Antrea vs Kestra

Antrea shipped v2.7.0 on August 15 alongside same-day 2.5.3 and 2.6.3 backports, continuing the four-branch maintenance pattern it has held all year. The minor release is the substantial one: Agent memberlist gossip is now authenticated and encrypted by default, an AntreaNodeConfig CRD lets operators define secondary OVS bridges and physical interfaces per node pool, and the Flow Aggregator gains a FlowStreamService plus end-to-end External-to-Pod flow export that preserves the original external source IP. The Go module path moved to antrea.io/antrea/v2.

Two arcs are running at once. Security defaults are tightening in ways that require operator action rather than just landing quietly — encrypted gossip with a documented rolling-update procedure, Multi-cluster member tokens bound to a ClusterID with the shared default token removed, antctl no longer forwarding caller credentials to Agents. In parallel, flow visibility is being built out as a product surface of its own: a streaming service, ring-buffer exporters, ClusterNetworkPolicy attribution in flow records, and NodePortLocal external client IPs. The dependency sweep underneath, including OVS 3.7.1 and a libovsdb swap to antrea-io forks, reads as a deliberate reduction of unmaintained upstreams.

Expect 2.7.1 and further 2.5.x/2.6.x backports within weeks, carrying the same #8251 hardening set that the two same-day patch releases already shipped. The upgrade-disruption warning on gossip encryption is the kind of note that usually generates a follow-up fix.