This page describes the supported features and limitations for managed
Anthos Service Mesh. For the list of Anthos Service Mesh supported features for
Anthos Service Mesh with an in-cluster control plane, see
In-cluster control plane.
The following limitations apply:
GKE clusters must be in one of the supported regions.
Migrations/upgrades are supported only from Anthos Service Mesh versions 1.9+
installed with Mesh CA. Installations with Istio CA (previously known as
Citadel) must first migrate to Mesh CA.
Scale is limited to 1000 services and 5000 workloads per cluster.
Only multi-primary deployment option for multi-cluster is supported:
primary-remote deployment option for multi-cluster is not.
istioctl ps is not supported, however you can use istioctl pc with the pod name and namespace instead.
Unsupported Istio APIs:
You can use the migration tool included with the asmcli to automatically
convert IstioOperator configurations to be compatible with
Google-managed control plane. For more information, see
Migrate from IstioOperator.
You can use the Google-managed control plane without an Anthos subscription,
but certain UI elements and features in Google Cloud Console are only available
to Anthos subscribers. For information about what is available
to subscribers and non-subscribers, see
Anthos and Anthos Service Mesh UI differences.
Google-managed control plane supported features
Install, upgrade, and roll back
Installation on new GKE clusters - the resulting installation uses Stackdriver and Mesh CA
Upgrades from ASM 1.9 versions that use Mesh CA
Direct (skip-level) upgrades from Anthos Service Mesh versions prior to 1.9 (see notes for indirect upgrades)
Direct (skip-level) upgrades from Istio OSS (see notes for indirect upgrades)
Direct (skip-level) upgrades from Istio-on-GKE add-on (see notes for indirect upgrades)
GKE private clusters with public endpoint access, with or without Master
Authorized Network (MAN) enabled.
In private clusters, the GKE control plane (master)
has a private and public endpoint. There are three configuration
combinations to control access to the cluster endpoints:
Public endpoint access disabled: creates a private cluster with no
client access to the public endpoint. The Google-managed control plane
requires the public endpoint access to be enabled. Note that this
doesn't mean that the public endpoint is externally accessible. For
more information, see
Endpoints in private clusters.
Public endpoint access enabled, authorized networks enabled: creates a
private cluster with limited access to the public endpoint.
Public endpoint access enabled, authorized networks disabled: create
a private cluster with unrestricted access to the public endpoint.
Although TCP is a supported protocol for networking, TCP
metrics aren't collected or reported. Metrics are displayed only for HTTP
services in the Cloud Console.
Services that are configured with Layer 7 capabilities for
the following protocols are not supported: WebSocket, MongoDB, Redis, Kafka,
Cassandra, RabbitMQ, Cloud SQL. You might be able to make the protocol work by
using TCP byte stream support. If TCP byte stream cannot support the protocol
(for example, Kafka sends a redirect address in a protocol-specific reply and
this redirect is incompatible with Anthos Service Mesh's routing logic), then the
protocol isn't supported.
Egress directly out from sidecars
Egress using egress gateways
Service entry resource
Percentage, fault injection, path matching, redirects, retries, rewriting,
timeout, retry, mirroring, header manipulation, and CORS routing rules