Skip to content
SPECIFICTION
Get listed

Google Config Sync

docs.cloud.google.com

Free plan Open source WebLinuxAPISelf-hosted
Visit docs.cloud.google.com
Spec score 8.7 #5 of 35 in GitOps Tools

What it is

Google Config Sync keeps configuration and policies aligned across Kubernetes clusters by monitoring a source of truth and reconciling cluster state. It can sync files from Git repositories, OCI images and Helm charts, and apply Policy Controller constraints to registered and connected clusters. Namespace management supports multi-tenancy through namespace-scoped policies such as RBAC roles. Config Sync supports Autopilot and Standard GKE clusters, plus GKE-attached clusters including EKS and AKS. Clusters must be registered to a fleet before the service can be enabled. Its architecture combines hosted Google Cloud components with open-source components running on GKE. For OCI repositories, it can integrate with an admission webhook signature verification server to help ensure only trusted images are used. Config Sync is included with Google Kubernetes Engine at free, subject to a GKE-supported cluster version and fleet registration. It runs only on x86-based nodes, not Arm nodes. The drift-prevention admission webhook can use high memory and cause out-of-memory errors in clusters with many custom resources.

Spec sheet

What it does
Config Sync automates synchronization of Kubernetes configurations and policies from a central source of truth to multiple clusters.Read 15 Oct 2026 · docs.cloud.google.com
Support
Google Cloud offers support packages including 24/7 coverage, phone support, and access to a technical support manager.Read 1 Oct 2026 · docs.cloud.google.com
API and extensibility
RootSync and RepoSync Kubernetes custom resources expose configuration fields such as source type, repository, revision, directory, and authentication.Read 15 Oct 2026 · pkg.go.dev
Architecture
Config Sync includes hosted components running in Google Cloud and open source components running on the GKE cluster.Read 1 Oct 2026 · docs.cloud.google.com
Authentication options
Supported repository authentication includes SSH keys, tokens, Kubernetes service accounts, Google service accounts, and GitHub Apps, with method-specific limitations.Read 15 Oct 2026 · docs.cloud.google.com
Automatic reconciliation
It continuously monitors the source of truth and reconciles cluster state to match it, preventing configuration drift.Read 1 Oct 2026 · docs.cloud.google.com
CLI tooling
Documentation provides the nomos command-line tool for validation, status inspection, hydration, and troubleshooting.Read 15 Oct 2026 · docs.cloud.google.com
Cloud integrations
Google documents integrations with the Google Cloud console, Terraform, Google Cloud CLI, Policy Controller, Workload Identity Federation for GKE, and Cloud Monitoring.Read 15 Oct 2026 · docs.cloud.google.com
Cluster modes
Config Sync supports both Autopilot and Standard GKE clusters.Read 1 Oct 2026 · docs.cloud.google.com
Company founded
Crunchbase lists Google as founded in 1998.Read 15 Oct 2026 · crunchbase.com
Company headquarters
Crunchbase lists Google's headquarters as Mountain View, California, United States.Read 15 Oct 2026 · crunchbase.com
Company legal name
Crunchbase identifies the maker's legal name as Google LLC and its parent as Alphabet.Read 15 Oct 2026 · crunchbase.com
Company ownership
Crunchbase identifies Google as a subsidiary of Alphabet and a for-profit public company traded as NASDAQ:GOOG.Read 15 Oct 2026 · crunchbase.com
Documentation depth
The documentation includes guides, quickstarts, installation instructions, gcloud references, error references, RootSync and RepoSync fields, release notes, training, and troubleshooting.Read 15 Oct 2026 · docs.cloud.google.com
Drift prevention limitation
The drift-prevention admission webhook can cause high memory usage and out-of-memory errors in clusters with many custom resources.Read 1 Oct 2026 · docs.cloud.google.com
Drift reconciliation
Config Sync continuously compares cluster state with the declared source and reconciles differences automatically.Read 15 Oct 2026 · docs.cloud.google.com
Fleet requirement
Clusters must be registered to a fleet before Config Sync can be enabled.Read 15 Oct 2026 · docs.cloud.google.com
GitOps synchronization
Config Sync automates synchronization of configuration and policies across any number of clusters.Read 1 Oct 2026 · docs.cloud.google.com
Go module
pkg.go.dev lists Config Sync version v1.23.3 as an Apache-2.0, tagged, redistributable Go module published March 11, 2026.Read 15 Oct 2026 · pkg.go.dev
Helm rendering
Config Sync fetches and renders Helm charts and can deploy their resulting resources into a namespace.Read 15 Oct 2026 · docs.cloud.google.com
Identity security
Workload Identity Federation for GKE is the recommended way to securely connect to Google Cloud services and is required for fleet packages.Read 1 Oct 2026 · docs.cloud.google.com
Independent service description
A UK government G-Cloud service summary describes Config Sync as keeping configuration in version control and automatically applying it consistently across Kubernetes clusters.Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
Kustomize support
It automatically renders native Kustomize configurations and Helm references, but excludes custom Kustomize plugins.Read 15 Oct 2026 · docs.cloud.google.com
Licence
The open-source Config Sync repository is published under the Apache-2.0 licence.Read 15 Oct 2026 · github.com
Limit: application delivery
Google describes Config Sync as complementary to CI/CD and primarily suited to base-layer resources rather than replacing application deployment systems.Read 15 Oct 2026 · cloud.google.com
Limit: built-in roles
Config Sync cannot directly manage GKE built-in ClusterRoles such as cluster-admin, admin, edit, and view.Read 15 Oct 2026 · docs.cloud.google.com
Limit: immutable fields
Changing immutable Kubernetes fields in place causes a KNV2009 error; the documented workaround is to delete and recreate the object through the source repository.Read 15 Oct 2026 · docs.cloud.google.com
Limit: Jobs
Google advises against syncing Kubernetes Jobs because immutable fields, automatic recreation, and completion handling can create reconciliation failures.Read 15 Oct 2026 · docs.cloud.google.com
Limit: secrets
The documentation warns that storing Kubernetes Secrets in a source of truth may be inappropriate because they contain sensitive information.Read 15 Oct 2026 · docs.cloud.google.com
Multi-cluster management
The service applies common configurations and policies across registered and connected clusters from one source.Read 15 Oct 2026 · docs.cloud.google.com
Namespace management
It provisions namespaces and namespace-scoped policies such as RBAC roles for multi-tenancy.Read 15 Oct 2026 · docs.cloud.google.com
Node architecture limitation
Config Sync runs only on x86-based nodes and not on Arm nodes.Read 1 Oct 2026 · docs.cloud.google.com
Notable news: release
The release notes report Config Sync version 1.25.1 on September 21, 2026, including dependency updates addressing multiple CVEs.Read 15 Oct 2026 · docs.cloud.google.com
Observability
A Google Cloud console dashboard shows synchronization status for clusters and packages without extra dashboard setup.Read 15 Oct 2026 · docs.cloud.google.com
OCI signature verification
For OCI repositories, Config Sync can integrate with a Kubernetes admission webhook signature verification server to help ensure only trusted OCI images are used.Read 1 Oct 2026 · docs.cloud.google.com
Policy Controller integration
Config Sync can distribute Policy Controller constraints alongside other Kubernetes resources.Read 15 Oct 2026 · docs.cloud.google.com
Policy management
It can consistently apply Policy Controller constraints across registered and connected clusters.Read 1 Oct 2026 · docs.cloud.google.com
Rating on G2
G2's similarly named Config listing is 5.0 out of 5 from 1 review, but the seller is TeamExtension and the page is not Google Config Sync.Read 15 Oct 2026 · g2.com
Resource requirements
Standard-cluster reconciler containers request 50 millicores and 200 MiB for the reconciler, while Autopilot requests 700 millicores and 512 MiB.Read 15 Oct 2026 · docs.cloud.google.com
Security control
Config Sync can prevent unauthorized deletion or mutation of managed resources through its admission webhook and reconciliation model.Read 15 Oct 2026 · cloud.google.com
Self-hosting
The public repository documents installation of OSS Config Sync directly on Kubernetes, while GKE and Anthos users can install through Google Cloud GUI or CLI.Read 15 Oct 2026 · github.com
Source types
Config Sync syncs configuration files from Git repositories, OCI images, and Helm charts.Read 1 Oct 2026 · docs.cloud.google.com
Sources of truth
It accepts Git repositories, OCI images, and Helm charts as configuration sources.Read 15 Oct 2026 · docs.cloud.google.com
Support scope
Google does not support issues with customer-owned YAML file configurations.Read 1 Oct 2026 · docs.cloud.google.com

Plans and prices

Config Sync included with GKE Free Included with Google Kubernetes Engine Requires GKE-supported cluster version · clusters must be registered to a fleet Read 1 Oct 2026 · cloud.google.com
Config Sync included with GKE Free No separate Config Sync charge; underlying GKE resources are billed GKE cluster required · fleet registration required · supports Autopilot and Standard clusters Read 15 Oct 2026 · cloud.google.com

Every Google Config Sync plan and price →

Strong points and limits

Strong points

  • Syncs from Git, OCI images and Helm charts.
  • Supports Autopilot and Standard GKE clusters.
  • Manages namespaces with scoped policies.
  • Can apply Policy Controller constraints across clusters.
  • Included with Google Kubernetes Engine.

Limits

  • Clusters must be registered to a fleet.
  • Runs only on x86-based nodes.
  • Drift-prevention webhook can cause high memory use.
  • Google does not support customer-owned YAML configuration issues.

Who it suits

Config Sync suits teams managing configuration, policies and namespaces across Kubernetes clusters, especially where a source of truth and multi-cluster reconciliation are needed. It requires fleet registration and runs on x86-based nodes.

Verdict

Config Sync provides continuous reconciliation and policy management across supported clusters, with Google Kubernetes Engine inclusion at no added listed price. Fleet registration, x86-only nodes and potential webhook memory pressure are important constraints.

Where Specifiction places it

Alternatives to Google Config SyncAll alternatives →