Project: Antrea (Runtime / Cloud Native Network)
File: CHANGELOG-1.7.md

Fix race conditions in NetworkPolicyController. (, [@tnqn]) Ensure NO_FLOOD is always set for IPsec tunnel ports and TrafficControl ports. ( , [@xliuxu] [@tnqn]) Fix Service routes being deleted on Agent startup on Windows. (, [@hongliangl]) Fix Agent crash in dual-stack clusters when any Node is not configured with an IP address for each address family. (, [@hongliangl]) Fix route deletion for Service ClusterIP and LoadBalancerIP when AntreaProxy is enabled. (, [@tnqn]) Upgrade Antrea base image to ubuntu 22.04. (, [@antoninbas]) Add OFSwitch connection check to Agent's liveness probes. (, [@tnqn]) Improve installcnichaining to support updates to CNI config file. (, [@antoninbas]) Add a periodic job to rejoin dead Nodes to fix Egress not working properly after long network downtime. (, [@tnqn]) Fix connectivity issues caused by MAC address changes with systemd v242 and later. (, [@wenyingd]) Fix potential deadlocks and memory leaks of memberlist maintenance in large-scale clusters. (, [@wenyingd]) Fix Windows AddNodePort parameter error. (, [@XinShuYang]) Set no-flood config with ports for TrafficControl after Agent restarting. (, [@hongliangl]) Fix multicast group not removed from cache when it is uninstalled. (, [@wenyingd]) Remove redundant Openflow messages when syncing an updated group to OVS. (, [@hongliangl]) Fix Antrea Octant plugin build. (, [@antoninbas]) Fix FlowExporter memory bloat when export process is dead. (, [@wsquan171]) Fix Pod-to-external traffic on EKS in policyOnly mode. (, [@antoninbas]) Use uplink interface name for host interface internal port to support DHCP client. (, [@gran-vmv]) Add TrafficControl feature to control the transmission of Pod traffic; it allows users to mirror or redirect traffic originating from specific Pods or destined for specific Pods to a local network device or a remote destination via a tunnel of various types. ( , [@tnqn] [@hongliangl] [@wenqiq]) Refer to for more information about this feature. Refer to for more information about using this feature to provide network-based intrusion detection service to your Pods. Add support for the IPsec Certificate-based Authentication. (, [@xliuxu]) Add an Antrea Agent configuration option `ipsec.authenticationMode` to specify authentication mode. Supported options are "psk" (default) and "cert". Add an Antrea Controller configuration option `ipsecCSRSigner.autoApprove` to specify the auto-approve policy of Antrea CSR signer for IPsec certificates management. By default, Antrea will auto-approve the CertificateSingingRequest (CSR) if it is verified. Add an Antrea Controller configuration option `ipsecCSRSigner.selfSignedCA` to specify whether to use auto-generated self-signed CA certificate. By default, Antrea will auto-generate a self-signed CA certificate. Add the following capabilities to Antrea-native policies: Add support for matching ICMP traffic. (, [@GraysonWu]) Add support for matching multicast and IGMP traffic. (, [@liu4480]) Add support for rule-level statistics for multicast and IGMP traffic. (, [@ceclinux]) Add the following capabilities to the Multicast feature: Add `antctl get podmulticaststats` command to query Pod-level multicast traffic statistics in Agent mode. (, [@ceclinux]) Add "MulticastGroup" API to query Pods that have joined multicast groups; `kubectl get multicastgroups` can generate requests and output responses of the API. ( , [@ceclinux]) Add an Antrea Agent configuration option `multicast.igmpQueryInterval` to specify the interval at which the antrea-agent sends IGMP queries to Pods. (, [@liu4480]) Add the following capabilities to the Multi-cluster feature: Add the Multi-cluster Gateway functionality which supports routing Multi-cluster Service traffic across clusters through tunnels between the Gateway Nodes. It enables Multi-cluster Service access across clusters, without requiring direct reachability of Pod IPs between

( , [@luolanzone]) Add a number of `antctl mc` subcommands for bootstrapping Multi-cluster; refer to the for more information. (, [@hjiajing]) Add the following capabilities to secondary network IPAM: Add support for IPAM for Pod secondary networks managed by Multus. (, [@jianjuns]) Add support for multiple IPPools. (, [@jianjuns]) Add support for static addresses. (, [@jianjuns]) Add support for NodePortLocal on Windows. (, [@XinShuYang]) Add support for Traceflow on Windows. (, [@gran-vmv]) Add support for containerd to antrea-eks-node-init.yml. (, [@antoninbas]) Add an Antrea Agent configuration option `disableTXChecksumOffload` to support cases in which the datapath's TX checksum offloading does not work properly. (, [@tnqn]) Add support for InternalTrafficPolicy in AntreaProxy. (, [@hongliangl]) Add the following documentations: Add for the Antrea Agent RBAC permissions and how to restrict them using Gatekeeper/OPA. (, [@antoninbas]) Add for Antrea Multi-cluster. (, [@luolanzone] [@jianjuns]) Add for the AntreaProxy feature. (, [@antoninbas]) Add for secondary network IPAM. (, [@jianjuns]) Optimize generic traffic performance by reducing OVS packet recirculation. (, [@tnqn]) Optimize NodePort traffic performance by reducing OVS packet recirculation. (, [@hongliangl]) Improve validation for IPPool CRD. (, [@jianjuns]) Improve validation for `egress.to.namespaces.match` of AntreaClusterNetworkPolicy rules. (, [@qiyueyao]) Deprecate the Antrea Agent configuration option `multicastInterfaces` in favor of `multicast.multicastInterfaces`. (, [@tnqn]) Reduce permissions of Antrea Agent ServiceAccount. (, [@xliuxu]) Create a Secret in the Antrea manifest for the antctl and antrea-agent ServiceAccount as K8s v1.24 no longer creates a token for each ServiceAccount automatically. (, [@antoninbas]) Implement garbage collector for IP Pools to clean up allocations and reservations for which owner no longer exists. (, [@annakhm]) Preserve client IP if the selected Endpoint is local regardless of ExternalTrafficPolicy. (, [@hongliangl]) Add a Helm chart for Antrea and use the Helm templates to generate the standard Antrea YAML manifests. (, [@antoninbas]) Make "Agent mode" antctl work out-of-the-box on Windows. (, [@antoninbas]) Truncate SessionAffinity timeout values of Services instead of wrapping around. (, [@antoninbas]) Move Antrea Windows log dir from `C:\k\antrea\logs\` to `C:\var\log\antrea\`. (, [@GraysonWu]) Limit max number of data values displayed on Grafana panels. (, [@heanlan]) Support deploying ClickHouse with Persistent Volume. (, [@yanjunz97]) Remove support for ELK Flow Collector. (, [@heanlan]) Improve documentation for Antrea-native policies. (, [@Dyanngg]) Update OVS version to 2.17.0. (, [@antoninbas]) Fix Egress not working with kube-proxy IPVS strictARP mode. (, [@xliuxu]) Fix intra-Node Pod traffic bypassing Ingress NetworkPolicies in some scenarios. (, [@hongliangl]) Fix FQDN policy support for IPv6. (, [@tnqn]) Fix multicast not working if the AntreaPolicy feature is disabled. (, [@liu4480]) Fix tolerations for Pods running on control-plane for Kubernetes >= 1.24. (, [@xliuxu]) Fix DNS resolution error of antrea-agent on AKS by using `ClusterFirst` dnsPolicy. (, [@tnqn]) Clean up stale routes installed by AntreaProxy when ProxyAll is disabled. (, [@hongliangl]) Ensure that Service traffic does not bypass NetworkPolicies when ProxyAll is enabled on Windows. (, [@hongliangl]) Use IP and MAC to find virtual management adapter to fix Agent crash in some scenarios on Windows. (, [@wenyingd]) Fix handling of the "reject" packets generated by the Antrea Agent to avoid infinite looping. (, [@GraysonWu]) Fix export/import of Services with named ports when using the Antrea Multi-cluster feature. (, [@luolanzone]) Fix Multi-cluster importer not working after leader controller restarts. (, [@luolanzone]) Fix Endpoint ResourceExports not cleaned up after corresponding Service is deleted. (, [@luolanzone]) Fix pool CRD format in egress.md and service-loadbalancer.md. (, [@jianjuns]) Fix infinite looping when Agent tries to delete a non-existing route. (, [@hongliangl]) Fix race condition in ConntrackConnectionStore and FlowExporter. (, [@heanlan])