GCP Config Connector

Config Connector enables managing GCP resources declaratively through Kubernetes custom resources. The Infra Management Cluster runs the Config Connector operator and manages resources for multiple GCP projects.

This page documents the ArgoCD Application / ApplicationSet resources that deliver KCC. For an end-to-end view of how KCC is used at Titanbay - operator install, authentication model, GCP resource inventory, and day-to-day operations - see the dedicated Config Connector section.

The operator is deployed as version 1.154.1 on both the Infra Management cluster and the tb-platform clusters (GKE Autopilot variants), running in namespaced mode with one Google Service Account per namespace via ConfigConnectorContext CRs. See Config Connector → Overview for the full architecture.

ArgoCD Resources

File Paths

Config Connector Operator

The operator watches for ConfigConnectorContext resources and creates controllers to manage GCP resources.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: config-connector-operator
spec:
  syncPolicy:
    automated:
      prune: false
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: infra-services
  source:
    path: k8s/infra-services/gcp-config-connector/overlays/infra-mgmt
    repoURL: https://github.com/Titanbay/infra-services
    targetRevision: 'main'

Source: k8s/infra-services/gcp-config-connector/overlays/infra-mgmt/

TB Platform Infrastructure

Cross-environment GCP resources for the tb-platform projects.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: tb-platform-infra
spec:
  syncPolicy:
    automated:
      prune: true
    syncOptions:
      - ServerSideApply=true
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: infra-services
  source:
    repoURL: https://github.com/Titanbay/infra-services
    path: k8s/tb-platform-infra
    targetRevision: 'main'

Source Structure:

k8s/tb-platform-infra/
├── base/                    # Shared resources
├── env/                     # Per-environment resources
│   ├── base/
│   ├── dev/
│   ├── qa/
│   └── prod/
└── vpc/                     # VPC-related resources
    ├── base/
    ├── dev/
    ├── qa/
    └── prod/

Infra Management Project

GCP resources for the main infrastructure management project.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infra-mgmt-project
spec:
  syncPolicy:
    syncOptions:
      - ServerSideApply=true
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: infra-mgmt
  source:
    repoURL: https://github.com/Titanbay/infra-services
    path: k8s/infra-services/tb-infra-mgmt-project
    targetRevision: 'main'

Source: k8s/infra-services/tb-infra-mgmt-project/

Infra Management VPC Project

VPC-related GCP resources.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infra-mgmt-vpc-project
spec:
  syncPolicy:
    automated:
      prune: true
    syncOptions:
      - ServerSideApply=true
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: infra-mgmt
  source:
    repoURL: https://github.com/Titanbay/infra-services
    path: k8s/infra-services/tb-infra-mgmt-vpc-project
    targetRevision: 'main'

Source: k8s/infra-services/tb-infra-mgmt-vpc-project/

Infra Security Project

Security-related GCP resources.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infra-security-project
spec:
  syncPolicy:
    syncOptions:
      - ServerSideApply=true
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: infra-mgmt
  source:
    repoURL: https://github.com/Titanbay/infra-services
    path: k8s/infra-services/tb-infra-security-project
    targetRevision: 'main'

Source: k8s/infra-services/tb-infra-security-project/

Source Structure

k8s/infra-services/
├── gcp-config-connector/           # Config Connector operator (base + overlays)
├── tb-infra-mgmt-project/          # Infra mgmt project resources
├── tb-infra-mgmt-vpc-project/      # VPC project resources
└── tb-infra-security-project/      # Security project resources

k8s/tb-platform-infra/              # Platform infrastructure
├── base/
├── env/
│   ├── dev/
│   ├── qa/
│   └── prod/
└── vpc/
    ├── dev/
    ├── qa/
    └── prod/

AppProjects

Config Connector applications use specific AppProjects:

How to Update

Adding GCP Resources

1. Create the Config Connector resource YAML in the appropriate directory
2. Add to the directory’s kustomization.yaml
3. Commit and push to main
4. ArgoCD syncs and Config Connector creates the GCP resource

Modifying Resources

1. Edit the resource YAML
2. Commit and push to main
3. Config Connector reconciles the change in GCP

Sync Options

The Config Connector applications on the hub use ServerSideApply=true because:

• Config Connector resources often have large specs
• Server-side apply handles field ownership correctly
• Prevents conflicts with Config Connector’s own updates

The exception is the spoke config-connector-operator Application delivered to the tb-platform clusters by tb-platform-init-services, which carries no syncPolicy block at all - see Related ApplicationSets.

Related ApplicationSets

For tb-platform clusters, Config Connector is delivered per environment via cluster-init:

tb-platform-environments and tb-platform-vpc-config use ServerSideApply=true with automated.prune: true. The config-connector-operator Application delivered by tb-platform-init-services has no syncPolicy block (no automated sync, no automated prune, and no ServerSideApply=true).

Related Documentation

• Config Connector - Operator architecture, authentication model, hub-and-spoke topology.
• Config Connector → Managed resources - Per-project GCP resource inventory.
• Config Connector → Operations - Adding, updating, deleting, and troubleshooting KCC resources.