DongHyeonkaandClaude Opus 5
98a74e90a5
The forward upgrade to 26.7.3 was zero downtime across 87 samples, and since databasechangelog stayed at 210 the rollback to 26.7.0 also succeeded, which narrows D-2's conclusion: rolling back fails when the schema moved, not because of the version number. The row count is the check. Role changes never reach the upstream through request repetition; the session is a snapshot taken at login and only a new session picks up the new claim. Auditing the docs also surfaced that Prometheus scrapes only keycloak, kubelet, node-exporter and itself, so the B-layer experiments have no metrics to screenshot rather than missing screenshots. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
31 lines
2.4 KiB
XML
31 lines
2.4 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 250" width="700" height="250" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
|
<style>
|
|
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
|
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
|
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
|
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
|
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
|
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
|
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
|
</style>
|
|
<defs>
|
|
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
|
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
|
</defs>
|
|
<text class="h" x="16" y="24">D-4 · 인증서 체인과 SAN 제약</text>
|
|
<rect class="ok" x="30" y="46" width="300" height="104"/>
|
|
<text class="t" x="180" y="68" text-anchor="middle">체인 4단계 · Verify return code: 0</text>
|
|
<text class="s" x="180" y="90" text-anchor="middle">0 CN=auth.hyeonworks.com</text>
|
|
<text class="s" x="180" y="106" text-anchor="middle">1 Let's Encrypt YE2</text>
|
|
<text class="s" x="180" y="122" text-anchor="middle">2 ISRG Root YE</text>
|
|
<text class="s" x="180" y="138" text-anchor="middle">3 ISRG Root X2</text>
|
|
<rect class="box" x="360" y="46" width="310" height="104"/>
|
|
<text class="t" x="515" y="68" text-anchor="middle">SAN 3개 · 와일드카드 아님</text>
|
|
<text class="s" x="515" y="90" text-anchor="middle">auth · app1 · app2</text>
|
|
<text class="r" x="515" y="114" text-anchor="middle">네 번째 이름이 없다</text>
|
|
<text class="s" x="515" y="134" text-anchor="middle">B-7 에서 Grafana 의 app2 를 빌려야 했다</text>
|
|
<rect class="box" x="30" y="168" width="640" height="60"/>
|
|
<text class="t" x="350" y="190" text-anchor="middle">단계가 1개면 cert.pem, 2개 이상이면 fullchain.pem 이다</text>
|
|
<text class="s" x="350" y="212" text-anchor="middle">브라우저는 중간 인증서를 캐시하므로 cert.pem 실수는 캐시 없는 클라이언트에서만 드러난다</text>
|
|
</svg>
|