Cloud Service Mesh 证书授权机构的费用包含在 Cloud Service Mesh 价格中。CA Service 不包含在 Cloud Service Mesh 基础价格中，而是单独计费。此外，CA Service 附带显式 SLA，但 Cloud Service Mesh 证书授权机构没有。
Istio CA
如果满足以下条件，我们建议您使用 Istio CA：
您的网格已使用 Istio CA，您不需要 Cloud Service Mesh 证书授权机构或 CA Service 提供的优势。
您需要自定义根 CA。
您有一些Google Cloud 外部的工作负载，其不接受Google Cloud托管式 CA 服务。
准备网关配置
Cloud Service Mesh 允许您将网关部署和管理为服务网格的一部分。网关描述了在网格边缘运行的负载均衡器，用于接收传入或传出 HTTP/TCP 连接。网关是 Envoy 代理，可让您精确控制进出网格的流量。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Plan an installation\n====================\n\n| **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis page provides information to help you plan a new installation\nof in-cluster Cloud Service Mesh for Kubernetes workloads off Google Cloud.\n| **Note:** If you need to install Cloud Service Mesh from a private or custom container registry, see [Install Cloud Service Mesh from a custom container registry](/service-mesh/docs/enable-optional-features-in-cluster#use_a_custom_overlay_for_custom_registry).\n\nCustomize the control plane\n---------------------------\n\nThe features that Cloud Service Mesh supports differ between platforms. We recommend\nthat you review the [Supported features](/service-mesh/docs/supported-features) to\nlearn which features are supported on your platform. Some features are enabled\nby default, and others you can optionally enable by creating an `IstioOperator`\noverlay file. When you run `asmcli install`, you can customize the control plane\nby specifying the [`--custom_overlay`](/service-mesh/docs/asmcli-reference)\noption with the overlay file. As a best practice, we recommend that you save\nthe overlay files in your version control system.\n\nThe\n[`asmcli` directory](https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/tree/release-1.25/asm/istio/options)\nin GitHub contains many overlay files. These files contain common customizations\nto the default configuration. You can use these files as they are, or you can\nmake additional changes to them as needed. Some of the files are required to\n[enable optional Cloud Service Mesh features](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/options/all-install-options).\nThe `anthos-service-mesh` package is downloaded when you run `asmcli` to\n[validate your project and cluster](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/install-dependent-tools#validate_project_and_cluster).\n\nWhen you install Cloud Service Mesh using `asmcli install`, you\ncan specify one or more overlay files with the `--option` or `--custom_overlay`.\nIf you don't need to make any changes to the files in the `anthos-service-mesh`\nrepository, you can use `--option`, and the script fetches the file from GitHub\nfor you. Otherwise, you can make changes to the overlay file, and then use the\n`--custom_overlay` option to pass it to the `asmcli`.\n\nChoose a Certificate Authority\n------------------------------\n\nDepending on your use case and platform, you can choose one of the following as\nthe certificate authority (CA) for issuing\n[mutual TLS (mTLS)](/service-mesh/docs/security/security-overview#mutual_tls)\ncertificates:\n\n- [Cloud Service Mesh certificate authority](/service-mesh/docs/security/security-overview#features)\n- [Certificate Authority Service](/certificate-authority-service/docs)\n- [Istio CA](https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/)\n\nThis section provides high-level information about each of these CA options and\ntheir use cases.\n\n### Mesh CA\n\nUnless you require a custom CA, we recommend that you use\nCloud Service Mesh certificate authority for the following reasons:\n\n- Cloud Service Mesh certificate authority is a highly reliable and scalable service that is optimized for dynamically scaled workloads.\n- With Cloud Service Mesh certificate authority, Google manages the security and availability of the CA backend.\n- Cloud Service Mesh certificate authority lets you rely on a single root of trust across clusters.\n\nCertificates from Cloud Service Mesh certificate authority include the following data about\nyour application's services:\n\n- The Google Cloud project ID\n- The GKE namespace\n- The GKE service account name\n\n| **Important:** The certificates issued by Cloud Service Mesh certificate authority should only be used to enable secure service-to-service communication within your service mesh, and not be used for any other purpose. These certificates are sent whenever services attempt to communicate with each other using mutual TLS. Make sure that you don't inadvertently expose confidential information by using these certificates when communicating outside your service mesh.\n\n### CA Service\n\n\n| **Platform note:** CA Service is only supported on the following platforms: GKE clusters on Google Cloud, Google Distributed Cloud (software only) for VMware, and Distributed Cloud. If you run `asmcli install` and specify `--ca gcp_cas` on other platforms, the installation appears successful, but your workloads will fail to start.\n\n\u003cbr /\u003e\n\nIn addition to [Cloud Service Mesh certificate authority](/service-mesh/docs/security/security-overview#features),\nyou can configure Cloud Service Mesh to use\n[Certificate Authority Service](/certificate-authority-service/docs). This\nguide provides you an opportunity to integrate with CA Service,\nwhich is recommended for the following use cases:\n\n- If you need different certificate authorities to sign workload certificates on different clusters.\n- If you need to back your signing keys in a [Cloud HSM](/kms/docs/hsm).\n- If you are in a highly regulated industry and are subject to compliance.\n- If you want to chain up your Cloud Service Mesh CA to a custom enterprise root certificate to sign workload certificates.\n\nThe cost of Cloud Service Mesh certificate authority is included in the\n[Cloud Service Mesh pricing](/service-mesh/pricing). The\nCA Service isn't included in the base Cloud Service Mesh price and is\n[charged separately](/certificate-authority-service/pricing). Additionally,\nCA Service comes with an\n[explicit SLA](/certificate-authority-service/sla), but the Cloud Service Mesh certificate authority does not.\n\n### Istio CA\n\nWe recommend that you use Istio CA if you meet the following criteria:\n\n- Your mesh already uses Istio CA and you do not require the benefits enabled by Cloud Service Mesh certificate authority or CA Service.\n- You require a custom root CA.\n- You have off-Google Cloud workloads where a Google Cloud-managed CA service is not acceptable.\n\nPrepare gateway configuration\n-----------------------------\n\nCloud Service Mesh gives you the option to deploy and manage gateways as part of your\nservice mesh. A gateway describes a load balancer operating at the edge of the\nmesh receiving incoming or outgoing HTTP/TCP connections. Gateways are Envoy\nproxies that provide you with fine-grained control over traffic entering and\nleaving the mesh.\n\n`asmcli` doesn't install the `istio-ingressgateway`. We recommend that you\ndeploy and manage the control plane and gateways separately. For more\ninformation, see [Installing and upgrading gateways](/service-mesh/docs/operate-and-maintain/gateways).\n\nWhat's next?\n------------\n\n- [Install dependent tools and validate cluster](/service-mesh/docs/onboarding/kubernetes-off-gcp/install/install-dependent-tools)"]]
