feat(tenants): BFF funde no pod do frontend-spa (P4.6) — Service fica, so o selector muda; Garmin e Prometheus continuam apontando pro mesmo nome

2026-09-26 16:34:12 +00:00
parent c7ee642017
commit 28b493accc
6 changed files with 183 additions and 186 deletions
@@ -1,63 +1,14 @@
-# BFF (Backend-for-Frontend) — ponto unico da SPA; agrega configuracao + cadastro
-# com token relay. Stateless (sem banco). Roteado em /bff no ingress do tenant.
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: servico-bff
-  namespace: acme-prod
-  labels:
-    app: servico-bff
-    athleticmap.io/contexto: bff
-spec:
-  replicas: 1
-  selector: { matchLabels: { app: servico-bff } }
-  template:
-    metadata:
-      labels:
-        app: servico-bff
-        athleticmap.io/contexto: bff
-    spec:
-      containers:
-        - name: servico-bff
-          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
-          imagePullPolicy: Never
-          ports: [{ containerPort: 8083 }]
-          env:
-            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
-            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
-            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
-            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
-            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
-            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
-            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
-            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
-            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
-            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
-            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
-            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
-            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
-            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
-            - { name: ATM_ISSUER, value: "https://auth-acme.athleticmap.com/realms/athleticmap" }
-            - name: ATM_CONSENTIMENTO_SEGREDO
-              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
-            - { name: ATM_TENANT, value: "acme" }
-            - { name: ATM_PLANO, value: "institucional" }
-            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://acme.athleticmap.com/integracoes/garmin" }
-          resources:
-            requests: { cpu: 50m, memory: 256Mi }
-            limits: { cpu: 500m, memory: 512Mi }
-          readinessProbe:
-            httpGet: { path: /bff/health, port: 8083 }
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            failureThreshold: 30
-          livenessProbe:
-            httpGet: { path: /actuator/health/liveness, port: 8083 }
-            initialDelaySeconds: 50
-            periodSeconds: 20
-            failureThreshold: 6
---
+# =============================================================================
+# So o Service. O Deployment foi FUNDIDO no pod do frontend-spa (P4.6,
+# 2026-09-26) — ver 95-frontend-spa.yaml, segundo container. Esta linha
+# de servico continua existindo porque:
+#   1. tenants/escolinha/96-ingress-garmin-public.yaml aponta DIRETO
+#      para este Service (o webhook do Garmin nao passa pelo nginx);
+#   2. o Prometheus raspa por ele (athleticmap.io/metricas: tenant).
+# O `selector` mudou de `app: servico-bff` para o rotulo do pod
+# fundido (athleticmap.io/bff-aqui); nome e porta do Service NAO mudaram — o
+# Ingress do Garmin nao precisou de nenhuma edicao.
+# =============================================================================
 apiVersion: v1
 kind: Service
 metadata:
@@ -66,5 +17,5 @@ metadata:
  labels:
    app: servico-bff
 spec:
-  selector: { app: servico-bff }
+  selector: { athleticmap.io/bff-aqui: "true" }
  ports: [{ name: http, port: 80, targetPort: 8083 }]
@@ -17,6 +17,7 @@ spec:
      labels:
        app: frontend-spa
        athleticmap.io/contexto: frontend
+        athleticmap.io/bff-aqui: "true"
    spec:
      containers:
        - name: frontend-spa
@@ -44,7 +45,15 @@ spec:
            - { name: ATM_API_CORE_URL, value: "http://runtime-core.acme-prod.svc.cluster.local" }
            - { name: ATM_API_OPERACAO_URL, value: "http://runtime-operacao.acme-prod.svc.cluster.local" }
            - { name: ATM_API_SAUDE_URL, value: "http://runtime-saude.acme-prod.svc.cluster.local" }
-            - { name: ATM_BFF_URL, value: "http://servico-bff.acme-prod.svc.cluster.local" }
+            # P4.6 fechado 2026-09-26: o BFF e o SEGUNDO CONTAINER deste
+            # mesmo pod (ver o container 'servico-bff' abaixo) — sem
+            # Deployment proprio. `127.0.0.1` porque os dois containers
+            # do pod compartilham a rede. O Service `servico-bff` continua
+            # existindo, so com o `selector` mudado para o rotulo
+            # `athleticmap.io/bff-aqui` deste pod — quem aponta direto para ele
+            # (o webhook do Garmin do escolinha, e o Prometheus) nao
+            # precisou de nenhuma edicao.
+            - { name: ATM_BFF_URL, value: "http://127.0.0.1:8083" }
            - { name: ATM_API_URL, value: "http://servico-bff.acme-prod.svc.cluster.local" }
          resources:
            requests: { cpu: 50m, memory: 64Mi }
@@ -57,6 +66,45 @@ spec:
            httpGet: { path: /, port: 80 }
            initialDelaySeconds: 5
            periodSeconds: 10
+        - name: servico-bff
+          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
+          imagePullPolicy: Never
+          ports: [{ containerPort: 8083 }]
+          env:
+            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
+            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
+            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
+            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
+            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
+            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
+            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
+            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
+            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
+            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
+            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
+            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
+            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
+            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
+            - { name: ATM_ISSUER, value: "https://auth-acme.athleticmap.com/realms/athleticmap" }
+            - name: ATM_CONSENTIMENTO_SEGREDO
+              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
+            - { name: ATM_TENANT, value: "acme" }
+            - { name: ATM_PLANO, value: "institucional" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://acme.athleticmap.com/integracoes/garmin" }
+          resources:
+            requests: { cpu: 50m, memory: 256Mi }
+            limits: { cpu: 500m, memory: 512Mi }
+          readinessProbe:
+            httpGet: { path: /bff/health, port: 8083 }
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            httpGet: { path: /actuator/health/liveness, port: 8083 }
+            initialDelaySeconds: 50
+            periodSeconds: 20
+            failureThreshold: 6
+
      volumes:
        - name: publico
          projected:
@@ -1,63 +1,14 @@
-# BFF (Backend-for-Frontend) — ponto unico da SPA; agrega configuracao + cadastro
-# com token relay. Stateless (sem banco). Roteado em /bff no ingress do tenant.
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: servico-bff
-  namespace: demo-prod
-  labels:
-    app: servico-bff
-    athleticmap.io/contexto: bff
-spec:
-  replicas: 1
-  selector: { matchLabels: { app: servico-bff } }
-  template:
-    metadata:
-      labels:
-        app: servico-bff
-        athleticmap.io/contexto: bff
-    spec:
-      containers:
-        - name: servico-bff
-          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
-          imagePullPolicy: Never
-          ports: [{ containerPort: 8083 }]
-          env:
-            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
-            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
-            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
-            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
-            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
-            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
-            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
-            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
-            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
-            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
-            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
-            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
-            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
-            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
-            - { name: ATM_ISSUER, value: "https://auth-demo.athleticmap.com/realms/athleticmap" }
-            - name: ATM_CONSENTIMENTO_SEGREDO
-              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
-            - { name: ATM_TENANT, value: "demo" }
-            - { name: ATM_PLANO, value: "institucional" }
-            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://demo.athleticmap.com/integracoes/garmin" }
-          resources:
-            requests: { cpu: 50m, memory: 256Mi }
-            limits: { cpu: 500m, memory: 512Mi }
-          readinessProbe:
-            httpGet: { path: /bff/health, port: 8083 }
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            failureThreshold: 30
-          livenessProbe:
-            httpGet: { path: /actuator/health/liveness, port: 8083 }
-            initialDelaySeconds: 50
-            periodSeconds: 20
-            failureThreshold: 6
---
+# =============================================================================
+# So o Service. O Deployment foi FUNDIDO no pod do frontend-spa (P4.6,
+# 2026-09-26) — ver 95-frontend-spa.yaml, segundo container. Esta linha
+# de servico continua existindo porque:
+#   1. tenants/escolinha/96-ingress-garmin-public.yaml aponta DIRETO
+#      para este Service (o webhook do Garmin nao passa pelo nginx);
+#   2. o Prometheus raspa por ele (athleticmap.io/metricas: tenant).
+# O `selector` mudou de `app: servico-bff` para o rotulo do pod
+# fundido (athleticmap.io/bff-aqui); nome e porta do Service NAO mudaram — o
+# Ingress do Garmin nao precisou de nenhuma edicao.
+# =============================================================================
 apiVersion: v1
 kind: Service
 metadata:
@@ -66,5 +17,5 @@ metadata:
  labels:
    app: servico-bff
 spec:
-  selector: { app: servico-bff }
+  selector: { athleticmap.io/bff-aqui: "true" }
  ports: [{ name: http, port: 80, targetPort: 8083 }]
@@ -17,6 +17,7 @@ spec:
      labels:
        app: frontend-spa
        athleticmap.io/contexto: frontend
+        athleticmap.io/bff-aqui: "true"
    spec:
      containers:
        - name: frontend-spa
@@ -44,7 +45,15 @@ spec:
            - { name: ATM_API_CORE_URL, value: "http://runtime-core.demo-prod.svc.cluster.local" }
            - { name: ATM_API_OPERACAO_URL, value: "http://runtime-operacao.demo-prod.svc.cluster.local" }
            - { name: ATM_API_SAUDE_URL, value: "http://runtime-saude.demo-prod.svc.cluster.local" }
-            - { name: ATM_BFF_URL, value: "http://servico-bff.demo-prod.svc.cluster.local" }
+            # P4.6 fechado 2026-09-26: o BFF e o SEGUNDO CONTAINER deste
+            # mesmo pod (ver o container 'servico-bff' abaixo) — sem
+            # Deployment proprio. `127.0.0.1` porque os dois containers
+            # do pod compartilham a rede. O Service `servico-bff` continua
+            # existindo, so com o `selector` mudado para o rotulo
+            # `athleticmap.io/bff-aqui` deste pod — quem aponta direto para ele
+            # (o webhook do Garmin do escolinha, e o Prometheus) nao
+            # precisou de nenhuma edicao.
+            - { name: ATM_BFF_URL, value: "http://127.0.0.1:8083" }
            - { name: ATM_API_URL, value: "http://servico-bff.demo-prod.svc.cluster.local" }
          resources:
            requests: { cpu: 50m, memory: 64Mi }
@@ -57,6 +66,45 @@ spec:
            httpGet: { path: /, port: 80 }
            initialDelaySeconds: 5
            periodSeconds: 10
+        - name: servico-bff
+          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
+          imagePullPolicy: Never
+          ports: [{ containerPort: 8083 }]
+          env:
+            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
+            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
+            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
+            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
+            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
+            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
+            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
+            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
+            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
+            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
+            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
+            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
+            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
+            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
+            - { name: ATM_ISSUER, value: "https://auth-demo.athleticmap.com/realms/athleticmap" }
+            - name: ATM_CONSENTIMENTO_SEGREDO
+              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
+            - { name: ATM_TENANT, value: "demo" }
+            - { name: ATM_PLANO, value: "institucional" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://demo.athleticmap.com/integracoes/garmin" }
+          resources:
+            requests: { cpu: 50m, memory: 256Mi }
+            limits: { cpu: 500m, memory: 512Mi }
+          readinessProbe:
+            httpGet: { path: /bff/health, port: 8083 }
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            httpGet: { path: /actuator/health/liveness, port: 8083 }
+            initialDelaySeconds: 50
+            periodSeconds: 20
+            failureThreshold: 6
+
      volumes:
        - name: publico
          projected:
@@ -1,63 +1,14 @@
-# BFF (Backend-for-Frontend) — ponto unico da SPA; agrega configuracao + cadastro
-# com token relay. Stateless (sem banco). Roteado em /bff no ingress do tenant.
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: servico-bff
-  namespace: piloto-prod
-  labels:
-    app: servico-bff
-    athleticmap.io/contexto: bff
-spec:
-  replicas: 1
-  selector: { matchLabels: { app: servico-bff } }
-  template:
-    metadata:
-      labels:
-        app: servico-bff
-        athleticmap.io/contexto: bff
-    spec:
-      containers:
-        - name: servico-bff
-          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
-          imagePullPolicy: Never
-          ports: [{ containerPort: 8083 }]
-          env:
-            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
-            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
-            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
-            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
-            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
-            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
-            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
-            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
-            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
-            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
-            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
-            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
-            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
-            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
-            - { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
-            - name: ATM_CONSENTIMENTO_SEGREDO
-              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
-            - { name: ATM_TENANT, value: "piloto" }
-            - { name: ATM_PLANO, value: "institucional" }
-            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://piloto.athleticmap.com/integracoes/garmin" }
-          resources:
-            requests: { cpu: 50m, memory: 256Mi }
-            limits: { cpu: 500m, memory: 512Mi }
-          readinessProbe:
-            httpGet: { path: /bff/health, port: 8083 }
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            failureThreshold: 30
-          livenessProbe:
-            httpGet: { path: /actuator/health/liveness, port: 8083 }
-            initialDelaySeconds: 50
-            periodSeconds: 20
-            failureThreshold: 6
---
+# =============================================================================
+# So o Service. O Deployment foi FUNDIDO no pod do frontend-spa (P4.6,
+# 2026-09-26) — ver 95-frontend-spa.yaml, segundo container. Esta linha
+# de servico continua existindo porque:
+#   1. tenants/escolinha/96-ingress-garmin-public.yaml aponta DIRETO
+#      para este Service (o webhook do Garmin nao passa pelo nginx);
+#   2. o Prometheus raspa por ele (athleticmap.io/metricas: tenant).
+# O `selector` mudou de `app: servico-bff` para o rotulo do pod
+# fundido (athleticmap.io/bff-aqui); nome e porta do Service NAO mudaram — o
+# Ingress do Garmin nao precisou de nenhuma edicao.
+# =============================================================================
 apiVersion: v1
 kind: Service
 metadata:
@@ -66,5 +17,5 @@ metadata:
  labels:
    app: servico-bff
 spec:
-  selector: { app: servico-bff }
+  selector: { athleticmap.io/bff-aqui: "true" }
  ports: [{ name: http, port: 80, targetPort: 8083 }]
@@ -17,6 +17,7 @@ spec:
      labels:
        app: frontend-spa
        athleticmap.io/contexto: frontend
+        athleticmap.io/bff-aqui: "true"
    spec:
      containers:
        - name: frontend-spa
@@ -44,7 +45,15 @@ spec:
            - { name: ATM_API_CORE_URL, value: "http://runtime-core.piloto-prod.svc.cluster.local" }
            - { name: ATM_API_OPERACAO_URL, value: "http://runtime-operacao.piloto-prod.svc.cluster.local" }
            - { name: ATM_API_SAUDE_URL, value: "http://runtime-saude.piloto-prod.svc.cluster.local" }
-            - { name: ATM_BFF_URL, value: "http://servico-bff.piloto-prod.svc.cluster.local" }
+            # P4.6 fechado 2026-09-26: o BFF e o SEGUNDO CONTAINER deste
+            # mesmo pod (ver o container 'servico-bff' abaixo) — sem
+            # Deployment proprio. `127.0.0.1` porque os dois containers
+            # do pod compartilham a rede. O Service `servico-bff` continua
+            # existindo, so com o `selector` mudado para o rotulo
+            # `athleticmap.io/bff-aqui` deste pod — quem aponta direto para ele
+            # (o webhook do Garmin do escolinha, e o Prometheus) nao
+            # precisou de nenhuma edicao.
+            - { name: ATM_BFF_URL, value: "http://127.0.0.1:8083" }
            - { name: ATM_API_URL, value: "http://servico-bff.piloto-prod.svc.cluster.local" }
          resources:
            requests: { cpu: 50m, memory: 64Mi }
@@ -57,6 +66,45 @@ spec:
            httpGet: { path: /, port: 80 }
            initialDelaySeconds: 5
            periodSeconds: 10
+        - name: servico-bff
+          image: docker.io/library/servico-bff:2.0-atualiza-4-antigos
+          imagePullPolicy: Never
+          ports: [{ containerPort: 8083 }]
+          env:
+            - { name: ATM_CONFIG_URL, value: "http://servico-configuracao" }
+            - { name: ATM_CADASTRO_URL, value: "http://servico-cadastro" }
+            - { name: ATM_ORGANIZACAO_URL, value: "http://servico-organizacao" }
+            - { name: ATM_PLANEJAMENTO_URL, value: "http://servico-planejamento" }
+            - { name: ATM_CAMPEONATO_URL, value: "http://servico-campeonato" }
+            - { name: ATM_SAUDE_URL, value: "http://servico-saude" }
+            - { name: ATM_FINANCEIRO_URL, value: "http://servico-financeiro" }
+            - { name: ATM_DOCUMENTOS_URL, value: "http://servico-documentos" }
+            - { name: ATM_ADMINISTRATIVO_URL, value: "http://servico-administrativo" }
+            - { name: ATM_ASSISTENCIA_SOCIAL_URL, value: "http://servico-assistencia-social" }
+            - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" }
+            - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" }
+            - { name: ATM_AGENDA_URL, value: "http://servico-agenda" }
+            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
+            - { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.com/realms/athleticmap" }
+            - name: ATM_CONSENTIMENTO_SEGREDO
+              valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } }
+            - { name: ATM_TENANT, value: "piloto" }
+            - { name: ATM_PLANO, value: "institucional" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://piloto.athleticmap.com/integracoes/garmin" }
+          resources:
+            requests: { cpu: 50m, memory: 256Mi }
+            limits: { cpu: 500m, memory: 512Mi }
+          readinessProbe:
+            httpGet: { path: /bff/health, port: 8083 }
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            httpGet: { path: /actuator/health/liveness, port: 8083 }
+            initialDelaySeconds: 50
+            periodSeconds: 20
+            failureThreshold: 6
+
      volumes:
        - name: publico
          projected: