How to do GitOps for AKS with Flux CD in Infrastructure as Code & DevOps

João Barros 31 de October de 2026 4 min read

Explains how to set up a GitOps workflow for an AKS cluster using Flux CD: useful to automate deployments, have history in Git and enable safe rollback in Infrastructure as Code & DevOps.

Prerequisites

Azure account with permissions to create resources.
kubectl, az, flux CLI installed locally.
AKS cluster created and kubectl context configured.
Git repository (GitHub, Azure Repos) to store YAML manifests.

Step 1: Prepare the Git repository for GitOps

The repository should contain a clear structure with Kubernetes manifests (deployments, services, kustomize or Helm charts). Here we use a "clusters/production" folder with Kustomize to manage overlays.

# Estrutura mínima
clusters/
  production/
    kustomization.yaml
    app-deployment.yaml
    app-service.yaml

Simple example of kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- app-deployment.yaml
- app-service.yaml

Step 2: Install Flux CD on the AKS cluster

Flux CD acts as an operator that synchronizes the cluster state with the Git repository. Install it with the flux CLI and create a GitRepository and a Kustomization that point to the repository.

# Autenticar no AKS
az aks get-credentials --resource-group rg-aks --name myAKS

# Instalar CRDs e controllers do Flux
flux install

Step 3: Connect the Git repository to Flux

Create a Git source in the cluster that points to the repository and branch. Flux will read that source and apply the described resources.

# Criar GitRepository (exemplo para GitHub)
flux create source git my-app-repo \
  --url=https://github.com/MEU_USER/meu-repo.git \
  --branch=main \
  --interval=1m

# Criar Kustomization apontando para a pasta no repositório
flux create kustomization my-app \
  --source=my-app-repo \
  --path="./clusters/production" \
  --prune=true \
  --interval=5m

Step 4: Manage secrets and credentials securely

Do not put secrets in plain text in Git. Use Flux with SOPS or integration with Azure Key Vault to protect secrets.

# Exemplo rápido com SOPS (local):
# 1. Gerar chave GPG, 2. encriptar ficheiro secret.yaml
sops --encrypt secret.yaml > secret.enc.yaml
# Commit de secret.enc.yaml no repositório

Step 5: Automate CI to update manifests

Set up a workflow (GitHub Actions, Azure Pipelines) that validates YAML and updates the Deployment image (image tag) in the repository — Flux detects the change and performs the automatic deploy.

# Exemplo mínimo de passo em GitHub Actions (yaml simplificado)
- name: Update image tag
  run: |
    yq e '.spec.template.spec.containers[0].image="myregistry/myapp:$GITHUB_SHA"' -i clusters/production/app-deployment.yaml
    git add clusters/production/app-deployment.yaml && git commit -m "ci: update image" && git push

Step 6: Monitor and perform rollback

Flux keeps a history of synchronizations. To monitor use the controllers and kubectl. A simple rollback is to revert in Git (revert commit) and Flux applies the previous version.

# Verificar Kustomization status
flux get kustomizations

# Reverter a alteração no Git (exemplo)
git revert 
git push
# O Flux deteta e aplica o rollback automaticamente

Verify the result

Confirm that Flux synchronized and that the resources are in the cluster:

# Verificar fontes e sincronização
flux get sources git
flux get kustomizations

# Verificar recursos Kubernetes
kubectl get deployments,svc -n default
kubectl describe deployment meu-app

Also check the Git repository that the CI commits appear and that there are no secrets in plain text.

Conclusion

With GitOps and Flux CD for AKS you get declarative, auditable deployments and simple rollbacks, integrating Infrastructure as Code & DevOps. Next steps: integrate Azure Key Vault for secrets, automate integration tests before push and use policies for security. Tip: start with staging environments to validate the flow before production — which part do you want to automate next?