atlas-iac/services/hermes/voice-deployment.yaml

# services/hermes/voice-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-stt
  namespace: hermes
  labels:
    app: hermes-stt
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-stt
  template:
    metadata:
      labels:
        app: hermes-stt
      annotations:
        ai.bstein.dev/role: private-chat-speech-to-text
        ai.bstein.dev/model: whisper-small-multilingual
        ai.bstein.dev/gpu: titan-21 dedicated speech time-slice
    spec:
      runtimeClassName: nvidia
      automountServiceAccountToken: false
      enableServiceLinks: false
      securityContext:
        supplementalGroups: [44]
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: stt
          image: registry.bstein.dev/bstein/hermes-jetson-stt@sha256:dfb0b0788dcf63747d8c761c6d3ea6a7459bcd8d0a5c92bcd4f6f434a760249f
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9000, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_STT_PORT, value: "9000"}
            - {name: HERMES_STT_MODEL, value: small}
            - {name: HERMES_STT_CACHE, value: /opt/models/whisper}
            - {name: NVIDIA_VISIBLE_DEVICES, value: all}
            - {name: NVIDIA_DRIVER_CAPABILITIES, value: "compute,utility"}
            - {name: JETSON_JETPACK, value: "5"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 90
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            requests:
              cpu: "2"
              memory: 4Gi
              nvidia.com/gpu.shared: 1
            limits:
              cpu: "6"
              memory: 10Gi
              nvidia.com/gpu.shared: 1
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-stt
  namespace: hermes
spec:
  selector:
    app: hermes-stt
  ports:
    - {name: http, port: 9000, targetPort: http, protocol: TCP}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-tts
  namespace: hermes
  labels:
    app: hermes-tts
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-tts
  template:
    metadata:
      labels:
        app: hermes-tts
      annotations:
        ai.bstein.dev/role: private-chat-text-to-speech
        ai.bstein.dev/model: piper-multilingual-en_US-amy-medium+ru_RU-irina-medium+es_MX-claude-high
        ai.bstein.dev/gpu: CPU-only beside Whisper on the voice node
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/hostname: titan-21
      containers:
        - name: tts
          image: registry.bstein.dev/bstein/hermes-jetson-tts@sha256:5cb9e57faab46365bff606c559af57b9505892be2909aea1ac523568d478b2cc
          imagePullPolicy: IfNotPresent
          ports:
            - {name: http, containerPort: 9001, protocol: TCP}
          env:
            - {name: HOME, value: /tmp}
            - {name: XDG_CACHE_HOME, value: /tmp/cache}
            - {name: HERMES_TTS_PORT, value: "9001"}
            - {name: HERMES_TTS_VOICE, value: en_US-amy-medium}
            - {name: HERMES_TTS_CACHE, value: /opt/models/piper}
            - {name: HERMES_TTS_ONNX_THREADS, value: "2"}
          startupProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet: {path: /health, port: http}
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
          resources:
            # Preloading all three policy voices measured ~243MB RSS versus
            # ~88MB for one; bump the request from 512Mi to 768Mi to cover
            # that ~155MB increase with headroom. The 2Gi limit already had
            # ample slack and is unchanged.
            requests: {cpu: "1", memory: 768Mi}
            limits: {cpu: "4", memory: 2Gi}
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-tts
  namespace: hermes
spec:
  selector:
    app: hermes-tts
  ports:
    - {name: http, port: 9001, targetPort: http, protocol: TCP}