donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

docs(keycloak-session-store): remake all 28 diagrams through the techviz pipeline

Browse Source 
The originating repository's SVGs were drawn by hand and every one of them
put a title, a subtitle and an explanation band inside the canvas. This
repository forbids both, so they could not be carried over — the whole set
was rebuilt through the skill's pipeline instead.

Each diagram went through prepare, references, prompt, a VizSpec 1.1 citing
document line ranges, lint, and render. All 28 pass lint and produce the
same eight formats the existing keycloak project has. Sentences moved out of
the canvas into <desc> and the paragraph beside each figure; the drawings
carry names only.

Two lint rules did real work rather than formatting work:

  edge-through-node                  caught arrows crossing an unrelated
                                     node and implying an adjacency that
                                     does not exist — four diagrams had to
                                     be restructured, not just relaid out
  evidence-outside-prepared-context  caught a diagram citing another
                                     section; its anchor moved from B-0 to
                                     B-1 so all three sections it draws on
                                     are inside the prepared context

lab-topology also had to change profile: its context offers a different
candidate set, and query-fanout with shard roles is what the section
actually shows — one entry point spreading to two Keycloak nodes.

The document now carries all 28 inline, one per claim that needed one, and
the section recording what was still missing is updated: the diagram gap is
closed, Studio records remain.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
2026-09-05 11:03:10 +09:00
co-authored by Claude Opus 5
parent b2963105a8
commit 75bed382c8
286 changed files with 65385 additions and 710 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.alt.md
+22
View File
@@ -0,0 +1,22 @@
# 쿠키에 담으면 공유할 것이 없다
## Alternative text
세션이 쿠키에 담기고 replica 는 같은 Secret 만 읽는 구성. Redis 저장소를 켜면 쿠키에 티켓만 남고 서버에 세션이 생긴다.
## Long description
oauth2-proxy 는 세션 전체를 쿠키에 담고 replica 는 같은 k8s Secret 을 읽을 뿐이다. 공유할 서버 상태가 없으니 콜백이 다른 replica 로 가도 된다. 대신 --cookie-secret 이 단수라 옛 secret 도 당분간 받아준다가 불가능하고 교체하는 순간 모든 쿠키가 한꺼번에 무효가 된다. Redis 저장소를 켜면 쿠키에는 티켓만 남는데, 티켓 안에 세션 id 가 있으므로 secret 을 바꾸면 어느 Redis 키를 지울지도 모르게 된다.
## Elements and evidence
- **k8s Secret** (datastore): 모든 replica 가 같은 값을 읽는다. Evidence: L419–L428.
- **쿠키의 티켓** (component): 세션 id 와 복호화 키가 함께 암호화되어 있다. Evidence: L429–L438.
- **Redis 의 세션** (datastore): 티켓을 못 풀면 어느 키인지도 모른다. Evidence: L429–L440.
- **TTL** (component): 요청으로 갱신되지 않아 생성 시각의 함수다. Evidence: L441–L452.
## Relationships
- **Redis 의 세션 → TTL:** 생성 시각이 여기 남는다. Evidence: L441–L452.
- **k8s Secret → 쿠키의 티켓:** 티켓을 암호화한다. Evidence: L419–L432.
- **쿠키의 티켓 → Redis 의 세션:** 키 이름을 만든다. Evidence: L429–L438.
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.d2
+18
View File
@@ -0,0 +1,18 @@
# 쿠키에 담으면 공유할 것이 없다
# Question: oauth2-proxy 의 secret 회전은 무엇을 남기는가
direction: down
n0: "k8s Secret" {
shape: cylinder
}
n1: "쿠키의 티켓" {
shape: rectangle
}
n2: "Redis 의 세션" {
shape: cylinder
}
n3: "TTL" {
shape: rectangle
}
n0 -> n1: "티켓을 암호화한다"
n1 -> n2: "키 이름을 만든다"
n2 -> n3: "생성 시각이 여기 남는다"
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.dot
+12
View File
@@ -0,0 +1,12 @@
digraph techviz {
graph [rankdir=TB, splines=ortho, nodesep=0.55, ranksep=0.85];
node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
n0 [label="k8s Secret", shape=cylinder, style="rounded,filled"];
n1 [label="쿠키의 티켓", shape=box, style="rounded,filled"];
n2 [label="Redis 의 세션", shape=cylinder, style="rounded,filled"];
n3 [label="TTL", shape=box, style="rounded,filled"];
n0 -> n1 [label="티켓을 암호화한다", style=solid];
n1 -> n2 [label="키 이름을 만든다", style=solid];
n2 -> n3 [label="생성 시각이 여기 남는다", style=solid];
}
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.drawio
+38
View File
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="b7-cookie-session-tradeoff" name="쿠키에 담으면 공유할 것이 없다">
<mxGraphModel dx="680" dy="729" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="n_secret" value="k8s Secret&lt;br/&gt;--cookie-secret 은 단수" tooltip="모든 replica 가 같은 값을 읽는다. | Evidence: L419-L428" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;shape=cylinder3;boundedLbl=1;backgroundOutline=1;fillColor=#eef6fb;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="70.0" y="60.0" width="174.0" height="97.0" as="geometry"/>
</mxCell>
<mxCell id="n_ticket" value="쿠키의 티켓&lt;br/&gt;secret 을 바꾸면 못 푼다" tooltip="세션 id 와 복호화 키가 함께 암호화되어 있다. | Evidence: L429-L438" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="80.5" y="253.0" width="153.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="n_redis-session" value="Redis 의 세션&lt;br/&gt;고아로 남는다" tooltip="티켓을 못 풀면 어느 키인지도 모른다. | Evidence: L429-L440" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;shape=cylinder3;boundedLbl=1;backgroundOutline=1;fillColor=#eef6fb;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
<mxGeometry x="82.0" y="420.0" width="150.0" height="97.0" as="geometry"/>
</mxCell>
<mxCell id="n_ttl" value="TTL&lt;br/&gt;역산으로 고아를 고른다" tooltip="요청으로 갱신되지 않아 생성 시각의 함수다. | Evidence: L441-L452" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="82.0" y="613.0" width="150.0" height="71.0" as="geometry"/>
</mxCell>
<mxCell id="e_r-ttl" value="생성 시각이 여기 남는다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_redis-session" target="n_ttl">
<mxGeometry relative="1" as="geometry">
<mxPoint x="181.0" y="565.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_s-t" value="티켓을 암호화한다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_secret" target="n_ticket">
<mxGeometry relative="1" as="geometry">
<mxPoint x="181.0" y="205.0" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_t-r" value="키 이름을 만든다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_ticket" target="n_redis-session">
<mxGeometry relative="1" as="geometry">
<mxPoint x="181.0" y="372.0" as="offset"/>
</mxGeometry>
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.excalidraw
+586
View File
@@ -0,0 +1,586 @@
{
"type": "excalidraw",
"version": 2,
"source": "techviz-harness",
"elements": [
{
"id": "edge-r-ttl",
"type": "arrow",
"x": 157.0,
"y": 517.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1135934964,
"version": 1,
"versionNonce": 1808446587,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-redis-session",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-ttl",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-r-ttl",
"type": "text",
"x": 129.0,
"y": 553.0,
"width": 104,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1479126096,
"version": 1,
"versionNonce": 701602824,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "생성 시각이 여기 남는다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "생성 시각이 여기 남는다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-s-t",
"type": "arrow",
"x": 157.0,
"y": 157.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 1862434854,
"version": 1,
"versionNonce": 618488197,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-secret",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-ticket",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-s-t",
"type": "text",
"x": 136.0,
"y": 193.0,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1484782167,
"version": 1,
"versionNonce": 493222229,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "티켓을 암호화한다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "티켓을 암호화한다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-t-r",
"type": "arrow",
"x": 157.0,
"y": 324.0,
"width": 0.0,
"height": 96.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": null,
"seed": 927026216,
"version": 1,
"versionNonce": 260065228,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"points": [
[
0.0,
0.0
],
[
0.0,
48.0
],
[
0.0,
48.0
],
[
0.0,
96.0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "node-ticket",
"focus": 0,
"gap": 4
},
"endBinding": {
"elementId": "node-redis-session",
"focus": 0,
"gap": 4
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": true
},
{
"id": "edge-label-t-r",
"type": "text",
"x": 136.0,
"y": 360.0,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 576053733,
"version": 1,
"versionNonce": 1463594537,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "키 이름을 만든다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "키 이름을 만든다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-secret",
"type": "rectangle",
"x": 70.0,
"y": 60.0,
"width": 174.0,
"height": 97.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#e7f5ff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1236896219,
"version": 1,
"versionNonce": 1269619969,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-secret",
"type": "text",
"x": 80.0,
"y": 70.0,
"width": 154.0,
"height": 77.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 809034914,
"version": 1,
"versionNonce": 1728073668,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "k8s Secret\n--cookie-secret 은 단수",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "k8s Secret\n--cookie-secret 은 단수",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-ticket",
"type": "rectangle",
"x": 80.5,
"y": 253.0,
"width": 153.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 36669833,
"version": 1,
"versionNonce": 185547631,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-ticket",
"type": "text",
"x": 90.5,
"y": 263.0,
"width": 133.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1697363880,
"version": 1,
"versionNonce": 82751645,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "쿠키의 티켓\nsecret 을 바꾸면 못 푼다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "쿠키의 티켓\nsecret 을 바꾸면 못 푼다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-redis-session",
"type": "rectangle",
"x": 82.0,
"y": 420.0,
"width": 150.0,
"height": 97.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#e7f5ff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 23377508,
"version": 1,
"versionNonce": 61209674,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-redis-session",
"type": "text",
"x": 92.0,
"y": 430.0,
"width": 130.0,
"height": 77.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 162518557,
"version": 1,
"versionNonce": 332434866,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Redis 의 세션\n고아로 남는다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Redis 의 세션\n고아로 남는다",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-ttl",
"type": "rectangle",
"x": 82.0,
"y": 613.0,
"width": 150.0,
"height": 71.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1465514607,
"version": 1,
"versionNonce": 1144908308,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-ttl",
"type": "text",
"x": 92.0,
"y": 623.0,
"width": 130.0,
"height": 51.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 56475114,
"version": 1,
"versionNonce": 531370675,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "TTL\n역산으로 고아를 고른다",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "TTL\n역산으로 고아를 고른다",
"autoResize": true,
"lineHeight": 1.25
}
],
"appState": {
"gridSize": 10,
"viewBackgroundColor": "#ffffff",
"currentItemFontFamily": 5
},
"files": {}
}
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.manifest.json
+32
View File
@@ -0,0 +1,32 @@
{
"harness_version": "0.2.0",
"spec_id": "b7-cookie-session-tradeoff",
"spec_version": "1.1",
"spec_sha256": "ae4774e0d8dfda387902c00a5d3c933672d4adf799cd6774760a74b8a1ad376a",
"source_context": {
"document": "docs/keycloak-session-store/final/document.md",
"document_sha256": "1d44cba1905544d92f1d26ae36a8deb64a3db3914d6b488fd30d6ae7f8cfbabe",
"anchor": {
"kind": "heading",
"value": "B-7 · B-7a — 쿠키에 담는 세션, 그리고 그 대가",
"line": 424
}
},
"outputs": [
"b7-cookie-session-tradeoff.svg",
"b7-cookie-session-tradeoff.mmd",
"b7-cookie-session-tradeoff.d2",
"b7-cookie-session-tradeoff.dot",
"b7-cookie-session-tradeoff.drawio",
"b7-cookie-session-tradeoff.excalidraw",
"b7-cookie-session-tradeoff.alt.md"
],
"lint_issue_count": 0,
"assumption_count": 0,
"assumptions_allowed": false,
"composition_profile": "component-flow",
"reference_ids": [
"payment-event-flow"
],
"diagram_only": true
}
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.mmd
+10
View File
@@ -0,0 +1,10 @@
%% 쿠키에 담으면 공유할 것이 없다
%% question: oauth2-proxy 의 secret 회전은 무엇을 남기는가
flowchart TB
n0[("k8s Secret")]
n1["쿠키의 티켓"]
n2[("Redis 의 세션")]
n3["TTL"]
n0 -->|"티켓을 암호화한다"| n1
n1 -->|"키 이름을 만든다"| n2
n2 -->|"생성 시각이 여기 남는다"| n3
docs/keycloak-session-store/final/assets/b7-cookie-session-tradeoff/b7-cookie-session-tradeoff.svg
+86
View File
@@ -0,0 +1,86 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="680" height="729" viewBox="0 0 680 729" role="img" aria-labelledby="diagram-title diagram-description">
<title id="diagram-title">쿠키에 담으면 공유할 것이 없다</title>
<desc id="diagram-description">oauth2-proxy 는 세션 전체를 쿠키에 담고 replica 는 같은 k8s Secret 을 읽을 뿐이다. 공유할 서버 상태가 없으니 콜백이 다른 replica 로 가도 된다. 대신 --cookie-secret 이 단수라 옛 secret 도 당분간 받아준다가 불가능하고 교체하는 순간 모든 쿠키가 한꺼번에 무효가 된다. Redis 저장소를 켜면 쿠키에는 티켓만 남는데, 티켓 안에 세션 id 가 있으므로 secret 을 바꾸면 어느 Redis 키를 지울지도 모르게 된다.</desc>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;b7-cookie-session-tradeoff&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;docs/keycloak-session-store/final/document.md&quot;,&quot;document_sha256&quot;:&quot;1d44cba1905544d92f1d26ae36a8deb64a3db3914d6b488fd30d6ae7f8cfbabe&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;heading&quot;,&quot;value&quot;:&quot;B-7 · B-7a — 쿠키에 담는 세션, 그리고 그 대가&quot;,&quot;line&quot;:424}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" />
</marker>
<style>
:root { color-scheme: light; }
text { font-family: Inter, Pretendard, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; fill: #111827; }
.canvas { fill: #ffffff; }
.group-box { fill: #ffffff; stroke: #9ca3af; stroke-width: 1.4; stroke-dasharray: 7 5; }
.group-label-bg { fill: #ffffff; }
.group-label { font-size: 13px; font-weight: 650; fill: #374151; }
.edge { fill: none; stroke: #374151; stroke-width: 1.8; stroke-linejoin: round; stroke-linecap: round; marker-end: url(#arrow); }
.edge.style-dashed, .edge.semantic-dashed, .edge.assumption { stroke-dasharray: 7 5; }
.edge.style-dotted { stroke-dasharray: 2 5; }
.edge.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.edge.emphasis-muted { stroke: #9ca3af; }
.edge.emphasis-warning, .edge.kind-failure, .edge.kind-error { stroke: #dc2626; stroke-width: 2.2; }
.edge-label-bg { fill: #ffffff; }
.edge-label { font-size: 12px; font-weight: 560; text-anchor: middle; }
.node-shape { fill: #ffffff; stroke: #4b5563; stroke-width: 1.7; }
.node-shape.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-shape.emphasis-muted { stroke: #9ca3af; fill: #f9fafb; }
.node-shape.emphasis-warning { stroke: #d97706; stroke-width: 2; fill: #fffdf5; }
.node-shape.kind-database, .node-shape.kind-datastore, .node-shape.kind-storage { fill: #f8fafc; }
.node-shape.kind-queue, .node-shape.kind-event, .node-shape.kind-topic { fill: #fafafa; }
.node-shape.assumption { stroke-dasharray: 4 4; }
.storage-bottom, .controller-divider { fill: none; stroke: #4b5563; stroke-width: 1.4; }
.controller-led { fill: #4b5563; }
.actor-symbol { fill: none; stroke: #4b5563; stroke-width: 1.8; stroke-linecap: round; }
.actor-symbol.emphasis-primary { stroke: #2563eb; stroke-width: 2.2; }
.node-label { font-size: 14px; font-weight: 650; text-anchor: middle; }
.node-role { font-size: 10px; letter-spacing: 0.04em; text-anchor: middle; fill: #6b7280; }
.node-detail-divider { stroke: #d1d5db; stroke-width: 1; }
.node-detail { font-size: 11px; fill: #374151; }
.assumption-badge { font-size: 9px; font-weight: 700; fill: #92400e; }
.failure-mark { stroke: #dc2626; stroke-width: 4; stroke-linecap: round; }
.lifeline { stroke: #9ca3af; stroke-width: 1.2; stroke-dasharray: 5 5; }
.timeline-axis { stroke: #374151; stroke-width: 1.8; marker-end: url(#arrow); }
.timeline-stem { stroke: #6b7280; stroke-width: 1.3; }
.timeline-marker { fill: #ffffff; stroke: #374151; stroke-width: 1.7; }
.timeline-marker.primary { fill: #2563eb; stroke: #2563eb; }
.timeline-marker.warning { fill: #dc2626; stroke: #dc2626; }
.timeline-label { font-size: 13px; font-weight: 650; text-anchor: middle; }
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
</style>
</defs>
<rect class="canvas" width="680" height="729" />
<polyline class="edge kind-read style-solid emphasis-normal" points="157.0,517.0 157.0,565.0 157.0,565.0 157.0,613.0" data-evidence="441-452" />
<rect class="edge-label-bg" x="128.4" y="551.0" width="105.1" height="22" rx="3" />
<text class="edge-label" x="181.0" y="566.0">생성 시각이 여기 남는다</text>
<polyline class="edge kind-write style-solid emphasis-normal" points="157.0,157.0 157.0,205.0 157.0,205.0 157.0,253.0" data-evidence="419-432" />
<rect class="edge-label-bg" x="141.8" y="191.0" width="78.3" height="22" rx="3" />
<text class="edge-label" x="181.0" y="206.0">티켓을 암호화한다</text>
<polyline class="edge kind-read style-solid emphasis-normal" points="157.0,324.0 157.0,372.0 157.0,372.0 157.0,420.0" data-evidence="429-438" />
<rect class="edge-label-bg" x="141.8" y="358.0" width="78.3" height="22" rx="3" />
<text class="edge-label" x="181.0" y="373.0">키 이름을 만든다</text>
<g id="node-secret">
<rect class="node-shape kind-datastore emphasis-primary role-source" data-evidence="419-428" x="70.0" y="73.0" width="174.0" height="71.0" /><ellipse class="node-shape kind-datastore emphasis-primary role-source" cx="157.0" cy="73.0" rx="87.0" ry="13.0" /><path class="storage-bottom" d="M 70.0 144.0 A 87.0 13.0 0 0 0 244.0 144.0" />
<text class="node-label" x="157.0" y="100.0">k8s Secret</text>
<line class="node-detail-divider" x1="84.0" y1="121.0" x2="230.0" y2="121.0" />
<text class="node-detail" x="86.0" y="138.0">--cookie-secret 은 단수</text>
</g>
<g id="node-ticket">
<rect class="node-shape kind-component emphasis-warning role-control" data-evidence="429-438" x="80.5" y="253.0" width="153.0" height="71.0" rx="7" />
<text class="node-label" x="157.0" y="280.0">쿠키의 티켓</text>
<line class="node-detail-divider" x1="94.5" y1="301.0" x2="219.5" y2="301.0" />
<text class="node-detail" x="96.5" y="318.0">secret 을 바꾸면 못 푼다</text>
</g>
<g id="node-redis-session">
<rect class="node-shape kind-datastore emphasis-warning role-target" data-evidence="429-440" x="82.0" y="433.0" width="150.0" height="71.0" /><ellipse class="node-shape kind-datastore emphasis-warning role-target" cx="157.0" cy="433.0" rx="75.0" ry="13.0" /><path class="storage-bottom" d="M 82.0 504.0 A 75.0 13.0 0 0 0 232.0 504.0" />
<text class="node-label" x="157.0" y="460.0">Redis 의 세션</text>
<line class="node-detail-divider" x1="96.0" y1="481.0" x2="218.0" y2="481.0" />
<text class="node-detail" x="98.0" y="498.0">고아로 남는다</text>
</g>
<g id="node-ttl">
<rect class="node-shape kind-component emphasis-primary role-target" data-evidence="441-452" x="82.0" y="613.0" width="150.0" height="71.0" rx="7" />
<text class="node-label" x="157.0" y="640.0">TTL</text>
<line class="node-detail-divider" x1="96.0" y1="661.0" x2="218.0" y2="661.0" />
<text class="node-detail" x="98.0" y="678.0">역산으로 고아를 고른다</text>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.4 KiB