Version 1.9

Customer-managed control plane supported features

This page describes features that are supported in Anthos Service Mesh 1.9.2 with a customer-managed control plane. To see the supported features for Anthos Service Mesh 1.9.2 with a Google-managed control plane instead, see Google-managed control plane.

For the supported features in previous versions of Anthos Service Mesh, see the archive documentation:

Supported versions

Support for Anthos Service Mesh follows the Anthos Version Support Policy. Google supports the current and previous two (n-2) minor versions of Anthos Service Mesh. The following table shows the supported versions of Anthos Service Mesh and the earliest end-of-life (EOL) date for a version.

Release version Release date Earliest EOL date
1.4 December 20, 2019 Unsupported (September 18, 2020)
1.5 May 20, 2020 Unsupported (February 17, 2021)
1.6 June 30, 2020 March 30, 2021
1.7 November 3, 2020 August 2, 2021
1.8 December 15, 2020 September 15, 2021
1.9 March 4, 2020 December 4, 2021

Anthos Service Mesh 1.5 and 1.4 are no longer supported. You must upgrade to Anthos Service Mesh 1.6 or later. For information on how to upgrade, see Upgrading from earlier versions.

For more information about our support policies, refer to Getting support.

Platform differences

The supported features differ between the supported platforms and whether the GKE on Google Cloud clusters are in the same project or in different projects. In the following tables, any feature with the icon indicates that the feature is enabled by default. Supported optional indicates that the feature is supported for the platform and can be enabled, as described in Enabling optional features.

The default and optional features are fully supported by Google Cloud Support. Features not explicitly listed in the tables receive best-effort support. Any feature with the icon indicates either the feature isn't available or it isn't supported.

For information on installing Anthos Service Mesh on Anthos on bare metal, contact Cloud Support.

Install/upgrade/downgrades

Installations, upgrades, and downgrades of Anthos Service Mesh must be done using istioctl install. The other methods of installing Istio are unsupported.

Using the install_asm script

The install_asm script calls istioctl install. For more information about the install_asm script, see Installation, migration, and upgrade on GKE.

Feature GKE clusters same project GKE clusters different projects Anthos clusters on VMware and on bare metal
New installations
Upgrades
Migration from Istio
Enabling optional features

Using istioctl install

Feature GKE clusters Anthos clusters on VMware and on bare metal
New installations
Upgrades
Migration from Istio
Enabling optional features

To migrate from the 1.6 version of the Istio on GKE add-on, follow the Upgrade to Istio 1.6 with Operator to upgrade to Anthos Service Mesh 1.7.

Security

Certificate distribution/rotation mechanisms

Feature GKE clusters Anthos clusters on VMware and on bare metal
workload certificate management using Envoy SDS
external certificate management on ingress gateway using Envoy SDS Supported optional

Certificate authority (CA) support

Feature GKE clusters same project GKE clusters different projects Anthos clusters on VMware and on bare metal
Anthos Service Mesh certificate authority (Mesh CA)
Certificate Authority Service (preview)
Citadel CA
Integration with custom CAs

Authorization policy

Feature GKE clusters Anthos clusters on VMware and on bare metal
Authorization v1beta1 policy

Authentication policy

Peer authentication

Feature GKE clusters Anthos clusters on VMware and on bare metal
Auto-mTLS
mTLS PERMISSIVE mode
mTLS STRICT mode Supported optional Supported optional

Request authentication

Feature GKE clusters Anthos clusters on VMware and on bare metal
JWT authentication

Telemetry

Metrics

Feature GKE clusters Anthos clusters on VMware and on bare metal
Cloud Monitoring (HTTP in-proxy metrics)
Cloud Monitoring (TCP in-proxy metrics)
Mesh telemetry (in-proxy edge data)
Prometheus metrics export to customer-installed Prometheus, Grafana, and Kiali dashboards Compatible Compatible
Custom adapters/backends, in or out of process
Arbitrary telemetry and logging backends

The integration between Anthos Service Mesh and the third-party telemetry products is supported.

Access logging

Feature GKE clusters Anthos clusters on VMware and on bare metal
Cloud Logging
Direct Envoy to stdout Supported optional Supported optional

Tracing

Feature GKE clusters Anthos clusters on VMware and on bare metal
Cloud Trace Supported optional
Jaeger tracing (allows use of customer-managed Jaeger) Compatible Compatible
Zipkin tracing (allows use of customer-managed Zipkin) Compatible Compatible

The integration between Anthos Service Mesh and the third-party telemetry products is supported.

Policy

Feature GKE clusters Anthos clusters on VMware and on bare metal
Policy checks

Networking

Traffic interception/redirection mechanism

Feature GKE clusters Anthos clusters on VMware and on bare metal
Traditional use of iptables using init containers with CAP_NET_ADMIN
Istio Container Network Interface (CNI) Supported optional Supported optional
Whitebox sidecar

Protocol support

Feature GKE clusters Anthos clusters on VMware and on bare metal
IPv4
HTTP/1.1
HTTP/2
TCP byte streams (Note 1)
gRPC
IPv6

Notes:

  1. Although TCP is a supported protocol for networking, TCP metrics aren't collected or reported. Metrics are displayed only for HTTP services in the Cloud Console.
  2. Services that are configured with Layer 7 capabilities for the following protocols are not supported: WebSocket, MongoDB, Redis, Kafka, Cassandra, RabbitMQ, Cloud SQL. You might be able to make the protocol work by using TCP byte stream support. If TCP byte stream cannot support the protocol (for example, Kafka sends a redirect address in a protocol-specific reply and this redirect is incompatible with Anthos Service Mesh's routing logic), then the protocol isn't supported.

Envoy deployments

Feature GKE clusters Anthos clusters on VMware and on bare metal
Sidecars
Ingress gateway
Egress directly out from sidecars
Egress using egress gateways Supported optional Supported optional

CRD support

Feature GKE clusters Anthos clusters on VMware and on bare metal
Sidecar resource
Service entry resource
Percentage, fault injection, path matching, redirects, retries, rewriting, timeout, retry, mirroring, header manipulation, and CORS routing rules
custom Envoy filters

Load balancer for the Istio ingress gateway

Feature GKE clusters Anthos clusters on VMware and on bare metal
Public load balancer
Google Cloud Internal load balancer Supported optional Not supported. See the links below.

For information on configuring load balancers, see the following:

Load balancing policies

Feature GKE clusters Anthos clusters on VMware and on bare metal
round robin
least connections
random
passthrough
Consistent Hash
locality-weighted

Multi-cluster support

For multi-primary deployments of GKE clusters in different projects, all the clusters must be in a shared Virtual Private Cloud (VPC).

Network

Feature GKE clusters Anthos clusters on VMware Anthos on bare metal
Single network
Multi-network

Deployment model

Feature GKE clusters Anthos clusters on VMware Anthos on bare metal
Multi-primary
Primary-remote

Notes on terminology

  • A primary cluster is a cluster with a control plane. A single mesh can have more than one primary cluster for high availability or to reduce latency. In the Istio 1.7 documentation, a multi-primary deployment is referred to as a replicated control plane.

  • A remote cluster is a cluster that connects to a control plane residing outside of the cluster. A remote cluster can connect to a control plane running in a primary cluster or to an external control plane.

  • Anthos Service Mesh uses a simplified definition of network based on general connectivity. Workload instances are on the same network if they are able to communicate directly, without a gateway.

User interface

Feature GKE clusters same project GKE clusters different projects Anthos clusters on VMware and on bare metal
Anthos Service Mesh dashboards in the Cloud Console
Cloud Monitoring
Cloud Logging

Installation of the Zipkin and Kiali addon components can no longer be done using istioctl install. If you enable metrics export to Prometheus, you can install your own instance of Grafana and Kiali. The integration between Anthos Service Mesh and the third-party telemetry add-ons is supported.

Supported platforms

Only the following environments are supported with Anthos Service Mesh 1.9.2. All other environments are unsupported.

Platform Version
GKE on Google Cloud We recommend that you enroll GKE clusters in a release channel. When enrolling, use the Regular release channel because other channels might be based on a GKE version that isn't supported. Anthos Service Mesh 1.9.2 supports the following GKE versions: 1.15, 1.16, 1.17, and 1.18. Note that GKE version 1.14 is not supported with Anthos Service Mesh 1.9.2.

For more information about the GKE versions included in each release channel see the following:

Anthos clusters on VMware Anthos 1.6, Kubernetes version 1.18
Anthos on bare metal Anthos 1.6, Kubernetes version 1.18

Unsupported platforms

Anthos Service Mesh 1.9.2-asm.1 hasn't been qualified on the following platforms:

These platforms were qualified and are fully supported on Anthos Service Mesh versions 1.6 and 1.7. If you have Anthos Service Mesh 1.6 or 1.7 installed on these platforms, don't upgrade to Anthos Service Mesh 1.9.2-asm.1.

See the following installation guides for details: