Flux v2.9.0 introduces a modular CLI plugin system, significant security enhancements including post-quantum cipher support and SSH commit signing, and more granular control over resource drift and Helm deployments. This release also marks the final removal of deprecated v1beta2 APIs for image and notification components.

Extensible CLI Plugin System — The new plugin system allows the Flux CLI to be extended without core changes, starting with specialized mirror and schema tools. This provides a modular way for platform engineers to add custom functionality to their GitOps toolchain.

SSH-based Git Commit Signing and Verification — SSH key support for commit signing simplifies secure automation workflows, allowing users to verify the integrity of changes made by Flux (like image updates) using existing SSH-based infrastructure.

Fine-grained Drift Control with Field Ignore Rules — Users can now prevent Flux from trying to 'fix' specific fields managed by other tools (like HorizontalPodAutoscalers), reducing friction when mixing Flux with other controllers.

Enhanced Post-Quantum Decryption and Workload Identity Support — Strengthens the security posture of secrets management and cloud integrations by supporting post-quantum sensitive encryption (Age) and eliminating the need for long-lived credentials via Workload Identity for Vault and AWS CodeCommit.

Removal of v1beta2 Image and Notification APIs — If you are using very old versions of image or notification APIs, your configurations will stop working. You must upgrade these resources to v1 before applying this update.