Describe the bug
Since updating to Flux 2.8.x on a cluster which uses CiliumEgressGatewayPolicy resources annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent, e.g.:
---
apiVersion: cilium.io/v2
kind: CiliumEgressGatewayPolicy
metadata:
name: my-policy
annotations:
kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
spec:
egressGateway:
nodeSelector:
matchLabels:
kubernetes.io/hostname: placeholder
egressIP: 1.2.3.4
selectors:
- podSelector:
matchLabels:
io.kubernetes.pod.namespace: velero
destinationCIDRs:
- "4.5.6.7/32"
Flux began "flapping" these resources - deleting them when they were present, and creating them when they were absent - on each reconciliation.
This cluster was previously running Flux 2.6.4 where the expected behaviour was observed, and I straight-shot to Flux 2.8.6 version after ensuring our source CRs and Flux's CRDs were updated to the newer apiVersions.
The only workaround I've found thus far is to is to also add the kustomize.toolkit.fluxcd.io/prune: Disabled annotation, but this doesn't fit my mental of how ssa: IfNotPresent should behave, and indeed did behave in previous versions of Flux.
Running kustomize-controller image ghcr.io/fluxcd/kustomize-controller:v1.8.4
Maybe this is only happening to cluster-scoped resources?
Steps to reproduce
Apply an kustomize.toolkit.fluxcd.io/ssa: IfNotPresent annotation to a CiliumEgressGatewayPolicy (presuming this affects other resource types as well) reconciled by a Kustomization with Flux 2.8.6.
Expected behavior
The resource should be created once and then be left alone by Flux.
Screenshots and recordings
No response
OS / Distro
Debian 12
Flux version
2.8.6
Flux check
► checking prerequisites
✔ Kubernetes 1.34.7 >=1.33.0-0
► checking version in cluster
✔ distribution: flux-v2.8.6
✔ bootstrapped: true
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v1.5.4
✔ image-automation-controller: deployment ready
► ghcr.io/fluxcd/image-automation-controller:v1.1.2
✔ image-reflector-controller: deployment ready
► ghcr.io/fluxcd/image-reflector-controller:v1.1.1
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v1.8.4
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v1.8.4
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v1.8.3
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta3
✔ buckets.source.toolkit.fluxcd.io/v1
✔ externalartifacts.source.toolkit.fluxcd.io/v1
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1
✔ helmreleases.helm.toolkit.fluxcd.io/v2
✔ helmrepositories.source.toolkit.fluxcd.io/v1
✔ imagepolicies.image.toolkit.fluxcd.io/v1
✔ imagerepositories.image.toolkit.fluxcd.io/v1
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1
✔ providers.notification.toolkit.fluxcd.io/v1beta3
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed
Git provider
No response
Container Registry provider
No response
Additional context
flux logs indeed shows the unexpected garbage collection of these resources:
Resource gets created:
2026-04-28T11:29:40.399Z info Kustomization/velero-backups.flux-system - All dependencies are ready, proceeding with reconciliation
2026-04-28T11:29:40.536Z info Kustomization/velero-backups.flux-system - server-side apply completed
2026-04-28T11:29:40.574Z info Kustomization/velero-backups.flux-system - Reconciliation finished in 184.274268ms, next run in 15m0s
15 minutes later, resource gets unexpectedly garbage collected:
2026-04-28T11:35:42.351Z info Kustomization/velero.flux-system - server-side apply completed
2026-04-28T11:35:42.363Z info Kustomization/velero.flux-system - garbage collection completed: CiliumEgressGatewayPolicy/velero-egress deleted
2026-04-28T11:35:42.454Z info Kustomization/velero.flux-system - Reconciliation finished in 317.383431ms, next run in 15m0s
(and repeat)
Code of Conduct
Describe the bug
Since updating to Flux 2.8.x on a cluster which uses
CiliumEgressGatewayPolicyresources annotated withkustomize.toolkit.fluxcd.io/ssa: IfNotPresent, e.g.:Flux began "flapping" these resources - deleting them when they were present, and creating them when they were absent - on each reconciliation.
This cluster was previously running Flux 2.6.4 where the expected behaviour was observed, and I straight-shot to Flux 2.8.6 version after ensuring our source CRs and Flux's CRDs were updated to the newer apiVersions.
The only workaround I've found thus far is to is to also add the
kustomize.toolkit.fluxcd.io/prune: Disabledannotation, but this doesn't fit my mental of howssa: IfNotPresentshould behave, and indeed did behave in previous versions of Flux.Running
kustomize-controllerimageghcr.io/fluxcd/kustomize-controller:v1.8.4Maybe this is only happening to cluster-scoped resources?
Steps to reproduce
Apply an
kustomize.toolkit.fluxcd.io/ssa: IfNotPresentannotation to aCiliumEgressGatewayPolicy(presuming this affects other resource types as well) reconciled by aKustomizationwith Flux 2.8.6.Expected behavior
The resource should be created once and then be left alone by Flux.
Screenshots and recordings
No response
OS / Distro
Debian 12
Flux version
2.8.6
Flux check
Git provider
No response
Container Registry provider
No response
Additional context
flux logsindeed shows the unexpected garbage collection of these resources:Resource gets created:
15 minutes later, resource gets unexpectedly garbage collected:
(and repeat)
Code of Conduct