mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-10-12 21:59:18 +00:00
103 lines
2.7 KiB
YAML
103 lines
2.7 KiB
YAML
# Default values for OpenClaw Gateway Helm Chart
|
|
image:
|
|
repository: ghcr.io/openclaw/openclaw
|
|
# Tag is "<appVersion>" or "<appVersion>-<variant>". Variants: "" (default,
|
|
# bundles codex + diagnostics-otel), "slim", "browser" (Chromium baked in for
|
|
# the Gateway-controlled browser).
|
|
variant: slim
|
|
pullPolicy: IfNotPresent
|
|
|
|
timezone: "Europe/Kyiv"
|
|
|
|
# Gateway port (WS + HTTP multiplexed: Control UI, probes, API)
|
|
httpPort: 18789
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 18789
|
|
|
|
# Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
|
|
# become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds
|
|
# refuse to start without gateway auth), ANTHROPIC_OAUTH_TOKEN (Claude
|
|
# setup-token), ANTHROPIC_API_KEY, OPENAI_API_KEY, ... The chart never creates it.
|
|
existingSecret: ""
|
|
|
|
# Extra plain environment variables (rendered as name/value pairs)
|
|
env: {}
|
|
|
|
# Seed config. Copied into the PVC only when missing (first boot); after that
|
|
# the PVC copy is the source of truth, so edits made through OpenClaw (Control
|
|
# UI, `openclaw config set`, doctor --fix) survive restarts. To reseed from
|
|
# here: delete ~/.openclaw/openclaw.json in the pod and restart.
|
|
config:
|
|
gateway:
|
|
mode: local
|
|
# Listen on the pod IP so the Service/Ingress can reach it (upstream
|
|
# default "loopback" only works with kubectl port-forward)
|
|
bind: lan
|
|
port: 18789
|
|
auth:
|
|
mode: token
|
|
controlUi:
|
|
enabled: true
|
|
agents:
|
|
defaults:
|
|
workspace: ~/.openclaw/workspace
|
|
|
|
# Seeded as ~/.openclaw/workspace/AGENTS.md when missing
|
|
agentsMd: |
|
|
# OpenClaw Assistant
|
|
|
|
You are a helpful AI assistant running in Kubernetes.
|
|
|
|
# Upstream images run as uid/gid 1000 (user "node"); fsGroup makes the PVC writable
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
# Upstream manifests use a read-only root; off here because agent exec tools,
|
|
# npm/plugin installs and Chromium write outside ~/.openclaw (only /tmp and
|
|
# the PVC are writable when enabled).
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
resources:
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "2"
|
|
memory: "2Gi"
|
|
|
|
# In-memory /dev/shm; Chromium (browser variant) crashes on the 64Mi default
|
|
shmSize: 512Mi
|
|
|
|
# Persistent ~/.openclaw (config, credentials, agent state DBs, workspace)
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: ""
|
|
storageClass: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 10Gi
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
|
|
ingresses: {}
|
|
# https:
|
|
# host: openclaw.example.com
|
|
# annotations: {}
|
|
# tls:
|
|
# - hosts:
|
|
# - openclaw.example.com
|