Google Config Sync

Google Config Sync automates configuration and policy synchronization across Kubernetes clusters. It monitors a source of truth and reconciles cluster state to help prevent configuration drift. Configuration can come from Git repositories, OCI images, or Helm charts, and the service can apply Policy Controller constraints across registered and connected clusters. It can also provision and manage namespaces with namespace-level policies, including RBAC roles for multi-tenancy. Config Sync supports Autopilot and Standard GKE clusters, as well as GKE-attached clusters including EKS and AKS. Clusters must be registered to a fleet before it can be enabled. Its architecture combines hosted components in Google Cloud with open source components on GKE. For OCI repositories, it can work with an admission webhook signature verification server to help restrict use to trusted images. Config Sync is included with Google Kubernetes Engine, subject to a supported cluster version and fleet registration. It runs only on x86-based nodes; its drift-prevention admission webhook may use high memory in clusters with many custom resources.

Config Sync brings configuration synchronization, policy application, and namespace management to Kubernetes environments. Check fleet registration, supported cluster versions, and node architecture before adopting it.

Config Sync suits teams managing configuration and policies across Kubernetes clusters, including GKE and attached clusters. It is a fit for users who can meet its fleet-registration and x86 node requirements.

Google Config Sync is a cloud-delivered GitOps service for keeping Kubernetes configuration and policy aligned across clusters. It is aimed at teams operating GKE fleets or GKE-attached environments that need a continuously reconciled source of truth. The strongest reason to choose it is fleet-wide consistency; fleet registration, x86-only nodes, and possible webhook memory pressure are meaningful prerequisites.

Overview

Config Sync continuously compares cluster state with configuration held in Git, OCI images, or Helm charts, then corrects differences. That makes it a practical defense against configuration drift across any number of clusters, provided your team is comfortable treating a defined source of truth as authoritative. It is a cloud deployment with hosted components in Google Cloud and open-source components running on the GKE cluster.

Before enablement, clusters must be registered to a fleet. Workload Identity Federation for GKE is the recommended secure connection to Google Cloud services and is required when using fleet packages. Config Sync supports both Autopilot and Standard GKE clusters, but it runs only on x86-based nodes, not Arm.

Key features

GitOps synchronization covers GitHub, GitLab, Bitbucket, Cloud Source Repositories, and Secure Source Manager, as well as OCI and Helm sources. Deployment targets include GKE clusters and GKE-attached clusters, including EKS and AKS. That combination suits organizations managing a mixed Kubernetes estate from a shared workflow, although the GKE fleet prerequisite still shapes the operating model.

Policy Controller constraints can be applied consistently across registered and connected clusters. Rego policy, policy testing, admission control, runtime enforcement, policy reporting, and audit logs provide a broad governance set rather than synchronization alone. Config Sync can also provision namespaces and apply namespace-scoped policies such as RBAC roles, a useful foundation for multi-tenancy and repeatable namespace boundaries.

Progressive delivery, CI/CD integration, infrastructure provisioning, infrastructure-as-code support, and Kubernetes management extend its role beyond a simple file copier. OCI repositories can integrate with a Kubernetes admission webhook for signature verification, helping restrict deployments to trusted OCI images. The trade-off is operational: the drift-prevention admission webhook can consume substantial memory and cause out-of-memory errors in clusters with many custom resources.

Pricing

Config Sync included with GKE — free, included with Google Kubernetes Engine. It requires a GKE-supported cluster version and fleet registration. There is no separate paid tier presented, so this is the natural fit for GKE users who want the capability within their existing Google Kubernetes Engine arrangement. The qualification requirements, rather than a seat or usage quota, are the key adoption constraints.

Google Cloud also offers support packages with 24/7 coverage, phone support, and access to a technical support manager. That support does not cover issues with customer-owned YAML configurations, so teams remain responsible for the quality and correctness of their manifests.

Platforms

Config Sync is offered through API, self-hosted cluster components, and the web, with a cloud deployment model. It supports GKE Autopilot and Standard clusters, plus GKE-attached EKS and AKS targets. x86 nodes are required; Arm-based nodes are not supported.

Who it's for

Choose Config Sync if you run multiple Kubernetes clusters, already use GKE or attached clusters, and need policy, namespace, and configuration changes to converge automatically. It is especially suitable for platform teams enforcing Rego-based controls and RBAC conventions across tenants. Look elsewhere if fleet registration is unacceptable, your nodes are Arm-based, or your custom-resource volume makes admission-webhook memory risk difficult to manage.

Pros and cons

Pros

• Continuous reconciliation limits configuration drift across any number of clusters.
• Git, OCI, and Helm sources cover common delivery workflows.
• Policy Controller, Rego, testing, admission, runtime enforcement, reporting, and audit logs support governance as well as deployment.
• Namespace provisioning and namespace-scoped RBAC help standardize multi-tenant operations.
• Attached EKS and AKS clusters can be managed alongside GKE targets.

Cons

• Every cluster must be fleet-registered before enablement.
• Arm nodes are unsupported.
• Drift-prevention admission webhooks may trigger high memory use and out-of-memory errors with many custom resources.
• Google support excludes customer-owned YAML configuration problems.

Alternatives

Jio CloudXP is a paid, modular platform with Android, iOS, API, and web access; choose it when that broader platform model fits better than Kubernetes-focused synchronization.

Apache CloudStack is free, open-source IaaS software for API, Linux, self-hosted, and web environments, making it the better direction for cloud infrastructure management rather than Config Sync's policy reconciliation.

Cloudify offers a no-time-limit Community plan requiring Docker or a VM and access to a cloud provider, useful when you want a freemium orchestration platform.

Kubermatic Kubernetes Platform provides a free Apache 2.0 Community Edition and a consumption-based Enterprise Edition for teams seeking a broader Kubernetes platform.

KubeSphere is a free, enterprise-grade open-source Kubernetes container platform for teams wanting that broader community platform.

Qstack offers free and paid plans for API, self-hosted, and web use, including a 9,999 CNY annual professional plan.

CloudBolt has a forever-free CMP plan capped at 100 resources, suited to smaller environments needing core cloud-management capabilities.

Crossplane is a free Apache 2.0 project that runs in an existing Kubernetes cluster, a straightforward choice for teams preferring open-source infrastructure composition.

Verdict

Google Config Sync is a strong choice for GKE-centered platform teams that need one continuously reconciled workflow for configuration, policy, and namespaces across clusters. Choose it for fleet-wide control and integrated governance; look elsewhere when Arm support, no fleet prerequisite, or lower webhook memory risk is essential.