Summary

When running OpenClaw in Kubernetes, gateway and worker nodes need to run as separate pods for independent scaling and fault isolation. Currently, the only way to pair workers to a gateway is through interactive device pairing (PIN-based), which doesn't work in headless container environments and blocks autoscaling.

• Workers must be individually paired to the gateway using an interactive PIN flow.
• No mechanism exists to authenticate workers in a headless, orchestrated environment.
• Scaling workers horizontally (e.g., kubectl scale or HPA) requires manual intervention per pod.
• No Kubernetes deployment manifests or Helm charts exist in the project.

Proposed solution

Add a Kubernetes Service Account (SA) Trust authentication method:

1. Workers present their K8s SA token (auto-mounted by the kubelet) to the gateway on connect.
2. The gateway validates the token against the K8s TokenReview API.
3. Validated workers skip device pairing and connect immediately.
4. New worker pods authenticate automatically — enabling HPA and kubectl scale with zero human interaction.

Include raw K8s manifests and a Helm chart for quick deployment.

Alternatives considered

• Shared secret / pre-shared key: Simpler but requires secret distribution and rotation. Doesn't leverage K8s-native identity.
• mTLS with custom CA: Strong auth but complex certificate lifecycle management. Overkill when K8s already provides pod identity.
• External identity provider (OIDC): Adds external dependency. K8s SA tokens are already OIDC-compatible and available without extra infra.

Additional context

• Already implemented: (PR link)
• Tested on K3s v1.34.3+k3s1 single-node cluster.
• Verified dynamic scaling from 2 to 5 workers — all authenticated via SA Trust in ~10 seconds.
• Deployed to 3 separate namespaces simultaneously using Helm.
• SA Trust is entirely opt-in — no changes to existing authentication flows.