docs: B-7 — the cookie secret has no overlap window and rotation orphans sessions

oauth2-proxy carries the authorization request in a signed cookie, so the callback can land on a different replica and still succeed, which is the opposite of the BFF failure in B-0. Sharing is therefore just sharing one Secret.

Rotating it is all-or-nothing: --cookie-secret is singular, so there is no second key to read old tickets with, and the log shows both the validation failure and Error removing session, leaving the Redis session orphaned because the key cannot be derived from a ticket that will not decode.

Getting there required two diagnoses: the callback 502 came from the full session riding in Set-Cookie past nginx's buffer, and every earlier attempt to read nginx config returned nothing because sudo on the host asks for a password while the guests do not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/evidence/b7-cookie-secret/01-deploy.txt

@@ -0,0 +1,13 @@
+=== Grafana ingress 를 잠시 내린다 (app2 를 빌린다) ===
+  grafana ingress 삭제
+secret/oauth2-proxy-secrets created
+deployment.apps/oauth2-proxy created
+service/oauth2-proxy created
+ingress.networking.k8s.io/oauth2-proxy created
+deployment "oauth2-proxy" successfully rolled out
+oauth2-proxy-c76b49c59-8p5hl   true   kc-lab-1
+oauth2-proxy-c76b49c59-b9928   true   kc-lab-2
+
+=== 진입점 확인 ===
+  https://app2.hyeonworks.com/  HTTP 302
+  /ping                         HTTP 200

docs/evidence/b7-cookie-secret/02-cookie-portability.txt

@@ -0,0 +1,9 @@
+=== curl 로 OAuth 흐름을 완주한다 (nginx 우회, Traefik 직접) ===
+  로그인 폼 action: https://auth.hyeonworks.com/realms/keycloak-patterns/login-actions/authenticate?session_co...
+  쿠키 항아리:
+                                 len=0
+    KC_AUTH_SESSION_HASH         len=64
+
+=== 두 replica 모두 이 쿠키를 받아들이는가 ===
+  10.42.1.135    /oauth2/auth  HTTP 000
+  10.42.1.134    /oauth2/auth  HTTP 000

docs/evidence/b7-cookie-secret/03-rotation.txt

@@ -0,0 +1,31 @@
+=== 세션이 Redis 에 들어갔는가 ===
+b5:pvc
+_oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a
+  dbsize: 2
+
+=== oauth2-proxy 가 cookie secret 을 여러 개 받는가 ===
+        --cookie-secret string                                the seed string for secure cookies (optionally base64 encoded)
+
+=== ★ secret 을 A → B 로 교체한다 ===
+deployment.apps/oauth2-proxy patched
+deployment "oauth2-proxy" successfully rolled out
+  현재 secret 키: COOKIE_SECRET_B
+  Redis 세션은 그대로인가: 2 키
+=== secret 교체 후 oauth2-proxy 로그 — 옛 쿠키를 어떻게 처리했나 ===
+[2026/09/04 05:41:46] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled
+[2026/09/04 05:42:18] [oauthproxy.go:1024] No valid authentication in request. Initiating login.
+100.123.124.30 - cb8c0ec1-1d87-479c-9aef-e1d9158a5829 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, lik
+[2026/09/04 05:42:18] [stored_session.go:94] Error loading cookied session: session ticket cookie failed validation: <nil>, removing session
+[2026/09/04 05:42:18] [stored_session.go:97] Error removing session: error decoding ticket to clear session: session ticket cookie failed validation: <nil>
+100.123.124.30 - 28af938f-08b5-4e15-9094-8d9591a18a3f - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/
+[2026/09/04 05:41:58] [providers.go:146] Warning: Your provider supports PKCE methods ["plain" "S256"], but you have not enabled one with --code-challenge-method
+[2026/09/04 05:41:58] [oauthproxy.go:172] OAuthProxy configured for OpenID Connect Client ID: oauth2-proxy
+[2026/09/04 05:41:58] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled
+100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - labuser@example.com [2026/09/04 05:42:18] [AuthSuccess] Authenticated via OAuth2: Session{email:labuser@example.com user:27df5ea9-8703
+100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/oauth2/callback?state=j7eKInWCrYqRyi5LVDGDjtLrIBJCpwdkmzoJVdhJUc0%3A%2Fapi%2Fecho&
+100.123.124.30 - a3074807-5143-49b9-b77c-e7e2eb90ac24 - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/favicon.ico" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebK
+
+=== Redis 세션 수 (옛 세션이 남아 있는가) ===
+  _oauth2_proxy-978dfaefbdadccb96c7be1625dba5616
+  _oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a
+  총: 2 개

docs/evidence/b7-cookie-secret/README.md

@@ -0,0 +1,18 @@
+# B-7 — oauth2-proxy cookie secret 교체 증거
+
+2026-09-04 16:00–16:15 KST
+해설: [`docs/experiment-b7-cookie-secret-rotation.md`](../../experiment-b7-cookie-secret-rotation.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-deploy.txt` | 양 노드에 replica 하나씩. `/` 302, `/ping` 200 |
+| `02-cookie-portability.txt` | curl 로 흐름을 완주하려던 시도 — 파드 IP 는 호스트에서 안 닿는다 |
+| `03-rotation.txt` | **`--cookie-secret string` 단수 확인** · 교체 후 `session ticket cookie failed validation` · **`Error removing session`** · Redis 에 **고아 세션 2개** |
+| `b7-oauth2proxy-login-success.png` | Redis 세션 전환 후 성공한 Forward-Auth — `x-forwarded-user/email/preferred-username` 과 **티켓 형태 쿠키** |
+
+## 핵심 네 줄
+
+1. **BFF 와 정반대다.** 인가 요청이 쿠키에 있어 **콜백이 다른 replica 로 가도 성공**한다 — B-0 에서 BFF 가 실패한 바로 그 지점.
+2. **502 의 원인은 큰 쿠키였다.** Traefik 직접은 정상이고 nginx 만 502 — B-4 의 헤더 절벽이 응답 쪽에서 재현됐다.
+3. **겹침 구간을 만들 수 없다.** `--cookie-secret` 이 단수라 B-6 의 무중단 회전이 불가능하다.
+4. **교체하면 서버 세션이 고아로 남는다.** 티켓을 못 푸니 지울 수도 없다.