本页面使用 Google Distributed Cloud（Google Distributed Cloud for VMware [纯软件] 和 Google Distributed Cloud for Bare Metal [纯软件] 上支持的功能相同），以及平台之间支持的功能存在差异的特定平台。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-14。"],[],[],null,["# In-cluster control plane supported features\n===========================================\n\nThis page describes features that are supported in Cloud Service Mesh\n1.26.0 with an in-cluster control plane. To see the supported\nfeatures for Cloud Service Mesh 1.26.0 with a managed control\nplane instead, see\n[Managed control plane](/service-mesh/docs/supported-features-managed).\n\nSupported versions\n------------------\n\nSupport for Cloud Service Mesh follows the\n[GKE Enterprise Version Support Policy](/anthos/docs/support/getting-support#version_support_policy).\n\nFor **managed Cloud Service Mesh with a `TRAFFIC_DIRECTOR` control plane implementation**, Google always supports this control plane.\n\nFor **managed Cloud Service Mesh with an `ISTIOD` control plane implementation** , Google supports the current Cloud Service Mesh\nversions available in each\n[release channel](/service-mesh/legacy/anthos-service-mesh/managed-anthos-service-mesh/select-a-release-channel#anthos_service_mesh_versions_per_channel).\n\nFor **self-installed in-cluster Cloud Service Mesh**, Google supports the current and\nprevious two (n-2) minor versions of Cloud Service Mesh.\n\nThe following table shows the supported versions of **self-installed in-cluster\nCloud Service Mesh** and the earliest end-of-life (EOL) date for a version.\n\nIf you are on an unsupported version of Cloud Service Mesh, then you must upgrade to\nCloud Service Mesh 1.24 or later. For information on how to\nupgrade, see [Upgrade Cloud Service Mesh](/service-mesh/docs/upgrade).\n\nThe following table shows the unsupported versions of Cloud Service Mesh and their\nend-of-life (EOL) date.\n\nFor more information about our support policies, refer to\n[Getting support](/service-mesh/docs/getting-support#version_support_policy).\n\nPlatform differences\n--------------------\n\nThere are differences in supported features between\n[supported platforms](/service-mesh/docs/supported-platforms).\n\nThe **Other GKE Enterprise clusters** columns refer to clusters\nthat are outside of Google Cloud, for example:\n\n- Google Distributed Cloud:\n\n - Google Distributed Cloud (software only) for VMware\n - Google Distributed Cloud (software only) for bare metal\n\n This page uses Google Distributed Cloud where the same support is available on\n both Google Distributed Cloud (software only) for VMware and\n Google Distributed Cloud (software only) for bare metal, and the specific\n platform where there are differences between the platforms.\n- GKE Enterprise on other public clouds:\n\n - [GKE on AWS](/anthos/clusters/docs/multi-cloud/aws)\n - [GKE on Azure](/anthos/clusters/docs/multi-cloud/azure)\n- GKE attached clusters - Third-party Kubernetes clusters that have\n been registered to a fleet. Cloud Service Mesh is supported on the following\n cluster types:\n\n - Amazon EKS clusters\n - Microsoft AKS clusters\n\nIn the following tables:\n\n- -- indicates the feature is enabled by default.\n- \\* -- indicates the feature is supported for the platform and can be enabled, as described in [Enabling optional features](/service-mesh/docs/enable-optional-features-in-cluster) or the feature guide linked in the feature table.\n- **Compatible** -- indicates the feature or third-party tool will integrate or work with Cloud Service Mesh, but is not fully supported by Google Cloud Support and a feature guide is not available.\n- -- indicates either the feature isn't available or it isn't supported in Cloud Service Mesh 1.26.0.\n\nThe default and optional features are fully supported by Google Cloud\nSupport. Features not explicitly listed in the tables receive best-effort\nsupport.\n\nBase Images\n-----------\n\nSecurity\n--------\n\n### Certificate distribution/rotation mechanisms\n\n### Certificate authority (CA) support\n\n### Cloud Service Mesh security features\n\nIn addition to supporting Istio security features, Cloud Service Mesh provides even\nmore capabilities to help you secure your applications.\n\n### Authorization policy\n\n### Authentication policy\n\n#### Peer authentication\n\nFor information on enabling mTLS STRICT mode, see\n[Configuring transport security](/service-mesh/docs/security/configuring-mtls).\n\n#### Request authentication\n\n**Notes:**\n\n1. Third-party JWT is enabled by default.\n\nTelemetry\n---------\n\n### Metrics\n\n### Proxy request logging\n\n### Tracing\n\n| **Note:** You can configure third-party telemetry products (such as Jaeger, Zipkin, and Grafana), but we cannot guarantee future compatibility and Cloud Support cannot provide help managing them.\n\nNetworking\n----------\n\n### Destination rule\n\n### Traffic interception/redirection mechanism\n\n### Protocol support\n\nServices that are configured with Layer 7 capabilities for\nthe following protocols are not supported: WebSocket, MongoDB, Redis, Kafka,\nCassandra, RabbitMQ, Cloud SQL. You might be able to make the protocol work\nby using TCP byte stream support. If TCP byte stream cannot support the protocol\n(for example, Kafka sends a redirect address in a protocol-specific reply and\nthis redirect is incompatible with Cloud Service Mesh's routing logic), then the\nprotocol isn't supported.\n\n**Notes:**\n\n1. Although TCP is a supported protocol for networking, TCP metrics aren't collected or reported. Metrics are displayed only for HTTP services in the Google Cloud console.\n\n### Envoy deployments\n\n### CRD support\n\n### Load balancer for the Istio ingress gateway\n\nFor information on configuring load balancers, see the following:\n\n- [Setting up your load balancer for Google Distributed Cloud (software only) for VMware](/anthos/gke/docs/on-prem/how-to/setup-load-balance)\n- GKE on AWS: [Creating a load balancer](https://cloud.google.com/anthos/gke/docs/aws/how-to/loadbalancer)\n- [Expose an ingress gateway using an external load balancer](/service-mesh/docs/operate-and-maintain/external-lb-gateway)\n\n### Kubernetes Gateway API (preview)\n\nIn Cloud Service Mesh v1.20 the Kubernetes Gateway API is available as a public\npreview.\n\n| **Warning:** Microsoft AKS attached and GKE on Azure clusters require an additional step to use the Kubernetes Gateway API.\n\nIf you are using Microsoft AKS attached clusters or\nGKE on Azure clusters, you must set the following annotation\nfor the gateway resource to configure health checks over TCP: \n\n service.beta.kubernetes.io/port_80_health-probe_protocol: tcp\n\nOtherwise, HTTP traffic won't be accepted.\n\n#### Kubernetes Gateway API preview requirements\n\nThe Kubernetes Gateway API preview has the following requirements:\n\n- Use the default automated deployments behavior for Gateways.\n\n- Use the `HttpRoute` CRD for routing configurations. The `HttpRoute` must have\n a `parentRef` pointing to a Gateway.\n\n- Don't use [Istio Gateway](https://istio.io/latest/docs/reference/config/networking/gateway/#Gateway)\n CRs and\n [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Gateway) CRs\n on the same cluster.\n\n### Load balancing policies\n\nFor more information on load balancing policies, see\n[Destination Rules](https://istio.io/latest/docs/concepts/traffic-management/#destination-rules).\n\n### Data plane\n\nMulti-cluster support\n---------------------\n\nFor multi-primary deployments of GKE clusters in different\nprojects, all the clusters must be in a\n[shared Virtual Private Cloud](/vpc/docs/shared-vpc) (VPC).\n\n### Network\n\n**Notes:**\n\n- For attached clusters, only multi-cluster meshes spanning a single platform (Microsoft AKS, Amazon EKS) are supported at this time.\n\n### Deployment model\n\n**Notes on terminology:**\n\n- A primary cluster is a cluster with a control plane. A single mesh can have\n more than one primary cluster for high availability or to reduce latency.\n In the Istio 1.7 documentation, a multi-primary deployment is referred to\n as a replicated control plane.\n\n- A remote cluster is a cluster that connects to a control plane residing\n outside of the cluster. A remote cluster can connect to a control plane\n running in a primary cluster or to an external control plane.\n\n- Cloud Service Mesh uses a simplified definition of network based on general\n connectivity. Workload instances are on the same network if they are able to\n communicate directly, without a gateway.\n\nUser interface\n--------------\n\n**Note:** On-premises clusters require GKE Enterprise version 1.11 or later.\nFor more information on upgrading see\n[Upgrading Google Distributed Cloud (software only) for VMware](/anthos/clusters/docs/on-prem/latest/how-to/upgrading)\nor\n[Upgrading Google Distributed Cloud (software only) for bare metal](/anthos/clusters/docs/bare-metal/latest/how-to/upgrade)."]]
