About the asmcli

Theasmcli is a Google-provided tool that you can use to install orupgrade Cloud Service Mesh. If you let it,asmcli will configure yourproject and cluster as follows:

• Grant you the required Identity and Access Management (IAM) permissions on yourGoogle Cloud project.
• Enable the required Google APIs on your Google Cloud project.
• Set a label on the cluster that identifies the mesh.
• Create a service account that lets data plane components, suchas the sidecar proxy, securely access your project's data and resources.
• Register the clusterto the fleet if it isn't already registered.

Just include the--enable_all flag when you runasmcli to let it configureyour project and cluster. For more information aboutasmcli options and flags,see theasmcli reference.

Next,asmcli configures YAML files with your project and cluster information.These configuration files are needed to install the Cloud Service Mesh control plane.

If you are new to Cloud Service Mesh and Istio, skip ahead toSupported platforms. The next section is intended tohelp existing Cloud Service Mesh upgrade to 1.19.

Transitioning toasmcli

Theasmcli takes the place ofistioctl install andinstall_asm. Althoughyou can still use the legacy tools in Cloud Service Mesh 1.11, we are deprecatingthem and they will no longer be supported in Cloud Service Mesh 1.12 and later.Please update your scripts and tools to useasmcli.

With Cloud Service Mesh 1.11 and later, all clusters must be registered to afleet. SeeFleet requirementsfor details.

Transitioning frominstall_asm

If you are familiar withinstall_asm,asmcli is similar but with thefollowing notable differences:

• You useasmcli install for new installations and upgrades.There isn't a--mode option like withinstall_asm. When you runasmcli install, it checks to see ifthere's an existing control plane on the cluster. If there isn't an existingcontrol plane,asmcli installs Cloud Service Mesh. If the cluster has anexisting control plane (either a Cloud Service Mesh control plane or an open sourceIstio control plane):

  • If the revision label on the existing control plane doesn't match therevision label for the new control plane,asmcli does acanary upgrade.

  • If the control plane revision labels are the same,asmcli does an in-placeupgrade.

• Most of theasmclioptions and flags behave the sameas the ones forinstall_asm.

Transitioning fromistioctl install

If you are familiar withistioctl install, if you normally pass anIstioOperator YAML file using the-f command-line argument to configure thecontrol plane, you can pass the file toasmcli using the--custom_overlayoption. In the Cloud Service Mesh documentation, we refer to these files as overlayfiles.

Note: By default,asmcli doesn't install an ingress gateway with the controlplane. For production deployments, we recommend that you install gatewaysseparately. For more information and best practices, seeInstall and upgrade gateways.We have provided sample Deployment, Service, ServiceAccount, and Roleconfiguration files in theanthos-service-mesh repository for both ingress and egress gateways to get you started. You candeploy them as they are or customize them as needed.

Supported platforms

Cloud Service Mesh installations on the list ofSupported platforms can be configuredor upgraded byasmcli.

However, not all features are available on the platforms outside of Google Cloud.For details, seeIn-cluster control plane supported features.

What's next

• Prerequisites