OpenClaw Helm Chart

Helm chart for OpenClaw (gateway). Deploys a single-instance StatefulSet with persistent storage, secrets management, and an optional LiteLLM proxy for model routing.

Requirements

• Helm v3
• A Kubernetes cluster with PersistentVolume support (optional if persistence is disabled)

Install

Charts are published as OCI artifacts in GHCR.

1. Create a Telegram bot via @BotFather:

   • Message @BotFather, send /newbot, and follow the prompts
   • Save the token: export telegramBotToken=

2. Generate a gateway token:

   export gatewayToken=$(openssl rand -hex 32)
   

3. Install the chart:

   helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
      --create-namespace --namespace openclaw \
      --set secrets.openclawGatewayToken=$gatewayToken \
      --set secrets.telegramBotToken=$telegramBotToken
   

   This deploys the OpenClaw gateway and a LiteLLM proxy with Github Copilot provider (enabled by default).

4. (Alternative) Use a specific model provider (e.g. Anthropic):

   helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
      --create-namespace --namespace openclaw \
      --set secrets.openclawGatewayToken=$gatewayToken \
      --set secrets.telegramBotToken=$telegramBotToken \
      --set litellm.secrets.provider=anthropic \
      --set litellm.secrets.apiKey= \
      --set litellm.secrets.apiBase= \
      --set litellm.model=claude-opus-4.6
   

5. Access the portal:

   kubectl --namespace openclaw port-forward openclaw-0 18789:18789
   

   Then open in your browser.

6. (Optional) View the Chrome browser GUI via noVNC:

   kubectl --namespace openclaw port-forward openclaw-0 6080:6080
   

   Then open in your browser to see the Chrome desktop.

Browser GUI

Chrome runs in headed mode inside a virtual display. Access the desktop via noVNC on port 6080 to watch browser automation in real time.

Tailscale

Tailscale integration for secure access to the gateway without exposing public ports. When enabled, each StatefulSet pod registers as a unique device on your Tailscale network.

helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
  --set secrets.openclawGatewayToken=$gatewayToken \
  --set secrets.telegramBotToken=$telegramBotToken \
  --set tailscale.enabled=true \
  --set secrets.tailscaleAuthKey=tskey-auth-xxxxx \
  --set tailscale.hostname=openclaw

After deployment, access the gateway via its Tailscale hostname (e.g. openclaw-0) or Tailscale IP.

Skills

The container image ships with built-in skills — structured instruction sets that teach the OpenClaw agent how to operate external coding tools as managed sub-agents. Skills are installed at ~/.openclaw/skills/ inside the container.

Included Skills

Built-in skills are synced from the container image to the persistent volume on every pod start, so upgrading the chart or image automatically updates them.

Adding Custom Skills

Add custom skills by placing them in the persistent volume at ~/.openclaw/skills//. You can copy them into the running pod:

kubectl -n openclaw cp ./my-skill openclaw-0:/home/vibe/.openclaw/skills/my-skill

Alternatively, mount a ConfigMap as a skill directory via extraVolumes and extraVolumeMounts. This works for simple skills consisting of a single SKILL.md:

helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
  --set secrets.openclawGatewayToken=$gatewayToken \
  --set 'extraVolumes[0].name=custom-skills' \
  --set 'extraVolumes[0].configMap.name=my-skills' \
  --set 'extraVolumeMounts[0].name=custom-skills' \
  --set 'extraVolumeMounts[0].mountPath=/home/vibe/.openclaw/skills/my-skill' \
  --set 'extraVolumeMounts[0].readOnly=true'

External Skills (PVC / NFS)

For skills stored outside the main persistent volume — such as shared skill packs on a separate PVC or NFS share — use openclaw.skills.volumes to mount them and auto-wire them into the config:

helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
  --set secrets.openclawGatewayToken=$gatewayToken \
  --set secrets.telegramBotToken=$telegramBotToken \
  --set 'openclaw.skills.volumes[0].name=shared-skills' \
  --set 'openclaw.skills.volumes[0].mountPath=/skills/shared' \
  --set 'openclaw.skills.volumes[0].persistentVolumeClaim.claimName=shared-skills-pvc'

Each volume entry mounts a read-only volume and automatically adds its mountPath to the skills.load.extraDirs list in openclaw.json. Any Kubernetes volume type works (PVC, NFS, hostPath, etc.):

openclaw:
  skills:
    volumes:
      - name: shared-skills
        mountPath: /skills/shared
        persistentVolumeClaim:
          claimName: shared-skills-pvc
      - name: nfs-skills
        mountPath: /skills/nfs
        nfs:
          server: 10.0.0.1
          path: /exported/skills

For skill directories already on the main PVC, use extraDirs instead:

openclaw:
  skills:
    load:
      extraDirs:
        - /home/vibe/my-project/skills

See skills/README.md for skill structure and authoring details.

Memory

OpenClaw supports semantic memory search over the agent workspace (MEMORY.md + memory/*.md + session transcripts). When configured, the agent can recall prior conversations, decisions, and notes using natural-language queries via the memory_search tool.

Memory search requires an embedding service (e.g. OpenAI, Azure, Cohere) to generate vector embeddings for indexed content. Embedding credentials are stored in the LiteLLM Secret and routed through the LiteLLM proxy — they never appear in openclaw.json (a plain ConfigMap). Configure via litellm.secrets.embedding* values:

helm install openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
  --create-namespace --namespace openclaw \
  --set secrets.openclawGatewayToken=$gatewayToken \
  --set litellm.secrets.provider=anthropic \
  --set litellm.secrets.apiKey= \
  --set litellm.model=claude-opus-4.6 \
  --set secrets.telegramBotToken=$telegramBotToken \
  --set litellm.secrets.embeddingProvider=openai \
  --set litellm.secrets.embeddingApiKey=

To use a custom embedding endpoint (e.g. Azure OpenAI or a self-hosted service), also set embeddingApiBase:

  --set litellm.secrets.embeddingApiBase=https://my-endpoint.openai.azure.com/openai/v1/

Upgrade / Uninstall

# Upgrade
helm upgrade openclaw oci://ghcr.io/feiskyer/openclaw-kubernetes/openclaw \
  --namespace openclaw \
  --set secrets.openclawGatewayToken=$gatewayToken \
  --set secrets.telegramBotToken=$telegramBotToken

# Uninstall
helm uninstall openclaw --namespace openclaw

LiteLLM Proxy

The chart includes a LiteLLM proxy between OpenClaw and model providers, enabled by default (litellm.enabled: true).

LiteLLM provides:

1. Provider decoupling – OpenClaw talks only to the local LiteLLM endpoint. Switching providers (e.g. GitHub Copilot to Anthropic) requires only a Helm values change.
2. Credential isolation – API keys (both chat model and embedding) live in the LiteLLM Secret and are never injected into the OpenClaw container or ConfigMap. OpenClaw authenticates to LiteLLM with a dummy token over the cluster-internal network.

Values and configuration

Quick reference

See dedicated sections below for Secrets, Messaging Platforms, Web Search, and LiteLLM Proxy.

Preset values files

Persistence and data directory

Persistence is enabled by default (persistence.enabled: true) using the cluster’s default StorageClass.

Secrets

Two modes:

1. Set values under secrets.* and let the chart create a Secret.
2. Reference an existing secret via secrets.existingSecret.

secrets.openclawGatewayToken is required when not using secrets.existingSecret.

LiteLLM has its own secret (-litellm) configured via litellm.secrets.*:

Messaging Platforms

OpenClaw supports multiple messaging platforms. Configure credentials via secrets.* values or an existing secret.

Web Search

OpenClaw supports web search via Brave or Perplexity. When an API key is configured, tools.web.search is automatically enabled in openclaw.json.

📖 Web Search Documentation

Development

# Lint the chart
./scripts/helm-lint.sh

# Render templates with each values file
./scripts/helm-test.sh

# Ad-hoc template rendering
helm template openclaw . -f values.yaml

FAQ

Links

• OpenClaw (formerly Moltbot/Clawdbot)
• OpenClaw Documentation
• AI Agent Community
• Source Code

Acknowledgments

License

This project is licensed under the MIT License.