7f32181ebe
entrypoint.sh creates /home/agent/vol/.openclaw-initializing at startup and removes it just before launching the gateway. Pod is not marked ready until init (volume copy + config baking) is fully complete. deployment.yaml adds readinessProbe: exec test ! -f sentinel, with initialDelaySeconds=5, periodSeconds=5, failureThreshold=60 (5 minute window for slow storage on first deploy).
256 lines
8.7 KiB
YAML
256 lines
8.7 KiB
YAML
# OpenClaw + PAI Kubernetes Deployment
|
|
#
|
|
# Sensitive values should be stored in a Secret and referenced via secretKeyRef.
|
|
# Non-sensitive values can be set directly in the env block below.
|
|
#
|
|
# Quick start:
|
|
# kubectl apply -f deployment.yaml
|
|
#
|
|
# To create the secrets manually:
|
|
# kubectl create secret generic openclaw-pai-secrets \
|
|
# --from-literal=OPENCLAW_GATEWAY_TOKEN=your-token \
|
|
# --from-literal=ANTHROPIC_API_KEY=your-key \
|
|
# --from-literal=GEMINI_API_KEY=your-key \
|
|
# --from-literal=OPENCLAW_TLS_CERT=$(base64 -w0 cert.pem) \
|
|
# --from-literal=OPENCLAW_TLS_KEY=$(base64 -w0 key.pem)
|
|
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: openclaw-pai-vol
|
|
# namespace: your-namespace
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
# storageClassName: your-storage-class
|
|
|
|
---
|
|
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openclaw-pai
|
|
# namespace: your-namespace
|
|
labels:
|
|
app: openclaw-pai
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: openclaw-pai
|
|
# OpenClaw maintains stateful session and gateway data on the PVC.
|
|
# Do not scale replicas above 1 without a shared storage solution.
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: openclaw-pai
|
|
spec:
|
|
containers:
|
|
- name: openclaw-pai
|
|
image: registry.nerdrage.cloud/spaceacemonkey/openclaw-pai:0.0.2
|
|
imagePullPolicy: Always
|
|
|
|
ports:
|
|
- name: gateway
|
|
containerPort: 18800
|
|
protocol: TCP
|
|
|
|
volumeMounts:
|
|
- name: vol
|
|
mountPath: /home/agent/vol
|
|
|
|
readinessProbe:
|
|
exec:
|
|
command: ["test", "!", "-f", "/home/agent/vol/.openclaw-initializing"]
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
failureThreshold: 60
|
|
|
|
env:
|
|
|
|
# ── Required ────────────────────────────────────────────
|
|
|
|
# Gateway auth token — what users type to log in to the web UI
|
|
- name: OPENCLAW_GATEWAY_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openclaw-pai-secrets
|
|
key: OPENCLAW_GATEWAY_TOKEN
|
|
|
|
# Primary model for OpenClaw agent
|
|
- name: OPENCLAW_DEFAULT_MODEL
|
|
value: "litellm/claude-sonnet-4-6"
|
|
|
|
# Display name for the OpenClaw agent (also seeded into IDENTITY.md on first deploy)
|
|
- name: OPENCLAW_AGENT_NAME
|
|
value: "Seift"
|
|
|
|
# API key for Claude Code / PAI / LiteLLM
|
|
- name: ANTHROPIC_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openclaw-pai-secrets
|
|
key: ANTHROPIC_API_KEY
|
|
|
|
# Primary model for PAI / Claude Code
|
|
- name: ANTHROPIC_MODEL
|
|
value: "claude-sonnet-4-6"
|
|
|
|
# Lightweight model for PAI
|
|
- name: ANTHROPIC_SMALL_FAST_MODEL
|
|
value: "claude-haiku-4"
|
|
|
|
# Display name for the PAI agent identity
|
|
- name: PAI_AGENT_NAME
|
|
value: "Seift"
|
|
|
|
# ── OpenClaw — TLS ──────────────────────────────────────
|
|
|
|
# TLS mode: off | auto | custom
|
|
- name: OPENCLAW_TLS
|
|
value: "off"
|
|
|
|
# Required when OPENCLAW_TLS=custom — base64-encoded cert PEM
|
|
# - name: OPENCLAW_TLS_CERT
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: openclaw-pai-secrets
|
|
# key: OPENCLAW_TLS_CERT
|
|
|
|
# Required when OPENCLAW_TLS=custom — base64-encoded key PEM
|
|
# - name: OPENCLAW_TLS_KEY
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: openclaw-pai-secrets
|
|
# key: OPENCLAW_TLS_KEY
|
|
|
|
# ── OpenClaw — config ───────────────────────────────────
|
|
|
|
# Gateway port (also update containerPort above if changed)
|
|
- name: OPENCLAW_GATEWAY_PORT
|
|
value: "18800"
|
|
|
|
# Comma-separated extra allowed origins for the web UI
|
|
# e.g. https://openclaw.example.com or https://192.168.0.94:18800
|
|
# - name: OPENCLAW_ALLOWED_ORIGINS
|
|
# value: "https://openclaw.example.com"
|
|
|
|
# Set to "true" to bypass device pairing for the web UI
|
|
- name: OPENCLAW_DISABLE_DEVICE_AUTH
|
|
value: "false"
|
|
|
|
# Gateway bind mode: lan (default) | loopback
|
|
- name: OPENCLAW_GATEWAY_BIND
|
|
value: "lan"
|
|
|
|
# Override the agent workspace path (defaults to $OPENCLAW_STATE_DIR/workspace)
|
|
# - name: OPENCLAW_WORKSPACE
|
|
# value: "/home/agent/vol/.openclaw/workspace"
|
|
|
|
# ── OpenClaw — LiteLLM ──────────────────────────────────
|
|
|
|
# If set, adds a LiteLLM provider block pointing at this URL
|
|
- name: LITELLM_BASE_URL
|
|
value: "http://localhost:4000"
|
|
|
|
# Base URL for Anthropic/LiteLLM API calls from Claude Code
|
|
- name: ANTHROPIC_BASE_URL
|
|
value: "http://localhost:4000"
|
|
|
|
# ── OpenClaw — memory search ────────────────────────────
|
|
|
|
# Memory search provider: gemini (only supported value currently)
|
|
# Requires GEMINI_API_KEY to be set
|
|
# - name: OPENCLAW_MEMORY_SEARCH_PROVIDER
|
|
# value: "gemini"
|
|
|
|
# Gemini API key — used for memory search and passed through to OpenClaw natively
|
|
# - name: GEMINI_API_KEY
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: openclaw-pai-secrets
|
|
# key: GEMINI_API_KEY
|
|
|
|
# ── OpenClaw — native passthrough ───────────────────────
|
|
|
|
# OpenAI API key — passed through to OpenClaw natively if needed
|
|
# - name: OPENAI_API_KEY
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: openclaw-pai-secrets
|
|
# key: OPENAI_API_KEY
|
|
|
|
# OpenClaw state directory — should match PVC mountPath + /.openclaw
|
|
- name: OPENCLAW_STATE_DIR
|
|
value: "/home/agent/vol/.openclaw"
|
|
|
|
# ── PAI / Claude Code ───────────────────────────────────
|
|
|
|
# PAI state directory
|
|
- name: PAI_DIR
|
|
value: "/home/agent/vol/.claude"
|
|
|
|
# Must always match PAI_DIR
|
|
- name: CLAUDE_CONFIG_DIR
|
|
value: "/home/agent/vol/.claude"
|
|
|
|
# PAI config directory
|
|
- name: PAI_CONFIG_DIR
|
|
value: "/home/agent/vol/.config/PAI"
|
|
|
|
# Projects directory passed to PAI
|
|
- name: PROJECTS_DIR
|
|
value: "/home/agent/vol/repositories"
|
|
|
|
# ── PAI — voice server ──────────────────────────────────
|
|
|
|
# Voice server URL for PAI TTS integration
|
|
- name: VOICE_SERVER_URL
|
|
value: "http://localhost:8888"
|
|
|
|
# ElevenLabs API key — enables VoiceServer integration
|
|
# - name: ELEVENLABS_API_KEY
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: openclaw-pai-secrets
|
|
# key: ELEVENLABS_API_KEY
|
|
|
|
# ── Deployment control ──────────────────────────────────
|
|
|
|
# Set to "true" to wipe and redeploy OpenClaw state from image on next start.
|
|
# Remove or set to "false" after use — leaving it "true" wipes state on every restart.
|
|
- name: FORCE_OPENCLAW_REDEPLOY
|
|
value: "false"
|
|
|
|
# Set to "true" to wipe and redeploy PAI state from image on next start.
|
|
# Remove or set to "false" after use — leaving it "true" wipes state on every restart.
|
|
- name: FORCE_PAI_REDEPLOY
|
|
value: "false"
|
|
|
|
volumes:
|
|
- name: vol
|
|
persistentVolumeClaim:
|
|
claimName: openclaw-pai-vol
|
|
|
|
---
|
|
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: openclaw-pai
|
|
# namespace: your-namespace
|
|
spec:
|
|
selector:
|
|
app: openclaw-pai
|
|
ports:
|
|
- name: gateway
|
|
port: 18800
|
|
targetPort: gateway
|
|
protocol: TCP
|
|
type: ClusterIP
|