VPC Service Controls for Cloud Service Mesh (Managed)

Cloud Service Mesh (Managed) supports VPC Service Controls as a generally available (GA) feature for new control planes.

To check whether your control plane supports VPC Service Controls GA, check the mesh feature state of your membership for the VPCSC_GA_SUPPORTED condition.

gcloud container fleet mesh describe --project FLEET_PROJECT_ID

The output is similar to:

(...)
membershipStates:
  projects/FLEET_PROJECT_NUMBER/locations/MEMBERSHIP_LOCATION/memberships/MEMBERSHIP_ID:
    servicemesh:
      conditions:
      - code: VPCSC_GA_SUPPORTED
        details: This control plane supports VPC Service Controls GA.
        documentationLink: http://cloud.google.com/service-mesh/v1.29/docs/managed/VPC Service Controls
        severity: INFO
(...)

If you have an existing control plane that does not report the VPCSC_GA_SUPPORTED condition and want to rely on VPC Service Controls, contact support.

Before you begin

The VPC Service Controls org-policy and service perimeter are configured at the organization level. Ensure that you have been granted the proper roles for administering VPC Service Controls.

Set up your VPC Service Controls service perimeter

Create or update your service perimeter:

  1. Add your cluster project(s) and fleet project to the service perimeter. Having a service mesh spread across multiple VPC Service Controls perimeters is not supported.

  2. Add restricted services to the service perimeter.

    You must add specific services to the allowed and restricted services lists in the service perimeter, so that your Cloud Service Mesh cluster can access them. Access to these services is also restricted within your cluster's Virtual Private Cloud (VPC) network.

    Not adding these services may cause the Cloud Service Mesh installation to fail or to not function properly. For example, if you don't add the Mesh Configuration API to the service perimeter, the installation will fail and the workloads won't receive their Envoy configuration from the managed control plane.

    Console

    1. Follow the steps in Updating a service perimeter to edit the perimeter.
    2. Click the Edit VPC Service Perimeter page.
    3. Under Restricted Services, Services to protect, click Add Services.
    4. On the Specify services to restrict dialog, click Filter services, and enter Mesh Configuration API.
    5. Select the service's checkbox.
    6. Click Add Mesh Configuration API.
    7. Repeat steps c - f, to add:
      • Cloud Service Mesh Certificate Authority API
      • GKE Hub API
      • Cloud IAM API