Cloud Service Mesh dan Traffic Director kini bergabung menjadi Cloud Service Mesh. Untuk mengetahui informasi selengkapnya, lihat ringkasan Cloud Service Mesh.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Prasyarat Cloud Service Mesh dalam cluster
Halaman ini menjelaskan prasyarat dan persyaratan untuk menginstal Cloud Service Mesh dalam cluster di GKE, seperti pemberian lisensi GKE Enterprise, persyaratan cluster, persyaratan fleet, dan persyaratan umum.
Cloud Service Mesh tersedia dengan GKE Enterprise atau sebagai layanan mandiri.
Google API digunakan untuk menentukan cara penagihan kepada Anda. Untuk menggunakan Cloud Service Mesh sebagai layanan mandiri, jangan aktifkan GKE Enterprise API di project Anda.
asmcli mengaktifkan semua Google API lain yang diperlukan untuk Anda. Untuk mengetahui informasi tentang harga Cloud Service Mesh, lihat Harga.
Pelanggan GKE Enterprise, pastikan untuk mengaktifkan GKE Enterprise API.
Jika bukan pelanggan GKE Enterprise, Anda tetap dapat menginstal Cloud Service Mesh, tetapi elemen dan fitur UI tertentu di konsol Google Cloud hanya tersedia untuk pelanggan GKE Enterprise. Untuk mengetahui informasi tentang
fitur yang tersedia bagi pelanggan dan non-pelanggan, lihat
Perbedaan UI GKE Enterprise dan Cloud Service Mesh.
Jika Anda mengaktifkan GKE Enterprise API, tetapi ingin menggunakan Cloud Service Mesh sebagai layanan mandiri, nonaktifkan GKE Enterprise API.
Persyaratan umum
Agar dapat disertakan dalam mesh layanan, port layanan harus diberi nama, dan namanya
harus menyertakan protokol port dalam sintaksis berikut:
name: protocol[-suffix]
dengan tanda kurung siku menunjukkan akhiran opsional yang harus dimulai dengan
tanda hubung. Untuk informasi selengkapnya, lihat
Penamaan port layanan.
Jenis mesin yang memiliki minimal 4 vCPU, seperti e2-standard-4.
Jika jenis mesin untuk cluster Anda tidak memiliki setidaknya 4 vCPU, ubah jenis mesin seperti yang dijelaskan dalam Memigrasikan workload ke jenis mesin yang berbeda.
Jumlah minimum node bergantung pada jenis mesin Anda. Cloud Service Mesh
memerlukan minimal 8 vCPU. Jika jenis mesin memiliki 4 vCPU, cluster Anda harus memiliki setidaknya 2 node. Jika jenis mesin memiliki 8 vCPU,
cluster hanya memerlukan 1 node. Jika Anda perlu menambahkan node, lihat Mengubah ukuran cluster.
Workload Identity GKE diperlukan. Sebaiknya aktifkan Workload Identity sebelum menginstal Cloud Service Mesh. Mengaktifkan Workload Identity akan mengubah cara
panggilan dari workload Anda ke Google API diamankan, seperti yang dijelaskan dalam
Batasan Workload Identity.
Perhatikan bahwa Anda tidak perlu mengaktifkan
Server Metadata GKE
di node pool yang ada.
Opsional, tetapi direkomendasikan, daftarkan cluster di
saluran rilis.
Sebaiknya daftarkan cluster Anda ke saluran rilis Reguler karena saluran
lain mungkin didasarkan pada versi GKE yang tidak didukung
dengan Cloud Service Mesh 1.26.0. Untuk mengetahui informasi selengkapnya, lihat
Platform yang didukung.
Ikuti petunjuk dalam artikel Mendaftarkan cluster yang ada di saluran rilis jika Anda memiliki versi GKE statis.
Jika menginstal Cloud Service Mesh di cluster pribadi, Anda harus membuka port
15017 di firewall agar webhook yang digunakan untuk
injeksi sidecar otomatis dan validasi
konfigurasi berfungsi. Untuk mengetahui informasi selengkapnya, lihat
Membuka port di cluster pribadi.
Pastikan komputer klien tempat Anda menginstal Cloud Service Mesh memiliki
konektivitas jaringan ke server API.
Untuk beban kerja Windows Server, Cloud Service Mesh tidak didukung. Jika
cluster Anda memiliki node pool Linux dan Windows Server, Anda masih dapat menginstal
Cloud Service Mesh dan menggunakannya pada workload Linux.
Semua cluster harus terdaftar ke fleet, dan fleet workload identity harus diaktifkan. Anda dapat
menyiapkan cluster
sendiri, atau Anda dapat mengizinkan asmcli mendaftarkan cluster selama cluster tersebut
memenuhi persyaratan berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# In-cluster Cloud Service Mesh prerequisites\n===========================================\n\n| **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis page describes the prerequisites and the requirements for installing\nin-cluster Cloud Service Mesh on GKE, such\nas GKE Enterprise licensing, cluster requirements, fleet requirements, and\ngeneral requirements.\n\nCloud project\n-------------\n\nBefore you begin:\n\n- [Select or create a Google Cloud project](https://console.cloud.google.com/projectselector2).\n\n- [Verify that billing is enabled](https://cloud.google.com/billing/docs/how-to/modify-project) for your project.\n\nGKE Enterprise licensing\n------------------------\n\nCloud Service Mesh is available with GKE Enterprise or as a standalone service.\nGoogle APIs are used to determine how you are billed. To use Cloud Service Mesh as\na standalone service, don't enable the GKE Enterprise API in your project.\nThe `asmcli` enables all of the other required Google APIs for you. For\ninformation about Cloud Service Mesh pricing, see [Pricing](/service-mesh/pricing).\n\n- GKE Enterprise subscribers, be sure to enable the GKE Enterprise API.\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=anthos.googleapis.com)\n- If you aren't a GKE Enterprise subscriber, you can still install\n Cloud Service Mesh, but certain UI elements and features in Google Cloud console are\n only available to GKE Enterprise subscribers. For information about\n what is available to subscribers and non-subscribers, see\n [GKE Enterprise and Cloud Service Mesh UI differences](/service-mesh/docs/ui-differences).\n\n- If you enabled the GKE Enterprise API, but you want to use Cloud Service Mesh as\n a standalone service,\n [disable the GKE Enterprise API](/service-usage/docs/enable-disable).\n\nGeneral requirements\n--------------------\n\n- To be included in the service mesh, service ports must be named, and the name\n must include the port's protocol in the following syntax:\n `name: `\u003cvar translate=\"no\"\u003eprotocol\u003c/var\u003e`[-`\u003cvar translate=\"no\"\u003esuffix\u003c/var\u003e`]`\n where the square brackets indicate an optional suffix that must start with a\n dash. For more information, see\n [Naming service ports](/service-mesh/docs/naming-service-ports).\n\n- If you have created a [service perimeter](/vpc-service-controls/docs/service-perimeters)\n in your organization, you might need to add the Cloud Service Mesh certificate authority service\n to the perimeter. See\n [Adding Cloud Service Mesh certificate authority to a service perimeter](/service-mesh/docs/operate-and-maintain/set-service-perimeter)\n for more information.\n\n- If you want to change the default [resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits)\n for the `istio-proxy` sidecar container, the new values must be greater than the\n default values to\n [avoid out-of-memory (OOM) events](/service-mesh/docs/troubleshooting/troubleshoot-sidecar-proxies).\n\n-\n A Google Cloud project can only have one mesh associated with it.\n\nCluster requirements\n--------------------\n\n- Verify that your cluster version is listed in\n [Supported platforms](/service-mesh/docs/supported-platforms).\n\n- Your GKE cluster must meet the following requirements:\n\n - The GKE cluster must be Standard. Autopilot clusters are\n only supported with [managed Cloud Service Mesh](/service-mesh/docs/managed/provision-managed-anthos-service-mesh).\n\n - A machine type that has at least 4 vCPUs, such as `e2-standard-4`.\n If the machine type for your cluster doesn't have at\n least 4 vCPUs, change the machine type as described in\n [Migrating workloads to different machine types](/kubernetes-engine/docs/tutorials/migrating-node-pool).\n\n - The minimum number of nodes depends on your machine type. Cloud Service Mesh\n requires at least 8 vCPUs. If the machine type has 4 vCPUs, your\n cluster must have at least 2 nodes. If the machine type has 8 vCPUs,\n the cluster only needs 1 node. If you need to add nodes, see\n [Resizing a cluster](/kubernetes-engine/docs/how-to/resizing-a-cluster).\n\n- GKE Workload Identity is required. We recommend that you\n enable [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity)\n before installing Cloud Service Mesh. Enabling Workload Identity changes the way\n calls from your workloads to Google APIs are secured, as described in\n [Workload Identity limitations](/kubernetes-engine/docs/how-to/workload-identity#limitations).\n Note that you do not need to enable the\n [GKE Metadata Server](/kubernetes-engine/docs/concepts/workload-identity#metadata_server)\n on [existing node pools](/kubernetes-engine/docs/how-to/workload-identity#migrate_applications_to).\n\n- Optional but recommended, enroll the cluster in a\n [release channel](/kubernetes-engine/docs/concepts/release-channels).\n\n We recommend that you enroll in the Regular release channel because other\n channels might be based on a GKE version that isn't supported\n with Cloud Service Mesh 1.26.0. For more information, see\n [Supported platforms](/service-mesh/docs/supported-platforms).\n Follow the instructions in\n [Enrolling an existing cluster in a release channel](/kubernetes-engine/docs/concepts/release-channels#enrolling_an_existing_cluster_in_a_release_channel)\n if you have a static GKE version.\n\n- If you are installing Cloud Service Mesh on a private cluster, you must open port\n 15017 in the firewall to get the webhooks used for\n [automatic sidecar injection](/service-mesh/docs/anthos-service-mesh-proxy-injection) and configuration\n validation to work. For more information, see\n [Opening a port on a private cluster](/service-mesh/docs/private-cluster-open-port).\n\n- Ensure that the client machine that you install Cloud Service Mesh from has\n network connectivity to the API server.\n\n- For Windows Server workloads, Cloud Service Mesh is not supported. If your\n cluster has both Linux and Windows Server node pools, you can still install\n Cloud Service Mesh and use it on your Linux workloads.\n\n - After provisioning Cloud Service Mesh, you must [contact support](/service-mesh/docs/getting-support) before initiating [IP rotation](/kubernetes-engine/docs/how-to/ip-rotation) or [certificate credential rotation](/kubernetes-engine/docs/how-to/credential-rotation).\n\nFleet requirements\n------------------\n\nAll clusters must be registered to a\n[fleet](/anthos/multicluster-management/fleets), and\n[fleet workload identity](/anthos/multicluster-management/fleets/workload-identity)\nmust be enabled. You can either\n[setup up the clusters](/anthos/multicluster-management/fleets/workload-identity#cluster_setup)\nyourself, or you can let `asmcli` register the clusters as long as they\nmeet the following requirements:\n| **Caution:** All Cloud Service Mesh clusters for one mesh must be registered to the same fleet at all times to use Cloud Service Mesh. Other clusters in the project of a Cloud Service Mesh cluster must not be registered to a different fleet.\n\n- **GKE** : *(applies to in-cluster and managed Cloud Service Mesh)* [Enable GKE Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) on your Google Kubernetes Engine cluster, if it is not already enabled. Additionally, you must [register the cluster using fleet Workload Identity](/anthos/fleet-management/docs/fleet-creation).\n\nWhen you run `asmcli install`, you specify the project ID\nof the\n[fleet host project](/anthos/multicluster-management/fleets#fleet-host-project).\n`asmcli` registers the cluster if it isn't already registered.\n| **Note:** If you have not registered a cluster from a project to a fleet hosted in a different project before, there are extra steps required to configure fleet permissions. For detailed instructions, see [Grant permissions for registering a cluster into a different project](/anthos/fleet-management/docs/before-you-begin#gke-cross-project).\n\nWhat's next?\n------------\n\n- [Plan a new installation](/service-mesh/legacy/in-cluster/plan-install)\n- [Plan an upgrade](/service-mesh/docs/upgrade/plan-upgrade)"]]
