Resolved

Kustomize namespace override prevents OCIRepository creation in FluxCD

Kubernetes
FluxCD
GitOps
Kustomize
OCI
Helm
DevOps
Configuration

FluxCD OCIRepository resources fail to appear in flux-system namespace when Kustomize applies top-level namespace override | Root cause and architectural pattern for proper GitOps resource organization

Resolving OCIRepository Namespace Conflicts in Kustomize and FluxCD

Issue

OCIRepository resources in Kubernetes, which define chart sources for FluxCD, were not appearing in the expected flux-system namespace. Despite explicit namespace declarations in the YAML configuration, these resources were being incorrectly deployed to a different namespace due to Kustomize’s namespace override behavior. This prevented FluxCD’s source-controller from accessing the resources, blocking HelmRelease operations.

Culprit

Kustomize’s top-level namespace declaration in kustomization.yaml was overriding all resource namespaces, including OCIRepository resources. FluxCD enforces that chart sources must reside in the flux-system namespace, where the source-controller operates. When Kustomize forced the OCIRepository into a different namespace (e.g., redis-system), the resource became inaccessible to the controller, causing deployment failures.

Solution

Centralized Chart Sources Pattern

Restructured the resource organization to:

  1. Isolate chart sources (OCIRepository, HelmRepository) in a dedicated file within the flux-system namespace, ensuring they are not affected by Kustomize namespace overrides.
  2. Reference shared sources across clusters using relative paths in the main Kustomization file.
  3. Remove conflicting namespace declarations from application-specific Kustomizations to avoid unintended overrides.

Outcome: OCIRepository resources are now correctly deployed in the flux-system namespace, enabling FluxCD to manage Helm charts and deploy applications successfully across namespaced environments.