Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog HiClaw Releases v1.1.0, Delivering a Kubernetes Cluster Deployment Implementation and Support for the Hermes Worker Runtime

HiClaw Releases v1.1.0, Delivering a Kubernetes Cluster Deployment Implementation and Support for the Hermes Worker Runtime

This article introduces the new features and bug fixes of HiClaw v1.1.0.

HiClaw v1.1.0 adds 11 new features and fixes 18 bugs. Special thanks to xcaspar, johnlanni, vincent067,cr72589,max-wc,Jingze,YuFeng,luoxiner,googs1025, and 9 contributors in total.

1

1. New Features

Kubernetes Native Architecture

HiClaw can run on top of the native Kubernetes control plane. hiclaw-controller replaces the old single-container mode and uses the standard Controller-Reconciler architecture: an embedded lightweight kube-apiserver + kine stores CRD data, and the Controller coordinates Worker/Team/Manager/Human CRs into containers, Matrix rooms, and gateway routes. In Embedded mode (hiclaw-controller container + standalone hiclaw-manager container), no external Kubernetes cluster is required. For enterprise deployments, the same Controller can run in a real Kubernetes cluster through the official Helm Chart (helm/hiclaw/), supporting Leader Election high availability, RBAC, PVC persistent storage, and Pod template overlays.

Hermes Worker Runtime

HiClaw supports using hermes-agent as a first-class Worker runtime for autonomous programming tasks. Hermes Worker has full autonomous programming Agent capabilities: terminal sandbox execution, multi-file code generation, debugging, visual analysis, and native mautrix Matrix integration — all running inside isolated containers. Unlike the agent runtime (Node.js) and QwenPaw (Python), which handle conversations and tool calls, Hermes is an autonomous programming Agent that can independently plan, execute, and iterate on complex software tasks. The installer provides an interactive choice among three runtimes, and Workers can switch runtimes in place: hiclaw update worker --runtime hermes (container recreation, while Matrix accounts, rooms, credentials, and MinIO data are preserved). Multi-Agent collaboration is also supported — Hermes Worker can participate in team projects together with agent and QwenPaw Workers, with cross-runtime m.mentions message delivery and unattended YOLO-mode autonomous execution.

Enterprise Kubernetes Deployment (Helm Chart)

HiClaw provides a production-grade Helm Chart for deploying HiClaw on Kubernetes clusters. The Chart deploys Tuwunel (Matrix server), MinIO (object storage), Element Web (IM client), and hiclaw-controller as separate Deployments/StatefulSets, with complete Service, RBAC, and Secret resources. Key enterprise features:

  • Leader Election (high availability): The Controller supports multi-replica deployment, and Lease-based Leader Election ensures that only one instance performs coordination at a time, with automatic failover on failure.
  • Agent Pod template: Cluster-specific configuration is injected into Agent Pods through ConfigMap overlays (nodeSelector, tolerations, imagePullSecrets, annotations, sysctls) without modifying Controller code.
  • Multi-tenant support: A pluggable credential provider Sidecar (hiclaw-credential-provider) integrates with the gateway and storage backend. Per-worker accessEntries in the CRD constrain object storage paths and support tenant isolation.
  • CRD-based resource management: kubectl / hiclaw CLI can be used interchangeably — Worker, Team, Human, and Manager are all standard CRDs, support short names (wk, tm, hm, mgr), and kubectl get workers works directly.

Pluggable Gateway and Storage Providers

The Controller now delegates gateway (Higress) and storage (MinIO/OSS) operations through Provider interfaces. A new hiclaw-credential-provider Sidecar handles STS token issuance, key rotation, and per-worker access policy enforcement. It can integrate with Alibaba Cloud OSS, AWS S3, or any S3-compatible backend without changing Controller code.

Multi-container Architecture

The Manager image no longer bundles Higress, Tuwunel, MinIO, and Element Web. Infrastructure services are dedicated to the hiclaw-embedded image (the Controller container), while Manager is a lightweight pure-Agent container (reducing size by about 1.7 GB). This enables independent scaling, restart isolation, and clear separation of responsibilities.

OpenClaw 2026.4.x Upgrade & Image Slimming by 1.7 GB

The built-in OpenClaw engine has been upgraded to hiclaw-2026.4.14, bringing Matrix private-network security fixes, structured Matrix debug logs (HICLAW_MATRIX_DEBUG=1), and unified gateway Control UI ports. The openclaw-base base image has been reset from higress/all-in-one (~1.79 GB) to higress/ubuntu:24.04 (~103 MB), shrinking all downstream images (manager, worker, copaw-worker, hermes-worker) by about 1.7 GB. Key compatibility fixes include: setting gateway.bind = \"lan\" to support cross-container access, autoJoin = \"always\" to ensure Matrix rooms are joined reliably, and dangerouslyAllowPrivateNetwork = true to adapt to the FQDN-over-loopback approach for the embedded homeserver.

Time-saving Migration

When upgrading from v1.0.9, workers-registry.json data is automatically migrated into CRD resources. The Worker runtime, model, skills, MCP Server, and team member relationships are all preserved. On first startup, the Controller detects the legacy state and creates the corresponding Worker/Team CRs.

Controller Container Includes HiClaw CLI, Supporting Direct Resource Management Without Authentication

The CLI is preinstalled and automatically authenticated inside the Controller container. Administrators can directly query or manage resources with docker exec -it hiclaw-controller hiclaw get workers without going through the Manager Agent. Supports commands such as create, get, update, delete, apply, worker wake/sleep/status, status, version, and more.

Worker CRD Supports spec.state Lifecycle Management

The Worker CRD now supports spec.state: running | stopped. Setting state: stopped (or hiclaw worker sleep) gracefully stops the container while preserving all state; setting state: running (or hiclaw worker wake) restarts it. Manager uses this mechanism to implement automatic sleep when idle and wake on demand.

First-run Welcome Prompt

After a fresh installation, a welcome/onboarding message is automatically sent as a direct message to the administrator, and it works correctly even in Embedded mode. Before sending, the Controller validates both Matrix room membership and LLM authentication readiness at the same time (end-to-end probing), ensuring that Manager will not receive messages it cannot reply to. The install script waits for the welcome message to finish sending, providing a smooth first-use experience.

Installer Improvements

Interactive Hermes runtime selection, masked secret entry display, version selection, uninstall subcommand (hiclaw-install.sh uninstall), and fast failure when the embedded image is missing (no more silent fallback to the now-defunct legacy architecture path).

2. Bug Fixes

  • Fixed the Controller rotating Matrix access tokens and gateway secrets every 5-minute reconciliation cycle, which caused Agent gateway restarts and in-flight message loss. Tokens are now persisted and reused across reconciliation cycles.
  • Fixed YOLO mode failing to propagate across the Controller→Manager boundary (Embedded mode), which caused multi-Worker project creation to hang while waiting for unreachable admin confirmation.
  • Fixed hiclaw create worker / hiclaw apply worker ignoring the default model set during administrator installation (HICLAW_DEFAULT_MODEL), causing all newly created Workers to silently use qwen3.5-plus.
  • Fixed HICLAW_DEFAULT_WORKER_RUNTIME not actually taking effect — the CRD schema-level default caused the API Server to fill in spec.runtime=openclaw before the Controller saw an empty value. Removed the CRD default and introduced correct environment-variable fallback parsing.
  • Fixed CoPaw Manager DM replies blocking for more than 5 minutes after Worker creation. CoPaw now uses --no-wait + heartbeat-delayed processing to provide reliable confirmation replies.
  • Fixed Hermes Worker not joining Matrix rooms — the Controller now performs a server-side JoinRoom after creating the room, instead of relying on the runtime's automatic invite acceptance behavior.
  • Fixed hiclaw apply worker --zip ignoring the Worker runtime in manifest.json and always defaulting to openclaw.
  • Fixed the AI route allowedConsumers being cleared when the Controller restarted, causing Manager/Worker to temporarily receive 403 errors.
  • Fixed old versions of AGENTS.md / SOUL.md / HEARTBEAT.md being re-pushed by mirror during reconciliation, overwriting the correctly merged versions. These files are now excluded from the mirror and managed by their respective authoritative writers.
  • Fixed the Higress WASM plugin service not starting, which caused LLM requests to return backend 404s.
  • Fixed the OpenClaw Control UI becoming inaccessible on port 18888 after the openclaw 2026.4.x upgrade (port unification, bind-address, and browser authentication changes).
  • Fixed the restart race condition in the openclaw Matrix channel when groupAllowFrom updates and message sending occurred concurrently, such as during Worker creation.
  • Fixed matrix.autoJoin defaulting to \"off\" in openclaw 2026.4.x, which caused the Agent to remain in invite state forever and never process room events.
  • Fixed uninstall not deleting the hiclaw-controller container, which left Docker volumes occupied and preserved old state across reinstalls.
  • Fixed team Workers losing runtime information during the v1.0.9→CR migration, silently restarting as openclaw regardless of the original runtime.
  • Fixed Hermes Worker multi-Agent collaboration: outbound m.mentions.user_ids for cross-runtime messages, in-container autonomous execution via HERMES_YOLO_MODE=1, and noise suppression with MATRIX_HOME_CHANNEL=disabled.
  • Fixed Manager openclaw.json using userId=@default instead of userId=@manager, silently dropping all administrator DM messages.
  • Fixed Manager image size: rebuilt openclaw-base from higress/all-in-one:2.2.1 (~1.79 GB) on top of higress/ubuntu:24.04 (~103 MB), shrinking all downstream images by about 1.7 GB.
AI Artificial Intelligence Developers Open Source Kubernetes cloud native Generative AI Higress GenAI AI Gateway OpenClaw HiClaw Cluster Deployment Hermes Worker Hermes Agent Kubernetes Native
0 1 0
Share on

Read previous post:

Building Cross-Cloud Observability: One Architecture, Unified Analytics

Alibaba Cloud Native Community

701 posts | 57 followers

You may also like

Comments

Alibaba Cloud Native Community

701 posts | 57 followers

Related Products

More Posts by Alibaba Cloud Native Community

See All