stubbi/openclaw-operator

Kubernetes operator for deploying and managing OpenClaw AI agent instances with production-grade security, observability, and lifecycle management.

What it solves

OpenClaw Kubernetes Operator simplifies the deployment and management of OpenClaw AI agents on Kubernetes. It replaces the manual configuration of multiple Kubernetes resources (like StatefulSets, Services, and NetworkPolicies) with a single declarative custom resource, ensuring production-grade security, observability, and lifecycle management for self-hosted AI agents.

How it works

The operator uses a custom resource definition (CRD) called OpenClawInstance to manage the entire agent stack. When a user defines an instance, the operator reconciles it into a set of 9+ managed resources, including RBAC, persistent storage, and network isolation. It also supports an OpenClawSelfConfig resource, allowing agents to autonomously update their own skills, configuration, and environment variables via the Kubernetes API, subject to an allowlist policy.

Who it’s for

Developers and platform engineers who want to run OpenClaw AI agents on their own infrastructure using Kubernetes, requiring operational rigor, security hardening, and automated lifecycle management.

Highlights

  • Declarative Management: A single CRD manages the entire stack, including StatefulSets, Services, and Ingress.
  • Agent Self-Configuration: Agents can autonomously install skills and patch their own config via the Kubernetes API.
  • Hardened Security: Default non-root users, read-only root filesystems, and default-deny NetworkPolicies.
  • Operational Resilience: Includes S3-backed snapshots for backup/restore, auto-scaling via HPA, and auto-updates via OCI registry polling.
  • Extensible Architecture: Supports sidecars for Chromium (browser automation), Ollama (local LLMs), and Tailscale (tailnet access).
  • Disk-Aware Readiness: An optional guard that prevents pods from accepting traffic if the workspace volume is full or read-only.

Related

  • Project
    openclaw/openclaw-enterprise

    An open-source, vendor-neutral platform for managing and deploying AI agents, functioning as a control plane for agent orchestration similar to Kubernetes.

  • Project
    kagent-dev/kagent

    A Kubernetes-native framework for building and managing AI agents, allowing them to be deployed and managed as declarative Kubernetes resources.

  • Project
    chrysb/alphaclaw

    A management harness for OpenClaw that provides a web-based UI, self-healing watchdog, and automated Git sync to simplify the deployment and maintenance of AI agents.

  • Project
    Yuan-lab-LLM/ClawManager

    ClawManager is an open‑source, Kubernetes‑native control plane that lets operators provision, govern, and collaborate on AI‑agent workspaces (OpenClaw, Hermes, OpenCode, DeepSeek Harness). It bundles a React UI, Go backend, MySQL state, and a set of services (AI Gateway, Northbound API, Security Protection) to provide one‑click runtime creation, model‑access auditing, reusable resource injection, team‑based task decomposition, and layered security monitoring. Deployable on k3s or full Kubernetes clusters, it targets platform teams that need scalable, policy‑driven AI agent infrastructure.

  • Dispatch
    OpenClaw Machines: Enterprise Infrastructure for OpenClaw Agents

    OpenClaw Machines is an open-source platform that enables the deployment of multiple hardware-isolated OpenClaw AI agents on self-hosted infrastructure using Firecracker microVMs.