Konflux 0.2.2 groups components and adds managed release retries

Konflux 0.2.2 is now available as a stable release, replacing the stream of release candidates that preceded it. The release notes bundle changes across the operator, build, integration, release, image-controller, policy and user-interface layers rather than presenting a narrow component update.

What changed

Component groups are the central application-model change. The integration service can create snapshots for pull-request groups, filter those groups and support nested ComponentGroup relationships. Related image-controller work adds dual-group support during the migration of ImageRepository APIs, while the UI gains a component-group model.

Release orchestration also gets more explicit failure handling. The release service can report retry information in ReleasePlanAdmission status, run managed pipeline retries with mitigations and publish a mitigation-success metric. Distributed tracing was added for release pipeline runs and for integration-service timing and trace propagation.

The integration service adds an agentready-config and an agent-ready check, alongside AI skills in its repository. Those entries signal that agent-oriented validation is entering the delivery workflow, but the release notes do not describe the checks as a general product guarantee; teams should inspect their own policy and pipeline configuration before relying on the label.

Security and compatibility details

The operator now requires a commit SHA with the /allow workflow to reduce fork-secret abuse, clears BearerTokenFile to prevent an in-cluster token override and updates cryptographic and telemetry dependencies for two listed CVEs. Enterprise Contract pins its Codecov action to a commit SHA and narrows id-token permission to the job level.

The build service updates controller-runtime for Kubernetes 0.35 compatibility, while the operator tracks OpenShift environment-test CRDs for Kubernetes 1.37 and later. These are implementation compatibility changes, not a declaration that every Konflux component supports every corresponding cluster release.

Who should test it

Platform teams using Konflux for multi-component applications should test how the new grouping and nested-group behavior changes snapshot creation, integration pipelines and image repositories. Teams with automated release recovery should verify retry ceilings, mitigation precedence and the new status fields before enabling managed retries broadly.

Security reviewers should confirm that local automation invoking /allow supplies an immutable commit SHA and check whether any scripts assumed the older behavior. Operators can install the release from its complete manifest, but production rollouts should first exercise the component-group webhooks, integration-runner permissions and release-retry paths in a non-production namespace.

Konflux 0.2.2 is a substantial integration release rather than a single headline feature. Its value is the coordinated movement toward grouped application delivery, observable retries and tighter automation boundaries; its risk is the number of controllers and APIs moving together.