Flux vs ArgoCD — GitOps Comparison

Choose between Flux and ArgoCD for GitOps deployments. Compare sync mechanisms, rollback, multi-tenancy, UI capabilities, and secrets integration with practical examples.

Feature Matrix

Flux — Bootstrap and HelmRelease Example

# Bootstrap Flux onto your cluster (points to your Git repo)
flux bootstrap github \
  --owner=my-org \
  --repository=fleet-infra \
  --branch=main \
  --path=clusters/production \
  --personal

# HelmRelease resource — clusters/production/apps/nginx/helmrelease.yaml
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
  name: nginx-ingress
  namespace: ingress-nginx
spec:
  interval: 10m
  chart:
    spec:
      chart: ingress-nginx
      version: "4.x"
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
        namespace: flux-system
  values:
    controller:
      replicaCount: 3
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
  upgrade:
    remediation:
      retries: 3
  rollback:
    timeout: 5m

# HelmRepository source
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: ingress-nginx
  namespace: flux-system
spec:
  interval: 1h
  url: https://kubernetes.github.io/ingress-nginx

ArgoCD — Install and Application Example

# Install ArgoCD
kubectl create namespace argocd
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Access UI (port-forward)
kubectl port-forward svc/argocd-server -n argocd 8080:443

# ArgoCD Application manifest
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: nginx-ingress
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: infrastructure
  source:
    repoURL: https://kubernetes.github.io/ingress-nginx
    chart: ingress-nginx
    targetRevision: 4.9.0
    helm:
      values: |
        controller:
          replicaCount: 3
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: ingress-nginx
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        maxDuration: 3m
        factor: 2

Flux SOPS Secrets Integration

# Generate age key pair
age-keygen -o age.agekey

# Add private key to Flux as a secret
kubectl create secret generic sops-age \
  --namespace=flux-system \
  --from-file=age.agekey=./age.agekey

# Encrypt a secret with SOPS
sops --age=$(cat age.agekey | grep "public key" | sed 's/.*: //') \
  --encrypt --in-place mysecret.yaml

# .sops.yaml — auto-encrypt any file matching the pattern
creation_rules:
  - path_regex: .*/secrets/.*\.yaml
    age: age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Flux Kustomization with SOPS decryption
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: apps
  namespace: flux-system
spec:
  interval: 10m
  path: ./clusters/production/apps
  prune: true
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  decryption:
    provider: sops
    secretRef:
      name: sops-age

Decision Guide

• Choose ArgoCD when: teams need self-service deployments via UI, strong RBAC needed for multiple teams, one-click rollback is important, Argo Rollouts for canary/blue-green, or you want a polished UI experience.
• Choose Flux when: pure GitOps without UI dependencies preferred, SOPS secrets integration needed, Kubernetes-native resource model, smaller ops overhead (no UI to maintain), or multi-cluster fleet management with Flux's sharding model.
• Both are CNCF graduated — there's no wrong choice. Many large organizations use ArgoCD for developer-facing app deployments and Flux for platform bootstrapping.