Skip to main content

Google Kubernetes Engine (GKE)

Overview​

Google Kubernetes Engine is fully supported by OpsWorker. The standard Helm installation works on GKE clusters without GKE-specific configuration.

Setup​

Follow the standard agent installation process.

GKE-Specific Notes​

Networking​

  • Firewall rules: Ensure outbound HTTPS (port 443) to *.amazonaws.com is allowed. The OpsWorker backend runs on AWS, so the agent needs to reach AWS SQS endpoints from your GKE cluster.
  • Cloud NAT: If nodes are in private subnets, ensure Cloud NAT is configured for outbound internet access.
  • VPC Service Controls: If using VPC-SC, add AWS SQS endpoints to the egress policy.

Workload Identity​

  • Not required: The agent uses a cluster token for authentication. Workload Identity configuration is not needed.

Cluster Modes​

ModeSupport
GKE StandardFully supported
GKE AutopilotSupported (Autopilot may enforce resource constraints; ensure the agent's resource requests meet Autopilot minimums)

Autopilot Considerations​

GKE Autopilot enforces minimum resource requests. The portal generates the install command for you (the cluster token and API key are auto-filled). If the agent pod isn't scheduling, add the resource requests to that command. The OpsWorker agent ships as an OCI chart, so no helm repo add is needed:

helm install opsworker-agent oci://public.ecr.aws/k1v3l8a8/opsworker-agent \
  --version=v0.9.3 \
  --namespace opsworker-agent --create-namespace \
  --set clusterToken=<auto-filled-by-portal> \
  --set apiKey=<auto-filled-by-portal> \
  --set resources.requests.cpu=250m \
  --set resources.requests.memory=512Mi \
  --timeout=90s

Next Steps​