Flux has released Flux Mirror, a CLI plugin that copies container images, Helm charts and OCI artifacts between registries using a declarative configuration. The plugin, part of the Flux v2.9 CLI plugin system, lets Kubernetes clusters reconcile only from registries that teams control themselves. It's designed to tackle persistent operational challenges with artifacts stored in registries outside an organization's direct oversight, including Docker Hub's rate restrictions and Broadcom's 2025 decision to stop updating the widely used free Bitnami catalog.
Flux Mirror handles three primary artifact types through a defined feature set. It replicates container images byte-for-byte, including multi-architecture manifest lists, transfers Helm charts from HTTP repositories into OCI registries, and moves Flux's own desired state artifacts. Teams describe what needs mirroring, from which sources, and to which destinations in a configuration file that encodes registry content as declarative state in version control. The plugin applies a selector pipeline using regular expressions, semantic version constraints, sorting and top N limiting so teams mirror only the versions they actually use. It verifies that each artifact was signed by the authorized person or build system before copying, using Cosign signatures and identity information, and it carries over SBOMs and build provenance so Flux can recheck this evidence on the cluster. The tool also enforces a minimum age for signatures, holding back newly signed artifacts and mirroring them only after they've been public long enough to be deemed safe.
The Flux CD team argues in the announcement that every Kubernetes user should be able to answer where their artifacts live, who can change them, and what happens when an upstream source disappears, even if they aren't using Flux itself. Control Plane, which backs Flux, wrote on X that when teams pull images directly from public registries in Kubernetes deployments, "you make their uptime, rate limits, and retention policy part of your production architecture." BIMP founder Hannah Foxwell emphasized in response to the LinkedIn announcement that platform teams want developers using their private curated registry, but to achieve that "you have to make sure the registry has everything they need when they need it."
The announcement explains that Flux Mirror addresses minimum artifact age, which matters because of increasingly fast supply chain attacks happening this year, including the Shai Hulud worm and subsequent waves, and the compromise of Aqua Security's Trivy GitHub Action that left malicious artifacts live for days. The plugin fits into the Flux project's shift toward Gitless GitOps, where OCI registries become the source of truth for desired state at runtime rather than Git repositories. Teams can install the plugin and run a sync from GitHub Actions using a dedicated setup action that verifies artifact attestations before first use, or as a Kubernetes CronJob placed alongside clusters and registries. Secrets can also be mirrored, including short-lived tokens for cloud workloads, and used in imagePullSecrets or secretRef fields in Kubernetes clusters.
For teams already using Flux or evaluating Gitless GitOps, the plugin provides a way to move artifacts into private registries, enforce identity and minimum age policies, and keep pull credentials rotated without maintaining a large collection of custom scripts. For others, it serves as a detailed example of how to design declarative mirror pipelines that combine image, chart and configuration artifacts with verified provenance and controlled flow from public infrastructure into production clusters. The approach of enforcing policies that only allow signed, aged artifacts into a private registry functions as a form of one-way diode in the software supply chain. Teams that depend on upstream registries they don't control may now face a choice between accepting external policy changes as part of their production risk profile or investing in tooling that insulates them from those dependencies. Organizations with lean platform teams will need to weigh the operational overhead of running mirror pipelines against the cost of outages triggered by registry policy shifts they can't anticipate.