Flux2 v2.9.5 - Helm v4.2.4 And Kubeconfig Guards

Flux2 v2.9.5 shipped on 31 August 2026. The patch puts helm-controller and source-controller back on upstream Helm v4.2.4 and drops the temporary Flux fork. The same tag also rejects kubeconfig Secrets that point at files on the controller filesystem.

The full release notes and downloads are on the GitHub release page.

Flux had been carrying a fork of Helm inside helm-controller and source-controller. This patch leaves that fork and pins upstream Helm at v4.2.4.

Chart fetch and render now track Helm’s own v4 line. Teams that deliver batch jobs, Airflow DAGs, or Flink clusters as Helm charts should treat this as a library swap, not a new CRD API. The notes do not list fork only patches that disappeared. Replay chart installs that already sit on Helm v4 against a staging cluster before rolling production controllers.

This release ships helm-controller v1.6.4 and source-controller v1.9.5. Controller detail lives in the helm-controller v1.6.4 changelog and the source-controller v1.9.5 changelog.

helm-controller and kustomize-controller validate kubeconfigs stored in .spec.kubeConfig Secrets.

The controllers reject local file references in certificate-authority, tokenFile, client-certificate, and client-key. Certificates and credentials must be embedded inline in the Secret. A path on the controller node is not accepted.

A Secret could previously tell the controller to read host files. That path is closed. It also breaks a real pattern. A kubeconfig that used certificate-authority: /etc/ssl/certs/ca.pem or a tokenFile aimed at a projected ServiceAccount token will fail validation after upgrade.

Blast radius is any HelmRelease or Kustomization that uses .spec.kubeConfig to reach a second cluster. Installs that never set .spec.kubeConfig are not affected.

Clusters that should never have let a Secret choose files on disk get a hard stop. Setups that injected CA material or tokens through hostPath or projected volumes and pointed kubeconfig at those paths will fail until the PEM and token bytes sit inline in the Secret. Do that rewrite before rolling the new controllers.

A previous kustomize-controller process that exited without cleanup could leave temporary directories on disk. This release purges those trees at startup. On a node with a small emptyDir or overlay, leftover reconcile scratch can fill the volume and confuse the next process. Startup purge is the blunt fix. It does not change how a successful reconcile writes its output.

The other kustomize fix is a crash in post-build substitution. A substring expression with a negative length, for example ${VAR:2:-1}, panicked. Bash counts back from the end of the string for that form. The controller and the flux CLI now match Bash instead of panicking.

Positive length slices were already fine. If substitutions copy Bash ${var:offset:length} and pass a negative length to strip a suffix, this is the patch that stops the panic. The kustomize-controller tag in this release is v1.9.5. See the kustomize-controller v1.9.5 changelog.

Inventory every HelmRelease and Kustomization with .spec.kubeConfig. Open the referenced Secret. If certificate-authority, client-certificate, client-key, or tokenFile hold filesystem paths, rewrite them to inline data before upgrading controllers. That is the change most likely to fail a reconcile after the bump.

The Helm fork drop is not described as a breaking API change. Chart installs that relied on fork only behavior should still be replayed in a staging namespace.

fluxcd/pkg updates pull Kubernetes client libraries to 1.36.4 in all controllers and the CLI. That is a client pin, not a cluster upgrade. The CLI side landed as pull 6046, pull 6048, and the component bump in pull 6049.

The notes also list source-watcher v2.2.4, notification-controller v1.9.4, image-reflector-controller v1.2.5, and image-automation-controller v1.2.5. The GitHub release page links those changelogs. The notes do not call out extra operator visible fixes there beyond the shared fluxcd/pkg bump.

Teams still on Flux v2.6 should follow the Upgrade Procedure for Flux v2.7+ rather than jumping this patch tag in isolation. The discussion is linked from the GitHub release page. Diff against the previous patch is v2.9.4 to v2.9.5.