Flux: baixar versions anteriors

Highlights
Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.
Overview of the new features:
- Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
- SPIFFE mTLS for inter-controller communication
- Notification Event, Alert and Provider APIs promoted to v1
- OCIRepository as a chart source for HelmRelease
- SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
- Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
- Flux artifact storage backend enabled by default for ImageRepository tags
- Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
- New Zoom, incident.io and Mastodon notification providers
- Built with Kubernetes 1.37 and Go 1.27
❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility
This release is compatible with the following Kubernetes versions:
──────────────────┬────────────────
Kubernetes version│Minimum required
──────────────────┼────────────────
v1.35 │>= 1.35.2
──────────────────┼────────────────
v1.36 │>= 1.36.1
──────────────────┼────────────────
v1.37 │>= 1.37.0
──────────────────┴────────────────
Note
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility
Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure
⚠️ Breaking changes in this release:
- Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
- The notification Alert and Provider APIs are promoted to v1. Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields, the static JWT token for Azure Event Hub, and TLS or proxy configuration in Provider.spec.secretRef. Use eventMetadata.summary, proxySecretRef and certSecretRef instead.
- The Flux artifact storage backend is now the default for the ImageRepository tag database. Switching the gate wipes the local tag database, so the first reconciliation after the upgrade rescans every ImageRepository. Set --feature-gates=FluxStorage=false to keep using BadgerDB.
- Remote cluster authentication with .spec.kubeConfig.configMapRef uses object identity; replace the legacy audiences key with credential.auth.fluxcd.io/audiences.
Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.10.

Components changelog
- source-controller v1.10.1
- kustomize-controller v1.10.1
- notification-controller v1.10.0
- helm-controller v1.7.1
- image-reflector-controller v1.3.0
- image-automation-controller v1.3.0
- source-watcher v2.3.1

CLI changelog
No CLI changes were merged to release/v2.10.x after it was cut from main.

Highlights
Flux v2.9.6 is a patch release that stops helm-controller from reapplying chart CRDs on every upgrade when server-side apply is enabled, and recovers HelmReleases left with a drifted Ready=Unknown condition after a failed status patch. source-controller normalizes Azure Blob listing ETags so unchanged containers are no longer re-downloaded on every reconcile, and evicts stale Helm repository index entries from the cache so repositories with frequently changing indexes no longer fail with "Cache is full". kustomize-controller extends SOPS decryption error redaction to spec.postBuild.substituteFrom values, so substituted secrets echoed back in API validation errors are masked out of status conditions and events, and adds the opt-in DisableCommitStatusEvent feature gate. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Stop reapplying chart CRDs on upgrades when using server-side apply with the default Create policy (helm-controller)
- Recover HelmReleases stranded with a drifted Ready=Unknown condition after a failed status patch (helm-controller)
- Ignore NotFound when deleting the HelmChart (helm-controller)
- Normalize Azure Blob listing ETags so unchanged containers are not re-downloaded on every reconcile (source-controller)
- Evict stale Helm repository index entries from the cache to avoid "Cache is full" errors (source-controller)
- Extend SOPS decryption error redaction to spec.postBuild.substituteFrom values (kustomize-controller)
Improvements:
- Add the opt-in DisableCommitStatusEvent feature gate (kustomize-controller)

Components changelog
- source-controller v1.9.6
- kustomize-controller v1.9.6
- helm-controller v1.6.5

CLI changelog
- [release/v2.9.x] Format reproducible created timestamp in UTC by @fluxcdbot in #6081
- Update toolkit components by @fluxcdbot in #6097

Highlights
Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
- Purge temporary directories at startup (kustomize-controller)
- Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)
Improvements:
- Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
- Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog
- source-controller v1.9.5
- source-watcher v2.2.4
- kustomize-controller v1.9.5
- helm-controller v1.6.4
- notification-controller v1.9.4
- image-reflector-controller v1.2.5
- image-automation-controller v1.2.5

CLI changelog
- Update fluxcd/pkg dependencies by @fluxcdbot in #6046
- Update fluxcd/pkg dependencies by @fluxcdbot in #6048
- Update toolkit components by @fluxcdbot in #6049

Highlights
Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by ImageUpdateAutomation, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, Bucket error handling and GCS static authentication in source-controller. On the CLI side, flux migrate -f now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.
Note that this release contains CRD schema changes for ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated along with the controllers.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Confine tarball extraction and bound glob expansion (source-watcher)
- Disallow force-update and deletion via refspecs (image-automation-controller)
- Unify HTTP server request limits (notification-controller)
- Align Helm repository index loading with upstream Helm v4 (source-controller)
- Improve error handling in Bucket reconciliation (source-controller)
- Pin OCI chart verification by digest (source-controller)
- Limit GCS static authentication to service account keys (source-controller)
- Restrict the allow-webhooks network policy to the receiver port (flux CLI)
Improvements:
- Add support for migrating repositories to 2.9 in flux migrate -f (flux CLI)
- Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)
- Update Bitbucket Cloud receiver guidance (notification-controller)

Components changelog
- source-controller v1.9.4
- source-watcher v2.2.3
- notification-controller v1.9.3
- image-reflector-controller v1.2.4
- image-automation-controller v1.2.4

CLI changelog
- [release/v2.9.x] Add support for 2.9 in migrate -f by @fluxcdbot in #6021
- Update fluxcd/pkg dependencies by @fluxcdbot in #6026
- [release/v2.9.x] fix: restrict allow-webhooks netpol to receiver port by @fluxcdbot in #6029
- Update toolkit components by @fluxcdbot in #6031

Highlights
Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered
Helm chart manifests, HelmReleases being marked as tested when their Helm test
hooks never ran, and spec.images entries that set only some image fields
discarding the remaining fields already declared for the same image in the
kustomization.yaml. The latter affects both kustomize-controller and the
flux build|diff kustomization commands. Users are encouraged to upgrade for
the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix empty lines vanishing from rendered chart manifests (helm-controller)
- Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
- Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)
Improvements:
- Update fluxcd/pkg dependencies
- Include source-watcher in the OCI flux-manifests artifact

Components changelog
- kustomize-controller v1.9.4
- helm-controller v1.6.3

CLI changelog
- [release/v2.9.x] Include source-watcher to oci flux-manifests by @fluxcdbot in #5996
- Update fluxcd/pkg dependencies by @fluxcdbot in #6006
- Update toolkit components by @fluxcdbot in #6011

What's Changed
- Update fluxcd/pkg dependencies by @fluxcdbot in #5984
- Update fluxcd/pkg dependencies by @fluxcdbot in #5990
- Update toolkit components by @fluxcdbot in #5994

Highlights
Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)
- Update SOPS dependency to fix .ini file decryption (kustomize-controller)
- Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)
- Fix a breaking change in the in-memory Kustomization build (Flux CLI)
Improvements:
- Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
- Update fluxcd/pkg dependencies

Components changelog
- source-controller v1.9.2
- kustomize-controller v1.9.2
- helm-controller v1.6.2
- notification-controller v1.9.2
- image-reflector-controller v1.2.2
- image-automation-controller v1.2.2
- source-watcher v2.2.2

CLI changelog
- [release/v2.9.x] Fix breaking change in-memory kustomization build by @fluxcdbot in #5971
- Update fluxcd/pkg dependencies by @fluxcdbot in #5977
- Update toolkit components by @fluxcdbot in #5979

Highlights
Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.
For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.
Overview of the new features:
- Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
- Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
- SOPS decryption with the Age post-quantum cipher (Kustomization)
- Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
- Helm post-render strategies, including chart hooks support (HelmRelease)
- Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
- Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
- Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
- AWS CodeCommit authentication using Workload Identity (GitRepository)
- Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
- Path pattern directory discovery for monorepos (ArtifactGenerator)
- Secret-less, OIDC-secured webhook Receivers (Receiver)
❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility
This release is compatible with the following Kubernetes versions:
──────────────────┬────────────────
Kubernetes version│Minimum required
──────────────────┼────────────────
v1.34 │>= 1.34.1
──────────────────┼────────────────
v1.35 │>= 1.35.0
──────────────────┼────────────────
v1.36 │>= 1.36.0
──────────────────┴────────────────
Note
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility
Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure
⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.
Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog
- source-controller v1.9.1
- kustomize-controller v1.9.1
- notification-controller v1.9.1
- helm-controller v1.6.1
- image-reflector-controller v1.2.1
- image-automation-controller v1.2.1
- source-watcher v2.2.1

CLI changelog
- Add backport label for Flux 2.8 by @matheuscscp in #5732
- Remove no longer needed workaround for Flux 2.8 by @matheuscscp in #5733
- Update toolkit components by @fluxcdbot in #5740
- Add missing things to release notes template by @matheuscscp in #5743
- ci: add top-level permissions to upgrade-fluxcd-pkg workflow by @gaganhr94 in #5763
- build(deps): bump the ci group across 1 directory with 11 updates by @dependabot[bot] in #5764
- Update fluxcd/pkg dependencies by @fluxcdbot in #5766
- Update toolkit components by @fluxcdbot in #5769
- Add target branch name to update branch by @matheuscscp in #5773
- Fix/resume exit code by @Aman-Cool in #5701
- Mark RFC 0010, 0011 and 0012 as implemented by @stefanprodan in #5776
- Update toolkit components by @fluxcdbot in #5780
- Add --resolve-symlinks flag to build and push artifact commands by @rohansood10 in #5724
- fix: validate --source flag in create kustomization command by @gma1k in #5798
- Update toolkit components by @fluxcdbot in #5821
- Add --show-source to flux get ks and flux get hr by @rafaelperoco in #5828
- Add flux create secret receiver command by @stefanprodan in #5835
- fix: handle multiple symlinks to same tar

Highlights
Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
- Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
- Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
- Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
- Improve path handling in the source reconcilers (source-controller)
- Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)
Improvements:
- Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
- Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
- Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
- Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
- Update fluxcd/pkg dependencies

Components changelog
- helm-controller v1.5.5
- image-automation-controller v1.1.4
- image-reflector-controller v1.1.2
- source-controller v1.8.5

CLI changelog
- Update toolkit components by @fluxcdbot in #5904

Highlights
Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)
Improvements:
- Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
- Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog
- helm-controller v1.5.4
- image-automation-controller v1.1.3
- kustomize-controller v1.8.5
- notification-controller v1.8.4
- source-controller v1.8.4

CLI changelog
- Update toolkit components by @fluxcdbot in #5891

Highlights
Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)
- Ignore force replace when server-side apply is enabled (helm-controller)
- Fix a regression where generic providers would not forward commit status events (notification-controller)
- Require the audience field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)
Improvements:
- Introduce the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries (kustomize-controller)
- Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)

Components changelog
- helm-controller v1.5.4
- image-automation-controller v1.1.2
- kustomize-controller v1.8.4
- notification-controller v1.8.4
- source-controller v1.8.3

CLI changelog
- Update toolkit components by @fluxcdbot in #5857

Highlights
Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)
- Fix Azure Blob prefix option not being passed to the storage client (source-controller)
Improvements:
- Improve error message for encrypted SSH keys without password (source-controller)
- Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)
- Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

Components changelog
- kustomize-controller v1.8.3
- source-controller v1.8.2
- notification-controller v1.8.3

CLI changelog
- Update toolkit components by @fluxcdbot in #5822

What's Changed
- Update fluxcd/pkg dependencies by @fluxcdbot in #5796
- [release/v2.8.x] fix: validate --source flag in create kustomization command by @fluxcdbot in #5799

What's Changed
- [release/v2.8.x] Add target branch name to update branch by @fluxcdbot in #5774
- Update toolkit components by @fluxcdbot in #5779

What's Changed
- [release/v2.8.x] build(deps): bump the ci group across 1 directory with 11 updates by @fluxcdbot in #5765
- Update fluxcd/pkg dependencies by @fluxcdbot in #5767
- Update toolkit components by @matheuscscp in #5770
- Update fluxcd/pkg dependencies by @fluxcdbot in #5771

Highlights
Flux v2.8.1 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix Git commit status events being dropped for Kustomizations (notification-controller)
- Fix health check for StatefulSets when the Pods are Pending/Unschedulable during rollout (helm-controller, kustomize-controller)
Components changelog
- kustomize-controller v1.8.1
- notification-controller v1.8.1
- helm-controller v1.5.1
CLI changelog
- [release/v2.8.x] Remove no longer needed workaround for Flux 2.8 by @fluxcdbot in #5735
- Update fluxcd/pkg dependencies by @fluxcdbot in #5739
- [release/v2.8.x] Update toolkit components by @fluxcdbot in #5741

Highlights
Flux v2.8.0 is a feature release. Users are encouraged to upgrade for the best experience.
For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.8 GA blog post.
Overview of the new features:
- Helm v4 support, including server-side apply and kstatus-based health checking (HelmRelease)
- Readiness evaluation of Helm-managed objects with CEL expressions (HelmRelease)
- Improved observability of Helm releases with inventory tracking in .status.inventory (HelmRelease)
- Reduced the mean time to recovery of Flux-managed applications via CancelHealthCheckOnNewRevision feature gate (Kustomization, HelmRelease)
- Support for commenting on Pull Requests directly from Flux notifications (Provider)
- Custom SSA apply stages for ordering resource application in kustomize-controller (Kustomization)
- Automatic GitHub App installation ID lookup from the repository owner (GitRepository, ImageUpdateAutomation, Provider)
- Support for Cosign v3 for verifying OCI artifacts and container images (OCIRepository)
- ArtifactGenerator support for extracting and modifying Helm charts (ArtifactGenerator)
- Bypass cache when fetching source objects via DirectSourceFetch feature gate (Kustomization, HelmRelease, ArtifactGenerator)
❤️ Big thanks to all the Flux contributors that helped us with this release!
Kubernetes compatibility
This release is compatible with the following Kubernetes versions:
──────────────────┬────────────────
Kubernetes version│Minimum required
──────────────────┼────────────────
v1.33 │>= 1.32.0
──────────────────┼────────────────
v1.34 │>= 1.34.1
──────────────────┼────────────────
v1.35 │>= 1.35.0
──────────────────┴────────────────
Note
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.
OpenShift compatibility
Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.
Upgrade procedure
⚠️ The Flux APIs v1beta2 and v2beta2 (deprecated in 2024) have reached end-of-life and have been removed from the CRDs.
Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.8.
Components changelog
- source-controller v1.8.0
- kustomize-controller v1.8.0
- notification-controller v1.8.0
- helm-controller v1.5.0
- image-reflector-controller v1.1.0
- image-automation-controller v1.1.0
- source-watcher v2.1.0
CLI changelog
- ci: Set GITHUB_TOKEN in the release-flux-manifests workflow by @stefanprodan in #5547
- Add backport label for Flux 2.7 by @matheuscscp in #5550
- build(deps): bump the ci group across 1 directory with 3 updates by @dependabot[bot] in #5548
- Fix flux push artifact not working with --provider by @matheuscscp in #5551
- Extend flux migrate to work with local files by @matheuscscp in #5554
- Improve flux migrate for live cluster migrations by @stefanprodan in #5558
- Fix flux migrate -f command to work with comments by @matheuscscp in #5560
- Add source-watcher to docs by @stefanprodan in #5562
- Fix flux migrate -f not considering kind comments by @matheuscscp in #5563
- refactor: convert Kustomization resource into unstructured map only once during variable substitution by @ramasai1 in #5566
- Update toolkit components by @fluxcdbot in #5568
- Disable AUR publishing by @stefanprodan in #5570
- Fix manifest generation for --storage-adv-addr and --events-addr flags by @stefanprodan in #5574
- Update dependencies to Kubernetes v1.34.1 and Go 1.25.2 by @stefanprodan in #5576
- Update toolkit components by @fluxcdbot in #5578

What's Changed
- [release/v2.7.x] Update toolkit components by @fluxcdbot in #5649
Full Changelog: v2.7.4...v2.7.5

What's Changed
- [release/v2.7.x] ci: Include source-watcher in the e2e test suite by @fluxcdbot in #5615
- [release/v2.7.x] Add source.extensions.fluxcd.io group to aggregated RBAC roles by @fluxcdbot in #5628
- [release/v2.7.x] Fix panic on reconcile with source of ExternalArtifact kind by @fluxcdbot in #5631
- [release/v2.7.x] Upgrade k8s to 1.34.2, c-r to 0.22.4 and helm to 3.19.2 by @fluxcdbot in #5634
- [release/v2.7.x] diff: report if object is skipped by @fluxcdbot in #5635
- [release/v2.7.x] Update toolkit components by @fluxcdbot in #5640
- [release/v2.7.x] Allow option to skip tenant namespace creation by @fluxcdbot in #5642
Full Changelog: v2.7.3...v2.7.4

Highlights
Flux v2.7.3 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Restore SOCKS5 proxy support in all controllers
- Fix status reporting of HelmReleases with RetryOnFailure strategy
- Automated retries for ImagePolicies when no image tags are found in the database
- Fix alerting for Telegram's message_thread_id
- Allow running kustomize-controller and helm-controller on the same loopback interface as source-watcher
⚠️ Note that signature verification for OCI artifacts in source-controller is not compatible with Cosign v3. Users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.
Components changelog
- source-controller v1.7.3
- kustomize-controller v1.7.2
- notification-controller v1.7.4
- helm-controller v1.4.3
- image-reflector-controller v1.0.3
- image-automation-controller v1.0.3
CLI changelog
- [release/v2.7.x] Pin cosign to v2.6.1 by @fluxcdbot in #5595
- [release/v2.7.x] Update toolkit components by @fluxcdbot in #5605
- [release/v2.7.x] fix: return accepted values for flags when calling Values.Type() by @fluxcdbot in #5606
Full Changelog: v2.7.2...v2.7.3

Highlights
Flux v2.3.0 is a feature release. Users are encouraged to upgrade for the best experience.For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.3 GA blog post.This release marks the General Availability (GA) of Flux Helm features and APIs, including helm-controller, the HelmRelease, HelmChart, and HelmRepository APIs.The HelmRepository v2 API comes with new features, such as the ability to reference Helm charts from OCIRepository sources, reuse existing HelmChart resources, and verify the integrity of Helm chart artifacts signed with Notary Notation.❤️ Big thanks to all the Flux contributors that helped us with this release!Kubernetes compatibility
This release is compatible with the following Kubernetes versions:| Kubernetes version | Minimum required |
|--------------------|------------------|
| v1.28 | >= 1.28.0 |
| v1.29 | >= 1.29.0 |
| v1.30 | >= 1.30.0 |[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.
API changes
HelmRelease v2
The HelmRelease kind was promoted from v2beta2 to v2 (GA).The v2 API is backwards compatible with v2beta2, with the exception of the deprecated fields which have been removed.Removed fields:- .spec.chart.spec.valuesFile replaced by .spec.chart.spec.valuesFiles.
- .spec.postRenderers.kustomize.patchesJson6902 replaced by .spec.postRenderers.kustomize.patches.
- .spec.postRenderers.kustomize.patchesStrategicMerge replaced by .spec.postRenderers.kustomize.patches.
- .status.lastAppliedRevision replaced by .status.history.chartVersion.
New fields:- .spec.chartRef allows referencing chart artifacts from OCIRepository and HelmChart objects.
- .spec.chart.spec.ignoreMissingValuesFiles allows ignoring missing values files instead of failing to reconcile.
HelmChart v1
The HelmChart kind was promoted from v1beta2 to v1 (GA).The v1 API is backwards compatible with v1beta2, with the exception of the deprecated fields which have been removed.Removed fields:- .spec.valuesFile replaced by .spec.chart.valuesFiles.
New fields:- .spec.ignoreMissingValuesFiles allows ignoring missing values files instead of failing to reconcile.
- .spec.verify.provider: notation verify the signature of a Helm OCI artifacts using Notation trust policy and CA certificate.
HelmRepository v1
The HelmRepository kind was promoted from v1beta2 to v1 (GA).The v1 API is backwards compatible with v1beta2.OCIRepository v1beta2
The OCIRepository kind gains new optional fields with no breaking changes.New fields:- .spec.ref.semverFilter allows filtering the tags based on regular expressions before applying the semver range.
- .spec.verify.provider: notation verify the signature of OCI artifacts using Notation trust policy and CA certificate.
Kustomization v1
The Flux Kustomization kind gains new optional fields with no breaking changes.New fields:- .spec.namePrefix allows setting a name prefix for the generated resources.
- .spec.nameSuffix allows setting a name suffix for the generated resources.
ImageUpdateAutomation v1beta2
The ImageUpdateAutomation kind was promoted from v1beta1 to v1beta2.The v1beta2 API is backwards compatible with v1beta1.Deprecated fields:- Updated template data has been deprecated in favour of Changed that is designed to accommodate for all the types of updates made.
New fields:- .spec.policySelector allows filtering ImagePolicy based on labels.
Receiver v1
The Receiver kind gains new optional fields with no breaking changes.New fields:- .spec.type: cdevents allows receiving, validating and filtering of CDEvents.
Upgrade procedure
Upgrade Flux from v2.x to v2.3.0 either by rerunning bootstrap or by using the Flux GitHub Action.For more details, please refer to the upgrade guide from the Announcing Flux 2.3 GA blog post.Components c

Components changelog
- helm-controller v0.37.2
CLI Changelog
- PR #4505 - @hiddeco - Update helm-controller to v0.37.2 in tests
- PR #4501 - @fluxcdbot - Update toolkit components
- PR #4499 - @stuebingerb - Fix typo in Git bootstrap
- PR #4495 - @dependabot[bot] - build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 in /tests/integration
- PR #4494 - @dependabot[bot] - build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0
- PR #4493 - @dependabot[bot] - build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 in /tests/azure
- PR #4491 - @dependabot[bot] - build(deps): bump the ci group with 3 updates

Components changelog
- source-controller v1.2.3
- kustomize-controller v1.2.1
- notification-controller v1.2.3
- helm-controller v0.37.1
CLI Changelog
- PR #4488 - @hiddeco - tests: update API dependencies
- PR #4484 - @stefanprodan - Run conformance tests for Kubernetes v1.29.0
- PR #4483 - @fluxcdbot - Update toolkit components
- PR #4481 - @hoexter - Remove duplicate part of the reconcile hr --reset help message
- PR #4478 - @stefanprodan - Remove deprecated monitoring configs
- PR #4476 - @hiddeco - Properly detect unsupported API errors
- PR #4468 - @hiddeco - Add 2.2.x backport label

- The .patchesStrategicMerge and .patchesJson6902 Kustomize post-rendering fields have been deprecated in favor of .patches.
- The .status.lastAppliedRevision and .status.lastReleaseRevision fields have been deprecated in favor of .status.history.
- The .status.lastAttemptedValuesChecksum has been deprecated in favor of .status.lastAttemptedConfigDigest.
- Drift detection and correction is now enabled on a per-release basis using the .spec.driftDetection.mode field.
- Ignoring specific fields during drift detection and correction is now supported using the .spec.driftDetection.ignore
- Helm tests can now be selectively run using the .spec.test.filters field.
- A history of metadata from Helm releases up to the previous successful release is now available in the .status.history field.
This includes any Helm test results when enabled.
- The .status.lastHandledForceAt and .status.lastHandledResetAt fields have been introduced to track the last time a force upgrade or reset was handled.
New Documentation
- HelmRelease v2beta2 specification
- Enable in-memory kustomize builds guide
Components changelog
- source-controller v1.2.2
- kustomize-controller v1.2.0
- notification-controller v1.2.2
- helm-controller v0.37.0
- image-reflector-controller v0.31.1
- image-automation-controller v0.37.0
CLI Changelog
- PR #4467 - @stefanprodan - Drop support for Kubernetes EOL versions
- PR #4465 - @stefanprodan - build: Update alpine and kubectl in flux-cli image
- PR #4464 - @souleb - Update go-git-providers to v0.19.2
- PR #4463 - @stefanprodan - Update Git dependencies
- PR #4461 - @fluxcdbot - Update toolkit components
- PR #4455 - @chewong - Fix typos in flux bootstrap documentation
- PR #4454 - @fluxcdbot - Update toolkit components
- PR #4437 - @stefanprodan - Add force and reset flags to flux reconcile hr
- PR #4433 - @darkowlzz - Update Helm OCI RFC - static HelmRepository design
- PR #4424 - @somtochiama - Show distribution name in flux check and flux version
- PR #4422 - @somtochiama - bootstrap: More details for context deadline exceeded error
- PR #4416 - @stefanprodan - Update dependencies to Kubernetes v1.28
- PR #4409 - @somtochiama - Make events cmd work well with lowercased and only kind selector
- PR #4404 - @VinGarcia - Fix flux install command so it returns an error when unexpected arguments are passed
- PR #4402 - @mclarke47 - fix build_artifact.go typo
- PR #4388 - @stefanprodan - [RFC-0003] OIDC identity matching for keyless verification
- PR #4382 - @darkowlzz - tests/int: Set exit code 1 on tf destroy fail
- PR #4380 - @hiddeco - Tweak permissions on created files
- PR #4355 - @somtochiama - Confirm before overriding installation by another manager
- PR #4345 - @somtochiama - Prevent flux install from overriding bootrapped cluster
- PR #4332 - @matheuscscp - Add CLI flags for OCIRepository signature verification
- PR #4329 - @hiddeco - Address various issues throughout code base
- PR #4324 - @somtochiama - bootstrap: Fix error msg when the Git token doesn't match the repo owner
- PR #4323 - @stefanprodan - e2e: Update Go dependencies
- PR #4317 - @Jaykul - Correct "sync" to "component" in log lines
- PR #4313 - @fluxcdbot - Update toolkit components
- PR #4311 - @darkowlzz - Check readiness of Flux kinds using kstatus
- PR #4298 - @darkowlzz - Add support for HelmRepo OCI and NC v1beta3 static objects
- PR #4296 - @Skarlso - fix: only wait for changeset if the result is not empty
- PR #4285 - @matheuscscp - Add badge for SLSA Level 3
- PR #4284 - @errordeveloper - Make flux pull work for OCI artifacts produced by other tools
- PR #4270 - @Azhovan - feat: add bootstrap gitea command
- PR #4255 - @hiddeco - tests/azure: update controller dependencies
- PR #4251 - @fluxcdbot - Update toolkit components
- PR #4238 - @makkes - Upgrade github.com/fluxcd/pkg/{git,git/gogit}
- PR #4233 - @sonbui00 - chore: remove support armv6h for aur package
- PR #4228 - @sonbui00 - Improve AUR package templates
- PR #4226 - @somtochiama - U

Fixes
- Ensures faster recovery of Kustomization and HelmRelease resources when the source-controller has restarted and is working on restoring the storage.
- Prevent source-controller from failing to reconcile OCIRepositories when artifacts contain symlinks.
- Addresses issue with helm-controller miss-labeling Custom Resource Definitions.
- Detect immutable field errors in Google Cloud resources managed by Flux Kustomizations.
- Better error reporting for flux bootstrap when the owner doesn't match the identity associated with the given token.
- Allow flux pull artifact to fetch OCI artifacts produced by other tools.
Components changelog
- source-controller v1.1.2
- kustomize-controller v1.1.1
- helm-controller v0.36.2
CLI Changelog
- PR #4324 - @somtochiama - bootstrap: Fix error msg when the Git token doesn't match the repo owner
- PR #4323 - @stefanprodan - e2e: Update Go dependencies
- PR #4313 - @fluxcdbot - Update toolkit components
- PR #4296 - @Skarlso - fix: only wait for changeset if the result is not empty
- PR #4285 - @matheuscscp - Add badge for SLSA Level 3
- PR #4284 - @errordeveloper - Make flux pull work for OCI artifacts produced by other tools

Fixes
- Use auto lookup strategy for Buckets to widen support for S3-compatible object storage services (source-controller).
- Fix Secret type check for HelmRepositories TLS certs referred in .spec.secretRef (source-controller).
- Fix the branch name reporting when the push branch is the same as the checkout branch (image-automation-controller).
- Restore Helm logs inclusion in failure events (helm-controller).
- Fix the impersonation of the default service account when diffing HelmReleases (helm-controller).
- Check source for nil artifact before loading Helm charts (helm-controller).
- Update the description of Kubernetes specific flag to distinguish them from Flux bootstrap flags (flux CLI).
Components changelog
- source-controller v1.1.1
- helm-controller v0.36.1
- image-automation-controller v0.36.1
CLI Changelog
- PR #4255 - @hiddeco - tests/azure: update controller dependencies
- PR #4251 - @fluxcdbot - Update toolkit components
- PR #4246 - @dependabot[bot] - build(deps): bump the ci group with 4 updates
- PR #4238 - @makkes - Upgrade github.com/fluxcd/pkg/{git,git/gogit}
- PR #4233 - @sonbui00 - chore: remove support armv6h for aur package
- PR #4228 - @sonbui00 - Improve AUR package templates
- PR #4227 - @dependabot[bot] - build(deps): bump the ci group with 3 updates
- PR #4226 - @somtochiama - Update description of kubeconfig specific flag
- PR #4222 - @dependabot[bot] - build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 in /tests/integration
- PR #4221 - @dependabot[bot] - build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 in /tests/azure
- PR #4215 - @dependabot[bot] - build(deps): bump the ci group with 4 updates
- PR #4213 - @dependabot[bot] - build(deps): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible in /tests/integration
- PR #4212 - @dependabot[bot] - build(deps): bump github.com/docker/docker from 23.0.1+incompatible to 23.0.3+incompatible in /tests/integration
- PR #4198 - @makkes - Add 2.1.x backport label
- PR #4197 - @stefanprodan - Fix links to fluxcd.io
- PR #4195 - @dependabot[bot] - build(deps): bump the ci group with 2 updates

- the deprecated field .spec.gitImplementation was removed
- the unused field .spec.accessFrom was removed
- the deprecated field .status.contentConfigChecksum was removed
- the deprecated field .status.artifact.checksum was removed
- the .status.url was removed (replaced by .status.artifact.url)
- the deprecated field .spec.validation was removed
- the deprecated field .spec.patchesStrategicMerge was removed (replaced by .spec.patches)
- the deprecated field .spec.patchesJson6902 was removed (replaced by .spec.patches)
- the deprecated field .status.url was removed (replaced by .status.webhookPath)
New Documentation
- Release cadence and support
- SLSA Assessment
- Controller sharding and horizontal scaling
- GitRepository v1 specification
- Kustomization v1 specification
- Receiver v1 specification
Components changelog
- source-controller v1.0.0
- kustomize-controller v1.0.0
- notification-controller v1.0.0
- helm-controller v0.35.0
- image-reflector-controller v0.29.0
- image-automation-controller v0.35.0
CLI Changelog
- PR #4035 - @stefanprodan - Update dependencies
- PR #4033 - @stefanprodan - docs: link to releases spec from website
- PR #4031 - @stefanprodan - Run conformance tests for Kubernetes v1.27.3
- PR #4029 - @stefanprodan - Run e2e tests on release branches
- PR #4028 - @makkes - Annotate errors from go-git-providers
- PR #4027 - @hiddeco - Update go-git to unreleased v5.8.0
- PR #4023 - @stefanprodan - Add backport GitHub Action workflow
- PR #4020 - @stefanprodan - Set minimum supported version to Kubernetes 1.24.0
- PR #4018 - @stefanprodan - docs: Fix the flux push example for ECR
- PR #4015 - @stefanprodan - Align go.mod version with Kubernetes (Go 1.20)
- PR #4008 - @stefanprodan - Add SLSA3 generators to release workflow
- PR #4006 - @fluxcdbot - Update toolkit components
- PR #4002 - @makkes - Don't log errors with missing CRDs for "get * all" commands
- PR #3990 - @aryan9600 - RFC-0004: add section about proxy
- PR #3976 - @darklore - Use equivalent and shorter way to generate shell completions
- PR #3955 - @somtochiama - Fix 'patchesJson6902' is deprecated' warning
- PR #3945 - @makkes - Make flux logs more lenient