CNE: Compatibility Matrix

The Cloud Native Experience (CNE) bootstrap works with the command-line tool and cluster versions listed here, for AWS Ready, Azure Ready, and GCP Ready deployments.

On every provider, the CNE launcher rejects a Terraform installation older than 1.5.0. On GCP, the provider setup script also enforces 1.10.0, and on AWS and Azure, the Terraform stacks enforce it. The bootstrap checks the other tools only for presence, so an incompatible version of another tool causes an error when that tool runs, rather than when the bootstrap starts.

Shared Tools

These requirements apply to every provider, except where a row’s notes name a provider.

Tool	Compatibility	Notes
Terraform	>= 1.10.0	On GCP, the setup script enforces this version. On AWS and Azure, the Terraform stacks enforce it. On every provider, the launcher rejects a version older than 1.5.0. Terraform provisions all infrastructure. See Terraform.
OpenTofu	Not supported	The bootstrap rejects it. See OpenTofu.
kubectl CLI	Within one minor version of your cluster	The version follows the Kubernetes version skew policy. On Azure, the teardown script requires it. See kubectl.
curl	Any	The launcher requires it to download the bootstrap archive.
jq	Any	The bootstrap scripts require it to parse JSON.
tar	Any	The launcher requires it to extract the bootstrap archive.
Helm CLI	Any	On Azure, the setup and teardown scripts require it. On AWS and GCP, the bootstrap does not require it; install it to inspect or pull charts by hand.
Argo Workflows CLI	v4.1.2	The bootstrap does not require it. Match the Argo Workflows server version, and install it for backup, restore, and online activation workflows.

Terraform

AWS Ready, Azure Ready, and GCP Ready require Terraform 1.10.0 or later.

The AWS and Azure Terraform stacks declare required_version = ">=1.10.0". The GCP stacks declare >=1.5.0, but the GCP setup script enforces 1.10.0 before running them, so 1.10.0 is the effective minimum on every provider.

The error you see depends on how old your installation is. On every provider, the launcher rejects an installation below 1.5.0. Between 1.5.0 and 1.10.0, the GCP setup script rejects it:

The installed Terraform version 1.7.5 is older than 1.10.0.

The AWS and Azure setup scripts do not check the version, so on those providers, Terraform itself rejects an installation between 1.5.0 and 1.10.0 when the setup script runs the first stack.

OpenTofu

OpenTofu is not supported on any provider, at any version. The CNE bootstrap requires the terraform executable and does not treat the tofu executable as an alternative, so a stock OpenTofu installation fails the presence check:

The utility terraform is not installed.

Symlinking terraform to an OpenTofu installation does not produce a supported configuration either. The bootstrap expects the version output to identify Terraform, and it does not recognize OpenTofu’s version output.

kubectl

No provider pins a Kubernetes version, so there is no fixed kubectl floor to install against. Kubernetes supports kubectl within one minor version, older or newer, of the API server. Check your cluster’s version after provisioning it and install a kubectl within one minor version of the result.

AWS Ready

The Terraform stack that creates the EKS cluster queries the cluster versions AWS offers under standard support and provisions one of them, rather than pinning a version of its own. The available version can change as AWS adds and retires EKS versions.

Dependency	Compatibility	Notes
Kubernetes (Amazon EKS)	One version from the set AWS lists under standard support	The stack does not pin a version.
AWS CLI	Version 2	The setup script runs `aws sso login`, a command AWS CLI version 1 does not provide.
PostgreSQL (Amazon RDS)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.
OpenSearch (Amazon OpenSearch) or Elasticsearch (ECK)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.

Azure Ready

The Terraform stack that creates the AKS cluster sets no Kubernetes version and subscribes it to the stable automatic upgrade channel. Azure therefore controls which Kubernetes version the cluster runs and when the cluster upgrades. The Liferay DXP Operator chart that the bootstrap installs requires Kubernetes 1.30 or later.

Dependency	Compatibility	Notes
Kubernetes (AKS)	1.30 or later, as served by the AKS `stable` upgrade channel	The stack does not pin a version.
Azure CLI	2.90.0 or later	The setup and teardown scripts require it and check it for presence only.
PostgreSQL (Azure Database for PostgreSQL Flexible Server)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service. Unless you set a version, it defaults to version 16.
Elasticsearch (ECK)	Per the Liferay Compatibility Matrix	Elasticsearch runs inside the cluster.

GCP Ready

The Terraform stack that creates the GKE cluster subscribes it to the REGULAR release channel and sets no minimum version. Google therefore controls which Kubernetes version the cluster runs and when the cluster upgrades. For the versions the channel serves, see GKE versioning.

Dependency	Compatibility	Notes
Kubernetes (GKE)	A version supported by the GKE REGULAR release channel	The stack does not pin a version.
gcloud CLI	> 399.0.0	The bootstrap checks it for presence only, but the Connect gateway recovery path needs this version.
GKE gcloud auth plugin	Latest	Install it after the gcloud CLI to authenticate `kubectl` with GKE clusters.
PostgreSQL (Cloud SQL)	Per the Liferay Compatibility Matrix	The bootstrap provisions it as an external service.
Elasticsearch (ECK)	Per the Liferay Compatibility Matrix	Elasticsearch runs inside the cluster.

When a Terraform apply fails, the setup script restores your kubectl context through the Connect gateway, using gcloud container fleet memberships get-credentials.

The gcloud CLI releases at or below 399.0.0 assume a Connect agent on the cluster and can fail against clusters registered by newer releases. Use a gcloud CLI release later than 399.0.0, or re-register the membership with --install-connect-agent. See Using the Connect gateway.