--- title: Flux Mirror Uses Gitless GitOps to Keep Software Supply... description: Flux has released Flux Mirror, a CLI plugin built on the Flux v2.9 CLI plugin system that mirrors container images, Helm charts and OCI artifacts between... canonical: https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control | daily.dev og:description: Flux has released Flux Mirror, a CLI plugin built on the Flux v2.9 CLI plugin system that mirrors container images, Helm charts and OCI artifacts between... og:url: https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq og:image: https://api.daily.dev/og/posts/ZVdTblCfQ.png og:image:alt: Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary Flux has released Flux Mirror, a CLI plugin built on the Flux v2.9 CLI plugin system that mirrors container images, Helm charts and OCI artifacts between registries using declarative configuration. It supports the project's shift toward Gitless GitOps, where OCI registries rather than Git repositories become the runtime source of truth. The plugin can copy multi-arch container images byte-for-byte, republish HTTP-based Helm charts as OCI artifacts, verify Cosign signatures and identity, carry over SBOMs and provenance, and enforce a minimum age before artifacts are mirrored, acting as a supply-chain 'diode'. It responds to incidents like Docker Hub rate limiting and Broadcom freezing the Bitnami catalogue, and can run via GitHub Actions or as a Kubernetes CronJob. Community reactions from Control Plane and BIMP's Hannah Foxwell highlight the risks of depending on public registries and the need for curated private registries. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Flux Mirror and what does it do in Flux v2.9? Flux Mirror is a CLI plugin, part of the Flux v2.9 CLI plugin system, that mirrors container images, Helm charts and OCI artifacts between registries using a declarative configuration file. It copies multi-architecture container images byte-for-byte, republishes HTTP-based Helm charts as OCI artifacts, verifies Cosign signatures and provenance, and enforces a minimum artifact age before mirroring. _Teams designing Gitless GitOps pipelines can follow Flux tooling updates like this on daily.dev._ ### How does Flux Mirror protect against supply chain attacks like Shai Hulud or the Trivy GitHub Action compromise? Flux Mirror enforces a minimum artifact age policy so newly signed artifacts are held back before being mirrored into a private registry, reducing exposure to fast-moving attacks such as the Shai Hulud npm worm and the compromise of Aqua Security's Trivy GitHub Action, which left malicious artifacts live for days. Combined with Cosign signature checks and identity verification, this acts as a one-way supply-chain diode. _Developers hardening their supply chain against fast-spreading exploits can track defenses like this on daily.dev._ ### Why did Broadcom's Bitnami catalogue freeze matter for Kubernetes users relying on public registries? Broadcom's 2025 decision to freeze the popular free Bitnami container catalogue demonstrated that an external registry's policy change can become part of a production architecture overnight, breaking pipelines that pulled images directly from it. This incident, alongside Docker Hub rate limiting, is cited as a reason teams should mirror artifacts into registries they control rather than depending on public sources at runtime. _Anyone weighing self-hosted registries against public ones can follow incidents like this on daily.dev._ ## Similar posts on daily.dev - [Flux turns 10\!](https://daily.dev/posts/flux-turns-10--i40mdinb9) · Flux · 8 upvotes · 0 comments - [A weekend of GitOps: GitHub Actions, FluxCD, and Istio on EKS](https://daily.dev/posts/a-weekend-of-gitops-github-actions-fluxcd-and-istio-on-eks-p3dhqenln) · Medium · 6 upvotes · 0 comments - [DevOps isn’t enough: GitOps strategies for regulated multicloud deployments](https://daily.dev/posts/devops-isn-t-enough-gitops-strategies-for-regulated-multicloud-deployments-qabg3ggfw) · All Things Open · 3 upvotes · 0 comments - [How to operate OpenShift in air-gapped environments](https://daily.dev/posts/how-to-operate-openshift-in-air-gapped-environments-xvrqyfpfx) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#supply-chain](https://daily.dev/tags/supply-chain), [#gitops](https://daily.dev/tags/gitops), [#flux](https://daily.dev/tags/flux) [View this post on daily.dev](https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control","url":"https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq"},"datePublished":"2026-08-20T08:05:23.771Z","dateModified":"2026-08-20T08:06:37.653Z","description":"Flux has released Flux Mirror, a CLI plugin built on the Flux v2.9 CLI plugin system that mirrors container images, Helm charts and OCI artifacts between...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/447ac7f48c8cbc2d1df53ea665b2f74b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/447ac7f48c8cbc2d1df53ea665b2f74b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,supply-chain,gitops,flux","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/flux-mirror-uses-gitless-gitops-to-keep-software-supply-chain-under-control-zvdtblcfq#faq","mainEntity":[{"@type":"Question","name":"What is Flux Mirror and what does it do in Flux v2.9?","acceptedAnswer":{"@type":"Answer","text":"Flux Mirror is a CLI plugin, part of the Flux v2.9 CLI plugin system, that mirrors container images, Helm charts and OCI artifacts between registries using a declarative configuration file. It copies multi-architecture container images byte-for-byte, republishes HTTP-based Helm charts as OCI artifacts, verifies Cosign signatures and provenance, and enforces a minimum artifact age before mirroring. Teams designing Gitless GitOps pipelines can follow Flux tooling updates like this on daily.dev."}},{"@type":"Question","name":"How does Flux Mirror protect against supply chain attacks like Shai Hulud or the Trivy GitHub Action compromise?","acceptedAnswer":{"@type":"Answer","text":"Flux Mirror enforces a minimum artifact age policy so newly signed artifacts are held back before being mirrored into a private registry, reducing exposure to fast-moving attacks such as the Shai Hulud npm worm and the compromise of Aqua Security's Trivy GitHub Action, which left malicious artifacts live for days. Combined with Cosign signature checks and identity verification, this acts as a one-way supply-chain diode. Developers hardening their supply chain against fast-spreading exploits can track defenses like this on daily.dev."}},{"@type":"Question","name":"Why did Broadcom's Bitnami catalogue freeze matter for Kubernetes users relying on public registries?","acceptedAnswer":{"@type":"Answer","text":"Broadcom's 2025 decision to freeze the popular free Bitnami container catalogue demonstrated that an external registry's policy change can become part of a production architecture overnight, breaking pipelines that pulled images directly from it. This incident, alongside Docker Hub rate limiting, is cited as a reason teams should mirror artifacts into registries they control rather than depending on public sources at runtime. Anyone weighing self-hosted registries against public ones can follow incidents like this on daily.dev."}}]} ```