Skip to main content
Flux is a focused Azure inventory and FinOps inteylligence workspace — governed evidence, analyzed. It synchronizes Azure Resource Graph, Azure Advisor, Cost Management, Azure Monitor, and LogicMonitor coverage into a locally-embedded DuckDB database, presents your estate through a modern React 19 dashboard, and surfaces explainable optimization opportunities with full source lineage. Built on FastAPI and Pydantic for the backend and React 19 with Vite and Recharts for the frontend, Flux is designed to be deployed as a Linux App Service behind Microsoft Entra ID Easy Auth, giving cloud teams a single, auditable workspace for every FinOps conversation.

​
What Flux collects

Inventory

Azure Resource Graph (ARG) provides paginated, enriched resource snapshots across every configured subscription. Resource records carry cost, utilization, and opportunity enrichment fields alongside the raw ARG JSON.

Cost

Azure Cost Management (actual and amortized) and FOCUS v1.0 cost exports give Flux a governed, checkpointed daily cost history. A 90-day initial backfill runs automatically for each new subscription, with rolling 14-day refreshes thereafter. An automated Cost Details fallback fills checkpointed months when the Query API is unavailable.

Advisor & Signals

Azure Advisor recommendations are collected through ARG, semantically de-duplicated, and corroborated with deterministic Flux Signals findings — versioned rules covering VM state, unattached disks, snapshots, Public IPs, NICs, NAT gateways, storage modernization, and tagging.

Telemetry

Azure Monitor platform metrics and LogicMonitor agent data provide VM CPU, memory, disk, and network observations. Incremental checkpointed collection runs every 30 minutes; all evidence feeds the governed right-sizing model.

​
Product areas

Flux contains ten active areas, each scoped to a specific FinOps or cloud-operations need:

​
Technology stack

  • React 19 + Vite + TypeScript — modular pages, responsive layout, route-level code splitting, Recharts for data visualization, Lucide for icons.
  • FastAPI + Pydantic — typed, async API with interactive docs at /docs; the same FastAPI process serves the built React assets in production.
  • DuckDB 1.4.5 (exact-pinned) — append-only analytical store with current views; all writes serialized through a singleton worker. Stored at data/flux.duckdb by default.
  • Azure Identity — secretless access to Azure Resource Graph, Advisor, and Cost Management via managed identity in App Service or local Azure PowerShell session in development.
  • App Service Authentication — Easy Auth validates Entra ID users and injects X-MS-CLIENT-PRINCIPAL; Flux decodes roles without touching tokens directly.

​
Identity model

Flux uses two independent identities that never need to share a credential: People authenticate with Microsoft Entra ID. App Service Authentication (Easy Auth) validates the user and injects the X-MS-CLIENT-PRINCIPAL claims payload. Flux decodes it and maps Entra app-role values or group object IDs to internal reader and admin roles. The default role values are Flux.Reader and Flux.Admin. Flux authenticates to Azure with managed identity. The application obtains a management token without any client secret and queries Azure Resource Graph, Advisor, and Cost Management for explicitly configured subscriptions. In development, the local Azure PowerShell session (Connect-AzAccount) plays the same role. Group object IDs can be substituted for app-role values through FLUX_ENTRA_ADMIN_ASSIGNMENTS and FLUX_ENTRA_READER_ASSIGNMENTS. Local development defaults to a mock administrator — FLUX_AUTH_MODE=mock — without requiring any Entra configuration.

​
Maturity

Flux is currently a focused internal alpha. Core platform areas — inventory, Cost Management, Advisor, Entra authorization, managed identity, synchronization operations, DuckDB model, and backup — are at Beta maturity. Forward-facing areas such as Flux Intelligence (Ask Flux), LogicMonitor, multi-source right-sizing, native reporting, inventory drift, and Azure Monitor are at Alpha maturity. Before production deployment, you must configure and validate Easy Auth, app-role assignments, managed identity RBAC, subscription scope, and operational health notifications. See the production gaps checklist in the README before going live.