Flux CD Cheat Sheet
GitOps toolkit for Kubernetes covering GitRepository/Kustomization/HelmRelease CRDs, the flux CLI, and multi-tenancy setup.
Bootstrap Flux onto a Cluster
Installs Flux controllers and wires the cluster to a Git repo as the source of truth.
flux check --pre # verify cluster prerequisitesflux bootstrap github \ --owner=my-org \ --repository=fleet-infra \ --branch=main \ --path=clusters/production \ --personalflux get all # list all Flux-managed resources
GitRepository Source
Defines where Flux pulls manifests from and how often it polls.
apiVersion: source.toolkit.fluxcd.io/v1kind: GitRepositorymetadata: name: webapp namespace: flux-systemspec: interval: 1m url: https://github.com/org/webapp-config ref: branch: main
Kustomization Reconciler
Applies a directory's manifests to the cluster, with pruning and health checks.
apiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata: name: webapp namespace: flux-systemspec: interval: 5m path: ./deploy/production prune: true sourceRef: kind: GitRepository name: webapp healthChecks: - apiVersion: apps/v1 kind: Deployment name: webapp namespace: default
HelmRelease from a HelmRepository
Manage a Helm chart deployment declaratively through Flux.
apiVersion: source.toolkit.fluxcd.io/v1kind: HelmRepositorymetadata: name: bitnami namespace: flux-systemspec: interval: 30m url: https://charts.bitnami.com/bitnami---apiVersion: helm.toolkit.fluxcd.io/v2kind: HelmReleasemetadata: name: redis namespace: flux-systemspec: interval: 10m chart: spec: chart: redis version: '18.x' sourceRef: kind: HelmRepository name: bitnami values: architecture: standalone
flux CLI & CRD Reference
Commands and CRDs you'll use daily.
- flux get kustomizations / helmreleases / sources git- list reconciliation status of each resource type
- flux reconcile kustomization webapp --with-source- force an immediate re-sync instead of waiting for the interval
- flux suspend / resume kustomization webapp- pause reconciliation, e.g. during an incident
- flux logs --follow- tail controller logs across the flux-system namespace
- ImageUpdateAutomation- CRD that auto-commits new image tags back to Git when a new image is detected
- Notification/Alert/Provider- CRDs to send reconciliation events to Slack, Teams, webhooks, etc.
OCIRepository Source for Helm/OCI Artifacts
Pull manifests or charts distributed as OCI artifacts instead of a Git repo, common with signed supply-chain workflows.
apiVersion: source.toolkit.fluxcd.io/v1beta2kind: OCIRepositorymetadata: name: webapp namespace: flux-systemspec: interval: 5m url: oci://ghcr.io/org/webapp-manifests ref: tag: v1.4.0 verify: provider: cosign secretRef: name: cosign-pub---apiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata: name: webapp namespace: flux-systemspec: sourceRef: kind: OCIRepository name: webapp
Automated Image Updates
Detect new container image tags and have Flux commit the bump back to Git automatically.
apiVersion: image.toolkit.fluxcd.io/v1beta2kind: ImageRepositorymetadata: name: webappspec: image: ghcr.io/org/webapp interval: 5m---apiVersion: image.toolkit.fluxcd.io/v1beta2kind: ImagePolicymetadata: name: webappspec: imageRepositoryRef: name: webapp policy: semver: range: '>=1.0.0'---apiVersion: image.toolkit.fluxcd.io/v1beta2kind: ImageUpdateAutomationmetadata: name: webappspec: sourceRef: kind: GitRepository name: webapp git: commit: author: { email: [email protected], name: fluxcdbot } push: branch: main update: path: ./deploy strategy: Setters
postBuild Variable Substitution
Inject per-environment values into rendered manifests without maintaining separate overlay copies.
apiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata: name: webapp-stagingspec: path: ./deploy/base sourceRef: { kind: GitRepository, name: webapp } postBuild: substitute: cluster_env: staging replica_count: "2" substituteFrom: - kind: ConfigMap name: cluster-vars - kind: Secret name: cluster-secrets optional: true# in a manifest: replicas: ${replica_count}
Ordering Reconciliation with dependsOn
Ensure a Kustomization only applies after another one has succeeded, e.g. CRDs before the operator that uses them.
apiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata: name: cert-manager-operator namespace: flux-systemspec: dependsOn: - name: cert-manager-crds interval: 10m path: ./infra/cert-manager sourceRef: kind: GitRepository name: fleet-infra wait: true timeout: 3m
Multi-Tenancy Vocabulary
Terms specific to running Flux safely across many teams on one cluster.
- Tenant- a namespace + ServiceAccount + RBAC bundle scoping what a team's Kustomizations/HelmReleases can touch
- spec.serviceAccountName- pins a Kustomization to a tenant's ServiceAccount so it can only apply resources that account is authorized for
- --no-cross-namespace-refs- flux bootstrap flag hardening the controllers so a tenant's sources can't be referenced from other namespaces
- flux-system namespace isolation- platform team owns flux-system; tenants get their own namespace with scoped GitRepository/Kustomization objects
- tenant.yaml (flux create tenant)- generates the Namespace/ServiceAccount/RoleBinding scaffolding for onboarding a new team
Split GitRepository/Kustomization definitions by environment directory (clusters/staging, clusters/production) rather than by branch — branch-per-environment fights Flux's continuous-reconciliation model and makes promoting a change require error-prone merges instead of a simple path bump.
