: true - priority: 2 - menunumber: 1310 + priority: 1 + menunumber: 1202 - id: credentials parentid: cloudsps @@ -102,23 +102,31 @@ menus: restype: menu isaction: true priority: 2 - menunumber: 1320 + menunumber: 1203 - id: connections parentid: cloudsps displayname: Connections restype: menu isaction: true - priority: 2 - menunumber: 1330 + priority: 3 + menunumber: 1204 + + - id: clouddrivers + parentid: cloudsps + displayname: Cloud Drivers + restype: menu + isaction: true + priority: 4 + menunumber: 1205 - id: cspaccounts parentid: cloudsps displayname: CSP Accounts restype: menu isaction: false - priority: 2 - menunumber: 1360 + priority: 5 + menunumber: 1206 - id: cloudresources parentid: environment @@ -126,15 +134,15 @@ menus: restype: menu isaction: false priority: 2 - menunumber: 1405 + menunumber: 1207 - id: serverspecs parentid: cloudresources displayname: Specs restype: menu isaction: true - priority: 2 - menunumber: 1410 + priority: 1 + menunumber: 1208 - id: serverimages parentid: cloudresources @@ -142,143 +150,95 @@ menus: restype: menu isaction: true priority: 2 - menunumber: 1420 + menunumber: 1209 - id: networks parentid: cloudresources displayname: Networks restype: menu isaction: true - priority: 2 - menunumber: 1510 + priority: 3 + menunumber: 1210 - id: securitygroups parentid: cloudresources displayname: Security Groups restype: menu isaction: true - priority: 2 - menunumber: 1520 + priority: 4 + menunumber: 1211 - id: myimages parentid: cloudresources displayname: MyImages restype: menu isaction: true - priority: 2 - menunumber: 1530 + priority: 5 + menunumber: 1212 - - id: disks + - id: sshkeys parentid: cloudresources - displayname: Disks + displayname: SSH Keys restype: menu isaction: true - priority: 2 - menunumber: 1540 + priority: 6 + menunumber: 1213 - - id: sshkeys + - id: disks parentid: cloudresources - displayname: SSH Keys + displayname: Disks restype: menu isaction: true - priority: 2 - menunumber: 1550 + priority: 7 + menunumber: 1214 - id: nlbs parentid: cloudresources displayname: NLB restype: menu isaction: true - priority: 2 - menunumber: 1555 + priority: 8 + menunumber: 1215 - id: resourcesync parentid: cloudresources displayname: Resource Sync restype: menu isaction: true - priority: 3 - menunumber: 1595 - - - id: cloudrescatalogs - parentid: environment - displayname: Cloud Res Catalogs - restype: menu - isaction: false - priority: 2 - menunumber: 1560 - - - id: workspacessettings - parentid: environment - displayname: Workspaces Settings - restype: menu - isaction: false - priority: 2 - menunumber: 1660 - - - id: allocatedprojects - parentid: workspacessettings - displayname: Allocated Projects - restype: menu - isaction: false - priority: 2 - menunumber: 1665 - - - id: sharemembers - parentid: workspacessettings - displayname: Share Members - restype: menu - isaction: false - priority: 2 - menunumber: 1666 - - - id: allocaterolesws - parentid: workspacessettings - displayname: Access Controls - restype: menu - isaction: false - priority: 2 - menunumber: 1667 + priority: 9 + menunumber: 1216 - id: operations parentid: home displayname: Operations restype: menu isaction: false - priority: 2 - menunumber: 1700 + priority: 1 + menunumber: 2000 - id: manage parentid: operations displayname: Manage restype: menu isaction: false - priority: 2 - menunumber: 1701 + priority: 1 + menunumber: 2100 - id: workspaces parentid: manage displayname: Workspaces restype: menu isaction: true - priority: 2 - menunumber: 1710 + priority: 1 + menunumber: 2101 - id: projects parentid: workspaces displayname: Projects restype: menu - isaction: false - priority: 2 - menunumber: 1720 - - - id: members - parentid: workspaces - displayname: Members - restype: menu - isaction: false - priority: 2 - menunumber: 1730 + isaction: true + priority: 1 + menunumber: 2102 - id: roles parentid: workspaces @@ -286,23 +246,15 @@ menus: restype: menu isaction: true priority: 2 - menunumber: 1740 - + menunumber: 2103 + - id: csproles parentid: workspaces displayname: CSP Roles restype: menu isaction: true - priority: 2 - menunumber: 1741 - - - id: projectboard - parentid: workspaces - displayname: Project board - restype: menu - isaction: false - priority: 2 - menunumber: 1728 + priority: 3 + menunumber: 2104 - id: workloads parentid: manage @@ -310,163 +262,289 @@ menus: restype: menu isaction: false priority: 2 - menunumber: 1750 + menunumber: 2105 - - id: mciworkloads + - id: infraworkloads parentid: workloads displayname: Infra Workloads restype: menu isaction: true - priority: 2 - menunumber: 1760 + priority: 1 + menunumber: 2106 - - id: pmkworkloads + - id: k8sworkloads parentid: workloads displayname: K8s Workloads restype: menu isaction: true priority: 2 - menunumber: 1790 + menunumber: 2107 - id: workflows parentid: manage displayname: Workflows restype: menu + isaction: false + priority: 3 + menunumber: 2108 + + - id: mcworkflows + parentid: workflows + displayname: Workflows + restype: menu isaction: true - priority: 2 - menunumber: 1998 + priority: 1 + menunumber: 2109 viewtype: iframe frameworkservice: mc-workflow-manager-fe path: /web/workflow/list - - id: swcatalogs + - id: mceventlistener + parentid: workflows + displayname: Event Listeners + restype: menu + isaction: true + priority: 2 + menunumber: 2110 + viewtype: iframe + frameworkservice: mc-workflow-manager-fe + path: /web/workflows/eventListener/list + + - id: applications parentid: manage + displayname: Applications + restype: menu + isaction: false + priority: 4 + menunumber: 2111 + + - id: swcatalogs + parentid: applications displayname: SW Catalogs restype: menu isaction: true + priority: 1 + menunumber: 2112 + viewtype: iframe + frameworkservice: mc-application-manager-fe + path: /web/applications/swcatalog + + - id: appstatus + parentid: applications + displayname: App Status + restype: menu + isaction: true priority: 2 - menunumber: 1998 + menunumber: 2113 viewtype: iframe frameworkservice: mc-application-manager-fe - path: /web/softwareCatalog + path: /web/applications/status - - id: datamigrations + - id: apprepository + parentid: applications + displayname: Repository + restype: menu + isaction: true + priority: 3 + menunumber: 2114 + viewtype: iframe + frameworkservice: mc-application-manager-fe + path: /web/applications/repository + + - id: mcdatamanager parentid: manage displayname: Data Migrations restype: menu + isaction: false + priority: 5 + menunumber: 2115 + + - id: mcdatagenerate + parentid: mcdatamanager + displayname: Generate + restype: menu + isaction: true + priority: 1 + menunumber: 2116 + viewtype: iframe + frameworkservice: mc-data-manager-fe + path: /generate/objectstorage + + - id: mcdatamigration + parentid: mcdatamanager + displayname: Migration + restype: menu isaction: true priority: 2 - menunumber: 1998 + menunumber: 2117 viewtype: iframe frameworkservice: mc-data-manager-fe - path: / + path: /migrate/objectstorage + + - id: mcdatabackup + parentid: mcdatamanager + displayname: Back Up + restype: menu + isaction: true + priority: 3 + menunumber: 2118 + viewtype: iframe + frameworkservice: mc-data-manager-fe + path: /backup/register + + - id: mcdatarestore + parentid: mcdatamanager + displayname: Restore + restype: menu + isaction: true + priority: 4 + menunumber: 2119 + viewtype: iframe + frameworkservice: mc-data-manager-fe + path: /restore/register + + - id: mcdatalogmanager + parentid: mcdatamanager + displayname: Log Management + restype: menu + isaction: true + priority: 5 + menunumber: 2120 + viewtype: iframe + frameworkservice: mc-data-manager-fe + path: /log-management - id: analytics parentid: operations displayname: Analytics restype: menu isaction: false - priority: 3 - menunumber: 1901 - - # - id: monitorings - # parentid: analytics - # displayname: Monitorings - # restype: menu - # isaction: false - # priority: 2 - # menunumber: 1905 - - # - id: mcismonitoring - # parentid: monitorings - # displayname: MCIs Monitoring - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1910 - - # - id: 3rdpartymonitoring - # parentid: monitorings - # displayname: 3rd party Monitoring - # restype: menu - # isaction: false - # priority: 2 - # menunumber: 1930 - - # - id: monitoringconfig - # parentid: monitorings - # displayname: Monitoring Config - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1940 - - # - id: eventsntraces - # parentid: analytics - # displayname: Events & Traces - # restype: menu - # isaction: false - # priority: 2 - # menunumber: 1950 - - # - id: alarmshistory - # parentid: eventsntraces - # displayname: Alarms History - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1960 - - # - id: thresholdconfig - # parentid: eventsntraces - # displayname: Threshold Config - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1970 - - # - id: logmanage - # parentid: eventsntraces - # displayname: Log Manage - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1980 - - # - id: logconfig - # parentid: eventsntraces - # displayname: Log Config - # restype: menu - # isaction: true - # priority: 2 - # menunumber: 1990 - - # - id: eventtrace - # parentid: eventsntraces - # displayname: Event Trace - # restype: menu - # isaction: false - # priority: 2 - # menunumber: 1996 + priority: 2 + menunumber: 2200 - id: costanalysis parentid: analytics displayname: Cost Analysis restype: menu + isaction: false + priority: 1 + menunumber: 2201 + + - id: costdashboard + parentid: costanalysis + displayname: Dash Board + restype: menu isaction: true - priority: 2 - menunumber: 1998 + priority: 1 + menunumber: 2202 viewtype: iframe frameworkservice: mc-cost-optimizer-fe path: / - - id: observability + - id: billingreport + parentid: costanalysis + displayname: Billing Report + restype: menu + isaction: true + priority: 2 + menunumber: 2203 + viewtype: iframe + frameworkservice: mc-cost-optimizer-fe + path: /billing-report + + - id: costalarm + parentid: costanalysis + displayname: Cost Alarm + restype: menu + isaction: true + priority: 3 + menunumber: 2204 + viewtype: iframe + frameworkservice: mc-cost-optimizer-fe + path: /alarm + + - id: budget + parentid: costanalysis + displayname: Budget + restype: menu + isaction: true + priority: 4 + menunumber: 2205 + viewtype: iframe + frameworkservice: mc-cost-optimizer-fe + path: /budget + + - id: mcobservability parentid: analytics displayname: Monitorings restype: menu + isaction: false + priority: 2 + menunumber: 2206 + + - id: mco11ymonitorings + parentid: mcobservability + displayname: Monitoring + restype: menu + isaction: true + priority: 1 + menunumber: 2207 + viewtype: iframe + frameworkservice: mc-observability-fe + path: /embed/monitoring + + - id: mc011ylogs + parentid: mcobservability + displayname: Logs + restype: menu + isaction: true + priority: 2 + menunumber: 2208 + viewtype: iframe + frameworkservice: mc-observability-fe + path: /embed/logs + + - id: mc011yconfig + parentid: mcobservability + displayname: Config + restype: menu isaction: true priority: 3 - menunumber: 1999 + menunumber: 2209 viewtype: iframe frameworkservice: mc-observability-fe - path: / + path: /embed/config + + - id: mc011yinsight + parentid: mcobservability + displayname: Insight + restype: menu + isaction: true + priority: 4 + menunumber: 2210 + viewtype: iframe + frameworkservice: mc-observability-fe + path: /embed/insight + + - id: mc011yalerts + parentid: mcobservability + displayname: Alert + restype: menu + isaction: true + priority: 5 + menunumber: 2211 + viewtype: iframe + frameworkservice: mc-observability-fe + path: /embed/alerts + + - id: mc011ytracing + parentid: mcobservability + displayname: Tracing + restype: menu + isaction: true + priority: 6 + menunumber: 2212 + viewtype: iframe + frameworkservice: mc-observability-fe + path: /embed/trace + diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml index f9bd3b4..b25d7e7 100644 --- a/conf/docker/docker-compose.mini.yaml +++ b/conf/docker/docker-compose.mini.yaml @@ -240,6 +240,11 @@ services: - ./conf/mc-iam-manager/.env volumes: - ./tool/mcc:/app/tool/mcc + # Menu catalog seed (bundled copy of mc-web-console conf/webconsole_menu_resources.yaml), + # read once at first install via MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml + - ./conf/mc-web-console/api/conf/webconsole_menu_resources.yaml:/app/asset/menu/webconsole_menu_resources.yaml:ro + # Role-menu seed overlay (post-init calls YAML API without filePath) + - ./conf/mc-iam-manager/permission.yaml:/app/asset/menu/permission.yaml:ro healthcheck: test: [ "CMD", "/app/tool/mcc", "rest", "get", "http://${MC_IAM_MANAGER_DOMAIN}:${MC_IAM_MANAGER_PORT}/readyz" ] <<: *default-health-check diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index 1390da4..a166dfa 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -270,6 +270,11 @@ services: - ./conf/mc-iam-manager/.env volumes: - ./tool/mcc:/app/tool/mcc + # Menu catalog seed: bundled copy of mc-web-console conf/webconsole_menu_resources.yaml + # (same file mc-web-console-api mounts for self mode). Read once at first install via + # MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml; later menu changes + # live in the IAM DB. Not mounted over asset/menu/menu.yaml, which IAM uses as a URL cache. + - ./conf/mc-web-console/api/conf/webconsole_menu_resources.yaml:/app/asset/menu/webconsole_menu_resources.yaml:ro # Role-menu seed overlay (SSOT bundle; post-init calls YAML API without filePath) - ./conf/mc-iam-manager/permission.yaml:/app/asset/menu/permission.yaml:ro healthcheck: diff --git a/conf/docker/menu.yaml b/conf/docker/menu.yaml deleted file mode 100644 index 823d654..0000000 --- a/conf/docker/menu.yaml +++ /dev/null @@ -1,417 +0,0 @@ -menus: - - - id: settings - parentid: home - displayname: Settings - restype: menu - isaction: false - priority: 4 - menunumber: 1200 - - - id: accountnaccess - parentid: settings - displayname: Account & Access - restype: menu - isaction: false - priority: 2 - menunumber: 1201 - - - id: organizations - parentid: accountnaccess - displayname: Organizations - restype: menu - isaction: false - priority: 2 - menunumber: 1205 - - - id: companyinfo - parentid: organizations - displayname: Company Info - restype: menu - isaction: false - priority: 2 - menunumber: 1212 - - - id: users - parentid: organizations - displayname: Users - restype: menu - isaction: true - priority: 2 - menunumber: 1220 - - - id: approvals - parentid: organizations - displayname: Approvals - restype: menu - isaction: false - priority: 2 - menunumber: 1230 - - - id: accesscontrols - parentid: organizations - displayname: Access Controls - restype: menu - isaction: false - priority: 2 - menunumber: 1240 - - - id: environment - parentid: settings - displayname: Environment - restype: menu - isaction: false - priority: 2 - menunumber: 1301 - - - id: cloudsps - parentid: environment - displayname: Cloud SPs - restype: menu - isaction: false - priority: 2 - menunumber: 1305 - - - id: cloudoverview - parentid: cloudsps - displayname: Cloud Overview - restype: menu - isaction: false - priority: 2 - menunumber: 1310 - - - id: regions - parentid: cloudsps - displayname: Regions - restype: menu - isaction: false - priority: 2 - menunumber: 1320 - - - id: connections - parentid: cloudsps - displayname: Connections - restype: menu - isaction: false - priority: 2 - menunumber: 1330 - - - id: clouddrivers - parentid: cloudsps - displayname: Cloud Drivers - restype: menu - isaction: false - priority: 2 - menunumber: 1340 - - - id: credentials - parentid: cloudsps - displayname: Credentials - restype: menu - isaction: false - priority: 2 - menunumber: 1350 - - - id: cloudresources - parentid: environment - displayname: Cloud Resources - restype: menu - isaction: false - priority: 2 - menunumber: 1405 - - - id: specs - parentid: cloudresources - displayname: Specs - restype: menu - isaction: false - priority: 2 - menunumber: 1410 - - - id: images - parentid: cloudresources - displayname: Images - restype: menu - isaction: false - priority: 2 - menunumber: 1420 - - - id: networks - parentid: cloudresources - displayname: Networks - restype: menu - isaction: false - priority: 2 - menunumber: 1510 - - - id: securitys - parentid: cloudresources - displayname: Securitys - restype: menu - isaction: false - priority: 2 - menunumber: 1520 - - - id: myimages - parentid: cloudresources - displayname: MyImages - restype: menu - isaction: false - priority: 2 - menunumber: 1530 - - - id: disks - parentid: cloudresources - displayname: Disks - restype: menu - isaction: false - priority: 2 - menunumber: 1540 - - - id: sshkeys - parentid: cloudresources - displayname: SSH Keys - restype: menu - isaction: false - priority: 2 - menunumber: 1550 - - - id: cloudrescatalogs - parentid: environment - displayname: Cloud Res Catalogs - restype: menu - isaction: false - priority: 2 - menunumber: 1560 - - - id: workspacessettings - parentid: environment - displayname: Workspaces Settings - restype: menu - isaction: false - priority: 2 - menunumber: 1660 - - - id: allocatedprojects - parentid: workspacessettings - displayname: Allocated Projects - restype: menu - isaction: false - priority: 2 - menunumber: 1665 - - - id: sharemembers - parentid: workspacessettings - displayname: Share Members - restype: menu - isaction: false - priority: 2 - menunumber: 1666 - - - id: allocaterolesws - parentid: workspacessettings - displayname: Access Controls - restype: menu - isaction: false - priority: 2 - menunumber: 1667 - - - id: operations - parentid: home - displayname: Operations - restype: menu - isaction: false - priority: 2 - menunumber: 1700 - - - id: manage - parentid: operations - displayname: Manage - restype: menu - isaction: false - priority: 2 - menunumber: 1701 - - - id: workspaces - parentid: manage - displayname: Workspaces - restype: menu - isaction: true - priority: 2 - menunumber: 1710 - - - id: projects - parentid: workspaces - displayname: Projects - restype: menu - isaction: false - priority: 2 - menunumber: 1720 - - - id: members - parentid: workspaces - displayname: Members - restype: menu - isaction: false - priority: 2 - menunumber: 1730 - - - id: roles - parentid: workspaces - displayname: Roles - restype: menu - isaction: true - priority: 2 - menunumber: 1740 - - - id: projectboard - parentid: workspaces - displayname: Project board - restype: menu - isaction: false - priority: 2 - menunumber: 1728 - - - id: workloads - parentid: manage - displayname: Workloads - restype: menu - isaction: false - priority: 2 - menunumber: 1750 - - - id: infraworkloads - parentid: workloads - displayname: Infra Workloads - restype: menu - isaction: true - priority: 2 - menunumber: 1760 - - - id: k8sworkloads - parentid: workloads - displayname: K8s Workloads - restype: menu - isaction: true - priority: 2 - menunumber: 1790 - - - id: workflows - parentid: manage - displayname: Workflows - restype: menu - isaction: true - priority: 2 - menunumber: 1998 - - - id: swcatalogs - parentid: manage - displayname: SW Catalogs - restype: menu - isaction: true - priority: 2 - menunumber: 1998 - - - id: datamigrations - parentid: manage - displayname: Data Migrations - restype: menu - isaction: true - priority: 2 - menunumber: 1998 - - - id: analytics - parentid: operations - displayname: Analytics - restype: menu - isaction: false - priority: 3 - menunumber: 1901 - - - id: monitorings - parentid: analytics - displayname: Monitorings - restype: menu - isaction: false - priority: 2 - menunumber: 1905 - - - id: mcismonitoring - parentid: monitorings - displayname: MCIs Monitoring - restype: menu - isaction: true - priority: 2 - menunumber: 1910 - - - id: 3rdpartymonitoring - parentid: monitorings - displayname: 3rd party Monitoring - restype: menu - isaction: false - priority: 2 - menunumber: 1930 - - - id: monitoringconfig - parentid: monitorings - displayname: Monitoring Config - restype: menu - isaction: true - priority: 2 - menunumber: 1940 - - - id: eventsntraces - parentid: analytics - displayname: Events & Traces - restype: menu - isaction: false - priority: 2 - menunumber: 1950 - - - id: alarmshistory - parentid: eventsntraces - displayname: Alarms History - restype: menu - isaction: true - priority: 2 - menunumber: 1960 - - - id: thresholdconfig - parentid: eventsntraces - displayname: Threshold Config - restype: menu - isaction: true - priority: 2 - menunumber: 1970 - - - id: logmanage - parentid: eventsntraces - displayname: Log Manage - restype: menu - isaction: true - priority: 2 - menunumber: 1980 - - - id: logconfig - parentid: eventsntraces - displayname: Log Config - restype: menu - isaction: true - priority: 2 - menunumber: 1990 - - - id: eventtrace - parentid: eventsntraces - displayname: Event Trace - restype: menu - isaction: false - priority: 2 - menunumber: 1996 - - - id: costanalysis - parentid: analytics - displayname: Cost Analysis - restype: menu - isaction: true - priority: 2 - menunumber: 1998 diff --git a/docs/running-on-instance.md b/docs/running-on-instance.md index 88ff8e9..46c04a1 100644 --- a/docs/running-on-instance.md +++ b/docs/running-on-instance.md @@ -105,7 +105,9 @@ cd ~/workspace/mc-admin-cli/bin ./installAll.sh ``` -`installAll.sh` prompts interactively for deployment mode and domain (see the main [README's Quick Guide](https://github.com/m-cmp/mc-admin-cli#quick-guide) for the Mode A/Mode B distinction and non-interactive flags), generates TLS certs and nginx config, then starts every container — including `mc-iam-manager-post-initial`, a one-shot setup container that seeds Keycloak realms/roles, registers the platform's menu catalog (mc-web-console's `conf/webconsole_menu_resources.yaml`, fetched via `MC_WEB_CONSOLE_MENUYAML`), and seeds role-menu permissions (mc-iam-manager's `asset/menu/permission.yaml`). This container exiting with code `0` is expected, not a failure. +`installAll.sh` prompts interactively for deployment mode and domain (see the main [README's Quick Guide](https://github.com/m-cmp/mc-admin-cli#quick-guide) for the Mode A/Mode B distinction and non-interactive flags), generates TLS certs and nginx config, then starts every container — including `mc-iam-manager-post-initial`, a one-shot setup container that seeds Keycloak realms/roles, seeds the platform's menu catalog (the bundled copy `conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml`, mounted into mc-iam-manager and pointed to by `MC_WEB_CONSOLE_MENUYAML`), and seeds role-menu permissions (bundled `conf/docker/conf/mc-iam-manager/permission.yaml`). Both seeds are applied once at first install; afterwards menus and role-menu mappings are edited in the console and live in the IAM DB (re-running post-init skips the menu step). This container exiting with code `0` is expected, not a failure. + +Upgrading an existing install: `installAll.sh` only adds *missing* variables to your `.env` files, so if `conf/docker/conf/mc-iam-manager/.env` still has `MC_WEB_CONSOLE_MENUYAML` set to the old raw GitHub URL, change it to `asset/menu/webconsole_menu_resources.yaml` (or keep the URL deliberately) before re-running. Allow a few minutes for every container to reach a healthy state. From 292ad638df0203281cda0630be672c47500811b7 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 15:25:42 +0900 Subject: [PATCH 14/22] fix(iam-nginx): resolve upstream hosts at request time to prevent clean-install crash loop On a fresh install the IAM/KC proxy blocks resolved their upstream hostnames at config-parse time, so nginx died with [emerg] host not found before the mc-iam-manager container existed. Switch the four static proxy_pass directives to the resolver + variable pattern already used by the other server blocks so nginx starts regardless of container startup order. The /auth/ block drops its literal URI: with a variable proxy_pass a literal URI replaces the entire request path, which would break /auth/realms/* subpaths (also fixed in the local template where this latent defect already existed). --- .../conf/mc-iam-manager/nginx.template.conf | 18 ++++++++++++++---- .../mc-iam-manager/nginx.template.local.conf | 4 +++- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/conf/docker/conf/mc-iam-manager/nginx.template.conf b/conf/docker/conf/mc-iam-manager/nginx.template.conf index 0a70e6b..f7dc69d 100644 --- a/conf/docker/conf/mc-iam-manager/nginx.template.conf +++ b/conf/docker/conf/mc-iam-manager/nginx.template.conf @@ -53,7 +53,9 @@ http { # Health check endpoint (accessible over HTTP) location /health { - proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz; + resolver 127.0.0.11 valid=10s; + set $upstream_iam ${MC_IAM_MANAGER_DOMAIN}; + proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -100,7 +102,9 @@ http { # Health check endpoint (accessible over HTTPS as well) location /health { - proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz; + resolver 127.0.0.11 valid=10s; + set $upstream_iam ${MC_IAM_MANAGER_DOMAIN}; + proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -115,7 +119,9 @@ http { } location / { - proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}; + resolver 127.0.0.11 valid=10s; + set $upstream_iam ${MC_IAM_MANAGER_DOMAIN}; + proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -130,7 +136,11 @@ http { } location /auth/ { - proxy_pass http://mc-iam-manager-kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/; + resolver 127.0.0.11 valid=10s; + set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}; + # No URI on variable proxy_pass: the original request URI is passed + # through unchanged (a literal URI here would replace the whole path) + proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; diff --git a/conf/docker/conf/mc-iam-manager/nginx.template.local.conf b/conf/docker/conf/mc-iam-manager/nginx.template.local.conf index 4b716f8..401872a 100644 --- a/conf/docker/conf/mc-iam-manager/nginx.template.local.conf +++ b/conf/docker/conf/mc-iam-manager/nginx.template.local.conf @@ -60,7 +60,9 @@ http { location /auth/ { resolver 127.0.0.11 valid=10s; set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}; - proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/; + # No URI on variable proxy_pass: the original request URI is passed + # through unchanged (a literal URI here would replace the whole path) + proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; From dc56a7d5bb58e4f0135d6d392c69ef8a70a92c29 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 15:26:16 +0900 Subject: [PATCH 15/22] fix(compose): drop mc-iam-manager dependency on nginx to break startup deadlock mc-iam-manager waited for mc-iam-manager-nginx (service_started) while nginx itself could not start until the mc-iam-manager DNS name existed, leaving both stuck on a fresh install. The IAM manager has no startup dependency on nginx (Keycloak and its own healthcheck are reached directly), and the standalone mc-iam-manager repository already runs with this dependency removed. --- conf/docker/docker-compose.mini.yaml | 1 - conf/docker/docker-compose.yaml | 2 -- 2 files changed, 3 deletions(-) diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml index f9bd3b4..d995cae 100644 --- a/conf/docker/docker-compose.mini.yaml +++ b/conf/docker/docker-compose.mini.yaml @@ -232,7 +232,6 @@ services: depends_on: - mc-iam-manager-db - mc-iam-manager-kc - - mc-iam-manager-nginx environment: DATABASE_URL: postgres://${MC_IAM_MANAGER_DATABASE_USER}:${MC_IAM_MANAGER_DATABASE_PASSWORD}@${MC_IAM_MANAGER_DATABASE_HOST}:5432/${MC_IAM_MANAGER_DATABASE_NAME} PORT: ${MC_IAM_MANAGER_PORT} diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index 1390da4..fcbcee8 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -259,8 +259,6 @@ services: condition: service_healthy mc-iam-manager-kc: condition: service_healthy - mc-iam-manager-nginx: - condition: service_started mc-infra-manager: condition: service_healthy environment: From c35b0cc3fb998fa000e39b9e1a691d79e30280ae Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 15:26:45 +0900 Subject: [PATCH 16/22] feat(compose): add healthcheck to mc-iam-manager-nginx Uses the /nginx-health endpoint already served by the templates so a crash-looping or misconfigured nginx is visible in compose ps instead of reporting plain Up. No service depends on nginx being healthy, so startup ordering is unaffected. --- conf/docker/docker-compose.mini.yaml | 3 +++ conf/docker/docker-compose.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml index d995cae..5c6d4e8 100644 --- a/conf/docker/docker-compose.mini.yaml +++ b/conf/docker/docker-compose.mini.yaml @@ -325,6 +325,9 @@ services: - ./container-volume/certbot/www:/var/www/certbot:ro depends_on: - mc-iam-manager-kc + healthcheck: + test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ] + <<: *default-health-check networks: - mc-iam-manager-network diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index fcbcee8..b67632e 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -365,6 +365,9 @@ services: - ./container-volume/certbot/www:/var/www/certbot:ro depends_on: - mc-iam-manager-kc + healthcheck: + test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ] + <<: *default-health-check networks: - mc-iam-manager-network - mc-observability-network From 40f3be7fa05d36062b10d06bbaad695e4b687cc6 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 15:27:08 +0900 Subject: [PATCH 17/22] fix(preset): substitute MC_OBSERVABILITY_FRONT_PORT in local nginx preset The dev/prod preset scripts gained this substitution earlier but the local script was missed, leaving a literal ${MC_OBSERVABILITY_FRONT_PORT} listen directive in the generated nginx.conf and failing nginx startup in local mode. --- conf/docker/conf/mc-iam-manager/0_preset_local.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/conf/docker/conf/mc-iam-manager/0_preset_local.sh b/conf/docker/conf/mc-iam-manager/0_preset_local.sh index 0cbfd2b..3a775f6 100755 --- a/conf/docker/conf/mc-iam-manager/0_preset_local.sh +++ b/conf/docker/conf/mc-iam-manager/0_preset_local.sh @@ -220,6 +220,7 @@ if [ -n "$MC_IAM_MANAGER_PUBLIC_DOMAIN" ] && [ -n "$MC_IAM_MANAGER_KEYCLOAK_PORT -e "s/\${MC_WORKFLOW_MANAGER_PROXY_PORT}/$MC_WORKFLOW_MANAGER_PROXY_PORT/g" \ -e "s/\${MC_DATA_MANAGER_PROXY_PORT}/$MC_DATA_MANAGER_PROXY_PORT/g" \ -e "s/\${MC_APPLICATION_MANAGER_PROXY_PORT}/$MC_APPLICATION_MANAGER_PROXY_PORT/g" \ + -e "s/\${MC_OBSERVABILITY_FRONT_PORT}/$MC_OBSERVABILITY_FRONT_PORT/g" \ "$TEMPLATE_FILE" > "$OUTPUT_FILE" echo "✓ nginx.conf generated (HTTP mode)" else From 60b134301ec69eb9b6453e4f1485eccdc745ac7c Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 15:29:26 +0900 Subject: [PATCH 18/22] fix(preset): substitute MC_IAM_MANAGER_DOMAIN in prod nginx preset The prod preset read MC_IAM_MANAGER_DOMAIN but never applied it to the generated nginx.conf. This was a no-op while the template hardcoded the container hostname; with the resolver/variable pattern the token must be substituted or nginx fails to parse the config. --- conf/docker/conf/mc-iam-manager/0_preset_prod.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/conf/docker/conf/mc-iam-manager/0_preset_prod.sh b/conf/docker/conf/mc-iam-manager/0_preset_prod.sh index 9a25bb6..780ff4d 100755 --- a/conf/docker/conf/mc-iam-manager/0_preset_prod.sh +++ b/conf/docker/conf/mc-iam-manager/0_preset_prod.sh @@ -62,6 +62,13 @@ echo " MC_COST_OPTIMIZER_FE_PROXY_PORT: $MC_COST_OPTIMIZER_FE_PROXY_PORT" # Copy template file and substitute environment variables cp "$TEMPLATE_FILE" "$OUTPUT_FILE" || { echo "Error: Failed to copy template file: $TEMPLATE_FILE → $OUTPUT_FILE"; exit 1; } +if [ -n "$MC_IAM_MANAGER_DOMAIN" ]; then + sed -i "s/\${MC_IAM_MANAGER_DOMAIN}/$MC_IAM_MANAGER_DOMAIN/g" "$OUTPUT_FILE" + echo "✓ MC_IAM_MANAGER_DOMAIN substitution done: $MC_IAM_MANAGER_DOMAIN" +else + echo "Warning: MC_IAM_MANAGER_DOMAIN environment variable is not set." +fi + if [ -n "$MC_IAM_MANAGER_PORT" ]; then sed -i "s/\${MC_IAM_MANAGER_PORT}/$MC_IAM_MANAGER_PORT/g" "$OUTPUT_FILE" echo "✓ MC_IAM_MANAGER_PORT substitution done: $MC_IAM_MANAGER_PORT" From b740ed0bd6eb3e5df5f63e8dcbfa5a650e4f5f20 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Fri, 7 Aug 2026 16:11:11 +0900 Subject: [PATCH 19/22] fix(install): start mc-iam-manager-nginx explicitly in wave 1 nginx was only ever started as a side effect of mc-iam-manager's compose dependency. With that dependency removed, no wave listed nginx, so a fresh install brought up the IAM manager without its public-domain endpoints and it never became healthy. List nginx in wave 1 ahead of the IAM manager. --- bin/installAll.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/installAll.sh b/bin/installAll.sh index 7f0434d..5691113 100755 --- a/bin/installAll.sh +++ b/bin/installAll.sh @@ -157,8 +157,12 @@ EXIT_STREAK_THRESHOLD=3 # depends_on chain automatically (already-running dependencies are a no-op). # mc-application-manager/mc-cost-optimizer-* depend on mc-observability-rabbitmq, # so the observability backbone wave runs before the app-tier wave. +# mc-iam-manager-nginx is listed explicitly: mc-iam-manager no longer declares a +# compose dependency on it (that dependency caused a startup deadlock), but the +# IAM manager still needs the public-domain endpoints nginx serves to become +# healthy, so nginx must start in the same wave. STARTUP_WAVES=( - "mc-infra-connector mc-infra-manager mc-iam-manager mc-iam-manager-post-initial" + "mc-infra-connector mc-infra-manager mc-iam-manager-nginx mc-iam-manager mc-iam-manager-post-initial" "mc-data-manager mc-web-console-api mc-web-console-front" "mc-observability-manager mc-observability-front mc-observability-insight mc-observability-insight-scheduler mc-observability-mcp-grafana mc-observability-mcp-maria mc-observability-mcp-influx mc-observability-log-collector" "mc-application-manager mc-workflow-manager mc-cost-optimizer-fe" From e6b077856221957955445a9620392e1159ad728b Mon Sep 17 00:00:00 2001 From: yh-noh Date: Wed, 9 Sep 2026 01:25:24 +0000 Subject: [PATCH 20/22] chore: bump mc-iam-manager, mc-web-console-api/front to 0.6.3 --- conf/docker/docker-compose.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index b67632e..58aa898 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -244,7 +244,7 @@ services: mc-iam-manager: container_name: mc-iam-manager - image: cloudbaristaorg/mc-iam-manager:0.6.2 + image: cloudbaristaorg/mc-iam-manager:0.6.3 restart: unless-stopped networks: - mc-iam-manager-network @@ -1113,7 +1113,7 @@ services: exec docker-entrypoint.sh postgres" mc-web-console-api: - image: cloudbaristaorg/mc-web-console-api:0.6.2 + image: cloudbaristaorg/mc-web-console-api:0.6.3 pull_policy: always container_name: mc-web-console-api platform: linux/amd64 @@ -1157,7 +1157,7 @@ services: <<: *default-health-check mc-web-console-front: - image: cloudbaristaorg/mc-web-console-front:0.6.2 + image: cloudbaristaorg/mc-web-console-front:0.6.3 pull_policy: always container_name: mc-web-console-front platform: linux/amd64 From 2b38ad4537f56a057360054636c93a8dd292a516 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Thu, 10 Sep 2026 01:52:20 +0000 Subject: [PATCH 21/22] chore: bump mc-iam-manager image to 0.6.3 Follows the m-cmp/mc-iam-manager v0.6.3 release (2026-09-09). Both the full and mini compose files are updated. --- conf/docker/docker-compose.mini.yaml | 2 +- conf/docker/docker-compose.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml index 5c6d4e8..eed1611 100644 --- a/conf/docker/docker-compose.mini.yaml +++ b/conf/docker/docker-compose.mini.yaml @@ -219,7 +219,7 @@ services: mc-iam-manager: container_name: mc-iam-manager - image: cloudbaristaorg/mc-iam-manager:0.6.2 + image: cloudbaristaorg/mc-iam-manager:0.6.3 restart: unless-stopped networks: - mc-iam-manager-network diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index b67632e..4d94cd9 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -244,7 +244,7 @@ services: mc-iam-manager: container_name: mc-iam-manager - image: cloudbaristaorg/mc-iam-manager:0.6.2 + image: cloudbaristaorg/mc-iam-manager:0.6.3 restart: unless-stopped networks: - mc-iam-manager-network From a9703153fc4d96eaa152b7df1a4dea1217bd0b45 Mon Sep 17 00:00:00 2001 From: yh-noh Date: Sat, 19 Sep 2026 03:23:58 +0000 Subject: [PATCH 22/22] chore: bump mc-web-console-api/front to 0.6.5 --- conf/docker/docker-compose.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml index 0518aa3..525d56b 100644 --- a/conf/docker/docker-compose.yaml +++ b/conf/docker/docker-compose.yaml @@ -1118,7 +1118,7 @@ services: exec docker-entrypoint.sh postgres" mc-web-console-api: - image: cloudbaristaorg/mc-web-console-api:0.6.3 + image: cloudbaristaorg/mc-web-console-api:0.6.5 pull_policy: always container_name: mc-web-console-api platform: linux/amd64 @@ -1162,7 +1162,7 @@ services: <<: *default-health-check mc-web-console-front: - image: cloudbaristaorg/mc-web-console-front:0.6.3 + image: cloudbaristaorg/mc-web-console-front:0.6.5 pull_policy: always container_name: mc-web-console-front platform: linux/amd64