How to Deploy Microsoft Azure Arc for GitOps-Driven Kubernetes Configuration Management

As enterprise cloud architectures evolve, organizations frequently adopt a multi-cloud or hybrid strategy, deploying Kubernetes clusters across Microsoft Azure (AKS), Amazon Web Services (EKS), Google Cloud (GKE), and on-premises VMware vSphere. Managing the configurations, security policies, and application deployments across this fractured landscape using manual kubectl apply commands or disparate CI/CD pipelines creates massive operational drift. To solve this, Microsoft engineered Azure Arc. Specifically, by deploying Azure Arc-enabled Kubernetes with the Flux extension, administrators can enforce a pure, mathematically consistent GitOps architecture, ensuring that every cluster globally synchronizes its state from a single, centralized Git repository.

The Architecture of Azure Arc and Flux

Azure Arc acts as a universal control plane. It projects non-Azure resources (like an AWS EKS cluster or a local K3s cluster running on a Raspberry Pi) into Azure Resource Manager (ARM), allowing you to manage them exactly as if they were native Azure resources.

The GitOps capability is powered by the Flux v2 extension. Rather than pushing configurations to the cluster (the traditional CI/CD push model, which requires opening inbound firewall ports), Flux utilizes a pull model. The Flux agent runs securely inside the Kubernetes cluster. It periodically polls a designated Git repository (such as GitHub, GitLab, or Azure Repos). If the declarative YAML manifests in the repository change, Flux automatically pulls the new state and reconciles it against the cluster’s current state, deploying the new application or updating the network policy without any human intervention.

Onboarding a Cluster to Azure Arc

To deploy this architecture, you must first connect your external Kubernetes cluster to Azure Arc. Assume you have a local Kubernetes cluster (e.g., Minikube or K3s) and the Azure CLI installed.

First, register the necessary Azure resource providers in your subscription:

az provider register --namespace Microsoft.Kubernetes
az provider register --namespace Microsoft.KubernetesConfiguration
az provider register --namespace Microsoft.ExtendedLocation

Next, use the Azure CLI to connect the cluster. This command deploys the Azure Arc agents (the azure-arc namespace) onto your cluster:

az connectedk8s connect \
    --name hybrid-k8s-cluster \
    --resource-group arc-management-rg \
    --location eastus

Within minutes, your external cluster will appear in the Azure Portal under Azure Arc > Kubernetes clusters, fully integrated with Azure’s governance and monitoring capabilities.

Deploying the Flux GitOps Configuration

With the cluster connected, you deploy the Flux extension to enforce the GitOps workflow. You must define the source Git repository that contains your Kubernetes manifests.

az k8s-configuration flux create \
    --name cluster-config \
    --cluster-name hybrid-k8s-cluster \
    --resource-group arc-management-rg \
    --cluster-type connectedClusters \
    --scope cluster \
    --namespace flux-system \
    --kind git \
    --url https://github.com/Azure/arc-k8s-demo \
    --branch main \
    --kustomization name=cluster-sync path=./cluster-config prune=true

This command instructs Azure to install the Flux operators into the flux-system namespace. The operator immediately clones the arc-k8s-demo repository, inspects the ./cluster-config directory, and applies the YAML files utilizing Kustomize.

The GitOps Developer Workflow

Once deployed, the operational paradigm shifts entirely to Git.

If a developer needs to deploy a new Redis cache or a security engineer needs to update a Calico network policy, they do not touch the cluster. They submit a Pull Request to the Git repository. Once the PR is merged into the main branch, the Flux agent running inside the Arc-enabled cluster detects the commit hash change during its next polling cycle (typically every 3-5 minutes).

Flux pulls the updated repository and dynamically executes the deployment. If a malicious actor gains node access and manually deletes a deployment utilizing kubectl delete, Flux detects that the cluster state no longer matches the Git state and instantly reinstalls the deployment, ensuring mathematical immutability. By combining Azure Arc with Flux, enterprises achieve true, zero-touch, globally synchronized infrastructure management.