LoginSign Up
← Back to all sparks
A

Antrea

INFRA · APIS
Velocity0.0

Kubernetes-native networking and security solution built on Open vSwitch

antrea.io ↗

Kubernetes CNI maintaining four release branches at once, mostly to carry CVE fixes back.

kubernetescninetworkingwireguardobservability
◆Current state
Antrea is an OVS-based Kubernetes CNI, and its release pattern is three or four live branches receiving the same fixes in parallel — v2.4.5, v2.5.1, v2.5.2, and the v2.6.x line all appear in this window, with identical entries for IPv6-over-IPv4 IPsec and CNI plugin CVE updates backported across them. The one feature release, v2.6.0, extended encryption coverage so Traceflow and Egress work with WireGuard enabled, added IPv6 and dual-stack NodePortLocal, and introduced FlowExporterDestination CRDs.
◆Where it's heading
Two arcs run in parallel. The feature arc is closing gaps where Antrea's own capabilities did not compose — encryption plus Egress, encryption plus Traceflow, dual-stack plus NodePortLocal were each combinations that previously did not work together. The maintenance arc is dependency hygiene: forking unmaintained libraries under the Antrea org, dropping abandoned dependencies outright, and tracking Kubernetes releases.
◆Prediction
Expect the composability work to continue closing feature-interaction gaps, and the backport discipline to keep every supported branch receiving CVE updates within days of each other.

◆Recent moves

  1. 1mo ago

    Dependency migration release: UUID, YAML, and AWS SDK swaps

    Almost entirely dependency work — migrating UUID and YAML libraries, moving unmaintained dependencies to Antrea forks, dropping abandoned packages, and tracking Kubernetes 1.36.1. Necessary hygiene with no operator-visible behavior change.

    View source ↗
  2. 4mo ago

    Controller panic on Nodes without IPs, CNI plugin CVE fix

    Fixes an Antrea Controller panic for Nodes without IPs and clamps negative IPFIX delta counts instead of wrapping them, which had been corrupting flow export data. Carries the CNI plugins 1.9.1 CVE update that all supported branches received.

    View source ↗
  3. 4mo ago

    v2.4 backport: IPv6 over IPv4 IPsec, tunnel port fix, CVE updates

    The v2.4 branch receiving the same fix set as v2.5.2 published minutes apart — TunnelPort being ignored, IPv6 over IPv4 IPsec, an agent crash from concurrent FQDN cache access, and three CVE-driven dependency updates. Evidence of a disciplined backport process rather than separate work.

    View source ↗
  4. 4mo ago

    v2.5 backport with a hybrid-mode stale Pod CIDR fix

    The v2.5 counterpart to the v2.4.5 release, carrying the same tunnel and IPsec fixes plus one specific to this branch: stale cached nftables state preventing OVS flows and routes from installing when a new Node reused a Pod CIDR. That failure mode is exactly the kind that presents as an unexplained networking outage.

    View source ↗
  5. 4mo ago

    WireGuard now works with Egress and Traceflow; dual-stack NodePortLocal

    The feature release in this window, and its theme is composability — Egress and Traceflow now function with WireGuard encryption enabled, and NodePortLocal gains IPv6 and dual-stack support. FlowExporterDestination CRDs let flow export targets be reconfigured without restarting Agents, which removes a disruptive step from observability changes.

    View source ↗
  6. 7mo ago

    Agent nil-pointer crash without AntreaProxy; flow-aggregator certificate conflicts

    Fixes an agent crash when AntreaProxy is disabled and stops multi-replica flow-aggregator deployments from generating conflicting self-signed certificates. Both are configuration paths that only fail once someone runs Antrea outside the default setup.

    View source ↗