DongHyeonkaandClaude Opus 5
2fa77a899e
Three injections failed first: kube-router keeps reinserting its chain above a hand-placed FORWARD rule, the JGroups connection direction had reversed since A-1, and only the raw table runs ahead of conntrack. Each failure looked like nothing happening. Blocking one direction never partitioned the cluster because JGroups reconnected the other way before failure detection fired. Blocking both produced a real split brain with two coordinators in JGROUPS_PING, yet only the non-coordinator node reported DOWN, so the Service kept an endpoint and the front door stayed at 200. That answers the question A-1 left open. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
2.3 KiB
Plaintext
43 lines
2.3 KiB
Plaintext
=== A-5 기준선 ===
|
|
keycloak-0=10.42.1.77 (kc-lab-2) keycloak-1=10.42.0.42 (kc-lab-1)
|
|
keycloak-0 1/1 Running 0 11m
|
|
keycloak-1 1/1 Running 1 (2m48s ago) 155m
|
|
postgres-7b474b88c8-9cmsv 1/1 Running 0 14m
|
|
Traceback (most recent call last):
|
|
File "<string>", line 3, in <module>
|
|
for r in json.load(sys.stdin)["data"]["result"]: print(f" cluster_size {r["metric"].get("pod"):12} = {r["value"][1]}")
|
|
~~~~~~~~~^^^^^^^^^^^
|
|
File "/usr/lib/python3.14/json/__init__.py", line 298, in load
|
|
return loads(fp.read(),
|
|
cls=cls, object_hook=object_hook,
|
|
parse_float=parse_float, parse_int=parse_int,
|
|
parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
|
|
File "/usr/lib/python3.14/json/__init__.py", line 352, in loads
|
|
return _default_decoder.decode(s)
|
|
~~~~~~~~~~~~~~~~~~~~~~~^^^
|
|
File "/usr/lib/python3.14/json/decoder.py", line 345, in decode
|
|
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
|
|
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
|
|
File "/usr/lib/python3.14/json/decoder.py", line 363, in raw_decode
|
|
raise JSONDecodeError("Expecting value", s, err.value) from None
|
|
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
|
|
|
|
=== 주입: keycloak-0 으로 들어가는 7800/57800 만 DROP (한 방향) ===
|
|
A-1 의 NetworkPolicy 는 conntrack ESTABLISHED 에 막혀 기존 연결을 못 끊었다.
|
|
FORWARD 최상단에 넣으면 conntrack 승인보다 먼저 평가된다.
|
|
Chain FORWARD (policy ACCEPT)
|
|
num target prot opt source destination
|
|
1 DROP 6 -- 0.0.0.0/0 10.42.1.77 tcp dpt:57800
|
|
2 DROP 6 -- 0.0.0.0/0 10.42.1.77 tcp dpt:7800
|
|
주입 시각: 12:28:23
|
|
|
|
=== 관찰 — 어느 쪽이 먼저 상대를 의심하는가 ===
|
|
+25초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+50초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+75초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+100초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+125초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+150초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+175초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|
|
+200초 | keycloak-0:1/1 keycloak-1:1/1 | 외부 200
|