Flux v2.9.0 released on 30-06-2026
Flux v2.9.0 is out now. Operators and integrators will benefit from a new CLI plugin system, finer server-side drift control, SOPS Age support, Helm post-render options and several security and automation improvements.
For the full changelog, upgrade instructions and installation notes, see the Flux GitHub repository and the Flux project website.
What’s in this release
- CLI plugin system (RFC-0013): add ‘flux plugin’ with built-in Mirror and Schema plugins, plugin installation with digest pinning, validation of plugin binary paths and GitHub Actions support to install plugins alongside Flux.
- Kustomization enhancements: server-side-apply DriftIgnoreRules for finer drift control, SOPS decryption with the Age cipher, and Kubernetes Workload Identity authentication for OpenBao and Vault.
- Security and signing: Git commit signing and verification with SSH keys for GitRepository and ImageUpdateAutomation, OCIRepository support for a custom Sigstore trusted root for keyless verification in air-gapped environments, plus AWS CodeCommit via Workload Identity and OIDC-secured, secret-less Receivers.
Upgrade notes
- The APIs image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2 have been removed — follow the Flux v2.7+ upgrade procedure for a smooth migration of CRDs and resources.
- If you need to roll back, revert to the prior minor release (see v2.8.0) and consult the full changelog comparing v2.8.0…v2.9.0 for the changes to expect.
Tell the project about your experience: raise issues or start a discussion on the Flux GitHub repository so others know what worked and what needs attention.
