<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa" -->

---
title: Announcing Flux 2.10 GA | daily.dev
description: Flux v2.10.0 is generally available, adding SPIFFE-based workload identity across the GitOps Toolkit. Flux controllers can now authenticate each other with...
canonical: https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Announcing Flux 2.10 GA | daily.dev
og:description: Flux v2.10.0 is generally available, adding SPIFFE-based workload identity across the GitOps Toolkit. Flux controllers can now authenticate each other with...
og:url: https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa
og:image: https://api.daily.dev/og/posts/mwFb7wOAA.png
og:image:alt: Announcing Flux 2.10 GA
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Announcing Flux 2.10 GA

**[Flux](https://daily.dev/sources/fluxcd)** · 13 min read · 0 upvotes · 0 comments

## Summary

Flux v2.10.0 is generally available, adding SPIFFE-based workload identity across the GitOps Toolkit. Flux controllers can now authenticate each other with mutual TLS using X509-SVIDs, and Flux objects can present short-lived SPIFFE credentials to registries and secret stores. The Event, Alert and Provider alerting APIs are promoted to stable v1, with new alerting providers for Zoom Team Chat, incident.io, and Mastodon. The CLI now supports kubectl-style TYPE/NAME arguments, and HelmRelease can reference an OCIRepository inline. A breaking RBAC change removes the default create permission on serviceaccounts/token, requiring a ClusterRoleBinding before upgrading. Flux v2.7 has reached end of life, and v2.10 supports Kubernetes 1.35 through 1.37 and OpenShift 4.22.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://fluxcd.io/blog/2026/10/flux-v2.10.0>

## Questions this post answers

### What breaking RBAC change do I need to handle before upgrading to Flux 2.10?

Flux 2.10's default RBAC no longer grants the create verb on the serviceaccounts/token resource. If you use object identity with the kubernetes credential provider on source-controller, notification-controller, image-reflector-controller, or image-automation-controller and rely on default RBAC, you must bind a ClusterRole with this permission to the controller ServiceAccounts before upgrading, as documented in fluxcd/flux2 pull request 6139.

_Track breaking changes like this RBAC update on daily.dev before you plan a Flux upgrade._

### How does SPIFFE-based mutual TLS work between Flux controllers in version 2.10?

Flux controllers authenticate each other with mutual TLS using X509-SVIDs issued by a SPIFFE Workload API such as SPIRE. Each traffic type (artifact fetching, internal event delivery, external webhooks) is enabled independently via controller flags specifying the Workload API socket and authorized SPIFFE IDs, and controller Services now expose an HTTPS port for this purpose.

_Developers hardening GitOps trust boundaries can follow SPIFFE and Flux updates on daily.dev._

### What happens to existing BadgerDB image tag data when upgrading image-reflector-controller in Flux 2.10?

Existing BadgerDB data is not migrated to the new default backend, which is now Flux artifact storage. After upgrading, the tag database starts empty and every ImageRepository performs a one-time full registry scan. To keep using BadgerDB instead, set the flag --feature-gates=FluxStorage=false on image-reflector-controller.

_Teams planning image-automation upgrades can check migration gotchas like this one on daily.dev._

## Similar posts on daily.dev

- [Flux turns 10\!](https://daily.dev/posts/flux-turns-10--i40mdinb9) · Flux · 8 upvotes · 0 comments
- [HashiCorp Vault 2.0 Marks Shift to IBM Lifecycle with New Identity Federation](https://daily.dev/posts/hashicorp-vault-2-0-marks-shift-to-ibm-lifecycle-with-new-identity-federation-aiyjug6wv) · InfoQ · 1 upvotes · 0 comments
- [Kubernetes v1.36 Promotes Stability, Compatibility & Reproducibility](https://daily.dev/posts/kubernetes-v1-36-promotes-stability-compatibility-reproducibility-q5x4goaqb) · Cloud Native Now · 14 upvotes · 0 comments
- [Self-Hosted Human and Machine Identities in Keycloak 26.4](https://daily.dev/posts/self-hosted-human-and-machine-identities-in-keycloak-26-4-qbyrik6nv) · CNCF · 0 upvotes · 0 comments

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#gitops](https://daily.dev/tags/gitops), [#flux](https://daily.dev/tags/flux)

[View this post on daily.dev](https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Flux 2.10 GA","url":"https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa"},"datePublished":"2026-10-26T15:50:27.453Z","dateModified":"2026-10-26T15:50:58.546Z","description":"Flux v2.10.0 is generally available, adding SPIFFE-based workload identity across the GitOps Toolkit. Flux controllers can now authenticate each other with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f62ef948bcd4d873a8fe3608aa1adb1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f62ef948bcd4d873a8fe3608aa1adb1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flux","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flux","logo":"https://media.daily.dev/image/upload/s--cMRgsf4e--/f_auto/v1743317541/logos/fluxcd","url":"https://daily.dev/sources/fluxcd"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,gitops,flux","timeRequired":"PT13M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flux","item":"https://daily.dev/sources/fluxcd"},{"@type":"ListItem","position":3,"name":"Announcing Flux 2.10 GA"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-flux-2-10-ga-mwfb7woaa#faq","mainEntity":[{"@type":"Question","name":"What breaking RBAC change do I need to handle before upgrading to Flux 2.10?","acceptedAnswer":{"@type":"Answer","text":"Flux 2.10's default RBAC no longer grants the create verb on the serviceaccounts/token resource. If you use object identity with the kubernetes credential provider on source-controller, notification-controller, image-reflector-controller, or image-automation-controller and rely on default RBAC, you must bind a ClusterRole with this permission to the controller ServiceAccounts before upgrading, as documented in fluxcd/flux2 pull request 6139. Track breaking changes like this RBAC update on daily.dev before you plan a Flux upgrade."}},{"@type":"Question","name":"How does SPIFFE-based mutual TLS work between Flux controllers in version 2.10?","acceptedAnswer":{"@type":"Answer","text":"Flux controllers authenticate each other with mutual TLS using X509-SVIDs issued by a SPIFFE Workload API such as SPIRE. Each traffic type (artifact fetching, internal event delivery, external webhooks) is enabled independently via controller flags specifying the Workload API socket and authorized SPIFFE IDs, and controller Services now expose an HTTPS port for this purpose. Developers hardening GitOps trust boundaries can follow SPIFFE and Flux updates on daily.dev."}},{"@type":"Question","name":"What happens to existing BadgerDB image tag data when upgrading image-reflector-controller in Flux 2.10?","acceptedAnswer":{"@type":"Answer","text":"Existing BadgerDB data is not migrated to the new default backend, which is now Flux artifact storage. After upgrading, the tag database starts empty and every ImageRepository performs a one-time full registry scan. To keep using BadgerDB instead, set the flag --feature-gates=FluxStorage=false on image-reflector-controller. Teams planning image-automation upgrades can check migration gotchas like this one on daily.dev."}}]}
```