[renovate]

This PR contains the following updates:

Package	Update	Change
fluxcd/flux2	minor	v2.9.5 → v2.10.0

---

Release Notes

fluxcd/flux2

v2.10.0

Compare Source

Highlights

Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.

Overview of the new features:

• Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
• SPIFFE mTLS for inter-controller communication
• Notification Event, Alert and Provider APIs promoted to v1
• OCIRepository as a chart source for HelmRelease
• SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
• Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
• Flux artifact storage backend enabled by default for ImageRepository tags
• Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
• New Zoom, incident.io and Mastodon notification providers
• Built with Kubernetes 1.37 and Go 1.27

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
v1.35	>= 1.35.2
v1.36	>= 1.36.1
v1.37	>= 1.37.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ Breaking changes in this release:

• Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
• The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
• The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
• Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog

• source-controller v1.10.1
• kustomize-controller v1.10.1
• notification-controller v1.10.0
• helm-controller v1.7.1
• image-reflector-controller v1.3.0
• image-automation-controller v1.3.0
• source-watcher v2.3.1

CLI changelog

• Add backport label for 2.9 by @​matheuscscp in #​5970
• Fix breaking change in-memory kustomization build by @​matheuscscp in #​5969
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5976
• Update toolkit components by @​fluxcdbot in #​5978
• Add checksum verification for SOPS in e2e workflows by @​ivonaest in #​5961
• Add --add-ignore-paths flag to artifact commands by @​ruslan-shaydullin in #​5885
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5983
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5989
• Update toolkit components by @​fluxcdbot in #​5993
• Include source-watcher to oci flux-manifests by @​sergelogvinov in #​5995
• docs: fix typo in RFC-0004 (enviornment -> environment) by @​mridulagithub in #​6002
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​6005
• Update toolkit components by @​fluxcdbot in #​6010
• Add version-file input to the Flux CLI action by @​somaz94 in #​5975
• Add support for 2.9 in migrate -f by @​matheuscscp in #​6020
• Fix Azure e2e tests after new major version with breaking changes by @​matheuscscp in #​6022
• fix: restrict allow-webhooks netpol to receiver port by @​stefanprodan in #​6028
• Update toolkit components by @​fluxcdbot in #​6030
• Update toolkit components by @​fluxcdbot in #​6050
• build(deps): bump the ci group across 1 directory with 19 updates by @​dependabot[bot] in #​6052
• Format reproducible created timestamp in UTC by @​lexfrei in #​6074
• Update to Kubernetes 1.37 by @​stefanprodan in #​6082
• Run conformance tests for Kubernetes 1.37 by @​stefanprodan in #​6083
• Remove the Cosign v2.6.1 pin by @​matheuscscp in #​6084
• Add --app-client-id flag to create secret githubapp by @​Erik-Schuetze in #​6090
• Update toolkit components by @​fluxcdbot in #​6096
• Match plugin archive entries with a leading ./ by @​Saadanjum0 in #​6099
• Stop diff processing after an error by @​idelchi in #​6070
• Respect pruning exclusions in kustomization diff by @​idelchi in #​6073
• Introduce RBAC for ArtifactGenerator cross-namespace artifacts by @​matheuscscp in #​6101
• [RFC-0014] Advanced Support for Short-Lived Cryptographic Material by @​matheuscscp in #​5702
• Validate plugin manifest name by @​Arawoof06 in #​6104
• ci: disable Replicated conformance tests by @​stefanprodan in #​6111
• [RFC-0014] RFC refinements by @​matheuscscp in #​6105
• [RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connection by @​matheuscscp in #​6114
• Update to Kubernetes 1.37.1 and Go 1.27 by @​stefanprodan in #​6117
• build(deps): bump the ci group across 1 directory with 15 updates by @​dependabot[bot] in #​6118
• [RFC-0014] Add rules for missing corner cases by @​matheuscscp in #​6121
• [RFC-0014] Address final nits arising from apis/crypto implementation by @​matheuscscp in #​6122
• [RFC-0014] Final iterations for 2.10 by @​matheuscscp in #​6125
• Revert "Introduce RBAC for ArtifactGenerator cross-namespace artifacts" by @​matheuscscp in #​6129
• Allow controllers to perform SubjectAccessReview by @​matheuscscp in #​6132
• Accept TYPE/NAME resource args in get/reconcile by @​souvik-biswas-dev in #​6134
• Add digests flag to plugin search, which displays SHA values for all os/arch per binary by @​datosh in #​6016
• Extend kubectl-style resource args to all Flux kinds and commands by @​stefanprodan in #​6135
• Escape terminal control characters in CLI output by @​Arawoof06 in #​6110
• Add suspend, resume and reconcile commands for ArtifactGenerator by @​xchose in #​6119
• [RFC-0014] Address review findings by @​matheuscscp in #​6136
• [RFC-0014] Inter-controller mTLS via SPIFFE by @​matheuscscp in #​6127
• Fix proxy bypass in bootstrap --ca-file by @​ljluestc in #​6038
• use restrictive file modes for generated manifests by @​Arawoof06 in #​6113
• fix(goreleaser): make Homebrew formula pass brew audit by @​trademomentumllc in #​5973
• Fix envsubst dropping input on long lines by @​stefanprodan in #​6138
• fix: return clear error when --private-key-file path starts with '~' by @​rafaelperoco in #​5859
• Fix stale flags and commands in CLI examples by @​rawsun007 in #​6123
• Fix typos in user-facing CLI messages and comments by @​MsfPablo in #​6051
• Remove unused fields from installFlags by @​Pranav-error in #​6061
• ⚠️ Breaking change: Harden RBAC for controllers by @​matheuscscp in #​6139
• Fix --in-memory-build restricting disk access by @​rycli in #​5974
• Update dependencies for Flux 2.10 by @​stefanprodan in #​6140
• [RFC-0014] Add 2.10 notes to RFC by @​matheuscscp in #​6145
• fix(create): reject conflicting image policy selectors for every flag pair by @​NUAAwqy in #​6144
• ci: Update GitHub Actions by @​stefanprodan in #​6147
• Update toolkit components by @​fluxcdbot in #​6148
• Add --policy-change-delay to create image update by @​stefanprodan in #​6146
• [RFC-0014] Remove temporary workarounds for mTLS e2e by @​matheuscscp in #​6137
• [RFC-0014] Add HTTPS port to controller Services by @​stefanprodan in #​6149
• [RFC-0014] Include SPIFFE mTLS in the e2e workflow by @​stefanprodan in #​6150
• ci: fix goreleaser signing with cosign v3 by @​stefanprodan in #​6151
• Remove unsupported fields in migrate -f by @​stefanprodan in #​6152
• Bump minimum Kubernetes version to 1.35 by @​stefanprodan in #​6153
• Update toolkit components by @​fluxcdbot in #​6154
• Use podinfo in the SPIFFE mTLS e2e test by @​stefanprodan in #​6156

New Contributors

• @​ivonaest made their first contribution in #​5961
• @​ruslan-shaydullin made their first contribution in #​5885
• @​sergelogvinov made their first contribution in #​5995
• @​mridulagithub made their first contribution in #​6002
• @​somaz94 made their first contribution in #​5975
• @​lexfrei made their first contribution in #​6074
• @​Erik-Schuetze made their first contribution in #​6090
• @​Saadanjum0 made their first contribution in #​6099
• @​idelchi made their first contribution in #​6070
• @​Arawoof06 made their first contribution in #​6104
• @​souvik-biswas-dev made their first contribution in #​6134
• @​datosh made their first contribution in #​6016
• @​xchose made their first contribution in #​6119
• @​ljluestc made their first contribution in #​6038
• @​trademomentumllc made their first contribution in #​5973
• @​rawsun007 made their first contribution in #​6123
• @​MsfPablo made their first contribution in #​6051
• @​Pranav-error made their first contribution in #​6061
• @​NUAAwqy made their first contribution in #​6144

Full Changelog: fluxcd/flux2@v2.9.6...v2.10.0

v2.9.6

Compare Source

Highlights

Flux v2.9.6 is a patch release that stops helm-controller from reapplying chart CRDs on every upgrade when server-side apply is enabled, and recovers HelmReleases left with a drifted Ready=Unknown condition after a failed status patch. source-controller normalizes Azure Blob listing ETags so unchanged containers are no longer re-downloaded on every reconcile, and evicts stale Helm repository index entries from the cache so repositories with frequently changing indexes no longer fail with "Cache is full". kustomize-controller extends SOPS decryption error redaction to spec.postBuild.substituteFrom values, so substituted secrets echoed back in API validation errors are masked out of status conditions and events, and adds the opt-in DisableCommitStatusEvent feature gate. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Stop reapplying chart CRDs on upgrades when using server-side apply with the default Create policy (helm-controller)
• Recover HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch (helm-controller)
• Ignore NotFound when deleting the HelmChart (helm-controller)
• Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile (source-controller)
• Evict stale Helm repository index entries from the cache to avoid "Cache is full" errors (source-controller)
• Extend SOPS decryption error redaction to spec.postBuild.substituteFrom values (kustomize-controller)

Improvements:

• Add the opt-in DisableCommitStatusEvent feature gate (kustomize-controller)

Components changelog

• source-controller v1.9.6
• kustomize-controller v1.9.6
• helm-controller v1.6.5

CLI changelog

• [release/v2.9.x] Format reproducible created timestamp in UTC by @​fluxcdbot in #​6081
• Update toolkit components by @​fluxcdbot in #​6097

Full Changelog: fluxcd/flux2@v2.9.5...v2.9.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

• Risk: LOW — patch bump (v2.9.5 → v2.9.6) of Flux itself. The blast radius is the whole cluster, since it updates the controllers, but the changes are bug fixes.
• Breaking changes: none. The PR only changes cluster/base/flux-system/gotk-components.yaml (version labels and controller images). Release notes (taken from the PR body, not fetched separately) list only fixes:
  • helm-controller no longer reapplies chart CRDs on upgrade under server-side apply, and recovers HelmReleases stuck with Ready=Unknown.
  • source-controller normalizes Azure Blob ETags and evicts stale Helm index cache entries.
  • kustomize-controller extends SOPS error redaction to postBuild.substituteFrom values.
  • The new DisableCommitStatusEvent feature gate is opt-in. This repo doesn't set it.
• Behavior to watch: the helm-controller CRD change affects HelmReleases that manage CRDs (e.g. kube-prometheus-stack, cloudnative-pg, metallb, traefik). It should only reduce needless CRD churn. After merge, check flux get hr -A for anything not Ready.
• Action needed: none, safe to merge on green.

[claude]

• Risk: LOW — patch bump (Flux v2.9.5 → v2.9.6), but it updates all Flux controllers (source v1.9.6, kustomize v1.9.6, helm v1.6.5), so blast radius is cluster-wide GitOps. Only gotk-components.yaml changes (version labels/images).
• Breaking changes: none. Release notes (from the Renovate PR body, which quotes the upstream v2.9.6 release) list only fixes plus one opt-in feature gate (DisableCommitStatusEvent). I did not fetch the upstream page separately.
  • helm-controller no longer reapplies chart CRDs on upgrade with SSA and the default Create policy. This matches crds: Create in the traefik and traefik-internal HelmReleases and should reduce churn. It doesn't change behaviour for CreateReplace.
  • SOPS error redaction now also covers postBuild.substituteFrom. cluster/base/apps.yaml uses substituteFrom and SOPS, so this is a benefit and needs no config change.
  • Other fixes (Azure Blob ETags, Helm index cache eviction, HelmRelease Ready=Unknown recovery) need no config change.
• Action needed: none, safe to merge on green. After merge, check that the flux-system Kustomization reconciles and the controllers roll out (flux check).

[claude]

• Risk: MEDIUM. It's a minor bump (v2.9.5 → v2.10.0), but it upgrades the Flux controllers and CRDs themselves, so a bad rollout affects every reconciliation in the cluster.
• Breaking changes (checked against the release notes in the PR body, since I didn't WebFetch upstream, and against this repo's manifests):
  • Default RBAC: crd-controller-flux-system swaps serviceaccounts/token create for subjectaccessreviews create. This is the 'object identity GA' change. It only matters if something here relies on workload identity or impersonation. I found no kubeConfig, serviceAccountName or feature-gate patches in the repo, and kustomization.yaml has no patches on the controllers. Not affected.
  • Notification Alert and Provider v1: cluster/base/flux-system/notifications/notifications.yaml uses v1beta3, which is now deprecated but still served. It also uses none of the dropped fields (spec.summary, spec.interval, TLS or proxy settings in secretRef). That directory is commented out in flux-system/kustomization.yaml anyway, so nothing is applied.
  • ImageRepository storage default and kubeConfig.configMapRef audiences: no image-automation controllers are installed and there is no kubeConfig. Not affected.
  • Kubernetes must be at least 1.35.2 (or 1.36.1 / 1.37.0 for those minors). I couldn't check the k3s version from the repo, so confirm it.
• Action needed: none, safe to merge on green once the cluster is on a supported k3s version. Optionally bump the notification manifests to v1 before re-enabling them.