RATATOSKRATATOSK
Sign in

Flux

v2.10.0CI/CD & App Delivery
Oct 26, 2026

ACTION 1CHECK 5OTHER 43

A broad release changes several defaults and API migration behavior while adding authentication, CLI, artifact, notification, and automation capabilities. It also includes routine fixes and dependency updates.

Action needed (1)

  • breakingAlways-enabled ObjectLevelWorkloadIdentity

    Flux now always enables ObjectLevelWorkloadIdentity.

Check if affected (5)

  • breakingThe default Flux RBAC create permission

    Applies if you use the default Flux RBAC.

    The default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource.

  • breakingDropped fields and settings in v1beta3 Alert and Provider conversion

    Applies if you convert a v1beta3 Alert or Provider to v1.

    Converting a v1beta3 Alert or Provider to v1 drops the deprecated Alert.spec.summary and Provider.spec.interval fields. It also drops the static JWT token for Azure Event Hub and TLS or proxy configuration in Provider.spec.secretRef.

  • breakingThe default ImageRepository tag database backend

    Applies if you use an ImageRepository tag database.

    The Flux artifact storage backend is now the default for the ImageRepository tag database.

  • breakingThe audiences key renamed to credential.auth.fluxcd.io/audiences

    Applies if you configure the legacy audiences key.

    The legacy audiences key is replaced by credential.auth.fluxcd.io/audiences.

  • breakingUnsupported fields in migrate -f

    Applies if you run migrate -f.

    Unsupported fields are removed when running migrate -f.

All 43 other recorded changesadditions 18 · value changes 11 · fixes 9 · constraints 5

additions (18)

  • - SOPS decryption for files encrypted with comment regexes
  • --override-manager-before-dry-run
  • .spec.policyChangeDelay
  • Cross-namespace artifacts
  • tenant namespace provisioning
  • path-pattern discovery
  • New Zoom, incident.io and Mastodon notification providers
  • Add --add-ignore-paths flag to artifact commands
  • Add version-file input to the Flux CLI action
  • Add --app-client-id flag to create secret githubapp
  • [RFC-0014] Advanced Support for Short-Lived Cryptographic Material
  • [RFC-0014] Annotations for AWS STS Endpoint and Docker Hub OIDC Connection
  • Allow controllers to perform SubjectAccessReview
  • Add digests flag to plugin search
  • Add suspend, resume and reconcile commands for ArtifactGenerator
  • [RFC-0014] Inter-controller mTLS via SPIFFE
  • Add --policy-change-delay to create image update
  • [RFC-0014] Add HTTPS port to controller Services

value changes (11)

  • retry on rejected pushes
  • .Changed.Summary
  • The notification Alert and Provider APIs are promoted to v1.
  • Update fluxcd/pkg dependencies
  • Update toolkit components
  • Format reproducible created timestamp in UTC
  • Remove the Cosign v2.6.1 pin
  • Respect pruning exclusions in kustomization diff
  • Update to Kubernetes 1.37.1 and Go 1.27
  • use restrictive file modes for generated manifests
  • Update dependencies for Flux 2.10

fixes (9)

  • Fix breaking change in-memory kustomization build
  • fix: restrict allow-webhooks netpol to receiver port
  • Match plugin archive entries with a leading ./
  • Stop diff processing after an error
  • Fix proxy bypass in bootstrap --ca-file
  • Fix envsubst dropping input on long lines
  • fix: return clear error when --private-key-file path starts with '~'
  • Fix --in-memory-build restricting disk access
  • fix(create): reject conflicting image policy selectors for every flag pair

constraints (5)

  • - OCIRepository as a chart source for HelmRelease
  • v1.35 | >= 1.35.2 |
  • Add support for 2.9 in migrate -f
  • Accept TYPE/NAME resource args in get/reconcile
  • Extend kubectl-style resource args to all Flux kinds and commands
Add Flux to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Flux releases →