This page describes the available arguments to the script and provides details on the changes that the script makes to your project and GKE cluster.


-p|--project_id CLUSTER_PROJECT_ID
The project ID that the cluster was created in.
-n|--cluster_name CLUSTER_NAME
The name of the cluster.
-l|--cluster_location CLUSTER_LOCATION
Either the zone (for single-zone clusters) or region (for regional clusters) that the cluster was created in.
-m|--mode {install|migrate|upgrade}
Enter install if you are doing a new installation of Anthos Service Mesh. Enter migrate if you are migrating from Istio. Enter upgrade to upgrade an existing Anthos Service Mesh installation to a new version.
-c|--ca {mesh_ca|citadel}
For new installations, if you want to use Mesh CA, you don't have to include this option because the script defaults to Mesh CA. For upgrades, you don't need to include this option because the script doesn't allow you to change the CA. For migrations, you specify citadel or mesh_ca. If you can schedule downtime for the migration, we recommend that you use mesh_ca. For more information about which CA to use, see Choosing a certificate authority. For additional options that you must specify when using Citadel, see Options for a custom certificate for Citadel.
--co|--custom_overlay YAML_FILE
The name of the IstioOperator custom resource (CR) YAML file to enable a feature that isn't enabled by default. The script must be able to locate the YAML file, so the file either needs to be in the same directory as the script, or you can specify a relative path. To add multiple files, specify --co|--custom_overlay and the filename, for example: --co overlay_file1.yaml --co overlay_file2.yaml --co overlay_file3.yaml
-o|--option OPTION_FILE
The name of a YAML file from the anthos-service-mesh package that contains the IstioOperator CR to enable an optional feature. When including one of these files, you don't need to download the anthos-service-mesh package first, and you don't specify the .yaml extension. If you need to modify any of the files, download the anthos-service-mesh package, make your changes, and use the --custom_overlay option. To add multiple files, specify -o|--option and the filename, for example: -o option_file1 -o option_file2 -o option_file3
-s|--service_account ACCOUNT
The name of a service account used to install Anthos Service Mesh. If not specified, the active user account in the current gcloud configuration is used. If you need to change the active user account, run gcloud auth login.
-k|--key_file FILE_PATH
The key file for a service account. Omit this option if you aren't using a service account.
-D|--output_dir DIR_PATH
If not specified, the script creates a temporary directory where it downloads files and configurations necessary for installing Anthos Service Mesh. Specify the --output-dir flag to designate an existing directory to use instead. Upon completion, the specified directory contains the asm and the istio-1.8.6-asm.8 subdirectories. The asm directory contains the configuration for the installation. The istio-1.8.6-asm.8 directory contains the extracted contents of installation file, which contains istioctl, samples, and manifests.

Options for Citadel custom certificate

If you specified citadel and you are using a custom CA, include the following options:

  • --ca_cert FILE_PATH: The intermediate certificate
  • --ca_key FILE_PATH: The key for the intermediate certificate
  • --root_cert FILE_PATH: The root certificate
  • --cert_chain FILE_PATH: The certificate chain

For more information, see Plugging in existing CA Certificates.

Enablement flags

The flags that start with --enable let the script enable the required Google APIs, set required Identity and Access Management (IAM) permissions, and update your cluster. If you prefer, you can update your project and cluster yourself before running the script as described in the Setting up your project and Setting up your cluster sections of the Multi-project installation guide. All of these flags are are incompatible with --only_validate, and the script terminates with an error in this case.

Allow the script to perform all of the individual enable actions described below.
Allow the script to attempt to bind the GCP user or service account running the script to the cluster-admin role on your cluster. The script determines the user account from the gcloud config get-value core/account command. If you are running the script locally with a user account, make sure that you call the gcloud auth login command before running the script. If you need to change the user account, run the gcloud config set core/account GCP_EMAIL_ADDRESS command where GCP_EMAIL_ADDRESS is the account that you use to log in to Google Cloud.
Allow the script to set required cluster labels.

Allow the script to enable the following required Google Cloud managed services and components:


Allow the script to enable all required Google APIs.


Allow the script to set the required IAM permissions.


Allow the script to register the cluster to the project that the cluster is in. If you don't include this flag, follow the steps in Registering a cluster to manually register the cluster. Note that unlike the other enablement flags, --enable-registration isn't included in --enable_all. You specify file this flag separately.

Other flags

Print commands before and after execution.
Print commands, but don't execute them.
Run validation but don't update the project or cluster and don't install Anthos Service Mesh. This flag is incompatible with the enablement flags. The script terminates with an error if you specify --only_validate with any enablement flag.
Instead of installing Anthos Service Mesh, print all of the compiled YAML to standard output (stdout). All other output is written to standard error (stderr), even if it would normally go to stdout. The script skips all validations and setup when you specify this flag.
By default, the script deploys the Canonical Service controller to your cluster. If you don't want the script to deploy the controller, specify --disable_canonical_service. For more information, refer to Enabling and disabling the Canonical Service controller.
Show a help message describing the options and flags and exit.
Print the version of install_asm and exit. If the command doesn't output a version, download the most recent version of install_asm_1.8.

Understanding the script

Although you download the script from a secure Cloud Source Repositories location, the script is also available on GitHub so that you can see what it does before you download it. The script validates that your project and cluster meet the Anthos Service Mesh requirements, and it automates all the steps that you would do manually to configure your project and cluster and then install Anthos Service Mesh using the istioctl install command.

With Anthos Service Mesh 1.8.6, you use the version of the install_asm script on the release-1.8-asm branch. For an explanation of the versioning and release process, see Versioning/Release.


validate_args() {
  if [[ "${MODE}" == "install" && -z "${CA}" ]]; then

  if is_managed; then
    if [[ "${MODE}" != "install" ]]; then
      fatal "Migrate and upgrade are incompatible with managed control plane."

    if [[ "${CA}" == "citadel" ]]; then
      fatal "Citadel is not supported with managed control plane."

    if [[ "${CA}" == "gcp_cas" ]]; then
      fatal "Google Certificate Authority Service integration is not supported with managed control plane."

    if [[ "${CUSTOM_CA}" -eq 1 ]]; then
      fatal "Specifying a custom CA with managed control plane is not supported."

  local MISSING_ARGS=0
  while read -r REQUIRED_ARG; do
    if [[ -z "${!REQUIRED_ARG}" ]]; then
      warn "Missing value for ${REQUIRED_ARG}"
    readonly "${REQUIRED_ARG}"
  done <<EOF
validate_dependencies() {

  if [[ "${MODE}" = "migrate" ]]; then
  elif [[ "${MODE}" = "upgrade" ]]; then

The validate_args and validate_dependencies functions:

  • Check that all the required tools are installed.
  • Verify that the project ID, cluster name, and cluster location that you entered as parameter values are valid.
  • Ensures that the cluster meets the minimum required machine type and number of nodes.

Setting up your project

If you included the --enable_all or --enable_apis flag, the script enables the required APIS:

required_apis() {
    cat << EOF
  case "${CA}" in

If you included the --enable_all or --enable_gcp_iam_roles flag, the script sets the required IAM permissions.

Setting up your cluster

The script does the following updates to your cluster if you have included the --enable_all flag, or one of the more granular enablement flags listed below:

Cluster update Flag
Enables Workload Identity, which lets GKE applications safely access Google Cloud services. --enable_gcp_components
Enables Cloud Monitoring and Cloud Logging on GKE --enable_gcp_components
Sets the mesh_idlabel on the cluster, which is required for metrics to get displayed on the Anthos Service Mesh pages in the Google Cloud console. --enable_cluster_labels
Sets a label like asmv=asm-186-8 so that you can tell that the cluster was modified by the script. --enable_cluster_labels
Binds the GCP user or service account running the script to the `cluster-admin` role on your cluster. --enable_cluster_roles

What's next