flux
Installation
Entrypoint
Types
Flux

flux

Flux CD on Kubernetes, including KCL-based config rendering, SOPS secret
encryption, Git commit of rendered manifests, Helmfile-driven operator
install, and reconciliation waiting via the Flux CLI.

Installation

dagger install github.com/stuttgart-things/blueprints/flux@v2.6.1

Entrypoint

Return Type

Flux

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \

func (m *MyModule) Example() *dagger.Flux  {
	return dag.
			Flux()
}

@function
def example() -> dagger.Flux:
	return (
		dag.flux()
	)

@func()
example(): Flux {
	return dag
		.flux()
}

Types

Flux 🔗

applyConfig() 🔗

ApplyConfig applies rendered config (non-secret) manifests to the cluster.

Return Type

String !

Arguments

Name	Type	Default Value	Description
configContent	String !	-	Config YAML content
namespace	String	"flux-system"	Target namespace
kubeConfig	Secret !	-	Kubeconfig secret for cluster access

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 apply-config --config-content string --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, configContent string, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Applyconfig(ctx, configContent, kubeConfig)
}

@function
async def example(configcontent: str, kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.applyconfig(configcontent, kubeconfig)
	)

@func()
async example(configContent: string, kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.applyConfig(configContent, kubeConfig)
}

applySecrets() 🔗

ApplySecrets applies secret manifests to the cluster.

Return Type

String !

Arguments

Name	Type	Default Value	Description
secretContent	String !	-	Secret YAML content
namespace	String	"flux-system"	Target namespace
kubeConfig	Secret !	-	Kubeconfig secret for cluster access

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 apply-secrets --secret-content string --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, secretContent string, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Applysecrets(ctx, secretContent, kubeConfig)
}

@function
async def example(secretcontent: str, kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.applysecrets(secretcontent, kubeconfig)
	)

@func()
async example(secretContent: string, kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.applySecrets(secretContent, kubeConfig)
}

bootstrap() 🔗

Bootstrap orchestrates a full Flux bootstrap lifecycle.

Phase order:

0: ValidateAgeKeyPair (secrets module) — fail fast on key mismatch
1: RenderConfig — render all manifests
2: EncryptString (secrets module) — encrypt before committing
3: CommitConfig — push to Git
4: DeployOperator — install operator (Helmfile)
5: ApplyConfig — apply FluxInstance CR
6: ApplySecrets — apply AFTER operator is running
7: VerifySecrets — confirm secrets exist
8: WaitForReconciliation — wait for Flux to reconcile

Return Type

String !

Arguments

Name	Type	Default Value	Description
ociSource	String	"ghcr.io/stuttgart-things/kcl-flux-instance:0.3.3"	OCI KCL module source for rendering Flux instance config
configParameters	String	-	Additional comma-separated key=value pairs for KCL parameters
fluxVersion	String	"2.8.5"	Flux instance version
entrypoint	String	"main.k"	KCL entrypoint file name
renderSecrets	Boolean	false	Whether KCL should also render Secret manifests
gitUsername	Secret	-	Git username for pull secret
gitPassword	Secret	-	GitHub token for git pull secret
sopsAgeKey	Secret	-	AGE private key for SOPS decryption (applied to cluster)
agePublicKey	Secret	-	AGE public key for encrypting secrets before git commit
sopsConfig	File	-	SOPS config file (.sops.yaml)
kubeConfig	Secret !	-	Kubeconfig secret for cluster access
namespace	String	"flux-system"	Target namespace for Flux
repository	String	-	Repository in “owner/repo” format
branchName	String	"main"	Branch name for git operations
destinationPath	String	"clusters/"	Destination path within the repository
gitRef	String	"refs/heads/main"	Git reference for Flux source (e.g., refs/heads/main)
gitToken	Secret	-	GitHub token for git operations
helmfileRef	String	"helmfile.yaml"	Helmfile reference
src	Directory	-	Directory containing the helmfile
applySecrets	Boolean	true	Apply rendered secrets to cluster
encryptSecrets	Boolean	false	Encrypt secrets with SOPS before git commit
commitToGit	Boolean	false	Commit rendered config to git
deployOperator	Boolean	true	Deploy Flux operator via Helmfile
waitForReconciliation	Boolean	true	Wait for Flux reconciliation
reconciliationTimeout	String	"5m"	Timeout for reconciliation check
applyConfig	Boolean	false	Apply rendered config to cluster
fluxCliImage	String	"ghcr.io/fluxcd/flux-cli:v2.8.5"	Flux CLI container image
operatorVersion	String	"0.47.0"	Flux operator version for Helmfile state values

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 bootstrap --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Bootstrap(ctxkubeConfig)
}

@function
async def example(kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.bootstrap(kubeconfig)
	)

@func()
async example(kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.bootstrap(kubeConfig)
}

commitConfig() 🔗

CommitConfig commits rendered config and optional secrets to a Git repository.

Return Type

String !

Arguments

Name	Type	Default Value	Description
configContent	String !	-	Config YAML content to commit
repository	String !	-	Repository in “owner/repo” format
branchName	String	"main"	Branch name for git operations
destinationPath	String	"clusters/"	Destination path within the repository
gitToken	Secret !	-	GitHub token for git operations
secretsContent	String	-	Optional secrets YAML content to include in the commit

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 commit-config --config-content string --repository string --git-token env:MYSECRET

func (m *MyModule) Example(ctx context.Context, configContent string, repository string, gitToken *dagger.Secret) string  {
	return dag.
			Flux().
			Commitconfig(ctx, configContent, repository, gitToken)
}

@function
async def example(configcontent: str, repository: str, gittoken: dagger.Secret) -> str:
	return await (
		dag.flux()
		.commitconfig(configcontent, repository, gittoken)
	)

@func()
async example(configContent: string, repository: string, gitToken: Secret): Promise<string> {
	return dag
		.flux()
		.commitConfig(configContent, repository, gitToken)
}

deployOperator() 🔗

DeployOperator deploys the Flux operator via Helmfile.

Return Type

Void !

Arguments

Name	Type	Default Value	Description
kubeConfig	Secret !	-	Kubeconfig secret for cluster access
helmfileRef	String	"helmfile.yaml"	Helmfile reference
src	Directory	-	Directory containing the helmfile
stateValues	String	-	Comma-separated key=value pairs for –state-values-set (e.g., “version=0.42.1”)

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 deploy-operator --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, kubeConfig *dagger.Secret)   {
	return dag.
			Flux().
			Deployoperator(ctx, kubeConfig)
}

@function
async def example(kubeconfig: dagger.Secret) -> None:
	return await (
		dag.flux()
		.deployoperator(kubeconfig)
	)

@func()
async example(kubeConfig: Secret): Promise<void> {
	return dag
		.flux()
		.deployOperator(kubeConfig)
}

destroy() 🔗

Destroy tears down Flux from a cluster.

Phase order:

0: Delete FluxInstance CR
1: Delete Flux secrets
2: Uninstall Flux operator (Helmfile destroy)
3: Delete flux-system namespace

Usage:

dagger call -m flux destroy --kube-config file:///tmp/kubeconfig

Return Type

String !

Arguments

Name	Type	Default Value	Description
kubeConfig	Secret !	-	Kubeconfig secret for cluster access
namespace	String	"flux-system"	Target namespace
helmfileRef	String	"helmfile.yaml"	Helmfile reference for Flux operator
src	Directory	-	Directory containing the helmfile
operatorVersion	String	"0.42.1"	Flux operator version for Helmfile state values

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 destroy --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Destroy(ctx, kubeConfig)
}

@function
async def example(kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.destroy(kubeconfig)
	)

@func()
async example(kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.destroy(kubeConfig)
}

renderConfig() 🔗

RenderConfig renders the Flux instance configuration using a KCL module. Returns the full rendered YAML (multi-document).

Return Type

String !

Arguments

Name	Type	Default Value	Description
ociSource	String	"ghcr.io/stuttgart-things/kcl-flux-instance:0.3.3"	OCI KCL module source
configParameters	String !	-	Comma-separated key=value pairs for KCL parameters
entrypoint	String	"main.k"	KCL entrypoint file name
renderSecrets	Boolean	false	Whether KCL should also render Secret manifests
gitUsername	Secret	-	Git username for pull secret
gitPassword	Secret	-	GitHub token for git pull secret
sopsAgeKey	Secret	-	AGE private key for SOPS decryption (applied to cluster)

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 render-config --config-parameters string

func (m *MyModule) Example(ctx context.Context, configParameters string) string  {
	return dag.
			Flux().
			Renderconfig(ctxconfigParameters)
}

@function
async def example(configparameters: str) -> str:
	return await (
		dag.flux()
		.renderconfig(configparameters)
	)

@func()
async example(configParameters: string): Promise<string> {
	return dag
		.flux()
		.renderConfig(configParameters)
}

verifySecrets() 🔗

VerifySecrets auto-extracts secret names from the YAML and verifies they exist in the cluster.

Return Type

String !

Arguments

Name	Type	Default Value	Description
secretContent	String !	-	Secret YAML content (multi-document)
namespace	String	"flux-system"	Target namespace
kubeConfig	Secret !	-	Kubeconfig secret for cluster access

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 verify-secrets --secret-content string --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, secretContent string, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Verifysecrets(ctx, secretContent, kubeConfig)
}

@function
async def example(secretcontent: str, kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.verifysecrets(secretcontent, kubeconfig)
	)

@func()
async example(secretContent: string, kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.verifySecrets(secretContent, kubeConfig)
}

waitForReconciliation() 🔗

WaitForReconciliation runs flux check with retry, reconciles sources, and gets all Flux resources.

Return Type

String !

Arguments

Name	Type	Default Value	Description
namespace	String	"flux-system"	Target namespace
kubeConfig	Secret !	-	Kubeconfig secret for cluster access
reconciliationTimeout	String	"5m"	Timeout for reconciliation check
fluxCliImage	String	"ghcr.io/fluxcd/flux-cli:v2.8.3"	Flux CLI container image

Example

dagger -m github.com/stuttgart-things/blueprints/flux@c7ef393421d63351238cacf682915a1b5ebc2875 call \
 wait-for-reconciliation --kube-config env:MYSECRET

func (m *MyModule) Example(ctx context.Context, kubeConfig *dagger.Secret) string  {
	return dag.
			Flux().
			Waitforreconciliation(ctxkubeConfig)
}

@function
async def example(kubeconfig: dagger.Secret) -> str:
	return await (
		dag.flux()
		.waitforreconciliation(kubeconfig)
	)

@func()
async example(kubeConfig: Secret): Promise<string> {
	return dag
		.flux()
		.waitForReconciliation(kubeConfig)
}