Highlights

Flux v2.8.1 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix Git commit status events being dropped for Kustomizations (notification-controller)
• Fix health check for StatefulSets when the Pods are Pending/Unschedulable during rollout (helm-controller, kustomize-controller)

Components changelog

• kustomize-controller v1.8.1
• notification-controller v1.8.1
• helm-controller v1.5.1

CLI changelog

• [release/v2.8.x] Remove no longer needed workaround for Flux 2.8 by @fluxcdbot in #5735
• Update fluxcd/pkg dependencies by @fluxcdbot in #5739
• [release/v2.8.x] Update toolkit components by @fluxcdbot in #5741

Full Changelog: v2.8.0...v2.8.1

Highlights

Flux v2.8.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.8 GA blog post.

Overview of the new features:

• Helm v4 support, including server-side apply and kstatus-based health checking (HelmRelease)
• Readiness evaluation of Helm-managed objects with CEL expressions (HelmRelease)
• Improved observability of Helm releases with inventory tracking in .status.inventory (HelmRelease)
• Reduced the mean time to recovery of Flux-managed applications via CancelHealthCheckOnNewRevision feature gate (Kustomization, HelmRelease)
• Support for commenting on Pull Requests directly from Flux notifications (Provider)
• Custom SSA apply stages for ordering resource application in kustomize-controller (Kustomization)
• Automatic GitHub App installation ID lookup from the repository owner (GitRepository, ImageUpdateAutomation, Provider)
• Support for Cosign v3 for verifying OCI artifacts and container images (OCIRepository)
• ArtifactGenerator support for extracting and modifying Helm charts (ArtifactGenerator)
• Bypass cache when fetching source objects via DirectSourceFetch feature gate (Kustomization, HelmRelease, ArtifactGenerator)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs v1beta2 and v2beta2 (deprecated in 2024) have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.8.

Components changelog

• source-controller v1.8.0
• kustomize-controller v1.8.0
• notification-controller v1.8.0
• helm-controller v1.5.0
• image-reflector-controller v1.1.0
• image-automation-controller v1.1.0
• source-watcher v2.1.0

CLI changelog

• ci: Set GITHUB_TOKEN in the release-flux-manifests workflow by @stefanprodan in #5547
• Add backport label for Flux 2.7 by @matheuscscp in #5550
• build(deps): bump the ci group across 1 directory with 3 updates by @dependabot[bot] in #5548
• Fix flux push artifact not working with --provider by @matheuscscp in #5551
• Extend flux migrate to work with local files by @matheuscscp in #5554
• Improve flux migrate for live cluster migrations by @stefanprodan in #5558
• Fix flux migrate -f command to work with comments by @matheuscscp in #5560
• Add source-watcher to docs by @stefanprodan in #5562
• Fix flux migrate -f not considering kind comments by @matheuscscp in #5563
• refactor: convert Kustomization resource into unstructured map only once during variable substitution by @ramasai1 in #5566
• Update toolkit components by @fluxcdbot in #5568
• Disable AUR publishing by @stefanprodan in #5570
• Fix manifest generation for --storage-adv-addr and --events-addr flags by @stefanprodan in #5574
• Update dependencies to Kubernetes v1.34.1 and Go 1.25.2 by @stefanprodan in #5576
• Update toolkit components by @fluxcdbot in #5578
• Restore GitHub PAT for backports by @matheuscscp in #5581
• [RFC-0012] Add command flux get source external by @dgunzy in #5555
• fix: handle error when writing password prompt to stdout by @akshatsinha0 in #5589
• Pin cosign to v2.6.1 by @matheuscscp in #5594
• [RFC-0012] Add command flux export source external by @dgunzy in #5583
• Fix bootstrap e2e test for image policy by @matheuscscp in #5604
• Update toolkit components by @fluxcdbot in #5603
• fix: return accepted values for flags when calling Values.Type() by @jaxels10 in #5602
• ci: Include source-watcher in the e2e test suite by @stefanprodan in #5614
• Add source.extensions.fluxcd.io group to aggregated RBAC roles by @matheuscscp in #5627
• Fix panic on reconcile with source of ExternalArtifact kind by @matheuscscp in #5630
• Upgrade k8s to 1.34.2, c-r to 0.22.4 and helm to 3.19.2 by @matheuscscp in #5633
• diff: report if object is skipped by @hown3d in #5625
• Update toolkit components by @fluxcdbot in #5639
• Allow option to skip tenant namespace creation by @anshuishere in #5597
• Update toolkit components by @fluxcdbot in #5648
• fix: #5654 by checking if both --chart and --chart-ref are set by @jaxels10 in #5656
• Added retry logic with delays to the Flux CLI download by @ivan-munteanu in #5659
• Run conformance tests for Kubernetes 1.35.0 by @stefanprodan in #5663
• fix: normalize path for Windows compatibility by @sibasispadhi in #5674
• Introduce support for looking up GH app installation ID by @matheuscscp in #5682
• Update dependencies to Kubernetes v1.35.0 by @stefanprodan in #5688
• Fix resume command logging success after reconciliation failure by @Aman-Cool in #5690
• Add 2.8 to supported versions for flux migrate -f by @matheuscscp in #5713
• Introduce workflow for bumping fluxcd/pkg deps by @matheuscscp in #5717
• Update fluxcd/pkg dependencies by @fluxcdbot in #5719
• Fix event listing ignoring pagination token by @matheuscscp in #5721
• Build with Go 1.26 by @stefanprodan in #5723
• Update toolkit components by @fluxcdbot in #5722
• Update helm-controller to v1.5.0 by @fluxcdbot in #5725
• build(deps): bump the ci group across 1 directory with 12 updates by @dependabot[bot] in #5720
• Fix bootstrap failure on Windows cross-drive paths by @veeceey in #5726
• Dump debug info on e2e tests by @matheuscscp in #5729
• Set Kubernetes 1.33 as min supported version by @matheuscscp in #5730
• Update conformance tests to min Kubernetes 1.33 by @stefanprodan in #5731

New Contributors

• @ramasai1 made their first contribution in #5566
• @akshatsinha0 made their first contribution in #5589
• @jaxels10 made their first contribution in #5602
• @hown3d made their first contribution in #5625
• @anshuishere made their first contribution in #5597
• @ivan-munteanu made their first contribution in #5659
• @sibasispadhi made their first contribution in #5674
• @Aman-Cool made their first contribution in #5690
• @veeceey made their first contribution in https://github.com/fluxcd/f...

Highlights

Flux v2.7.5 is a patch release that comes with fixes to helm-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix HelmRelease history truncation when using the RetryOnFailure strategy.

⚠️ Note that signature verification for OCI artifacts in source-controller is not compatible with Cosign v3.
Flux users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.

Components changelog

• helm-controller v1.4.5

CLI changelog

• [release/v2.7.x] Update toolkit components by @fluxcdbot in #5649

Full Changelog: v2.7.4...v2.7.5

Highlights

Flux v2.7.4 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Add DisableConfigWatchers feature gate to all controllers for disabling the Secrets/ConfigMaps watchers
• Fix Workload Identity for Azure China Cloud in all controllers
• Update Helm Go SDK to v3.19.2 fixing schema validation issues in helm-controller
• Skip secret decryption for remote kustomize patches in kustomize-controller
• Improve post-build error reporting in kustomize-controller
• Add ArtifactGenerator to aggregated RBAC roles

⚠️ Note that signature verification for OCI artifacts in source-controller is not compatible with Cosign v3.
Flux users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.

Components changelog

• source-controller v1.7.4
• kustomize-controller v1.7.3
• notification-controller v1.7.5
• helm-controller v1.4.4
• image-reflector-controller v1.0.4
• image-automation-controller v1.0.4
• source-watcher v2.0.3

CLI changelog

• [release/v2.7.x] ci: Include source-watcher in the e2e test suite by @fluxcdbot in #5615
• [release/v2.7.x] Add source.extensions.fluxcd.io group to aggregated RBAC roles by @fluxcdbot in #5628
• [release/v2.7.x] Fix panic on reconcile with source of ExternalArtifact kind by @fluxcdbot in #5631
• [release/v2.7.x] Upgrade k8s to 1.34.2, c-r to 0.22.4 and helm to 3.19.2 by @fluxcdbot in #5634
• [release/v2.7.x] diff: report if object is skipped by @fluxcdbot in #5635
• [release/v2.7.x] Update toolkit components by @fluxcdbot in #5640
• [release/v2.7.x] Allow option to skip tenant namespace creation by @fluxcdbot in #5642

Full Changelog: v2.7.3...v2.7.4

Highlights

Flux v2.7.3 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Restore SOCKS5 proxy support in all controllers
• Fix status reporting of HelmReleases with RetryOnFailure strategy
• Automated retries for ImagePolicies when no image tags are found in the database
• Fix alerting for Telegram's message_thread_id
• Allow running kustomize-controller and helm-controller on the same loopback interface as source-watcher

⚠️ Note that signature verification for OCI artifacts in source-controller is not compatible with Cosign v3. Users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.

Components changelog

• source-controller v1.7.3
• kustomize-controller v1.7.2
• notification-controller v1.7.4
• helm-controller v1.4.3
• image-reflector-controller v1.0.3
• image-automation-controller v1.0.3

CLI changelog

• [release/v2.7.x] Pin cosign to v2.6.1 by @fluxcdbot in #5595
• [release/v2.7.x] Update toolkit components by @fluxcdbot in #5605
• [release/v2.7.x] fix: return accepted values for flags when calling Values.Type() by @fluxcdbot in #5606

Full Changelog: v2.7.2...v2.7.3

Highlights

Flux v2.7.2 is a patch release that comes with security fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

All Flux components are now built with Go 1.25.2 which includes fixes for vulnerabilities in the Go stdlib that could lead to denial of service. The list of security fixes can be found in the Go 1.25.2 release notes.

Components changelog

• source-controller v1.7.2
• kustomize-controller v1.7.1
• notification-controller v1.7.3
• helm-controller v1.4.2
• image-reflector-controller v1.0.2
• image-automation-controller v1.0.2
• source-watcher v2.0.2

CLI changelog

• [release/v2.7.x] Fix manifest generation for --storage-adv-addr and --events-addr flags by @github-actions[bot] in #5575
• [release/v2.7.x] Update dependencies to Kubernetes v1.34.1 and Go 1.25.2 by @github-actions[bot] in #5577
• [release/v2.7.x] Update toolkit components by @github-actions[bot] in #5579

Full Changelog: v2.7.1...v2.7.2

Highlights

Flux v2.7.1 is a patch release that comes with various improvements and fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Improvements:

• Extend flux migrate with support for migrating manifests in Git repositories to the latest API versions.
• Add recommendations for configuring HelmReleases on production environments.

Fixes:

• Fix flux migrate command to handle managed fields properly.
• Fix self-signed TLS cert handling for public Helm repositories in source-controller.
• Fix the default API versions used by receivers in notification-controller.
• Fix redundant Ready condition patching in helm-controller.
• Fix workload identity configuration examples for kubeconfig in helm-controller and kustomize-controller.

Components changelog

• source-controller v1.7.1
• notification-controller v1.7.2
• helm-controller v1.4.1

CLI changelog

• [release/v2.7.x] Backport CI fixes and updates by @matheuscscp in #5552
• [release/v2.7.x] Fix flux push artifact not working with --provider by @github-actions[bot] in #5553
• [release/v2.7.x] Extend flux migrate to work with local files by @github-actions[bot] in #5557
• [release/v2.7.x] Improve flux migrate for live cluster migrations by @github-actions[bot] in #5559
• [release/v2.7.x] Fix flux migrate -f command to work with comments by @github-actions[bot] in #5561
• [release/v2.7.x] Fix flux migrate -f not considering kind comments by @github-actions[bot] in #5564
• [release/v2.7.x] Update toolkit components by @github-actions[bot] in #5569
• [release/v2.7.x] Disable AUR publishing by @github-actions[bot] in #5571

Full Changelog: v2.7.0...v2.7.1

Highlights

Flux v2.7.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.7 GA blog post.

Overview of the new features:

• General availability release of the Image Automation APIs (ImagePolicy, ImageRepository, ImageUpdateAutomation)
• Watch for changes in ConfigMaps and Secrets references (Kustomization, HelmRelease)
• Support for remote cluster authentication using Workload Identity (Kustomization, HelmRelease)
• Extend the readiness evaluation of dependencies with CEL expressions (Kustomization, HelmRelease)
• Support for global SOPS Age decryption keys on single-tenant clusters (Kustomization)
• Support for optional Kustomize components (Kustomization)
• Introduce RetryOnFailure lifecycle management strategy (HelmRelease)
• Support mTLS for sending alerts to external systems (Provider)
• Object-level workload identity authentication (Bucket, Provider)
• Support mTLS for GitHub App transport (GitRepository, ImageUpdateAutomation, Provider)
• OpenTelemetry tracing for Kustomization and HelmRelease reconciliation (Provider)
• Support for 3rd-party source controllers (ExternalArtifact)
• Support for source composition and decomposition patterns (ArtifactGenerator)
• CancelHealthCheckOnNewRevision feature gate (kustomize-controller)
• GitSparseCheckout feature gate (image-automation-controller)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs v1beta1 and v2beta1 (deprecated in 2023) have reached end-of-life and have been removed from the CRDs.

Unless you are using Flux Operator to deploy the Flux controllers, you must run the flux migrate command on clusters before upgrading.

For more details, please refer to the Flux v2.7 upgrade guide.

Components changelog

• source-controller v1.7.0
• kustomize-controller v1.7.0
• notification-controller v1.7.0 v1.7.1
• helm-controller v1.4.0
• image-reflector-controller v1.0.0 v1.0.1
• image-automation-controller v1.0.0 v1.0.1
• source-watcher v2.0.0 v2.0.1

New Documentation

• ImageRepository v1 specification
• ImagePolicy v1 specification
• ImageUpdateAutomation v1 specification
• ExternalArtifact v1 specification
• ArtifactGenerator v1beta1 specification

CLI changelog

• Add backport label for v2.6.x by @stefanprodan in #5379
• Update image-reflector-controller to v0.35.1 by @fluxcdbot in #5381
• Add digest pinning to image automation testing by @stefanprodan in #5383
• correct small typo by @JIbald in #5388
• Remove credentials sync manifests by @matheuscscp in #5347
• Add sparse checkout to cli by @ba-work in #5389
• fix: Allow Azure CLI calls in flux push artifact --provider azure on DevOps runners by @matheuscscp in #5390
• Fix knownhosts key mismatch regression bug by @matheuscscp in #5404
• refactor: Use normalize.UnstructuredList instead of ssa.SetNativeKindsDefaults by @cappyzawa in #5407
• Make service-account name configurable in flux create tenant by @reiSh6phoo9o in #5402
• Update toolkit components by @fluxcdbot in #5409
• refactor: cleanup GetArtifactRegistryCredentials error handling by @cappyzawa in #5418
• Promote image CLI commands to stable by @dgunzy in #5421
• Update toolkit components by @fluxcdbot in #5426
• Bump pkg/ssa to v0.49.0 for CABundle validation fix by @dgunzy in #5431
• [RFC-0010] Add workload identity support for remote clusters by @matheuscscp in #5434
• Update toolkit components by @fluxcdbot in #5443
• Fix flux push artifact for insecure registries by @stefanprodan in #5449
• [RFC-0010] Add workload identity support for remote generic clusters by @matheuscscp in #5452
• Fix flux diff kustomization ignore patterns by @dgunzy in #5451
• Update dependencies to Kubernetes 1.33.2 by @stefanprodan in #5453
• build(deps): bump the ci group across 1 directory with 7 updates by @dependabot[bot] in #5435
• Upgrade fluxcd/pkg dependencies by @matheuscscp in #5455
• ci: Use GITHUB_TOKEN for API calls in update workflow by @stefanprodan in #5460
• manifests: Add app.kubernetes.io/part-of: flux label to controller pods by @pinkavaj in #5440
• Migrate sourcesecret package to runtime/secrets APIs by @cappyzawa in #5462
• Implement flux migrate command by @stefanprodan in #5473
• [RFC-0007] Implementation history update by @stefanprodan in #5480
• Run conformance tests for Kubernetes 1.34.0 by @stefanprodan in #5497
• Update to Kubernetes v1.34.0 and Go 1.25.0 by @stefanprodan in #5499
• build(deps): bump the ci group across 1 directory with 10 updates by @dependabot[bot] in #5500
• Allow the Go runtime to dynamically set GOMAXPROCS by @stefanprodan in #5501
• fix(events): respect --all-namespaces flag by @mohiuddin-khan-shiam in #5414
• [RFC-0011] OpenTelemetry Tracing by @adri1197 in #5321
• [RFC-0012] External Artifact API by @stefanprodan in #5292
• Add --show-history flag to debug helmrelease by @hawkaii in #5505
• Skip release candidates on updates by @matheuscscp in #5507
• ci: Align azure e2e tests secret names with fluxcd/pkg by @matheuscscp in #5508
• Update image-reflector-controller to v1.0.0 by @fluxcdbot in #5517
• Update source-controller to v1.7.0 by @fluxcdbot in #5518
• Add the source-watcher controller to the Flux distribution by @stefanprodan in #5519
• Add read-only commands for ArtifactGenerator kind by @stefanprodan in #5520
• ci: Add source-watcher to the update workflow by @stefanprodan in #5521
• Update image-automation-controller to v1.0.0 by @fluxcdbot in #5522
• Update image-reflector-controller to v1.0.1 by @fluxcdbot in #5525
• Implement flux [reconcile|suspend|resume] image policy commands by @lukas8219 in #5492
• Ha...

Highlights

Flux v2.6.4 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

Fixes:

• Fix for SOPS decryption with US Government KMS keys failing with the error:

STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID: ,
request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host

Components changelog

• kustomize-controller v1.6.1

CLI changed

• [release/v2.6.x] Update toolkit components by @fluxcdbot in #5444

Full Changelog: v2.6.3...v2.6.4

Highlights

Flux v2.6.3 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

Fixes:

• Fix for rsa-sha2-512 and rsa-sha2-256 algorithms not being prioritized for ssh-rsa host keys in source-controller, image-automation-controller and Flux CLI bootstrap.

Components changelog

• source-controller v1.6.2
• image-automation-controller v0.41.2

CLI changed

• [release/v2.6.x] Update toolkit components by @fluxcdbot in #5427

Full Changelog: v2.6.2...v2.6.3