Release/v1.7.x

CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 1.7.0
+
+**Release date:** 2026-10-24
+
+This minor release adds OCIRepository as a chart template for HelmRelease,
+graduates object-level workload identity, now renamed to object identity, and
+introduces SPIFFE mTLS between the controllers.
+
+### Object Identity
+
+Object-level workload identity is now generally available and renamed to object
+identity. Workload identity refers exclusively to identities assigned to Flux
+controllers, while object identity refers to identities assigned to Flux
+objects. The `ObjectLevelWorkloadIdentity` feature gate is retired and the
+feature is always enabled.
+
+Two credential providers can now supply the credential: `kubernetes`, which
+uses the Kubernetes TokenRequest API and was already available, and `spiffe`,
+which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured
+on the ServiceAccount with `credential.auth.fluxcd.io/provider`, independently
+of the service provider in `.spec.provider`.
+
+See the [object identity documentation](https://fluxcd.io/flux/integrations/object-identity/)
+for the annotation reference.
+
+### Inter-Controller mTLS
+
+This release introduces SPIFFE mTLS for inter-controller communication. Flux
+controllers authenticate each other with X.509-SVIDs, and each traffic type is
+enabled independently by configuring the SPIFFE Workload API socket and the
+SPIFFE IDs that the controller authorizes. See the
+[inter-controller mTLS documentation](https://fluxcd.io/flux/installation/configuration/intercontroller-mtls/)
+for the controller flags and an example configuration.
+
+### HelmRelease
+
+The chart template now supports `OCIRepository` as the `.spec.chart.kind`.
+Instead of referencing an existing source with `.spec.chartRef`, a HelmRelease
+can declare an OCIRepository in `.spec.chart.spec`; the controller creates and
+manages that object in the release namespace and fetches the chart from its
+artifact. Chart version and values are changed atomically, and the release is
+upgraded automatically when the OCIRepository artifact changes.
+
+Remote cluster authentication with `.spec.kubeConfig.configMapRef` is now part
+of object identity: the ServiceAccount named in the referenced ConfigMap can use
+the `kubernetes` or `spiffe` credential provider through its annotations. The
+legacy `audiences` key must be replaced with
+`credential.auth.fluxcd.io/audiences` when using the annotations.
+
+### General updates
+
+The controller is built with Kubernetes 1.37, Go 1.27 and Helm 4.3.1.
+
+Fixes:
+- Sort source requests by dependencies
+  [#1576](https://github.com/fluxcd/helm-controller/pull/1576)
+- Unlock releases stuck in the uninstalling state
+  [#1606](https://github.com/fluxcd/helm-controller/pull/1606)
+- Fix failed rollback after a canceled health check
+  [#1605](https://github.com/fluxcd/helm-controller/pull/1605)
+- Fix nil hook output callback panic
+  [#1604](https://github.com/fluxcd/helm-controller/pull/1604)
+
+Improvements:
+- Add OCIRepository as a chart template
+  [#1600](https://github.com/fluxcd/helm-controller/pull/1600)
+- Add SPIFFE mTLS for the artifact fetcher and event recorder
+  [#1623](https://github.com/fluxcd/helm-controller/pull/1623)
+- Add the `spiffe` credential provider and SPIFFE Broker API
+  [#1626](https://github.com/fluxcd/helm-controller/pull/1626)
+- Retire the `ObjectLevelWorkloadIdentity` feature gate
+  [#1626](https://github.com/fluxcd/helm-controller/pull/1626)
+- Update to Kubernetes 1.37 and Go 1.27
+  [#1591](https://github.com/fluxcd/helm-controller/pull/1591)
+  [#1614](https://github.com/fluxcd/helm-controller/pull/1614)
+- Various dependency updates
+  [#1544](https://github.com/fluxcd/helm-controller/pull/1544)
+  [#1629](https://github.com/fluxcd/helm-controller/pull/1629)
+
 ## 1.6.5
 
 **Release date:** 2026-10-01

config/manager/kustomization.yaml

@@ -5,4 +5,4 @@ resources:
 images:
   - name: fluxcd/helm-controller
     newName: fluxcd/helm-controller
-    newTag: v1.6.0
+    newTag: v1.7.0

go.mod

@@ -17,7 +17,7 @@ replace (
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/fluxcd/cli-utils v1.4.0
-	github.com/fluxcd/helm-controller/api v1.6.0
+	github.com/fluxcd/helm-controller/api v1.7.0
 	github.com/fluxcd/pkg/apis/acl v0.12.0
 	github.com/fluxcd/pkg/apis/event v0.32.0
 	github.com/fluxcd/pkg/apis/kustomize v1.23.0