From 9f3d81729dd6b6d3e902ca02a55fc6d02f99abd0 Mon Sep 17 00:00:00 2001
From: Ryan Blundon <ryan.blundon@protonmail.com>
Date: Mon, 25 May 2026 20:43:03 -0500
Subject: [PATCH] fix(jarvis): run as root for NFS compat, add namespace PSA
 baseline label

---
 cluster/applications/jarvis/deployment.yaml | 25 ++++++++-------------
 cluster/applications/jarvis/namespace.yaml  |  9 ++++++++
 2 files changed, 18 insertions(+), 16 deletions(-)
 create mode 100644 cluster/applications/jarvis/namespace.yaml

diff --git a/cluster/applications/jarvis/deployment.yaml b/cluster/applications/jarvis/deployment.yaml
index 645bbee..65a944b 100644
--- a/cluster/applications/jarvis/deployment.yaml
+++ b/cluster/applications/jarvis/deployment.yaml
@@ -35,23 +35,13 @@ spec:
       labels:
         app: jarvis
     spec:
+      # Running as root to work around NFS root_squash preventing UID 10000
+      # from writing to the PVC. Hermes supports root execution.
+      # PSA namespace must be set to baseline or privileged for this to work.
       securityContext:
+        runAsUser: 0
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: fix-ownership
-          image: busybox
-          command: ["sh", "-c", "chown -R 10000:10000 /opt/data"]
-          securityContext:
-            runAsNonRoot: false
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-              add: ["CHOWN"]
-          volumeMounts:
-            - name: data
-              mountPath: /opt/data
       containers:
         - name: hermes
           image: nousresearch/hermes-agent:latest
@@ -60,8 +50,7 @@ spec:
             - containerPort: 8642
               name: gateway
           securityContext:
-            runAsNonRoot: true
-            runAsUser: 10000
+            runAsUser: 0
             allowPrivilegeEscalation: false
             capabilities:
               drop: ["ALL"]
@@ -74,6 +63,10 @@ spec:
               value: "0.0.0.0"
             - name: API_SERVER_CORS_ORIGINS
               value: "*"
+            - name: HERMES_UID
+              value: "0"
+            - name: HERMES_GID
+              value: "0"
           volumeMounts:
             - name: data
               mountPath: /opt/data
diff --git a/cluster/applications/jarvis/namespace.yaml b/cluster/applications/jarvis/namespace.yaml
new file mode 100644
index 0000000..4b30ebc
--- /dev/null
+++ b/cluster/applications/jarvis/namespace.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jarvis
+  labels:
+    # baseline PSA required — Hermes runs as root due to NFS root_squash
+    # preventing UID 10000 from writing to nfs-emporium PVC.
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: baseline