mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-10-13 06:09:16 +00:00
120 lines
3.5 KiB
YAML
120 lines
3.5 KiB
YAML
# Default values for OpenClaw Gateway Helm Chart
|
|
image:
|
|
repository: ghcr.io/openclaw/openclaw
|
|
# Tag is "<appVersion>" or "<appVersion>-<variant>". Variants: "" (default,
|
|
# bundles codex + diagnostics-otel), "slim", "browser" (Chromium baked in for
|
|
# the Gateway-controlled browser).
|
|
variant: slim
|
|
pullPolicy: IfNotPresent
|
|
|
|
timezone: "Europe/Kyiv"
|
|
|
|
# Gateway port (WS + HTTP multiplexed: Control UI, probes, API)
|
|
httpPort: 18789
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 18789
|
|
# For LoadBalancer/NodePort: "Local" keeps the real client IP. Required when
|
|
# gateway.trustedProxies covers the pod CIDR, otherwise SNATed direct
|
|
# connections look like a proxy without forwarded headers and get rejected.
|
|
externalTrafficPolicy: ""
|
|
|
|
# Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
|
|
# become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds
|
|
# refuse to start without gateway auth), OPENAI_API_KEY, ... The chart never
|
|
# creates it.
|
|
existingSecret: ""
|
|
|
|
# Claude Code CLI for the claude-cli agent runtime (Claude subscription via
|
|
# `claude auth login`, no API key). The image doesn't ship it, so an init
|
|
# container installs it into the PVC once; ~/.claude (login) and the install
|
|
# live on the PVC. Log in once after first deploy:
|
|
# kubectl exec -it deploy/<release> -- claude auth login
|
|
claudeCli:
|
|
enabled: false
|
|
installUrl: https://claude.ai/install.sh
|
|
|
|
# Extra plain environment variables (rendered as name/value pairs)
|
|
env: {}
|
|
|
|
# Seed config. Copied into the PVC only when missing (first boot); after that
|
|
# the PVC copy is the source of truth, so edits made through OpenClaw (Control
|
|
# UI, `openclaw config set`, doctor --fix) survive restarts. To reseed from
|
|
# here: delete ~/.openclaw/openclaw.json in the pod and restart.
|
|
config:
|
|
gateway:
|
|
mode: local
|
|
# Listen on the pod IP so the Service/Ingress can reach it (upstream
|
|
# default "loopback" only works with kubectl port-forward)
|
|
bind: lan
|
|
port: 18789
|
|
auth:
|
|
mode: token
|
|
controlUi:
|
|
enabled: true
|
|
agents:
|
|
defaults:
|
|
workspace: ~/.openclaw/workspace
|
|
|
|
# Seeded as ~/.openclaw/workspace/AGENTS.md when missing
|
|
agentsMd: |
|
|
# OpenClaw Assistant
|
|
|
|
You are a helpful AI assistant running in Kubernetes.
|
|
|
|
# Upstream images run as uid/gid 1000 (user "node"); fsGroup makes the PVC writable
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
# Upstream manifests use a read-only root; off here because agent exec tools,
|
|
# npm/plugin installs and Chromium write outside ~/.openclaw (only /tmp and
|
|
# the PVC are writable when enabled).
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
resources:
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "2"
|
|
memory: "2Gi"
|
|
|
|
# In-memory /dev/shm; Chromium (browser variant) crashes on the 64Mi default
|
|
shmSize: 512Mi
|
|
|
|
# Persistent home dirs, each a subPath of one PVC mounted under /home/node:
|
|
# ~/.openclaw always (config, credentials, agent state DBs, workspace), plus
|
|
# the Claude CLI dirs when claudeCli.enabled, plus extraHomePaths.
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: ""
|
|
extraHomePaths: []
|
|
# - .config/gh
|
|
storageClass: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 10Gi
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
|
|
ingresses: {}
|
|
# https:
|
|
# host: openclaw.example.com
|
|
# annotations: {}
|
|
# tls:
|
|
# - hosts:
|
|
# - openclaw.example.com
|