flux2

Highlights

Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.

Overview of the new features:

• Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
• SPIFFE mTLS for inter-controller communication
• Notification Event, Alert and Provider APIs promoted to v1
• OCIRepository as a chart source for HelmRelease
• SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
• Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
• Flux artifact storage backend enabled by default for ImageRepository tags
• Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
• New Zoom, incident.io and Mastodon notification providers
• Built with Kubernetes 1.37 and Go 1.27

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

| Kubernetes version | Minimum required |

|--------------------|------------------|

| v1.35 | >= 1.35.2 |

| v1.36 | >= 1.36.1 |

| v1.37 | >= 1.37.0 |

> [!NOTE]

> Note that the Flux project offers support only for the latest three minor versions of Kubernetes.

> Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as

> ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ Breaking changes in this release:

• Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
• The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
• The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
• Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog

• source-controller v1.10.1
• kustomize-controller v1.10.1
• notification-controller v1.10.0
• helm-controller v1.7.1
• image-reflector-controller v1.3.0
• image-automation-controller v1.3.0
• source-watcher v2.3.1

CLI changelog

• Add backport label for 2.9 by @matheuscscp in https://github.com/fluxcd/flux2/pull/5970
• Fix breaking change in-memory kustomization build by @matheuscscp in https://github.com/fluxcd/flux2/pull/5969
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5976
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5978
• Add checksum verification for SOPS in e2e workflows by @ivonaest in https://github.com/fluxcd/flux2/pull/5961
• Add --add-ignore-paths flag to artifact commands by @ruslan-shaydullin in https://github.com/fluxcd/flux2/pull/5885
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5983
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5989
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5993
• Include source-watcher to oci flux-manifests by @sergelogvinov in https://github.com/fluxcd/flux2/pull/5995
• docs: fix typo in RFC-0004 (enviornment -> environment) by @mridulagithub in https://github.com/fluxcd/flux2/pull/6002
• Update fluxcd/pkg dependencies by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6005
• Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/6010
• Add version-file input to the Flux CLI action by @somaz94 in https://github.com/fluxcd/flux2/pull/5975
• Add support for 2.9 in migrate -f by @matheuscscp in https://github.com/fluxcd/flux2/pull/6020
• Fix Azure e2e tests after new major version with breaking changes by @matheuscscp in https://github.com/fluxcd/flux2/pull/6022
• fix: restrict allow-webhooks netpol to receiver port by @stefanprodan in https://github.com/fluxcd/flux2/pull/6028