CNE: Compatibility Matrix

The Cloud Native Experience (CNE) bootstrap works with the command-line tool and cluster versions listed here, for AWS Ready and GCP Ready deployments.

The CNE bootstrap verifies the Terraform version but checks the other tools only for presence. An incompatible version of another tool causes an error when that tool runs, rather than when the bootstrap starts.

Shared Tools

These requirements are the same on AWS and GCP.

Tool	Compatibility	Notes
Terraform	>= 1.10.0	This is the only version the bootstrap enforces. Terraform provisions all infrastructure.
OpenTofu	Not supported	The bootstrap rejects it. See OpenTofu.
kubectl CLI	Within one minor version of your cluster	The version follows the Kubernetes version skew policy. See kubectl.
curl	Any	The launcher requires it to download the bootstrap archive.
jq	Any	The bootstrap scripts require it to parse JSON.
tar	Any	The launcher requires it to extract the bootstrap archive.
Helm CLI	Any	The bootstrap does not require it. Install it to inspect or pull charts by hand.
Argo Workflows CLI	v4.1.2	The bootstrap does not require it. Match the Argo Workflows server version, and install it for backup, restore, and online activation workflows.

Terraform

AWS Ready and GCP Ready require Terraform 1.10.0 or later.

The AWS Terraform stacks declare required_version = ">=1.10.0". The GCP stacks declare >=1.5.0, but the GCP setup script enforces 1.10.0 before running them, so 1.10.0 is the effective minimum for both deployments.

The CNE bootstrap checks the version twice, so the error you see depends on how old your installation is. The launcher rejects an installation below 1.5.0, and the provider setup script rejects one between 1.5.0 and 1.10.0:

The installed Terraform version 1.7.5 is older than 1.10.0.

OpenTofu

OpenTofu is not supported on either cloud, at any version. The CNE bootstrap requires the terraform executable and does not treat the tofu executable as an alternative, so a stock OpenTofu installation fails the presence check:

The utility terraform is not installed.

Symlinking terraform to an OpenTofu installation does not produce a supported configuration either. The bootstrap expects the version output to identify Terraform, and it does not recognize OpenTofu’s version output.

kubectl

Neither AWS Ready nor GCP Ready pins a Kubernetes version, so there is no fixed kubectl floor to install against. Kubernetes supports kubectl within one minor version, older or newer, of the API server. Check your cluster’s version after provisioning it and install a kubectl within one minor version of the result.

AWS Ready

The EKS stack queries the cluster versions AWS offers under standard support and provisions one of them, rather than pinning a version of its own. The available version can change as AWS adds and retires EKS versions.

Dependency	Compatibility	Notes
Kubernetes (Amazon EKS)	One version from the set AWS lists under standard support	The stack does not pin a version.
AWS CLI	Version 2	The setup script runs `aws sso login`, a command AWS CLI version 1 does not provide.
PostgreSQL (Amazon RDS)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.
OpenSearch (Amazon OpenSearch) or Elasticsearch (ECK)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.

GCP Ready

The GKE stack subscribes the cluster to the REGULAR release channel and sets no minimum version. Google therefore controls which Kubernetes version the cluster runs and when the cluster upgrades. For the versions the channel serves, see GKE versioning.

Dependency	Compatibility	Notes
Kubernetes (GKE)	A version supported by the GKE REGULAR release channel	The stack does not pin a version.
gcloud CLI	> 399.0.0	The bootstrap checks it for presence only, but the Connect gateway recovery path needs this version.
GKE gcloud auth plugin	Latest	Install it after the gcloud CLI to authenticate `kubectl` with GKE clusters.
PostgreSQL (Cloud SQL)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.
Elasticsearch (ECK)	Per the Liferay Compatibility Matrix	Elasticsearch runs on-cluster.

When a Terraform apply fails, the setup script restores your kubectl context through the Connect gateway, using gcloud container fleet memberships get-credentials.

The gcloud CLI releases at or below 399.0.0 assume a Connect agent on the cluster and can fail against clusters registered by newer releases. Use a gcloud CLI release later than 399.0.0, or re-register the membership with --install-connect-agent. See Using the Connect gateway.