DongHyeonkaandClaude Opus 5
cdac9b8178
An audit against the standard the series set — concepts, procedure, commands, architecture diagram, evidence table, terminal output — found the three new experiments met it while twelve of the original ones had no diagram at all: A-0, A-1, A-3, A-4, A-5, A-6, A-8, B-0, B-2, B-7, C-2, D-2. Each now has one drawn from what that experiment actually found, not filler: A-0 shows sharing going through PostgreSQL rather than between the caches; A-3 the gap between the 200 and the WAL flush, with both failed injections; A-5 the three silent injection failures; A-6 the two places latency is multiplied; B-0 the repository keyed by principal with no session id; B-2 the primary key that causes the overwrite; D-2 why the rolling update stopped the accident halfway. Also corrected the index's stale claim of 11 experiments without a screenshot — it is 14, and the reason is recorded: those experiments were measured from terminals, the database and logs, and the observability stack does not scrape Redis, the BFF or PostgreSQL, so there is no console to photograph. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
3.7 KiB
XML
53 lines
3.7 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 860 420" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,sans-serif">
|
|
<style>
|
|
.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
|
|
.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
|
|
.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
|
|
.warn{fill:#fff8f0;stroke:#bf8700;stroke-width:1.5;rx:6}
|
|
.t{font-size:12px;fill:#1f2328}
|
|
.tb{font-size:12.5px;fill:#1f2328;font-weight:600}
|
|
.s{font-size:10.5px;fill:#656d76}
|
|
.ttl{font-size:14px;fill:#1f2328;font-weight:600}
|
|
.r{stroke:#cf222e;stroke-width:1.6;fill:none}
|
|
.g{stroke:#1a7f37;stroke-width:1.6;fill:none}
|
|
.k{stroke:#8c959f;stroke-width:1.3;fill:none}
|
|
</style>
|
|
<defs>
|
|
<marker id="a" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#8c959f"/></marker>
|
|
<marker id="ar" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#cf222e"/></marker>
|
|
<marker id="ag" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#1a7f37"/></marker>
|
|
</defs>
|
|
<text x="20" y="26" class="ttl">B-7 — BFF 와 정반대의 성질: 공유할 상태가 없고, 대신 겹침 구간도 없다</text>
|
|
<text x="20" y="44" class="s">oauth2-proxy 는 세션을 쿠키에 담는다</text>
|
|
<rect x="30" y="72" width="380" height="120" class="box"/>
|
|
<text x="46" y="94" class="tb">replica 는 무엇을 공유하나</text>
|
|
<rect x="46" y="106" width="160" height="34" class="box"/>
|
|
<text x="58" y="128" class="t">oauth2-proxy A</text>
|
|
<rect x="250" y="106" width="146" height="34" class="box"/>
|
|
<text x="262" y="128" class="t">oauth2-proxy B</text>
|
|
<rect x="106" y="152" width="230" height="30" class="ok"/>
|
|
<text x="118" y="172" class="s">같은 k8s Secret 을 읽는다</text>
|
|
<path d="M126 142 L180 150" class="g"/>
|
|
<path d="M316 142 L262 150" class="g"/>
|
|
<text x="46" y="196" class="s"> </text>
|
|
<rect x="440" y="72" width="390" height="120" class="ok"/>
|
|
<text x="456" y="94" class="tb">그래서 얻는 것</text>
|
|
<text x="456" y="118" class="s">공유할 서버 상태가 없다 → 콜백이 다른 replica 로 가도 된다</text>
|
|
<text x="456" y="140" class="s">replica 를 늘려도 세션 저장소 고민이 없다</text>
|
|
<text x="456" y="164" class="s">BFF 가 Redis·PostgreSQL 로 풀던 문제가 아예 생기지 않는다</text>
|
|
<rect x="30" y="212" width="380" height="106" class="dead"/>
|
|
<text x="46" y="234" class="tb">★ 대신 겹침 구간을 만들 수 없다</text>
|
|
<text x="46" y="258" class="t">--cookie-secret 은 단수다</text>
|
|
<text x="46" y="280" class="s">「옛 secret 도 당분간 받아준다」가 불가능하다</text>
|
|
<text x="46" y="300" class="s">교체하는 순간 모든 쿠키가 한꺼번에 무효가 된다</text>
|
|
<rect x="440" y="212" width="390" height="106" class="warn"/>
|
|
<text x="456" y="234" class="tb">교체하면 벌어지는 일</text>
|
|
<text x="456" y="258" class="s">옛 쿠키 → session ticket cookie failed validation</text>
|
|
<text x="456" y="278" class="s">Keycloak SSO 가 살아 있으면 로그인 화면 없이 조용히 재인증</text>
|
|
<text x="456" y="300" class="s" fill="#cf222e">서버 쪽 세션은 고아로 남는다 — 티켓을 못 풀어 지우지도 못한다</text>
|
|
<rect x="30" y="338" width="800" height="66" class="ok"/>
|
|
<text x="46" y="360" class="tb">→ B-7a 가 이어받았다</text>
|
|
<text x="46" y="382" class="s">「지울 수 없다」는 oauth2-proxy 의 한계일 뿐이었다. 운영자는 지울 수 있고, TTL 역산으로 고아만 골라낼 수 있다</text>
|
|
<text x="46" y="398" class="s">그리고 고아는 생성 후 정확히 1시간에 사라진다 — TTL 이 요청으로 갱신되지 않기 때문이다</text>
|
|
</svg>
|