fluxcd/flux2 v2.10.0 on GitHub

Highlights

Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.

Overview of the new features:

Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
SPIFFE mTLS for inter-controller communication
Notification Event, Alert and Provider APIs promoted to v1
OCIRepository as a chart source for HelmRelease
SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
Flux artifact storage backend enabled by default for ImageRepository tags
Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
New Zoom, incident.io and Mastodon notification providers
Built with Kubernetes 1.37 and Go 1.27

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
`v1.35`	`>= 1.35.2`
`v1.36`	`>= 1.36.1`
`v1.37`	`>= 1.37.0`

Note

Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ Breaking changes in this release:

Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog

source-controller v1.10.1
kustomize-controller v1.10.1
notification-controller v1.10.0
helm-controller v1.7.1
image-reflector-controller v1.3.0
image-automation-controller v1.3.0
source-watcher v2.3.1

CLI changelog

Add backport label for 2.9 by @matheuscscp in #5970
Fix breaking change in-memory kustomization build by @matheuscscp in #5969
Update fluxcd/pkg dependencies by @fluxcdbot in #5976
Update toolkit components by @fluxcdbot in #5978
Add checksum verification for SOPS in e2e workflows by @ivonaest in #5961
Add --add-ignore-paths flag to artifact commands by @ruslan-shaydullin in #5885
Update fluxcd/pkg dependencies by @fluxcdbot in #5983
Update fluxcd/pkg dependencies by @fluxcdbot in #5989
Update toolkit components by @fluxcdbot in #5993
Include source-watcher to oci flux-manifests by @sergelogvinov in #5995
docs: fix typo in RFC-0004 (enviornment -> environment) by @mridulagithub in #6002
Update fluxcd/pkg dependencies by @fluxcdbot in #6005
Update toolkit components by @fluxcdbot in #6010
Add version-file input to the Flux CLI action by @somaz94 in #5975
Add support for 2.9 in migrate -f by @matheuscscp in #6020
Fix Azure e2e tests after new major version with breaking changes by @matheuscscp in #6022
fix: restrict allow-webhooks netpol to receiver port by @stefanprodan in #6028
Update toolkit components by @fluxcdbot in #6030
Update toolkit components by @fluxcdbot in #6050
build(deps): bump the ci group across 1 directory with 19 updates by @dependabot[bot] in #6052
Format reproducible created timestamp in UTC by @lexfrei in #6074
Update to Kubernetes 1.37 by @stefanprodan in #6082
Run conformance tests for Kubernetes 1.37 by @stefanprodan in #6083
Remove the Cosign v2.6.1 pin by @matheuscscp in #6084
Add --app-client-id flag to create secret githubapp by @Erik-Schuetze in #6090
Update toolkit components by @fluxcdbot in #6096
Match plugin archive entries with a leading ./ by @Saadanjum0 in #6099
Stop diff processing after an error by @idelchi in #6070
Respect pruning exclusions in kustomization diff by @idelchi in #6073
Introduce RBAC for ArtifactGenerator cross-namespace artifacts by @matheuscscp in #6101
[RFC-0014] Advanced Support for Short-Lived Cryptographic Material by @matheuscscp in #5702
Validate plugin manifest name by @Arawoof06 in #6104
ci: disable Replicated conformance tests by @stefanprodan in #6111
[RFC-0014] RFC refinements by @matheuscscp in #6105
[RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connection by @matheuscscp in #6114
Update to Kubernetes 1.37.1 and Go 1.27 by @stefanprodan in #6117
build(deps): bump the ci group across 1 directory with 15 updates by @dependabot[bot] in #6118
[RFC-0014] Add rules for missing corner cases by @matheuscscp in #6121
[RFC-0014] Address final nits arising from apis/crypto implementation by @matheuscscp in #6122
[RFC-0014] Final iterations for 2.10 by @matheuscscp in #6125
Revert "Introduce RBAC for ArtifactGenerator cross-namespace artifacts" by @matheuscscp in #6129
Allow controllers to perform SubjectAccessReview by @matheuscscp in #6132
Accept TYPE/NAME resource args in get/reconcile by @souvik-biswas-dev in #6134
Add digests flag to plugin search, which displays SHA values for all os/arch per binary by @datosh in #6016
Extend kubectl-style resource args to all Flux kinds and commands by @stefanprodan in #6135
Escape terminal control characters in CLI output by @Arawoof06 in #6110
Add suspend, resume and reconcile commands for ArtifactGenerator by @xchose in #6119
[RFC-0014] Address review findings by @matheuscscp in #6136
[RFC-0014] Inter-controller mTLS via SPIFFE by @matheuscscp in #6127
Fix proxy bypass in bootstrap --ca-file by @ljluestc in #6038
use restrictive file modes for generated manifests by @Arawoof06 in #6113
fix(goreleaser): make Homebrew formula pass brew audit by @trademomentumllc in #5973
Fix envsubst dropping input on long lines by @stefanprodan in #6138
fix: return clear error when --private-key-file path starts with '~' by @rafaelperoco in #5859
Fix stale flags and commands in CLI examples by @rawsun007 in #6123
Fix typos in user-facing CLI messages and comments by @MsfPablo in #6051
Remove unused fields from installFlags by @Pranav-error in #6061
⚠️ Breaking change: Harden RBAC for controllers by @matheuscscp in #6139
Fix --in-memory-build restricting disk access by @rycli in #5974
Update dependencies for Flux 2.10 by @stefanprodan in #6140
[RFC-0014] Add 2.10 notes to RFC by @matheuscscp in #6145
fix(create): reject conflicting image policy selectors for every flag pair by @NUAAwqy in #6144
ci: Update GitHub Actions by @stefanprodan in #6147
Update toolkit components by @fluxcdbot in #6148
Add --policy-change-delay to create image update by @stefanprodan in #6146
[RFC-0014] Remove temporary workarounds for mTLS e2e by @matheuscscp in #6137
[RFC-0014] Add HTTPS port to controller Services by @stefanprodan in #6149
[RFC-0014] Include SPIFFE mTLS in the e2e workflow by @stefanprodan in #6150
ci: fix goreleaser signing with cosign v3 by @stefanprodan in #6151
Remove unsupported fields in migrate -f by @stefanprodan in #6152
Bump minimum Kubernetes version to 1.35 by @stefanprodan in #6153
Update toolkit components by @fluxcdbot in #6154
Use podinfo in the SPIFFE mTLS e2e test by @stefanprodan in #6156

New Contributors

@ivonaest made their first contribution in #5961
@ruslan-shaydullin made their first contribution in #5885
@sergelogvinov made their first contribution in #5995
@mridulagithub made their first contribution in #6002
@somaz94 made their first contribution in #5975
@lexfrei made their first contribution in #6074
@Erik-Schuetze made their first contribution in #6090
@Saadanjum0 made their first contribution in #6099
@idelchi made their first contribution in #6070
@Arawoof06 made their first contribution in #6104
@souvik-biswas-dev made their first contribution in #6134
@datosh made their first contribution in #6016
@xchose made their first contribution in #6119
@ljluestc made their first contribution in #6038
@trademomentumllc made their first contribution in #5973
@rawsun007 made their first contribution in #6123
@MsfPablo made their first contribution in #6051
@Pranav-error made their first contribution in #6061
@NUAAwqy made their first contribution in #6144

Full Changelog: v2.9.6...v2.10.0