> ## Documentation Index
> Fetch the complete documentation index at: https://daily-ms-pcc-self-hosted.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-Hosted Region on Oracle OKE

> A reference architecture for a self-hosted region on Oracle Cloud's OKE: standalone VCN, Karpenter node pools, managed stores, Gateway API front door.

export const productNameSingular = "self-hosted region";

This page describes a {productNameSingular} on Oracle Cloud Infrastructure's Kubernetes Engine (OKE) as Daily builds and validates it. Like the [AWS EKS layout](/enterprise/reference/aws-eks) it is one proven shape, not a requirement; it is worth reading even if you are not on OCI, because it is the layout that uses the package's release-owned Gateway mode and Karpenter for the platform nodes as well as the agent nodes.

## Layout

* **A standalone VCN** with no peering and no path in from any other network. The region agent dials out to Pipecat Cloud; nothing needs to reach in. Public: the WebSocket front door and the cluster's API endpoint.
* **An OKE enhanced cluster** (VCN-native pod networking, OIDC discovery for workload identity) on a stock OKE arm64 image, with one small static **bootstrap pool** tainted for critical add-ons — Karpenter, CoreDNS, and DaemonSets, and nothing else.
* **Karpenter** (Oracle's provider) with two node pools on Ampere shapes: `platform` for the platform components, cert-manager, and monitoring, and `bots`, tainted so only agent pods land there. Shape menus follow the 1:2 CPU:memory ratio of voice agents; disruption is graceful — nodes leave only when empty.
* **Managed stores** for sizes above `dev`: **OCI Cache** (Valkey) as the broker and **OCI Search with OpenSearch** as the log store, TLS and password on both, wired through `externalBroker.*` and `logging.external.*`. Note that OCI's floor for OpenSearch is three nodes. `dev` runs the package's bundled stores.
* **Platform prerequisites** cert-manager and trust-manager, and optionally a local kube-prometheus-stack.

## WebSocket front door

OKE's native ingress controller implements only the Ingress API and cannot change its load balancer's 60-second idle timeout, which ends a WebSocket session at 60 idle seconds. This layout therefore uses **Gateway API** with **Envoy Gateway** as the implementation — what Oracle's own OKE documentation installs for Gateway API — fronted by an **OCI network load balancer** through one annotation, with TLS terminating in Envoy from a cert-manager (Let's Encrypt, HTTP-01) certificate and **external-dns** writing the hostname into an OCI DNS zone. All of it is authenticated by workload identity; no key material is stored anywhere.

The front door itself belongs to the region package's `gateway` exposure mode, so it is created at `helm install` and removed at uninstall:

```yaml theme={null}
wsExposure:
  mode: gateway
  gateway:
    host: ws.acme-oci.example.com
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt
    infrastructureAnnotations:
      oci.oraclecloud.com/load-balancer-type: nlb
      oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "None"
    tls:
      secretName: pipecat-ws-tls
envoy-gateway:
  enabled: true
```

Registering the region reads the architecture from the cluster and the WebSocket endpoint from the stack's outputs, so the region record declares exactly what was built. A `dig` of the hostname resolving to the load balancer and `curl -I https://<hostname>/` answering with a valid certificate confirms the path.

## Values

As on EKS, the region's values file is generated from the infrastructure's outputs — front door, agent placement, monitors — and your own tuning is layered after it. It carries no image references or versions, so [upgrades stay version-only](/enterprise/operations#upgrading-the-region-package).

## Sizes

`dev` (one bootstrap node, bundled stores, no monitoring), `small` (two bootstrap nodes, managed stores, monitoring), `load`, and `production`. The bootstrap pool never scales; everything that scales with load is a Karpenter node pool.

## Provider notes

* **Container runtime.** OKE's Oracle Linux nodes run CRI-O with strict short-name resolution, which rejects unqualified image names such as `curlimages/curl`. The region package qualifies every third-party image it references (package 0.1.11 or later); if you mirror images, keep them fully qualified.
* **Compartment isolation.** Use a compartment with nothing else in it: the node dynamic group matches every instance in the compartment, so a shared compartment means shared node identity.
* **Kubernetes version.** Pin the OKE version after the first apply; left unset, the newest OKE release becomes an unplanned control-plane upgrade on the next apply.