Kube-OVN v1.17.0 is the first release of the v1.17 minor line. It upgrades the networking stack, adds service-scoped load balancing and VPC egress capabilities, modernizes kubectl-ko, and includes reliability, security, and dependency updates.
⚠️ Breaking changes
- ClusterNetworkPolicy API: CNP is promoted to
v1beta1withnetwork-policy-apiv0.3.0. Existing CNP manifests using the oldportsfield must be converted toprotocolsbefore upgrading. The release does not automatically migrate stored objects or provide legacy-format compatibility. (#7892) - Pod VIP allocation:
ovn.kubernetes.io/vipis no longer used to assign fixed Pod IPs, and thekube_host_vm_vipVIP type is removed. Remove or migrate these resources before upgrading; use IPPool or the supported static IP annotations instead. (#7721) - VPC NAT Gateway Service DNAT:
--enable-nftable-lb-svcis replaced by--enable-gw-nftable-lb-svcand--enable-gw-nftable-svc-cluster-ip, both defaulting tofalse, with no compatibility alias.IptablesDnatRuleobjects withtype: shareare now controller-owned Service accounting records and cannot be created or managed manually. (#7451) - Node external gateway: automatic node external gateway namespace, OVS port, route, BFD, and cleanup reconciliation has been removed. Existing deployments that depend on this path must use the supported VPC external gateway or VPC Egress Gateway paths. (#7670)
- OVN/OVS load-balancer behavior: OVN/OVS are upgraded to 26.03/3.7. The obsolete
EnableOVNLBPreferLocalconfiguration andprefer_local_backendoption writer are removed; review load-balancer locality settings during upgrade. (#7357)
Highlights
- Upgrade OVN to 26.03 and OVS to 3.7, with regenerated database models and refreshed Kube-OVN patches. (#7357)
- Add service-scoped OVN load balancers for ClusterIP and LoadBalancer Services, including ClientIP session affinity,
internalTrafficPolicy, traffic distribution, and EndpointSlice node/zone hints. (#7378, #7457) - Add nftables share-DNAT Service support in VPC NAT Gateway for LoadBalancer and ClusterIP Services. (#7451)
- Add primary-CNI egress support, dynamic VPC Egress Gateway features, explicit BGP next hops, and fixed-count IPPool allocation. (#7824, #7425, #7834, #7702)
- Add CNP conformance support, named ports for ANP/BANP/CNP, and improved policy selector and priority handling. (#7820, #7807)
- Rewrite
kubectl-koas a cross-platform Go CLI with an independent node agent. Add workload-styleexec, native packet diagnostics, and packet capture across VM/VMI live migration. (#7606, #7636, #7639) - Add YAML configuration for BGP speaker parameters, configurable Geneve TX offload, optional bundled CNI plugin installation, optional periodic CNI recomputation, and externally managed webhook certificates. (#6933, #7873, #7694, #7714, #7727)
Reliability and security
- Rebuild corrupted or invalid OVN database members from Raft headers or the live Raft cluster. (#7871, #7888)
- Use atomic OVS operations, serialize ProviderNetwork cleanup, preserve policy and security-group state, and improve load-balancer and gateway reconciliation. (#7865, #7880, #7875, #7884)
- Separate CNI execution, node IPsec, and scheduling privileges, and run service load-balancer gateways without root privileges. (#7593, #7598, #7876)
- Update Kubernetes, Go, Multus, MetalLB, cert-manager, cryptography, and other dependencies; refresh CI security scanning and bundled license handling.