Summary
v2.11.0 adds an experimental nftables backend for network policies and BFD support for external BGP peers. It also contains bug and security fixes for the Network Routes Controller (BGP password logging leak) and Network Services Controller (dual-stack NodePort programming), and behavior changes around CNI config loading and MTU autodetection.
User-facing changes:
- Experimental nftables backend for network policies - new
--use-nftables-for-netpolflag to have the Network Policy Controller use nftables instead of iptables. Please review the docs (https://github.com/cloudnativelabs/kube-router/blob/master/docs/nftables.md) for instructions on how to enable this feature. - BFD for BGP external peers - BFD is now available for external BGP peers. Please review the docs (https://github.com/cloudnativelabs/kube-router/blob/master/docs/bgp.md) for the new CLI flags and configurations required to enable BFD.
- kube-router no longer exits on startup if node MTU can't be autodetected - previously, kube-router would terminate if node MTU cannot be autodetected. Now, it logs an error and leaves the CNI configuration for the bridge interface without an explicit MTU.
- kube-router now rejects stray positional CLI arguments - kube-router will exit and log errors for unrecognized flags instead of silently handling them
- Dual-stack services now program IPv6 NodePorts - services now appropriately get their IPv6 NodePort programmed
Notable maintenance changes:
- Go - 1.26.3 -> 1.26.6
- Kubernetes client libraries - v0.36.1 -> v0.36.3
- GoBGP - v4.5.0 -> v4.8.0
Contributions
Thanks to @thomasferrandiz and @twz123 for their contributions to this release!
Changelog
- ecbb2c85 - chore(deps): Bump GoBGP version in go.mod to match GoBGP binary
- ccb07696 - Prep v2.11.0 release (#2139)
- chore(setup-go): Update setup-go from v6.4.0 -> v6.5.0
- chore(ci-container.yml): Update setup-qemu-action v4.1.0 -> v4.2.0
- chore(ci-container.yml): Update login-action from v4.2.0 -> v4.6.0
- chore(ci-container.yml): Update build-push-action from v7.2.0 -> v7.3.0
- chore(ci-e2e-netpol.yml): Update build time base image golang:1.26.3-alpine3.23 -> golang:1.26.6-alpine3.24
- chore(ci-e2e-netpol.yml): Update runtime base image alpine:3.23.4 -> alpine:3.23.5
- chore(ci-e2e-netpol.yml): Update go version 1.26.3 -> 1.26.6
- chore(ci-e2e-netpol.yml): Update kind node image v1.32.2 -> v1.36.1
- chore(ci-e2e-netpol.yml): Bump setup-go v6.4.0 -> v6.5.0
- chore(ci-e2e-netpol.yml): Bump build-push-action v7.0.0 -> v7.3.0
- chore(ci-release.yml): Bump v4.1.1 -> v4.2.2
- chore(ci-e2e-netpol.yml): Bump Kind v0.27.0 -> v0.32.0
- chore(ci.yml): Update buildtime base image golang:1.26.3-alpine3.23 -> golang:1.26.6-alpine3.24
- chore(ci.yml): Update runtime base image alpine:3.23.4 -> alpine:3.23.5
- chore(ci.yml): Bump go version 1.26.3 -> 1.26.6
- chore(close_stale.yml): Bump stale action v10.3.0 -> v10.4.0
- chore(codeql-analysis.yml): Bump codeql-action init v4.36.2 -> v4.37.7
- chore(codeql-analysis): Update codeql-action autobuild v4.36.2 -> v4.37.7
- chore(codeql-analysis.yml): Upgrade codeql-action analyze action v4.36.2 -> v.37.7
- chore(scorecard.yml): Bump codeql-action upload-sarif v4.36.2 -> v4.37.7
- chore(Dockerfile): Bump buildtime base golang:1-alpine sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d -> sha256:70b46548e42db77e0966aaf3619fd068734dc6c77584d526b91126504fd95816
- chore(Dockerfile): Bump runtime base alpine:latest sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 -> sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
- chore(Makefile): Bump docker build image golang 1.26.3-alpine3.23 -> 1.26.6-alpine3.24
- chore(Makefile): Bump runtime base alpine 3.23.4 -> 3.23.5
- chore(Makefile): Bump doctoc image node:alpine 7c6af15abe4e3de859690e7db171d0d711bf37d27528eddfe625b2fe89e097f8 -> aadf416b2cdce311a8811ba3f0608a61b77dbf997500e2eafe781b51f6a0b019
- chore(Makefile): Bump doctoc version 2.4.1 -> 2.5.0
- chore(Makefile): Bump typos version v1.46.3 -> v1.49.0
- chore(Makefile): Bump gobgp version v4.7.0 -> v4.8.0
- chore(Makefile): Bump goreleaser v2.16.0 -> v2.17.1
- chore(Makefile): Bump grype v0.112.0 -> v0.117.0
- chore(dependency-updater): Bump alpine version
- chore(ci-e2e-netpol.yml): Bump runtime base alpine 3.23.5 -> 3.24.1
- chore(ci.yml): Bump runtime base alpine 3.23.5 -> 3.24.1
- chore(Makefile): Bump runtime base alpine from 3.23.5 -> 3.24.1
- chore(Makefile): Fix grype sha256
- b8ace674 - feat: Add additional test for peer config
- a692257b - feat(nrc): Add more tests related to BFD validation from YAML unmarshalling and remove redundant validate check
- ed2f8857 - fix: Address more PR comments related to BFD configs and validation
- a40cbcf9 - fix: Address comments related to milliseconds and use microseconds instead
- 755974a6 - feat(nrc): Implement BFD support
- f741fe42 - fix(NRC): remove potential bgp secrets leak <Aaron U'Ren>
- 8f679a95 - fix(codeql-analysis): pin GitHub write perms to job <Aaron U'Ren>
- dda3c151 - fix(ci-e2e-netpol): pin setup-go by SHA <Aaron U'Ren>
- 9b729cfd - fact(kube-router.go): remove stale flag glog workaround <Aaron U'Ren>
- 3f905b52 - fact: pass informers to controllers via interfaces <Aaron U'Ren>
- 18a0b7af - fix(NSC): program v6 NodePort for dual-stack services <Aaron U'Ren>
- ca99eb35 - fact(NRC): derive context from stopCh in Run() <Aaron U'Ren>
- 373e34e2 - fact(NSC): replace IfaceNotFound with errors.AsType <Aaron U'Ren>
- 2e8b7d6b - fact(NRC): extract setKubeBridgeMTU, fix IPv6 comment <Aaron U'Ren>
- 0588b3b9 - fix(kube-router.go): fail on unrecognized positional args <Aaron U'Ren>
- 645d659f - fix(ci-e2e-netpol): bug introduced in 63fb00c <Aaron U'Ren>
- 3225cc3f - build(deps): bump github.com/onsi/gomega from 1.38.3 to 1.42.1 <dependabot[bot]>
- d59e85f6 - build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 <dependabot[bot]>
- 136943f3 - build(deps): bump the k8s-dependencies group across 1 directory with 4 updates <dependabot[bot]>
- 0a34cbf0 - build(deps): bump sigs.k8s.io/knftables from 0.0.20 to 0.0.22 <dependabot[bot]>
- b8a6447b - build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 <dependabot[bot]>
- bdcea684 - build(deps): bump actions/checkout from 6.0.2 to 7.0.1 <dependabot[bot]>
- 651e4ef1 - build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.2.0 <dependabot[bot]>
- dde22778 - doc(developing.md): document testing levels and ci entry points <Aaron U'Ren>
- 483c5b82 - doc(e2e-netpol.sh): document env knobs and iterate workflow <Aaron U'Ren>
- e3096fb4 - feat(Makefile): add test-all aggregate target <Aaron U'Ren>
- 74db5fbc - feat(e2e-netpol.sh): add refresh subcommand for iterating <Aaron U'Ren>
- 48e0441e - feat(e2e-netpol.sh): skip kind install when already present <Aaron U'Ren>
- b5e31851 - feat(e2e): switch runner to ginkgo cli for parallel and focused runs <Aaron U'Ren>
- c2d04b90 - fix(test): allow test-integration to run in container <Aaron U'Ren>
- 79ef16b4 - fix(NPC): ensure proper handling of protocol only rules <Aaron U'Ren>
- 63fb00c6 - test(e2e-netpol): for regressions <Aaron U'Ren>
- 703c8435 - fix(NPC): ensure comments don't exceed max len <Aaron U'Ren>
- f9614d92 - fix(NPC): reorder nftables GC to stop pod firewall chain leak <Aaron U'Ren>
- 061fa21c - fix(NPC): create nftables top level chains without flushing on startup <Aaron U'Ren>
- d0933e64 - fact(NPC): remove dead nftables chain helpers, dedupe accept rule <Aaron U'Ren>
- 8dc89b4e - feat: implement nftables-only mode for NetworkPolicyController
- 50f0cca8 - build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 <dependabot[bot]>
- 08d45e64 - build(deps): bump github.com/aws/aws-sdk-go-v2/config <dependabot[bot]>
- 597b2233 - build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 <dependabot[bot]>
- 61245d03 - fix(NRC): Handle kube-bridge setup failures safely
- f4d37f9d - chore(NRC): Use netlink's LinkNotFoundError
- b694e302 - chore(NRC): Move the kube-bridge setup into its own method
- 9f766c72 - Read and write CNI file only once
- 8e06b803 - Export cniNetworkConfig
- 8d38e5d9 - Don't export cniNetworkConfig struct fields
- 398bb548 - Move the go directive to the top of go.mod
- 500a1a52 - fix(Makefile): add cni-download to PHONY to stop arch caching <Aaron U'Ren>
- 337e03b3 - feat(Dockerfile): add defense check to ensure arch matches <Aaron U'Ren>
- 40bb225e - feat(build): don't emulate go build on qemu <Aaron U'Ren>
- b1a452fc - fix(.goreleaser.yml): pin checksum file name for SLSA provenance <Aaron U'Ren>
- fb242795 - Remove dead error checks
- 384187ca - build(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 <dependabot[bot]>
- 9995d7df - build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 <dependabot[bot]>
- 4ef6c3e6 - build(deps): bump actions/attest from 4.1.0 to 4.1.1 <dependabot[bot]>
- 063066ba - build(deps): bump github.com/aws/aws-sdk-go-v2/config <dependabot[bot]>
- a6ffb5cb - build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 <dependabot[bot]>
- 0d40f1e1 - build(deps): bump github.com/moby/moby/client from 0.4.1 to 0.5.0 <dependabot[bot]>
- b7317a0f - build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 <dependabot[bot]>
- a9331d00 - build(deps): bump actions/checkout from 6.0.2 to 7.0.0 <dependabot[bot]>
- c5addb48 - build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds <dependabot[bot]>
- 2f035299 - build(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 <dependabot[bot]>
- 741f943d - build(deps): bump the k8s-dependencies group with 4 updates <dependabot[bot]>
- f8fed37d - build(deps): bump github.com/ccoveille/go-safecast/v2 <dependabot[bot]>
- 438f1d2e - build(deps): bump github.com/aws/aws-sdk-go-v2/config <dependabot[bot]>
- 7a7e2e8c - build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds <dependabot[bot]>
- 8de1c5b0 - build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 <dependabot[bot]>