Deploying OpenClaw on OpenShift

Introduction

In this post, I want to describe how to deploy OpenClaw on OpenShift using a browser-based installer. It is possible to configure OpenClaw to use a self-hosted model endpoint. This post builds on Running the Red Hat AI Inference Server on OpenShift for the model serving layer and sits alongside the Hermes Agent deployment post as a second option for running an AI agent on the same cluster.

The two approaches are different in character. Hermes uses YAML manifests applied to OpenShift, requires a custom ServiceAccount with the anyuid SCC, and is configured through environment variables and a config file. For OpenClaw it is possible to leverage the claw-installer repository, a community supported tool that automates the deployment of OpenClaw on OpenShift. The claw-installer uses a browser-based installer that generates and applies all manifests, runs inside the default restricted-v2 SCC without elevated permissions, and handles OpenShift OAuth authentication automatically through a sidecar container.

What is OpenClaw

OpenClaw is an open-source agent framework designed to run on your own infrastructure. It connects to model providers, integrates with messaging platforms, and exposes a web interface for interacting with an agent.

Peter Steinberger created OpenClaw in late 2025. The project gained traction quickly: by early 2026 it had become the most-starred software project in GitHub’s history, overtaking repositories that had accumulated stars over decades. At the NVIDIA GTC keynote in March 2026, NVIDIA CEO Jensen Huang put it directly: “OpenClaw is the number one. It is the most popular open-source project in the history of humanity, and it did so in just a few weeks.”

The gateway is the always-on component. It manages sessions, routes requests between channels, dispatches tool calls, and emits events. On OpenShift, it runs as a three-container pod: an init container that handles startup configuration, an OAuth-proxy sidecar that ties authentication to the OpenShift OAuth server, and the OpenClaw gateway itself. The pod runs under the default restricted-v2 SCC.

OpenClaw supports the Model Context Protocol for tool integration. An mcp.json file placed in the agent workspace directory provisions MCP servers at deploy time, and the installer merges it into the main configuration.

Prerequisites

• A running OpenShift cluster. The post Deploying OpenShift on AWS covers one way to get there.
• The RHAIIS deployment from Running the Red Hat AI Inference Server on OpenShift running in the rhaiis namespace, or an external model provider API key if you prefer a AI model as a service.
• Node.js 22 or later installed locally.

Deploying OpenClaw

1. Create a namespace:

oc new-project openclaw

2. Clone the installer:

git clone https://github.com/sallyom/claw-installer.git
cd claw-installer

3. Start the installer:

npm install && npm run build && npm run dev

The installer starts a local web server on port 3000. Open http://localhost:3000 in a browser.

4. Configure the deployment in the installer UI.

In the Deploy tab, select OpenShift as the deployment target. The installer reads the current oc context to detect the cluster and active namespace. Fill in the configuration form:

• Agent Name: a name of your choice for your agent
• Project / Namespace: the namespace to deploy the agent into, the installer pre-fills this from the current namespace in the oc context
• Inference providers: add one or more model backends, for each provider specify the model endpoint, the model name, and the API key

If using RHAIIS as the model provider, the internal service DNS name keeps all model traffic inside the cluster. Retrieve the API key from the rhaiis namespace before filling in the form:

export MODEL_API_KEY=$(oc get secret vllm-api-key-secret -n rhaiis \
  -o jsonpath='{.data.VLLM_API_KEY}' | base64 -d)
echo $MODEL_API_KEY

Set the model endpoint to the internal cluster address:

http://rhaiis-vllm.rhaiis.svc.cluster.local:8000/v1

5. Click Deploy OpenClaw.

The installer generates and applies all manifests against the active cluster context. In the target namespace it creates a ServiceAccount with OpenShift OAuth annotations, secrets for the OAuth client and the gateway token, ConfigMaps for the agent configuration and workspace files, a 10Gi PVC backed by block storage, a Deployment running the three-container pod, a Service, and a TLS-terminated Route using the cluster wildcard certificate.

Once the pod reaches Running status, the OpenShift Topology view shows the deployment with two services: the gateway on port 18789 and the OAuth proxy on port 8443.

6. Retrieve the gateway token:

export OPENCLAW_HOST=$(oc get route openclaw -n openclaw \
  -o jsonpath='{.spec.host}')
export OPENCLAW_GATEWAY_TOKEN=$(oc get secret openclaw-secrets -n openclaw \
  -o jsonpath='{.data.OPENCLAW_GATEWAY_TOKEN}' | base64 -d)

echo "OPENCLAW_HOST          : ${OPENCLAW_HOST}"
echo "OPENCLAW_GATEWAY_TOKEN : ${OPENCLAW_GATEWAY_TOKEN}"

7. Open the Route in a browser.

OpenShift OAuth handles authentication automatically. Log in with your cluster credentials when prompted. After login, the OpenClaw gateway dashboard appears. Paste the gateway token into the Gateway-Token field to authenticate the browser session with the running gateway.

8. Approve the pairing in the installer.

Go back to the installer at http://localhost:3000, open the Instances tab, find the running instance, and click Approve Pairing. This confirms the connection between the local installer session and the cluster deployment.

Once the pairing is approved, the web interface is ready. The chat window connects to the configured model backend and the agent shows as ready. The OpenClaw dashboard can be used to further configure the agent, for example adding additional model providers or connecting messaging platforms.

The OpenClaw gateway can expose an OpenAI-compatible API, so adding it as a connection in Open WebUI follows the same steps described in the Running the Red Hat AI Inference Server on OpenShift and Deploying Hermes Agent on OpenShift posts.

Conclusion

OpenClaw on OpenShift is a different path compared to the Hermes Agent deployment covered in the previous post. The installer handles all manifest generation from a web form, and the result is a running agent in minutes without writing any YAML. The OpenShift OAuth sidecar covers authentication from the start, using existing cluster credentials rather than a separately managed API key. The pod runs under the default restricted-v2 security policy, which matters in environments where elevated SCCs require explicit approval from a cluster administrator.

If RHAIIS is already running on the same cluster, pointing OpenClaw at the internal service address keeps all model traffic off the public network. Both agents can run on the same cluster in separate namespaces without any conflict.

References

• Running the Red Hat AI Inference Server on OpenShift - link
• Deploying Hermes Agent on OpenShift - link
• claw-installer - GitHub repository - link
• OpenClaw Project website - link
• Peter Steinbergers GitHub Profile - link
• OpenClaw surpasses React as most-starred software on GitHub - link
• NVIDIA GTC 2026 Keynote - YouTube - link
• Nvidia CEO Jensen Huang says OpenClaw is “definitely the next ChatGPT” - CNBC - link
• Deploying OpenShift on AWS with Automated Cluster Provisioning - link
• Deploying agents with Red Hat AI: The curious case of OpenClaw - link
• OpenClaw - GitHub repository - link