Warning

This page was translated from the original Japanese version by PLaMo Translate. The Japanese version is authoritative; the English translation may contain inaccuracies.

Configuring GitOps-Style Continuous Delivery

GitOps is a methodology that enables declarative management of resource configurations using Git, with changes automatically applied to the cluster. By adopting GitOps, you can clearly track configuration changes and their history while reducing manual intervention through automated deployment processes.

For PFCP, we provide Flux as a managed service to implement GitOps on Kubernetes. Flux is an open-source automation tool designed for GitOps on Kubernetes, responsible for monitoring repository changes and automatically applying them to the cluster. Below, we’ll explain how to enable GitOps using Flux.

Installing and Configuring Flux

When referring to “repository” in this documentation, it specifically refers to a GitHub repository.

1. Access the Namespaces page in the portal and create a namespace for using Flux’s Kubernetes resources. For this example, we’ll create a namespace named org-foo--flux.
2. Create a ServiceAccount named flux in the org-foo--flux namespace. Flux will use this ServiceAccount to apply manifests. Note that the ServiceAccount must be named exactly flux; using any other name will result in incorrect operation.

   kubectl create serviceaccount flux --namespace=org-foo--flux
   

3. Grant permissions from the namespaces where you want to apply manifests through the Flux ServiceAccount in the org-foo--flux namespace.

   kubectl create rolebinding flux \
      # The namespace where you want to apply manifests
      --namespace=org-foo--target \
      # The permissions Flux will use for manifest application
      --clusterrole=org-edit \
      # The ServiceAccount Flux will use for manifest application
      --serviceaccount=org-foo--flux:flux
   

   If you have multiple namespaces where you want to apply manifests, you must grant permissions from each respective namespace in a similar manner.

   Warning

   If you want to manage resources requiring org-admin privileges

   Please modify the --clusterrole=org-edit part according to the type of resources you want to manage. For example, if you want to manage RoleBindings with Flux, you’ll need to provide org-admin privileges to the flux ServiceAccount. In such cases, strictly limit access to the org-foo--flux namespace to only organization administrators to prevent unauthorized cluster operations by regular users using the org-admin-privileged flux ServiceAccount.

4. Create the GitRepository and Kustomization resources by writing the following manifest.yaml file. In this example, the manifests located in the main branch of https://github.com/pfcomputing/hello will be applied to the cluster.

   apiVersion: source.toolkit.fluxcd.io/v1
   kind: GitRepository
   metadata:
     name: hello
     namespace: org-foo--flux
   spec:
     interval: 5m
     url: https://github.com/pfcomputing/hello
     ref:
       branch: main
   ---
   apiVersion: kustomize.toolkit.fluxcd.io/v1
   kind: Kustomization
   metadata:
     name: hello
     namespace: org-foo--flux
   spec:
     interval: 10m
     sourceRef:
       kind: GitRepository
       name: hello
     path: "./kustomize"
     prune: true
     timeout: 1m
   

5. Apply the manifests.

   kubectl apply -f manifest.yaml
   

These steps will synchronize the manifest files in your configured repository with the current state of the cluster.

Using Private Git Repositories with Flux

In addition to public repositories, you can also perform GitOps by referencing private repositories. Below are the steps to do so.

1. Create a Secret for accessing the Git repository.

   export KEY_NAME=flux-ssh-key
   ssh-keygen -t ed25519 -f $KEY_NAME
   kubectl create secret generic flux-git-secret \
   --from-literal=known_hosts="$(ssh-keyscan github.com)" \
   --from-file=identity=$KEY_NAME
   

2. Register the output of cat $KEY_NAME.pub as a deployment key with read permissions for the relevant repository on GitHub (GitHub documentation).

3. Modify the GitRepository section in manifest.yaml as follows:

   • Modify the URL to point to your private repository
   • Add a spec.secretRef field with name: flux-git-secret

   apiVersion: source.toolkit.fluxcd.io/v1
   kind: GitRepository
   ...
   spec:
     ...
     url: # Update to your desired private repository URL
     secretRef: # Add this field
       name: flux-git-secret
   

4. Apply the manifests.

   kubectl apply -f manifest.yaml
   

These changes will synchronize the manifests present in your private repository with the current state of the cluster.

Flux also supports using repositories other than GitHub and features notification capabilities. For more detailed information, please refer to the following resources:

• Flux Documentation