Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
Flux
GitOps toolkit for continuously reconciling Kubernetes clusters.
Latest Flux changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Flux release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Flux updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
Flux updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
1
5
20
Latest Flux changelog updates
Patch v2.9.4 fixes numerous controller issues (tarball extraction, glob limits, refspec restrictions, HTTP request limits, Helm repo index handling, OCI chart digest pinning, GCS static auth, Bucket error handling)
Fixed Helm controller rendering so empty lines no longer disappear from generated chart manifests.
Fixed regression causing Kustomization with openapi.path URLs to fail reconciliation
Disabled Flux variable substitution on all CRDs to prevent schema corruption with post‑build substitution.
Introduces a Flux CLI plugin system with Mirror and Schema plugins and many new capabilities such as SSA ignore rules, Age‑based SOPS decryption, workload‑identity auth for Vault/OpenBao, Helm post‑render hooks, literal Helm values, empt...
Added security patches by updating go‑git to v5.19.1 (fixing CVE‑2026‑45571/45570) and upgrading Kubernetes to v1.36.1.
Fixed kustomize controller bug that caused non‑namespaced resources annotated with ssa:IfNotPresent to be repeatedly deleted and recreated
Fixed helm controller post-renderer conflict and ignored force replace when server‑side apply is enabled.
Fixed race condition in Kustomize controller that caused stale cache data and stuck reconciliations.
Fixes flux build ks and flux diff ks commands on Windows
Fixed regression in Helm controller causing templating errors for charts with embedded content (YAML separators, scripts, CAs in ConfigMaps).
Fixed enqueuing logic for source Flux objects and corrected Go template separator issue with Helm 4.1.3
Fixed Git commit status events being dropped for Kustomizations in the notification controller.
Add Helm v4 support with server‑side apply, health checks, CEL‑based readiness, inventory tracking, and new feature gates like CancelHealthCheckOnNewRevision and DirectSourceFetch; extend GitHub integration for PR comments and automatic ...
Fix HelmRelease history truncation when using the RetryOnFailure strategy.
Added DisableConfigWatchers feature gate, ArtifactGenerator to aggregated RBAC roles, source.extensions group, and an option to skip tenant namespace creation.
Restored SOCKS5 proxy support across all controllers and fixed HelmRelease status reporting with RetryOnFailure.
Flux v2.7.2 patch release adds security fixes by rebuilding all components with Go 1.25.2 and updating to Kubernetes v1.34.1.
Extend `flux migrate` to handle Git‑repo and local manifests, live cluster migrations, and improve comment handling.
General availability of Image Automation APIs (ImagePolicy, ImageRepository, ImageUpdateAutomation) plus new features like remote cluster authentication via Workload Identity, mTLS for alerts and GitHub App, OpenTelemetry tracing, and CE...
Patch release v2.6.4 with bug fixes
Fixed RSA SHA2-256/512 host key prioritization for SSH in source controller, image automation controller, and CLI bootstrap.
Fix Azure DevOps runner authentication for flux push artifact provider azure.
Updated Image Reflector Controller to v0.35.1.
General availability of OCI Artifacts APIs and artifact commands, including OCI digest pinning, workload‑level identity authentication, and cached registry credentials
Upgrade kustomize controller to v1.5.1.
Introduces GitHub App authentication, custom health checks (CEL), fine‑grained garbage collection, secret decryption, custom event metadata, OCIRepository commit status updates, CEL‑based resource filtering, and debug commands for Kustom...
GA of Bucket v1 API with proxy, mTLS, and custom STS support; GitRepository, OCIRepository, and HelmRelease gain optional fields for OIDC, proxy, and schema‑validation control
General Availability of Helm controller and GA APIs (HelmRelease v2, HelmChart v1, HelmRepository v1) with new fields and removal of deprecated fields
Updated Kubernetes to v1.28.6 and other dependencies, patching upstream CVEs and rebuilding controllers with Go 1.21.6 on Alpine 3.19.1.
Fixed label selector sharding issue in the Helm controller (now v0.37.2).
- Fixed API backwards‑compatibility issues and improved error detection in kustomize and helm controllers.
Updated Flux CLI and controllers (Kustomize v5.3, Kubernetes v1.28.4) with Gitea bootstrap support, force/reset commands for HelmRelease, and expanded alerting (NATS, Bitbucket Server).
Improve recovery of Kustomization and HelmRelease resources after source controller restart
Add auto‑lookup strategy for Buckets to broaden S3‑compatible storage support (source controller)
Extended Flux APIs with new proxy settings, verify modes, apply policies, Git push refspec/options, and adoption of Kubernetes TLS Secrets (new cert fields, deprecating caFile/keyFile/certFile).
Fixed AWS authentication for cross‑region ECR repositories in source and image reflector controllers.
Promoted GitRepository, Kustomization, and Receiver APIs to v1 (GA), removing several deprecated fields and requiring manifest updates – a breaking change.
Patch release fixing bugs across multiple controllers.
Added automatic detection of cgroup v1 paths to helm controller's OOM watch feature.
Added experimental HelmRelease drift detection and DNS lookup support in Helm templates via feature gates
Updated notification controller to correctly handle default API version for ImageRepositories when no version is set on a Receiver.
Update source controller to prevent excessive memory usage during HelmRepository reconciliation
Deprecate Image Automation autologin flags and change source revision format to `<branch tag @sha1:<commit>` (breaking changes).
Embedded SBOM and SLSA Provenance attestations in Flux controller images and added scanning for CVEs (security).
Update git/gogit library to v0.4.1.
Fixes Notification API upgrade issues from v1beta1 to v1beta2.
Fix Notification API upgrade from v1beta1 to v1beta2
Graduated Notification API to v1beta2; requires updating CRDs and introduces breaking changes like field length limits and deprecating Receiver.status.url.
Deprecates the .spec.gitImplementation field, defaulting to go-git (affects Azure DevOps and AWS CodeCommit support) with a feature gate to revert.
Added Cosign signature verification for OCI Helm charts and a new generic HMAC alert provider for webhook authentication.
Strict validation now requires time units on duration fields (breaking change).
Breaking: Flux controller logs now use Kubernetes structured logging format.
Added contextual login for Helm charts from ECR, ACR, and GAR; introduced OCIRepository.layerSelector and Azure Blob SAS token authentication.
Added OCI artifact support with new `OCIRepository` source type, Helm OCI dependencies, and CLI commands (`flux push/pull/tag/artifact`).
Fix ImageRepository public repository scan for unconfigured provider registries
Fix SIGSEGV during chart dependency resolution
Fixed Helm OCI authentication caching issue, ensuring credentials reload each reconciliation
Fixed libgit2‑related issues: SSH connection leaks, known‑hosts error messages, and BitBucket server authentication; improved Helm OCI source reconciliation and logging in service meshes.
Fixed multiple controller bugs: Helm OCI chart semver sorting, service‑account impersonation, image name tag validation, libgit2 SSH host‑key verification, and GitLab HTTP/S authentication.
Breaking change: Flux no longer supports kubeconfigs using client.authentication.k8s.io/v1alpha1; users must upgrade to v1beta1.
Fix temporary directory generation to use absolute paths on all operating systems, addressing macOS file system issues.
Fix regression introduced in v0.30.0 that prevented macOS users from upgrading Flux via bootstrap due to filesystem security constraints.
Added option to disable remote bases in Kustomize overlays via `noRemoteBases=true`, enforcing local-only resources for security and performance.
Fixed HelmRepository Condition handling
Memory consumption reduced during HelmRepository reconciliation
Fixed source controller panic when a HelmRepository artifact lacked a Size (regression bug).
Updated dependencies to satisfy static security analysis tools
Fixed regression bug for Kustomizations files that include remote references
Breaking changes to source controller: runtime namespace env var ignored, file‑based KubeConfig options disabled, insecure/exec providers off by default (enable via flags).
Controller components upgraded: kustomize to v0.22.3, source to v0.22.5, image automation to v0.21.3, notification to v0.23.2
Patch release v0.28.4 improves stability of the experimental managed transport.
Fixed regression bug in SOPS Azure Key Vault decryption.
Fix regression that caused notification spam
Fixed regression bug in image update automation.
Graduates Flux Source API to v1beta2, requiring the new CRD for dependent controllers (breaking change) and adds new reconcilers.
Patch release v0.27.4 adds .spec.securityContext.fsGroup to Helm and Notification controller Deployments.
Improved libgit2 OpenSSL build dependency in image automation controller
Add basic authentication support for alerts sent to the Grafana annotations API.
Fix secret handling by converting stringData to data before diffing (workaround for upstream Kubernetes bug)
Enforced DNS‑label naming for Flux custom resources and made Helm uninstall wait enabled by default (disable via spec.uninstall.disableWait).
Fix bootstrap by resetting the schema cache after applying CRDs
Fixed race condition in flux bootstrap and CRD wait handling
Fix panic in bootstrap when orgRef is missing and correct exit code handling for flux diff.
Bump minimum supported Kubernetes to v1.20.6 and enable native impersonation for multi‑tenant clusters, altering controller behavior when both kubeConfig and ServiceAccountName are set.
Updated kubectl to 1.23.1 in the Flux CLI container image.
Fixed regression bug affecting Kubernetes 1.21 introduced in v0.25.0
Fix regression bug in self‑hosted GitLab bootstrap introduced in v0.25.0
Updated Flux components and CLI to Go 1.17/Alpine 3.15, aligning with Kubernetes 1.23 and Helm 3.7, and bumped component versions.
Adjusted the SHA hex length included in SemVer metadata for HelmCharts generated from GitRepository and Bucket resources using the Revision reconcile strategy.
Add a new bootstrap command for BitBucket Server/Data Center repositories.
Add artifact integrity verification based on SHA‑2
Bumped Helm, Image Reflector, and Image Automation controllers to newer versions (v0.12.2, v0.13.1, v0.17.1).
Flux bootstrap now prompts for GitHub/GitLab PAT when not set in the environment, removing the need for secret env vars.
Update toolkit components and bump source/image automation controller versions
Set ECDSA (nistp384) as the default SSH key algorithm for all Flux commands that generate SSH keys, replacing RSA SHA‑1 to comply with GitHub’s policy.
Updated source-controller to version 0.17.1
Introduces `flux tree` CLI command to display all Kubernetes resources managed by Flux, with expanded Helm release support.
Added a new --poll-interval flag to the flux check command and expanded test coverage (secret export unit test, libgit2 tag semver e2e test, envtest setup)
Added a new `--wait` flag to the `create kustomization` CLI command.
Improve drift detection for Kubernetes custom resources
Update kustomize controller to v0.15.4
Fixed server-side apply bugs for APIService objects on Kubernetes < 1.22, resolving metrics server deployment issues.
Introduced breaking changes and new features across core components, including server‑side apply support and multi‑arch kubectl image
Added dynamic completion support and fixed Zsh completion to work with source‑only mode.
Added new CLI options and bootstrap support for custom CAs, and enabled non‑interactive git source creation.
Updated toolkit components and added new log flags (--since, --since-time) for enhanced observability.
Added a watch flag to `flux get` and success message for secret creation; introduced patch‑based reconcile and other feature enhancements.
Add status selector flag to get commands for filtering by status conditions.
Updated kustomize, source, and toolkit components to latest versions and upgraded e2e Kubernetes to v1.21.1
Fix Azure DevOps SSH cloning issue
Fixed Helm CVE GHSA-56hp-xqp3-w2jf
Fix source controller compatibility on ARM64
Upgraded Flux and its controllers to Kustomize v4, which removes YAML anchor support, limits resource URLs to files/plain YAML/git clones (no archives), and can error on non‑string keys due to a Kustomize bug.
Upgrade go-git dependency to v5.4.2
Added GoFish as an install option for the Flux CLI.
Update go‑git library to v5.4.1
Updated toolkit components.
Updated the image automation controller to v0.9.1 and upgraded Go git providers to v0.1; refreshed Prometheus labels and dashboard
Updated toolkit components and introduced a new `suspend/resume all` command
Updated toolkit components to the latest versions.
Promote image automation APIs to v1alpha2 with breaking changes and update upgrade guides and docs
Added a flag to guard potentially destructive reconcile operations
Published OpenAPI schemas for Flux CRDs.
Ensure bootstrap always reports component health
Added support for private keys, recursive submodule handling, and source namespace option in Git bootstrap commands
Added ability to supply a private key from a file for Git sources/secrets and updated toolkit components.
Added new CLI capabilities: get‑all for sources/images, push‑branch and repo‑path flags, flux logs command, and configurable manifests directory
Restored the default key algorithm flag and added sourceSecret and manifest generation for Kustomizations.
Updated core controllers (image automation, kustomize) and toolkit components, embedded Kubernetes manifests in the flux binary with Apple Silicon support.
Added prerelease identifiers to Kubernetes version constraints handling.
Added security scanning actions (Snyk, CodeQL) and refactored the Flux GitHub Action.
Added image update feature parity roadmap, validation for single image policy selector, and caFile support in Git source/secret commands
Add resource‑by‑name lookup and multi‑values‑file support for creating Helm releases
Update toolkit UI components
Updated toolkit components to the latest version.
Fixed the create secret commands.
Fixed type handling in various get source commands.
Added functionality to create a secret for TLS commands (PR 788).
Fix RBAC cluster role binding by adding ServiceAccount namespace
Added dedicated service account per controller and leader election permissions
Updated the fluxcd/pkg/git dependency to version v0.2.3.
Bumped kustomize controller to v0.6.3
Removed default GitImplementation and added a custom flag for specifying the implementation.
Added regex filter to policy command, egress traffic support for controller pods, and Git‑based sync options generation.
Added `helm create secret` command and support for ecdsa/ed25519 keys in secret creation.
Update the image automation controller to v0.2.0, improving CI/CD image handling.
Updated documentation with notes on TargetPath, JSON values, deploy keys, ignored flux action binary, and fixed gitignore typo and zsh completion example.
Update toolkit components
Updated kustomize controller to v0.5.1.
Fixed cluster domain mapping to ensure correct routing
Introduce a cluster domain flag for the bootstrap command
Update source controller to v0.5.4
Updated source controller to v0.5.3.
Updated source, Kustomize, and Git controllers/components to newer versions (v0.5.2, v0.5.0, v0.7.0, v0.1.0).
Added new features: secret creation command, secret labeling, Helm controller update, automated Flux upgrades, and publishing install manifests.
Updated Helm controller to v0.4.1.
Added a service‑account argument to the create commands
Updated source controller and toolkit components to v0.4.x and added suspend/resume commands for sources.
Added AWS IAM role example to SOPS documentation
Update Helm controller to v0.2.1
Updated source and kustomize controllers to v0.2.2.
Added Terraform provider installation docs, Helm values file example, and typo fixes.
Updated notification controller to v0.2.1 and added target namespace flag to the create ks command
Updated kustomize controller to v0.2.1 and upgraded Kubernetes to 1.19 with kustomize 0.6.4
Source controller component upgraded to v0.2.1
Add GOTK section, monitoring guide, and several documentation updates (GitOps Toolkit, HelmRelease, stable Helm repo, README rewrite).
Updated toolkit components and added custom flags with validation rules
Added GitLab HTTPS auth, Windows CLI binary, rebase action, client‑side bootstrap validation, and cluster stats dashboard to the CLI
Added install package and ARM instruction guide, plus new featured talks and meetups section
Added GitHub Actions integration from fluxcd/pkg@main and multi‑path KUBECONFIG support
Added install‑time option to disable the network policy
Removed an erroneous break statement in get commands, fixing command execution
Updated Go runtime to version 1.15.
Remove leading spaces from creationTimestamp field
Added extensive new features: multi‑namespace tenant ownership, bucket source support, bucket CRUD commands, ARMv7 builds, tenant creation command, and enhanced bootstrap handling.
Update kustomize controller to v0.0.12
Switch CI to use the fluxcdbot token for authentication.
Add a new branch flag to the bootstrap command
Add a Homebrew formula for the project, enabling installation via brew
Add integration with Mozilla SOPS for secret encryption (PR #209)
- Updated the kustomize controller to version v0.0.10.
Switch to GitHub Container Registry for publishing AMD64 and ARM64 container images
Added ARM64 support for install and bootstrap processes.
Upgrade notification controller to v0.0.8
Fixed HelmRelease JSON schema by changing v1.JSON to a pointer
Include PR author information in generated changelog entries.
Updated Helm controller to version v0.0.4
Updated components and migrated to dedicated fluxcd/pkg and API modules for improved modularity.
Updated controllers for compatibility with Helm v3.3.0
Updated the notification controller to v0.0.7 and added TLS certificate support for Helm sources
Mark metrics as completed and add a progress bar with checks in the roadmap documentation
Upgrade kustomize controller to v0.0.6.
Added container registry and image pull secret as install options
Update helm controller to version v0.0.1 beta.4
Updated Helm controller to v0.0.1 beta.3
Renamed the kustomization argument from `validate` to `validation`.
Added proper handling of nested lists in the roadmap view.
Added an export option to the tk install command
Updated controllers and Go modules
Added new Helm management commands (suspend, resume, reconcile) and renamed the sync command to reconcile.
Added webhook receivers guide and expanded Flux Toolkit documentation.
Added a notifications guide and a notification component to the project
Updated controllers to v0.0.1 and added support for KUBECONFIG environment variable.