feat: segredos e variaveis da publicacao de 29/09 — resumo-chave (N16), resumo-credentials e garmin-token-chave nos 4 tenants, retencao 1825, molde

2026-09-29 16:36:15 +00:00
parent a3505c1e36
commit 6bb9e4d8b3
15 changed files with 177 additions and 5 deletions
@@ -69,7 +69,14 @@ spec:
            - { name: ATM_PLANO, value: "{{PLANO}}" }
            # Retencao da trilha de auditoria. O expurgo roda agendado DENTRO
            # deste runtime — ver RuntimeSaude.
-            - { name: ATM_AUDITORIA_RETENCAO_DIAS, value: "730" }
+            # Cifra dos tokens Garmin (RIPD R5, 2026-09-29). Sem o Secret a integracao
+            # Garmin fica DESLIGADA e o runtime sobe normalmente. O provisionamento
+            # ainda NAO sela este Secret: tenant novo precisa dele a mao (pendencia).
+            - name: ATM_GARMIN_TOKEN_CHAVE
+              valueFrom:
+                secretKeyRef: { name: garmin-token-chave, key: chave, optional: true }
+            # 5 anos (P6.3/P6.4, decisao do dono 2026-09-28); era 730.
+            - { name: ATM_AUDITORIA_RETENCAO_DIAS, value: "1825" }
          resources:
            requests: { cpu: 50m, memory: 384Mi }
            limits:   { cpu: "1",  memory: 768Mi }
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: resumo-credentials
+  namespace: acme-prod
+spec:
+  encryptedData:
+    token: AgCIPLHHcWj+PED8cNAY27ailm8tNDINYKdHLjmvnVVHFiKF/FKVi7SphY/lbUsNvtc7dqodphQcW1DFFoj9yT7CPqZpjstLLG88j23/TAojfGtMe/KMq89LBcXSYr+JVc9xvOw+A3vWVyEOpoqvOH/sWjdAxxopSamxL03ITohEiLbkaQo/alJUyU/oqE5N+t0KLuMEBjpvWwmjLFxO9zYYFijLZkpb/GJgzt9az+0RkTXdgJvVm5sVkmfWwtT3xKiiT2Bz1JcMx00bUr+661RLGoTwkZIM/Aong5fi9230FER8j3v2iWZQ/QgBBy8CpTyjKzC1fGySyI2i9a6vsHw+hg1/CLgHKEPBKa+4acZmhJLUajFhLeTV5KuFyryfDS17h8BHEygWYivfll5d2lGdCpO6a8UKq4avv06j3OE78JpaP5GDEAxs6OtjZnW++X6ppGViZk/RqCp6txCK/F2blpMBFk09O466Jr4AeuC+1l4xdqD0NcQey6yoB7cnTyX4NCsDLjkFVY5f8KgLvFJ6ollTD+GCykA9aMT3nO/Rub+IHopsm3cwghIxTPrIDfko60bm4zV4OFvBvCAt3u3uaM4rTwGgO75okW2fFSnN6CxCniCriUrUUJAUSNWmWu4z67xJQ0D2qTZzOimzUvy1f7kIckdWSkGdzQuIYsO7/vStKKWCf1j2darZ0nrZRVE6F92ta3HHoYSGp22GfbzCOz7bKOfzWPl1vsugYZxuPO67TfjmO2RC2jZQ
+  template:
+    metadata:
+      creationTimestamp: null
+      name: resumo-credentials
+      namespace: acme-prod
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: garmin-token-chave
+  namespace: acme-prod
+spec:
+  encryptedData:
+    chave: AgAgWSTzbAX2AxKG9nXclIdciGM+XlnqgOY5XKogAjkDGdPoSCd1w49ECEiTNwP1u9C1nyksyjYWai0k0yIXrKnkizI0C5mmU9dcBzyf9RfJ5ThkscZXVIbWGWmZdqdC4+IcFFqfcry1Scr4kbIwaUfYJSeElCkYHJ7Wc9xTk3DXY9X8pucmTtGccv6O/Zu9Rgd+HiHjtuO8EwSdaPfigVCU380Hx69MY6lKHq1rQLxvZslnQpzRZNXBTOIlH36iJT55aMPrRfdUJlwRo7Q/ZrFjuurU9CmhuLEbbbnt5JYLwmslwPerejNf6HUUTuFE/TasxOv8yl6AHkbJAtGgOKIIW8lFYQJD+/+xS4HLlFNyFkJz/QxtEML4bw4BVxwyOF4ev1D2x0RJh3AAnGi3x5F+WdLQKMeEOmI84YHQ3fY+NtRUqIyOmt1S2kTNxPpt2y5Agr8vhJHCZgA0YbrSz/gfiVKHI5HgYLTQ11WiW9TX9Y2mdsA3rYD/mAIeG9guW5ohOZwajHXyFKyRUACyj9gBb6fUL5MRKeUYLbHpkgymn/zsky6aggT+XAJFOZgnzTIFTuy7J+6lb/1MBg8cBS8Wcs6UYYurcdcfdzT10rrViAnPil+bfbYuzrT0Kg+IqfTxheqgTBRyByDNmQHSwkgzFQS5TOGy6A2ghku/tXbmX6ZrD1Pk9U5fda4p9XvQSiv7Qit19GH9OaBlh+1aXqYy7/bYZy64CoDVlEKAZkMozc3xt2zriQZuIe89cw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: garmin-token-chave
+      namespace: acme-prod
@@ -57,8 +57,14 @@ spec:
            secretKeyRef:
              name: garmin-oauth
              key: GARMIN_CLIENT_SECRET
+        - name: ATM_GARMIN_TOKEN_CHAVE
+          valueFrom:
+            secretKeyRef:
+              name: garmin-token-chave
+              key: chave
+              optional: true
        - name: ATM_AUDITORIA_RETENCAO_DIAS
-          value: '730'
+          value: '1825'   # 5 anos (P6.3/P6.4, 2026-09-29); era 730
        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
          value: '10'
        resources:
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: resumo-credentials
+  namespace: demo-prod
+spec:
+  encryptedData:
+    token: AgB7YaUeDoWA3tShsiEMXSWiR6ehOY3MbMsLGnTyWfHIfr+riV5nwByXxohab4eiNswlu/T3/yQuLrxQqhnK8lzpZRFE1gi5JEuxvK4ycF1yTKob0F9BfVoiD0vAEvNiU/2u0kFblKeNfgDArGEyCgX6GaiElC/DL8uYSlS334TbJT1RlCpI0fEuiR3QfeVDZawqlSvRYfu0x09PoVcXgdNoJkWdonFJ+ZgLbyJVBt2VnVGNDTQzitrbQjZEZ54bcrwjCOyKzBLcOXYFRj/aMuoddY5fw1xCV6Ks3CP9OouRUkOD/K3/TnrHZ0kULXNvZSVN9IVVQ498sQhymi9O1chRLaDm6Nabm7kXecK1qEvSF2k1U8Xda/GrDndrbzXjpWeNdbRpMIWhA36tV4pNkq17VrfMqKnCODBVwCiCSfoPfLSkPJ3RyujNpiYF7vmqAOpUab2BDak5OUeIsWuqv13slxjatT38eCLaTWWzpRvFmGW6phNynS/rwQX3wOYKjCF+bvFeVeobfHZevPbrwUhWoQMm8tiLOgIZOuqVzhsmGbCY60ff5RHFhYmokVHylIPcFPnxWZPw+lkiRs9QhxYJ5DhXnzgjon5Tol70lZUM4ae2mvDGEG242/Zf6jtUYElAgM7fafRY47KpAXp0W6q6hnMclvcZFMoFK0hvZ8XzmCKcNcxRzpaJ7DwWLpYIp0GaufIGJw/mg1Ykk4ZKwmFXFZ+SDt8w4gI2nFvTAbHlUL3yJ4zPtrKvVvTf
+  template:
+    metadata:
+      creationTimestamp: null
+      name: resumo-credentials
+      namespace: demo-prod
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: garmin-token-chave
+  namespace: demo-prod
+spec:
+  encryptedData:
+    chave: AgAyll299+W5t1yfQEhDIEma/vWpGPe2W4zAsMEcCrvP4Jw7ckKbLQ5/rdzdSuRafImLc1Y1NGfGIehCm6nP+TZkzteti7XyJfyPjTs1/gYuUc5kLvMcSbWwRlcdseOsyXAWRvP9uclK3sCcy8kW3AemM13tmFnaib36sZl3cHikE4kYJTxFtaaERuk+rPovWKubRCieoP3JzpuArsXYrTxY2WTbJnsWnLwcuYa38eAGihGnsIbaBr0okrlRPs1axTPULCdgn+CX8SmiAL7FHyfmZnqs3OywN4MpkoNxN5qEGqcTLztN/74v9vHCFTEd8rQtNgemBiDB6X4gaiZU2ZxtlZLyAw5fJMB/10kXJobNYeWIrnz4CkB6TRluFcJvFSeiS2E5qc5yCoZNvoijKpBF+AlmpkarXTsovISR0TbbqYMoerTxzUeSiRiiHfMQTW9h7jv72jv7prkeDut6ghy4yYsxQczcAbFOLU9O01FC0BRnLUogpVFrvnrje7cMV39nFj7+iKNlys9o9rBKr/ef6a4eVde7rpAKJ3xJjln1kyS2B5JkiKf4lcwtarCusWBv90ChIj4aLEUZo7ao8E/Ttu+4Ofj+YWcB8JU18bYzZx8TnPTdN0SfiV/yEMNp5CDK+d6MMvkN/LAAu2U4Sp96eRTA/lL0yHBR/561kv0ZP1fZCnMsOlqYKv5jv1OOtHQhkMKjeAzlGB6Z6BKfEkbg3fFhelAFyzoJ46WIFNGkAoLShvbCLOIu2cdhPQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: garmin-token-chave
+      namespace: demo-prod
@@ -57,8 +57,14 @@ spec:
            secretKeyRef:
              name: garmin-oauth
              key: GARMIN_CLIENT_SECRET
+        - name: ATM_GARMIN_TOKEN_CHAVE
+          valueFrom:
+            secretKeyRef:
+              name: garmin-token-chave
+              key: chave
+              optional: true
        - name: ATM_AUDITORIA_RETENCAO_DIAS
-          value: '730'
+          value: '1825'   # 5 anos (P6.3/P6.4, 2026-09-29); era 730
        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
          value: '10'
        resources:
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: resumo-credentials
+  namespace: escolinha-prod
+spec:
+  encryptedData:
+    token: AgArMM/sZKPgyVzRK18yMwDs9GVhQxTjJxHB9eZUj8tUpwq5x3cx8eUDeAMX25fcm7+75qcrdtL3GWUZvc2A5fdS2N29Tmjh/nXq6HE5MG2QlBuAA0vOZ78oZGnT1rN2SFK5a7chNGrwaepJ2+e1n+tyYpXsokt2Id66Bj1Kz5/bGhMArb92GIBqRCCNzUHmNvd9dQrYs9sZPvtqf4Ohx1e0MeFpCi9MJnSApN5f6JzEzhiRNkcOcWnnDvDyzURzWBtpD9XlOVcHfBQozDOFl2xyDtrjIaIjtqtcVj4UxtjoDRnFWhKuyKv4C3XOsHcXc7FxTCYmPyQ8mCqFbL9GkxcYTckZQfBF4wv654tCAWHK9dAQOPUgvgY/6j1xKY3Waxs6XqolaeVkdielXhgsaOL862rXifb6OBFp7K0iIusSKWFkAkbWDlv3zafBali+07xVfBg3sThnaVGQLwonxC003LesJxvwBTAAjWNtQ6/HF9/6G5WXeAFlFoPQgfi+V/32kHXWvPEkPMLaRwzIYMCUDJalA1k8IxTbD9j/Is038AP2ImCtZjlkJYBtJpl2ZF/sP5sem+P6QiiOufv6GgaNoXfjlaRvmEgUKAcgOTCEFQ1WO2U19+svXF+v6m9a8q9iTuEvRi0/p/B7CTi0peeAi/MICU6PK5TEBSGsrgdV6O3VbA9VtzGmLDA7pXHphAwn1FW91pYGrZzl+zsCUrjwC4K3SP/ZOIXq4WvY+kNejArjlOiT5+N/lgoZ
+  template:
+    metadata:
+      creationTimestamp: null
+      name: resumo-credentials
+      namespace: escolinha-prod
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: garmin-token-chave
+  namespace: escolinha-prod
+spec:
+  encryptedData:
+    chave: AgBJmLchDrA071vfUWXHF/viOb06GglRROeOmh5UiuidEZq9PCjcpQ0CHZAHfe+9JC1T6TEYMBMpFDWEP3SgATEf8iS22ek8QB854DISrU6okdXNbpRGC7kPdPirdYEcHpjyUX9acWaMJn6EGZrf/kVnvm7Y48KLFnY4l/y8wHPCGcG12t2qdU4xjKxJgJE5ljAFcf+7e4duqYSwk54YmrBu9ERVchN3Mie3uevXYB7zAjNXmPq3LMSHYm4QehyZSfPuakjcHqHLJ1s3RWR4X8Slgh1J22qQMsBiWndfN8PaC+xy+whbn9f19J4Aaf6KldVPIfCZMfADy8pYl/2wDAjP99i3/yunsVYTmuvbESvSibxIqTbpAfw0rBU3ClhkDHXIYr5I0m+oIdAQAusWqsqbQAcU16QCqWTZLFmAMjmCajWhTKrCHDDhxyjTtIupYcWHyWQCEnFR5fEvCGUSoBTwqPFVYldxbXyM83SjU/s0552SHLPtaCvCHOwNvUtdKOTx0QHoG0e2KwloSPLz5P6ohb8Uno44dZ5pfUQgL8pPCM+vKt2+I5lEVg8jVX3OAQZVe0cP7pWQN0yqC+AAv4AFfwUFr4PL+VjfQaqHo8iQjptP94snu7b9n6IaddiBju/d1x32AUajzj5tT558XEsEe5l56PEgalSaHa/lXU2pzgYufcYvsYxZ8MV/Svwrc8+wyeoASHna64WWstT05yGuiqEvIoOoDgnLXRMeoWir8ruuls/U28kgzEEnEg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: garmin-token-chave
+      namespace: escolinha-prod
@@ -55,8 +55,14 @@ spec:
            secretKeyRef:
              name: garmin-oauth
              key: GARMIN_CLIENT_SECRET
+        - name: ATM_GARMIN_TOKEN_CHAVE
+          valueFrom:
+            secretKeyRef:
+              name: garmin-token-chave
+              key: chave
+              optional: true
        - name: ATM_AUDITORIA_RETENCAO_DIAS
-          value: '730'
+          value: '1825'   # 5 anos (P6.3/P6.4, 2026-09-29); era 730
        - name: ATM_PLANO
          value: institucional
        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: resumo-credentials
+  namespace: piloto-prod
+spec:
+  encryptedData:
+    token: AgBxIXlTUuCAyEnn0EZwl/18VXqrfvPqJxSHPlp2zmMFlyqO5kiKnpqJFzUdEfpGnwSgPOCj84NeZbhQRfP13yQMzDEj3cfENJIXdgm+WQVjs5aX109CC47E06Kde1M7j6VCzIhARdNTPtZuycGYtRM8Ktv77HMiTbEwuO/Y5usdak00plGDwkyoxSRSOSVqMt23+4iaH7d/joSMlTNLCTR0kgHYqw2JN2hkjj6diPnwt7WMvtDkq/O3Osnf49cnbmOAVPdMO1hRMTmnfef97wS2xX3pMwjkbPgAn8KxvdP8NpQH1nMmAU1NT/eN3W7lYwh8ywdh/aX0UHzq+PPDqjLJ8jGolHgeve49txzUFIed7I1DB9bFfXRCBCpVoAfL51/2o2oP435KG4ZpgsAQB9oSPvbnYbbXrnIlELSoKSMVebTn5wkeNav1OhSvcZTRw5CNG+fbdF5vOV8DZRrwM1pprCjC2/Sky+vD+XYW9jcfw6Z4ljAsvAJfCbMzmUTjzT19XrmifvjNH3H78u+PECbJVr7k0uWz4wq/vdABsF2c9alwbof0vvtpelsCm0AdJ6VFBTzP5+yOEq0J+33yvXXwLCVLylTvvPNQvRD45zOMqdJoPAzqqSqlo6BI0rhJ8rVjJ2BIcB+JS/2i/2SHO257y5oCf5vEn5kZkbPPWFK9SPrOAZdcoJkG+M/bxrPFGkheZeEf3ao2ZuD9f/La/GqVVO1jnOVVsVDF+0EDDeR/oMvLCGGkY3ovcmw2
+  template:
+    metadata:
+      creationTimestamp: null
+      name: resumo-credentials
+      namespace: piloto-prod
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: garmin-token-chave
+  namespace: piloto-prod
+spec:
+  encryptedData:
+    chave: AgClanJahsdn8LyGiSj+oZ2VQKyJXnvjSW4/JtocCbmiRZbAQJqD9jrzXaVhH0cALq12FOH9t/L3qu3oSstWWND1Cb7aZw8VqgyeKC0dNKueXuDovui69Y4IAij1v3XE/4PdPu/LukhoxVCvdzCX4f3kjchPuiaWHJLtE6sIs3R6h11yg4XcFQrJhweLMo/hATGByKZhBGmIeTwEM8pCflVSIxk9saabewJtXrSKFExQ1smz9JiOEp43D/LZhVcoE4LYwXgo2BKuAaBphGQBu0CzdTvK99K5FS7foEWfu0Z2xN6+P+XNqI4nX9o3C3IEy5Z6GJrxX1h8bxMgob0hKZbXsCoCxygAVwfLahyV8kNItx57PRaE8vjFTU2SyT1KQ2r2KHDeUtz858LgUkSOw9rrSAvHZdEltMXNWehUqtImRBCmNlm5YXmX4exVHWc/v4n1V+CtAOkSWU4Ao0VSjJCEVaCqdO/gtpvjvKsdyTDf79GhlfH9Blttu28l8M1MahnqyzdL4cXupwozgkRipz6keywAMKau5377JO6EoF0UwBnnVD3D82pswA2NW7UbrTrE4si4aI3ZEs6KfputrXiU8Xteis24Xmjs9/nl902+3YVUEnomDoanUQHK5WKh5/aWva2vSeeAX51PK8GELqHntAr2eX2fjw+JbpI/2I31EUeHXgOko15BEVwEngEZVVZ9AW+Y/DlM0xIg66y6qfTUGzVx3QFm7in6i47yy4JptldqwW7EHeVyKau59g==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: garmin-token-chave
+      namespace: piloto-prod
@@ -57,8 +57,14 @@ spec:
            secretKeyRef:
              name: garmin-oauth
              key: GARMIN_CLIENT_SECRET
+        - name: ATM_GARMIN_TOKEN_CHAVE
+          valueFrom:
+            secretKeyRef:
+              name: garmin-token-chave
+              key: chave
+              optional: true
        - name: ATM_AUDITORIA_RETENCAO_DIAS
-          value: '730'
+          value: '1825'   # 5 anos (P6.3/P6.4, 2026-09-29); era 730
        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
          value: '10'
        resources:
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: resumo-chave
+  namespace: plataforma-prod
+spec:
+  encryptedData:
+    chave: AgAAoj8cqXO0T7BHtFVqgxgVRBZuC7trDTivNE8N/pRzkJhz7/8wE266lY5HfO6G5aEaBupyWx2iwp2c5pTvI0s8NTNZFcqYDhFJWmMs75+4WDgDPAUXlUDVJsBP5cJDOEVefQJjhKJohFFT3nLJuWjvncHJ9cQybDJBqgBnY9QOS0Cl0S7SRkvOe9ls3/nq0Z4tNZfzRLBz0aQBooEE+7qT8p6gsnQubjwFyl3Wyx4cKReXRVZKN42zFlzQuY9+ZmL12ULv/7mj19VjGCdqKKR73ZOgLa4kmZjsSfCz/5fRUG6bTNDA4Paf4fAZG0vIj96SZejg389+ho43tjNxg4VqL8bBGsPaN/5uqiBu1ZTu8TxUB0t7XKKebm3H2rj1kiQOI3426S4akT2tj5rWGlMH3gFdG0TMWKKb2rQM7qxVKOYXS/+/7PTgQrPhpJIFShsnH2xPK1UyzvzIKnHIN8Pkl/UQUs72YYPZb7WQJup7qSOBttjAo/9PIKRGzCdoLVDxBV4x0oPznl6aUghPlQays9BRirYc9JULoZl91w5WsYmb6Z27n43bOei4pN7aRXhGFP7z/3lH/QnLKaHMkuEh6wH9kUeNtR6nFwh2fZCx4qZL2aP2PkLy/kS/L7RfckKxak6vF5scGPuvY8LtbOxlQyzEzIU6qaj4hKlqp3eXWllJ9stlY625d9xYfb3DTcdoX+s1zdVq+oLb9j749w9psMb6JakByVbJZJyknn0zeeQYnKHsZWIGBK8Tifts/dUPWFuvUbv9kBqzGC9pJdI=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: resumo-chave
+      namespace: plataforma-prod
@@ -85,6 +85,12 @@ spec:
          volumeMounts:
            - { name: gitops, mountPath: /gitops }
          env:
+            # N16 — a chave de que sai o token de CADA tenant (HMAC do nome; ChaveDoResumo).
+            # Sem ela o captacao recusa todo resumo (401) e o provisionamento nao sela o
+            # resumo-credentials do tenant novo. Selada em 08-sealed-resumo-chave.yaml.
+            - name: RESUMO_CHAVE
+              valueFrom:
+                secretKeyRef: { name: resumo-chave, key: chave, optional: true }
            # E-mail dos LOGINS dos realms que o provisionamento cria (EtapaCriarRealm).
            # Caixa propria, fora da cota da nao-responda@. Senha no SealedSecret smtp-logins.
            - { name: SMTP_LOGINS_USUARIO, value: "acesso@athleticmap.com" }