Medical speech recognition,
on your infrastructure.

The service combines a lightweight API proxy with a licensed medical engine. It accepts asynchronous audio streams over WebSocket and returns partial and final results. There is no REST transcription or job queue.

Plan for two eligible nodes

The example uses two API replicas and two engine replicas, spread across at least two schedulable nodes. Reserve capacity for Kubernetes, image storage and your actual workload. These figures are a starting allocation, not a throughput guarantee.

You need kubectl, Helm 3, Bash, access to the target cluster and permission to create the namespace, Secrets, workloads and network policies. Confirm Kubernetes, CNI and CPU compatibility with Voxist. No GPU is required for this profile.

Ask your Voxist contact for a qualified, matching deployment kit. Do not substitute images or chart versions independently.

• Qualified Helm chart version, checksum and release notes. The chart itself is publicly downloadable.
• API and engine image repositories with approved SHA-256 digests.
• Harbor registry URL, a username and a password supplied by Voxist to access and download your images, with expiry and renewal instructions.
• Supplier activation key, model/language entitlement and licence activation conditions.
• Approved egress policy for your DNS/CNI, current licence endpoints and any proxy requirements.
• Sizing advice, a non-patient test recording with expected results, support and upgrade procedures.

Use an explicit context for every command. Replace the uppercase placeholders before running the examples.

export KUBE_CONTEXT="YOUR_CLUSTER_CONTEXT"
export CHART="./voxist-asr-medical-0.1.2-rc.1.tgz"
helm pull oci://registry.voxist.com/charts/voxist-asr-medical --version 0.1.2-rc.1
kubectl --context "$KUBE_CONTEXT" get nodes
# Create once; reuse the namespace if it already exists.
kubectl --context "$KUBE_CONTEXT" create namespace medical-asr

Sign in to Harbor

Voxist gives you a Harbor username and password for your read-only image access. These credentials are separate from the engine licence key. The registry is registry.voxist.com, hosted on Voxist’s OVH infrastructure. Docker will prompt for the password without putting it in the command. Docker CLI is needed for this step. Alternatively, ask Voxist for a Kubernetes-ready Docker config JSON.

export REGISTRY_HOST="registry.voxist.com"
export REGISTRY_USER="YOUR_VOXIST_USERNAME"
export REGISTRY_AUTH_DIR="$(mktemp -d)"
chmod 700 "$REGISTRY_AUTH_DIR"
docker --config "$REGISTRY_AUTH_DIR" login "$REGISTRY_HOST"   --username "$REGISTRY_USER"
chmod 600 "$REGISTRY_AUTH_DIR/config.json"

Use the generated config.json as /secure/path/registry-reader.json in the Secret command below. The directory contains credentials: protect it and remove the temporary copy after creating the Secret.

Create the two Secrets

Save the supplier key in a protected file with no trailing newline. The registry file must be a Docker config JSON, not a raw robot-account response. Keep both files out of Git and do not put credentials in Helm values or shell arguments.

kubectl --context "$KUBE_CONTEXT" -n medical-asr   create secret generic medical-engine-license   --from-file=api-key=/secure/path/supplier-license-key

kubectl --context "$KUBE_CONTEXT" -n medical-asr   create secret generic harbor-medical-pull   --type=kubernetes.io/dockerconfigjson   --from-file=.dockerconfigjson=/secure/path/registry-reader.json

Check the chart checksum against the value delivered by Voxist before installation.

shasum -a 256 "$CHART"

Download the starting values, replace the two repositories and digests, then have your network policy approved. The release name must remain medical-asr: the pod placement selectors use this name.

The template keeps ingress disabled, references existing Secrets and enables strict placement on different hosts. It is a template to complete, not a ready-to-run configuration.

Allow the required outbound traffic

• Cluster nodes → registry.voxist.com over HTTPS (443).
• Engine pods → cluster DNS over TCP/UDP 53.
• Engine pods → license.voxist.com over secure WebSocket (WSS), TCP port 443, for supplier licence activation and usage reporting.

Render and inspect the configuration first, then install the approved release. The egress overlay must contain the network settings agreed for your cluster.

helm lint "$CHART" -f customer-values.yaml -f approved-egress.yaml
helm template medical-asr "$CHART" --namespace medical-asr   -f customer-values.yaml -f approved-egress.yaml

helm upgrade --install medical-asr "$CHART"   --kube-context "$KUBE_CONTEXT" --namespace medical-asr   -f customer-values.yaml -f approved-egress.yaml   --wait --timeout 10m

kubectl --context "$KUBE_CONTEXT" -n medical-asr   rollout status deployment/medical-asr-worker --timeout=300s
kubectl --context "$KUBE_CONTEXT" -n medical-asr   rollout status deployment/medical-asr-api --timeout=300s
kubectl --context "$KUBE_CONTEXT" -n medical-asr get pods -o wide

Confirm 2/2 ready replicas for both components, with each pair on different nodes. A successful Helm command alone does not establish full redundancy.

Keep the service private. Forward the API port locally, then run the checks from a second terminal.

kubectl --context "$KUBE_CONTEXT" -n medical-asr   port-forward service/medical-asr-api 19300:3000

curl --fail http://127.0.0.1:19300/health/ready

Send a real audio stream

Use the non-patient recording provided by Voxist. Send raw PCM signed 16-bit little-endian, mono, 16 kHz as binary WebSocket frames. Do not send a WAV header. The sample_rate parameter does not resample audio.

ws://127.0.0.1:19300/ws?lang=fr-medical&sample_rate=16000

1. Open the socket and wait for the connection to be established.
2. Stream audio in small binary chunks, paced to real time.
3. After the last audio frame, send the text message Done.
4. Wait for final results before closing. Compare the transcript with the expected reference.

Monitoring

Connect local health and metrics endpoints to your existing monitoring stack, including Grafana. Keep these endpoints private. No outbound anonymous telemetry collector is included in this deployment; agree any such integration separately with Voxist.

Upgrade in a quiet window

Obtain a newly qualified chart and image pair. Save the current values and revision, stop accepting new streams and allow active sessions to finish before running the installation command with the new kit.

Return to a previous release

helm history medical-asr --kube-context "$KUBE_CONTEXT" -n medical-asr
# Replace PREVIOUS_REVISION with the last validated revision.
helm rollback medical-asr PREVIOUS_REVISION   --kube-context "$KUBE_CONTEXT" -n medical-asr --wait --timeout 10m

A rollback requires a previous release and available images. Recheck replica placement, readiness and an audio transcription after every upgrade or rollback.

For support, provide chart/image versions, timestamps with timezone, replica status and redacted errors. Never send licence keys, registry credentials or patient audio in routine support messages.