Installing on GKE Autopilot Private Cluster

[raghu-manne]

I am installing sealed secrets on GKE Autopilot Private Cluster; i am installing the controller on the different namespace than the kube-system. Controller seems working fine and able to unseal and create k8s secrets.

But my concern is, here it is mentioned some firewall rules needs to be created to get it working. I have tested without creating firewalls and the controller is working as expected.
Is there something that would break if i don't create firewall rules?

[mg1986jp]

GKE Autopilot private clusters have a few restrictions that can trip up sealed-secrets:

1. The controller needs outbound access to the Kubernetes API server. In a private cluster, make sure the control plane authorized networks allow the controller's pod IP range.

2. Autopilot has CPU/memory requirements for pods. If the controller is getting evicted or failing to schedule, try setting resource requests/limits in the Helm values:

resources:
  requests:
    cpu: 250m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi

3. If you're installing in a different namespace (not kube-system), you might need the controller to have the right RBAC to create Secrets across namespaces. The default Helm chart handles this, but double-check that the ClusterRole and ClusterRoleBinding were created.

4. Private clusters might block the controller from fetching its own certificate if there's a webhook involved. Check if the controller pod starts successfully with kubectl logs -n <namespace> -l app.kubernetes.io/name=sealed-secrets.

What specific error are you seeing?