IAM fixes & features

asset/mcmpapi/service-actions.yaml

@@ -3,7 +3,7 @@ serviceActions:
         _meta:
             version: 0.5.0
             repository: https://github.com/m-cmp/mc-application-manager
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
         checkConnectionUsingPOST:
             method: post
             resourcePath: /oss/connection-check
@@ -272,7 +272,7 @@ serviceActions:
         _meta:
             version: 0.5.0
             repository: https://github.com/m-cmp/mc-cost-optimizer
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
         getAbrnormalRcmd:
             method: post
             resourcePath: /api/costopti/be/opti/abnormalRcmd
@@ -331,9 +331,13 @@ serviceActions:
             description: ""
     mc-iam-manager:
         _meta:
-            version: 0.3.0
+            version: 0.5.2
             repository: https://github.com/m-cmp/mc-iam-manager
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
+        CreateFrameworkService:
+            method: post
+            resourcePath: /api/mcmp-apis
+            description: Creates a new MCMP API service (framework) record. Returns 409 if a service with the same name already exists.
         ResetUserPassword:
             method: put
             resourcePath: /api/users/id/{userId}/password
@@ -592,7 +596,7 @@ serviceActions:
             description: Delete a role by its name.
         deleteUser:
             method: delete
-            resourcePath: /api/users/{id}
+            resourcePath: /api/users/id/{userId}
             description: Delete a user by their ID.
         deleteWorkspace:
             method: delete
@@ -1224,7 +1228,7 @@ serviceActions:
             description: Update the details of an existing role.
         updateUser:
             method: put
-            resourcePath: /api/users/{id}
+            resourcePath: /api/users/id/{userId}
             description: Update the details of an existing user.
         updateUserStatus:
             method: post
@@ -1242,7 +1246,7 @@ serviceActions:
         _meta:
             version: main
             repository: https://github.com/cloud-barista/cb-spider
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
         add-favorite-imagespec:
             method: post
             resourcePath: /vm/imagespecfavorite
@@ -1327,6 +1331,10 @@ serviceActions:
             method: get
             resourcePath: /countnlb
             description: Get the total number of Network Load Balancers (NLBs) across all connections.
+        count-all-rdbms:
+            method: get
+            resourcePath: /countrdbms
+            description: Get the total number of RDBMS instances across all connections.
         count-all-securitygroup:
             method: get
             resourcePath: /countsecuritygroup
@@ -1367,6 +1375,10 @@ serviceActions:
             method: get
             resourcePath: /countnlb/{ConnectionName}
             description: Get the total number of Network Load Balancers (NLBs) for a specific connection.
+        count-rdbms-by-connection:
+            method: get
+            resourcePath: /countrdbms/{ConnectionName}
+            description: Get the total number of RDBMS instances for a specific connection.
         count-s3-by-connection:
             method: get
             resourcePath: /counts3/{ConnectionName}
@@ -1415,6 +1427,10 @@ serviceActions:
             method: post
             resourcePath: /nlb
             description: "Create a new Network Load Balancer (NLB) with specified configurations. \U0001F577️ [[Concept Guide](https://github.com/cloud-barista/cb-spider/wiki/Network-Load-Balancer-and-Driver-API)]"
+        create-rdbms:
+            method: post
+            resourcePath: /rdbms
+            description: Create a new Relational Database (RDBMS) with the specified configuration.
         create-s3-bucket:
             method: put
             resourcePath: /s3/{BucketName}
@@ -1477,6 +1493,10 @@ serviceActions:
             method: delete
             resourcePath: /cspnlb/{Id}
             description: Delete a specified CSP Network Load Balancer (NLB).
+        delete-csp-rdbms:
+            method: delete
+            resourcePath: /csprdbms/{Id}
+            description: Delete a specified CSP RDBMS.
         delete-csp-securitygroup:
             method: delete
             resourcePath: /cspsecuritygroup/{Id}
@@ -1505,6 +1525,10 @@ serviceActions:
             method: delete
             resourcePath: /nlb/{Name}
             description: Delete a specified Network Load Balancer (NLB).
+        delete-rdbms:
+            method: delete
+            resourcePath: /rdbms/{Name}
+            description: Delete a specified RDBMS instance.
         delete-recent-imagespec:
             method: delete
             resourcePath: /vm/imagespecrecent
@@ -1646,6 +1670,18 @@ serviceActions:
             method: get
             resourcePath: /quotainfo
             description: "Retrieve all quota limits and current usage for a given service type. No filtering is applied; all CSP-original quota items for the service type are returned. \U0001F577️ Supported CSPs: AWS, Azure, GCP, Alibaba."
+        get-rdbms:
+            method: get
+            resourcePath: /rdbms/{Name}
+            description: Retrieve details of a specific RDBMS instance.
+        get-rdbms-metainfo:
+            method: get
+            resourcePath: /rdbmsmetainfo
+            description: Retrieve CSP-specific RDBMS capability information (supported engines, features, storage options).
+        get-rdbms-owner-vpc:
+            method: get
+            resourcePath: /getrdbmsowner
+            description: Retrieve the Owner VPC of a given RDBMS CSP ID.
         get-region:
             method: get
             resourcePath: /region/{RegionName}
@@ -1847,6 +1883,14 @@ serviceActions:
             method: get
             resourcePath: /allnlbinfo
             description: Retrieve a comprehensive list of all Network Load Balancers (NLBs) associated with a specific connection, <br> including those mapped between CB-Spider and the CSP, <br> only registered in CB-Spider's metadata, <br> and only existing in the CSP.
+        list-all-rdbms:
+            method: get
+            resourcePath: /allrdbms
+            description: Retrieve a comprehensive list of all RDBMS instances associated with a specific connection, <br> including those mapped between CB-Spider and the CSP, <br> only registered in CB-Spider's metadata, <br> and only existing in the CSP.
+        list-all-rdbms-info:
+            method: get
+            resourcePath: /allrdbmsinfo
+            description: Retrieve a list of all RDBMS information associated with all connections.
         list-all-securitygroup:
             method: get
             resourcePath: /allsecuritygroup
@@ -1939,6 +1983,10 @@ serviceActions:
             method: get
             resourcePath: /quotaservicetype
             description: "Retrieve the list of service type names for which quota information is available. Use a returned service type as input to the GetQuotaInfo API. \U0001F577️ Supported CSPs: AWS, Azure, GCP, Alibaba."
+        list-rdbms:
+            method: get
+            resourcePath: /rdbms
+            description: Retrieve a list of RDBMS instances associated with a specific connection.
         list-recent-imagespec:
             method: get
             resourcePath: /vm/imagespecrecent
@@ -2079,6 +2127,10 @@ serviceActions:
             method: post
             resourcePath: /regnlb
             description: Register a new Network Load Balancer (NLB) with the specified name and CSP ID.
+        register-rdbms:
+            method: post
+            resourcePath: /regrdbms
+            description: Register a new RDBMS with the specified name and CSP ID.
         register-region:
             method: post
             resourcePath: /region
@@ -2169,6 +2221,10 @@ serviceActions:
             method: delete
             resourcePath: /regnlb/{Name}
             description: Unregister a Network Load Balancer (NLB) with the specified name.
+        unregister-rdbms:
+            method: delete
+            resourcePath: /regrdbms/{Name}
+            description: Unregister an RDBMS with the specified name.
         unregister-region:
             method: delete
             resourcePath: /region/{RegionName}
@@ -2205,7 +2261,7 @@ serviceActions:
         _meta:
             version: main
             repository: https://github.com/cloud-barista/cb-tumblebug
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
         AddNLBNodes:
             method: post
             resourcePath: /ns/{nsId}/infra/{infraId}/nlb/{nlbId}/node
@@ -4760,7 +4816,7 @@ serviceActions:
         _meta:
             version: 0.5.0
             repository: https://github.com/m-cmp/mc-workflow-manager
-            generatedAt: "2026-05-12T07:17:42Z"
+            generatedAt: "2026-06-01T02:11:43Z"
         checkConnectionUsingGET:
             method: get
             resourcePath: /readyz

conf/mc-iam-manager/0_preset_dev.sh

@@ -19,24 +19,29 @@ CERT_PARENT_DIR="${PROJECT_ROOT}/container-volume/mc-iam-manager"
 # --- 3. 필요한 디렉토리 생성 (Let's Encrypt 구조와 동일) ---
 echo "Creating necessary directories..."
 
-# 현재 사용자 정보 가져오기
+# Get current user info
 CURRENT_USER=$(whoami)
+CURRENT_GROUP=$(id -gn)
 
-echo "Current user: ${CURRENT_USER}"
+echo "Current user: ${CURRENT_USER}:${CURRENT_GROUP}"
 
-# 실제 쓰기가 필요한 서브디렉토리만 targeted 생성 (chown -R 없음 — root 소유 Docker 볼륨과 공존)
+# Only the certs/ and nginx/ subdirs need to be writable by this script.
+# postgres/ and keycloak/ are Docker-managed and may be root-owned from a
+# previous run — do not touch them. Newly mkdir'd dirs are user-owned automatically,
+# so chown is unnecessary. If mkdir or the writable check fails, the root-owned
+# state must be cleared first via cleanAll.sh (which handles sudo interactively).
 for _dir in "${CERT_PARENT_DIR}/certs" "${CERT_PARENT_DIR}/nginx"; do
     if ! mkdir -p "$_dir" 2>/dev/null; then
         echo "❌ Error: Cannot create $_dir"
-        echo "   Root-owned files from a previous Docker run may be blocking access."
-        echo "   Clean up with: sudo rm -rf ${CERT_PARENT_DIR}/postgres ${CERT_PARENT_DIR}/keycloak"
-        echo "   Then retry."
+        echo "   A previous Docker run likely left root-owned files in the parent directory."
+        echo "   Please run the cleanup script first, then re-run installAll.sh:"
+        echo "       cd ${SCRIPT_DIR}/../../bin && ./cleanAll.sh"
         exit 1
     fi
     if [ ! -w "$_dir" ]; then
         echo "❌ Error: $_dir exists but is not writable by ${CURRENT_USER}."
-        echo "   Clean up with: sudo rm -rf ${CERT_PARENT_DIR}/postgres ${CERT_PARENT_DIR}/keycloak"
-        echo "   Then retry."
+        echo "   Please run the cleanup script first, then re-run installAll.sh:"
+        echo "       cd ${SCRIPT_DIR}/../../bin && ./cleanAll.sh"
         exit 1
     fi
 done
@@ -61,11 +66,18 @@ if [ ! -f "$TEMPLATE_FILE" ]; then
     exit 1
 fi
 
-# .env 파일을 환경변수로 로드
-echo "환경변수를 로드합니다..."
+# Load .env file as environment variables
+# Use line-by-line parsing instead of source to safely handle unquoted multi-word
+# values (e.g. cron schedules like "0 30 0,6 * * ?") that docker compose .env allows.
+echo "Loading environment variables..."
 
-# .env 파일을 직접 소스로 불러오기
-source "$ENV_FILE"
+while IFS= read -r line || [[ -n "$line" ]]; do
+    [[ "$line" =~ ^[[:space:]]*# ]] && continue
+    [[ "$line" =~ ^[[:space:]]*$ ]] && continue
+    if [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]]; then
+        declare "${BASH_REMATCH[1]}=${BASH_REMATCH[2]}"
+    fi
+done < "$ENV_FILE"
 
 # 필수 환경변수 검증
 echo "필수 환경변수를 검증합니다..."
@@ -128,40 +140,56 @@ mkdir -p "${CERT_DIR}" || { echo "Error: Failed to create ${CERT_DIR}"; exit 1;
 echo "✓ Certificate directory created successfully"
 
 
-## 로컬환경(인증서) 설정
-# --- 3. hosts 파일에 도메인 추가 (관리자 권한 필요) ---
-HOSTS_FILE="/etc/hosts"
-echo "Checking ${MC_IAM_MANAGER_PUBLIC_DOMAIN} in ${HOSTS_FILE}..."
-
-if grep -E "^[[:space:]]*127\.0\.0\.1[[:space:]]+${MC_IAM_MANAGER_PUBLIC_DOMAIN}[[:space:]]*$" "${HOSTS_FILE}" > /dev/null; then
-    echo "✓ ${MC_IAM_MANAGER_PUBLIC_DOMAIN} already exists in ${HOSTS_FILE}. Skipping."
+## Local environment (certificate) settings
+# Determine whether PUBLIC_DOMAIN is an IP address or a hostname
+if [[ "${MC_IAM_MANAGER_PUBLIC_DOMAIN}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    IS_IP=true
+    SAN_ENTRY="IP:${MC_IAM_MANAGER_PUBLIC_DOMAIN}"
+    echo "✓ PUBLIC_DOMAIN is an IP address — skipping /etc/hosts modification"
 else
-    echo "Removing any existing entries for ${MC_IAM_MANAGER_PUBLIC_DOMAIN}..."
-    sed -i "/[[:space:]]*127\.0\.0\.1[[:space:]]\+${MC_IAM_MANAGER_PUBLIC_DOMAIN}[[:space:]]*$/d" "${HOSTS_FILE}"
+    IS_IP=false
+    SAN_ENTRY="DNS:${MC_IAM_MANAGER_PUBLIC_DOMAIN}"
+fi
+
+# --- 3. Add domain to hosts file (only if it is a hostname) ---
+if [ "$IS_IP" = false ]; then
+    HOSTS_FILE="/etc/hosts"
+    echo "Checking ${MC_IAM_MANAGER_PUBLIC_DOMAIN} in ${HOSTS_FILE}..."
 
-    echo "Adding 127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN} to ${HOSTS_FILE}..."
-    if echo "127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN}" >> "${HOSTS_FILE}" 2>/dev/null; then
-        echo "✓ ${MC_IAM_MANAGER_PUBLIC_DOMAIN} added successfully to ${HOSTS_FILE}."
+    if grep -E "^[[:space:]]*127\.0\.0\.1[[:space:]]+${MC_IAM_MANAGER_PUBLIC_DOMAIN}[[:space:]]*$" "${HOSTS_FILE}" > /dev/null; then
+        echo "✓ ${MC_IAM_MANAGER_PUBLIC_DOMAIN} already exists in ${HOSTS_FILE}. Skipping."
     else
-        echo "⚠️  Failed to add to ${HOSTS_FILE} — run with sudo or manually add:"
-        echo "    echo '127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN}' | sudo tee -a ${HOSTS_FILE}"
+        echo "Removing any existing entries for ${MC_IAM_MANAGER_PUBLIC_DOMAIN}..."
+        sed -i "/[[:space:]]*127\.0\.0\.1[[:space:]]\+${MC_IAM_MANAGER_PUBLIC_DOMAIN}[[:space:]]*$/d" "${HOSTS_FILE}"
+
+        echo "Adding 127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN} to ${HOSTS_FILE}..."
+        if echo "127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN}" >> "${HOSTS_FILE}" 2>/dev/null; then
+            echo "✓ ${MC_IAM_MANAGER_PUBLIC_DOMAIN} added successfully to ${HOSTS_FILE}."
+        else
+            echo "⚠️  Failed to add to ${HOSTS_FILE} — run with sudo or manually add:"
+            echo "    echo '127.0.0.1 ${MC_IAM_MANAGER_PUBLIC_DOMAIN}' | sudo tee -a ${HOSTS_FILE}"
+        fi
     fi
 fi
 
 
-# --- 4. Self-Signed Certificate 생성 ---
-echo "Generating Self-Signed Certificate for ${MC_IAM_MANAGER_PUBLIC_DOMAIN}... ${CERT_DIR}"
+# --- 4. Generate Self-Signed Certificate (with SAN) ---
+echo "Generating Self-Signed Certificate for ${MC_IAM_MANAGER_PUBLIC_DOMAIN} (SAN: ${SAN_ENTRY})... ${CERT_DIR}"
 
-# 기존 인증서 삭제 (새로 발급하기 위해)
+# Remove existing certificate files (to issue a fresh one)
 if [ -f "${CERT_DIR}/privkey.pem" ]; then
     echo "Removing existing certificate files..."
     rm "${CERT_DIR}/privkey.pem" "${CERT_DIR}/fullchain.pem" 2>/dev/null
 fi
 
 openssl genrsa -out "${CERT_DIR}/privkey.pem" 2048
 openssl req -new -key "${CERT_DIR}/privkey.pem" -out "${CERT_DIR}/csr.pem" -subj "/CN=${MC_IAM_MANAGER_PUBLIC_DOMAIN}"
-openssl x509 -req -days 365 -in "${CERT_DIR}/csr.pem" -signkey "${CERT_DIR}/privkey.pem" -out "${CERT_DIR}/fullchain.pem"
-rm "${CERT_DIR}/csr.pem" # CSR 파일 제거
+openssl x509 -req -days 365 \
+    -in "${CERT_DIR}/csr.pem" \
+    -signkey "${CERT_DIR}/privkey.pem" \
+    -out "${CERT_DIR}/fullchain.pem" \
+    -extfile <(printf "subjectAltName=${SAN_ENTRY}\nbasicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment")
+rm "${CERT_DIR}/csr.pem"
 
 if [ -f "${CERT_DIR}/fullchain.pem" ]; then
     echo "Self-Signed Certificate generated successfully at ${CERT_DIR}."