From 2996ca7a921829a5d62dfe5600c30161577d0ac8 Mon Sep 17 00:00:00 2001 From: ATM Platform Date: Wed, 23 Sep 2026 21:45:45 +0000 Subject: [PATCH] docs(P3.3): restaurar o cabecalho que a rotacao apagou O kubeseal devolve YAML limpo, e a rotacao do token levou junto 17 linhas que diziam por que ha dois segredos, que o AsaasConfig recusa subir se forem iguais, e que 15 recusas seguidas param a fila da conta no Asaas. Entra tambem o que mudou hoje: o token do webhook nao precisa mais ser digitado no painel, porque o script o grava pela API. --- tenants/plataforma/07-sealed-asaas.yaml | 59 ++++++++++++++++++------- 1 file changed, 43 insertions(+), 16 deletions(-) diff --git a/tenants/plataforma/07-sealed-asaas.yaml b/tenants/plataforma/07-sealed-asaas.yaml index b60520f..a15462d 100644 --- a/tenants/plataforma/07-sealed-asaas.yaml +++ b/tenants/plataforma/07-sealed-asaas.yaml @@ -1,16 +1,43 @@ ---- -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: asaas-credentials - namespace: plataforma-prod -spec: - encryptedData: - api-key: AgBiaakijMDkM2tResLKR+TMTbvrHiTQgRMQkItjJbfqjDad1eHJ7Ot6PzOR+aApC7zGRP/PonFZQ6i7Yyj+arSTT4F6Wl16cIjGS+QNorKnHu3kbEuytgi9zb/6fYbw3DW9K2AQ5SXCU65ptpMY4FXhjzec+c7dBKxAM2l1nEq/Xysa6EUOtVdlvEYisfMEpRQj3MgyOjiVupEvasCDVVDOXreuQuKcPw6Gee6c7gxPpSpnTQ2Osb9Ssol35aXoXAuTCiiInZQk2TOdJ6MbqF/BnBp21SGgl9zYkS0y/V9InbbcsHjNKsq+d9pu8GDkm4i9+y952293ozgey6C3N2RxETtCrREwK9eXbXtvXoatgC/MQ1G41PWjBKRWUwJO1MLf1hsGiP3QDzxOjPgEAYm8B65yVm23JhvWkxnV85EiZSSbqv1OU2+k4vREGavpqqwm5JSvwW34aFGBsiuaCrp5JQ/R1BxpGGfCMTwkCIVPL3CgKTRB4mBB2yjKOG0sT159BMr1xJGNisPXLmHp1jufuldAXnqMF6fkJZgPjrNg0XuZEPbYDN9reNmB2m/ECr/qJYAvJVD5hq4eaNDTJru2rf0Dg6bNuUb5vbXNuJvR9OIMy3lL5hXhpZFI/Upd/a1PGRsgYkGwvEUTf1KMHnWD2uIGsFLYqUjAP5Ge2Xz5IUlMfOfYUUO9FF04Wz9Z2npPF561vyNM8RZbSnwHBelErtky1z9P7FRopTBTwiyVdS7GAhnWAy0T3XbJHCqtgepcVvuHBBmxKznHIHm0zCTJ8JmyTDzAcG9Zeu0F9G9kQxeCkH9IRMf+JmYVXgqRBVXwXxjKtym4ru1Hvjg9lr2XaoVv8le9qQc+rO+uQ8uFoJXliEe0To/OqImPDcFIGeNrwOi0+GyRlMDdyinzmF/fhYQibSP7 - webhook-token: AgAJ+5MCIt6JxBA2exMY4ZmXy//HOsDA8ZyUR1eZSkm0vN9KJ/nDZwEsiyyTK4+ZbFNOqyS3Cki6LiRhlPRuKQCeF8BiQBNkeWkrrXMq+wBhfzQivwGLfFuQj2whYw+lcxlcReEiwKNiVDGvqQu+weQB8MLg+huEV3InZ+0AAgSRXyTD2qDgIEt61kg87Fd+kRzieq+icrpUjfSmm8l0d3Sre5sYxSJ4jrVvCBWqiG4456+JglVbht62Tfjj0uFs3jQanhVK8N6h4ZkLyow7ke5QcrNjnacK5VB+TeH3TTbtPj3KcumXvqpxd2sPxRPq42P9QBnMz9yi9EBp1vY9NgwKZkgrhXP7mStp2EkYBTX4N2vOWXmHTMR6iW5kh67VcM2nl6ME1z9unT+iWsw7MclcUocjfZhsTUT18m6PUHqxzdRoPvYxag6KwDoNweQ3K1ut4xI/anzocBJFJG76Q3w+lk5vK2QypzlXS3rj0ArCyex+ZxNtXZgDhXDW1OvJXaLZ0jJQ6+dhNYGKx3Kdr5WBJ+Cxxxe8RCkC9excb38tR6NDQyFnYL1Rd0syE8JWayYeYAqCPoaiAxDcHj7P76BTs2BUsRGMSC6P+V1paYXkYcUvaKrmqndtFSA81M0XSOtTXKPE+mFeNpc+dr693/hYvLwUuk5vZsAy8Ftv3hHaGNa0/cAeGNQwyT8jwjp8AIsk2pHwEnWK8PKYYzdTPZ+tN90eZm/r2LxCjCmHHxvbvg== - template: - metadata: - creationTimestamp: null - name: asaas-credentials - namespace: plataforma-prod +# ============================================================================ +# Credenciais do Asaas do tenant `plataforma`. Geradas em 2026-09-17 (P3.3); token do webhook rotacionado +# em 2026-09-23. +# +# PODE SER COMMITADO: cifrado para ESTE cluster e preso ao nome +# `asaas-credentials` no namespace `plataforma-prod`. +# +# Sao DOIS segredos por desenho: `api-key` autoriza COBRAR e MOVIMENTAR +# DINHEIRO; `webhook-token` so autoriza alguem a nos AVISAR que algo aconteceu. +# `AsaasConfig` recusa subir o pod se forem iguais. +# +# O `webhook-token` tem de estar cadastrado no painel do Asaas, no campo "Token +# de autenticacao" do webhook. Se ele for regerado aqui sem ser atualizado la, os +# avisos passam a ser recusados — e 15 recusas seguidas param a fila da conta. +# +# PARA REGERAR: `scripts/gerar_credenciais_plataforma.sh asaas` (pede a chave de +# producao do painel). Passo a passo da ligacao em +# `docs/p33-ligar-o-asaas-de-producao.md`. +# +# 2026-09-23: o token do webhook NAO precisa mais ser digitado no painel. O +# `gerar_credenciais_plataforma.sh asaas` grava o valor no webhook de cobranca +# pela API (`PUT /v3/webhooks/{id}`, alvo escolhido pela URL terminando em +# `/webhooks/asaas`), entao os dois lados viram juntos e ninguem ve o valor. +# +# Este cabecalho ja se perdeu uma vez, porque o `kubeseal` devolve YAML limpo. +# O `gravar()` do script passou a preserva-lo. +# ============================================================================ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: asaas-credentials + namespace: plataforma-prod +spec: + encryptedData: + api-key: AgBiaakijMDkM2tResLKR+TMTbvrHiTQgRMQkItjJbfqjDad1eHJ7Ot6PzOR+aApC7zGRP/PonFZQ6i7Yyj+arSTT4F6Wl16cIjGS+QNorKnHu3kbEuytgi9zb/6fYbw3DW9K2AQ5SXCU65ptpMY4FXhjzec+c7dBKxAM2l1nEq/Xysa6EUOtVdlvEYisfMEpRQj3MgyOjiVupEvasCDVVDOXreuQuKcPw6Gee6c7gxPpSpnTQ2Osb9Ssol35aXoXAuTCiiInZQk2TOdJ6MbqF/BnBp21SGgl9zYkS0y/V9InbbcsHjNKsq+d9pu8GDkm4i9+y952293ozgey6C3N2RxETtCrREwK9eXbXtvXoatgC/MQ1G41PWjBKRWUwJO1MLf1hsGiP3QDzxOjPgEAYm8B65yVm23JhvWkxnV85EiZSSbqv1OU2+k4vREGavpqqwm5JSvwW34aFGBsiuaCrp5JQ/R1BxpGGfCMTwkCIVPL3CgKTRB4mBB2yjKOG0sT159BMr1xJGNisPXLmHp1jufuldAXnqMF6fkJZgPjrNg0XuZEPbYDN9reNmB2m/ECr/qJYAvJVD5hq4eaNDTJru2rf0Dg6bNuUb5vbXNuJvR9OIMy3lL5hXhpZFI/Upd/a1PGRsgYkGwvEUTf1KMHnWD2uIGsFLYqUjAP5Ge2Xz5IUlMfOfYUUO9FF04Wz9Z2npPF561vyNM8RZbSnwHBelErtky1z9P7FRopTBTwiyVdS7GAhnWAy0T3XbJHCqtgepcVvuHBBmxKznHIHm0zCTJ8JmyTDzAcG9Zeu0F9G9kQxeCkH9IRMf+JmYVXgqRBVXwXxjKtym4ru1Hvjg9lr2XaoVv8le9qQc+rO+uQ8uFoJXliEe0To/OqImPDcFIGeNrwOi0+GyRlMDdyinzmF/fhYQibSP7 + webhook-token: AgAJ+5MCIt6JxBA2exMY4ZmXy//HOsDA8ZyUR1eZSkm0vN9KJ/nDZwEsiyyTK4+ZbFNOqyS3Cki6LiRhlPRuKQCeF8BiQBNkeWkrrXMq+wBhfzQivwGLfFuQj2whYw+lcxlcReEiwKNiVDGvqQu+weQB8MLg+huEV3InZ+0AAgSRXyTD2qDgIEt61kg87Fd+kRzieq+icrpUjfSmm8l0d3Sre5sYxSJ4jrVvCBWqiG4456+JglVbht62Tfjj0uFs3jQanhVK8N6h4ZkLyow7ke5QcrNjnacK5VB+TeH3TTbtPj3KcumXvqpxd2sPxRPq42P9QBnMz9yi9EBp1vY9NgwKZkgrhXP7mStp2EkYBTX4N2vOWXmHTMR6iW5kh67VcM2nl6ME1z9unT+iWsw7MclcUocjfZhsTUT18m6PUHqxzdRoPvYxag6KwDoNweQ3K1ut4xI/anzocBJFJG76Q3w+lk5vK2QypzlXS3rj0ArCyex+ZxNtXZgDhXDW1OvJXaLZ0jJQ6+dhNYGKx3Kdr5WBJ+Cxxxe8RCkC9excb38tR6NDQyFnYL1Rd0syE8JWayYeYAqCPoaiAxDcHj7P76BTs2BUsRGMSC6P+V1paYXkYcUvaKrmqndtFSA81M0XSOtTXKPE+mFeNpc+dr693/hYvLwUuk5vZsAy8Ftv3hHaGNa0/cAeGNQwyT8jwjp8AIsk2pHwEnWK8PKYYzdTPZ+tN90eZm/r2LxCjCmHHxvbvg== + template: + metadata: + creationTimestamp: null + name: asaas-credentials + namespace: plataforma-prod