k8s/lab/deployment.yaml

@@ -16,28 +16,14 @@ spec:
       labels:
         app: vanna-clubpetro
     spec:
-      # A imagem roda como non-root (uid/gid 10001). fsGroup dá posse dos
-      # volumes (PVC) ao grupo 10001 pra que o processo consiga escrever no
-      # store/cache — sem isso o ChromaDB/CSV falha com Permission denied.
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 10001
-        runAsGroup: 10001
-        fsGroup: 10001
       containers:
         - name: vanna-clubpetro
           image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/vanna-clubpetro:lab-latest
           imagePullPolicy: IfNotPresent
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
           ports:
             - name: http
               containerPort: 8765
           env:
-            - name: HOME
-              value: /home/app
             - name: VANNA_CORS_ORIGINS
               value: "https://lab.clubpetro.com,https://homologation.clubpetro.com"
           envFrom:
@@ -71,7 +57,7 @@ spec:
               mountPath: /app/data_storage
               subPath: data_storage
             - name: data
-              mountPath: /home/app/.cache/chroma
+              mountPath: /root/.cache/chroma
               subPath: chroma-onnx-cache
       volumes:
         - name: data