docs(P3.3): restaurar o cabecalho que a rotacao apagou

O kubeseal devolve YAML limpo, e a rotacao do token levou junto 17 linhas que diziam por que ha dois segredos, que o AsaasConfig recusa subir se forem iguais, e que 15 recusas seguidas param a fila da conta no Asaas. Entra tambem o que mudou hoje: o token do webhook nao precisa mais ser digitado no painel, porque o script o grava pela API.
2026-09-23 21:45:45 +00:00
parent 305ad93795
commit 2996ca7a92
1 changed files with 43 additions and 16 deletions
@@ -1,16 +1,43 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: asaas-credentials
-  namespace: plataforma-prod
-spec:
-  encryptedData:
-    api-key: AgBiaakijMDkM2tResLKR+TMTbvrHiTQgRMQkItjJbfqjDad1eHJ7Ot6PzOR+aApC7zGRP/PonFZQ6i7Yyj+arSTT4F6Wl16cIjGS+QNorKnHu3kbEuytgi9zb/6fYbw3DW9K2AQ5SXCU65ptpMY4FXhjzec+c7dBKxAM2l1nEq/Xysa6EUOtVdlvEYisfMEpRQj3MgyOjiVupEvasCDVVDOXreuQuKcPw6Gee6c7gxPpSpnTQ2Osb9Ssol35aXoXAuTCiiInZQk2TOdJ6MbqF/BnBp21SGgl9zYkS0y/V9InbbcsHjNKsq+d9pu8GDkm4i9+y952293ozgey6C3N2RxETtCrREwK9eXbXtvXoatgC/MQ1G41PWjBKRWUwJO1MLf1hsGiP3QDzxOjPgEAYm8B65yVm23JhvWkxnV85EiZSSbqv1OU2+k4vREGavpqqwm5JSvwW34aFGBsiuaCrp5JQ/R1BxpGGfCMTwkCIVPL3CgKTRB4mBB2yjKOG0sT159BMr1xJGNisPXLmHp1jufuldAXnqMF6fkJZgPjrNg0XuZEPbYDN9reNmB2m/ECr/qJYAvJVD5hq4eaNDTJru2rf0Dg6bNuUb5vbXNuJvR9OIMy3lL5hXhpZFI/Upd/a1PGRsgYkGwvEUTf1KMHnWD2uIGsFLYqUjAP5Ge2Xz5IUlMfOfYUUO9FF04Wz9Z2npPF561vyNM8RZbSnwHBelErtky1z9P7FRopTBTwiyVdS7GAhnWAy0T3XbJHCqtgepcVvuHBBmxKznHIHm0zCTJ8JmyTDzAcG9Zeu0F9G9kQxeCkH9IRMf+JmYVXgqRBVXwXxjKtym4ru1Hvjg9lr2XaoVv8le9qQc+rO+uQ8uFoJXliEe0To/OqImPDcFIGeNrwOi0+GyRlMDdyinzmF/fhYQibSP7
-    webhook-token: AgAJ+5MCIt6JxBA2exMY4ZmXy//HOsDA8ZyUR1eZSkm0vN9KJ/nDZwEsiyyTK4+ZbFNOqyS3Cki6LiRhlPRuKQCeF8BiQBNkeWkrrXMq+wBhfzQivwGLfFuQj2whYw+lcxlcReEiwKNiVDGvqQu+weQB8MLg+huEV3InZ+0AAgSRXyTD2qDgIEt61kg87Fd+kRzieq+icrpUjfSmm8l0d3Sre5sYxSJ4jrVvCBWqiG4456+JglVbht62Tfjj0uFs3jQanhVK8N6h4ZkLyow7ke5QcrNjnacK5VB+TeH3TTbtPj3KcumXvqpxd2sPxRPq42P9QBnMz9yi9EBp1vY9NgwKZkgrhXP7mStp2EkYBTX4N2vOWXmHTMR6iW5kh67VcM2nl6ME1z9unT+iWsw7MclcUocjfZhsTUT18m6PUHqxzdRoPvYxag6KwDoNweQ3K1ut4xI/anzocBJFJG76Q3w+lk5vK2QypzlXS3rj0ArCyex+ZxNtXZgDhXDW1OvJXaLZ0jJQ6+dhNYGKx3Kdr5WBJ+Cxxxe8RCkC9excb38tR6NDQyFnYL1Rd0syE8JWayYeYAqCPoaiAxDcHj7P76BTs2BUsRGMSC6P+V1paYXkYcUvaKrmqndtFSA81M0XSOtTXKPE+mFeNpc+dr693/hYvLwUuk5vZsAy8Ftv3hHaGNa0/cAeGNQwyT8jwjp8AIsk2pHwEnWK8PKYYzdTPZ+tN90eZm/r2LxCjCmHHxvbvg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: asaas-credentials
-      namespace: plataforma-prod
+# ============================================================================
+# Credenciais do Asaas do tenant `plataforma`. Geradas em 2026-09-17 (P3.3); token do webhook rotacionado
+# em 2026-09-23.
+#
+# PODE SER COMMITADO: cifrado para ESTE cluster e preso ao nome
+# `asaas-credentials` no namespace `plataforma-prod`.
+#
+# Sao DOIS segredos por desenho: `api-key` autoriza COBRAR e MOVIMENTAR
+# DINHEIRO; `webhook-token` so autoriza alguem a nos AVISAR que algo aconteceu.
+# `AsaasConfig` recusa subir o pod se forem iguais.
+#
+# O `webhook-token` tem de estar cadastrado no painel do Asaas, no campo "Token
+# de autenticacao" do webhook. Se ele for regerado aqui sem ser atualizado la, os
+# avisos passam a ser recusados — e 15 recusas seguidas param a fila da conta.
+#
+# PARA REGERAR: `scripts/gerar_credenciais_plataforma.sh asaas` (pede a chave de
+# producao do painel). Passo a passo da ligacao em
+# `docs/p33-ligar-o-asaas-de-producao.md`.
+#
+# 2026-09-23: o token do webhook NAO precisa mais ser digitado no painel. O
+# `gerar_credenciais_plataforma.sh asaas` grava o valor no webhook de cobranca
+# pela API (`PUT /v3/webhooks/{id}`, alvo escolhido pela URL terminando em
+# `/webhooks/asaas`), entao os dois lados viram juntos e ninguem ve o valor.
+#
+# Este cabecalho ja se perdeu uma vez, porque o `kubeseal` devolve YAML limpo.
+# O `gravar()` do script passou a preserva-lo.
+# ============================================================================
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: asaas-credentials
+  namespace: plataforma-prod
+spec:
+  encryptedData:
+    api-key: AgBiaakijMDkM2tResLKR+TMTbvrHiTQgRMQkItjJbfqjDad1eHJ7Ot6PzOR+aApC7zGRP/PonFZQ6i7Yyj+arSTT4F6Wl16cIjGS+QNorKnHu3kbEuytgi9zb/6fYbw3DW9K2AQ5SXCU65ptpMY4FXhjzec+c7dBKxAM2l1nEq/Xysa6EUOtVdlvEYisfMEpRQj3MgyOjiVupEvasCDVVDOXreuQuKcPw6Gee6c7gxPpSpnTQ2Osb9Ssol35aXoXAuTCiiInZQk2TOdJ6MbqF/BnBp21SGgl9zYkS0y/V9InbbcsHjNKsq+d9pu8GDkm4i9+y952293ozgey6C3N2RxETtCrREwK9eXbXtvXoatgC/MQ1G41PWjBKRWUwJO1MLf1hsGiP3QDzxOjPgEAYm8B65yVm23JhvWkxnV85EiZSSbqv1OU2+k4vREGavpqqwm5JSvwW34aFGBsiuaCrp5JQ/R1BxpGGfCMTwkCIVPL3CgKTRB4mBB2yjKOG0sT159BMr1xJGNisPXLmHp1jufuldAXnqMF6fkJZgPjrNg0XuZEPbYDN9reNmB2m/ECr/qJYAvJVD5hq4eaNDTJru2rf0Dg6bNuUb5vbXNuJvR9OIMy3lL5hXhpZFI/Upd/a1PGRsgYkGwvEUTf1KMHnWD2uIGsFLYqUjAP5Ge2Xz5IUlMfOfYUUO9FF04Wz9Z2npPF561vyNM8RZbSnwHBelErtky1z9P7FRopTBTwiyVdS7GAhnWAy0T3XbJHCqtgepcVvuHBBmxKznHIHm0zCTJ8JmyTDzAcG9Zeu0F9G9kQxeCkH9IRMf+JmYVXgqRBVXwXxjKtym4ru1Hvjg9lr2XaoVv8le9qQc+rO+uQ8uFoJXliEe0To/OqImPDcFIGeNrwOi0+GyRlMDdyinzmF/fhYQibSP7
+    webhook-token: AgAJ+5MCIt6JxBA2exMY4ZmXy//HOsDA8ZyUR1eZSkm0vN9KJ/nDZwEsiyyTK4+ZbFNOqyS3Cki6LiRhlPRuKQCeF8BiQBNkeWkrrXMq+wBhfzQivwGLfFuQj2whYw+lcxlcReEiwKNiVDGvqQu+weQB8MLg+huEV3InZ+0AAgSRXyTD2qDgIEt61kg87Fd+kRzieq+icrpUjfSmm8l0d3Sre5sYxSJ4jrVvCBWqiG4456+JglVbht62Tfjj0uFs3jQanhVK8N6h4ZkLyow7ke5QcrNjnacK5VB+TeH3TTbtPj3KcumXvqpxd2sPxRPq42P9QBnMz9yi9EBp1vY9NgwKZkgrhXP7mStp2EkYBTX4N2vOWXmHTMR6iW5kh67VcM2nl6ME1z9unT+iWsw7MclcUocjfZhsTUT18m6PUHqxzdRoPvYxag6KwDoNweQ3K1ut4xI/anzocBJFJG76Q3w+lk5vK2QypzlXS3rj0ArCyex+ZxNtXZgDhXDW1OvJXaLZ0jJQ6+dhNYGKx3Kdr5WBJ+Cxxxe8RCkC9excb38tR6NDQyFnYL1Rd0syE8JWayYeYAqCPoaiAxDcHj7P76BTs2BUsRGMSC6P+V1paYXkYcUvaKrmqndtFSA81M0XSOtTXKPE+mFeNpc+dr693/hYvLwUuk5vZsAy8Ftv3hHaGNa0/cAeGNQwyT8jwjp8AIsk2pHwEnWK8PKYYzdTPZ+tN90eZm/r2LxCjCmHHxvbvg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: asaas-credentials
+      namespace: plataforma-prod