rules-fluxcd

Flux service account bound to cluster-admin role — CWE-269. Granting cluster-admin to the Flux reconciler means a compromised GitRepository or OCI source can reconfigure any resource in the entire cluster. Follow least-privilege: create a ClusterRole with only the specific apiGroups/resources Flux needs to reconcile your workloads.

fluxctl is the Flux v1 CLI and is no longer maintained. Flux v1 reached end-of-life in November 2022. Migrate to Flux v2 (flux CLI) to receive security patches and new features. The Flux v2 bootstrap procedure and migration guide are at https://fluxcd.io/flux/migration/.

Plaintext credential in Flux GitRepository manifest — CWE-798. Storing SSH keys or passwords directly in the manifest puts them in your Git history forever. Use a Kubernetes Secret (referenced by secretRef) and inject it via Sealed Secrets, External Secrets Operator, or SOPS-encrypted secrets.

Mutable ':latest' image tag in Flux manifest — CWE-829. Using ':latest' means each reconciliation can silently deploy a different image, making rollbacks unreliable and opening a supply-chain attack vector (image poisoning). Pin to an immutable digest ('image: registry/repo@sha256:<hash>') or use an ImagePolicy resource with a semantic version range.

Flux OCIRepository source without digest pinning — CWE-829. An OCI artifact reference without a digest can be silently replaced by a compromised registry push. Add a 'ref.digest' field ('ref: { digest: sha256:<hash> }') or use Flux's ImagePolicy with digest verification to ensure the exact artifact is deployed.