Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Prepare-se para configurar a API Gateway para o Cloud Service Mesh
Nesta página, descrevemos como instalar as definições de recursos personalizados
necessárias para o gateway no seu cluster.
Limitações
Não é possível ter uma combinação de clusters gateway config-api e istio config-api na
mesma frota.
A descoberta de serviços e o balanceamento de carga de vários clusters não são compatíveis com clusters da
API de configuração gateway.
Se um cluster for integrado usando a flag --management automatic atual,
ele começará a usar a API de configuração istio e não poderá mudar
para a API gateway.
Somente FQDNs são aceitos. Nomes curtos não são aceitos.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
NAME EXTERNAL_ID LOCATION
my-cluster 91980bb9-593c-4b36-9170-96445c9edd39 us-west1
Configurar permissões
Os comandos a seguir concedem permissão a todos os usuários autenticados,
mas é possível usar a federação de identidade da carga de trabalho para o GKE e conceder permissão apenas a contas selecionadas.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["# Prepare to setup the Gateway API for Cloud Service Mesh\n=======================================================\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page describes how to install the required custom resource definitions\nfor the gateway into your cluster.\n\nLimitations\n-----------\n\n- Having a mix of `gateway` config-api and `istio` config-api clusters in the same fleet is not supported.\n- Multi-cluster service discovery and load balancing is not supported for `gateway` config-api clusters.\n- If a cluster is onboarded using the existing `--management automatic` flag then the cluster starts using the `istio` configuration API and cannot change to `gateway` API.\n- Only FQDNs are supported. Short names are not supported.\n\nPrerequisites\n-------------\n\nAs a starting point, this guide assumes that you have already\n[created a Google Cloud project](/sdk/docs/install-sdk#before-you-begin) and\n[installed `kubectl`](/kubernetes-engine/docs/how-to/cluster-access-for-kubectl#install_kubectl).\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com, gkehub.googleapis.com, mesh.googleapis.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com, gkehub.googleapis.com, mesh.googleapis.com)\n\n\u003cbr /\u003e\n\n4. Generate a kubeconfig entry for your cluster: \n\n```\ngcloud container clusters get-credentials CLUSTER_NAME --location LOCATION --project PROJECT_ID\n```\n\nwhere:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e is the name of your cluster\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is the location of your cluster\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of your cluster\n\nCreate and register a GKE cluster\n---------------------------------\n\n1. Create a GKE cluster:\n\n gcloud container clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --enable-ip-alias \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --release-channel=regular \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --gateway-api=standard\n\n where:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e is the name of your cluster\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is the location of your cluster\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of your cluster\n2. Enable Workload Identity Federation for GKE:\n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --workload-pool=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog\n\n3. Run the GKE Metadata Server on your node:\n\n gcloud container node-pools update default-pool \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --workload-metadata=GKE_METADATA\n\n4. Register your cluster to a [fleet](/kubernetes-engine/fleet-management/docs#introducing_fleets):\n\n gcloud container hub memberships register \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --gke-cluster \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n5. Verify that the cluster is registered to the fleet:\n\n gcloud container hub memberships list --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n The output is similar to: \n\n NAME EXTERNAL_ID LOCATION\n my-cluster 91980bb9-593c-4b36-9170-96445c9edd39 us-west1\n\nSet up permissions\n------------------\n\nNote that the following commands grant permission to all authenticated users,\nbut you can use Workload Identity Federation for GKE to grant permission to only select accounts.\n\n1. Grant the `trafficdirector.client` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"group:\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog:/allAuthenticatedUsers/\" \\\n --role \"roles/trafficdirector.client\"\n\n2. Grant the `container.developer` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@container-engine-robot.iam.gserviceaccount.com\" \\\n --role \"roles/container.developer\"\n\n where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number.\n3. Grant the `compute.networkAdmin` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@container-engine-robot.iam.gserviceaccount.com\" \\\n --role \"roles/compute.networkAdmin\"\n\n where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number.\n\nEnable Cloud Service Mesh\n-------------------------\n\n1. Enable the mesh feature:\n\n gcloud container hub mesh enable --project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n2. Update the mesh to use the Gateway API:\n\n gcloud alpha container fleet mesh update \\\n --config-api gateway \\\n --memberships \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n3. Verify the update by describing the status of Cloud Service Mesh resource:\n\n gcloud alpha container fleet mesh describe\n\nInstall custom resource definitions\n-----------------------------------\n\nInstall the GRPCRoute custom resource definition (CRD): \n\n curl https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml \\\n | kubectl apply -f -\n\nThe output is similar to: \n\n customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created\n\nWhat's next\n-----------\n\n- [Set up an Envoy sidecar service mesh on GKE](/service-mesh/v1.21/docs/gateway/set-up-envoy-mesh)\n- [Set up a proxyless gRPC service mesh on GKE](/service-mesh/v1.21/docs/gateway/proxyless-grpc-mesh)"]]
