{"id":14156323,"url":"https://github.com/fluxcd/cues","last_synced_at":"2026-03-16T16:31:39.954Z","repository":{"id":101612340,"uuid":"477765597","full_name":"fluxcd/cues","owner":"fluxcd","description":"Experimental CUE packages for generating Flux configurations","archived":false,"fork":false,"pushed_at":"2023-08-02T11:14:40.000Z","size":448,"stargazers_count":73,"open_issues_count":1,"forks_count":6,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-02-25T15:28:28.915Z","etag":null,"topics":["cuelang","gitops-toolkit"],"latest_commit_sha":null,"homepage":"","language":"CUE","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fluxcd.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-04-04T15:40:08.000Z","updated_at":"2025-01-25T20:31:13.000Z","dependencies_parsed_at":"2024-03-30T22:41:53.748Z","dependency_job_id":null,"html_url":"https://github.com/fluxcd/cues","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/fluxcd/cues","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fluxcd%2Fcues","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fluxcd%2Fcues/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fluxcd%2Fcues/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fluxcd%2Fcues/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fluxcd","download_url":"https://codeload.github.com/fluxcd/cues/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fluxcd%2Fcues/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":285277271,"owners_count":27144150,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-19T02:00:05.673Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cuelang","gitops-toolkit"],"created_at":"2024-08-17T08:05:22.824Z","updated_at":"2025-11-19T16:01:57.827Z","avatar_url":"https://github.com/fluxcd.png","language":"CUE","funding_links":[],"categories":["others"],"sub_categories":[],"readme":"# cues\n\n[![build](https://github.com/fluxcd/cues/workflows/build/badge.svg)](https://github.com/fluxcd/cues/actions)\n[![license](https://img.shields.io/github/license/fluxcd/cues.svg)](https://github.com/fluxcd/cues/blob/main/LICENSE)\n[![release](https://img.shields.io/github/v/tag/fluxcd/cues?include_prereleases\u0026label=release)](https://github.com/fluxcd/cues/tags)\n\nA collection of [CUE](https://cuelang.org) packages and tools for generating [Flux](https://fluxcd.io) configurations.\n\n## Project\n\nThis project is for Flux users who want to reduce the Kubernetes boilerplate when configuring delivery pipelines across\nenvironments. Instead of working with Kubernetes YAML, you will build abstractions with CUE, encode good\npractices and validation to simplify complex tasks such as creating a new environment, onboard teams, drive workload\npromotion and ultimately reduce toil.\n\n\u003e Note that this project is in the experimental phase, the CUE APIs may change in a breaking manner.\n\n### Prerequisites\n\nTo run `cue` commands, you'll need the following tools:\n\n- Go \u003e= 1.17.0\n- CUE \u003e= 0.4.3\n- SOPS \u003e= 3.7.0\n- Flux \u003e= 0.28.0\n\nOn macOS or Linux you can install the prerequisites with Homebrew:\n\n```shell\nbrew install go cue sops fluxcd/tap/flux\n```\n\n### Secrets management\n\nSecrets such as access tokens, SSH keys, certs, etc are stored in plain text in CUE files\nthat follow the `\u003cname\u003e.secrets.cue` naming convention.\n\nTo safely store these secrets in Git, you'll be using [Mozilla SOPS](https://github.com/mozilla/sops)\nwith Age keys or cloud KMS.\n\nEach user with access to this repo, would have its own [Age](https://github.com/FiloSottile/age)\nprivate key in env and all the other users public keys:\n\n```shell\nexport SOPS_AGE_KEY=USER1-SECRET-KEY\nexport SOPS_AGE_RECIPIENTS=USER1-PUB-KEY,USER2-PUB-KEY\n```\n\nBefore committing changes to Git, you can encrypt all `*.secrets.cue` files with:\n\n```shell\ncue seal .\n```\n\nAfter pulling changes from Git, you can decrypt the secrets locally with:\n\n```shell\ncue unseal .\n```\n\n## Abstractions\n\n### Cluster\n\nThe [cluster](pkg/cluster) CUE package is an abstraction for making `flux install` and `flux bootstrap` declarative.\n\n#### Install tool\n\nExample definition:\n\n```cue\nlocal: cluster.#Install \u0026 {\n\tname: \"kind\"\n\tkubeconfig: context: \"kind-\\(name)\"\n\tflux: {\n\t\tnamespace:  \"flux-system\"\n\t\tversion:    \"v0.28.5\"\n\t\tcomponents: cluster.Components.All\n\t}\n\taddons: [\n\t\t#CertManager \u0026 {\n\t\t\tspec: chart: version: \"v1.8.x\"\n\t\t},\n\t\t#Kyverno \u0026 {\n\t\t\tspec: chart: version: \"v2.3.x\"\n\t\t},\n\t\t#MetricsServer \u0026 {\n\t\t\tspec: chart: version: \"v3.8.x\"\n\t\t},\n\t]\n}\n```\n\nTo get started with the `cue install` tool please see this [guide](tools/install).\n\n#### Bootstrap tool\n\nExample definition:\n\n```cue\nstaging: cluster.#Bootstrap \u0026 {\n\tname: \"staging\"\n\tgit: {\n\t\t// This repository must exists.\n\t\turl: \"https://github.com/org/kube-fleet.git\"\n\t\t// This branch will be created if it doesn't exists.\n\t\tbranch: \"main\"\n\t\t// This PAT must have push access to the repository.\n\t\t// The PAT is persisted in-cluster as a secret in the flux namespace.\n\t\ttoken: secrets.gitToken\n\t\tpath:  \"./clusters/\\(name)\"\n\t}\n\tkubeconfig: context: \"kind-\\(name)\"\n\tflux: {\n\t\tnamespace:  \"flux-system\"\n\t\tversion:    \"v0.28.5\"\n\t\tcomponents: cluster.Components.All\n\t}\n}\n```\n\nTo get started with the `cue bootstrap` tool please see this [guide](tools/bootstrap).\n\n### Tenant\n\nThe [tenant](pkg/tenant) CUE package is an abstraction built on top of Kubernetes RBAC and Flux account impersonation\nwith the goal of simplifying the onboard procedure of teams and their workloads onto Kubernetes clusters.\n\nExample definition:\n\n```cue\nawesomeTeam: tenant.#Tenant \u0026 {\n\tspec: {\n\t\tname:      \"awesome-team\"\n\t\tnamespace: \"awesome-apps\"\n\t\trole:      \"namespace-admin\"\n\t\tgit: {\n\t\t\ttoken:  secrets.gitToken\n\t\t\turl:    \"https://github.com/org/kube-awesome-team\"\n\t\t\tbranch: \"main\"\n\t\t\tpath:   \"./deploy/releases\"\n\t\t}\n\t\tslack: {\n\t\t\ttoken:   secrets.slackToken\n\t\t\tchannel: \"awesome-alerts\"\n\t\t\tcluster: \"prod-eu-central-1\"\n\t\t}\n\t}\n}\n```\n\nThe [tenants generator](generators/tenants) can be used by platform admins to generate the Kubernetes YAML\nmanifests needed by Flux for tenants onboarding, such as: namespaces, service accounts, role bindings, secrets,\nFlux Git repositories, kustomizations, notification providers and alerts.\n\nTo get started with the tenants generator please see this [guide](generators/tenants/README.md).\n\n### Release\n\nThe [release](pkg/tenant) CUE package is an abstraction built on top of Helm and Flux\nwith the goal of simplifying the delivery of applications across environments.\n\nExample definition:\n\n```cue\nawesomeApp: release.#Release \u0026 {\n\tspec: {\n\t\tname:      \"awesome-app\"\n\t\tnamespace: \"apps\"\n\t\trepository: {\n\t\t\turl:      \"https://org.github.io/charts\"\n\t\t\tuser:     secrets.helmUser\n\t\t\tpassword: secrets.helmPassword\n\t\t}\n\t\tchart: {\n\t\t\tname: \"app\"\n\t\t\tversion: \"1.2.x\"\n\t\t}\n\t\t// These values are stored in an immutable ConfigMap.\n\t\tvalues: {\n\t\t\thpa: maxReplicas: 10\n\t\t\tresources: {\n\t\t\t\tlimits: memory: \"512Mi\"\n\t\t\t\trequests: memory: \"32Mi\"\n\t\t\t}\n\t\t}\n\t\t// These values are stored in an immutable Secret encrypted with SOPS.\n\t\tsecretValues: {\n\t\t\tredis: password: secrets.redisPassword\n\t\t}\n\t}\n}\n```\n\nThe [releases generator](generators/releases) can be used by various teams to generate the Kubernetes YAML\nmanifests needed by Flux for installing and upgrading Helm releases.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffluxcd%2Fcues","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffluxcd%2Fcues","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffluxcd%2Fcues/lists"}