Ctrlk
Log in|Playground
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Running the groundcover sensor on GKE Autopilot

Running the privileged groundcover sensor on GKE Autopilot requires an approved WorkloadAllowlist and Autopilot mode in the chart.

Requirements

  • A GKE Autopilot cluster on 1.32.2-gke.1652000 or later.

  • The groundcover Helm chart with Autopilot support (agent.gke.autopilot.*) in version 1.12.90+.

How it works

  1. Allowlist — Google stores groundcover's approved sensor allowlist in a managed partner repo (groundcover/sensor/*).

  2. Synchronizer — you install an AllowlistSynchronizer (a cluster-scoped CR) that pulls that allowlist into your cluster as a WorkloadAllowlist.

  3. Label — the sensor pod carries cloud.google.com/matching-allowlist, which tells Autopilot to match it against the allowlist and admit it.

Enabling agent.gke.autopilot.enabled wires up (2) and (3) for you.

Install

Add to your sensor values:

agent:
  gke:
    autopilot:
      enabled: true
      # installs an AllowlistSynchronizer pointing at groundcover's partner repo
      installAllowlistSynchronizer: true
      allowlistRepoPath: "groundcover/sensor/*"

If you already manage allowlists yourself, set installAllowlistSynchronizer: false and provide your own AllowlistSynchronizer .

Private image mirrors

If you pull the sensor images from your own private registry (not public.ecr.aws/groundcovercom or quay.io/groundcover), reference them by digest and pin your workload to that digest:

A mirror of a groundcover image keeps the same digest, and the approved allowlist lists those digests (containerImageDigests), so a digest-pinned image is admitted regardless of its registry path. If you mirror a version whose digest isn't in the allowlist yet, ask groundcover to add it.

Troubleshooting

  • Sensor pods rejected by "GKE Warden" — the WorkloadAllowlist isn't installed yet (check kubectl get workloadallowlist) or the matching label is missing. Confirm the AllowlistSynchronizer is Ready.

  • … Mismatch … in the rejection — the running sensor differs from the approved allowlist (e.g. an extra volume/mount from custom values). Autopilot prints the exact field; align your values or contact groundcover for an updated allowlist.

  • See also Google's guide: https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads

Last updated