►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: Flux - Stefan Prodan, Weaveworks & Alexis Richardson, Weaveworks
In this session, we will introduce the basics of Flux and its Helm Operator sub-project. Flux is an open source operator that makes GitOps happen in your cluster. It automatically ensures that the state of your Kubernetes cluster matches the configuration you’ve supplied in Git. We will explore the GitOps methodology and talk about the benefits of using Flux to do Kubernetes cluster management and application delivery. We shall compare Flux with other approaches like Spinnaker and talk about the differences between CiOps and GitOps. Flux joined CNCF in August 2019 as a sandbox project.
https://sched.co/Uai2
A
Hi
I'm
Alexis
Richardson-
this
is
my
colleague
Stefan
proton
from
we've
works.
We're
going
to
talk
about
flux.
This
is
our
special
CN
CF
allocated
slot
for
every
CN,
CF
project,
sandbox
or
otherwise.
There's
a
couple
of
slots
to
talk
about
the
project.
This
is
supposed
to
be
an
introductory
session.
So,
if
you
have
heard
all
of
this
before
I
apologize,
Stefan
is
doing
a
deep
dive
later
on
this
week.
A
A
The
answer
from
now
on
should
be
the
same
because
these
projects
are
merging
into
one,
which
is
something
that
happens
very
rarely
in
open
source
that
you
take
two
successful
projects
which
have
thousands
of
users
and
bring
them
together
into
a
single
thing.
It's
like
I,
said
a
planetary
conjunction.
We
should
expect
unusual
things
to
be
happening
that
we
see
in
the
fields,
but
it's
great
because
what's
happened
here
is
it's
an
example
of
parallel
evolution?
A
A
It's
remarkable
how
similar
the
physical
properties
of
that
of
the
eye
designs
are
they've
grown
in
two
completely
different
environmental
niches.
Fulfilling
apparently
similar
needs
similar
design.
We've
works
started
our
business
wanting
to
help
developers
create
applications
using
containers.
We
thought
this
would
be
a
big
deal
about
five
years
ago,
when
we
found
that
the
company
was
the
week
of
something
called
kubernetes
being
founded,
I
being
a
skeptical
person
thought
that
kubernetes
would
never
take
off
because
it
had
a
very
silly
name.
A
Luckily,
I
was
wrong.
It
wasn't
long
before
we
were
building
a
SAS
product
as
part
of
our
marketing
strategy
to
reach
out
to
developers
and
help
them
build
these
applications
in
Ursus
our
product.
We
had
to
run
it
on
something
and
we
wrote
our
own
scheduler
first
kept
blowing
up
and
we
ended
up
spending
more
time.
A
Writing
the
schedule,
whether
we
were
writing
the
app
that
people
were
supposed
to
be
using
and
buying,
and
so
somebody
said
well,
let's
get
an
off-the-shelf
one
and
we
look
to
mesosphere
and
nobody
could
understand
that
we
looked
at
her
and
we
tried
to
put
patches
into
dr.
swarm,
but
they
were
pushed
back
by
the
docker
team.
We
talked
to
how
she
Cooper
bat
nomads
and
they
said
don't
use
nomads
that
was
version
0.2.
A
So
by
process
of
elimination
we
found
Cuba
Nettie's,
which
meant
that
we
had
to
become
people
who
run
kubernetes
now,
I,
don't
know
if
you
are
in
in
the
audience.
If
you
have
people
who
run
Cuban
areas,
but
it's
a
lot
easy
to
do.
You
have
to
do
a
lot
of
stuff,
like
you
have
to
figure
out
how
to
monitor
it,
how
to
deploy
it,
how
to
put
apps
onto
it,
had
a
monitor
those
apps
and
if
things
blow
up
how
to
get
how
to
get
it
back
up
again
and
being
a
business
person.
A
Well.
That
was
pretty
quick,
not
bad.
Forty
minutes
a
45
minutes
now
we're
doing
this
in
just
a
few
minutes
because
we
got
better
at
it,
but
I
asked
them.
What
did
you
do
to
make
that
possible?
But
they
said
we
can
build
a
crack
cluster
for
an
entire
application
at
will,
because
we
have
a
complete
description
of
everything,
we're
running
stored
and
get,
and
we
can
use
that
to
instruct
the
system
how
to
build
itself.
A
It
was
that
sounds
really
clever,
so
we
started
calling
this
gift
ops
because
it
was
operations
driven
by
a
description
in
get
and
ink
adopts.
One
of
the
things
that
you
do
is
you
deploy
apps
the
clusters,
not
by
sitting
outside
running
cube,
control
or
a
bunch
of
scripts
or
Jenkins
or
spinnaker,
or
other
things
that
sit
outside
the
cluster.
Instead,
you
give
the
cluster
a
set
of
instructions
and
it
runs
agents
inside
itself
that
go
AHA.
My
cluster
is
in
the
wrong
state.
A
So
now
we
have
two
projects
doing
the
same
thing
independently.
So
we
thought
this
is
a
silly
situation,
because
this
is
open-source
we're
supposed
to
collaborate.
We
collaborate
and
since
we're
not
trying
to
do
things
like
hold
features
back
from
you
to
force
you
to
buy
Enterprise
flux,
it's
all
it's
all
out
there.
Everything
that
you
can
see.
What
you
see
is
what
you
get.
We
have
other
products
for
enterprise
stuff.
Like
policy
and
governance.
We've
had
a
strong
incentive
to
team
up
with
Intuit
it
took
a
while
to
convince
each
other.
A
A
Okay,
so
it
mentions
here:
AWS
are
also
to
be
thanked,
for
this
I
hope
there'll
be
other
large
companies
soon.
Maybe
Stefan
is
gonna.
Tell
you
a
bit
about
flux
in
an
introductory
manner.
Yeah.
Is
that
good?
She
would
you
wanna
take
over
yeah.
You
know
when
I
say
my
water.
Thank
you
very
much.
I
would
Hugh
stuff.
B
Okay,
so
this
is
my
favorite
slide
on
Kito's.
That
I
I
think
is
it's
very
simple:
to
explain
what
flux
does,
because
flux
is
a
simple
tool.
Flux
is
not
complex
tool.
It
doesn't
try
to
do
many.
Many
things
what
it
tries
to
do
is
replace
all
these
CLI
to
link
with
another
CLI,
much
known
that
any
other
Scylla
is
out
there,
which
is
good
right.
So,
instead
of
applying
changing
the
state
of
your
cluster
with
different
tools
with
cube
cotta
with
helm
with
customize
and
yeah,
maybe
some
scripts
that
trap
those
don't
see
allies.
B
We
want
to
replace
all
of
that
with
single
command,
which
is
good
which
modify
something
you
push
it
to
a
git
repository
and
from
there
that
something
ends
up
on
the
cluster
and
it
can
be
anything.
Flux
is
not
open.
Ated
flux
doesn't
look
at
what
have
you
put
in
your
git
repo
that
defines
the
cluster?
It
can
be
a
custom
resource
definition
can
be
a
name.
Space
can
be
a
role.
B
Why
we
should
use
this
kind
of
approach
to
infrastructure?
One
of
one
of
many
advantages
is
the
fact
that
if
he
is
good,
you
have
this
nice
history
of
any
change
that
happened
on
your
cluster,
so
you
can
do
git
history
and
you
can
see
who
did
what
on
the
production
cluster?
You
can
engage
your
team
in
approving
changes
like
if
we
are
running
all
kinds
of
CLS
and
everybody
is
doing
from
some
computer,
then
we
have
no
idea
what
exactly
change
in
the
cluster.
B
So
basically
we
need,
to
you
know,
have
a
very
solid
logging
solution
around
kubernetes
subscribe
to
all
the
events
and
it's
very
hard
to
reproduce
the
state
like.
If
you
lose
the
cluster,
how
can
you
reproduce
everything
that
was
there?
Of
course
there
are
tools
like
Valero
and
others
that
can
snapshot
the
TCP.
You
can
restore
that
state.
Somehow
we
think
github
solves
this
problem
easily,
because
if
you
lose
the
cluster,
your
state
is
tore
outside
it's
in
the
git
repo
you
create
on
your
cluster.
B
A
B
Can
restore
everything
that
was
before
in
the
kubernetes?
It
is
the
storage,
and
even
that
is
not
true,
because
what
you
studying
it
is
an
intention,
for
example,
with
self
manager.
I
want
a
certificate,
so
you
store
the
the
request
of
a
certificate
in
your
git
repository
that
did
request.
It
doesn't
have
the
actual
certificate
server
manager
will
talk
to
let's
encrypt
and
we
get
that
object
for
me
and
creates
it
on
the
cluster
so
desire
state.
B
What
we
save
in
a
git
repository
is
not
the
actual
state
is
an
intent.
I
want
if
something
breaks
I
want
to
get
to
that
thing,
but
it's
not
like
database
name
snapshot
right,
so
4,
4
4,
let's
encrypt
it
to
you,
destroy
the
cluster.
You
create
a
new
cluster.
You
linked
to
the
same
git
repo
and,
let's
encrypt
will
will
do
the
request
again.
Selma
general.
Do
the
request
again:
you'll
have
like
similar
certificate.
What
is
not
that
certificate
right?
B
B
B
Of
course
you
have
to
have
a
git
repository
a
container
registry,
and
here
the
in
the
container
registry
part
was
very
important.
Is
that
you,
you
store
their
images
that
are
immutable.
That
means
no
latest
tag,
never
push
an
image
twice.
If
something
changes
in
your
code
is
something
changes
in
a
config
that
you
store
inside
the
container
use
a
get
sha
use,
semver
use
something
unique
when
you
push
to
that
poster,
that's
something
people
usually
forget
when
they
do
kubernetes.
B
B
So
flux
does
pulling
on
the
git
repository,
it
looks
at
it
and
it
has
by
default.
It
has
a
five
minutes
interval,
so
you
change
something
now
and
in
the
next
five
minutes
it
will.
It
will
apply
that
change
on
the
cluster
and
you
can,
of
course
you
can
fine-tune
that
reconciliation
loop.
It
also
watches
container
registries
how
it
does
that
it
looks
at
your
kubernetes
cluster.
It
looks
at
all
the
image
put
secrets
that
you
have
there.
B
It
uses
those
secrets
to
connect
to
the
container
registry
and
creates
a
database
a
cache
of
all
the
images
that
are
running
on
your
cluster
and
they're
tagged
tabs.
That
is
metadata.
The
aren't,
like
flux,
doesn't
actually
download
an
image,
but
it
it
knows
if
the
image
that
I'm
running
now
it
is
the
latest
image
or
how
many
versions
behind
and
so
on.
So
it's
only
metadata.
B
What
are
things
a
gift
ops
engine
should
do.
Of
course
it
should
have
the
possibility
to
undo
changes
that
are
aren't
going
through
get.
For
example,
let's
say
you,
you
have
a
deployment
you
provision
it
with
in
a
get
ops
way.
Then
you
go
with
Q
control
and
you
do
keep
control
edit.
That
deployment,
then
you
change
something.
B
Flux
will
undo
it
because
we
think
ok,
you
can
react
to
get
hooks
like.
Usually
she
is
built
like
that.
You
put
something
to
give.
The
system
reacts
red.
We
think
about
continuous
deployment
in
inside
the
cluster
should
reconcile
state
all
the
time,
even
if
there
is
no
event,
because
you
cannot
know
if
someone
modified
your
crossed
right
so
flux
does
this
continuously
sing.
It
continuously
applies
the
desired
state.
So
if
you
try
to
change
it,
it
will
it
will
and
will
change
so
you
have
to
scale
it
to
zero.
B
If
you
want
to
do
nasty
stuff
on
your
cluster
puppet
had
the
same
way
of
running
many
other
tools.
Do
this
detox
is
not
it's
not
a
new
concept,
but
it
it
applies
differently
to
kubernetes,
because
you
know
you
don't
need
to
store
an
intermediary
state
like
in
telephone
or
in
puppet
and
all
these
other
tools.
You
need
this
plan.
B
This
plan
is
to
be
stored
in
another
way
in
another
place,
and
when
you
apply
the
plan,
you
have
to
have
a
lock,
so
you
don't
run
it
in
parallel
and
so
on
how
kubernetes
is
built
and
because
of
etcd
and
the
kubernetes
api.
You
don't
have
this
constrains.
You
can
apply
a
thing
in
peril
ten
times
it
will
just
work
to
work
once
and
all
the
other
actions
are
no
another
thing
that
flux
does.
It
verifies
the
identity
of
a
computer
with
GPG.
What
what
that
means.
It
protects
you
from.
B
The
signing
key
is
not
in
stored
in
github
right,
it's
stored
on
your
computer.
So
even
if
someone
breaks
your
account,
they
don't
have
the
key.
They
cannot
sign
that
commit
and
flux
sees
the
commit
party
to
not
apply
it
because
it
has
a
list
of
approved
keys
above
proved
committers.
It
doesn't
just
look
at
the
user
name
of
the
committee,
so
this
is
how
it
does
does
this.
Has
the
security
feature.
B
B
So
in
this
way
we
don't
have
to
have
five
flux
versions
for
all
all
those
all
these
I
know
breaking
changes
in
kubernetes
and
so
on.
It's
on
you,
you
can
replace
the
tool
that
applies
applies.
The
change
now
flux
talks
a
lot
with
the
kubernetes
api
to
discover
what's
running
on
your
cluster,
so
it
uses
informers
and
all
the
stuff.
So
it
queries
a
lot.
The
API
why
it
does
that
to
enable
garbage
collection,
we
can
detect
that
something
was
in
a
git
repository.
It
got
applied
on
a
server
inside
the
cluster.
B
B
B
We
need
it,
but
we
had
a
couple
of
iterations
how
how
to
implement
this
garbage
collection
thingy
in
such
a
way
that
you
don't
put
a
lot
of
pressure
on
the
on
the
API
server
and
you
don't
have
to
query
each
object
and
we
use
the
dynamic
client.
The
dynamic
client
go
for
kubernetes.
This
is
how
we
discover
everything.
That's
running
in
your
cluster.
B
How
you
install
flux
is
quite
easy.
We
have
several
ways
of
installing
it.
We
have
a
flux,
ETL
comment
line
that
has
an
install
option
and
also
has
an
identity
option
and
I
want
to
show
you
how
it
works.
We
also
have
a
hand
chart
that
has
all
the
options
out
there
to
set
up
flux
in
the
read-only
mode
to
deploy
it
with
PGP
keys
to
deploy
it
with
your
known
hosts.
For
example,
you
can
use
a
private
git,
repo
flux
doesn't
know
about
it.
It
cannot
connect
it.
B
So
you
have
to
mount
those
kind
of
informations
into
flux
with
the
hand
chart,
then
we
also
offer
a
customized
base.
So
if
you
are,
if
you
want
to
integrate
flux
in,
let's
say
a
cluster
bootstrap
customize
is
the
way
to
do
it.
Don't
boost
rep
clusters
with
help,
because
home
tree
will
not
support
multiple
namespaces
and
stuff
like
that,
so
these
are
all
the
offerings
that
we
have
for
the
insulin.
It's
quite
easy.
I
want
to
show
you
how
it
works.
B
B
B
B
Okay,
so
I've
applied
those
those
things
and
now
what
what
flux
does
when
it
starts?
It
looks
up
an
SSH
key
in
the
cluster.
So
if
you
don't
have
an
SSH
key
secret
in
the
cluster
with
the
flux
name,
it
will
create
one
for
you,
so
we
can
get
the
public
key
of
that
of
that
C
of
that
key
with
the
identity
command.
So
when
I
run,
identity.
B
B
B
And
fluxes
until
I
did
that
flux
every
couple
of
10
seconds
or
something
that
will
just
check
do
I
have
write
access
to
the
repo?
No
okay,
I'll,
try
again
I'll
try
again
now
it
has
and
what
will
happen.
Flux
will
create
a
git
tag
when
it
synchronizes.
But
let's,
let's
see
if
something
is
happening
on
on
white
cluster,
I'll
do
get
namespaces.
I
have
a
demo
name
space
in
there
is
not
there
yet
can
do.
Watch.
B
B
B
B
B
What
happened
now
I
have
this
workload
directory
synchronized
and
you
can
do
a
couple
of
things
when
you
install
flocks,
you
can
say
synchronize
those
directories.
Why
we?
Why
we
have
this
future?
There
is
the
fact
that
you
can
have
a
git
repository
that
you
can
manage
multiple
clusters,
so
you
can
say
can
have
let's
say,
dev
directory
and
staging
directory
and
production
director
and
can
point
different
flux,
instances
to
different
different
directories.
B
B
B
B
Three
minutes:
okay,
another
thing
that
can
do
is
flux.
You
can
create
these
update
policies
and
you
can
say:
I
have
this
deployment
I
want
to
I,
want
flux
to
monitor
the
registry
and
based
on
these
policies.
I
want
to
flux,
update
the
actual
deployment
spec
and
you
can
use
reg
X,
you
can
use
globe
or
you
can
use
simpler
expressions
to
define
how
flux
should
update
your
your
workloads.
B
We
also
have
customized
support
how
how
this
works
is.
You
can
have
a
you,
can
have
a
customized
layer
thing
inside
your
git
repository
and
next
to
the
main
cast
customization
llamó
you'll.
Have
this
file
called
flux,
llamo
and
flux?
Shaman
is
a
way
to
tell
flux.
What
kind
of
generators
it
can
use
a
generator
is
can
be
anything
that
writes
to
standard
dot.
So
in
this
case
we
run
customized
build
for
the
whole
repository
customized.
B
Build
will
write
all
the
all
the
definitions
to
standard
out
and
from
there
flux
takes
that
and
applies
it
to
the
cluster.
So
you
can
mix
and
match
different
things
here,
for
example,
let's
say
you
want
to
customize
a
help
chart
and
that
hand
chart
doesn't
offer
that
kind
of
customization
right.
You
can
do
here.
The
first
generator
command
could
be
Helen
template
and
afterwards
you
can
have
a
patch
inside
your
did,
repository
and
run
a
customized
build
for
that.
B
Other
things
you
can
do
here
can
I'll
replace
environment
variables.
If
this
is
the
way
you
want
to
the
templating
right,
so
we
are
not
open-ended
about
how
you
are
doing
your
own
templating.
As
long
as
your
tools
will
write,
standard
outflux
can
call
into
them
and
use
them.
How
you
can
add
your
own
tools
to
to
the
flux
image
you
use
an
init
container
and
you
can
copy
your
binary
in
the
into
a
shared
volume.
So
flux
can
access
it.
B
Also
have
a
multi-tenancy
support
for
flux,
so
the
idea
is
that
if
you
run
a
single
flux
instance
per
cluster,
that
flux
instance
has
to
synchronize
everything,
so
it
has
to
create
role
bindings.
It
has
to
create
custom
resource
definition,
all
these
global
objects-
and
maybe
you
don't
want
to
to
have
a
single
git
repository
with
everything
inside
all
these
dangerous
objects
that
you
can
change
my
network
policies
and
everything
right.
B
So
the
idea
is
you:
can
you
can
have
system
flux
that
you
deploying
a
special
namespace
and
that
the
flux
instance,
the
people
in
charge
of
that
flux?
Users
are
the
cluster
administrators
and
that
flux
instance
can
provision
namespaces
and
in
those
namespaces
it
can
deploy
another
fluxes,
thus
13.
So
let's
say
you
have
five
things
in
your
company.
B
You
keep
gave
each
team
its
own
git
repository,
so
they
can
do
whatever
they
want
in
there,
but
they
will
not
be
able
to
affect
another
team
name
space,
because
that
flux
instance
can
only
synchronize
the
state
you
can
put
whatever
in
there,
but
it
only
works
for
that
namespace,
it's
enforced
with
our
bot.
So
this
is
a
way
you
can
do
multi-tenancy
for
your
teams
with
flux.
You
need
multiple
instances
right
and
here
is
an
example
of
what
each
team
can
do.
B
We
have
secret
support
in
flux
through
the
benami
shield
secret
operator.
What
the
benancio
secret
does
it?
Let
you
store
a
SIL
circuit
which
is
an
encrypted
file
in
your
git
repository.
It's
a
custom
resource
flux
will
synchronize
it
on
the
cluster
and
silicic.
A
controller
will
will
decrypt
it
and
you
create
a
kubernetes
secret.
So
in
this
way
it's
it's
one
way
to
store
sensitive
information
in
in
a
public
repository.
No
one
can
decrypt
it.
Everyone
that
has
the
public
key,
can
add
new,
silly
secrets
to
the
repo
another
option.
B
B
There
is
also
a
project
called
helm
operator,
which
is
a
sub
project
of
flux.
We
love
helm
and
we
want
to
to
be
able
to
do
helm
operations
through
get
like
with
you
do,
with
the
normal
kubernetes
deployments
and
yeah
services.
So
we
created
this
he'll
release,
custom
resource
that
maps
all
the
things
that
you
can
do
from
the
command
line,
and
it
also
has
things
like
values
the
helm
operator
can
do.
Many
things
are
just
spirit.
B
B
We
get
this
question
a
lot
like:
okay
flux
runs
it
cluster
also.
How
is
it
active
all
operators
act
like
people
if
they
apply
state
on
the
cluster
right.
We
think
that
having
this
having
good
gift
flows
and
protective
branches
and
keys,
it's
is
basically
the
level
one
our
buck
for
your
organization.
B
This
is
how
you
can
protect
your
your
clusters
from
unwanted
changes
and,
of
course,
if
the
multi-tenancy
model,
even
if
someone
tries
to
make
a
change
that
will
impact
the
whole
class
that
you
cannot
cannot
do
it
and
flux
works
very
well
with
flagger,
and
you
can
now
use
them
together.
They
are
not
related
in
any
ways:
they
they
don't
know
one
of
another,
but
they
you
can
build
progressive
delivery,
pipe
pipelines
with
both
of
them.
The
idea
is
that
flux
synchronizes
something
from
the
git
repository
and
flagger
detect.
So
there
is
a
change.
B
B
B
And
the
roadmap,
of
course
we
want
to
adopt
the
detox
engine.
We
want
to
extract
the
container
registry
and
image
scanning
as
a
sub-project,
so,
for
example,
our
NGO
can
benefit
from
from
this
thing
that
Tony
flux
does
we
want
to
have
a
Han
registry
scanning
in
there
and
the
biggest
problem
we
have
with
get
ops
tooling
right
now
are
the
web
cooks.
So
let's
say
if
you
want
to
deploy
East,
EO
or
linker
D,
or
things
like
that,
because
flux
applies
the
whole
state.
B
At
the
same
time,
you
you
deploy
the
admission
controller,
the
mutational
mission
controller,
along
with
all
your
other
applications.
So
there
is
a
race
condition
there,
and
some
pods
will
not
get
injected
with
the
sidecar,
for
example
right,
so
you
have
to
go
there
and
delete
those
pods.
The
first
time
you
post
wrap
the
cluster
to
get
the
cycle
everywhere.
So
a
way
to
solve
this
will
be
to
add
to
flux.
This
readiness
checks,
so
I
can
say,
apply
things
in
phases
apply.
First,
all
these
definitions
check
for
are
they
healthy?
B
Are
they
running
and
only
afterwards
apply
the
whole
state?
So
this
is
one
way
to
solve
the
mission
controllers,
bootstrap
yeah,
with
the
agro
flux
thing
we
we
want
to
have
one
to
support.
Multiple
git
repos,
healthy
3
has
OCA
based
registry
support
as
last
week,
so
we
already
scheduled.
We
already
know
how
to
scan
container
registries.
So
we
have
to
extend
this
this
this
future
to
and
support
helm
like
scan
the
registry
and
find
the
help
chart
and
update
it
and
yeah.