Stage 5 · Platform
GitOps & Progressive Delivery
Flux Reconciliation
Using GitRepository, Kustomization, HelmRelease, image automation, and source-controller reconciliation.
Flux Overview
Flux is a set of continuous and progressive delivery solutions for Kubernetes. It is a CNCF graduated project with a composable architecture — each controller handles a specific concern. Flux v2 uses a pull-based reconciliation model driven by Git repositories.
| Controller | Purpose |
|---|---|
| source-controller | Fetches artifacts from Git, Helm, and S3 sources |
| kustomization-controller | Applies Kustomize overlays and raw YAML |
| helm-controller | Manages HelmRelease lifecycle |
| image-reflector-controller | Scans registries for new image tags |
| image-automation-controller | Updates Git repo when new images are found |
| notification-controller | Sends alerts and handles external events |
Source Controller
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: myapp
namespace: flux-system
spec:
interval: 1m
url: https://github.com/myorg/gitops-repo.git
ref:
branch: main
secretRef:
name: git-credentials
ignore: |
# paths to ignore
/docs/
*.md
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: bitnami
namespace: flux-system
spec:
interval: 24h
url: https://charts.bitnami.com/bitnamiThe GitRepository resource defines where Flux fetches manifests from. interval: 1m means Flux checks for changes every minute. The ignore field excludes paths that should not trigger reconciliation.
Kustomization Controller
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: myapp
namespace: flux-system
spec:
interval: 5m
path: ./overlays/production
prune: true
sourceRef:
kind: GitRepository
name: myapp
healthChecks:
- apiVersion: apps/v1
kind: Deployment
name: myapp
namespace: production
timeout: 3m
dependsOn:
- name: infrastructure
patches:
- target:
kind: Deployment
name: myapp
patch: |
- op: replace
path: /spec/replicas
value: 6The Kustomization resource applies Kustomize overlays from a GitRepository. dependsOn ensures infrastructure is deployed first. patches allow per-environment customization without modifying the source repository.
Helm Controller
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: myapp
namespace: production
spec:
interval: 10m
chart:
spec:
chart: myapp
version: "1.0.x"
sourceRef:
kind: HelmRepository
name: myapp-charts
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
remediateLastFailure: true
values:
replicaCount: 3
image:
repository: ghcr.io/myorg/myapp
tag: "2.0.0"
valuesFrom:
- kind: ConfigMap
name: myapp-values
valuesKey: values.yamlHelmRelease manages the full Helm lifecycle — install, upgrade, and rollback. remediation retries failed operations. valuesFrom pulls values from ConfigMaps or Secrets, keeping sensitive data out of the HelmRelease manifest.
Image Automation
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
name: myapp
namespace: flux-system
spec:
image: ghcr.io/myorg/myapp
interval: 5m
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
name: myapp
namespace: flux-system
spec:
imageRepositoryRef:
name: myapp
policy:
semver:
range: ">=2.0.0"
---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImageUpdateAutomation
metadata:
name: myapp
namespace: flux-system
spec:
interval: 5m
sourceRef:
kind: GitRepository
name: myapp
git:
checkout:
ref:
branch: main
commit:
author: fluxbot
message: "chore: update image {{range .Images}}{{println .}}{{end}}"
push:
branch: main
update:
path: ./overlays/production
strategy: SettersImage automation scans the registry for new tags matching the semver policy. When a new version is found, it updates the image tag in the Git repository and pushes the change. Flux then reconciles the new image.
Reconciliation Loop
Flux continuously reconciles the desired state (Git) with the actual state (cluster). The reconciliation loop: fetch the source, generate manifests, compare with cluster state, apply differences, and report status. This loop runs at the interval specified in each resource.
Flux agents in the cluster poll Git for changes. Nothing pushes changes to the cluster. This is more secure than push-based CI because the cluster does not need to expose an API. The Git repository is the single source of truth.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.