This page shows the Google Cloud features that
are available on each of the following environments:

- [Google Kubernetes Engine (GKE) on Google Cloud](https://docs.cloud.google.com/kubernetes-engine/docs)
- Google Distributed Cloud (GKE on-premises):
  - [On VMware](https://docs.cloud.google.com/anthos/clusters/docs/on-prem)
  - [On bare metal](https://docs.cloud.google.com/anthos/clusters/docs/bare-metal/latest)
  - [Google Distributed Cloud connected deployments](https://docs.cloud.google.com/distributed-cloud/edge/latest/docs/overview)
- GKE Multi-Cloud:
  - [GKE on AWS](https://docs.cloud.google.com/anthos/clusters/docs/multi-cloud/aws)
  - [GKE on Azure](https://docs.cloud.google.com/anthos/clusters/docs/multi-cloud/azure)
  - [GKE attached clusters](https://docs.cloud.google.com/anthos/clusters/docs/multi-cloud/attached), which are third-party Kubernetes clusters registered to your [fleet](https://docs.cloud.google.com/kubernetes-engine/fleet-management/docs).

This page is for Operators who define IT solutions and system
architecture in accordance with company strategy in coordination with key
stakeholders. To learn more about common roles and example tasks that we
reference in Google Cloud content, see [Common GKE
user roles and tasks](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/concepts/roles-tasks).

## Enable GKE and related features

This section describes how to enable the features that are described on
this page.

### Enable GKE

To enable GKE, enable the GKE API.

[Enable GKE API](https://console.cloud.google.com/apis/enableflow?apiid=container.googleapis.com)

Enabling this API gives you access to the GKE, which includes
the following features:

- [Config Sync](https://docs.cloud.google.com/anthos-config-management/docs/config-sync-overview)
- [Policy Controller](https://docs.cloud.google.com/anthos-config-management/docs/concepts/policy-controller)
- [Config Controller](https://docs.cloud.google.com/anthos-config-management/docs/concepts/config-controller-overview)
- [Migrate to Containers](https://docs.cloud.google.com/migrate/containers/docs/getting-started)
- [GKE Identity Service](https://docs.cloud.google.com/kubernetes-engine/enterprise/identity/setup/fleet)
- [Cloud Logging](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-logs#default-logs-enterprise) and [Cloud Monitoring](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/configure-metrics#default-metrics-enterprise) for GKE system components
- [Security posture dashboard](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard)
- [Node to node encryption](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/enable-inter-node-transparent-encryption)
- [FQDN network policies](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies)

### Enable related products and features

To use the following products and features with GKE, you must
enable each of these features individually. For more information, see the
following links.

- [Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/overview)
- [Binary Authorization](https://docs.cloud.google.com/binary-authorization/docs/enabling)
- [Multi Cluster Ingress](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/multi-cluster-ingress)

See the following pricing guides for detailed information about how these
products and features are billed.

- [Cloud Service Mesh](https://cloud.google.com/service-mesh/pricing)
- [Binary Authorization](https://cloud.google.com/binary-authorization/pricing)
- [Multi Cluster Ingress](https://cloud.google.com/kubernetes-engine/pricing#multi-cluster-gateway-and-multi-cluster-ingress)

## Features available on GKE clusters on Google Cloud

To use some features, you must register the cluster to a [fleet](https://docs.cloud.google.com/kubernetes-engine/fleet-management/docs).
You can see which features require fleets in the following table.

A small number of features aren't supported on
[Autopilot
clusters](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview). These are also
shown in the table.

| **Feature** | **Available on GKE standard clusters** | **Available on Autopilot clusters** | **Available without fleet membership** |
|---|---|---|---|
| Config Sync | Yes | Yes | No |
| Policy Controller | Yes | Yes | No |
| Config Controller | Yes | Yes | No |
| Cloud Service Mesh in-cluster | Yes | No | No |
| Managed Cloud Service Mesh | Yes | Yes | No |
| Knative serving | Yes | No | No |
| Migrate to Containers | Yes | Yes | Yes |
| GKE Identity Service | Yes | Yes | No |
| Binary Authorization | Yes | Yes | Yes |
| Multi Cluster Ingress | Yes | Yes | No |
| Cloud Logging and Cloud Monitoring for GKE system components | Yes | Yes | Yes |
| Advanced security posture and compliance monitoring | Yes | Yes | Yes |
| Node to node encryption | Yes | No | Yes |
| FQDN network policies | Yes | Yes | Yes |

## Features available on clusters outside of Google Cloud

The following tables show which key Google Cloud and
GKE features are available on clusters outside of
Google Cloud.

For more information about which versions of the features
are supported on each environment, see the [version support
matrix](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/version-and-upgrade-support).

### Plugins and load balancers

GKE clusters outside of Google Cloud use a
combination of built-in GKE capabilities along with
platform-native capabilities.

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| Network plugin | Yes | Yes | Yes | Yes | No | Yes |
| Container storage interface (CSI) \& hybrid storage | Yes | Yes | Yes | Yes | No | Yes |
| Bundled L4 load balancer | Yes | Yes | No | No | No | Yes |
| Platform-native load balancers | N/A | N/A | Yes | Yes | No | N/A |

### Operations and management

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | GDC (connected) |
|---|---|---|---|---|---|---|
| [GKE dashboard in the Google Cloud console](https://docs.cloud.google.com/kubernetes-engine/fleet-management/docs/console) | Yes | Yes | Yes | Yes | Yes | Yes |
| [Connect Gateway](https://docs.cloud.google.com/kubernetes-engine/enterprise/multicluster-management/gateway/using) | Yes | Yes | Yes | Yes | Yes | Yes |
| [Cloud Logging and Cloud Monitoring](https://docs.cloud.google.com/stackdriver/docs) | Yes | Yes | Yes | Yes | Yes | Yes |
| [Prometheus/Grafana](https://docs.cloud.google.com/anthos/clusters/docs/on-prem/concepts/logging-and-monitoring#prometheus_and_grafana) | Yes | Yes | No | No | No | No |

### Security and Identity

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [GKE Identity Service](https://docs.cloud.google.com/kubernetes-engine/enterprise/identity) | Yes | Yes | Yes | Yes | No | No |
| [Fleet workload identity](https://docs.cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) | Yes | Yes | Yes | Yes | Yes | Yes |
| [Cloud Audit Logs](https://docs.cloud.google.com/logging/docs/audit) | Yes | Yes | Yes | Yes | No | Yes |
| [Binary Authorization](https://docs.cloud.google.com/binary-authorization) | Yes | Yes | Yes | No | Yes | No |

### Service management

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [Cloud Service Mesh in-cluster](https://docs.cloud.google.com/service-mesh/docs/unified-install/prerequisites) | Yes | Yes | Yes | Yes | Yes\* | No |
| [Managed Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/managed/service-mesh) | No | No | No | No | No | No |
| [Service dashboards in the Google Cloud console](https://docs.cloud.google.com/service-mesh/docs/observability/explore-dashboard) | Yes | Yes | Yes | No | Yes\* | No |
| [Cloud Service Mesh certificate authority](https://docs.cloud.google.com/service-mesh/docs/security/security-overview#mesh_ca) | Yes | Yes | No | No | No | No |
| [Cloud Service Mesh integration with Certificate Authority Service](https://docs.cloud.google.com/service-mesh/docs/security/security-overview#ca_service) | Yes | Yes | No | No | No | No |

^**\*** For the list of attached clusters that
Cloud Service Mesh supports, see
[Supported platforms](https://docs.cloud.google.com/service-mesh/docs/supported-platforms).^

### Configuration management

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [Policy Controller](https://docs.cloud.google.com/anthos-config-management/docs/concepts/policy-controller) | Yes | Yes | Yes | Yes | Yes | No |
| [Config Sync](https://docs.cloud.google.com/anthos-config-management/docs/config-sync-overview) | Yes | Yes | Yes | Yes | Yes | Yes |
| [Config Controller](https://docs.cloud.google.com/anthos-config-management/docs/concepts/config-controller-overview) | Yes | Yes | No | No | No | No |

^**\*** To install Policy Controller, AKS clusters must not
have the Azure Policy add-on.^

### Application deployment

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [Knative serving](https://docs.cloud.google.com/anthos/run/docs/architecture-overview) | Yes | No | No | No | No | No |
| [Google Cloud Marketplace](https://docs.cloud.google.com/marketplace) | Yes | Yes | Yes | Yes | No | No |

### Application migration

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [Migrate to Containers](https://docs.cloud.google.com/migrate/containers/docs/getting-started) | Yes | Yes | Yes | No | No | No |

### VM management

| **Feature** | **GDC (VMware)** | **GDC (bare metal)** | **GKE on AWS** | **GKE on Azure** | **Attached clusters** | **GDC (connected)** |
|---|---|---|---|---|---|---|
| [VM Runtime on Google Distributed Cloud](https://docs.cloud.google.com/anthos/clusters/docs/bare-metal/latest/vm-runtime/overview) | No | Yes | No | No | No | Yes |

## What's next

- [Version and upgrade support](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/version-and-upgrade-support)
- [Managed Cloud Service Mesh supported features](https://docs.cloud.google.com/service-mesh/docs/managed/supported-features-mcp)
- [In-cluster Cloud Service Mesh supported features](https://docs.cloud.google.com/service-mesh/docs/supported-features)