A platform for running OpenClaw AI assistants at scale on OpenShift. This repo is the central hub for issues, documentation, and cross-project coordination. No code lives here — open issues at github.com/redhat-et/claw-project/issues.
A set of workflows for deploying and managing OpenClaw instances for different kinds of users. A cluster admin deploys multiple instances using preconfigured templates from claw-collections via a GitOps approach, controlling how much freedom each user gets — from a completely locked-down kiosk to full self-service.
| Persona | What they do | Where to start |
|---|---|---|
| Cluster Admin | Deploys instances via GitOps, sets security policies, manages credentials | Deployment scenarios |
| Power User | Self-manages their OpenClaw with full control over persona, skills, and models | Deployer guide |
| Business User | Uses a curated assistant (HR, Sales, etc.) preconfigured by admin | Enterprise onboarding (Scenario B) |
| Developer | Codes with OpenClaw, customizes workspace, creates collections | Collections guide |
The spec.config.management field on every Claw CR controls how
much freedom the user has:
user operator
├─────────────────────────────────────────────────────────────┤
Full freedom Fully locked down
Power users Regulated kiosks
User edits persist Operator reconciles on restart
| Mode | User can | Admin controls | Best for |
|---|---|---|---|
user |
Modify persona, install skills, change models, add plugins | Credentials, network egress, proxy boundary | Developers, power users |
operator |
Use the assistant as configured | Everything: persona, skills, models, network, plugins | Business users, regulated environments |
In between, admins combine mode with network policies, read-only persona mounts, and skill allowlists to fine-tune the control level. See Scenario F for the most restrictive example.
Clone these so your local AI can read them and guide you, and so you can fix and contribute:
| Repo | Clone | What it is |
|---|---|---|
| openclaw | github.com/openclaw/openclaw | The OpenClaw agent — config, skills, plugins, the Control UI |
| claw-operator | github.com/redhat-et/claw-operator | The OpenShift operator — defines the Claw CR, manages instances |
| claw-operator-extras | github.com/redhat-et/claw-operator-extras | The Deployer web app and admin dashboard |
| claw-collections | github.com/redhat-et/claw-collections | Reusable workspace bundles (collections) and examples |
| claw-project | github.com/redhat-et/claw-project | This hub — issues and documentation |
Step-by-step scenario walkthroughs — start here.
| Guide | What you'll build |
|---|---|
| Your first AI assistant | Personal instance (D), then a shared team setup (A) |
| Registry lockdown | Block public registries, use internal mirrors |
| Locked-down kiosk | Regulated environment with strict guardrails |
| GitHub-aware assistant | Non-LLM API access via proxy credential injection |
Per-department profiles (Scenario B) and autonomous agent (Scenario E) walkthroughs are planned. See all scenarios for the full list.
Recommended practices for running OpenClaw well. See the operations guide for the full index.
| Topic | Status |
|---|---|
| GitOps deployment with Argo CD | Available |
| Git-based change tracking | Available |
| Sealed Secrets for credentials | Available |
| Custom agent image | Available |
| Agent backup and restore (static keys) | Available |
| S3 file exchange with Workload Identity | Available |
| Google Meet and Calendar API setup | Available |
| Cost attribution, upgrades, monitoring | Planned |
Deep-dive material for evaluation, architecture, and customization.
| Document | Description |
|---|---|
| Enterprise onboarding workflows | Six deployment scenarios — overview and CRD gap analysis |
| Operator technical brief | Architecture, security model, and operational characteristics |
| Proxy security FAQ | How the credential proxy works, what it enforces, and remaining attack surface |
| Collections guide | Creating and using preconfigured workspace bundles |
| Deployer guide | Using the web app to manage OpenClaw instances |
| Document | Description |
|---|---|
| Enterprise deployment design | Proposed features: OCI skill delivery, configurable passthroughs, persona modes |
| Business users configuration | Configuration strategies for locked-down business user instances |