Offboard ambient networking

Autopilot Standard

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

Note: Before using GKE ambient networking, you must be added to an allowlist. Request access to the allowlist by filling out the sign-up form.

Follow these steps to safely disable and remove ambient networking from your cluster.

1. Remove all ambient policies impacting your services, ensuring no policy enforces strict mTLS:

   kubectl delete gcpservertlspolicies -n ambient-test server
   kubectl delete gcpclienttlspolicies -n ambient-test server-mtls
   kubectl delete gcpauthzpolicy -n ambient-test --all
   

2. Remove the label from the relevant namespace to disable traffic interception:

   kubectl label namespace ambient-test networking.gke.io/dataplane-mode-
   

3. Verify that the annotation ambient.networking.gke.io/redirection is removed from all Pods in the Namespace:

   kubectl get pods -n ambient-test -o yaml | grep redirection
   

   The output should be an empty response.

4. Optionally, if you enabled Layer 4 metrics generation, remove the metrics label from the namespace:

   kubectl label namespace ambient-test networking.gke.io/ambient-network-metrics-
   

5. Disable ambient networking at the cluster level to remove ambient components:

   gcloud beta container clusters update CLUSTER_NAME \
       --location=CLUSTER_LOCATION --no-enable-ambient-networking
   

   Replace the following:

   • CLUSTER_NAME: the name of the cluster.
   • CLUSTER_LOCATION: the Compute Engine region or zone of the cluster.