LoginSign Up
← Back to all sparks
A

Antrea

INFRA · APIS
Velocity6.3

Kubernetes-native networking and security solution built on Open vSwitch

antrea.io ↗

Antrea turned on gossip encryption by default and made users read the upgrade guide first.

kubernetes-cniencryption-by-defaultflow-visibilitymulti-clustercrdbackports
◆Current state
Antrea shipped v2.7.0 on August 15 alongside same-day 2.5.3 and 2.6.3 backports, continuing the four-branch maintenance pattern it has held all year. The minor release is the substantial one: Agent memberlist gossip is now authenticated and encrypted by default, an AntreaNodeConfig CRD lets operators define secondary OVS bridges and physical interfaces per node pool, and the Flow Aggregator gains a FlowStreamService plus end-to-end External-to-Pod flow export that preserves the original external source IP. The Go module path moved to antrea.io/antrea/v2.
◆Where it's heading
Two arcs are running at once. Security defaults are tightening in ways that require operator action rather than just landing quietly — encrypted gossip with a documented rolling-update procedure, Multi-cluster member tokens bound to a ClusterID with the shared default token removed, antctl no longer forwarding caller credentials to Agents. In parallel, flow visibility is being built out as a product surface of its own: a streaming service, ring-buffer exporters, ClusterNetworkPolicy attribution in flow records, and NodePortLocal external client IPs. The dependency sweep underneath, including OVS 3.7.1 and a libovsdb swap to antrea-io forks, reads as a deliberate reduction of unmaintained upstreams.
◆Prediction
Expect 2.7.1 and further 2.5.x/2.6.x backports within weeks, carrying the same #8251 hardening set that the two same-day patch releases already shipped. The upgrade-disruption warning on gossip encryption is the kind of note that usually generates a follow-up fix.

◆Recent moves

  1. 3d ago

    v2.5 backport of the #8251 security hardening set

    The v2.5 branch receives the same #8251 hardening batch as v2.6.3 hours earlier: antctl authenticating with a short-lived ServiceAccount token instead of forwarding caller credentials, authorization checks on SupportBundleCollection and PacketCapture secrets, and a controller crash from cyclic ChildGroups. Also carries the host-local IPAM garbage collector releasing in-use Pod IPs — a real outage class on older branches.

    View source ↗
  2. 4d ago

    v2.6 backport: antctl token auth and IPAM GC fix

    Near-identical to the v2.5.3 release published nine hours later — the same coordinated security batch and datapath convergence fixes, applied to the v2.6 branch. Antrea keeps four branches supported and moves this class of fix across all of them in one pass.

    View source ↗
  3. 4d ago

    Agent gossip encrypted by default; AntreaNodeConfig CRD

    ⚡ SPARK

    The release that changes what Antrea assumes about its own cluster: gossip traffic between Agents is authenticated and encrypted by default, closing the path by which an unauthorized host could influence Egress and ServiceExternalIP ownership. Around that sit a new AntreaNodeConfig CRD for per-node-pool bridge and interface configuration, a FlowStreamService, and a Go module path break to antrea.io/antrea/v2.

    View source ↗
  4. 2mo ago

    Dependency migration release: UUID, YAML, and AWS SDK swaps

    A dependency-only release on the v2.6 branch, and in hindsight the start of the sweep that v2.7.0 completes — unmaintained upstreams being replaced ahead of the minor release rather than during it.

    View source ↗
  5. 4mo ago

    Controller panic on Nodes without IPs, CNI plugin CVE fix

    A patch release pairing a controller panic on Nodes without IPs with a CNI plugin CVE update. Representative of what the maintenance branches carried before the August security batch.

    View source ↗
  6. 4mo ago

    v2.4 backport: IPv6 over IPv4 IPsec, tunnel port fix, CVE updates

    The v2.4 branch getting IPv6-over-IPv4 IPsec support plus a tunnel port fix — evidence that Antrea backports capability, not only security, to its older supported branches.

    View source ↗