DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.4 KiB
Plaintext
38 lines
1.4 KiB
Plaintext
#cloud-config
|
|
# Template for both lab guests. scripts/rebuild-seed.sh substitutes __NODE__
|
|
# and bakes this into a CIDATA seed image.
|
|
#
|
|
# Copy to kc-lab.yaml and fill the two placeholders. The real file is ignored by
|
|
# git because plain_text_passwd is a credential, however disposable.
|
|
#
|
|
# Indentation is spaces only. YAML forbids tabs, and cloud-init fails silently
|
|
# on a parse error: the guest boots as "localhost" with no user and no way in.
|
|
hostname: kc-lab-__NODE__
|
|
fqdn: kc-lab-__NODE__
|
|
manage_etc_hosts: true
|
|
|
|
users:
|
|
- name: donghyeon
|
|
groups: [sudo]
|
|
shell: /bin/bash
|
|
# NOPASSWD is required: the k3s installer and the fault-injection scripts
|
|
# run non-interactively and would block on a password prompt.
|
|
sudo: ['ALL=(ALL) NOPASSWD:ALL']
|
|
# Console-only escape hatch. Without it, a cloud-init failure leaves a guest
|
|
# that cannot be logged into at all, so its own failure log is unreadable.
|
|
# ssh_pwauth stays false, so this never widens SSH exposure.
|
|
lock_passwd: false
|
|
plain_text_passwd: CHANGE_ME
|
|
ssh_authorized_keys:
|
|
# Lab host key: needed because automation runs from the lab host, where
|
|
# agent forwarding is not available.
|
|
- CHANGE_ME_LAB_HOST_PUBLIC_KEY
|
|
# Workstation key: lets ProxyJump reach the guest directly.
|
|
- CHANGE_ME_WORKSTATION_PUBLIC_KEY
|
|
|
|
ssh_pwauth: false
|
|
package_update: true
|
|
packages:
|
|
- curl
|
|
- nftables
|