Self-Hosted Region on Oracle OKE

A reference architecture for a self-hosted region on Oracle Cloud’s OKE: standalone VCN, Karpenter node pools, managed stores, Gateway API front door.

This page describes a on Oracle Cloud Infrastructure’s Kubernetes Engine (OKE) as Daily builds and validates it. Like the AWS EKS layout it is one proven shape, not a requirement; it is worth reading even if you are not on OCI, because it is the layout that uses the package’s release-owned Gateway mode and Karpenter for the platform nodes as well as the agent nodes.

Layout

• A standalone VCN with no peering and no path in from any other network. The region agent dials out to Pipecat Cloud; nothing needs to reach in. Public: the WebSocket front door and the cluster’s API endpoint.
• An OKE enhanced cluster (VCN-native pod networking, OIDC discovery for workload identity) on a stock OKE arm64 image, with one small static bootstrap pool tainted for critical add-ons — Karpenter, CoreDNS, and DaemonSets, and nothing else.
• Karpenter (Oracle’s provider) with two node pools on Ampere shapes: platform for the platform components, cert-manager, and monitoring, and bots, tainted so only agent pods land there. Shape menus follow the 1:2 CPU:memory ratio of voice agents; disruption is graceful — nodes leave only when empty.
• Managed stores for sizes above dev: OCI Cache (Valkey) as the broker and OCI Search with OpenSearch as the log store, TLS and password on both, wired through externalBroker.* and logging.external.*. Note that OCI’s floor for OpenSearch is three nodes. dev runs the package’s bundled stores.
• Platform prerequisites cert-manager and trust-manager, and optionally a local kube-prometheus-stack.

WebSocket front door

OKE’s native ingress controller implements only the Ingress API and cannot change its load balancer’s 60-second idle timeout, which ends a WebSocket session at 60 idle seconds. This layout therefore uses Gateway API with Envoy Gateway as the implementation — what Oracle’s own OKE documentation installs for Gateway API — fronted by an OCI network load balancer through one annotation, with TLS terminating in Envoy from a cert-manager (Let’s Encrypt, HTTP-01) certificate and external-dns writing the hostname into an OCI DNS zone. All of it is authenticated by workload identity; no key material is stored anywhere.

The front door itself belongs to the region package’s gateway exposure mode, so it is created at helm install and removed at uninstall:

wsExposure:
  mode: gateway
  gateway:
    host: ws.acme-oci.example.com
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt
    infrastructureAnnotations:
      oci.oraclecloud.com/load-balancer-type: nlb
      oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "None"
    tls:
      secretName: pipecat-ws-tls
envoy-gateway:
  enabled: true

Registering the region reads the architecture from the cluster and the WebSocket endpoint from the stack’s outputs, so the region record declares exactly what was built. A dig of the hostname resolving to the load balancer and curl -I https://<hostname>/ answering with a valid certificate confirms the path.

Values

As on EKS, the region’s values file is generated from the infrastructure’s outputs — front door, agent placement, monitors — and your own tuning is layered after it. It carries no image references or versions, so upgrades stay version-only.

Sizes

dev (one bootstrap node, bundled stores, no monitoring), small (two bootstrap nodes, managed stores, monitoring), load, and production. The bootstrap pool never scales; everything that scales with load is a Karpenter node pool.

Provider notes

• Container runtime. OKE’s Oracle Linux nodes run CRI-O with strict short-name resolution, which rejects unqualified image names such as curlimages/curl. The region package qualifies every third-party image it references (package 0.1.11 or later); if you mirror images, keep them fully qualified.
• Compartment isolation. Use a compartment with nothing else in it: the node dynamic group matches every instance in the compartment, so a shared compartment means shared node identity.
• Kubernetes version. Pin the OKE version after the first apply; left unset, the newest OKE release becomes an unplanned control-plane upgrade on the next apply.