如何通过Terraform为GKE集群（含Autopilot模式）启用Anthos Service Mesh

我有两个通过Terraform创建的GKE集群，其中一个是Autopilot模式。目前已经把这两个集群注册到我的Anthos Fleet（注册代码示例如下），但找不到通过Terraform为它们启用Anthos Service Mesh的相关资料。集群详情页的界面如下：

注册代码示例 #

resource "google_gke_hub_membership" "anthos_registration" {
  provider      = google-beta
  project = var.project_id
  membership_id = google_container_cluster.cluster.name
  endpoint {
    gke_cluster {
      resource_link = "//container.googleapis.com/${google_container_cluster.foobar.id}"
    }
  }
}

要通过Terraform为已注册到Anthos Fleet的GKE集群启用Anthos Service Mesh，需使用google_gke_hub_feature_membership资源（依赖google-beta provider），结合Anthos Service Mesh对应的feature ID servicemesh。

核心配置步骤 #

• 启用必要API
  先在项目中启用Anthos Service Mesh和GKE Hub的API，避免部署时权限不足：

  resource "google_project_service" "servicemesh_api" {
    provider = google-beta
    project  = var.project_id
    service  = "servicemesh.googleapis.com"
  }
  
  resource "google_project_service" "gkehub_api" {
    provider = google-beta
    project  = var.project_id
    service  = "gkehub.googleapis.com"
  }
  

• 为集群启用ASM
  针对每个已注册的集群，添加google_gke_hub_feature_membership资源，配置管理模式：

  resource "google_gke_hub_feature_membership" "asm_enable" {
    provider       = google-beta
    project        = var.project_id
    feature        = "servicemesh"
    membership     = google_gke_hub_membership.anthos_registration.membership_id
    service_mesh {
      management = "MANAGEMENT_AUTOMATIC" # 自动管理模式，Autopilot集群推荐使用
    }
  }
  

  • MANAGEMENT_AUTOMATIC：由Google自动维护ASM控制平面和数据平面，无需手动操作，适合Autopilot和标准GKE集群。
  • 若需自定义控制平面部署，可改用MANAGEMENT_MANUAL，但需额外配置控制平面的镜像版本、资源限制等参数。

• Autopilot集群额外注意
  Autopilot集群启用ASM时，Terraform会自动处理平台层面的依赖，但要确保：

  • 集群所在GCP区域支持Anthos Service Mesh
  • 项目拥有ASM控制平面所需的资源配额

完整整合示例 #

将注册集群和启用ASM的代码整合，确保资源依赖顺序正确：

# 启用必要API
resource "google_project_service" "servicemesh_api" {
  provider = google-beta
  project  = var.project_id
  service  = "servicemesh.googleapis.com"
}

resource "google_project_service" "gkehub_api" {
  provider = google-beta
  project  = var.project_id
  service  = "gkehub.googleapis.com"
}

# 注册集群到Anthos Fleet
resource "google_gke_hub_membership" "anthos_registration" {
  provider      = google-beta
  project       = var.project_id
  membership_id = google_container_cluster.cluster.name
  endpoint {
    gke_cluster {
      resource_link = "//container.googleapis.com/${google_container_cluster.cluster.id}"
    }
  }
  depends_on = [google_project_service.gkehub_api]
}

# 启用Anthos Service Mesh
resource "google_gke_hub_feature_membership" "asm_enable" {
  provider       = google-beta
  project        = var.project_id
  feature        = "servicemesh"
  membership     = google_gke_hub_membership.anthos_registration.membership_id
  service_mesh {
    management = "MANAGEMENT_AUTOMATIC"
  }
  depends_on = [google_project_service.servicemesh_api, google_gke_hub_membership.anthos_registration]
}

验证部署结果 #

执行terraform apply完成部署后，可通过GCloud命令验证ASM状态：

gcloud container clusters describe YOUR_CLUSTER_NAME --zone YOUR_CLUSTER_ZONE --format="value(addonsConfig.serviceMeshConfig.enabled)"

返回true则表示ASM已成功启用。

内容的提问来源于stack exchange，提问作者CommonSenseCode