FluxCD Resources

Purpose: For platform engineers, provides FluxCD CRD field reference as used by openCenter.

Resource Types

openCenter uses four FluxCD Custom Resource Definitions (CRDs):

CRD	API Group	Purpose
GitRepository	source.toolkit.fluxcd.io/v1	Tracks a Git repository as a source
HelmRepository	source.toolkit.fluxcd.io/v1	Tracks a Helm chart repository
Kustomization	kustomize.toolkit.fluxcd.io/v1	Reconciles manifests from a source
HelmRelease	helm.toolkit.fluxcd.io/v2	Manages a Helm chart release

GitRepository

Each platform service has a GitRepository in services/sources/ pointing to openCenter-gitops-base (community) or opencenter-gitops-enterprise (enterprise).

Community Source

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: opencenter-cert-manager-community
  namespace: flux-system
spec:
  url: ssh://git@github.com/opencenter-cloud/openCenter-gitops-base.git
  ref:
    tag: release-2026.01
  secretRef:
    name: opencenter-base-deploy-key
  interval: 15m

Enterprise Source

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: opencenter-gitops-enterprise
  namespace: flux-system
spec:
  url: ssh://git@github.com/opencenter-cloud/opencenter-gitops-enterprise.git
  ref:
    branch: main
  secretRef:
    name: enterprise-repo-deploy-key
  interval: 1m

Field	Description
spec.url	Git clone URL (SSH for private repos)
spec.ref.tag	Pinned tag for reproducible deployments
spec.ref.branch	Track a branch (enterprise repos)
spec.secretRef	Kubernetes Secret with SSH deploy key
spec.interval	How often FluxCD polls for changes

HelmRepository

Defined in service base manifests. Points to upstream Helm chart registries (community) or private OCI registries (enterprise).

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: jetstack
  namespace: cert-manager
spec:
  url: https://charts.jetstack.io
  interval: 1h
  type: default

In enterprise deployments, the upstream source is replaced with a private OCI registry via Kustomize patches.

Kustomization

Defined in services/fluxcd/. Pulls manifests from a GitRepository and applies them.

Community Pattern

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: cert-manager
  namespace: flux-system
spec:
  sourceRef:
    kind: GitRepository
    name: opencenter-cert-manager-community
  path: ./applications/base/services/cert-manager
  interval: 5m
  retryInterval: 1m
  timeout: 10m
  prune: true
  wait: true
  decryption:
    provider: sops
    secretRef:
      name: sops-age

Enterprise Pattern

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: cert-manager-enterprise
  namespace: flux-system
spec:
  sourceRef:
    kind: GitRepository
    name: opencenter-gitops-enterprise
  path: ./applications/enterprise/services/cert-manager/overlays/install
  interval: 10m
  retryInterval: 1m
  timeout: 10m
  prune: true
  wait: true
  healthChecks:
    - apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      name: cert-manager
      namespace: cert-manager

Field	Description
spec.sourceRef	Which source to pull manifests from
spec.path	Directory path within the source
spec.interval	Reconciliation interval (default: 5m)
spec.prune	Delete resources removed from Git
spec.wait	Wait for resources to become ready
spec.decryption	SOPS decryption config (provider + key secret)
spec.healthChecks	Resources to monitor for readiness

HelmRelease

Defined in openCenter-gitops-base base manifests. Manages Helm chart installation and upgrades.

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cert-manager
  namespace: cert-manager
spec:
  chart:
    spec:
      chart: cert-manager
      version: "v1.18.2"
      sourceRef:
        kind: HelmRepository
        name: jetstack
  interval: 5m
  driftDetection:
    mode: enabled
  install:
    crds: CreateReplace
    remediation:
      retries: 3
  upgrade:
    crds: CreateReplace
    remediation:
      retries: 3
  valuesFrom:
    - kind: Secret
      name: cert-manager-values
    - kind: Secret
      name: cert-manager-values-override
      optional: true

Field	Description
spec.chart.spec.chart	Chart name in the repository
spec.chart.spec.version	Pinned chart version
spec.chart.spec.sourceRef	Which HelmRepository to pull from
spec.driftDetection.mode	Enable drift detection (enabled)
spec.install.crds	CRD install policy: CreateReplace, Skip
spec.install.remediation	Retry count on failed install
spec.upgrade.remediation	Retry count on failed upgrade
spec.valuesFrom	Values sources (Secret or ConfigMap, optional flag for overrides)

Values Layering

HelmReleases use valuesFrom to layer values (merged in order, later wins):

1. Chart defaults — built into the Helm chart
2. Base values — <service>-values Secret (from gitops-base helm-values/)
3. Enterprise values — appended by enterprise overlay (optional)
4. Cluster override — <service>-values-override Secret (from cluster repo, optional: true)

Reconciliation Flow

1. Source Controller polls GitRepository every 15m (sources) / HelmRepository every 1h
2. On new commits/tags, fetches the archive
3. Kustomize Controller reconciles every 5m — builds manifests, decrypts SOPS secrets
4. Helm Controller installs/upgrades on chart or values changes
5. Drift Detection re-applies manifests if cluster state diverges from Git
6. Failed reconciliations retry per remediation.retries

Useful Commands

# Source status
flux get sources git -A

# Kustomization status
flux get kustomizations -A

# HelmRelease status
flux get helmreleases -A

# Force immediate reconciliation
flux reconcile source git flux-system
flux reconcile kustomization cert-manager

# Suspend/resume (maintenance windows)
flux suspend kustomization cert-manager
flux resume kustomization cert-manager