Flux 2.10.0

What's new in 2.10.0

Highlights
Flux v2.10.0 is a feature release. Users are encouraged to upgrade for the best experience.
Overview of the new features:
- Object identity is generally available; the ObjectLevelWorkloadIdentity feature gate is retired
- SPIFFE mTLS for inter-controller communication
- Notification Event, Alert and Provider APIs promoted to v1
- OCIRepository as a chart source for HelmRelease
- SOPS decryption for files encrypted with comment regexes, and --override-manager-before-dry-run (Kustomization)
- Image update batching with .spec.policyChangeDelay, retry on rejected pushes, and .Changed.Summary (ImageUpdateAutomation)
- Flux artifact storage backend enabled by default for ImageRepository tags
- Cross-namespace artifacts, tenant namespace provisioning, and path-pattern discovery (ArtifactGenerator)
- New Zoom, incident.io and Mastodon notification providers
- Built with Kubernetes 1.37 and Go 1.27
❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility
This release is compatible with the following Kubernetes versions:
──────────────────┬────────────────
Kubernetes version│Minimum required
──────────────────┼────────────────
v1.35 │>= 1.35.2
──────────────────┼────────────────
v1.36 │>= 1.36.1
──────────────────┼────────────────
v1.37 │>= 1.37.0
──────────────────┴────────────────
Note
Note that the Flux project offers support only for the latest three minor versions of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as
ControlPlane that provide enterprise support for Flux.

OpenShift compatibility
Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure
⚠️ Breaking changes in this release:
- Object identity is always enabled and the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding.
- The notification Alert and Provider APIs are promoted to v1. …

Full release notes »