{"id":18839387,"url":"https://github.com/andreswebs/terraform-github-fluxcd-bootstrap","last_synced_at":"2026-05-15T13:02:01.337Z","repository":{"id":124076953,"uuid":"394052639","full_name":"andreswebs/terraform-github-fluxcd-bootstrap","owner":"andreswebs","description":"Deploys the FluxCD toolkit on Kubernetes and stores the manifests in an existing GitHub repository","archived":false,"fork":false,"pushed_at":"2024-04-17T11:14:27.000Z","size":103,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-22T00:20:42.569Z","etag":null,"topics":["fluxcd","github","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/andreswebs/fluxcd-bootstrap/github/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andreswebs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-08-08T19:26:32.000Z","updated_at":"2023-01-14T14:11:27.000Z","dependencies_parsed_at":"2024-01-15T21:46:53.652Z","dependency_job_id":null,"html_url":"https://github.com/andreswebs/terraform-github-fluxcd-bootstrap","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":"andreswebs/tf-module-cookiecutter","purl":"pkg:github/andreswebs/terraform-github-fluxcd-bootstrap","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreswebs%2Fterraform-github-fluxcd-bootstrap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreswebs%2Fterraform-github-fluxcd-bootstrap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreswebs%2Fterraform-github-fluxcd-bootstrap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreswebs%2Fterraform-github-fluxcd-bootstrap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andreswebs","download_url":"https://codeload.github.com/andreswebs/terraform-github-fluxcd-bootstrap/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreswebs%2Fterraform-github-fluxcd-bootstrap/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33067476,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T11:35:32.926Z","status":"ssl_error","status_checked_at":"2026-05-15T11:35:31.362Z","response_time":103,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fluxcd","github","terraform-module"],"created_at":"2024-11-08T02:42:56.246Z","updated_at":"2026-05-15T13:02:01.295Z","avatar_url":"https://github.com/andreswebs.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-github-fluxcd-bootstrap\n\nDeploys the [FluxCD](https://fluxcd.io/docs/) toolkit on Kubernetes and stores the manifests in an existing GitHub repository.\n\n**Note**: If using the default settings, this module will generate an SSH key pair and the public key will be added to the existing GitHub repository.\nThis key pair will be stored unencrypted in the Terraform state.\nMake sure that only authorized users have direct access to the Terraform state.\n\nIt is highly recommended to use a remote state backend supporting encryption at rest. See [References](#references) for more information.\n\nSee the [examples](#usage) to use an externally generated key instead.\n\n[//]: # (BEGIN_TF_DOCS)\n\n\n## Usage\n\nExample:\n\n```hcl\nprovider \"github\" {\n  token = var.github_token\n  owner = var.github_owner\n}\n\nprovider \"kubernetes\" {\n  config_path    = \"~/.kube/config\"\n  config_context = \"my-context\"\n}\n\nmodule \"fluxcd\" {\n  source                  = \"github.com/andreswebs/terraform-github-fluxcd-bootstrap\"\n  git_repository_name     = \"k8s-fleet\"\n  git_branch              = \"main\"\n  git_target_path         = \"clusters/your-cluster\"\n  github_owner            = \"your-github-name\"\n  github_deploy_key_title = \"flux-your-cluster\"\n}\n```\n\nIf using an externally generated deploy key, first add the deploy public key to the GitHub repository (see [instructions](https://docs.github.com/en/developers/overview/managing-deploy-keys#setup-2)). Then create\na Kubernetes secret with the contents below:\n\n```sh\nkubectl create secret generic \\\n    flux-system \\\n    --namespace flux-system \\\n    --from-file=identity \\\n    --from-file=identity.pub \\\n    --from-literal=known_hosts=\"$(ssh-keyscan github.com)\"\n```\n\nThe key files must be named `identity` (private key) and `identity.pub` (public key).\n\nAfter creating the secret, pass its name to the module:\n\n```hcl\nmodule \"fluxcd\" {\n  source                  = \"github.com/andreswebs/terraform-github-fluxcd-bootstrap\"\n  git_repository_name     = \"k8s-fleet\"\n  git_branch              = \"main\"\n  git_target_path         = \"clusters/your-cluster\"\n  github_owner            = \"your-github-name\"\n  github_deploy_key_title = \"flux-your-cluster\"\n  create_deploy_key       = false\n  flux_sync_secret_name   = \"flux-system\" ## --\u003e name of the Kubernetes secret containing your deploy key\n}\n```\n\n\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_create_deploy_key\"\u003e\u003c/a\u003e [create\\_deploy\\_key](#input\\_create\\_deploy\\_key) | Create the GitHub deploy key? | `bool` | `true` | no |\n| \u003ca name=\"input_create_namespace\"\u003e\u003c/a\u003e [create\\_namespace](#input\\_create\\_namespace) | Create the Kubernetes namespace? | `bool` | `true` | no |\n| \u003ca name=\"input_flux_image_pull_secrets\"\u003e\u003c/a\u003e [flux\\_image\\_pull\\_secrets](#input\\_flux\\_image\\_pull\\_secrets) | Kubernetes secret name used for pulling the toolkit images from a private registry | `string` | `\"\"` | no |\n| \u003ca name=\"input_flux_install_components\"\u003e\u003c/a\u003e [flux\\_install\\_components](#input\\_flux\\_install\\_components) | Toolkit components to include in the install manifests | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"source-controller\",\u003cbr\u003e  \"kustomize-controller\",\u003cbr\u003e  \"helm-controller\",\u003cbr\u003e  \"notification-controller\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_flux_install_components_extra\"\u003e\u003c/a\u003e [flux\\_install\\_components\\_extra](#input\\_flux\\_install\\_components\\_extra) | List of extra components to include in the install manifests | `list(string)` | `[]` | no |\n| \u003ca name=\"input_flux_install_network_policy\"\u003e\u003c/a\u003e [flux\\_install\\_network\\_policy](#input\\_flux\\_install\\_network\\_policy) | Deny ingress access to the toolkit controllers from other namespaces using network policies? | `bool` | `true` | no |\n| \u003ca name=\"input_flux_install_toleration_keys\"\u003e\u003c/a\u003e [flux\\_install\\_toleration\\_keys](#input\\_flux\\_install\\_toleration\\_keys) | List of toleration keys used to schedule the components pods onto nodes with matching tailist | `list(string)` | `[]` | no |\n| \u003ca name=\"input_flux_log_level\"\u003e\u003c/a\u003e [flux\\_log\\_level](#input\\_flux\\_log\\_level) | Log level for Flux toolkit components | `string` | `\"info\"` | no |\n| \u003ca name=\"input_flux_registry\"\u003e\u003c/a\u003e [flux\\_registry](#input\\_flux\\_registry) | Container registry from where the Flux toolkit images are pulled | `string` | `\"ghcr.io/fluxcd\"` | no |\n| \u003ca name=\"input_flux_resources_name\"\u003e\u003c/a\u003e [flux\\_resources\\_name](#input\\_flux\\_resources\\_name) | The name of generated Kubernetes resources | `string` | `\"flux-system\"` | no |\n| \u003ca name=\"input_flux_secret_name\"\u003e\u003c/a\u003e [flux\\_secret\\_name](#input\\_flux\\_secret\\_name) | The name of the secret that is referenced by `GitRepository`, used by flux to deploy to the git repository | `string` | `\"flux-system\"` | no |\n| \u003ca name=\"input_flux_sync_interval_minutes\"\u003e\u003c/a\u003e [flux\\_sync\\_interval\\_minutes](#input\\_flux\\_sync\\_interval\\_minutes) | Sync interval in minutes | `number` | `1` | no |\n| \u003ca name=\"input_flux_version\"\u003e\u003c/a\u003e [flux\\_version](#input\\_flux\\_version) | FluxCD version; defaults to the latest available | `string` | `null` | no |\n| \u003ca name=\"input_flux_watch_all_namespaces\"\u003e\u003c/a\u003e [flux\\_watch\\_all\\_namespaces](#input\\_flux\\_watch\\_all\\_namespaces) | Watch for custom resources in all namespaces? | `bool` | `true` | no |\n| \u003ca name=\"input_git_branch\"\u003e\u003c/a\u003e [git\\_branch](#input\\_git\\_branch) | Git branch | `string` | `\"main\"` | no |\n| \u003ca name=\"input_git_repository_name\"\u003e\u003c/a\u003e [git\\_repository\\_name](#input\\_git\\_repository\\_name) | Name of the Git repository to store the FluxCD manifests | `string` | n/a | yes |\n| \u003ca name=\"input_git_target_path\"\u003e\u003c/a\u003e [git\\_target\\_path](#input\\_git\\_target\\_path) | Target path for storing FluxCD manifests in the Git repository | `string` | `\".\"` | no |\n| \u003ca name=\"input_github_deploy_key_readonly\"\u003e\u003c/a\u003e [github\\_deploy\\_key\\_readonly](#input\\_github\\_deploy\\_key\\_readonly) | Set the GitHub deploy key as read-only? | `bool` | `true` | no |\n| \u003ca name=\"input_github_deploy_key_title\"\u003e\u003c/a\u003e [github\\_deploy\\_key\\_title](#input\\_github\\_deploy\\_key\\_title) | GitHub deploy key title | `string` | `\"flux\"` | no |\n| \u003ca name=\"input_github_owner\"\u003e\u003c/a\u003e [github\\_owner](#input\\_github\\_owner) | GitHub owner | `string` | n/a | yes |\n| \u003ca name=\"input_github_ssh_domain\"\u003e\u003c/a\u003e [github\\_ssh\\_domain](#input\\_github\\_ssh\\_domain) | Domain to use for SSH to GitHub | `string` | `\"github.com\"` | no |\n| \u003ca name=\"input_github_ssh_known_hosts_file\"\u003e\u003c/a\u003e [github\\_ssh\\_known\\_hosts\\_file](#input\\_github\\_ssh\\_known\\_hosts\\_file) | Path to a temporary file used to store GitHub's known hosts during the deployment | `string` | `\"/tmp/github_known_hosts\"` | no |\n| \u003ca name=\"input_k8s_cluster_domain\"\u003e\u003c/a\u003e [k8s\\_cluster\\_domain](#input\\_k8s\\_cluster\\_domain) | The internal cluster domain | `string` | `\"cluster.local\"` | no |\n| \u003ca name=\"input_k8s_namespace\"\u003e\u003c/a\u003e [k8s\\_namespace](#input\\_k8s\\_namespace) | Name of the Kubernetes namespace where the resources will be deployed | `string` | `\"flux-system\"` | no |\n| \u003ca name=\"input_k8s_namespace_annotations\"\u003e\u003c/a\u003e [k8s\\_namespace\\_annotations](#input\\_k8s\\_namespace\\_annotations) | Annotations to apply to the Kubernetes namespace when it is created | `map(string)` | `{}` | no |\n| \u003ca name=\"input_k8s_namespace_labels\"\u003e\u003c/a\u003e [k8s\\_namespace\\_labels](#input\\_k8s\\_namespace\\_labels) | Labels to apply to the Kubernetes namespace when it is created | `map(string)` | `{}` | no |\n\n## Modules\n\nNo modules.\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_deploy_key\"\u003e\u003c/a\u003e [deploy\\_key](#output\\_deploy\\_key) | SSH key added to the GitHub repository |\n| \u003ca name=\"output_github_repository\"\u003e\u003c/a\u003e [github\\_repository](#output\\_github\\_repository) | GitHub repository used by flux |\n| \u003ca name=\"output_known_hosts\"\u003e\u003c/a\u003e [known\\_hosts](#output\\_known\\_hosts) | Known hosts for GitHub's SSH domain |\n| \u003ca name=\"output_namespace\"\u003e\u003c/a\u003e [namespace](#output\\_namespace) | The name (metadata.name) of the namespace |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_flux\"\u003e\u003c/a\u003e [flux](#provider\\_flux) | 1.0.0-rc.1 |\n| \u003ca name=\"provider_github\"\u003e\u003c/a\u003e [github](#provider\\_github) | ~\u003e 5.0 |\n| \u003ca name=\"provider_kubectl\"\u003e\u003c/a\u003e [kubectl](#provider\\_kubectl) | ~\u003e 1.14 |\n| \u003ca name=\"provider_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#provider\\_kubernetes) | ~\u003e 2.16 |\n| \u003ca name=\"provider_local\"\u003e\u003c/a\u003e [local](#provider\\_local) | ~\u003e 2.2 |\n| \u003ca name=\"provider_null\"\u003e\u003c/a\u003e [null](#provider\\_null) | ~\u003e 3.2 |\n| \u003ca name=\"provider_tls\"\u003e\u003c/a\u003e [tls](#provider\\_tls) | ~\u003e 4.0 |\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e 1.3 |\n| \u003ca name=\"requirement_flux\"\u003e\u003c/a\u003e [flux](#requirement\\_flux) | 1.0.0-rc.1 |\n| \u003ca name=\"requirement_github\"\u003e\u003c/a\u003e [github](#requirement\\_github) | ~\u003e 5.0 |\n| \u003ca name=\"requirement_kubectl\"\u003e\u003c/a\u003e [kubectl](#requirement\\_kubectl) | ~\u003e 1.14 |\n| \u003ca name=\"requirement_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#requirement\\_kubernetes) | ~\u003e 2.16 |\n| \u003ca name=\"requirement_local\"\u003e\u003c/a\u003e [local](#requirement\\_local) | ~\u003e 2.2 |\n| \u003ca name=\"requirement_null\"\u003e\u003c/a\u003e [null](#requirement\\_null) | ~\u003e 3.2 |\n| \u003ca name=\"requirement_tls\"\u003e\u003c/a\u003e [tls](#requirement\\_tls) | ~\u003e 4.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [github_repository_deploy_key.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_deploy_key) | resource |\n| [github_repository_file.install](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |\n| [github_repository_file.kustomize](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |\n| [github_repository_file.sync](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |\n| [kubectl_manifest.install](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/resources/manifest) | resource |\n| [kubectl_manifest.sync](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/resources/manifest) | resource |\n| [kubernetes_namespace.flux](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |\n| [kubernetes_secret.flux_ssh](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |\n| [null_resource.k8s_namespace](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |\n| [null_resource.ssh_scan](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |\n| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |\n| [flux_install.this](https://registry.terraform.io/providers/fluxcd/flux/1.0.0-rc.1/docs/data-sources/install) | data source |\n| [flux_sync.this](https://registry.terraform.io/providers/fluxcd/flux/1.0.0-rc.1/docs/data-sources/sync) | data source |\n| [github_repository.this](https://registry.terraform.io/providers/integrations/github/latest/docs/data-sources/repository) | data source |\n| [kubectl_file_documents.install](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/data-sources/file_documents) | data source |\n| [kubectl_file_documents.sync](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/data-sources/file_documents) | data source |\n| [local_file.known_hosts](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/file) | data source |\n\n[//]: # (END_TF_DOCS)\n\n## Authors\n\n**Andre Silva** - [@andreswebs](https://github.com/andreswebs)\n\n## License\n\nThis project is licensed under the [Unlicense](UNLICENSE.md).\n\n## References\n\n\u003chttps://www.terraform.io/docs/language/state/sensitive-data.html\u003e\n\n\u003chttps://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1\u003e\n\n## Acknowledgments\n\n\u003chttps://github.com/kube-champ/terraform-k8s-flux-bootstrap\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreswebs%2Fterraform-github-fluxcd-bootstrap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandreswebs%2Fterraform-github-fluxcd-bootstrap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreswebs%2Fterraform-github-fluxcd-bootstrap/lists"}