openclaw: deploy openclaw on kube

kubernetes/system/flux/kustomization.yaml

@@ -11,3 +11,5 @@ resources:
   - stalwart-certificates.yaml
   - longhorn.yaml
   - longhorn-jobs.yaml
+  - openclaw-operator.yaml
+  - openclaw.yaml

kubernetes/system/flux/openclaw-operator.yaml

@@ -0,0 +1,20 @@
+# Flux Kustomization for the OpenClaw operator
+# Separate from main homeprod because the operator's CRDs must be installed
+# before OpenClawInstance resources can be applied
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openclaw-operator
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/openclaw-operator
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: openclaw-operator
+      namespace: openclaw-operator-system

kubernetes/system/flux/openclaw.yaml

@@ -0,0 +1,25 @@
+# Flux Kustomization for the OpenClaw instance
+# Depends on the openclaw-operator so its CRDs exist before applying
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openclaw
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  dependsOn:
+    - name: openclaw-operator
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/personal/openclaw
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: StatefulSet
+      name: openclaw
+      namespace: openclaw

kubernetes/system/openclaw-operator/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - openclaw-namespace.yaml
+  - repository.yaml
+  - release.yaml

kubernetes/system/openclaw-operator/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openclaw-operator-system

kubernetes/system/openclaw-operator/openclaw-namespace.yaml

@@ -0,0 +1,7 @@
+# Namespace watched by the operator for OpenClawInstance resources.
+# Must exist before the operator deploys: watchNamespaces renders namespaced
+# Role/RoleBinding into it and the chart does not create namespaces.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openclaw

kubernetes/system/openclaw-operator/release.yaml

@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openclaw-operator
+  namespace: openclaw-operator-system
+spec:
+  interval: 1m
+  chart:
+    spec:
+      chart: openclaw-operator
+      version: "0.39.0"
+      sourceRef:
+        kind: HelmRepository
+        name: openclaw-operator
+        namespace: openclaw-operator-system
+      interval: 1m
+  values:
+    # Scope the operator's watches and RBAC to the openclaw namespace only
+    # (renders Role/RoleBinding instead of cluster-wide ClusterRole).
+    watchNamespaces:
+      - openclaw
+    metrics:
+      serviceMonitor:
+        # No Prometheus Operator CRDs in this cluster (VictoriaMetrics stack).
+        enabled: false

kubernetes/system/openclaw-operator/repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openclaw-operator
+  namespace: openclaw-operator-system
+spec:
+  type: oci
+  interval: 1h
+  url: oci://ghcr.io/paperclipinc/charts