sync: installAll wave startup/monitoring, cleanAll image-keep option, nginx/iam fixes - #190
Merged
Conversation
The custom mc-observability-influx image exits once after first-time DB init, then Docker restarts it. Docker Compose aborts any service waiting on service_healthy when its dependency exits, even briefly. - Delete init.sh: it duplicates init-database.sh without auth credentials, causing an auth failure on INFLUXDB_HTTP_AUTH_ENABLED=true that can trigger the exit. init-database.sh already creates insight and downsampling with proper auth, so init.sh is redundant. - Add mc-observability-influx-ready and mc-observability-influx-2-ready (busybox) containers: they poll each influx /health endpoint and exit 0 once healthy, surviving the restart window. - Change depends_on for mc-observability-manager, mc-observability-insight, and mc-observability-mcp-influx from service_healthy on influx to service_completed_successfully on the ready containers, so they wait through the restart rather than aborting.
common.SysCall discarded docker compose up's exit code, so mcc infra run always returned 0 even when Compose aborted the startup graph partway through (e.g. a service failing its healthcheck). installAll.sh could never detect this, leaving services stuck in Created state with no error reported. - run.go now uses RunE + SysCallWithError so the real exit code propagates, and sets SilenceUsage to avoid dumping help text on runtime failures. - installAll.sh brings the stack up in staged waves instead of one monolithic call, checks each wave's exit code immediately, and points to iam_manager_init.sh if IAM setup didn't complete. - monitor_containers now uses `docker ps -a` so Created/Exited containers are classified as failures instead of being indistinguishable from "still pulling", and stops polling immediately instead of waiting out the full 20-minute timeout.
Bump cb-spider to 0.12.34 and cb-tumblebug to 0.12.24
# Conflicts: # conf/docker/docker-compose.yaml
[feat]: align admin-cli IAM setup with permission.yaml seed
[refactor]: point MENU_PERMISSIONS env to permission.yaml
- mciworkloads -> infraworkloads (MCI Workloads -> Infra Workloads) - pmkworkloads -> k8sworkloads (PMK Workloads -> K8s Workloads)
chore: rename mci/pmk workload menu id and label
fix: handle influx init-exit-restart so docker compose up does not abort
ssl_ciphers only listed RSA-suite ciphers (ECDHE-RSA-*), but the server's Let's Encrypt certificate is ECDSA. No cipher could be negotiated under TLS 1.2 for an ECDSA cert, causing handshake_failure and breaking Alibaba IMS OIDC discovery (TLS 1.3-only backends work by accident since TLS 1.3 cipher suites are cert-signature-agnostic).
fix(nginx): allow ECDSA cipher suites for TLS 1.2
fix: mcc infra run silently swallows docker compose failures
IP/domain 설치 시 3001, 9090 등 SSL 전용 포트로 평문 HTTP 요청이 오면 nginx가 497 코드를 내부 발생시키고 400을 반환하던 문제. http 컨텍스트에 error_page 497 리다이렉트 한 줄을 추가해 모든 listen <port> ssl 블록에 상속되도록 처리.
.env/.env.setup은 MC_IAM_MANAGER_PREDEFINED_ROLE로 정의하는데 1_setup_auto.sh/1_setup_manual.sh의 init_predefined_roles()는 접두사 없는 PREDEFINED_ROLE을 읽고 있었다. 이 변수는 어디서도 정의되지 않아 항상 빈 값이었고, 실제로는 역할이 생성되지 않는 상태였다. 두 스크립트 모두 실제 정의된 변수명으로 통일한다.
mc-iam-manager의 workspace-project 목록 조회(GET
/api/users/workspaces/id/{workspaceId}/projects/list)가 레지스트리에
등록돼 있지 않았다. 같은 계열의 listUserWorkspaces 옆에 추가한다.
[fix]: redirect plain-HTTP requests on SSL-only nginx ports to HTTPS
…gistry fix: listUserProjectsByWorkspace 레지스트리 추가
…nitor Containers with a restart policy (unless-stopped/on-failure) can be sampled mid-crash-cycle and get flagged as a permanent failure immediately. mc-observability-influx in particular exits by design during its own init, so a single Exited snapshot isn't conclusive. Only fail once a container stays Created/Exited across several polls.
Default behavior (full nuke of containers/volumes/networks/images) is unchanged. With --keep-current-images, only images whose repository is referenced in conf/docker/docker-compose.yaml but whose tag no longer matches the pinned version are removed; the currently pinned versions are kept so the next installAll.sh run doesn't need to re-pull them and hit Docker Hub's pull rate quota. Containers/volumes/networks and generated config files are still cleaned the same way in both modes.
fix: debounce Created/Exited detection in installAll.sh background monitor
feat: add --keep-current-images option to cleanAll.sh
dogfootman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--keep-current-images옵션 추가(재설치 시 이미지 재다운로드 방지, Docker Hub pull 쿼터 대응)