How to safely install Flux CLI

[WOW-Lin]

We encounter a major issue when install flux cli locally after replacing a new laptop within the organisation. It seems every-time we run "flux install" command, it not only installed the latest version to our locally machine, but also automatically upgraded flux version in our kubernetes cluster which caused lots of incompatibility issues.

Just wondering what is the best practise to install flux locally without impacting our server?

[kingdonb]

Hello, the local Flux installation is usually accomplished with a package manager tool such as brew, nix, or chocolatey – the flux install command doesn't serve any function to install or upgrade the cli itself:

https://fluxcd.io/flux/installation/#install-the-flux-cli

The command flux install isn't generally meant to be used except for with the --export command, like in the getting started guide or in the Flux GitHub Action where you can use it to generate the manifests for upgrading Flux outside of a normal bootstrap process.

https://fluxcd.io/flux/flux-gh-action/#automate-flux-updates

You should not run flux install against a live cluster, and for production clusters you typically should not have the ready access where running flux install on a production server can have this impact. Using RBAC, you can isolate the users and keep this type of admin access behind a "break glass" – it should be the normal practice for every change to go through Git, and only touching the cluster for bootstrap with the admin credentials.

If normal devs have that kind of access outside of a dev and test environment, I would say there is something wrong with the configuration. We would like to update the docs to reflect this better and more consistently, that flux install or flux create are both an anti-pattern and meant to be used for generating and testing resources only, not for interaction with live or production workloads.

You should never flux create ... instead always flux create ... --export – and there are hopefully not many places left in the docs where we don't abide this principle consistently. The same goes for flux install – don't use this without --export. I don't think that any Flux docs demonstrate using flux install at all, except for adjacent to the bootstrap upgrade doc linked above. The flux install CLI docs could make it clearer that this command is not meant for use to install flux except in a narrow case that circumvents GitOps; however this command is not intended for everyday use.

In general understand that flux install is for upgrading Flux in the namespace outside of GitOps, which you should never need to do if Flux is bootstrapped normally. Use one of the upgrade methods like the GitHub Action to send you a PR automatically when a Flux upgrade is available, and merge it to get Flux upgraded. Then you never need to access the "break glass" credentials after the first initial bootstrap is finished, and you can avoid running flux bootstrap again for subsequent upgrades like the docs prescribe.

You can do upgrades either way. flux bootstrap is idempotent. But you should generally not run flux install against any cluster, unless it is a temporary cluster or for specific purposes. I think a lot of guides out there in the wild make this mistake, where people get the wrong idea that you can use Flux this way. Flux is for GitOps, so we think as a best practice you should always start from bootstrap, then manage everything that you can (including, but especially Flux itself!) via GitOps.

[WOW-Lin]

Thank you @kingdonb , that helps, happy to close the thread.

[WOW-Lin]

This helped me understood better how some of the flux command works