# OpenClaw AKS 部署文件
# 包含沙箱功能 (DinD 模式)
# 
# 部署步骤：
# 1. 先将 ACR 附加到 AKS: az aks update --name <aks> --resource-group <rg> --attach-acr openclawacr
# 2. 部署: kubectl apply -f openclaw-deploy.yaml
# 3. 查看状态: kubectl get pods -n openclaw
# 4. 查看日志: kubectl logs -n openclaw -l app=openclaw -c gateway -f

---
apiVersion: v1
kind: Namespace
metadata:
  name: openclaw

---
# Secret: 存储敏感信息
apiVersion: v1
kind: Secret
metadata:
  name: openclaw-secrets
  namespace: openclaw
type: Opaque
stringData:
  # Gateway 认证令牌
  OPENCLAW_GATEWAY_TOKEN: "07f99167450cffe6c236a3da36ac3c029f708bee54d742820b523b990d3ba0d4"
  
  # LiteLLM API Key
  LITELLM_API_KEY: "sk-litellm-taiji-prod-8f3a9b2c4d5e6f7g"
  
  # 飞书配置
  FEISHU_APP_ID: "cli_a90af793703a9bcc"
  FEISHU_APP_SECRET: "16Df1ByGy5frbdj7Vm5azbLOSBcprbaw"
  
  # Telegram Bot Token
  TELEGRAM_BOT_TOKEN: "8550418255:AAF50xr0MvNwZ4lqpW5PI5tZQ9uRZymKWvc"
  
  # Gateway Auth Token (Web UI 用)
  GATEWAY_AUTH_TOKEN: "6b8c483a5495fa1a0babe425504fcbf0633bb1ca8e8ed0fa0a89dfa30267636a"

---
# ConfigMap: OpenClaw 配置文件
apiVersion: v1
kind: ConfigMap
metadata:
  name: openclaw-config
  namespace: openclaw
data:
  openclaw.json: |
    {
      "meta": {
        "lastTouchedVersion": "2026.1.30"
      },
      "models": {
        "providers": {
          "litellm": {
            "baseUrl": "https://litellm.graystone-fb459c5d.southeastasia.azurecontainerapps.io/v1",
            "apiKey": "${LITELLM_API_KEY}",
            "api": "openai-completions",
            "models": [
              {
                "id": "taiji/gemini-2.5-flash",
                "name": "Gemini 2.5 Flash",
                "reasoning": false,
                "input": ["text"],
                "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
                "contextWindow": 1000000,
                "maxTokens": 8192
              }
            ]
          }
        }
      },
      "agents": {
        "defaults": {
          "model": {
            "primary": "litellm/taiji/gemini-2.5-flash"
          },
          "models": {
            "litellm/taiji/gemini-2.5-flash": {
              "alias": "gemini-2.5-flash"
            }
          },
          "workspace": "/home/node/.openclaw/workspace",
          "compaction": { "mode": "safeguard" },
          "maxConcurrent": 4,
          "subagents": { "maxConcurrent": 8 },
          "sandbox": {
            "mode": "all",
            "workspaceAccess": "rw",
            "scope": "agent",
            "docker": {
              "image": "openclawacr.azurecr.io/openclaw-sandbox:arm64",
              "network": "bridge"
            },
            "browser": {
              "enabled": true,
              "image": "openclawacr.azurecr.io/openclaw-sandbox-browser:arm64"
            }
          }
        }
      },
      "messages": {
        "ackReactionScope": "group-mentions"
      },
      "commands": {
        "native": "auto",
        "nativeSkills": "auto"
      },
      "channels": {
        "telegram": {
          "enabled": true,
          "dmPolicy": "pairing",
          "botToken": "${TELEGRAM_BOT_TOKEN}",
          "groupPolicy": "allowlist",
          "streamMode": "partial"
        },
        "feishu": {
          "appId": "${FEISHU_APP_ID}",
          "appSecret": "${FEISHU_APP_SECRET}",
          "enabled": true,
          "connectionMode": "websocket",
          "dmPolicy": "open",
          "groupPolicy": "open"
        }
      },
      "gateway": {
        "port": 18789,
        "mode": "local",
        "bind": "lan",
        "auth": {
          "mode": "token",
          "token": "${GATEWAY_AUTH_TOKEN}"
        },
        "http": {
          "endpoints": {
            "chatCompletions": { "enabled": true }
          }
        }
      },
      "plugins": {
        "entries": {
          "telegram": { "enabled": true },
          "feishu": { "enabled": true }
        },
        "installs": {
          "feishu": {
            "source": "npm",
            "spec": "@m1heng-clawd/feishu",
            "installPath": "/home/node/.openclaw/extensions/feishu",
            "version": "0.1.6"
          }
        }
      },
      "tools": {
        "sandbox": {
          "tools": {
            "allow": [
              "exec", "process", "read", "write", "edit", "browser",
              "sessions_list", "sessions_history", "sessions_send", "sessions_spawn", "session_status"
            ],
            "deny": ["canvas", "nodes", "cron", "discord", "gateway"]
          }
        }
      }
    }

---
# PersistentVolumeClaim: 存储 workspace 和配置数据
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openclaw-data
  namespace: openclaw
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: managed-csi  # Azure AKS 默认存储类
  resources:
    requests:
      storage: 10Gi

---
# Deployment: OpenClaw Gateway + DinD Sidecar
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw
  namespace: openclaw
  labels:
    app: openclaw
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openclaw
  template:
    metadata:
      labels:
        app: openclaw
    spec:
      # 初始化容器：准备配置文件 + 安装飞书插件
      initContainers:
      # 第一步：使用 OpenClaw 镜像安装飞书插件
      - name: plugin-install
        image: openclawacr.azurecr.io/openclaw:arm64
        command:
        - sh
        - -c
        - |
          echo "=== Installing Feishu plugin ==="
          cd /home/node
          
          # 创建必要目录
          mkdir -p /data/extensions /data/workspace /data/sandboxes
          
          # 安装飞书插件到持久化目录
          if [ ! -d "/data/extensions/feishu/node_modules" ]; then
            echo "Installing @m1heng-clawd/feishu plugin..."
            npm pack @m1heng-clawd/feishu --pack-destination /tmp
            mkdir -p /data/extensions/feishu
            tar -xzf /tmp/m1heng-clawd-feishu-*.tgz -C /data/extensions/feishu --strip-components=1
            cd /data/extensions/feishu && npm install --production
            echo "Plugin installed successfully"
          else
            echo "Plugin already installed, skipping..."
          fi
          
          ls -la /data/extensions/feishu/
        volumeMounts:
        - name: data
          mountPath: /data
      
      # 第二步：准备配置文件（替换环境变量）
      - name: config-init
        image: busybox:1.36
        command:
        - sh
        - -c
        - |
          # 复制配置文件并替换环境变量占位符
          cp /config-template/openclaw.json /config/openclaw.json
          sed -i "s|\${LITELLM_API_KEY}|$LITELLM_API_KEY|g" /config/openclaw.json
          sed -i "s|\${FEISHU_APP_ID}|$FEISHU_APP_ID|g" /config/openclaw.json
          sed -i "s|\${FEISHU_APP_SECRET}|$FEISHU_APP_SECRET|g" /config/openclaw.json
          sed -i "s|\${TELEGRAM_BOT_TOKEN}|$TELEGRAM_BOT_TOKEN|g" /config/openclaw.json
          sed -i "s|\${GATEWAY_AUTH_TOKEN}|$GATEWAY_AUTH_TOKEN|g" /config/openclaw.json
          
          echo "Config initialized successfully"
          cat /config/openclaw.json
        env:
        - name: LITELLM_API_KEY
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: LITELLM_API_KEY
        - name: FEISHU_APP_ID
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: FEISHU_APP_ID
        - name: FEISHU_APP_SECRET
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: FEISHU_APP_SECRET
        - name: TELEGRAM_BOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: TELEGRAM_BOT_TOKEN
        - name: GATEWAY_AUTH_TOKEN
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: GATEWAY_AUTH_TOKEN
        volumeMounts:
        - name: config-template
          mountPath: /config-template
        - name: config
          mountPath: /config
        - name: data
          mountPath: /data

      containers:
      # ========== Gateway 容器 ==========
      - name: gateway
        image: openclawacr.azurecr.io/openclaw:arm64
        ports:
        - containerPort: 18789
          name: http
        - containerPort: 18790
          name: bridge
        env:
        - name: HOME
          value: "/home/node"
        - name: TERM
          value: "xterm-256color"
        - name: OPENCLAW_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: openclaw-secrets
              key: OPENCLAW_GATEWAY_TOKEN
        # Docker 连接到 DinD sidecar
        - name: DOCKER_HOST
          value: "tcp://localhost:2375"
        volumeMounts:
        - name: config
          mountPath: /home/node/.openclaw/openclaw.json
          subPath: openclaw.json
        - name: data
          mountPath: /home/node/.openclaw/workspace
          subPath: workspace
        - name: data
          mountPath: /home/node/.openclaw/sandboxes
          subPath: sandboxes
        - name: data
          mountPath: /home/node/.openclaw/extensions
          subPath: extensions
        command:
        - node
        - dist/index.js
        - gateway
        - --bind
        - lan
        - --port
        - "18789"
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "2000m"
        readinessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 10
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 30
          periodSeconds: 30

      # ========== DinD Sidecar (用于沙箱) ==========
      - name: dind
        image: docker:24-dind
        securityContext:
          privileged: true  # DinD 需要特权模式
        env:
        - name: DOCKER_TLS_CERTDIR
          value: ""  # 禁用 TLS，内部通信
        ports:
        - containerPort: 2375
          name: docker
        volumeMounts:
        - name: docker-storage
          mountPath: /var/lib/docker
        - name: data
          mountPath: /home/node/.openclaw/workspace
          subPath: workspace
        - name: data
          mountPath: /home/node/.openclaw/sandboxes
          subPath: sandboxes
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "4Gi"
            cpu: "2000m"

      volumes:
      - name: config-template
        configMap:
          name: openclaw-config
      - name: config
        emptyDir: {}
      - name: data
        persistentVolumeClaim:
          claimName: openclaw-data
      - name: docker-storage
        emptyDir: {}

---
# Service: 暴露 Gateway 端口
apiVersion: v1
kind: Service
metadata:
  name: openclaw
  namespace: openclaw
spec:
  selector:
    app: openclaw
  ports:
  - name: http
    port: 18789
    targetPort: 18789
  - name: bridge
    port: 18790
    targetPort: 18790
  type: ClusterIP

---
# Ingress: 外部访问 (可选，需要 Ingress Controller)
# 如果使用 Azure Application Gateway 或 nginx-ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: openclaw
  namespace: openclaw
  annotations:
    # 如果使用 nginx-ingress:
    # kubernetes.io/ingress.class: nginx
    # nginx.ingress.kubernetes.io/websocket-services: openclaw
    
    # 如果使用 Azure Application Gateway:
    # kubernetes.io/ingress.class: azure/application-gateway
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/websocket-services: "openclaw"
    # 启用 HTTPS 重定向（可选，如果希望强制 HTTPS）
    # nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  # TLS 配置：使用自签名证书
  # 使用前需要先运行: ./generate-self-signed-cert.sh <your-domain> openclaw openclaw-tls
  tls:
  - hosts:
    - openclaw.yourdomain.com  # ← 修改为你的域名
    secretName: openclaw-tls   # ← 对应 Kubernetes Secret 名称
  rules:
  - host: openclaw.yourdomain.com  # ← 修改为你的域名
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: openclaw
            port:
              number: 18789