Service instance deployment and billing

Sandbox cluster

Before you deploy Agent Manager, prepare an OpenClaw-ACS-Sandbox Cluster Edition service instance.

• China site: Create an OpenClaw-ACS-Sandbox Cluster Edition instance

• International site: Create an OpenClaw-ACS-Sandbox Cluster Edition instance

Network and vSwitch

If you plan to create Alibaba Cloud managed Supabase, prepare the cluster management vSwitch or a new vSwitch in the corresponding zone. Do not select the OpenClaw dedicated vSwitch. For details, see Step 5: Configure the network settings.

If you use an existing open source Supabase, prepare the browser access URL, the server access URL, the Anon Key, the Service Role Key, and the database connection string in advance.

Model invocation

You can configure models after the deployment. To connect to Alibaba Cloud AI Gateway automatically during the deployment, prepare the DashScope API key, the gateway specification, and the network type in advance.

If you enable AI Gateway during the deployment, get the DashScope API key from the Model Studio console in advance.

RAM permissions

The RAM user or role that creates the service instance must have the permission to create Compute Nest service instances, and the permissions to operate the ROS, CS, VPC, ECS, OSS, and optional AI Gateway resources involved in the template. The required permissions are subject to the verification result on the Compute Nest creation page.

The Alibaba Cloud Access Credential Source in the template is used by the platform to access resources such as OSS, SkillHub, and AI Gateway. It is not equivalent to the permissions of the RAM user that creates the service instance. When you select Use Existing AccessKey, grant the permissions to the corresponding RAM user or role based on the Reference Access Policy for Existing AccessKey displayed on the page.

Step 1: Go to the service instance creation page

1. Log on to the Alibaba Cloud Compute Nest console.

2. Search for and open the Agent Manager service.

3. Click Start Deployment or Create to go to the Create Service Instance page.

   You can also search for Agent Manager in the service catalog. The service card provides the product page, the deployment documentation, and the entry to create a service instance.

Step 2: Complete the pre-deployment confirmation

Read the whitelist configuration confirmation instructions and select the check box. Instance upgrades and Skill mounting depend on the Agent Sandbox shared storage.

Step 3: Configure the Sandbox settings

1. For Sandbox Cluster ID (ClusterId), select the Kubernetes cluster where the existing ACS Sandbox resides.

2. For K8s Namespace (PlatformNamespaceName), enter the platform namespace. The default value is openclaw-platform.

Step 4: Configure the Supabase settings

For Supabase Source (SupabaseDeploymentMode), select CreateNew (create Alibaba Cloud managed Supabase) in a production environment. This is the recommended option.

If you select UseExistingOpenSource (use an existing open source Supabase), enter the public URL, the server access URL, the Anon Key, the Service Role Key, and the database connection string of the existing Supabase. This mode applies to compatibility verification, migration, or testing, and is not recommended for a production environment.

Step 5: Configure the network settings

Select the zone where Supabase resides (ZoneId), the VPC (VpcId), and the vSwitch (VSwitchId).

If you select to create Alibaba Cloud managed Supabase, use the cluster management vSwitch or a regular vSwitch in the corresponding zone. Do not select the OpenClaw dedicated vSwitch.

Step 6: Configure Agent access authentication, OSS, AI Gateway, and access credentials

1. For Enable Agent Access Authentication (EnableAgentGatewayAccess), keep the default enabled state unless you need to continue using the legacy E2B direct address.

2. For Select an Existing or New OSS Bucket (OssOption), select whether to create an OSS bucket or to reuse an existing one.

3. To enable Alibaba Cloud AI Gateway during the deployment, set Configure AI Gateway (EnableAIGateway) to Yes, enter the DashScope API key, and select the gateway specification and the network access type.

4. For Alibaba Cloud Access Credential Source (AccessKeyMode), select automatic creation of an AccessKey or use an existing AccessKey.

   (Recommended) Enable Agent access authentication in a production environment. After you verify that access through the gateway works, tighten the security groups, ACLs, or network policies of the E2B upstream entry.

Step 7: Confirm the order and create the instance

1. Check the parameter completeness and the pricing details on the right side.

2. Click Next: Confirm Order.

3. Select the Compute Nest Terms of Service check box.

4. Click Create Now.

   The deployment usually takes 5 to 10 minutes. Creating Supabase may take a longer time. During the deployment, view the status, the resources, and the deployment logs on the service instance details page. After the deployment is complete, verify the service instance as described in Verify the result.

View the service instance status

1. Open the Compute Nest console.

2. Go to Service Instance Management.

3. Find the Agent Manager service instance.

4. Confirm that the status is Deployed.

   If the status stays at Deploying for a long time, first view the deployment logs on the service instance details page.

Get the platform access URLs

After the deployment is complete, view the following URLs in the service instance outputs:

Open the API health check URL. If a healthy status is returned, the platform API has started.

Get the initial administrator account

The service instance outputs contain the initial administrator information. The default values are as follows:

Agent access gateway

The Agent access gateway protects the Agent web pages. After it is enabled, when a user opens an application access link from the platform, the gateway verifies the logon status and the instance ownership before the user reaches the actual Agent.

# Use the HTTP/IP gateway
NAMESPACE=openclaw-platform
GATEWAY_IP="$(kubectl -n "$NAMESPACE" get svc openclaw-agent-gateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')"
kubectl -n "$NAMESPACE" patch configmap openclaw-platform-config \
  --type merge \
  -p "{\"data\":{\"AGENT_GATEWAY_DOMAIN\":\"http://$GATEWAY_IP:8080\"}}"
kubectl -n "$NAMESPACE" rollout restart deployment/openclaw-platform
kubectl -n "$NAMESPACE" rollout status deployment/openclaw-platform --timeout=300s

# Use the HTTPS domain gateway
NAMESPACE=openclaw-platform
GATEWAY_DOMAIN="https://<gateway domain>"
kubectl -n "$NAMESPACE" patch configmap openclaw-platform-config \
  --type merge \
  -p "{\"data\":{\"AGENT_GATEWAY_DOMAIN\":\"$GATEWAY_DOMAIN\"}}"
kubectl -n "$NAMESPACE" rollout restart deployment/openclaw-platform
kubectl -n "$NAMESPACE" rollout status deployment/openclaw-platform --timeout=300s

# Disable the gateway entry and fall back to the legacy E2B direct address
NAMESPACE=openclaw-platform
kubectl -n "$NAMESPACE" patch configmap openclaw-platform-config \
  --type merge \
  -p '{"data":{"AGENT_GATEWAY_DOMAIN":""}}'
kubectl -n "$NAMESPACE" rollout restart deployment/openclaw-platform
kubectl -n "$NAMESPACE" rollout status deployment/openclaw-platform --timeout=300s

GlobalTrafficPolicy network policy

If the cluster uses GlobalTrafficPolicy to implement network isolation for Agent pods, make sure that spec.selector.matchLabels matches the pods that SandboxSet creates. After you add an Agent type or modify the SandboxSet labels, check the selector again.

kubectl edit globaltrafficpolicy openclaw-global-policy

For example, if the policy needs to match OpenClaw pods:

spec:
  selector:
    matchLabels:
      app: agent-manager-openclaw

You can extend an existing selector for the same network rules. For different network rules, create a separate GlobalTrafficPolicy. After the policy takes effect, verify that the required paths between the platform, Agent Gateway, and Sandbox are still reachable.

Common deployment issues

The gateway returns 502

First check the logs of openclaw-agent-gateway, and then identify the segment where the problem occurs:

A working direct connection after you disable the gateway does not prove that the e2b-ca-cert is correct, because the legacy direct path bypasses the certificate verification from nginx to the E2B upstream. For detailed troubleshooting, see FAQ and troubleshooting.

Pre-deployment confirmation

Sandbox settings

Supabase settings

Network settings

Agent access authentication

OSS storage settings

AI Gateway settings

Cloud resource access credentials