atlas-iac/services/hermes/voice-deployment.yaml

# services/hermes/voice-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-stt
  namespace: hermes
  labels:
    app: hermes-stt
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-stt
  template:
    metadata:
      labels:
        app: hermes-stt
      annotations:
        ai.bstein.dev/role: private-chat-speech-to-text
        ai.bstein.dev/model: whisper-turbo
        ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
    spec:
      runtimeClassName: nvidia
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: stt
          image: registry.bstein.dev/bstein/hermes-jetson-stt@sha256:a67494014716a65152b7595122b1717a742db206c6f556c740fecc110452f65b
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9000, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_STT_MODEL, value: large-v3-turbo}
            - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
            - {name: NVIDIA_VISIBLE_DEVICES, value: all}
            - {name: NVIDIA_DRIVER_CAPABILITIES, value: compute,utility}
            - {name: JETSON_JETPACK, value: "5"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 90
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests:
              cpu: "2"
              memory: 4Gi
              nvidia.com/gpu.shared: 1
            limits:
              cpu: "6"
              memory: 10Gi
              nvidia.com/gpu.shared: 1
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-stt
  namespace: hermes
spec:
  selector:
    app: hermes-stt
  ports:
    - {name: http, port: 9000, targetPort: http, protocol: TCP}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-tts
  namespace: hermes
  labels:
    app: hermes-tts
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-tts
  template:
    metadata:
      labels:
        app: hermes-tts
      annotations:
        ai.bstein.dev/role: private-chat-text-to-speech
        ai.bstein.dev/model: piper-en-us-lessac-high
        ai.bstein.dev/gpu: CPU-only on routing node
    spec:
      nodeSelector:
        kubernetes.io/hostname: titan-20
      containers:
        - name: tts
          image: registry.bstein.dev/bstein/hermes-jetson-tts@sha256:6483ca4e89d0663c770b7b3e3c9c9ff85d457ae877f2e83c55765cadc901d9b7
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9001, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_TTS_VOICE, value: en_US-lessac-high}
            - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests: {cpu: 500m, memory: 512Mi}
            limits: {cpu: "2", memory: 2Gi}
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-tts
  namespace: hermes
spec:
  selector:
    app: hermes-tts
  ports:
    - {name: http, port: 9001, targetPort: http, protocol: TCP}