Flux
v2.8.5CI/CD & App DeliveryFlux v2.8.5 patches a cache race condition that could freeze Kustomizations, fixes Azure Blob prefix handling, and adds GCR Receiver verification fields.
breakingStuck Kustomizations? This patch likely fixes you
If you've seen Kustomizations get stuck after a reconciliation timeout or cancellation — often requiring a manual flux reconcile or pod restart to unblock — the race condition fix in kustomize-controller v1.8.3 directly addresses this. Upgrade to v2.8.5 and monitor your reconciliation loops post-upgrade. No config changes needed, but watch for Kustomizations that were previously stuck to automatically recover.
breakingVerify Azure Blob prefix filtering actually works after upgrade
If you're using Bucket sources backed by Azure Blob Storage with a prefix configured, that prefix was not being applied — meaning your source-controller was fetching more objects than intended. After upgrading to v2.8.5, the prefix filter will now take effect. Validate that your expected subset of blobs is still being synced correctly and that no previously-ignored paths break your deployments.
enhancementTighten GCR webhook security with email and audience verification
The GCR Receiver now accepts optional 'email' and 'audience' fields. If you're using GCR image push webhooks to trigger Flux reconciliation, add these fields to your Receiver spec to validate the service account identity and token audience — reducing the risk of forged webhook requests. This is opt-in, so existing setups won't break, but teams with strict security postures should configure it.
Key changes (5)
- Race condition fix in kustomize-controller: cancelled reconciliations no longer leave stale cache data that blocks Kustomization progress
- Azure Blob Storage source fix: prefix option now correctly passed to the storage client (was silently ignored before)
- Clearer error message when using encrypted SSH keys without a passphrase in source-controller
- GCR Receiver gains optional 'email' and 'audience' fields for stricter webhook verification in notification-controller
- New Azure Event Hub managed identity auth example added to notification-controller manifests