From 495638903ae44283cd5207df32b96ab850c07d4c Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Mon, 10 Aug 2026 00:49:52 -0300
Subject: [PATCH] fix(hermes): isolate voice runtime environment

---
 services/hermes/voice-deployment.yaml     | 6 ++++++
 testing/tests/test_hermes_chat_quality.py | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/services/hermes/voice-deployment.yaml b/services/hermes/voice-deployment.yaml
index 63f087c2f..a65854f5b 100644
--- a/services/hermes/voice-deployment.yaml
+++ b/services/hermes/voice-deployment.yaml
@@ -23,6 +23,8 @@ spec:
         ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
     spec:
       runtimeClassName: nvidia
+      automountServiceAccountToken: false
+      enableServiceLinks: false
       nodeSelector:
         kubernetes.io/hostname: titan-21
       containers:
@@ -34,6 +36,7 @@ spec:
           env:
             - {name: HOME, value: /tmp}
             - {name: XDG_CACHE_HOME, value: /tmp/cache}
+            - {name: HERMES_STT_PORT, value: "9000"}
             - {name: HERMES_STT_MODEL, value: large-v3-turbo}
             - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
             - {name: NVIDIA_VISIBLE_DEVICES, value: all}
@@ -112,6 +115,8 @@ spec:
         ai.bstein.dev/model: piper-en-us-lessac-high
         ai.bstein.dev/gpu: CPU-only on routing node
     spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
       nodeSelector:
         kubernetes.io/hostname: titan-20
       containers:
@@ -123,6 +128,7 @@ spec:
           env:
             - {name: HOME, value: /tmp}
             - {name: XDG_CACHE_HOME, value: /tmp/cache}
+            - {name: HERMES_TTS_PORT, value: "9001"}
             - {name: HERMES_TTS_VOICE, value: en_US-lessac-high}
             - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
           startupProbe:
diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py
index 71fc1819c..2453209ba 100644
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@@ -225,6 +225,10 @@ def test_voice_workloads_have_deliberate_xavier_placement():
     assert "@sha256:" in tts["containers"][0]["image"]
     assert stt["nodeSelector"] == {"kubernetes.io/hostname": "titan-21"}
     assert tts["nodeSelector"] == {"kubernetes.io/hostname": "titan-20"}
+    assert stt["automountServiceAccountToken"] is False
+    assert tts["automountServiceAccountToken"] is False
+    assert stt["enableServiceLinks"] is False
+    assert tts["enableServiceLinks"] is False
     assert stt["runtimeClassName"] == "nvidia"
     stt_resources = stt["containers"][0]["resources"]
     assert stt_resources["requests"]["nvidia.com/gpu.shared"] == 1