OpenClaw从单机Docker部署迁移到Kubernetes集群的完整方案

# 00-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: openclaw
  labels:
    app: openclaw
    environment: production

# 01-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: openclaw-config
  namespace: openclaw
data:
  openclaw.yaml: |
    gateway:
      port: 18789
      auth_token: ${GATEWAY_AUTH_TOKEN}
    model:
      default: ${DEFAULT_MODEL}
      providers:
        openai:
          api_key: ${OPENAI_API_KEY}
    logging:
      level: info
      file: /data/logs/gateway.log
      format: json
    channels:
      feishu:
        enabled: true
        app_id: ${FEISHU_APP_ID}
    performance:
      max_concurrent_requests: 50
      request_timeout_ms: 120000
    security:
      rate_limit:
        enabled: true
        max_requests_per_minute: 100

# 02-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: openclaw-secrets
  namespace: openclaw
type: Opaque
stringData:
  GATEWAY_AUTH_TOKEN: "your-secure-token-here"
  OPENAI_API_KEY: "sk-prod-xxxxxxxxxxxxx"
  FEISHU_APP_ID: "cli_xxxxxxxxxxxxx"
  FEISHU_APP_SECRET: "xxxxxxxxxxxxxxxxxxxx"
  TELEGRAM_BOT_TOKEN: "123456789:ABCdefGHIjklMNOpqrsTUVwxyz"

# 03-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    app: openclaw
    component: gateway
spec:
  # 副本数（HPA 启用后会自动调整）
  replicas: 3
  # 滚动更新策略
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 更新时最多多出 1 个 Pod
      maxUnavailable: 0  # 更新时不允许不可用 Pod
  # Pod 选择器
  selector:
    matchLabels:
      app: openclaw
      component: gateway
  # Pod 模板
  template:
    metadata:
      labels:
        app: openclaw
        component: gateway
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "18789"
        prometheus.io/path: "/metrics"
    spec:
      # 优雅终止时间
      terminationGracePeriodSeconds: 60
      # 容器定义
      containers:
      - name: gateway
        image: openclaw:latest
        imagePullPolicy: Always
        ports:
        - name: http
          containerPort: 18789
          protocol: TCP
        # 环境变量（从 Secret 注入）
        envFrom:
        - secretRef:
            name: openclaw-secrets
        env:
        - name: DEFAULT_MODEL
          value: "gpt-4o-mini"
        - name: NODE_ENV
          value: "production"
        - name: TZ
          value: "Asia/Shanghai"
        # 配置文件挂载
        volumeMounts:
        - name: config
          mountPath: /etc/openclaw
          readOnly: true
        - name: data
          mountPath: /data/openclaw
        - name: logs
          mountPath: /data/logs
        # 资源限制
        resources:
          requests:
            cpu: "500m"
            memory: "512Mi"
          limits:
            cpu: "2000m"
            memory: "2Gi"
        # 存活探针——检测容器是否存活
        livenessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 30
          periodSeconds: 15
          timeoutSeconds: 5
          failureThreshold: 3
        # 就绪探针——检测容器是否准备好接收流量
        readinessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 2
        # 启动探针——给慢启动的容器更多时间
        startupProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 5
          periodSeconds: 10
          failureThreshold: 12  # 最多等 2 分钟
      # 数据卷定义
      volumes:
      - name: config
        configMap:
          name: openclaw-config
      - name: data
        persistentVolumeClaim:
          claimName: openclaw-data-pvc
      - name: logs
        emptyDir: {}
      # Pod 反亲和性——尽量分散到不同节点
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: openclaw
                  component: gateway
              topologyKey: kubernetes.io/hostname

# 04-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    app: openclaw
    component: gateway
spec:
  type: ClusterIP
  selector:
    app: openclaw
    component: gateway
  
  ports:
  - name: http
    port: 80
    targetPort: 18789
    protocol: TCP
  
  # 会话亲和性——同一客户端请求尽量路由到同一 Pod
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 3600

# 05-persistentvolume.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openclaw-data-pvc
  namespace: openclaw
spec:
  accessModes:
    - ReadWriteMany  # 多 Pod 同时读写
  resources:
    requests:
      storage: 20Gi
  storageClassName: nfs-client  # 根据你的存储类型调整

# 06-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: openclaw-ingress
  namespace: openclaw
  annotations:
    # Nginx Ingress 配置
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
    nginx.ingress.kubernetes.io/websocket-services: "openclaw-gateway"
    # SSL 重定向
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # 速率限制
    nginx.ingress.kubernetes.io/limit-rps: "100"
    # 证书管理
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - openclaw.your-domain.com
    secretName: openclaw-tls
  
  rules:
  - host: openclaw.your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: openclaw-gateway
            port:
              number: 80

# 07-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: openclaw-gateway-hpa
  namespace: openclaw
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: openclaw-gateway
  
  # 最小/最大副本数
  minReplicas: 2
  maxReplicas: 10
  
  # 扩缩容指标
  metrics:
  # CPU 使用率
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  
  # 内存使用率
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  
  # 自定义指标——请求速率
  - type: Pods
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "50"
  
  # 扩缩容行为
  behavior:
    # 扩容策略——快速响应
    scaleUp:
      stabilizationWindowSeconds: 60  # 60秒稳定窗口
      policies:
      - type: Percent
        value: 100    # 每次最多翻倍
        periodSeconds: 60
      - type: Pods
        value: 4      # 每次最多加4个
        periodSeconds: 60
      selectPolicy: Max
    
    # 缩容策略——缓慢回收
    scaleDown:
      stabilizationWindowSeconds: 300  # 5分钟稳定窗口
      policies:
      - type: Percent
        value: 10     # 每次最多减10%
        periodSeconds: 120
      selectPolicy: Min

# 08-servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: openclaw-gateway
  namespace: openclaw
  labels:
    release: prometheus
spec:
  selector:
    matchLabels:
      app: openclaw
      component: gateway
  endpoints:
  - port: http
    path: /metrics
    interval: 30s
    scrapeTimeout: 10s

#!/bin/bash
# deploy-k8s.sh
# OpenClaw K8s 一键部署脚本
set -e
NAMESPACE="openclaw"
echo "🚀 开始部署 OpenClaw 到 Kubernetes..."
# 1. 检查 kubectl 连接
if ! kubectl cluster-info &> /dev/null; then
    echo "❌ 无法连接到 Kubernetes 集群"
    echo "💡 请检查 kubeconfig 配置"
    exit 1
fi
echo "✅ 集群连接正常: $(kubectl cluster-info | head -1)"
# 2. 创建 Namespace
kubectl apply -f 00-namespace.yaml
# 3. 部署 ConfigMap 和 Secret
kubectl apply -f 01-configmap.yaml
kubectl apply -f 02-secret.yaml
# 4. 创建持久化存储
kubectl apply -f 05-persistentvolume.yaml
# 5. 部署应用
kubectl apply -f 03-deployment.yaml
kubectl apply -f 04-service.yaml
# 6. 等待 Deployment 就绪
echo "⏳ 等待 Pod 就绪..."
kubectl wait --for=condition=available \
    --timeout=300s \
    deployment/openclaw-gateway \
    -n $NAMESPACE
# 7. 部署 Ingress
kubectl apply -f 06-ingress.yaml
# 8. 部署 HPA
kubectl apply -f 07-hpa.yaml
# 9. 部署监控
kubectl apply -f 08-servicemonitor.yaml
# 10. 显示状态
echo ""
echo "📊 部署状态："
kubectl get all -n $NAMESPACE
echo ""
echo "📊 HPA 状态："
kubectl get hpa -n $NAMESPACE
echo ""
echo "✅ 部署完成！"
echo "   访问地址: https://openclaw.your-domain.com"
echo "   查看日志: kubectl logs -f deployment/openclaw-gateway -n $NAMESPACE"
echo "   查看 Pod: kubectl get pods -n $NAMESPACE -w"

# 查看 Pod 状态
kubectl get pods -n openclaw -o wide
# 查看 Pod 日志（实时）
kubectl logs -f deployment/openclaw-gateway -n openclaw
# 查看所有 Pod 日志（stern 工具）
stern -n openclaw openclaw-gateway
# 进入 Pod 调试
kubectl exec -it deployment/openclaw-gateway -n openclaw -- sh
# 手动扩容
kubectl scale deployment openclaw-gateway -n openclaw --replicas=5
# 滚动重启
kubectl rollout restart deployment/openclaw-gateway -n openclaw
# 查看滚动更新状态
kubectl rollout status deployment/openclaw-gateway -n openclaw
# 回滚到上一个版本
kubectl rollout undo deployment/openclaw-gateway -n openclaw
# 查看 HPA 状态
kubectl describe hpa openclaw-gateway-hpa -n openclaw
# 查看资源使用
kubectl top pods -n openclaw
kubectl top nodes