GKE feature matrix for Google Distributed Cloud connected

This page describes the availability of various Kubernetes and GKE features on Distributed Cloud connected. Because Distributed Cloud connected is a managed platform, Google manages many of the underlying platform features.

The following tables summarize whether a feature is available, who manages it, and how its behavior might differ from standard Kubernetes or cloud-based GKE.

Cluster management and lifecycle

Feature Availability Managed by Description and differences
Control plane Available Google Google fully provisions and manages the Kubernetes control plane. You can't access or modify control plane components.
Worker node operating system (OS) Available Google Google provisions and manages the operating system on the worker nodes.
Cluster upgrades Available Google (default) or You (optional) Google automatically schedules and performs cluster upgrades by default. You can opt out of automatic upgrades by choosing the NONE release channel. You can manually trigger upgrades using the Google Cloud CLI or the API. For more information, see Upgrade the software version of a cluster.
Fleet registration Available Google Clusters are automatically registered to a Google Cloud Fleet upon creation.
SSH access to nodes Unavailable Not applicable Direct SSH access to worker nodes isn't available.
Cluster autoscaler Unavailable Not applicable Because the physical hardware capacity is fixed, cluster autoscaling isn't supported.
Node auto-provisioning Unavailable Not applicable Not supported because the physical hardware capacity is fixed.
Survivability mode Available Google If disconnected from Google Cloud, your clusters enter survivability mode, and workloads continue to run for up to 7 days. For more information, see Survivability mode.

Compute and workloads

Feature Availability Managed by Description and differences
Linux containers Available You You deploy and manage standard Kubernetes container workloads. For more information, see Deploy workloads.
Virtual machines (VM Runtime on GDC) Available You You deploy and manage virtual machine guest workloads alongside containers using the Google-managed VM runtime. VM workloads are supported only on Distributed Cloud connected servers, and aren't supported on refreshed rack hardware. For more information, see Manage virtual machines.
GPU workloads Available You Supported on select hardware configurations. You manage the workload deployments. For more information, see Manage GPU workloads.
Horizontal pod autoscaling (HPA) Available You You can use HPA to automatically scale your workloads based on resource utilization (CPU and memory) using standard Kubernetes manifests. Because the physical hardware capacity is fixed, you must manage your overall cluster capacity and configure resource quotas. GKE-specific HPA features, such as traffic-based autoscaling and HPA performance profiles, are not supported. For more information, see Configure horizontal Pod autoscaling.
Custom resource definitions (CRDs) Available You You can deploy and manage CRDs to extend the Kubernetes API for your own workloads. Because Distributed Cloud connected is a managed environment, Google doesn't support or troubleshoot user-installed CRDs or operators. You must not modify or delete Google-managed system CRDs. For more information, see the Kubernetes Custom Resources documentation.
Preemptible or Spot VMs Unavailable Not applicable Not supported on dedicated hardware.
Windows Server nodes Unavailable Not applicable Windows nodes (Kubernetes worker nodes) aren't supported. However, you can run Windows Server guest workloads as virtual machines using VM Runtime on GDC.
Host namespaces Unavailable Not applicable User workloads can't run in the host's PID, IPC, or network namespaces.
Privileged containers Unavailable Not applicable User containers can't be run in privileged mode (securityContext.privileged: true).
Control plane node scheduling Unavailable Not applicable You can't schedule user workloads on control plane nodes. Under node toleration restrictions, scheduling Pods with control plane toleration keys is blocked.

Networking

Feature Availability Managed by Description and differences
Network Function operator Available Google Google installs and manages the Network Function operator. You configure advanced networking scenarios, such as VLANs, using the custom resources provided by the operator. For more information, see Network Function operator.
Ingress Available You You can configure an Ingress resource for your workloads using the provided network features. For more information, see Networking features of Distributed Cloud connected.
Service load balancing Available You You can expose your workloads to your local network using standard Kubernetes services of type LoadBalancer, which are backed by a bundled MetalLB Layer 2 load balancer. For more information, see Load balancing.
Network policies Available You Standard Kubernetes network policies are supported for workload traffic control. For more information, see Control communication between Pods and Services using network policies.
Cluster DNS Available Google Google installs and manages the underlying cluster DNS components. You configure the upstream name servers and domain-specific routing rules using the ClusterDNS custom resource. For more information, see Configure DNS for a cluster.
Multiple network interfaces (multi-NIC) for Pods Available You You can connect your Pods to multiple network interfaces to separate different types of traffic or to connect workloads to secondary networks. You configure the networks and subnetworks using Distributed Cloud connected custom resources. The MacVLAN driver isn't supported on Pods running virtual machines. For more information, see Create and manage networks.

Storage

Feature Availability Managed by Description and differences
Storage classes Available You (configuration) and Google (updates) You configure and manage Symcloud Storage classes, including setting the default storage class. Google manages software updates for the underlying bundled software-defined storage solution. For more information, see Symcloud Storage classes.
Persistent volume claims Available You You create persistent volume claims to request persistent storage for your workloads. Only the ReadWriteOnce (RWO) access mode is supported. ReadWriteMany (RWX) is not supported. For more information, see Configure abstracted Symcloud Storage volumes for workloads.
External block storage Unavailable Not applicable Not supported on dedicated Distributed Cloud connected hardware. Workloads must use the configured local software-defined storage classes (Symcloud Storage).
hostPath volumes Available Google (policies) and you (configuration) Use hostPath volumes only as a highly restricted fallback, not as a recommended design pattern for general storage. For standard application volumes and VM disks, we recommend using network-based storage classes or PersistentVolumeClaims. To support low-level hardware pass-through and networking configuration, Google enforces policy controller webhooks that restrict read/write access to the following directories: /dev/hugepages, /dev/infiniband, /dev/vfio, /dev/char, and /sys/devices.
Volume types Available You User workloads support only a restricted set of volume types: configMap, csi, downwardAPI, emptyDir, nfs, persistentVolumeClaim, projected, and secret.

Security and identity

Feature Availability Managed by Description and differences
Workload Identity Available Google Fleet Workload Identity Federation is the default and is configured automatically for your clusters. For more information, see Workload Identity Cluster Authentication.
Workload role-based access control (RBAC) Available You You configure RBAC for your users and workloads. For more information, see Roles and permissions.
Platform RBAC Available Google Google manages RBAC for system components and the control plane. For more information, see Roles and permissions.
External Secrets Operator Available You You install and manage the External Secrets Operator to securely retrieve secrets from Secret Manager for your workloads. For more information, see Use External Secrets Operator.
User and group impersonation Unavailable Not applicable Kubernetes user and group impersonation isn't supported.
CertificateSigningRequest Unavailable Not applicable Workloads can't request X.509 certificate issuance through the standard Kubernetes CertificateSigningRequest resource type.

Observability and configuration

Feature Availability Managed by Description and differences
Audit logging Available Google Audit logs are automatically collected and routed to Cloud Logging. For more information, see Google Distributed Cloud connected audit logging.
Platform metrics and logs Available Google Google monitors the health and performance of platform components. For more information, see Logs and metrics.
Application metrics and logs Available You You are responsible for monitoring your own application workloads. For more information, see Logs and metrics.
Fleet packages Available You You can use Config Sync fleet packages to automate the deployment of configurations across your clusters. For more information, see Use fleet packages in Distributed Cloud connected.