Dalton Alvarenga
f4a2ee44ca
All checks were successful
CD / build (pull_request) Successful in 5m2s
Adequa o repo ao guia de promoção lab -> homolog mantendo Python (Gate 0 via stackException). Cumpre os gates aplicáveis: - promotion-manifest.yaml: stackException (Python/Vanna), Gate B N/A, Gate D/G declarados, capacidade e deltas. - k8s/hml/: overlay homolog — secret DB dedicado (vanna-clubpetro-db, Gate G), probes httpGet /health (Gate E), resources.requests, replicas:1, non-root securityContext; host homologation.clubpetro.com (sem host de lab). - server.py: rota GET /health (alvo das probes). - Dockerfile: usuário non-root uid/gid 10001 + HOME/cache graváveis (Gate E). - .env.example: remove literal lab.clubpetro.com do CORS (Gate D). - k8s/ flat movido para k8s/lab/ (simetria lab/hml); cd.yml aplica k8s/lab/. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
86 lines
2.7 KiB
YAML
86 lines
2.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: vanna-clubpetro-deployment
|
|
labels:
|
|
app: vanna-clubpetro
|
|
spec:
|
|
replicas: 1 # ChromaDB SQLite-based — múltiplas réplicas corrompem o vector store
|
|
strategy:
|
|
type: Recreate # com PVC ReadWriteOnce não dá pra ter 2 pods montando ao mesmo tempo
|
|
selector:
|
|
matchLabels:
|
|
app: vanna-clubpetro
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: vanna-clubpetro
|
|
spec:
|
|
# Gate E: pod roda como non-root. fsGroup dá posse dos volumes (PVC) ao
|
|
# grupo 10001 pra que o processo non-root consiga escrever no store/cache.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
containers:
|
|
- name: vanna-clubpetro
|
|
# A tag é sobrescrita pelo pipeline (kubectl set image). Placeholder:
|
|
image: us-central1-docker.pkg.dev/corepetro/clubpetro/vanna-clubpetro:hml-latest
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: http
|
|
containerPort: 8765
|
|
env:
|
|
- name: HOME
|
|
value: /home/app
|
|
- name: VANNA_CORS_ORIGINS
|
|
value: "https://homologation.clubpetro.com"
|
|
envFrom:
|
|
# Gate G: credenciais do ClickHouse num secret DEDICADO ao serviço.
|
|
- secretRef:
|
|
name: vanna-clubpetro-db
|
|
# Config de app (OpenAI, RLS defaults etc.) em secret separado.
|
|
- secretRef:
|
|
name: vanna-clubpetro-secret
|
|
resources:
|
|
requests:
|
|
cpu: "200m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "1"
|
|
memory: "2Gi"
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8765
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8765
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /app/chroma_db
|
|
subPath: chroma_db
|
|
- name: data
|
|
mountPath: /app/data_storage
|
|
subPath: data_storage
|
|
- name: data
|
|
mountPath: /home/app/.cache/chroma
|
|
subPath: chroma-onnx-cache
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: vanna-clubpetro-data
|