---
next_cursor: eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImZsdXgiLCJ2IjoxfQ
has_more: false
next: https://sincecutoff.com/v1/changes.md?tool=flux&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImZsdXgiLCJ2IjoxfQ
items: 7
---
# sincecutoff.com changes: flux

## flux bootstrap supports sparse checkout (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-bootstrap-supports-sparse-checkout-c4335674ece6
- score: 0.97

How to use it:

When bootstrapping Flux from a monorepo, pass `--sparse-checkout` with comma-separated directories and include the directory given to `--path`.

Examples:

```
flux bootstrap github --owner=<owner> --repository=<repository> --path=<path> --sparse-checkout=<path>,<directory>
```

- why_it_matters: Bootstrap Flux from a large monorepo while limiting the directories checked out by Flux.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://github.com/fluxcd/flux2/pull/5918>, <https://v2-9.docs.fluxcd.io/flux/cmd/flux_bootstrap/>, <https://v2-9.docs.fluxcd.io/flux/cmd/flux_bootstrap_github/>
- gotchas: "Version: v2.9.0"; "--sparse-checkout: Comma-separated directories included in the GitRepository sparse checkout; the configured `--path` must be one of them."; "--path (required): Bootstrap target path; include it in `--sparse-checkout`."; "--owner (required): GitHub repository owner."; "--repository (required): GitHub repository name."; "The `--path` directory must be included in the `--sparse-checkout` list."; "The flag applies to the `github`, `gitlab`, `gitea`, `git`, and `bitbucket-server` bootstrap providers."

## Flux CLI adds plugin discovery, installation, management, and invocation (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-cli-adds-plugin-discovery-installation-management-and-invocation-79e43fc45e58
- score: 0.93

How to use it:

When you need a catalog plugin in a Flux repository, search with `flux plugin search`, install it with `flux plugin install <name>`, then invoke it as `flux <name>`. Manage installed plugins with `flux plugin ls`, `flux plugin update [<name>]`, and `flux plugin uninstall <name>`.

Examples:

```
flux plugin search [<query>]
```

```
flux plugin install <name>[@<version>|@<digest>]
```

```
flux <name> <plugin-args>
```

- why_it_matters: Install or invoke a catalog plugin while working with a Flux repository.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://github.com/fluxcd/flux2/pull/5849>, <https://github.com/fluxcd/plugins>, <https://v2-9.docs.fluxcd.io/flux/cmd/flux_plugin_install/>, <https://v2-9.docs.fluxcd.io/blog/2026/06/flux-v2.9.0/>
- gotchas: "Version: v2.9.0"; "query: Optional catalog search filter."; "name (required): Plugin name to install or uninstall; plugin name used as a Flux subcommand when invoking it."; "version: Optional version pin in `<name>@<version>` form; mutually exclusive with the digest pin."; "digest: Optional digest pin in `<name>@<digest>` form; mutually exclusive with the version pin."; "plugin name for update: Specify one installed plugin to update; omit it to update all installed plugins."; "Prerequisite: Use the Flux CLI v2.9.0 or later, which introduces the plugin system."; "Prerequisite: The plugin must be available in the Flux plugin catalog to install it."; "The catalog is the official catalog at https://github.com/fluxcd/plugins."

## Flux CLI introduces flux trigger receiver (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-cli-introduces-flux-trigger-receiver-d1079c5a70ca
- score: 0.93

How to use it:

When debugging a Receiver’s event-driven reconciliation workflow, send its webhook with `flux trigger receiver`, which computes the webhook path and POSTs the payload; it does not require Kubernetes cluster access.

Examples:

```
flux trigger receiver <receiver-name> --token=<receiver-token> --url=<webhook-base-url>
```

- why_it_matters: Trigger a Flux receiver while debugging a repository's event-driven reconciliation workflow.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://v2-9.docs.fluxcd.io/flux/cmd/flux_trigger_receiver/>
- gotchas: "Version: v2.9.0"; "<receiver-name> (required): Receiver name used to compute the webhook path."; "--token (required): Receiver token; required for generic and generic-hmac, and must not be set for generic-oidc."; "--url (required): Base URL of the notification-controller webhook receiver; may include a base path."; "--type: Receiver type: `generic`, `generic-hmac`, or `generic-oidc`; defaults to `generic`."; "--payload: JSON request body; defaults to `{}`."; "--oidc-audience: Audience of OIDC token to fetch; requires `--oidc-provider`; defaults to `notification-controller`."; "--oidc-provider: OIDC provider to fetch token from: `github` or `forgejo`; generic-oidc only and mutually exclusive with `--oidc-token`."; "--oidc-token: OIDC token for the request; generic-oidc only, mutually exclusive with `--oidc-provider`; defaults to `FLUX_TRIGGER_RECEIVER_OIDC_TOKEN`."; "--retries: Retry count on connection errors or retryable HTTP status codes (404, 408, 429, 5xx); defaults to 10; `0` disables retries."; "--retry-delay: Delay between retries; defaults to 10s."; "Prerequisite: Use a Flux CLI version that includes the command (introduced in v2.9.0)."; "Prerequisite: For generic and generic-hmac, provide the Receiver token; generic-oidc must not set `--token`."

## flux create secret receiver command (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-create-secret-receiver-command-a4bb7cf1ece5
- score: 0.94

How to use it:

When creating a Receiver webhook secret, run `flux create secret receiver` with a name, receiver type, and webhook hostname. For GCR receivers, also provide the required service account email claim.

Examples:

```
flux create secret receiver <name> --namespace=<namespace> --type=github --hostname=<hostname> --export
```

```
flux create secret receiver <name> --namespace=<namespace> --type=gcr --hostname=<hostname> --email-claim=<service-account-email> --export
```

- why_it_matters: Create a Receiver secret from the Flux CLI.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://v2-9.docs.fluxcd.io/flux/cmd/flux_create_secret_receiver/>
- gotchas: "Version: v2.9.0"; "name (required): Receiver secret name positional argument."; "--type (required): Receiver type: generic, generic-hmac, github, gitlab, bitbucket, harbor, dockerhub, quay, gcr, nexus, acr, or cdevents."; "--hostname (required): Hostname used to compute the webhook URL."; "--email-claim: IAM service account email; required when type is gcr."; "--audience-claim: Custom OIDC token audience for GCR; defaults to the webhook URL."; "--token: Webhook validation token; auto-generated if omitted."; "--namespace: Secret namespace; defaults to flux-system."; "--export: Print generated YAML to stdout."

## flux create source oci supports OCIRepository layer selectors (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-create-source-oci-supports-ocirepository-layer-selectors-1c17e6104f21
- score: 0.96

How to use it:

When you need an OCIRepository to select and process a specific OCI layer, run `flux create source oci` with `--layer-selector=<media-type>:<operation>` and `--export` to render the resource YAML.

Examples:

```
flux create source oci <name> --url=<oci-url> --tag=<tag> --layer-selector=<media-type>:<operation> --export
```

- why_it_matters: Export an OCIRepository that selects and processes a specific OCI layer.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://github.com/fluxcd/flux2/pull/5892>, <https://fluxcd.io/flux/cmd/flux_create_source_oci/>, <https://fluxcd.io/flux/components/source/api/v1/>
- gotchas: "Version: v2.9.0"; "<name>: Positional OCIRepository name. The docs do not mark it required."; "--url: OCI repository URL. The docs do not mark it required."; "--tag: OCI artifact tag. The docs do not mark it required."; "--layer-selector: Layer selector in `<media-type>:<operation>` form; the docs do not mark the flag required. Supported operations are `extract` and `copy`."; "mediaType: Selects the first OCI layer matching this media type."; "operation: `extract` extracts the compressed layer to storage by default; `copy` stores the compressed layer as-is. The documented allowed values are `extract` and `copy`."; "--export: Exports the generated resource in YAML format to stdout."; "The operation must be one of the supported API values `extract` or `copy`."; "The source states that this adds CLI support for fields already supported by the OCIRepository API and source-controller; it does not change controller behavior or the API."

## flux get ks and flux get hr show source (flux, 2026-06-30)
Published 2026-10-16
- slug: flux-get-ks-and-flux-get-hr-show-source-1d05dd26e107
- score: 0.94

How to use it:

When inspecting Kustomization or HelmRelease source references, run `flux get ks --show-source` or `flux get hr --show-source`. The flag displays each resource’s source reference.

Examples:

```
flux get ks --show-source
```

```
flux get hr --show-source
```

- why_it_matters: Inspect the source associated with a Kustomization or HelmRelease.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://fluxcd.io/flux/cmd/flux_get_kustomizations/>, <https://fluxcd.io/flux/cmd/flux_get_helmreleases/>
- gotchas: "Version: v2.9.0"; "--show-source: Show the source reference for each Kustomization or HelmRelease."; "--show-source: Show the source reference for each HelmRelease."

## Receiver secret-less OIDC-secured webhooks (flux, 2026-06-30)
Published 2026-10-16
- slug: receiver-secret-less-oidc-secured-webhooks-24e97f0fb868
- score: 0.94

How to use it:

When configuring an OIDC-secured webhook Receiver, set its type to `generic-oidc` and define an OIDC provider with validations and the Flux resources to reconcile. The Receiver uses no Secret; callers send a valid OIDC ID token in the `Authorization: Bearer` header.

Examples:

```
apiVersion: notification.toolkit.fluxcd.io/v1
kind: Receiver
metadata:
  name: <receiver-name>
  namespace: <namespace>
spec:
  type: generic-oidc
  oidcProviders:
    - issuerURL: <issuer-url>
      validations:
        - expression: "<CEL expression>"
          message: "<failure message>"
  resources:
    - apiVersion: <api-group>/<version>
      kind: <resource-kind>
      name: <resource-name>
```

- why_it_matters: Configure a Receiver webhook secured with OIDC without a secret.
- sources: <https://github.com/fluxcd/flux2/releases/tag/v2.9.0>, <https://v2-9.docs.fluxcd.io/flux/components/notification/receivers/>
- gotchas: "Version: v2.9.0"; "spec.type (required): Set to `generic-oidc` for OIDC authentication without a Secret."; "spec.oidcProviders[].issuerURL (required): Issuer URL matched against the token's `iss` claim."; "spec.oidcProviders[].audience: Expected token `aud` claim; defaults to `notification-controller`."; "spec.oidcProviders[].validations (required): CEL boolean expressions; every expression must evaluate to true. `expression` is required; `message` is returned when that expression fails."; "spec.oidcProviders[].variables: Ordered named CEL expressions exposed as `vars.<name>`; each entry has `name` and `expression`. Variables can use claims and previously defined variables."; "spec.secretRef: Must be omitted for `generic-oidc`; setting it is rejected."; "spec.resources (required): Flux resources reconciled when the webhook is called. Each entry requires `kind` and `name`; `apiVersion` and `namespace` are optional. `matchLabels` is optional and requires `name: \"*\"`."; "Authorization header (required): Webhook request must carry a valid OIDC ID token as `Authorization: Bearer <token>`."; "Prerequisite: Configure at least one OIDC provider and required CEL validations; constrain identity claims because a valid token signature alone does not authorize a request."; "Prerequisite: The target Flux Custom Resources must be listed in `spec.resources`."; "The webhook is described as secret-less and OIDC-secured."

Next: https://sincecutoff.com/v1/changes.md?tool=flux&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImZsdXgiLCJ2IjoxfQ
Save `next_cursor`; next visit, pass it to get only what was published since.
<!-- end of page -->