Prepare for Flux v2.9.0

[stefanprodan]

Flux 2.9.0 adds support for CLI plugins, extend server-side apply with field ignore rules and enhance the secrets decryption.

📅 Target dates: 29-30 June

🚀 Roadmap milestone: https://fluxcd.io/roadmap/#v29-q2-2026

ℹ️ Highlights

• Introduce flux-mirror and flux-schema plugins
• Extend Flux server-side apply with field ignore rules with Kustomization.spec.ignore
• Enhance the secrets decryption with Age post-quantum cipher and OpenBao/Vault workload identity auth
• Support SSH keys for Git commit verification and signing
• Support workload identity auth for AWS CodeCommit repositories
• Enhance keyless verification for air-gapped envs with custom Sigstore trusted root
• Add literal mode to HelmRelease valuesFrom (mirror helm --set-literal semantics)

⚠️ End-of-life support

The following APIs have reached end-of-life and are being removed from the CRDs:

• image.toolkit.fluxcd.io/v1beta2
• notification.toolkit.fluxcd.io/v1beta2

Unless you are using Flux Operator to deploy the Flux controllers, you must run the flux migrate command on clusters before upgrading.

Dependencies updates

• Go 1.26
• Kubernetes 1.36
• Controller Runtime 0.24
• Kustomize 5.8
• Helm 4.2
• Cosign 3.0
• fluxcd/go-git-providers v0.28.0

Release checklist

• source-controller v1.9.0
• source-watcher v2.2.0
• kustomize-controller v1.9.0
• notification-controller v1.9.0
• helm-controller v1.6.0
• image-reflector-controller v1.2.0
• image-automation-controller v1.2.0
• flux-benchmark v2.9.0
• flux2 v2.9.0
• terraform-provider-flux v1.9.0

Conformance testing

Distribution	Versions
Kubernetes KinD	1.34, 1.35, 1.36
OpenShift	4.21.0-okd
K3s	1.34, 1.35, 1.36
AWS	EKS 1.35
Azure	AKS 1.35
Google Cloud	GKE 1.35

Documentation

• Publish "Flux CLI Plugins" section with flux-mirror and flux-schema docs
• Update API docs
• Publish v2.9 website
• Publish Flux release change log to GitHub & Slack