paperclipinc/openclaw-operator

What it solves

OpenClaw Kubernetes Operator simplifies the deployment and management of self-hosted AI agents on Kubernetes. It removes the operational complexity of manually configuring network isolation, secret management, persistent storage, and health monitoring by encoding these requirements into a single declarative resource.

How it works

The operator introduces a custom resource called OpenClawInstance. When a user defines this resource, the operator automatically reconciles it into a full stack of over nine Kubernetes resources, including StatefulSets, Services, NetworkPolicies, and PVCs. It also supports an OpenClawSelfConfig resource, which allows AI agents to autonomously request changes to their own configuration, skills, or environment variables via the Kubernetes API, subject to an allowlist policy.

Who it’s for

Developers and operators who want to run the OpenClaw AI agent platform on their own infrastructure with production-grade security and observability rather than using the managed hosting service.

Highlights

• Agent Self-Configuration: Agents can autonomously install skills and patch their own config through the Kubernetes API.
• Hardenened Security: Defaults to non-root users, read-only root filesystems, and default-deny NetworkPolicies.
• Disk-Aware Readiness: An optional guard that prevents pods from accepting traffic if the workspace volume is full or read-only.
• Automated Lifecycle: Includes OCI registry polling for auto-updates, S3-backed snapshots for backups, and HPA integration for scaling.
• Extensible Sidecars: Built-in support for Chromium (headless browser automation), Ollama (local LLMs), and Tailscale (secure networking).
• CORS Management: Automatically manages gateway tokens and Control UI allowed origins to ensure connectivity through reverse proxies.