Flux CD

GitOps Automated Sync Image Automation Helm Integration

A comprehensive guide to Flux CD covering GitOps, automated sync, image automation, Helm integration, and practical implementation strategies for Kubernetes.

GitOps Automated Sync Image Automation Helm Integration

What is Flux CD?

Flux CD is a CNCF Graduated open-source GitOps tool for Kubernetes. It keeps Kubernetes clusters in sync with configuration sources like Git repositories, automatically applying changes when new code is available [citation:4][citation:10].

Flux CD is built on Kubernetes' API extension system and uses custom resources (GitRepository, Kustomization, HelmRelease) rather than a standalone REST API [citation:12]. Its key principles [citation:4]:

Declarative Configuration: Everything is defined as code in Git
Automated Reconciliation: Flux continuously syncs the cluster with Git
Pull Model: Flux pulls changes from Git, minimizing attack surface [citation:4]
Multi-Tenancy: True Kubernetes RBAC via impersonation [citation:4]
Progressive Delivery: Canary and blue-green via Flagger [citation:4]

Key Principle: Flux CD is a pure declarative GitOps tool. Unlike ArgoCD, Flux favors CLI and YAML configuration over a graphical UI [citation:2][citation:7]. It was designed for teams who prefer a Kubernetes-native, modular, and security-first approach [citation:9].

Flux CD Architecture

Flux CD consists of a set of specialized controllers that work together to enable GitOps [citation:4][citation:7][citation:10]:

Source Controller

Git/Helm repository management

Monitors Git repositories and Helm repositories for changes. Fetches artifacts and makes them available to other controllers [citation:10].

Source acquisition

Kustomize Controller

Kustomize manifest generation

Generates Kubernetes manifests using Kustomize and applies them to the cluster. Supports dependencies between resources [citation:10].

Manifest management

Helm Controller

Helm chart deployment

Declaratively manages Helm chart releases. Supports Helm tests, rollbacks, and uninstalls. Integrates with GitRepository and HelmRepository sources [citation:10].

Helm deployments

Notification Controller

Alerting and event handling

Sends alerts to Slack, email, and webhooks. Receives external events to trigger reconciliations [citation:4][citation:10].

Notifications

Image Automation Controllers

Automated image updates

Image Reflector and Image Automation controllers scan container registries and automatically update Git manifests with new image tags [citation:4][citation:7].

Image updates

Installing Flux CD

Flux CD is installed using the flux CLI tool, which bootstraps the cluster and configures Flux to manage itself from a Git repository [citation:7][citation:11].

                # Install Flux CLI
curl -s https://fluxcd.io/install.sh | sudo bash
flux --version

# Bootstrap Flux (GitHub example)
export GITHUB_TOKEN=<your-token>
flux bootstrap github \
  --owner=<your-org> \
  --repository=<your-repo> \
  --branch=main \
  --path=./clusters/production \
  --personal

# Bootstrap Flux (GitLab example)
export GITLAB_TOKEN=<your-token>
flux bootstrap gitlab \
  --owner=<your-org> \
  --repository=<your-repo> \
  --branch=main \
  --path=./clusters/production

# Verify installation
flux check
kubectl get pods -n flux-system

# Install specific components
flux install --components="source-controller,kustomize-controller,helm-controller"
            

Installation Considerations:

Flux requires a Git personal access token with repo permissions
The bootstrap process creates a flux-system namespace and resources
Flux supports air-gapped installations out of the box [citation:7]
Installation is lightweight compared to ArgoCD [citation:9]

GitRepository and Kustomization

Flux CD uses GitRepository to define the source and Kustomization to define the action [citation:2][citation:7][citation:8].

                # GitRepository - defines source
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/myorg/my-app
  ref:
    branch: main
  secretRef:
    name: git-credentials  # Optional for private repos

# Kustomization - defines sync behavior
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 5m
  path: ./kubernetes/overlays/production
  prune: true
  sourceRef:
    kind: GitRepository
    name: my-app
  targetNamespace: production
  validation: client

# Multiple Kustomizations with dependencies
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: infrastructure
  namespace: flux-system
spec:
  interval: 5m
  path: ./infrastructure
  prune: true
  sourceRef:
    kind: GitRepository
    name: infra-repo

---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: applications
  namespace: flux-system
spec:
  interval: 5m
  path: ./applications
  prune: true
  sourceRef:
    kind: GitRepository
    name: apps-repo
  dependsOn:
  - name: infrastructure
            

Key Concept: Flux CD separates the source from the action [citation:2][citation:8]. A GitRepository defines where manifests come from, and a Kustomization defines how they are applied. This provides more flexibility than ArgoCD's single Application resource [citation:2].

Helm Integration

Flux CD's Helm Controller manages Helm releases declaratively. It supports server-side Helm templating and full release lifecycle management [citation:2][citation:4][citation:7].

                # HelmRepository
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: bitnami
  namespace: flux-system
spec:
  interval: 1h
  url: https://charts.bitnami.com/bitnami

# HelmRelease
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: nginx
  namespace: default
spec:
  interval: 5m
  chart:
    spec:
      chart: nginx
      sourceRef:
        kind: HelmRepository
        name: bitnami
        namespace: flux-system
      interval: 1h
  values:
    replicaCount: 3
    service:
      type: ClusterIP
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"

# HelmRelease with values from Git
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: my-app
  namespace: default
spec:
  interval: 5m
  chart:
    spec:
      chart: ./charts/my-app
      sourceRef:
        kind: GitRepository
        name: my-app
        namespace: flux-system
  valuesFrom:
  - kind: ConfigMap
    name: app-values
    valuesKey: values.yaml

# Upgrade with rollback
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: my-app
spec:
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  rollback:
    enable: true
            

Helm Advantages with Flux:

Server-side templating (unlike ArgoCD's client-side) [citation:2]
Full Helm release lifecycle management
Supports Helm hooks and tests [citation:10]
Works with OCI registries for Helm charts [citation:4]

Image Automation

Flux CD provides built-in image automation that automatically updates Git manifests when new container images are available [citation:4][citation:9].

                # ImageRepository - scans registry for new images
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
  name: my-app
  namespace: flux-system
spec:
  image: ghcr.io/myorg/myapp
  interval: 5m
  accessFrom:
    namespaceSelectors:
    - matchLabels:
        kubernetes.io/metadata.name: flux-system

# ImagePolicy - defines update policy
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: my-app
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: my-app
  filterTags:
    pattern: '^v(?P.*)$'
    extract: '$version'
  policy:
    semver:
      range: '>=1.0.0 <2.0.0'

# ImageUpdateAutomation - updates Git manifests
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: my-app
  namespace: flux-system
spec:
  sourceRef:
    kind: GitRepository
    name: my-app
  gitSpec:
    commit:
      author:
        email: flux@example.com
        name: flux-bot
      messageTemplate: 'Update image to {{ .NewImage }}'
    push:
      branch: main
  update:
    path: ./kubernetes/overlays/production
    strategy: Setters

# Use in Kustomization with image tag
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
spec:
  images:
  - name: ghcr.io/myorg/myapp
    newName: ghcr.io/myorg/myapp
    newTag: v1.2.3  # Automatically updated by flux
            

Image Automation Benefits:

Native image automation without external tools [citation:9]
Supports semver version ranges
Automatically commits and pushes changes to Git
Works with any OCI-compliant registry [citation:4]

Progressive Delivery with Flagger

Flux CD integrates with Flagger for progressive delivery strategies: canary, blue-green, and A/B testing [citation:4][citation:10].

                # Flagger Canary
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: my-app
  namespace: default
spec:
  provider: istio
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  progressDeadlineSeconds: 60
  service:
    port: 80
  analysis:
    interval: 30s
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      threshold: 99
      interval: 1m
    - name: request-duration
      threshold: 500
      interval: 1m
            

Flagger Advantages:

Canary, blue-green, and A/B testing [citation:10]
Metric-based analysis and rollback
Integration with Istio, NGINX, and other traffic routers
Works seamlessly with Flux CD

Multi-Tenancy in Flux CD

Flux CD supports multi-tenancy through native Kubernetes RBAC, where each tenant operates within their namespace using their own ServiceAccount [citation:3][citation:4].

                # Tenant Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a

# Tenant ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tenant-a-sa
  namespace: tenant-a

# Tenant Role (within namespace)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tenant-a-role
  namespace: tenant-a
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Tenant RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tenant-a-binding
  namespace: tenant-a
subjects:
- kind: ServiceAccount
  name: tenant-a-sa
  namespace: tenant-a
roleRef:
  kind: Role
  name: tenant-a-role
  apiGroup: rbac.authorization.k8s.io

# Flux GitRepository with tenant ServiceAccount
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: tenant-a-repo
  namespace: tenant-a
spec:
  interval: 1m
  url: https://github.com/tenant-a/repo
  ref:
    branch: main
  serviceAccountName: tenant-a-sa
            

Multi-Tenancy Considerations:

Flux uses Kubernetes RBAC via impersonation [citation:3]
Each tenant operates within their namespace scope [citation:3]
Blast radius is naturally bounded to the tenant scope [citation:3]
Requires more configuration than ArgoCD's centralized approach [citation:7]

Flux CD vs ArgoCD Comparison

Feature	Flux CD	ArgoCD
Architecture	Modular controllers	Centralized controller
User Interface	CLI only (third-party UIs available) [citation:2]	Full web UI [citation:2]
Installation	Lightweight, CLI bootstrap [citation:7]	Single YAML, heavier [citation:11]
Helm Templating	Server-side [citation:2]	Client-side [citation:2]
Image Automation	Built-in [citation:9]	External Image Updater [citation:9]
Multi-Tenancy	Kubernetes RBAC impersonation [citation:3]	Projects + RBAC [citation:7]
Multi-Cluster	Per-cluster installation [citation:2]	Centralized [citation:2]
Progressive Delivery	Flagger [citation:10]	Argo Rollouts [citation:7]
Secret Management	SOPS native integration [citation:11]	External Secrets Operator [citation:3]
Learning Curve	Low [citation:2]	Medium [citation:2]
Market Share	11% (CNCF 2025) [citation:2]	60% (CNCF 2025) [citation:2]
Best For	Security-first, Kubernetes purists [citation:9]	Teams wanting visibility and UI [citation:9]

When to Choose Flux CD:

You prefer a pure declarative, YAML-first approach [citation:2]
Security and minimal attack surface are critical [citation:9]
You need native image automation [citation:9]
You're operating in an air-gapped environment [citation:7]
You have strict multi-tenancy requirements [citation:3]

Frequently Asked Questions

What is the difference between Flux CD and ArgoCD?

Flux CD uses a modular architecture and CLI, while ArgoCD has a centralized controller and web UI [citation:2][citation:7]. Flux CD is more security-focused and Kubernetes-native; ArgoCD prioritizes visibility and user experience [citation:9].

Does Flux CD have a GUI?

Flux CD has no native web UI—it is designed for CLI and YAML operations [citation:2][citation:7]. However, third-party UIs like Weave GitOps and the Flux Operator provide visualization [citation:1][citation:2].

What is the Flux bootstrap process?

Bootstrap installs Flux controllers in the cluster and configures them to manage themselves from a Git repository [citation:7]. The CLI creates a flux-system directory in the repo where all Flux configuration is stored [citation:7].

What is Flagger and how does it relate to Flux?

Flagger is a progressive delivery tool that integrates with Flux CD to provide canary, blue-green, and A/B testing deployment strategies [citation:4][citation:10]. It is often used together with Flux for advanced deployment patterns.

Does Flux support Helm?

Yes! Flux has a dedicated Helm Controller that manages Helm releases declaratively [citation:4][citation:7]. It supports server-side Helm templating, Helm hooks, and rollbacks [citation:2][citation:10].

How does Flux handle multi-tenancy?

Flux uses native Kubernetes RBAC with impersonation [citation:3]. Each tenant operates within their namespace using their own ServiceAccount, limiting the blast radius of a compromise [citation:3][citation:4].

What is image automation in Flux?

Flux provides built-in image automation that scans container registries and automatically updates Git manifests when new images are available [citation:4][citation:9]. This is a native feature, unlike ArgoCD which requires a separate Image Updater [citation:9].

Is Flux CD production-ready?

Yes, Flux CD is a CNCF Graduated project, which means it is production-ready and widely adopted [citation:4][citation:9]. It is used by enterprises for large-scale, secure deployments [citation:9].

Previous: Argo Rollouts Next: Troubleshooting Pods

Flux CD is a powerful, security-focused GitOps tool for Kubernetes. Its modular architecture, native image automation, and Helm integration make it an excellent choice for teams prioritizing security and declarative operations.