diff --git a/tenants/escolinha/17-netpol-keycloak-compartilhado.yaml b/tenants/escolinha/17-netpol-keycloak-compartilhado.yaml new file mode 100644 index 0000000..929862b --- /dev/null +++ b/tenants/escolinha/17-netpol-keycloak-compartilhado.yaml @@ -0,0 +1,26 @@ +# ============================================================================= +# Card 156 (2026-09-26): o realm deste tenant mora no Keycloak COMPARTILHADO +# (`plataforma-prod`), e os runtimes/BFF/CronJobs precisam alcanca-lo para +# baixar o JWKS e pedir token. A `deny-cross-tenant` deste namespace nao +# abria essa saida (os tenants provisionados ja nascem com ela). O outro lado +# e o `16-netpol-tenants-no-keycloak.yaml` do plataforma. +# +# namespaceSelector + podSelector, e nao ipBlock: o controlador de rede do k3s +# avalia a politica DEPOIS do DNAT, com o IP do POD — ClusterIP nao serve. +# ============================================================================= +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-keycloak-compartilhado + namespace: escolinha-prod +spec: + podSelector: {} + policyTypes: [Egress] + egress: + - to: + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: plataforma-prod } + podSelector: + matchLabels: { app: keycloak } + ports: + - { protocol: TCP, port: 8080 } diff --git a/tenants/escolinha/20-keycloak.yaml b/tenants/escolinha/20-keycloak.yaml index d295e64..2700891 100644 --- a/tenants/escolinha/20-keycloak.yaml +++ b/tenants/escolinha/20-keycloak.yaml @@ -5,7 +5,7 @@ metadata: name: keycloak namespace: escolinha-prod spec: - replicas: 1 + replicas: 0 selector: matchLabels: app: keycloak diff --git a/tenants/escolinha/30-apps-stubs.yaml b/tenants/escolinha/30-apps-stubs.yaml index 47e0b10..b1bc32d 100644 --- a/tenants/escolinha/30-apps-stubs.yaml +++ b/tenants/escolinha/30-apps-stubs.yaml @@ -17,8 +17,8 @@ spec: image: docker.io/library/athletic-map-backend:1.3 imagePullPolicy: Never env: - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } ports: [{ containerPort: 8083 }] readinessProbe: diff --git a/tenants/escolinha/55-cronjobs-financeiro.yaml b/tenants/escolinha/55-cronjobs-financeiro.yaml index 2c3cd99..18be401 100644 --- a/tenants/escolinha/55-cronjobs-financeiro.yaml +++ b/tenants/escolinha/55-cronjobs-financeiro.yaml @@ -88,9 +88,9 @@ spec: exec /bin/sh /script/disparar.sh env: - name: KEYCLOAK_URL - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/token - name: ISSUER_HOST - value: auth-escolinha.athleticmap.com + value: auth.athleticmap.com - name: CLIENT_SECRET valueFrom: secretKeyRef: @@ -133,9 +133,9 @@ spec: command: ["/bin/sh", "/script/disparar.sh"] env: - name: KEYCLOAK_URL - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/token - name: ISSUER_HOST - value: auth-escolinha.athleticmap.com + value: auth.athleticmap.com - name: ALVO value: http://servico-financeiro/api/financeiro/notas/processar?limite=50 - name: CLIENT_SECRET @@ -180,9 +180,9 @@ spec: command: ["/bin/sh", "/script/disparar.sh"] env: - name: KEYCLOAK_URL - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/token + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/token - name: ISSUER_HOST - value: auth-escolinha.athleticmap.com + value: auth.athleticmap.com - name: ALVO value: http://servico-financeiro/api/financeiro/conciliacao?limiteEventos=100&limiteCobrancas=100 - name: CLIENT_SECRET diff --git a/tenants/escolinha/65-runtime-core.yaml b/tenants/escolinha/65-runtime-core.yaml index b45f9dc..8904447 100644 --- a/tenants/escolinha/65-runtime-core.yaml +++ b/tenants/escolinha/65-runtime-core.yaml @@ -36,9 +36,9 @@ spec: name: db-credentials key: password - name: ATM_JWK_SET_URI - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs - name: ATM_ISSUER - value: https://auth-escolinha.athleticmap.com/realms/athleticmap + value: https://auth.athleticmap.com/realms/athleticmap-4 - name: ATM_TENANT value: escolinha - name: ATM_KC_ADMIN_ENABLED diff --git a/tenants/escolinha/66-runtime-operacao.yaml b/tenants/escolinha/66-runtime-operacao.yaml index 71ebf79..ebef4d2 100644 --- a/tenants/escolinha/66-runtime-operacao.yaml +++ b/tenants/escolinha/66-runtime-operacao.yaml @@ -36,9 +36,9 @@ spec: name: db-credentials key: password - name: ATM_JWK_SET_URI - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs - name: ATM_ISSUER - value: https://auth-escolinha.athleticmap.com/realms/athleticmap + value: https://auth.athleticmap.com/realms/athleticmap-4 - name: ATM_TENANT value: escolinha - name: ATM_PLANO diff --git a/tenants/escolinha/67-runtime-saude.yaml b/tenants/escolinha/67-runtime-saude.yaml index f3bb160..0492cfb 100644 --- a/tenants/escolinha/67-runtime-saude.yaml +++ b/tenants/escolinha/67-runtime-saude.yaml @@ -36,9 +36,9 @@ spec: name: db-credentials key: password - name: ATM_JWK_SET_URI - value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs + value: http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs - name: ATM_ISSUER - value: https://auth-escolinha.athleticmap.com/realms/athleticmap + value: https://auth.athleticmap.com/realms/athleticmap-4 - name: ATM_TENANT value: escolinha - name: GARMIN_REDIRECT_URI diff --git a/tenants/escolinha/70-servico-configuracao.yaml b/tenants/escolinha/70-servico-configuracao.yaml index 95dbb85..1755c17 100644 --- a/tenants/escolinha/70-servico-configuracao.yaml +++ b/tenants/escolinha/70-servico-configuracao.yaml @@ -31,8 +31,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 320Mi } diff --git a/tenants/escolinha/72-servico-organizacao.yaml b/tenants/escolinha/72-servico-organizacao.yaml index f014841..03ea03b 100644 --- a/tenants/escolinha/72-servico-organizacao.yaml +++ b/tenants/escolinha/72-servico-organizacao.yaml @@ -30,8 +30,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 320Mi } diff --git a/tenants/escolinha/74-servico-planejamento.yaml b/tenants/escolinha/74-servico-planejamento.yaml index 96c2297..6659bd8 100644 --- a/tenants/escolinha/74-servico-planejamento.yaml +++ b/tenants/escolinha/74-servico-planejamento.yaml @@ -30,8 +30,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 320Mi } diff --git a/tenants/escolinha/76-servico-campeonato.yaml b/tenants/escolinha/76-servico-campeonato.yaml index 56738e0..f988617 100644 --- a/tenants/escolinha/76-servico-campeonato.yaml +++ b/tenants/escolinha/76-servico-campeonato.yaml @@ -30,8 +30,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 320Mi } diff --git a/tenants/escolinha/78-servico-saude.yaml b/tenants/escolinha/78-servico-saude.yaml index 02e87e7..ff02198 100644 --- a/tenants/escolinha/78-servico-saude.yaml +++ b/tenants/escolinha/78-servico-saude.yaml @@ -30,8 +30,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } # Garmin: DNS devolve IPv6 primeiro e a rota IPv6 do cluster falha; forcar IPv4. - { name: JAVA_TOOL_OPTIONS, value: "-Djava.net.preferIPv4Stack=true" } diff --git a/tenants/escolinha/79-servico-financeiro.yaml b/tenants/escolinha/79-servico-financeiro.yaml index f544b5d..e8ef073 100644 --- a/tenants/escolinha/79-servico-financeiro.yaml +++ b/tenants/escolinha/79-servico-financeiro.yaml @@ -30,8 +30,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } - { name: ATM_PLANO, value: "institucional" } resources: diff --git a/tenants/escolinha/80-servico-cadastro.yaml b/tenants/escolinha/80-servico-cadastro.yaml index f0b4adb..72ad9c3 100644 --- a/tenants/escolinha/80-servico-cadastro.yaml +++ b/tenants/escolinha/80-servico-cadastro.yaml @@ -31,8 +31,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } - { name: ATM_KC_ADMIN_ENABLED, value: "true" } - name: ATM_KC_CLIENT_SECRET diff --git a/tenants/escolinha/81-servico-documentos.yaml b/tenants/escolinha/81-servico-documentos.yaml index bd96967..c24ad67 100644 --- a/tenants/escolinha/81-servico-documentos.yaml +++ b/tenants/escolinha/81-servico-documentos.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/82-servico-administrativo.yaml b/tenants/escolinha/82-servico-administrativo.yaml index 178eb82..0fb89c7 100644 --- a/tenants/escolinha/82-servico-administrativo.yaml +++ b/tenants/escolinha/82-servico-administrativo.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/83-servico-assistencia-social.yaml b/tenants/escolinha/83-servico-assistencia-social.yaml index cd7e0dc..8a6a2d6 100644 --- a/tenants/escolinha/83-servico-assistencia-social.yaml +++ b/tenants/escolinha/83-servico-assistencia-social.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/84-servico-pedagogico.yaml b/tenants/escolinha/84-servico-pedagogico.yaml index dfe68c3..7db37b9 100644 --- a/tenants/escolinha/84-servico-pedagogico.yaml +++ b/tenants/escolinha/84-servico-pedagogico.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/85-servico-nutricao.yaml b/tenants/escolinha/85-servico-nutricao.yaml index 5e55967..7712b44 100644 --- a/tenants/escolinha/85-servico-nutricao.yaml +++ b/tenants/escolinha/85-servico-nutricao.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/86-servico-agenda.yaml b/tenants/escolinha/86-servico-agenda.yaml index 026b5b7..5bde5fa 100644 --- a/tenants/escolinha/86-servico-agenda.yaml +++ b/tenants/escolinha/86-servico-agenda.yaml @@ -26,8 +26,8 @@ spec: - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: { name: db-credentials, key: password } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - { name: ATM_TENANT, value: "escolinha" } resources: requests: { cpu: 50m, memory: 300Mi } diff --git a/tenants/escolinha/95-frontend-spa.yaml b/tenants/escolinha/95-frontend-spa.yaml index 2dad27c..d47182d 100644 --- a/tenants/escolinha/95-frontend-spa.yaml +++ b/tenants/escolinha/95-frontend-spa.yaml @@ -25,8 +25,8 @@ spec: imagePullPolicy: Never ports: [{ containerPort: 80 }] env: - - { name: ATM_KC_URL, value: "https://auth-escolinha.athleticmap.com" } - - { name: ATM_REALM, value: "athleticmap" } + - { name: ATM_KC_URL, value: "https://auth.athleticmap.com" } + - { name: ATM_REALM, value: "athleticmap-4" } - { name: ATM_CLIENT, value: "spa" } - { name: ATM_TENANT, value: "escolinha" } - { name: ATM_PLANO, value: "institucional" } @@ -84,8 +84,8 @@ spec: - { name: ATM_PEDAGOGICO_URL, value: "http://servico-pedagogico" } - { name: ATM_NUTRICAO_URL, value: "http://servico-nutricao" } - { name: ATM_AGENDA_URL, value: "http://servico-agenda" } - - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" } - - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.com/realms/athleticmap" } + - { name: ATM_JWK_SET_URI, value: "http://keycloak.plataforma-prod.svc:8080/realms/athleticmap-4/protocol/openid-connect/certs" } + - { name: ATM_ISSUER, value: "https://auth.athleticmap.com/realms/athleticmap-4" } - name: ATM_CONSENTIMENTO_SEGREDO valueFrom: { secretKeyRef: { name: consentimento-selo, key: segredo } } - { name: ATM_TENANT, value: "escolinha" }