liveBook · Manning

Hierarchy repository

As explained in Google Anthos in Action

A hierarchy repository is an Anthos Config Management policy repository whose directory structure expresses configuration purpose, scope, and namespace inheritance.

A hierarchy repository is an Anthos Config Management (ACM) policy repository whose directories organize Kubernetes objects by purpose and scope. Hierarchy is the default policy-directory format; unstructured is the other supported format. The ACM operator examines the objects and applies the appropriate ones to connected clusters. The format is set with `spec.sourceFormat` in the operator configuration. section 11.2.1

Four top-level directories divide the policy directory:

  • `system` holds repository configuration, such as the deployed configuration version. section 11.2.1
  • `clusterregistry` holds Cluster definitions and ClusterSelectors for selecting subsets of clusters. section 11.2.1
  • `cluster` holds cluster-wide objects other than namespaces. section 11.2.1
  • `namespaces` holds namespace-scoped objects, Namespace definitions and NamespaceSelectors. section 11.2.1

Within `namespaces`, an abstract namespace groups actual namespaces that should share objects. An object placed in an abstract namespace is copied to its descendants; nested abstract namespaces provide additional layers. A NamespaceSelector can narrow that inheritance—for example, applying a shared ConfigMap only to namespaces labeled for finance applications. section 11.2.1

Cloud and data-center policy layout

A deployment spanning GKE on GCP and GKE on VMware can define both clusters and their selectors in `clusterregistry`, place ClusterRoles and Policy Controller constraints in `cluster`, and organize application namespaces beneath `namespaces`. A cloud ClusterSelector restricts a cloud database configuration to the cloud cluster. Hierarchy Controller can separately propagate Secrets and ConfigMaps from a central namespace, allowing those Secrets to be applied there without checking them into Git. Database replication itself requires separate configuration. section 11.3.2

<Git Repo Parent>
├── bin
└── policy_directory
   ├── namespaces
   │   ├── rbac.yaml
   │   ├── central
   │   │   ├── namespace.yaml
   │   │   └── database_location_config.yaml
   │   ├── applications
   │   │   ├── service_account.yaml
   │   │   ├── website
   │   │   │   ├── namespace.yaml
   │   │   │   ├── hierarchy.yaml
   │   │   │   └── repo-sync.yaml
   │   │   └── inventory
   │   │       ├── namespace.yaml
   │   │       ├── hierarchy.yaml
   │   │       └── repo-sync.yaml
   │   └── village-linen-ac15e6
   │       ├── namespace.yaml
   │       ├── hierarchy.yaml
   │       └── repo-sync.yaml
   ├── cluster
   │   ├── rbac.yaml
   │   ├── hierarchy.yaml
   │   └── constraints.yaml
   ├── clusterregistry
   │   ├── data center.yaml
   │   ├── cloud.yaml
   │   └── selectors.yaml
   └── system
       └── repo.yaml

The repository tree shows the four directories alongside central, application and project namespace configurations. section 11.3.2

With multiple repositories, one root repository may use hierarchy or unstructured format; each additional repository configures objects in a single namespace. Keep that distinction in mind when dividing policy ownership across repositories. section 11.2.1

How Google Anthos in Action covers it

How deep it goes
Defines the directory layout and inheritance rules, then illustrates multi-cluster policy placement; leaves database replication configuration outside scope.
Examples
Uses namespace directory trees and a GKE cloud-and-data-center deployment with cluster selectors, RBAC, ConfigMaps and Secrets.
What it assumes
Assumes familiarity with Git repositories, Kubernetes objects, clusters and namespaces; explains the hierarchy-specific layout and abstract namespaces.
What you can do after
Operate/configure it by placing policies in scoped directories and using selectors to limit where objects apply.
How it connects
Connects Kubernetes objects, abstract namespaces, NamespaceSelectors, ClusterSelectors, Config Sync and Hierarchy Controller.
Cover of Google Anthos in Action
liveBookmanning.com
Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.