m-cmp · MZC-CSC · Sep 24, 2026 · Aug 11, 2026 · Aug 10, 2026 · Aug 10, 2026
diff --git a/.gitignore b/.gitignore
@@ -67,7 +67,6 @@ bin/profile.json
 conf/docker/conf/mc-data-manager/data/var/run/data-manager/profile/profile.json
 conf/docker/conf/mc-data-manager/data/var/log/
 
-conf/docker/conf/mc-iam-manager/menu.yaml
 conf/docker/conf/mc-iam-manager/nginx.conf
 conf/docker/conf/mc-iam-manager/api.yaml
 

diff --git a/README.md b/README.md
@@ -17,7 +17,7 @@ If you have any difficulties in using mcc, please let us know.
 - Management tool that supports the installation, execution, status information provision, termination, and API calls of the M-CMP system.
 - Currently, infra subcommand is only support docker compose base infra install and management.
   - [infra subcommand](./docs/mc-admin-cli-infra.md)
-- If you want to checkout how to run the whole subsystem on the single instance on CSP Instance, see [this document](./docs/mc-admin-cli-infra.md).
+- If you want to checkout how to run the whole subsystem on the single instance on CSP Instance, see [this document](./docs/running-on-instance.md).
 
 ## Development & Test Environment
 - Go 1.25.0 (minimum required version)
@@ -196,7 +196,10 @@ curl -k https://<DOMAIN>/auth/realms/mciam/.well-known/openid-configuration | gr
 ```
 Expected: `"issuer": "https://<DOMAIN>/auth/realms/mciam"` — must start with `https://` and include `/auth/`.
 
-**(d) mc-iam-manager-post-initial 8-step setup:**
+**(d) mc-iam-manager-post-initial 11-step setup:**
+
+Among other things, these steps seed the platform's menu catalog and role-menu permissions — both chained into a single server-side call, so a single step covers both. The seeds are the bundled copies `conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml` (a copy of mc-web-console's canonical catalog) and `conf/docker/conf/mc-iam-manager/permission.yaml`, mounted read-only into the mc-iam-manager container. They are read **once, at first install**: re-running post-init skips the menu step when menus already exist (`skipped: true` in its log), and later menu / role-menu changes are made in the console (Menus, Roles screens) and live in the IAM DB. To overwrite from the yaml again, use the console's Setup Status "Force re-seed ▶ Menu" or `1_setup_manual.sh` option 4b (role mappings are backed up first). When the bundled copies are updated in this repo (new console release), existing installs pick them up only through such a forced re-seed.
+
 ```shell
 docker logs mc-iam-manager-post-initial | tail -5
 ```
@@ -449,7 +452,7 @@ cd bin && ./mcc infra info
 docker rm mc-iam-manager-post-initial 2>/dev/null
 ./mcc infra run -s mc-iam-manager-post-initial
 docker logs -f mc-iam-manager-post-initial
-# Each of the 8 setup steps should finish with ✓
+# Each of the 11 setup steps should finish with ✓
 
 # 3. Verify
 curl -s http://localhost:5000/readyz | jq .

diff --git a/README_kr.md b/README_kr.md
@@ -177,7 +177,7 @@ curl -k https://<DOMAIN>/auth/realms/mciam/.well-known/openid-configuration | gr
 ```
 기대 응답: `"issuer": "https://<DOMAIN>/auth/realms/mciam"` — 반드시 `https://`로 시작하고 `/auth/`가 포함되어야 합니다.
 
-**(d) mc-iam-manager-post-initial 8단계 설정 완료 확인:**
+**(d) mc-iam-manager-post-initial 11단계 설정 완료 확인:**
 ```shell
 docker logs mc-iam-manager-post-initial | tail -5
 ```
@@ -425,7 +425,7 @@ cd bin && ./mcc infra info
 docker rm mc-iam-manager-post-initial 2>/dev/null
 ./mcc infra run -s mc-iam-manager-post-initial
 docker logs -f mc-iam-manager-post-initial
-# 8단계 각각이 ✓ 로 완료되어야 합니다
+# 11단계 각각이 ✓ 로 완료되어야 합니다
 
 # 3. 헬스 상태 확인
 curl -s http://localhost:5000/readyz | jq .

diff --git a/bin/cleanAll.sh b/bin/cleanAll.sh
@@ -168,7 +168,6 @@ echo
 echo "Deleting mc-iam-manager configuration files..."
 files_to_delete=(
   "../conf/docker/conf/mc-iam-manager/api.yaml"
-  "../conf/docker/conf/mc-iam-manager/menu.yaml"
   "../conf/docker/conf/mc-iam-manager/nginx.conf"
 )
 

diff --git a/bin/installAll.sh b/bin/installAll.sh
@@ -157,8 +157,12 @@ EXIT_STREAK_THRESHOLD=3
 # depends_on chain automatically (already-running dependencies are a no-op).
 # mc-application-manager/mc-cost-optimizer-* depend on mc-observability-rabbitmq,
 # so the observability backbone wave runs before the app-tier wave.
+# mc-iam-manager-nginx is listed explicitly: mc-iam-manager no longer declares a
+# compose dependency on it (that dependency caused a startup deadlock), but the
+# IAM manager still needs the public-domain endpoints nginx serves to become
+# healthy, so nginx must start in the same wave.
 STARTUP_WAVES=(
-    "mc-infra-connector mc-infra-manager mc-iam-manager mc-iam-manager-post-initial"
+    "mc-infra-connector mc-infra-manager mc-iam-manager-nginx mc-iam-manager mc-iam-manager-post-initial"
     "mc-data-manager mc-web-console-api mc-web-console-front"
     "mc-observability-manager mc-observability-front mc-observability-insight mc-observability-insight-scheduler mc-observability-mcp-grafana mc-observability-mcp-maria mc-observability-mcp-influx mc-observability-log-collector"
     "mc-application-manager mc-workflow-manager mc-cost-optimizer-fe"

diff --git a/conf/api.yaml b/conf/api.yaml
@@ -3,7 +3,7 @@
 
 services:
   mc-infra-connector:
-    version: 0.12.18
+    version: 0.13.2
     baseurl: http://mc-infra-connector:1024/spider
     auth:
       type: basic
@@ -17,7 +17,7 @@ services:
       type: bearer
 
   mc-infra-manager:
-    version: 0.12.9
+    version: 0.13.2
     baseurl: http://mc-infra-manager:1323/tumblebug
     auth:
       type: basic
@@ -1195,7 +1195,7 @@ serviceActions:
     InitialMenus:
       method: post
       resourcePath: /api/setup/initial-menus
-      description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync."
+      description: "메뉴 카탈로그 yaml 시딩 (1_setup_auto.sh init_menu와 동일). 메뉴가 이미 있으면 skip(200, skipped=true); queryParams force=true면 역할-메뉴 매핑 백업 후 덮어씀. FR-006-08 Force re-seed."
     SyncMcmpApis:
       method: post
       resourcePath: /api/setup/sync-mcmp-apis
@@ -2831,16 +2831,6 @@ serviceActions:
       method: post
       resourcePath: /ns/{nsId}/buildAgnosticImage
       description: Creates an MCI infrastructure, executes post-deployment commands, creates snapshots from each subgroup, and optionally cleans up the MCI. This is a complete workflow for building CSP-agnostic custom images.
-    PostCmdK8sCluster:
-      method: post
-      resourcePath: /ns/{nsId}/cmd/k8sCluster/{k8sClusterId}
-      description: 'Send a command to specified Container in K8sCluster
-
-        [note] This feature is not intended for general use
-
-        This API is provided as an exceptional and limited function for specific purposes such as migration.
-
-        Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.'
     PostCmdInfra:
 
       method: post
@@ -2867,16 +2857,6 @@ serviceActions:
       description: 'Download a file from a specific VM in MCI via SCP through bastion host.
 
         The file size should be less than 200MB.'
-    PostFileToK8sCluster:
-      method: post
-      resourcePath: /ns/{nsId}/transferFile/k8sCluster/{k8sClusterId}
-      description: 'Transfer a file to specified Container in K8sCluster. The tar command is required in the container.
-
-        [note] This feature is not intended for general use
-
-        This API is provided as an exceptional and limited function for specific purposes such as migration.
-
-        Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.'
     PostFileToInfra:
 
       method: post

diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup
@@ -78,7 +78,13 @@ MODE=standalone # [standalone|docker] both are same.
 MC_IAM_MANAGER_USE_TICKET_VALID=true # [true|false]
 
 MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml
-MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
+# Menu catalog seed. Default: bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml,
+# mounted read-only into mc-iam-manager at this path and read ONCE at first install (later menu
+# changes live in the IAM DB; re-seed only via force). Set a raw URL instead to seed from a remote file.
+# Note: mc-web-console-api reads this value only for the Setup Status "Seed source" display;
+# the value mc-iam-manager actually uses comes from conf/mc-iam-manager/.env.
+MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml
+#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
 # YAML role-menu permission seed (path or remote URL); IAM env_file prefers conf/mc-iam-manager/.env
 MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml
 
@@ -277,6 +283,11 @@ MC_DATA_MANAGER_MYSQL_DATABASE=mcmp
 MC_DATA_MANAGER_MYSQL_USER=mcmp
 MC_DATA_MANAGER_MYSQL_PASSWORD=mcmp
 MC_DATA_MANAGER_MYSQL_ROOT_PASSWORD=mcmp
+# Host uid/gid used to chown the data-manager volume at init.
+# Named with the framework prefix so the shell's reserved UID variable
+# can never leak into the compose interpolation by accident.
+MC_DATA_MANAGER_UID=0
+MC_DATA_MANAGER_GID=0
 
 # MC-OBSERVABILITY
 MC_OBSERVABILITY_MARIADB_ROOT_PASSWORD=qwe1212!Q
@@ -294,6 +305,14 @@ MC_OBSERVABILITY_MCP_GRAFANA_PORT=8000
 MC_OBSERVABILITY_MCP_MARIA_PORT=8001
 MC_OBSERVABILITY_MCP_INFLUX_PORT=8002
 
+# Host-side names for values the observability images read under their own
+# fixed env keys (GRAFANA_API_KEY / OPENAI_API_KEY / OLLAMA_BASE_URL).
+# docker-compose.yaml maps these prefixed variables onto those keys so the
+# generic names never collide with the host environment.
+MC_OBSERVABILITY_GRAFANA_API_KEY=
+MC_OBSERVABILITY_OPENAI_API_KEY=
+MC_OBSERVABILITY_OLLAMA_BASE_URL=http://210.207.104.224:11434
+
 # MC-WEB-CONSOLE
 MC_WEB_CONSOLE_POSTGRES_DB=mcwebconsoledbdev
 MC_WEB_CONSOLE_POSTGRES_USER=mcwebadmin

diff --git a/conf/docker/api.yaml b/conf/docker/api.yaml
@@ -3,7 +3,7 @@
 
 services:
   mc-infra-connector:
-    version: 0.12.18
+    version: 0.13.2
     baseurl: http://mc-infra-connector:1024/spider
     auth:
       type: basic
@@ -17,7 +17,7 @@ services:
       type: bearer
 
   mc-infra-manager:
-    version: 0.12.9
+    version: 0.13.2
     baseurl: http://mc-infra-manager:1323/tumblebug
     auth:
       type: basic
@@ -1195,7 +1195,7 @@ serviceActions:
     InitialMenus:
       method: post
       resourcePath: /api/setup/initial-menus
-      description: "menu.yaml 기반 메뉴 일괄 재등록 (1_setup_auto.sh init_menu와 동일). FR-006-08 Re-sync."
+      description: "메뉴 카탈로그 yaml 시딩 (1_setup_auto.sh init_menu와 동일). 메뉴가 이미 있으면 skip(200, skipped=true); queryParams force=true면 역할-메뉴 매핑 백업 후 덮어씀. FR-006-08 Force re-seed."
     SyncMcmpApis:
       method: post
       resourcePath: /api/setup/sync-mcmp-apis
@@ -2831,16 +2831,6 @@ serviceActions:
       method: post
       resourcePath: /ns/{nsId}/buildAgnosticImage
       description: Creates an MCI infrastructure, executes post-deployment commands, creates snapshots from each subgroup, and optionally cleans up the MCI. This is a complete workflow for building CSP-agnostic custom images.
-    PostCmdK8sCluster:
-      method: post
-      resourcePath: /ns/{nsId}/cmd/k8sCluster/{k8sClusterId}
-      description: 'Send a command to specified Container in K8sCluster
-
-        [note] This feature is not intended for general use
-
-        This API is provided as an exceptional and limited function for specific purposes such as migration.
-
-        Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.'
     PostCmdInfra:
 
       method: post
@@ -2867,16 +2857,6 @@ serviceActions:
       description: 'Download a file from a specific VM in MCI via SCP through bastion host.
 
         The file size should be less than 200MB.'
-    PostFileToK8sCluster:
-      method: post
-      resourcePath: /ns/{nsId}/transferFile/k8sCluster/{k8sClusterId}
-      description: 'Transfer a file to specified Container in K8sCluster. The tar command is required in the container.
-
-        [note] This feature is not intended for general use
-
-        This API is provided as an exceptional and limited function for specific purposes such as migration.
-
-        Kubernetes resource information required as input for this API is not currently provided, and its availability in the future is uncertain.'
     PostFileToInfra:
 
       method: post

diff --git a/conf/docker/conf/mc-iam-manager/.env b/conf/docker/conf/mc-iam-manager/.env
@@ -17,7 +17,12 @@ MODE=standalone # [standalone|docker] both are same.
 MC_IAM_MANAGER_USE_TICKET_VALID=true # [true|false]
 
 MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml
-MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
+# Menu catalog seed (path relative to the IAM container's /app, or a remote URL).
+# Default: bundled copy conf/mc-web-console/api/conf/webconsole_menu_resources.yaml mounted by
+# docker-compose. Read ONCE at first install — afterwards menus/role-menu mappings are edited in the
+# IAM DB; initial-menus skips when menus exist unless ?force=true (backs up role mappings first).
+MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml
+#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
 # YAML role-menu permission seed (path or remote URL).
 # Default: conf bundle + compose mount at /app/asset/menu/permission.yaml
 MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml

diff --git a/conf/docker/conf/mc-iam-manager/.env.setup b/conf/docker/conf/mc-iam-manager/.env.setup
@@ -3,6 +3,8 @@
 ## Generated from .env.setup — be sure to change passwords and secrets in production
 ## permission.yaml: conf bundle + compose mount to /app/asset/menu/permission.yaml,
 ## or set MC_WEB_CONSOLE_MENU_PERMISSIONS to a path or remote YAML URL
+## menu catalog: conf/mc-web-console/api/conf/webconsole_menu_resources.yaml bundle + compose mount
+## to /app/asset/menu/webconsole_menu_resources.yaml (MC_WEB_CONSOLE_MENUYAML), seeded once at install
 
 # Basic service configuration
 # MC_IAM_MANAGER_DOMAIN: Internal Docker container name — differs from PUBLIC_DOMAIN, do not change
@@ -17,7 +19,12 @@ MODE=standalone
 MC_IAM_MANAGER_USE_TICKET_VALID=true
 
 MC_ADMIN_CLI_APIYAML=https://raw.githubusercontent.com/m-cmp/mc-admin-cli/refs/heads/main/conf/api.yaml
-MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
+# Menu catalog seed (path relative to the IAM container's /app, or a remote URL).
+# Default: bundled copy mounted by docker-compose. Read ONCE at first install — afterwards menus and
+# role-menu mappings are edited in the IAM DB; POST /api/setup/initial-menus skips when menus exist
+# unless ?force=true (backs up role mappings first). Set a raw URL only to seed from a remote file.
+MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml
+#MC_WEB_CONSOLE_MENUYAML=https://raw.githubusercontent.com/m-cmp/mc-web-console/refs/heads/main/conf/webconsole_menu_resources.yaml
 # YAML role-menu permission seed (path or remote URL).
 # Default: conf bundle + compose mount at /app/asset/menu/permission.yaml
 MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml
@@ -101,3 +108,5 @@ MC_APPLICATION_MANAGER_PROXY_PORT=18084
 MC_APPLICATION_MANAGER_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_APPLICATION_MANAGER_PROXY_PORT}
 MC_OBSERVABILITY_FRONT_PROXY_PORT=18081
 MC_OBSERVABILITY_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_OBSERVABILITY_FRONT_PROXY_PORT}
+MC_WEB_CONSOLE_FRONT_PORT=3001
+MC_WEB_CONSOLE_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_WEB_CONSOLE_FRONT_PORT}
diff --git a/conf/docker/conf/mc-iam-manager/0_preset_local.sh b/conf/docker/conf/mc-iam-manager/0_preset_local.sh
@@ -220,6 +220,7 @@ if [ -n "$MC_IAM_MANAGER_PUBLIC_DOMAIN" ] && [ -n "$MC_IAM_MANAGER_KEYCLOAK_PORT
         -e "s/\${MC_WORKFLOW_MANAGER_PROXY_PORT}/$MC_WORKFLOW_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_DATA_MANAGER_PROXY_PORT}/$MC_DATA_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_APPLICATION_MANAGER_PROXY_PORT}/$MC_APPLICATION_MANAGER_PROXY_PORT/g" \
+        -e "s/\${MC_OBSERVABILITY_FRONT_PORT}/$MC_OBSERVABILITY_FRONT_PORT/g" \
         "$TEMPLATE_FILE" > "$OUTPUT_FILE"
     echo "✓ nginx.conf generated (HTTP mode)"
 else

diff --git a/conf/docker/conf/mc-iam-manager/0_preset_prod.sh b/conf/docker/conf/mc-iam-manager/0_preset_prod.sh
@@ -62,6 +62,13 @@ echo "  MC_COST_OPTIMIZER_FE_PROXY_PORT: $MC_COST_OPTIMIZER_FE_PROXY_PORT"
 # Copy template file and substitute environment variables
 cp "$TEMPLATE_FILE" "$OUTPUT_FILE" || { echo "Error: Failed to copy template file: $TEMPLATE_FILE → $OUTPUT_FILE"; exit 1; }
 
+if [ -n "$MC_IAM_MANAGER_DOMAIN" ]; then
+    sed -i "s/\${MC_IAM_MANAGER_DOMAIN}/$MC_IAM_MANAGER_DOMAIN/g" "$OUTPUT_FILE"
+    echo "✓ MC_IAM_MANAGER_DOMAIN substitution done: $MC_IAM_MANAGER_DOMAIN"
+else
+    echo "Warning: MC_IAM_MANAGER_DOMAIN environment variable is not set."
+fi
+
 if [ -n "$MC_IAM_MANAGER_PORT" ]; then
     sed -i "s/\${MC_IAM_MANAGER_PORT}/$MC_IAM_MANAGER_PORT/g" "$OUTPUT_FILE"
     echo "✓ MC_IAM_MANAGER_PORT substitution done: $MC_IAM_MANAGER_PORT"