[dependabot]

Bumps github.com/fluxcd/kustomize-controller/api from 1.9.6 to 1.10.1.

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.10.1

Changelog

v1.10.1 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.10.1
• ghcr.io/fluxcd/kustomize-controller:v1.10.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

v1.10.0

Changelog

v1.10.0 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.10.0
• ghcr.io/fluxcd/kustomize-controller:v1.10.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.10.1

Release date: 2026-10-25

This patch release changes how the controller reacts when a downloaded artifact does not match the digest advertised in the source status. Instead of leaving the Kustomization failed until the next retry interval, the controller now marks it as not ready with ArtifactFailed and requeues after --requeue-dependency (default 30s), matching the behavior it already had for a missing artifact.

Fixes:

• Requeue on artifact digest mismatch #1793
• Update fluxcd/pkg dependencies #1790

1.10.0

Release date: 2026-10-24

This minor release graduates object-level workload identity, now renamed to object identity, introduces SPIFFE mTLS between the controllers, and adds SOPS decryption support for files encrypted with comment regexes.

Object Identity

Object-level workload identity is now generally available and renamed to object identity. Workload identity refers exclusively to identities assigned to Flux controllers, while object identity refers to identities assigned to Flux objects. The ObjectLevelWorkloadIdentity feature gate is retired and the feature is always enabled.

Two credential providers can now supply the credential: kubernetes, which uses the Kubernetes TokenRequest API and was already available, and spiffe, which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured on the ServiceAccount with credential.auth.fluxcd.io/provider, independently of the service provider in .spec.provider.

See the object identity documentation for the annotation reference.

Inter-Controller mTLS

This release introduces SPIFFE mTLS for inter-controller communication. Flux controllers authenticate each other with X.509-SVIDs, and each traffic type is enabled independently by configuring the SPIFFE Workload API socket and the SPIFFE IDs that the controller authorizes. See the inter-controller mTLS documentation for the controller flags and an example configuration.

... (truncated)

Commits

• 746d9d2 Merge pull request #1794 from fluxcd/release-v1.10.1
• 73cc988 Release v1.10.1
• 66bbc54 Add changelog entry for v1.10.1
• 582c3e0 Merge pull request #1793 from fluxcd/backport-1792-to-release/v1.10.x
• 4616fd4 Requeue on artifact digest mismatch
• 11240fc Merge pull request #1790 from fluxcd/update-pkg-deps/release/v1.10.x
• 1f76026 Update fluxcd/pkg dependencies
• bb44b71 Merge pull request #1787 from fluxcd/release-v1.10.0
• 407039a Release v1.10.0
• 8614db9 Add changelog entry for v1.10.0
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Rebasing onto main now that ksail#8243 cleared the vulnerability scan; this head was cut from an older base whose k8s.io/api/apimachinery mix fails to compile.

@dependabot rebase

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #7259 | upstream | last-verified 2026-11-10: this bump requires the Kubernetes v0.37 client libraries (k8s.io/api v0.37.1 or structured-merge-diff v7); the build fails to compile against the v0.36 stack ksail#7259 keeps until Kyverno and vcluster support v0.37

Re-verified 2026-11-10 (Go module proxy): the newest stable Kyverno (v1.19.2) and vCluster (v0.37.7, tagged 2026-11-10) still require Kubernetes api/client-go v0.36.x. Kyverno v1.20.0-rc.4 now targets v0.37.1, but vCluster v0.38.0-rc.2 still targets v0.36.3, so ksail#7259 stays blocked and this PR stays parked. Main still maps k8s.io/apimachinery v0.37.1 => v0.36.6.