Prepare Flux v0.26.0 release

[stefanprodan]

This is an overarching issue for tracking the Flux v0.26.0 release preparation.

Catalog and sign artifacts

• Publish SBOM for Flux and the GitOps Toolkit components #2302
• Sign the release checksums and container images with Cosign and GitHub OIDC #2303
• fluxcd.io (document the signature verification of container images, binaries and SBOM)

Security improvements

• Allow setting a default service account for impersonation #2340
• Allow disabling cross-namespace references #2337
• Conform to the Kubernetes restricted pod security standard #2014
• flux2 (drop support for EOL Kubernetes 1.19 in flux check)
• fluxcd.io (document the pod security standard and update Kubernetes supported versions)

Migrate from Debian to Alpine for libgit2 static build

• Statically build using musl toolchain and target alpine source-controller#558
• Statically build using musl toolchain and target alpine image-automation-controller#303

Fuzzing

• Refactor Fuzz implementation pkg#212
• Refactor Fuzz implementation kustomize-controller#536
• Refactor Fuzz implementation helm-controller#396
• Add fuzz testing for notifiers notification-controller#306
• Refactor Fuzz implementation image-reflector-controller#221

New features and improvements

• Preview local changes with flux build/diff kustomization #2167
• Pass headers to generic provider through secretRef notification-controller#317
• Get credentials from GCP/Azure when needed image-reflector-controller#194
• Add support for cross-namespace sourceRef in ImageUpdateAutomation image-automation-controller#299
• SOPS: Add support for HashiCorp Vault token-based authentication kustomize-controller#538
• Revoke kubectl managed fields ownership kustomize-controller#527

Documentation

• Update docs for Flux v0.26.0 website#727
• Add docs for autologin(ACR/ECR/GCR) website#702
• Update the Mozilla SOPS decryption with HashiCorp Vault section website#713

[texasbobs]

Is there an ETA for this? We are kind of stuck right now in our deployment process with Flux2 in test and Flux in prod. We have been experiencing issues where a commit "works" when deployed in test with Flux2 yet fails in prod with Flux. We're hoping to test the "revoke kubectl managed fields" change as soon as we can get this release.

[stefanprodan]

@texasbobs please use the release candidate from fluxcd/kustomize-controller#527 and see if it fixes the issues.

[texasbobs]

That works. Thank you! We're going to continue to run this image in test until v0.26 comes out. Then we can look at continuing our rollout to prod.

[stefanprodan]

All controllers have been released #2345