Config Sync overview
Config Sync is a GitOps service offered as a part of Anthos. Config Sync is built on an open source core and lets cluster operators and platform administrators deploy configurations from Git, OCI, or Helm repositories. The service has the flexibility to support one or many clusters and any number of repositories per cluster or namespace. The clusters can be in a hybrid or multi-cloud environment.
Config Sync benefits
GitOps is considered a universal best practice for organizations managing Kubernetes configuration as scale. The benefits of improved stability, better readability, consistency, audit and security are common to all GitOps tools. Config Sync is a part of Anthos which provides you with a set of unique advantages:
- Integrated with Anthos: platform admins can install Config Sync using a few clicks in the Google Cloud console, using Terraform, or by using Google Cloud CLI on any cluster connected to your Anthos fleet. The service is pre-configured to work with other Anthos and Google Cloud services like Policy Controller, Workload Identity and Cloud Monitoring.
- Built-in observability: Config Sync has an observability dashboard that is built into the Google Cloud console, requiring no additional setup. Platform administrators can view the state of their synchronization and reconciliation by visiting the Google Cloud console or by using the Google Cloud CLI.
- Multi-cloud and hybrid support: Config Sync is tested across several cloud providers and in hybrid environments prior to every GA release. To view the support matrix, see Anthos version and upgrade support.
Understanding Config Sync
The following diagram shows you an overview of how teams might sync their clusters to a single root repository (managed by an admin) and multiple namespace repositories (managed by application operators):
A central administrator manages the centralized infrastructure for the organization and enforces policies on the cluster and on all namespaces in the organization. The application operators, who are responsible for managing live deployments, apply configurations to the applications in the namespaces that they work on.
In cases where configs don't yet exist, the process would start with creating configuration.
Config Sync lets you create a common set of configuration and policies, such as Policy Controller constraints, and consistently apply them across registered and connected clusters from a single source of truth.
Instead of repeatedly running the
kubectl apply command manually, you can
orchestrate deployment of configuration changes to fleets of clusters through
Git. For more information, see
Safe rollouts with Anthos Config Management.
Configuring namespaces with Config Sync provides you with the following capabilities:
- You can consistently provision Kubernetes namespaces with namespace-scoped policies, such as RBAC roles, across registered and connected clusters. Namespace-scoped policies make it easier to implement and manage multi-tenancy within your clusters.
- Apply policies to multiple related namespaces, without duplicating configs, and with the ability to override or extend a config for a given namespace or set of namespaces, making it easier to apply consistent policies across tenants.