chore(deps): bump the go group with 7 updates

[dependabot]

Bumps the go group with 7 updates:

Package	From	To
github.com/fluxcd/flux2/v2	2.5.1	2.6.0
github.com/fluxcd/helm-controller/api	1.2.0	1.3.0
github.com/fluxcd/image-automation-controller/api	0.40.0	0.41.0
github.com/fluxcd/image-reflector-controller/api	0.34.0	0.35.0
github.com/fluxcd/kustomize-controller/api	1.5.1	1.6.0
github.com/fluxcd/notification-controller/api	1.5.0	1.6.0
github.com/fluxcd/source-controller/api	1.5.0	1.6.0

Updates github.com/fluxcd/flux2/v2 from 2.5.1 to 2.6.0

Release notes

Sourced from github.com/fluxcd/flux2/v2's releases.

v2.6.0

Highlights

Flux v2.6.0 is a feature release. Users are encouraged to upgrade for the best experience.

For a compressive overview of new features and API changes included in this release, please refer to the Announcing Flux 2.6 GA blog post.

Overview of the new features:

• General availability release for the Flux OCI Artifacts APIs and flux artifact commands
• Support for OCI digests pinning (ImagePolicy, ImageUpdateAutomation)
• Object-level workload identity authentication (OCIRepository, ImageRepository, Kustomization, Alert Provider)
• Cache registry credentials for cloud providers (OCIRepository, ImageRepository)
• Git HTTP/S Mutual TLS authentication (GitRepository, ImageUpdateAutomation)
• Support for sparse checkout (GitRepository)
• Support for GitHub App authentication (Alert Provider)
• Support for managed Identity authentication to Azure Event Hub (Alert Provider)
• Customize the ID of the Git commit status with CEL expressions (Alert Provider)
• WaitForTermination deletion policy (Kustomization)
• DisableChartDigestTracking feature gate (HelmRelease)

❤️ Big thanks to all the Flux contributors that helped us with this release!

Kubernetes compatibility

This release is compatible with the following Kubernetes versions:

Kubernetes version	Minimum required
v1.31	>= 1.31.0
v1.32	>= 1.32.0
v1.33	>= 1.33.0

[!NOTE] Note that the Flux project offers support only for the latest three minor versions of Kubernetes. Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors such as ControlPlane that provide enterprise support for Flux.

OpenShift compatibility

Flux can be installed on Red Hat OpenShift cluster directly from OperatorHub using Flux Operator. The operator allows the configuration of Flux multi-tenancy lockdown, network policies, persistent storage, sharding, vertical scaling and the synchronization of the cluster state from Git repositories, OCI artifacts, and S3-compatible storage.

Upgrade procedure

Upgrade Flux from v2.5.0 to v2.6.0 by following the upgrade guide.

To upgrade the APIs, make sure the new CRDs and controllers are deployed, and then change the manifests in Git:

1. Set apiVersion: source.toolkit.fluxcd.io/v1 in the YAML files that contain OCIRepository definitions.

... (truncated)

Commits

• 4c66d37 Merge pull request #5370 from fluxcd/update-components
• 481c3c6 Update toolkit components
• 1d1d96b Merge pull request #5373 from fluxcd/dependabot-up
• 0b97277 Update dependabot config
• 6507321 Merge pull request #5371 from fluxcd/oci-ga
• 79fed69 Update CLI to OCIRepository v1 (GA)
• b37ba73 Merge pull request #5345 from fluxcd/store-digests
• 65766ff Add --interval and --reflect-digest flags to flux create image policy
• 19d9b87 Merge pull request #5369 from fluxcd/oci-commands
• d82ec5a Promote artifact commands to stable
• Additional commits viewable in compare view

Updates github.com/fluxcd/helm-controller/api from 1.2.0 to 1.3.0

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.3.0

Changelog

v1.3.0 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.3.0
• ghcr.io/fluxcd/helm-controller:v1.3.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.3.0

Release date: 2025-05-28

This minor release comes with various bug fixes and improvements.

The controller now supports the DisableChartDigestTracking feature gate, which allows disabling appending the digest of OCI Helm charts to the chart version. This is useful for charts that do not follow Helm's recommendation of using the app version instead of the chart version as a label in the manifests.

In addition, the Kubernetes dependencies have been updated to v1.33, Helm has been updated to v3.17.3 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Fix returning wrong error value in Kubernetes HTTP client #1188

Improvements:

• Add DisableChartDigestTracking feature gate #1212
• Various dependency updates #1227 #1221 #1220 #1218 #1206 #1209 #1204

Commits

• e47f47f Merge pull request #1229 from fluxcd/release-v1.3.0
• aa70ca3 Release v1.3.0
• 483f166 Add changelog entry for v1.3.0
• b6d8e39 Merge pull request #1227 from fluxcd/oci-ga
• 034ea18 Update controller to OCIRepository v1 (GA)
• ff69170 Update dependencies
• b2e9046 Merge pull request #1221 from fluxcd/dependabot/github_actions/ci-5eaca88b60
• 4653af4 Bump the ci group across 1 directory with 3 updates
• 68883e4 Merge pull request #1220 from fluxcd/upgrade-deps
• 95e69b5 Upgrade fluxcd/pkg packages
• Additional commits viewable in compare view

Updates github.com/fluxcd/image-automation-controller/api from 0.40.0 to 0.41.0

Release notes

Sourced from github.com/fluxcd/image-automation-controller/api's releases.

v0.41.0

Changelog

v0.41.0 changelog

Container images

• docker.io/fluxcd/image-automation-controller:v0.41.0
• ghcr.io/fluxcd/image-automation-controller:v0.41.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-automation-controller/api's changelog.

0.41.0

Release date: 2025-05-28

This prerelease comes with support for updating image digests, for configuring mTLS with HTTPS Git repositories, and with caching Git provider access tokens.

ImagePolicy API now supports reflecting image digests in-cluster. By integrating with this feature the ImageUpdateAutomation API can now update image digests in YAML manifests. See this guide for more details.

The controller now caches Git provider access tokens by default. This behavior can be disabled or fine-tuned by adjusting the token cache controller flags (see docs). The token cache also exposes metrics that are documented here.

For configuring mTLS with HTTPS Git repositories see the GitRepository docs.

In addition, the Kubernetes dependencies have been updated to v1.33 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Fix tag parsing logic misinterpreting host:port registry url #893

Improvements:

• Update digest of latest image #902
• Introduce token cache for Git provider access tokens #861 #895 #897
• Add support for mutual TLS to Git HTTP/S operations #886
• Support for all recognized Kustomize config file names #864
• Various dependency updates #916 #908 #900 #896 #898 #891

... (truncated)

Commits

• b4ad41b Merge pull request #917 from fluxcd/release-v0.41.0
• b09cceb Release v0.41.0
• 4f207d5 Merge pull request #916 from fluxcd/update-sc
• e5ae409 Update dependencies
• 48b16c2 Merge pull request #902 from fluxcd/update-digests
• 806d410 Update digest of latest image
• 4addc4e Merge pull request #908 from fluxcd/dependabot/github_actions/ci-773070ff14
• 82f0853 Bump the ci group across 1 directory with 4 updates
• f7387cc Merge pull request #913 from fluxcd/rfc-0010-docs
• 3d434f0 [RFC-0010] Link workload identity docs to complete guide
• Additional commits viewable in compare view

Updates github.com/fluxcd/image-reflector-controller/api from 0.34.0 to 0.35.0

Release notes

Sourced from github.com/fluxcd/image-reflector-controller/api's releases.

v0.35.0

Changelog

v0.35.0 changelog

Container images

• docker.io/fluxcd/image-reflector-controller:v0.35.0
• ghcr.io/fluxcd/image-reflector-controller:v0.35.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-reflector-controller/api's changelog.

0.35.0

Release date: 2025-05-27

This prerelease comes with support for object-level workload identity and image digest reflection.

ImageRepository

ImageRepository API now supports object-level workload identity by setting .spec.provider to one of aws, azure, or gcp, and setting .spec.serviceAccountName to the name of a service account in the same namespace that has been configured with appropriate cloud permissions. For this feature to work, the controller feature gate ObjectLevelWorkloadIdentity must be enabled. See a complete guide here.

ImageRepository API now caches registry credentials for cloud providers by default. This behavior can be disabled or fine-tuned by adjusting the token cache controller flags (see docs). The token cache also exposes metrics that are documented here.

ImagePolicy

ImagePolicy API now supports configuring a digest reflection policy through the field .spec.digestReflectionPolicy. This allows users to configure the controller to reflect the digest of the latest image tag in the status of the ImagePolicy resource. See this guide for more details.

General updates

The controller now collects the garbage from BadgerDB, the database where it stores image tags. The interval is 10 minutes by default, but it can be disabled or fine-tuned, see docs.

In addition, the Kubernetes dependencies have been updated to v1.33 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Downgrade Masterminds/semver to v3.3.0 #761

Improvements:

• [RFC-0010] Introduce object-level workload identity and cache credentials

... (truncated)

Commits

• 832b91d Merge pull request #768 from fluxcd/release-v0.35.0
• dc7b08c Release v0.35.0
• e9e2426 Merge pull request #767 from fluxcd/dependabot/github_actions/ci-a39aa48eed
• 88d864b Bump the ci group with 18 updates
• c5a592b Merge pull request #766 from fluxcd/rfc-0010-docs
• 3e212d2 [RFC-0010] Link workload identity docs to complete guide
• 6275ee0 Merge pull request #765 from fluxcd/upgrade-deps
• 8eea66d Update dependencies
• c491302 Merge pull request #757 from stealthybox/gc-channel
• 8ec426f Implement BadgerGC with controller runtime
• Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.5.1 to 1.6.0

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.6.0

Changelog

v1.6.0 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.6.0
• ghcr.io/fluxcd/kustomize-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.6.0

Release date: 2025-05-28

This minor release comes with various bug fixes and improvements.

Kustomization API now supports object-level workload identity by setting .spec.decryption.serviceAccountName to the name of a service account in the same namespace that has been configured with appropriate cloud permissions. For this feature to work, the controller feature gate ObjectLevelWorkloadIdentity must be enabled. See a complete guide here.

Kustomization API now supports the value WaitForTermination for the .spec.deletionPolicy field. This instructs the controller to wait for the deletion of all resources managed by the Kustomization before allowing the Kustomization itself to be deleted. See docs here.

In addition, the Kubernetes dependencies have been updated to v1.33 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Fix performance regression due to using client without cache #1436
• Fix secret value showing up in logs #1372

Improvements:

• [RFC-0010] Introduce KMS provider decryption with service account #1426 #1449 #1456
• Add WaitForTermination option to DeletionPolicy #1444
• Skip emitting events for suspended Kustomizations #1396
• Various dependency updates #1458 #1448 #1433 #1435 #1429 #1414 #1410 #1401

Commits

• f54038e Merge pull request #1460 from fluxcd/release-v1.6.0
• 6efc3eb Release v1.6.0
• 9eb8ca7 Add changelog entry for v1.6.0
• 24e54da Merge pull request #1458 from fluxcd/oci-ga
• ff76a91 Update controller to OCIRepository v1 (GA)
• f2db6a2 Update dependencies
• ada569f Merge pull request #1448 from fluxcd/dependabot/github_actions/ci-b758b462f2
• 1d32962 Bump the ci group across 1 directory with 4 updates
• e537b99 Merge pull request #1456 from fluxcd/rfc-0010-docs
• 8303b08 [RFC-0010] Link workload identity docs to complete guide
• Additional commits viewable in compare view

Updates github.com/fluxcd/notification-controller/api from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/fluxcd/notification-controller/api's releases.

v1.6.0

Changelog

v1.6.0 changelog

Container images

• docker.io/fluxcd/notification-controller:v1.6.0
• ghcr.io/fluxcd/notification-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/notification-controller/api's changelog.

1.6.0

Release date: 2025-05-27

This minor release comes with various bug fixes and improvements.

Provider

The azureeventhub provider now supports workload identity both at the controller and object levels. For object level, the .spec.serviceAccountName field can be set to the name of a service account in the same namespace that was configured with a Managed Identity. For object level to work, the controller feature gate ObjectLevelWorkloadIdentity must be enabled. See a complete guide here.

The github and githubdispatch providers now support authenticating with a GitHub App. See docs here and here.

For commit status providers it is now possible to define a custom status string by defining a CEL expression in the .spec.commitStatusExpr field. The variables event, alert and provider are available for the CEL expression. See docs.

General updates

In addition, the Kubernetes dependencies have been updated to v1.33 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Fix Slack chat.postMessage error handling #1086
• Fix pass 'certPool' to Gitea client on creation #1084
• CrossNamespaceObjectReference: Fix MaxLength validation to kubernetes max size of 253 #1108
• Sanitize proxy error logging #1093

Improvements:

• [RFC-0010] Workload Identity support for azureeventhub provider #1106 #1116 #1120

... (truncated)

Commits

• 3a6de1f Merge pull request #1121 from fluxcd/release-v1.6.0
• a52f071 Release v1.6.0
• 0e0e912 Add changelog entry for v1.6.0
• 7383fe8 Merge pull request #1108 from larhauga/fix-crossnamespaceobjectref-maxlength
• 2284a0d CrossNamespaceObjectReference: Fix MaxLength validation to kubernetes max siz...
• d32f5e2 Merge pull request #1101 from fluxcd/dependabot/github_actions/ci-4c7c75f92f
• b416d68 build(deps): bump the ci group across 1 directory with 14 updates
• 3842f0c Merge pull request #1120 from fluxcd/rfc-0010-docs
• f2e2340 [RFC-0010] Link workload identity docs to complete guide
• 01dfe12 Merge pull request #1119 from fluxcd/upgrade-deps
• Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.6.0

Changelog

v1.6.0 changelog

Container images

• docker.io/fluxcd/source-controller:v1.6.0
• ghcr.io/fluxcd/source-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.6.0

Release date: 2025-05-27

This minor release promotes the OCIRepository API to GA, and comes with new features, improvements and bug fixes.

OCIRepository

The OCIRepository API has been promoted from v1beta2 to v1 (GA). The v1 API is backwards compatible with v1beta2.

OCIRepository API now supports object-level workload identity by setting .spec.provider to one of aws, azure, or gcp, and setting .spec.serviceAccountName to the name of a service account in the same namespace that has been configured with appropriate cloud permissions. For this feature to work, the controller feature gate ObjectLevelWorkloadIdentity must be enabled. See a complete guide here.

OCIRepository API now caches registry credentials for cloud providers by default. This behavior can be disabled or fine-tuned by adjusting the token cache controller flags (see docs). The token cache also exposes metrics that are documented here.

GitRepository

GitRepository API now supports sparse checkout by setting a list of directories in the .spec.sparseCheckout field. This allows for optimizing the amount of data fetched from the Git repository.

GitRepository API now supports mTLS authentication for HTTPS Git repositories by setting the fields tls.crt, tls.key, and ca.crt in the .data field of the referenced Secret in .spec.secretRef.

GitRepository API now caches credentials for non-generic providers by default. This behavior can be disabled or fine-tuned by adjusting the token cache controller flags (see docs). The token cache also exposes metrics that are documented here.

General updates

In addition, the Kubernetes dependencies have been updated to v1.33 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Downgrade Masterminds/semver to v3.3.0

... (truncated)

Commits

• 83cb986 Merge pull request #1813 from fluxcd/release-v1.6.0
• 465741e Release v1.6.0
• ac4afb3 Add changelog entry for v1.6.0
• 359d50d Merge pull request #1811 from fluxcd/rfc-0010-docs
• d555222 [RFC-0010] Link workload identity docs to complete guide
• fdc84c7 Merge pull request #1812 from fluxcd/containerd-v1.7.27
• 71aa99e Fix flaky test
• 36e0d0d Update containerd v1.7.27
• e98b89a Merge pull request #1794 from fluxcd/ocirepository-v1
• aadaf1c Remove deprecated status fields from OCIRepository v1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions