Troubleshoot ambient networking

Autopilot Standard

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

Note: Before using GKE ambient networking, you must be added to an allowlist. Request access to the allowlist by filling out the sign-up form.

This page shows you how to troubleshoot and verify Google Kubernetes Engine (GKE) ambient networking. It provides instructions for checking the health of in-cluster ambient components, diagnosing traffic authentication and authorization issues, verifying certificate issuance, and inspecting metrics and logs.

Verify components are installed and healthy

In-cluster components for Cloud Service Mesh ambient mode are installed in the gke-managed-ambient namespace. You can see the status of all relevant Pods with the following command:

kubectl get pods -n gke-managed-ambient

Verify traffic is authenticated and authorized

Using Logs Explorer in Google Cloud console, check the access logs that correspond to the connections of interest:

resource.type="k8s_container"
resource.labels.location="CLUSTER_LOCATION"
resource.labels.cluster_name="CLUSTER_NAME"
logName="projects/PROJECT_ID/logs/gke-ambient-node-proxy-accesslog"

The access logs display connection details, including authentication and authorization status.

Log format

Field	Type	Description
connection	struct	Connection information.
connection.src_ip	string	Source IP of the connection.
connection.src_port	int	Source port of the connection.
connection.dest_ip	string	Destination IP of the connection.
connection.dest_port	int	Destination port of the connection.
connection.direction	string	Direction of the connection: {ingress, egress}
src	struct	Endpoint information of the source.
src.spiffe_id	string	The SPIFFE identity of the Pod. Empty if the Pod does not have a SPIFFE identity.
dst	struct	Endpoint information of the destination.
dst.spiffe_id	string	The SPIFFE identity of the Pod. Empty if the Pod does not have a SPIFFE identity.
error_details	string	Details about the error that occurred (or - if no error occurred).
timestamp	string	Time when the connection was observed (UTC).
tls_failure_reason	string	TLS handshake failure reason. null if the connection is not TLS.

Verify certificates are successfully issued

Use the following command to inspect the status of CertificateSigningRequests for workload Pods in your cluster:

kubectl get csr

You should see "Approved,Issued" conditions similar to the following:

NAME                           AGE   SIGNERNAME                 CONDITION
gke-ambient-spiffe-csr-q8kqh   2s    spiffe.gke.io/fleet-svid   Approved,Issued
gke-ambient-spiffe-csr-t5px2   7s    spiffe.gke.io/fleet-svid   Approved,Issued

Network Services Monitoring metrics

In addition to standard Cloud Observability metrics, Cloud Service Mesh ambient networking integrates with Network Services Monitoring to provide detailed Layer 4 network telemetry.

For more information, see the Network Services Monitoring overview and the Network Services Monitoring metrics reference.