- Updated pod.spec.securityContext and all container/initContainer securityContext to be fully compliant with restricted:latest (runAsNonRoot: true, allowPrivilegeEscalation: false, runAsUser: 1000, capabilities drop ALL, seccomp RuntimeDefault, fsGroup)
- Changed initContainer from root chown to non-root mkdir/chmod relying on fsGroup (avoids PSA violation)
- Updated default model to grok-4.20-0309-reasoning (per xAI switch note)
- Added automountServiceAccountToken: false and imagePullPolicy for best practices (matches openclaw deployment pattern)
- hermes-webui now runs as non-root with WANTED_UID matching
This should resolve the container not starting. Leave PR open for review before merge.
Enables /v1/models endpoint query for custom providers (fixes qwen model not showing under qwen-vllm).
Changes:
- Added `type: openai` to `rtx6000-brain` and `qwen-vllm` providers
- Standardized base_url to full FQDN: \*.customer1.svc.cluster.local
- Added context_length to qwen-vllm provider
- Updated models.qwen-vllm base_url and context_length for consistency
- Makes rtx6000-brain selectable in the /model provider picker (preferred name)
- Uses short Kubernetes service names (optimal for same-namespace)
- Keeps existing models: section for CLI compatibility
- Will appear as provider options after ArgoCD/Helm rollout + /restart
- Primary 'vllm' entry for easy /model vllm usage
- Uses model from the rtx6000 deployment
- Kept existing qwen-vllm, rtx6000-vllm, and rtx6000-brain for compatibility
Added rtx6000-brain alongside the existing rtx6000-vllm entry.
Uses the exact model name from rtx6000-vllm Deployment and the correct ClusterIP service endpoint.
