Running ARMO/Rapid7 Node Agents on GKE Autopilot Clusters

GKE Autopilot has historically restricted workloads that require privileged permissions, such as node agents used for security observability. This made it difficult for tools like the ARMO Platform (and the Rapid7 distribution built on it) to deploy their node-level agents on Autopilot clusters.

Why It Works Now

GKE Autopilot supports a mechanism for customers to run approved privileged workloads through a feature called Workload Allowlisting. ARMO publishes Google-approved WorkloadAllowlists for its node agents, and cluster operators enable them by installing an AllowlistSynchronizer that references the allowlist path.
Learn more in the official GKE documentation:
👉 Running Autopilot Partner Workloads

Prerequisites

• GKE version: 1.32.2-gke.1652000 or later (required for the AllowlistSynchronizer resource).
• Helm chart: a version that exposes the nodeAgent.gke.allowlist values (1.27.5 or later). Use a recent chart version.

Choose your distribution

The allowlist path and name depend on which node-agent image you run. All allowlists live in ARMO's Google-managed allowlist repository (ARMO/…).

How allowlist versioning works

Each allowlist is published per Helm chart minor version, and its name encodes that minor version — e.g. chart 1.40.x → armo-private-node-agent-1.40-v2 (or armo-rapid7-node-agent-1.40-v2). A revision suffix such as -v2 is appended when an allowlist is superseded; the Verified versions table lists the exact current names. The synchronizer paths below use a wildcard (/*), so they install all approved versions for the workload; you then select the one matching your chart with the Helm flag in Step 4.

The allowlist matching your chart minor must already be approved and published. After installing the synchronizer, confirm the expected version appears in kubectl get WorkloadAllowlist (Step 3) before deploying.

Verified Helm chart versions on GKE Autopilot

The chart versions below are verified on GKE Autopilot: their matching WorkloadAllowlist is
Google-approved and published, and the node-agent has been validated running on a live Autopilot cluster
(autoscaler mode). On a verified version, the Helm chart already points nodeAgent.gke.allowlist.name at
the correct allowlist by default — you only need to enable the feature (Step 4).

Older charts: minor 1.27 has published allowlists (armo-*-node-agent-1.27) but predates several
node-agent settings; use a version listed above for GKE Autopilot.

Running a chart minor that isn't listed yet? Its allowlist may not be approved/published for
Autopilot. Confirm with kubectl get WorkloadAllowlist (Step 3); if the matching version isn't there,
use a verified chart version. New minors are added to this table once their allowlist is approved and
validated — the Helm chart release pipeline blocks a release whose node-agent would drift from an
approved allowlist, so published versions stay in sync with this list.

Step-by-Step Guide

Step 1: Install the AllowlistSynchronizer

Apply an AllowlistSynchronizer for the distribution(s) you run — in a single command, no file to save:

kubectl apply -f - <<'EOF'
apiVersion: auto.gke.io/v1
kind: AllowlistSynchronizer
metadata:
  name: kubescape-allow-list
spec:
  allowlistPaths:
  # ARMO private node-agent
  - ARMO/armo-private-node-agent/*
  # Rapid7 node-agent
  - ARMO/armo-rapid7-node-agent/*
EOF

Keep only the paths you need. A single synchronizer may list multiple paths.

Step 2: Wait for the AllowlistSynchronizer to sync (optional)

kubectl wait --for=condition=Ready allowlistsynchronizer/kubescape-allow-list --timeout=60s

Step 3: Validate the Allowlist Sync

kubectl get WorkloadAllowlist

You should see the installed allowlists, including the version that matches your Helm chart minor. For example:

$ kubectl get WorkloadAllowlist
NAME                               AGE
armo-private-node-agent-1.40-v2    37s
armo-rapid7-node-agent-1.40-v2     37s

The exact names are listed in the Verified versions
table (a revision suffix such as -v2 is appended when an allowlist is superseded — always use the name
shown here / in that table).

Step 4: Install with Helm

Enable the GKE Autopilot allowlist when you install or upgrade the chart. Recent chart versions ship the
correct allowlist name for that chart version by default (the wrapper value
kubescape-operator.nodeAgent.gke.allowlist.name), so you normally only need to enable the feature:

ARMO:

helm upgrade --install armosec armosec/armosec-kubescape-operator -n kubescape --create-namespace \
  ... <all the other settings: clusterName, account, accessKey, imagePullSecret, server> ... \
  --set kubescape-operator.nodeAgent.gke.allowlist.enabled=true

Rapid7:

helm upgrade --install rapid7 armosec/rapid7-operator -n kubescape --create-namespace \
  ... <all the other settings> ... \
  --set kubescape-operator.nodeAgent.gke.allowlist.enabled=true

Both charts wrap the public kubescape-operator, so node-agent values are nested under
kubescape-operator.

Enabling the feature adds the cloud.google.com/matching-allowlist label to the node-agent pod,
which is how GKE matches the workload to the allowlist.

Overriding the allowlist name (older charts, or to pin a specific version): set
kubescape-operator.nodeAgent.gke.allowlist.name to the exact name shown in Step 3 that matches your
chart — for example armo-private-node-agent-1.40-v2 (ARMO) or armo-rapid7-node-agent-1.40-v2
(Rapid7). The name must match an allowlist that is installed in the cluster (Step 3).

Step 5: Verify the Node Agent Pod is Running

kubectl get pods -n kubescape

Look for a pod named node-agent-* with STATUS: Running.

Using private (mirrored) images

If you mirror the node-agent image into your own registry, reference it by the SHA-256 digest that matches the public image. Each allowlist publishes the accepted digests (containerImageDigests); see Run Autopilot partner workloads — private image mirrors.

Troubleshooting

Node-agent pod/DaemonSet rejected with a GKE Warden error (Workload Mismatches Found or
does not contain all required exemptions): the workload doesn't match the allowlist it was pointed at.
Common causes:

• Wrong or missing version. The allowlist named on the pod isn't installed in the cluster. Re-check
  Step 3 (kubectl get WorkloadAllowlist) and make sure the name matches an installed allowlist for
  your chart version. If it isn't there yet, the approved allowlist may still be rolling out to your
  region (Google rolls out gradually, up to ~7 business days after approval).
• AllowlistSynchronizer not Ready. Run kubectl get allowlistsynchronizer — a SyncError
  usually means one listed path isn't published yet. Keep only paths you use.
• The node-agent genuinely changed. If you run a chart version newer than the latest approved
  allowlist, its node-agent may require settings the allowlist doesn't cover yet. Use a chart version
  whose matching allowlist is approved, or contact support.

The node-agent runs one DaemonSet per node group (the autoscaler sizes them per instance type), so you
may see several node-agent-* pods — this is expected.

🎉 You're Done!

Your GKE Autopilot cluster is now running the ARMO/Rapid7 node agents securely and in compliance with GKE's partner workload policies.