2 Commits

Author	SHA1	Message	Date
Dalton Alvarenga	8a6b954b32	[lab] fix(k8s): fsGroup/non-root no overlay de lab p/ imagem uid 10001 ... A imagem passou a rodar non-root (uid/gid 10001), mas o overlay de lab não tinha securityContext/fsGroup — os dirs do PVC (chroma_db, data_storage) ficavam root:root e a escrita do ChromaDB/CSV falhava com Permission denied (pod subia e /health respondia, mas query quebraria). Alinha o lab ao hml: - pod securityContext runAsNonRoot + runAsUser/Group/fsGroup 10001 - container: allowPrivilegeEscalation:false, drop ALL - HOME=/home/app e cache ONNX montado em /home/app/.cache/chroma Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-08-11 19:14:48 -03:00
Dalton Alvarenga	f4a2ee44ca	[lab] chore(promotion): prepara serviço para gates lab -> homolog ... Adequa o repo ao guia de promoção lab -> homolog mantendo Python (Gate 0 via stackException). Cumpre os gates aplicáveis: - promotion-manifest.yaml: stackException (Python/Vanna), Gate B N/A, Gate D/G declarados, capacidade e deltas. - k8s/hml/: overlay homolog — secret DB dedicado (vanna-clubpetro-db, Gate G), probes httpGet /health (Gate E), resources.requests, replicas:1, non-root securityContext; host homologation.clubpetro.com (sem host de lab). - server.py: rota GET /health (alvo das probes). - Dockerfile: usuário non-root uid/gid 10001 + HOME/cache graváveis (Gate E). - .env.example: remove literal lab.clubpetro.com do CORS (Gate D). - k8s/ flat movido para k8s/lab/ (simetria lab/hml); cd.yml aplica k8s/lab/. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-08-11 18:50:22 -03:00