paperclipinc/openclaw-operator

What it solves

Deploying AI agents to Kubernetes is complex, requiring the orchestration of network isolation, secret management, persistent storage, and health monitoring. The OpenClaw Kubernetes Operator simplifies this by encoding these operational requirements into a single declarative resource, allowing users to self-host AI agents with production-grade security and observability.

How it works

The operator introduces a custom resource called OpenClawInstance. When a user defines this resource, the operator automatically reconciles it into a full stack of over nine Kubernetes resources, including StatefulSets, Services, NetworkPolicies, and PersistentVolumeClaims.

Key mechanisms include:

• Adaptive Configuration: Agents can autonomously request changes to their own skills or environment via the OpenClawSelfConfig resource, which the operator validates against an allowlist.
• Lifecycle Management: It handles auto-updates via OCI registry polling, S3-backed snapshots for backup/restore, and auto-scaling via HPA integration.
• Hardened Security: By default, it deploys agents as non-root users with read-only root filesystems and default-deny NetworkPolicies.
• Sidecar Integration: It can automatically deploy sidecars for Chromium (browser automation), Ollama (local LLMs), or Tailscale (secure networking).

Who it’s for

Developers and organizations who want to self-host OpenClaw AI agents on their own Kubernetes infrastructure rather than using a managed service, specifically those requiring strict control over security, data persistence, and operational rigor.

Highlights

• Agent Self-Configuration: Allows agents to install skills and patch their own config at runtime through the Kubernetes API.
• Disk-Aware Readiness: Prevents pods from accepting traffic when the workspace volume is full or read-only, avoiding silent write failures.
• Declarative Stack: Manages the entire agent environment (RBAC, Ingress, PVC, etc.) via a single CRD.
• Built-in Observability: Integrated Prometheus metrics and structured JSON logging.
• S3 Snapshots: Automatic backups to S3-compatible storage during deletions or on a schedule.
• Flexible Runtime: Built-in init containers for pnpm and Python/uv to support MCP servers and skills.