You know the feeling. The deploy pipeline is green, but approvals are stuck in Phabricator limbo. FluxCD waits patiently for its next sync while developers slam refresh and curse permissions. This is where pairing FluxCD with Phabricator stops being a nice-to-have and starts feeling mandatory.
FluxCD handles your cluster state like a disciplined accountant, reconciling manifests, images, and policies until everything matches the desired spec. Phabricator tracks code reviews, tasks, and approvals across teams. Used together, they create a workflow that actually reflects reality—code that’s reviewed, merged, and deployed based on explicit, traceable intent.
Here’s the logic of the integration. FluxCD listens for changes in Git. Phabricator provides structured review signals and metadata for those changes. A sync job connects the two, often through webhooks or commit annotations that reflect approved revisions. The result is simple: once a diff passes review in Phabricator, FluxCD’s automation picks it up and reconciles it into the environment. No manual step, no copy-paste between chat messages and YAML files.
How do I connect FluxCD and Phabricator?
Map your Phabricator repository triggers to a FluxCD source. Use the Phabricator Herald rules to notify Flux controllers on commit approval. Then align identity through OIDC or an access proxy like Okta or GitHub Actions for traceable audit entries. The main goal is consistent identity: the same user who reviewed should be the identity FluxCD sees when performing the deploy.
Best practices center on access mapping. Tie RBAC roles in Kubernetes to Phabricator users so permissions mirror review responsibility. Rotate tokens as you would any service account under AWS IAM or SOC 2 compliance. Treat webhook secrets like deploy credentials—short-lived, versioned, and revocable.