Warning
This release changes the Network Policy Agent events eBPF binary.
When the agent starts with a changed events binary, it reinstalls the node's global eBPF maps, including the conntrack map, with default (empty) state. Connection-tracking entries for connections opened before the upgrade are lost. Return traffic for those in-flight connections can be dropped on pods with network policies applied, unless policy explicitly allows that return traffic. New connections are not affected.
This applies to any upgrade path that crosses this release, including upgrades that skip versions (for example, upgrading from a version earlier than this one to a later version).
Recommendation: Upgrade during a maintenance window, or roll nodes gradually, and make sure your applications retry dropped connections.
What's Changed
- conntrack: summarize stale-entry cleanup logging to cut log noise by @yash97 in #622
- build: bump Go to 1.26.9 and golang.org/x/net to v0.60.0 by @Pavani-Panakanti in #701
- build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.65.0 to 1.89.3 by @dependabot in #695
- ci: fix test image registry for nightly, cyclonus, performance and BPF cleanup check by @Pavani-Panakanti in #702
- build(deps): bump k8s.io modules to v0.37.1 and controller-runtime to v0.25.2 by @Pavani-Panakanti in #703
- build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot in #693
- Check for a detached eBPF context before cleanup branches by @Pavani-Panakanti in #692
- build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot in #641
- Run the full integration suite by default by @emilyhuaa in #706
- fix(ebpf): measure BulkRefreshMapEntries latency after the refresh by @mloiseleur in #689
- fix(ebpf): allow IPv6 MLD carried behind a Hop-by-Hop header by @emilyhuaa in #696
- fix(ebpf): serialize podIdentifier state so rule writes reach the attached program (#676) by @Pavani-Panakanti in #705
- fix(utils): IPv4 conversion for uint32 values whose trailing octets are zero (#714) by @ishani-das in #718
- (npa) fix memory leak with stale/deleted pods in Pod Identifier to PE map by @jaydeokar in #627
- perf(controllers): cut PolicyEndpoint reconcile cost (no deep copies, sorted pod identifier lists) by @zac-nixon in #724
- Shorten the kernel conntrack entry of denied TCP SYNs by @aaithal in #704
- test: use an in-cluster server in the dots-in-pod-name policy test by @Pavani-Panakanti in #739
- Handle failures for cleanup pods and retry by @jaydeokar in #726
- build(deps): bump k8s.io/api from 0.37.1 to 0.37.2 by @dependabot in #734
- fix(ebpf): roll back programs a failed attach loaded by @Pavani-Panakanti in #715
- build(deps): bump github.com/samber/lo from 1.52.0 to 1.53.0 by @dependabot in #735
- build(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.317.0 to 1.343.0 by @dependabot in #736
- build(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.37.0-rc.1 by @dependabot in #737
- utils: match EEXIST by errno in IsFileExistsError by @aaithal in #747
- fix: retry failed eBPF policy programming (#686) by @haouc in #710
- test: cover node-to-pod traffic under deny-all NP and CNP by @Pavani-Panakanti in #750
- fix: tighten host veth lookup by @haouc in #727
- Bump golang.org/x/net from 0.60.0 to 0.62.0 by @Issacwww in #758
- conntrack: add tests pinning the GC's keep and delete behavior by @aaithal in #755
- test(cyclonus): tolerate transient kubectl failures while polling the cyclonus job by @cdirubbio in #779
New Contributors
- @mloiseleur made their first contribution in #689
- @ishani-das made their first contribution in #718
- @aaithal made their first contribution in #704
Full Changelog: v1.4.3...v1.5.0