In-cluster control plane supported features

This page describes features that are supported in Cloud Service Mesh1.24.6 with an in-cluster control plane. To see the supportedfeatures for Cloud Service Mesh 1.24.6 with a managed controlplane instead, seeManaged control plane.

Supported versions

Support for Cloud Service Mesh follows theGKE Enterprise Version Support Policy.

Formanaged Cloud Service Mesh with aTRAFFIC_DIRECTOR control plane implementation, Google always supports this control plane.

Formanaged Cloud Service Mesh with anISTIOD control plane implementation, Google supports the current Cloud Service Meshversions available in eachrelease channel.

Forself-installed in-cluster Cloud Service Mesh, Google supports the current andprevious two (n-2) minor versions of Cloud Service Mesh.

The following table shows the supported versions ofself-installed in-clusterCloud Service Mesh and the earliest end-of-life (EOL) date for a version.

If you are on an unsupported version of Cloud Service Mesh, then you must upgrade toCloud Service Mesh 1.22 or later. For information on how toupgrade, seeUpgrade Cloud Service Mesh.

The following table shows the unsupported versions of Cloud Service Mesh and theirend-of-life (EOL) date.

For more information about our support policies, refer toGetting support.

Platform differences

There are differences in supported features betweensupported platforms.

TheOther GKE Enterprise clusters columns refer to clustersthat are outside of Google Cloud, for example:

• Google Distributed Cloud:

  • Google Distributed Cloud (software only) for VMware
  • Google Distributed Cloud (software only) for bare metal

  This page uses Google Distributed Cloud where the same support is available onboth Google Distributed Cloud (software only) for VMware andGoogle Distributed Cloud (software only) for bare metal, and the specificplatform where there are differences between the platforms.

• GKE Enterprise on other public clouds:

  • GKE on AWS
  • GKE on Azure

• GKE attached clusters - Third-party Kubernetes clusters that havebeen registered to a fleet. Cloud Service Mesh is supported on the followingcluster types:

  • Amazon EKS clusters
  • Microsoft AKS clusters

In the following tables:

• – indicates the feature is enabled bydefault.
• * – indicates the feature is supported forthe platform and can be enabled, as described inEnabling optional featuresor the feature guide linked in the feature table.
• Compatible – indicates the feature or third-party tool will integrate orwork with Cloud Service Mesh, but is not fully supported by Google Cloud Supportand a feature guide is not available.
• – indicates either the feature isn'tavailable or it isn't supported in Cloud Service Mesh 1.24.6.

The default and optional features are fully supported by Google CloudSupport. Features not explicitly listed in the tables receive best-effortsupport.

Base Images

Security

Certificate distribution/rotation mechanisms

Certificate authority (CA) support

Cloud Service Mesh security features

In addition to supporting Istio security features, Cloud Service Mesh provides evenmore capabilities to help you secure your applications.

Authorization policy

Authentication policy

Peer authentication

For information on enabling mTLS STRICT mode, seeConfiguring transport security.

Request authentication

Notes:

1. Third-party JWT is enabled by default.

Telemetry

Metrics

Proxy request logging

Tracing

• Setting up your load balancer for Google Distributed Cloud (software only) for VMware
• GKE on AWS:Creating a load balancer
• Expose an ingress gateway using an external load balancer

Kubernetes Gateway API (preview)

In Cloud Service Mesh v1.20 the Kubernetes Gateway API is available as a publicpreview.

service.beta.kubernetes.io/port_80_health-probe_protocol:tcp

• Use the default automated deployments behavior for Gateways.

• Use theHttpRoute CRD for routing configurations. TheHttpRoute must haveaparentRef pointing to a Gateway.

• Don't useIstio GatewayCRs andKubernetes Gateway API CRson the same cluster.

Load balancing policies

For more information on load balancing policies, seeDestination Rules.

Data plane

Multi-cluster support

For multi-primary deployments of GKE clusters in differentprojects, all the clusters must be in ashared Virtual Private Cloud (VPC).

Network

Notes:

• For attached clusters, only multi-cluster meshes spanning a single platform(Microsoft AKS, Amazon EKS) are supported at this time.

Deployment model

Notes on terminology:

• A primary cluster is a cluster with a control plane. A single mesh can havemore than one primary cluster for high availability or to reduce latency.In the Istio 1.7 documentation, a multi-primary deployment is referred toas a replicated control plane.

• A remote cluster is a cluster that connects to a control plane residingoutside of the cluster. A remote cluster can connect to a control planerunning in a primary cluster or to an external control plane.

• Cloud Service Mesh uses a simplified definition of network based on generalconnectivity. Workload instances are on the same network if they are able tocommunicate directly, without a gateway.

User interface

Note: On-premises clusters require GKE Enterprise version 1.11 or later.For more information on upgrading seeUpgrading Google Distributed Cloud (software only) for VMwareorUpgrading Google Distributed Cloud (software only) for bare metal.