platformchangelog.dev
43 tools
tools43j k move f filter
‹ tools fluxtool

Flux

v2.9.6current · 2026-10-01

GitOps toolkit for Kubernetes: a set of controllers that keep clusters in sync with Git, OCI and Helm sources.

governance CNCF graduated·license oss
toolCI/CD
release lines seen2.92.82.72.62.52.4
homepagerepositorylatest release
alternatives2
Argo Rolloutsv1.10.1

Argo Rollouts handles canary and blue-green steps; Flux pairs with Flagger for the same job.

Argo CDv3.5.5

Both are CNCF-graduated GitOps engines; Argo CD ships a UI and app-centric model, Flux is a lighter controller toolkit.

case notes and incidents
How athenahealth modernized healthcare workloads with Amazon EKS Hybrid Nodes (AWS Containers Blog, 2026-09-30)
A platform team that must keep latency-sensitive or data-resident workloads on premises can run them under the same EKS control plane, APIs and tooling as cloud nodes, instead of operating a second control plane. The team still owns the hardware, network, node OS and storage, and needs Direct Connect or VPN connectivity and a separate nodeadm upgrade path for hybrid nodes.
other coverage
From Kubernetes Dashboard to Headlamp: Understanding the Transition (Kubernetes Blog, 2026-06-01)
releases30change lines typed from the source notes
v2.9.62026-10-01patch+++++++~~~~~sharesource
  • Source-controller v1.9.6changed
  • Kustomize-controller v1.9.6changed
  • Helm-controller v1.6.5changed
  • [release/v2.9.x] Format reproducible created timestamp in UTCchanged
  • Update toolkit componentschanged
  • Stop reapplying chart CRDs on upgrades when using server-side apply with the default Create policy (helm-controller)added
  • Recover HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch (helm-controller)added
  • Ignore NotFound when deleting the HelmChart (helm-controller)added
  • Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile (source-controller)added
  • Evict stale Helm repository index entries from the cache to avoid "Cache is full" errors (source-controller)added
  • Extend SOPS decryption error redaction to spec.postBuild.substituteFrom values (kustomize-controller)added
  • Add the opt-in DisableCommitStatusEvent feature gate (kustomize-controller)added
12 lines7 added5 changedtyped from the source notes
v2.9.52026-08-31patch+++++~~~~~~~~~~sharesource
  • Source-controller v1.9.5changed
  • Source-watcher v2.2.4changed
  • Kustomize-controller v1.9.5changed
  • Helm-controller v1.6.4changed
  • Notification-controller v1.9.4changed
  • Image-reflector-controller v1.2.5changed
  • Image-automation-controller v1.2.5changed
  • Update fluxcd/pkg dependencieschanged
  • Update fluxcd/pkg dependencieschanged
  • Update toolkit componentschanged
  • Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)added
  • Purge temporary directories at startup (kustomize-controller)added
3 more lines
  • Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)added
  • Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)added
  • Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)added
15 lines5 added10 changedtyped from the source notes
v2.9.42026-08-07patch++++++++++~~~~~~~~sharesource
  • Source-controller v1.9.4changed
  • Source-watcher v2.2.3changed
  • Notification-controller v1.9.3changed
  • Image-reflector-controller v1.2.4changed
  • Image-automation-controller v1.2.4changed
  • [release/v2.9.x] Add support for 2.9 in migrate -fchanged
  • Update fluxcd/pkg dependencieschanged
  • [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver portchanged
  • Update toolkit componentschanged
  • Confine tarball extraction and bound glob expansion (source-watcher)added
  • Disallow force-update and deletion via refspecs (image-automation-controller)added
  • Unify HTTP server request limits (notification-controller)added
8 more lines
  • Align Helm repository index loading with upstream Helm v4 (source-controller)added
  • Improve error handling in Bucket reconciliation (source-controller)added
  • Pin OCI chart verification by digest (source-controller)added
  • Limit GCS static authentication to service account keys (source-controller)added
  • Restrict the allow-webhooks network policy to the receiver port (flux CLI)added
  • Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)added
  • Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)added
  • Update Bitbucket Cloud receiver guidance (notification-controller)added
20 lines11 added9 changedtyped from the source notes
v2.9.32026-07-23patch+++++~~~~~sharesource
  • Kustomize-controller v1.9.4changed
  • Helm-controller v1.6.3changed
  • [release/v2.9.x] Include source-watcher to oci flux-manifestschanged
  • Update fluxcd/pkg dependencieschanged
  • Update toolkit componentschanged
  • Fix empty lines vanishing from rendered chart manifests (helm-controller)added
  • Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)added
  • Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)added
  • Update fluxcd/pkg dependenciesadded
  • Include source-watcher in the OCI flux-manifests artifactadded
10 lines5 added5 changedtyped from the source notes
v2.9.22026-07-13patch+++++~~~~~~~~~~sharesource
  • Source-controller v1.9.3changed
  • Kustomize-controller v1.9.3changed
  • Helm-controller v1.6.2changed
  • Notification-controller v1.9.2changed
  • Image-reflector-controller v1.2.3changed
  • Image-automation-controller v1.2.3changed
  • Source-watcher v2.2.2changed
  • Update fluxcd/pkg dependencieschanged
  • Update fluxcd/pkg dependencieschanged
  • Update toolkit componentschanged
  • Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)added
  • Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)added
3 more lines
  • Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)added
  • Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)added
  • Update fluxcd/pkg dependenciesadded
15 lines5 added10 changedtyped from the source notes
v2.9.12026-07-07patch++++++~~~~~~~~~~sharesource
  • Source-controller v1.9.2changed
  • Kustomize-controller v1.9.2changed
  • Helm-controller v1.6.2changed
  • Notification-controller v1.9.2changed
  • Image-reflector-controller v1.2.2changed
  • Image-automation-controller v1.2.2changed
  • Source-watcher v2.2.2changed
  • [release/v2.9.x] Fix breaking change in-memory kustomization buildchanged
  • Update fluxcd/pkg dependencieschanged
  • Update toolkit componentschanged
  • Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)added
  • Update SOPS dependency to fix .ini file decryption (kustomize-controller)added
4 more lines
  • Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)added
  • Fix a breaking change in the in-memory Kustomization build (Flux CLI)added
  • Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)added
  • Update fluxcd/pkg dependenciesadded
16 lines6 added10 changedtyped from the source notes
v2.9.02026-06-30minor+++~~~~~~~~~~~~~~*sharesource
  • Source-controller v1.9.1changed
  • Kustomize-controller v1.9.1changed
  • Notification-controller v1.9.1changed
  • Helm-controller v1.6.1changed
  • Image-reflector-controller v1.2.1changed
  • Image-automation-controller v1.2.1changed
  • Source-watcher v2.2.1changed
  • Add backport label for Flux 2.8changed
  • Remove no longer needed workaround for Flux 2.8changed
  • Update toolkit componentschanged
  • Add missing things to release notes templatechanged
  • Update fluxcd/pkg dependencieschanged
59 more lines
  • Update toolkit componentschanged
  • Add target branch name to update branchchanged
  • Mark RFC 0010, 0011 and 0012 as implementedchanged
  • Update toolkit componentschanged
  • Add --resolve-symlinks flag to build and push artifact commandschanged
  • Update toolkit componentschanged
  • Add --show-source to flux get ks and flux get hrchanged
  • Add flux create secret receiver commandchanged
  • Add --in-memory-build to flux build ks and flux diff kschanged
  • Migrate end-to-end test to latest cloud SDKschanged
  • Add AI Agents guidancechanged
  • [RFC-0013] Flux CLI Plugin Systemchanged
  • Add --ignore-not-found to flux diff kschanged
  • [RFC-0013] Implement plugin systemchanged
  • Update toolkit componentschanged
  • Add digest pinning support to flux plugin installchanged
  • Add --ns-follows-kube-context global flag for using the kubeconfig context namespacechanged
  • Include source-watcher in install.yaml manifestschanged
  • Update toolkit componentschanged
  • Update toolkit componentschanged
  • Update fluxcd/pkg dependencieschanged
  • Validate Helm source URL schemeschanged
  • Introduce flux trigger receiverchanged
  • Update to Kubernetes 1.36 and Go 1.26changed
  • Run conformance tests for Kubernetes 1.36changed
  • Add support for AWS CodeCommit to flux bootstrap gitchanged
  • Validate plugin binary pathchanged
  • Update fluxcd/pkg dependencieschanged
  • Support specifing sparseCheckout in flux bootstrapchanged
  • Update toolkit componentschanged
  • Honor ks.spec.postBuild.substituteStrategychanged
  • Add DriftIgnoreRules support to flux diff kustomizationchanged
  • Allow signing commits using SSH keychanged
  • Update toolkit componentschanged
  • Update fluxcd/pkg dependencieschanged
  • Cmd: support type!=status in get --status-selectorchanged
  • Fix flux get all --status-selector for empty results and notification resourceschanged
  • Upgrade go-git-providers to v0.27.0changed
  • Fix using Receiver adapter for ArtifactGeneratorchanged
  • Update fluxcd/pkg dependencieschanged
  • Add CLI support for OCIRepository.spec.layerSelector in flux create source ocichanged
  • Update toolkit componentschanged
  • Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)added
  • Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)added
  • SOPS decryption with the Age post-quantum cipher (Kustomization)added
  • Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)added
  • Helm post-render strategies, including chart hooks support (HelmRelease)added
  • Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)added
  • Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)added
  • Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)added
  • AWS CodeCommit authentication using Workload Identity (GitRepository)added
  • Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)added
  • Path pattern directory discovery for monorepos (ArtifactGenerator)added
  • Secret-less, OIDC-secured webhook Receivers (Receiver)added
  • Install Plugins alongside Flux setup in gh actionsadded
  • Resume exit codefixed
  • Validate --source flag in create kustomization commandfixed
  • Handle multiple symlinks to same target in build artifactfixed
  • Preserve invalid metadata.labels in flux build ksfixed
8 maintenance lines (dependency bumps, CI, tests, docs)
  • Add top-level permissions to upgrade-fluxcd-pkg workflowmaintenance
  • Bump the ci group across 1 directory with 11 updatesmaintenance
  • Add AI Coding Assistants Guidancemaintenance
  • Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0maintenance
  • Migrate MakeDependsOn to shared apis/meta funcmaintenance
  • Bump the ci group across 1 directory with 19 updatesmaintenance
  • Target host arch for local builds/envtestmaintenance
  • Bump the ci group with 6 updatesmaintenance
79 lines13 added54 changed4 fixed8 maintenancetyped from the source notes
v2.8.82026-05-20patchsecurity++++++++++~~~~~!sharesource
  • Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)security
  • Helm-controller v1.5.5changed
  • Image-automation-controller v1.1.4changed
  • Image-reflector-controller v1.1.2changed
  • Source-controller v1.8.5changed
  • Update toolkit componentschanged
  • Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)added
  • Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)added
  • Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)added
  • Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)added
  • Improve path handling in the source reconcilers (source-controller)added
  • Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)added
4 more lines
  • Move Helm back to upstream v4.2.0 (source-controller, helm-controller)added
  • Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)added
  • Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)added
  • Update fluxcd/pkg dependenciesadded
16 lines1 security10 added5 changedtyped from the source notes
v2.8.72026-05-12patchsecurity++~~~~~~!sharesource
  • Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)security
  • Helm-controller v1.5.4changed
  • Image-automation-controller v1.1.3changed
  • Kustomize-controller v1.8.5changed
  • Notification-controller v1.8.4changed
  • Source-controller v1.8.4changed
  • Update toolkit componentschanged
  • Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)added
  • Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)added
9 lines1 security2 added6 changedtyped from the source notes
v2.8.62026-04-21patch++++++~~~~~~sharesource
  • Helm-controller v1.5.4changed
  • Image-automation-controller v1.1.2changed
  • Kustomize-controller v1.8.4changed
  • Notification-controller v1.8.4changed
  • Source-controller v1.8.3changed
  • Update toolkit componentschanged
  • Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)added
  • Ignore force replace when server-side apply is enabled (helm-controller)added
  • Fix a regression where generic providers would not forward commit status events (notification-controller)added
  • Require the audience field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)added
  • Introduce the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries (kustomize-controller)added
  • Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)added
12 lines6 added6 changedtyped from the source notes
v2.8.52026-04-07patch+++++~~~~sharesource
  • Kustomize-controller v1.8.3changed
  • Source-controller v1.8.2changed
  • Notification-controller v1.8.3changed
  • Update toolkit componentschanged
  • Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)added
  • Fix Azure Blob prefix option not being passed to the storage client (source-controller)added
  • Improve error message for encrypted SSH keys without password (source-controller)added
  • Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)added
  • Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)added
9 lines5 added4 changedtyped from the source notes
v2.8.42026-04-07patch++~~sharesource
  • Update fluxcd/pkg dependencieschanged
  • [release/v2.8.x] fix: validate --source flag in create kustomization commandchanged
  • Fix flux build ks and flux diff ks on Windowsadded
  • Fix --source flag validation in create kustomization commandadded
4 lines2 added2 changedtyped from the source notes
18 older releases
v2.8.32026-03-16patch +~~~ 4 lines
v2.8.22026-03-12patchsecurity ++++~~~~~~~~~~~! 16 lines
v2.8.12026-02-27patch ++~~~~~~ 8 lines
v2.8.02026-02-24minor +++~~~~~~~~~~~~~~* 67 lines
v2.7.52025-11-27patch +~~ 3 lines
v2.7.42025-11-24patch +++++~~~~~~~~~~~~~ 20 lines
v2.7.32025-10-28patch +++++~~~~~~~~~ 14 lines
v2.7.22025-10-08patch ~~~~~~~~~ 10 lines
v2.7.12025-10-06patch +++++++~~~~~~~~~~~ 18 lines
v2.7.02025-09-30minor +++++~~~~~~~~~~~~~* 86 lines
v2.6.42025-07-08patch +~~ 3 lines
v2.6.32025-06-27patch +~~~ 4 lines
v2.6.22025-06-16patch +++~~~~~~ 9 lines
v2.6.12025-06-02patch ++~~~ 5 lines
v2.6.02025-05-29minor +++++++++++~~~~-*** 59 lines
v2.5.12025-02-25patch ++~~~ 5 lines
v2.5.02025-02-20minor ++++~~~~~~~~~~~~~~ 43 lines
v2.4.02024-09-30minor ++++~~~~~~~~~~~~~~ 43 lines