Cloud Service Mesh dan Traffic Director kini bergabung menjadi Cloud Service Mesh. Untuk mengetahui informasi selengkapnya, lihat ringkasan Cloud Service Mesh.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menyiapkan project dan cluster sendiri
Saat Anda menginstal Cloud Service Mesh menggunakan
asmcli, Cloud Service Mesh dapat
mengonfigurasi project dan cluster untuk
Anda jika Anda menyertakan flag --enable_all atau flag pengaktifan yang lebih terperinci.
Jika Anda lebih memilih untuk melakukan penyiapan sendiri, bukan meminta asmcli melakukan perubahan, ikuti langkah-langkah di halaman ini.
Jika sudah menginstal Cloud Service Mesh versi sebelumnya, Anda tidak perlu membuat perubahan apa pun pada project atau cluster sebelum menggunakan asmcli untuk mengupgrade ke versi Cloud Service Mesh terbaru.
Secara default, asmcli tidak menginstal istio-ingressgateway. Sebaiknya
Anda men-deploy dan mengelola bidang kontrol dan gateway secara terpisah.
Cloud Service Mesh mendukung injeksi otomatis untuk deployment gateway, yang mempermudah upgrade Cloud Service Mesh. Setelah mengupgrade Cloud Service Mesh, Anda memulai ulang gateway seperti layanan untuk mengambil konfigurasi bidang kontrol baru.
Untuk mengetahui informasi selengkapnya, lihat
Menginstal dan mengupgrade gateway.
Klik menu drop-down di bagian atas halaman. Di jendela
Pilih dari yang muncul, pilih project Anda.
Project ID ditampilkan di kartu Project info pada Dasbor project.
Buat variabel lingkungan untuk kumpulan beban kerja menggunakan project ID:
export WORKLOAD_POOL=PROJECT_ID.svc.id.goog
Tetapkan peran Identity and Access Management (IAM) yang diperlukan. Jika Anda adalah
Pemilik Project, Anda memiliki semua izin yang diperlukan untuk menyelesaikan
pemasangan. Jika Anda bukan Pemilik Project, Anda memerlukan seseorang yang memiliki peran tersebut untuk memberi Anda peran IAM tertentu berikut. Dalam perintah berikut, ganti PROJECT_ID dengan project ID dari langkah sebelumnya dan GCP_EMAIL_ADDRESS dengan akun yang Anda gunakan untuk login ke Google Cloud.
ROLES=(
'roles/servicemanagement.admin' \
'roles/serviceusage.serviceUsageAdmin' \
'roles/meshconfig.admin' \
'roles/compute.admin' \
'roles/container.admin' \
'roles/resourcemanager.projectIamAdmin' \
'roles/iam.serviceAccountAdmin' \
'roles/iam.serviceAccountKeyAdmin' \
'roles/gkehub.admin')
for role in "${ROLES[@]}"
do
gcloud projects add-iam-policy-binding PROJECT_ID \
--member "user:GCP_EMAIL_ADDRESS" \
--role="$role"
done
Jika Anda menyertakan flag --enable_all atau --enable_gcp_iam_roles saat menjalankan asmcli, flag tersebut akan menetapkan peran IAM yang diperlukan untuk Anda.
Selain mesh.googleapis.com, perintah ini juga mengaktifkan API berikut:
API
Tujuan
Dapat Dinonaktifkan
meshconfig.googleapis.com
Cloud Service Mesh menggunakan Mesh Configuration API untuk meneruskan data konfigurasi dari mesh Anda ke Google Cloud. Selain itu, mengaktifkan Mesh Configuration API memungkinkan Anda mengakses halaman Cloud Service Mesh di Google Cloud konsol dan menggunakan otoritas sertifikasi Cloud Service Mesh.
Tidak
meshca.googleapis.com
Terkait dengan Certificate Authority Cloud Service Mesh yang digunakan oleh Cloud Service Mesh terkelola.
Tidak
container.googleapis.com
Diperlukan untuk membuat cluster Google Kubernetes Engine (GKE).
Lakukan inisialisasi project untuk menyiapkannya agar dapat diinstal. Di antara hal lainnya, perintah ini membuat akun layanan untuk memungkinkan komponen data plane, seperti proxy sidecar, mengakses data dan resource project Anda dengan aman.
Dalam perintah berikut, ganti FLEET_PROJECT_ID dengan project host fleet:
Perintah ini akan direspons dengan tanda kurung kurawal kosong: {}
Untuk cluster GKE di Google Cloud ,
tetapkan zona atau region default untuk Google Cloud CLI. Jika
Anda tidak menetapkan default di sini, pastikan untuk menentukan opsi --zone atau
--region dalam perintah gcloud container clusters di halaman ini.
Jika Anda memiliki cluster zona tunggal, tetapkan zona default:
gcloud config set compute/zone CLUSTER_LOCATION
Jika Anda memiliki cluster regional, tetapkan region default:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Set up your project and cluster yourself\n========================================\n\nWhen you install Cloud Service Mesh using\n[`asmcli`](/service-mesh/docs/asmcli-reference), it can\nconfigure your project and your cluster for\nyou if you include the `--enable_all` flag or the more granular\n[enablement flags](/service-mesh/docs/asmcli-reference#enablement_flags).\nIf you prefer to do the setup yourself rather than having `asmcli` make the\nchanges, follow the steps on this page.\n\nIf you already have a previous version of Cloud Service Mesh installed, you don't\nneed to make any changes to your project or cluster before using\n[`asmcli` to upgrade](/service-mesh/docs/upgrade/upgrade) to the latest\nCloud Service Mesh version.\n\nBy default, `asmcli` doesn't install the `istio-ingressgateway`. We\nrecommend that you deploy and manage the control plane and gateways separately.\nCloud Service Mesh supports auto-injection for gateway deployments, which makes\nCloud Service Mesh upgrades easier. After upgrading Cloud Service Mesh, you restart the\ngateways just like your services to pick up the new control plane configuration.\nFor more information, see\n[Installing and upgrading gateways](/service-mesh/docs/operate-and-maintain/gateways).\n| **Warning:** On upgrades, `asmcli` removes the default `istio-ingressgateway` from the `istio-system` namespace. If you need the default `istio-ingressgateway` installed with the in-cluster control plane, include the `--option legacy-default-ingressgateway` argument.\n\nBefore you begin\n----------------\n\n- Review the prerequisites and requirements ([outside Google Cloud](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/cloud-service-mesh-prerequisites), [GKE](/service-mesh/docs/../legacy/in-cluster/cloud-service-mesh-prerequisites))\n- Plan the installation ([outside Google Cloud](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/plan-install), [GKE](/service-mesh/docs/../legacy/in-cluster/plan-install)) or the [upgrade](/service-mesh/docs/unified-install/plan-upgrade)\n- Install the required tools ([outside Google Cloud](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/install-dependent-tools), [GKE](/service-mesh/docs/../legacy/in-cluster/install-dependent-tools))\n\nSet up your project\n-------------------\n\n1. Get the project ID for the project that the cluster was\n created in.\n\n ### gcloud\n\n Run the following command: \n\n gcloud projects list\n\n ### Console\n\n 1. Go to the [**Dashboard** page](https://console.cloud.google.com/home) in the\n Google Cloud console.\n\n [Go to the Dashboard page](https://console.cloud.google.com/home)\n 2. Click the drop-down list at the top of the page. In the\n **Select from** window that appears, select your project.\n\n The project ID is displayed on the project Dashboard **Project info**\n card.\n2. Create an environment variable for the workload pool using the project ID:\n\n export WORKLOAD_POOL=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog\n\n3. Set the required Identity and Access Management (IAM) roles. If you are a\n *Project Owner* , you have all the necessary permissions to complete\n the installation. If you aren't a *Project Owner* , you need someone who is\n to grant you the following specific IAM roles. In the\n following command, replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the\n project ID from the previous step and \u003cvar translate=\"no\"\u003eGCP_EMAIL_ADDRESS\u003c/var\u003e\n with the account that you use to sign in to Google Cloud.\n\n ROLES=(\n 'roles/servicemanagement.admin' \\\n 'roles/serviceusage.serviceUsageAdmin' \\\n 'roles/meshconfig.admin' \\\n 'roles/compute.admin' \\\n 'roles/container.admin' \\\n 'roles/resourcemanager.projectIamAdmin' \\\n 'roles/iam.serviceAccountAdmin' \\\n 'roles/iam.serviceAccountKeyAdmin' \\\n 'roles/gkehub.admin')\n for role in \"${ROLES[@]}\"\n do\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"user:\u003cvar translate=\"no\"\u003eGCP_EMAIL_ADDRESS\u003c/var\u003e\" \\\n --role=\"$role\"\n done\n\n If you include the `--enable_all` or `--enable_gcp_iam_roles` flag when\n you run `asmcli`, it sets the required IAM roles for you.\n4. Enable the required Google APIs:\n\n gcloud services enable \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n mesh.googleapis.com\n\n In addition to `mesh.googleapis.com`, this command also enables the\n following APIs:\n | **Note:** Some required APIs have transitive dependencies on other APIs.\n\n \u003cbr /\u003e\n\n | **Warning:** Disabling `connectgateway.googleapis.com`, `trafficdirector.googleapis.com`, `networkservices.googleapis.com`, and/or `networksecurity.googleapis.com` causes managed Cloud Service Mesh control plane to stop working. If the fleet does not use managed Cloud Service Mesh on any cluster, then these APIs can be disabled.\n\n Enabling the APIs can take a minute or more to complete. When the APIs\n are enabled, you see output similar to the following: \n\n ```\n Operation \"operations/acf.601db672-88e6-4f98-8ceb-aa3b5725533c\" finished\n successfully.\n ```\n\n If you include the `--enable_all` or `--enable_apis` flag when you run\n `asmcli`, it enables the required APIs for you.\n\nSet up your cluster\n-------------------\n\nIf you include the `--enable_all` flag, or one of the more granular\n[enablement flags](/service-mesh/docs/unified-install/reference#enablement_flags),\n`asmcli` sets up your cluster for you.\n\n1. [Register the cluster to the fleet](/anthos/fleet-management/docs/fleet-creation).\n\n2. Initialize your project to ready it for installation. Among other things,\n this command creates a service account to let data plane components, such\n as the sidecar proxy, securely access your project's data and resources.\n In the following command replace \u003cvar translate=\"no\"\u003eFLEET_PROJECT_ID\u003c/var\u003e with\n the\n [fleet host project](/anthos/multicluster-management/fleets#fleet-host-project):\n\n **Warning:** If your `FLEET_PROJECT_ID` is the same as your `PROJECT_ID`, then remove the `\"FLEET_PROJECT_ID.hub.id.goog\",` from the following command. Otherwise, you will receive an error code due to `INVALID_ARGUMENT`. \n\n curl --request POST \\\n --header \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"workloadIdentityPools\":[\"\u003cvar translate=\"no\"\u003eFLEET_PROJECT_ID\u003c/var\u003e.hub.id.goog\",\"\u003cvar translate=\"no\"\u003eFLEET_PROJECT_ID\u003c/var\u003e.svc.id.goog\",\"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog\"]}' \\\n \"https://meshconfig.googleapis.com/v1alpha1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e:initialize\"\n\n The command responds with empty curly braces: `{}`\n3. For GKE on Google Cloud clusters,\n set the default zone or region for the Google Cloud CLI. If\n you don't set the default here, be sure to specify either the `--zone` or\n `--region` option in the `gcloud container clusters` commands on this page.\n\n - If you have a single-zone cluster, set the default zone:\n\n gcloud config set compute/zone \u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e\n\n - If you have a regional cluster, set the default region:\n\n gcloud config set compute/region \u003cvar translate=\"no\"\u003eCLUSTER_LOCATION\u003c/var\u003e\n\n4. For GKE on Google Cloud clusters, enable\n [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity):\n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --workload-pool=${WORKLOAD_POOL}\n\n Enabling Workload Identity can take up to 10 to 15 minutes.\n5. For GKE on Google Cloud clusters, enable\n [Cloud Monitoring and Cloud Logging on GKE](/monitoring/kubernetes-engine):\n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --enable-stackdriver-kubernetes\n\nYour project and cluster are now ready for a new installation using `asmcli`.\n\nWhat's next\n-----------\n\n- [Install dependent tools and validate cluster outside Google Cloud](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/install-dependent-tools)\n- [Install dependent tools and validate cluster on GKE](/service-mesh/docs/../legacy/in-cluster/install-dependent-tools)"]]
