Agentic AI runs arbitrary code with tool access. The interesting question is not whether that needs a boundary, but which boundary actually holds. KubeClaw is an attempt to answer that by building one end to end – OpenTofu provisions the infrastructure, Ansible maintains it, and Cilium restricts egress to the services each workload genuinely needs.
Contain the blast radius
Run agent workloads in isolated Kubernetes namespaces with host hardening, private networking, and explicit Cilium egress policies.
IPv6-first infrastructure
Provision Hetzner nodes without public IPv4 addresses and use NAT64/DNS64 when IPv4-only services are unavoidable.
Built to be taken apart
Every decision is written down, including the ones that turned out to be wrong. Read it, disagree with it, and build something better.
Take the ideas, not the cluster
The documentation is organized around the decisions behind the design, the commands that build it, and the checks that tell you it works. Use it to learn the shape of the problem -- then build a version you have reviewed yourself.