A policy directory is a text-based collection of declarative policy and configuration files stored separately from managed Kubernetes clusters. Anthos Config Management uses it as the desired-state definition, examining and applying its Kubernetes objects to connected clusters. section 11.1.2 section 11.2.1
Organize and operate the directory around these responsibilities:
- Store the directory in Git so operations teams can inspect plaintext configuration, track changes, and identify compliance drift. section 11.1.2
- Choose hierarchy or unstructured format; hierarchy is the default and records the choice in the operator configuration object's spec.sourceFormat field. section 11.2.1
- Apply abstract namespaces to share objects across child namespaces, then narrow propagation with NamespaceSelector when labels identify the intended targets. section 11.2.1
- Enable multiple repositories when needed: one root repository may use either format, while additional repositories configure objects in a single namespace. section 11.2.1
Namespace-scoped application layout
A hierarchy repository can place staging and production beneath namespaces, with namespace.yaml and application.yaml files grouped under application-specific directories. Shared RBAC or service-account files can sit alongside those application definitions.
Inspect rollout and drift with the nomos command, Anthos UI, Cloud Logging, and Cloud Monitoring. These surfaces expose configuration versions, installation state, events, and possible rollout errors or lag. section 11.1.2
