Yuan-lab-LLM/ClawManager

A Kubernetes-native control plane for AI agent instance management, with governed AI access, runtime orchestration, and reusable resources across multiple agent runtimes.

ClawManager – A Kubernetes‑native control plane for AI agents

What it is – ClawManager is an open‑source platform that lets you run, govern, and collaborate on AI‑agent workspaces (e.g., chat‑bots, coding assistants) inside a Kubernetes cluster. It provides a single web console that combines runtime orchestration, model‑access governance, reusable resource injection, team‑based collaboration, and security monitoring.

Why it matters – Deploying AI agents at scale usually requires a lot of manual Kubernetes plumbing: creating pods, handling storage, securing model API keys, and tracking usage. ClawManager abstracts all of that into a “control plane” so operators can provision agents with a click, enforce policies, and audit AI traffic without exposing the underlying cluster to end users.

Core capabilities (as described in the README)

Area	What you get
Runtime & instance management	Create and manage OpenClaw, Hermes, OpenCode, or DeepSeek Harness workspaces in Lite (shared gateway pool) or Pro (dedicated desktop) mode. Control CPU/memory/storage, view files, get shell/desktop access, and generate password‑protected Share Links.
Northbound API & enterprise auth	A separate API gateway with JWE auth, scoped tokens, mTLS, LDAP/LDAPS support, and rate‑limiting. External systems can create, query, restart, or reset instances programmatically.
AI Gateway	Centralised, governed entry point for model calls (OpenAI, Anthropic, etc.). Provides model catalog, health, pricing, audit logs, per‑instance token accounting, and risk‑rule routing.
Agent Control Plane	Runtime agents register securely, send heartbeats, receive commands, and stay in sync with the desired state defined in the console.
Resource Management	Reusable “Resources”, “Resource Packs”, and “Injection Records” for channels, skill ZIPs, scheduled tasks, and environment variables. Skill Hub adds versioning, ownership, and publishing.
Team Collaboration	Leader‑mediated workspaces where a single OpenClaw Lite “Leader” decomposes a user request, dispatches tasks to Workers (OpenClaw/Hermes Lite), tracks progress via an Execution Kanban, and publishes a final synthesized result.
Security Protection Platform	Admin‑only console showing four defense layers (runtime, host/container, component trust, outbound governance), live alerts, kill‑switch, full‑chain audit, and policy configuration.

Architecture snapshot

Frontend – React (v19) UI, served as a web portal for users and admins.
Backend – Go 1.21+ services handling control‑plane logic, API gateway, and security modules.
State store – MySQL for persistent platform data.
Kubernetes – Deployable on any K8s distribution (k3s or full‑size clusters). Uses standard CSI storage classes (example: Longhorn) and can run in single‑node or multi‑node setups.
Runtime pods – Managed workspaces run as side‑car containers (Lite) or dedicated Deployments (Pro) inside the cluster.
Supporting services – Skill scanner, object storage, Redis Team Bus for team messaging, and optional LDAP integration.

Typical workflow

Admin defines governance policies (model access, cost limits, security rules) and creates reusable resources (skills, channel templates).
User opens the portal, selects a runtime (e.g., OpenClaw Lite), and launches a workspace.
The workspace pod registers with the Agent Control Plane and receives its desired configuration.
All AI calls from the workspace flow through the AI Gateway, where they are logged, cost‑tracked, and optionally rerouted based on risk rules.
For collaborative tasks, the user creates a Team; the Leader decomposes the request, assigns Workers, and aggregates results.
Admins monitor security alerts and can trigger a circuit‑breaker to halt suspicious activity.

Getting started (from the README)

Choose a Kubernetes distribution – k3s (single‑node or cluster) or a standard k8s cluster.
Apply the appropriate clawmanager.yaml manifest from the deployments/ folder (examples include HostPath for single‑node or CSI/RWX for clustered storage).
Follow the User Guide (docs/use_guide_en.md) for first‑login flow.
Optional: Deploy the Northbound API add‑on (deployments/k8s/northbound/) if you need external programmatic control.
Configure LDAP or other auth methods via the admin console if required.

Who should consider using it

Platform/DevOps teams that need to serve many AI‑agent instances to internal users or customers without hand‑crafting Kubernetes objects for each.
Product teams building AI‑augmented applications that require governed model usage, cost visibility, and audit trails.
Security‑focused organisations that want built‑in runtime hardening, policy enforcement, and incident‑response tooling for AI workloads.
Research labs that want a shared “Team” workspace where multiple agents can collaborate on a single problem.

Community & support

Discord & WeChat groups (QR codes in the README) for real‑time discussion.
Open issue tracker on GitHub for bugs and feature requests.
MIT license – free to use, modify, and commercialise.

Bottom line – ClawManager is a full‑stack, Kubernetes‑native platform that turns AI agents into first‑class, governable workloads, handling everything from provisioning to security and cost accounting in a single web‑based control plane.