Flux CD

Flux v2.9.0 adds a CLI plugin system, Server-Side Apply field ignore rules, SOPS decryption with the Age post-quantum cipher, Kubernetes Workload Identity auth for OpenBao and Vault, Helm post-render strategies and literal value mode, Git commit signing with SSH keys, AWS CodeCommit auth via Workload Identity, custom Sigstore trusted roots for air-gapped OCI verification, path pattern directory discovery for monorepos, and secret-less OIDC-secured webhook Receivers. The image.toolkit.fluxcd.io/v1beta2 and notification.toolkit.fluxcd.io/v1beta2 APIs have reached end-of-life and are removed from the CRDs, so users must follow the Flux v2.7+ upgrade procedure and migrate off these v1beta2 APIs before upgrading to v2.9.

Matters for: Teams running GitOps pipelines with Helm charts, encrypted secrets via SOPS, air-gapped OCI registries, or monorepo repositories on Kubernetes clusters, including those using OpenBao, Vault, or AWS CodeCommit for authentication.