GKE feature matrix for Google Distributed Cloud connected

This page describes the availability of various Kubernetes and GKE features on Distributed Cloud connected. Because Distributed Cloud connected is a managed platform, Google manages many of the underlying platform features.

The following tables summarize whether a feature is available, who manages it, and how its behavior might differ from standard Kubernetes or cloud-based GKE.

Cluster management and lifecycle

Feature	Availability	Managed by	Description and differences
Control plane	Available	Google	Google fully provisions and manages the Kubernetes control plane. You can't access or modify control plane components.
Worker node operating system (OS)	Available	Google	Google provisions and manages the operating system on the worker nodes.
Cluster upgrades	Available	Google (default) or You (optional)	Google automatically schedules and performs cluster upgrades by default. You can opt out of automatic upgrades by choosing the NONE release channel. You can manually trigger upgrades using the Google Cloud CLI or the API. For more information, see Upgrade the software version of a cluster.
Fleet registration	Available	Google	Clusters are automatically registered to a Google Cloud Fleet upon creation.
SSH access to nodes	Unavailable	Not applicable	Direct SSH access to worker nodes isn't available.
Cluster autoscaler	Unavailable	Not applicable	Because the physical hardware capacity is fixed, cluster autoscaling isn't supported.
Node auto-provisioning	Unavailable	Not applicable	Not supported because the physical hardware capacity is fixed.
Survivability mode	Available	Google	If disconnected from Google Cloud, your clusters enter survivability mode, and workloads continue to run for up to 7 days. For more information, see Survivability mode.

Compute and workloads

Feature	Availability	Managed by	Description and differences
Linux containers	Available	You	You deploy and manage standard Kubernetes container workloads. For more information, see Deploy workloads.
Virtual machines (VM Runtime on GDC)	Available	You	You deploy and manage virtual machine guest workloads alongside containers using the Google-managed VM runtime. VM workloads are supported only on Distributed Cloud connected servers, and aren't supported on refreshed rack hardware. For more information, see Manage virtual machines.
GPU workloads	Available	You	Supported on select hardware configurations. You manage the workload deployments. For more information, see Manage GPU workloads.
Horizontal pod autoscaling (HPA)	Available	You	You can use HPA to automatically scale your workloads based on resource utilization (CPU and memory) using standard Kubernetes manifests. Because the physical hardware capacity is fixed, you must manage your overall cluster capacity and configure resource quotas. GKE-specific HPA features, such as traffic-based autoscaling and HPA performance profiles, are not supported. For more information, see Configure horizontal Pod autoscaling.
Custom resource definitions (CRDs)	Available	You	You can deploy and manage CRDs to extend the Kubernetes API for your own workloads. Because Distributed Cloud connected is a managed environment, Google doesn't support or troubleshoot user-installed CRDs or operators. You must not modify or delete Google-managed system CRDs. For more information, see the Kubernetes Custom Resources documentation.
Preemptible or Spot VMs	Unavailable	Not applicable	Not supported on dedicated hardware.
Windows Server nodes	Unavailable	Not applicable	Windows nodes (Kubernetes worker nodes) aren't supported. However, you can run Windows Server guest workloads as virtual machines using VM Runtime on GDC.
Host namespaces	Unavailable	Not applicable	User workloads can't run in the host's PID, IPC, or network namespaces.
Privileged containers	Unavailable	Not applicable	User containers can't be run in privileged mode (securityContext.privileged: true).
Control plane node scheduling	Unavailable	Not applicable	You can't schedule user workloads on control plane nodes. Under node toleration restrictions, scheduling Pods with control plane toleration keys is blocked.

Networking

Feature	Availability	Managed by	Description and differences
Network Function operator	Available	Google	Google installs and manages the Network Function operator. You configure advanced networking scenarios, such as VLANs, using the custom resources provided by the operator. For more information, see Network Function operator.
Ingress	Available	You	You can configure an Ingress resource for your workloads using the provided network features. For more information, see Networking features of Distributed Cloud connected.
Service load balancing	Available	You	You can expose your workloads to your local network using standard Kubernetes services of type LoadBalancer, which are backed by a bundled MetalLB Layer 2 load balancer. For more information, see Load balancing.
Network policies	Available	You	Standard Kubernetes network policies are supported for workload traffic control. For more information, see Control communication between Pods and Services using network policies.
Cluster DNS	Available	Google	Google installs and manages the underlying cluster DNS components. You configure the upstream name servers and domain-specific routing rules using the ClusterDNS custom resource. For more information, see Configure DNS for a cluster.
Multiple network interfaces (multi-NIC) for Pods	Available	You	You can connect your Pods to multiple network interfaces to separate different types of traffic or to connect workloads to secondary networks. You configure the networks and subnetworks using Distributed Cloud connected custom resources. The MacVLAN driver isn't supported on Pods running virtual machines. For more information, see Create and manage networks.

Storage

Feature	Availability	Managed by	Description and differences
Storage classes	Available	You (configuration) and Google (updates)	You configure and manage Symcloud Storage classes, including setting the default storage class. Google manages software updates for the underlying bundled software-defined storage solution. For more information, see Symcloud Storage classes.
Persistent volume claims	Available	You	You create persistent volume claims to request persistent storage for your workloads. Only the ReadWriteOnce (RWO) access mode is supported. ReadWriteMany (RWX) is not supported. For more information, see Configure abstracted Symcloud Storage volumes for workloads.
External block storage	Unavailable	Not applicable	Not supported on dedicated Distributed Cloud connected hardware. Workloads must use the configured local software-defined storage classes (Symcloud Storage).
hostPath volumes	Available	Google (policies) and you (configuration)	Use hostPath volumes only as a highly restricted fallback, not as a recommended design pattern for general storage. For standard application volumes and VM disks, we recommend using network-based storage classes or PersistentVolumeClaims. To support low-level hardware pass-through and networking configuration, Google enforces policy controller webhooks that restrict read/write access to the following directories: /dev/hugepages, /dev/infiniband, /dev/vfio, /dev/char, and /sys/devices.
Volume types	Available	You	User workloads support only a restricted set of volume types: configMap, csi, downwardAPI, emptyDir, nfs, persistentVolumeClaim, projected, and secret.

Security and identity

Feature	Availability	Managed by	Description and differences
Workload Identity	Available	Google	Fleet Workload Identity Federation is the default and is configured automatically for your clusters. For more information, see Workload Identity Cluster Authentication.
Workload role-based access control (RBAC)	Available	You	You configure RBAC for your users and workloads. For more information, see Roles and permissions.
Platform RBAC	Available	Google	Google manages RBAC for system components and the control plane. For more information, see Roles and permissions.
External Secrets Operator	Available	You	You install and manage the External Secrets Operator to securely retrieve secrets from Secret Manager for your workloads. For more information, see Use External Secrets Operator.
User and group impersonation	Unavailable	Not applicable	Kubernetes user and group impersonation isn't supported.
CertificateSigningRequest	Unavailable	Not applicable	Workloads can't request X.509 certificate issuance through the standard Kubernetes CertificateSigningRequest resource type.

Observability and configuration

Feature	Availability	Managed by	Description and differences
Audit logging	Available	Google	Audit logs are automatically collected and routed to Cloud Logging. For more information, see Google Distributed Cloud connected audit logging.
Platform metrics and logs	Available	Google	Google monitors the health and performance of platform components. For more information, see Logs and metrics.
Application metrics and logs	Available	You	You are responsible for monitoring your own application workloads. For more information, see Logs and metrics.
Fleet packages	Available	You	You can use Config Sync fleet packages to automate the deployment of configurations across your clusters. For more information, see Use fleet packages in Distributed Cloud connected.