Install Config Sync as a fleet default

gcloud

1. Create a manifest named apply-spec.yaml with the following contents. If you've already created a manifest, you don't need to create a new one.

   applySpecVersion: 1
   spec:
     configSync:
       enabled: true
       sourceType: git
       sourceFormat: unstructured
       syncRepo: REPO
       syncRev: REVISION
       secretType: SECRET_TYPE
       # only required if gcpserviceaccount is the secretType
       # gcpServiceAccountEmail: EMAIL
       metricsGcpServiceAccountEmail: METRICS_EMAIL
       preventDrift: false
   

   Replace the following:

   • REPO: the URL of your Git repository, for example https://github.com/GoogleCloudPlatform/anthos-config-management-samples. Use the HTTPS format for the URL, or the SSH format if ssh is the sourceType.
   • REVISION: the Git revision (tag or hash) or branch name to sync from. When using a hash, it must be a full hash, and not an abbreviated form.

   • SECRET_TYPE: the authentication method used to connect to your Git repository. For public repositories, use none. For private repositories, use one of the following:

     • ssh: use an SSH key pair.
     • cookiefile: use a cookiefile.
     • token: use a token.
     • gcpserviceaccount: use a Google service account if Workload Identity Federation for GKE is enabled. Secure Source Manager or Cloud Source Repositories only.
     • gcenode: use a Google service account if Workload Identity Federation for GKE is not enabled. Secure Source Manager or Cloud Source Repositories only.
     • githubapp: use a GitHub App to authenticate to a GitHub repository.

     For more information about connecting your Git repository to Config Sync, see Grant Config Sync access to Git.

   • EMAIL: if gcpserviceaccount is the secretType, uncomment this field and add the Google service account email address, for example config-sync@PROJECT_ID.iam.gserviceaccount.com.

   • METRICS_EMAIL: the email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring. For more information on setting up metrics export, see Monitor Config Sync.

   For a complete list of fields that you can add to the apply-spec manifest, see gcloud apply spec fields.

2. Apply the apply-spec file with your default fleet settings by running the following command:

   gcloud beta container fleet config-management enable \
       --fleet-default-member-config=apply-spec.yaml
   

Console

1. In the Google Cloud console, go to the Feature Manager page.

   Go to Feature Manager

2. In the Config Sync pane, click Configure.

3. Review your fleet-level settings. All new clusters that you create in the fleet inherit these settings.

4. Optional: To change the default settings, click Customize fleet settings. In the dialog that appears, do the following:

   1. Select the Config Sync version that you want to use.
   2. Click Save changes.

5. Click Configure.

6. In the Configuring fleet settings confirmation dialog, click Confirm. If you haven't previously enabled Config Sync, clicking Confirm also enables the anthosconfigmanagement.googleapis.com API.

Although you can't configure your source of truth settings as a fleet default from the Google Cloud console, you can select multiple clusters when you use the Deploy a package feature.

Terraform

To enable Config Sync as a fleet default, refer to the following example:

resource "google_gke_hub_feature" "default" {
  name     = "configmanagement"
  location = "global"

  fleet_default_member_config {
    configmanagement {
      config_sync {
        # The field `enabled` was introduced in Terraform version 5.41.0, and
        # needs to be set to `true` explicitly to install Config Sync.
        enabled = true
        git {
          sync_repo   = "REPO"
          sync_branch = "BRANCH"
          policy_dir  = "DIRECTORY"
          secret_type = "SECRET"
        }
      }
    }
  }
}

Replace the following:

• REPO: the URL to the Git repository that contains your configuration files.
• BRANCH: the repository branch, for example main.
• DIRECTORY: the path within the Git repository that represents the top level of the repository you want to sync.
• SECRET: the secret auth type.

For more information about using Terraform, see Provision Config Sync resources with Terraform.

gcloud

1. Create a manifest named apply-spec.yaml with the following contents. If you've already created a manifest, you don't need to create a new one.

   applySpecVersion: 1
   spec:
     configSync:
       enabled: true
       sourceType: oci
       sourceFormat: unstructured
       syncRepo: REPO
       secretType: SECRET_TYPE
       # only required if gcpserviceaccount is the secretType
       # gcpServiceAccountEmail: EMAIL
       metricsGcpServiceAccountEmail: METRICS_EMAIL
       preventDrift: false
   

   Replace the following:

   • REPO: the URL of your OCI image with the format LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME. By default, the image is pulled from the latest tag, but you can pull in images by TAG or DIGEST instead. Specify TAG or DIGEST in the PACKAGE_NAME:

     • To pull by TAG: LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME:TAG
     • To pull by DIGEST: LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME@sha256:DIGEST

   • SECRET_TYPE: the authentication method used to connect to your OCI image. For public images, use none as the value. For private images, use one of the following:

     • gcpserviceaccount: Secure Source Manager or Cloud Source Repositories only. Use a Google service account if Workload Identity Federation for GKE is enabled.
     • gcenode: Secure Source Manager or Cloud Source Repositories only. Use a Google service account if Workload Identity Federation for GKE is not enabled.

     For more information on connecting your OCI image to Config Sync, see Grant Config Sync access to OCI or Helm.

   • EMAIL: if gcpserviceaccount is the secretType, uncomment this field and add the Google service account email address, for example config-sync@PROJECT_ID.iam.gserviceaccount.com.

   • METRICS_EMAIL: the email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring. For more information on setting up metrics export, see Monitor Config Sync.

   For a complete list of fields that you can add to the apply-spec manifest, see gcloud apply spec fields.

2. Apply the apply-spec file with your default fleet settings by running the following command:

   gcloud beta container fleet config-management enable \
       --fleet-default-member-config=apply-spec.yaml
   

Console

1. In the Google Cloud console, go to the Feature Manager page.

   Go to Feature Manager

2. In the Config Sync pane, click Configure.

3. Review your fleet-level settings. All new clusters you create in the fleet inherit these settings.

4. Optional: To change the default settings, click Customize fleet settings. In the dialog that appears, do the following:

   1. Select the Config Sync version that you want to use.
   2. Click Save changes.

5. Click Configure.

6. In the Configuring fleet settings confirmation dialog, click Confirm. If you haven't previously enabled Config Sync, clicking Confirm also enables the anthosconfigmanagement.googleapis.com API.

Although you can't configure your source of truth settings as a fleet default from the Google Cloud console, you can select multiple clusters when you use the Deploy a package feature.

Terraform

To enable Config Sync as a fleet default, refer to the following example:

resource "google_gke_hub_feature" "configmanagement_feature_member" {
  name     = "configmanagement"
  location = "global"

  fleet_default_member_config {
    configmanagement {
      config_sync {
        # The field `enabled` was introduced in Terraform version 5.41.0, and
        # needs to be set to `true` explicitly to install Config Sync.
        enabled = true
        oci {
          sync_repo   = "REPO"
          policy_dir  = "DIRECTORY"
          secret_type = "SECRET"
        }
      }
    }
  }
}

Replace the following:

• REPO: the URL to the OCI image repository that contains your configuration files.
• DIRECTORY: the absolute path of the directory containing the resources you want to sync. To use the root directory, leave this field blank.
• SECRET: the secret auth type.

For more information about using Terraform, see Provision Config Sync resources with Terraform.

gcloud

1. Sync an existing membership to the fleet default configuration:

   gcloud beta container fleet config-management apply \
       --origin=FLEET \
       --membership=MEMBERSHIP_NAME
   

   Replace MEMBERSHIP_NAME with the fleet membership name of the cluster that you want to sync with the fleet default configuration.

2. Confirm that your membership configurations are synced with the fleet default:

   gcloud beta container fleet config-management status
   

   The output of this command should display as Yes for the Synced_to_Fleet_Default status of the membership that you synced.

console

1. Go to Feature Manager:

   Go to Feature Manager: Config Sync

2. In the cluster table, select the clusters that you want to sync to fleet settings.

3. Click Sync to fleet settings.