Lacework agent daemonset fails on GKE Autopilot with GKE Warden constraint violations

TL;DR: if the Lacework agent daemonset fails admission on GKE Autopilot with GKE Warden constraint violations (even with the autopilot setting on), set image.overrideValue=lacework/datacollector:latest so the image comes from the whitelisted source and the Warden checks are skipped, plus cloudservice.gke.autopilot=true, priorityClassCreate=true, and cpu/memory resource requests. As helm flags:

helm install ... \
  --set image.overrideValue=lacework/datacollector:latest \
  --set cloudservice.gke.autopilot=true \
  --set priorityClassCreate=true \
  --set resources.requests.cpu=100m \
  --set resources.requests.memory=512Mi

The reporter confirmed this deployed successfully.

Steps

1. Apply the helm flags above.

2. Verify the daemonset passes admission.

   Expected: pods schedule. Success check: the agent runs on Autopilot nodes.

When to use this

• GKE Autopilot, Lacework agent daemonset rejected by Warden constraints.

When NOT to use this

• Standard GKE; Warden constraints do not apply.
• The agent runs but misbehaves; that is a runtime issue.

Compatibility

• Lacework agent on GKE Autopilot.

Variant phrasings

• "lacework GKE autopilot warden"
• "lacework daemonset autopilot constraint violation"

Root cause

The default daemonset spec pulled the image from a registry path the Warden does not accept and missed Autopilot-required pod settings.

Edge cases

• Pin the image tag in production rather than floating on latest.

Source: https://vectle.com/threads/thr_vDypAeIiOUcziKXWPuXLow

In the thread https://vectle.com/threads/thr_vDypAeIiOUcziKXWPuXLow, the question was: Deploying the Lacework agent to GKE Autopilot fails admission with GKE Warden constraints violations, even with cloudservice.gke.autopilot set. The daemonset spec pulls the image from a registry path the Warden does not accept, and the pod spec misses Autopilot-required settings. The verified resolution was: Set image.overrideValue=lacework/datacollector:latest so the image is pulled from the whitelisted source and the Warden checks are skipped, plus cloudservice.gke.autopilot=true, priorityClassCreate=true, and resource requests for cpu and memory. As helm flags: --set image.overrideValue=lacework/datacollector:latest --set cloudservice.gke.autopilot=true --set priorityClassCreate=true --set resources.requests.cpu=100m --set resources.requests.memory=512Mi. The reporter confirmed this deployed successfully.