Skip to main content
Version: 0.16.0

Installing Weave GitOps Enterpriseenterprise

Weave GitOps Enterprise (WGE) provides ops teams with an easy way to assess the health of multiple clusters in a single place. It shows cluster information such as Kubernetes version and number of nodes and provides details about the GitOps operations on those clusters, such as Git repositories and recent commits. Additionally, it aggregates Prometheus alerts to assist with troubleshooting.

To purchase entitlement to Weave GitOps Enterprise please contact


There is no need to install Weave GitOps (OSS) before installing Weave GitOps Enterprise

To install Weave GitOps Enterprise

1. Set up a Management Cluster with flux

To get you started in this document we'll cover:

  • kind as our management cluster with the CAPD provider
  • EKS as our management cluster with the CAPA provider

However Weave GitOps Enterprise supports any combination of management cluster and CAPI provider.

1.1 We start with creating a kind-config.
kind: Cluster
- role: control-plane
- hostPath: /var/run/docker.sock
containerPath: /var/run/docker.sock

The extraMounts are for the Docker CAPI provider (CAPD) to be able to talk to the host docker

1.2 Start your kind cluster using the configuration above and Kubernetes v1.23.6
kind create cluster --config kind-config.yaml --image=kindest/node:v1.23.6
Install Flux onto your cluster with the flux bootstrap command.
flux bootstrap github \
--owner=<github username> \
--repository=fleet-infra \
--branch=main \
--path=./clusters/management \
  • owner - The username (or organization) of the git repository
  • repository - Git repository name
  • branch - Git branch (default "main")
  • path - path relative to the repository root, when specified the cluster sync will be scoped to this path
  • personal - if set, the owner is assumed to be a repo user

More information about flux and the flux bootstrap command can be found here

At this point a few things have occurred:
  • Your Flux management cluster is now running
  • A new git repo was created based on the parameters you set in the flux bootstrap command. Take a look at your repositories.

2. Install a CAPI provider

clusterctl versions

The example templates provided in this guide have been tested with clusterctl version 1.1.3. However you might need to use an older or newer version depending on the capi-providers you plan on using.

Download a specific version of clusterctl from the releases page.

In order to be able to provision Kubernetes clusters, a CAPI provider needs to be installed. See Cluster API Providers page for more details on providers. Here we'll continue with our example instructions for CAPD and CAPA.

# Enable support for `ClusterResourceSet`s for automatically installing CNIs

clusterctl init --infrastructure docker

3. Apply the entitlements secret

Contact for a valid entitlements secret. Then apply it to the cluster:

kubectl apply -f entitlements.yaml

4. Configure access for writing to git from the UI

GitHub requires no additional configuration for OAuth git access

5. Configure and commit

We deploy WGE via a Helm chart. We'll save and adapt the below template, before committing it to git to a flux-reconciled path.

Clone the newly created repo locally as we're gonna add some things!

git clone git@<provider>:<username>/fleet-infra
cd fleet-infra

Download the helm-release to clusters/management/weave-gitops-enterprise.yaml and tweak:

kind: HelmRepository
name: weave-gitops-enterprise-charts
namespace: flux-system
interval: 60m
name: weave-gitops-enterprise-credentials
kind: HelmRelease
name: weave-gitops-enterprise
namespace: flux-system
interval: 65m
chart: mccp
kind: HelmRepository
name: weave-gitops-enterprise-charts
namespace: flux-system
version: 0.12.0
crds: CreateReplace
crds: CreateReplace
interval: 50m
# -- Configure TLS settings if needed
# tls:
# -- Can be disabled if TLS is handled by a user-provided ingress controller
# enabled: true
# -- optionally specify a TLS secret
# secretName: null
# -- Can be changed depending on your git repo structure
# repositoryPath: ./clusters/management/clusters
# repositoryClustersPath: ./cluster
type: github
# -- Change if using on-prem github/gitlab
# hostname:


Ensure this has been set to your repository URL.


By default, WGE will create new clusters in the clusters/management/clusters path. This can be configured with values.config.capi.repositoryPath. For example you might what to change it to clusters/my-cluster/cluster if you configured flux to reconcile ./clusters/my-cluster instead.


The other important path to configure is where applications and workloads that will be run on the new cluster will be stored. By default this is ./clusters. When a new cluster is specified any profiles that have been selected will be written to ./clusters/{.namespace}/{.clusterName}/profiles.yaml. When the new cluster is bootstrapped, flux will be sync the ./clusters/{.namespace}/{.clusterName} path.

(Optional) Install policy agent

Policy agent comes packaged with the WGE chart. To install it you need to set the following values:

  • values.policy-agent.enabled: set to true to install the agent with WGE
  • values.policy-agent.config.accountId: organization name, used as identifier
  • values.policy-agent.config.clusterId: unique identifier for the cluster

Commit and push all the files

git add clusters/management/weave-gitops-enterprise.yaml
git commit -m "Deploy Weave GitOps Enterprise"
git push

Flux will reconcile the helm-release and WGE will be deployed into the cluster. You can check the flux-system namespace to verify all pods are running.

6. Configure password

In order to login to the WGE UI, you need to generate a bcrypt hash for your chosen password and store it as a secret in the Kubernetes cluster.

There are several different ways to generate a bcrypt hash, this guide uses gitops get bcrypt-hash from our CLI, which can be installed by following the instructions here.

PASSWORD="<your password>"
echo -n $PASSWORD | gitops get bcrypt-hash

Use the hashed output to create a Kubernetes username/password secret.

kubectl create secret generic cluster-user-auth \
--namespace flux-system \
--from-literal=username=wego-admin \

Install CLI

Install the Weave GitOps Enterprise CLI tool. You can use brew or curl

brew install weaveworks/tap/gitops-ee
curl --silent --location "$(uname | tr '[:upper:]' '[:lower:]')-$(uname -m).tar.gz" | tar xz -C /tmp
sudo mv /tmp/gitops /usr/local/bin
gitops version

Next steps

In our following Get Started document, we will walk you through logging into the GitOps Dashboard and deploying an application.

Then you can head over to either:

(Optional) Install the TF-Controller

The TF-Controller is a controller for Flux to reconcile Terraform resources in a GitOps way.

With Flux and the TF-Controller, Weave GitOps Enterprise makes it easy to add Terraform templates to clusters and continuously reconcile any changes made to the Terraform source manifest.

Check out our guide on how to use Terraform templates, and why not try your hands at using it with the RDS example!

Install the TF-Controller to a cluster using Helm:

# Add tf-controller helm repository
helm repo add tf-controller

# Install tf-controller
helm upgrade -i tf-controller tf-controller/tf-controller \
--namespace flux-system

Consult the TF-Controller Installation documentation for more details on which parameters are configurable and how to install a specific version.