Skip to content

Latest commit

 

History

History
113 lines (96 loc) · 12.3 KB

CHANGELOG-1.15.md

File metadata and controls

113 lines (96 loc) · 12.3 KB

Changelog 1.15

1.15.2 - 2024-06-20

Fixed

  • Remove unexpected altname after renaming interface to avoid failure when moving host interface to OVS bridge. (#6321, @gran-vmv)
  • Do not try to update type of Secret in selfSignedCertProvider to avoid self-signed certificate update failure. (#6205, @tnqn)
  • Install multicast related iptables rules only on IPv4 chains to fix the antrea-agent initialization failure occurring when the Multicast feature is enabled in dual-stack clusters. (#6123, @wenyingd)
  • Fix a single rule deletion bug for NodePortLocal on Linux and improve robustness of NPL rule cleanup. (#6284, @antoninbas)
  • Fix a bug causing AntreaProxy not to delete stale UDP conntrack entries for the virtual NodePort DNAT IP. (#6379, @hongliangl)
  • Improve stale UDP conntrack entries deletion accuracy in AntreaProxy. (#6193, @hongliangl)
  • Fix antrea-agent crash when enabling proxyAll in networkPolicyOnly mode. (#6259, @hongliangl)
  • Fix a bug preventing local traffic from being identified in networkPolicyOnly mode. (#6251, @hongliangl)
  • Avoid generating defunct process when starting Suricata, the L7 ANP engine. (#6366, @hongliangl)

1.15.1 - 2024-03-25

Changed

  • Stop using projects.registry.vmware.com for user-facing images. (#6073, @antoninbas)
  • Persist TLS certificate and key of antrea-controller and periodically sync the CA cert to improve robustness. (#5955, @tnqn)
  • Disable cgo for all Antrea binaries. (#5988, @antoninbas)

Fixed

  • Disable libcapng to make logrotate run as root in UBI images to fix an OVS crash issue. (#6052, @xliuxu)
  • Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (#6077, @tnqn)
  • Fix race condition in agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (#5954, @tnqn)
  • Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (#6050, @gran-vmv)
  • Update maximum number of buckets to 700 in OVS group add/insert_bucket message. (#5942, @hongliangl)
  • Use 65000 MTU upper bound for interfaces in encap mode in case of large packets being dropped unexpectedly. (#5997, @antoninbas)
  • Skip loading openvswitch kernel module if it's already built-in. (#5979, @antoninbas)

1.15.0 - 2024-01-26

Added

  • Support Egress using IPs from a subnet that is different from the default Node subnet . (#5799, @tnqn)
    • Refer to this document for more information about this feature.
  • Add a migration tool to support migrating from other CNIs to Antrea. (#5677, @hjiajing)
  • Add L7 network flow export support in Antrea that enables exporting network flows with L7 protocol information. (#5218, @tushartathgur)
    • Refer to this document for more information about this feature.
  • Add a new feature NodeNetworkPolicy that allows users to apply ClusterNetworkPolicy to Kubernetes Nodes. (#5658 #5716, @hongliangl @Atish-iaf)
    • Refer to this document for more information about this feature.
  • Add Antrea flexible IPAM support for the Multicast feature. (#4922, @ceclinux)
  • Support Talos clusters to run Antrea as the CNI, and add Talos to the K8s installers document. (#5718 #5766, @antoninbas)
  • Support secondary network when the network configuration in NetworkAttachmentDefinition does not include IPAM configuration. (#5762, @jianjuns)
  • Add instructions to install Antrea in encap mode in AKS. (#5901, @antoninbas)

Changed

  • Change secondary network Pod controller to subscribe to CNIServer events to support bridging and VLAN network. (#5767, @jianjuns)
  • Use Antrea IPAM for secondary network support. (#5427, @jianjuns)
  • Create different images for antrea-agent and antrea-controller to minimize the overall image size, speeding up the startup of both antrea-agent and antrea-controller. (#5856 #5902 #5903, @jainpulkit22)
  • Don't create tunnel interface (antrea-tun0) when using Wireguard encryption mode. (#5885 #5909, @antoninbas)
  • Record an event when Egress IP assignment changes for better troubleshooting. (#5765, @jainpulkit22)
  • Update Windows documentation with clearer installation guide and instructions. (#5789, @antoninbas)
  • Enable IPv4/IPv6 forwarding on demand automatically to eliminate the need for user intervention or dependencies on other components. (#5833, @tnqn)
  • Add ability to skip loading kernel modules in antrea-agent to support some specialized distributions (e.g.: Talos). (#5754, @antoninbas)
  • Add NetworkPolicy rule name in Traceflow observation. (#5667, @Atish-iaf)
  • Use Traceflow API v1beta1 instead of the deprecated API version in antctl traceflow. (#5689, @Atish-iaf)
  • Replace net.IP with netip.Addr in FlowExporter which optimizes the memory usage and improves the performance of the FlowExporter. (#5532, @antoninbas)
  • Update kubemark from v1.18.4 to v1.29.0 for antrea-agent-simulator. (#5820, @luolanzone)
  • Upgrade CNI plugins to v1.4.0. (#5747 #5813, @antoninbas @luolanzone)
  • Update the document for Egress feature's options and usage on AWS cloud. (#5436, @tnqn)
  • Add Flexible IPAM design details in antrea-ipam.md. (#5339, @gran-vmv)

Fixed

  • Fix incorrect MTU configurations for the WireGuard encryption mode and GRE tunnel mode. (#5880 #5926, @hjiajing @tnqn)
  • Prioritize L7 NetworkPolicy flows over TrafficControl to avoid a potential issue that a TrafficControl CR with a redirect action to the same Pod could bypass the L7 engine. (#5768, @hongliangl)
  • Delete OVS port and flows before releasing Pod IP. (#5788, @tnqn)
  • Store NetworkPolicy in filesystem as fallback data source to let antre-agent fallback to use the files if it can't connect to antrea-controller on startup. (#5739, @tnqn)
  • Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (#5777, @tnqn)
  • Fix Clean-AntreaNetwork.ps1 invocation in Prepare-AntreaAgent.ps1 for containerized OVS on Windows. (#5859, @antoninbas)
  • Add missing space to kubelet args in Prepare-Node.ps1 so that kubelet can start successfully on Windows. (#5858, @antoninbas)
  • Fix antctl trace-packet command failure which is caused by missing arguments. (#5838, @luolanzone)
  • Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (#5795, @tnqn)
  • Set net.ipv4.conf.antrea-gw0.arp_announce to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (#5657, @gran-vmv)
  • Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). (#5687 #5705, @GraysonWu)
  • Add host-local IPAM GC on startup to avoid potential IP leak issue after antrea-agent restart. (#5660, @antoninbas)
  • Fix the CrashLookBackOff issue when using the UBI-based image. (#5723, @antoninbas)
  • Remove redundant log in fillPodInfo/fillServiceInfo to fix log flood issue, and update DestinationServiceAddress for deny connections. (#5592 #5704, @yuntanghsu)
  • Enhance HNS network initialization on Windows to avoid some corner cases. (#5841, @XinShuYang)
  • Fix endpoint querier rule index in response to improve troubleshooting. (#5783, @qiyueyao)
  • Avoid unnecessary rule reconciliations in FQDN controller. (#5893, @Dyanngg)
  • Update Windows OVS download link to remove the invalid certificate preventing unsigned OVS driver installation. (#5839, @XinShuYang)
  • Fix IP annotation not working on StatefulSets for Antrea FlexibleIPAM. (#5715, @gran-vmv)
  • Add DHCP IP retries in PrepareHNSNetwork to fix potential IP retrieving failure. (#5819, @XinShuYang)
  • Revise antctl mc deploy to support Antrea Multi-cluster deployment update when the manifests are changed. (#5257, @luolanzone)