fix(hermes): isolate voice runtime environment

services/hermes/voice-deployment.yaml

@@ -23,6 +23,8 @@ spec:
         ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
     spec:
       runtimeClassName: nvidia
+      automountServiceAccountToken: false
+      enableServiceLinks: false
       nodeSelector:
         kubernetes.io/hostname: titan-21
       containers:
@@ -34,6 +36,7 @@ spec:
           env:
             - {name: HOME, value: /tmp}
             - {name: XDG_CACHE_HOME, value: /tmp/cache}
+            - {name: HERMES_STT_PORT, value: "9000"}
             - {name: HERMES_STT_MODEL, value: large-v3-turbo}
             - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
             - {name: NVIDIA_VISIBLE_DEVICES, value: all}
@@ -112,6 +115,8 @@ spec:
         ai.bstein.dev/model: piper-en-us-lessac-high
         ai.bstein.dev/gpu: CPU-only on routing node
     spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
       nodeSelector:
         kubernetes.io/hostname: titan-20
       containers:
@@ -123,6 +128,7 @@ spec:
           env:
             - {name: HOME, value: /tmp}
             - {name: XDG_CACHE_HOME, value: /tmp/cache}
+            - {name: HERMES_TTS_PORT, value: "9001"}
             - {name: HERMES_TTS_VOICE, value: en_US-lessac-high}
             - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
           startupProbe:

testing/tests/test_hermes_chat_quality.py

@@ -225,6 +225,10 @@ def test_voice_workloads_have_deliberate_xavier_placement():
     assert "@sha256:" in tts["containers"][0]["image"]
     assert stt["nodeSelector"] == {"kubernetes.io/hostname": "titan-21"}
     assert tts["nodeSelector"] == {"kubernetes.io/hostname": "titan-20"}
+    assert stt["automountServiceAccountToken"] is False
+    assert tts["automountServiceAccountToken"] is False
+    assert stt["enableServiceLinks"] is False
+    assert tts["enableServiceLinks"] is False
     assert stt["runtimeClassName"] == "nvidia"
     stt_resources = stt["containers"][0]["resources"]
     assert stt_resources["requests"]["nvidia.com/gpu.shared"] == 1