Install Cloud Service Mesh for Kubernetes workloads off Google Cloud

This page explains how to install unmanaged, in-cluster Cloud Service Mesh for Kubernetes workloads off Google Cloud:

  • Run asmcli to do a new installation of Cloud Service Mesh 1.30.4-asm.1.
  • Optionally, deploy an ingress gateway.
  • Deploy or redeploy your workloads to inject sidecar proxies.

If you need to install unmanaged, in-cluster Cloud Service Mesh with an istiod control plane on GKE, see Install in-cluster Cloud Service Mesh on Google Cloud. Note that for Kubernetes workloads on Google Cloud, we recommend provisioning a managed control plane

For instructions to prepare an offline installation of Cloud Service Mesh, see Prepare an offline installation of Cloud Service Mesh You will need to specify the --offline and --output_dir options when running asmcli install.

Limitations

Note the following limitations:

  • All Cloud Service Mesh clusters for one mesh must be registered to the same fleet at all times to use Cloud Service Mesh. Other clusters in the project of a Cloud Service Mesh cluster must not be registered to a different fleet.

  • The asmcli tool must have access to the Google Kubernetes Engine (GKE) endpoint. You can configure access through a "jump" server, such as a Compute Engine VM within the Virtual Private Cloud (VPC) giving specific access.

Before you begin

Before you begin, make sure that you:

Roles required to install in-cluster Cloud Service Mesh

The following table describes the roles that are required to install in-cluster Cloud Service Mesh.

Role name Role ID Grant location Description
GKE Hub Admin roles/gkehub.admin Fleet project Full access to GKE Hubs and related resources.
Kubernetes Engine Admin roles/container.admin Cluster project. Note that this role must be granted in both Fleet and cluster project for cross-project bindings. Provides access to full management of Container Clusters and their Kubernetes API objects.
Mesh Config Admin roles/meshconfig.admin Fleet and cluster project Provides permissions required to initialize managed components of Cloud Service Mesh, such as managed control plane and backend permission that allows workloads to talk to Stackdriver without each being individually authorized (for both managed and in-cluster control planes).
Project IAM Admin roles/resourcemanager.projectIamAdmin Cluster project Provides permissions to administer IAM policies on projects.
Service Account Admin roles/iam.serviceAccountAdmin Fleet project Authenticate as a service account.
Service Management Admin roles/servicemanagement.admin Fleet project Full control of Google Service Management resources.
Service Usage Admin roles/serviceusage.serviceUsageAdmin Fleet project Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project.(Note 1)
CA Service Admin Beta roles/privateca.admin Fleet project Full access to all CA Service resources. (Note 2)

Notes:

  1. Service Usage Admin - This role is necessary as a prerequisite to enable the mesh.googleapis.com API when initially provisioning managed Cloud Service Mesh.
  2. CA Service Admin - This role is only required if you are integrating with CA Service.

Install Cloud Service Mesh

The following outlines how to install Cloud Service Mesh:

  1. Run asmcli install to install the in-cluster control plane on a single cluster. See the following sections for command line examples. The examples contain both required arguments and optional arguments that you might find useful. We recommend that you always specify the output_dir argument so that you can locate sample gateways and tools such as istioctl. See the navigation bar on the right for a list of the examples.

  2. Optionally, install an ingress gateway. By default, asmcli doesn't install the istio-ingressgateway. We recommend that you deploy and manage the control plane and gateways separately. If you need the default istio-ingressgateway installed with the in-cluster control plane, include the --option legacy-default-ingressgateway argument.

  3. To complete setting up Cloud Service Mesh, you need to enable automatic sidecar injection and deploy or redeploy workloads.

  4. If you are installing Cloud Service Mesh on more than one cluster, run asmcli install on each cluster. When you run asmcli install, be sure to use the same FLEET_PROJECT_ID for each cluster. After Cloud Service Mesh is installed, see the instructions to set up a multi-cluster mesh off Google Cloud.

  5. If your clusters are on different networks (as they are in island mode then you should pass a unique network name to asmcli using the --network_id flag.

Install default features and Mesh CA

This section shows how to run asmcli to install Cloud Service Mesh with the default supported features for your platform and enable Cloud Service Mesh certificate authority as the certificate authority.

On-premises

Run the following commands on Google Distributed Cloud (software only) for VMware or Google Distributed Cloud (software only) for bare metal to install the control plane with default features and Cloud Service Mesh certificate authority. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca mesh_ca
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --ca mesh_ca Use Cloud Service Mesh certificate authority as the certificate authority. asmcliconfigures Cloud Service Mesh certificate authority to use fleet workload identity

To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

AWS

Run the following commands on GKE on AWS to install the control plane with default features and Cloud Service Mesh certificate authority. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca mesh_ca
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --ca mesh_ca Use Cloud Service Mesh certificate authority as the certificate authority. asmcliconfigures Cloud Service Mesh certificate authority to use fleet workload identity.

To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

Azure

Run the following commands on GKE on Azure to install the control plane with default features and Cloud Service Mesh certificate authority. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca mesh_ca
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --ca mesh_ca Use Cloud Service Mesh certificate authority as the certificate authority. asmcliconfigures Cloud Service Mesh certificate authority to use fleet workload identity.

To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

Amazon EKS

Run the following commands on Amazon EKS to install the control plane with default features and Cloud Service Mesh certificate authority. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --option attached-cluster \
  --network_id default \
  --ca mesh_ca
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --option attached-cluster Changes the default signing utility to be istiod.
    • --network_id If you are setting up a multi-network mesh, then set the --network_id to a unique value for each cluster in the mesh.
    • --ca mesh_ca Use Cloud Service Mesh certificate authority as the certificate authority. asmcliconfigures Cloud Service Mesh certificate authority to use fleet workload identity.

To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

Microsoft AKS

Run the following commands on Microsoft AKS to install the control plane with default features and Cloud Service Mesh certificate authority. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    HUB_REGISTRATION_EXTRA_FLAGS=--has-private-issuer ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --option attached-cluster \
  --network_id default \
  --ca mesh_ca
    • HUB_REGISTRATION_EXTRA_FLAGS=--has-private-issuer Allows registration with GKE GKE Fleet.
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --option attached-cluster Changes the default signing utility to be istiod.
    • --network_id If you are setting up a multi-network mesh, then set the --network_id to a unique value for each cluster in the mesh.
    • --ca mesh_ca Use Cloud Service Mesh certificate authority as the certificate authority. asmcliconfigures Cloud Service Mesh certificate authority to use fleet workload identity.

To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

Install default features and Certificate Authority (CA) Service

This section shows how to run asmcli to install Cloud Service Mesh with the default supported features for your platform and enable CA Service as the certificate authority.

In addition to Cloud Service Mesh certificate authority, you can configure Cloud Service Mesh to use Certificate Authority Service. This guide provides you an opportunity to integrate with CA Service, which is recommended for the following use cases:

  • If you need different certificate authorities to sign workload certificates on different clusters.
  • If you need to back your signing keys in a Cloud HSM.
  • If you are in a highly regulated industry and are subject to compliance.
  • If you want to chain up your Cloud Service Mesh CA to a custom enterprise root certificate to sign workload certificates.

The cost of Cloud Service Mesh certificate authority is included in the Cloud Service Mesh pricing. The CA Service isn't included in the base Cloud Service Mesh price and is charged separately. Additionally, CA Service comes with an explicit SLA, but the Cloud Service Mesh certificate authority does not.

Configure CA Service

  1. Create the CA pool in the tier DevOps and in the same region as the cluster that it serves to avoid excessive latency issues or potential cross-region outages. For more information, see Workload-optimized tiers.
  2. Create the CA to have at least one active certificate authority in the CA pool in the same project as the GKE cluster. Use subordinate CA's to sign Cloud Service Mesh workload certificates. Note down the CA pool corresponding to the subordinate CA.

  3. If it is meant to only service certificates for Cloud Service Mesh workloads, set up the following issuance policy for the CA pool:

    policy.yaml

    baselineValues:
  keyUsage:
    baseKeyUsage:
      digitalSignature: true
      keyEncipherment: true
    extendedKeyUsage:
      serverAuth: true
      clientAuth: true
  caOptions:
    isCa: false
identityConstraints:
  allowSubjectPassthrough: false
  allowSubjectAltNamesPassthrough: true
  celExpression:
    expression: subject_alt_names.all(san, san.type == URI && san.value.startsWith("spiffe://PROJECT_ID.svc.id.goog/ns/") )

  4. To update the CA pool's issuance policy, use the following command:

    gcloud privateca pools update CA_POOL --location ca_region --issuance-policy policy.yaml

    For information on setting a policy on a pool, see Using a certificate issuance policy.

  5. If you are using a certificate template, then configure it now. For more information, follow the CA Service guide for workload identity certificates. Ensure the certificate template is created in the same region as the CA pool. If there are multiple regions for CA pools, then create a certificate template per region.

Configure Cloud Service Mesh to use CA Service

Run the following commands on Google Distributed Cloud (software only) for VMware or Google Distributed Cloud (software only) for bare metal to install the control plane with default features and Certificate Authority Service. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install:

    ./asmcli install \
  --kubeconfig KUBECONFIG_FILE \
  --fleet_id FLEET_PROJECT_ID \
  --output_dir DIR_PATH \
  --enable_all \
  --ca gcp_cas \
  --platform multicloud \
  --ca_pool  projects/CA_POOL_PROJECT_ID/locations/ca_region/caPools/CA_POOL
    • --fleet_id The project ID of the fleet host project.
    • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
    • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
    • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
    • --enable_all Allows the script to:
      • Grant required IAM permissions.
      • Enable the required Google APIs.
      • Set a label on the cluster that identifies the mesh.
      • Register the cluster to the fleet if it isn't already registered.
    • --ca gcp_cas Use Certificate Authority Service as the certificate authority. Changing certificate authorities during an upgrade causes downtime. asmcliconfigures Certificate Authority Service to use fleet workload identity
    • --ca_pool The full identifier for the Certificate Authority Service CA Pool. If you are using a certificate template, then append the template id separated by :. For example: 
        --ca_pool projects/CA_POOL_PROJECT_ID/locations/ca_region/caPools/CA_POOL:projects/CA_POOL_PROJECT_ID/locations/ca_region/certificateTemplates/CERT_TEMPLATE_ID

    To view SLOs and infrastructure metrics in the Cloud Service Mesh UI, you must also perform the first three steps in Enable application logging and monitoring. If logging and monitoring are not enabled and do not receive custom logs and metrics, the Cloud Service Mesh dashboard will not display SLOs, error logs, or CPU and memory metrics.

Install default features with Istio CA

This section explains how to:

  • Generate certificates and keys for the Istio CA that Cloud Service Mesh uses to sign your workloads.
  • Run asmcli to install Cloud Service Mesh with default features and enable Istio CA.

By default environments that install Cloud Service Mesh with Istio CA report metrics to Prometheus. If you want to use the Cloud Service Mesh dashboards, you must enable Stackdriver. For more information, see Install with optional features.

For the best security, we highly recommend maintaining an offline root CA and using the subordinate CAs to issue certificates for each cluster. For more information, see Plug in CA Certificates. In this configuration, all workloads in the service mesh use the same root certificate authority (CA). Each Cloud Service Mesh CA uses an intermediate CA signing key and certificate, signed by the root CA. When multiple CAs exist within a mesh, this establishes a hierarchy of trust among the CAs. You can repeat these steps to provision certificates and keys for any number of certificate authorities.

The Makefile to generate the certificates is located in the istio-1.30.4-asm.1 subdirectory in the --output_dir directory that you specified in the asmcli validate command. If you didn't run asmcli validate, or you don't have the downloaded directory locally, you can get the Makefile by downloading the Cloud Service Mesh installation file and extracting the contents.

  1. Change to the istio-1.30.4-asm.1 directory.

  2. Create a directory for the certificates and keys:

    mkdir -p certs && \
pushd certs

  3. Generate a root certificate and key:

    make -f ../tools/certs/Makefile.selfsigned.mk root-ca

    This generates these files:

    • root-cert.pem: the root certificate
    • root-key.pem: the root key
    • root-ca.conf: the configuration for openssl to generate the root certificate
    • root-cert.csr: the CSR for the root certificate

  4. Generate an intermediate certificate and key:

    make -f ../tools/certs/Makefile.selfsigned.mk cluster1-cacerts

    This generates these files in a directory named cluster1:

    • ca-cert.pem: the intermediate certificates
    • ca-key.pem: the intermediate key
    • cert-chain.pem: the certificate chain which istiod uses
    • root-cert.pem: the root certificate

    If you perform these steps using an offline computer, copy the generated directory to a computer with access to the clusters.

  5. Return to the previous directory:

    popd

  6. Run asmcli to install a mesh using Istio CA:

    On-premises

    Run the following commands on Google Distributed Cloud (software only) for VMware or Google Distributed Cloud (software only) for bare metal to install the control plane with default features and Istio CA. Enter your values in the provided placeholders.

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca citadel \
  --ca_cert CA_CERT_FILE_PATH \
  --ca_key CA_KEY_FILE_PATH \
  --root_cert ROOT_CERT_FILE_PATH \
  --cert_chain CERT_CHAIN_FILE_PATH
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate
      • --ca_key The key for the intermediate certificate
      • --root_cert The root certificate
      • --cert_chain The certificate chain

    AWS

    Run the following commands on GKE on AWS to install the control plane with default features and Istio CA. Enter your values in the provided placeholders. You can choose to enable Ingress for the public subnet or the private subnet.

    Public

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca citadel \
  --ca_cert CA_CERT_FILE_PATH \
  --ca_key CA_KEY_FILE_PATH \
  --root_cert ROOT_CERT_FILE_PATH \
  --cert_chain CERT_CHAIN_FILE_PATH
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate.
      • --ca_key The key for the intermediate certificate.
      • --root_cert The root certificate.
      • --cert_chain The certificate chain.

    Private

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Save the following YAML to a file called istio-operator-internal-lb.yaml:

      apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    ingressGateways:
    - enabled: true
      k8s:
        serviceAnnotations:
          service.beta.kubernetes.io/aws-load-balancer-internal: "true"
      name: istio-ingressgateway

    3. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca citadel \
  --ca_cert FILE_PATH \
  --ca_key FILE_PATH \
  --root_cert FILE_PATH \
  --cert_chain FILE_PATH \
  --custom_overlay istio-operator-internal-lb.yaml
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate.
      • --ca_key The key for the intermediate certificate.
      • --root_cert The root certificate.
      • --cert_chain The certificate chain.
      • --custom_overlay The name of the overlay file created. For more information about overlay files, see Enabling optional features on the in-cluster control plane

    Azure

    Run the following commands on GKE on Azure to install the control plane with default features and Istio CA. Enter your values in the provided placeholders. You can choose to enable Ingress for the public subnet or the private subnet.

    Public

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca citadel \
  --ca_cert CA_CERT_FILE_PATH \
  --ca_key CA_KEY_FILE_PATH \
  --root_cert ROOT_CERT_FILE_PATH \
  --cert_chain CERT_CHAIN_FILE_PATH
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate.
      • --ca_key The key for the intermediate certificate.
      • --root_cert The root certificate.
      • --cert_chain The certificate chain.

    Private

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Save the following YAML to a file called istio-operator-internal-lb.yaml:

      apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    ingressGateways:
    - enabled: true
      k8s:
        serviceAnnotations:
          service.beta.kubernetes.io/aws-load-balancer-internal: "true"
      name: istio-ingressgateway

    3. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --ca citadel \
  --ca_cert FILE_PATH \
  --ca_key FILE_PATH \
  --root_cert FILE_PATH \
  --cert_chain FILE_PATH \
  --custom_overlay istio-operator-internal-lb.yaml
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate.
      • --ca_key The key for the intermediate certificate.
      • --root_cert The root certificate.
      • --cert_chain The certificate chain.
      • --custom_overlay The name of the overlay file created. For more information about overlay files, see Enabling optional features on the in-cluster control plane

    Amazon EKS

    Run the following commands on Amazon EKS to install the control plane with default features and Istio CA. Enter your values in the provided placeholders.

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Run asmcli install:

      ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --option attached-cluster \
  --ca citadel \
  --ca_cert CA_CERT_FILE_PATH \
  --ca_key CA_KEY_FILE_PATH \
  --root_cert ROOT_CERT_FILE_PATH \
  --cert_chain CERT_CHAIN_FILE_PATH \
  --network_id default
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • --option attached-cluster Changes the default signing utility to be istiod.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate
      • --ca_key The key for the intermediate certificate
      • --root_cert The root certificate
      • --cert_chain The certificate chain
      • --network_id If you are setting up a multi-network mesh, then set the --network_id to a unique value for each cluster in the mesh.

    Microsoft AKS

    Run the following commands on Microsoft AKS to install the control plane with default features and Istio CA. Enter your values in the provided placeholders.

    1. Set the current context to your user cluster:

      kubectl config use-context CLUSTER_NAME

    2. Run asmcli install:

      HUB_REGISTRATION_EXTRA_FLAGS=--has-private-issuer ./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --option attached-cluster \
  --ca citadel \
  --ca_cert CA_CERT_FILE_PATH \
  --ca_key CA_KEY_FILE_PATH \
  --root_cert ROOT_CERT_FILE_PATH \
  --cert_chain CERT_CHAIN_FILE_PATH \
  --network_id default
      • HUB_REGISTRATION_EXTRA_FLAGS=--has-private-issuer Allows registration with GKE GKE Fleet.
      • --fleet_id The project ID of the fleet host project.
      • --kubeconfig The full path to the kubeconfig file. The environment variable $PWD doesn't work here. Additionally, relative kubeconfig file locations that use a `~` will not work.
      • --output_dir Include this option to specify a directory where asmcli downloads the anthos-service-mesh package and extracts the installation file, which contains istioctl, samples, and manifests. Otherwise asmcli downloads the files to a tmp directory. You can specify either a relative path or a full path. The environment variable $PWD doesn't work here.
      • --platform multicloud Specifies that the platform is something other than Google Cloud, such as on-premises or multi-cloud.
      • --enable_all Allows the script to:
        • Grant required IAM permissions.
        • Enable the required Google APIs.
        • Set a label on the cluster that identifies the mesh.
        • Register the cluster to the fleet if it isn't already registered.
      • --option attached-cluster Changes the default signing utility to be istiod.
      • -ca citadel Use Istio CA as the certificate authority.
      • --ca_cert The intermediate certificate
      • --ca_key The key for the intermediate certificate
      • --root_cert The root certificate
      • --cert_chain The certificate chain
      • --network_id If you are setting up a multi-network mesh, then set the --network_id to a unique value for each cluster in the mesh.

Install with Istio CA with Google Cloud Observability enabled

If you want to use Cloud Service Mesh dashboards, you must enable Stackdriver.

On-premises

Run the following commands on Google Distributed Cloud (software only) for VMware or Google Distributed Cloud (software only) for bare metal to install the control plane with Stackdriver and other optional features features and Istio CA. Enter your values in the provided placeholders.

  1. Set the current context to your user cluster:

    kubectl config use-context CLUSTER_NAME

  2. Run asmcli install: