From 8a6b954b3297aa489943484e6d2c7ee57214b54c Mon Sep 17 00:00:00 2001
From: Dalton Alvarenga <dalton.alvarenga@familiapires.com.br>
Date: Tue, 11 Aug 2026 19:14:48 -0300
Subject: [PATCH] [lab] fix(k8s): fsGroup/non-root no overlay de lab p/ imagem
 uid 10001
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A imagem passou a rodar non-root (uid/gid 10001), mas o overlay de lab não
tinha securityContext/fsGroup — os dirs do PVC (chroma_db, data_storage)
ficavam root:root e a escrita do ChromaDB/CSV falhava com Permission denied
(pod subia e /health respondia, mas query quebraria). Alinha o lab ao hml:
- pod securityContext runAsNonRoot + runAsUser/Group/fsGroup 10001
- container: allowPrivilegeEscalation:false, drop ALL
- HOME=/home/app e cache ONNX montado em /home/app/.cache/chroma

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 k8s/lab/deployment.yaml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/k8s/lab/deployment.yaml b/k8s/lab/deployment.yaml
index 1592c6c..dd4e6b9 100644
--- a/k8s/lab/deployment.yaml
+++ b/k8s/lab/deployment.yaml
@@ -16,14 +16,28 @@ spec:
       labels:
         app: vanna-clubpetro
     spec:
+      # A imagem roda como non-root (uid/gid 10001). fsGroup dá posse dos
+      # volumes (PVC) ao grupo 10001 pra que o processo consiga escrever no
+      # store/cache — sem isso o ChromaDB/CSV falha com Permission denied.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
       containers:
         - name: vanna-clubpetro
           image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/vanna-clubpetro:lab-latest
           imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           ports:
             - name: http
               containerPort: 8765
           env:
+            - name: HOME
+              value: /home/app
             - name: VANNA_CORS_ORIGINS
               value: "https://lab.clubpetro.com,https://homologation.clubpetro.com"
           envFrom:
@@ -57,7 +71,7 @@ spec:
               mountPath: /app/data_storage
               subPath: data_storage
             - name: data
-              mountPath: /root/.cache/chroma
+              mountPath: /home/app/.cache/chroma
               subPath: chroma-onnx-cache
       volumes:
         - name: data
-- 
2.45.2