Config Connector is a Kubernetes add-on that provisions Google Cloud resources from declarative Kubernetes objects. It lets teams already working with Kubernetes configure resources such as Cloud SQL instances, storage buckets, networks, Pub/Sub topics, and BigQuery datasets without switching to a separate resource definition format. With appropriate permissions, resource definitions can reference one another and serve as a single source of truth. section 11.2.3 section 11.5
Each object has a status section showing the resource’s current state as it is created or updated in Google Cloud. Definitions can also obtain sensitive values from Kubernetes Secrets and information from ConfigMaps. Keep passwords out of the configuration repository: create or update the Secret separately, then let the configured namespace hierarchy replicate it where needed. section 11.2.3 section 11.3.2
A database assembled from Kubernetes objects
Define a SQLInstance, then a SQLDatabase and SQLUser whose instanceRef fields name that instance. Set the user’s password through a secretKeyRef rather than putting it in the resource definition. On the next reconciliation, an updated Secret supplies the new password. section 11.3.2
---
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLInstance
metadata:
name: village-linen
annotations:
configmanagement.gke.io/cluster-selector: sel-clu-cloud
spec:
region: us-central1
databaseVersion: POSTGRES_9_6
settings:
tier: db-custom-16-61440
---
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLDatabase
metadata:
name: village-linen-primary
annotations:
configmanagement.gke.io/cluster-selector: sel-clu-cloud
spec:
charset: UTF8
collation: en_US.UTF8
instanceRef:
name: village-linen
---
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLUser
metadata:
name: village-linen-dbuser
annotations:
configmanagement.gke.io/cluster-selector: sel-clu-cloud
spec:
instanceRef:
name: village-linen
password:
valueFrom:
secretKeyRef:
name: db-creds
key: password
The Cloud SQL declarations show instanceRef linking the database and user to the instance, secretKeyRef supplying the password, and a cluster-selector annotation on each object. section 11.3.2
Control where definitions land before synchronizing them. Namespace selectors can target eligible project namespaces; cluster selectors can restrict cloud-resource definitions to a GKE cluster where Config Connector is enabled. Sending those definitions to a cluster without the add-on fails, while sending them to an unintended cluster creates avoidable troubleshooting work. In a repository-based workflow, teams can submit resource changes for review instead of changing production directly. section 11.3.1 section 11.3.2
