flux-instance

Flux Instance

Chainguard's redistribution of the Flux Instance Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

This chart creates a FluxInstance custom resource. It does not run a workload itself: the Flux Operator reconciles the FluxInstance into a running Flux distribution. Install Chainguard's flux-operator chart first.

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace flux-system

Installation

helm install flux-instance oci://cgr.dev/ORGANIZATION/charts/flux-instance \
  --namespace flux-system \
  --create-namespace \
  --set healthcheck.image.pullSecrets[0].name=cgr-pull-secret

The pull secret is consumed by the optional post-install health check Job, which runs a Chainguard image when you set healthcheck.enabled=true.

The Flux controllers themselves are deployed by the Flux Operator from the instance.distribution settings in the FluxInstance spec, not from this chart's image values. See the FluxInstance documentation to configure the distribution registry and image pull secrets for the controllers.

About This Chart

This is a redistribution of the upstream Flux Instance. All upstream configuration options apply.

For full documentation, see: https://fluxcd.control-plane.io/operator/