blog/2025/03/10/how-to-setup-preview-environments-with-fluxcd-in-kubernetes/

[giscus[bot]]

blog/2025/03/10/how-to-setup-preview-environments-with-fluxcd-in-kubernetes/

Set up GitOps-driven preview environments in Kubernetes using FluxCD. Automatically deploy and comment URLs on GitHub pull requests.

https://developer-friendly.blog/blog/2025/03/10/how-to-setup-preview-environments-with-fluxcd-in-kubernetes/

[HeikoOnnebrink]

Hi
did you manage to set this up without using PAT?
I am using ArgoCD on AKS where ArgoCD repo server connects to ADO repo using workload identity.
When I wanted to use ArgoCD Application sets for preview deployments I got stuck as it seems not to support workload identity.
Now I am looking for alternatives like Flux and would be willing to replace the ArgoCD stack if it gives me required features like described here, but it must all leverage Workload Identity for modern auth. Using PAT is no option for me..
cheers
Heiko

[meysam81]

Hey @HeikoOnnebrink

Yes, Workload Identity is supported by the flux operator.

The revised code will look like this:

  apiVersion: fluxcd.controlplane.io/v1
  kind: ResourceSetInputProvider
  metadata:                                                
    name: preview-deployments                              
    namespace: staging
  spec:                                                    
    type: AzureDevOpsPullRequest
    url: https://dev.azure.com/<org>/<project>/_git/<repo>
    serviceAccountName: ado-reader # federated with the Entra identity; omit to use the operator's SA
    filter:
      labels:                                              
        - preview                                          
  ---                                                      
  # inside the ResourceSet, per PR                     
  apiVersion: source.toolkit.fluxcd.io/v1
  kind: GitRepository
  spec:                                                    
    provider: azure                                        
    serviceAccountName: ado-reader # needs cluster.objectLevelWorkloadIdentity: true
    url: https://dev.azure.com/<org>/<project>/_git/<repo>
    ref:                                                   
      commit: << inputs.sha >>

[HeikoOnnebrink]

thx for quick feedback... seems I will need to move to FluxCD. ArgoCD is stuck for too long time on supporting Workload Identity for ArgoCD Application Sets, reading Helm from OCI repo etc..
FluxCD seems to be more mature here and covers all areas from regular deployments, preview environments and allows future migration to GitLess OCI backed setup ..

[meysam81]

Yeah I have experience with both in production setups

Fluxcd is the mature solution for sure... I have always felt that Fluxcd is more ergonomic, more aligned with declarative definition... more k8s friendly

Argocd is clumsy in its implementation IMHO... it doesn't give me what I want

Fluxcd is a perfect fit for GitOps... I can't recommend it enough honestly