Flux: Continuous and Progressive Delivery for Kubernetes

Managing Kubernetes clusters through manual imperative commands often introduces configuration drift across environments. Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories and OCI artifacts), and automating updates to configuration when there is new code to deploy. By treating declarative code repositories as the single source of truth, teams ensure that the state of live clusters accurately reflects audited revision histories.

GitOps Architecture and the GitOps Toolkit

Flux version 2 ("v2") is built from the ground up to use Kubernetes' API extension system, and to integrate with Prometheus and other core components of the Kubernetes ecosystem. Rather than running as a monolithic agent, Flux v2 is constructed with the GitOps Toolkit, a set of composable APIs and specialized tools for building Continuous Delivery on top of Kubernetes. These dedicated controllers handle source acquisition, manifest kustomization, Helm chart lifecycles, and event notifications independently.

Security and tenant boundaries represent critical considerations in shared cluster deployments. Flux uses true Kubernetes RBAC via impersonation and supports multiple Git repositories. This architecture allows platform teams to isolate tenant permissions through standard Kubernetes service accounts and roles, ensuring that application teams can only apply configurations within their designated namespaces.

Prerequisites and CLI Installation

Before bootstrapping components onto a cluster, operators must install the dedicated management binary. The flux command-line interface (CLI) is used to bootstrap and interact with Flux. On macOS or Linux environments equipped with Homebrew, the CLI can be installed directly from the official tap:

With the CLI available in your path, verify that your active Kubernetes context satisfies minimum API version requirements. Check you have everything needed to run Flux by running the following command: flux check --pre to validate cluster connectivity and ensure necessary controller privileges are present before proceeding:

Bootstrapping Flux to a Kubernetes Cluster

The bootstrap workflow automates cluster onboarding by provisioning repository structures and deploying controller manifests. Creates a git repository fleet-infra on your GitHub account. Adds Flux component manifests to the repository. Deploys Flux Components to your Kubernetes Cluster. Execute the bootstrap command with your personal GitHub account credentials to initialize the cluster:

Managing Declarative Sources and Kustomizations

Once the controllers are active in the flux-system namespace, you can declare external Git sources. Use the CLI to generate a GitRepository custom resource tracking an application repository:

Next, configure a Kustomization resource that instructs Flux how to reconcile the manifests retrieved from that source. The kustomize-controller validates prerequisites, handles prune operations, and monitors health checks during rollout:

Drift Detection, Reconciliation, and Release Maintenance

Flux actively enforces desired state by continuously comparing live Kubernetes objects against Git manifests. When a Kubernetes manifest is removed from the podinfo repository, Flux removes it from your cluster. When you delete a Kustomization from the fleet-infra repository, Flux removes all Kubernetes objects previously applied from that Kustomization. Any manual modifications made to workloads via kubectl edit are reverted automatically back to the committed specification.

During debugging sessions or urgent troubleshooting, operators may need to make temporary manual adjustments. Suspending updates to a kustomization allows you to directly edit objects applied from a kustomization, without your changes being reverted by the state in Git. Once testing concludes, running flux resume re-enables automatic reconciliation and realigns the cluster with Git.

For continuous deployment across complex environments, Flux enables application deployment (CD) and (with the help of Flagger) progressive delivery (PD) through automatic reconciliation. Maintaining the installation requires applying regular controller updates; for example, Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation to guarantee cluster stability and security compliance.