chore(deps): update fluxcd#1600
Merged
Merged
Conversation
--- kubernetes/apps/infrastructure/operators/cloudnative-pg/app Kustomization: flux-system/database-cloudnative-pg HelmRelease: operators/cloudnative-pg
+++ kubernetes/apps/infrastructure/operators/cloudnative-pg/app Kustomization: flux-system/database-cloudnative-pg HelmRelease: operators/cloudnative-pg
@@ -12,13 +12,13 @@
spec:
chart: cloudnative-pg
sourceRef:
kind: HelmRepository
name: cnpg
namespace: flux-system
- version: 0.28.2
+ version: 0.28.0
install:
createNamespace: true
remediation:
retries: 3
interval: 15m
maxHistory: 3
--- kubernetes/flux Kustomization: flux-system/cluster OCIRepository: flux-system/flux-manifests
+++ kubernetes/flux Kustomization: flux-system/cluster OCIRepository: flux-system/flux-manifests
@@ -7,9 +7,9 @@
kustomize.toolkit.fluxcd.io/namespace: flux-system
name: flux-manifests
namespace: flux-system
spec:
interval: 10m
ref:
- digest: sha256:45ed09e8241e4b0ee38d0fc8d8e42b6002d55c880b0859c9c484bf22340116d5
+ digest: sha256:c1e1c1bbfbd90082ccaad5105334e0a26c4eccd37248ad20e1511004ebab50e3
url: oci://ghcr.io/fluxcd/flux-manifests
|
Terraform PlanShared✅ |
bo0tzz
approved these changes
May 19, 2026
renovate
Bot
force-pushed
the
renovate/fluxcd
branch
from
May 19, 2026 10:29
f9205ca to
37d0a5a
Compare
--- HelmRelease: operators/cloudnative-pg ConfigMap: operators/cnpg-default-monitoring
+++ HelmRelease: operators/cloudnative-pg ConfigMap: operators/cnpg-default-monitoring
@@ -28,17 +28,17 @@
) AS states(state)
LEFT JOIN (
SELECT datname
, state
, usename
, COALESCE(application_name, '') AS application_name
- , pg_catalog.count(*)
- , COALESCE(EXTRACT (EPOCH FROM (pg_catalog.max(pg_catalog.now() OPERATOR(pg_catalog.-) xact_start))), 0) AS max_tx_secs
+ , COUNT(*)
+ , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs
FROM pg_catalog.pg_stat_activity
GROUP BY datname, state, usename, application_name
- ) sa ON states.state OPERATOR(pg_catalog.=) sa.state
+ ) sa ON states.state = sa.state
WHERE sa.usename IS NOT NULL
metrics:
- datname:
usage: "LABEL"
description: "Name of the database"
- usename:
@@ -56,27 +56,27 @@
- max_tx_duration_seconds:
usage: "GAUGE"
description: "Maximum duration of a transaction in seconds"
backends_waiting:
query: |
- SELECT pg_catalog.count(*) AS total
+ SELECT count(*) AS total
FROM pg_catalog.pg_locks blocked_locks
JOIN pg_catalog.pg_locks blocking_locks
- ON blocking_locks.locktype OPERATOR(pg_catalog.=) blocked_locks.locktype
+ ON blocking_locks.locktype = blocked_locks.locktype
AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database
AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation
AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page
AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple
AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid
AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid
AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid
AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid
AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid
- AND blocking_locks.pid OPERATOR(pg_catalog.<>) blocked_locks.pid
- JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid OPERATOR(pg_catalog.=) blocking_locks.pid
+ AND blocking_locks.pid != blocked_locks.pid
+ JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid
WHERE NOT blocked_locks.granted
metrics:
- total:
usage: "GAUGE"
description: "Total number of backends that are currently waiting on other queries"
@@ -112,20 +112,20 @@
description: "Time at which postgres started (based on epoch)"
pg_replication:
query: |
SELECT CASE WHEN (
NOT pg_catalog.pg_is_in_recovery()
- OR pg_catalog.pg_last_wal_receive_lsn() OPERATOR(pg_catalog.=) pg_catalog.pg_last_wal_replay_lsn())
+ OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())
THEN 0
ELSE GREATEST (0,
- EXTRACT(EPOCH FROM (pg_catalog.now() OPERATOR(pg_catalog.-) pg_catalog.pg_last_xact_replay_timestamp())))
+ EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))
END AS lag,
pg_catalog.pg_is_in_recovery() AS in_recovery,
- EXISTS (TABLE pg_catalog.pg_stat_wal_receiver) AS is_wal_receiver_up,
- (SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas
+ EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,
+ (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas
metrics:
- lag:
usage: "GAUGE"
description: "Replication lag behind primary in seconds"
- in_recovery:
usage: "GAUGE"
@@ -167,23 +167,23 @@
description: "Replication lag in bytes"
pg_stat_archiver:
query: |
SELECT archived_count
, failed_count
- , COALESCE(EXTRACT(EPOCH FROM (pg_catalog.now() OPERATOR(pg_catalog.-) last_archived_time)), -1) AS seconds_since_last_archival
- , COALESCE(EXTRACT(EPOCH FROM (pg_catalog.now() OPERATOR(pg_catalog.-) last_failed_time)), -1) AS seconds_since_last_failure
+ , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival
+ , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure
, COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time
, COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time
- , COALESCE(CAST(CAST('x' OPERATOR(pg_catalog.||) pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn
- , COALESCE(CAST(CAST('x' OPERATOR(pg_catalog.||) pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn
+ , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn
+ , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn
, EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time
FROM pg_catalog.pg_stat_archiver
predicate_query: |
SELECT NOT pg_catalog.pg_is_in_recovery()
- OR pg_catalog.current_setting('archive_mode') OPERATOR(pg_catalog.=) 'always'
+ OR pg_catalog.current_setting('archive_mode') = 'always'
metrics:
- archived_count:
usage: "COUNTER"
description: "Number of WAL files that have been successfully archived"
- failed_count:
usage: "COUNTER"
@@ -463,18 +463,18 @@
usage: "GAUGE"
description: "Setting value"
pg_extensions:
query: |
SELECT
- pg_catalog.current_database() as datname,
+ current_database() as datname,
name as extname,
default_version,
installed_version,
CASE
- WHEN default_version OPERATOR(pg_catalog.=) installed_version THEN 0
+ WHEN default_version = installed_version THEN 0
ELSE 1
END AS update_available
FROM pg_catalog.pg_available_extensions
WHERE installed_version IS NOT NULL
metrics:
- datname:
--- HelmRelease: operators/cloudnative-pg CustomResourceDefinition: operators/clusters.postgresql.cnpg.io
+++ HelmRelease: operators/cloudnative-pg CustomResourceDefinition: operators/clusters.postgresql.cnpg.io
@@ -5710,12 +5710,13 @@
type: boolean
procMount:
description: |-
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
+ This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
description: |-
Whether this container has a read-only root filesystem.
Default is false.
--- HelmRelease: operators/cloudnative-pg CustomResourceDefinition: operators/poolers.postgresql.cnpg.io
+++ HelmRelease: operators/cloudnative-pg CustomResourceDefinition: operators/poolers.postgresql.cnpg.io
@@ -2875,12 +2875,13 @@
type: boolean
procMount:
description: |-
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
+ This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
description: |-
Whether this container has a read-only root filesystem.
Default is false.
@@ -4445,12 +4446,13 @@
type: boolean
procMount:
description: |-
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
+ This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
description: |-
Whether this container has a read-only root filesystem.
Default is false.
@@ -4928,12 +4930,13 @@
If set to true or not present, the pod will be run in the host user namespace, useful
for when the pod needs a feature only available to the host user namespace, such as
loading a kernel module with CAP_SYS_MODULE.
When set to false, a new userns is created for the pod. Setting false is useful for
mitigating container breakout vulnerabilities even allowing users to run their
containers as root without actually having root privileges on the host.
+ This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.
type: boolean
hostname:
description: |-
Specifies the hostname of the Pod
If not specified, the pod's hostname will be set to a system-defined value.
type: string
@@ -6097,12 +6100,13 @@
type: boolean
procMount:
description: |-
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
+ This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
description: |-
Whether this container has a read-only root filesystem.
Default is false.
@@ -6665,20 +6669,12 @@
PodResourceClaim references exactly one ResourceClaim, either directly
or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
for the pod.
It adds a name to it that uniquely identifies the ResourceClaim inside the Pod.
Containers that need access to the ResourceClaim reference it with this name.
-
- When the DRAWorkloadResourceClaims feature gate is enabled and this Pod
- belongs to a PodGroup, a PodResourceClaim is matched to a
- PodGroupResourceClaim if all of their fields are equal (Name,
- ResourceClaimName, and ResourceClaimTemplateName). A matched claim references
- a single ResourceClaim shared across all Pods in the PodGroup, reserved for
- the PodGroup in ResourceClaimStatus.ReservedFor rather than for individual
- Pods.
properties:
name:
description: |-
Name uniquely identifies this resource claim inside the pod.
This must be a DNS_LABEL.
type: string
@@ -6697,22 +6693,12 @@
The template will be used to create a new ResourceClaim, which will
be bound to this pod. When this pod is deleted, the ResourceClaim
will also be deleted. The pod name and resource name, along with a
generated component, will be used to form a unique name for the
ResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.
-
- When the DRAWorkloadResourceClaims feature gate is enabled and the pod
- belongs to a PodGroup that defines a PodGroupResourceClaim with the same
- Name and ResourceClaimTemplateName, this PodResourceClaim resolves to the
- ResourceClaim generated for the PodGroup. All pods in the group that
- define an equivalent PodResourceClaim matching the
- PodGroupResourceClaim's Name and ResourceClaimTemplateName share the same
- generated ResourceClaim. ResourceClaims generated for a PodGroup are
- owned by the PodGroup and their lifecycles are tied to the PodGroup
- instead of any individual pod.
This field is immutable and no changes will be made to the
corresponding ResourceClaim by the control plane after creating the
ResourceClaim.
Exactly one of ResourceClaimName and ResourceClaimTemplateName must
@@ -6833,34 +6819,12 @@
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
- schedulingGroup:
- description: |-
- SchedulingGroup provides a reference to the immediate scheduling runtime
- grouping object that this Pod belongs to.
- This field is used by the scheduler to identify the group and apply the
- correct group scheduling policies. The association with a group also
- impacts other lifecycle aspects of a Pod that are relevant in a wider context
- of scheduling like preemption, resource attachment, etc. If not specified,
- the Pod is treated as a single unit in all of these aspects.
- The group object referenced by this field may not exist at the time the
- Pod is created.
- This field is immutable, but a group object with the same name may be
- recreated with different policies. Doing this during pod scheduling
- may result in the placement not conforming to the expected policies.
- properties:
- podGroupName:
- description: |-
- PodGroupName specifies the name of the standalone PodGroup object
- that represents the runtime instance of this group.
- Must be a DNS subdomain.
- type: string
- type: object
securityContext:
description: |-
SecurityContext holds pod-level security attributes and common container settings.
Optional: Defaults to empty. See type description for default values of each field.
properties:
appArmorProfile:
@@ -8283,13 +8247,13 @@
- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
[Diff truncated by flux-local]
--- HelmRelease: operators/cloudnative-pg Deployment: operators/cloudnative-pg
+++ HelmRelease: operators/cloudnative-pg Deployment: operators/cloudnative-pg
@@ -14,14 +14,14 @@
matchLabels:
app.kubernetes.io/name: cloudnative-pg
app.kubernetes.io/instance: cloudnative-pg
template:
metadata:
annotations:
- checksum/rbac: a2bc7f270f82f536e2ad0688f7e1544619e1b00fd5572097f5e76442a85645e7
- checksum/monitoring-config: 6b268dfd0cfce0955dbb5deea0ceb8f78809e7e9005bb361eb878f58b8ba0e5f
+ checksum/rbac: 6c7321a8c07d6a27e8ea208202acf166e4f32514a20df4db65c933cb40df6711
+ checksum/monitoring-config: f873a0c169d70f7ee62f0a96aed7686db6d7c57aa78a4d1bc33b1f86c0a6a0cb
labels:
app.kubernetes.io/name: cloudnative-pg
app.kubernetes.io/instance: cloudnative-pg
spec:
containers:
- args:
@@ -31,20 +31,20 @@
- --config-map-name=cnpg-controller-manager-config
- --webhook-port=9443
command:
- /manager
env:
- name: OPERATOR_IMAGE_NAME
- value: ghcr.io/cloudnative-pg/cloudnative-pg:1.29.1
+ value: ghcr.io/cloudnative-pg/cloudnative-pg:1.29.0
- name: OPERATOR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: MONITORING_QUERIES_CONFIGMAP
value: cnpg-default-monitoring
- image: ghcr.io/cloudnative-pg/cloudnative-pg:1.29.1
+ image: ghcr.io/cloudnative-pg/cloudnative-pg:1.29.0
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /readyz
port: webhook-server
scheme: HTTPS |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.8.6→2.8.7v2.8.6→v2.8.7v2.8.6→v2.8.745ed09e→c1e1c1bRelease Notes
fluxcd/flux2 (flux2)
v2.8.7Compare Source
Highlights
Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
kustomize.toolkit.fluxcd.io/ssa: IfNotPresentwhere non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)Improvements:
Components changelog
CLI changelog
Full Changelog: fluxcd/flux2@v2.8.6...v2.8.7
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled because a matching PR was automerged previously.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.