fluxcd.io

Flux is a set of continuous and progressive delivery solutions for Kubernetes, and it is a CNCF Graduated project. It is open and extensible, its APIs are stable, and its core idea is GitOps: you describe the desired state of your system in Git, and Flux reconciles the cluster to match it. If you run Kubernetes and want deployments driven by Git rather than by manual kubectl commands, Flux is built for that workflow.

What problem Flux solves

Kubernetes tells you how to run workloads, but not how to keep a cluster continuously aligned with what you intended. Flux closes that gap:

• Declarative and automated — Describe the entire desired state of your system in Git, including apps, configuration, dashboards, and monitoring. YAML enforces conformance to the declared system, and changes are synced automatically, so you don't need to run kubectl yourself.
• Auditable — Everything is controlled through pull requests. Your Git history becomes a sequence of transactions, letting you recover state from any snapshot.
• Continuous delivery (CD) — Push to Git and Flux does the rest through automatic reconciliation.
• Progressive delivery (PD) — With Flagger, Flux deploys apps using canaries, feature flags, and A/B rollouts.

Key capabilities

GitOps for apps and infrastructure

Flux can manage any Kubernetes resource, not just application workloads. Infrastructure and workload dependency management is built in, so ordering between infrastructure and the apps that depend on it is handled for you.

Works with your existing tools

Flux works with your Git providers (GitHub, GitLab, Bitbucket, and even S3-compatible buckets as a source), all major container registries, fully integrates with OCI, and works with all CI workflow providers. It supports common tooling such as Kustomize and Helm, plus GitHub, GitLab, Harbor, and custom webhooks, with notifications on Slack.

Automated image updates

Flux can push back to Git for you: it scans container images and patches manifests, so image updates flow through Git like any other change.

Security by design

Flux follows a pull-based model with the least amount of privileges, adheres to Kubernetes security policies, and integrates tightly with security tools and best practices.

Multi-tenancy and multi-cluster

Flux uses true Kubernetes RBAC via impersonation and supports multiple Git repositories. Multi-cluster infrastructure and apps work out of the box with Cluster API: one Kubernetes cluster can manage apps in the same or other clusters, spin up additional clusters, and manage clusters including lifecycle and fleets.

Who it is for

Flux fits teams that:

• Run Kubernetes and want Git to be the single source of truth for both apps and infrastructure.
• Need an audit trail and rollback via Git history and pull requests.
• Want progressive delivery (canaries, A/B, feature flags) without bolting on a separate system.
• Operate multiple clusters or tenants and need RBAC-based isolation.
• Already use Helm, Kustomize, or OCI artifacts and want them reconciled automatically.

If you only need one-off kubectl apply runs, or you have no Git-based workflow, Flux adds process you may not need.

Getting started

The project publishes a "Get started" entry point on fluxcd.io, and the current release is Flux 2.9 GA. The community also holds regular project meetings — for example, the CNCF Flux Project Meeting is scheduled for 2026-09-23 at 12:00 UTC via Zoom. For the latest setup instructions and version-specific details, start from the official site rather than third-party guides.

Flux implements GitOps by treating a Git repository as the single source of truth for your Kubernetes cluster. You declare the desired state of your system — applications, configuration, dashboards, monitoring, and other resources — in Git using YAML. Flux then continuously pulls that state and reconciles it against the cluster, so changes are applied automatically without running kubectl by hand. This model fits teams that want auditable, declarative delivery for both apps and infrastructure on any Kubernetes distribution.

The core mechanism: pull, reconcile, repeat

Flux runs inside the cluster and watches your declared sources. The loop works like this:

1. Declare — You commit the desired state to Git as YAML manifests.
2. Pull — Flux fetches from your Git provider (GitHub, GitLab, Bitbucket, or even S3-compatible buckets as a source).
3. Reconcile — Flux compares the declared state with what's actually running and applies the difference.
4. Repeat — Reconciliation runs continuously, so drift is corrected automatically.

Because Flux pulls rather than waiting for an external system to push, it needs fewer privileges and aligns with Kubernetes security policies. The site describes this as a "pull vs. push" design with least-privilege access.

What you can manage

Flux is not limited to application deployments. The declared system state can include:

• Applications and their configuration
• Dashboards and monitoring
• Any Kubernetes resource
• Infrastructure and workload dependencies, with dependency management built in

This is why Flux is described as GitOps for both apps and infrastructure, rather than a deployment-only tool.

Auditability through pull requests

Every change flows through a pull request. That gives you two things:

• A transaction history — Your Git history is a sequence of changes, so you can recover state from any snapshot.
• Review before apply — Changes are visible and reviewable before they reach the cluster.

If something goes wrong, you revert the commit rather than manually undoing cluster changes.

Progressive delivery with Flagger

Flux handles continuous delivery (CD). For progressive delivery (PD), it works alongside Flagger to roll out apps with canaries, feature flags, and A/B rollouts. This lets you release gradually and shift traffic based on observed behavior rather than switching all users at once.

Automated image updates back to Git

Flux can push back to Git for you. It scans container images and patches the manifests with updated image references, so a new image tag becomes a Git commit — keeping the repository as the source of truth even for version bumps. This closes the loop: image updates are auditable commits like any other change.

Tool and platform compatibility

Flux is a CNCF Graduated project, and its APIs are stable. It works with any Kubernetes and supports multi-tenancy through true Kubernetes RBAC via impersonation, plus multiple Git repositories. Multi-cluster infrastructure and apps work out of the box with Cluster API — one cluster can manage apps in the same or other clusters, spin up additional clusters, and manage cluster lifecycle and fleets.

When this approach fits

Choose Flux's GitOps model when you want:

• A single declarative source of truth in Git for apps and infrastructure
• Automatic reconciliation instead of manual kubectl changes
• Pull-request-based review and a recoverable Git history
• Progressive delivery via Flagger and automated image updates back to Git

If your workflow depends on imperative cluster changes or you cannot grant a controller in-cluster access to your Git sources, the pull-based model will need adjustment before it fits.

Flux addresses security through a pull-based reconciliation model, least-privilege access, and adherence to Kubernetes security policies, while multi-tenancy is implemented with true Kubernetes RBAC via impersonation and support for multiple Git repositories. This makes it a reasonable fit for platform teams that need to run shared GitOps infrastructure across teams or clusters — provided they already use Kubernetes RBAC and are comfortable granting Flux cluster-level read access to reconcile resources.

The security model: pull, not push

The core architectural choice is that Flux pulls from sources rather than having an external system push into the cluster. In practice this means:

• The cluster initiates connections to Git providers, container registries, and OCI sources. No inbound access to the cluster is required for deployment.
• Credentials for sources live inside the cluster as Kubernetes Secrets, so they are subject to the same RBAC and namespace isolation as any other cluster resource.
• Flux is designed around least amount of privileges — you grant only the permissions needed for the resources it reconciles, rather than a broad deploy credential held outside the cluster.

This is the opposite trade-off from push-based CI pipelines, where an external runner holds cluster credentials. If your threat model treats outbound-only connections and in-cluster secrets as safer than externally stored deploy tokens, Flux's model is the stronger option.

Security integration and policy adherence

Flux is built to adhere to Kubernetes security policies and to integrate tightly with security tooling and best practices. The project maintains a dedicated security considerations document covering its posture. Because everything is declared in Git and applied through pull requests, the change path is auditable: your Git history is a sequence of transactions, and you can recover state from any snapshot.

Multi-tenancy: real Kubernetes RBAC via impersonation

Flux does not invent its own permission system. It uses true Kubernetes RBAC via impersonation, which means:

• Reconciliation can act as a specific ServiceAccount, so a tenant's workloads are only ever applied with that tenant's permissions.
• A tenant cannot escalate beyond what its own RBAC allows, because the API server enforces the boundary — not Flux.
• Multiple Git repositories are supported, so different teams can own separate repositories and separate reconciliation scopes.

This is the key distinction from tools that use a single privileged controller identity for all tenants. With impersonation, the Kubernetes API server remains the enforcement point, which is what makes the model auditable and consistent with existing cluster policy.

Multi-cluster and "multi-everything"

Multi-cluster infrastructure and apps work out of the box with Cluster API:

• One Kubernetes cluster can manage apps in the same cluster or in other clusters.
• Flux can spin up additional clusters itself.
• It can manage cluster lifecycle and fleets.

Combined with multi-repository support and RBAC impersonation, this covers the common platform-team pattern: a management cluster running Flux, tenant repositories scoped by RBAC, and workload clusters provisioned and reconciled through Cluster API.

What to check before adopting it for a shared platform

If your teams already operate under namespace-scoped RBAC and you want Git to be the single auditable source of truth, Flux's security and tenancy model aligns with that setup. If your organization instead relies on a central external deploy system holding cluster credentials, the pull model is a meaningful architectural change you should evaluate first.

Start at the official Flux website, fluxcd.io. The homepage has a Get started entry point for installing and configuring Flux, and it also lists community events and project meetings. Flux is a CNCF Graduated project, so the site is the canonical place to confirm the current release (the homepage announces Flux 2.9 GA) and to find upcoming community calls.

Getting started with Flux

Flux is described on its site as "a set of continuous and progressive delivery solutions for Kubernetes that are open and extensible." The practical path is:

1. Open fluxcd.io and use the Get started link.
2. Follow the installation and configuration guidance there for your Kubernetes cluster.
3. Confirm you are on the current release — the site announces Flux 2.9 GA as the latest version.

What you get once running, per the site's own description:

• Declarative & Automated — you describe the desired state of your system in Git (apps, configuration, dashboards, monitoring) and Flux syncs changes automatically, so you don't run kubectl for routine changes.
• Push to Git and Flux does the rest — Flux handles application deployment (CD) and, with Flagger, progressive delivery (PD) through automatic reconciliation. It can also push back to Git via automated container image updates (image scanning and patching).
• Auditable — everything is controlled through pull requests, and the Git history gives you a sequence of transactions you can recover state from.

Joining the community

The site lists community activity directly, including a next event:

Beyond meetings, the homepage surfaces Community and Adopted by sections, so you can see who else uses Flux and where to plug in. Release announcements such as Flux 2.9 GA also appear on the site, which makes it a reasonable single place to track versions and events.

What Flux works with

If your decision depends on fitting Flux into an existing toolchain, the site states it works with:

• Git providers — GitHub, GitLab, Bitbucket, and even S3-compatible buckets as a source.
• Container registries — all major registries, with full OCI integration.
• CI workflow providers — all common providers.
• Kubernetes tooling — Kustomize and Helm.
• Webhooks and notifications — GitHub, GitLab, Harbor, and custom webhooks; notifications on Slack.

Security and multi-tenancy notes

The site describes Flux as designed with security in mind: pull vs. push, least privilege, adherence to Kubernetes security policies, and integration with security tools and best practices. For multi-tenancy, it uses true Kubernetes RBAC via impersonation and supports multiple Git repositories. Multi-cluster infrastructure and apps are described as working out of the box with Cluster API — one cluster can manage apps in the same or other clusters, spin up additional clusters, and manage cluster lifecycle and fleets.

If your goal is simply to evaluate Flux, start with the Get started link and the 2.9 GA announcement; if your goal is to participate, the project meeting listing on the same site is the concrete next step.

Flux works with the tools you likely already run: GitHub, GitLab, and Bitbucket as Git sources (plus S3-compatible buckets), major container registries with full OCI integration, any CI workflow provider, Kustomize and Helm for configuration, webhooks from GitHub, GitLab, Harbor or custom endpoints, and any Kubernetes distribution. It is a CNCF Graduated project, and its APIs are stable.

The sections below break that down by category so you can check each piece against your own stack.

Git and source providers

Flux reconciles the desired state you keep in Git, so the source layer is the first thing to verify.

• Git hosting: GitHub, GitLab, and Bitbucket are named as supported Git providers.
• Object storage as a source: You can use S3-compatible buckets as a source instead of (or alongside) a Git repository.
• Multiple repositories: Flux supports more than one Git repository, which matters if you separate app config from infrastructure config.

If your organization uses a self-hosted Git server that speaks the same protocols as these providers, the same source mechanisms apply — but confirm against your provider's API compatibility rather than assuming.

Container registries and OCI

Flux handles image automation and OCI artifacts:

• Registries: It works with all major container registries.
• OCI: Integration with OCI is described as full, covering OCI artifacts as a delivery format.
• Image automation: Flux can scan for new container images and patch the image reference back into Git automatically, so a new build becomes a Git commit rather than a manual edit.

This is the mechanism behind "push to Git and Flux does the rest" — you push an image, Flux writes the updated tag or digest to your repository, and reconciliation deploys it.

CI and delivery tooling

Flux is designed to sit alongside CI rather than replace it:

• CI providers: It integrates with all CI workflow providers. The common pattern is CI builds and tests, then Flux pulls the result into the cluster.
• Progressive delivery: With Flagger, Flux deploys apps using canaries, feature flags, and A/B rollouts.
• Configuration tools: Kustomize and Helm are both supported.
• Webhooks: GitHub, GitLab, Harbor, and custom webhooks can trigger reconciliation.

A practical example: your CI pipeline builds an image and pushes it to a registry; Flux's image automation commits the new tag to Git; Flux reconciles the cluster; Flagger shifts traffic gradually while watching metrics.

Kubernetes and multi-cluster

• Any Kubernetes: Flux is described as working with any Kubernetes distribution.
• Multi-tenancy: It uses true Kubernetes RBAC via impersonation, so tenants are isolated with native Kubernetes permissions rather than a Flux-specific model.
• Multi-cluster: With Cluster API, one cluster can manage apps in the same or other clusters, spin up additional clusters, and manage cluster lifecycle and fleets.

Notifications and observability

• Notifications: Slack is named, and the webhook support means you can route events to other systems as well.
• Auditability: Because everything flows through pull requests, your Git history is a sequence of transactions you can recover state from.

How to decide whether it fits

The main decision point is not whether Flux supports a given category — it covers the common ones — but whether your specific provider's API matches what Flux expects. For anything outside the named list, test the source or webhook integration in a non-production cluster before committing.