Repository navigation
feat: Add containerized OpenClaw agent - #94
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughThis PR adds comprehensive OpenClaw agent deployment support by introducing documentation and Kubernetes manifests for running OpenClaw on OpenShift. Changes include updating the AGENTS registry, adding deployment guides, Kubernetes resources (secrets, ConfigMaps, PVCs, Deployment, Service, Route), and customizable Kustomize overlays for different deployment scenarios (standard and Codex Harness). ChangesOpenClaw Agent Deployment
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Large PR detected (1548 lines changed) This PR exceeds 1200 lines of code changes (excluding lock files, generated content, and images). Large PRs are harder to review thoroughly and are more likely to introduce bugs. Consider splitting this PR into smaller, focused changes. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
agents/openclaw/openclaw_agent/overlays/codex-harness/deployment-patch.yaml (1)
10-57:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHarden container securityContext for restricted-v2 and scanner findings.
Both
gatewayandcodex-app-serverare patched without explicit container security context (Lines 10-57). That leaves privilege defaults and is flagged by Checkov/Trivy.Suggested patch
- name: gateway + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] env: - name: OPENCLAW_GATEWAY_TOKEN valueFrom: secretKeyRef: name: openclaw-secrets @@ - name: codex-app-server image: ghcr.io/openai/codex-app-server:latest + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] args: - "app-server" - "--listen" - "ws://0.0.0.0:39175"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/openclaw/openclaw_agent/overlays/codex-harness/deployment-patch.yaml` around lines 10 - 57, The containers "gateway" and "codex-app-server" lack explicit container-level securityContext causing scanner findings; add a securityContext block under each container spec (for the container entries named gateway and codex-app-server) that enforces non-root execution (runAsNonRoot: true and a non-root runAsUser), disables privilege escalation (allowPrivilegeEscalation: false), drops all capabilities (capabilities: drop: ["ALL"]), sets readOnlyRootFilesystem: true, and includes a seccompProfile (type: RuntimeDefault) and restrictive procMount if desired; ensure these fields are added to each container definition so the readinessProbe and existing env/ports/resources remain unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 58: Replace the non-deterministic image reference
ghcr.io/openclaw/openclaw:latest used by openclaw/openclaw_agent with a specific
version tag or immutable digest across all manifests and documentation; update
the Kustomize overlays and any deployment YAMLs that reference
ghcr.io/openclaw/openclaw to use a pinned tag (e.g.,
ghcr.io/openclaw/openclaw:vX.Y.Z) or a digest (sha256:...) and update AGENTS.md
text to show the pinned reference so deployments are reproducible and
supply-chain controlled.
In `@agents/openclaw/openclaw_agent/docs/codex-harness.md`:
- Around line 7-23: The markdown diagram block in codex-harness.md is using an
unlabeled fenced code block which triggers markdownlint MD040; change the
opening fence from ``` to ```text for the ASCII art and ensure there's a blank
line before and after the fenced block (preserve the diagram content unchanged)
so the fenced block around the Pod/gateway/codex diagram is explicitly labeled
and lint-safe.
In `@agents/openclaw/openclaw_agent/docs/installer-deployment.md`:
- Around line 35-58: The markdown blocks in installer-deployment.md trigger
MD040/MD031 because several fenced code blocks lack explicit language and
surrounding blank lines; update the three problematic blocks (the oc whoami
output block showing "<your-username>", the Node.js command block "node
--version", and the Node.js output block "v22.x.x") to include a language tag
(e.g., ```bash for commands and ```text for plain outputs) and ensure there is a
blank line before and after each fenced block so the linter no longer complains
about missing fence language and missing blank lines.
In `@agents/openclaw/openclaw_agent/docs/troubleshooting.md`:
- Around line 206-212: The docs instruct deleting PVC openclaw-home-pvc but the
shipped manifest defines openclaw-state (see 03-pvc.yaml), so update the
troubleshooting step to use the correct PVC name or explicitly document
different names per deployment mode; replace openclaw-home-pvc with
openclaw-state (or add a parenthetical that manifest-based installs use
openclaw-state and Helm/other installs may use openclaw-home-pvc) in the delete
command and any explanatory text.
In `@agents/openclaw/openclaw_agent/manifests/04-deployment.yaml`:
- Line 21: Replace the mutable image tag "ghcr.io/openclaw/openclaw:latest" used
in the Deployment (strategy: Recreate) with an immutable reference: either a
specific version tag (e.g., :v1.2.3) or an image digest (sha256:...) for both
container entries that currently use that image; update the manifest to use that
pinned tag/digest so the Deployment and its containers (the entries referencing
ghcr.io/openclaw/openclaw:latest) deploy a fixed artifact and won’t silently
change on re-push.
- Around line 18-81: Add explicit securityContext entries at both the pod level
and container level: set pod.spec.securityContext.runAsNonRoot=true (and
optionally runAsUser >0), and for each container set
securityContext.allowPrivilegeEscalation=false and
securityContext.runAsNonRoot=true; additionally set
container.securityContext.readOnlyRootFilesystem=true on the gateway container
(but do not set readOnlyRootFilesystem on the init container named init-config
since it writes to /data/.openclaw). Update the Deployment manifest's pod spec
and the containers (initContainers.name: init-config and containers.name:
gateway) accordingly to satisfy CKV_K8S_20/23 and the Trivy checks.
In `@agents/openclaw/openclaw_agent/manifests/kustomization.yaml`:
- Around line 4-10: The route in 06-route.yaml is pointing to the service port
named "gateway", which bypasses the OAuth proxy; update the Route's spec.to or
spec.port.targetPort to use the "oauth-ui" port name instead of "gateway" so
traffic is routed through the OAuth proxy; open
agents/openclaw/openclaw_agent/manifests/06-route.yaml and change the targetPort
value from "gateway" to "oauth-ui", and verify the corresponding Service in
05-service.yaml defines a port named "oauth-ui" so the name matches.
In `@agents/openclaw/openclaw_agent/overlays/codex-harness/configmap-patch.yaml`:
- Line 38: The ConfigMap entry "authToken": "${CODEX_APP_SERVER_TOKEN}" will
remain a literal string in Kubernetes and cause auth failures; update the
codex-harness config (configmap-patch.yaml) to either replace the placeholder
with the actual token value in the "authToken" field or switch to OpenClaw's
supported secret-injection mechanism (or Kubernetes Secret + env/subPath/volume
mount) so the gateway receives the real token instead of the literal
"${CODEX_APP_SERVER_TOKEN}". Ensure you modify the "authToken" key and document
which secret or injection mechanism you used.
---
Outside diff comments:
In `@agents/openclaw/openclaw_agent/overlays/codex-harness/deployment-patch.yaml`:
- Around line 10-57: The containers "gateway" and "codex-app-server" lack
explicit container-level securityContext causing scanner findings; add a
securityContext block under each container spec (for the container entries named
gateway and codex-app-server) that enforces non-root execution (runAsNonRoot:
true and a non-root runAsUser), disables privilege escalation
(allowPrivilegeEscalation: false), drops all capabilities (capabilities: drop:
["ALL"]), sets readOnlyRootFilesystem: true, and includes a seccompProfile
(type: RuntimeDefault) and restrictive procMount if desired; ensure these fields
are added to each container definition so the readinessProbe and existing
env/ports/resources remain unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: dc06a53a-36eb-4abc-9f4c-e797d0abbc46
📒 Files selected for processing (19)
AGENTS.mdagents/openclaw/openclaw_agent/README.mdagents/openclaw/openclaw_agent/docs/codex-harness.mdagents/openclaw/openclaw_agent/docs/installer-deployment.mdagents/openclaw/openclaw_agent/docs/model-compatibility.mdagents/openclaw/openclaw_agent/docs/troubleshooting.mdagents/openclaw/openclaw_agent/manifests/01-secret.yamlagents/openclaw/openclaw_agent/manifests/02-configmap.yamlagents/openclaw/openclaw_agent/manifests/03-pvc.yamlagents/openclaw/openclaw_agent/manifests/04-deployment.yamlagents/openclaw/openclaw_agent/manifests/05-service.yamlagents/openclaw/openclaw_agent/manifests/06-route.yamlagents/openclaw/openclaw_agent/manifests/kustomization.yamlagents/openclaw/openclaw_agent/overlays/codex-harness/codex-secret.yamlagents/openclaw/openclaw_agent/overlays/codex-harness/configmap-patch.yamlagents/openclaw/openclaw_agent/overlays/codex-harness/deployment-patch.yamlagents/openclaw/openclaw_agent/overlays/codex-harness/kustomization.yamlagents/openclaw/openclaw_agent/overlays/example/configmap-patch.yamlagents/openclaw/openclaw_agent/overlays/example/kustomization.yaml
|
|
||
| **a2a/langgraph_crewai_agent** - Uses `python:3.12-slim` (not UBI9), PYTHONPATH `/app` (not `/opt/app-root/src`), `charts/a2a-langgraph-crewai/` chart, `template.env` (not `.env.example`), `entrypoint.sh` (not `main.py`), Starlette (not FastAPI). No tests/ directory. | ||
|
|
||
| **openclaw/openclaw_agent** - Kustomize-based deployment of OpenClaw on OpenShift. Uses pre-built image (`ghcr.io/openclaw/openclaw:latest`), not a Dockerfile. Kustomize overlays for customization (model endpoint, storage class, Codex Harness sidecar). No Makefile, no FastAPI, no src/. Port 18789 (gateway). |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all mutable OpenClaw image references and where they appear.
# Expected: no ':latest' references in deployable manifests/docs intended as source of truth.
rg -n --iglob '*.{yml,yaml,md}' 'ghcr\.io/openclaw/openclaw:latest|image:\s*ghcr\.io/openclaw/openclaw'Repository: red-hat-data-services/agentic-starter-kits
Length of output: 1030
Pin OpenClaw image to a specific version or digest instead of latest.
The ghcr.io/openclaw/openclaw:latest reference makes deployments non-reproducible and reduces supply-chain control. Use a specific version tag or digest in all deployment manifests and documentation so rollouts are deterministic.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 58, Replace the non-deterministic image reference
ghcr.io/openclaw/openclaw:latest used by openclaw/openclaw_agent with a specific
version tag or immutable digest across all manifests and documentation; update
the Kustomize overlays and any deployment YAMLs that reference
ghcr.io/openclaw/openclaw to use a pinned tag (e.g.,
ghcr.io/openclaw/openclaw:vX.Y.Z) or a digest (sha256:...) and update AGENTS.md
text to show the pinned reference so deployments are reproducible and
supply-chain controlled.
There was a problem hiding this comment.
Same rationale as the deployment.yaml comment — OpenClaw upstream uses latest as their recommended tag. The AGENTS.md description accurately reflects the current deployment pattern.
There was a problem hiding this comment.
@aakankshaduggal, understood — if the OpenClaw upstream only publishes and recommends latest, then the AGENTS.md description is correct as-is. I'll note this for future reviews.
ʕ •ᴥ•ʔ ～
📝 Learnings were identified and not saved (knowledge base disabled). Enable
| spec: | ||
| initContainers: | ||
| - name: init-config | ||
| image: ghcr.io/openclaw/openclaw:latest |
There was a problem hiding this comment.
Pin image tags to a specific version or digest instead of latest.
Both containers reference ghcr.io/openclaw/openclaw:latest. A mutable tag means any re-push can silently change what runs in production with no rollback path. This is especially risky with the Recreate strategy (line 10), where the old pod is deleted before the new one starts.
🔧 Proposed fix
- image: ghcr.io/openclaw/openclaw:latest # init container
+ image: ghcr.io/openclaw/openclaw:v<VERSION>@sha256:<digest>
- image: ghcr.io/openclaw/openclaw:latest # gateway container
+ image: ghcr.io/openclaw/openclaw:v<VERSION>@sha256:<digest>Also applies to: 41-41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agents/openclaw/openclaw_agent/manifests/04-deployment.yaml` at line 21,
Replace the mutable image tag "ghcr.io/openclaw/openclaw:latest" used in the
Deployment (strategy: Recreate) with an immutable reference: either a specific
version tag (e.g., :v1.2.3) or an image digest (sha256:...) for both container
entries that currently use that image; update the manifest to use that pinned
tag/digest so the Deployment and its containers (the entries referencing
ghcr.io/openclaw/openclaw:latest) deploy a fixed artifact and won’t silently
change on re-push.
There was a problem hiding this comment.
Keeping latest intentionally. OpenClaw upstream does not publish stable versioned tags — their release model uses latest as the recommended tag. Pinning to a digest would break on every upstream release and add maintenance burden for a starter kit. If upstream adopts semver tags in the future, we can pin then.
There was a problem hiding this comment.
@aakankshaduggal, understood — that's a reasonable trade-off for a starter kit when the upstream project doesn't publish versioned tags. I'll note this for future reviews.
(｡•́︿•̀｡)
📝 Learnings were identified and not saved (knowledge base disabled). Enable
| resources: | ||
| - 01-secret.yaml | ||
| - 02-configmap.yaml | ||
| - 03-pvc.yaml | ||
| - 04-deployment.yaml | ||
| - 05-service.yaml | ||
| - 06-route.yaml |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the route backend port wired by the base kustomization.
# Expected safe value for OAuth-gated UI: targetPort: oauth-ui
fd -i "06-route.yaml" agents/openclaw/openclaw_agent/manifests --exec sed -n '1,120p' {}Repository: red-hat-data-services/agentic-starter-kits
Length of output: 417
Fix OAuth bypass vulnerability: change route targetPort from gateway to oauth-ui
The included route resource 06-route.yaml currently targets the gateway port instead of oauth-ui, which bypasses the OAuth proxy and breaks the intended SSO security boundary. Change line in agents/openclaw/openclaw_agent/manifests/06-route.yaml:
Port Configuration Fix
port:
- targetPort: gateway
+ targetPort: oauth-ui🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agents/openclaw/openclaw_agent/manifests/kustomization.yaml` around lines 4 -
10, The route in 06-route.yaml is pointing to the service port named "gateway",
which bypasses the OAuth proxy; update the Route's spec.to or
spec.port.targetPort to use the "oauth-ui" port name instead of "gateway" so
traffic is routed through the OAuth proxy; open
agents/openclaw/openclaw_agent/manifests/06-route.yaml and change the targetPort
value from "gateway" to "oauth-ui", and verify the corresponding Service in
05-service.yaml defines a port named "oauth-ui" so the name matches.
There was a problem hiding this comment.
Not a vulnerability — the base Kustomize manifests intentionally don't include an oauth-proxy sidecar. That's an installer-specific addition (see docs/installer-deployment.md). The base deployment uses the gateway's built-in token auth (OPENCLAW_GATEWAY_TOKEN), so the route correctly targets the gateway port. The OAuth proxy setup is only relevant when deploying via claw-installer, which creates its own Route.
There was a problem hiding this comment.
@aakankshaduggal, thanks for the clarification — that makes sense. The base manifests rely on the gateway's built-in token authentication (OPENCLAW_GATEWAY_TOKEN), so routing to the gateway port is correct. The OAuth proxy is installer-managed and out of scope for these base manifests. I'll update my understanding for future reviews.
📝 Learnings were identified and not saved (knowledge base disabled). Enable
|
Hey @aakankshaduggal - a new repo-level ruleset is added that now requires Unit Tests and lint checks to pass before merge, plus approval from the agentic-starter-kits-maintainers team. This PR is currently blocked because the Unit Tests check hasn't run on it. A rebase onto main should pick up the updated workflow and trigger the required checks. Please rebase when you get a chance. |
Kustomize-based deployment of OpenClaw on OpenShift with vLLM model serving, OAuth SSO, and restricted-v2 SCC compliance. Includes base manifests, example overlay, Codex Harness sidecar overlay, and docs for installer deployment, troubleshooting, and model compatibility. Tested on OpenShift 4.19 (ROSA) with vLLM model serving. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add language specifiers to fenced code blocks, blank lines around fences and lists, and wrap bare URLs in markdown link syntax. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add pod and container securityContext (runAsNonRoot, drop ALL capabilities, disallow privilege escalation) - Fix PVC name mismatch: troubleshooting.md now references openclaw-state (matching manifests) with note about installer variant - Fix markdownlint errors in troubleshooting.md (blank lines before fenced code blocks in numbered lists) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove codex-harness overlay and docs from this PR to keep scope focused on core OpenClaw deployment. Codex Harness will be added in a follow-up PR. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Aligns with agreed repo structure: platform-based agents use agents/<name>/deployment/ for deployment manifests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
b6d8887 to
ea4446a
Compare
## Summary - Audit and fix all broken markdown links across the repo (97 errors → 0) - Add `lychee.toml` configuration for CI link checking (RHAIENG-5323) - Update redirected URLs to their final destinations (33 redirects → 3) ## Changes ### Broken relative links fixed (18 links, 13 files) - Fix `../../../docs/` → `../../../../docs/` across 11 agent READMEs - Fix ADK cross-reference path in a2a agent README - Fix mlflow doc path in react_agent README - Remove dangling references to planned-but-never-created openclaw docs (codex-harness.md removed in PR #94, vertex-ai-provider.md never created) ### Dead external URLs fixed (22 links) - AutoML: branch `automl_sample` → `main`, repo `LukaszCmielowski` → `opendatahub-io` - Container catalog: updated vLLM CUDA RHEL9 URL (added hash ID) - EvalHub: `redhat-ai-services/evalhub` → `eval-hub/eval-hub` - OGX docs: fixed trailing slash causing 404 ### Redirected URLs updated (30 redirects eliminated) - `docs.anthropic.com` → `code.claude.com` - `console.anthropic.com` → `platform.claude.com` (label + URL) - `python.langchain.com` → `docs.langchain.com` - `docs.llamaindex.ai` → `developers.llamaindex.ai` - `ollama.com/docs` → `docs.ollama.com` - `google.github.io/adk-docs` → `adk.dev` - `github.com/sst/opencode` → `github.com/anomalyco/opencode` - `git-scm.com/downloads` → `git-scm.com/install` - `kubernetes.io/docs/` → `kubernetes.io/docs/home/` - `modelcontextprotocol.io/` → `modelcontextprotocol.io/docs/getting-started/intro` ### New files - `lychee.toml` — link checker config with domain-scoped exclusions, curl-style UA to bypass docs.redhat.com bot protection (no global 403 accept) - `images/autogen_logo.svg` — was referenced but missing (official upstream logo) ### Other fixes - Root README logo: constrained to 200x200, use relative path `./images/` - Autogen README logo: constrained to 100x100 with `<img>` tag - PR template: fix CONTRIBUTING.md relative path (`.github/` → `../`) - YAML comment: updated catalog.redhat.com URL in `llminferenceservice.yaml` ## Lychee scan results (post-fix) | Status | Count | |---|---| | Total | 576 | | Successful | 548 | | Redirects | 11 (unfixable: Google/GitHub login, CrewAI versioned, docs.openshift.com→docs.redhat.com) | | Excluded | 28 (developer.nps.gov, gnu.org, milvus.io, localhost) | | **Errors** | **0** | ## Test plan - [x] `lychee --config lychee.toml '**/*.md'` passes with 0 errors - [x] All pre-commit hooks pass - [x] Spot-check fixed relative links render correctly on GitHub - [x] Spot-check updated external URLs load in browser - [x] Verify `images/autogen_logo.svg` renders in autogen agent README 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Description
Add OpenClaw as a containerized agent for OpenShift deployment. Provides production-tested Kustomize manifests, overlays, and documentation for deploying OpenClaw on RHOAI with vLLM model serving, OAuth SSO, and restricted-v2 SCC compliance.
This is a non-standard agent (like
claude/claude_agentin #92) — uses pre-built images fromghcr.io/openclaw/openclaw:latestand Kustomize overlays instead of the standard FastAPI/Helm pattern.Includes:
Codex Harness overlay and docs will be added in a follow-up PR.
Tested on OpenShift 4.19 (ROSA) with vLLM model serving.
Jira Ticket
RHAIENG-4373
Testing
make testpasses (run from the affected agent directory)Deployed and validated on ROSA cluster:
oc apply -k manifests/creates all resourcesoc kustomize overlays/example/)Checklist
.envor secret files are included in this PRReview Guidance
Non-standard agent — no Makefile, Dockerfile, FastAPI, or src/ directory. Review focuses on Kustomize manifests correctness, documentation completeness, and AGENTS.md entry.
Related PRs