docs: fill the untested items and record why the B layer has no graphs
The forward upgrade to 26.7.3 was zero downtime across 87 samples, and since databasechangelog stayed at 210 the rollback to 26.7.0 also succeeded, which narrows D-2's conclusion: rolling back fails when the schema moved, not because of the version number. The row count is the check. Role changes never reach the upstream through request repetition; the session is a snapshot taken at login and only a new session picks up the new claim. Auditing the docs also surfaced that Prometheus scrapes only keycloak, kubelet, node-exporter and itself, so the B-layer experiments have no metrics to screenshot rather than missing screenshots. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
co-authored by
Claude Opus 5
Claude Opus 5
parent
b5528fae87
commit
98a74e90a5
@@ -0,0 +1,12 @@
|
||||
# 다이어그램 규약
|
||||
|
||||
| 표현 | 뜻 |
|
||||
|---|---|
|
||||
| 실선 상자 | 살아 있는 구성 요소 |
|
||||
| 붉은 점선 상자 | 이 실험에서 죽이거나 막은 것 |
|
||||
| ✂ 붉은 X | 주입 지점 |
|
||||
| 실선 화살표 | 정상 경로 |
|
||||
| 붉은 점선 화살표 | 실험에서 깨진 경로 |
|
||||
| 회색 글씨 | 측정값 |
|
||||
|
||||
SVG 는 GitHub 에서 그대로 렌더링되며 외부 폰트를 쓰지 않는다.
|
||||
@@ -0,0 +1,26 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">A-2 · PostgreSQL 정지 — 살아남는 노드가 없다</text>
|
||||
<rect class="box" x="30" y="46" width="180" height="52"/><text class="t" x="120" y="68" text-anchor="middle">keycloak-1</text><text class="s" x="120" y="86" text-anchor="middle">캐시: 세션 N개</text>
|
||||
<rect class="box" x="480" y="46" width="180" height="52"/><text class="t" x="570" y="68" text-anchor="middle">keycloak-0</text><text class="s" x="570" y="86" text-anchor="middle">캐시: 세션 M개</text>
|
||||
<path class="ln" d="M210,72 L480,72"/><text class="s" x="345" y="66" text-anchor="middle">7800 · 살아 있다</text>
|
||||
<path class="bad" d="M120,100 L300,150"/><path class="bad" d="M570,100 L400,150"/>
|
||||
<rect class="dead" x="270" y="156" width="160" height="52"/>
|
||||
<text class="r" x="350" y="178" text-anchor="middle">postgres ✗</text><text class="s" x="350" y="196" text-anchor="middle">replicas=0</text>
|
||||
<rect class="dead" x="30" y="228" width="290" height="52"/>
|
||||
<text class="r" x="175" y="250" text-anchor="middle">양쪽 모두 NotReady</text><text class="s" x="175" y="268" text-anchor="middle">ready 주소 = [] · 외부 503</text>
|
||||
<rect class="box" x="370" y="228" width="290" height="52"/>
|
||||
<text class="t" x="515" y="250" text-anchor="middle">up{job="keycloak"} = 1</text><text class="s" x="515" y="268" text-anchor="middle">프로세스는 살아 있다 — up 은 못 잡는다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.4 KiB |
@@ -0,0 +1,36 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 330" width="720" height="330" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
</style>
|
||||
<defs><marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker></defs>
|
||||
<text class="h" x="16" y="24">A-7 · 같은 주입, 같은 관측, 정반대 결과</text>
|
||||
|
||||
<text class="h" x="180" y="52" text-anchor="middle">persistent (KC 26 기본)</text>
|
||||
<rect class="box" x="30" y="62" width="300" height="54"/>
|
||||
<text class="t" x="180" y="84" text-anchor="middle">keycloak ×2 — 로컬 캐시</text>
|
||||
<path class="ln" d="M180,116 L180,140"/>
|
||||
<rect class="ok" x="70" y="142" width="220" height="40"/>
|
||||
<text class="g" x="180" y="167" text-anchor="middle">PostgreSQL — 진실의 원천</text>
|
||||
|
||||
<text class="h" x="540" y="52" text-anchor="middle">volatile (KC 24 이전 방식)</text>
|
||||
<rect class="box" x="390" y="62" width="300" height="54"/>
|
||||
<text class="t" x="540" y="84" text-anchor="middle">keycloak ×2 — 캐시가 곧 진실</text>
|
||||
<path class="ln" d="M470,116 L470,140"/><path class="ln" d="M610,140 L610,116"/>
|
||||
<rect class="ok" x="430" y="142" width="220" height="40"/>
|
||||
<text class="g" x="540" y="167" text-anchor="middle">클러스터 복제 (7800)</text>
|
||||
|
||||
<rect class="box" x="30" y="202" width="660" height="112"/>
|
||||
<text class="t" x="360" y="224" text-anchor="middle">뒤집힌 세 결과</text>
|
||||
<text class="s" x="200" y="248" text-anchor="middle">A-1 7800 차단 후 교차 refresh</text>
|
||||
<text class="g" x="430" y="248" text-anchor="middle">200</text><text class="r" x="560" y="248" text-anchor="middle">400 Session not active</text>
|
||||
<text class="s" x="200" y="272" text-anchor="middle">A-8 롤링 재시작 후 refresh</text>
|
||||
<text class="g" x="430" y="272" text-anchor="middle">200</text><text class="r" x="560" y="272" text-anchor="middle">400 Session not active</text>
|
||||
<text class="s" x="200" y="296" text-anchor="middle">A-2 DB 정지 중 새 로그인</text>
|
||||
<text class="r" x="430" y="296" text-anchor="middle">500</text><text class="g" x="560" y="296" text-anchor="middle">200</text>
|
||||
<text class="s" x="430" y="230" text-anchor="middle">persistent</text><text class="s" x="560" y="230" text-anchor="middle">volatile</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.8 KiB |
@@ -0,0 +1,33 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 330" width="700" height="330" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">B-1 · Redis 는 세션만 옮기고 토큰은 두고 간다</text>
|
||||
<rect class="box" x="30" y="46" width="140" height="46"/><text class="t" x="100" y="66" text-anchor="middle">bff-0</text><text class="s" x="100" y="82" text-anchor="middle">kc-lab-1</text>
|
||||
<rect class="box" x="30" y="104" width="140" height="46"/><text class="t" x="100" y="124" text-anchor="middle">bff-1</text><text class="s" x="100" y="140" text-anchor="middle">kc-lab-2</text>
|
||||
<rect class="ok" x="330" y="46" width="330" height="60"/>
|
||||
<text class="t" x="495" y="68" text-anchor="middle">Redis — Application Session</text>
|
||||
<text class="s" x="495" y="86" text-anchor="middle">sessionRepository → RedisSessionRepository ✔ 옮겨졌다</text>
|
||||
<text class="s" x="495" y="100" text-anchor="middle">필드: SPRING_SECURITY_CONTEXT · TTL 1772초</text>
|
||||
<rect class="dead" x="330" y="122" width="330" height="60"/>
|
||||
<text class="r" x="495" y="144" text-anchor="middle">프로세스 메모리 — OAuth2AuthorizedClient</text>
|
||||
<text class="s" x="495" y="162" text-anchor="middle">InMemoryOAuth2AuthorizedClientService ✗ 그대로</text>
|
||||
<text class="s" x="495" y="176" text-anchor="middle">access token · refresh token 이 여기 있다</text>
|
||||
<path class="ln" d="M170,69 L330,69"/><path class="ln" d="M170,127 L330,80"/>
|
||||
<path class="bad" d="M170,140 L330,150"/>
|
||||
<rect class="box" x="30" y="210" width="630" height="90"/>
|
||||
<text class="t" x="345" y="234" text-anchor="middle">그 결과 사용자에게 보이는 것</text>
|
||||
<text class="s" x="345" y="256" text-anchor="middle">principal: labuser ← 로그인은 되어 있다</text>
|
||||
<text class="s" x="345" y="272" text-anchor="middle">accessTokenStoredOnServer: false ← 토큰이 없다</text>
|
||||
<text class="r" x="345" y="292" text-anchor="middle">완전히 로그아웃되는 편이 차라리 낫다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.8 KiB |
@@ -0,0 +1,29 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">B-3 · 동시 refresh — 경쟁이 아니라 세션 파괴</text>
|
||||
<rect class="box" x="30" y="46" width="150" height="40"/><text class="t" x="105" y="71" text-anchor="middle">같은 refresh token ×5</text>
|
||||
<path class="ln" d="M180,66 L280,66"/>
|
||||
<rect class="box" x="280" y="42" width="180" height="48"/><text class="t" x="370" y="62" text-anchor="middle">Keycloak</text>
|
||||
<text class="s" x="370" y="80" text-anchor="middle">rotation ON · maxReuse=0</text>
|
||||
<path class="ln" d="M460,58 L560,58"/><rect class="box" x="560" y="42" width="110" height="24"/><text class="s" x="615" y="58" text-anchor="middle">1× HTTP 200</text>
|
||||
<path class="bad" d="M460,78 L560,78"/><rect class="dead" x="560" y="66" width="110" height="24"/><text class="s" x="615" y="82" text-anchor="middle">4× HTTP 400</text>
|
||||
<rect class="dead" x="120" y="120" width="460" height="70"/>
|
||||
<text class="r" x="350" y="144" text-anchor="middle">재사용 탐지가 client session 을 제거한다</text>
|
||||
<text class="s" x="350" y="164" text-anchor="middle">user_session 은 남고 client_session = 0 (정상 세션은 1)</text>
|
||||
<text class="s" x="350" y="180" text-anchor="middle">그래서 오류가 "Session doesn't have required client"</text>
|
||||
<rect class="dead" x="120" y="210" width="460" height="60"/>
|
||||
<text class="r" x="350" y="234" text-anchor="middle">★ 이긴 요청의 새 토큰도 곧바로 400</text>
|
||||
<text class="s" x="350" y="254" text-anchor="middle">재시도로 회복 불가 → Q2 의 판정은 lock</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.5 KiB |
@@ -0,0 +1,37 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 290" width="700" height="290" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">B-4 · edge 가 설정하지 않은 헤더는 그대로 통과한다</text>
|
||||
<rect class="box" x="30" y="46" width="130" height="60"/><text class="t" x="95" y="68" text-anchor="middle">공격자</text>
|
||||
<text class="s" x="95" y="86" text-anchor="middle">X-Auth-Request-</text><text class="s" x="95" y="100" text-anchor="middle">Roles: admin</text>
|
||||
<path class="ln" d="M160,76 L250,76"/>
|
||||
<rect class="box" x="250" y="40" width="180" height="72"/><text class="t" x="340" y="62" text-anchor="middle">nginx</text>
|
||||
<text class="s" x="340" y="82" text-anchor="middle">proxy_set_header 한 것만 덮어쓴다</text>
|
||||
<text class="r" x="340" y="100" text-anchor="middle">X-Auth-Request-* 는 설정이 없다</text>
|
||||
<path class="bad" d="M430,76 L520,76"/>
|
||||
<rect class="dead" x="520" y="46" width="150" height="60"/>
|
||||
<text class="r" x="595" y="68" text-anchor="middle">upstream</text>
|
||||
<text class="s" x="595" y="86" text-anchor="middle">['viewer','admin']</text><text class="s" x="595" y="100" text-anchor="middle">둘 다 도착 · 검증 없음</text>
|
||||
<rect class="box" x="30" y="134" width="310" height="66"/>
|
||||
<text class="t" x="185" y="156" text-anchor="middle">구분자 문제</text>
|
||||
<text class="s" x="185" y="176" text-anchor="middle">"admin,editor" 와 "role-with,comma" 가</text>
|
||||
<text class="s" x="185" y="192" text-anchor="middle">도착 시점에 구별되지 않는다</text>
|
||||
<rect class="box" x="360" y="134" width="310" height="66"/>
|
||||
<text class="t" x="515" y="156" text-anchor="middle">크기는 절벽이다</text>
|
||||
<text class="s" x="515" y="176" text-anchor="middle">4KB 통과 · 8KB → Tomcat 400</text>
|
||||
<text class="s" x="515" y="192" text-anchor="middle">16KB → 연결 끊김 (nginx)</text>
|
||||
<rect class="dead" x="30" y="222" width="640" height="50"/>
|
||||
<text class="r" x="350" y="244" text-anchor="middle">헤더가 인가 근거가 되면 위조 가능성이 곧 권한 상승이다</text>
|
||||
<text class="s" x="350" y="262" text-anchor="middle">Q4 의 5문항 중 2·4번 해당 → Q4 자신의 기준으로 BFF 구조</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 3.1 KiB |
@@ -0,0 +1,35 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">B-5 · 파드가 Ready 인 채로 계속 실패한다</text>
|
||||
<rect class="box" x="30" y="46" width="180" height="76"/>
|
||||
<text class="t" x="120" y="68" text-anchor="middle">bff ×2</text>
|
||||
<text class="g" x="120" y="90" text-anchor="middle">Ready = true</text>
|
||||
<text class="s" x="120" y="110" text-anchor="middle">Service 에 그대로 남는다</text>
|
||||
<path class="bad" d="M210,84 L330,84"/>
|
||||
<rect class="dead" x="330" y="58" width="160" height="52"/>
|
||||
<text class="r" x="410" y="80" text-anchor="middle">redis ✗</text><text class="s" x="410" y="98" text-anchor="middle">replicas=0</text>
|
||||
<rect class="box" x="30" y="146" width="310" height="110"/>
|
||||
<text class="t" x="185" y="168" text-anchor="middle">health group 이 갈랐다</text>
|
||||
<text class="r" x="185" y="192" text-anchor="middle">/actuator/health → 503</text>
|
||||
<text class="g" x="185" y="214" text-anchor="middle">/actuator/health/readiness → 200 UP</text>
|
||||
<text class="s" x="185" y="238" text-anchor="middle">redis 지표가 readiness 그룹에 없다</text>
|
||||
<rect class="box" x="360" y="146" width="310" height="110"/>
|
||||
<text class="t" x="515" y="168" text-anchor="middle">A-2 와 정반대</text>
|
||||
<text class="s" x="515" y="192" text-anchor="middle">A-2 Keycloak: DB 검사가 readiness 에</text>
|
||||
<text class="s" x="515" y="208" text-anchor="middle">→ NotReady → 503 (명확)</text>
|
||||
<text class="s" x="515" y="230" text-anchor="middle">B-5 BFF: 없음 → Ready 유지</text>
|
||||
<text class="r" x="515" y="248" text-anchor="middle">→ HTTP 000 (멈춤)</text>
|
||||
<text class="s" x="16" y="284">영속화: 볼륨 없이 AOF 만 켜면 appendonlydir 은 생기지만 파드 삭제로 전부 사라진다 — 볼륨이 먼저다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.8 KiB |
@@ -0,0 +1,34 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 260" width="700" height="260" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">B-6 · 회전은 안전하고 옛 키를 버리는 순간이 위험하다</text>
|
||||
<rect class="ok" x="30" y="46" width="190" height="76"/>
|
||||
<text class="t" x="125" y="68" text-anchor="middle">t0 — 키 A 만</text>
|
||||
<text class="s" x="125" y="88" text-anchor="middle">발급 A · 검증 A</text>
|
||||
<text class="s" x="125" y="108" text-anchor="middle">JWKS RS256 1개</text>
|
||||
<path class="ln" d="M220,84 L255,84"/>
|
||||
<rect class="ok" x="255" y="46" width="190" height="76"/>
|
||||
<text class="t" x="350" y="68" text-anchor="middle">t1 — B 추가 (priority 200)</text>
|
||||
<text class="g" x="350" y="88" text-anchor="middle">발급 B · 검증 A+B</text>
|
||||
<text class="s" x="350" y="108" text-anchor="middle">옛 토큰 200 · 새 토큰 200</text>
|
||||
<path class="bad" d="M445,84 L480,84"/>
|
||||
<rect class="dead" x="480" y="46" width="190" height="76"/>
|
||||
<text class="t" x="575" y="68" text-anchor="middle">t2 — A 제거</text>
|
||||
<text class="r" x="575" y="88" text-anchor="middle">옛 토큰 즉시 401</text>
|
||||
<text class="s" x="575" y="108" text-anchor="middle">캐시가 유예를 주지 않는다</text>
|
||||
<rect class="box" x="30" y="146" width="640" height="60"/>
|
||||
<text class="t" x="350" y="168" text-anchor="middle">겹침 구간(t1~t2)의 최소 길이 = 옛 키로 서명된 것 중 가장 오래 사는 것의 수명</text>
|
||||
<text class="s" x="350" y="190" text-anchor="middle">access token 60초 · refresh token 1800초 → 최소 30분</text>
|
||||
<text class="s" x="16" y="234">모르는 kid 를 만나면 JWKS 를 다시 받으므로 제거가 즉시 반영된다. 유예는 옛 키를 남겨두는 기간으로 만든다.</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.7 KiB |
@@ -0,0 +1,31 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">C-1 · SSO 의 구조와 IdP 로그아웃의 한계</text>
|
||||
<rect class="box" x="220" y="42" width="260" height="52"/>
|
||||
<text class="t" x="350" y="64" text-anchor="middle">Keycloak user session ×1</text>
|
||||
<text class="s" x="350" y="82" text-anchor="middle">oqOjHekin4JU-BZjgQLjUByW</text>
|
||||
<path class="ln" d="M300,96 L180,130"/><path class="ln" d="M400,96 L520,130"/>
|
||||
<rect class="box" x="60" y="134" width="240" height="52"/>
|
||||
<text class="t" x="180" y="156" text-anchor="middle">client session — bff-confidential</text>
|
||||
<text class="s" x="180" y="174" text-anchor="middle">app1 · Redis 세션 + PostgreSQL 토큰</text>
|
||||
<rect class="box" x="400" y="134" width="240" height="52"/>
|
||||
<text class="t" x="520" y="156" text-anchor="middle">client session — oauth2-proxy</text>
|
||||
<text class="s" x="520" y="174" text-anchor="middle">app2 · 쿠키 티켓 + Redis 세션</text>
|
||||
<rect class="dead" x="220" y="206" width="260" height="40"/>
|
||||
<text class="r" x="350" y="231" text-anchor="middle">IdP 세션 삭제 ✗</text>
|
||||
<path class="bad" d="M300,246 L200,262"/><path class="bad" d="M400,246 L500,262"/>
|
||||
<rect class="ok" x="60" y="256" width="240" height="34"/><text class="g" x="180" y="278" text-anchor="middle">app1 그대로 동작</text>
|
||||
<rect class="ok" x="400" y="256" width="240" height="34"/><text class="g" x="520" y="278" text-anchor="middle">app2 그대로 동작</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.4 KiB |
@@ -0,0 +1,30 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 270" width="700" height="270" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">D-1 · 빈 데이터베이스가 200 을 냈다</text>
|
||||
<rect class="box" x="30" y="46" width="180" height="46"/><text class="t" x="120" y="66" text-anchor="middle">pg_dump</text><text class="s" x="120" y="82" text-anchor="middle">395KB · 101 테이블 · 세션 포함</text>
|
||||
<path class="ln" d="M210,69 L270,69"/>
|
||||
<rect class="dead" x="270" y="42" width="180" height="54"/>
|
||||
<text class="r" x="360" y="64" text-anchor="middle">DROP SCHEMA CASCADE</text><text class="s" x="360" y="84" text-anchor="middle">남은 테이블 0</text>
|
||||
<path class="ln" d="M450,69 L510,69"/>
|
||||
<rect class="ok" x="510" y="42" width="160" height="54"/>
|
||||
<text class="g" x="590" y="64" text-anchor="middle">복구 1초</text><text class="s" x="590" y="84" text-anchor="middle">오류 0건 · 재시작 0회</text>
|
||||
<rect class="box" x="30" y="118" width="640" height="76"/>
|
||||
<text class="t" x="350" y="140" text-anchor="middle">테이블이 0개일 때 무엇이 깨졌는가 — 전부가 아니다</text>
|
||||
<text class="g" x="350" y="162" text-anchor="middle">/protocol/openid-connect/certs → 200 (realm 키가 캐시에 있다)</text>
|
||||
<text class="r" x="350" y="182" text-anchor="middle">/.well-known → 500 토큰 발급 → 400</text>
|
||||
<rect class="dead" x="30" y="210" width="640" height="46"/>
|
||||
<text class="r" x="350" y="232" text-anchor="middle">헬스체크는 "DB 가 살아 있다"만 보고 "데이터가 있다"는 안 본다</text>
|
||||
<text class="s" x="350" y="250" text-anchor="middle">RPO = 백업 주기 + A-3 의 synchronous_commit 손실 · 덤프는 같은 호스트 /tmp 에 있었다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.6 KiB |
@@ -0,0 +1,31 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 280" width="700" height="280" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">D-3 · 네 경로 중 RBAC 만 실제로 감춘다</text>
|
||||
<rect class="dead" x="30" y="46" width="310" height="60"/>
|
||||
<text class="r" x="185" y="68" text-anchor="middle">kubectl get -o jsonpath | base64 -d</text>
|
||||
<text class="s" x="185" y="88" text-anchor="middle">POSTGRES_PASSWORD = lab-postgres-change-me</text>
|
||||
<rect class="dead" x="360" y="46" width="310" height="60"/>
|
||||
<text class="r" x="515" y="68" text-anchor="middle">저장소 (at rest)</text>
|
||||
<text class="s" x="515" y="88" text-anchor="middle">Encryption Disabled · state.db 에 평문</text>
|
||||
<rect class="dead" x="30" y="120" width="310" height="60"/>
|
||||
<text class="r" x="185" y="142" text-anchor="middle">파드 안</text>
|
||||
<text class="s" x="185" y="162" text-anchor="middle">KEYCLOAK_CLIENT_SECRET=... 환경변수</text>
|
||||
<rect class="ok" x="360" y="120" width="310" height="60"/>
|
||||
<text class="g" x="515" y="142" text-anchor="middle">RBAC</text>
|
||||
<text class="s" x="515" y="162" text-anchor="middle">default SA 는 get secrets 불가</text>
|
||||
<rect class="box" x="30" y="200" width="640" height="60"/>
|
||||
<text class="t" x="350" y="222" text-anchor="middle">describe 는 "14 bytes" 만 보여줘 감춰졌다는 착각을 준다</text>
|
||||
<text class="s" x="350" y="244" text-anchor="middle">base64 는 감추기 위한 것이 아니라 YAML 에 임의 바이트를 담기 위한 인코딩이다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.4 KiB |
@@ -0,0 +1,30 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 250" width="700" height="250" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
||||
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
||||
</style>
|
||||
<defs>
|
||||
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
||||
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
||||
</defs>
|
||||
<text class="h" x="16" y="24">D-4 · 인증서 체인과 SAN 제약</text>
|
||||
<rect class="ok" x="30" y="46" width="300" height="104"/>
|
||||
<text class="t" x="180" y="68" text-anchor="middle">체인 4단계 · Verify return code: 0</text>
|
||||
<text class="s" x="180" y="90" text-anchor="middle">0 CN=auth.hyeonworks.com</text>
|
||||
<text class="s" x="180" y="106" text-anchor="middle">1 Let's Encrypt YE2</text>
|
||||
<text class="s" x="180" y="122" text-anchor="middle">2 ISRG Root YE</text>
|
||||
<text class="s" x="180" y="138" text-anchor="middle">3 ISRG Root X2</text>
|
||||
<rect class="box" x="360" y="46" width="310" height="104"/>
|
||||
<text class="t" x="515" y="68" text-anchor="middle">SAN 3개 · 와일드카드 아님</text>
|
||||
<text class="s" x="515" y="90" text-anchor="middle">auth · app1 · app2</text>
|
||||
<text class="r" x="515" y="114" text-anchor="middle">네 번째 이름이 없다</text>
|
||||
<text class="s" x="515" y="134" text-anchor="middle">B-7 에서 Grafana 의 app2 를 빌려야 했다</text>
|
||||
<rect class="box" x="30" y="168" width="640" height="60"/>
|
||||
<text class="t" x="350" y="190" text-anchor="middle">단계가 1개면 cert.pem, 2개 이상이면 fullchain.pem 이다</text>
|
||||
<text class="s" x="350" y="212" text-anchor="middle">브라우저는 중간 인증서를 캐시하므로 cert.pem 실수는 캐시 없는 클라이언트에서만 드러난다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.4 KiB |
@@ -0,0 +1,57 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 470" width="760" height="470" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
||||
<style>
|
||||
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
||||
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
||||
.host{fill:#f6f8fa;stroke:#59636e;stroke-width:1.6;rx:8}
|
||||
.node{fill:#fff;stroke:#0969da;stroke-width:1.6;rx:8}
|
||||
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
||||
</style>
|
||||
<defs><marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker></defs>
|
||||
|
||||
<rect class="box" x="290" y="12" width="180" height="38"/>
|
||||
<text class="t" x="380" y="30" text-anchor="middle">개발 노트북</text>
|
||||
<text class="s" x="380" y="44" text-anchor="middle">브라우저 · kubectl · Playwright</text>
|
||||
<path class="ln" d="M380,52 L380,80"/>
|
||||
<text class="s" x="392" y="70">https · tailnet 100.x · split DNS</text>
|
||||
|
||||
<rect class="host" x="40" y="84" width="680" height="66"/>
|
||||
<text class="h" x="56" y="106">test-server</text>
|
||||
<text class="s" x="56" y="122">Arch Linux · 12GB · WiFi only · sudo 는 비밀번호 필요</text>
|
||||
<rect class="box" x="430" y="94" width="270" height="46"/>
|
||||
<text class="t" x="565" y="112" text-anchor="middle">nginx :443 — TLS 종료</text>
|
||||
<text class="s" x="565" y="128" text-anchor="middle">auth / app1 / app2 (SAN 3개, 와일드카드 아님)</text>
|
||||
|
||||
<path class="ln" d="M240,152 L200,186"/><path class="ln" d="M520,152 L560,186"/>
|
||||
<text class="s" x="330" y="172" text-anchor="middle">http · libvirt NAT (virbr0)</text>
|
||||
|
||||
<rect class="node" x="40" y="190" width="320" height="250"/>
|
||||
<text class="h" x="56" y="212">kc-lab-1 · 5120MB</text>
|
||||
<text class="s" x="56" y="228">k3s server · 10.42.0.0/24</text>
|
||||
<rect class="box" x="56" y="238" width="130" height="26"/><text class="t" x="121" y="255" text-anchor="middle">traefik ×1</text>
|
||||
<rect class="box" x="196" y="238" width="148" height="26"/><text class="t" x="270" y="255" text-anchor="middle">coredns</text>
|
||||
<rect class="box" x="56" y="272" width="130" height="26"/><text class="t" x="121" y="289" text-anchor="middle">keycloak-1</text>
|
||||
<rect class="box" x="196" y="272" width="148" height="26"/><text class="t" x="270" y="289" text-anchor="middle">bff (1/2)</text>
|
||||
<rect class="box" x="56" y="306" width="288" height="26"/><text class="t" x="200" y="323" text-anchor="middle">oauth2-proxy (1/2)</text>
|
||||
<rect class="box" x="56" y="340" width="288" height="46"/>
|
||||
<text class="t" x="200" y="358" text-anchor="middle">prometheus (PVC) · grafana</text>
|
||||
<text class="s" x="200" y="374" text-anchor="middle">관측 스택은 여기 고정 — 죽이지 않는다</text>
|
||||
|
||||
<rect class="node" x="400" y="190" width="320" height="250"/>
|
||||
<text class="h" x="416" y="212">kc-lab-2 · 4096MB</text>
|
||||
<text class="s" x="416" y="228">k3s agent · 10.42.1.0/24</text>
|
||||
<rect class="box" x="416" y="238" width="288" height="26"/><text class="t" x="560" y="255" text-anchor="middle">keycloak-0</text>
|
||||
<rect class="box" x="416" y="272" width="140" height="26"/><text class="t" x="486" y="289" text-anchor="middle">bff (2/2)</text>
|
||||
<rect class="box" x="566" y="272" width="138" height="26"/><text class="t" x="635" y="289" text-anchor="middle">oauth2-proxy</text>
|
||||
<rect class="box" x="416" y="306" width="140" height="46"/>
|
||||
<text class="t" x="486" y="324" text-anchor="middle">postgres</text><text class="s" x="486" y="340" text-anchor="middle">PVC (노드 고정)</text>
|
||||
<rect class="box" x="566" y="306" width="138" height="46"/>
|
||||
<text class="t" x="635" y="324" text-anchor="middle">redis</text><text class="s" x="635" y="340" text-anchor="middle">PVC + AOF</text>
|
||||
<text class="s" x="560" y="374" text-anchor="middle">장애 주입은 여기</text>
|
||||
|
||||
<path d="M360,290 L400,290" stroke="#0969da" stroke-width="1.6" fill="none" marker-end="url(#a)"/>
|
||||
<path d="M400,300 L360,300" stroke="#0969da" stroke-width="1.6" fill="none" marker-end="url(#a)"/>
|
||||
<text class="s" x="380" y="284" text-anchor="middle">7800</text>
|
||||
<text class="s" x="380" y="318" text-anchor="middle">JGroups</text>
|
||||
|
||||
<text class="s" x="40" y="460">A-0 에서 확인: 세션은 이 7800 이 아니라 postgres 를 통해 공유된다</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 4.3 KiB |
Reference in New Issue
Block a user