LoginSign Up
← Back to all sparks
Flux logo

Flux

DEVOPS
Velocity6.3

GitOps tool

fluxcd.io ↗

Flux 2.10 swaps static secrets for SPIFFE identity across GitOps controllers and cloud access.

gitopskubernetesworkload-identityspiffecli-pluginssecrets-management
◆Current state
Flux 2.10 is the project's most significant release since the plugin system. It brings SPIFFE workload identity to the GitOps Toolkit, so controllers can authenticate each other with mutual TLS and Flux objects can present short-lived credentials to registries, secret stores and remote clusters. The Event, Alert and Provider APIs also reach stable v1. Around it, the plugin ecosystem keeps filling out with Flux Mirror, while flux9s reached 1.0.
◆Where it's heading
The arc since 2.9 has two tracks: an extensible CLI that picks up plugins for schema and mirroring, and a steady removal of long-lived credentials. The OpenBao work dropped the bootstrap token, and 2.10 extends that idea to internal traffic and external access. Together they point to a CD layer that owns less configuration and fewer secrets.
◆Prediction
Expect more SPIFFE integrations and further promotion of object identity into default setups, though the Workload API requirement will slow adoption. The Flux MCP Server is also gaining tools through Flux Operator, so that surface should keep growing.

◆Recent moves

  1. 19d ago

    Blog: Announcing Flux 2.10 GA

    ⚡ SPARK

    Flux 2.10 carries the credential-removal thread from the OpenBao work into the controllers themselves, with SPIFFE-based mutual TLS and object identity reaching general availability. The alerting APIs also go stable, which gives integrations a fixed target.

    View source ↗
  2. 1mo ago

    Blog: flux9s GA: Flux cluster state, from the terminal

    flux9s reaches 1.0, a K9s-inspired terminal UI that shows live state for every Flux resource and is read-only by default. It adds another operator surface around the project, alongside the web UI.

    View source ↗
  3. 3mo ago

    Blog: Introducing Flux Mirror

    Flux Mirror, a new CLI plugin, copies images, Helm charts and OCI artifacts between registries from declarative config, with verification at sync time. It is the plugin system paying off, and its Apache 2.0 license is a pointed contrast with Bitnami's charts-syncer license change.

    View source ↗
  4. 3mo ago

    Blog: Selective drift correction with ignore rules

    Drift ignore rules let a Kustomization leave specific fields alone, ending the fight between Flux and controllers such as autoscalers. It replaces coarse options with field-level control, a long-requested fix.

    View source ↗
  5. 3mo ago

    Blog: Flux and OpenBao: Secrets and Signatures

    This guide shows Flux 2.9 decrypting SOPS secrets through OpenBao with workload identity, plus Cosign signing with keys held in OpenBao. The static-token removal it documents is the early form of what 2.10 makes central.

    View source ↗
  6. 4mo ago

    Blog: Introducing Flux Schema and the Ecosystem Catalog

    ⚡ SPARK

    Flux Schema, a new CLI plugin, validates Kubernetes manifests against JSON Schema and CEL rules using the same evaluation semantics as the API server, paired with a hosted Ecosystem Schema Catalog—the first substantial payoff of the 2.9 plugin system and a step toward AI-assisted validation.

    View source ↗