DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
49 lines
2.2 KiB
Plaintext
49 lines
2.2 KiB
Plaintext
수집 시각: 2026-09-03 16:16:48 KST
|
|
주제: 프록시 우회 경로 차단 (NetworkPolicy)
|
|
|
|
=== [1] 차단 전 — 클러스터 안에서 앱에 직접 요청 ===
|
|
명령: kubectl run ... -- curl http://echo:8081/api/echo \
|
|
-H 'X-Forwarded-Proto: https' -H 'X-Forwarded-Host: evil.example.com' -H 'X-Forwarded-For: 1.2.3.4'
|
|
|
|
scheme https
|
|
secure True
|
|
serverName evil.example.com ← 위조 성공
|
|
remoteAddr 1.2.3.4 ← 위조 성공
|
|
requestUrl https://evil.example.com/api/echo
|
|
|
|
★ Traefik 을 거치지 않으면 헤더 위조가 그대로 통한다.
|
|
trustedIPs 와 internalProxies 가 둘 다 '대역'을 믿기 때문.
|
|
|
|
=== [2] 적용한 것 ===
|
|
deploy/lab/k8s/traefik-forwarded-headers.yaml — 192.168.122.0/24 제거
|
|
"--entryPoints.web.forwardedHeaders.trustedIPs=10.42.0.0/16"
|
|
"--entryPoints.websecure.forwardedHeaders.trustedIPs=10.42.0.0/16"
|
|
|
|
deploy/lab/k8s/echo-network-policy.yaml — Traefik 파드에서만 8081 허용
|
|
[{"from":[{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"kube-system"}},"podSelector":{"matchLabels":{"app.kubernetes.io/name":"traefik"}}}],"ports":[{"port":8081,"protocol":"TCP"}]},{"from":[{"ipBlock":{"cidr":"10.42.0.1/32"}},{"ipBlock":{"cidr":"10.42.1.1/32"}}],"ports":[{"port":8081,"protocol":"TCP"}]}]
|
|
|
|
=== [3] 차단 후 — 정상 경로 (계속 동작해야 함) ===
|
|
x-forwarded-proto https
|
|
x-forwarded-port 443
|
|
x-forwarded-host app1.hyeonworks.com
|
|
x-real-ip 100.123.124.30
|
|
x-forwarded-server traefik-5d6fcf895-wpfhr
|
|
--- 앱이 해석한 값
|
|
scheme https
|
|
secure True
|
|
serverName app1.hyeonworks.com
|
|
serverPort 443
|
|
remoteAddr 100.123.124.30
|
|
localAddr 10.42.0.14
|
|
requestUrl https://app1.hyeonworks.com/api/echo
|
|
|
|
=== [4] 차단 후 — 우회 시도 ===
|
|
HTTP 000 / curl exit 7
|
|
HTTP 000 / curl exit 7
|
|
|
|
★ curl exit 7 = Failed to connect. 연결 자체가 성립하지 않는다.
|
|
|
|
=== [5] 파드 건강 상태 (probe 가 차단되지 않았는지) ===
|
|
echo-54dbd94986-8jmdb 1/1 Running restarts=0
|
|
echo-54dbd94986-lfltk 1/1 Running restarts=0
|