antrea

Added

• Support LoadBalancerIPMode in AntreaProxy to implement K8s KEP-1860. (#6102, @hongliangl)
• Add sameLabels field support for Antrea ClusterNetworkPolicy peer Namespace selection to allow users to create ACNPs that isolate Namespaces based on their label values. (#4537, @Dyanngg)
• Add multiple physical interfaces support for the secondary network bridge. (#5959, @aroradaman)
• Use a Node's primary NIC as the secondary OVS bridge physical interface. (#6108, @aroradaman)
• Add user documentation for Antrea native secondary network support. (#6015 #6042, @jianjuns @antoninbas)
• Add a new versioned API NetworkPolicyEvaluation and a new antctl sub-command for querying the effective policy rule applied to particular traffic. (#5740 #6112, @qiyueyao)

Changed

• Multiple deprecated APIs, fields and options have been removed from Antrea.
  • Remove deprecated v1alpha1 CRDs Tier, ClusterNetworkPolicy, NetworkPolicy, Traceflow and ExternalEntity. (#6162 #6177 #6238, @luolanzone @hjiajing @antoninbas)
  • Remove deprecated v1alpha2 and v1alpha3 CRDs ClusterGroups, ExternalIPPool, ClusterGroup and Group. (#6049 #6239, @luolanzone @antoninbas)
  • Remove deprecated ServiceAccount field in ClusterSet type for Antrea Multi-cluster. (#6134, @luolanzone)
  • Remove deprecated options enableIPSecTunnel,multicastInterfaces, multicluster.enable and legacyCRDMirroring. (#5158, @luolanzone)
  • Clean up unused code for NodePortLocal and remove the deprecated nplPortRange config. (#5943, @luolanzone)
  • Clean up deprecated APIServices. (#6002, @tnqn)
• Documentation has been updated to reflect recent changes and provide better guidance to users.
  • Add upgrade instructions for Antrea v2.0. (#6261, @antoninbas)
  • Update the OVS pipeline document and workflow diagram to keep them up to date. (#5412, @hongliangl)
  • Clarify documentation for IPPool and ExternalIPPool CRDs. (#6183, @antoninbas)
  • Document Pods using FQDN based policies must respect DNS TTL. (#6230, @tnqn)
  • Document the limitations of Audit Logging for policy rules. (#6225, @antoninbas)
• Optimizing Antrea binaries size.
  • Optimize package organization to reduce antctl binary size. (#6037, @tnqn)
  • Reduce antrea-cni binary size by removing unnecessary import packages. (#6038, @tnqn)
  • Strip all debug symbols from Go binaries by default. (#6035, @antoninbas)
  • Disable cgo for all Antrea binaries. (#5988, @antoninbas)
• Increase the minimum supported Kubernetes version to v1.19. (#6089, @hjiajing)
• Add OVS groups dump information to support bundle to help troubleshooting. (#6195, @shikharish)
• Add egressNodeName in flow records for Antrea Flow Aggregator. (#6012, @Atish-iaf)
• Add EgressNode field in the Traceflow Egress observation to include the name of the Egress Node. (#5949, @Atish-iaf)
• Upgrade IPPool CRD to v1beta1 and make the subnet definition consistent with the one in ExternalIPPool CRD. (#6036, @mengdie-song)
• Request basic memory for antrea-controller to improve its scheduling and reduce its OOM adjustment score, enhancing overall robustness. (#6233, @tnqn)
• Increase default rate limit of antrea-controller to improve performance for batch requests. (#6231, @tnqn)
• Remove Docker support for antrea-agent on Windows, update Windows documentation to remove all Docker-specific instructions, and all mentions of (userspace) kube-proxy. (#6019 #6255, @XinShuYang @antoninbas)
• Stop publishing the legacy unified image. (#6182, @antoninbas)
• Avoid unnecessary DNS queries for FQDN rule of NetworkPolicy in antrea-agent. (#6200, @tnqn)
• Stop using projects.registry.vmware.com for user-facing images. (#6073, @antoninbas)
• Fall back to lenient decoding when strict decoding config fails to tolerate unknown fields and duplicate fields, ensuring forward compatibility of configurations. (#6156, @tnqn)
• Skip loading openvswitch kernel module if it's already built-in. (#5979, @antoninbas)
• Persist TLS certificate and key of antrea-controller and sync the CA cert periodically to improve robustness. (#5955 #6205, @tnqn)
• Add more validations for ExternalIPPool CRD to improve robustness. (#5898, @aroradaman)
• Add Antrea L7 NetworkPolicy logs for allowed HTTP traffic. (#6014, @qiyueyao)
• Update maximum number of buckets to 700 in OVS group add/insert_bucket message. (#5942, @hongliangl)
• Add a flag for antctl to print OVS table names when users run antctl get ovsflows --table-names-only. (#5895 #6100, @luolanzone)
• Improve log message when antrea-agent fails to join a new Node. (#6048, @roopeshsn)
• Remove the prefix rancher-wins when collecting antrea-agent logs on Windows. (#6223, @wenyingd)
• Upgrade K8s libraries to v0.29.2. (#5843, @hjiajing)
• Upgrade base image from UBI8 to UBI9 for Antrea UBI images. (#5737, @xliuxu)

Fixed

• Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (#6077, @tnqn)
• Disable libcapng to make logrotate run as root in UBI images to fix an OVS crash issue. (#6052, @xliuxu)
• Fix a race condition in antrea-agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (#5954, @tnqn)
• Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (#6050, @gran-vmv)
• Use 65000 MTU upper bound for interfaces in encap mode to account for the MTU automatically configured by OVS on tunnel ports, and avoid packet drops on some clusters. (#5997, @antoninbas)
• Install multicast related iptables rules only on IPv4 chains to fix the antrea-agent initialization failure occurred when the Multicast feature is enabled in dual-stack clusters. (#6123, @wenyingd)
• Remove incorrect AntreaProxy warning on Windows when proxyAll is disabled. (#6242, @antoninbas)
• Explicitly set kubelet's log files in Prepare-Node.ps1 on Windows, to ensure that they are included in support bundle collections. (#6221, @wenyingd)
• Add validation on antrea-agent options to fail immediately when encryption is requested and the Multicast feature enabled. (#5920, @wenyingd)
• Don't print the incorrect warning message when users run antrea-controller --version outside of K8s. (#5993, @prakrit55)
• Record event when EgressIP is uninstalled from a Node and remains unassigned. (#6011, @jainpulkit22)
• Fix a bug that the local traffic cannot be identified on networkPolicyOnly mode. (#6251, @hongliangl)
• Use reserved OVS controller ports for the default Antrea ports to fix a potential ofport mismatch issue. (#6202, @antoninbas)

Added

• Enable Windows OVS container to run on pristine host environment, without requiring some dependencies to be installed manually ahead of time. (#5440, @NamanAg30)

Changed

• Stop using projects.registry.vmware.com for user-facing images. (#6073, @antoninbas)
• Persist TLS certificate and key of antrea-controller and periodically sync the CA cert to improve robustness. (#5955, @tnqn)
• Disable cgo for all Antrea binaries. (#5988, @antoninbas)

Fixed

• Disable libcapng to make logrotate run as root in UBI images to fix an OVS crash issue. (#6052, @xliuxu)
• Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (#6077, @tnqn)
• Fix race condition in agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (#5954, @tnqn)
• Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (#6050, @gran-vmv)
• Fix incorrect MTU configurations for the WireGuard encryption mode and GRE tunnel mode. (#5880 #5926, @hjiajing @tnqn)
• Use 65000 MTU upper bound for interfaces in encap mode in case of large packets being dropped unexpectedly. (#5997, @antoninbas)
• Install Multicast related iptables rules only on IPv4 chains to fix the Antrea agent initialization failure occurred when Multicast feature is enabled in dual-stack clusters. (#6123, @wenyingd)

Changed

• Stop using projects.registry.vmware.com for user-facing images. (#6073, @antoninbas)
• Persist TLS certificate and key of antrea-controller and periodically sync the CA cert to improve robustness. (#5955, @tnqn)
• Disable cgo for all Antrea binaries. (#5988, @antoninbas)

Fixed

• Disable libcapng to make logrotate run as root in UBI images to fix an OVS crash issue. (#6052, @xliuxu)
• Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (#6077, @tnqn)
• Fix race condition in agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (#5954, @tnqn)
• Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (#6050, @gran-vmv)
• Update maximum number of buckets to 700 in OVS group add/insert_bucket message. (#5942, @hongliangl)
• Use 65000 MTU upper bound for interfaces in encap mode in case of large packets being dropped unexpectedly. (#5997, @antoninbas)

Changed

• Stop using projects.registry.vmware.com for user-facing images. (#6073, @antoninbas)
• Persist TLS certificate and key of antrea-controller and periodically sync the CA cert to improve robustness. (#5955, @tnqn)
• Disable cgo for all Antrea binaries. (#5988, @antoninbas)

Fixed

• Disable libcapng to make logrotate run as root in UBI images to fix an OVS crash issue. (#6052, @xliuxu)
• Fix nil pointer dereference when ClusterGroup/Group is used in NetworkPolicy controller. (#6077, @tnqn)
• Fix race condition in agent Traceflow controller when a tag is associated again with a new Traceflow before the old Traceflow deletion event is processed. (#5954, @tnqn)
• Change the maximum flags from 7 to 255 to fix the wrong TCP flags validation issue in Traceflow CRD. (#6050, @gran-vmv)
• Update maximum number of buckets to 700 in OVS group add/insert_bucket message. (#5942, @hongliangl)
• Use 65000 MTU upper bound for interfaces in encap mode in case of large packets being dropped unexpectedly. (#5997, @antoninbas)
• Skip loading openvswitch kernel module if it's already built-in. (#5979, @antoninbas)

Added

• Support Egress using IPs from a subnet that is different from the default Node subnet
  . (#5799, @tnqn)
  • Refer to this document for more information about this feature.
• Add a migration tool to support migrating from other CNIs to Antrea. (#5677, @hjiajing)
  • Refer to this document for more information about this tool.
• Add L7 network flow export support in Antrea that enables exporting network flows with L7 protocol information. (#5218, @tushartathgur)
  • Refer to this document for more information about this feature.
• Add a new feature NodeNetworkPolicy that allows users to apply ClusterNetworkPolicy to Kubernetes Nodes. (#5658 #5716, @hongliangl @Atish-iaf)
  • Refer to this document for more information about this feature.
• Add Antrea flexible IPAM support for the Multicast feature. (#4922, @ceclinux)
• Support Talos clusters to run Antrea as the CNI, and add Talos to the K8s installers document. (#5718 #5766, @antoninbas)
• Support secondary network when the network configuration in NetworkAttachmentDefinition does not include IPAM configuration. (#5762, @jianjuns)
• Add instructions to install Antrea in encap mode in AKS. (#5901, @antoninbas)

Changed

• Change secondary network Pod controller to subscribe to CNIServer events to support bridging and VLAN network. (#5767, @jianjuns)
• Use Antrea IPAM for secondary network support. (#5427, @jianjuns)
• Create different images for antrea-agent and antrea-controller to minimize the overall image size, speeding up the startup of both antrea-agent and antrea-controller. (#5856 #5902 #5903, @jainpulkit22)
• Don't create tunnel interface (antrea-tun0) when using Wireguard encryption mode. (#5885 #5909, @antoninbas)
• Record an event when Egress IP assignment changes for better troubleshooting. (#5765, @jainpulkit22)
• Update Windows documentation with clearer installation guide and instructions. (#5789, @antoninbas)
• Enable IPv4/IPv6 forwarding on demand automatically to eliminate the need for user intervention or dependencies on other components. (#5833, @tnqn)
• Add ability to skip loading kernel modules in antrea-agent to support some specialized distributions (e.g.: Talos). (#5754, @antoninbas)
• Add NetworkPolicy rule name in Traceflow observation. (#5667, @Atish-iaf)
• Use Traceflow API v1beta1 instead of the deprecated API version in antctl traceflow. (#5689, @Atish-iaf)
• Replace net.IP with netip.Addr in FlowExporter which optimizes the memory usage and improves the performance of the FlowExporter. (#5532, @antoninbas)
• Update kubemark from v1.18.4 to v1.29.0 for antrea-agent-simulator. (#5820, @luolanzone)
• Upgrade CNI plugins to v1.4.0. (#5747 #5813, @antoninbas @luolanzone)
• Update the document for Egress feature's options and usage on AWS cloud. (#5436, @tnqn)
• Add Flexible IPAM design details in antrea-ipam.md. (#5339, @gran-vmv)

Fixed

• Fix incorrect MTU configurations for the WireGuard encryption mode and GRE tunnel mode. (#5880 #5926, @hjiajing @tnqn)
• Prioritize L7 NetworkPolicy flows over TrafficControl to avoid a potential issue that a TrafficControl CR with a redirect action to the same Pod could bypass the L7 engine. (#5768, @hongliangl)
• Delete OVS port and flows before releasing Pod IP. (#5788, @tnqn)
• Store NetworkPolicy in filesystem as fallback data source to let antre-agent fallback to use the files if it can't connect to antrea-controller on startup. (#5739, @tnqn)
• Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (#5777, @tnqn)
• Fix Clean-AntreaNetwork.ps1 invocation in Prepare-AntreaAgent.ps1 for containerized OVS on Windows. (#5859, @antoninbas)
• Add missing space to kubelet args in Prepare-Node.ps1 so that kubelet can start successfully on Windows. (#5858, @antoninbas)
• Fix antctl trace-packet command failure which is caused by missing arguments. (#5838, @luolanzone)
• Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (#5795, @tnqn)
• Set net.ipv4.conf.antrea-gw0.arp_announce to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (#5657, @gran-vmv)
• Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). (#5687 #5705, @GraysonWu)
• Add host-local IPAM GC on startup to avoid potential IP leak issue after antrea-agent restart. (#5660, @antoninbas)
• Fix the CrashLookBackOff issue when using the UBI-based image. (#5723, @antoninbas)
• Remove redundant log in fillPodInfo/fillServiceInfo to fix log flood issue, and update DestinationServiceAddress for deny connections. (#5592 #5704, @yuntanghsu)
• Enhance HNS network initialization on Windows to avoid some corner cases. (#5841, @XinShuYang)
• Fix endpoint querier rule index in response to improve troubleshooting. (#5783, @qiyueyao)
• Avoid unnecessary rule reconciliations in FQDN controller. (#5893, @Dyanngg)
• Update Windows OVS download link to remove the invalid certificate preventing unsigned OVS driver installation. (#5839, @XinShuYang)
• Fix IP annotation not working on StatefulSets for Antrea FlexibleIPAM. (#5715, @gran-vmv)
• Add DHCP IP retries in PrepareHNSNetwork to fix potential IP retrieving failure. (#5819, @XinShuYang)
• Revise antctl mc deploy to support Antrea Multi-cluster deployment update when the manifests are changed. (#5257, @luolanzone)

Changed

• Enable IPv4/IPv6 forwarding on demand automatically to eliminate the need for user intervention or dependencies on other components. (#5833, @tnqn)

Fixed

• Store NetworkPolicy in filesystem as fallback data source to let antrea-agent fallback to use the files if it can't connect to antrea-controller on startup. (#5739, @tnqn)
• Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (#5795, @tnqn)
• Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (#5777, @tnqn)
• Fix Clean-AntreaNetwork.ps1 invocation in Prepare-AntreaAgent.ps1 for containerized OVS on Windows. (#5859, @antoninbas)
• Add missing space to kubelet args in Prepare-Node.ps1 so that kubelet can start successfully on Windows. (#5858, @antoninbas)
• Update Windows OVS download link to remove the redundant certificate to fix OVS driver installation failure. (#5839, @XinShuYang)
• Add DHCP IP retries in PrepareHNSNetwork on Windows to fix the potential race condition issue where acquiring a DHCP IP address may fail after CreateHNSNetwork. (#5819, @XinShuYang)
• Fix antctl trace-packet command failure which is caused by arguments missing issue. (#5838, @luolanzone)
• Fix incorrect MTU configurations for the WireGuard encryption mode and GRE tunnel mode. (#5880 #5926, @hjiajing @tnqn)

Fixed

• Update Install-WindowsCNI-Containerd.ps1 script to make it compatible with containerd 1.7. (#5528, @NamanAg30)
• Store NetworkPolicy in filesystem as fallback data source to let antrea-agent fallback to use the files if it can't connect to antrea-controller on startup. (#5739, @tnqn)
• Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (#5795, @tnqn)
• Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (#5777, @tnqn)
• Fix Clean-AntreaNetwork.ps1 invocation in Prepare-AntreaAgent.ps1 for containerized OVS on Windows. (#5859, @antoninbas)
• Fix antctl trace-packet command failure which is caused by arguments missing issue. (#5838, @luolanzone)
• Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). (#5687 #5705, @GraysonWu)
• Set net.ipv4.conf.antrea-gw0.arp_announce to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (#5657, @gran-vmv)
• Add DHCP IP retries in PrepareHNSNetwork on Windows to fix the potential race condition issue where acquiring a DHCP IP address may fail after CreateHNSNetwork. (#5819, @XinShuYang)

Fixed

• Update Install-WindowsCNI-Containerd.ps1 script to make it compatible with containerd 1.7. (#5528, @NamanAg30)
• Store NetworkPolicy in filesystem as fallback data source to let antre-agent fallback to use the files if it can't connect to antrea-controller on startup. (#5739, @tnqn)
• Support Local ExternalTrafficPolicy for Services with ExternalIPs when Antrea proxyAll mode is enabled. (#5795, @tnqn)
• Enable Pod network after realizing initial NetworkPolicies to avoid traffic from/to Pods bypassing NetworkPolicy when antrea-agent restarts. (#5777, @tnqn)
• Fix a deadlock issue in NetworkPolicy Controller which causes a FQDN resolution failure. (#5566 #5583, @Dyanngg @tnqn)
• Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). (#5687 #5705, @GraysonWu)
• Set net.ipv4.conf.antrea-gw0.arp_announce to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (#5657, @gran-vmv)
• Fix antctl tf CLI failure when the Traceflow is using an IPv6 address. (#5588, @Atish-iaf)
• Fix NetworkPolicy span calculation to avoid out-dated data when multiple NetworkPolicies have the same selector. (#5554, @tnqn)
• Fix SSL library downloading failure in Install-OVS.ps1 on Windows. (#5510, @XinShuYang)
• Fix rollback invocation after CmdAdd failure in CNI server. (#5548, @antoninbas)
• Do not apply Egress to traffic destined for ServiceCIDRs to avoid performance issue and unexpected behaviors. (#5495, @tnqn)
• Do not delete IPv6 link-local route in route reconciler to fix cross-Node Pod traffic or Pod-to-external traffic. (#5483, @wenyingd)

Fixed

• Fix the CrashLookBackOff issue when using the UBI-based image. (#5723, @antoninbas)
• Skip enforcement of ingress NetworkPolicies rules for hairpinned Service traffic (Pod accessing itself via a Service). (#5687 #5705, @GraysonWu)
• Set net.ipv4.conf.antrea-gw0.arp_announce to 1 to fix an ARP request leak when a Node or hostNetwork Pod accesses a local Pod and AntreaIPAM is enabled. (#5657, @gran-vmv)

Fixed

• Fix antctl tf CLI failure when the Traceflow is using an IPv6 address. (#5588, @Atish-iaf)
• Fix a deadlock issue in NetworkPolicy Controller which causes a FQDN resolution failure. (#5566 #5583, @Dyanngg @tnqn)
• Fix NetworkPolicy span calculation to avoid out-dated data when multiple NetworkPolicies have the same selector. (#5554, @tnqn)
• Fix SSL library downloading failure in Install-OVS.ps1 on Windows. (#5510, @XinShuYang)
• Fix rollback invocation after CmdAdd failure in CNI server. (#5548, @antoninbas)
• Do not apply Egress to traffic destined for ServiceCIDRs to avoid performance issue and unexpected behaviors. (#5495, @tnqn)
• Do not delete IPv6 link-local route in route reconciler to fix cross-Node Pod traffic or Pod-to-external traffic. (#5483, @wenyingd)

Added

• Add rate-limit config to Egress to specify the rate limit of north-south egress traffic of this Egress. (#5425, @GraysonWu)
• Add IPAllocated and IPAssigned conditions to Egress status to improve Egress visibility. (#5282, @AJPL88 @tnqn)
• Add goroutine stack dump in SupportBundle for both Antrea Agent and Antrea Controller. (#5538, @aniketraj1947)
• Add "X-Load-Balancing-Endpoint-Weight" header to AntreaProxy Service healthcheck. (#5299, @hongliangl)
• Add log rotation configuration in Antrea Agent config for audit logs. (#5337 #5366, @antoninbas @mengdie-song)
• Add GroupMembers API Pagination support to Antrea Go clientset. (#5533, @qiyueyao)
• Add Namespaced Group Membership API for Antrea Controller. (#5380, @qiyueyao)
• Support Pod secondary interfaces on VLAN network. (#5341 #5365 #5279, @jianjuns)
• Enable Windows OVS container to run on pristine host environment, without requiring some dependencies to be installed manually ahead of time. (#5440, @NamanAg30)
• Update Install-WindowsCNI-Containerd.ps1 script to make it compatible with containerd 1.7. (#5528, @NamanAg30)
• Add a new all-in-one manifest for the Multi-cluster leader cluster, and update the Multi-cluster user guide. (#5389 #5531, @luolanzone)
• Clean up auto-generated resources in leader and member clusters when a ClusterSet is deleted, and recreate resources when a member cluster rejoins the ClusterSet. (#5351 #5410, @luolanzone)

Changed

• Multiple APIs are promoted from beta to GA. The corresponding feature gates are removed from Antrea config files.
  • Promote feature gate EndpointSlice to GA. (#5393, @hongliangl)
  • Promote feature gate NodePortLocal to GA. (#5491, @hjiajing)
  • Promote feature gate AntreaProxy to GA, and add an option antreaProxy.enable to allow users to disable this feature. (#5401, @hongliangl)
• Make antrea-controller not tolerate Node unreachable to speed up the failover process. (#5521, @tnqn)
• Improve antctl get featuregates output. (#5314, @cr7258)
• Increase the rate limit setting of PacketInMeter and the size of PacketInQueue. (#5460, @GraysonWu)
• Add hostAliases to Helm values for Flow Aggregator. (#5386, @yuntanghsu)
• Decouple Audit logging from AntreaPolicy feature gate to enable logging for NetworkPolicy when AntreaPolicy is disabled. (#5352, @qiyueyao)
• Change Traceflow CRD validation to webhook validation. (#5230, @shi0rik0)
• Stop using /bin/sh and invoke the binary directly for OVS commands in Antrea Agent. (#5364, @antoninbas)
• Install flows for nested Services in EndpointDNAT only when Antrea Multi-cluster is enabled. (#5411, @hongliangl)
• Make rate-limiting of PacketIn messages configurable; the same rate-limit value applies to each feature that is dependent on PacketIn messages (e.g, Traceflow) but the limit is enforced independently for each feature. (#5450, @GraysonWu)
• Change the default flow's action to drop in ARPSpoofGuardTable to effectively prevent ARP spoofing. (#5378, @hongliangl)
• Remove auto-generated suffix from ConfigMap names, and add config checksums as Deployment annotations in Windows manifests, to avoid stale ConfigMaps when updating Antrea while preserving automatic rolling of Pods. (#5545, @Atish-iaf)
• Add a ClusterSet deletion webhook for the leader cluster to reject ClusterSet deletion if there is any MemberClusterAnnounce. (#5475, @luolanzone)
• Update Go version to v1.21. (#5377, @antoninbas)

Fixed

• Remove the dependency of the MulticastGroup API on the NetworkPolicyStats feature gate, to fix the empty list issue when users run kubectl get multicastgroups even when the Multicast is enabled. (#5367, @ceclinux)
• Fix antctl tf CLI failure when the Traceflow is using an IPv6 address. (#5588, @Atish-iaf)
• Fix a deadlock issue in NetworkPolicy Controller which causes a FQDN resolution failure. (#5566 #5583, @Dyanngg @tnqn)
• Fix NetworkPolicy span calculation to avoid out-dated data when multiple NetworkPolicies have the same selector. (#5554, @tnqn)
• Use the first matching address when getting Node address to find the correct transport interface. (#5529, @xliuxu)
• Fix rollback invocation after CmdAdd failure in CNI server and improve logging. (#5548, @antoninbas)
• Add error log when Antrea network's MTU exceeds Suricata's maximum supported value. (#5408, @hongliangl)
• Do not delete IPv6 link-local route in route reconciler to fix cross-Node Pod traffic or Pod-to-external traffic. (#5483, @wenyingd)
• Do not apply Egress to traffic destined for ServiceCIDRs to avoid performance issue and unexpected behaviors. (#5495, @tnqn)
• Unify TCP and UDP DNS interception flows to fix invalid flow matching for DNS responses. (#5392, @GraysonWu)
• Fix the burst setting of the PacketInQueue to reduce the DNS response delay when a Pod has any FQDN policy applied. (#5456, @tnqn)
• Fix SSL library downloading failure in Install-OVS.ps1 on Windows. (#5510, @XinShuYang)
• Do not attempt to join Windows antrea-agents to the memberlist cluster to avoid misleading error logs. (#5434, @tnqn)
• Fix an issue that antctl proxy is not using the user specified port. (#5435, @tnqn)
• Enable IPv6 on OVS internal port if needed in bridging mode to fix agent crash issue when IPAM is enabled. (#5409, @antoninbas)
• Fix missing protocol in Service when processing ANP named ports to ensure rule can be enforced correctly in OVS. (#5370, @Dyanngg)
• Fix error log when agent fails to connect to K8s API. (#5353, @tnqn)
• Fix a bug that ClusterSet status is not updated in Antrea Multi-cluster. (#5338, @luolanzone)
• Fix an Antrea Controller crash issue in handling empty Pod labels for LabelIdentity when the config enableStretchedNetworkPolicy is enabled for Antrea Multi-cluster. (#5404 #5449, @Dyanngg)
• Always initialize ovs_meter_packet_dropped_count metrics to fix a bug that the metrics are not showing up if OVS Meter is not supported on the system. (#5413, @tnqn)
• Skip starting modules which are not required by VM Agent to fix logs flood due to RBAC warning. (#5391, @mengdie-song)

Fixed

• Fix a deadlock issue in NetworkPolicy Controller which causes a FQDN resolution failure. (#5566 #5583, @Dyanngg @tnqn)
• Fix NetworkPolicy span calculation to avoid out-dated data when multiple NetworkPolicies have the same selector. (#5554, @tnqn)
• Fix SSL library downloading failure in Install-OVS.ps1 on Windows. (#5510, @XinShuYang)
• Fix rollback invocation after CmdAdd failure in CNI server and improve logging. (#5548, @antoninbas)
• Do not apply Egress to traffic destined for ServiceCIDRs to avoid performance issue and unexpected behaviors. (#5495, @tnqn)
• Do not delete IPv6 link-local route in route reconciler to fix cross-Node Pod traffic or Pod-to-external traffic. (#5483, @wenyingd)
• Fix discovered Service CIDR flapping on Agent start. (#5017, @tnqn)

Changed

• Change the default flow's action to drop in ARPSpoofGuardTable to effectively prevent ARP spoofing. (#5378, @hongliangl)
• Stop using /bin/sh and invoke the binary directly for OVS commands in Antrea Agent. (#5364, @antoninbas)
• Increase the rate limit setting of PacketInMeter and the size of PacketInQueue. (#5460, @GraysonWu)
• Revert a change to serve the v1alpha2 version of the ClusterGroup CRD again for the consistent API promotion plan. (#5277, @GraysonWu)
• Upgrade Open vSwitch to 2.17.7. (#5225, @antoninbas)

Fixed

• Fix an Antrea Controller crash issue in handling empty Pod labels for LabelIdentity when the config enableStretchedNetworkPolicy is enabled for Antrea Multi-cluster. (#5404 #5449, @Dyanngg)
• Remove NetworkPolicyStats dependency of MulticastGroup API to fix the empty list issue when users run kubectl get multicastgroups even when the Multicast is enabled. (#5367, @ceclinux)
• Do not attempt to join Windows agents to the memberlist cluster to avoid misleading error logs. (#5434, @tnqn)
• Fix the burst setting of the PacketInQueue to reduce the DNS response delay when a Pod has any FQDN policy applied. (#5456, @tnqn)
• Use OpenFlow group for Network Policy logging to avoid packet drops when massive connections hit the policy. (#5061, @wenyingd)

Changed

• Change the default flow's action to drop in ARPSpoofGuardTable to effectively prevent ARP spoofing. (#5378, @hongliangl)
• Stop using /bin/sh and invoke the binary directly for OVS commands in Antrea Agent. (#5364, @antoninbas)
• Increase the rate limit setting of PacketInMeter and the size of PacketInQueue. (#5460, @GraysonWu)

Fixed

• Fix an Antrea Controller crash issue in handling empty Pod labels for LabelIdentity when the config enableStretchedNetworkPolicy is enabled for Antrea Multi-cluster. (#5404 #5449, @Dyanngg)
• Remove NetworkPolicyStats dependency of MulticastGroup API to fix the empty list issue when users run kubectl get multicastgroups even when the Multicast is enabled. (#5367, @ceclinux)
• Fix a bug that ClusterSet status is not updated in Antrea Multi-cluster. (#5338, @luolanzone)
• Always initialize ovs_meter_packet_dropped_count metrics to fix a bug that the metrics are not showing up if OVS Meter is not supported on the system. (#5413, @tnqn)
• Unify TCP and UDP DNS interception flows to fix invalid flow matching for DNS responses. (#5392, @GraysonWu)
• Fix an issue that antctl proxy is not using the user specified port. (#5435, @tnqn)
• Do not attempt to join Windows agents to the memberlist cluster to avoid misleading error logs. (#5434, @tnqn)
• Fix the burst setting of the PacketInQueue to reduce the DNS response delay when a Pod has any FQDN policy applied. (#5456, @tnqn)

Changed

• Change the default flow's action to drop in ARPSpoofGuardTable to effectively prevent ARP spoofing. (#5378, @hongliangl)
• Stop using /bin/sh and invoke the binary directly for OVS commands in Antrea Agent. (#5364, @antoninbas)
• Increase the rate limit setting of PacketInMeter and the size of PacketInQueue. (#5460, @GraysonWu)
• Upgrade Open vSwitch to 2.17.7. (#5225, @antoninbas)

Fixed

• Fix IPv4 groups containing IPv6 endpoints mistakenly in dual-stack clusters in AntreaProxy implementation. (#5194, @tnqn)
• Fix ClusterClaim webhook bug to avoid ClusterClaim deletion failure. (#5075, @luolanzone)
• Ensure the Egress IP is always correctly advertised to the network, including when the userspace ARP responder is not running or when the Egress IP is temporarily claimed by multiple Nodes. (#5127, @tnqn)
• Fix status report when no-op changes are applied to Antrea-native policies. (#5096, @tnqn)
• Bump up libOpenflow version to fix a PacketIn response parse error. (#5157, @wenyingd)
• Remove NetworkPolicyStats dependency of MulticastGroup API to fix the empty list issue when users run kubectl get multicastgroups even when the Multicast is enabled. (#5367, @ceclinux)
• Fix an Antrea Controller crash issue in handling empty Pod labels for LabelIdentity when the config enableStretchedNetworkPolicy is enabled for Antrea Multi-cluster. (#5404 #5449, @Dyanngg)
• Do not attempt to join Windows agents to the memberlist cluster to avoid misleading error logs. (#5434, @tnqn)
• Fix the burst setting of the PacketInQueue to reduce the DNS response delay when a Pod has any FQDN policy applied. (#5456, @tnqn)

Added

• Add AdminNetworkPolicy support in Antrea to align with K8s NetworkPolicy API, and document the introduction and usage. (#5170 #5270, @Dyanngg)
• Support DSR mode for Service's external addresses in AntreaProxy, including LoadBalancerIPs and ExternalIPs. (#5202 #5251, @tnqn)
• Containerize Windows userspace OVS processes and run them in a container of the Antrea Agent Pod to align with the Linux design. (#4936 #5052 #5303, @rajnkamr @Atish-iaf)
• Add a new option ContainerRuntime to allow users to configure the container runtime while using the script Prepare-Node.ps1 on K8s Windows Node. (#5071, @NamanAg30)
• Add support for TLS, HTTP, and HTTPS protocols for FlowAggregator to connect to the ClickHouse DB, and allow users to specify the CA certificate for TLS and HTTPS. (#5171, @yuntanghsu)
• Enhance Antrea L7 NetworkPolicy to support the TLS protocol. (#4932, @hongliangl)
• Add command antctl upgrade api-storage in antctl to support resource storage version migration for Antrea CRDs. (#5198, @hongliangl)
• Add support for removing the associated stale conntrack entries when UDP Endpoints are removed, with which UDP requests can be redirected to other Endpoints immediately rather than waiting for the conntrack entries to expire. (#5112, @hongliangl)
• Add Egress information to flow records for Pod-to-external flows in FlowExporter. (#5088, @dreamtalen)
• Increase accuracy of Pod information in the flow records by adding a Pod store in FlowExporter and FlowAggregator for them to fetch the Pod information. (#5185, @yuntanghsu)
• Add support for Service annotation service.kubernetes.io/topology-mode in AntreaProxy since the old service.kubernetes.io/topology-aware-hints annotation has been deprecated in Kubernetes 1.27. (#5241, @mengdie-song)
• Support the well-known label service.kubernetes.io/service-proxy-name in AntreaProxy to align with KEP 2447. (#4973, @hongliangl)
• Add a new Prometheus metric to represent the number of packets dropped by OVS meter. (#5165, @mengdie-song)
• Add support for the sort-by flag in more antctl get commands for more fields. (#4346, @jainpulkit22)
• Add the kubeAPIServerOverride option to allow users to override the kube-apiserver address for antrea-controller. (#5056, @tnqn)
• Add documentation for deploying Antrea with a Rancher cluster. (#4733, @jainpulkit22)

Changed

• Multiple APIs are promoted from alpha to beta. The alpha versions are deprecated and will be removed in a future release.
  • Promote ClusterGroup and Group to v1beta1. (#5181, @GraysonWu)
  • Promote ExternalIPPool API to v1beta1. (#5176, @hongliangl)
  • Promote Tier API to v1beta1. (#5172, @GraysonWu)
  • Promote Egress API to v1beta1. (#5180, @wenqiq)
  • Promote AntreaClusterNetworkPolicy and AntreaNativeNetworkPolicy API to v1beta1. (#5186, @GraysonWu)
  • Promote Traceflow API to v1beta1. (#5108, @luolanzone)
  • Add a validation schema for the matchLabels field of the ExternalIPPool CRD. (#5284, @tnqn)
• Enable proxyAll by default for AntreaProxy on Windows because the kube-proxy userspace datapath has been removed since Kubernetes 1.26. (#4980, @XinShuYang)
• Change default port range of NodePortLocal on Windows to 40000-41000 to avoid conflicts with the Windows default dynamic port range. (#5107, @XinShuYang)
• Remove the ClusterClaim CRD and upgrade the ClusterSet CRD version to v1alpha2, and enhance the ClusterSet controller to support ClusterSet version upgrade. (#5001 #5250, @luolanzone)
• Increase the controller QPS setting in Multi-cluster Controller to improve multi-cluster resource export performance, and increase the LabelIdentity controller worker count to improve its performance. (#5099, @GraysonWu)
• Improve direct connections to the Antrea apiserver in antctl with accessibility to Node ExternalIP and add a new --insecure option to support both secure and insecure connections. (#5135, @antoninbas)
• Add two new fields to audit logs, including the "direction" of the NP rule (Ingress or Egress) and the reference of the Pod (<Namespace>/<Name>) to which the NP rule is applied. (#5101, @antoninbas)
• Add a FlowExporter configuration toggle to antrea-agent for users to explicitly enable/disable flow exports. (#5021, @yuntanghsu)
• Add OpenAPI schema for the AntreaAgentInfo and AntreaControllerInfo CRDs. (#5206, @ceclinux)
• Update short-name for AntreaNetworkPolicy to ANNP. (#5081, @qiyueyao)
• Use syscall to query or operate network adapters on Windows to reduce operation delay. (#4898, @wenyingd @qiyueyao)
• Update out-of-date audit logs docs for new log fields. (#5199, @cr7258)
• Switched to structured logging and change verbosity of potentially misleading Info log in the Antrea NetworkPolicy reconciler. (#5048, @antoninbas)
• Revert a change to serve the v1alpha2 version of the ClusterGroup CRD again for the consistent API promotion plan. (#5277, @GraysonWu)
• Upgrade Open vSwitch to version 2.17.7. (#5225, @antoninbas)
• Upgrade Windows Open vSwitch to version 3.0.5. (#5120, @wenyingd)
• Upgrade ClickHouse go client to v2. (#5020, @heanlan)
• Remove Antrea Octant plugin. (#5049, @antoninbas)

Fixed

• Bump up libOpenflow and ofnet library versions to fix a PacketIn2 response parse error. (#5154, @wenyingd)
• Bump up libOpenflow library to v0.12.1 to fix an antrea-agent crash issue when marshaling the IGMPv3 query packet. (#5320, @ceclinux)
• Use OpenFlow group for Network Policy logging to avoid packet drops when massive connections hit the policy. (#5061, @wenyingd)
• Fix an issue in Antrea-native policies with FQDN rules where TCP src port is unset on the TCP DNS response flow. (#5078, @wenyingd)
• Fix status report when no-op changes are applied to Antrea-native policies. (#5096, @tnqn)
• Ensure the Egress IP is always correctly advertised to the network, including when the userspace ARP responder is not running or when the Egress IP is temporarily claimed by multiple Nodes. (#5127, @tnqn)
• Fix incorrect FlowMod message passing in the modifyFlows function of the OpenFlow client to avoid unexpected flow error. (#5125, @Dyanngg)
• Fix a bug that antrea-agent fails to delete the ExternalNode CR when it runs on a RHEL 8.4 VM on Azure cloud. (#5191, @wenyingd)
• Fix IPv4 groups containing IPv6 endpoints mistakenly in dual-stack clusters in AntreaProxy implementation. (#5194, @tnqn)
• Fix RBAC permissions for the Antctl ClusterRole to ensure the ClusterRole definition is up-to-date. (#5166, @antoninbas)
• Fix some code examples in a few documentations. (#5182, @tnqn)
• Add apiVersion and kind for unstructured objects in antctl mc codes to fix a rollback failure. (#5138, @luolanzone)
• Fix a ClusterClaim webhook bug that can lead to ClusterClaim deletion failures. (#5075, @luolanzone)
• Revise "antctl mc deploy" command to fix a Multi-cluster deployment failure on EKS clusters. (#5080, @luolanzone)

Fixed

• Bump up libOpenflow and ofnet versions to fix a PacketIn2 response parse error. (#5154, @wenyingd)
• Fix incorrect FlowMod message passing in the modifyFlows function of the OpenFlow client to avoid unexpected flow error. (#5125, @Dyanngg)
• Ensure the Egress IP is always correctly advertised to the network, including when the userspace ARP responder is not running or when the Egress IP is temporarily claimed by multiple Nodes. (#5127, @tnqn)
• Fix ClusterClaim webhook bug to avoid ClusterClaim deletion failure. (#5075, @luolanzone)
• Fix an issue in ANP with FQDN rules where TCP src port is unset on the TCP DNS response flow. (#5078, @wenyingd)
• Fix status report when no-op changes are applied to Antrea-native policies. (#5096, @tnqn)
• Fix IPv4 groups containing IPv6 endpoints mistakenly in dual-stack clusters in AntreaProxy implementation. (#5194, @tnqn)

Changed

• Update Open vSwitch to 2.17.6. (#4959, @tnqn)
• Bump up whereabouts to v0.6.1. (#4988, @hjiajing)

Fixed

• In Antrea Agent Service CIDR discovery, prevent headless Services from updating the discovered Service CIDR to avoid overwriting the default route of host network unexpectedly. (#5008, @hongliangl)
• Use LOCAL instead of CONTROLLER as the in_port of packet-out messages to fix a Windows agent crash issue. (#4992, @tnqn)
• Fix a bug that a deleted NetworkPolicy is still enforced when a new NetworkPolicy with the same name exists. (#4986, @tnqn)
• Improve Windows cleanup scripts to avoid unexpected failures. (#4722, @wenyingd)
• Fix a race condition between stale controller and ResourceImport reconcilers in Antrea Multi-cluster controller. (#4853, @Dyanngg)
• Make FQDN NetworkPolicy work for upper case FQDNs. (#4934, @GraysonWu)
• Run agent modules that rely on Services access after AntreaProxy is ready to fix a Windows agent crash issue. (#4946, @tnqn)
• Fix the Antrea Agent crash issue which is caused by a concurrency bug in Multicast feature with encap mode. (#4903, @ceclinux)

Changed

• Decrease log verbosity value for antrea-agent specified in the Windows manifest for containerd from 4 to 0. (#4676, @XinShuYang)
• Ensure cni folders are created when starting antrea-agent with containerd on Windows. (#4685, @XinShuYang)
• Document the limit of maximum receiver group number on a Linux Node for multicast. (#4850, @ceclinux)
• Update Open vSwitch to 2.17.6 (#4959, @tnqn)
• Bump up whereabouts to v0.6.1. (#4988, @hjiajing)

Fixed

• Ensure NO_FLOOD is always set for IPsec tunnel ports and TrafficControl ports. (#4419 #4654 #4674, @xliuxu @tnqn)
• Fix Service routes being deleted on Agent startup on Windows. (#4470, @hongliangl)
• Fix route deletion for Service ClusterIP and LoadBalancerIP when AntreaProxy is enabled. (#4711, @tnqn)
• Fix OpenFlow Group being reused with wrong type because groupDb cache was not cleaned up. (#4592, @ceclinux)
• Fix antctl not being able to talk with GCP kube-apiserver due to missing platforms specific imports. (#4494, @luolanzone)
• Fix Agent crash in dual-stack clusters when any Node is not configured with an IP address for each address family. (#4480, @hongliangl)
• Fix Service not being updated correctly when stickyMaxAgeSeconds or InternalTrafficPolicy is updated. (#4845, @tnqn)
• Fix the Antrea Agent crash issue when large amount of multicast receivers with different multicast IPs on one Node start together. (#4870, @ceclinux)
• Fix the Antrea Agent crash issue which is caused by a concurrency bug in Multicast feature with encap mode. (#4903, @ceclinux)
• Fix the Antrea Agent crash issue on Windows by running modules that rely on Services after AntreaProxy is ready. (#4946, @tnqn)
• Make FQDN NetworkPolicy work for upper case DNS. (#4934, @GraysonWu)
• Fix a bug that a deleted NetworkPolicy is still enforced when a new NetworkPolicy with the same name exists. (#4986, @tnqn)
• Fix a race condition between stale controller and ResourceImport reconcilers in Antrea Multi-cluster controller. (#4853, @Dyanngg)
• Recover ovsdb-server and ovs-vswitched service if they do not exist when running the Windows cleanup script. (#4722, @wenyingd)

The Multicast, TopologyAwareHints, and NodeIPAM features are graduated from Alpha to Beta. The TopologyAwareHints, NodeIPAM features are enabled by default. Multicast can be enabled with a new Antrea Agent configuration parameter: multicast.enable.

Added

• Add two new fields sourcePort and sourceEndPort in Antrea-native policy API to match traffic initiated from specific ports. (#4687, @Dyanngg)
• Add a new field logLabel to Antrea-native policy CRDs; the user-provided label is added to audit logs. (#4748, @qiyueyao)
• Add Antrea Controller API for querying Antrea Groups and ClusterGroups by IP addresses. (#4807, @Dyanngg)
• Add a new Antrea Controller configuration clientCAFile to allow user to specify client CA. (#4664, @wenyingd)
• Add support for ExternalIP in AntreaProxy to allow a Service to be accessed from outside the cluster using an external IP address. (#4866, @hongliangl)
• Add WireGuard tunnel mode for Antrea Multi-cluster to support encryption of the traffic between member clusters. (#4737 #4606 #4848, @hjiajing)
  • Refer to Antrea Multi-cluster user guide for more informantion about this feature.
• Add support for EndpointSlice API for Multi-cluster Services. When the EndpointSlice API is available for the cluster, EndpointSlice resources of the exported Service, rather than the Endpoints resource, will be processed. (#4895, @luolanzone)
• Add a new exporter to FlowAggregator to write flows to a local file. (#4855, @antoninbas)
• Add openEuler 22.03 as a new supported OS of Antrea, and update the Kubernetes installer document with the information. (#4957, @ceclinux)

Changed

• Deprecate Antrea Octant Plugin; it is replaced by a dedicated Antrea UI. (#4825, @antoninbas)
• Update Open vSwitch version to 2.17.6. (#4959, @tnqn)
• Update Windows OVS version to 2.16.7. (#4705, @XinShuYang)
• Add status.egressIP field for Egress to represent the effective Egress IP. (#4603, @tnqn)
• Add a new Failed phase in ANP status for the case when all Agents have reported the status and at least one failure is received. (#4608, @wenyingd)
• Check the existence of AntreaAgentInfo CRD before operating on it for worker Node or ExternalNode. (#4762, @wenyingd)
• Stop serving v1alpha2 version of the ClusterGroup CRD. (#4812, @antoninbas)
• Optimize the cached flows in Antrea Agent to reduce Agent memory usage. (#4495, @wenyingd)
• Replace PacketIn/Controller with PacketIn2/Controller2 to improve packetin handler. (#4768, @GraysonWu)
• Change to look up Pods by name instead of IP address to fetch labels in Flow Aggregator, to avoid obtaining incorrect Pods when Pod turnover is high. (#4942, @dreamtalen)
• Do not export Services of type ExternalName in Antrea Multi-cluster; this is consistent with the upstream Multi-cluster Service KEP. (#4814, @luolanzone)
• Update Multi-cluster user guide to provide more details for Gateway enablement. (#4889, @luolanzone)
• Update documentation for recent MetalLB versions. (#4803, @antoninbas)
• Add support for short-circuiting in AntreaProxy to ensure that the traffic from Pod/Node clients to
  external addresses behaves the same way as the traffic from external clients to external addresses. (#4815, @hongliangl)
• Add OVS table name as label for ovs_flow_count Prometheus metrics. (#4893, @cr7258)
• Make IGMP query versions configurable for Antrea Multicast. (#4876, @ceclinux)
• Document the limit of maximum receiver group number on a Linux Node for Antrea Multicast. (#4850, @ceclinux)
• Upgrade K8s libraries to v0.26.4. (#4935, @heanlan)
• Bump up whereabouts to v0.6.1. (#4988, @hjiajing)

Fixed

• Unify AntreaProxy behavior across Linux and Windows. Windows agents now configure only a single route for all Service ClusterIPs and can restore routes after they are deleted by accident. (#3889, @hongliangl)
• Use LOCAL instead of CONTROLLER as the in_port of packet-out messages to fix a Windows agent crash issue. (#4992, @tnqn)
• Run agent modules that rely on Services access after AntreaProxy is ready to fix a Windows agent crash issue. (#4946, @tnqn)
• Improve Windows cleanup scripts to avoid unexpected failures. (#4722 #5013, @wenyingd)
• Fix a bug that a deleted NetworkPolicy is still enforced when a new NetworkPolicy with the same name exists. (#4986, @tnqn)
• Make FQDN NetworkPolicy work for upper case FQDNs. (#4934, @GraysonWu)
• Fix a bug that K8s Networkpolicy audit logging doesn't work for Service access. (#4780, @qiyueyao)
• Fix Service not being updated correctly when stickyMaxAgeSeconds or InternalTrafficPolicy is updated. (#4845, @tnqn)
• Fix EndpointSlice API availablility check to resolve the issue that AntreaProxy always falls back to the Endpoints API when EndpointSlice is enabled. (#4852, @tnqn)
• In Antrea Agent Service CIDR discovery, prevent headless Services from updating the discovered Service CIDR to avoid overwriting the default route of host network unexpectedly. (#5008, @hongliangl)
• Fix the Antrea Agent crash issue when a large amount of multicast receivers with different multicast IPs on one Node start together. (#4870, @ceclinux)
• Fix the Antrea Agent crash issue which is caused by a concurrency bug in Multicast feature with encap mode. (#4903, @ceclinux)
• Use a random port when the UDP source port in a Traceflow is 0. (#4963, @gran-vmv)
• Set default flag to 2 for TCP Traceflow to fix a Traceflow timeout issue when the flag is not provided. (#4948, @luolanzone)
• Fix concurrent map write bug for LabelIdentity controller in Antrea Multi-cluster. (#4994, @Dyanngg)
• Fix a race condition between stale controller and ResourceImport reconcilers in Antrea Multi-cluster controller. (#4853, @Dyanngg)
• Bump up Suricata to 6.0.12 to fix a L7 NetworkPolicy issue. (#4968, @xliuxu)
• Fix discovered Service CIDR flapping on Agent start. (#5017, @tnqn)