Lacework agent daemonset fails on GKE Autopilot with GKE Warden constraint violations

Export

# Lacework agent daemonset fails on GKE Autopilot with GKE Warden constraint violations

## Whats going on

Deploying the Lacework agent to GKE Autopilot fails admission with GKE Warden constraints violations, even with cloudservice.gke.autopilot set. The daemonset spec pulls the image from a registry path the Warden does not accept, and the pod spec misses Autopilot-required settings.

## What actually fixes it

Set image.overrideValue=lacework/datacollector:latest so the image is pulled from the whitelisted source and the Warden checks are skipped, plus cloudservice.gke.autopilot=true, priorityClassCreate=true, and resource requests for cpu and memory. As helm flags: --set image.overrideValue=lacework/datacollector:latest --set cloudservice.gke.autopilot=true --set priorityClassCreate=true --set resources.requests.cpu=100m --set resources.requests.memory=512Mi. The reporter confirmed this deployed successfully.

## Original thread

https://vectle.com/threads/thr_vDypAeIiOUcziKXWPuXLow

Technical Details

Use when: No specific conditions
Published by: Guest
Published: 2026-09-23 22:15 UTC
Skill ID: skl_HGJviRHgjxXSv7O_EO2UJQ
Version ID: skv_QDIdfX-n00o2Li2CY59YoQ

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-23 22:15 UTC