Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[],[],null,["# Prepare to setup the Gateway API for Cloud Service Mesh\n=======================================================\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page describes how to install the required custom resource definitions\nfor the gateway into your cluster.\n\nLimitations\n-----------\n\n- Having a mix of `gateway` config-api and `istio` config-api clusters in the same fleet is not supported.\n- Multi-cluster service discovery and load balancing is not supported for `gateway` config-api clusters.\n- If a cluster is onboarded using the existing `--management automatic` flag then the cluster starts using the `istio` configuration API and cannot change to `gateway` API.\n- Only FQDNs are supported. Short names are not supported.\n\nPrerequisites\n-------------\n\nAs a starting point, this guide assumes that you have already\n[created a Google Cloud project](/sdk/docs/install-sdk#before-you-begin) and\n[installed `kubectl`](/kubernetes-engine/docs/how-to/cluster-access-for-kubectl#install_kubectl).\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com, gkehub.googleapis.com, mesh.googleapis.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com, gkehub.googleapis.com, mesh.googleapis.com)\n\n\u003cbr /\u003e\n\n4. Generate a kubeconfig entry for your cluster: \n\n```\ngcloud container clusters get-credentials CLUSTER_NAME --location LOCATION --project PROJECT_ID\n```\n\nwhere:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e is the name of your cluster\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is the location of your cluster\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of your cluster\n\nCreate and register a GKE cluster\n---------------------------------\n\n1. Create a GKE cluster:\n\n gcloud container clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --enable-ip-alias \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --release-channel=regular \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --gateway-api=standard\n\n where:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e is the name of your cluster\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is the location of your cluster\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of your cluster\n2. Enable Workload Identity Federation for GKE:\n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --workload-pool=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog\n\n3. Run the GKE Metadata Server on your node:\n\n gcloud container node-pools update default-pool \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --workload-metadata=GKE_METADATA\n\n4. Register your cluster to a [fleet](/kubernetes-engine/fleet-management/docs#introducing_fleets):\n\n gcloud container hub memberships register \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --gke-cluster \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n5. Verify that the cluster is registered to the fleet:\n\n gcloud container hub memberships list --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n The output is similar to: \n\n NAME EXTERNAL_ID LOCATION\n my-cluster 91980bb9-593c-4b36-9170-96445c9edd39 us-west1\n\nSet up permissions\n------------------\n\nNote that the following commands grant permission to all authenticated users,\nbut you can use Workload Identity Federation for GKE to grant permission to only select accounts.\n\n1. Grant the `trafficdirector.client` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"group:\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog:/allAuthenticatedUsers/\" \\\n --role \"roles/trafficdirector.client\"\n\n2. Grant the `container.developer` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@container-engine-robot.iam.gserviceaccount.com\" \\\n --role \"roles/container.developer\"\n\n where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number.\n3. Grant the `compute.networkAdmin` role:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@container-engine-robot.iam.gserviceaccount.com\" \\\n --role \"roles/compute.networkAdmin\"\n\n where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number.\n\nEnable Cloud Service Mesh\n-------------------------\n\n1. Enable the mesh feature:\n\n gcloud container hub mesh enable --project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n2. Update the mesh to use the Gateway API:\n\n gcloud alpha container fleet mesh update \\\n --config-api gateway \\\n --memberships \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n3. Verify the update by describing the status of Cloud Service Mesh resource:\n\n gcloud alpha container fleet mesh describe\n\nInstall custom resource definitions\n-----------------------------------\n\nInstall the GRPCRoute custom resource definition (CRD): \n\n curl https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml \\\n | kubectl apply -f -\n\nThe output is similar to: \n\n customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created\n\nWhat's next\n-----------\n\n- [Set up an Envoy sidecar service mesh on GKE](/service-mesh/v1.21/docs/gateway/set-up-envoy-mesh)\n- [Set up a proxyless gRPC service mesh on GKE](/service-mesh/v1.21/docs/gateway/proxyless-grpc-mesh)"]]
