donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Files
b1a78752df0db098d5440190925cd798517837e2
document-haness/docs/keycloak-session-store/final/evidence/raw/relive-2026-09-17/a7-06-prep-and-switch.txt
T
DongHyeonkaandClaude Opus 5 32e39e20aa fix(setup): 실험대에서 35편을 끝까지 밟고 어긋난 명령·결과 31건을 고친다 
test-server 를 비우고 다시 세운 뒤 Setup 기록 35편(virtualization 9 ·
keycloak-session-store 26)을 문서에 적힌 명령 그대로 쳤다. 어긋난 자리를
기록과 SSOT 양쪽에 실측과 함께 넣었다.

막히던 것
- 04 의 인증서 경로가 live/hyeonworks.com 이라 nginx 가 [emerg] 로 안 떴다.
  실제 계보는 live/auth.hyeonworks.com 이고 「문제가 생기면」은 진단이 거꾸로였다
- 인증서가 와일드카드가 아니다. SAN 이 auth·app1·app2 셋뿐이라 그 밖의 이름은
  TLS 에서 끊기고 curl 이 exit 60 · %{http_code} 000 을 낸다. SSOT 안에서
  두 문단이 서로 어긋나 있었다
- A-7 14번 ①이 kc-lab-1 에서 여섯 줄 다 실패하는데 마지막 date 만 「차단」을 찍는다

검사가 실패할 수 없던 자리
- B-1 의 세션 키 고르기는 앞 단계가 $KEY 를 채워 둬서 루프가 한 건도 못 맞혀도
  통과한다. KEY= 로 비우고 키마다 1/0 을 찍게 바꿨다
- k3s-agent 유닛의 sed -i 는 패턴에 $HOME 이 들어 있어 아무 줄도 안 바꾼 채 성공한다

certbot
- renew --dry-run 의 종료 코드는 성공도 0, 실패도 0, 다른 사유의 실패는 1 이다.
  본문의 renew failure(s) 로만 판정할 수 있다
- --dry-run 은 staging 서버를 쓰는데 renewal/*.conf 의 account= 는 운영 계정을
  가리킨다. 실패한 dry-run 이 staging 계정을 하나 더 만들어 다음 실행이 계속 멎는다
- 훅을 755 로 놓고 시뮬레이션이 성공해도 Running deploy-hook command 는 안 나온다.
  certbot 2.1.0 에는 --run-deploy-hooks 도 없다
- 강제 갱신은 실제로 쳤고 서빙까지 닿았다. serial 06F3E0EF…1373 → 065547…3DF1,
  notAfter Dec 3 → Dec 16, nginx worker 2629 4712 → 4745 4754

독자가 칠 수 있는 형태로
- 안 되는 형태가 번호 붙은 단계에 앉아 있던 8곳을 뒤집고, 되는 형태를 ①로 올렸다
- 랩 안에서 공개 이름을 치는 curl 65줄에 --resolve 를 붙였다. 붙인 형태를 실제로
  쳐서 문서가 적은 값과 같은지 확인했다
- 힙독·sed -i·echo >>·&&·|| 를 편집기 + 파일 리스팅 + 분할 형태로 바꿨다
- 닫는 코드펜스가 빠져 뒤 200여 줄의 블록 종류가 뒤집혀 있던 곳을 포함해 3곳을 고쳤다

관문: check_body PASS · check_prose error 0 · check_evidence 두 프로젝트 문제 없음 ·
verify-tech-log-tree error 0 · verify-project-layout error 0 · 코드펜스 전수 0건

남은 것: B-0 주입은 keycloak-pattern 저장소의 소스를 고치고 이미지를 다시 구워야
해서 안 했다(unknown).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-17 19:38:12 +09:00

173 lines
14 KiB
Plaintext
Raw Blame History

=== a7 1 ① 노드와 파드를 넓게 본다 ===
NAME STATUS ROLES AGE VERSION
kc-lab-1 Ready control-plane 4h34m v1.36.4+k3s1
kc-lab-2 Ready <none> 4h33m v1.36.4+k3s1
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
bff-5d97897676-nmlqs 1/1 Running 0 155m 10.42.0.22 kc-lab-1 <none> <none>
bff-5d97897676-zvfhp 1/1 Running 0 155m 10.42.1.51 kc-lab-2 <none> <none>
keycloak-0 1/1 Running 0 126m 10.42.1.64 kc-lab-2 <none> <none>
keycloak-1 1/1 Running 0 126m 10.42.0.29 kc-lab-1 <none> <none>
oauth2-proxy-d9b587458-7x9jt 1/1 Running 0 60m 10.42.1.78 kc-lab-2 <none> <none>
oauth2-proxy-d9b587458-njxdw 1/1 Running 0 60m 10.42.1.79 kc-lab-2 <none> <none>
postgres-7b474b88c8-48lrr 1/1 Running 0 165m 10.42.1.46 kc-lab-2 <none> <none>
redis-f94bc6dbf-s674z 1/1 Running 0 128m 10.42.1.63 kc-lab-2 <none> <none>
=== a7 1 ② IP 를 변수에 담는다 ===
10.42.1.64 10.42.0.29
=== a7 2 컨테이너 args 를 그대로 찍는다 ===
["start"]
=== a7 3 온라인 세션과 offline token 을 나눠 센다 ===
offline_flag | count
--------------+-------
0 | 143
(1 row)
=== a7 4 ① 탐침을 띄우고 Ready 를 기다린다 ===
pod/a7-probe created
pod/a7-probe condition met
=== a7 4 ② 비밀번호의 길이만 센다 ===
19
=== a7 4 ③ 탐침 안에 값이 들어갔는지 본다 ===
K0=10.42.1.64 K1=10.42.0.29 PW길이=19
=== a7 5 ② 토큰을 파드 안 파일에 담고 길이를 찍는다 ===
rt 612 bytes
=== a7 5 ③ 반대 노드에서 그 토큰으로 갱신한다 ===
200
=== a7 6 빌드 기능 목록에서 이름을 찾는다 ===
persistent-user-sessions[:v1]
persistent-user-sessions
exit=0
=== a7 7 온라인·오프라인 세션 행을 전부 지운다 ===
DELETE 144
=== a7 8 파일 대신 patch 로 바꾸는 형태 ===
statefulset.apps/keycloak patched
=== a7 8 ③ 전환 시각을 남기고 롤아웃을 기다린다 ===
18:02:41 전환
Waiting for partitioned roll out to finish: 0 out of 2 new pods have been updated...
Waiting for 1 pods to be ready...
Waiting for 1 pods to be ready...
Waiting for 1 pods to be ready...
Waiting for partitioned roll out to finish: 1 out of 2 new pods have been updated...
Waiting for 1 pods to be ready...
Waiting for 1 pods to be ready...
Waiting for 1 pods to be ready...
partitioned roll out complete: 2 new pods have been updated...
exit=0
18:03:47 롤아웃 끝
=== a7 9 args 와 파드 나이를 함께 본다 ===
["start","--features-disabled=persistent-user-sessions"]
keycloak-0 1/1 Running 0 31s 10.42.1.82 kc-lab-2 <none> <none>
keycloak-1 1/1 Running 0 64s 10.42.0.37 kc-lab-1 <none> <none>
=== a7 9 ① 롤아웃 뒤 IP 를 다시 잡는다 ===
10.42.1.82 10.42.0.37
=== a7 9 ② 탐침을 지우고 새 IP 로 다시 띄운다 ===
pod "a7-probe" deleted from keycloak-lab namespace
pod/a7-probe created
pod/a7-probe condition met
=== a7 10 ① 한쪽 노드에만 다섯 번 로그인한다 ===
200 200 200 200 200
=== a7 10 ② 같은 질의로 DB 행을 다시 센다 ===
offline_flag | count
--------------+-------
(0 rows)
=== a7 11 ① 한 줄짜리 JSON 을 통째로 본다 ===
{"status":"success","data":{"resultType":"vector","result":[{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"users","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"sessions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"82"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"clientSessions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"82"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authorization","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"offlineSessions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"realmRevisions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"7"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authenticationSessions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"userRevisions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"keys","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"work","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"realms","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"7"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"offlineClientSessions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"actionTokens","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"1"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authorizationRevisions","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"loginFailures","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"crl","cache_manager":"keycloak","exported_node":"keycloak-1-47642","instance":"10.42.0.37:9000","job":"keycloak","node":"kc-lab-1","pod":"keycloak-1"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"users","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"work","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"1"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"loginFailures","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"clientSessions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"62"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"actionTokens","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"offlineClientSessions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authenticationSessions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"keys","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"crl","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authorizationRevisions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"offlineSessions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"sessions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"62"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"authorization","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"realmRevisions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"7"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"realms","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"7"]},{"metric":{"__name__":"vendor_statistics_approximate_entries_unique","cache":"userRevisions","cache_manager":"keycloak","exported_node":"keycloak-0-23770","instance":"10.42.1.82:9000","job":"keycloak","node":"kc-lab-2","pod":"keycloak-0"},"value":[1789635775.118,"0"]}]}}
=== a7 11 ② 캐시 이름과 파드와 값만 세로로 늘어놓는다 ===
"cache":"users"
"pod":"keycloak-1"}
"0"]}
"cache":"sessions"
"pod":"keycloak-1"}
"82"]}
"cache":"clientSessions"
"pod":"keycloak-1"}
"82"]}
"cache":"authorization"
"pod":"keycloak-1"}
"0"]}
"cache":"offlineSessions"
"pod":"keycloak-1"}
"0"]}
"cache":"realmRevisions"
"pod":"keycloak-1"}
"7"]}
"cache":"authenticationSessions"
"pod":"keycloak-1"}
"0"]}
"cache":"userRevisions"
"pod":"keycloak-1"}
"0"]}
"cache":"keys"
"pod":"keycloak-1"}
"0"]}
"cache":"work"
"pod":"keycloak-1"}
"0"]}
"cache":"realms"
"pod":"keycloak-1"}
"7"]}
"cache":"offlineClientSessions"
"pod":"keycloak-1"}
"0"]}
"cache":"actionTokens"
"pod":"keycloak-1"}
"1"]}
"cache":"authorizationRevisions"
"pod":"keycloak-1"}
"0"]}
"cache":"loginFailures"
"pod":"keycloak-1"}
"0"]}
"cache":"crl"
"pod":"keycloak-1"}
"0"]}
"cache":"users"
"pod":"keycloak-0"}
"0"]}
"cache":"work"
"pod":"keycloak-0"}
"1"]}
"cache":"loginFailures"
"pod":"keycloak-0"}
"0"]}
"cache":"clientSessions"
"pod":"keycloak-0"}
"62"]}
"cache":"actionTokens"
"pod":"keycloak-0"}
"0"]}
"cache":"offlineClientSessions"
"pod":"keycloak-0"}
"0"]}
"cache":"authenticationSessions"
"pod":"keycloak-0"}
"0"]}
"cache":"keys"
"pod":"keycloak-0"}
"0"]}
"cache":"crl"
"pod":"keycloak-0"}
"0"]}
"cache":"authorizationRevisions"
"pod":"keycloak-0"}
"0"]}
"cache":"offlineSessions"
"pod":"keycloak-0"}
"0"]}
"cache":"sessions"
"pod":"keycloak-0"}
"62"]}
"cache":"authorization"
"pod":"keycloak-0"}
"0"]}
"cache":"realmRevisions"
"pod":"keycloak-0"}
"7"]}
"cache":"realms"
"pod":"keycloak-0"}
"7"]}
"cache":"userRevisions"
"pod":"keycloak-0"}
"0"]}]}}
exit=0
Reference in New Issue View Git Blame Copy Permalink