Flux Mirror Plugin Turns Container Registries Into a 'Supply-Chain Diode' for Gitless GitOps
Flux's new CLI plugin mirrors images, Helm charts, and OCI artifacts into registries teams control, holding back newly signed artifacts to blunt fast-moving supply-chain attacks.
Overview
The Flux project has introduced Flux Mirror, a CLI plugin that mirrors container images, Helm charts, and OCI artifacts between registries from a declarative configuration, according to a Flux blog post published by Flux maintainer Leigh Capili. The plugin ships through the Flux CLI Plugin System introduced in Flux v2.9, and is designed to let Kubernetes clusters reconcile only from registries that a team operates itself rather than pulling directly from public infrastructure, as InfoQ reported.
What We Know
Flux Mirror addresses what the project calls one of the oldest usability problems in Kubernetes: dependence on registries an organization doesn’t control. “When you put an image from a registry you don’t operate into your Deployment, you make that registry’s uptime, rate limits, and retention policy part of your production architecture,” the Flux team wrote, citing Docker Hub rate-limit changes in 2020 and 2025 and Broadcom’s move in August 2025 to freeze the free Bitnami catalog and shift its images to a read-only legacy namespace. The frozen bitnami-legacy index, the post notes, has swelled to 27MB — a file every client has to download just to resolve one chart version.
The plugin covers three categories of artifacts from a single declarative config file: container images, copied “byte-for-byte” with multi-architecture manifest lists mirrored as a whole; Helm charts, pulled from classic HTTP repositories and republished as deterministic OCI artifacts; and Flux’s own desired-state artifacts produced by flux push artifact, according to the Flux announcement. A selector pipeline — regex, then semver, then sort, then top-N — lets teams mirror only the versions they actually depend on rather than an upstream project’s entire release history.
Verification is central to the design. Flux Mirror can enforce cosign keyless signature verification with OIDC identity matching before copying an artifact, and it carries SBOMs and build provenance alongside each artifact as OCI 1.1 referrers. Authentication supports cloud Workload Identity for AWS ECR, Azure ACR, and Google GAR, plus token auth, JWKs, and mTLS, per the Flux post. A companion flux mirror secret command resolves the same host credentials — including short-lived tokens minted through Workload Identity — and writes them into a Kubernetes dockerconfigjson Secret that pods can reference directly.
The plugin’s most distinctive feature is a minimum-age check on signatures. Flux Mirror can be configured to hold back an artifact until its cosign signature has aged past a set threshold — 48 hours in one of the project’s own examples — before mirroring it. Because container image timestamps can be set by the publisher and are therefore untrustworthy, Flux Mirror instead measures age against the signature’s entry in the Rekor transparency log, which countersigns the timestamp so it “cannot be quietly rewritten later,” the Flux team wrote. A tag whose signature is valid but too recent is skipped with the reason signature-too-new, and a signature with no verifiable timestamp fails outright. “Combining identity policies, attestations, and minimum artifact age turns your mirror into what we’ve been calling a supply-chain diode,” the Flux team wrote.
The Flux post frames the minimum-age feature against a run of recent software supply-chain incidents. It points to the Shai-Hulud worm, which compromised more than 500 npm packages in September 2025 by self-replicating through stolen publish tokens, and describes several follow-on “mini Shai-Hulud” waves through 2026 — including one in May that pushed 639 malicious versions across 323 packages within a single hour, a July wave that hit AsyncAPI packages, and a more recent wave that backdoored npm packages including keyv and cacheable, together totaling over a billion combined monthly downloads. Closer to the cloud-native ecosystem, the post says attackers who stole an Aqua Security CI token in February published a malicious Trivy release in March and force-pushed 76 of the 77 release tags of the widely used trivy-action, tracked as CVE-2026-33634, leaving malicious artifacts live for days before remediation. The post also notes that tj-actions/changed-files had its tags retroactively repointed in a similar attack the year before.
Citing what it describes as “one analysis,” the Flux team wrote that 8 of 10 major supply-chain attacks had exploit windows under a week — the rationale for holding artifacts back before trusting them. The post says the broader ecosystem is converging on the same idea: pnpm now applies a 24-hour minimum release age by default, npm has added a native minimum-release-age option, and Renovate can gate update pull requests with a similar setting.
Writing on X, Flux backer Control Plane summarized the underlying risk the plugin targets: “When you pull images directly from public registries in your Kubernetes Deployments, you make their uptime, rate limits, and retention policy part of your production architecture,” according to InfoQ. Responding to Flux’s LinkedIn announcement, BIMP founder Hannah Foxwell framed the plugin from a platform-team perspective: “Platform teams want dev teams using their private curated registry but to do that you have to make sure the registry has everything they need when they need it,” InfoQ reported.
Flux Mirror is part of the project’s broader push toward what it calls “Gitless GitOps,” in which OCI registries — not just Git repositories — serve as the source of truth for a cluster’s desired state at runtime. Flux already treats registries as first-class sources: OCIRepository fetches desired-state artifacts, HelmRelease can consume OCI charts through a chartRef, and flux push artifact stamps every artifact with its source URL and revision so flux trace can trace any cluster object back to the commit that produced it. Mirror and a second new plugin, Schema, are described in the Flux post as “the first two official plugins of Flux’s second decade,” following the Flux CLI Plugin System’s introduction in Flux v2.9, which reached general availability on June 30, 2026.
InfoQ noted that Flux Mirror isn’t the only tool addressing artifact relocation: guides for Argo CD describe combining regctl, Helm, and ORAS to copy charts and images between registries, and community tools like helmper target similar Helm chart and image synchronization, though InfoQ said those approaches lack Flux Mirror’s integrated verification and drift detection.
What We Don’t Know
Neither the Flux announcement nor InfoQ’s coverage discloses adoption figures, a roadmap for additional plugins beyond Mirror and Schema, or how the CNCF-governed project plans to sustain Flux Mirror’s development. It’s also not yet clear how widely Kubernetes teams already running Argo CD or other GitOps tooling will adopt a Flux-specific plugin for registry mirroring.
Why It Matters
Flux Mirror lands as maintainers of widely used CI and package tooling are converging on the same defensive pattern — holding new releases back for a cooldown period before letting them into production pipelines — in response to a wave of fast-moving supply-chain compromises across npm and GitHub Actions. By tying that cooldown to a cryptographically verifiable timestamp rather than a registry’s own metadata, and packaging it as a declarative, Kubernetes-native tool, Flux is positioning artifact mirroring as a standard piece of cluster security rather than a one-off script teams write for themselves.