Trying to add GKE instance to a service mesh stalled

[irogers97]

kubectl describe controlplanerevision asm-managed -n istio-system
Name: asm-managed
Namespace: istio-system
Labels: app.kubernetes.io/created-by=mesh.googleapis.com
istio.io/owned-by=mesh.googleapis.com
mesh.cloud.google.com/managed-cni-enabled=true
Annotations: mesh.cloud.google.com/external-mesh: projects/*******/locations/global/meshes/gsmrsvd-j7pjy2ptrbgmual95l3l66-external-mesh
mesh.cloud.google.com/proxy: {"managed":"true"}
API Version: mesh.cloud.google.com/v1beta1
Kind: ControlPlaneRevision
Metadata:
Creation Timestamp: 2025-06-02T12:12:17Z
Generation: 1
Resource Version: 1748870798940927015
UID: d6ecaf5a-f69c-4042-9cc8-0a5064743c57
Spec:
Channel: regular
Type: managed_service
Status:
Conditions:
Last Transition Time: 2025-06-02T13:26:38Z
Message: The provisioning process has not completed successfully
Reason: NotProvisioned
Status: False
Type: Reconciled
Last Transition Time: 2025-06-02T13:26:38Z
Message: Provisioning has finished
Reason: ProvisioningFinished
Status: True
Type: ProvisioningFinished
Last Transition Time: 2025-06-02T13:26:38Z
Message: An internal error has occurred. Please contact customer support. This will be retried within 15 minutes.
Reason: PreconditionFailed
Status: True
Type: Stalled
Events: <none>

[reinc]

Hi @irogers97,

Welcome to Google Cloud Community! 

The output from kubectl describe controlplanerevision asm-managed -n istio-system clearly indicates a problem with your Anthos Service Mesh (ASM) managed control plane provisioning.

This means the system tried to provision the managed control plane, but it hit a PreconditionFailed error, causing the process to stall. While it says "internal error" and "contact customer support," PreconditionFailed often points to an issue in your environment or configuration that Google's systems detected, you may see this documentation for your reference.

The GKE cluster must be correctly registered to a Fleet, and the ASM feature must be enabled on that Fleet.

• Check Fleet Membership:

gcloud container fleet memberships list --project <YOUR_PROJECT_ID>
gcloud container fleet memberships describe <YOUR_MEMBERSHIP_NAME> --project <YOUR_PROJECT_ID>

Ensure the cluster is listed and its state is OK.

• Check ASM Feature on Fleet:

gcloud container fleet mesh describe --project <YOUR_PROJECT_ID>

This should show ASM as enabled and configured. If you used gcloud container fleet mesh enable, ensure it completed successfully.

For more additional reference, you may check this Google Cloud Self-Paced Lab about Installing Cloud Service Mesh on GKE. It illustrates how Cloud Service Mesh simplifies deploying feature-rich Istio service meshes on Anthos clusters.

If the issue still persists and needs further assistance, please feel free to reach out to our Google Cloud Support team to investigate the internal error furthermore.


Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.