Managed native configuration

This page is part of the Kubernetes storage and credentials reference.

With Gateway managed mode off, Kubernetes gives the Gateway a writable copy of its native configuration. With managed mode on, Kubernetes creates that copy only when the deployment uses runtime Gateway images and private gatewayRouting, and the saved Configuration meets the following native admin requirements.

• Trusted-proxy authentication accepts x-occ-identity: occ-workspace-files with operator.admin identity scopes.
• Trusted-proxy device auto-approval is enabled; the machine identity grant supplies administrator authority independently of device scopes.
• controlUi.enabled is true and controlUi.allowedOrigins is nonempty.
• Dangerous device-auth disabling and host-header origin fallback are disabled.

For those gateways, the managed ConfigMap remains read-only at /etc/openclaw-managed/openclaw.json. The nonroot init container copies it to /home/node/.openclaw/openclaw.json on the Pod-local emptyDir, and OPENCLAW_CONFIG_PATH points to that writable copy. Other managed Gateways read the ConfigMap directly at /etc/openclaw/openclaw.json.

Native edits change only the copy; Pod replacement or Agent redeployment restores the managed snapshot, while the persistent gateway and workspace claims retain their data. Pod-local provenance records Agent revision ID, snapshot hash and generated bridges; only matches with the managed baseline are rebuilt. Peer recovery and same-Pod restarts retain unrelated edits; conflicting bridge edits remain refused. Pod replacement clears copy/provenance. Edits stay outside OCE Configuration and AgentRevisions; see the native admin feature boundary and deployment procedure.

Configuration OpenClaw refuses at startup

When an embedded or dedicated Gateway starts, OpenClaw checks every setting. This includes the config of each plugin entry, even a disabled or denied plugin, against that plugin's schema. One failure stops the Gateway. When the Gateway exits before it first serves, its wrapper runs openclaw config validate. If that reports the configuration invalid, the wrapper holds the failed check gateway-config (code UNAVAILABLE) instead of restarting, and the worker fails the deployment with RUNTIME_STARTUP_FAILED within seconds. The Gateway log names up to five setting paths, with OpenClaw's schema message where it gives one, and never their values. Fix or remove those settings, then deploy a new version. A dedicated Gateway validates its configuration before OpenClaw starts. It holds gateway-config the same way when no invalid setting belongs to its Gateway tool policy, and gateway-tool-policy otherwise.

Custom Codex provider capabilities

runtime.modelProvider.supportsStandaloneWebSearch defaults to false. Set it to true only when the explicit runtime.modelProvider.baseUrl supports Codex's standalone web-search protocol. True without that endpoint or a nonboolean value is rejected.

For dedicated Codex API-key authentication, OCE writes supports_standalone_web_search = true under the existing custom provider in Codex's user configuration. Account logins and other Harnesses ignore this declaration. Protected providerTools: none still disables web search. The option does not grant network access or validate endpoint support. Deploy a new Agent revision to apply a changed declaration.