Google Config Sync

Google Config Sync is a cloud-delivered GitOps service for keeping Kubernetes configuration and policy aligned across clusters. It is aimed at teams running GKE fleets or GKE-attached environments that need repeatable control instead of manual correction. The payoff is consistent multi-cluster state, provided your fleet, node architecture, and security setup meet its prerequisites.

Overview

Config Sync continuously compares each cluster with a declared source of truth and reconciles differences. That is a strong fit for organisations where configuration drift is a recurring operational risk, and less suitable when teams need ad-hoc, cluster-local changes to remain authoritative. Synchronisation can cover any number of clusters, with both managed control-plane integration absent and multi-cluster management present.

The service combines hosted components in Google Cloud with open-source components running on GKE. Clusters must be registered to a fleet before Config Sync can be enabled. Workload Identity Federation for GKE is the recommended secure connection to Google Cloud services and is required for fleet packages, so identity planning belongs in the initial design rather than after deployment.

Key features

Sources include Git repositories, OCI images, and Helm charts. Git integrations cover GitHub, GitLab, Bitbucket, Cloud Source Repositories, and Secure Source Manager. Deployment targets include GKE and GKE-attached clusters, including EKS and AKS. This makes the service practical for a mixed Kubernetes estate, although the fleet-oriented setup still centres operations on Google Cloud.

Config Sync applies Policy Controller constraints consistently across registered and connected clusters. Its policy toolset supports Rego, policy testing, admission control, runtime enforcement, policy reporting, and audit logs. These controls suit teams that need guardrails before and during workload execution, not just configuration delivery.

Namespace provisioning and namespace-scoped policies, including RBAC roles, support multi-tenancy by giving teams a repeatable way to establish boundaries. Infrastructure provisioning and infrastructure-as-code support extend the workflow beyond application manifests. Progressive delivery and CI/CD integration are also supported.

For OCI repositories, integration with a Kubernetes admission webhook signature-verification server can help restrict deployments to trusted images. The trade-off is operational: the drift-prevention admission webhook can consume substantial memory and may trigger out-of-memory errors in clusters containing many custom resources. Config Sync runs only on x86 nodes, not Arm, which rules it out for Arm-only node pools.

Pricing

Config Sync included with GKE: free, billed as included with Google Kubernetes Engine. It requires a GKE-supported cluster version and fleet registration. There is no separate paid tier described for Config Sync itself, so this is the natural choice for teams already paying for eligible GKE clusters and wanting the synchronization and policy functions without an additional listed license charge.

Google Cloud offers support packages with 24/7 coverage, phone support, and access to a technical support manager. That support does not extend to issues in customer-owned YAML configurations, so teams remain responsible for the correctness of their manifests and custom resources.

Platforms

Config Sync is delivered as a cloud service with API and web access, while its cluster components run self-hosted on Kubernetes. It supports both Autopilot and Standard GKE clusters, plus attached EKS and AKS clusters. The x86-only requirement is the key platform constraint.

Who it's for

Choose Config Sync if you operate registered GKE fleets, need one GitOps process across many clusters, and want policy enforcement, namespace governance, and auditability in the same workflow. It is especially relevant to platform teams managing multi-tenant environments or a GKE-plus-attached-cluster estate.

Look elsewhere if Arm nodes are mandatory, fleet registration is unacceptable, or your clusters carry enough custom resources to make webhook memory pressure a serious concern. It is also a poor fit for teams that want support to cover bespoke YAML authoring.

Pros and cons

Pros

• Continuous reconciliation: Automatically returns cluster state to the declared source of truth, limiting configuration drift.
• Broad source and target coverage: Git, OCI, and Helm inputs work across GKE and attached EKS or AKS clusters.
• Integrated governance: Rego policies, testing, admission and runtime enforcement, reporting, audit logs, RBAC, and namespace management address both delivery and control.
• Included with GKE: The listed Config Sync plan costs nothing for eligible GKE use.

Cons

• Fleet dependency: Every cluster must be fleet-registered before enablement, adding an architectural prerequisite.
• x86 only: Arm nodes are unsupported.
• Webhook resource risk: Drift prevention can cause high memory use and out-of-memory failures with many custom resources.
• Configuration-support boundary: Google does not support customer-owned YAML problems.

Alternatives

Kubermatic Kubernetes Platform is a free, Apache-licensed option with Community and consumption-based Enterprise editions, and supports more operating systems and self-hosted deployment.

Cloudify suits teams wanting a freemium platform with a no-time-limit Community plan, provided they can run Docker or a VM and supply cloud access.

Apache CloudStack is a free, open-source IaaS choice when infrastructure cloud management matters more than Config Sync's Kubernetes reconciliation.

KubeSphere offers a free, enterprise-grade open-source Kubernetes container platform for teams seeking a broader self-hosted platform.

Qstack provides a lifetime-free basic plan and paid annual tiers for IDC-oriented teams.

CloudBolt is a freemium cloud-management platform whose free edition is capped at 100 resources.

Karmada is a free open-source Kubernetes management system for self-hosted multi-cluster operations.

Crossplane is a free Apache 2.0 project running inside an existing Kubernetes cluster for infrastructure-as-code workflows.

For broader category browsing, see Multi-Cloud Management Software, Infrastructure Policy as Code Tools, and GitOps Tools.

Verdict

Google Config Sync is a strong choice for GKE-centric platform teams that need continuous, policy-aware reconciliation across a fleet and attached clusters. Choose it for its unified GitOps, namespace, and policy controls at no separately listed Config Sync charge; look elsewhere if you require Arm support, avoid fleet registration, or cannot absorb webhook memory risk.