Flux Files

Highlights

Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.

Overview of the new features:

• Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
• SPIFFE mTLS for inter-controller communication
• Notification Event, Alert and Provider APIs promoted to v1
• OCIRepository as a chart source for HelmRelease
• SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
• Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
• Flux artifact storage backend enabled by default for ImageRepository tags
• Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
• New Zoom, incident.io and Mastodon notification providers
• Built with Kubernetes 1.37 and Go 1.27

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

[!NOTE] Note that the Flux project offers support only for the latest three minor versions of Kubernetes. Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ Breaking changes in this release:

• Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See [#6139] for the required ClusterRole and ClusterRoleBinding.
• The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
• The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
• Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog

• source-controller v1.10.1
• kustomize-controller v1.10.1
• notification-controller v1.10.0
• helm-controller v1.7.1
• image-reflector-controller v1.3.0
• image-automation-controller v1.3.0
• source-watcher v2.3.1

CLI changelog

• Add backport label for 2.9 by @matheuscscp in https://github.com/fluxcd/flux2/pull/5970
• Fix breaking change in-memory kustomization build by @matheuscscp in https://github.com/fluxcd/flux2/pull/5969
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5976
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5978
• Add checksum verification for SOPS in e2e workflows by @ivonaest in https://github.com/fluxcd/flux2/pull/5961
• Add --add-ignore-paths flag to artifact commands by @ruslan-shaydullin in https://github.com/fluxcd/flux2/pull/5885
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5983
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5989
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5993
• Include source-watcher to oci flux-manifests by @sergelogvinov in https://github.com/fluxcd/flux2/pull/5995
• docs: fix typo in RFC-0004 (enviornment -> environment) by @mridulagithub in https://github.com/fluxcd/flux2/pull/6002
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6005
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6010
• Add version-file input to the Flux CLI action by @somaz94 in https://github.com/fluxcd/flux2/pull/5975
• Add support for 2.9 in migrate -f by @matheuscscp in https://github.com/fluxcd/flux2/pull/6020
• Fix Azure e2e tests after new major version with breaking changes by @matheuscscp in https://github.com/fluxcd/flux2/pull/6022
• fix: restrict allow-webhooks netpol to receiver port by @stefanprodan in https://github.com/fluxcd/flux2/pull/6028
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6030
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6050
• build(deps): bump the ci group across 1 directory with 19 updates by @dependabot[bot] in https://github.com/fluxcd/flux2/pull/6052
• Format reproducible created timestamp in UTC by @lexfrei in https://github.com/fluxcd/flux2/pull/6074
• Update to Kubernetes 1.37 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6082
• Run conformance tests for Kubernetes 1.37 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6083
• Remove the Cosign v2.6.1 pin by @matheuscscp in https://github.com/fluxcd/flux2/pull/6084
• Add --app-client-id flag to create secret githubapp by @Erik-Schuetze in https://github.com/fluxcd/flux2/pull/6090
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6096
• Match plugin archive entries with a leading ./ by @Saadanjum0 in https://github.com/fluxcd/flux2/pull/6099
• Stop diff processing after an error by @idelchi in https://github.com/fluxcd/flux2/pull/6070
• Respect pruning exclusions in kustomization diff by @idelchi in https://github.com/fluxcd/flux2/pull/6073
• Introduce RBAC for ArtifactGenerator cross-namespace artifacts by @matheuscscp in https://github.com/fluxcd/flux2/pull/6101
• [RFC-0014] Advanced Support for Short-Lived Cryptographic Material by @matheuscscp in https://github.com/fluxcd/flux2/pull/5702
• Validate plugin manifest name by @Arawoof06 in https://github.com/fluxcd/flux2/pull/6104
• ci: disable Replicated conformance tests by @stefanprodan in https://github.com/fluxcd/flux2/pull/6111
• [RFC-0014] RFC refinements by @matheuscscp in https://github.com/fluxcd/flux2/pull/6105
• [RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connection by @matheuscscp in https://github.com/fluxcd/flux2/pull/6114
• Update to Kubernetes 1.37.1 and Go 1.27 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6117
• build(deps): bump the ci group across 1 directory with 15 updates by @dependabot[bot] in https://github.com/fluxcd/flux2/pull/6118
• [RFC-0014] Add rules for missing corner cases by @matheuscscp in https://github.com/fluxcd/flux2/pull/6121
• [RFC-0014] Address final nits arising from apis/crypto implementation by @matheuscscp in https://github.com/fluxcd/flux2/pull/6122
• [RFC-0014] Final iterations for 2.10 by @matheuscscp in https://github.com/fluxcd/flux2/pull/6125
• Revert "Introduce RBAC for ArtifactGenerator cross-namespace artifacts" by @matheuscscp in https://github.com/fluxcd/flux2/pull/6129
• Allow controllers to perform SubjectAccessReview by @matheuscscp in https://github.com/fluxcd/flux2/pull/6132
• Accept TYPE/NAME resource args in get/reconcile by @souvik-biswas-dev in https://github.com/fluxcd/flux2/pull/6134
• Add digests flag to plugin search, which displays SHA values for all os/arch per binary by @datosh in https://github.com/fluxcd/flux2/pull/6016
• Extend kubectl-style resource args to all Flux kinds and commands by @stefanprodan in https://github.com/fluxcd/flux2/pull/6135
• Escape terminal control characters in CLI output by @Arawoof06 in https://github.com/fluxcd/flux2/pull/6110
• Add suspend, resume and reconcile commands for ArtifactGenerator by @xchose in https://github.com/fluxcd/flux2/pull/6119
• [RFC-0014] Address review findings by @matheuscscp in https://github.com/fluxcd/flux2/pull/6136
• [RFC-0014] Inter-controller mTLS via SPIFFE by @matheuscscp in https://github.com/fluxcd/flux2/pull/6127
• Fix proxy bypass in bootstrap --ca-file by @ljluestc in https://github.com/fluxcd/flux2/pull/6038
• use restrictive file modes for generated manifests by @Arawoof06 in https://github.com/fluxcd/flux2/pull/6113
• fix(goreleaser): make Homebrew formula pass brew audit by @trademomentumllc in https://github.com/fluxcd/flux2/pull/5973
• Fix envsubst dropping input on long lines by @stefanprodan in https://github.com/fluxcd/flux2/pull/6138
• fix: return clear error when --private-key-file path starts with '~' by @rafaelperoco in https://github.com/fluxcd/flux2/pull/5859
• Fix stale flags and commands in CLI examples by @rawsun007 in https://github.com/fluxcd/flux2/pull/6123
• Fix typos in user-facing CLI messages and comments by @MsfPablo in https://github.com/fluxcd/flux2/pull/6051
• Remove unused fields from installFlags by @Pranav-error in https://github.com/fluxcd/flux2/pull/6061
• ⚠️ Breaking change: Harden RBAC for controllers by @matheuscscp in https://github.com/fluxcd/flux2/pull/6139
• Fix --in-memory-build restricting disk access by @rycli in https://github.com/fluxcd/flux2/pull/5974
• Update dependencies for Flux 2.10 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6140
• [RFC-0014] Add 2.10 notes to RFC by @matheuscscp in https://github.com/fluxcd/flux2/pull/6145
• fix(create): reject conflicting image policy selectors for every flag pair by @NUAAwqy in https://github.com/fluxcd/flux2/pull/6144
• ci: Update GitHub Actions by @stefanprodan in https://github.com/fluxcd/flux2/pull/6147
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6148
• Add --policy-change-delay to create image update by @stefanprodan in https://github.com/fluxcd/flux2/pull/6146
• [RFC-0014] Remove temporary workarounds for mTLS e2e by @matheuscscp in https://github.com/fluxcd/flux2/pull/6137
• [RFC-0014] Add HTTPS port to controller Services by @stefanprodan in https://github.com/fluxcd/flux2/pull/6149
• [RFC-0014] Include SPIFFE mTLS in the e2e workflow by @stefanprodan in https://github.com/fluxcd/flux2/pull/6150
• ci: fix goreleaser signing with cosign v3 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6151
• Remove unsupported fields in migrate -f by @stefanprodan in https://github.com/fluxcd/flux2/pull/6152
• Bump minimum Kubernetes version to 1.35 by @stefanprodan in https://github.com/fluxcd/flux2/pull/6153
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6154
• Use podinfo in the SPIFFE mTLS e2e test by @stefanprodan in https://github.com/fluxcd/flux2/pull/6156

New Contributors

• @ivonaest made their first contribution in https://github.com/fluxcd/flux2/pull/5961
• @ruslan-shaydullin made their first contribution in https://github.com/fluxcd/flux2/pull/5885
• @sergelogvinov made their first contribution in https://github.com/fluxcd/flux2/pull/5995
• @mridulagithub made their first contribution in https://github.com/fluxcd/flux2/pull/6002
• @somaz94 made their first contribution in https://github.com/fluxcd/flux2/pull/5975
• @lexfrei made their first contribution in https://github.com/fluxcd/flux2/pull/6074
• @Erik-Schuetze made their first contribution in https://github.com/fluxcd/flux2/pull/6090
• @Saadanjum0 made their first contribution in https://github.com/fluxcd/flux2/pull/6099
• @idelchi made their first contribution in https://github.com/fluxcd/flux2/pull/6070
• @Arawoof06 made their first contribution in https://github.com/fluxcd/flux2/pull/6104
• @souvik-biswas-dev made their first contribution in https://github.com/fluxcd/flux2/pull/6134
• @datosh made their first contribution in https://github.com/fluxcd/flux2/pull/6016
• @xchose made their first contribution in https://github.com/fluxcd/flux2/pull/6119
• @ljluestc made their first contribution in https://github.com/fluxcd/flux2/pull/6038
• @trademomentumllc made their first contribution in https://github.com/fluxcd/flux2/pull/5973
• @rawsun007 made their first contribution in https://github.com/fluxcd/flux2/pull/6123
• @MsfPablo made their first contribution in https://github.com/fluxcd/flux2/pull/6051
• @Pranav-error made their first contribution in https://github.com/fluxcd/flux2/pull/6061
• @NUAAwqy made their first contribution in https://github.com/fluxcd/flux2/pull/6144

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.9.6...v2.10.0