Anthos / GKE Enterprise Complete Guide: Multi-Cloud Kubernetes, Fleet & Service Mesh

GKE Enterprise (formerly Anthos) is Google Cloud's unified multi-cloud and hybrid Kubernetes platform. It combines Fleet management, Config Sync, Policy Controller, and Anthos Service Mesh to centrally operate Kubernetes environments spanning GCP, AWS, Azure, on-prem, and edge locations.

Core Features

• Fleet: Logical unit for managing multiple clusters together
• Config Sync: Automated configuration sync via GitOps
• Policy Controller: Policy enforcement built on OPA Gatekeeper
• Anthos Service Mesh: Managed Istio (mTLS, traffic control, observability)
• Multi-cluster Ingress / Services: Cross-cluster communication
• Backup for GKE: Velero-based backup
• Binary Authorization: Run only signed container images
• Identity Service: Unified OIDC / SAML authentication

Supported Platforms

Fleet (Fleet Management)

• Group multiple Kubernetes clusters into logical units
• Identity Unification: integrated Workload Identity
• Namespace sync: automatically propagate Fleet namespaces
• Cross-cluster Service Discovery
• Multi-cluster Ingress / Gateway

Config Sync (GitOps)

# RootSync 設定例
apiVersion: configsync.gke.io/v1beta1
kind: RootSync
metadata:
  name: root-sync
  namespace: config-management-system
spec:
  sourceFormat: unstructured
  git:
    repo: https://github.com/my-org/k8s-config.git
    branch: main
    dir: clusters/prod
    auth: ssh

# Repository 構造例
clusters/prod/
├── namespaces/
│   ├── production/
│   │   ├── deployment.yaml
│   │   └── service.yaml
│   └── monitoring/
└── cluster-scoped/
    ├── clusterrole.yaml
    └── networkpolicy.yaml

Policy Controller

# OPA Constraint Template 例: 全 Pod に Resource Limit 必須
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredresources
spec:
  crd:
    spec:
      names: { kind: K8sRequiredResources }
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredresources
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := sprintf("Container %v has no CPU limit", [container.name])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
  name: require-resource-limits
spec:
  match:
    kinds: [{ apiGroups: [""], kinds: ["Pod"] }]

Anthos Service Mesh (ASM)

• Managed Istio service mesh
• mTLS encrypts all pod-to-pod traffic
• Per-pod access control via Authorization Policy
• Traffic splitting (Canary / Blue-Green)
• Telemetry: automatic trace, metric, and log collection
• Integrated Cloud Monitoring dashboards

Pricing Example

Multi-Cloud Kubernetes Comparison

Typical Use Cases

• Multi-cloud strategy (running Kubernetes on both AWS and GCP)
• Regulated industries (hybrid on-prem + GCP)
• Edge computing (Kubernetes at stores or factories with central management)
• Microservice governance and audit for financial institutions
• Government agencies (Sovereign Cloud + GCP)
• Consolidating heterogeneous Kubernetes environments after M&A

* Google Cloud is a trademark of Google LLC. For the latest information, see the official GKE Enterprise page.