kubeclaw

OpenClaw operator for Kubernetes.

What it does

Kubeclaw runs Scobleclaw agents as Kubernetes workloads. It provides:

• CRDs for declaring agents, tool bindings, and judge policies as K8s resources
• Controller that reconciles desired state → running pods with proper config injection
• Agent Judge integration as a K8s admission webhook for per-tool authorization
• Helm chart for easy deployment

Architecture

┌─────────────────────────────────────────────┐
│  Kubeclaw Controller Manager                │
│                                             │
│  ┌─────────┐  ┌──────────┐  ┌───────────┐ │
│  │ Agent    │  │ Agent    │  │ Judge     │ │
│  │ Reconciler│ │Group    │  │ Webhook   │ │
│  │         │  │ Reconciler│  │ Handler   │ │
│  └────┬────┘  └────┬─────┘  └─────┬─────┘ │
│       │             │              │        │
│  ┌────▼────┐  ┌────▼─────┐  ┌────▼─────┐ │
│  │ ConfigMap│  │ Secret   │  │ Validating│ │
│  │ Generator│  │ Generator│  │ Admission │ │
│  └─────────┘  └──────────┘  └───────────┘ │
└─────────────────────────────────────────────┘

CRDs

Agent

Defines a single Scobleclaw agent deployment.

apiVersion: scobleclaw.ai/v1alpha1
kind: Agent
metadata:
  name: marcus-chief-of-staff
spec:
  model: deepseek-v4-pro:cloud
  workspace:
    configMapRef: marcus-workspace
  channels:
    - discord:
        botTokenSecretRef:
          name: discord-bot-token
          key: token
  judge:
    enabled: true
    model: deepseek-v4-pro:cloud
    shadowMode: false
  resources:
    requests:
      memory: "512Mi"
      cpu: "250m"

AgentGroup

Manages a group of related agents (e.g., all Scobleclaw departments).

JudgePolicy

Defines authorization policies for the Agent Judge admission webhook.

Quick Start

# Install CRDs
make install

# Run controller locally
make run

# Deploy to cluster
helm install kubeclaw ./charts/kubeclaw

Development

# Generate CRD manifests and client code
make generate

# Run tests
make test

# Build manager binary
make build

License

MIT