RootSync is the ACM object that stores how Config Sync fetches the root repository when a cluster uses multiple repository mode. Enabling enableMultiRepo moves Git URLs, credentials, and repository-fetch settings out of ConfigManagement and into RootSync; namespace repositories use RepoSync objects instead. section 11.2.1 section 11.2.2
Use RootSync to establish the governance boundary between centrally managed configuration and namespace-owned applications:
- Manage organization-wide policies, RBAC rules, Istio rules, and namespace configuration from the root repository. section 11.2.1
- Let application teams manage individual namespaces through RepoSync while retaining centralized restrictions on what those repositories may modify. section 11.2.1
- Resolve conflicts in favor of the root repository, whose objects override conflicting definitions from namespace repositories. section 11.2.1
- Grant namespace worker service accounts appropriate permissions with built-in roles or custom Role and ClusterRole bindings. section 11.2.1
Platform and application team split
An operations or security team uses RootSync for organization-wide policies and namespace setup, while application teams use RepoSync to deploy applications within permitted namespaces. section 11.2.1
