Deploy OpenClaw Enterprise

Install OpenClaw Enterprise on Kubernetes, verify access to the OpenClaw Control Plane (OCC), then deploy an Agent and check its model response. Use Local Setup for a first installation on your machine. The production guides below are for operators using an existing cluster; Kubernetes Setup gives a short introduction. Run repository commands from the repository root. Starting OCC needs no model credential; an Agent needs one to send a model request.

Development

Use Local Setup to start the platform with Kubernetes and verify authenticated access. Then deploy your first Agent. The local Kubernetes development guide explains the profile for contributors working on the platform.

Verify development

Follow Local Setup to verify the control plane. That check proves authenticated access; it does not prove an Agent can answer a model request. Complete Deploy your first Agent for that result. For local Kubernetes images and cleanup, see local operations.

Open the platform console

Use Local Setup for local sign-in. In production, open /console/ on the approved internal HTTPS origin matching OCC_AUTH_BASE_URL. Sign in with a human administrator account; service keys are for automation. The console reference covers browser behavior and limits.

Production

Choose the guide for your cluster:

Standard Kubernetes: prepare an existing Kubernetes cluster, storage, networking, and PostgreSQL.
Amazon EKS: prepare AWS managed Kubernetes, node groups, VPC networking, EBS storage, and optional RDS PostgreSQL.

Both paths use the same Helm chart and shared installation procedure. Cluster hosting does not select the Agent model provider.

Production prerequisites

Kubernetes 1.35 or later, an explicit context, enforcing NetworkPolicies, Helm, a version-compatible kubectl, Python 3, yq v4, and the installed OCC CLI. Use Bash for image selection and model verification, and Node.js 24 or newer for profile generation or the API transport-credential example. Manual YAML plus console transport provisioning avoids those Node commands. Older Kubernetes servers produce a startup warning and remain outside the supported boundary.
Controller and runtime image digests and a chart matched to their source; see private image delivery.
External PostgreSQL with separate migrator and application roles.
A Kubernetes node pool labeled for OCC control-plane Pods. The production example selects nodes with oce-role: control; the chart default is {}. Set controlPlane.nodeSelector to the reviewed labels for your cluster.
A Kubernetes node pool labeled for Agent runtime Pods. The production Installation example selects nodes with oce-role: agents; set drivers.compute.configuration.runtime.nodeSelector to the reviewed labels for gateway and Agent scheduling.
Operator-managed HTTPS access for approved clients; the chart does not create TLS or Ingress.
Operator-created startup, database, authentication, optional Backend Secrets, fresh bootstrap PVC, gateway storage, and exact /32 egress destinations.

Production installation sequence

Follow these pages in order in the same operator shell:

Build images and install the control plane. Generate configuration from an installation profile (recommended) or copy the manual YAML examples, then create system Secrets, prepare the fresh bootstrap PVC, install the chart, and authenticate to the production API.
Prepare Namespaces and deploy Agents. Grant tenant RoleBindings, choose embedded OpenClaw or dedicated Codex, provision exact-Agent credentials, and deploy an immutable revision.
Verify the production workload. Confirm the active revision and require a real model response. The guide offers a TUI and an HTTP check using the optional loopback password on Kubernetes trusted-proxy gateways.

Before upgrading a retained installation, complete the upgrade migration checklist. Then use production image upgrades to release the control plane without replacing Agent revisions, or to update Agent runtimes and redeploy the running fleet. Runtime releases require an interruption window. For a persistent Helm installation on k3d, use local k3d image upgrades.

For ongoing business operation, use production handoff to record owners, credential renewal, alert response, and recovery decisions. When GitHub sign-in needs recovery or must be turned back off, use sign-in maintenance with the API stopped.

For private workspace-file administration, configure Agent workspace routing. For operational logs, use platform observability.

To exercise this production procedure in a disposable local Kubernetes cluster, build and import local images, then resume the production installation sequence with the generated YAML copies. For first-time setup, use Local Setup.

Stop or remove a production deployment

Inventory tenant workloads before uninstalling the control plane:

bash

helm uninstall oce --namespace openclaw-system \  --kubeconfig "$KUBECONFIG_FILE" --kube-context "$CONTEXT"

Helm does not own external PostgreSQL, operator-created Secrets, bootstrap PVCs, or tenant workloads created by Compute. Retain database, bootstrap storage, and tenant resources until recovery and retention requirements are satisfied.

For startup diagnosis, see the production startup flow. For runtime proof, see the production TUI flow.

Customization

Use Helm values, Kubernetes manifests, Installation startup YAML, and Collector Secrets for production. Use deploy/runtime for runtime image recipe and pinned source identity. The settings reference and Driver references own field defaults, precedence, and limits.

Trusted Installation YAML can also select the SSH Compute Driver; that reference owns host configuration, credentials, and operational limits.

Trusted Installation YAML can select a PluginDriver for Agent plugin resolution. Agent create/update stores structurally valid plugin maps; deployment startup validates catalog membership and policy support. SSH Compute rejects nonempty plugin maps and Agent default plugin approver policies, so use Kubernetes Compute for those runtime paths. See Agent plugins for the current contract and testing for fixture prerequisites.