Flux

Flux#

Flux is the other CNCF-graduated GitOps controller for Kubernetes, peer to Argo CD. Built on top of Fluxcd v2 (Kubernetes-controller shape). Lighter UI than Argo CD; composes lower-level CRDs (GitRepository, Kustomization, HelmRelease) that the operator wires together. The right pick when GitOps is one of several controllers in a platform-engineering pipeline.

Architecture#

Flux is a set of controllers, each watching a CRD:

  • source-controller, reconciles GitRepository, OCIRepository, HelmRepository, Bucket sources.

  • kustomize-controller, applies a Kustomization to a cluster.

  • helm-controller, releases a HelmRelease (chart + values).

  • notification-controller, ships events and alerts out (Slack, generic webhooks).

  • image-reflector-controller + image-automation-controller, the image-update pipeline, watch a registry, commit new tags back to Git.

A minimal flow#

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata: { name: app, namespace: flux-system }
spec:
  interval: 1m
  url: https://github.com/myorg/k8s-manifests
  ref: { branch: main }
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata: { name: app, namespace: flux-system }
spec:
  interval: 5m
  path: ./apps/web/overlays/prod
  prune: true
  sourceRef:
    kind: GitRepository
    name: app
  targetNamespace: prod
  validation: client

CLI#

The flux CLI bootstraps, inspects, and operates the controllers.

$ flux bootstrap github \
    --owner=myorg \
    --repository=k8s-manifests \
    --branch=main \
    --path=clusters/prod \
    --personal
$ flux get sources git
$ flux get kustomizations
$ flux reconcile kustomization app --with-source
$ flux suspend kustomization app
$ flux resume kustomization app
$ flux logs --kind=Kustomization --name=app

Image updates#

The image automation controllers close the loop, build pushes an image; Flux detects the new tag; Flux commits the tag bump back to the manifests repo; Flux’s reconcile picks it up.

apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata: { name: web, namespace: flux-system }
spec:
  image: ghcr.io/myorg/web
  interval: 1m
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata: { name: web, namespace: flux-system }
spec:
  imageRepositoryRef: { name: web }
  policy: { semver: { range: '>=1.0.0' } }

Strengths#

  • Composes well with other controllers; the design encourages small CRDs that other automation can react to.

  • Multi-tenancy at the namespace level; each tenant gets a Flux controller scope.

  • SOPS / age decryption built in via decryption.provider: sops on a Kustomization.

Weaknesses#

  • No first-class UI in the box; flux CLI plus Grafana dashboards plus optional Weave GitOps UI fill the gap.

  • Steeper learning curve than Argo CD’s bundled experience.

When to pick Flux#

  • Platform engineering shop building a layered controller stack; Flux composes.

  • SOPS-encrypted secrets in Git; Flux’s built-in decryption is the simplest path.

  • The team prefers CLI + dashboards over a heavy UI.

When to pick Argo CD#

  • GitOps for end users with a strong UI for diff / sync / rollback.

  • Multi-cluster fan-out where one control plane manages many clusters.

References#

Contents