apiVersion:compute.cnrm.cloud.google.com/v1beta1kind:ComputeNetworkmetadata:annotations:cnrm.cloud.google.com/management-conflict-prevention-policy:"none"cnrm.cloud.google.com/project-id:"PROJECT-ID"cnrm.cloud.google.com/deletion-policy:"abandon"name:defaultspec:description:Default network for the project
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2024-12-21 UTC。"],[[["\u003cp\u003eConfig Connector manages Google Cloud resources by mapping Kubernetes resource names, container annotations, and optionally, region or location.\u003c/p\u003e\n"],["\u003cp\u003eConflicts can arise when multiple Config Connector resources attempt to manage the same Google Cloud resource, which Config Connector handles through a leasing system.\u003c/p\u003e\n"],["\u003cp\u003eLeases are namespace-scoped and are managed using two labels, \u003ccode\u003ecnrm-lease-holder-id\u003c/code\u003e and \u003ccode\u003ecnrm-lease-expiration\u003c/code\u003e, ensuring only one Config Connector instance manages a resource at any given time.\u003c/p\u003e\n"],["\u003cp\u003eConflict prevention can be controlled using the \u003ccode\u003ecnrm.cloud.google.com/management-conflict-prevention-policy\u003c/code\u003e annotation with values of \u003ccode\u003eresource\u003c/code\u003e (prevent conflicts) or \u003ccode\u003enone\u003c/code\u003e (do not prevent conflicts), defaulting to \u003ccode\u003enone\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eConflict prevention has limitations, including not working with resources that do not support labels and when managing multiple resources with the same name in the same namespace using resource IDs.\u003c/p\u003e\n"]]],[],null,["# Managing conflicts with multiple Config Connector resources\n===========================================================\n\n*** ** * ** ***\n\nThis page describes how Config Connector handles conflicts. Conflicts can happen\nwhen the same resource is managed by multiple resources.\n\nConfig Connector\n[manages or acquires](/config-connector/docs/how-to/managing-deleting-resources)\nresources by mapping the combination of Kubernetes resource name, container\nannotation, and if applicable, region or location. In the simplest case, you\norganize your resources with Google Cloud\n[projects](/resource-manager/docs/cloud-platform-resource-hierarchy#projects).\n\nGoogle Cloud supports additional levels of hierarchy beyond projects:\nfolders, projects, and organizations. You can map resources to your\n[folders, projects, and organizations](/config-connector/docs/how-to/organizing-resources/overview)\nwith an annotation. When you create a resource without an annotation using\nConfig Connector, the resource is created in the project that shares the\nresource's namespace.\n\nIt is possible, but not recommended, to create two Config Connector resources\nin different namespaces that manage the same Google Cloud resource.\nConfig Connector only manages the corresponding Google Cloud resource if\nit is able to obtain a lease on the Google Cloud resource and conflict\nprevention is [enabled](#modifying_conflict_prevention).\n\nLeases are namespace-scoped. To obtain a namespace-scoped lease, Config Connector\nadds two labels to the resource:\n\n1. `cnrm-lease-holder-id`: Config Controller generates a unique ID for each namespace that manages a resource with conflict prevention enabled. This unique ID is what's used to set `cnrm-lease-holder-id`. To see the mapping of the namespace to the `cnrm-lease-holder-id` value, you can look at the `namespace-id` ConfigMap in the `cnrm-system` namespace.\n2. `cnrm-lease-expiration`: An expiration time in [Unix epoch time](https://en.wikipedia.org/wiki/Unix_time).\n\nConfig Connector is able to update these values if any of the following is\ntrue:\n\n- The value of `cnrm-lease-holder-id` matches the namespace's globally unique ID.\n- The value of `cnrm-lease-holder-id` is empty or non-existent.\n- The value of `cnrm-lease-expiration` is in the past.\n\nWhen a Config Connector instance obtains a lease on a resource, the expiration\ntime is set to 40 minutes in the future. The same instance of Config Connector\nretains management as long as the resource is in the namespace. Config Connector\nextends the expiration time by 40 minutes when less than 20 minutes remain.\n\nIf Config Connector is unable to obtain a lease on a given resource, the output\nof\n[`kubectl describe`](/config-connector/docs/how-to/get-resource-info#describing_a_resource)\non the resource lists a Status of `ManagementConflict`.\n\nModifying conflict prevention\n-----------------------------\n\nYou can control conflict prevention by adding the\n`cnrm.cloud.google.com/management-conflict-prevention-policy` annotation to the\nresource with one of the following values:\n\n- `resource`: management conflicts are prevented at the resource level by saving the appropriate lease labels into the resource as described in the preceding section.\n- `none`: management conflicts are not prevented.\n\nThe default value is `none`.\n\nIn the following example, a manifest for the default ComputeNetwork uses a\nmanagement policy of `none`, which means that conflicts are not prevented: \n\n apiVersion: compute.cnrm.cloud.google.com/v1beta1\n kind: ComputeNetwork\n metadata:\n annotations:\n cnrm.cloud.google.com/management-conflict-prevention-policy: \"none\"\n cnrm.cloud.google.com/project-id: \"\u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e\"\n cnrm.cloud.google.com/deletion-policy: \"abandon\"\n name: default\n spec:\n description: Default network for the project\n\nLimitations\n-----------\n\nConflict prevention has the following limitations:\n\n- Conflict prevention does not work for resources that don't support\n labels. Even if you change the value from `none` to `resource`, it still\n doesn't work.\n\n- If you are\n [Managing resources with the resourceID field](/config-connector/docs/how-to/managing-resources-with-resource-ids)\n you can create multiple resources with the same Google Cloud resource name,\n created under the same namespace. These resources create conflicts that\n Config Connector cannot manage."]]
