Flux CD vs Google Config Sync

Flux CD is a free, open-source set of continuous and progressive delivery tools for Kubernetes. It uses GitOps to reconcile clusters with configuration from sources such as Git repositories, and manages Kubernetes resources along with infrastructure and workload dependencies. Integrations include GitHub, GitLab, Bitbucket, S3-compatible buckets, OCI, container registries, Helm, and Kustomize. With Flagger, it supports canary deployments, feature flags, and A/B rollouts; it can also scan container images and push automated updates back to Git. Flux can send alerts to external systems, including chat systems such as Slack. For multi-tenancy, it uses Kubernetes RBAC through impersonation and supports multiple repositories and clusters. Its CLI and controller images are signed, and controller deployments follow the Kubernetes restricted pod security standard. Flux does not provide its own UI, although third-party interfaces are available. Installation requires cluster-admin rights, and older end-of-life Kubernetes versions are unsupported; the listed minimum versions begin at v1.34.1 for v1.34.

Google Config Sync keeps configuration and policies aligned across Kubernetes clusters by monitoring a source of truth and reconciling cluster state. It can sync files from Git repositories, OCI images and Helm charts, and apply Policy Controller constraints to registered and connected clusters. Namespace management supports multi-tenancy through namespace-scoped policies such as RBAC roles. Config Sync supports Autopilot and Standard GKE clusters, plus GKE-attached clusters including EKS and AKS. Clusters must be registered to a fleet before the service can be enabled. Its architecture combines hosted Google Cloud components with open-source components running on GKE. For OCI repositories, it can integrate with an admission webhook signature verification server to help ensure only trusted images are used. Config Sync is included with Google Kubernetes Engine at free, subject to a GKE-supported cluster version and fleet registration. It runs only on x86-based nodes, not Arm nodes. The drift-prevention admission webhook can use high memory and cause out-of-memory errors in clusters with many custom resources.