diff --git a/moldes/consolidado/71-runtime-operacao.yaml b/moldes/consolidado/71-runtime-operacao.yaml index 18b0290..80c5be7 100644 --- a/moldes/consolidado/71-runtime-operacao.yaml +++ b/moldes/consolidado/71-runtime-operacao.yaml @@ -85,6 +85,11 @@ spec: - name: ASAAS_WEBHOOK_TOKEN valueFrom: secretKeyRef: { name: asaas-credentials, key: webhook-token, optional: true } + # Segredo do desafio anti-robo do convite publico (05/10/2026). Opcional: sem ele cada processo + # gera um aleatorio (vale com 1 replica; um restart invalida desafios em andamento, 10 min). + - name: ATM_CAMPEONATO_DESAFIO_SEGREDO + valueFrom: + secretKeyRef: { name: desafio-convite, key: segredo, optional: true } # O AMBIENTE CHEGA JUNTO DA CHAVE, no mesmo Secret: uma chave de sandbox # so vale no sandbox, e os dois sao um fato so. Ausente (o tenant ainda # nao tem subconta aprovada), o runtime fica em sandbox e com a diff --git a/moldes/consolidado/95-frontend-spa.yaml b/moldes/consolidado/95-frontend-spa.yaml index c20edae..87898fd 100644 --- a/moldes/consolidado/95-frontend-spa.yaml +++ b/moldes/consolidado/95-frontend-spa.yaml @@ -83,7 +83,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 10 - name: servico-bff - image: docker.io/library/servico-bff:2.17-aluno + image: docker.io/library/servico-bff:2.18-seguranca imagePullPolicy: Never ports: [{ containerPort: 8083 }] env: diff --git a/tenants/acme/24-sealed-desafio-convite.yaml b/tenants/acme/24-sealed-desafio-convite.yaml new file mode 100644 index 0000000..ae1b04a --- /dev/null +++ b/tenants/acme/24-sealed-desafio-convite.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: desafio-convite + namespace: acme-prod +spec: + encryptedData: + segredo: AgAPpk7fH3TDlgdOc7iB2XrYLg4zzwfJD68TrRQjRiADPh+XbObyw1+UnSoITe7ftBPXb5XML3g9ADyPCH93sFlFx4/D+ofoELDj7qa4ECtB9lDvGERkDPBS7UF9R5x76xxcaYCT+70k9hEzqVJ8ge7IH7gRycn2C7X+zdMxRUz0BkHxzWsPi3HBXNBDPA1ny12HkqsO836h7mqmEw6wHaumy3AJZ0+F5Y3LBAyW5LcNOwvHD7F0vmK6KYj90ZXCUWOQtQbNMzSXN+rDrZ69nm0U4eoLe5FhZgcdVCL/8J4L8YuCrkscBiFFQwa6t0uvOk5gk4dTnZuXAezkCg1A5f2Y8+v171o/pzBuZ5cxmyaG9MVwhLBKlXiiq2hgS3BNIEKryPOjC/TJlm0x+dq+EsPDKcF/xSIESwSISiwnNjHeljqcU3lWs2G9MX4TcNzzbUvpHQo2AVWWhKF0P6RBeDFpnzwJ6mrYub99w4wTdaxcmewr5qJki00upGJ6A/JMqznLcRcqSXzud/pKtHSCyTgGSgPrIcqY7Gv+/vYbG2Cvc+/CLH9ndMpxcGt7bYBMjCjawBAYOTjLmyo5ymGsqxGkBA3m0lapkCVoHtGYMKEQjkcgAARgXhsattH0g7Wt6RWSlCD1V3GlqEiTMf/JdzsbuU5bXYIwbr78bLGzM3zRb5RUI4D+GGq6WljY+UFdqMVcftstsDUSpM5wsHCOKMYq19oZK/WkcI0YEwUmAKErH6E1vBOnj3qtLtuTXYzoeTdP4XZ0IAm/i5jzrpFKHSRC + template: + metadata: + creationTimestamp: null + name: desafio-convite + namespace: acme-prod diff --git a/tenants/acme/66-runtime-operacao.yaml b/tenants/acme/66-runtime-operacao.yaml index 8d0be35..5186669 100644 --- a/tenants/acme/66-runtime-operacao.yaml +++ b/tenants/acme/66-runtime-operacao.yaml @@ -26,6 +26,13 @@ spec: ports: - containerPort: 8083 env: + # Segredo do desafio anti-robo do convite publico (05/10/2026). + - name: ATM_CAMPEONATO_DESAFIO_SEGREDO + valueFrom: + secretKeyRef: + name: desafio-convite + key: segredo + optional: true - name: SPRING_DATASOURCE_URL value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_acme - name: SPRING_DATASOURCE_USERNAME diff --git a/tenants/acme/95-frontend-spa.yaml b/tenants/acme/95-frontend-spa.yaml index 2df22ca..77df815 100644 --- a/tenants/acme/95-frontend-spa.yaml +++ b/tenants/acme/95-frontend-spa.yaml @@ -67,7 +67,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 10 - name: servico-bff - image: docker.io/library/servico-bff:2.17-aluno + image: docker.io/library/servico-bff:2.18-seguranca imagePullPolicy: Never ports: [{ containerPort: 8083 }] env: diff --git a/tenants/demo/24-sealed-desafio-convite.yaml b/tenants/demo/24-sealed-desafio-convite.yaml new file mode 100644 index 0000000..5c1ced0 --- /dev/null +++ b/tenants/demo/24-sealed-desafio-convite.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: desafio-convite + namespace: demo-prod +spec: + encryptedData: + segredo: AgBG0nDwd8Z+FcAlN9Uo2eYv68PqOaV49+W6P0LoiyN5uIyvp4T/019tPEEH+CswcoxMg6BhDZ+xltXeTV2Qi4xxrg9CcD22q9XicthgNFKJiN6bsnkvq/fgzx94PMgozyHAd6Sx0HRbcVLqyCOq8ZH1WkhkxiBLOGMZOQpGpSF2POpXYSu9+8WampZH2j2GMV1TJX01kdcQYc0fNfo1M0Nr/2NRorNvkrYVApUMcFfRDxcHp9q0X/6JL2nTeWoh+pfY73c2vztOtcPUrSfn/eglp0ZPpFS656Ahud36iJLaAd1tyTSvMaVxv2zh7W+aJlzAwvjk6ec/DNZxb8OlAbZuFZCIuunx0oSUkJCe5TFBaYF0NTOCwQBP09WpZG17ZqkPKzVgF70gagAaU8sDPJ2nROMm8cLIFubm9j1BmXcztsWhDt9dKFU4GRwTS4hty1tgk33gonT7vBxuzLvoM2QojXA1WiJagzANdbt6e1O5+VGTQUIAcHIyAaafmvYf6OLJzJ7tq6OfDaU5mIdZ/845IS2XT6N8uyO1LgH9stt3+qFWR6Bh7DghN6j7dQLvy5Fqz825h4A55+/QDsb9t4OZY66slvbTmQ4QnrUjDQjeTlaW91UfO18CjGTaAN8xutYAxAnuNxn29SThelUg2ruYXcYAHEnTep9zqyQZf1wZZOoqg11koPWDwud7mrzGIyONpNSMyt8h/kknSeAD9f0W0cr6FvNBDQPAOzlguL5RRjw7aew3UgmDzp7fNsqqo2oBnhqb23VsRaCctwtH/U6l + template: + metadata: + creationTimestamp: null + name: desafio-convite + namespace: demo-prod diff --git a/tenants/demo/66-runtime-operacao.yaml b/tenants/demo/66-runtime-operacao.yaml index 1269843..cd21815 100644 --- a/tenants/demo/66-runtime-operacao.yaml +++ b/tenants/demo/66-runtime-operacao.yaml @@ -26,6 +26,13 @@ spec: ports: - containerPort: 8083 env: + # Segredo do desafio anti-robo do convite publico (05/10/2026). + - name: ATM_CAMPEONATO_DESAFIO_SEGREDO + valueFrom: + secretKeyRef: + name: desafio-convite + key: segredo + optional: true - name: SPRING_DATASOURCE_URL value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_demo - name: SPRING_DATASOURCE_USERNAME diff --git a/tenants/demo/95-frontend-spa.yaml b/tenants/demo/95-frontend-spa.yaml index c113a63..1b0901d 100644 --- a/tenants/demo/95-frontend-spa.yaml +++ b/tenants/demo/95-frontend-spa.yaml @@ -67,7 +67,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 10 - name: servico-bff - image: docker.io/library/servico-bff:2.17-aluno + image: docker.io/library/servico-bff:2.18-seguranca imagePullPolicy: Never ports: [{ containerPort: 8083 }] env: diff --git a/tenants/escolinha/24-sealed-desafio-convite.yaml b/tenants/escolinha/24-sealed-desafio-convite.yaml new file mode 100644 index 0000000..657f481 --- /dev/null +++ b/tenants/escolinha/24-sealed-desafio-convite.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: desafio-convite + namespace: escolinha-prod +spec: + encryptedData: + segredo: AgBsHvfFQIZrEuscFcPi/VtsPbdCiJCTy/QokopifwAU2YUt+Bx2DnbyHd0JazpHru2/qDTY/SCS9tpNeVysK7gzpXLjQL4gymOt7i1p5XwyFZ9Vys7kZWrAAtQzB32MiodSHVxRKm3tUJmtZwrKUHmp7bDKe2UeZVFZsmTwIqp/fsRvY0DE+tOGqOAhVJpN0Rl/HRoiuaV3LJhOiGS4FRbMI55Wv+QtmsoiAhqFjQ7XqnwQuGcjNqf1OvD/ge922zv2q8wHhDEOMV9cVXgiPHvrko41wVfXvhCleurQ929Yf+SEYu/lxV8jr5RqFphFI5z3JBFsDpKVxQmQ0+IoiUXaATMUviyN+qEohlABBDidhSR2z7lKmsVkgoVCsfX9mw6edzc8GS17Qkysqic5n/XQY8ZwR0xOrfjYc8Uc4nnIGOF0UajwW1rq56iQN9C/E4NY8o9qvY8Y3EzX9iyybi/lD+JFwZ5tg3kxx2iIVqL9uUeVDHTBK1jh1OJLNYg4ywhT0ir3FLma73mPO7+HVSfOJGU8eQUnjm1oYfhMKDPFqvcgrXnIZM4yCc1I+DeM/B5a1mQj0Li5RNfP6o07CPT/UvwZZlNpN5FvMrVGegONwKfCcajBUIIx8LDuouosaSKE2TnVNXWjsoG82XUYT4DWPJDy8K8VXYibUgDw1dEz1UQdNHu+LPHUn4hJfPAzaMwK4iaD0pekDP5OyPOrnsMKDLNP5hjy4bIWqN29mUE5neO932Il7SVwxLnaFLjy/ZVicXeH0ReGrNh8I9fWFKup + template: + metadata: + creationTimestamp: null + name: desafio-convite + namespace: escolinha-prod diff --git a/tenants/escolinha/66-runtime-operacao.yaml b/tenants/escolinha/66-runtime-operacao.yaml index 6017198..a97d5c5 100644 --- a/tenants/escolinha/66-runtime-operacao.yaml +++ b/tenants/escolinha/66-runtime-operacao.yaml @@ -26,6 +26,13 @@ spec: ports: - containerPort: 8083 env: + # Segredo do desafio anti-robo do convite publico (05/10/2026). + - name: ATM_CAMPEONATO_DESAFIO_SEGREDO + valueFrom: + secretKeyRef: + name: desafio-convite + key: segredo + optional: true - name: SPRING_DATASOURCE_URL value: jdbc:postgresql://postgres:5432/athleticmap - name: SPRING_DATASOURCE_USERNAME diff --git a/tenants/escolinha/95-frontend-spa.yaml b/tenants/escolinha/95-frontend-spa.yaml index 5c30114..d46be7c 100644 --- a/tenants/escolinha/95-frontend-spa.yaml +++ b/tenants/escolinha/95-frontend-spa.yaml @@ -67,7 +67,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 10 - name: servico-bff - image: docker.io/library/servico-bff:2.17-aluno + image: docker.io/library/servico-bff:2.18-seguranca imagePullPolicy: Never ports: [{ containerPort: 8083 }] env: diff --git a/tenants/piloto/24-sealed-desafio-convite.yaml b/tenants/piloto/24-sealed-desafio-convite.yaml new file mode 100644 index 0000000..5e72ede --- /dev/null +++ b/tenants/piloto/24-sealed-desafio-convite.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: desafio-convite + namespace: piloto-prod +spec: + encryptedData: + segredo: AgBvEf3sSmhCN3UeseW2ivoc+EreP4dkWpBQIsMlcjzSj6eN+VxlXUBy+yWsj5yDJ8wFWLmElA2Zkmx8cOey4Usp30eWKZGXDqf1iHUW2DzFjSxOZXAHLCNOnrrNHo9hvRGxpGthf9HiMNyY8ppm/7Sd2x0Y7NzjxSEuFJ5DBZNOOeMKqwA8bH7g7fcB16V9RWyLiO9tyKnPTMKqfcXH7fo79VSTrcn9GTz+TpCizhAbr8HhIPAQwCoMRa1QanMeoCU86G9xJLPeU/CMu35cOkgjB5wGfXnlucfByA5dh0MgNlKyLHwM5nFL1FV37gn1fDeoFkxXz8guGTo2OHqbmXBYrxzfXek9ErHyU0DEbj0Gt6pnoAQWr4/2/ysS3k5mJ5ZTYd4uAWAMHjJrHYygfHfKX48Cld181IJBPsRx9IdXJ2ZARqjVKjshEWgPutokSzdKY1yoPiioZcT7+uRwOpesYJGx5gmqCdbw+RKRb0ooLmZjjk8MP93QO7MvE65cblJhSnY0aP2z++6KgWD2pixZaKh3bKI82q1pNHVEMO7LCU73ilvvCTotHXR6+Ut8h/lk/3Y61s1vEBugWZIiqTf+2IeexIkUs7Q44H7cSrUFxHuwEchCdncaVdOsL5qHqHI26E7xUT3TPvrSGuIcw45ENv9YnoH0sCOmt0Ovsa5yWdEHiEmgxditBgHy4RkAL4nukl4Cw9j1ccw/lVaZTlOrUUAIK9D4c1BCU6AS7iloFGC8AYiOapqMv/TqP6ro7RHx7jQvILn019gCyUPO57x6 + template: + metadata: + creationTimestamp: null + name: desafio-convite + namespace: piloto-prod diff --git a/tenants/piloto/66-runtime-operacao.yaml b/tenants/piloto/66-runtime-operacao.yaml index f9d8087..22f87fa 100644 --- a/tenants/piloto/66-runtime-operacao.yaml +++ b/tenants/piloto/66-runtime-operacao.yaml @@ -26,6 +26,13 @@ spec: ports: - containerPort: 8083 env: + # Segredo do desafio anti-robo do convite publico (05/10/2026). + - name: ATM_CAMPEONATO_DESAFIO_SEGREDO + valueFrom: + secretKeyRef: + name: desafio-convite + key: segredo + optional: true - name: SPRING_DATASOURCE_URL value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_piloto - name: SPRING_DATASOURCE_USERNAME diff --git a/tenants/piloto/95-frontend-spa.yaml b/tenants/piloto/95-frontend-spa.yaml index 5686879..a025503 100644 --- a/tenants/piloto/95-frontend-spa.yaml +++ b/tenants/piloto/95-frontend-spa.yaml @@ -67,7 +67,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 10 - name: servico-bff - image: docker.io/library/servico-bff:2.17-aluno + image: docker.io/library/servico-bff:2.18-seguranca imagePullPolicy: Never ports: [{ containerPort: 8083 }] env: