DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
124 lines
12 KiB
XML
124 lines
12 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="1426" viewBox="0 0 1200 1426" role="img">
|
|
<title>terminal evidence</title>
|
|
<desc>Terminal-style rendering generated from retained command output. Sensitive-looking values are redacted in the visual asset.</desc>
|
|
<rect x="1" y="1" width="1198" height="1424" rx="14" fill="#0d1117" stroke="#30363d"/>
|
|
<rect x="1" y="1" width="1198" height="44" rx="14" fill="#161b22"/>
|
|
<rect x="1" y="30" width="1198" height="14" fill="#161b22"/>
|
|
<circle cx="24" cy="22" r="6" fill="#ff5f57"/>
|
|
<circle cx="44" cy="22" r="6" fill="#febc2e"/>
|
|
<circle cx="64" cy="22" r="6" fill="#28c840"/>
|
|
<text x="92" y="27" fill="#8b949e" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace">terminal evidence</text>
|
|
<text x="24" y="68" fill="#c9d1d9" font-size="15" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">$ set -e
|
|
set -o pipefail
|
|
D=$(mktemp -d); trap 'rm -rf "$D"' EXIT
|
|
C=/shared/codebase/clean-architecture-backend-template
|
|
</tspan><tspan x="24" dy="22">M=$C/src/messaging/messaging-spring-boot-starter
|
|
CACHE=/root/.gradle/caches/modules-2/files-2.1
|
|
java -version 2>&1 | gre</tspan><tspan x="24" dy="22">p version
|
|
cp=""
|
|
while IFS= read -r line; do
|
|
coord=${line%%=*}; confs=${line#*=}
|
|
case ",$confs," in *",testRuntimeCla</tspan><tspan x="24" dy="22">sspath,"*) ;; *) continue ;; esac
|
|
g=${coord%%:*}; rest=${coord#*:}; n=${rest%%:*}; v=${rest##*:}
|
|
jar=$(find "$CACHE/</tspan><tspan x="24" dy="22">$g/$n/$v" -name '*.jar' ! -name '*sources*' ! -name '*javadoc*' 2>/dev/null | head -1) || true
|
|
[ -n "$jar" ] && cp="$c</tspan><tspan x="24" dy="22">p:$jar"
|
|
done < <(grep -E '^[a-zA-Z0-9._-]+:[^=]+=' "$M/gradle.lockfile")
|
|
|
|
cat > "$D/TlsDefaultProbe.java" <<'JAVA'
|
|
impor</tspan><tspan x="24" dy="22">t org.apache.kafka.clients.CommonClientConfigs;
|
|
import org.apache.kafka.clients.producer.ProducerConfig;
|
|
import org.apac</tspan><tspan x="24" dy="22">he.kafka.common.config.SaslConfigs;
|
|
import org.apache.kafka.common.config.SslConfigs;
|
|
import org.apache.kafka.common.ser</tspan><tspan x="24" dy="22">ialization.ByteArraySerializer;
|
|
import org.apache.kafka.common.serialization.StringSerializer;
|
|
import java.util.HashMap;</tspan><tspan x="24" dy="22">
|
|
import java.util.Map;
|
|
import java.util.TreeSet;
|
|
|
|
/** 조립되는 두 생산자의 설정 맵을 그대로 Kafka 클라이언트에 넘겨 해석</tspan><tspan x="24" dy="22">된 보안 값을 읽는다. */
|
|
public final class TlsDefaultProbe {
|
|
|
|
/** KafkaMessagingAutoConfiguration.messagingKafkaProduc</tspan><tspan x="24" dy="22">er:139-152 이 넣는 것 전부. */
|
|
private static Map<String, Object> platformTransport() {
|
|
Map<String, Object> config</tspan><tspan x="24" dy="22"> = new HashMap<>();
|
|
config.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, "broker-1:9093");
|
|
config.put(ProducerCon</tspan><tspan x="24" dy="22">fig.KEY_SERIALIZER_CLASS_CONFIG, ByteArraySerializer.class);
|
|
config.put(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG</tspan><tspan x="24" dy="22">, ByteArraySerializer.class);
|
|
config.put(ProducerConfig.ACKS_CONFIG, "all");
|
|
config.put(ProducerConfig.ENABLE_ID</tspan><tspan x="24" dy="22">EMPOTENCE_CONFIG, true);
|
|
return config;
|
|
}
|
|
|
|
/** KafkaSenderConfig.kafkaSeamProducer:65-80 이 넣는 것 전부. */
|
|
p</tspan><tspan x="24" dy="22">rivate static Map<String, Object> seam() {
|
|
Map<String, Object> config = new HashMap<>();
|
|
config.put(ProducerConf</tspan><tspan x="24" dy="22">ig.BOOTSTRAP_SERVERS_CONFIG, "broker-1:9093");
|
|
config.put(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG, StringSerializ</tspan><tspan x="24" dy="22">er.class);
|
|
config.put(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG, StringSerializer.class);
|
|
config.put(Producer</tspan><tspan x="24" dy="22">Config.ACKS_CONFIG, "all");
|
|
config.put(ProducerConfig.ENABLE_IDEMPOTENCE_CONFIG, true);
|
|
config.put(ProducerConfi</tspan><tspan x="24" dy="22">g.MAX_BLOCK_MS_CONFIG, 10_000);
|
|
config.put(ProducerConfig.LINGER_MS_CONFIG, 0);
|
|
config.put(ProducerConfig.REQUES</tspan><tspan x="24" dy="22">T_TIMEOUT_MS_CONFIG, 15_000);
|
|
config.put(ProducerConfig.DELIVERY_TIMEOUT_MS_CONFIG, 30_000);
|
|
return config;
|
|
}
|
|
</tspan><tspan x="24" dy="22">
|
|
private static void report(String label, Map<String, Object> config) {
|
|
System.out.println(" " + label);
|
|
Syst</tspan><tspan x="24" dy="22">em.out.println(" 조립부가 넣은 키 " + config.size() + " 개 : " + new TreeSet<>(config.keySet()));
|
|
ProducerConfig </tspan><tspan x="24" dy="22">resolved = new ProducerConfig(config);
|
|
System.out.println(
|
|
" security.protocol = "</tspan><tspan x="24" dy="22">
|
|
+ resolved.getString(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG));
|
|
System.out.println(
|
|
" s</tspan><tspan x="24" dy="22">sl.endpoint.identification.algorithm = \""
|
|
+ resolved.getString(SslConfigs.SSL_ENDPOINT_IDENTIFICATION_AL</tspan><tspan x="24" dy="22">GORITHM_CONFIG) + "\"");
|
|
System.out.println(
|
|
" sasl.mechanism = "
|
|
+</tspan><tspan x="24" dy="22"> resolved.getString(SaslConfigs.SASL_MECHANISM));
|
|
System.out.println(
|
|
" sasl.jaas.config </tspan><tspan x="24" dy="22"> = "
|
|
+ resolved.getPassword(SaslConfigs.SASL_JAAS_CONFIG));
|
|
System.out.println(
|
|
" ssl.</tspan><tspan x="24" dy="22">enabled.protocols = "
|
|
+ resolved.getList(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG));
|
|
S</tspan><tspan x="24" dy="22">ystem.out.println();
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
System.out.println();
|
|
System.out.println("k</tspan><tspan x="24" dy="22">afka-clients " + org.apache.kafka.common.utils.AppInfoParser.getVersion()
|
|
+ " 가 아래 설정 맵에서 해석하는 보안 </tspan><tspan x="24" dy="22">값");
|
|
report("KafkaMessagingAutoConfiguration.messagingKafkaProducer", platformTransport());
|
|
report("KafkaSender</tspan><tspan x="24" dy="22">Config.kafkaSeamProducer", seam());
|
|
}
|
|
}
|
|
JAVA
|
|
javac -encoding UTF-8 -cp "$cp" -d "$D/out" "$D/TlsDefaultProbe.java" 2>&</tspan><tspan x="24" dy="22">1 | head -10
|
|
java -Dstdout.encoding=UTF-8 -cp "$D/out:$cp" TlsDefaultProbe 2>&1 | grep -vE '^[0-9]{4}-|^\s+at |WARN |INF</tspan><tspan x="24" dy="22">O |SLF4J'
|
|
</tspan></text>
|
|
<text x="24" y="882" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">cwd: /shared/codebase/clean-architecture-backend-template</tspan></text>
|
|
<text x="24" y="904" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">time: 2026-09-03T12:25:21+00:00 · exit 0</tspan></text>
|
|
<line x1="24" y1="918" x2="1176" y2="918" stroke="#30363d"/>
|
|
<text x="24" y="958" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">openjdk version "21.0.12" 2026-07-21</tspan></text>
|
|
<text x="24" y="980" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1002" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">kafka-clients 4.1.2 가 아래 설정 맵에서 해석하는 보안 값</tspan></text>
|
|
<text x="24" y="1024" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> KafkaMessagingAutoConfiguration.messagingKafkaProducer</tspan></text>
|
|
<text x="24" y="1046" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 조립부가 넣은 키 5 개 : [acks, bootstrap.servers, enable.idempotence, key.serializer, value.serializer]</tspan></text>
|
|
<text x="24" y="1068" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> security.protocol = PLAINTEXT</tspan></text>
|
|
<text x="24" y="1090" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> ssl.endpoint.identification.algorithm = "https"</tspan></text>
|
|
<text x="24" y="1112" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> sasl.mechanism = GSSAPI</tspan></text>
|
|
<text x="24" y="1134" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> sasl.jaas.config = null</tspan></text>
|
|
<text x="24" y="1156" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> ssl.enabled.protocols = [TLSv1.2, TLSv1.3]</tspan></text>
|
|
<text x="24" y="1178" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1200" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> KafkaSenderConfig.kafkaSeamProducer</tspan></text>
|
|
<text x="24" y="1222" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 조립부가 넣은 키 9 개 : [acks, bootstrap.servers, delivery.timeout.ms, enable.idempotence, key.serializer, linger.ms, max.bl</tspan><tspan x="24" dy="22">ock.ms, request.timeout.ms, value.serializer]</tspan></text>
|
|
<text x="24" y="1266" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> security.protocol = PLAINTEXT</tspan></text>
|
|
<text x="24" y="1288" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> ssl.endpoint.identification.algorithm = "https"</tspan></text>
|
|
<text x="24" y="1310" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> sasl.mechanism = GSSAPI</tspan></text>
|
|
<text x="24" y="1332" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> sasl.jaas.config = null</tspan></text>
|
|
<text x="24" y="1354" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> ssl.enabled.protocols = [TLSv1.2, TLSv1.3]</tspan></text>
|
|
<text x="24" y="1376" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
</svg>
|