Flux

[Givemeurcookies]

Are there any plans on using Flux for reconciling changes? Similar to how Kubeapps supports Flux: https://kubeapps.dev/docs/latest/tutorials/managing-flux-packages/

Without going into too many details, using flux would make Kubero work declaratively which has some major benefits such as functioning a single source of truth and better transparency of changes that Kubero makes to the cluster when making a deploy (and also allows rollbacks in case of an edge-case which might break something). It overall also helps with migrating clusters, could allow support for multi-clusters and even allows deleting whole clusters which might be required in disaster recovery.

[mms-gianni]

Hey there. Flux2 looks very interesting. Didn't dive deep into it yet.

Kubero won't cover the features Kubeapps has. But deploying helm charts might become a thing at some point. And using Flux seems to be a good solution for this task.

[Givemeurcookies]

Flux works with both normal manifests, Kustomize and Helm (if you use a flux helm controller, which is installed by default, there's also controllers for other templating systems). So Flux is focused on more than just deploying helm charts. Flux also works in clusters which have been set up imperatively originally and will only manage the resources/manifests you declaratively define.

I'd probably take a look at how the auto image update component works in Flux https://fluxcd.io/flux/guides/image-update/ as it pushes changes back to a git repository when a new image tag is released in a container registry, which might give you some clues on how to do git auth and so forth.

Only thing you need to be take into account when it comes to moving from imperative to declarative is secret management. It's possible to add secrets using kubectl (imperative) and then use flux to reference the secrets in the manifest. Other solutions are using sealed secrets, Mozilla SOPS; but there's also the external secrets operator which lets you centralise secrets and enforce better security. I have a personal preference to 1password for this, but there's a lot of different providers that can be used.

[mms-gianni]

I've added it to the roadmap to keep track of it.

Roadmap (view)