Prepare for Flux v2.0.0-rc.4

[stefanprodan]

The 4nd release candidate of Flux GA comes with support for Kubernetes 1.27, Kustomize 5.0, Helm 3.12 and Cosign 2.0.

⚠️ Note that Kustomize v5 contains breaking changes, please consult their changelog for more details.

The GitOps Toolkit and the Flux controllers have been updated to controller-runtime v0.15 which contains breaking changes that could affect 3rd-party controllers that integrate with Flux.

Flux dependencies have been updated to patch the following vulnerabilities:

• CVE-2023-28840 (Docker)
• CVE-2023-28841 (Docker)
• CVE-2023-28842 (Docker)
• CVE-2023-30551 (Sigstore Rekor)

TODOs:

• Update Flux controllers to Kustomize v5.0 #3564
• Update Flux components to Kubernetes controller-runtime v0.15 #3907
• Update cosign to v2 source-controller#1096
• Fix revision discarded on event rate limiting key calculation notification-controller#517
• Fix Alert .spec.eventMetadata behavior notification-controller#529
• Include eventv1.MetaTokenKey on event rate limiting key calculation notification-controller#530
• Prefix event key attributes with identifier notification-controller#534
• Use last attempted values checksum as event metadata token helm-controller#692
• cloneRefName() does not support annotated git tags pkg#546
• Use registry host to get ACR access token and add new OIDCLogin function pkg#560
• [oci] Add function for configuring transport with retry backoff pkg#563
• Update validation workflow to Kustomize v5 flux2-kustomize-helm-example#97
• feat: add reconcile source chart command #3675
• Retry oci push operations #3918

Release checklist:

• source-controller v1.0.0-rc.4
• kustomize-controller v1.0.0-rc.4
• notification-controller v1.0.0-rc.4
• helm-controller: v0.34.0
• image-reflector-controller v0.28.0
• image-automation-controller v0.34.0
• flux2 v2.0.0-rc.4
• terraform-provider-flux v1.0.0-rc.4

Documentation:

• Publish Flux release change log to GitHub & Slack
• Update Kustomize references in docs to v5