feat(github-release): update release fluxcd/flux2 ( v2.8.8 → v2.9.1 )#4017
Open
renovate[bot] wants to merge 1 commit into
Open
feat(github-release): update release fluxcd/flux2 ( v2.8.8 → v2.9.1 )#4017renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
flux2 (gotk-components.yaml): v2.8.8 → v2.9.0
Verdict: Safe to merge
This bumps the Flux GitOps runtime manifests (CRDs + RBAC + controller Deployments) from v2.8.8 to v2.9.0, a feature release. Sub-component images move: source-controller v1.9.0→v1.9.1, kustomize-controller v1.9.0→v1.9.1, helm-controller v1.6.0→v1.6.1, notification-controller v1.9.0→v1.9.1 (all four are patch releases dated 2026-06-30, adding kubectl categories to their CRDs and documenting CLI options — no functional changes). The CRD schema changes in the diff (new optional fields, dropped kind requirement in a couple of validations) come from the v1.9.0/v1.6.0 minor releases that this PR's CRD manifests are catching up to.
Breaking changes (researched, not applicable to this repo):
- notification-controller v1.9.0 removed the deprecated
notification.toolkit.fluxcd.io/v1beta2API (Alert/Provider/Receiver). Checked all 4 Alert/Provider manifests influx-system-extra/github-alerts/andflux-system-extra/discord-alerts/— all already usev1beta3. NoReceiverresources exist in the repo. Not actionable. - notification-controller v1.9.0 also enforces CVE-2026-40109 by requiring
email/audiencefields on GCR Receiver secrets — repo has no Receiver resources at all, not applicable. - kustomize-controller v1.9.0 enables the
StrictPostBuildSubstitutionsfeature gate by default: reconciliation now fails if a${VAR}referenced in manifests has no default and is missing frompostBuild.substituteFrom. The repo's single root Kustomization (flux-system/gotk-sync.yaml) sourcescluster-settingsConfigMap andcluster-secretsSecret. I cross-checked every${VAR}reference found across the tree (SECRET_DOMAIN,SECRET_VOLSYNC_*,SECRET_AUTH_*,SVC_NGINX_*, etc.) against the keys defined influx-system-extra/cluster/cluster-settings.yamlandcluster-secrets.sops.yaml— all referenced variables are defined. Not actionable. - helm-controller v1.6.0 changed the default Helm post-render strategy to
combined(Helm v4.2 alignment) via the new.spec.postRenderStrategyfield — this is a real behavioral change, but the repo is already running thehelm-controller:v1.6.0image (visible as the pre-PR value in the diff), so this behavior is already in effect on the cluster today and is not newly introduced by this PR. No HelmRelease in the repo setspostRenderers, which is the feature this mainly affects.
New features worth adopting (optional, no action required):
.spec.ignoreonKustomization— JSON-pointer-scoped drift-detection ignore rules, could simplify any future need to ignore mutated fields (e.g. webhook-injected fields) without disabling drift detection entirely..spec.postBuild.substituteStrategy: Always— only useful if a Kustomization's substitutions are all default-valued; not relevant to the current single root Kustomization.Provider.spec.certSecretRefnow supports full mTLS (ca.crt + tls.crt + tls.key), not just CA-only — not currently used by the github/discord Providers in this repo.
Sources consulted:
- https://redirect.github.com/fluxcd/flux2/releases/tag/v2.9.0
- https://redirect.github.com/fluxcd/flux2/issues/5942
- https://github.com/fluxcd/source-controller/blob/v1.9.1/CHANGELOG.md
- https://github.com/fluxcd/kustomize-controller/blob/v1.9.1/CHANGELOG.md
- https://github.com/fluxcd/notification-controller/blob/v1.9.1/CHANGELOG.md
- https://github.com/fluxcd/helm-controller/blob/v1.6.1/CHANGELOG.md
- Repo files:
flux-system-extra/github-alerts/{provider,alert}.yaml,flux-system-extra/discord-alerts/{provider,alert}.yaml,flux-system/gotk-sync.yaml,flux-system-extra/cluster/cluster-settings.yaml,flux-system-extra/cluster/cluster-secrets.sops.yaml
Claude Review Usage
|
| datasource | package | from | to | | --------------- | ------------ | ------ | ------ | | github-releases | fluxcd/flux2 | v2.8.8 | v2.9.1 | Signed-off-by: Winston R. Milling <wrmilling@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/fluxcd-flux2-2.x
branch
from
ffa7f07 to
9f5b5c9
Compare
renovate
Bot
changed the title
There was a problem hiding this comment.
fluxcd/flux2: v2.8.8 → v2.9.1
Verdict: Safe to merge
This PR upgrades the Flux GitOps runtime manifests (flux-system/gotk-components.yaml) from v2.8.8 to v2.9.1. Compared to the prior review (which covered v2.9.0), the key difference is the v2.9.1 patch release — a same-day bugfix drop that is directly relevant to this repo.
What changed since v2.9.0 (the incremental delta)
Sub-component images updated: source-controller v1.9.0→v1.9.2, kustomize-controller v1.9.0→v1.9.2, helm-controller v1.6.0→v1.6.2, notification-controller v1.9.0→v1.9.2.
v2.9.1 fixes (all four controllers):
- All Flux CRDs are now annotated with
kustomize.toolkit.fluxcd.io/substitute: disabled, preventing Kustomizations with post-build substitution from corrupting CRD schemas containing${...}sequences. This is directly relevant to this repo:flux-system/gotk-sync.yamlusespostBuild.substituteFrom(sourcingcluster-settingsandcluster-secrets), andflux-system/gotk-components.yamllives under the root path./that the Kustomization applies. Without this annotation, the CRD schemas with embedded${...}patterns could be mangled during reconciliation. - kustomize-controller: SOPS dependency updated to fix
.inifile decryption (no.iniSOPS files in this repo — not applicable, but harmless). - kustomize-controller: Dry-run error fixed where applying a resource with a strategic merge patch could fail with
<resource> is invalid(general reliability improvement). - CLI: Fix for a breaking change in the in-memory Kustomization build (not used by this repo).
Breaking changes from v2.9.0 (re-confirmed not applicable)
- notification/v1beta2 API removal: All four Alert/Provider resources in
flux-system-extra/github-alerts/andflux-system-extra/discord-alerts/already usenotification.toolkit.fluxcd.io/v1beta3. NoReceiverresources exist in the repo. - GCR Receiver
email/audienceenforcement (CVE-2026-40109): No Receiver resources in this repo. - StrictPostBuildSubstitutions enabled by default (kustomize-controller v1.9.0): The root Kustomization references
cluster-settingsandcluster-secrets; all${VAR}references in the tree are covered by those sources (verified in the prior review — no change in this PR). - Helm post-render strategy default changed to
combined(helm-controller v1.6.0): Already in effect on the cluster since v1.6.0 was the pre-PR image version. No HelmRelease in this repo setspostRenderers.
Not applicable to this repo:
- source-controller v1.9.2: Registry auth token caching during Notation verification — performance improvement only, no behavior change for this repo's OCI sources.
Sources consulted:
- https://redirect.github.com/fluxcd/flux2/releases/tag/v2.9.1
- https://redirect.github.com/fluxcd/source-controller/blob/v1.9.2/CHANGELOG.md
- https://redirect.github.com/fluxcd/kustomize-controller/blob/v1.9.2/CHANGELOG.md
- https://redirect.github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md
- https://redirect.github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md
- Repo files:
flux-system/gotk-sync.yaml,flux-system-extra/github-alerts/{provider,alert}.yaml,flux-system-extra/discord-alerts/{provider,alert}.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.8.8→v2.9.1Release Notes
fluxcd/flux2 (fluxcd/flux2)
v2.9.1Compare Source
v2.9.0Compare Source
Highlights
Flux v2.9.0 is a feature release. Users are encouraged to upgrade for the best experience.
For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.9 GA blog post.
Overview of the new features:
flux plugin)Kustomization)Kustomization)Kustomization)HelmRelease)helm --set-literal(HelmRelease)Kustomization,HelmRelease)GitRepository,ImageUpdateAutomation)GitRepository)OCIRepository)ArtifactGenerator)Receiver)❤️ Big thanks to all the Flux contributors that helped us with this release!
Kubernetes compatibility
This release is compatible with the following Kubernetes versions:
v1.34>= 1.34.1v1.35>= 1.35.0v1.36>= 1.36.0OpenShift compatibility
Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.
Upgrade procedure
image.toolkit.fluxcd.io/v1beta2andnotification.toolkit.fluxcd.io/v1beta2have reached end-of-life and have been removed from the CRDs.
Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from older versions of Flux to v2.9.
Components changelog
CLI changelog
--show-sourcetoflux get ksandflux get hrby @rafaelperoco in #5828flux create secret receivercommand by @stefanprodan in #5835--in-memory-buildtoflux build ksandflux diff ksby @rycli in #5794--ignore-not-foundtoflux diff ksby @rycli in #5845flux plugin installby @Iam-Karan-Suresh in #5872--ns-follows-kube-contextglobal flag for using the kubeconfig context namespace by @jtyr in #5831flux trigger receiverby @matheuscscp in #5908flux bootstrap gitby @taraspos in #5868flux build ksby @raffis in #5906ks.spec.postBuild.substituteStrategyby @matheuscscp in #5945type!=statusin get --status-selector by @3uzbcqje in #5952flux get all --status-selectorfor empty results and notification resources by @matheuscscp in #5954New Contributors
Full Changelog: fluxcd/flux2@v2.8.0...v2.9.0
Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.