Project: Antrea (Runtime / Cloud Native Network)
File: CHANGELOG-1.15.md

Stop using `projects.registry.vmware.com` for user-facing images. (, [@antoninbas]) Persist TLS certificate and key of antrea-controller and periodically sync the CA cert to improve robustness. (, [@tnqn]) Disable cgo for all Antrea binaries. (, [@antoninbas]) Disable `libcapng` to make logrotate run as root in UBI images to fix an OVS crash issue. (, [@xliuxu]) Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (, [@tnqn]) Fix race condition in agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (, [@tnqn]) Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (, [@gran-vmv]) Update maximum number of buckets to 700 in OVS group add/insert_bucket message. (, [@hongliangl]) Use 65000 MTU upper bound for interfaces in encap mode in case of large packets being dropped unexpectedly. (, [@antoninbas]) Skip loading openvswitch kernel module if it's already built-in. (, [@antoninbas]) Support Egress using IPs from a subnet that is different from the default Node subnet . (, [@tnqn]) Refer to for more information about this feature. Add a migration tool to support migrating from other CNIs to Antrea. (, [@hjiajing]) Refer to for more information about this tool. Add L7 network flow export support in Antrea that enables exporting network flows with L7 protocol information. (, [@tushartathgur]) Refer to for more information about this feature. Add a new feature `NodeNetworkPolicy` that allows users to apply `ClusterNetworkPolicy` to Kubernetes Nodes. ( , [@hongliangl] [@Atish-iaf]) Refer to for more information about this feature. Add Antrea flexible IPAM support for the Multicast feature. (, [@ceclinux]) Support Talos clusters to run Antrea as the CNI, and add Talos to the K8s installers document. ( , [@antoninbas]) Support secondary network when the network configuration in `NetworkAttachmentDefinition` does not include IPAM configuration. (, [@jianjuns]) Add instructions to install Antrea in `encap` mode in AKS. (, [@antoninbas]) Change secondary network Pod controller to subscribe to CNIServer events to support bridging and VLAN network. (, [@jianjuns]) Use Antrea IPAM for secondary network support. (, [@jianjuns]) Create different images for antrea-agent and antrea-controller to minimize the overall image size, speeding up the startup of both antrea-agent and antrea-controller. ( , [@jainpulkit22]) Don't create tunnel interface (antrea-tun0) when using Wireguard encryption mode. ( , [@antoninbas]) Record an event when Egress IP assignment changes for better troubleshooting. (, [@jainpulkit22]) Update Windows documentation with clearer installation guide and instructions. (, [@antoninbas]) Enable IPv4/IPv6 forwarding on demand automatically to eliminate the need for user intervention or dependencies on other

(, [@tnqn]) Add ability to skip loading kernel modules in antrea-agent to support some specialized distributions (e.g.: Talos). (, [@antoninbas]) Add NetworkPolicy rule name in Traceflow observation. (, [@Atish-iaf]) Use Traceflow API v1beta1 instead of the deprecated API version in `antctl traceflow`. (, [@Atish-iaf]) Replace `net.IP` with `netip.Addr` in FlowExporter which optimizes the memory usage and improves the performance of the FlowExporter. (, [@antoninbas]) Update kubemark from v1.18.4 to v1.29.0 for antrea-agent-simulator. (, [@luolanzone]) Upgrade CNI plugins to v1.4.0. ( , [@antoninbas] [@luolanzone]) Update the document for Egress feature's options and usage on AWS cloud. (, [@tnqn]) Add Flexible IPAM design details in `antrea-ipam.md`. (, [@gran-vmv]) Fix incorrect MTU configurations for the WireGuard encryption mode and GRE tunnel mode. ( , [@hjiajing] [@tnqn]) Prioritize L7 NetworkPolicy flows over `TrafficControl` to avoid a potential issue that a `TrafficControl` CR with a redirect action to the same Pod could bypass the L7 engine. (, [@hongliangl]) Delete OVS port and flows before releasing Pod IP. (, [@tnqn]) Store NetworkPolicy in filesystem as fallback data source to let antre-agent fallback to use the files if it can't connect to antrea-controller on startup. (, [@tnqn]) Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (, [@tnqn]) Fix Clean-AntreaNetwork.ps1 invocation in Prepare-AntreaAgent.ps1 for containerized OVS on Windows. (, [@antoninbas]) Add missing space to kubelet args in Prepare-Node.ps1 so that kubelet can start successfully on Windows. (, [@antoninbas]) Fix `antctl trace-packet` command failure which is caused by missing arguments. (, [@luolanzone]) Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (, [@tnqn]) Set `net.ipv4.conf.antrea-gw0.arp_announce` to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (, [@gran-vmv]) Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). ( , [@GraysonWu]) Add host-local IPAM GC on startup to avoid potential IP leak issue after antrea-agent restart. (, [@antoninbas]) Fix the CrashLookBackOff issue when using the UBI-based image. (, [@antoninbas]) Remove redundant log in `fillPodInfo`/`fillServiceInfo` to fix log flood issue, and update `DestinationServiceAddress` for deny connections. ( , [@yuntanghsu]) Enhance HNS network initialization on Windows to avoid some corner cases. (, [@XinShuYang]) Fix endpoint querier rule index in response to improve troubleshooting. (, [@qiyueyao]) Avoid unnecessary rule reconciliations in FQDN controller. (, [@Dyanngg]) Update Windows OVS download link to remove the invalid certificate preventing unsigned OVS driver installation. (, [@XinShuYang]) Fix IP annotation not working on StatefulSets for Antrea FlexibleIPAM. (, [@gran-vmv]) Add DHCP IP retries in `PrepareHNSNetwork` to fix potential IP retrieving failure. (, [@XinShuYang]) Revise `antctl mc deploy` to support Antrea Multi-cluster deployment update when the manifests are changed. (, [@luolanzone])