--- author: dholbach date: 2022-01-31 9:30:00+00:00 title: January 2022 Update description: New Flux and Flagger releases bring more security, terraform-controller team wants feedback, Flux articles and docs, upcoming Flux events helping you get started and more. url: /blog/2022/01/january-update/ resources: - src: "**.png" title: "Image #:counter" tags: [monthly-update] --- As the Flux family of projects and its communities are growing, we strive to inform you each month about what has already landed, new possibilities which are available for integration, and where you can get involved. Read our [last update here](/blog/2021/11/december-update/). It's the beginning of February 2022 and you have been waiting for a long time - let's recap together what happened in January and December- there has been so much happening! ## News in the Flux family ### Flux v0.26: more secure by default We released [Flux v0.26.0](https://github.com/fluxcd/flux2/releases/tag/v0.26.0). This release comes with new features and improvements. First of all, please note that the minimum supported version of Kubernetes is now v1.20.6. Flux may work on Kubernetes 1.19, but we don't recommend running EOL versions in production. On multi-tenant clusters, Flux controllers are now using the native Kubernetes impersonation feature. When both `spec.kubeConfig` and `spec.ServiceAccountName` are specified in Flux custom resources, the controllers will impersonate the service account on the target cluster, previously the controllers ignored the service account. #### :lock: Security enhancements - Platform admins have the option to [lock down Flux on multi-tenant clusters](/flux/installation/configuration/multitenancy/) and enforce tenant isolation at namespace level without having to use a 3rd party admission controller. - The Flux installation conforms to the Kubernetes [restricted pod security standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) and the Seccomp runtime default security profile was enabled for all controllers. - The container images of all Flux's components are signed with [Cosign and GitHub OIDC](/flux/security/#signed-container-images). - Flux releases include a [Software Bill of Materials (SBOM)](/flux/security/#software-bill-of-materials) that is available for download on the GitHub release page. #### :rocket: New features and improvements {{< imgproc featured-image Resize 800x >}} New feature in action: flux diff kustomization {{< /imgproc >}} - Preview local changes against live clusters with the `flux diff kustomization` command. - Undo changes made directly on clusters (with `kubectl` server-side apply) to Flux managed objects. - Native support for [Hashicorp Vault](/flux/components/kustomize/kustomization/#hashicorp-vault) token-based authentication when decrypting SOPS encrypted secrets. - Auto-login to AWS ECR, Azure ACR and Google Cloud GCR for [image update automation](/flux/guides/image-update/#imagerepository-cloud-providers-authentication) on EKS, AKS or GKE. - On single-tenant clusters, image automation can now refer to Git repositories in other namespaces than the ImageImageUpdateAutomation object. ### Flux v0.25 the last to officially support Kubernetes 1.19 The Flux community has been hard at work and released Flux 0.25. We encourage you to upgrade for the best experience! - This version aligns Flux and its components with the [Kubernetes 1.23](https://kubernetes.io/blog/2021/12/07/kubernetes-1-23-release-announcement/) release and [Helm 3.7](https://github.com/helm/helm/releases/tag/v3.7.0). - The Flux CLI and the GitOps Toolkit controllers are now built with Go 1.17 and Alpine 3.15. - In addition, various Go and OS packages were updated to fix known CVEs. :warning: Note that Kubernetes 1.19 has reached end-of-life in November 2021. This is the last Flux release where Kubernetes 1.19 is supported. ### Flagger 1.17 has landed This release comes with support for [Kuma Service Mesh](https://kuma.io/). For more details see the [Kuma Progressive Delivery tutorial](/flagger/tutorials/kuma-progressive-delivery). {{< imgproc flagger-kuma-canary Resize 600x >}} Kuma Progressive Delivery with Flagger {{< /imgproc >}} To differentiate alerts based on the cluster name, you can configure Flagger with the `-cluster-name=my-cluster` command flag, or with Helm `--set clusterName=my-cluster`. In addition to that, Flagger now publishes a Software Bill of Materials (SBOM) for every release and we added the cluster name to flagger comment arguments for altering. ### Security news Security was a big focus for us in the past weeks. If you take a look at the ["Follow-Up" project](https://github.com/orgs/fluxcd/projects/5) after the [CNCF-funded audit](/blog/2021-11-10-flux-security-audit/), you will notice that almost all the tasks have been done (or are indeed very close). It's largely the fuzzing work which is close to land and some additional documentation. 2.5 months after the audit concluded we are quite happy with where we have arrived - having the analysis of the auditors in front of us gave us a solid focus. In the 0.26 release of Flux, we applied the [restricted pod security standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) to all controllers. In practice this means: - all Linux capabilities were dropped - the root filesystem was set to read-only - the `seccomp` profile was set to the runtime default - run as non-root was enabled - the filesystem group was set to 1337 - the user and group ID was set to 65534 Flux also enables the Seccomp runtime default across all controllers. Why is this important? Well, the default `seccomp` profile blocks key system calls that can be used maliciously, for example to break out of the container isolation. The recently disclosed [kernel vulnerability CVE-2022-0185](https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-in-kubernetes) is a good example of that. Big news are also that we - [Publish SBOM for Flux and the GitOps Toolkit components](https://github.com/fluxcd/flux2/issues/2302) and - [Sign the release checksums and container images with Cosign and GitHub OIDC](https://github.com/fluxcd/flux2/issues/2303) One bit we are still working on and will be part of the next release is upgrading our [dependency libgit2 to 1.3.0](https://github.com/fluxcd/source-controller/pull/557), which will add support for ed25519 for both client authentication and hostKey verification. ### A word on RFCs After reviews from all maintainers, [RFC-0001 Authorization](https://github.com/fluxcd/flux2/tree/main/rfcs/0001-authorization) is merged. This RFC describes in detail, for [Flux version 0.24](https://github.com/fluxcd/flux2/releases/tag/v0.24.0), how Flux determines which operations are allowed to proceed, and how this interacts with Kubernetes\' access control. To this point, the Flux project has provided [examples of how to make a multi-tenant system](https://github.com/fluxcd/flux2-multi-tenancy/tree/v0.1.0), but not explained exactly how they relate to Flux\'s authorization model; nor has the authorization model itself been documented. Further work on support for multi-tenancy, among other things, requires a full account of Flux\'s authorization model as a baseline. **Goals**: Give a comprehensive account of Flux\'s authorization model **Non-Goals**: Justify the model as it stands; this RFC simply records the state as at v0.24. ## Recent & Upcoming Events It's important to keep you up to date with new features and developments in Flux and provide simple ways to see our work in action and chat with our engineers. ### January 27: GitOps & Flux: A Refresher - Priyanka Ravi [View the video here](https://youtu.be/81EOeobifio). Priyanka "Pinky" Ravi is an end user of GitOps and Flux, and now is advocating for others like you to enjoy the benefits of GitOps today! :tada: Benefits of GitOps and Flux! How GitOps and Flux bring you security, reliability, velocity and more - no more pagers on Saturdays! no more breaches to the cluster that you can\'t roll back. no more worrying about how you\'ll fare in the next security audit. Pinky shares from personal experience why GitOps has been an essential part of achieving a best-in-class delivery and platform team. :tada: What is GitOps and Flux? For beginners and advanced users alike, Pinky gives a brief overview of definitions, CNCF-based principles, and Flux\'s capabilities: multi-tenancy, multi-cluster, (multi-everything!), for apps and infra, and more. :tada: How Flux delivers these benefits Pinky covers a little of Flux\'s microservices architecture and how the various components deliver this robust, secure, and trusted open source solution. Through the components of the Flux project, users today are enjoying compatibility with Helm, Jenkins, Terraform, Prometheus, and more as well as with cloud providers such as AWS, Azure, Google Cloud, and more. ### February 2: Get Started with Flux - Priyanka Ravi [Register here](https://www.meetup.com/GitOps-Community/events/283239976/) Is your team stuck working weekends during an upgrade? Dealing with long deployment windows due to manual processes? Are you tired of dealing with too many vendor tools, or not having an audit trail for compliance? There\'s got to be a better way! There is, and during this session Priyanka \"Pinky\" Ravi will give you an overview of how to get better security, velocity, and reliability with GitOps, and then how to get GitOps going on your own machine! By the end of this talk, you\'ll see two easy paths to getting GitOps up and running using Flux on Kubernetes. You\'ll see GitOps in action with a sample app that you deploy and then customize using configs. And then you\'ll hear ways that delivery and platform teams today are benefitting from GitOps, saving them from headaches, boredom, fires, and saving them time and money. Join us! ### February 16: GitOps with Amazon EKS Anywhere + Flux - Dan Budris [Register here](https://www.meetup.com/GitOps-Community/events/283339915/) Amazon EKS Anywhere is an open-source tool which helps you create and manage Kubernetes clusters on-premises. EKS Anywhere allows you to manage your Kubernetes clusters in a scalable and declarative manner with the help of GitOps, powered under-the-hood with CNCF Flux. In this session, Dan will share how EKS Anywhere integrates with Flux and uses GitOps workflows to manage the cluster lifecycle. Dan is a Software Engineer on the AWS EKS Anywhere team, working on tools to help developers easily build and manage Kubernetes clusters on premises. In the past, Dan has worked as a System Administrator, DevOps Engineer, SRE, gardener, cook and professional door-knocker. When he's not helping to build EKS Anywhere you can find him weeding the garden or in the kitchen working his way through another cookbook. ### March 2: Managing Thousands of Clusters & Their Workloads with Flux - Max Jonas Werner [Register here](https://www.meetup.com/GitOps-Community/events/283484465/) One of the main goals of DevOps is to automate operations as much as possible. By automating most operations, DevOps can provide business agility and allow Developers to focus more on business applications. This allows operations to be more efficient by being less error-prone and repeatable, improving the overall developer experience. D2iQ uses Flux to automatically enable this experience in its products. Join us for a hands-on session on multi-cluster management using GitOps. Max is a Senior Software Engineer at D2iQ (formerly Mesosphere) and is based out of Hamburg. He is one of the lead developers of D2iQ\'s multi-cluster management offering that is based on Flux. ### Flux Bug Scrub If you've never joined a Flux Bug Scrub before, (or even if you have) we welcome you to join this weekly meeting with Flux developers which is an open "office hour" where we visit issues and discussions in the Flux org, and have open discussion about it. We also try to make sure that nobody is left blocked on an important question, waiting for a response. This is a great venue for beginners to meet the Flux team and find "good first issues" as we triage new issues together; you can get an issue assigned to you here, a great help for folks as they are learning and getting involved with the Flux Open Source project. In the coming weeks, we also plan to make some additional changes to the Bug Scrub format, opening up the possibility that we will have planned presentations or predetermined discussion topics, so that these meetings are less random and we can attract more interest. Look to the schedule for information about how to join at [https://fluxcd.io/\#calendar](/#calendar) or [add the Flux events to your own calendar](/community/#subscribing-to-the-flux-calendar) if you want to participate, and be sure you don't miss out on the new Flux Bug Scrub, Special Edition! ## In other news A big shout-out to our friends at the Cloud Native Computing Foundation (CNCF)! As part of [being an Incubating project](/blog/2021/03/flux-is-a-cncf-incubation-project/), we have access to resources which help us build and deliver Flux to a significant degree. This time around, we were [granted some Equinix ARM machines](https://github.com/cncf/cluster/issues/196) to help us with builds and running end-to-end tests on ARM64. A big thanks from our community... :smiling_face_with_hearts: ### Community project: Terraform Controller for Flux Chanwit Kaewkasi and others have been hard at work. They created a [Flux controller which reconciles Terraform](https://github.com/chanwit/tf-controller) resources in the GitOps way. It's important to understand that this is different from `fluxcd/terraform-provider-flux`, which is for bootstrapping Flux from Terraform (by a Terraform user). The TF-controller is a Kubernetes controller that allows a Flux / Kubernetes user to reconcile Terraform resources, e.g. deploying PostgreSQL on AWS, enforcing Security Groups, and preparing IAM Role Policies. So it considerably extends the scope of what is being GitOps'ed. It comes with GitOps models to support reconciling Terraform resources within GitOps pipelines. For example, - Full GitOps Automation - GitOps for Existing Terraform resources - GitOps model for plan and manually apply Terraform - Drift Detection of Terraform resources Its README goes into quite a bit of detail on how to make use of it. Its latest version 0.8.0 supports Flux v0.25.x and Terraform 1.1.4. The Helma chart for TF-controller is also available. Please note that TF-controller isn't supporting multi-tenancy yet. And we\'re actively working on a model of it: [https://github.com/chanwit/tf-controller/issues/59](https://github.com/chanwit/tf-controller/issues/59) We very much appreciate Chanwit and friends working on this and want to extend their request for testing and feedback - take it for a spin and let them know how it's working! ### People writing/talking about Flux [Deutsche Telekom preps Kubernetes 5G core with GitOps](https://searchitoperations.techtarget.com/news/252510456/Deutsche-Telekom-preps-Kubernetes-5G-core-with-GitOps) πŸ“ƒ Beth Pariseau recently wrote about how "GitOps will help the German mobile carrier manage IT automation for its 5G SA app on a large internal Kubernetes platform with minimal staff needed to do hands-on administration." Deutsche Telekom uses Flux in its [Das Schiff](https://github.com/telekom/das-schiff) project, you can also find this listed as an [Integration](/integrations/) on our website. [Flux Multi-Cluster Multi-Tenant by Example (Continued)](https://john-tucker.medium.com/flux-multi-cluster-multi-tenant-by-example-continued-4caa024e6dc7) πŸ“ƒ John Tucker walks through this continuation of a [previous article](https://john-tucker.medium.com/flux-multi-cluster-multi-tenant-by-example-a8d6f9cc82f0) for using Flux to deliver applications in a multi-cluster multi-tenant Kubernetes environment. [Flux - Kubernetes GitOps (CNCFMinutes 20)](https://youtu.be/1X3JgCnRNsw) πŸ“Ί Want to know what Flux is and does in \~8 minutes? CNCF Ambassador [Saiyam Pathak](https://twitter.com/saiyampathak) gave a [brief overview of Flux](https://youtu.be/1X3JgCnRNsw) on his [CNCFMinutes YouTube Series](https://youtube.com/playlist?list=PL5uLNcv9SibB658blGUEv18IhcMGL0dxC) Dan Wessels, Field Engineer at Solo.io has a couple of articles and a talk to share on Flux: - [https://www.solo.io/blog/gloo-edge-api-gateway-multi-cluster-provisioning-with-gitops/](https://www.solo.io/blog/gloo-edge-api-gateway-multi-cluster-provisioning-with-gitops/) πŸ“ƒ - [https://www.solo.io/blog/the-3-best-ways-to-use-flux-and-flagger-for-gitops-with-your-envoy-proxy-api-gateways/](https://www.solo.io/blog/the-3-best-ways-to-use-flux-and-flagger-for-gitops-with-your-envoy-proxy-api-gateways/) πŸ“ƒ - [Flux Booth talk: GitOps and Cloud Native API Gateways by Dan Wessels](https://youtu.be/yzE-9qgyJGg) πŸ“Ί The [External Secrets Operator project](https://external-secrets.io/) describes itself as > a Kubernetes operator that integrates external secret management > systems like [AWS Secrets > Manager](https://aws.amazon.com/secrets-manager/), > [HashiCorp Vault](https://www.vaultproject.io/), > [Google Secrets > Manager](https://cloud.google.com/secret-manager), > [Azure Key > Vault](https://azure.microsoft.com/en-us/services/key-vault/) > and many more. The operator reads information from external APIs and > automatically injects the values into a [Kubernetes > Secret](https://kubernetes.io/docs/concepts/configuration/secret/). The team around it also wrote a [guide on how to use it with Flux](https://external-secrets.io/guides-gitops-using-fluxcd/) - check it out. There is also [Introduction to GitOps with Flux v2](https://armmaster17.github.io/2021/11/07/gitops1/) by [Joshua Zenn](https://twitter.com/zennjos) πŸ“ƒ. ### News from the Website and our Docs How we present ourselves to users on our website and how we talk about Flux and explain it in our documentation is important to us. So since the last Flux update blog we got a lot done: - We added instructions on how to [encrypt secrets using HashiCorp Vault](/flux/guides/mozilla-sops/#encrypting-secrets-using-hashicorp-vault) - We explain [how to bootstrap Flux on AWS EKS with CodeCommit Git repositories](/flux/use-cases/aws-codecommit/) - Docs updates for Flux v0.26.0, including a \"Multi-tenancy lockdown\" section in the install docs - References in the Helm Operator (legacy) section were updated to 1.4.2. - Updated Flux endorsements and [Resources - so many resources](/resources/) - Many docs improvements and internal bug fixes - Again we updated our internal dependencies like Hugo and Docsy to the latest to benefit from upstream fixes and new features Thanks a lot to these contributors: Stefan Prodan, Lloyd Chang, Kingdon Barrett, Andri Muhyidin, Luke Mallon, Somtochi Oneykwere, Stacey Potter, Christian Berendt, Daniel Quackenbush, Hidde Beydals, IΓ±igo Iglesias, Jens Fosgerau, Moritz, Phil Fenstermacher, Sam Cook, Scott Rigby, SoulΓ© Ba and vasu1124. We are proud to announce new [Flux adopters](/adopters/) who officially joined our community since last time: [SAP SE](https://sap.com), [Alea](https://www.alea.com), [William & Mary](https://www.wm.edu), [23 Technologies GmbH](https://www.23technologies.cloud), [DKB Codefactory](https://www.dkbcodefactory.com), [99 Group](https://www.99.co), [Trendhim](https://www.trendhim.com). If you would like to add your organisation to the Flux Adopters page, [here's how](https://github.com/fluxcd/website/tree/main/adopters). #### CNCF TechDocs Team assess Flux Docs and Website Alison Dowdney talked to the CNCF TechDocs team and asked for an assessment of our docs and website to help us understand how we can further improve. We are very grateful for the hard work Celeste Horgan put into assessing our docs and [compiling a report](https://github.com/cncf/techdocs/blob/main/assessments/0005-fluxcd.md). We are very pleased with the outcome: our site consistently scores 4 or 5 (out of 5) on all criteria. There are a couple of very wise recommendations we will discuss in our next dev meetings to figure out a way forward. If you want to know more, either read the report, or have a look at the [project board](https://github.com/orgs/fluxcd/projects/3) we set up to track this effort. If you would like to [work with us](/contributing/docs/) on the website and documentation, please reach out to us on Slack. πŸ’– Thanks again CNCF and TechDocs team - we very much appreciate being part of this community and receiving so much support in growing our project! ## Flux Project Facts! We are very proud of what we put together, here we want to reiterate some Flux facts - they are sort of our mission statement with Flux. 1. 🀝 Flux provides GitOps for both apps or infrastructure. Flux and Flagger deploy apps with canaries, feature flags, and A/B rollouts. Flux can also manage any Kubernetes resource. Infrastructure and workload dependency management is built-in. 1. πŸ€– Just push to Git and Flux does the rest. Flux enables application deployment (CD) and (with the help of Flagger) progressive delivery (PD) through automatic reconciliation. Flux can even push back to Git for you with automated container image updates to Git (image scanning and patching). 1. πŸ”© Flux works with your existing tools: Flux works with your Git providers (GitHub, GitLab, Bitbucket, can even use s3-compatible buckets as a source), all major container registries, and all CI workflow providers. 1. ☸️ Flux works with any Kubernetes and all common Kubernetes tooling: Kustomize, Helm, RBAC, and policy-driven validation (OPA, Kyverno, admission controllers) so it simply falls into place. 1. 🀹 Flux does Multi-Tenancy (and "Multi-everything"): Flux uses true Kubernetes RBAC via impersonation and supports multiple Git repositories. Multi-cluster infrastructure and apps work out of the box with Cluster API: Flux can use one Kubernetes cluster to manage apps in either the same or other clusters, spin up additional clusters themselves, and manage clusters including lifecycle and fleets. 1. πŸ“ž Flux alerts and notifies: Flux provides health assessments, alerting to external systems and external events handling. Just "git push", and get notified on Slack and [other chat systems](https://github.com/fluxcd/notification-controller/blob/main/docs/spec/v1beta1/provider.md). 1. πŸ‘ Users trust Flux: Flux is a CNCF Incubating project and was categorised as \"Adopt\" on the [CNCF CI/CD Tech Radar](https://radar.cncf.io/2020-06-continuous-delivery) (alongside Helm). 1. πŸ’– Flux has a lovely community that is very easy to work with! We welcome contributors of any kind. The components of Flux are on Kubernetes core controller-runtime, so anyone can contribute and its functionality can be extended very easily. ## Over and out If you like what you read and would like to get involved, here are a few good ways to do that: - Join our [upcoming dev meetings](/community/#meetings) on 2022-02-02 or 2022-02-10. - Talk to us in the \#flux channel on [CNCF Slack](https://slack.cncf.io/) - Join the [planning discussions](https://github.com/fluxcd/flux2/discussions) - And if you are completely new to Flux, take a look at our [Get Started guide](/flux/get-started/) and give us feedback - Social media: Follow [Flux on Twitter](https://twitter.com/fluxcd), join the discussion in the [Flux LinkedIn group](https://www.linkedin.com/groups/8985374/). We are looking forward to working with you.