Cloud Service Mesh는 GKE Enterprise에서 또는 독립형 서비스로 사용 가능합니다.
Google API는 청구 방식을 결정하는 데 사용됩니다. Cloud Service Mesh를 독립형 서비스로 사용하려면 프로젝트에 GKE Enterprise API를 사용 설정하지 마세요.
asmcli는 다른 모든 필수 Google API를 사용 설정합니다. Cloud Service Mesh 가격에 대한 자세한 내용은 가격 책정을 참조하세요.
GKE Enterprise 구독자는 GKE Enterprise API를 사용 설정해야 합니다.
GKE Enterprise 구독자가 아니어도 Cloud Service Mesh를 설치할 수 있지만 GKE Enterprise 구독자만 Google Cloud 콘솔의 특정 UI 요소와 기능을 사용할 수 있습니다. 구독자와 비구독자가 사용할 수 있는 항목에 대한 자세한 내용은 GKE Enterprise 및 Cloud Service Mesh UI 차이점을 참조하세요.
GKE Enterprise API를 사용 설정했지만 Cloud Service Mesh를 독립형 서비스로 사용하려면 GKE Enterprise API를 중지합니다.
일반 요구사항
서비스 메시에 포함하려면 서비스 포트의 이름이 지정되어야 하며 이름은 name: protocol[-suffix] 문법에서 포트 프로토콜을 포함해야 합니다. 여기서 대괄호는 대시로 시작해야 하는 선택적 서픽스를 나타냅니다. 자세한 내용은 서비스 포트 이름 지정을 참조하세요.
vCPU가 4개 이상 있는 머신 유형(예: e2-standard-4).
클러스터의 머신 유형에 4개 미만의 vCPU가 있으면 여러 머신 유형에 워크로드 마이그레이션에 설명된 대로 머신 유형을 변경합니다.
최소 노드 수는 머신 유형에 따라 다릅니다. Cloud Service Mesh에는 최소 8개의 vCPU가 필요합니다. 머신 유형에 vCPU가 4개 있는 경우 클러스터에는 노드가 2개 이상 있어야 합니다. 머신 유형에 vCPU가 8개 있는 경우 클러스터에는 노드가 1개만 필요합니다. 노드를 추가해야 하는 경우 클러스터 크기 조절을 참조하세요.
GKE 워크로드 아이덴티티는 필수 항목입니다. Cloud Service Mesh를 설치하기 전 워크로드 아이덴티티를 사용 설정하는 것이 좋습니다. 워크로드 아이덴티티를 사용 설정하면 워크로드 아이덴티티 제한사항의 설명대로 워크로드에서 Google API로 호출이 보호되는 방식이 변경됩니다.
기존 노드 풀에서는 GKE 메타데이터 서버를 사용 설정할 필요가 없습니다.
선택사항이지만 출시 채널에 클러스터를 등록하는 것이 좋습니다.
다른 채널은 Cloud Service Mesh 1.26.0에서 지원되지 않는 GKE 버전을 기반으로 할 수 있으므로 일반 출시 채널에 등록하는 것이 좋습니다. 자세한 내용은 지원되는 플랫폼을 참조하세요.
정적 GKE 버전이 있는 경우 출시 채널에 기존 클러스터 등록의 안내를 따릅니다.
비공개 클러스터에 Cloud Service Mesh를 설치하는 경우 자동 사이드카 삽입에 사용되는 웹훅 및 구성 검증을 작동하기 위해 방화벽에서 포트 15017을 열어야 합니다. 자세한 내용은 비공개 클러스터에서 포트 열기를 참조하세요.
Cloud Service Mesh를 설치할 클라이언트 머신이 API 서버에 네트워크로 연결되어 있는지 확인합니다.
Windows Server 워크로드의 경우 Cloud Service Mesh가 지원되지 않습니다. 클러스터에 Linux 및 Windows Server 노드 풀이 둘 다 있는 경우에도 Cloud Service Mesh를 설치하고 Linux 워크로드에서 사용할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-20(UTC)"],[],[],null,["In-cluster Cloud Service Mesh prerequisites **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis page describes the prerequisites and the requirements for installing\nin-cluster Cloud Service Mesh on GKE, such\nas GKE Enterprise licensing, cluster requirements, fleet requirements, and\ngeneral requirements.\n\nCloud project\n\nBefore you begin:\n\n- [Select or create a Google Cloud project](https://console.cloud.google.com/projectselector2).\n\n- [Verify that billing is enabled](https://cloud.google.com/billing/docs/how-to/modify-project) for your project.\n\nGKE Enterprise licensing\n\nCloud Service Mesh is available with GKE Enterprise or as a standalone service.\nGoogle APIs are used to determine how you are billed. To use Cloud Service Mesh as\na standalone service, don't enable the GKE Enterprise API in your project.\nThe `asmcli` enables all of the other required Google APIs for you. For\ninformation about Cloud Service Mesh pricing, see [Pricing](/service-mesh/pricing).\n\n- GKE Enterprise subscribers, be sure to enable the GKE Enterprise API.\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=anthos.googleapis.com)\n- If you aren't a GKE Enterprise subscriber, you can still install\n Cloud Service Mesh, but certain UI elements and features in Google Cloud console are\n only available to GKE Enterprise subscribers. For information about\n what is available to subscribers and non-subscribers, see\n [GKE Enterprise and Cloud Service Mesh UI differences](/service-mesh/docs/ui-differences).\n\n- If you enabled the GKE Enterprise API, but you want to use Cloud Service Mesh as\n a standalone service,\n [disable the GKE Enterprise API](/service-usage/docs/enable-disable).\n\nGeneral requirements\n\n- To be included in the service mesh, service ports must be named, and the name\n must include the port's protocol in the following syntax:\n `name: `\u003cvar translate=\"no\"\u003eprotocol\u003c/var\u003e`[-`\u003cvar translate=\"no\"\u003esuffix\u003c/var\u003e`]`\n where the square brackets indicate an optional suffix that must start with a\n dash. For more information, see\n [Naming service ports](/service-mesh/docs/naming-service-ports).\n\n- If you have created a [service perimeter](/vpc-service-controls/docs/service-perimeters)\n in your organization, you might need to add the Cloud Service Mesh certificate authority service\n to the perimeter. See\n [Adding Cloud Service Mesh certificate authority to a service perimeter](/service-mesh/docs/operate-and-maintain/set-service-perimeter)\n for more information.\n\n- If you want to change the default [resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits)\n for the `istio-proxy` sidecar container, the new values must be greater than the\n default values to\n [avoid out-of-memory (OOM) events](/service-mesh/docs/troubleshooting/troubleshoot-sidecar-proxies).\n\n-\n A Google Cloud project can only have one mesh associated with it.\n\nCluster requirements\n\n- Verify that your cluster version is listed in\n [Supported platforms](/service-mesh/docs/supported-platforms).\n\n- Your GKE cluster must meet the following requirements:\n\n - The GKE cluster must be Standard. Autopilot clusters are\n only supported with [managed Cloud Service Mesh](/service-mesh/docs/managed/provision-managed-anthos-service-mesh).\n\n - A machine type that has at least 4 vCPUs, such as `e2-standard-4`.\n If the machine type for your cluster doesn't have at\n least 4 vCPUs, change the machine type as described in\n [Migrating workloads to different machine types](/kubernetes-engine/docs/tutorials/migrating-node-pool).\n\n - The minimum number of nodes depends on your machine type. Cloud Service Mesh\n requires at least 8 vCPUs. If the machine type has 4 vCPUs, your\n cluster must have at least 2 nodes. If the machine type has 8 vCPUs,\n the cluster only needs 1 node. If you need to add nodes, see\n [Resizing a cluster](/kubernetes-engine/docs/how-to/resizing-a-cluster).\n\n- GKE Workload Identity is required. We recommend that you\n enable [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity)\n before installing Cloud Service Mesh. Enabling Workload Identity changes the way\n calls from your workloads to Google APIs are secured, as described in\n [Workload Identity limitations](/kubernetes-engine/docs/how-to/workload-identity#limitations).\n Note that you do not need to enable the\n [GKE Metadata Server](/kubernetes-engine/docs/concepts/workload-identity#metadata_server)\n on [existing node pools](/kubernetes-engine/docs/how-to/workload-identity#migrate_applications_to).\n\n- Optional but recommended, enroll the cluster in a\n [release channel](/kubernetes-engine/docs/concepts/release-channels).\n\n We recommend that you enroll in the Regular release channel because other\n channels might be based on a GKE version that isn't supported\n with Cloud Service Mesh 1.26.4. For more information, see\n [Supported platforms](/service-mesh/docs/supported-platforms).\n Follow the instructions in\n [Enrolling an existing cluster in a release channel](/kubernetes-engine/docs/concepts/release-channels#enrolling_an_existing_cluster_in_a_release_channel)\n if you have a static GKE version.\n\n- If you are installing Cloud Service Mesh on a private cluster, you must open port\n 15017 in the firewall to get the webhooks used for\n [automatic sidecar injection](/service-mesh/docs/anthos-service-mesh-proxy-injection) and configuration\n validation to work. For more information, see\n [Opening a port on a private cluster](/service-mesh/docs/private-cluster-open-port).\n\n- Ensure that the client machine that you install Cloud Service Mesh from has\n network connectivity to the API server.\n\n- For Windows Server workloads, Cloud Service Mesh is not supported. If your\n cluster has both Linux and Windows Server node pools, you can still install\n Cloud Service Mesh and use it on your Linux workloads.\n\n - After provisioning Cloud Service Mesh, you must [contact support](/service-mesh/docs/getting-support) before initiating [IP rotation](/kubernetes-engine/docs/how-to/ip-rotation) or [certificate credential rotation](/kubernetes-engine/docs/how-to/credential-rotation).\n\nFleet requirements\n\nAll clusters must be registered to a\n[fleet](/anthos/multicluster-management/fleets), and\n[fleet workload identity](/anthos/multicluster-management/fleets/workload-identity)\nmust be enabled. You can either\n[setup up the clusters](/anthos/multicluster-management/fleets/workload-identity#cluster_setup)\nyourself, or you can let `asmcli` register the clusters as long as they\nmeet the following requirements:\n| **Caution:** All Cloud Service Mesh clusters for one mesh must be registered to the same fleet at all times to use Cloud Service Mesh. Other clusters in the project of a Cloud Service Mesh cluster must not be registered to a different fleet.\n\n- **GKE** : *(applies to in-cluster and managed Cloud Service Mesh)* [Enable GKE Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) on your Google Kubernetes Engine cluster, if it is not already enabled. Additionally, you must [register the cluster using fleet Workload Identity](/anthos/fleet-management/docs/fleet-creation).\n\nWhen you run `asmcli install`, you specify the project ID\nof the\n[fleet host project](/anthos/multicluster-management/fleets#fleet-host-project).\n`asmcli` registers the cluster if it isn't already registered.\n| **Note:** If you have not registered a cluster from a project to a fleet hosted in a different project before, there are extra steps required to configure fleet permissions. For detailed instructions, see [Grant permissions for registering a cluster into a different project](/anthos/fleet-management/docs/before-you-begin#gke-cross-project).\n\nWhat's next?\n\n- [Plan a new installation](/service-mesh/legacy/in-cluster/plan-install)\n- [Plan an upgrade](/service-mesh/docs/upgrade/plan-upgrade)"]]
