yuan-lab-llm--clawmanager/deployments/k8s/single-node/clawmanager.yaml

# ClawManager single-node install profile.
# Official validation target: HostPath on one labeled storage node.
# Before installing, label exactly one node:
#   kubectl label node <node> clawmanager.io/storage-node=true --overwrite
# Replace paths or StorageClass names only if you understand the single-node constraints.
apiVersion: v1
kind: Namespace
metadata:
  name: clawmanager-system
---
apiVersion: v1
kind: Secret
metadata:
  name: clawmanager-secrets
  namespace: clawmanager-system
type: Opaque
stringData:
  mysql-root-password: root123
  mysql-password: clawreef123
  jwt-secret: change-me-in-production
  runtime-agent-control-token: change-me-runtime-control-token
  runtime-agent-report-token: change-me-runtime-report-token
  openclaw-gateway-token: change-me-openclaw-gateway-token
  minio-root-user: minioadmin
  minio-root-password: minioadmin@123
  minio-access-key: minioadmin
  minio-secret-key: minioadmin@123
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: clawmanager-mysql-init
  namespace: clawmanager-system
data:
  001_init_schema.sql: |
    CREATE DATABASE IF NOT EXISTS clawmanager CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
    USE clawmanager;

    CREATE TABLE IF NOT EXISTS users (
      id INT AUTO_INCREMENT PRIMARY KEY,
      username VARCHAR(255) UNIQUE NOT NULL,
      email VARCHAR(320) UNIQUE NOT NULL,
      password_hash VARCHAR(255) NOT NULL,
      role ENUM('admin', 'user') DEFAULT 'user',
      is_active BOOLEAN DEFAULT TRUE,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      last_login TIMESTAMP,
      INDEX idx_username (username),
      INDEX idx_role (role)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instances (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL,
      name VARCHAR(255) NOT NULL,
      description TEXT,
      type ENUM('openclaw', 'ubuntu', 'debian', 'centos', 'custom', 'webtop', 'hermes') DEFAULT 'ubuntu',
      runtime_type ENUM('desktop', 'shell') NOT NULL DEFAULT 'desktop',
      status ENUM('creating', 'running', 'stopped', 'error', 'deleting') DEFAULT 'creating',
      cpu_cores DECIMAL(10,2) NOT NULL,
      memory_gb INT NOT NULL,
      disk_gb INT NOT NULL,
      gpu_enabled BOOLEAN DEFAULT FALSE,
      gpu_type VARCHAR(100),
      gpu_count INT DEFAULT 0,
      os_type VARCHAR(50) NOT NULL,
      os_version VARCHAR(50) NOT NULL,
      image_registry VARCHAR(255),
      image_tag VARCHAR(100),
      storage_class VARCHAR(50) DEFAULT 'standard',
      mount_path VARCHAR(255) DEFAULT '/data',
      pod_name VARCHAR(255),
      pod_namespace VARCHAR(255),
      pod_ip VARCHAR(45),
      access_url VARCHAR(500),
      access_token VARCHAR(255),
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      started_at TIMESTAMP,
      stopped_at TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
      INDEX idx_user_id (user_id),
      INDEX idx_status (status),
      INDEX idx_type (type)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS persistent_volumes (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      pvc_name VARCHAR(255) UNIQUE NOT NULL,
      pvc_namespace VARCHAR(255) NOT NULL,
      storage_size_gb INT NOT NULL,
      storage_class VARCHAR(50),
      mount_path VARCHAR(255),
      status ENUM('pending', 'bound', 'released', 'failed') DEFAULT 'pending',
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      INDEX idx_instance_id (instance_id),
      UNIQUE KEY uk_pvc_name_namespace (pvc_name, pvc_namespace)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS backups (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      backup_name VARCHAR(255) NOT NULL,
      backup_size_gb INT,
      backup_path VARCHAR(500),
      status ENUM('creating', 'completed', 'failed', 'deleted') DEFAULT 'creating',
      backup_type ENUM('manual', 'scheduled') DEFAULT 'manual',
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      completed_at TIMESTAMP,
      expires_at TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      INDEX idx_instance_id (instance_id),
      INDEX idx_created_at (created_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS backup_schedules (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      schedule_name VARCHAR(255),
      cron_expression VARCHAR(100) NOT NULL,
      retention_days INT DEFAULT 30,
      is_active BOOLEAN DEFAULT TRUE,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      INDEX idx_instance_id (instance_id)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS user_quotas (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL UNIQUE,
      max_instances INT DEFAULT 10,
      max_cpu_cores DECIMAL(10,2) DEFAULT 40,
      max_memory_gb INT DEFAULT 100,
      max_storage_gb INT DEFAULT 500,
      max_gpu_count INT DEFAULT 2,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
      INDEX idx_user_id (user_id)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_usage (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      cpu_usage_percent DECIMAL(5,2),
      memory_usage_gb DECIMAL(10,2),
      disk_usage_gb DECIMAL(10,2),
      gpu_usage_percent DECIMAL(5,2),
      uptime_seconds INT,
      recorded_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      INDEX idx_instance_recorded (instance_id, recorded_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS audit_logs (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT,
      action VARCHAR(100) NOT NULL,
      resource_type VARCHAR(50) NOT NULL,
      resource_id INT,
      details JSON,
      ip_address VARCHAR(45),
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL,
      INDEX idx_user_id (user_id),
      INDEX idx_action (action),
      INDEX idx_created_at (created_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    INSERT INTO users (username, email, password_hash, role, is_active)
    SELECT 'admin', 'admin@clawmanager.local', '$2a$10$pbenze514mwv3pvQySQBVOsF5J4DBXL2kVo1hLa8JFhQu5x3AKvBi', 'admin', TRUE
    WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin');

    INSERT INTO user_quotas (user_id, max_instances, max_cpu_cores, max_memory_gb, max_storage_gb, max_gpu_count)
    SELECT id, 100, 200, 1000, 5000, 10 FROM users
    WHERE username = 'admin'
      AND NOT EXISTS (SELECT 1 FROM user_quotas WHERE user_id = users.id);
  002_add_webtop_instance_type.sql: |
    USE clawmanager;
    ALTER TABLE instances
    MODIFY COLUMN type ENUM('openclaw', 'ubuntu', 'debian', 'centos', 'custom', 'webtop', 'hermes') DEFAULT 'ubuntu';
  003_add_system_image_settings.sql: |
    USE clawmanager;
    CREATE TABLE IF NOT EXISTS system_image_settings (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_type VARCHAR(50) NOT NULL,
      runtime_type ENUM('desktop', 'shell') NOT NULL DEFAULT 'desktop',
      display_name VARCHAR(255) NOT NULL,
      image VARCHAR(500) NOT NULL,
      is_enabled BOOLEAN NOT NULL DEFAULT TRUE,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      INDEX idx_instance_type (instance_type)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  004_fix_seeded_admin_password.sql: |
    USE clawmanager;
    UPDATE users
    SET password_hash = '$2a$10$pbenze514mwv3pvQySQBVOsF5J4DBXL2kVo1hLa8JFhQu5x3AKvBi'
    WHERE username = 'admin'
      AND password_hash = '$2a$10$N9qo8uLOickgx2ZMRZoMy.MqrzL9wGC3qD3Q.ZHqQH6t3q7l1L5uG';
  005_update_openclaw_default_image.sql: |
    USE clawmanager;
    UPDATE system_image_settings
    SET image = 'ghcr.io/yuan-lab-llm/agentsruntime/openclaw:latest'
    WHERE instance_type = 'openclaw'
      AND image IN (
        'ericpearlee/openclaw:v2026.3.24',
        'ghcr.io/yuan-lab-llm/clawmanager-openclaw-image/openclaw:latest'
      );
  006_add_openclaw_config_center.sql: |
    USE clawmanager;
    SET @openclaw_snapshot_column_exists = (
      SELECT COUNT(*)
      FROM information_schema.COLUMNS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'instances'
        AND COLUMN_NAME = 'openclaw_config_snapshot_id'
    );
    SET @openclaw_snapshot_column_sql = IF(
      @openclaw_snapshot_column_exists = 0,
      'ALTER TABLE instances ADD COLUMN openclaw_config_snapshot_id INT NULL AFTER access_token',
      'SELECT 1'
    );
    PREPARE openclaw_snapshot_column_stmt FROM @openclaw_snapshot_column_sql;
    EXECUTE openclaw_snapshot_column_stmt;
    DEALLOCATE PREPARE openclaw_snapshot_column_stmt;

    CREATE TABLE IF NOT EXISTS openclaw_config_resources (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL,
      resource_type VARCHAR(50) NOT NULL,
      resource_key VARCHAR(100) NOT NULL,
      name VARCHAR(255) NOT NULL,
      description TEXT NULL,
      enabled BOOLEAN NOT NULL DEFAULT TRUE,
      version INT NOT NULL DEFAULT 1,
      tags_json LONGTEXT NOT NULL,
      content_json LONGTEXT NOT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
      UNIQUE KEY uk_openclaw_resource_key (user_id, resource_type, resource_key),
      INDEX idx_openclaw_resource_user_type (user_id, resource_type),
      INDEX idx_openclaw_resource_user_enabled (user_id, enabled)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS openclaw_config_bundles (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL,
      name VARCHAR(255) NOT NULL,
      description TEXT NULL,
      enabled BOOLEAN NOT NULL DEFAULT TRUE,
      version INT NOT NULL DEFAULT 1,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
      INDEX idx_openclaw_bundle_user (user_id),
      INDEX idx_openclaw_bundle_user_enabled (user_id, enabled)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS openclaw_config_bundle_items (
      id INT AUTO_INCREMENT PRIMARY KEY,
      bundle_id INT NOT NULL,
      resource_id INT NOT NULL,
      sort_order INT NOT NULL DEFAULT 0,
      required BOOLEAN NOT NULL DEFAULT TRUE,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (bundle_id) REFERENCES openclaw_config_bundles(id) ON DELETE CASCADE,
      FOREIGN KEY (resource_id) REFERENCES openclaw_config_resources(id) ON DELETE CASCADE,
      UNIQUE KEY uk_openclaw_bundle_resource (bundle_id, resource_id),
      INDEX idx_openclaw_bundle_item_bundle (bundle_id, sort_order)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS openclaw_injection_snapshots (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NULL,
      user_id INT NOT NULL,
      mode VARCHAR(20) NOT NULL,
      bundle_id INT NULL,
      selected_resource_ids_json LONGTEXT NOT NULL,
      resolved_resources_json LONGTEXT NOT NULL,
      rendered_manifest_json LONGTEXT NOT NULL,
      rendered_env_json LONGTEXT NOT NULL,
      secret_name VARCHAR(255) NULL,
      status VARCHAR(30) NOT NULL DEFAULT 'pending',
      error_message TEXT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      activated_at TIMESTAMP NULL,
      INDEX idx_openclaw_snapshot_user_created (user_id, created_at),
      INDEX idx_openclaw_snapshot_instance (instance_id),
      INDEX idx_openclaw_snapshot_bundle (bundle_id)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  007_add_instance_agent_control_plane.sql: |
    USE clawmanager;
    SET @instance_agent_bootstrap_token_column_exists = (
      SELECT COUNT(*)
      FROM information_schema.COLUMNS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'instances'
        AND COLUMN_NAME = 'agent_bootstrap_token'
    );
    SET @instance_agent_bootstrap_token_column_sql = IF(
      @instance_agent_bootstrap_token_column_exists = 0,
      'ALTER TABLE instances ADD COLUMN agent_bootstrap_token VARCHAR(255) NULL AFTER access_token',
      'SELECT 1'
    );
    PREPARE instance_agent_bootstrap_token_column_stmt FROM @instance_agent_bootstrap_token_column_sql;
    EXECUTE instance_agent_bootstrap_token_column_stmt;
    DEALLOCATE PREPARE instance_agent_bootstrap_token_column_stmt;

    CREATE TABLE IF NOT EXISTS instance_agents (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      agent_id VARCHAR(255) NOT NULL,
      agent_version VARCHAR(50) NOT NULL,
      protocol_version VARCHAR(50) NOT NULL,
      status VARCHAR(30) NOT NULL DEFAULT 'online',
      capabilities_json LONGTEXT NOT NULL,
      host_info_json LONGTEXT NULL,
      session_token VARCHAR(255) NULL,
      session_expires_at TIMESTAMP NULL,
      last_heartbeat_at TIMESTAMP NULL,
      last_reported_at TIMESTAMP NULL,
      last_seen_ip VARCHAR(45) NULL,
      registered_at TIMESTAMP NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      UNIQUE KEY uk_instance_agents_instance (instance_id),
      UNIQUE KEY uk_instance_agents_session_token (session_token),
      INDEX idx_instance_agents_agent_id (agent_id),
      INDEX idx_instance_agents_status (status),
      INDEX idx_instance_agents_last_heartbeat (last_heartbeat_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_runtime_status (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      infra_status VARCHAR(30) NOT NULL DEFAULT 'creating',
      agent_status VARCHAR(30) NOT NULL DEFAULT 'offline',
      openclaw_status VARCHAR(30) NOT NULL DEFAULT 'unknown',
      openclaw_pid INT NULL,
      openclaw_version VARCHAR(100) NULL,
      current_config_revision_id INT NULL,
      desired_config_revision_id INT NULL,
      summary_json LONGTEXT NULL,
      system_info_json LONGTEXT NULL,
      health_json LONGTEXT NULL,
      last_reported_at TIMESTAMP NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      UNIQUE KEY uk_instance_runtime_status_instance (instance_id),
      INDEX idx_instance_runtime_status_agent_status (agent_status),
      INDEX idx_instance_runtime_status_openclaw_status (openclaw_status)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_desired_state (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      desired_power_state VARCHAR(30) NOT NULL DEFAULT 'running',
      desired_config_revision_id INT NULL,
      desired_runtime_action VARCHAR(50) NULL,
      updated_by INT NULL,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      FOREIGN KEY (updated_by) REFERENCES users(id) ON DELETE SET NULL,
      UNIQUE KEY uk_instance_desired_state_instance (instance_id)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_commands (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      agent_id VARCHAR(255) NULL,
      command_type VARCHAR(50) NOT NULL,
      payload_json LONGTEXT NULL,
      status VARCHAR(30) NOT NULL DEFAULT 'pending',
      idempotency_key VARCHAR(255) NOT NULL,
      issued_by INT NULL,
      issued_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      dispatched_at TIMESTAMP NULL,
      started_at TIMESTAMP NULL,
      finished_at TIMESTAMP NULL,
      timeout_seconds INT NOT NULL DEFAULT 300,
      result_json LONGTEXT NULL,
      error_message TEXT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      FOREIGN KEY (issued_by) REFERENCES users(id) ON DELETE SET NULL,
      UNIQUE KEY uk_instance_commands_idempotency (instance_id, idempotency_key),
      INDEX idx_instance_commands_instance_status (instance_id, status),
      INDEX idx_instance_commands_agent_status (agent_id, status),
      INDEX idx_instance_commands_issued_at (issued_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_config_revisions (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      source_snapshot_id INT NULL,
      source_bundle_id INT NULL,
      revision_no INT NOT NULL,
      content_json LONGTEXT NOT NULL,
      checksum VARCHAR(255) NOT NULL,
      status VARCHAR(30) NOT NULL DEFAULT 'published',
      published_by INT NULL,
      published_at TIMESTAMP NULL,
      activated_at TIMESTAMP NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      FOREIGN KEY (published_by) REFERENCES users(id) ON DELETE SET NULL,
      UNIQUE KEY uk_instance_config_revision_unique (instance_id, revision_no),
      INDEX idx_instance_config_revision_instance (instance_id, revision_no),
      INDEX idx_instance_config_revision_status (status)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  008_add_skill_management.sql: |
    USE clawmanager;
    CREATE TABLE IF NOT EXISTS skill_blobs (
      id INT AUTO_INCREMENT PRIMARY KEY,
      content_hash VARCHAR(128) NOT NULL,
      archive_hash VARCHAR(128) NOT NULL,
      object_key VARCHAR(512) NOT NULL,
      file_name VARCHAR(255) NOT NULL,
      media_type VARCHAR(100) NOT NULL DEFAULT 'application/gzip',
      size_bytes BIGINT NOT NULL DEFAULT 0,
      scan_status VARCHAR(30) NOT NULL DEFAULT 'pending',
      risk_level VARCHAR(30) NOT NULL DEFAULT 'unknown',
      last_scanned_at TIMESTAMP NULL,
      last_scan_result_id INT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      UNIQUE KEY uk_skill_blobs_content_hash (content_hash),
      INDEX idx_skill_blobs_scan_status (scan_status),
      INDEX idx_skill_blobs_risk_level (risk_level)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS skills (
      id INT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL,
      skill_key VARCHAR(120) NOT NULL,
      name VARCHAR(255) NOT NULL,
      description TEXT NULL,
      current_version_id INT NULL,
      source_type VARCHAR(30) NOT NULL DEFAULT 'uploaded',
      status VARCHAR(30) NOT NULL DEFAULT 'active',
      risk_level VARCHAR(30) NOT NULL DEFAULT 'unknown',
      last_scanned_at TIMESTAMP NULL,
      last_scan_result_id INT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
      UNIQUE KEY uk_skills_user_key (user_id, skill_key),
      INDEX idx_skills_user_status (user_id, status),
      INDEX idx_skills_risk_level (risk_level)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS skill_versions (
      id INT AUTO_INCREMENT PRIMARY KEY,
      skill_id INT NOT NULL,
      blob_id INT NOT NULL,
      version_no INT NOT NULL,
      manifest_json LONGTEXT NULL,
      source_type VARCHAR(30) NOT NULL DEFAULT 'uploaded',
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (skill_id) REFERENCES skills(id) ON DELETE CASCADE,
      FOREIGN KEY (blob_id) REFERENCES skill_blobs(id) ON DELETE RESTRICT,
      UNIQUE KEY uk_skill_versions_skill_version (skill_id, version_no),
      UNIQUE KEY uk_skill_versions_skill_blob (skill_id, blob_id),
      INDEX idx_skill_versions_skill_id (skill_id, version_no)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS instance_skills (
      id INT AUTO_INCREMENT PRIMARY KEY,
      instance_id INT NOT NULL,
      skill_id INT NOT NULL,
      skill_version_id INT NULL,
      source_type VARCHAR(40) NOT NULL DEFAULT 'discovered_in_instance',
      install_path VARCHAR(1024) NULL,
      observed_hash VARCHAR(128) NULL,
      status VARCHAR(30) NOT NULL DEFAULT 'active',
      last_seen_at TIMESTAMP NULL,
      removed_at TIMESTAMP NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (instance_id) REFERENCES instances(id) ON DELETE CASCADE,
      FOREIGN KEY (skill_id) REFERENCES skills(id) ON DELETE CASCADE,
      FOREIGN KEY (skill_version_id) REFERENCES skill_versions(id) ON DELETE SET NULL,
      UNIQUE KEY uk_instance_skills_instance_skill (instance_id, skill_id),
      INDEX idx_instance_skills_instance (instance_id, status),
      INDEX idx_instance_skills_skill (skill_id, status)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

    CREATE TABLE IF NOT EXISTS skill_scan_results (
      id INT AUTO_INCREMENT PRIMARY KEY,
      blob_id INT NOT NULL,
      engine VARCHAR(60) NOT NULL,
      risk_level VARCHAR(30) NOT NULL DEFAULT 'unknown',
      status VARCHAR(30) NOT NULL DEFAULT 'completed',
      summary TEXT NULL,
      findings_json LONGTEXT NULL,
      scanned_at TIMESTAMP NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      FOREIGN KEY (blob_id) REFERENCES skill_blobs(id) ON DELETE CASCADE,
      INDEX idx_skill_scan_results_blob (blob_id, scanned_at),
      INDEX idx_skill_scan_results_risk (risk_level, scanned_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  009_cpu_cores_decimal.sql: |
    USE clawmanager;
    ALTER TABLE instances MODIFY COLUMN cpu_cores DECIMAL(10,2) NOT NULL;
    ALTER TABLE user_quotas MODIFY COLUMN max_cpu_cores DECIMAL(10,2) DEFAULT 40;
  011_add_hermes_instance_type.sql: |
    USE clawmanager;
    ALTER TABLE instances
    MODIFY COLUMN type ENUM('openclaw', 'ubuntu', 'debian', 'centos', 'custom', 'webtop', 'hermes') DEFAULT 'ubuntu';
  012_update_agents_runtime_default_images.sql: |
    USE clawmanager;
    UPDATE system_image_settings
    SET image = 'ghcr.io/yuan-lab-llm/agentsruntime/openclaw:latest'
    WHERE instance_type = 'openclaw'
      AND image IN (
        'ericpearlee/openclaw:v2026.3.24',
        'ghcr.io/yuan-lab-llm/clawmanager-openclaw-image/openclaw:latest'
      );

    UPDATE system_image_settings
    SET image = 'ghcr.io/yuan-lab-llm/agentsruntime/hermes:latest'
    WHERE instance_type = 'hermes'
      AND image IN (
        'registry.example.com/hermes-webtop:latest',
        'lscr.io/linuxserver/webtop:ubuntu-xfce'
      );
  013_normalize_agents_runtime_image_names.sql: |
    USE clawmanager;
    UPDATE system_image_settings
    SET image = 'ghcr.io/yuan-lab-llm/agentsruntime/openclaw:latest'
    WHERE image = 'ghcr.io/Yuan-lab-LLM/AgentsRuntime/openclaw:latest';

    UPDATE system_image_settings
    SET image = 'ghcr.io/yuan-lab-llm/agentsruntime/hermes:latest'
    WHERE image = 'ghcr.io/Yuan-lab-LLM/AgentsRuntime/hermes:latest';
  019_add_instance_runtime_type.sql: |
    USE clawmanager;
    SET @instance_runtime_type_column_exists = (
      SELECT COUNT(*)
      FROM information_schema.COLUMNS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'instances'
        AND COLUMN_NAME = 'runtime_type'
    );
    SET @instance_runtime_type_column_sql = IF(
      @instance_runtime_type_column_exists = 0,
      'ALTER TABLE instances ADD COLUMN runtime_type ENUM(''desktop'', ''shell'') NOT NULL DEFAULT ''desktop'' AFTER type',
      'SELECT 1'
    );
    PREPARE instance_runtime_type_column_stmt FROM @instance_runtime_type_column_sql;
    EXECUTE instance_runtime_type_column_stmt;
    DEALLOCATE PREPARE instance_runtime_type_column_stmt;
  020_add_system_image_runtime_type.sql: |
    USE clawmanager;
    SET @system_image_runtime_type_column_exists = (
      SELECT COUNT(*)
      FROM information_schema.COLUMNS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'system_image_settings'
        AND COLUMN_NAME = 'runtime_type'
    );
    SET @system_image_runtime_type_column_sql = IF(
      @system_image_runtime_type_column_exists = 0,
      'ALTER TABLE system_image_settings ADD COLUMN runtime_type ENUM(''desktop'', ''shell'') NOT NULL DEFAULT ''desktop'' AFTER instance_type',
      'SELECT 1'
    );
    PREPARE system_image_runtime_type_column_stmt FROM @system_image_runtime_type_column_sql;
    EXECUTE system_image_runtime_type_column_stmt;
    DEALLOCATE PREPARE system_image_runtime_type_column_stmt;
  021_add_openclaw_shell_runtime_image.sql: |
    USE clawmanager;
    SET @system_image_is_enabled_column_exists = (
      SELECT COUNT(*)
      FROM information_schema.COLUMNS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'system_image_settings'
        AND COLUMN_NAME = 'is_enabled'
    );
    SET @system_image_is_enabled_column_sql = IF(
      @system_image_is_enabled_column_exists = 0,
      'ALTER TABLE system_image_settings ADD COLUMN is_enabled BOOLEAN NOT NULL DEFAULT TRUE',
      'SELECT 1'
    );
    PREPARE system_image_is_enabled_column_stmt FROM @system_image_is_enabled_column_sql;
    EXECUTE system_image_is_enabled_column_stmt;
    DEALLOCATE PREPARE system_image_is_enabled_column_stmt;

    SET @system_image_unique_instance_type_index_name = (
      SELECT INDEX_NAME
      FROM information_schema.STATISTICS
      WHERE TABLE_SCHEMA = DATABASE()
        AND TABLE_NAME = 'system_image_settings'
        AND COLUMN_NAME = 'instance_type'
        AND NON_UNIQUE = 0
        AND INDEX_NAME <> 'PRIMARY'
      LIMIT 1
    );
    SET @system_image_unique_instance_type_index_sql = IF(
      @system_image_unique_instance_type_index_name IS NOT NULL,
      CONCAT(
        'ALTER TABLE system_image_settings DROP INDEX `',
        REPLACE(@system_image_unique_instance_type_index_name, '`', '``'),
        '`'
      ),
      'SELECT 1'
    );
    PREPARE system_image_unique_instance_type_index_stmt FROM @system_image_unique_instance_type_index_sql;
    EXECUTE system_image_unique_instance_type_index_stmt;
    DEALLOCATE PREPARE system_image_unique_instance_type_index_stmt;

    INSERT INTO system_image_settings (instance_type, runtime_type, display_name, image, is_enabled)
    SELECT
      'openclaw',
      'desktop',
      'OpenClaw Desktop',
      'ghcr.io/yuan-lab-llm/agentsruntime/openclaw:latest',
      TRUE
    WHERE NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'openclaw'
        AND runtime_type = 'desktop'
    )
    AND NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'openclaw'
        AND is_enabled = FALSE
    );

    INSERT INTO system_image_settings (instance_type, runtime_type, display_name, image, is_enabled)
    SELECT
      'openclaw',
      'shell',
      'OpenClaw Lite',
      'ghcr.io/yuan-lab-llm/agentsruntime/openclaw-lite:latest',
      TRUE
    WHERE NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'openclaw'
        AND runtime_type = 'shell'
    )
    AND NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'openclaw'
        AND is_enabled = FALSE
    );
  022_add_openclaw_config_bundle_skills.sql: |
    USE clawmanager;
    CREATE TABLE IF NOT EXISTS openclaw_config_bundle_skills (
      id INT AUTO_INCREMENT PRIMARY KEY,
      bundle_id INT NOT NULL,
      skill_id INT NOT NULL,
      sort_order INT NOT NULL DEFAULT 0,
      required BOOLEAN NOT NULL DEFAULT TRUE,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (bundle_id) REFERENCES openclaw_config_bundles(id) ON DELETE CASCADE,
      FOREIGN KEY (skill_id) REFERENCES skills(id) ON DELETE CASCADE,
      UNIQUE KEY uk_openclaw_bundle_skill (bundle_id, skill_id),
      INDEX idx_openclaw_bundle_skill_bundle (bundle_id, sort_order)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  023_normalize_runtime_config_mounts.sql: |
    USE clawmanager;
    UPDATE instances
    SET mount_path = '/config',
        updated_at = CURRENT_TIMESTAMP
    WHERE type IN ('openclaw', 'ubuntu', 'webtop', 'hermes')
      AND mount_path IN ('/data', '/home/user/data', '/config/.hermes');
  031_add_hermes_lite_runtime_image.sql: |
    USE clawmanager;
    UPDATE system_image_settings
    SET
      image = 'ghcr.io/yuan-lab-llm/agentsruntime/hermes-lite:latest',
      display_name = 'Hermes Lite',
      is_enabled = TRUE
    WHERE instance_type = 'hermes'
      AND runtime_type = 'shell'
      AND image IN (
        'ghcr.io/yuan-lab-llm/agentsruntime/hermes-shell:latest',
        'registry.example.com/your-custom-shell-image:latest'
      );

    INSERT INTO system_image_settings (instance_type, runtime_type, display_name, image, is_enabled)
    SELECT
      'hermes',
      'shell',
      'Hermes Lite',
      'ghcr.io/yuan-lab-llm/agentsruntime/hermes-lite:latest',
      TRUE
    WHERE NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'hermes'
        AND runtime_type = 'shell'
    )
    AND NOT EXISTS (
      SELECT 1
      FROM system_image_settings
      WHERE instance_type = 'hermes'
        AND is_enabled = FALSE
    );
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: clawmanager-mysql-pv
  labels:
    app: clawmanager
    managed-by: clawmanager
    clawmanager.io/storage-profile: single-node
    clawmanager.io/storage-node: "true"
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: clawmanager.io/storage-node
              operator: In
              values:
                - "true"
  hostPath:
    path: /data/clawmanager/system/mysql
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
  namespace: clawmanager-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  storageClassName: manual
  volumeName: clawmanager-mysql-pv
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: clawmanager-minio-pv
  labels:
    app: clawmanager
    managed-by: clawmanager
    clawmanager.io/storage-profile: single-node
    clawmanager.io/storage-node: "true"
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: clawmanager.io/storage-node
              operator: In
              values:
                - "true"
  hostPath:
    path: /data/clawmanager/system/minio
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: minio-data
  namespace: clawmanager-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: manual
  volumeName: clawmanager-minio-pv
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: clawmanager-redis-pv
  labels:
    app: clawmanager
    managed-by: clawmanager
    clawmanager.io/storage-profile: single-node
    clawmanager.io/storage-node: "true"
spec:
  capacity:
    storage: 1Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: clawmanager.io/storage-node
              operator: In
              values:
                - "true"
  hostPath:
    path: /data/clawmanager/system/redis
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-data
  namespace: clawmanager-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: manual
  volumeName: clawmanager-redis-pv
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: clawmanager-workspaces-pv
  labels:
    app: clawmanager
    managed-by: clawmanager
    clawmanager.io/storage-profile: single-node
    clawmanager.io/storage-node: "true"
spec:
  capacity:
    storage: 50Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: clawmanager.io/storage-node
              operator: In
              values:
                - "true"
  hostPath:
    path: /data/clawmanager/system/workspaces
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: clawmanager-workspaces
  namespace: clawmanager-system
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 50Gi
  storageClassName: manual
  volumeName: clawmanager-workspaces-pv
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql
  namespace: clawmanager-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - name: mysql
          #image: mysql:8.4.8
          image: mysql:8.4.8
          imagePullPolicy: IfNotPresent
          args:
            - "--innodb-use-native-aio=0"
          ports:
            - containerPort: 3306
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: mysql-root-password
            - name: MYSQL_DATABASE
              value: clawmanager
            - name: MYSQL_USER
              value: clawmanager
            - name: MYSQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: mysql-password
          volumeMounts:
            - name: mysql-data
              mountPath: /var/lib/mysql
            - name: mysql-init
              mountPath: /docker-entrypoint-initdb.d
          readinessProbe:
            exec:
              command: ["sh", "-c", "mysqladmin ping -h 127.0.0.1 -uroot -p$MYSQL_ROOT_PASSWORD"]
            initialDelaySeconds: 20
            periodSeconds: 10
      volumes:
        - name: mysql-data
          persistentVolumeClaim:
            claimName: mysql-data
        - name: mysql-init
          configMap:
            name: clawmanager-mysql-init
---
apiVersion: v1
kind: Service
metadata:
  name: mysql
  namespace: clawmanager-system
spec:
  selector:
    app: mysql
  ports:
    - name: mysql
      port: 3306
      targetPort: 3306
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio
  namespace: clawmanager-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      labels:
        app: minio
    spec:
      containers:
        - name: minio
          image: minio/minio:latest
          imagePullPolicy: IfNotPresent
          args:
            - server
            - /data
            - --console-address
            - ":9001"
          env:
            - name: MINIO_ROOT_USER
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: minio-root-user
            - name: MINIO_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: minio-root-password
          ports:
            - name: api
              containerPort: 9000
            - name: console
              containerPort: 9001
          volumeMounts:
            - name: minio-data
              mountPath: /data
          readinessProbe:
            tcpSocket:
              port: api
            initialDelaySeconds: 10
            periodSeconds: 10
      volumes:
        - name: minio-data
          persistentVolumeClaim:
            claimName: minio-data
---
apiVersion: v1
kind: Service
metadata:
  name: minio
  namespace: clawmanager-system
spec:
  selector:
    app: minio
  ports:
    - name: api
      port: 9000
      targetPort: api
    - name: console
      port: 9001
      targetPort: console
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: clawmanager-team-redis
  namespace: clawmanager-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: clawmanager-team-redis
  template:
    metadata:
      labels:
        app: clawmanager-team-redis
    spec:
      containers:
        - name: redis
          image: redis:7-alpine
          imagePullPolicy: IfNotPresent
          args:
            - redis-server
            - --appendonly
            - "yes"
          ports:
            - name: redis
              containerPort: 6379
          readinessProbe:
            tcpSocket:
              port: redis
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: redis-data
              mountPath: /data
      volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: redis-data
---
apiVersion: v1
kind: Service
metadata:
  name: clawmanager-redis
  namespace: clawmanager-system
spec:
  selector:
    app: clawmanager-team-redis
  ports:
    - name: redis
      port: 6379
      targetPort: redis
---
apiVersion: v1
kind: Service
metadata:
  name: clawmanager-team-redis
  namespace: clawmanager-system
spec:
  selector:
    app: clawmanager-team-redis
  ports:
    - name: redis
      port: 6379
      targetPort: redis
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: clawmanager-app
  namespace: clawmanager-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clawmanager-runtime-manager
rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - create
      - update
  - apiGroups:
      - apps
    resources:
      - deployments
      - deployments/scale
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clawmanager-runtime-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: clawmanager-runtime-manager
subjects:
  - kind: ServiceAccount
    name: clawmanager-app
    namespace: clawmanager-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clawmanager-app-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: clawmanager-app
    namespace: clawmanager-system
---
---
# Explicit lease permissions for control-plane leader election. The
# cluster-admin binding above already covers this; this Role documents the
# requirement and keeps leader election working if RBAC is tightened later.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: clawmanager-app-leaderelection
  namespace: clawmanager-system
rules:
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: clawmanager-app-leaderelection
  namespace: clawmanager-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: clawmanager-app-leaderelection
subjects:
  - kind: ServiceAccount
    name: clawmanager-app
    namespace: clawmanager-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: skill-scanner
  namespace: clawmanager-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: skill-scanner
  template:
    metadata:
      labels:
        app: skill-scanner
    spec:
      containers:
        - name: skill-scanner
          image: ghcr.io/yuan-lab-llm/skill-scanner:latest
          imagePullPolicy: IfNotPresent
          command:
            - /opt/skill-scanner-venv/bin/skill-scanner-api
            - --host
            - 0.0.0.0
            - --port
            - "8000"
          env:
            - name: SKILL_SCANNER_LLM_API_KEY
              value: ""
            - name: SKILL_SCANNER_LLM_MODEL
              value: ""
            - name: SKILL_SCANNER_LLM_BASE_URL
              value: ""
            - name: SKILL_SCANNER_META_LLM_API_KEY
              value: ""
            - name: SKILL_SCANNER_META_LLM_MODEL
              value: ""
            - name: SKILL_SCANNER_META_LLM_BASE_URL
              value: ""
          ports:
            - name: http
              containerPort: 8000
---
apiVersion: v1
kind: Service
metadata:
  name: skill-scanner
  namespace: clawmanager-system
spec:
  selector:
    app: skill-scanner
  ports:
    - name: http
      port: 8000
      targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: clawmanager-app
  namespace: clawmanager-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: clawmanager-app
  template:
    metadata:
      labels:
        app: clawmanager-app
    spec:
      serviceAccountName: clawmanager-app
      containers:
        - name: clawmanager-app
          image: ghcr.io/yuan-lab-llm/clawmanager:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: https
              containerPort: 8443
            - name: proxy
              containerPort: 9001
          env:
            - name: SERVER_ADDRESS
              value: ":9001"
            - name: SERVER_MODE
              value: "release"
            - name: DB_HOST
              value: "mysql"
            - name: DB_PORT
              value: "3306"
            - name: DB_USER
              value: "clawmanager"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: mysql-password
            - name: DB_NAME
              value: "clawmanager"
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: jwt-secret
            - name: OBJECT_STORAGE_ENDPOINT
              value: "minio.clawmanager-system.svc.cluster.local:9000"
            - name: OBJECT_STORAGE_REGION
              value: ""
            - name: OBJECT_STORAGE_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: minio-access-key
            - name: OBJECT_STORAGE_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: minio-secret-key
            - name: OBJECT_STORAGE_BUCKET
              value: "clawmanager-skills"
            - name: OBJECT_STORAGE_USE_SSL
              value: "false"
            - name: OBJECT_STORAGE_BASE_PATH
              value: "skills"
            - name: OBJECT_STORAGE_FORCE_PATH_STYLE
              value: "true"
            - name: K8S_MODE
              value: "incluster"
            - name: K8S_NAMESPACE
              value: "clawmanager"
            - name: K8S_STORAGE_CLASS
              value: "manual"
            - name: CLAWMANAGER_STORAGE_PROFILE
              value: "single-node"
            - name: K8S_HOSTPATH_FALLBACK_ENABLED
              value: "true"
            - name: K8S_PVC_BIND_TIMEOUT
              value: "2m"
            - name: K8S_CONTROL_PLANE_STORAGE_CLASS
              value: "manual"
            - name: K8S_INSTANCE_STORAGE_CLASS
              value: "manual"
            - name: K8S_WORKSPACE_STORAGE_CLASS
              value: "manual"
            - name: K8S_WORKSPACE_ACCESS_MODE
              value: "ReadWriteMany"
            - name: K8S_PV_HOST_PATH_PREFIX
              value: "/data/clawreef"
            - name: CLAWMANAGER_WORKSPACE_ARCHIVE_MAX_MIB
              value: "500"
            - name: PLATFORM_REDIS_URL
              value: "redis://clawmanager-redis.clawmanager-system.svc.cluster.local:6379/0"
            - name: TEAM_REDIS_URL
              value: "redis://clawmanager-redis.clawmanager-system.svc.cluster.local:6379/0"
            - name: CLAWMANAGER_DESKTOP_DIRECT_PROXY
              value: "true"
            # Leader election for control-plane singleton background loops.
            # Required before scaling replicas > 1 so SyncService / Team event
            # consumers / stale-task monitor run on exactly one replica.
            - name: CLAWMANAGER_LEADER_ELECTION
              value: "true"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CLAWMANAGER_TEAM_REDIS_URL
              value: "redis://clawmanager-redis.clawmanager-system.svc.cluster.local:6379/0"
            - name: CLAWMANAGER_TEAM_MANAGER_BASE_URL
              value: "http://clawmanager-gateway.clawmanager-system.svc.cluster.local:9001"
            - name: RUNTIME_NAMESPACE
              value: "clawmanager-system"
            - name: RUNTIME_WORKSPACE_ROOT
              value: "/workspaces"
            - name: RUNTIME_WORKSPACE_PVC_CLAIM
              value: "clawmanager-workspaces"
            - name: RUNTIME_MAX_GATEWAYS_PER_POD
              value: "100"
            - name: RUNTIME_GATEWAY_PORT_START
              value: "20000"
            - name: RUNTIME_GATEWAY_PORT_END
              value: "20299"
            - name: RUNTIME_SCHEDULER_ENABLED
              value: "true"
            - name: RUNTIME_HEARTBEAT_TIMEOUT
              value: "10s"
            - name: RUNTIME_AGENT_CONTROL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-control-token
            - name: RUNTIME_AGENT_REPORT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-report-token
            - name: OPENCLAW_GATEWAY_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: openclaw-gateway-token
            - name: SKILL_SCANNER_ENABLED
              value: "true"
            - name: SKILL_SCANNER_BASE_URL
              value: "http://skill-scanner.clawmanager-system.svc.cluster.local:8000"
            - name: SKILL_SCANNER_TIMEOUT_SECONDS
              value: "120"
            - name: SKILL_SCANNER_NAMESPACE
              value: "clawmanager-system"
            - name: SKILL_SCANNER_DEPLOYMENT
              value: "skill-scanner"
          volumeMounts:
            - name: tls-cert
              mountPath: /var/run/clawreef-tls
              readOnly: true
            - name: workspaces
              mountPath: /workspaces
          readinessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
            initialDelaySeconds: 30
            periodSeconds: 20
      volumes:
        - name: tls-cert
          secret:
            secretName: clawmanager-tls
            optional: true
        - name: workspaces
          persistentVolumeClaim:
            claimName: clawmanager-workspaces
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-runtime
  namespace: clawmanager-system
  labels:
    app: openclaw-runtime
    clawmanager.io/runtime-type: openclaw
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openclaw-runtime
      clawmanager.io/runtime-type: openclaw
  template:
    metadata:
      labels:
        app: openclaw-runtime
        clawmanager.io/runtime-type: openclaw
    spec:
      containers:
        - name: runtime
          image: ghcr.io/yuan-lab-llm/agentsruntime/openclaw-lite:latest
          imagePullPolicy: Always
          env:
            - name: CLAWMANAGER_RUNTIME_TYPE
              value: openclaw
            - name: CLAWMANAGER_BACKEND_URL
              value: "http://clawmanager-gateway.clawmanager-system.svc.cluster.local:9001"
            - name: CLAWMANAGER_RUNTIME_DEPLOYMENT_NAME
              value: openclaw-runtime
            - name: CLAWMANAGER_RUNTIME_IMAGE_REF
              value: ghcr.io/yuan-lab-llm/agentsruntime/openclaw-lite:latest
            - name: RUNTIME_WORKSPACE_ROOT
              value: /workspaces
            - name: RUNTIME_GATEWAY_PORT_START
              value: "20000"
            - name: RUNTIME_GATEWAY_PORT_END
              value: "20299"
            - name: RUNTIME_AGENT_LISTEN_ADDR
              value: "0.0.0.0:19090"
            - name: RUNTIME_AGENT_PUBLIC_PORT
              value: "19090"
            - name: RUNTIME_GATEWAY_COMMAND
              value: "/usr/local/bin/openclaw gateway run --allow-unconfigured --auth token --bind lan --force"
            - name: OPENCLAW_GATEWAY_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: openclaw-gateway-token
            - name: RUNTIME_AGENT_CONTROL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-control-token
            - name: RUNTIME_AGENT_REPORT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-report-token
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - name: agent
              containerPort: 19090
          volumeMounts:
            - name: workspaces
              mountPath: /workspaces
      volumes:
        - name: workspaces
          persistentVolumeClaim:
            claimName: clawmanager-workspaces
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-runtime
  namespace: clawmanager-system
  labels:
    app: hermes-runtime
    clawmanager.io/runtime-type: hermes
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hermes-runtime
      clawmanager.io/runtime-type: hermes
  template:
    metadata:
      labels:
        app: hermes-runtime
        clawmanager.io/runtime-type: hermes
    spec:
      containers:
        - name: runtime
          image: ghcr.io/yuan-lab-llm/agentsruntime/hermes-lite:latest
          imagePullPolicy: IfNotPresent
          env:
            - name: CLAWMANAGER_RUNTIME_TYPE
              value: hermes
            - name: CLAWMANAGER_BACKEND_URL
              value: "http://clawmanager-gateway.clawmanager-system.svc.cluster.local:9001"
            - name: CLAWMANAGER_RUNTIME_DEPLOYMENT_NAME
              value: hermes-runtime
            - name: CLAWMANAGER_RUNTIME_IMAGE_REF
              value: ghcr.io/yuan-lab-llm/agentsruntime/hermes-lite:latest
            - name: CLAWMANAGER_AGENT_PORT
              value: "19090"
            - name: CLAWMANAGER_GATEWAY_PORT_START
              value: "20000"
            - name: CLAWMANAGER_GATEWAY_PORT_END
              value: "20299"
            - name: HERMES_TUI_DIR
              value: /usr/local/lib/hermes-agent/ui-tui
            - name: CLAWMANAGER_AGENT_CONTROL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-control-token
            - name: CLAWMANAGER_AGENT_REPORT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-report-token
            - name: RUNTIME_WORKSPACE_ROOT
              value: /workspaces
            - name: RUNTIME_AGENT_LISTEN_ADDR
              value: "0.0.0.0:19090"
            - name: RUNTIME_AGENT_PUBLIC_PORT
              value: "19090"
            - name: RUNTIME_GATEWAY_PORT_START
              value: "20000"
            - name: RUNTIME_GATEWAY_PORT_END
              value: "20299"
            - name: RUNTIME_AGENT_CONTROL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-control-token
            - name: RUNTIME_AGENT_REPORT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: clawmanager-secrets
                  key: runtime-agent-report-token
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - name: agent
              containerPort: 19090
          volumeMounts:
            - name: workspaces
              mountPath: /workspaces
      volumes:
        - name: workspaces
          persistentVolumeClaim:
            claimName: clawmanager-workspaces
---
apiVersion: v1
kind: Service
metadata:
  name: clawmanager-frontend
  namespace: clawmanager-system
spec:
  type: NodePort
  selector:
    app: clawmanager-app
  ports:
    - name: https
      port: 443
      targetPort: https
      nodePort: 30443
---
apiVersion: v1
kind: Service
metadata:
  name: clawmanager-gateway
  namespace: clawmanager-system
spec:
  type: ClusterIP
  selector:
    app: clawmanager-app
  ports:
    - name: api
      port: 9001
      targetPort: 9001
---
apiVersion: v1
kind: Service
metadata:
  name: clawmanager-egress-proxy
  namespace: clawmanager-system
spec:
  type: ClusterIP
  selector:
    app: clawmanager-app
  ports:
    - name: proxy
      port: 3128
      targetPort: 9001