Skip to main content

Self-Hosted Kubernetes

Overview​

OpsWorker supports any CNCF-conformant Kubernetes distribution, version 1.24 or later.

Setup​

Follow the standard agent installation process.

Supported Distributions​

DistributionSupport
kubeadmFully supported
k3sFully supported
Rancher (RKE/RKE2)Fully supported
OpenShiftSupported (see notes below)
Tanzu (TKG)Fully supported
MicroK8sFully supported

Network Requirements​

The agent requires outbound HTTPS (port 443) to AWS SQS:

  • sqs.*.amazonaws.com
  • *.amazonaws.com

Ensure your firewall, proxy, or network policies allow this traffic.

Proxy Configuration​

The chart has no dedicated proxy values. If outbound traffic goes through a proxy, set the standard HTTPS_PROXY and NO_PROXY environment variables on the agent container via the chart's env list. The agent ships as an OCI chart (no helm repo add needed), and the cluster token and API key are auto-filled by the portal:

helm install opsworker-agent oci://public.ecr.aws/k1v3l8a8/opsworker-agent \
  --version=v0.9.3 \
  --namespace opsworker-agent --create-namespace \
  --set clusterToken=<auto-filled-by-portal> \
  --set apiKey=<auto-filled-by-portal> \
  --set-string env[0].name=HTTPS_PROXY \
  --set-string env[0].value=http://proxy.internal:3128 \
  --set-string env[1].name=NO_PROXY \
  --set-string env[1].value=10.0.0.0/8\,172.16.0.0/12\,.cluster.local \
  --timeout=90s

OpenShift Notes​

OpenShift may require SecurityContextConstraints (SCC) adjustments:

oc adm policy add-scc-to-user anyuid \
  system:serviceaccount:opsworker-agent:opsworker-agent

Or create a custom SCC for the agent based on the restricted SCC with necessary permissions.

Air-Gapped Environments​

OpsWorker requires connectivity to AWS SQS for agent communication. Fully air-gapped environments (no internet access) are not currently supported. If you have a partial air gap with outbound proxy, configure the proxy settings as shown above.

Next Steps​