DongHyeonkaandClaude Opus 5
98a74e90a5
The forward upgrade to 26.7.3 was zero downtime across 87 samples, and since databasechangelog stayed at 210 the rollback to 26.7.0 also succeeded, which narrows D-2's conclusion: rolling back fails when the schema moved, not because of the version number. The row count is the check. Role changes never reach the upstream through request repetition; the session is a snapshot taken at login and only a new session picks up the new claim. Auditing the docs also surfaced that Prometheus scrapes only keycloak, kubelet, node-exporter and itself, so the B-layer experiments have no metrics to screenshot rather than missing screenshots. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
32 lines
2.4 KiB
XML
32 lines
2.4 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 280" width="700" height="280" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
|
|
<style>
|
|
.t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
|
|
.r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
|
|
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
|
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
|
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
|
.ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
|
|
.bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
|
|
</style>
|
|
<defs>
|
|
<marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
|
|
<marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
|
|
</defs>
|
|
<text class="h" x="16" y="24">D-3 · 네 경로 중 RBAC 만 실제로 감춘다</text>
|
|
<rect class="dead" x="30" y="46" width="310" height="60"/>
|
|
<text class="r" x="185" y="68" text-anchor="middle">kubectl get -o jsonpath | base64 -d</text>
|
|
<text class="s" x="185" y="88" text-anchor="middle">POSTGRES_PASSWORD = lab-postgres-change-me</text>
|
|
<rect class="dead" x="360" y="46" width="310" height="60"/>
|
|
<text class="r" x="515" y="68" text-anchor="middle">저장소 (at rest)</text>
|
|
<text class="s" x="515" y="88" text-anchor="middle">Encryption Disabled · state.db 에 평문</text>
|
|
<rect class="dead" x="30" y="120" width="310" height="60"/>
|
|
<text class="r" x="185" y="142" text-anchor="middle">파드 안</text>
|
|
<text class="s" x="185" y="162" text-anchor="middle">KEYCLOAK_CLIENT_SECRET=... 환경변수</text>
|
|
<rect class="ok" x="360" y="120" width="310" height="60"/>
|
|
<text class="g" x="515" y="142" text-anchor="middle">RBAC</text>
|
|
<text class="s" x="515" y="162" text-anchor="middle">default SA 는 get secrets 불가</text>
|
|
<rect class="box" x="30" y="200" width="640" height="60"/>
|
|
<text class="t" x="350" y="222" text-anchor="middle">describe 는 "14 bytes" 만 보여줘 감춰졌다는 착각을 준다</text>
|
|
<text class="s" x="350" y="244" text-anchor="middle">base64 는 감추기 위한 것이 아니라 YAML 에 임의 바이트를 담기 위한 인코딩이다</text>
|
|
</svg>
|