mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-10-13 06:09:16 +00:00
Add openclaw Helm chart (openclaw/openclaw Gateway)
This commit is contained in:
@@ -0,0 +1,14 @@
|
||||
apiVersion: v2
|
||||
name: openclaw
|
||||
description: >-
|
||||
OpenClaw Gateway (personal AI assistant server). Own chart (not a wrapper):
|
||||
upstream ships only raw Kustomize manifests (scripts/k8s/manifests), and the
|
||||
Gateway is a single Deployment + Service + PVC + seed ConfigMap, so the image
|
||||
is tracked directly off openclaw/openclaw releases via the annotation below
|
||||
and scripts/update-charts.sh.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "2026.9.6"
|
||||
annotations:
|
||||
version-source: github-release:openclaw/openclaw
|
||||
version-pattern: "s|^v||"
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-seed
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
data:
|
||||
openclaw.json: |
|
||||
{{- toPrettyJson .Values.config | nindent 4 }}
|
||||
AGENTS.md: |
|
||||
{{- .Values.agentsMd | nindent 4 }}
|
||||
@@ -0,0 +1,163 @@
|
||||
{{- $tag := .Chart.AppVersion -}}
|
||||
{{- with .Values.image.variant }}{{ $tag = printf "%s-%s" $tag . }}{{ end -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/component: gateway
|
||||
annotations:
|
||||
version-source: {{ index .Chart.Annotations "version-source" }}
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ .Release.Name }}
|
||||
annotations:
|
||||
checksum/seed: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
# Seed-if-missing: the PVC copy owns config after first boot
|
||||
- name: seed-config
|
||||
image: busybox:1.38
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
[ -f /home/node/.openclaw/openclaw.json ] || cp /seed/openclaw.json /home/node/.openclaw/openclaw.json
|
||||
mkdir -p /home/node/.openclaw/workspace
|
||||
[ -f /home/node/.openclaw/workspace/AGENTS.md ] || cp /seed/AGENTS.md /home/node/.openclaw/workspace/AGENTS.md
|
||||
{{- with .Values.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 16Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /home/node/.openclaw
|
||||
- name: seed
|
||||
mountPath: /seed
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ $tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- node
|
||||
- /app/dist/index.js
|
||||
- gateway
|
||||
- run
|
||||
{{- with .Values.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.httpPort }}
|
||||
name: http
|
||||
env:
|
||||
- name: TZ
|
||||
value: {{ .Values.timezone | quote }}
|
||||
- name: HOME
|
||||
value: /home/node
|
||||
- name: OPENCLAW_CONFIG_DIR
|
||||
value: /home/node/.openclaw
|
||||
- name: NODE_ENV
|
||||
value: production
|
||||
{{- range $key, $value := .Values.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.existingSecret }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
# Probes assert the JSON probe contract, not just the status code: the
|
||||
# Control UI answers unknown paths with a catch-all 200. /startupz
|
||||
# ignores channel health, so one failing channel account can't pull
|
||||
# the Gateway out of Service endpoints (/readyz is channel-aware).
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- node
|
||||
- -e
|
||||
- "require('http').get('http://127.0.0.1:{{ .Values.httpPort }}/startupz', r => { let b = ''; r.on('data', d => b += d); r.on('end', () => { try { process.exit(r.statusCode < 400 && JSON.parse(b).status === 'started' ? 0 : 1); } catch { process.exit(1); } }); }).on('error', () => process.exit(1))"
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 30
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- node
|
||||
- -e
|
||||
- "require('http').get('http://127.0.0.1:{{ .Values.httpPort }}/startupz', r => { let b = ''; r.on('data', d => b += d); r.on('end', () => { try { process.exit(r.statusCode < 400 && JSON.parse(b).status === 'started' ? 0 : 1); } catch { process.exit(1); } }); }).on('error', () => process.exit(1))"
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- node
|
||||
- -e
|
||||
- "require('http').get('http://127.0.0.1:{{ .Values.httpPort }}/healthz', r => { let b = ''; r.on('data', d => b += d); r.on('end', () => { try { process.exit(r.statusCode < 400 && JSON.parse(b).ok === true ? 0 : 1); } catch { process.exit(1); } }); }).on('error', () => process.exit(1))"
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /home/node/.openclaw
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: shm
|
||||
mountPath: /dev/shm
|
||||
volumes:
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" .Release.Name) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: seed
|
||||
configMap:
|
||||
name: {{ .Release.Name }}-seed
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: shm
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: {{ .Values.shmSize }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- range $name, $config := .Values.ingresses }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $.Release.Name }}-{{ $name }}
|
||||
{{- with $config.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
rules:
|
||||
- host: {{ $config.host }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: {{ $.Release.Name }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- with $config.tls }}
|
||||
tls:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-data
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- toYaml .Values.persistence.accessModes | nindent 4 }}
|
||||
{{- with .Values.persistence.storageClass }}
|
||||
storageClassName: {{ . }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
app: {{ .Release.Name }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,102 @@
|
||||
# Default values for OpenClaw Gateway Helm Chart
|
||||
image:
|
||||
repository: ghcr.io/openclaw/openclaw
|
||||
# Tag is "<appVersion>" or "<appVersion>-<variant>". Variants: "" (default,
|
||||
# bundles codex + diagnostics-otel), "slim", "browser" (Chromium baked in for
|
||||
# the Gateway-controlled browser).
|
||||
variant: slim
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
timezone: "Europe/Kyiv"
|
||||
|
||||
# Gateway port (WS + HTTP multiplexed: Control UI, probes, API)
|
||||
httpPort: 18789
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 18789
|
||||
|
||||
# Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
|
||||
# become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds
|
||||
# refuse to start without gateway auth), ANTHROPIC_OAUTH_TOKEN (Claude
|
||||
# setup-token), ANTHROPIC_API_KEY, OPENAI_API_KEY, ... The chart never creates it.
|
||||
existingSecret: ""
|
||||
|
||||
# Extra plain environment variables (rendered as name/value pairs)
|
||||
env: {}
|
||||
|
||||
# Seed config. Copied into the PVC only when missing (first boot); after that
|
||||
# the PVC copy is the source of truth, so edits made through OpenClaw (Control
|
||||
# UI, `openclaw config set`, doctor --fix) survive restarts. To reseed from
|
||||
# here: delete ~/.openclaw/openclaw.json in the pod and restart.
|
||||
config:
|
||||
gateway:
|
||||
mode: local
|
||||
# Listen on the pod IP so the Service/Ingress can reach it (upstream
|
||||
# default "loopback" only works with kubectl port-forward)
|
||||
bind: lan
|
||||
port: 18789
|
||||
auth:
|
||||
mode: token
|
||||
controlUi:
|
||||
enabled: true
|
||||
agents:
|
||||
defaults:
|
||||
workspace: ~/.openclaw/workspace
|
||||
|
||||
# Seeded as ~/.openclaw/workspace/AGENTS.md when missing
|
||||
agentsMd: |
|
||||
# OpenClaw Assistant
|
||||
|
||||
You are a helpful AI assistant running in Kubernetes.
|
||||
|
||||
# Upstream images run as uid/gid 1000 (user "node"); fsGroup makes the PVC writable
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# Upstream manifests use a read-only root; off here because agent exec tools,
|
||||
# npm/plugin installs and Chromium write outside ~/.openclaw (only /tmp and
|
||||
# the PVC are writable when enabled).
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "250m"
|
||||
memory: "512Mi"
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: "2Gi"
|
||||
|
||||
# In-memory /dev/shm; Chromium (browser variant) crashes on the 64Mi default
|
||||
shmSize: 512Mi
|
||||
|
||||
# Persistent ~/.openclaw (config, credentials, agent state DBs, workspace)
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: local-path
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 10Gi
|
||||
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
ingresses: {}
|
||||
# https:
|
||||
# host: openclaw.example.com
|
||||
# annotations: {}
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - openclaw.example.com
|
||||
Reference in New Issue
Block a user