---
title: Flux2 Install and Usage
url: https://devopstales.github.io/kubernetes/gitops-flux2/
date: 2021-05-07
keywords: kubernetes deployment, gitops, Flux2
---


In this post I will show you how you can use Install and Use the GitOps Tool Flux2.

<!--more-->

{{< content "/filedir/k8s-gitops.html" >}}

### Install Flux2 cli

```bash
curl -s https://fluxcd.io/install.sh | sudo bash
```

### Bootstrap Flux2 Server components

Flux is installed in a GitOps way and its manifest will be pushed to the repository, so you will also need a GitHub account and a [personal access token](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) that can create repositories (check all permissions under `repo`) to enable Flux do this.

```bash
export GITHUB_TOKEN=<token>
export GITHUB_USER=devopstales

flux check --pre

flux bootstrap github \
  --owner=$GITHUB_USER \
  --repository=gitops-repo \
  --branch=main \
  --path=./01_flux2/ \
  --personal
```

If you try to install in a secure Kubernetes cluster with runAsNonRoot psp the notification-controller and the source-controller can't start because it runs as root.

```yaml
nano rb.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: psp-rolebinding-flux-system
  namespace: flux-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system-unrestricted-psp-role
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts

kubectl apply -f rb.yaml
```

With `--path` you can configure the directory which will be used to reconcile the target cluster.

```bash
./01_flux2/
└── flux-system # <- namespace dir generated by bootstrap
    ├── gotk-components.yaml
    ├── gotk-sync.yaml
    ├── rb.yaml # <- RoleBinding for psp created by me
    └── kustomization.yaml
```

### Deploy application

Add an application to the cluster and upload to the git repository:

```bash
./01_flux2/
├── 00_guestbook # <- guestbook application
│   ├── 00_ns.yaml
│   ├── 01_rb.yaml
│   ├── 02_guestbook-ui-svc.yaml
│   └── 03_guestbook-ui-deployment.yaml
└── flux-system # <- namespace dir generated by bootstrap
    ├── gotk-components.yaml
    ├── gotk-sync.yaml
    ├── rb.yaml # <- RoleBinding for psp created by me
    └── kustomization.yaml
```

### Add another Git repository

We will be using a public repository github.com/stefanprodan/podinfo, podinfo is a tiny web application made with Go. Create a GitRepository manifest pointing to podinfo repository’s master branch:

```bash
mkdir ./01_flux2/01_podinfo

flux create source git podinfo \
  --url=https://github.com/stefanprodan/podinfo \
  --branch=master \
  --interval=30s \
  --export > ./01_flux2/01_podinfo/podinfo-source.yaml
```

```yaml
cat 01_flux2/01_podinfo/podinfo-source.yaml
---
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 30s
  ref:
    branch: master
  url: https://github.com/stefanprodan/podinfo
```

```bash
./01_flux2/
├── 00_guestbook # <- guestbook application
│   ├── 00_ns.yaml
│   ├── 01_rb.yaml
│   ├── 02_guestbook-ui-svc.yaml
│   └── 03_guestbook-ui-deployment.yaml
├── 01_podinfo
│   └── podinfo-source.yaml
└── flux-system # <- namespace dir generated by bootstrap
    ├── gotk-components.yaml
    ├── gotk-sync.yaml
    ├── rb.yaml # <- RoleBinding for psp created by me
    └── kustomization.yaml
```

### Kustomization

We will create a Flux Kustomization manifest for podinfo. This configures Flux to apply the kustomize directory located in the podinfo repository.

```bash
flux create kustomization podinfo \
  --source=podinfo \
  --path="./kustomize" \
  --prune=true \
  --validation=client \
  --interval=5m \
  --export > ./01_flux2/01_podinfo/podinfo-kustomization.yaml
```

```yaml
cat ./01_flux2/01_podinfo/podinfo-kustomization.yaml
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 5m0s
  path: ./kustomize
  prune: true
  sourceRef:
    kind: GitRepository
    name: podinfo
  validation: client
```

```bash
./01_flux2/
├── 00_guestbook # <- guestbook application
│   ├── 00_ns.yaml
│   ├── 01_rb.yaml
│   ├── 02_guestbook-ui-svc.yaml
│   └── 03_guestbook-ui-deployment.yaml
├── 01_podinfo
│   ├── podinfo-kustomization.yaml
│   └── podinfo-source.yaml
└── flux-system # <- namespace dir generated by bootstrap
    ├── gotk-components.yaml
    ├── gotk-sync.yaml
    ├── rb.yaml # <- RoleBinding for psp created by me
    └── kustomization.yaml
```

### Manage Helm Releases

I usually use Ransher's helm operator but Flux has it's own. It has two part the `HelmRepository` and the `HelmRelease`:

```yaml
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: HelmRepository
metadata:
  name: chartmuseum
  namespace: flux-system
spec:
  url: https://chartmuseum.github.io/charts
  interval: 10m
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: chartmuseum
  namespace: flux-system
spec:
  interval: 5m
  chart:
    spec:
      chart: chartmuseum
      version: "2.14.2"
      sourceRef:
        kind: HelmRepository
        name: chartmuseum
        namespace: flux-system
      interval: 1m
  values:
    env:
      open:
        AWS_SDK_LOAD_CONFIG: true
        STORAGE: amazon
        STORAGE_AMAZON_BUCKET: "bucket-name"
        STORAGE_AMAZON_PREFIX: ""
        STORAGE_AMAZON_REGION: "region-name"
    serviceAccount:
      create: true
      annotations:
        eks.amazonaws.com/role-arn: "role-arn"
    securityContext:
      enabled: true
      fsGroup: 65534
```

It is possible to define a list of ConfigMap and Secret resources from which to take values. 

```yaml
spec:
  valuesFrom:
  - kind: ConfigMap
    name: prod-env-values
    valuesKey: values-prod.yaml
  - kind: Secret
    name: prod-tls-values
    valuesKey: crt
    targetPath: tls.crt
```