Deploy and operate OpenClaw Enterprise
Use these guides to install and run OpenClaw Enterprise on Kubernetes. They are for operators responsible for the OpenClaw Control Plane (OCC), tenant Namespaces, networking, and runtime credentials. If you want to try the platform on your own machine, start with Local Setup.
Install the platform
For EKS, follow the complete quickstart from AWS prerequisites through browser access and Agent onboarding.
For a custom Kubernetes installation:
- Prepare the cluster, storage, and network.
- Install the control plane and make an authenticated API request. Helm readiness alone does not verify API access.
- Deploy a production Agent and verify the selected runtime. A selected version alone does not prove a model can answer; use the model response verification for trusted-proxy gateways.
- Prepare the production handoff to record who responds to failures and who owns credentials and access.
The installation overview lists shared prerequisites and explains which resources Helm leaves behind when you uninstall it.
Upgrade and recover
Start with the upgrade checklist, then follow production image upgrades or Installation configuration changes. If an upgrade fails, use upgrade recovery, including cleanup after an interrupted preflight.
Run the platform
| Task | Start here |
|---|---|
| Diagnose a failed installation, blocked Namespace, or unavailable control plane | Troubleshoot the platform |
| Configure or verify operational logs | Observability |
| Scrape application metrics | OCC metrics and production scraping |
| Check that NetworkPolicies isolate the control plane and each Agent | Check Agent network isolation |
| Connect the control plane to private Agent workspace files | Agent workspace routing |
| Set up and verify the trusted-operator native admin pilot | Agent native admin UI |
| Renew or revoke a credential | Credential rotation |
| Issue or revoke keys for scripts and services | Service API Keys |
For a failure isolated to one Agent, start with Agent troubleshooting.