A Helm chart for deploying OpenClaw AI agent pods on Kubernetes.

Deploy an AI agent in 2 files instead of 8+. KubeClaw handles the namespace, deployment, service, PVC, RBAC, config generation, and optional scheduled workflows — all from a single HelmRelease values file and a secret.

KubeClaw deploys an OpenClaw agent pod that:

1. Clones your git repos via SSH
2. Connects to Matrix and/or Telegram
3. Listens for messages and executes skills (markdown instruction files)
4. Optionally runs scheduled multi-step workflows via CronJobs

Each agent gets its own namespace (devpod-{name}), persistent storage, service account, and service endpoint.

A working agent needs just an agentName, a git repo, and a secret:

# helmrelease.yaml
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: myagent
  namespace: flux-system
spec:
  targetNamespace: devpod-myagent
  install:
    createNamespace: true
  chart:
    spec:
      chart: .
      sourceRef:
        kind: GitRepository
        name: kubeclaw
        namespace: flux-system
  values:
    agentName: myagent

    image:
      repository: your-registry/openclaw

    git:
      repos:
        - url: "git@github.com:yourorg/myproject.git"
          path: "/data/repos/myproject"

    channels:
      matrix:
        homeserver: "https://matrix.example.com"

    skills:
      myagent.md: |
        # My Agent
        You are a dev agent for myproject at /data/repos/myproject.

    existingSecret: devpod-secrets

# devpod-secrets.enc.yaml (SOPS-encrypted)
apiVersion: v1
kind: Secret
metadata:
  name: devpod-secrets
  namespace: devpod-myagent
stringData:
  MATRIX_ACCESS_TOKEN: "syt_..."
  GITHUB_TOKEN: "ghp_..."
  git-ssh-key: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
  claude-credentials.json: |
    {"oauth_token": "..."}

Commit both files, push, and Flux deploys a running agent.

Workflows are scheduled multi-step pipelines. Add a workflows block to run agent tasks on a cron schedule:

# Add to your HelmRelease values:
workflows:
  daily-summary:
    schedule: "0 9 * * 1-5"        # 9 AM UTC, weekdays
    notify:
      telegram:
        chatId: "123456789"
    steps:
      - name: summarize
        notify: true
        timeout: 300
        skill: |
          Summarize the latest commits in /data/repos/myproject.
          Format for Telegram, keep it under 3000 chars.

This creates a CronJob that kubectl execs into the agent pod, runs the skill, and sends the output to Telegram.

Workflows support multiple sequential steps, automatic git report commits, and context variables passed between steps. See examples/workflow-product-iteration.yaml for a multi-step example.

See examples/ for complete configurations of each variant.

For every agent:

Optional resources:

• ClusterRoleBinding to cluster-admin (when rbac.clusterAdmin.enabled: true)
• ClusterRole + ClusterRoleBinding for orchestrator (when rbac.orchestrator.enabled: true and clusterAdmin is disabled)

When workflows are defined, adds per-workflow CronJob + shared workflow RBAC.

All optional — include only what your agent needs:

Agents are reachable within the cluster at:

{name}-devpod.devpod-{name}.svc.cluster.local:18789

# Install test plugin
helm plugin install https://github.com/helm-unittest/helm-unittest.git

# Run tests (90 tests, 12 suites)
make test

# Lint
make lint

# Template an example
make template

# Template all examples
make template-all

# Pod not starting — check events and startup logs
kubectl describe pod -n devpod-{name} -l app.kubernetes.io/instance={name}
kubectl logs -n devpod-{name} deployment/{name}-devpod -f

# Workflow not running — check CronJob and trigger manually
kubectl get cronjobs -n devpod-{name}
kubectl create job -n devpod-{name} "test-$(date +%s)" --from=cronjob/{name}-wf-{workflow}

# Secret missing
kubectl get secret -n devpod-{name} devpod-secrets

MIT