atlas-iac/services/hermes/voice-deployment.yaml

# services/hermes/voice-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-stt
  namespace: hermes
  labels:
    app: hermes-stt
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-stt
  template:
    metadata:
      labels:
        app: hermes-stt
      annotations:
        ai.bstein.dev/role: private-chat-speech-to-text
        ai.bstein.dev/model: whisper-turbo
        ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
    spec:
      runtimeClassName: nvidia
      automountServiceAccountToken: false
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: stt
          image: registry.bstein.dev/bstein/hermes-jetson-stt@sha256:d70bc0892bfce7dc474b24c62d2427a22c6022d0d406c349fcb83d82130de768
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9000, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_STT_PORT, value: "9000"}
            - {name: HERMES_STT_MODEL, value: large-v3-turbo}
            - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
            - {name: NVIDIA_VISIBLE_DEVICES, value: all}
            - {name: NVIDIA_DRIVER_CAPABILITIES, value: compute,utility}
            - {name: JETSON_JETPACK, value: "5"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 90
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests:
              cpu: "2"
              memory: 4Gi
              nvidia.com/gpu.shared: 1
            limits:
              cpu: "6"
              memory: 10Gi
              nvidia.com/gpu.shared: 1
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-stt
  namespace: hermes
spec:
  selector:
    app: hermes-stt
  ports:
    - {name: http, port: 9000, targetPort: http, protocol: TCP}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-tts
  namespace: hermes
  labels:
    app: hermes-tts
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-tts
  template:
    metadata:
      labels:
        app: hermes-tts
      annotations:
        ai.bstein.dev/role: private-chat-text-to-speech
        ai.bstein.dev/model: piper-en-us-lessac-high
        ai.bstein.dev/gpu: CPU-only on routing node
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/hostname: titan-20
      containers:
        - name: tts
          image: registry.bstein.dev/bstein/hermes-jetson-tts@sha256:1020a73e8941932dd071e5dcc66b5583ebb9376f9ee2fd1711b50e026eb88467
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9001, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_TTS_PORT, value: "9001"}
            - {name: HERMES_TTS_VOICE, value: en_US-lessac-high}
            - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests: {cpu: 500m, memory: 512Mi}
            limits: {cpu: "2", memory: 2Gi}
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-tts
  namespace: hermes
spec:
  selector:
    app: hermes-tts
  ports:
    - {name: http, port: 9001, targetPort: http, protocol: TCP}