Release v1.10.0

CHANGELOG.md

@@ -2,6 +2,112 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.10.0
+
+**Release date:** 2026-10-24
+
+This minor release graduates object-level workload identity, now renamed to
+object identity, introduces SPIFFE mTLS between the controllers, and adds
+GitHub App Client ID support for Git repositories.
+
+### Object Identity
+
+Object-level workload identity is now generally available and renamed to object
+identity. Workload identity refers exclusively to identities assigned to Flux
+controllers, while object identity refers to identities assigned to Flux
+objects. The `ObjectLevelWorkloadIdentity` feature gate is retired and the
+feature is always enabled.
+
+⚠️ **Breaking change:** the default Flux RBAC no longer grants the `create`
+verb on the `serviceaccounts/token` resource. If your installation relies on
+the default RBAC, bind a ClusterRole with this permission to the controller
+ServiceAccount before upgrading. See
+[fluxcd/flux2#6139](https://github.com/fluxcd/flux2/pull/6139) for the required
+ClusterRole and ClusterRoleBinding, and the
+[object identity documentation](https://fluxcd.io/flux/integrations/object-identity/)
+for the API reference.
+
+Two credential providers can now supply the credential: `kubernetes`, which
+uses the Kubernetes TokenRequest API and was already available, and `spiffe`,
+which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured
+on the ServiceAccount with `credential.auth.fluxcd.io/provider`, independently
+of the service provider in `.spec.provider`.
+
+### Inter-Controller mTLS
+
+This release introduces SPIFFE mTLS for inter-controller communication. Flux
+controllers authenticate each other with X.509-SVIDs, and each traffic type is
+enabled independently by configuring the SPIFFE Workload API socket and the
+SPIFFE IDs that the controller authorizes. See the
+[inter-controller mTLS documentation](https://fluxcd.io/flux/installation/configuration/intercontroller-mtls/)
+for the controller flags and an example configuration.
+
+### GitRepository
+
+GitHub App authentication accepts a Client ID as an alternative to the numeric
+App ID (`githubAppClientID`). Signature verification is re-run when the trusted
+keys rotate, so a revoked or replaced key no longer leaves a stale
+`SourceVerified=True` condition.
+
+### OCIRepository
+
+Generic OCI repositories now support object identity. The credential is sent as
+a bearer token, or as the password in HTTP basic authentication when
+`credential.auth.fluxcd.io/username` is set. Audiences default to the registry
+host and can be overridden with `credential.auth.fluxcd.io/audiences`.
+
+Signature verification is re-run when the verification keys rotate, and the
+origin revision from OCI image metadata is forwarded in events.
+
+### ExternalArtifact
+
+A new `.status.exportedInputs` field exposes structured data extracted from the
+source resource, for consumers such as ResourceSet to implement templating.
+
+### General updates
+
+The controller is built with Kubernetes 1.37 and Go 1.27.
+
+Fixes:
+- Close GCP object streams on error paths
+  [#2053](https://github.com/fluxcd/source-controller/pull/2053)
+- Close Azure blob streams on error paths
+  [#2200](https://github.com/fluxcd/source-controller/pull/2200)
+- Remove leaked Helm index cache on reconcile errors
+  [#2201](https://github.com/fluxcd/source-controller/pull/2201)
+  [#2202](https://github.com/fluxcd/source-controller/pull/2202)
+- Purge stale temp dirs at startup
+  [#2176](https://github.com/fluxcd/source-controller/pull/2176)
+- Include the repository URL in Helm index parse errors
+  [#2063](https://github.com/fluxcd/source-controller/pull/2063)
+- Support the AWS `ap-southeast-6` region for Bucket sources
+  [#2183](https://github.com/fluxcd/source-controller/pull/2183)
+
+Improvements:
+- Support Kubernetes ServiceAccount tokens for `generic` OCI repositories
+  [#2192](https://github.com/fluxcd/source-controller/pull/2192)
+- Add the `spiffe` credential provider and SPIFFE Broker API
+  [#2197](https://github.com/fluxcd/source-controller/pull/2197)
+- Retire the `ObjectLevelWorkloadIdentity` feature gate
+  [#2197](https://github.com/fluxcd/source-controller/pull/2197)
+- Add SPIFFE mTLS between the controllers
+  [#2194](https://github.com/fluxcd/source-controller/pull/2194)
+- Add GitHub App Client ID support
+  [#2168](https://github.com/fluxcd/source-controller/pull/2168)
+- Reverify sources when verification keys rotate
+  [#2166](https://github.com/fluxcd/source-controller/pull/2166)
+  [#2179](https://github.com/fluxcd/source-controller/pull/2179)
+- Expose the OCI origin revision in events
+  [#2127](https://github.com/fluxcd/source-controller/pull/2127)
+- Add ExternalArtifact exported inputs
+  [#2182](https://github.com/fluxcd/source-controller/pull/2182)
+- Update to Kubernetes 1.37 and Go 1.27
+  [#2162](https://github.com/fluxcd/source-controller/pull/2162)
+  [#2186](https://github.com/fluxcd/source-controller/pull/2186)
+- Various dependency updates
+  [#2100](https://github.com/fluxcd/source-controller/pull/2100)
+  [#2203](https://github.com/fluxcd/source-controller/pull/2203)
+
 ## 1.9.6
 
 **Release date:** 2026-10-01

config/manager/kustomization.yaml

@@ -6,4 +6,4 @@ resources:
 images:
 - name: fluxcd/source-controller
   newName: fluxcd/source-controller
-  newTag: v1.9.0
+  newTag: v1.10.0

go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/fluxcd/pkg/tar v1.4.0
 	github.com/fluxcd/pkg/testserver v0.15.0
 	github.com/fluxcd/pkg/version v0.20.0
-	github.com/fluxcd/source-controller/api v1.9.0
+	github.com/fluxcd/source-controller/api v1.10.0
 	github.com/go-git/go-billy/v5 v5.9.2
 	github.com/go-git/go-git/v5 v5.19.3
 	github.com/go-logr/logr v1.4.4