fix(github-release): update aqua:fluxcd/flux2 to v2.7.5 #600
Conversation
homebot-0
bot
added
deps/core
WalkthroughBumps the flux2 tool version from 2.7.3 to 2.7.5 in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
ℹ️ SOPS Encryption CheckNo SOPS files detected in this pull request.
No encryption validation required for this PR. |
✅ Gitleaks Secret Scan PassedNo secrets detected in this pull request.
|
homebot-0
bot
force-pushed
the
renovate/aqua-fluxcd-flux2-2.x
branch
from
3129ee8 to
f96dd37
Compare
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
homebot-0
bot
force-pushed
the
renovate/aqua-fluxcd-flux2-2.x
branch
from
f96dd37 to
e76f83c
Compare
homebot-0
bot
force-pushed
the
renovate/aqua-fluxcd-flux2-2.x
branch
from
e76f83c to
1817dbb
Compare
homebot-0
bot
force-pushed
the
renovate/aqua-fluxcd-flux2-2.x
branch
from
1817dbb to
bd60577
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.mise.toml:
- Line 17: Do not change the "aqua:fluxcd/flux2" entry to "2.7.5" yet; instead
revert or hold the version and perform pre-upgrade migration and compatibility
checks: run `flux migrate` on each cluster to convert deprecated CRD APIs
(v1beta1/v2beta1) before upgrading controllers, verify source-controller OCI
signature compatibility with your cosign version (downgrade to cosign v2.6 or
wait for flux v2.8 if you use cosign v3), and follow the Flux v2.7 upgrade guide
step-by-step to confirm API versions and controller compatibility prior to
updating the "aqua:fluxcd/flux2" version.
| "aqua:cue-lang/cue" = "0.14.2" | ||
| "aqua:FiloSottile/age" = "1.2.1" | ||
| "aqua:fluxcd/flux2" = "2.7.3" | ||
| "aqua:fluxcd/flux2" = "2.7.5" |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Flux v2.7.5 release notes upgrade procedure breaking changes
💡 Result:
Summary — what changed (breaking) in Flux v2.7.5 and how to upgrade
Key breaking / EOL items
- The deprecated toolkit APIs v1beta1 / v2beta1 were removed from the CRDs (source/kustomize/helm/image/notification v1beta1/v2beta1). You must migrate resources to the stable APIs before/when upgrading. [1][2]
- Signature verification for OCI artifacts in source-controller is not compatible with Cosign v3 (use Cosign v2.6 until v2.8 adds support). [1]
- (From the v2.7.0 minor release) some previously deprecated flags/features were removed (example: image-reflector-controller autologin flags removed — set ImageRepository.spec.provider instead). Review the v2.7 changelog for other API/flag removals and behavioral changes (Kustomization/HelmRelease readiness, new fields and feature-gates). [2]
Upgrade procedure (short)
- Read the Flux v2.7 upgrade guide and follow the "Upgrade Procedure for Flux v2.7+" step‑by‑step. [3]
- Unless you deploy controllers via Flux Operator, run flux migrate on each cluster to migrate CRs to the stable APIs before upgrading the controllers. [1][3]
- Update the flux CLI first, then upgrade controllers via your install method:
- bootstrap Git: regenerate manifests with flux bootstrap and push;
- bootstrap via flux CLI: rerun the same bootstrap command for each cluster;
- Terraform: update provider and terraform apply;
- kubectl: apply the latest install.yaml from the releases page. [3]
- After upgrade, run flux check and verify controller versions and health. [3]
Important links (read before upgrading)
- GitHub release notes v2.7.5 (includes upgrade note and fixes). [1]
- Flux v2.7 blog / changelog with breaking changes and feature list. [2]
- Flux upgrade docs / step-by-step procedure. [3]
Sources
[1] Flux v2.7.5 GitHub release (fluxcd/flux2).
[2] Flux blog — Announcing Flux 2.7 (release/changelog).
[3] Flux documentation — Upgrade procedure / Flux upgrade page.
🌐 Web query:
Flux 2.7 cosign OCI signature verification compatibility
💡 Result:
Short answer: Yes — Flux (including the 2.x source-controller used in Flux 2.7) supports verifying OCI artifact signatures produced by Sigstore cosign. You can verify both key-based and keyless (OIDC/Fulcio) cosign signatures for OCIRepository artifacts and for Helm charts stored as OCI artifacts. Configure spec.verify.provider: cosign and either point to a Secret with .pub keys (secretRef) or omit secretRef and use matchOIDCIdentity for keyless validation. Flux will set SourceVerified on success and refuse to fetch the artifact on verification failure. Examples and config fields are documented in the Flux docs. [1][2][3]
Sources:
- Flux OCIRepository / verification docs (cosign, secretRef, matchOIDCIdentity). [1]
- Flux cheatsheet & blog on signing/verifying OCI artifacts and Helm charts with cosign. [2][3]
References:
[1] https://fluxcd.io/flux/components/source/ocirepositories/
[2] https://fluxcd.io/flux/cheatsheets/oci-artifacts/
[3] https://fluxcd.io/blog/2022/10/prove-the-authenticity-of-oci-artifacts/
Do not bump Flux to v2.7.5 without explicit pre-upgrade migration and compatibility checks.
v2.7.5 is NOT a safe patch bump—it removes deprecated CRD APIs (v1beta1/v2beta1 across source/kustomize/helm/image/notification controllers). You must run flux migrate on each cluster to migrate all resources to stable APIs before upgrading controllers. Additionally, source-controller's OCI artifact signature verification is incompatible with Cosign v3; you must either downgrade to Cosign v2.6 or wait for v2.8. Review your current API versions, Cosign version, and follow the Flux v2.7 upgrade guide step-by-step before rollout.
🤖 Prompt for AI Agents
In @.mise.toml at line 17, Do not change the "aqua:fluxcd/flux2" entry to
"2.7.5" yet; instead revert or hold the version and perform pre-upgrade
migration and compatibility checks: run `flux migrate` on each cluster to
convert deprecated CRD APIs (v1beta1/v2beta1) before upgrading controllers,
verify source-controller OCI signature compatibility with your cosign version
(downgrade to cosign v2.6 or wait for flux v2.8 if you use cosign v3), and
follow the Flux v2.7 upgrade guide step-by-step to confirm API versions and
controller compatibility prior to updating the "aqua:fluxcd/flux2" version.
bd60577 to
8a81d7d
Compare
1 participant
This PR contains the following updates:
2.7.3→2.7.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
🐾 Talos PETS: Patch version will be auto-merged after 1-day stabilization. In-place upgrade via talosctl.
🐄 Talos CATTLE: Major/minor version requires manual approval. Full VM rebuild via Terraform.
Release Notes
fluxcd/flux2 (aqua:fluxcd/flux2)
v2.7.5Compare Source
Highlights
Flux v2.7.5 is a patch release that comes with fixes to helm-controller. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
RetryOnFailurestrategy.Flux users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.
Components changelog
CLI changelog
Full Changelog: fluxcd/flux2@v2.7.4...v2.7.5
v2.7.4Compare Source
Highlights
Flux v2.7.4 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.
ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.
Fixes:
DisableConfigWatchersfeature gate to all controllers for disabling the Secrets/ConfigMaps watchersArtifactGeneratorto aggregated RBAC rolesFlux users are advised to use Cosign v2.6 for signing Flux OCI artifacts and Helm charts, until support for Cosign v3 is added in Flux v2.8.
Components changelog
CLI changelog
Full Changelog: fluxcd/flux2@v2.7.3...v2.7.4
Configuration
📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.