atmadmin/athletic-map-deploy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(piloto): realm vai para o Keycloak compartilhado como athleticmap-1 (card 156) — issuer/JWKS/KC_URL trocados, saida de rede aberta, Keycloak proprio em replicas 0

Browse Source
This commit is contained in:
deploy
2026-09-26 17:38:51 +00:00
parent 3a634a8775
commit 035e74681c
21 changed files with 71 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tenants/piloto/17-netpol-keycloak-compartilhado.yaml
+26
View File
@@ -0,0 +1,26 @@
# =============================================================================
# Card 156 (2026-09-26): o realm deste tenant mora no Keycloak COMPARTILHADO
# (`plataforma-prod`), e os runtimes/BFF/CronJobs precisam alcanca-lo para
# baixar o JWKS e pedir token. A `deny-cross-tenant` deste namespace nao
# abria essa saida (os tenants provisionados ja nascem com ela). O outro lado
# e o `16-netpol-tenants-no-keycloak.yaml` do plataforma.
#
# namespaceSelector + podSelector, e nao ipBlock: o controlador de rede do k3s
# avalia a politica DEPOIS do DNAT, com o IP do POD — ClusterIP nao serve.
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: egress-keycloak-compartilhado
namespace: piloto-prod
spec:
podSelector: {}
policyTypes: [Egress]
egress:
- to:
- namespaceSelector:
matchLabels: { kubernetes.io/metadata.name: plataforma-prod }
podSelector:
matchLabels: { app: keycloak }
ports:
- { protocol: TCP, port: 8080 }
tenants/piloto/20-keycloak.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ metadata:
name: keycloak
namespace: piloto-prod
spec:
replicas: 1
replicas: 0
selector:
matchLabels:
app: keycloak
tenants/piloto/30-apps-stubs.yaml
+2 -2
View File
@@ -17,8 +17,8 @@ spec:
image: docker.io/library/athletic-map-backend:1.3
imagePullPolicy: Never
env:
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
ports: [{ containerPort: 8083 }]
readinessProbe:
tenants/piloto/55-cronjobs-financeiro.yaml
+6 -6
View File
@@ -88,9 +88,9 @@ spec:
exec /bin/sh /script/disparar.sh
env:
- name: KEYCLOAK_URL
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/token
- name: ISSUER_HOST
value: auth-piloto.athleticmap.com
value: auth.athleticmap.com
- name: CLIENT_SECRET
valueFrom:
secretKeyRef:
@@ -133,9 +133,9 @@ spec:
command: ["/bin/sh", "/script/disparar.sh"]
env:
- name: KEYCLOAK_URL
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/token
- name: ISSUER_HOST
value: auth-piloto.athleticmap.com
value: auth.athleticmap.com
- name: ALVO
value: http://servico-financeiro/api/financeiro/notas/processar?limite=50
- name: CLIENT_SECRET
@@ -180,9 +180,9 @@ spec:
command: ["/bin/sh", "/script/disparar.sh"]
env:
- name: KEYCLOAK_URL
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/token
- name: ISSUER_HOST
value: auth-piloto.athleticmap.com
value: auth.athleticmap.com
- name: ALVO
value: http://servico-financeiro/api/financeiro/conciliacao?limiteEventos=100&limiteCobrancas=100
- name: CLIENT_SECRET
tenants/piloto/65-runtime-core.yaml
+2 -2
View File
@@ -36,9 +36,9 @@ spec:
name: db-compartilhado
key: password
- name: ATM_JWK_SET_URI
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs
- name: ATM_ISSUER
value: https://auth-piloto.athleticmap.com/realms/athleticmap
value: https://auth.athleticmap.com/realms/athleticmap-1
- name: ATM_TENANT
value: piloto
- name: ATM_PLANO
tenants/piloto/66-runtime-operacao.yaml
+2 -2
View File
@@ -36,9 +36,9 @@ spec:
name: db-compartilhado
key: password
- name: ATM_JWK_SET_URI
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs
- name: ATM_ISSUER
value: https://auth-piloto.athleticmap.com/realms/athleticmap
value: https://auth.athleticmap.com/realms/athleticmap-1
- name: ATM_TENANT
value: piloto
- name: ATM_PLANO
tenants/piloto/67-runtime-saude.yaml
+2 -2
View File
@@ -36,9 +36,9 @@ spec:
name: db-compartilhado
key: password
- name: ATM_JWK_SET_URI
value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs
- name: ATM_ISSUER
value: https://auth-piloto.athleticmap.com/realms/athleticmap
value: https://auth.athleticmap.com/realms/athleticmap-1
- name: ATM_TENANT
value: piloto
- name: ATM_PLANO
tenants/piloto/70-servico-configuracao.yaml
+2 -2
View File
@@ -31,8 +31,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 320Mi }
tenants/piloto/72-servico-organizacao.yaml
+2 -2
View File
@@ -30,8 +30,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 320Mi }
tenants/piloto/74-servico-planejamento.yaml
+2 -2
View File
@@ -30,8 +30,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 320Mi }
tenants/piloto/76-servico-campeonato.yaml
+2 -2
View File
@@ -30,8 +30,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 320Mi }
tenants/piloto/78-servico-saude.yaml
+2 -2
View File
@@ -30,8 +30,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
# Garmin: DNS devolve IPv6 primeiro e a rota IPv6 do cluster falha; forcar IPv4.
- { name: JAVA_TOOL_OPTIONS, value: "-Djava.net.preferIPv4Stack=true" }
tenants/piloto/79-servico-financeiro.yaml
+2 -2
View File
@@ -30,8 +30,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
- { name: ATM_PLANO, value: "institucional" }
resources:
tenants/piloto/80-servico-cadastro.yaml
+2 -2
View File
@@ -31,8 +31,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
- { name: ATM_KC_ADMIN_ENABLED, value: "true" }
- name: ATM_KC_CLIENT_SECRET
tenants/piloto/81-servico-documentos.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/82-servico-administrativo.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/83-servico-assistencia-social.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/84-servico-pedagogico.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/85-servico-nutricao.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/86-servico-agenda.yaml
+2 -2
View File
@@ -26,8 +26,8 @@ spec:
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef: { name: db-compartilhado, key: password }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- { name: ATM_TENANT, value: "piloto" }
resources:
requests: { cpu: 50m, memory: 300Mi }
tenants/piloto/95-frontend-spa.yaml
+4 -4
View File
@@ -25,8 +25,8 @@ spec:
imagePullPolicy: Never
ports: [{ containerPort: 80 }]
env:
- { name: ATM_KC_URL, value: "https://auth-piloto.athleticmap.com" }
- { name: ATM_REALM, value: "athleticmap" }
- { name: ATM_KC_URL, value: "https://auth.athleticmap.com" }
- { name: ATM_REALM, value: "athleticmap-1" }
- { name: ATM_CLIENT, value: "spa" }
- { name: ATM_TENANT, value: "piloto" }
- { name: ATM_PLANO, value: "institucional" }
@@ -84,8 +84,8 @@ spec:
- { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
- { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
- { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
- { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-1/protocol/openid-connect/certs" }
- { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-1" }
- name: ATM_CONSENTIMENTO_SEGREDO
valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
- { name: ATM_TENANT, value: "piloto" }