Install Config Sync

With Config Sync, you can manage Kubernetes resources by using files, called configs, that are stored in one or more Git repositories. This page shows you how to enable and configure Config Sync so that it syncs from your root repository. Config Sync is available if you use Anthos or Google Kubernetes Engine (GKE).

When you install Config Sync with a version of 1.7.0 or later, using the Google Cloud Console or the gcloud command-line tool the latest Config Management Operator is installed by default. This operator provides you with additional features such as syncing from multiple repositories and syncing Kustomize and Helm configurations.

Before you begin

Before you install Config Sync, prepare your environment, clusters, and roles, and enable Anthos Config Management.

Prepare your local environment

Prepare your local environment by completing the following tasks:

  1. Create, or make sure you have access to, a Git repository that can contain the configs that Config Sync syncs to. The repository you select is going to become your root repository.
  2. Install and initialize the Cloud SDK, which provides the gcloud, and nomos commands. If you use Cloud Shell, the Cloud SDK comes pre-installed.

Cluster requirements

Create, or make sure you have access to, a cluster that meets the following requirements:

  • Is on an Anthos supported platform and version.
  • Is not an Autopilot cluster.
  • Has Workload Identity enabled if you use GKE clusters. Workload Identity is the recommended way to access Google Cloud services from applications running within Google Kubernetes Engine (GKE) due to its improved security properties and manageability.

  • If you want to use a private GKE cluster, configure the Cloud NAT to permit egress from private GKE nodes. For details, see Example GKE setup. Alternatively, you can enable Private Google Access to connect to the set of external IP addresses used by Google APIs and services.

  • If you want to use a Google service account when you grant Config Sync access to your Git repository, then you must include the read-only scope in access scopes for the nodes in the cluster for Cloud Source Repositories.

    You can add the read-only scope by including cloud-source-repos-ro in the --scopes list specified at cluster creation time, or by using the cloud-platform scope at cluster creation time. For example:

    gcloud container clusters create CLUSTER_NAME --scopes=cloud-platform

Prepare your cluster

After you have created a suitable cluster, complete the following steps:

  1. If you are using Anthos Config Management for the first time, enable Anthos Config Management.

  2. Grant the required IAM roles to the user registering the cluster.

  3. If you plan to use the gcloud command-line tool to configure Config Sync, register your cluster to a fleet now. If you plan to use the Google Cloud Console, register your clusters when you

Install Config Sync

In the following sections, you grant Config Sync access to your repository. After you have granted access, you configure the installation for your root repository.

Grant Config Sync read-only access to Git

Config Sync needs read-only access to your Git repository so that it can read the configs committed to the repository and apply them to your clusters.

If your repository does not require authentication for read-only access, you can continue to configure Config Sync and use none as your authentication type. For example, if you can browse the repository using a web interface without logging in, or if you can use git clone to create a clone of the repository locally without providing credentials or using saved credentials, then you do not need to authenticate. In this case, you do not need to create a Secret.

However, most users need to create credentials because read access to their repository is restricted. If credentials are required, they are stored in the git-creds Secret on each enrolled cluster (unless you are using a Google service account).

Config Sync supports the following mechanisms for authentication:

  • SSH key pair
  • cookiefile
  • Token
  • Google service account (Cloud Source Repositories only)

The mechanism that you choose depends on what your repository supports. Generally, we recommend using an SSH key pair. GitHub and Bitbucket both support using an SSH key pair. However, if you are using a repository in Cloud Source Repositories, we recommend that you use a Google service account instead as the process is simpler. If your organization hosts your repository and you don't know which authentication methods are supported, contact your administrator.

SSH key pair

An SSH key pair consists of two files, a public key and a private key. The public key typically has a .pub extension.

To use an SSH key pair, complete the following steps:

  1. Create an SSH key pair to allow Config Sync to authenticate to your Git repository. This step is necessary if you need to authenticate to the repository to clone it or read from it. Skip this step if a security administrator provides you with a key pair. You can use a single key pair for all clusters, or a key pair per cluster, depending on your security and compliance requirements.

    The following command creates a 4096-bit RSA key. Lower values are not recommended:

    ssh-keygen -t rsa -b 4096 \
-C "GIT_REPOSITORY_USERNAME" \
-N '' \
-f /path/to/KEYPAIR_FILENAME

    Replace the following:

    • GIT_REPOSITORY_USERNAME: the username that you want Config Sync to use to authenticate to the repository
    • /path/to/KEYPAIR_FILENAME: a path to the key pair

    If you are using a third-party Git repository host such as GitHub, or you want to use a service account with Cloud Source Repositories, we recommend that you use a separate account.

  2. Configure your repository to recognize the newly created public key. Refer to the documentation for your Git hosting provider. Instructions for some popular Git hosting providers are included for convenience:

  3. Add the private key to a new Secret in the cluster:

    kubectl create ns config-management-system && \
kubectl create secret generic git-creds \
 --namespace=config-management-system \
 --from-file=ssh=/path/to/KEYPAIR_PRIVATE_KEY_FILENAME

    Replace /path/to/KEYPAIR_PRIVATE_KEY_FILENAME with the name of the private key (the one without the .pub suffix).

  4. Delete the private key from the local disk or otherwise protect it.

  5. When you configure Config Sync and add the URL for your Git repository, use the SSH protocol. If you are using a repository in Cloud Source Repositories, you must use the following format when you enter your URL:

    ssh://EMAIL@source.developers.google.com:2022/p/PROJECT_ID/r/REPO_NAME

    Replace the following:

    • EMAIL: your Google Cloud username
    • PROJECT_ID: the ID of the Google Cloud project where the repository is located
    • REPO_NAME: the name of the repository

cookiefile

The process for acquiring a cookiefile depends on the configuration of your repository. For an example, see Generate static credentials in the Cloud Source Repositories documentation. The credentials are usually stored in the .gitcookies file in your home directory, or they might be provided to you by a security administrator.

To use a cookiefile, complete the following steps:

  1. After you create and obtain the cookiefile, add it to a new Secret in the cluster.

    If you don't use HTTPS proxy, create the Secret with the following command:

    kubectl create ns config-management-system && \
kubectl create secret generic git-creds \
 --namespace=config-management-system \
 --from-file=cookie_file=/path/to/COOKIEFILE

    If you need to use an HTTPS proxy or HTTP proxy, add it to the Secret together with cookiefile by running the following command:

    kubectl create ns config-management-system && \
kubectl create secret generic git-creds \
 --namespace=config-management-system \
 --from-file=cookie_file=/path/to/COOKIEFILE \
 --from-literal=https_proxy=HTTPS_PROXY_URL \
 --from-literal=http_proxy=HTTP_PROXY_URL

    Replace the following:

*/path/to/COOKIEFILE: the appropriate path and filename *HTTPS_PROXY_URL: the URL for the HTTPS proxy that you use when communicating with the Git repository *HTTP_PROXY_URL: the URL for the HTTP proxy that you use when communicating with the Git repository

  1. Protect the contents of the cookiefile if you still need it locally. Otherwise, delete it.

Token

If your organization does not permit the use of SSH keys, you might prefer to use a token. With Config Sync, you can use GitHub's personal access tokens (PATs), GiLab's PATs or deploy keys, or Bitbucket's app password as your token.

To create a Secret using your token, complete the following steps:

  1. Create a token using GitHub, GitLab, or Bitbucket:

  2. After you create and obtain the token, add it to a new Secret in the cluster:

    kubectl create ns config-management-system && \
kubectl create secret generic git-creds \
  --namespace="config-management-system" \
  --from-literal=username=USERNAME \
  --from-literal=token=TOKEN

    Replace the following:

    • USERNAME: the username that you want to use.
    • TOKEN: the token that you created in the previous step.

  3. Protect the token if you still need it locally. Otherwise, delete it.

Google service
account

If your repository is in Cloud Source Repositories, you can give Config Sync access to a repository in the same project as your managed cluster by using a Google service account.

To use a repository in Cloud Source Repositories as your Config Sync repository, complete the following steps:

  1. Retrieve your Cloud Source Repositories URL:

    1. List all repositories:

      gcloud source repos list

    2. From the output, copy the URL from the repository that you want to use. For example:

      REPO_NAME  PROJECT_ID  URL
my-repo    my-project  https://source.developers.google.com/p/my-project/r/my-repo-csr

      You need to use this URL when you configure Config Sync in the following section. If you configure Config Sync using the Google Cloud Console, you add the URL in the URL field. If you configure Config Sync using the gcloud command-line tool, you add the URL to the syncRepo field of your configuration file.

  2. When you configure Config Sync, select the appropriate authentication type. The authentication type that you should pick differs depending on if you have Workload Identity enabled in your cluster:

    Workload Identity enabled

    1. If necessary, create a service account. Ensure that the service account has read access to Cloud Source Repositories by granting it the source.reader role.

    2. If you configure Config Sync using the Google Cloud Console, select Workload Identity as the Authentication Type and then add your service account email.

      If you configure Config Sync using the gcloud command-line tool, add gcpserviceaccount as the secretType and then add your service account email to gcpServiceAccountEmail.

    3. After configuring Config Sync, create an IAM policy binding between the Kubernetes service account and the Google service account. The Kubernetes service account is not created until you configure Config Sync for the first time.

      This binding lets the Config Sync Kubernetes service account act as the Google service account:

      gcloud iam service-accounts add-iam-policy-binding \
   --role roles/iam.workloadIdentityUser \
   --member "serviceAccount:PROJECT_ID.svc.id.goog[config-management-system/root-reconciler]" \
   GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

      Replace the following:

      • PROJECT_ID: your organization's project ID
      • GSA_NAME: the custom Google service account that you want to use to connect to Cloud Source Repositories. Make sure that the Google service account that you select has the source.reader role.

    Workload Identity not enabled

    If you configure Config Sync using the Google Cloud Console, select Google Cloud Repository as the Authentication Type.

    If you configure Config Sync using the gcloud command-line tool, add gcenode as the secretType.

    Selecting either Google Cloud Repository or gcenode lets you use the Compute Engine default service account. By default, the Compute Engine default service account, PROJECT_ID-compute@developer.gserviceaccount.com, has source.reader access to the repository for the same project. However, if your Cloud Source Repositories is located in a project different from your cluster's project, you have to grant default Compute Engine service account from the cluster's project, the source.reader in the Cloud Source Repositories's project.

    You can add the source.reader role with the following command:

    gcloud projects add-iam-policy-binding PROJECT_ID \
  --member serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com \
  --role roles/source.reader

    Replace the following:

    • PROJECT_ID: your organization's project ID
    • PROJECT_NUMBER: your organization's project number

    You cannot modify access scopes after you create a node pool. However, you can create a new node pool with the proper access scope while using the same cluster. The default gke-default scope does not include cloud-source-repos-ro.

Configure Config Sync

In this section, you configure the settings for your root repository. The Google Cloud Console guides you through the installation process and automates many of the steps. You can also use the gcloud command-line tool to complete the installation.

Console

Register your clusters

To use Config Management, you must first register your clusters. Registering your clusters lets them share a common set of configurations and policies.

To register your clusters, complete the following tasks:

  1. In the Cloud Console:

    This page shows you which clusters are currently registered and configured and lets you begin registering new clusters.

  2. Click New Setup.

  3. In the Select registered clusters for Config Management page, locate the Unregistered clusters from this project table, and find the cluster that you want to register.

  4. Click Register next to the cluster that you want to register.

    Once the cluster is successfully registered, it appears in the Select registered clusters for Config Management table.

Install Config Sync

Once you have registered your clusters, you can continue on to install and configure Config Sync.

To install Config Sync, complete the following steps:

  1. In the Select registered clusters for Config Management page, select the clusters that you want to configure, and select Next.
  2. In the Config Sync page that appears, select the Anthos Config Management version that you want to use from the Version drop-down list. The default is the current version.
  3. In the Configurations section, leave the Enable Config Sync checkbox selected.
  4. In the URL field, add the URL of the Git repository to use as the source of truth. Enter URLs using either the HTTPS or SSH protocol. For example, https://github.com/GoogleCloudPlatform/anthos-config-management-samples. If you don't enter a protocol, the URL is treated as an HTTPS URL.

  5. In the Authentication type drop-down list, select the one of the following options:

    • None: Use no authentication.
    • SSH: Use an SSH key pair.
    • Cookiefile: Use a cookiefile.
    • Token: Use a token.
    • Google Cloud Repository: Use a Google service account to access a Cloud Source Repositories repository. Only select this option if Workload Identity is not enabled in your cluster.
    • Workload Identity: Use a Google service account to access a Cloud Source Repositories repository. You can only select Workload Identity when you use GKE clusters with Workload Identity enabled. The integration with Fleet Workload Identity for other Anthos clusters isn't supported. When you select Workload Identity, you need to add your Google service account email address. For example, acm@PROJECT_ID.iam.gserviceaccount.com. If you select this authentication type, you also need to create an IAM policy binding after you finish configuring Config Sync. For details, see the Google service account tab of the Grant Config Sync read-only access to Git section.

  6. Follow the instructions in the Google Cloud Console to grant Config Sync read-only access to Git and click Continue.

  7. Optional: In the Branch field, add the branch of the repository to sync from. The default is the master branch.

  8. Optional: In the Tag/Commit field, add the Git revision (tag or hash) to check out. The default is HEAD.

  9. Optional: In the Policy directory field, add the path within the repository to the top of the policy hierarchy to sync. The default is the root directory of the repository.

  10. Optional: In the Sync wait field, add the period in seconds between consecutive syncs. The default is 15 seconds.

  11. Optional: In the Git proxy field, enter the URL for the HTTPS proxy to be used when communicating with the Git repository. This is an optional field, and if it's left blank, no proxy is used. Proxy is only supported when using an authorization type of cookiefile or none.

    The URL for the HTTPS proxy is shown as plain text in the RootSync resource that Config Sync creates. If the URL contains sensitive information such as a username or password and you need to hide the sensitive information, you can leave Git proxy empty and add the URL for the HTTPS proxy or HTTP proxy into the same Secret used for the Git credential. Storing the proxy in the Secret is only supported when using an authorization type of cookiefile.

  12. Optional: In the Source format field, choose either unstructured or hierarchy. The default is unstructured and we recommend that you select unstructured as this format lets you organize your configs in the way that is most convenient to you.

  13. If you don't want to install Policy Controller, click Next and clear the Enable Policy Controller checkbox.

  14. Click Complete to complete the Config Sync installation.

gcloud

Before you continue, make sure you've registered your clusters to a fleet.

If you use Anthos or GKE, complete the following steps to configure Config Sync with the gcloud command-line tool.

  1. Prepare the configuration by either creating a new apply-spec.yaml manifest or by using an existing manifest. Using an existing manifest lets you configure your cluster with the same settings used by another cluster.

Create new manifest

To configure Config Sync with new settings for your cluster, create a file named apply-spec.yaml and copy the following YAML file into it:

# apply-spec.yaml

applySpecVersion: 1
spec:
  configSync:
    # Set to true to install and enable Config Sync
    enabled: true
    sourceFormat: FORMAT
    syncRepo: REPO
    syncBranch: BRANCH
    secretType: TYPE
    gcpServiceAccountEmail: EMAIL
    policyDir: DIRECTORY

Replace the following:

  • FORMAT: add unstructured to use an unstructured repository or add hierarchy to use a hierarchical repository. These values are case-sensitive. This field is optional and the default value is hierarchy. We recommend that you add unstructured, because this format lets you organize your configs in the way that is most convenient to you.
  • REPO: add the URL of the Git repository to use as the source of truth. You can enter URLs using either the HTTPS or SSH protocol. For example, https://github.com/GoogleCloudPlatform/anthos-config-management-samples uses the HTTPS protocol. If you don't enter a protocol, the URL is treated as an HTTPS URL. This field is required.
  • BRANCH: the branch of the repository to sync from. The default is the main (master) branch.

  • TYPE: one of the following secretTypes:

    • none: Use no authentication.
    • ssh: Use an SSH key pair.
    • cookiefile: Use a cookiefile.
    • token: Use a token.
    • gcpserviceaccount: Use a Google service account to access a Cloud Source Repositories. If you select this authentication type, you need to create an IAM policy binding after you finish configuring Config Sync. For details, see the Google service account tab of the Grant Config Sync read-only access to Git section.
    • gcenode: Use a Google service account to access a Cloud Source Repositories. Only select this option if Workload Identity is not enabled in your cluster.

    For more information on these authentication types, see Granting Config Sync read-only access to Git.

  • EMAIL: If you added gcpserviceaccount as your secretType, add your Google service account email address. For example, acm@PROJECT_ID.iam.gserviceaccount.com.

  • DIRECTORY: the path in the Git repository to the root directory that contains the configuration that you want to sync to. The default is the root directory of the repository.

For a complete list of fields that you can add to the spec field, see gcloud fields.

Use existing manifest

To configure your cluster with the same settings used by another cluster, fetch the settings from a registered cluster:

 gcloud alpha container hub config-management fetch-for-apply \
     --membership=MEMBERSHIP_NAME \
     --project=PROJECT_ID \
     > CONFIG_YAML_PATH

Replace the following:

  • MEMBERSHIP_NAME: the membership name of the registered cluster that has the Config Sync settings you want to use
  • PROJECT_ID: your project ID
  • CONFIG_YAML_PATH: the path to the apply-spec.yaml file which contains the settings fetched from the cluster

2. Apply the apply-spec.yaml file. If you are using an existing manifest, you should apply the file to the cluster that you want to configure with the settings that you fetched in the previous command:

  gcloud beta container hub config-management apply \
      --membership=MEMBERSHIP_NAME \
      --config=CONFIG_YAML_PATH \
      --project=PROJECT_ID

Replace the following:

  • MEMBERSHIP_NAME: the membership name that you chose when you registered your cluster. You can find the name with gcloud container hub memberships list.
  • CONFIG_YAML_PATH: the path to your apply-spec.yaml file.
  • PROJECT_ID: your project ID.

After you have finished configuring your root repository, you can optionally choose to configure syncing from namespace repositories. These repositories are helpful if you want a repository that contains namespace-scoped configs synced to a particular namespace across clusters.

Verify the installation

After you have installed and configured Config Sync, you can verify that the installation completed successfully.

Console

Complete the following steps:

  1. In the Cloud Console:

  2. In the cluster table, view the Config sync status column. A successful installation has a status of Synced.

gcloud

Run the following command:

gcloud beta container hub config-management status \
    --project=PROJECT_ID

Replace PROJECT_ID with your project's ID.

A successful installation has a status of SYNCED. If you see an error after running the preceding command, make sure that you created the git-creds Secret. If you have created the Secret, try rerunning the following command:

gcloud beta container hub config-management apply

You can also use the nomos status command to check if the Config Sync is installed successfully. A valid installation with no problems has a status of PENDING or SYNCED. An invalid or incomplete installation has a status of NOT INSTALLED OR NOT CONFIGURED. The output also includes any reported errors.

It's possible to have an invalid configuration that isn't detected right away, such as a missing or invalid git-creds Secret. For troubleshooting steps, see Valid but incorrect ConfigManagement object in the Troubleshooting page.

Upgrade Config Sync

Config Sync is upgraded whenever you upgrade Anthos Config Management. To learn more, see Upgrade Anthos Config Management.

Resource requests

Summary of total resource requests

The following table lists the combined amount of resource requests for Config Sync, depending on what features you are using.

Feature CPU Memory
(v1.9+) Default (multi-repo) mode 240 m + 80 m * (number of RootSync and RepoSync objects) 620 Mi + 210 Mi * (number of RootSync and RepoSync objects)
(v1.7 - v1.8) Default (multi-repo) mode 710 m + 260 m * (number of RootSync and RepoSync objects) 620 Mi + 210 Mi * (number of RootSync and RepoSync objects)
Hierarchy Controller 220 m 220 Mi
Single repository mode 460 m 310 Mi

Detailed resource requests

The following table lists Kubernetes resource requirements for Config Sync components. For more information, see Managing Resources for Containers in the Kubernetes documentation.

Deployment name CPU request (m) per replica Memory request (Mi) per replica Single or multiple repositories
git-importer 450 300 Single
monitor Default1 Default Single
resource-group-controller-manager 100+default 50+default Multi
admission-webhook2 20 20 Multi
otel-collector 200 400 Multi
reconciler-manager 20 120 Multi
reconciler (one per RootSync and RepoSync) 80+default 200+default Multi
hnc-controller-manager 100+default 150+default Hierarchy Controller
gke-hc-controller-manager 100+default 50+default Hierarchy Controller

1 The default resource request uses a CPU request of 10 and a memory request of 10 Mi.

2 The admission webhook has two replicas, so when calculating the total resource requests, you need to double the value.

What's next