Skip to content

GitOps Comparison — Argo CD vs Flux

Summary

Canonical comparison of the two CNCF-graduated GitOps engines, Argo CD and FluxCD. Argo CD is a centralized hub with a rich UI, sync waves/hooks and ApplicationSets; its pre-GA Argo CD Agent adds a pull-based spoke model. Flux runs independent controllers in every cluster, pulls its own desired state, and ships built-in image automation. Versions and facts below come from the refreshed topic pages (2026-09-25).

Quick Reference

Dimension Argo CD Flux
Latest version 3.5.3 (2026-09-14); 3.6 in RC, GA planned 2026-11-03 v2.9.5 (2026-08-31)
Supported versions Three newest minors: 3.5, 3.4, 3.3 Three newest minors: 2.9, 2.8, 2.7
Release cadence Quarterly minors (Feb, May, Aug, Nov) At least three minors a year, about two weeks after each Kubernetes minor
Architecture Hub-and-spoke: controllers in a management cluster reconcile many clusters. Argo CD Agent (argoproj-labs, pre-GA) lets spokes dial in to the hub Decentralized: every cluster runs its own controllers and pulls its own sources
CNCF status Graduated (Argo project, 2022-12-06) Graduated (2022-11-30)
Web UI Built in: live diff, resource tree, logs, SSO-scoped actions None in the CNCF distribution. Flux Operator Web UI (AGPL-3.0), Headlamp or Backstage plugins
Image automation Not built in (Argo CD Image Updater or CI) Built in: image-reflector and image-automation controllers (v1 API GA since 2.7, opt-in install)
Manifest rendering Helm 4.2.1 (Helm 4 since 3.5), Kustomize 5.8.1, Jsonnet, plain YAML, Config Management Plugins Helm v4 (since 2.8), Kustomize, plain YAML. No Jsonnet or plugin mechanism
Sources Git, Helm repositories, OCI Git, OCI, Helm repositories, buckets
Default Git polling timeout.reconciliation 180s (3m) No default: spec.interval is required on every object (docs recommend 1m for sources)
Kubernetes tested 1.33 to 1.36 (3.5) 1.34 to 1.36 (2.9)
License Apache-2.0 Apache-2.0 (Flux Operator: AGPL-3.0)

Architecture Comparison

Classic Argo CD holds credentials for every target cluster and applies from the hub. The Argo CD Agent inverts the connection, and Flux never needs a hub at all.

flowchart LR
    GIT[("Git / Helm / OCI sources")]
    subgraph ARGO["Argo CD"]
        HUB["Hub: argocd-server,<br/>application-controller, repo-server"]
        C1["Cluster A<br/>(classic spoke)"]
        subgraph C2["Cluster B (Agent spoke)"]
            AG["argocd-agent +<br/>local application-controller"]
        end
        HUB -->|"watch + apply<br/>(needs API access)"| C1
        AG -->|"outbound gRPC + mTLS"| HUB
    end
    subgraph FLUX["Flux"]
        F1["Cluster X: source-, kustomize-,<br/>helm-controller"]
        F2["Cluster Y: source-, kustomize-,<br/>helm-controller"]
    end
    HUB -->|"fetch + render"| GIT
    AG -->|"fetch + render"| GIT
    F1 -->|"pull"| GIT
    F2 -->|"pull"| GIT

Detailed diagrams: Argo CD explanation (components, Agent managed and autonomous modes, Source Hydrator) and Flux explanation.

Feature Matrix

Feature Argo CD Flux
Drift detection Live state kept current by watches; drift shows as OutOfSync right away. Self-heal optional kustomize-controller re-applies with SSA every spec.interval. HelmRelease drift detection is opt-in (spec.driftDetection)
Auto-healing Yes (auto-sync with selfHeal) Yes (every interval)
Rollback argocd app rollback or UI to an earlier sync, only for apps without auto-sync; otherwise Git revert Git revert; HelmRelease remediation can roll back failed upgrades
Sync ordering and hooks Sync phases (PreSync, Sync, PostSync, SyncFail, PreDelete, PostDelete) and sync waves No waves. dependsOn waits for upstream objects to be Ready (custom CEL readyExpr since 2.7), plus health checks and SSA apply stages. Helm chart hooks run inside HelmReleases
Fleet templating ApplicationSet (9 generators; Progressive Syncs beta) Kustomize overlays and post-build substitution; ResourceSet and ResourceSetInputProvider from the Flux Operator (AGPL-3.0) for templated bundles and PR preview environments
OCI sources Yes Yes, with Cosign/Notation signature verification
Source verification Source Integrity: Git commit signature verification per AppProject (3.5) Git commit/tag verification (PGP; SSH since 2.9); Cosign or Notation for OCI artifacts
Rendered-manifest pattern Source Hydrator commits rendered YAML to Git (beta in 3.5, disabled by default) No equivalent controller; render in CI and publish OCI artifacts
Notifications argocd-notifications: Slack, Microsoft Teams Workflows, email, webhooks notification-controller: Alerts to chat and webhooks, Git commit status, PR/MR comments (2.8+); inbound Receiver webhooks
SSO / RBAC Dex/OIDC, Argo CD RBAC, AppProjects; sync impersonation (beta in 3.5) Kubernetes RBAC and service-account impersonation; lockdown with --no-cross-namespace-refs and --default-service-account. Flux Operator Web UI adds OIDC SSO
Monorepo support Webhooks, manifest-generate-paths, shallow clone (3.3+) spec.ignore, sparseCheckout, ArtifactGenerator (2.7+), OCI artifacts built in CI
No inbound access to clusters / air-gapped Classic hub needs network reach to every cluster API. Agent autonomous mode suits air-gapped or intermittent sites (pre-GA) Native: each cluster pulls; local registry mirrors (Flux Mirror plugin, 2.9)
Helm 4 Yes, since 3.5 (spec.source.helm.version: v3 is ignored) Yes, since 2.8 (SSA + kstatus); UseHelm3Defaults feature gate restores Helm 3 behaviour
Progressive delivery companion Argo Rollouts Flagger

Operational Comparison

Dimension Argo CD Flux
Installation install.yaml or ha/install.yaml manifests (or a Helm chart) in the management cluster; Agent on each spoke if used flux bootstrap per cluster, or the Flux Operator's FluxInstance
Day-2 complexity Moderate: Redis, repo-server scaling, controller sharding, HA Low per cluster; the work is in repository layout across many clusters
Debugging UI with visual diff, sync status and logs; argocd CLI flux CLI and kubectl (events, conditions, logs); optional Web UI
Team model Platform team runs the hub; app teams self-serve through AppProjects Platform team defines tenants per cluster; teams own their Kustomizations and HelmReleases
Footprint Higher (API server, repo-server, Redis, Dex) Small (controllers request 64Mi memory each by default)
Security exposure Hub concentrates cluster credentials; several critical CVEs in 2025-2026 (for example CVE-2026-42880, CVSS 9.6) No central credential store; each cluster holds only its own credentials
Support window About nine months per minor (three quarterly minors) Three minors, at least three per year

Which One Should I Pick?

Start from network topology, then from the features only one engine has.

flowchart TD
    Q1{"May a central hub reach<br/>every cluster API?"}
    Q1 -->|"No"| Q2{"Is the pre-GA Argo CD Agent<br/>acceptable for production?"}
    Q2 -->|"Yes"| AAG["Argo CD with the Agent<br/>(managed or autonomous mode)"]
    Q2 -->|"No"| FX1["Flux<br/>(each cluster pulls its own state)"]
    Q1 -->|"Yes"| Q3{"Need a built-in multi-cluster UI<br/>with SSO-scoped RBAC?"}
    Q3 -->|"Yes"| ARGO1["Argo CD"]
    Q3 -->|"No"| Q4{"Need sync waves and hooks,<br/>Jsonnet or CMP plugins?"}
    Q4 -->|"Yes"| ARGO2["Argo CD"]
    Q4 -->|"No"| Q5{"Want built-in image tag automation<br/>or the smallest per-cluster footprint?"}
    Q5 -->|"Yes"| FX2["Flux"]
    Q5 -->|"No"| EITHER["Either fits: choose by team model<br/>(central platform team: Argo CD,<br/>per-cluster ownership: Flux)"]

Decision Guide

Scenario Recommendation
Visual management, stakeholder visibility Argo CD: built-in UI with live diff
Security-hardened or air-gapped, no inbound cluster access Flux; or Argo CD with the Agent once its maturity is acceptable to you
Edge or many small clusters Flux: no central hub to scale or lose; Argo CD Agent is the Argo alternative
Central platform team managing fleets Argo CD: single pane of glass, ApplicationSets
Image automation (auto-update tags in Git) Flux: built-in image automation
Ordered deploys with migrations and smoke tests Argo CD: sync phases, waves and hooks
Multi-team with granular RBAC in the tool Argo CD: AppProjects plus Argo CD RBAC over SSO groups
Kubernetes RBAC as the only authorization model Flux
Helm 4 charts Either: Argo CD 3.5+ and Flux 2.8+ both render with Helm 4

Sources