atlas-iac/services/hermes/voice-deployment.yaml

# services/hermes/voice-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-stt
  namespace: hermes
  labels:
    app: hermes-stt
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-stt
  template:
    metadata:
      labels:
        app: hermes-stt
      annotations:
        ai.bstein.dev/role: private-chat-speech-to-text
        ai.bstein.dev/model: whisper-large-v3-turbo greedy + proper-noun prompt (tiny rolling previews)
        ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
    spec:
      runtimeClassName: nvidia
      automountServiceAccountToken: false
      enableServiceLinks: false
      securityContext:
        supplementalGroups: [44]
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: stt
          image: registry.bstein.dev/bstein/hermes-jetson-stt:git-fd0a4b23f9c03265f57cc0d247dbfd72d4f207a8-build-24-release@sha256:bc6db0e58d95dc708f98078ec5b91cea2bcf433647d9155fc7ddf4df2336f754 # {"$imagepolicy": "hermes:hermes-stt-release"}
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9000, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_STT_PORT, value: "9000"}
            - {name: HERMES_STT_MODEL, value: large-v3-turbo}
            # Fast-and-accurate production decode: the accurate turbo model and
            # the proper-noun priming prompt, but greedy single-temperature so
            # startup warmup and per-utterance latency stay low (beam search
            # made cold start ~8min on this Jetson). Beam is env-tunable if a
            # future accuracy pass wants it.
            - {name: HERMES_STT_FINAL_BEAM_SIZE, value: "1"}
            - {name: HERMES_STT_FINAL_TEMPERATURE, value: "0.0"}
            - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
            - {name: NVIDIA_VISIBLE_DEVICES, value: all}
            - {name: NVIDIA_DRIVER_CAPABILITIES, value: "compute,utility"}
            - {name: JETSON_JETPACK, value: "5"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 90
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests:
              cpu: "2"
              memory: 4Gi
              nvidia.com/gpu.shared: 1
            limits:
              cpu: "6"
              memory: 10Gi
              nvidia.com/gpu.shared: 1
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-stt
  namespace: hermes
spec:
  selector:
    app: hermes-stt
  ports:
    - {name: http, port: 9000, targetPort: http, protocol: TCP}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-tts
  namespace: hermes
  labels:
    app: hermes-tts
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-tts
  template:
    metadata:
      labels:
        app: hermes-tts
      annotations:
        ai.bstein.dev/role: private-chat-text-to-speech
        ai.bstein.dev/model: piper-multilingual-en-ru-es
        ai.bstein.dev/gpu: CPU-only beside Whisper on the voice node
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: tts
          image: registry.bstein.dev/bstein/hermes-jetson-tts:git-d254931a14793a2e612bbea36642ee947c5355a9-build-16-release@sha256:c54c73c4480cf41e18f803466f647553efe8b06f480b381d895ee657c6015c47 # {"$imagepolicy": "hermes:hermes-tts-release"}
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9001, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_TTS_PORT, value: "9001"}
            - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
            - {name: HERMES_TTS_ONNX_THREADS, value: "4"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests: {cpu: "1", memory: 512Mi}
            limits: {cpu: "4", memory: 2Gi}
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-tts
  namespace: hermes
spec:
  selector:
    app: hermes-tts
  ports:
    - {name: http, port: 9001, targetPort: http, protocol: TCP}