Catalog

The catalog is what Flux installs on a socle cluster, one module at a time, from your kube block. Some are on by default; the others wait for you.

• on by defaultargocdgitopsArgoCD, the GitOps layer you ship your applications with, served on the private Gateway when you set a domain.Every cloud
• off by defaultargocd-image-updatergitopsNew image tags in your registry reach your ArgoCD applications, without a commit per release.Every cloud · needs argocd; needs crossplane on aws, gcp
• DNSoff by defaultexternal-dnsnetworkingPublishes DNS records for your Services, Ingresses and HTTPRoutes into your cloud's zone.Every cloud
• on by defaultgateway-apinetworkingGateway API CRDs, the cilium GatewayClass and the shared public and private Gateways — on GKE's own classes on gcp.aws, azure, gcp, scaleway
• off by defaultkyvernosecurityThe Kyverno admission engine, with no policy, failing open and never judging the socle's namespaces.Every cloud
• off by defaultkyverno-policiessecurityThe socle's baseline Pod Security and image policies, in Audit, any of them enforceable natively.Every cloud · needs kyverno
• ESoff by defaultexternal-secretssecretsKubernetes Secrets read from your cloud's secret manager, kept in step when they rotate.Every cloud
• Roff by defaultreloadersecretsRolls a workload when a ConfigMap or Secret it reads changes, opt-in per workload.Every cloud
• off by defaultkedaautoscalingEvent-driven autoscaling down to zero, with optional read-only access to your aws queues or gcp Pub/Sub subscriptions.Every cloud · needs crossplane on aws, gcp
• on by defaultmetrics-serverobservabilityThe resource metrics API behind kubectl top and every HorizontalPodAutoscaler on CPU or memory, on EKS.aws only
• on by defaultmonitoringobservabilityThe monitoring stack in one release: metrics, logs and traces storage, the cluster scraped, Grafana, and kube-prometheus-stack's alert rules.Every cloud
• on by defaultotel-agentobservabilityNode-level OpenTelemetry collector: every container's log, with its pod's metadata, to VictoriaLogs.Every cloud
• on by defaultotel-gatewayobservabilityCluster-level OpenTelemetry collector: your applications' OTLP metrics, logs and traces, and the Kubernetes events.Every cloud
• Voff by defaultvelerobackupBackup and restore of your applications' volumes and objects, chosen by two labels.aws, gcp · needs crossplane on aws, gcp
• off by defaultcrossplaneplatformThe tooling each module uses to declare its own cloud access: Crossplane and its providers (aws and gcp).Every cloud
• Hon by defaulthelloplatformpodinfo, a smoke test that your socle renders, converges and garbage-collects.Every cloud

• The foot of each brick is the clouds the module is offered on; elsewhere tofu plan refuses it. CI proves every module on AWS only.
• Observability is three modules, the stack and its two collectors: how they fit.
• Cilium, CoreDNS and the EKS add-ons are not modules: they run before Flux.

How modules depend on each other

Turning a module on never turns another on. Some need another one on, some only wait for it, some plug into it when it is there. Select a module:

On their own, needing nothing and needed by nothing: hello.

• requires: does not work without it; tofu plan refuses it alone
• after: waits for it to be ready when it is on
• uses: plugs into it when it is on, runs without it

Turning a module on never turns another on. Select a module to see what it needs.

How kube turns them on

List only what differs from the defaults; a module you leave out is on or off as its brick says.

kube = {
  argocd     = { domain = "argocd.acme.example" }   # on by default: change an attribute
  kyverno    = { enabled = true }                   # off by default: turn it on
  hello      = { enabled = false }                  # on by default: turn it off
}

• Names are snake_case; pages and namespaces use kebab-case.
• values takes any chart value, yours winning; values_secret names a Secret for what must stay out of the OpenTofu state.
• A typo, a wrong type, or a module not offered on your cloud fails at plan, with the allowed list.
• Turning a module off removes what it installed; CRDs that hold your objects stay.

Steps: Enable a module. Whole schema: Inputs.