Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Cloud SDK 592.0.0 promotes --enable-ambient-networking to a GA CLI flag; the ambient networking product remains in Preview.
- Clusters need GKE 1.36.4-gke.1391000 or later, a region supported by Regional Cloud Service Mesh, Gateway API, Fleet, Workload Identity and Dataplane V2.
- Preview covers single-cluster Layer 4 only. Istio APIs, interoperability with sidecars or proxyless gRPC, headless Services, trafficDistribution and GKE Sandbox have stated limits.
- The per-hour charge for Pods labeled for ambient is not enforced during Preview, but standard Cloud Observability and Certificate Authority Service charges still apply.
Separate the GA command flag from Preview product status
Google Cloud's November 3, 2026 release notes say Cloud SDK 592.0.0 promotes --enable-ambient-networking to GA for gcloud container clusters create, create-auto and update. This describes the release stage of the flag in the gcloud command interface.
The GKE ambient networking overview and preparation pages still mark the product Preview and identify the applicable Pre-GA terms. A GA command flag does not change the product's stage, support scope or other Preview conditions. It also does not establish that a particular project can create or update an eligible cluster.
Check each cluster prerequisite
The preparation page requires GKE 1.36.4-gke.1391000 or later and a cluster in a region supported by Regional Cloud Service Mesh. Before scheduling a change, compare the intended region with the official list. Appearing on that list is a prerequisite, not proof that a specific project, quota or cluster is ready to enable the feature.
Also confirm Gateway API, Fleet, Workload Identity and GKE Dataplane V2. For an existing cluster, the preparation page specifically requires Dataplane V2 to be enabled, a machine type of e2-standard-4 or larger, Fleet membership, Gateway API and Workload Identity. A CLI accepting the flag is not a complete eligibility check.
Compare the Preview scope with your workloads
The current Preview supports single-cluster Layer 4 mesh capabilities. It requires the Kubernetes Gateway API and does not support Istio APIs. Workloads enrolled in ambient cannot interoperate with sidecar-injected workloads or proxyless gRPC workloads. The preparation page also lists headless Services, the Service trafficDistribution field and GKE Sandbox as unsupported.
Inventory the workloads and Services that must communicate before deciding whether these limits rule out the target cluster. Do not transfer assumptions from another Cloud Service Mesh or Istio deployment model, or turn the single-cluster Layer 4 description into a multi-cluster or Layer 7 capability claim.
Check traffic policies and the node-component limitation
Adding the networking.gke.io/dataplane-mode=ambient label to a namespace enrolls it for traffic redirection; the cluster flag or label alone does not configure and verify mTLS. If mTLS is required, configure the applicable server-side and client-side TLS policies and check that the controller accepts them. The preparation page notes that policy propagation takes time.
The preparation page documents a conditional security limitation: if the gke-ambient-nriplugin is unavailable on a node, enforcement of inbound traffic authentication and authorization might be bypassed. This is a documented failure mode, not evidence that a cluster experienced an incident or attack. Include the availability dependency in a Preview deployment's risk assessment.
Which charges are waived during Preview?
There are also two distinct pricing boundaries. The documented SKU for Pods labeled in an ambient namespace is USD 0.004 per Pod-hour, but the page says this charge is not enforced during Preview. Standard Cloud Observability (Monitoring and Logging) and Certificate Authority Service charges still apply. The Regional Cloud Service Mesh page separately points current regional service pricing to global pricing and describes regional SKUs as a future GA item; that does not make the related services free overall.
Use eligibility and limits to decide whether to pilot
If your immediate goal is only to use the newly GA gcloud flag, record that separately from product maturity. Consider ambient networking only as a Preview pilot when the target version, supported region and cluster prerequisites all match and the workloads do not depend on the unsupported interoperability paths above. A workload that requires a GA product commitment should not treat the flag's stage as a substitute.
The current documentation can screen out ineligible clusters, but it does not establish a particular project's quota, permissions, service activation or actual availability. This guide summarizes the cited official material; it does not report a change made to a GKE cluster, a connectivity test or verified eligibility for a customer environment.
Sources
Frequently Asked Questions
Does the permissive mTLS policy in the preparation guide reject plaintext requests?
No. The example permissive server policy accepts both mTLS and plaintext traffic. It uses traffic sniffing to distinguish them, and the guide warns that this can break applications using their own TLS or a server-speaks-first protocol such as MySQL. Do not treat the example as a strict mTLS configuration; check the workload protocol and required policy mode first.
Can I judge connectivity as soon as the controller accepts a TLS policy?
The preparation guide says server-policy propagation can take up to three minutes after controller acceptance. Its client-policy step says you might need to wait at least two minutes before continuing. These are waiting conditions in the official example, not promises about end-to-end latency or success rates. Distinguish policy acceptance, propagation and an actual connection check.