CVE fixes, controller reliability, Helm update
Release history
flux2 releases
Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.
All releases
19 shown
- GCR Receiver secret now requires audience field for tighter verification
- MigrateAPIVersion feature gate for migrating API versions in managed field entries
- go-git v5.18.0 update bringing Git operation performance improvements
Full changelog
Highlights
Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
- Fix a post-renderer conflict between overlapping hooks and templates (helm-controller)
- Ignore force replace when server-side apply is enabled (helm-controller)
- Fix a regression where generic providers would not forward commit status events (notification-controller)
- Require the
audiencefield on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller)
Improvements:
- Introduce the
MigrateAPIVersionfeature gate for migrating the API version of resources in managed field entries (kustomize-controller) - Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller)
Components changelog
- helm-controller v1.5.4
- image-automation-controller v1.1.2
- kustomize-controller v1.8.4
- notification-controller v1.8.4
- source-controller v1.8.3
CLI changelog
- Update toolkit components by @fluxcdbot in https://github.com/fluxcd/flux2/pull/5857
Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.5...v2.8.6
Fixed race condition causing Kustomizations to get stuck in cache.
Fixes helm-controller regression in templating for charts with YAML separators and embedded content.
- CVE-2026-27138 potential DoS during TLS handshakes
Fixes for Git commit status events in Kustomizations and StatefulSet health checks during rollout.
- Removed v1beta2 and v2beta2 API versions from CRDs
- Helm v4 support with server-side apply
- CancelHealthCheckOnNewRevision feature
- Cosign v3 support
Fixed HelmRelease history truncation with RetryOnFailure strategy.
Fixed Workload Identity for Azure China and Helm schema validation issues.
Restored SOCKS5 proxy support and fixed HelmRelease retry reporting.
- Go 1.25.2 stdlib vulnerabilities fixes for DoS prevention
- Flux APIs v1beta1 and v2beta1 removed; flux migrate command required before upgrading
- Image Automation APIs general availability
- Workload Identity support
- OpenTelemetry tracing
Fixes spurious error events and excessive logging in image-reflector-controller.