Will Flux reconcile this repo, and is it safe to merge?
Paste or drop the Flux manifests of your GitOps repo - the clusters/ entry points, the
Kustomizations, HelmReleases and sources, the tenants. Your browser reads every document and checks it:
Flux APIs that 2.7 and 2.8 removed, fields the CRDs require, dependsOn
cycles, sources of the wrong kind - and the dangerous ones: plaintext Secrets and credentials in
Git, insecure: true, cluster-admin for a tenant, cross-namespace sources,
prune: false, charts on *, image automation pushing straight to main. Free,
before you sign in, and nothing is uploaded. Then pick a lane: the audit writes the
corrected document for each finding and the flux migrate steps, or the fix
returns the corrected documents - and the page re-checks them before you trust them.
The companies, repos and values in the examples are invented. The first three are audits (the first also carries a saved fix, one click after the audit), the last two fixes; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The audit classifies the repo, confirms or dismisses every flag below, adds what rules cannot see, gives the corrected document for each finding, the flux migrate steps and what each applier reconciles.
What this does, and what it does not
The check is a reading of the text, not a cluster: nothing talks to Kubernetes, to Flux or to your Git
host, and there is no flux-schema validation or kustomize build. Every document is read with its line
numbers, named as Kind/name, and each flag carries the catalogue id it comes from and the
line it points at. Checks only see what you paste: a source or dependency defined in a file you did not
paste is noted, not reported as missing. The Flux version on the cluster, whether a repo is private and
what a chart's values do are outside the paste - the lanes ask rather than assume.
The paid lanes see your paste and the page's facts. Every quote, line and fix they return is checked against your paste, every fix and the corrected documents are put back and re-checked, and a reply that repeats a secret from your paste is called out. A paste stays in this browser unless you run a lane - and if the free check finds a secret in it, rotate that secret whatever you do next. Derived from the agent skill @fluxcd/gitops-repo-audit by the Flux CD maintainers (fluxcd/agent-skills, Apache-2.0). Sources are listed in llms.txt.