Two repos, one reconciliation loop
The bootstrapper clones a battle-tested template into your namespace. Flux watches your repo and keeps the cluster in sync.
Developer / AI
git push
Git Repository
Source of truth
Flux Controllers
Reconciles state
SOPS Secrets
Encrypted at rest, decrypted in-memory
Kubernetes Cluster
Drift auto-corrected on every cycle
Flux Operator
Manages controller lifecycle
Flux Instance
- source-controller
- kustomize-controller
- helm-controller
Two-repo strategy
Template Repository
GitOpsAI/gitops-ai-templateA battle-tested GitOps structure with Helm values, Kustomization overlays, and SOPS config. You never modify this repo directly — it receives upstream improvements and security patches.
View on GitHubYour GitOps Repository
created in your namespace during bootstrapA fork cloned into your GitHub or GitLab namespace. This is your single source of truth. All cluster changes flow through Git — versioned, reviewable, and reversible.
GitOps reconciliation loop
Push a change
Edit a HelmRelease, update values, or add a component. Commit and push to your GitOps repo.
Flux detects the commit
source-controller polls your repo and pulls the new revision automatically.
Manifests are applied
kustomize-controller renders and applies resources. SOPS secrets are decrypted in-memory using the age key stored in the cluster.
Helm charts upgrade
helm-controller processes HelmRelease changes, upgrading or installing charts with your values.
Drift is auto-corrected
If someone manually modifies a resource, Flux reverts it to match Git on the next cycle. No manual kubectl apply ever needed.
Security model
Secrets at Rest
All sensitive values (API tokens, keys) are encrypted with SOPS/Age before being committed. The private key exists only in the cluster and on the bootstrap machine.
Container Hardening
Non-root users, read-only root filesystems, and dropped capabilities following NSA Kubernetes hardening guidelines.
Network Isolation
NetworkPolicy resources limit pod-to-pod communication. Ingress is restricted to CIDR ranges you specify during the wizard.
Git Auth
Flux authenticates over HTTPS using a GitLab or GitHub PAT scoped to minimum permissions. No SSH keys or cluster-to-internet exposure.
Monitoring out of the box
Prometheus CRDs
ServiceMonitor and PodMonitor custom resources are installed by default. Every component ships ready-made scrape targets -- add Prometheus and metrics are collected instantly.
Grafana Dashboards
Enable Grafana as an optional component to get pre-built dashboards for cluster health, ingress traffic, and Flux reconciliation status.
Flux Alerts
Flux Web UI shows reconciliation status for every component. Failed deployments and drift corrections surface immediately -- no digging through logs.
Zero Configuration
No YAML to write. The bootstrap wires everything together -- service discovery, scrape intervals, and dashboard provisioning are handled automatically.