Flux releases Mirror CLI plugin to mirror images, charts, and OCI artifacts declaratively

Flux Mirror introduces a CLI plugin that moves the source of truth for desired state from Git repositories to OCI registries, aligning with the project's Gitless GitOps direction. The plugin works by reading a declarative configuration that defines which container images, Helm charts, and OCI artefacts should be mirrored between source and destination registries. This shift means that at runtime Flux no longer pulls artefacts directly from external sources but from a controlled mirror that the team operates.

Adopting Flux Mirror requires teams to author a mirroring configuration file, set up read access to source registries and write access to destination registries, and decide on verification policies such as Cosign signatures, SBOM inclusion, and minimum artefact age. Operational overhead includes running the plugin either as a GitHub Actions step in a CI pipeline or as a Kubernetes CronJob co-located with the cluster and registries, and managing any secrets needed for imagePullSecrets or secretRef fields. The effort is comparable to setting up any other mirroring solution but is integrated with Flux's existing plugin system.

The solution stops working when teams lack sufficient permissions to read from the source registry or write to the destination registry, or when they rely on artefact sources that cannot be mirrored due to network restrictions or authentication mechanisms not supported by the plugin. Additionally, Flux Mirror depends on Cosign for signature verification; artefacts without valid signatures or those that fail the minimum age check will not be mirrored, potentially blocking workflows that expect the latest versions. It also does not replace Git-based configuration for other Flux components, so teams must still maintain Git repositories for cluster-level desired state.

While the announcement notes that similar outcomes can be achieved with community tools such as regctl, Helm, ORAS, or helmper, those approaches lack the integrated verification, drift detection, and secret-mirroring capabilities that Flux Mirror provides. The plugin therefore represents a consolidated option for organisations seeking a single, Flux-native way to enforce supply-chain safety while moving toward a registry-centric Gitless GitOps model.