GitOps with Flux and Argo CD
Roll the agent out to a fleet from one set of manifests, with the cluster name substituted per cluster.
Tokens stay out of Git
Each cluster has its own token from Settings > Integrations > Add cluster. Store it in your secret manager and sync it to a Secret named
kubeon-agent-token in the kubeon namespace, for example with External Secrets or SOPS. The manifests below only name that Secret.Flux
Commit an OCI HelmRepository and a HelmRelease once, and a Kustomization per cluster whose postBuild.substitute sets CLUSTER_NAME. Upgrades are a change to chart.spec.version; Flux reconciles within 10 minutes.
Flux manifests
# clusters/prod-use1-a/kubeon-agent.yamlapiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata: name: kubeon-agent namespace: flux-systemspec: interval: 10m prune: true wait: true path: ./platform/kubeon-agent sourceRef: kind: GitRepository name: platform-gitops postBuild: substitute: CLUSTER_NAME: prod-use1-a---# platform/kubeon-agent/helm-repository.yamlapiVersion: source.toolkit.fluxcd.io/v1kind: HelmRepositorymetadata: name: kubeon namespace: flux-systemspec: type: oci interval: 20m url: oci://registry.kubeon.io/kubeon/charts---# platform/kubeon-agent/helm-release.yamlapiVersion: helm.toolkit.fluxcd.io/v2kind: HelmReleasemetadata: name: kubeon-agent namespace: flux-systemspec: interval: 10m targetNamespace: kubeon install: createNamespace: true chart: spec: chart: kubeon-agent version: "0.6.0" interval: 30m sourceRef: kind: HelmRepository name: kubeon values: clusterName: ${CLUSTER_NAME} kubeon: existingSecret: kubeon-agent-token # synced per cluster by your secret managerKeep each chart version in its own directory, for example
platform/kubeon-agent/0.6.0/, and move clusters between directories to roll out in waves.Argo CD
Use an Application per cluster, or an ApplicationSet with a cluster generator that templates clusterName from the cluster's name.
Application
# Register registry.kubeon.io/kubeon/charts in Argo CD as a Helm repository with enableOCI: "true".apiVersion: argoproj.io/v1alpha1kind: Applicationmetadata: name: kubeon-agent namespace: argocdspec: project: platform source: repoURL: registry.kubeon.io/kubeon/charts chart: kubeon-agent targetRevision: 0.6.0 helm: valuesObject: clusterName: prod-use1-a kubeon: existingSecret: kubeon-agent-token destination: server: https://kubernetes.default.svc namespace: kubeon syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=trueTerraform
If clusters are created with Terraform, install the agent in the same apply with the Helm provider:
kubeon-agent.tf
resource "helm_release" "kubeon_agent" { name = "kubeon-agent" repository = "oci://registry.kubeon.io/kubeon/charts" chart = "kubeon-agent" version = "0.6.0" namespace = "kubeon" create_namespace = true values = [yamlencode({ clusterName = "prod-use1-a" kubeon = { existingSecret = "kubeon-agent-token" } })]}Need help with this guide?Contact support