# Flux v2.10.0

> CI/CD & App Delivery · 2026-10-26

A broad release changes several defaults and API migration behavior while adding authentication, CLI, artifact, notification, and automation capabilities. It also includes routine fixes and dependency updates.

## Action needed
- **[breaking]** Always-enabled `ObjectLevelWorkloadIdentity`
  - Flux now always enables `ObjectLevelWorkloadIdentity`.

## Check if affected
- **[breaking]** The default Flux RBAC `create` permission
  - Applies if you use the default Flux RBAC.
  - The default Flux RBAC no longer grants the `create` verb on the `serviceaccounts/token` resource.
- **[breaking]** Dropped fields and settings in `v1beta3` `Alert` and `Provider` conversion
  - Applies if you convert a `v1beta3` `Alert` or `Provider` to `v1`.
  - Converting a `v1beta3` `Alert` or `Provider` to `v1` drops the deprecated `Alert.spec.summary` and `Provider.spec.interval` fields. It also drops the static JWT token for Azure Event Hub and TLS or proxy configuration in `Provider.spec.secretRef`.
- **[breaking]** The default `ImageRepository` tag database backend
  - Applies if you use an `ImageRepository` tag database.
  - The Flux artifact storage backend is now the default for the `ImageRepository` tag database.
- **[breaking]** The `audiences` key renamed to `credential.auth.fluxcd.io/audiences`
  - Applies if you configure the legacy `audiences` key.
  - The legacy `audiences` key is replaced by `credential.auth.fluxcd.io/audiences`.
- **[breaking]** Unsupported fields in `migrate -f`
  - Applies if you run `migrate -f`.
  - Unsupported fields are removed when running `migrate -f`.

## Other recorded changes
- 43 (added 18, value_changed 11, defect_corrected 9, constraint_changed 5)

[Full analysis](https://ratatosk.io/en/releases/flux/v2.10.0)

[Original release notes](https://github.com/fluxcd/flux2/releases/tag/v2.10.0)