k3s (D6): Dienst-VM k3s per tofu, Rollen k3s-server/k3s-agent/k3s-apps, Manifeste, NEX-Sprachdienste als k3s-Umzugstest

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-15 11:55:18 +02:00
parent 6cccc01d14
commit 2c1d43e9c7
23 changed files with 701 additions and 15 deletions
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nex
+  labels:
+    knaster.app: nex-speech
@@ -0,0 +1,56 @@
+# NEX-Spracherkennung (whisper.cpp, M4000) auf gpu-pve52, umgezogen von Docker Compose (Task 6.2, D6).
+# Host-Netz wie zuvor: Port 8178 auf der VM-Adresse, die ufw-Regel der VM (nur appsrv08) gilt weiter.
+# Image stammt aus dem Compose-Build und wurde in das containerd von k3s importiert (Rolle nex-speech-k3s).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nex-stt
+  namespace: nex
+  labels: {app: nex-stt}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}   # Host-Port 8178 kann nur einmal belegt sein
+  selector:
+    matchLabels: {app: nex-stt}
+  template:
+    metadata:
+      labels: {app: nex-stt}
+    spec:
+      runtimeClassName: nvidia
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      nodeSelector:
+        kubernetes.io/hostname: gpu-pve52
+      containers:
+        - name: whisper
+          image: knaster/nex-whisper:v1.9.4-cu12.6
+          imagePullPolicy: Never
+          env:
+            - {name: WHISPER_PORT, value: "8178"}
+            - {name: WHISPER_MODEL, value: /models/whisper/ggml-large-v3-turbo.bin}
+            - {name: WHISPER_LANGUAGE, value: de}
+            - {name: WHISPER_BEAM_SIZE, value: "5"}
+            - {name: WHISPER_EXTRA_ARGS, value: ""}
+          resources:
+            limits: {nvidia.com/gpu: 1}
+          securityContext:
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: models, mountPath: /models/whisper, readOnly: true}
+            - {name: run, mountPath: /run/nex-whisper}
+          startupProbe:
+            httpGet: {path: /health, port: 8178, host: 127.0.0.1}
+            periodSeconds: 5
+            failureThreshold: 60
+          readinessProbe:
+            httpGet: {path: /health, port: 8178, host: 127.0.0.1}
+            periodSeconds: 30
+          livenessProbe:
+            httpGet: {path: /health, port: 8178, host: 127.0.0.1}
+            periodSeconds: 30
+            failureThreshold: 3
+      volumes:
+        - name: models
+          hostPath: {path: /srv/models/whisper, type: Directory}
+        - name: run
+          emptyDir: {medium: Memory, sizeLimit: 512Mi}
@@ -0,0 +1,56 @@
+# NEX-Sprachausgabe (Piper, CPU) auf gpu-pve52, Host-Netz Port 8179 (ufw: nur appsrv08).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nex-tts
+  namespace: nex
+  labels: {app: nex-tts}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels: {app: nex-tts}
+  template:
+    metadata:
+      labels: {app: nex-tts}
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      nodeSelector:
+        kubernetes.io/hostname: gpu-pve52
+      containers:
+        - name: piper
+          image: knaster/nex-tts-piper:1.8.0
+          imagePullPolicy: Never
+          env:
+            - {name: TTS_PORT, value: "8179"}
+            - {name: PIPER_VOICES_DIR, value: /voices}
+            - {name: PIPER_VOICES, value: "de_DE-thorsten-high,de_DE-kerstin-low"}
+            - {name: PIPER_DEFAULT_VOICE, value: de_DE-thorsten-high}
+            - {name: PCM_SAMPLE_RATE, value: "24000"}
+            - {name: TTS_MAX_CHARS, value: "5000"}
+            - {name: TTS_PARALLEL, value: "2"}
+          resources:
+            limits: {cpu: "3", memory: 2Gi}   # ein Kern bleibt für whisper-server und das System
+            requests: {cpu: "500m", memory: 512Mi}
+          securityContext:
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: voices, mountPath: /voices, readOnly: true}
+            - {name: tmp, mountPath: /tmp}
+          startupProbe:
+            httpGet: {path: /health, port: 8179, host: 127.0.0.1}
+            periodSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /health, port: 8179, host: 127.0.0.1}
+            periodSeconds: 30
+          livenessProbe:
+            httpGet: {path: /health, port: 8179, host: 127.0.0.1}
+            periodSeconds: 30
+            failureThreshold: 3
+      volumes:
+        - name: voices
+          hostPath: {path: /srv/models/piper, type: Directory}
+        - name: tmp
+          emptyDir: {sizeLimit: 64Mi}