Flux
v2.9.0CI/CD & App DeliveryJul 1, 2026
Flux v2.9.0 is a feature release adding capabilities across most controllers, with one breaking change: the end-of-life image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2 APIs have been removed from the CRDs.
breakingv1beta2 image and notification APIs removed
Applies to any cluster still running resources on image.toolkit.fluxcd.io/v1beta2 or notification.toolkit.fluxcd.io/v1beta2. Both APIs have reached end-of-life and were dropped from the CRDs in v2.9.0. Migrate ImagePolicy, ImageRepository, ImageUpdateAutomation, Alert, Provider, and Receiver resources to their current API version before upgrading, or the controllers will fail to reconcile them.
Key changes (8)
- Breaking: image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2 are end-of-life and removed from the CRDs; migrate affected resources before upgrading.
- New Flux CLI Plugin System (`flux plugin`) with Mirror and Schema plugins.
- Kustomization gains Server-Side Apply field ignore rules for finer drift control, and SOPS decryption via the Age post-quantum cipher.
- New Workload Identity authentication paths: OpenBao/Vault in Kustomization, and AWS CodeCommit in GitRepository.
- HelmRelease adds post-render strategies (including chart hooks) and a literal mode for values matching `helm --set-literal`.
- Git commit signing/verification with SSH keys added for GitRepository and ImageUpdateAutomation; OCIRepository supports custom Sigstore trusted roots for air-gapped keyless verification.
- Secret-less, OIDC-secured webhook Receivers added, plus path pattern directory discovery for monorepos in ArtifactGenerator.
- Component controllers bumped (source-controller v1.9.1, kustomize-controller v1.9.1, notification-controller v1.9.1, helm-controller v1.6.1, image-reflector/automation-controller v1.2.1); CLI now builds against Kubernetes 1.36 and Go 1.26, plus assorted CLI additions and small bugfixes.