Config Sync-managed labels and annotations

Config Sync adds and manages several labels and annotations on objects in the cluster. Don't modify these values unless they are marked Safe to modify in the following tables.

Labels

Label	Description	Safe to modify
app.kubernetes.io/managed-by: configmanagement.gke.io	Indicates that Config Sync manages the object.	No.
applyset.kubernetes.io/id: APPLYSET_ID	Indicates that the RootSync or RepoSync object is the parent of the specified ApplySet.	No.
applyset.kubernetes.io/part-of: APPLYSET_ID	Indicates that the resource object is a member of the specified ApplySet.	No.
configsync.gke.io/declared-version: API_VERSION	Indicates the API version in which a resource was initially declared.	No.

Annotations

Annotation	Description	Safe to modify
applyset.kubernetes.io/tooling: configsync.gke.io/v1	Indicates that the ApplySet specified by the applyset.kubernetes.io/id label is managed by Config Sync. Only set on ApplySet parents, not members.	No.
configmanagement.gke.io/cluster-name: CLUSTER_NAME	The name of the cluster, used by ClusterSelectors.	No.
configmanagement.gke.io/declared-config: JSON_OUTPUT	JSON representation of how the object is declared in the source of truth.	No.
configmanagement.gke.io/managed: enabled	Indicates that Config Sync manages the object.	Yes. For more information, see Manage existing cluster objects.
configmanagement.gke.io/sync-kind: SYNC_KIND	Indicates whether the sync type is a RootSync or RepoSync object.	No.
configmanagement.gke.io/sync-name: SYNC_NAME	Indicates the name of the RootSync or RepoSync associated with the object.	No.
configmanagement.gke.io/sync-namespace: SYNC_NAMESPACE	Indicates the Namespace of the RootSync or RepoSync associated with the object.	No.
configmanagement.gke.io/source-path: PATH	The path in the source of truth to the file declaring this object.	No.
configmanagement.gke.io/token: TOKEN_HASH	The hash of the repository when this object was last modified.	No.
configsync.gke.io/declared-fields: DECLARED_FIELDS	Stores the declared configuration of a resource. This annotation uses the same format as the managed fields of server-side apply.	No.
configsync.gke.io/image-to-sync: SOURCE_IMAGE_URL	The OCI image URL with the latest digest fetched by Config Sync.	No.
configsync.gke.io/manager: MANAGER	Which reconciler manages the current object. The value is :root or NAMESPACE.	No.
configsync.gke.io/resource-id: RESOURCE_ID	Indicates information about the resource's group, kind, namespace, and name.	No.
configsync.gke.io/git-context: GIT_CONTEXT	Stores the Git context that a resource is synced from. Includes information on the repository, branch, and revision.	No.
config.k8s.io/owning-inventory: INVENTORY	Indicates the resource-group object that owns this resource.	No.
configsync.gke.io/deletion-propagation-policy: Foreground	Enables deletion propagation of resources managed by a RootSync or RepoSync. This behavior is disabled by default if the annotation is not set or if the annotation is configsync.gke.io/deletion-propagation-policy: Orphan.	Yes. For more information, see Delete managed resources.
configsync.gke.io/requires-rendering: true	Indicates that the source of truth contains Kustomize configurations that require rendering.	No.
configsync.gke.io/dynamic-ns-selector-enabled: true	Indicates that the source of truth contains NamespaceSelector objects that use the dynamic mode.	No.