ServerMind for Kubernetes/GitOps & Helm

GitOps & Helm

Deliver from git or an OCI artifact with a GitOps engine built into the agent, with nothing extra to install on your clusters. Install Helm charts rendered on the hub, so clusters never need to reach a chart repository.

No Argo · no Flux

How Delivery Works

Pulled by the agent

Each target cluster’s agent does a shallow fetch from git over HTTPS or pulls an OCI artifact. The hub never clones.

Rendered in place

Kustomize, a Helm chart in the repo, or plain multi-document YAML. SOPS files are decrypted with age keys held on the cluster.

Applied and pruned

Server-side apply, with ApplySet pruning that runs only when every apply succeeded. Drift correction is on by default.

Tracked per commit

The agent reports the exact commit SHA and health per target. Rollback pins a commit from the repository’s own sync history.

Fan-Out Across Clusters

  • Generators: list, clusters, git directories, git files, matrix and merge
  • ApplicationSet parameter names, such as path.basename and label.<key>
  • A target that stops matching is retired, not torn down
  • Projects limit which repos, clusters and namespaces a record may use; one forbidden destination parks the whole record
  • Tenant-authored records cannot apply Secrets, RBAC or privileged workloads

Sync Gates

Checked on the hub before a sync is sent. Each gate warns or blocks.

Max deletionsPreviewed prune count
Forbidden namespacesNamespaces the sync may not touch
Policy severityOpen PolicyReports at or above a level
Image severityKnown vulnerabilities in the images
Upgrade readyCluster mid-upgrade or failing its readiness scan

Familiar Controls

  • Sync waves and hooks: Argo CD annotations and helm.sh/hook mapped to PreSync, Sync and PostSync
  • ignoreDifferences by JSON pointer or by field manager, so an HPA can own replicas
  • Sync options including RespectIgnoreDifferences, Replace, ApplyOutOfSyncOnly, FailOnSharedResource and PruneLast
  • Sync windows with deny and allow rules on a UTC cron schedule
  • Push webhooks from GitHub, GitLab and Bitbucket, with signature checks and replay protection
  • Hydration renders the source and opens a GitHub pull request or GitLab merge request
  • Image automation selects new tags and commits them back to git
  • Polls every 60 seconds by default, or on a per-repository interval

Helm Catalog & Releases

CatalogAdd HTTP chart repositories once. The hub fetches the index and charts, so clusters need no access to the repository.
RenderUpstream helm template runs on the hub, and the rendered manifests are checked before anything is sent
InstallServer-side apply on the cluster. The agent writes a standard Helm release Secret, so helm history still works.
Failed installObjects created by the failed install are removed again
UpgradeBumps the revision. A failed upgrade leaves objects in place rather than causing an outage.
RollbackRe-applies a stored revision as a new revision, with no re-render
GuardrailCharts that contain Secrets, RBAC or privileged workloads need an admin

Already running Argo CD or Flux? The agent reports their Applications, Kustomizations and HelmReleases alongside ServerMind’s own.

← Workloads & Live OperationsUpgrades & Lifecycle →