Where Does FluxCD Store Desired State and Credentials?
FluxCD keeps desired state in a Git repository with cluster credentials in kubeconfig and controllers in flux-system.
Last updated
FluxCD stores cluster desired state in Git. Manifests, kustomizations, and image policies live in the repository the controllers watch. The cluster holds only the synced result plus the flux-system namespace.
That inversion defines disaster recovery. Losing the cluster loses nothing declarative; re-bootstrap replays Git. Kubeconfig on the operator machine is the only local credential that matters.
Where FluxCD stores this, by platform
~/.kube/config (plus your Git repo)
Operator credential for CLI requests, overridable with flags. Desired state lives in Git. Controllers run in the flux-system namespace.
~/.kube/config (plus your Git repo)
Same kubeconfig model on Mac. Bootstrap writes flux-system on first run. Re-bootstrap replays the repo after cluster loss.
C:\Users\<you>\.kube\config (plus your Git repo)
Same layout under the user profile on Windows. Git holds manifests; the cluster holds synced results. Back up the repo, not the cluster.
Frequently asked questions
How do I move FluxCD to a new cluster?
Point a fresh cluster at the same Git repository and bootstrap again. Desired state lives in Git, not on the old cluster. Secrets need their own backup outside the repo.
Is the flux CLI enough to manage it?
Yes for day-to-day use. The CLI reads the standard kubeconfig and talks to in-cluster controllers. Bootstrap writes the flux-system namespace that does the real work.
Notice an outdated path? Let us know.