Config Connector 會透過對應 Kubernetes 資源名稱、容器註解，以及適用情況下的區域或位置組合管理或取得資源。在最簡單的情況下，您可以使用 Google Cloud
專案來彙整資源。
Google Cloud 支援專案以外的其他階層層級：資料夾、專案和機構。您可以使用註解將資源對應至資料夾、專案和機構。使用 Config Connector 建立資源時，如果沒有使用註解，系統會在共用資源命名空間的專案中建立資源。
您可以在不同的命名空間中建立兩個 Config Connector 資源，用來管理相同的 Google Cloud 資源，但我們不建議這麼做。Config Connector 只能在能夠取得 Google Cloud 資源的租約，且已啟用衝突預防功能的情況下，管理相應的 Google Cloud 資源。
apiVersion:compute.cnrm.cloud.google.com/v1beta1kind:ComputeNetworkmetadata:annotations:cnrm.cloud.google.com/management-conflict-prevention-policy:"none"cnrm.cloud.google.com/project-id:"PROJECT-ID"cnrm.cloud.google.com/deletion-policy:"abandon"name:defaultspec:description:Default network for the project
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eConfig Connector manages Google Cloud resources by mapping Kubernetes resource names, container annotations, and optionally, region or location.\u003c/p\u003e\n"],["\u003cp\u003eConflicts can arise when multiple Config Connector resources attempt to manage the same Google Cloud resource, which Config Connector handles through a leasing system.\u003c/p\u003e\n"],["\u003cp\u003eLeases are namespace-scoped and are managed using two labels, \u003ccode\u003ecnrm-lease-holder-id\u003c/code\u003e and \u003ccode\u003ecnrm-lease-expiration\u003c/code\u003e, ensuring only one Config Connector instance manages a resource at any given time.\u003c/p\u003e\n"],["\u003cp\u003eConflict prevention can be controlled using the \u003ccode\u003ecnrm.cloud.google.com/management-conflict-prevention-policy\u003c/code\u003e annotation with values of \u003ccode\u003eresource\u003c/code\u003e (prevent conflicts) or \u003ccode\u003enone\u003c/code\u003e (do not prevent conflicts), defaulting to \u003ccode\u003enone\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eConflict prevention has limitations, including not working with resources that do not support labels and when managing multiple resources with the same name in the same namespace using resource IDs.\u003c/p\u003e\n"]]],[],null,["# Managing conflicts with multiple Config Connector resources\n===========================================================\n\n*** ** * ** ***\n\nThis page describes how Config Connector handles conflicts. Conflicts can happen\nwhen the same resource is managed by multiple resources.\n\nConfig Connector\n[manages or acquires](/config-connector/docs/how-to/managing-deleting-resources)\nresources by mapping the combination of Kubernetes resource name, container\nannotation, and if applicable, region or location. In the simplest case, you\norganize your resources with Google Cloud\n[projects](/resource-manager/docs/cloud-platform-resource-hierarchy#projects).\n\nGoogle Cloud supports additional levels of hierarchy beyond projects:\nfolders, projects, and organizations. You can map resources to your\n[folders, projects, and organizations](/config-connector/docs/how-to/organizing-resources/overview)\nwith an annotation. When you create a resource without an annotation using\nConfig Connector, the resource is created in the project that shares the\nresource's namespace.\n\nIt is possible, but not recommended, to create two Config Connector resources\nin different namespaces that manage the same Google Cloud resource.\nConfig Connector only manages the corresponding Google Cloud resource if\nit is able to obtain a lease on the Google Cloud resource and conflict\nprevention is [enabled](#modifying_conflict_prevention).\n\nLeases are namespace-scoped. To obtain a namespace-scoped lease, Config Connector\nadds two labels to the resource:\n\n1. `cnrm-lease-holder-id`: Config Controller generates a unique ID for each namespace that manages a resource with conflict prevention enabled. This unique ID is what's used to set `cnrm-lease-holder-id`. To see the mapping of the namespace to the `cnrm-lease-holder-id` value, you can look at the `namespace-id` ConfigMap in the `cnrm-system` namespace.\n2. `cnrm-lease-expiration`: An expiration time in [Unix epoch time](https://en.wikipedia.org/wiki/Unix_time).\n\nConfig Connector is able to update these values if any of the following is\ntrue:\n\n- The value of `cnrm-lease-holder-id` matches the namespace's globally unique ID.\n- The value of `cnrm-lease-holder-id` is empty or non-existent.\n- The value of `cnrm-lease-expiration` is in the past.\n\nWhen a Config Connector instance obtains a lease on a resource, the expiration\ntime is set to 40 minutes in the future. The same instance of Config Connector\nretains management as long as the resource is in the namespace. Config Connector\nextends the expiration time by 40 minutes when less than 20 minutes remain.\n\nIf Config Connector is unable to obtain a lease on a given resource, the output\nof\n[`kubectl describe`](/config-connector/docs/how-to/get-resource-info#describing_a_resource)\non the resource lists a Status of `ManagementConflict`.\n\nModifying conflict prevention\n-----------------------------\n\nYou can control conflict prevention by adding the\n`cnrm.cloud.google.com/management-conflict-prevention-policy` annotation to the\nresource with one of the following values:\n\n- `resource`: management conflicts are prevented at the resource level by saving the appropriate lease labels into the resource as described in the preceding section.\n- `none`: management conflicts are not prevented.\n\nThe default value is `none`.\n\nIn the following example, a manifest for the default ComputeNetwork uses a\nmanagement policy of `none`, which means that conflicts are not prevented: \n\n apiVersion: compute.cnrm.cloud.google.com/v1beta1\n kind: ComputeNetwork\n metadata:\n annotations:\n cnrm.cloud.google.com/management-conflict-prevention-policy: \"none\"\n cnrm.cloud.google.com/project-id: \"\u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e\"\n cnrm.cloud.google.com/deletion-policy: \"abandon\"\n name: default\n spec:\n description: Default network for the project\n\nLimitations\n-----------\n\nConflict prevention has the following limitations:\n\n- Conflict prevention does not work for resources that don't support\n labels. Even if you change the value from `none` to `resource`, it still\n doesn't work.\n\n- If you are\n [Managing resources with the resourceID field](/config-connector/docs/how-to/managing-resources-with-resource-ids)\n you can create multiple resources with the same Google Cloud resource name,\n created under the same namespace. These resources create conflicts that\n Config Connector cannot manage."]]
