Version 1.13

In-cluster control plane supported features

This page describes features that are supported in Anthos Service Mesh 1.13.2 with an in-cluster control plane. To see the supported features for Anthos Service Mesh 1.13.2 with a Google-managed control plane instead, see Google-managed control plane.

Supported versions

Support for Anthos Service Mesh follows the Anthos Version Support Policy. Google supports the current and previous two (n-2) minor versions of Anthos Service Mesh. The following table shows the supported versions of Anthos Service Mesh and the earliest end-of-life (EOL) date for a version.

Release version Release date Earliest EOL date
1.13 March 30, 2022 December 30, 2022
1.12 December 9, 2021 September 9, 2022
1.11 October 6, 2021 July 6, 2022

If you are on an unsupported version of Anthos Service Mesh, then you must upgrade to Anthos Service Mesh 1.10 or later. For information on how to upgrade, see Upgrade Anthos Service Mesh.

The following table shows the unsupported versions of Anthos Service Mesh and their end-of-life (EOL) date.

Release version Release date EOL date
1.10 June 24, 2021 Unsupported (March 30, 2022)
1.9 March 4, 2021 Unsupported (December 14, 2021)
1.8 December 15, 2020 Unsupported (December 14, 2021)
1.7 November 3, 2020 Unsupported (December 14, 2021)
1.6 June 30, 2020 Unsupported (March 30, 2021)
1.5 May 20, 2020 Unsupported (February 17, 2021)
1.4 December 20, 2019 Unsupported (September 18, 2020)

For more information about our support policies, refer to Getting support.

Platform differences

The supported features differ between the supported platforms.

The Other Anthos clusters columns refer to clusters that are outside of Google Cloud, for example:

  • Anthos on-prem:

    • Anthos clusters on VMware (GKE on-prem)
    • Anthos on bare metal

    This page uses Anthos on-prem where the same support is available on both Anthos clusters on VMware and Anthos on bare metal, and the specific platform where there are differences between the platforms.

  • Anthos on other public clouds:

  • Attached clusters - Attached clusters are third-party Kubernetes clusters that have been registered to a fleet. Anthos Service Mesh is supported on the following cluster types:

    • Amazon EKS clusters
    • Microsoft AKS clusters

In the following tables:

  • – indicates the feature is enabled by default.
  • Supported optional – indicates the feature is supported for the platform and can be enabled, as described in Enabling optional features or the feature guide linked in the feature table.
  • Compatible – indicates the feature or third-party tool will integrate or work with Anthos Service Mesh, but is not fully supported by Google Cloud Support and a feature guide is not available.
  • – indicates either the feature isn't available or it isn't supported in Anthos Service Mesh 1.13.2.

The default and optional features are fully supported by Google Cloud Support. Features not explicitly listed in the tables receive best-effort support.

Security

Certificate distribution/rotation mechanisms

Feature GKE clusters on Google Cloud Other Anthos clusters
Workload certificate management
External certificate management on ingress and egress gateways.

Certificate authority (CA) support

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Anthos Service Mesh certificate authority (Mesh CA)
Certificate Authority Service Supported optional Supported optional
Istio CA (previously known as Citadel) Supported optional Supported optional
Plug in your own CA certificates Supported by CA service and Istio CA Supported by CA service and Istio CA Supported by Istio CA

Anthos Service Mesh security features

In addition to supporting Istio security features, Anthos Service Mesh provides even more capabilities to help you secure your applications.

Feature GKE clusters on Google Cloud Anthos on-prem Anthos clusters on AWS (Multi-Cloud) Other Anthos clusters
IAP integration
End-user authentication
Audit policies Supported optional
Dry-run mode
Denial logging

Authorization policy

Feature GKE clusters on Google Cloud Other Anthos clusters
Authorization v1beta1 policy

Authentication policy

Peer authentication

Feature GKE clusters on Google Cloud Other Anthos clusters
Auto-mTLS
mTLS PERMISSIVE mode

For information on enabling mTLS STRICT mode, see Configuring transport security.

Request authentication

Feature GKE clusters on Google Cloud Other Anthos clusters
JWT authentication

Base Images

Feature GKE clusters on Google Cloud Other Anthos clusters
Distroless proxy image

Telemetry

Metrics

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Cloud Monitoring (HTTP in-proxy metrics)
Cloud Monitoring (TCP in-proxy metrics)
Prometheus metrics export to customer-installed Prometheus, Grafana, and Kiali dashboards Compatible Compatible Compatible
Custom adapters/backends, in or out of process
Arbitrary telemetry and logging backends
The integration between Anthos Service Mesh and metrics export to Prometheus is supported.
The topology graph in the Google Cloud console no longer uses the Mesh telemetry service as its data source. Although the data source for the topology graph has changed, the UI remains the same.

Access logging

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Cloud Logging
Direct Envoy to stdout Supported optional Supported optional Supported optional

Tracing

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Cloud Trace Supported optional Supported optional
Jaeger tracing (allows use of customer-managed Jaeger) Compatible Compatible Compatible
Zipkin tracing (allows use of customer-managed Zipkin) Compatible Compatible Compatible
The integration between Anthos Service Mesh and Jaeger or Zipkin is supported. See Distributed Tracing for details.

Networking

Traffic interception/redirection mechanism

Feature GKE clusters on Google Cloud Other Anthos clusters
Traditional use of iptables using init containers with CAP_NET_ADMIN
Container Network Interface (CNI) Supported optional Supported optional

Protocol support

Services that are configured with Layer 7 capabilities for the following protocols are not supported: WebSocket, MongoDB, Redis, Kafka, Cassandra, RabbitMQ, Cloud SQL. You might be able to make the protocol work by using TCP byte stream support. If TCP byte stream cannot support the protocol (for example, Kafka sends a redirect address in a protocol-specific reply and this redirect is incompatible with Anthos Service Mesh's routing logic), then the protocol isn't supported.

Feature GKE clusters on Google Cloud Other Anthos clusters
IPv4
HTTP/1.1
HTTP/2
TCP byte streams (Note 1)
gRPC
IPv6

Notes:

  1. Although TCP is a supported protocol for networking, TCP metrics aren't collected or reported. Metrics are displayed only for HTTP services in the Cloud console.

Envoy deployments

Feature GKE clusters on Google Cloud Other Anthos clusters
Sidecars
Ingress gateway
Egress directly out from sidecars
Egress using egress gateways Supported optional Supported optional

CRD support

Feature GKE clusters on Google Cloud Other Anthos clusters
Istio API support (exceptions below)
custom Envoy filters

Load balancer for the Istio ingress gateway

Feature GKE clusters on Google Cloud Other Anthos clusters
Public load balancer
Google Cloud Internal load balancer Supported optional Not supported. See the links below.

For information on configuring load balancers, see the following:

Load balancing policies

Feature GKE clusters on Google Cloud Other Anthos clusters
Round robin
Least connections
Random
Passthrough
Consistent hash
Locality

For more information on load balancing policies, see Destination Rules.

Multi-cluster support

For multi-primary deployments of GKE clusters in different projects, all the clusters must be in a shared Virtual Private Cloud (VPC).

Network

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Single network
Multi-network

Deployment model

Feature GKE clusters on Google Cloud Anthos clusters on-premises Other Anthos clusters
Multi-primary
Primary-remote

Notes on terminology

  • A primary cluster is a cluster with a control plane. A single mesh can have more than one primary cluster for high availability or to reduce latency. In the Istio 1.7 documentation, a multi-primary deployment is referred to as a replicated control plane.

  • A remote cluster is a cluster that connects to a control plane residing outside of the cluster. A remote cluster can connect to a control plane running in a primary cluster or to an external control plane.

  • Anthos Service Mesh uses a simplified definition of network based on general connectivity. Workload instances are on the same network if they are able to communicate directly, without a gateway.

User interface

Feature GKE clusters on Google Cloud same project GKE clusters on Google Cloud different projects Anthos clusters on VMware (GKE on-prem) Anthos on bare metal Other Anthos clusters
Anthos Service Mesh dashboards in the Cloud console * * Supported optional
Cloud Monitoring Supported optional
Cloud Logging Supported optional
Cloud Trace Supported optional

* Note that on-prem clusters require Anthos version 1.11+. For more information on upgrading see Upgrading Anthos clusters on VMware or Upgrading Anthos on bare metal.

Supported platforms

Anthos Service Mesh 1.13.2 supports any combination of the following platforms and environments. All other environments are unsupported.

Platform Version
GKE on Google Cloud We recommend that you enroll GKE clusters on Google Cloud in a release channel. When enrolling, use the Regular release channel because other channels might be based on a GKE version that isn't supported. Anthos Service Mesh 1.13.2 supports the following GKE versions: 1.21 and 1.22.

For more information about the GKE versions included in each release channel see the following:

The GKE cluster must be Standard. GKE Autopilot cluster is not supported by the in-cluster control plane. In order to use the GKE Autopilot, you must choose managed Anthos Service Mesh.

Anthos clusters on VMware 1.11 Kubernetes version 1.22
Anthos on bare metal 1.11 Kubernetes version 1.21
Anthos clusters on AWS current and previous generation (1.10) Kubernetes version 1.22
Anthos attached clusters Amazon EKS and Microsoft AKS on Kubernetes 1.21 are supported with Anthos Service Mesh 1.13. For information on installing Anthos Service Mesh on EKS or AKS, see About the asmcli.

Supported upgrade paths

The Anthos Service Mesh version that you can upgrade from differs by platform.

GKE

You can upgrade directly to Anthos Service Mesh 1.13.2-asm.5 on Google Kubernetes Engine from the following versions:

1.11+

On-premises

You can upgrade directly to Anthos Service Mesh 1.13.2-asm.5 on Anthos clusters on VMware and Anthos on bare metal from the following versions:

1.11+

Anthos clusters on AWS

You can upgrade directly to Anthos Service Mesh 1.13.2-asm.5 on Anthos clusters on AWS from the following versions:

1.11+

Amazon EKS

If you have Anthos Service Mesh 1.7 installed on EKS, you will need to install Anthos Service Mesh 1.13 on a new cluster. Upgrades from Anthos Service Mesh 1.7 to Anthos Service Mesh 1.13 aren't supported.

Microsoft AKS

If you have Anthos Service Mesh 1.7 installed on AKS, you will need to install Anthos Service Mesh 1.13 on a new cluster. Upgrades from Anthos Service Mesh 1.7 to Anthos Service Mesh 1.13 aren't supported.