Project: Antrea (Runtime / Cloud Native Network)
File: CHANGELOG-1.1.md

Improve the batch installation of NetworkPolicy rules when the Agent starts: only generate flow operations based on final desired state instead of incrementally. (, [@tnqn]) Fix deadlock when initializing the GroupEntityIndex (in the Antrea Controller) with many groups; this was preventing correct distribution and enforcement of NetworkPolicies. (, [@tnqn]) Use "os/exec" package instead of third-party modules to run PowerShell commands and configure host networking on Windows; this change prevents Agent goroutines from getting stuck when configuring routes. (, [@lzhecheng]) [Windows] Fix panic in Agent when calculating the stats for a rule newly added to an existing NetworkPolicy. (, [@tnqn]) Fix bug in iptables rule installation for dual-stack clusters: if a rule was already present for one protocol but not the other, its installation may have been skipped. (, [@lzhecheng]) Upgrade OVS version to 2.14.2 to pick up security fixes for CVE-2015-8011, CVE-2020-27827 and CVE-2020-35498. (, [@antoninbas]) Fix inter-Node ClusterIP Service access when AntreaProxy is disabled. (, [@tnqn]) Fix duplicate group ID allocation in AntreaProxy when using a combination of IPv4 and IPv6 Services in dual-stack clusters; this was causing Service connectivity issues. (, [@hongliangl]) Fix intra-Node ClusterIP Service access when both the AntreaProxy and Egress features are enabled. (, [@tnqn]) Fix invalid clean-up of the HNS Endpoint during Pod deletion, when Docker is used as the container runtime. (, [@wenyingd]) [Windows] Fix race condition on Windows when retrieving the local HNS Network created by Antrea for containers. (, [@tnqn]) [Windows] Fix invalid conversion function between internal and versioned types for controlplane API, which was causing JSON marshalling errors. (, [@tnqn]) Fix implementation of the v1beta1 version of the legacy "controlplane.antrea.tanzu.vmware.com" API: the API was incorrectly using some v1beta2 types and it was missing some field selectors. (, [@tnqn]) Enable "noEncap" and "hybrid" traffic modes for clusters which include Windows Nodes. ( , [@lzhecheng] [@tnqn]) [Windows] Each Agent is responsible for annotating its Node resource with the MAC address of the uplink interface, using the "node.antrea.io/mac-address" annotation; the annotation is used to forward Pod traffic Add a generic mechanism to define policy rules enforced on all the network endpoints belonging to the same Namespace as the target of the AppliedTo; this makes it very easy to define an Antrea CNP to only allow same-Namespace traffic (Namespace isolation) across all Namespaces in the cluster or a subset of them. (, [@Dyanngg]) Add support for the "Reject" action of Antrea-native policies in the Traceflow observations. (, [@gran-vmv]) Add support for the "endPort" field in K8s

(, [@GraysonWu]) Add support for , [@xliuxu]) Export flow records about connections denied by NetworkPolicies from the FlowExporter and the FlowAggregator; the records include information about the policy responsible for denying the connection when applicable. (, [@zyiou]) Add more NetworkPolicy-related information to IPFIX flow records exported by the FlowAggregator (policy type and rule name). (, [@heanlan]) Add live-traffic Traceflow support to the Antrea , , [@luolanzone]) Add crd.antrea.io/v1alpha3/ClusterGroup API resource which removes the deprecated "ipBlock" field; a , [@Dyanngg]) Add support for providing an IP address as the source for live-traffic Traceflow; the source can also be omitted altogether in which case any source can be a match. (, [@jianjuns]) Add ICMP echo ID and sequence number to the captured packet for live-traffic Traceflow. (, [@jianjuns]) Add support for dumping OVS groups with the "antctl get of" command. (, [@jianjuns]) Add new "antreaagentdenyconnectioncount" Prometheus metric to keep track of the number of connections denied because of NetworkPolicies; if too many connections are denied within a short window of time, the metric may undercount. (, [@zyiou]) Generate and check-in clientset code for ClusterGroupMembers and GroupAssociation, to facilitate consumption of these APIs by third-party software. (, [@Dyanngg]) Document requirements for the Node network (how to configure firewalls, security groups, etc.) when running Antrea. (, [@luolanzone]) Rename Antrea Go module from github.com/vmware-tanzu/antrea to antrea.io/antrea, using a vanity import path. (, [@antoninbas]) Enable , [@tnqn]) Change the export mechanism for the FlowAggregator: instead of exporting all flows periodically with a fixed interval, we introduce an "active timeout" and an "inactive timeout", and flow information is exported differently based on flow activity. (, [@srikartati]) Periodically verify the local gateway's configuration and the gateway routes on each Node, and correct any discrepancy. (, [@hty690]) Remove the "enableTLSToFlowAggregator" parameter from the Agent configuration; this information can be provided using the "flowCollectorAddr" parameter. (, [@zyiou]) Specify antrea-agent as the default container for kubectl commands using the "kubectl.kubernetes.io/default-container" annotation introduced in K8s v1.21. (, [@tnqn]) Improve the OpenAPI schema for Antrea-native policy CRDs to enable a more comprehensive validation. (, [@wenqiq]) Bump K8s dependencies (k8s.io/apiserver, k8s.io/client-go, etc.) to v0.21.0 and replace klog with klog/v2. (, [@xliuxu]) Add nodeSelector for FlowAggregator and ELK Pods in YAML manifests: they must run on amd64 Nodes. (, [@antoninbas]) Update reference Kibana configuration to decode the flowType field and display a human-friendly string instead of an integer. (, [@zyiou]) Package , [@arunvelayutham]) Start enabling Antrea end-to-end tests for Windows Nodes. (, [@lzhecheng]) Parameterize K8s download path in Windows helper

( , [@jayunit100] [@lzhecheng]) [Windows] It was discovered that the AntreaProxy implementation has an upper-bound for the number of Endpoints it can support for each Service: we increase this upper-bound from ~500 to 800, log a warning for Services with a number of Endpoints greater than 800, and arbitrarily drop some Endpoints so we can still provide load-balancing for the Service. (, [@hongliangl]) Fix Antrea-native policy with multiple AppliedTo selectors: some rules were never realized by the Agents as they thought they had only received partial information from the Controller. (, [@tnqn]) Fix re-installation of the OpenFlow groups when the OVS daemons are restarted to ensure that AntreaProxy keeps functioning. (, [@antoninbas]) Configure the MTU correctly in Windows containers, or Path MTU Discovery fails and datagrams with the minimum size are transmitted leading to poor performance in overlay mode. (, [@lzhecheng]) [Windows] Fix IPFIX flow records exported by the Antrea Agent. (, [@zyiou]) If a connection spanned multiple export cycles, it wasn't handled properly and no record was sent for the connection If a connection spanned a single export cycle, a single record was sent but "delta counters" were set to 0 which caused flow visualization to omit the flow in dashboards Fix incorrect stats reporting for ingress rules of some NetworkPolicies: some types of traffic were bypassing the OVS table keeping track of statistics once the connection was established, causing packet and byte stats to be incorrect. (, [@ceclinux]) Fix ability of the FlowExporter to connect to the FlowAggregator on Windows: the "flow-aggregator.flow-aggregator.svc" DNS name cannot be resolved on Windows because the Agent is running as a process. (, [@dreamtalen]) [Windows] Fix Traceflow for "hairpinned" Service traffic. (, [@gran-vmv]) Fix possible crash in the FlowExporter and FlowAggregator when re-establishing a connection for exporting flow records. (, [@srikartati]) Fix local access (from the K8s Node) to the port of a Pod with NodePortLocal enabled running on the same Node. (, [@antoninbas]) Add conntrack label parsing in the FlowExporter when using the OVS netdev datapath, so that NetworkPolicy information can be populated correctly in flow records. (, [@dreamtalen]) Fix the retry logic when enabling the OVS bridge local interface on Windows Nodes. (, [@antoninbas]) [Windows] Sleep for a small duration before injecting Traceflow packet even when the destination is local, to ensure that flow installation can complete and avoid transient errors. (, [@gran-vmv]) Build antrea-cni binary and release binaries without cgo, to avoid dependencies on system libraries. (, [@antoninbas]) Do not populate hostNetwork Pods into AppliedTo groups sent by the Controller to the Agents to avoid unnecessary logs (NetworkPolicies are not enforced on hostNetwork Pods). (, [@Dyanngg]) Fix formatting of K8s code generation tags for Antrea API type declarations, to ensure that auto-generated godocs are rendered correctly. (, [@heshengyuan1311]) Update brew install commands in the documentation for bringing up a local K8s test cluster. (, [@RayBB])