Flux vs HashiCorp
Side-by-side trajectory, velocity, and editorial themes.
Flux 2.9 turns the mature GitOps engine into an extensible, plugin-driven platform.
Flux, the CNCF GitOps controller, is a decade-old project shipping steady minor GAs. The feed mixes those releases with community and case-study blog posts (a 10-year retrospective, a Morgan Stanley scaling story, a Terraform bootstrap guide). On the product side, the 2.7–2.9 line has moved from GA-ing image update automation to Helm v4 support and now a first-class CLI plugin system.
Flux is investing in extensibility and keyless, quantum-resistant security: a plugin architecture that lets capabilities ship independently of the core CLI, post-quantum SOPS decryption, Workload Identity across more backends, and finer server-side apply control. The arc is toward a composable GitOps toolkit that large regulated fleets can extend without forking.
Expect the plugin catalog to grow beyond the initial Mirror and Schema plugins and the post-quantum and Workload Identity work to expand to more providers, with field-ignore and post-render controls becoming defaults as they stabilize.
HashiCorp pushes an infrastructure graph and Boundary 1.0 while reorienting around AI-agent access
HashiCorp is layering two moves on top of its IaC and secrets core: a graph-based source of truth for sprawling multi-cloud estates, and a steady buildout of access control for AI agents. Boundary reached 1.0 with session recording, Vault and Boundary both shipped agent-security previews, and HCP gained SCIM provisioning. The through-line is governing who — and increasingly what — can touch infrastructure.
Terraform is being repositioned from provisioning tool to system-of-record via Infragraph, while Boundary and Vault extend privileged access from humans to autonomous agents. The AI-agent framing recurs across nearly every release, suggesting HashiCorp sees agent access as the next control-plane contest. Expect the graph and the access layer to knit into a single governance story.
Likely next: Infragraph moving from limited to general availability, and more concrete Vault and Boundary primitives for scoping and recording AI-agent sessions.
See more alternatives to Flux →
See more alternatives to HashiCorp →