# 00-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: openclaw
  labels:
    app: openclaw
    environment: production

# 01-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: openclaw-config
  namespace: openclaw
data:
  openclaw.yaml: |
    gateway:
      port: 18789
      auth_token: ${GATEWAY_AUTH_TOKEN}
    model:
      default: ${DEFAULT_MODEL}
      providers:
        openai:
          api_key: ${OPENAI_API_KEY}
    logging:
      level: info
      file: /data/logs/gateway.log
      format: json
    channels:
      feishu:
        enabled: true
        app_id: ${FEISHU_APP_ID}
    performance:
      max_concurrent_requests: 50
      request_timeout_ms: 120000
    security:
      rate_limit:
        enabled: true
        max_requests_per_minute: 100

# 02-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: openclaw-secrets
  namespace: openclaw
type: Opaque
stringData:
  GATEWAY_AUTH_TOKEN: "your-secure-token-here"
  OPENAI_API_KEY: "sk-prod-xxxxxxxxxxxxx"
  FEISHU_APP_ID: "cli_xxxxxxxxxxxxx"
  FEISHU_APP_SECRET: "xxxxxxxxxxxxxxxxxxxx"
  TELEGRAM_BOT_TOKEN: "123456789:ABCdefGHIjklMNOpqrsTUVwxyz"

# 03-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    app: openclaw
    component: gateway
spec:
  # 副本數(shù)（HPA 啟用后會自動調(diào)整）
  replicas: 3
  # 滾動更新策略
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 更新時最多多出 1 個 Pod
      maxUnavailable: 0  # 更新時不允許不可用 Pod
  # Pod 選擇器
  selector:
    matchLabels:
      app: openclaw
      component: gateway
  # Pod 模板
  template:
    metadata:
      labels:
        app: openclaw
        component: gateway
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "18789"
        prometheus.io/path: "/metrics"
    spec:
      # 優(yōu)雅終止時間
      terminationGracePeriodSeconds: 60
      # 容器定義
      containers:
      - name: gateway
        image: openclaw:latest
        imagePullPolicy: Always
        ports:
        - name: http
          containerPort: 18789
          protocol: TCP
        # 環(huán)境變量（從 Secret 注入）
        envFrom:
        - secretRef:
            name: openclaw-secrets
        env:
        - name: DEFAULT_MODEL
          value: "gpt-4o-mini"
        - name: NODE_ENV
          value: "production"
        - name: TZ
          value: "Asia/Shanghai"
        # 配置文件掛載
        volumeMounts:
        - name: config
          mountPath: /etc/openclaw
          readOnly: true
        - name: data
          mountPath: /data/openclaw
        - name: logs
          mountPath: /data/logs
        # 資源限制
        resources:
          requests:
            cpu: "500m"
            memory: "512Mi"
          limits:
            cpu: "2000m"
            memory: "2Gi"
        # 存活探針——檢測容器是否存活
        livenessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 30
          periodSeconds: 15
          timeoutSeconds: 5
          failureThreshold: 3
        # 就緒探針——檢測容器是否準備好接收流量
        readinessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 2
        # 啟動探針——給慢啟動的容器更多時間
        startupProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 5
          periodSeconds: 10
          failureThreshold: 12  # 最多等 2 分鐘
      # 數(shù)據(jù)卷定義
      volumes:
      - name: config
        configMap:
          name: openclaw-config
      - name: data
        persistentVolumeClaim:
          claimName: openclaw-data-pvc
      - name: logs
        emptyDir: {}
      # Pod 反親和性——盡量分散到不同節(jié)點
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: openclaw
                  component: gateway
              topologyKey: kubernetes.io/hostname

# 04-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    app: openclaw
    component: gateway
spec:
  type: ClusterIP
  selector:
    app: openclaw
    component: gateway
  
  ports:
  - name: http
    port: 80
    targetPort: 18789
    protocol: TCP
  
  # 會話親和性——同一客戶端請求盡量路由到同一 Pod
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 3600

# 05-persistentvolume.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openclaw-data-pvc
  namespace: openclaw
spec:
  accessModes:
    - ReadWriteMany  # 多 Pod 同時讀寫
  resources:
    requests:
      storage: 20Gi
  storageClassName: nfs-client  # 根據(jù)你的存儲類型調(diào)整

# 06-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: openclaw-ingress
  namespace: openclaw
  annotations:
    # Nginx Ingress 配置
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
    nginx.ingress.kubernetes.io/websocket-services: "openclaw-gateway"
    # SSL 重定向
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # 速率限制
    nginx.ingress.kubernetes.io/limit-rps: "100"
    # 證書管理
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - openclaw.your-domain.com
    secretName: openclaw-tls
  
  rules:
  - host: openclaw.your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: openclaw-gateway
            port:
              number: 80

# 07-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: openclaw-gateway-hpa
  namespace: openclaw
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: openclaw-gateway
  
  # 最小/最大副本數(shù)
  minReplicas: 2
  maxReplicas: 10
  
  # 擴縮容指標
  metrics:
  # CPU 使用率
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  
  # 內(nèi)存使用率
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  
  # 自定義指標——請求速率
  - type: Pods
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "50"
  
  # 擴縮容行為
  behavior:
    # 擴容策略——快速響應
    scaleUp:
      stabilizationWindowSeconds: 60  # 60秒穩(wěn)定窗口
      policies:
      - type: Percent
        value: 100    # 每次最多翻倍
        periodSeconds: 60
      - type: Pods
        value: 4      # 每次最多加4個
        periodSeconds: 60
      selectPolicy: Max
    
    # 縮容策略——緩慢回收
    scaleDown:
      stabilizationWindowSeconds: 300  # 5分鐘穩(wěn)定窗口
      policies:
      - type: Percent
        value: 10     # 每次最多減10%
        periodSeconds: 120
      selectPolicy: Min

# 08-servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    release: prometheus
spec:
  selector:
    matchLabels:
      app: openclaw
      component: gateway
  endpoints:
  - port: http
    path: /metrics
    interval: 30s
    scrapeTimeout: 10s

#!/bin/bash
# deploy-k8s.sh
# OpenClaw K8s 一鍵部署腳本
set -e
NAMESPACE="openclaw"
echo "?? 開始部署 OpenClaw 到 Kubernetes..."
# 1. 檢查 kubectl 連接
if ! kubectl cluster-info &> /dev/null; then
    echo "? 無法連接到 Kubernetes 集群"
    echo "?? 請檢查 kubeconfig 配置"
    exit 1
fi
echo "? 集群連接正常: $(kubectl cluster-info | head -1)"
# 2. 創(chuàng)建 Namespace
kubectl apply -f 00-namespace.yaml
# 3. 部署 ConfigMap 和 Secret
kubectl apply -f 01-configmap.yaml
kubectl apply -f 02-secret.yaml
# 4. 創(chuàng)建持久化存儲
kubectl apply -f 05-persistentvolume.yaml
# 5. 部署應用
kubectl apply -f 03-deployment.yaml
kubectl apply -f 04-service.yaml
# 6. 等待 Deployment 就緒
echo "? 等待 Pod 就緒..."
kubectl wait --for=condition=available \
    --timeout=300s \
    deployment/openclaw-gateway \
    -n $NAMESPACE
# 7. 部署 Ingress
kubectl apply -f 06-ingress.yaml
# 8. 部署 HPA
kubectl apply -f 07-hpa.yaml
# 9. 部署監(jiān)控
kubectl apply -f 08-servicemonitor.yaml
# 10. 顯示狀態(tài)
echo ""
echo "?? 部署狀態(tài)："
kubectl get all -n $NAMESPACE
echo ""
echo "?? HPA 狀態(tài)："
kubectl get hpa -n $NAMESPACE
echo ""
echo "? 部署完成！"
echo "   訪問地址: https://openclaw.your-domain.com"
echo "   查看日志: kubectl logs -f deployment/openclaw-gateway -n $NAMESPACE"
echo "   查看 Pod: kubectl get pods -n $NAMESPACE -w"

# 查看 Pod 狀態(tài)
kubectl get pods -n openclaw -o wide
# 查看 Pod 日志（實時）
kubectl logs -f deployment/openclaw-gateway -n openclaw
# 查看所有 Pod 日志（stern 工具）
stern -n openclaw openclaw-gateway
# 進入 Pod 調(diào)試
kubectl exec -it deployment/openclaw-gateway -n openclaw -- sh
# 手動擴容
kubectl scale deployment openclaw-gateway -n openclaw --replicas=5
# 滾動重啟
kubectl rollout restart deployment/openclaw-gateway -n openclaw
# 查看滾動更新狀態(tài)
kubectl rollout status deployment/openclaw-gateway -n openclaw
# 回滾到上一個版本
kubectl rollout undo deployment/openclaw-gateway -n openclaw
# 查看 HPA 狀態(tài)
kubectl describe hpa openclaw-gateway-hpa -n openclaw
# 查看資源使用
kubectl top pods -n openclaw
kubectl top nodes