Skip to main content

Data Flow: GitOps

Purpose: For platform engineers, explains how a Git push propagates through FluxCD to become running Kubernetes resources.

Flow Summary​

Components​

ComponentNamespaceRole
Source Controllerflux-systemPolls Git repositories and Helm registries for changes
Kustomize Controllerflux-systemApplies Kustomization manifests, handles SOPS decryption
Helm Controllerflux-systemRenders and applies HelmRelease resources
Notification Controllerflux-systemSends reconciliation events to external systems

Sequence​

  1. Developer pushes a commit to the monitored Git branch.
  2. Source Controller detects the new revision (poll interval or webhook).
  3. Source Controller downloads and stores the artifact (tarball of repo contents).
  4. Kustomize Controller picks up Kustomization resources referencing that source.
  5. Kustomize Controller builds the manifests (overlays, patches, variable substitution).
  6. If manifests contain SOPS-encrypted values, Kustomize Controller decrypts them using the Age key in flux-system.
  7. Built manifests are applied to the Kubernetes API server.
  8. Helm Controller processes any HelmRelease resources similarly (template → apply).
  9. Notification Controller emits events for success/failure.

Reconciliation Behavior​

  • Default poll interval: 1 minute (configurable per GitRepository).
  • Failed reconciliations retry with exponential backoff.
  • Drift detection: resources modified outside Git are reverted on the next reconciliation cycle.
  • Dependency ordering: Kustomization.spec.dependsOn controls apply sequence.