Project: Antrea (Runtime / Cloud Native Network)
File: CHANGELOG-1.6.md

Add for the Antrea Agent RBAC permissions and how to restrict them using Gatekeeper/OPA. (, [@antoninbas]) Clean up stale routes installed by AntreaProxy when ProxyAll is disabled. (, [@hongliangl]) Fix export/import of Services with named ports when using the Antrea Multi-cluster feature. (, [@luolanzone]) Fix handling of the "reject" packets generated by the Antrea Agent to avoid infinite looping. (, [@GraysonWu]) Fix DNS resolution error of Antrea Agent on AKS by using `ClusterFirst` dnsPolicy. (, [@tnqn]) Fix tolerations for Pods running on control-plane for Kubernetes >= 1.24. (, [@xliuxu]) Reduce permissions of Antrea Agent ServiceAccount. (, [@xliuxu]) , [@hongliangl]) Fix Antrea wildcard FQDN NetworkPolicies not working when NodeLocal DNSCache is enabled. (, [@hongliangl]) The Egress feature is graduated from Alpha to Beta and is therefore enabled by default. The support for proxying all Service traffic by Antrea Proxy (enabled by `antreaProxy.proxyAll`) is now Beta. Add the following capabilities to the [Antrea IPAM] feature: Support pre-allocating continuous IPs for StatefulSet. (, [@annakhm]) Support specifying VLAN for IPPool. Traffic from Pods whose IPPools are configured with a VLAN ID will be tagged when leaving the Node uplink. (, [@gran-vmv]) Add the following capabilities to the [Antrea Multi-cluster] feature: Support Antrea ClusterNetworkPolicy replication in a ClusterSet. (, [@Dyanngg]) Add `antctl mc` subcommand for Antrea Multi-cluster resources. ( , [@hjiajing] [@bangqipropel]) Add the following capabilities to the [AntreaPolicy] feature: Add Node selector in Antrea-native policies to allow matching traffic originating from specific Nodes or destined to specific Nodes. (, [@wenqiq]) Add ServiceAccount selector in Antrea-native policies to allow selecting Pods by ServiceAccount. (, [@GraysonWu]) Support Pagination for ClusterGroupMembership API. (, [@qiyueyao]) Add Port Number to Audit Logging. (, [@qiyueyao]) [Flow Visibility] Add Grafana Flow Collector as the new visualization tool for flow records. Add Grafana dashboards, Clickhouse data schema, deployment files, and doc. ( , [@heanlan] [@zyiou] [@dreamtalen]) Add support for exporting flow records to ClickHouse from Flow Aggregator. ( , [@wsquan171] [@dreamtalen]) Add ClickHouse monitor to ensure data retention for in-memory ClickHouse deployment. ( , [@yanjunz97]) , [@wenyingd]) , [@XinShuYang]) Add SKIPCNIBINARIES environment variable to support skipping the installation of specified CNI plugins. (, [@jainpulkit22]) Support UBI8-based container image to run Antrea. (, [@ksamoray]) Add the following documentations: Add for ServiceExternalIP feature and Service of type LoadBalancer. (, [@hty690]) Add for deploying Antrea to Minikube cluster. (, [@jainpulkit22]) Add for `antctl` Multi-cluster commands. (, [@bangqipropel]) Add for Multiple-VLAN support. (, [@gran-vmv]) Add for Multi-cluster. (, [@luolanzone]) Add for NetworkpolicyStats docs. (, [@ceclinux]) Remove all legacy (*.antrea.tanzu.vmware.com) APIs. (, [@antoninbas]) Remove Kind-specific manifest and scripts. Antrea now uses OVS kernel datapath for Kind

(, [@antoninbas]) , [@wenyingd]) Add an agent config parameter "enableBridgingMode" for enabling flexible IPAM (bridging mode). ( , [@jianjuns]) Use iptables-wrapper in Antrea container to support distros that runs iptables in "nft" mode. (, [@antoninbas]) Install CNI configuration files after installing CNI binaries to support container runtime `cri-o`. (, [@tnqn]) Upgrade packaged Whereabouts version to v0.5.1. (, [@antoninbas]) Upgrade to go-ipfix v0.5.12. (, [@yanjunz97]) Upgrade Kustomize from v3.8.8 to v4.4.1 to fix Cronjob patching bugs. (, [@yanjunz97]) Fail in Agent initialization if GRE tunnel type is used with IPv6. (, [@antoninbas]) Refactor the OpenFlow pipeline for future extensibility. (, [@hongliangl]) Validate IP ranges of IPPool for Antrea IPAM. (, [@ksamoray]) Validate protocol in the CRD schema of Antrea-native policies. (, [@KMAnju-2021]) Validate labels in the CRD schema of Antrea-native policies and ClusterGroup. (, [@GraysonWu]) Reduce permissions of Antrea ServiceAccounts. (, [@tnqn]) Remove --k8s-1.15 flag from hack/generate-manifest.sh. (, [@antoninbas]) Remove unnecessary CRDs and RBAC rules from Multi-cluster manifest. (, [@luolanzone]) Update label and image repo of antrea-mc-controller to be consistent with antrea-controller and antrea-agent. ( , [@luolanzone]) Add clusterID annotation to ServiceExport/Import resources. (, [@luolanzone]) Do not log error when Service for Endpoints is not found to avoid log spam. (, [@tnqn]) Ignore Services of type ExternalName for NodePortLocal feature. (, [@antoninbas]) Add powershell command replacement in the Antrea Windows documentation. (, [@GraysonWu]) Add userspace ARP/NDP responders to fix Egress and ServiceExternalIP support for IPv6 clusters. (, [@hty690]) Fix incorrect results by `antctl get networkpolicy` when both Pod and Namespace are specified. (, [@Dyanngg]) Fix IP leak issue when AntreaIPAM is enabled. (, [@gran-vmv]) Fix error when dumping OVS flows for a NetworkPolicy via `antctl get ovsflows`. (, [@jainpulkit22]) Fix IPsec encryption for IPv6 overlays. (, [@antoninbas]) Add ignored interfaces names when getting interface by IP to fix NetworkPolicyOnly mode in AKE. (, [@wenyingd]) Fix duplicate IP case for NetworkPolicy. (, [@tnqn]) Don't delete the routes which are added for the peer IPv6 gateways on Agent startup. ( , [@Jexf] [@xliuxu]) Fix pkt mark conflict between HostLocalSourceMark and SNATIPMark. (, [@tnqn]) Unconditionally sync CA cert for Controller webhooks to fix Egress support when AntreaPolicy is disabled. (, [@antoninbas]) Fix inability to access NodePort in particular cases. (, [@hongliangl]) Fix ipBlocks referenced in nested ClusterGroup not processed correctly. (, [@Dyanngg]) Realize Egress for a Pod as soon as its network is created. (, [@tnqn]) Fix NodePort/LoadBalancer issue when proxyAll is enabled. (, [@hongliangl]) Do not panic when processing a PacketIn message for a denied connection. (, [@antoninbas]) Fix CT mark matching without range in flow exporter. (, [@hongliangl]) , [@hongliangl])