Managed Cloud Service Mesh release channels
Deprecated: Provisioning managed Cloud Service Mesh with asmcli will bedeprecated onAug 22, 2024 and support will end inFebruary 2025. Thischange only affects Google Cloud clusters. Off-Google Cloud clusters will continueto use asmcli as normal.Cloud Service Mesh releases updates often, to deliver security updates, fixknown issues, and introduce new features. Release channels balance betweenstability and the feature set of the Cloud Service Mesh version. Cloud Service Meshrelease channels are tied toGoogle Kubernetes Engine (GKE) release channels.Google automatically manages the version and upgrade cadence for each releasechannel.
Note: Managed Cloud Service Mesh consists of the managed control plane and manageddata plane. Both components use the same release channel.This document covers comparisons of release channels, and how to updateunmanaged proxies.
Available release channels
The following release channels are available. Each channel offers a trade-offbetween feature availability and update churn. Features in each channel have adifferent maturity level. Critical security patches are delivered to all releasechannels in order to protect your clusters and Google's infrastructure.
| Channel | New managed Cloud Service Mesh availability | Properties |
|---|---|---|
| Rapid | After each Cloud Service Mesh release | Get the latest Cloud Service Mesh release as early as possible, and beable to use new features the moment they are included in a release. Yourcontrol plane is frequently updated to stay on the latest available patchversion, and deliver newer capabilities. The Rapid channel is best used to testnewer Cloud Service Mesh versions and APIs on pre-production environments. |
| Regular | Rapid is promoted to Regular* | Access Cloud Service Mesh and Istio features reasonably soon after theydebut, but on a version that has been qualified over a longer period oftime. Offers a balance of feature availability and release stability, andis what we recommend for most users. |
| Stable | Regular is promoted to Stable* | Prioritize stability over new functionality. Changes and new versions inthis channel are rolled out last, after being validated on the Rapid andRegular channels which allows even more time for validation. |
*The promotion schedule to the next channel depends on multiplefactors, including the open source Istio release, Anthos release, and patchingschedule, and therefore is subject to change. To stay informed with thelatest information, add the URL of theCloud Service Mesh release notes toyourfeed reader, or add the feed URL directly:https://cloud.google.com/feeds/servicemesh-release-notes.xml | ||
When a minor version of managed Cloud Service Mesh has sufficient usage anddemonstrated stability in the Rapid channel, it is promoted to the Regularchannel. Eventually, the minor version is promoted to the Stable channel, whichonly receives high-priority updates and security patches. Each promotionsignals a graduating level of stability and production-readiness, based onobserved performance of the control plane running that version.
All channels are based on a generally available (GA) release (althoughindividual features may not always be GA, as marked). New Cloud Service Meshversions are first released to the Rapid channel, and over time are promoted tothe Regular, and Stable channel. This allows you to select a channel that meetsyour business, stability, and functionality needs.
Your cluster's Cloud Service Mesh channel is determined by its GKEcluster channel.
| GKE Channel | Cloud Service Mesh Channel |
|---|---|
| Rapid | Rapid |
| Regular | Regular |
| Stable | Stable |
| (no channel) | Regular |
Cloud Service Mesh versions per channel
Your Cloud Service Mesh channel is determined by your GKE clusterchannel at time of provisioning managed Cloud Service Mesh. If you change theGKE cluster channel later, then you keep the originalCloud Service Mesh channel.
The following table shows the current channel to Cloud Service Mesh version mapping:
| Channel | Cloud Service Mesh Version |
|---|---|
| Rapid | 1.21 |
| Regular | 1.20 |
| Stable | 1.19 |
Default channel
In a newly installed Cloud Service Mesh where there is a single managed channelinstalled in a cluster, that channel will be the default channel for thatcluster.
If clusters with an existing Istio or Cloud Service Mesh installation have thedefault tag configured, then it must be pointed to the managed revision.Otherwise, no action is required.
You can use theistio-injection=enabled label as an alias that pointsinjection to the other labels you use for the channel, such as thedefault revision. Wherever our documentation shows to use theistio.io/revnamespace label for injection, it's possible to use theistio-injection=enabled label instead.
Injection labels
To allow Cloud Service Mesh to manage the workloads in a given namespace, thenamespace must be labeled with a label corresponding to the installed channel.Managed Cloud Service Mesh supports two types of labels:
- standardrevision labels,namely
asm-managed-stable,asm-managed,asm-managed-rapid,corresponding to the channelsstable,regular, andrapid. - default injection label (for example,
istio-injection=enabled), corresponding to the default channelfor that cluster. Using the default injection label simplifies migration betweenrevisions. For example, whenmigrating from Istio OSS or fromunmanaged Cloud Service Mesh to managed Cloud Service Mesh, since there is no need tore-label each namespace individually. Wherever Cloud Service Mesh documentation showsto use theistio.io/revnamespace label for injection, it's possible to usetheistio-injection=enabledlabel instead.
Other examples of injection labels include labelling workloads withsidecar.istio.io/inject (commonly used for gateways) andistio.io/rev, whichworks for both namespaces and workloads.
Default injection labels
To apply the default injection label to a namespace:
Note: Although you can also useistio.io/rev=default instead ofistio-injection=enabled as a default injection label, we recommend tostandardize aroundistio-injection=enabled.kubectllabelnamespaceNAMESPACEistio-injection=enabledistio.io/rev---overwrite"istio-injection not found" inthe output. That means that the namespace didn't previously have theistio-injection label, which you should expect in newinstallations of Cloud Service Mesh or new deployments.Revision labels
Like other Kubernetes labels, a revision label is a key-value pair.The key in a revision label is alwaysistio.io/rev, but the value varies.To select a release channel, you apply one of the follow revision namesto your namespaces:
| Revision name | Channel |
|---|---|
asm-managed | Regular |
asm-managed-rapid | Rapid |
asm-managed-stable | Stable |
For example, to apply the Regular release channel to a namespace:
kubectllabelnamespaceNAMESPACEistio.io/rev=asm-managed--overwriteWe recommend that you use the same release channel that the cluster uses.
To see what release channel a namespace is using:
kubectlgetnamespaceNAMESPACE-ojsonpath='{.metadata.labels.istio\.io/rev}{"\n"}'Update unmanaged proxies
After each Cloud Service Mesh release, restart the unmanaged proxies for yourservices and gateways. Although the service mesh is fine when thecontrol plane and proxies are at different versions, we recommend that youupdate the proxies so that they are configured with the new Cloud Service Meshversion.
Check thecontrol plane and proxy version.
If the control plane version is newer than the proxy version, restartthe unmanaged proxies for your services and gateways.
kubectlrolloutrestartdeployment-nNAMESPACE
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.