Google Anthos Config Management (ACM) is a set of Google Cloud-hosted and in-cluster components that let you automatically deploy shared environment configurations and enforce approved security policies across fleets. Anthos Config Management is used to manage Kubernetes objects in all the clusters. Anthos Config Management is a GitOps-style tool. GitOps is a process where a Git source control repository is the source of truth for configuration. A Git provider workflow allows multiple stakeholders to participate in the review of changes.

Anthos Config Management runs an agent in every cluster that pulls config directly from Git. It can also pull bundled files from an image registry. Anthos Config Management can pull configuration directly from a Git repository. It can also pull from an OCI image repository or a Helm repository.

The following diagram shows the recommended Anthos Config Management deployment using one folder containing configurations for all the clusters. Other individual folders hold configuration data for one application:

Figure 5.   Google Anthos Config Management application

An Anthos Config Management component per cluster pulls the configuration details directly from a source control repository or an image registry. A cloud management plane configures the data sources and Anthos Config Management versions.

Anthos Config Management manages the in-cluster resources. The resources that affect the whole cluster (cluster-wide or cluster-scoped) are managed separately from the resources that only affect one namespace (namespace-scoped). The latter is used to define the applications.

Different categories of resources are managed by a different set of tools:

• Google Cloud resources are managed by the Google Cloud console, gcloud CLI, or Terraform.
• In-cluster resources are managed by Anthos Config Management.

 Anthos Config Management does not manage the admin clusters and their resources.