Add openclaw Helm chart (openclaw/openclaw Gateway)

2026-10-12 21:59:18 +00:00 · 2026-09-27 13:19:14 +03:00
parent bf3caddadf
commit faf4e3eee2
8 changed files with 353 additions and 0 deletions
@@ -0,0 +1,102 @@
+# Default values for OpenClaw Gateway Helm Chart
+image:
+  repository: ghcr.io/openclaw/openclaw
+  # Tag is "<appVersion>" or "<appVersion>-<variant>". Variants: "" (default,
+  # bundles codex + diagnostics-otel), "slim", "browser" (Chromium baked in for
+  # the Gateway-controlled browser).
+  variant: slim
+  pullPolicy: IfNotPresent
+
+timezone: "Europe/Kyiv"
+
+# Gateway port (WS + HTTP multiplexed: Control UI, probes, API)
+httpPort: 18789
+
+service:
+  type: ClusterIP
+  port: 18789
+
+# Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
+# become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds
+# refuse to start without gateway auth), ANTHROPIC_OAUTH_TOKEN (Claude
+# setup-token), ANTHROPIC_API_KEY, OPENAI_API_KEY, ... The chart never creates it.
+existingSecret: ""
+
+# Extra plain environment variables (rendered as name/value pairs)
+env: {}
+
+# Seed config. Copied into the PVC only when missing (first boot); after that
+# the PVC copy is the source of truth, so edits made through OpenClaw (Control
+# UI, `openclaw config set`, doctor --fix) survive restarts. To reseed from
+# here: delete ~/.openclaw/openclaw.json in the pod and restart.
+config:
+  gateway:
+    mode: local
+    # Listen on the pod IP so the Service/Ingress can reach it (upstream
+    # default "loopback" only works with kubectl port-forward)
+    bind: lan
+    port: 18789
+    auth:
+      mode: token
+    controlUi:
+      enabled: true
+  agents:
+    defaults:
+      workspace: ~/.openclaw/workspace
+
+# Seeded as ~/.openclaw/workspace/AGENTS.md when missing
+agentsMd: |
+  # OpenClaw Assistant
+
+  You are a helpful AI assistant running in Kubernetes.
+
+# Upstream images run as uid/gid 1000 (user "node"); fsGroup makes the PVC writable
+securityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  # Upstream manifests use a read-only root; off here because agent exec tools,
+  # npm/plugin installs and Chromium write outside ~/.openclaw (only /tmp and
+  # the PVC are writable when enabled).
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+resources:
+  requests:
+    cpu: "250m"
+    memory: "512Mi"
+  limits:
+    cpu: "2"
+    memory: "2Gi"
+
+# In-memory /dev/shm; Chromium (browser variant) crashes on the 64Mi default
+shmSize: 512Mi
+
+# Persistent ~/.openclaw (config, credentials, agent state DBs, workspace)
+persistence:
+  enabled: true
+  existingClaim: ""
+  storageClass: local-path
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+ingresses: {}
+  # https:
+  #   host: openclaw.example.com
+  #   annotations: {}
+  #   tls:
+  #     - hosts:
+  #         - openclaw.example.com