Skip to content
This repository was archived by the owner on Jul 31, 2026. It is now read-only.

chore(deps): update dependency flux2 to v2.9.3 - #80

Open
bde-dev wants to merge 1 commit into
mainfrom
renovate/flux2-2.x
Open

chore(deps): update dependency flux2 to v2.9.3#80
bde-dev wants to merge 1 commit into
mainfrom
renovate/flux2-2.x

Conversation

@bde-dev

@bde-dev bde-dev commented Feb 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

This PR contains the following updates:

Package Update Change
flux2 minor 2.7.5 → 2.9.3

Release Notes

fluxcd/flux2 (flux2)

v2.9.3

Compare Source

Highlights

Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and spec.images entries that set only some image fields discarding the remaining fields already declared for the same image in the kustomization.yaml. The latter affects both kustomize-controller and the flux build|diff kustomization commands. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix empty lines vanishing from rendered chart manifests (helm-controller)
  • Fix HasBeenTested for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)
  • Fix a spec.images entry setting only some of the image fields discarding the remaining fields already declared for the same image in the kustomization.yaml at spec.path, e.g. overriding only newName produced an untagged image reference (kustomize-controller, flux CLI)

Improvements:

  • Update fluxcd/pkg dependencies
  • Include source-watcher in the OCI flux-manifests artifact

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.2...v2.9.3

v2.9.2

Compare Source

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
  • Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
  • Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
  • Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

  • Update fluxcd/pkg dependencies

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.1...v2.9.2

v2.9.1

Compare Source

Highlights

Flux v2.9.1 is a patch release. The main fix, applied across all controllers, disables Flux variable substitution on the Flux CRDs by annotating them with kustomize.toolkit.fluxcd.io/substitute: disabled, so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schemas when they contain ${...} sequences. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Disable Flux variable substitution on all Flux CRDs, preventing post-build substitution from corrupting CRD schemas that contain ${...} sequences (all controllers)
  • Update SOPS dependency to fix .ini file decryption (kustomize-controller)
  • Fix a dry-run error where applying a resource with a strategic merge patch could fail with <resource> is invalid (kustomize-controller)
  • Fix a breaking change in the in-memory Kustomization build (Flux CLI)

Improvements:

  • Cache the registry authorization token during Notation verification, so it is fetched once per verification instead of once per request (source-controller)
  • Update fluxcd/pkg dependencies

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.0...v2.9.1

v2.9.0

Compare Source

Highlights

Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.

Overview of the new features:

  • Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
  • Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
  • SOPS decryption with the Age post-quantum cipher (Kustomization)
  • Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
  • Helm post-render strategies, including chart hooks support (HelmRelease)
  • Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
  • Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
  • Git commit signing and verification with SSH keys (GitRepository, ImageUpdateAutomation)
  • AWS CodeCommit authentication using Workload Identity (GitRepository)
  • Custom Sigstore trusted root for keyless verification in air-gapped environments (OCIRepository)
  • Path pattern directory discovery for monorepos (ArtifactGenerator)
  • Secret-less, OIDC-secured webhook Receivers (Receiver)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version Minimum required
v1.34 >= 1.34.1
v1.35 >= 1.35.0
v1.36 >= 1.36.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2
have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.

Components changelog

CLI changelog

New Contributors

Full Changelog: fluxcd/flux2@v2.8.0...v2.9.0

v2.8.8

Compare Source

Highlights

Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller)
  • Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller)
  • Stop force-applying non-CRD objects placed under a chart's crds/ directory (helm-controller)
  • Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller)
  • Improve path handling in the source reconcilers (source-controller)
  • Support Helm semver build-metadata encoding in OCIRepository tags (source-controller)

Improvements:

  • Update go-git to v5.19.1 which fixes CVE-2026-45571 and CVE-2026-45570 (source-controller, image-automation-controller)
  • Move Helm back to upstream v4.2.0 (source-controller, helm-controller)
  • Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller)
  • Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller)
  • Update fluxcd/pkg dependencies

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.7...v2.8.8

v2.8.7

Compare Source

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

  • Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
  • Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.6...v2.8.7

v2.8.6

Compare Source

Highlights

Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)
  • Ignore force replace when server-side apply is enabled (helm-controller)
  • Fix a regression where generic providers would not forward commit status events (notification-controller)
  • Require the audience field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)

Improvements:

  • Introduce the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries (kustomize-controller)
  • Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.5...v2.8.6

v2.8.5

Compare Source

Highlights

Flux v2.8.5 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)
  • Fix Azure Blob prefix option not being passed to the storage client (source-controller)

Improvements:

  • Improve error message for encrypted SSH keys without password (source-controller)
  • Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)
  • Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.4...v2.8.5

v2.8.4

Compare Source

Highlights

Flux v2.8.4 is a patch release that includes fixes for the Flux CLI. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix flux build ks and flux diff ks on Windows
  • Fix --source flag validation in create kustomization command

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.3...v2.8.4

v2.8.3

Compare Source

Highlights

Flux v2.8.3 is a patch release that fixes a regression in helm-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix templating errors for charts that include --- in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps (helm-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.2...v2.8.3

v2.8.2

Compare Source

Highlights

Flux v2.8.2 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix enqueuing new reconciliation requests for events on source Flux objects when they are already reconciling the revision present in the watch event (kustomize-controller, helm-controller)
  • Fix the Go templates bug of YAML separator --- getting concatenated to apiVersion: by updating to Helm 4.1.3 (helm-controller)
  • Fix canceled HelmReleases getting stuck when they don't have a retry strategy configured by introducing a new feature gate DefaultToRetryOnFailure that improves the experience when the CancelHealthCheckOnNewRevision is enabled (helm-controller)
  • Fix the auth scope for Azure Container Registry to use the ACR-specific scope (source-controller, image-reflector-controller)
  • Fix potential Denial of Service (DoS) during TLS handshakes (CVE-2026-27138) by building all controllers with Go 1.26.1

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.1...v2.8.2

v2.8.1

Compare Source

Highlights

Flux v2.8.1 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Fix Git commit status events being dropped for Kustomizations (notification-controller)
  • Fix health check for StatefulSets when the Pods are Pending/Unschedulable during rollout (helm-controller, kustomize-controller)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.8.0...v2.8.1

v2.8.0

Compare Source

Highlights

Flux v2.8.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.8 GA blog post.

Overview of the new features:

  • Helm v4 support, including server-side apply and kstatus-based health checking (HelmRelease)
  • Readiness evaluation of Helm-managed objects with CEL expressions (HelmRelease)
  • Improved observability of Helm releases with inventory tracking in .status.inventory (HelmRelease)
  • Reduced the mean time to recovery of Flux-managed applications via CancelHealthCheckOnNewRevision feature gate (Kustomization, HelmRelease)
  • Support for commenting on Pull Requests directly from Flux notifications (Provider)
  • Custom SSA apply stages for ordering resource application in kustomize-controller (Kustomization)
  • Automatic GitHub App installation ID lookup from the repository owner (GitRepository, ImageUpdateAutomation, Provider)
  • Support for Cosign v3 for verifying OCI artifacts and container images (OCIRepository)
  • ArtifactGenerator support for extracting and modifying Helm charts (ArtifactGenerator)
  • Bypass cache when fetching source objects via DirectSourceFetch feature gate (Kustomization, HelmRelease, ArtifactGenerator)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version Minimum required
v1.33 >= 1.32.0
v1.34 >= 1.34.1
v1.35 >= 1.35.0

[!NOTE]
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

⚠️ The Flux APIs v1beta2 and v2beta2 (deprecated in 2024) have reached end-of-life and have been removed from the CRDs.

Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.8.

Components changelog

CLI changelog

New Contributors

Full Changelog: fluxcd/flux2@v2.7.0...v2.8.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@bde-dev bde-dev added the mise label Feb 24, 2026
@bde-dev

bde-dev commented Feb 24, 2026

Copy link
Copy Markdown
Owner Author

AI Assessment

Field Value
Decision NEEDS_REVIEW
Risk Level HIGH
Update Type MINOR
Component flux2
Version 2.7.5 -> 2.8.0
Breaking Changes true

Analysis

Flux2 is a critical core infrastructure component in this Kubernetes homelab (GitOps controller). While this is a minor version update (2.7.5 → 2.8.0), it contains confirmed breaking changes: (1) Removal of deprecated v1beta2 and v2beta2 CRD APIs, (2) Updated Kubernetes version compatibility matrix with minimum requirement of v1.32.0 for K8s v1.33+, and (3) Multiple infrastructure component upgrades (source-controller, kustomize-controller, notification-controller, helm-controller, image controllers). The release notes explicitly mention an 'Upgrade Procedure' warning and recommend following documented migration steps. This requires validation that: (a) all GitOps manifests are using v1 or v2 stable API versions, (b) the cluster meets the new K8s minimum version requirements, and (c) all feature flags and behaviors are compatible with the new version.

Recommendation

Manual review is required before merging. Steps: (1) Verify all Flux custom resources in the GitOps repository use v1 or v2 API versions (not deprecated v1beta2/v2beta2), (2) Confirm the homelab's Kubernetes version meets minimum requirements (≥v1.32.0 for K8s v1.33+), (3) Review the 'Announcing Flux 2.8 GA' blog post for new features and behavioral changes, (4) Test the upgrade in a non-production environment first, (5) Execute the documented upgrade procedure, (6) Validate that all Flux resources reconcile successfully post-upgrade. Consider staging this update with a manual test before auto-merging.

Analyzed by n8n AI Agent using Claude

@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.0 chore(deps): update dependency flux2 to v2.8.1 Feb 27, 2026
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.1 chore(deps): update dependency flux2 to v2.8.2 Mar 12, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch 2 times, most recently from 7f638fc to ce2393c Compare March 16, 2026 14:01
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.2 chore(deps): update dependency flux2 to v2.8.3 Mar 16, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from ce2393c to 783201b Compare April 17, 2026 14:01
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.3 chore(deps): update dependency flux2 to v2.8.5 Apr 17, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 783201b to 171b49d Compare June 1, 2026 13:03
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.5 chore(deps): update dependency flux2 to v2.8.8 Jun 1, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 171b49d to b2b3b46 Compare June 1, 2026 16:01
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch 6 times, most recently from b982402 to f443622 Compare June 10, 2026 13:08
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.8 chore(deps): update dependency flux2 to v2.8.8 - autoclosed Jun 10, 2026
@bde-dev bde-dev closed this Jun 10, 2026
@bde-dev
bde-dev deleted the renovate/flux2-2.x branch June 10, 2026 16:08
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.8 - autoclosed chore(deps): update dependency flux2 to v2.8.8 Jun 10, 2026
@bde-dev bde-dev reopened this Jun 10, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch 2 times, most recently from f443622 to 378bb7f Compare June 10, 2026 17:01
@bde-dev

bde-dev commented Jun 19, 2026

Copy link
Copy Markdown
Owner Author

AI Assessment

Field Value
Decision NEEDS_REVIEW
Risk Level MEDIUM
Update Type MINOR
Component flux2 (Flux CD GitOps Toolkit)
Version 2.7.5 -> 2.8.8
Breaking Changes true

Analysis

While v2.8.8 is a stable patch release with CVE fixes and reliability improvements, this update spans the v2.8.0 feature release which contains API removals. As a core infrastructure component (Flux CD is critical for GitOps operations), and given the breaking changes introduced in 2.8.0, manual verification is required to ensure the homelab's Flux manifests use the current API versions and are compatible with the new Helm v4 support.

Recommendation

NEEDS_REVIEW - Before merging, verify: (1) All Flux custom resources use v1 or v2 API versions (not deprecated v1beta2/v2beta2), (2) HelmRelease resources are compatible with Helm v4 if applicable, (3) Follow the official Flux v2.7+ upgrade procedure. Once verified, this update is safe to apply as it includes important security fixes and stability improvements.

Analyzed by n8n AI Agent using Claude

@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 378bb7f to 7cd70de Compare June 30, 2026 16:01
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.8.8 chore(deps): update dependency flux2 to v2.9.0 Jun 30, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 7cd70de to 71b89bb Compare July 7, 2026 14:01
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.9.0 chore(deps): update dependency flux2 to v2.9.1 Jul 7, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 71b89bb to f6c1c75 Compare July 13, 2026 14:00
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.9.1 chore(deps): update dependency flux2 to v2.9.2 Jul 13, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from f6c1c75 to 3ca5a0a Compare July 23, 2026 18:23
@bde-dev bde-dev changed the title chore(deps): update dependency flux2 to v2.9.2 chore(deps): update dependency flux2 to v2.9.3 Jul 23, 2026
@bde-dev
bde-dev force-pushed the renovate/flux2-2.x branch from 3ca5a0a to 6269e87 Compare July 27, 2026 19:03
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

mise

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bde-dev @renovate-bot