托管式 Cloud Service Mesh 由托管式控制平面和托管式数据平面组成。借助托管式 Cloud Service Mesh，Google 能够代您处理升级、扩缩和安全性，以让您最大限度地减少用户手动维护工作。启用代管式数据平面后，Google 会安装一个集群内控制器，该控制器可代您管理边车代理。
下图显示了托管式 Cloud Service Mesh 的 Cloud Service Mesh 组件和功能：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# About Cloud Service Mesh\n========================\n\nCloud Service Mesh is a suite of tools that helps you monitor and manage a reliable\nservice mesh on-premises or on Google Cloud.\n\nWhat is a service mesh?\n-----------------------\n\nA service mesh is an architecture that enables managed, observable, and secure\ncommunication across your services, letting you create robust enterprise\napplications made up of many microservices on your chosen infrastructure.\nService meshes factor out all the common concerns of running a service such as\nmonitoring, networking, and security, with consistent, powerful tools, making it\neasier for service developers and operators to focus on creating and managing\ngreat applications for their users.\n\nCloud Service Mesh is powered by [Istio](https://istio.io),\na highly configurable and powerful open source service mesh platform, with\ntools and features that enable industry best practices. Cloud Service Mesh is\ndeployed as a uniform layer across your entire infrastructure. Service\ndevelopers and operators can use its rich feature set without making changes to\napplication code.\n\nArchitecturally, a service mesh consists of one or more control planes and a\ndata plane. The service mesh monitors all traffic through a proxy. On Kubernetes,\nthe proxy is deployed by a\n[sidecar pattern](https://kubernetes.io/blog/2015/06/the-distributed-system-toolkit-patterns/#example-1-sidecar-containers)\nto the microservices in the mesh. This pattern decouples application or business\nlogic from network functions, and enables developers to focus on the features\nthat the business needs. Service meshes also let operations teams and\ndevelopment teams decouple their work from one another.\n\nHow can Cloud Service Mesh help me?\n-----------------------------------\n\nWith Cloud Service Mesh, you get an GKE Enterprise tested and supported\ndistribution of Istio, letting you create and deploy a service mesh on\nGKE on Google Cloud and other\n[platforms](/service-mesh/v1.19/docs/supported-platforms)\nwith full Google support.\n\nFeatures\n--------\n\nCloud Service Mesh has a suite of features and tools that help you observe and\nmanage secure, reliable services in a unified way.\n| **Note:** Some features, such as Cloud Service Mesh certificate authority and the Cloud Service Mesh dashboards in the Google Cloud console aren't available on all GKE Enterprise environments. To learn about the service mesh features supported on each environment, see [In-cluster control plane supported features](/service-mesh/v1.19/docs/supported-features).\n\n### Traffic management\n\nCloud Service Mesh controls the flow of traffic between services, into the mesh\n(ingress), and to outside services (egress). You configure and deploy\n[Istio-compatible custom resources](https://istio.io/v1.19/docs/concepts/traffic-management/)\nto manage this traffic at the application (L7) layer. For example, with the\ncustom resources, you can:\n\n- Create [canary](https://martinfowler.com/bliki/CanaryRelease.html) and [blue-green](https://martinfowler.com/bliki/BlueGreenDeployment.html) deployments.\n- Provide fine-grained control over specific routes for services.\n- Configure [load balancing](/service-mesh/v1.19/docs/supported-features#load_balancing_policies) between services.\n- Set up [circuit breakers](https://martinfowler.com/bliki/CircuitBreaker.html).\n\nCloud Service Mesh maintains a service registry of all services in the mesh by\nname and by their respective endpoints. It maintains the registry to manage the\nflow of traffic (for example, Kubernetes Pod IP addresses). By using this\nservice registry, and by running the proxies side-by-side with the services, the\nmesh can direct traffic to the appropriate endpoint.\n\n### Observability insights\n\nThe Cloud Service Mesh pages in the Google Cloud console provide the following\ninsights into your service mesh:\n\n- Service metrics and logs for HTTP traffic within your mesh's\n GKE cluster are automatically ingested to Google Cloud.\n\n- Preconfigured service dashboards give you the information you need to understand\n your services.\n\n- In-depth telemetry---powered by [Cloud Monitoring](/monitoring/docs),\n [Cloud Logging](/logging/docs), and [Cloud Trace](/trace/docs)---lets you\n dig deep into your service metrics and logs. You can filter and slice your\n data on a wide variety of attributes.\n\n- Service-to-service relationships at a glance help you understand who connects to\n each service and the services that each service depends on.\n\n- You can quickly see the communication security posture not only of your service,\n but its relationships to other services.\n\n- Service level objectives (SLOs) give you insight into the health of your\n services. You can easily define an SLO and alert on your own standards of\n service health.\n\nLearn more about Cloud Service Mesh's observability features in our\n[Observability guide](/service-mesh/v1.19/docs/observability-overview).\n\n### Security benefits\n\n- Mitigates risk of replay or impersonation attacks that use stolen credentials.\n Cloud Service Mesh relies on mutual TLS (mTLS) certificates to authenticate\n peers, rather than bearer tokens such as\n [JSON Web Tokens](https://jwt.io/introduction/) (JWT).\n\n- Ensures encryption in transit. Using mTLS for authentication also ensures that\n all TCP communications are encrypted in transit.\n\n- Ensures that only authorized clients can access a service with sensitive data,\n irrespective of the network location of the client and the application-level\n credentials.\n\n- Mitigates the risk of user data breach within your production network.\n You can ensure that insiders can only access sensitive data through\n authorized clients.\n\n- Identifies which clients accessed a service with sensitive data.\n Cloud Service Mesh access logging captures the mTLS identity of the client in\n addition to the IP address.\n\n- All in-cluster control plane components and proxies use\n [FIPS 140-2 validated](/security/compliance/fips-140-2-validated) encryption\n modules.\n\nLearn more about Cloud Service Mesh's security benefits and features in our\n[Security guide](/service-mesh/v1.19/docs/security/security-overview).\n\nDeployment options\n------------------\n\nYou have the following deployment options in Cloud Service Mesh:\n\n- Managed Cloud Service Mesh\n- In-cluster control plane\n\n### Managed Anthos Service Mesh\n\nManaged Cloud Service Mesh consists of the managed control plane and the managed data\nplane. With managed Cloud Service Mesh, Google handles upgrades, scaling, and\nsecurity for you, minimizing manual user maintenance. With the\nmanaged data plane enabled, Google installs an in-cluster controller that manages\nthe sidecar proxies for you.\n\nThe following diagram shows the Cloud Service Mesh components and features for\nmanaged Cloud Service Mesh:\n\nFor information on setting up or migrating\nto a managed Cloud Service Mesh, see\n[Provision managed Cloud Service Mesh](/service-mesh/v1.19/docs/managed/provision-managed-anthos-service-mesh).\n\n### In-cluster control plane\n\nThe following diagram shows the Cloud Service Mesh components and features\nfor the in-cluster control plane and sidecar proxies.\n\nFor information on installing an in-cluster Cloud Service Mesh, see\n[Install Cloud Service Mesh](/service-mesh/v1.19/docs/unified-install/install-anthos-service-mesh).\n\nWhat's next?\n------------\n\n- [Install Cloud Service Mesh](/service-mesh/v1.19/docs/unified-install/asmcli-overview)\n- [Configure transport security](/service-mesh/v1.19/docs/security/configuring-mtls)"]]
