diff --git a/moldes/consolidado/00-namespace-quota-netpol.yaml b/moldes/consolidado/00-namespace-quota-netpol.yaml index fbefd99..9815719 100644 --- a/moldes/consolidado/00-namespace-quota-netpol.yaml +++ b/moldes/consolidado/00-namespace-quota-netpol.yaml @@ -164,6 +164,8 @@ spec: - { protocol: TCP, port: 8080 } # captacao (N16, 2026-09-29): o resumo diario vai pelo Service interno. - { protocol: TCP, port: 8083 } + # servico de voz (05/10/2026): transcricao pelo BFF. + - { protocol: TCP, port: 8091 } # 4. HTTPS para a internet publica. Ver o cabecalho: nao da para estreitar # com flannel, e uma lista de CIDR de SaaS quebraria a cobranca sem aviso. diff --git a/moldes/consolidado/95-frontend-spa.yaml b/moldes/consolidado/95-frontend-spa.yaml index 7d792d7..c20edae 100644 --- a/moldes/consolidado/95-frontend-spa.yaml +++ b/moldes/consolidado/95-frontend-spa.yaml @@ -104,6 +104,7 @@ spec: - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/{{REALM}}" } - { name: ATM_TENANT, value: "{{TENANT}}" } - { name: ATM_PLANO, value: "{{PLANO}}" } + - { name: ATM_TRANSCRICAO_URL, value: "http://servico-voz.plataforma-prod.svc:8091" } # servico de voz (05/10/2026) # `optional` porque o molde ainda NAO cria este Secret. Sem ele o # selo de consentimento simplesmente nao e emitido — o BFF sobe e # funciona (ver SeloDeConsentimento, que trata segredo vazio). No dia diff --git a/tenants/acme/23-netpol-voz.yaml b/tenants/acme/23-netpol-voz.yaml new file mode 100644 index 0000000..e891a85 --- /dev/null +++ b/tenants/acme/23-netpol-voz.yaml @@ -0,0 +1,19 @@ +# Servico de voz (05/10/2026): saida do BFF (pod frontend-spa) para a transcricao na plataforma. +# Par da 24-netpol-tenants-na-voz da plataforma. Tenant novo: a porta 8091 esta no 00- do molde. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-voz + namespace: acme-prod +spec: + podSelector: + matchLabels: { app: frontend-spa } + policyTypes: [Egress] + egress: + - to: + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: plataforma-prod } + podSelector: + matchLabels: { app: servico-voz } + ports: + - { protocol: TCP, port: 8091 } diff --git a/tenants/acme/95-frontend-spa.yaml b/tenants/acme/95-frontend-spa.yaml index 6466156..2df22ca 100644 --- a/tenants/acme/95-frontend-spa.yaml +++ b/tenants/acme/95-frontend-spa.yaml @@ -90,6 +90,7 @@ spec: valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } } - { name: ATM_TENANT, value: "acme" } - { name: ATM_PLANO, value: "prata" } + - { name: ATM_TRANSCRICAO_URL, value: "http://servico-voz.plataforma-prod.svc:8091" } # servico de voz (05/10/2026) - { name: GARMIN_FRONTEND_REDIRECT, value: "https://acme.athleticmap.com/integracoes/garmin" } resources: requests: { cpu: 50m, memory: 256Mi } diff --git a/tenants/demo/23-netpol-voz.yaml b/tenants/demo/23-netpol-voz.yaml new file mode 100644 index 0000000..d9b76d9 --- /dev/null +++ b/tenants/demo/23-netpol-voz.yaml @@ -0,0 +1,19 @@ +# Servico de voz (05/10/2026): saida do BFF (pod frontend-spa) para a transcricao na plataforma. +# Par da 24-netpol-tenants-na-voz da plataforma. Tenant novo: a porta 8091 esta no 00- do molde. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-voz + namespace: demo-prod +spec: + podSelector: + matchLabels: { app: frontend-spa } + policyTypes: [Egress] + egress: + - to: + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: plataforma-prod } + podSelector: + matchLabels: { app: servico-voz } + ports: + - { protocol: TCP, port: 8091 } diff --git a/tenants/demo/95-frontend-spa.yaml b/tenants/demo/95-frontend-spa.yaml index 29b2ad4..c113a63 100644 --- a/tenants/demo/95-frontend-spa.yaml +++ b/tenants/demo/95-frontend-spa.yaml @@ -90,6 +90,7 @@ spec: valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } } - { name: ATM_TENANT, value: "demo" } - { name: ATM_PLANO, value: "bronze" } + - { name: ATM_TRANSCRICAO_URL, value: "http://servico-voz.plataforma-prod.svc:8091" } # servico de voz (05/10/2026) - { name: GARMIN_FRONTEND_REDIRECT, value: "https://demo.athleticmap.com/integracoes/garmin" } resources: requests: { cpu: 50m, memory: 256Mi } diff --git a/tenants/escolinha/23-netpol-voz.yaml b/tenants/escolinha/23-netpol-voz.yaml new file mode 100644 index 0000000..6e6fd4e --- /dev/null +++ b/tenants/escolinha/23-netpol-voz.yaml @@ -0,0 +1,19 @@ +# Servico de voz (05/10/2026): saida do BFF (pod frontend-spa) para a transcricao na plataforma. +# Par da 24-netpol-tenants-na-voz da plataforma. Tenant novo: a porta 8091 esta no 00- do molde. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-voz + namespace: escolinha-prod +spec: + podSelector: + matchLabels: { app: frontend-spa } + policyTypes: [Egress] + egress: + - to: + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: plataforma-prod } + podSelector: + matchLabels: { app: servico-voz } + ports: + - { protocol: TCP, port: 8091 } diff --git a/tenants/escolinha/95-frontend-spa.yaml b/tenants/escolinha/95-frontend-spa.yaml index 65a134c..5c30114 100644 --- a/tenants/escolinha/95-frontend-spa.yaml +++ b/tenants/escolinha/95-frontend-spa.yaml @@ -90,6 +90,7 @@ spec: valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } } - { name: ATM_TENANT, value: "escolinha" } - { name: ATM_PLANO, value: "institucional" } + - { name: ATM_TRANSCRICAO_URL, value: "http://servico-voz.plataforma-prod.svc:8091" } # servico de voz (05/10/2026) - { name: GARMIN_FRONTEND_REDIRECT, value: "https://escolinha.athleticmap.com/integracoes/garmin" } resources: requests: { cpu: 50m, memory: 256Mi } diff --git a/tenants/piloto/23-netpol-voz.yaml b/tenants/piloto/23-netpol-voz.yaml new file mode 100644 index 0000000..1cdae57 --- /dev/null +++ b/tenants/piloto/23-netpol-voz.yaml @@ -0,0 +1,19 @@ +# Servico de voz (05/10/2026): saida do BFF (pod frontend-spa) para a transcricao na plataforma. +# Par da 24-netpol-tenants-na-voz da plataforma. Tenant novo: a porta 8091 esta no 00- do molde. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-voz + namespace: piloto-prod +spec: + podSelector: + matchLabels: { app: frontend-spa } + policyTypes: [Egress] + egress: + - to: + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: plataforma-prod } + podSelector: + matchLabels: { app: servico-voz } + ports: + - { protocol: TCP, port: 8091 } diff --git a/tenants/piloto/95-frontend-spa.yaml b/tenants/piloto/95-frontend-spa.yaml index 8c1761f..5686879 100644 --- a/tenants/piloto/95-frontend-spa.yaml +++ b/tenants/piloto/95-frontend-spa.yaml @@ -90,6 +90,7 @@ spec: valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } } - { name: ATM_TENANT, value: "piloto" } - { name: ATM_PLANO, value: "institucional" } + - { name: ATM_TRANSCRICAO_URL, value: "http://servico-voz.plataforma-prod.svc:8091" } # servico de voz (05/10/2026) - { name: GARMIN_FRONTEND_REDIRECT, value: "https://piloto.athleticmap.com/integracoes/garmin" } resources: requests: { cpu: 50m, memory: 256Mi } diff --git a/tenants/plataforma/24-netpol-tenants-na-voz.yaml b/tenants/plataforma/24-netpol-tenants-na-voz.yaml new file mode 100644 index 0000000..9220ec6 --- /dev/null +++ b/tenants/plataforma/24-netpol-tenants-na-voz.yaml @@ -0,0 +1,26 @@ +# Servico de voz (05/10/2026): so o BFF dos tenants chega a porta 8091. Mesmo padrao do 23-netpol-tenants-no-captacao: +# tenants novos pelo label, os 4 antigos pelo nome. Nenhum outro pod da plataforma fica exposto. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: tenants-na-voz + namespace: plataforma-prod +spec: + podSelector: + matchLabels: { app: servico-voz } + policyTypes: [Ingress] + ingress: + - from: + - namespaceSelector: + matchExpressions: + - { key: athleticmap.io/tenant, operator: Exists } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: piloto-prod } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: demo-prod } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: acme-prod } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: escolinha-prod } + ports: + - { protocol: TCP, port: 8091 } diff --git a/tenants/plataforma/25-servico-voz.yaml b/tenants/plataforma/25-servico-voz.yaml new file mode 100644 index 0000000..04e7710 --- /dev/null +++ b/tenants/plataforma/25-servico-voz.yaml @@ -0,0 +1,51 @@ +# Servico de voz (transcricao de AUDIO JA GRAVADO, portugues) — faster-whisper, modelo `small`, CPU int8. +# Fonte: services/servico-voz do repositorio de codigo. Um so para todos os tenants: quem chama e o BFF de cada +# tenant (`ATM_TRANSCRICAO_URL`), nunca o navegador. SEM Ingress: a protecao e a rede (24-netpol-tenants-na-voz). +# O audio so existe em memoria/arquivo temporario durante a transcricao; o texto nao vai para log. +# Uma transcricao por vez (o modelo usa 3 threads); 1 min de audio leva ~20-40 s de CPU. +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: servico-voz + namespace: plataforma-prod + labels: { app: servico-voz } +spec: + replicas: 1 + selector: { matchLabels: { app: servico-voz } } + template: + metadata: + labels: { app: servico-voz } + spec: + securityContext: { runAsNonRoot: true, runAsUser: 10001 } + containers: + - name: servico-voz + image: docker.io/library/servico-voz:1.1-small + imagePullPolicy: Never + ports: [{ containerPort: 8091 }] + env: + - { name: ATM_VOZ_MODELO, value: "small" } + - { name: ATM_VOZ_THREADS, value: "3" } + - { name: ATM_VOZ_MAX_MB, value: "25" } + resources: + requests: { cpu: 200m, memory: 600Mi } + limits: { cpu: "3", memory: 2Gi } + readinessProbe: + httpGet: { path: /saude, port: 8091 } + initialDelaySeconds: 15 + periodSeconds: 10 + livenessProbe: + httpGet: { path: /saude, port: 8091 } + initialDelaySeconds: 60 + periodSeconds: 30 + failureThreshold: 4 +--- +apiVersion: v1 +kind: Service +metadata: + name: servico-voz + namespace: plataforma-prod + labels: { app: servico-voz } +spec: + selector: { app: servico-voz } + ports: [{ name: http, port: 8091, targetPort: 8091 }]