You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -20,7 +20,7 @@ With GitOps, you declare the desired state of your Kubernetes clusters in files
20
20
21
21
Because these files are stored in a Git repository, they're versioned, and changes between versions are easily tracked. Kubernetes controllers run in the clusters and continually reconcile the cluster state with the desired state declared in the Git repository. These operators pull the files from the Git repositories and apply the desired state to the clusters. The operators also continuously assure that the cluster remains in the desired state.
22
22
23
-
GitOps on Azure Arc-enabled Kubernetes or Azure Kubernetes Service uses [Flux](https://fluxcd.io/docs/), a popular open-source tool set. Flux provides support for common file sources (Git and Helm repositories, Buckets, Azure Blob Storage) and template types (YAML, Helm, and Kustomize). Flux also supports multi-tenancy and deployment dependency management, among [other features](https://fluxcd.io/docs/).
23
+
GitOps on Azure Arc-enabled Kubernetes or Azure Kubernetes Service uses [Flux](https://fluxcd.io/docs/), a popular open-source tool set. Flux provides support for common file sources (Git and Helm repositories, Buckets) and template types (YAML, Helm, and Kustomize). Flux also supports multi-tenancy and deployment dependency management, among [other features](https://fluxcd.io/docs/).
24
24
25
25
## Flux cluster extension
26
26
@@ -38,7 +38,7 @@ The most recent version of the Flux v2 extension and the two previous versions (
38
38
39
39
The `microsoft.flux` extension installs by default the [Flux controllers](https://fluxcd.io/docs/components/) (Source, Kustomize, Helm, Notification) and the FluxConfig CRD, fluxconfig-agent, and fluxconfig-controller. You can control which of these controllers is installed and can optionally install the Flux image-automation and image-reflector controllers, which provide functionality around updating and retrieving Docker images.
40
40
41
-
*[Flux Source controller](https://toolkit.fluxcd.io/components/source/controller/): Watches the source.toolkit.fluxcd.io custom resources. Handles the synchronization between the Git repositories, Helm repositories, Buckets and Azure Blob storage. Handles authorization with the source for private Git, Helm repos and Azure blob storage accounts. Surfaces the latest changes to the source through a tar archive file.
41
+
*[Flux Source controller](https://toolkit.fluxcd.io/components/source/controller/): Watches the source.toolkit.fluxcd.io custom resources. Handles the synchronization between the Git repositories, Helm repositories, and Buckets. Handles authorization with the source for private Gitand Helm repos. Surfaces the latest changes to the source through a tar archive file.
42
42
*[Flux Kustomize controller](https://toolkit.fluxcd.io/components/kustomize/controller/): Watches the `kustomization.toolkit.fluxcd.io` custom resources. Applies Kustomize or raw YAML files from the source onto the cluster.
43
43
*[Flux Helm controller](https://toolkit.fluxcd.io/components/helm/controller/): Watches the `helm.toolkit.fluxcd.io` custom resources. Retrieves the associated chart from the Helm Repository source surfaced by the Source controller. Creates the `HelmChart` custom resource and applies the `HelmRelease` with given version, name, and customer-defined values to the cluster.
44
44
*[Flux Notification controller](https://toolkit.fluxcd.io/components/notification/controller/): Watches the `notification.toolkit.fluxcd.io` custom resources. Receives notifications from all Flux controllers. Pushes notifications to user-defined webhook endpoints.
@@ -69,7 +69,7 @@ The `microsoft.flux` extension installs by default the [Flux controllers](https:
69
69
70
70
:::image type="content" source="media/gitops/flux2-config-install.png" alt-text="Diagram showing the installation of a Flux configuration in an Azure Arc-enabled Kubernetes or Azure Kubernetes Service cluster." lightbox="media/gitops/flux2-config-install.png":::
71
71
72
-
You create Flux configuration resources (`Microsoft.KubernetesConfiguration/fluxConfigurations`) to enable GitOps management of the cluster from your Git repos, Bucket sources or Azure Blob Storage. When you create a `fluxConfigurations` resource, the values you supply for the parameters, such as the target Git repo, are used to create and configure the Kubernetes objects that enable the GitOps process in that cluster. To ensure data security, the `fluxConfigurations` resource data is stored encrypted at rest in an Azure Cosmos DB database by the Cluster Configuration service.
72
+
You create Flux configuration resources (`Microsoft.KubernetesConfiguration/fluxConfigurations`) to enable GitOps management of the cluster from your Git reposor Bucket sources. When you create a `fluxConfigurations` resource, the values you supply for the parameters, such as the target Git repo, are used to create and configure the Kubernetes objects that enable the GitOps process in that cluster. To ensure data security, the `fluxConfigurations` resource data is stored encrypted at rest in an Azure Cosmos DB database by the Cluster Configuration service.
73
73
74
74
The `fluxconfig-agent` and `fluxconfig-controller` agents, installed with the `microsoft.flux` extension, manage the GitOps configuration process.
75
75
@@ -87,7 +87,7 @@ The `fluxconfig-agent` and `fluxconfig-controller` agents, installed with the `m
87
87
* Sets up RBAC (service account provisioned, role binding created/assigned, role created/assigned).
88
88
* Creates `GitRepository` or `Bucket` custom resource and `Kustomization` custom resources from the information in the `FluxConfig` custom resource.
89
89
90
-
Each `fluxConfigurations` resource in Azure will be associated in a Kubernetes cluster with one Flux `GitRepository` or `Bucket` custom resource and one or more `Kustomization` custom resources. When you create a `fluxConfigurations` resource, you'll specify, among other information, the URL to the source (Git repository, Bucket or Azure Blob storage) and the sync target in the source for each `Kustomization`. You can configure dependencies between `Kustomization` custom resources to control deployment sequencing. Also, you can create multiple namespace-scoped `fluxConfigurations` resources on the same cluster for different applications and app teams.
90
+
Each `fluxConfigurations` resource in Azure will be associated in a Kubernetes cluster with one Flux `GitRepository` or `Bucket` custom resource and one or more `Kustomization` custom resources. When you create a `fluxConfigurations` resource, you'll specify, among other information, the URL to the source (Git repositoryor Bucket) and the sync target in the source for each `Kustomization`. You can configure dependencies between `Kustomization` custom resources to control deployment sequencing. Also, you can create multiple namespace-scoped `fluxConfigurations` resources on the same cluster for different applications and app teams.
91
91
92
92
> [!NOTE]
93
93
> The `fluxconfig-agent` monitors for new or updated `fluxConfiguration` resources in Azure. The agent requires connectivity to Azure for the desired state of the `fluxConfiguration` to be applied to the cluster. If the agent is unable to connect to Azure, there will be a delay in making the changes in the cluster until the agent can connect. If the cluster is disconnected from Azure for more than 48 hours, then the request to the cluster will time-out, and the changes will need to be re-applied in Azure.
### Flux v2 - Installing the `microsoft.flux` extension in a cluster with Kubelet Identity enabled
426
-
427
-
When working with Azure Kubernetes clusters, one of the authentication options to use is kubelet identity. In order to let Flux use this, add a parameter --config useKubeletIdentity=true at the time of Flux extension installation.
### Flux v2 - `microsoft.flux` extension installation CPU and memory limits
434
426
435
427
The controllers installed in your Kubernetes cluster with the Microsoft.Flux extension require the following CPU and memory resource limits to properly schedule on Kubernetes cluster nodes.
@@ -634,14 +634,6 @@ Here's an example for including the [Flux image-reflector and image-automation c
634
634
az k8s-extension create -g <cluster_resource_group> -c <cluster_name> -t <connectedClusters or managedClusters> --name flux --extension-type microsoft.flux --config image-automation-controller.enabled=true image-reflector-controller.enabled=true
635
635
```
636
636
637
-
### Using Kubelet identity as authentication method for Azure Kubernetes Clusters
638
-
639
-
When working with Azure Kubernetes clusters, one of the authentication options to use is kubelet identity. In order to let Flux use this, add a parameter --config useKubeletIdentity=true at the time of Flux extension installation.
Flux controllers require a **nonroot**[Security Context Constraint](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.2/html/authentication/managing-pod-security-policies) to properly provision pods on the cluster. These constraints must be added to the cluster prior to onboarding of the `microsoft.flux` extension.
@@ -705,9 +697,8 @@ Arguments
705
697
--bucket-insecure : Communicate with a bucket without TLS. Allowed values: false,
706
698
true.
707
699
--bucket-name : Name of the S3 bucket to sync.
708
-
--container-name : Name of the Azure Blob Storage container to sync
709
700
--interval --sync-interval : Time between reconciliations of the source on the cluster.
--kind : Source kind to reconcile. Allowed values: bucket, git.
711
702
Default: git.
712
703
--kustomization -k : Define kustomizations to sync sources with parameters ['name',
713
704
'path', 'depends_on', 'timeout', 'sync_interval',
@@ -761,17 +752,6 @@ Global Arguments
761
752
--subscription : Name or ID of subscription. You can configure the default
762
753
subscription using `az account set -s NAME_OR_ID`.
763
754
--verbose : Increase logging verbosity. Use --debug for full debug logs.
764
-
765
-
Azure Blob Storage Account Auth Arguments
766
-
--sp_client_id : The client ID for authenticating a service principal with Azure Blob, required for this authentication method
767
-
--sp_tenant_id : The tenant ID for authenticating a service principal with Azure Blob, required for this authentication method
768
-
--sp_client_secret : The client secret for authenticating a service principal with Azure Blob
769
-
--sp_client_cert : The Base64 encoded client certificate for authenticating a service principal with Azure Blob
770
-
--sp_client_cert_password : The password for the client certificate used to authenticate a service principal with Azure Blob
771
-
--sp_client_cert_send_chain : Specifies whether to include x5c header in client claims when acquiring a token to enable subject name / issuer based authentication for the client certificate
772
-
--account_key : The Azure Blob Shared Key for authentication
773
-
--sas_token : The Azure Blob SAS Token for authentication
774
-
--mi_client_id : The client ID of the managed identity for authentication with Azure Blob
|`--timeout`|[golang duration format](https://pkg.go.dev/time#Duration.String)| Maximum time to attempt to reconcile the source before timing out. Default: `10m`. |
819
791
|`--sync-interval``--interval`|[golang duration format](https://pkg.go.dev/time#Duration.String)| Time between reconciliations of the source on the cluster. Default: `10m`. |
820
792
@@ -895,27 +867,9 @@ If you use a `bucket` source instead of a `git` source, here are the bucket-spec
895
867
|`--bucket-secret-key`| String | Secret Key used to authenticate with the `bucket`. |
896
868
|`--bucket-insecure`| Boolean | Communicate with a `bucket` without TLS. If not provided, assumed false; if provided, assumed true. |
897
869
898
-
### Azure Blob Storage Account source arguments
899
-
900
-
If you use a `azblob` source, here are the blob-specific command arguments.
901
-
902
-
| Parameter | Format | Notes |
903
-
| ------------- | ------------- | ------------- |
904
-
|`--url``-u`| URL String | The URL for the `azblob`. |
905
-
|`--container-name`| String | Name of the Azure Blob Storage container to sync |
906
-
|`--sp_client_id`| String | The client ID for authenticating a service principal with Azure Blob, required for this authentication method |
907
-
|`--sp_tenant_id`| String | The tenant ID for authenticating a service principal with Azure Blob, required for this authentication method |
908
-
|`--sp_client_secret`| String | The client secret for authenticating a service principal with Azure Blob |
909
-
|`--sp_client_cert`| String | The Base64 encoded client certificate for authenticating a service principal with Azure Blob |
910
-
|`--sp_client_cert_password`| String | The password for the client certificate used to authenticate a service principal with Azure Blob |
911
-
|`--sp_client_cert_send_chain`| String | Specifies whether to include x5c header in client claims when acquiring a token to enable subject name / issuer based authentication for the client certificate |
912
-
|`--account_key`| String | The Azure Blob Shared Key for authentication |
913
-
|`--sas_token`| String | The Azure Blob SAS Token for authentication |
914
-
|`--mi_client_id`| String | The client ID of the managed identity for authentication with Azure Blob |
915
-
916
870
### Local secret for authentication with source
917
871
918
-
You can use a local Kubernetes secret for authentication with a `git`, `bucket`or `azBlob` source. The local secret must contain all of the authentication parameters needed for the source and must be created in the same namespace as the Flux configuration.
872
+
You can use a local Kubernetes secret for authentication with a `git`or `bucket` source. The local secret must contain all of the authentication parameters needed for the source and must be created in the same namespace as the Flux configuration.
0 commit comments