A Kubernetes operator automates application or platform management by running inside a cluster and applying declared configuration through Kubernetes. Anthos Config Management (ACM) deploys one operator per managed cluster; it reads cluster identity, Git settings, and feature flags, then synchronizes selected resources from a policy repository. section 11.2
Operational responsibilities and trade-offs include:
- Connect to public or private Git repositories with appropriate credentials, optionally selecting a repository subdirectory, branch, revision, and synchronization interval. section 11.2
- Manage only objects declared in policy configuration, preserving a minimum footprint and allowing other deployment mechanisms to operate in the same cluster. section 11.2
- Track managed objects with annotations, while requiring operators to understand ownership when several tools deploy resources concurrently. section 11.2
- Adjust synchronization frequency and optionally prevent cluster changes that conflict with managed resources. section 11.2
Installing Knative with an operator
On a Kubernetes cluster such as Amazon EKS, Google GKE, IBM IKS, Red Hat OpenShift Cloud Platform, or Minikube, Knative can be installed with YAML files or an operator. The installation proceeds through custom resource definitions, core Serving or Eventing components, networking or messaging layers, DNS or Broker configuration, and optional extensions. section 9.3.5
applySpecVersion: 1
spec:
clusterName: <name of cluster>
enableMultiRepo: <true/false, enables multiple repository mode>
enableLegacyFields: <true/false, used with multi repo, see below>
policyController:
enabled: <true/false>
templateLibraryInstalled: <true/false, installs the Google-provided template library for policy controller>
sourceFormat: <hierarchy or unstructured. Sets the type of policy organization>
preventDrift: <if set to true, rejects changes to the cluster that conflict with managed resources>
git:
syncRepo: <url of the git repository>
syncBranch: <branch of the git repository to sync from>
policyDir: <relative path in the git repository to the policy directory>
syncWait: <number of seconds between sync attempts>
syncRev: <git revision to sync from. Used if a specific commit or tag should be used instead of a branch>
secretType: <ssh, cookiefile, token, gcenode, gcpserviceaccount or none. Specifies the type of authentication to perform>
gcpServiceAccountEmail: <email of the service account to use for git access. Only used when secretType is gcpserviceaccount>
proxy:
httpProxy: <proxy information for http connection, styled similarly to the HTTP_PROXY environment variable>
httpsProxy: <proxy information for https connection, styled similarly to the HTTPS_PROXY environment variable>
Use the ACM specification to configure cluster identity, repository synchronization, policy organization, drift prevention, feature flags, and repository credentials. section 11.2
