이 튜토리얼에서는 Google Kubernetes Engine(GKE) Enterprise 버전 클러스터를 만들고 구성 동기화를 사용하여 멀티 저장소 샘플 저장소의 구성에 동기화합니다.
규정 준수팀에서 조직의 모든 구성원이 내부 규칙을 준수하도록 해야 한다고 가정해 보세요. 이러한 규칙을 적용하기 위해 규정 준수팀은 구성을 만들고 샘플 저장소에 추가했습니다. 조직의 각 클러스터는 저장소에 동기화해야 하며 클러스터를 만들고 동기화할 책임은 사용자에게 있습니다.
시작하기 전에
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
In the Principal column, find all rows that identify you or a group that
you're included in. To learn which groups you're included in, contact your
administrator.
For all rows that specify or include you, check the Role column to see whether
the list of roles includes the required roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
Fetching cluster endpoint and auth data.
kubeconfig entry generated for cs-cluster.
승인을 요청하는 메시지가 표시되면 승인을 클릭합니다.
클러스터 및 저장소 검사
config-sync-quickstart 디렉터리에는 ClusterRole, CustomResourceDefinition, Rolebinding, 네임스페이스, RepoSync 구성이 포함됩니다. 모니터링용 Prometheus 연산자의 구성도 포함되어 있습니다.
이 구성은 구성 동기화가 저장소에서 읽도록 구성되는 즉시 적용됩니다.
구성 동기화가 관리하는 모든 객체에는 configmanagement.gke.io로 설정된 app.kubernetes.io/managed-by 라벨이 있습니다. 이 라벨을 사용하여 관리형 객체를 볼 수 있습니다.
구성 동기화가 관리하는 네임스페이스를 나열하려면 다음 명령어를 실행합니다.
kubectl get ns -l app.kubernetes.io/managed-by=configmanagement.gke.io
출력은 다음과 비슷합니다.
NAME STATUS AGE
gamestore Active 58s
monitoring Active 58s
ClusterRole, Reposync, CRD, Rolebinding 등의 다른 객체를 같은 방식으로 검사할 수 있습니다.
동기화 상태 확인
구성 동기화를 사용하는 경우 nomos 명령줄 도구를 사용할 수 있습니다. 이 도구는 구성 동기화의 추가 기능을 제공합니다.
이 섹션에서는 nomos status 명령어를 사용하여 구성 동기화가 클러스터에 모든 구성을 성공적으로 동기화했는지 확인합니다.
nomos status
출력은 다음과 비슷합니다.
*gke_PROJECT_ID_ZONE_cs-cluster
--------------------
<root>:root-sync https://github.com/GoogleCloudPlatform/anthos-config-management-samples/config-sync-quickstart/multirepo/root@main
SYNCED @ 2023-02-03 16:58:42 +0000 UTC 1fbab5c90af9029b26451fec92e9900d8db23aee
Managed resources:
NAMESPACE NAME STATUS SOURCEHASH
clusterrole.rbac.authorization.k8s.io/namespace-reader Current 1fbab5c
clusterrole.rbac.authorization.k8s.io/prometheus-acm Current 1fbab5c
clusterrole.rbac.authorization.k8s.io/prometheus-operator Current 1fbab5c
clusterrole.rbac.authorization.k8s.io/webstore-admin Current 1fbab5c
clusterrolebinding.rbac.authorization.k8s.io/prometheus-acm Current 1fbab5c
clusterrolebinding.rbac.authorization.k8s.io/prometheus-operator Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/alertmanagerconfigs.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/alertmanagers.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/anvils.acme.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/podmonitors.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/probes.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/prometheuses.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/prometheusrules.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/servicemonitors.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/thanosrulers.monitoring.coreos.com Current 1fbab5c
customresourcedefinition.apiextensions.k8s.io/webstores.marketplace.com Current 1fbab5c
namespace/gamestore Current 1fbab5c
namespace/monitoring Current 1fbab5c
gamestore reposync.configsync.gke.io/repo-sync Current 1fbab5c
gamestore rolebinding.rbac.authorization.k8s.io/gamestore-admin Current 1fbab5c
gamestore rolebinding.rbac.authorization.k8s.io/gamestore-webstore-admin Current 1fbab5c
monitoring deployment.apps/prometheus-operator Current 1fbab5c
monitoring prometheus.monitoring.coreos.com/acm Current 1fbab5c
monitoring service/prometheus-acm Current 1fbab5c
monitoring service/prometheus-operator Current 1fbab5c
monitoring serviceaccount/prometheus-acm Current 1fbab5c
monitoring serviceaccount/prometheus-operator Current 1fbab5c
monitoring servicemonitor.monitoring.coreos.com/acm-service Current 1fbab5c
--------------------
gamestore:repo-sync https://github.com/GoogleCloudPlatform/anthos-config-management-samples/config-sync-quickstart/multirepo/namespaces/gamestore@main
SYNCED @ 2023-02-03 16:58:51 +0000 UTC 1fbab5c90af9029b26451fec92e9900d8db23aee
Managed resources:
NAMESPACE NAME STATUS SOURCEHASH
gamestore configmap/store-inventory Current 1fbab5c
gamestore webstore.marketplace.com/gameplace Current 1fbab5c
이 출력에서는 cs-cluster가 두 저장소에서 성공적으로 동기화되는 것을 확인할 수 있습니다. 또한 모든 리소스의 상태가 Current이므로 리소스 상태가 원하는 상태와 일치합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["In this tutorial, you create a Google Kubernetes Engine cluster and\nuse Config Sync to sync to configs in the\n[multi-repo samples repository](https://github.com/GoogleCloudPlatform/anthos-config-management-samples/tree/main/config-sync-quickstart/multirepo).\n\nImagine that your compliance team is responsible for making sure that everyone\nin your organization is following internal rules. To enforce these rules, the\ncompliance team has created configs, which they have added to the samples\nrepository. Each cluster in your organization is required to sync to the\nrepository and you are responsible for creating and syncing clusters.\n\nBefore you begin\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n1.\n\n Make sure that you have the following role or roles on the project:\n\n Kubernetes Engine Admin\n\n Check for the roles\n 1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=project)\n 2. Select the project.\n 3.\n In the **Principal** column, find all rows that identify you or a group that\n you're included in. To learn which groups you're included in, contact your\n administrator.\n\n 4. For all rows that specify or include you, check the **Role** column to see whether the list of roles includes the required roles.\n\n Grant the roles\n 1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=project)\n 2. Select the project.\n 3. Click person_add **Grant access**.\n 4.\n In the **New principals** field, enter your user identifier.\n\n This is typically the email address for a Google Account.\n\n 5. In the **Select a role** list, select a role.\n 6. To grant additional roles, click add **Add\n another role** and add each additional role.\n 7. Click **Save**.\n\nCreate a cluster\n\nIn this section, you create a cluster that you can use in this tutorial.\nAlthough in a real-world scenario you would likely manage multiple\nclusters, to simplify this tutorial you only create and manage one cluster.\n\nTo create a cluster, complete the following steps:\n\n1. Enable the Google Kubernetes Engine API.\n\n [Go to GKE](https://console.cloud.google.com/apis/library/container.googleapis.com)\n2. In the Google Cloud console, go to the **Kubernetes Engine** page.\n\n [Go to Google Kubernetes Engine](https://console.cloud.google.com/kubernetes/list)\n3. Click *add_box* **Create**.\n\n4. In the **Autopilot** section, select **Configure**.\n\n5. In the **Cluster basics** section, enter `cs-cluster` in the **Name**\n field. Leave all other fields with their recommended defaults.\n\n6. Click **Create** . You are taken to the **Kubernetes clusters** page. It\n takes several minutes for your cluster to be created. When you see a green\n check mark in the **Status** column next to your cluster, it's ready.\n\nConfigure your cluster\n\nNow that you've created a cluster, you can configure Config Sync to sync\nto the configs in the [`config-sync-quickstart` directory](https://github.com/GoogleCloudPlatform/anthos-config-management-samples/tree/main/config-sync-quickstart)\nof the samples repository.\n\nTo configure Config Sync on the Google Cloud console, complete the\nfollowing steps:\n\n1. In the Google Cloud console, go to the **Config** page under the **Features** section.\n\n \u003cbr /\u003e\n\n [Go to Config](https://console.cloud.google.com/kubernetes/config_management)\n2. Click *add* **Install Config Sync**.\n3. Select the Config Sync version that you want to use.\n4. Under **Installation options** , select **Install Config Sync on individual clusters**.\n5. In the **Available clusters** table, select `cs-cluster` and click **Install Config Sync** . In the **Settings** tab, you should see the status for the `cs-cluster` as **Enabled** after a few minutes.\n6. On the **Config Sync dashboard** , click **Deploy cluster package**.\n7. In the **Select clusters for package deployment** table, select `cs-cluster` and then click **Continue**.\n8. Leave **Package hosted on Git** selected and then click **Continue**.\n9. In the **Package name** field, enter `sample-repository`.\n10. In the **Repository URL** field, enter `https://github.com/GoogleCloudPlatform/anthos-config-management-samples`.\n11. In the **Path** field, enter `config-sync-quickstart/multirepo/root`.\n12. Leave all other fields with their default values.\n13. Click **Deploy Package**.\n\n After a few minutes, you should see **Synced** in the **Sync status**\n column for `cs-cluster`.\n\nNow that Config Sync is synced to a repository, it continuously reconciles\nthe state of your clusters with the configs in the repository.\n\nView package details\n\nTo view all the objects that are managed by Config Sync, from the **Packages** tab, click `cs-cluster`\nand view the package details page. From this page, you get an overview of all\nresources synced per package and details like the resource type and which namespace\nthe resources is synced to.\n\nYou can navigate to the\n[/config-sync-quickstart/multirepo/](https://github.com/GoogleCloudPlatform/anthos-config-management-samples/tree/main/config-sync-quickstart/multirepo)\nfolder of the repository in GitHub to explore the configs\nthat caused these namespaces to be created. The `config-sync-quickstart` directory includes ClusterRole,\nCustomResourceDefinition, Rolebinding, Namespace, and RepoSync configs. It\nalso includes configurations for the Prometheus Operator for monitoring.\n\nClean up\n\n1. Go to the GKE menu in Google Cloud console.\n\n [Go to GKE](https://console.cloud.google.com/kubernetes/list)\n2. Next to the `cs-cluster`, click *more_vert* **Actions** , then click *delete* **Delete**.\n\n3. When prompted to confirm, click **Delete** again.\n\nWhat's next\n\n- Learn about [validating configs](/kubernetes-engine/enterprise/config-sync/docs/how-to/validating-configs)."]]
