fix(compose): break mc-iam-manager <-> nginx clean-install startup deadlock - #84
Merged
Merged
Conversation
…an-install crash loop On a fresh install the IAM/KC proxy blocks resolved their upstream hostnames at config-parse time, so nginx died with [emerg] host not found before the mc-iam-manager container existed. Switch the four static proxy_pass directives to the resolver + variable pattern already used by the other server blocks so nginx starts regardless of container startup order. The /auth/ block drops its literal URI: with a variable proxy_pass a literal URI replaces the entire request path, which would break /auth/realms/* subpaths (also fixed in the local template where this latent defect already existed).
…p deadlock mc-iam-manager waited for mc-iam-manager-nginx (service_started) while nginx itself could not start until the mc-iam-manager DNS name existed, leaving both stuck on a fresh install. The IAM manager has no startup dependency on nginx (Keycloak and its own healthcheck are reached directly), and the standalone mc-iam-manager repository already runs with this dependency removed.
Uses the /nginx-health endpoint already served by the templates so a crash-looping or misconfigured nginx is visible in compose ps instead of reporting plain Up. No service depends on nginx being healthy, so startup ordering is unaffected.
…eset
The dev/prod preset scripts gained this substitution earlier but the
local script was missed, leaving a literal ${MC_OBSERVABILITY_FRONT_PORT}
listen directive in the generated nginx.conf and failing nginx startup
in local mode.
The prod preset read MC_IAM_MANAGER_DOMAIN but never applied it to the generated nginx.conf. This was a no-op while the template hardcoded the container hostname; with the resolver/variable pattern the token must be substituted or nginx fails to parse the config.
nginx was only ever started as a side effect of mc-iam-manager's compose dependency. With that dependency removed, no wave listed nginx, so a fresh install brought up the IAM manager without its public-domain endpoints and it never became healthy. List nginx in wave 1 ahead of the IAM manager.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
배경
클린 설치(기존 볼륨 없음)에서
mc-iam-manager-nginx는 nginx.conf가mc-iam-managerupstream을 config-parse 시점에 DNS 해석하는데 컨테이너가 아직 없어[emerg] host not found로 크래시 루프에 빠진다. 반면mc-iam-manager는depends_on: mc-iam-manager-nginx: condition: service_started라 Restarting 상태인 nginx를 기다리며 Created에서 영영 멈춘다 — 상호 대기 데드락. 기존 볼륨이 있는 재기동에서는 nginx가 이미 한 번 뜬 적이 있어 안 드러나고 fresh install에서만 재현된다.변경 내용
nginx.template.conf(+local): 4개 staticproxy_pass지시문을 config-parse 시점 DNS 해석 대신resolver+ 변수 패턴으로 전환 — nginx가 컨테이너 기동 순서와 무관하게 시작 가능./auth/블록은 변수 proxy_pass 특성상 리터럴 URI가 전체 경로를 대체해버리는 문제가 있어/auth/realms/*서브패스가 깨지지 않도록 같이 수정(로컬 템플릿에 이미 있던 잠복 결함)docker-compose.yaml(+mini):mc-iam-manager의 nginxdepends_on: service_started를 제거. 단, mc-iam-manager의/readyz(기본 헬스체크,isNginxHealthy()— mc-iam-manager 소스src/handler/health_handler.go:229)는http://mc-iam-manager-nginx/nginx-health를 직접 호출해 자기 healthy 판정에 포함시키므로 nginx와 iam 사이엔 실제 기능적 결합이 있다.service_started(컨테이너 시작 여부만 체크, healthy 대기 아님)는 이 결합을 보장하기엔 애초에 약한 조건이면서 동시에 DNS 데드락을 유발하는 원인이었으므로, blocking depends_on 대신 nginx와 iam이 동시에(같은 wave에서) 기동하도록 재설계했다(아래 installAll.sh 변경과 세트). nginx에도 헬스체크 추가(/nginx-health, 기존 엔드포인트 재사용)bin/installAll.sh: 위 depends_on 제거로 어느 wave에도 nginx가 안 들어가게 된 문제 수정 — wave 1에 nginx를 명시적으로 포함해 iam과 동시 기동을 보장(iam의/readyz가 nginx 응답을 요구하므로 이 순서 보장이 필수)MC_IAM_MANAGER_DOMAIN(prod),MC_OBSERVABILITY_FRONT_PORT(local) 치환 누락 수정 — resolver/변수 패턴 도입 후 치환이 안 되면 nginx가 설정 자체를 파싱 못 함