Stay organized with collections
Save and categorize content based on your preferences.
This page explains how to manage packages with Config Sync from the Google Cloud console.
A package is a set of Kubernetes resource object manifests that are managed in
a source of truth and synced to a cluster by Config Sync. Each package
definition is contained in a RootSync or RepoSync object on the cluster.
For more detailed information about RootSync and RepoSync objects, see
Config Sync architecture.
After you have registered your clusters to a fleet and installed Config Sync,
you can configure Config Sync to deploy a package to a cluster from a
source of truth. You can deploy the same package
to multiple clusters or deploy different packages to different clusters.
You can edit a package after deploying it, except for some settings like
package name and sync type. For more information, see
Manage packages.
To deploy a package, complete the following steps:
In the Google Cloud console, go to the Config Sync dashboard.
In the Select clusters for package deployment table, select the cluster
that you want to deploy a package to and then click Continue.
Select either Package hosted on Git or Package hosted on OCI as
your source type and then click Continue.
In the Package details section, enter a Package name, which
identifies the RootSync or RepoSync object.
In the Sync type field, choose either Cluster scoped sync or Namespace scoped sync as
the sync type.
Cluster scoped sync creates a RootSync object and Namespace scoped sync creates a RepoSync object.
For more information about these objects, see
Config Sync architecture.
In the Source section, complete the following:
For sources hosted in a Git repository, enter the following fields:
Enter the URL of the Git repository that you're using as a source of truth
as the Repository URL.
Optional: Update the Revision field to check out if you're not using
the default HEAD.
Optional: Update the Path field if you don't want to sync from the
root repository.
Optional: Update the Branch field if you're not using the default
main branch.
For sources hosted in an OCI image, enter the following fields:
Enter the URL of the OCI image that you're using as a source of truth
as the Image.
Enter the path of the directory to sync from,
relative to the root directory, as the Directory.
(Optional): Expand the Advanced settings section to complete the following:
Select an Authentication type. Config Sync needs read-only access to
your source of truth to read the configuration files in the source and apply them to your clusters.
Unless your source requires no authentication, such as a public repository,
ensure that you grant Config Sync
read-only access to your Git repository,
OCI image, or Helm chart (gcloud CLI only).
Choose the same authentication type that you configured when you installed
Config Sync:
None: Use no authentication.
SSH: Authenticate by using an SSH key pair.
Cookiefile: Authenticate by using a cookiefile.
Token: Authenticate by using an access token or password.
Google Cloud Repository: Use a Google service account to access a
Cloud Source Repositories repository. Only select this option if
Workload Identity Federation for GKE is not enabled in your cluster.
Workload Identity: Use a Google service account to access a
Cloud Source Repositories repository.
Enter a number in seconds to set the Sync wait time, which determines
how long Config Sync waits between attempts to pull from the source of truth.
Enter a Git proxy URL for the HTTPS proxy to be used when
communicating with the source of truth.
Choose Hierarchy to change the Source format.
The default value Unstructured is recommended in most cases since it
lets you organize your source of truth however you want.
Click Deploy Package.
You are redirected to the Config Sync Packages page. After a few
minutes, you should see Synced in the Sync status
column for the cluster that you configured.
Edit a package
To edit a package that you've already deployed, complete the following steps:
In the Google Cloud console, go to the Config Sync Packages tab.
(Optional): Expand the Quick filters menu and then select a filter to
help find the package that you want to edit.
Expand the package name that you want to edit and then, in the row that contains
the cluster name, click the context menu more_vert
and then click editEdit package.
Review and update the package settings that you want to change.
Click Save.
Uninstall a package
To uninstall a package from the Google Cloud console, complete the following steps:
In the Google Cloud console, go to the Config Sync Packages tab.
(Optional): Expand the Quick filters menu and then select a filter to
help find the package that you want to uninstall.
Expand the package name that you want to uninstall and then, in the row that contains
the cluster name, click the context menu more_vert
and then click deleteUninstall package.
In the confirmation dialog, select whether to uninstall only the RootSync or RepoSync object,
or uninstall the RootSync or RepoSync and all of the resources managed by the
RootSync or RepoSync.
Type the confirmation message and then click Uninstall.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Manage packages\n\nThis page explains how to manage packages with Config Sync from the Google Cloud console.\n\nA *package* is a set of Kubernetes resource object manifests that are managed in\na and synced to a cluster by Config Sync. Each package\ndefinition is contained in a *RootSync* or *RepoSync* object on the cluster.\nFor more detailed information about RootSync and RepoSync objects, see\n[Config Sync architecture](/kubernetes-engine/enterprise/config-sync/docs/concepts/architecture#rootsync-reposync).\n\nBefore you begin\n----------------\n\n- [Install Config Sync](/kubernetes-engine/enterprise/config-sync/docs/how-to/installing-config-sync).\n\nDeploy a package\n----------------\n\nAfter you have registered your clusters to a fleet and installed Config Sync,\nyou can configure Config Sync to deploy a package to a cluster from a\n. You can deploy the same package\nto multiple clusters or deploy different packages to different clusters.\nYou can edit a package after deploying it, except for some settings like\npackage name and sync type. For more information, see\n[Manage packages](/kubernetes-engine/enterprise/config-sync/docs/how-to/manage-packages).\n| **Note:** If you want Config Sync to render and apply a Helm chart, you must [configure Config Sync with the Google Cloud CLI](/kubernetes-engine/enterprise/config-sync/docs/how-to/installing-config-sync#configuring-config-sync) instead.\n\nTo deploy a package, complete the following steps:\n\n1. In the Google Cloud console, go to the **Config Sync dashboard**.\n\n [Go to Config Sync dashboard](https://console.cloud.google.com/kubernetes/config_management)\n2. Click **Deploy Package**.\n\n3. In the **Select clusters for package deployment** table, select the cluster\n that you want to deploy a package to and then click **Continue**.\n\n4. Select either **Package hosted on Git** or **Package hosted on OCI** as\n your source type and then click **Continue**.\n\n5. In the **Package details** section, enter a **Package name**, which\n identifies the RootSync or RepoSync object.\n\n6. In the **Sync type** field, choose either **Cluster scoped sync** or **Namespace scoped sync** as\n the sync type.\n\n Cluster scoped sync creates a RootSync object and Namespace scoped sync creates a RepoSync object.\n For more information about these objects, see\n [Config Sync architecture](/kubernetes-engine/enterprise/config-sync/docs/concepts/architecture#rootsync-reposync).\n7. In the **Source** section, complete the following:\n\n - For sources hosted in a Git repository, enter the following fields:\n\n 1. Enter the URL of the Git repository that you're using as a source of truth as the **Repository URL**.\n 2. Optional: Update the **Revision** field to check out if you're not using the default `HEAD`.\n 3. Optional: Update the **Path** field if you don't want to sync from the root repository.\n 4. Optional: Update the **Branch** field if you're not using the default `main` branch.\n - For sources hosted in an OCI image, enter the following fields:\n\n 1. Enter the URL of the OCI image that you're using as a source of truth as the **Image**.\n 2. Enter the path of the directory to sync from, relative to the root directory, as the **Directory**.\n8. (Optional): Expand the **Advanced settings** section to complete the following:\n\n 1. Select an **Authentication type** . Config Sync needs read-only access to\n your source of truth to read the configuration files in the source and apply them to your clusters.\n Unless your source requires no authentication, such as a public repository,\n ensure that you grant Config Sync\n read-only access to your [Git repository](/kubernetes-engine/enterprise/config-sync/docs/how-to/installing-config-sync#git-creds-secret),\n [OCI image](/kubernetes-engine/enterprise/config-sync/docs/how-to/installing-config-sync#oci-access), or [Helm chart](/kubernetes-engine/enterprise/config-sync/docs/how-to/installing-config-sync#helm-access) (gcloud CLI only).\n Choose the same authentication type that you configured when you installed\n Config Sync:\n\n | **Note:** for OCI, you can only select **Workload Identity** for authentication.\n - **None**: Use no authentication.\n - **SSH**: Authenticate by using an SSH key pair.\n - **Cookiefile** : Authenticate by using a `cookiefile`.\n - **Token**: Authenticate by using an access token or password.\n - **Google Cloud Repository** : Use a Google service account to access a Cloud Source Repositories repository. Only select this option if Workload Identity Federation for GKE is *not* enabled in your cluster.\n - **Workload Identity**: Use a Google service account to access a Cloud Source Repositories repository.\n 2. Enter a number in seconds to set the **Sync wait time**, which determines\n how long Config Sync waits between attempts to pull from the source of truth.\n\n 3. Enter a **Git proxy** URL for the HTTPS proxy to be used when\n communicating with the source of truth.\n\n 4. Choose **Hierarchy** to change the **Source format**.\n\n The default value **Unstructured** is recommended in most cases since it\n lets you organize your source of truth however you want.\n9. Click **Deploy Package**.\n\n You are redirected to the Config Sync **Packages** page. After a few\n minutes, you should see **Synced** in the **Sync status**\n column for the cluster that you configured.\n\nEdit a package\n--------------\n\nTo edit a package that you've already deployed, complete the following steps:\n\n1. In the Google Cloud console, go to the Config Sync **Packages** tab.\n\n [Go to Packages](https://console.cloud.google.com/kubernetes/config_management/packages)\n2. (Optional): Expand the **Quick filters** menu and then select a filter to\n help find the package that you want to edit.\n\n3. Expand the package name that you want to edit and then, in the row that contains\n the cluster name, click the context menu *more_vert*\n and then click *edit*\n **Edit package**.\n\n4. Review and update the package settings that you want to change.\n\n5. Click **Save**.\n\nUninstall a package\n-------------------\n\n| **Note:** The Google Cloud console uses the deletion propagation feature to delete package resources. If you don't manage your RootSync and RepoSync objects with the Google Cloud console, you can still use the deletion propagation feature to achieve a similar uninstall behavior, with `kubectl` or any other Kubernetes client. For more information, see [Bulk delete objects](/kubernetes-engine/enterprise/config-sync/docs/how-to/managing-objects#bulk_delete_objects) ([Preview](/products#product-launch-stages)).\n\nTo uninstall a package from the Google Cloud console, complete the following steps:\n\n1. In the Google Cloud console, go to the Config Sync **Packages** tab.\n\n [Go to Packages](https://console.cloud.google.com/kubernetes/config_management/packages)\n2. (Optional): Expand the **Quick filters** menu and then select a filter to\n help find the package that you want to uninstall.\n\n3. Expand the package name that you want to uninstall and then, in the row that contains\n the cluster name, click the context menu *more_vert*\n and then click *delete*\n **Uninstall package**.\n\n4. In the confirmation dialog, select whether to uninstall only the RootSync or RepoSync object,\n or uninstall the RootSync or RepoSync **and** all of the resources managed by the\n RootSync or RepoSync.\n\n5. Type the confirmation message and then click **Uninstall**.\n\nWhat's next\n-----------\n\n- [Monitor the status of Config Sync and packages](/kubernetes-engine/enterprise/config-sync/docs/how-to/use-config-sync-dashboard)\n- Use the [`nomos` command-line tool](/kubernetes-engine/enterprise/config-sync/docs/how-to/nomos-command)\n- [Troubleshoot Config Sync](/kubernetes-engine/enterprise/config-sync/docs/how-to/troubleshooting-config-sync)"]]