Configure Clawdlinux Operator

Helm settings are defined in chart values and the values schema.

Select A Runtime

Set AgentWorkload.spec.orchestration.type:

• argo: default multi-step DAG execution.
• pod: bring-your-own single pod.
• kagent: unstructured Agent adapter; requires kagent in the cluster.

For pod and kagent adapters, check CLAWDLINUX_AGENT_IMAGE. Provider endpoints, Secret references, and model mappings belong in the workload spec. LiteLLM is an optional in-cluster multi-provider proxy. Never store provider keys in ConfigMaps or committed values files.

Configure Isolation

Label pods to opt into gVisor mutation:

metadata:
  labels:
    agentic.clawdlinux.org/runtime-sandbox: gvisor

The webhook sets runtimeClassName: gvisor unless a runtime class is already specified. Nodes need runsc. Strict enforcement requires the named RuntimeClass and a Ready node capable of running it. Without a RuntimeClass scheduling selector, label nodes only after confirming runsc:

agentic.clawdlinux.org/gvisor-ready: "true"

global.runtimeSandbox.enforcementMode defaults to strict. Use best-effort only when you accept an unsandboxed fallback.

Configure Egress And Actions

networkPolicy.enabled=true renders default-deny egress for selected pods in the release namespace. The cluster CNI enforces NetworkPolicy; creating policy objects alone does not prove traffic is blocked. networkPolicy.cilium.enabled=true enables optional Cilium FQDN policy and requires Cilium. Managed workload namespaces need separate policy application and matching labels.

spec.opaPolicy selects strict or permissive behavior in the legacy in-process Go evaluator. The direct action path does not execute Rego. Shipped Rego files are integration examples.

Cost And Evidence

The default NoOpCostReporter records nothing. AGENTIC_COST_TRACKING=memory enables volatile local-evaluation reporting, unsuitable for billing. Optional observability components do not connect automatic complete per-run signed evidence.

See monitoring, security, and API reference.