From e1e0d14c37d067857fa91586e2c37279585dbeeb Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Sat, 24 Oct 2026 12:26:42 +0100 Subject: [PATCH 1/4] Add changelog entry for v1.10.0 Signed-off-by: Matheus Pimenta --- CHANGELOG.md | 106 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3843579c1..4595f6fea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,112 @@ All notable changes to this project are documented in this file. +## 1.10.0 + +**Release date:** 2026-10-24 + +This minor release graduates object-level workload identity, now renamed to +object identity, introduces SPIFFE mTLS between the controllers, and adds +GitHub App Client ID support for Git repositories. + +### Object Identity + +Object-level workload identity is now generally available and renamed to object +identity. Workload identity refers exclusively to identities assigned to Flux +controllers, while object identity refers to identities assigned to Flux +objects. The `ObjectLevelWorkloadIdentity` feature gate is retired and the +feature is always enabled. + +⚠️ **Breaking change:** the default Flux RBAC no longer grants the `create` +verb on the `serviceaccounts/token` resource. If your installation relies on +the default RBAC, bind a ClusterRole with this permission to the controller +ServiceAccount before upgrading. See +[fluxcd/flux2#6139](https://github.com/fluxcd/flux2/pull/6139) for the required +ClusterRole and ClusterRoleBinding, and the +[object identity documentation](https://fluxcd.io/flux/integrations/object-identity/) +for the API reference. + +Two credential providers can now supply the credential: `kubernetes`, which +uses the Kubernetes TokenRequest API and was already available, and `spiffe`, +which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured +on the ServiceAccount with `credential.auth.fluxcd.io/provider`, independently +of the service provider in `.spec.provider`. + +### Inter-Controller mTLS + +This release introduces SPIFFE mTLS for inter-controller communication. Flux +controllers authenticate each other with X.509-SVIDs, and each traffic type is +enabled independently by configuring the SPIFFE Workload API socket and the +SPIFFE IDs that the controller authorizes. See the +[inter-controller mTLS documentation](https://fluxcd.io/flux/installation/configuration/intercontroller-mtls/) +for the controller flags and an example configuration. + +### GitRepository + +GitHub App authentication accepts a Client ID as an alternative to the numeric +App ID (`githubAppClientID`). Signature verification is re-run when the trusted +keys rotate, so a revoked or replaced key no longer leaves a stale +`SourceVerified=True` condition. + +### OCIRepository + +Generic OCI repositories now support object identity. The credential is sent as +a bearer token, or as the password in HTTP basic authentication when +`credential.auth.fluxcd.io/username` is set. Audiences default to the registry +host and can be overridden with `credential.auth.fluxcd.io/audiences`. + +Signature verification is re-run when the verification keys rotate, and the +origin revision from OCI image metadata is forwarded in events. + +### ExternalArtifact + +A new `.status.exportedInputs` field exposes structured data extracted from the +source resource, for consumers such as ResourceSet to implement templating. + +### General updates + +The controller is built with Kubernetes 1.37 and Go 1.27. + +Fixes: +- Close GCP object streams on error paths + [#2053](https://github.com/fluxcd/source-controller/pull/2053) +- Close Azure blob streams on error paths + [#2200](https://github.com/fluxcd/source-controller/pull/2200) +- Remove leaked Helm index cache on reconcile errors + [#2201](https://github.com/fluxcd/source-controller/pull/2201) + [#2202](https://github.com/fluxcd/source-controller/pull/2202) +- Purge stale temp dirs at startup + [#2176](https://github.com/fluxcd/source-controller/pull/2176) +- Include the repository URL in Helm index parse errors + [#2063](https://github.com/fluxcd/source-controller/pull/2063) +- Support the AWS `ap-southeast-6` region for Bucket sources + [#2183](https://github.com/fluxcd/source-controller/pull/2183) + +Improvements: +- Support Kubernetes ServiceAccount tokens for `generic` OCI repositories + [#2192](https://github.com/fluxcd/source-controller/pull/2192) +- Add the `spiffe` credential provider and SPIFFE Broker API + [#2197](https://github.com/fluxcd/source-controller/pull/2197) +- Retire the `ObjectLevelWorkloadIdentity` feature gate + [#2197](https://github.com/fluxcd/source-controller/pull/2197) +- Add SPIFFE mTLS between the controllers + [#2194](https://github.com/fluxcd/source-controller/pull/2194) +- Add GitHub App Client ID support + [#2168](https://github.com/fluxcd/source-controller/pull/2168) +- Reverify sources when verification keys rotate + [#2166](https://github.com/fluxcd/source-controller/pull/2166) + [#2179](https://github.com/fluxcd/source-controller/pull/2179) +- Expose the OCI origin revision in events + [#2127](https://github.com/fluxcd/source-controller/pull/2127) +- Add ExternalArtifact exported inputs + [#2182](https://github.com/fluxcd/source-controller/pull/2182) +- Update to Kubernetes 1.37 and Go 1.27 + [#2162](https://github.com/fluxcd/source-controller/pull/2162) + [#2186](https://github.com/fluxcd/source-controller/pull/2186) +- Various dependency updates + [#2100](https://github.com/fluxcd/source-controller/pull/2100) + [#2203](https://github.com/fluxcd/source-controller/pull/2203) + ## 1.9.6 **Release date:** 2026-10-01 From 918acb273db727c3fe87f7a5d9b7e1363d512347 Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Sat, 24 Oct 2026 12:26:47 +0100 Subject: [PATCH 2/4] Release v1.10.0 Signed-off-by: Matheus Pimenta --- config/manager/kustomization.yaml | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml index c204df0eb..661bf294a 100644 --- a/config/manager/kustomization.yaml +++ b/config/manager/kustomization.yaml @@ -6,4 +6,4 @@ resources: images: - name: fluxcd/source-controller newName: fluxcd/source-controller - newTag: v1.9.0 + newTag: v1.10.0 diff --git a/go.mod b/go.mod index 7db58d0a2..0aca3ec97 100644 --- a/go.mod +++ b/go.mod @@ -42,7 +42,7 @@ require ( github.com/fluxcd/pkg/tar v1.4.0 github.com/fluxcd/pkg/testserver v0.15.0 github.com/fluxcd/pkg/version v0.20.0 - github.com/fluxcd/source-controller/api v1.9.0 + github.com/fluxcd/source-controller/api v1.10.0 github.com/go-git/go-billy/v5 v5.9.2 github.com/go-git/go-git/v5 v5.19.3 github.com/go-logr/logr v1.4.4 From 112ca2bdbcf54fd287dd46b29b2847a473666e59 Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Sat, 24 Oct 2026 13:02:21 +0100 Subject: [PATCH 3/4] Fix goreleaser signing with cosign v3 bundles Signed-off-by: Matheus Pimenta (cherry picked from commit ae35e784d5f6987e4b05b32990800d5f52934ac6) --- .goreleaser.yaml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 7b61ce0c1..5df799481 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -44,14 +44,11 @@ sboms: # https://goreleaser.com/customization/sign signs: - cmd: cosign - env: - - COSIGN_EXPERIMENTAL=1 - certificate: "${artifact}.pem" + signature: "${artifact}.sigstore.json" args: - sign-blob - "--yes" - - "--output-certificate=${certificate}" - - "--output-signature=${signature}" + - "--bundle=${signature}" - "${artifact}" artifacts: checksum output: true From fbca3b6354f45b3355d216ab9e9fa97649baaf32 Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Sat, 24 Oct 2026 13:04:47 +0100 Subject: [PATCH 4/4] Bump gha-workflows to v0.17.0 Signed-off-by: Matheus Pimenta (cherry picked from commit d9f1f8e04d9c4401234eeca1a518b14d06785929) --- .github/workflows/backport.yaml | 2 +- .github/workflows/cifuzz.yaml | 2 +- .github/workflows/e2e.yaml | 4 ++-- .github/workflows/release.yaml | 2 +- .github/workflows/scan.yaml | 2 +- .github/workflows/sync-labels.yaml | 2 +- .github/workflows/test.yaml | 2 +- .github/workflows/upgrade-fluxcd-pkg.yaml | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index f35ff5e9a..92aac065e 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -7,6 +7,6 @@ jobs: permissions: contents: write # for reading and creating branches. pull-requests: write # for creating pull requests against release branches. - uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.16.0 + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.17.0 secrets: github-token: ${{ secrets.BOT_GITHUB_TOKEN }} diff --git a/.github/workflows/cifuzz.yaml b/.github/workflows/cifuzz.yaml index 8e80fab19..83281156a 100644 --- a/.github/workflows/cifuzz.yaml +++ b/.github/workflows/cifuzz.yaml @@ -11,7 +11,7 @@ jobs: contents: read # for reading the repository code. steps: - name: Test suite setup - uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0 + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0 with: go-version: 1.27.x - name: Smoke test Fuzzers diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 910492527..29c359447 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -13,7 +13,7 @@ jobs: contents: read # for reading the repository code. steps: - name: Test suite setup - uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0 + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0 with: go-version: 1.27.x - name: Verify @@ -39,7 +39,7 @@ jobs: contents: read # for reading the repository code. steps: - name: Test suite setup - uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0 + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0 with: go-version: 1.27.x - name: Setup Flux CLI diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 039d46774..6a359d74f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,7 +15,7 @@ jobs: contents: write # for creating the GitHub release. id-token: write # for creating OIDC tokens for signing. packages: write # for pushing and signing container images. - uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.16.0 + uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.17.0 with: controller: ${{ github.event.repository.name }} release-candidate-prefix: ${{ github.event.inputs.tag }} diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index da139cf90..e4c5bddaa 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -11,7 +11,7 @@ jobs: permissions: contents: read # for reading the repository code. security-events: write # for uploading the CodeQL analysis results. - uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.16.0 + uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.17.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} fossa-token: ${{ secrets.FOSSA_TOKEN }} diff --git a/.github/workflows/sync-labels.yaml b/.github/workflows/sync-labels.yaml index 92bfacf01..445fdbfd9 100644 --- a/.github/workflows/sync-labels.yaml +++ b/.github/workflows/sync-labels.yaml @@ -11,6 +11,6 @@ jobs: permissions: contents: read # for reading the labels file. issues: write # for creating and updating labels. - uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.16.0 + uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.17.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 52379ed2b..f6da63fe1 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Test suite setup - uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0 + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0 with: go-version: 1.27.x - name: Run tests diff --git a/.github/workflows/upgrade-fluxcd-pkg.yaml b/.github/workflows/upgrade-fluxcd-pkg.yaml index 08508fb0e..58b0d2366 100644 --- a/.github/workflows/upgrade-fluxcd-pkg.yaml +++ b/.github/workflows/upgrade-fluxcd-pkg.yaml @@ -5,6 +5,6 @@ on: jobs: upgrade-fluxcd-pkg: - uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.16.0 + uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.17.0 secrets: github-token: ${{ secrets.BOT_GITHUB_TOKEN }}