Flux Mirror Uses Gitless GitOps to Keep Software Supply Chain Under Control
Flux has introduced Flux Mirror, a CLI plugin that mirrors container images, Helm charts and OCI artifacts between registries from a declarative configuration. The plugin is part of the Flux v2.9 CLI plugin system and is presented as a way to keep Kubernetes clusters reconciling only from registries that teams operate themselves. By Matt Saunders
Flux Mirror, a new CLI plugin from the Flux v2.9 project, allows container images, Helm charts, and OCI artifacts to be mirrored between registries using a declarative configuration. This is part of Flux's broader shift towards Gitless GitOps, where OCI registries become the source of truth rather than Git repositories. The plugin addresses operational issues with external registries, such as Docker Hub's rate limiting and Broadcom's freeze on the Bitnami catalogue.
Key features include mirroring container images byte-for-byte, including multi-architecture manifest lists, Helm charts from HTTP repositories into OCI registries, and relocating Flux's desired state artefacts. A configuration file specifies mirroring details, such as sources, destinations, and policies for registry content. Teams can encode registry content as declarative state in version control, ensuring that every Kubernetes user knows where their artefacts live, who can change them, and what happens when upstream sources disappear.
Flux Mirror groups container images, Helm charts, and Flux OCI desired state artefacts into a single workflow, republishing Helm charts as deterministic OCI artefacts while maintaining control over source versions through selectors defined by regular expressions, semantic version constraints, sorting, and limiting options. The plugin also checks artifact signatures using Cosign and preserves Software Bill of Materials (SBOMs) and build provenance for verification on the cluster. Minimum age requirements for signatures ensure that only safe artefacts are mirrored.
Operational integration with Gitless GitOps pipelines is straightforward, with the plugin installable via GitHub Actions setup actions or as a Kubernetes CronJob. Secrets, including short-lived tokens for cloud workloads, can also be mirrored and used within Kubernetes clusters. Flux Mirror is not standalone; it builds on existing tools like regctl, Helm, ORAS, and helmper, enhancing their capabilities with integrated verification and drift detection.
The plugin's use of minimum artifact age policies addresses urgent concerns about rapid supply chain attacks, such as the Shai Hulud worm and compromised Trivy GitHub Action, which left vulnerable artifacts in production for days.
Flux Mirror mitigates risks associated with pulling images directly from public registries, ensuring that factors like uptime, rate limits, and retention policies are controlled within private registries. This approach helps maintain a consistent and secure software supply chain, reducing dependency on external, unpredictable sources.
Written by urgent.news from InfoQ's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
