feat(flux): enrich KSail with Flux v2.9.0 capabilities (distribution bump + new features)

[devantler]

🤖 Generated by the Daily AI Assistant

Problem / opportunity

Flux v2.9.0 is out with a substantial feature set. KSail installs Flux via the flux-operator (FluxInstance CR, pkg/svc/installer/flux/), and its distribution artifact was just pinned to flux-operator-manifests v0.52.0 (Flux 2.8.x) in #5596 to dodge the v0.53.0 / Flux-2.9.0 Receiver CRD restructure (#5595). So KSail is currently a Flux 2.8.x distributor and does not yet surface any 2.9.0 capability.

This roadmap epic tracks (a) safely adopting Flux 2.9.0 as KSail's distribution and (b) enriching KSail with the new Flux 2.9.0 capabilities where they add operator/user value. Several of these features overlap directly with KSail's own in-flight roadmaps, so part of the work is positioning (converge vs complement), not just plumbing.

What's new in Flux 2.9.0 (source: the release blog)

• Flux CLI Plugin System — first-class plugins that ship/version independently of the flux CLI, with two official plugins:
  • mirror — mirrors Helm charts, OCI artifacts, and container images between registries, declaratively.
  • schema — validates Kubernetes manifests against JSON schemas + CEL rules.
• kustomize-controller: Kustomization.spec.ignore SSA field-ignore rules (fine-grained drift control); SOPS Age post-quantum cipher; Workload Identity auth for OpenBao/Vault; SSH-key Git commit signing/verification.
• helm-controller: post-render strategies with chart hooks (⚠️ breaking: default nohooks → combined); literal valuesFrom (--set-literal semantics); CEL health checks with empty-kind cross-resource expressions.
• source-controller: custom Sigstore trusted root (air-gapped); ArtifactGenerator path-pattern discovery with named captures ({app}/{env}); AWS CodeCommit Workload Identity; SSH commit verification.
• notification-controller: OIDC-secured / secret-less generic Receivers; per-resource Receiver filtering; new flux trigger receiver command.
• Removed APIs (EOL): image.toolkit.fluxcd.io/v1beta2, notification.toolkit.fluxcd.io/v1beta2. ✅ KSail references neither (verified) — no migration needed, but generated scaffolds/templates should be re-confirmed.
• Kubernetes compatibility: 1.34–1.36 + OpenShift 4.21. (⚠️ confirm against KSail's supported/tested k8s matrix.)
• Breaking: Helm post-render default → combined; GCR Receivers now require email + audience.

Proposed direction (candidate children — decompose oldest-first)

1. Bump the Flux distribution to 2.9.0 (foundation). Move the manifests/operator pin v0.52.0 → v0.53.0 (matched pair) once the bug(flux): FluxInstance BuildFailed — floating flux-operator-manifests:latest + distribution 2.x breaks Flux bootstrap #5595 Receiver-CRD restructure is handled (the operator's bundled eventSources[].kind enum patch must apply to the new CRD shape — that mismatch is exactly what bug(flux): FluxInstance BuildFailed — floating flux-operator-manifests:latest + distribution 2.x breaks Flux bootstrap #5595/fix(flux): pin flux-operator-manifests distribution artifact (no floating :latest) #5596 worked around). Gate: every --gitops-engine Flux System Test leg green on 2.9.0. Size: M.
2. Position vs the new mirror & schema Flux plugins (design/ADR). These overlap KSail's native [Repo Assist] [feature]: add local-remote service mirroring (Telepresence/mirrord-style dev bridge) #4521 (local-remote mirroring) and Extend workload validate and workload scan to validate/scan all GitOps layers in-process #5344 (workload validate/scan schema validation). Decide: delegate to / wrap / complement / stay native. Size: M (design-first).
3. Kustomization.spec.ignore drift control — surface in KSail's reconcile/drift detection so users declare SSA field-ignore rules (ties into workload reconcile). Size: S–M.
4. CEL-based Helm health checks — leverage in KSail's revision-aware reconcile readiness (workload reconcile readiness is revision-unaware → false pass/fail on a freshly pushed artifact #5576) for richer readiness gating. Size: S–M.
5. OIDC/secret-less Receivers + per-resource filtering + flux trigger receiver — surface in KSail's GitOps webhook/notification UX. Size: M.
6. SOPS decryption enhancements — Age post-quantum cipher + Workload-Identity OpenBao/Vault backends; relates to KSail cipher tooling (feat(cipher): rotate SOPS Age recipients (re-seal all encrypted files to a new key set) #5443). Size: S–M.
7. SSH-key Git commit signing/verification — source/kustomize-controller now verify SSH-signed commits; relates to KSail supply-chain verify (chore(deps): Bump devantler-tech/reusable-workflows/.github/workflows/todos.yaml from 1.23.0 to 1.25.0 #1570). Size: S–M.
8. Track the Helm combined post-render default (breaking) + literal valuesFrom — ensure KSail's Helm handling/docs track the new default and expose set-literal semantics. Size: S.

Acceptance criteria (epic)

• KSail distributes Flux 2.9.0 with all Flux System Test legs green (child Talos implementation #1).
• A documented positioning decision for mirror/schema vs KSail's native features (child feature/talos-optimizations #2).
• The highest-value 2.9.0 capabilities are surfaced in KSail config/commands/docs via the decomposed children, each shipped under the normal draft-PR + validate discipline.
• KSail's supported-Kubernetes matrix and generated scaffolds are confirmed against 2.9.0's compatibility + removed-API set.

[devantler]

🤖 Generated by the Daily AI Assistant

Epic progress

Child 1 (distribution bump → Flux 2.9.0) — ✅ DONE. The flux-operator grouped
Dependabot PR #5608 bumped the chart 0.52.0→0.53.0 and the manifests distribution
artifact v0.52.0→v0.53.0 as a matched pair, and merged with 41/41 checks green
(0 failed) — the full CI including every --gitops-engine Flux System Test E2E leg.
The #5595 Receiver-CRD concern turned out to be skew-only (a pinned v0.52.0 chart
patching floating-:latest v0.53.0 manifests, which #5596 fixed); a matched v0.53.0 pair
carries the operator's own bundled patches, so no KSail-side patch adaptation was
needed. KSail is now a Flux 2.9.0 distributor. Acceptance criterion 1 met.

Removed-API + k8s-matrix confirmation — ✅ clean. Verified on main: KSail references
neither removed EOL API (image.toolkit.fluxcd.io/v1beta2,
notification.toolkit.fluxcd.io/v1beta2) in any Go/YAML/template file — no migration. The
supported Kubernetes version is a user-configurable per-cluster field (no hardcoded
default that conflicts with Flux 2.9.0's 1.34–1.36 support), so no forced bump.

Child 2 (positioning vs mirror/schema plugins) — ✅ DECIDED in #5624 (closed):
flux mirror → complement (orthogonal to #4521's dev traffic bridge);
flux schema → stay-native, converge on CEL (keep #5344's in-process, zero-dep,
per-layer-attributed validate; track native CEL-rule validation as a future #5344 slice).
Full reasoning in #5624.

Remaining queue (capability children, decompose oldest-first as they become startable):
#3 Kustomization.spec.ignore drift control (→ workload reconcile), #4 CEL Helm health
checks (→ #5576 readiness), #5 OIDC/secret-less Receivers + filtering, #6 SOPS Age-PQ +
Workload-Identity backends (→ #5443), #7 SSH-key commit signing/verify (→ #1570), #8 track
the Helm combined post-render default (breaking) + literal valuesFrom. Each ships under
the normal draft-PR + validate discipline.