Flux v2.10.0
breaking++~~~~~~~~~~~~~~~*
Flux v2.10.0 shipped with 94 changes: 10 added, 73 changed, 4 fixed, and 4 marked breaking. Breaking changes include object identity always on with a narrowed default RBAC (no create on serviceaccounts/token), notification Alert and Provider APIs promoted to v1 with dropped v1beta3 fields, the artifact storage backend becoming the default for ImageRepository tag database, and a change to kubeConfig audiences key. The release also adds SPIFFE mTLS between controllers, OCIRepository as a HelmRelease chart source, and Zoom, incident.io and Mastodon notification providers, and updates Kubernetes to 1.37 and Go to 1.27.
What changes for platform teams
Platform teams upgrading Flux must bind a ClusterRole with serviceaccounts/token create permission to the controller ServiceAccount if they rely on default RBAC, and migrate v1beta3 notification resources to v1. Expect a full ImageRepository rescan after upgrade unless FluxStorage=false is set.
Changes
- !Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.changed / breaking
- !The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.changed / breaking
- !The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.changed / breaking
- !Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.changed / breaking
- Source-controller v1.10.1changed
- Kustomize-controller v1.10.1changed
- Notification-controller v1.10.0changed
- Helm-controller v1.7.1changed
- Image-reflector-controller v1.3.0changed
- Image-automation-controller v1.3.0changed
- Source-watcher v2.3.1changed
- Add backport label for 2.9changed
75 more lines
- Fix breaking change in-memory kustomization buildchanged
- Update fluxcd/pkg dependencieschanged
- Update toolkit componentschanged
- Add checksum verification for SOPS in e2e workflowschanged
- Add --add-ignore-paths flag to artifact commandschanged
- Update fluxcd/pkg dependencieschanged
- Update fluxcd/pkg dependencieschanged
- Update toolkit componentschanged
- Include source-watcher to oci flux-manifestschanged
- Update fluxcd/pkg dependencieschanged
- Update toolkit componentschanged
- Add version-file input to the Flux CLI actionchanged
- Add support for 2.9 in migrate -fchanged
- Fix Azure e2e tests after new major version with breaking changeschanged
- Update toolkit componentschanged
- Update toolkit componentschanged
- Format reproducible created timestamp in UTCchanged
- Update to Kubernetes 1.37changed
- Run conformance tests for Kubernetes 1.37changed
- Remove the Cosign v2.6.1 pinchanged
- Add --app-client-id flag to create secret githubappchanged
- Update toolkit componentschanged
- Match plugin archive entries with a leading ./changed
- Stop diff processing after an errorchanged
- Respect pruning exclusions in kustomization diffchanged
- Introduce RBAC for ArtifactGenerator cross-namespace artifactschanged
- [RFC-0014] Advanced Support for Short-Lived Cryptographic Materialchanged
- Validate plugin manifest namechanged
- [RFC-0014] RFC refinementschanged
- [RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connectionchanged
- Update to Kubernetes 1.37.1 and Go 1.27changed
- [RFC-0014] Add rules for missing corner caseschanged
- [RFC-0014] Address final nits arising from apis/crypto implementationchanged
- [RFC-0014] Final iterations for 2.10changed
- Revert "Introduce RBAC for ArtifactGenerator cross-namespace artifacts"changed
- Allow controllers to perform SubjectAccessReviewchanged
- Accept TYPE/NAME resource args in get/reconcilechanged
- Add digests flag to plugin search, which displays SHA values for all os/arch per binarychanged
- Extend kubectl-style resource args to all Flux kinds and commandschanged
- Escape terminal control characters in CLI outputchanged
- Add suspend, resume and reconcile commands for ArtifactGeneratorchanged
- [RFC-0014] Address review findingschanged
- [RFC-0014] Inter-controller mTLS via SPIFFEchanged
- Fix proxy bypass in bootstrap --ca-filechanged
- Use restrictive file modes for generated manifestschanged
- Fix envsubst dropping input on long lineschanged
- Fix stale flags and commands in CLI exampleschanged
- Fix typos in user-facing CLI messages and commentschanged
- Remove unused fields from installFlagschanged
- Breaking change: Harden RBAC for controllerschanged
- Fix --in-memory-build restricting disk accesschanged
- [RFC-0014] Add 2.10 notes to RFCchanged
- Update toolkit componentschanged
- Add --policy-change-delay to create image updatechanged
- [RFC-0014] Remove temporary workarounds for mTLS e2echanged
- [RFC-0014] Add HTTPS port to controller Serviceschanged
- [RFC-0014] Include SPIFFE mTLS in the e2e workflowchanged
- Remove unsupported fields in migrate -fchanged
- Bump minimum Kubernetes version to 1.35changed
- Update toolkit componentschanged
- Use podinfo in the SPIFFE mTLS e2e testchanged
- Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retiredadded
- SPIFFE mTLS for inter-controller communicationadded
- Notification Event, Alert and Provider APIs promoted to v1added
- OCIRepository as a chart source for HelmReleaseadded
- SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)added
- Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)added
- Flux artifact storage backend enabled by default for ImageRepository tagsadded
- Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)added
- New Zoom, incident.io and Mastodon notification providersadded
- Built with Kubernetes 1.37 and Go 1.27added
- Restrict allow-webhooks netpol to receiver portfixed
- Make Homebrew formula pass brew auditfixed
- Return clear error when --private-key-file path starts with '~'fixed
- Reject conflicting image policy selectors for every flag pairfixed
7 maintenance lines (dependency bumps, CI, tests, docs)
- Fix typo in RFC-0004 (enviornment -> environment)maintenance
- Bump the ci group across 1 directory with 19 updatesmaintenance
- Disable Replicated conformance testsmaintenance
- Bump the ci group across 1 directory with 15 updatesmaintenance
- Update dependencies for Flux 2.10maintenance
- Update GitHub Actionsmaintenance
- Fix goreleaser signing with cosign v3maintenance
94 lines10 added73 changed4 fixed7 maintenancetyped from the source notes
Full release notes ↗ · all Flux releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules