Kube-OVN v1.17.1 is the first patch release for the v1.17 maintenance line. It improves IPsec cleanup and pod policy reconciliation, reduces default privileges, and updates Go dependencies.
⚠️ Breaking changes
- Default behavior change: direct logical-port traffic no longer skips conntrack by default. The controller flag
--ls-ct-skip-dst-lport-ips, installer variableLS_CT_SKIP_DST_LPORT_IPS, classic Helm valuefunc.LS_CT_SKIP_DST_LPORT_IPS, and v2 Helm valuefeatures.LS_CT_SKIP_DST_LPORT_IPSnow default tofalse. Review explicit overrides during upgrades; leave this disabled for the corrected default, or explicitly set it totrueif the previous behavior is required. See #7932.
Highlights
- Clean up pod routing policies when EIP/SNAT annotations are removed (#7904).
- Allow IPsec cleanup to finish on hardware-offload nodes without IPsec state (#7914).
Reliability and security
- Grant CSR approval/signing permissions only when IPsec is enabled. When enabling IPsec, update the release manifests or Helm configuration together so the controller receives the required permissions (#7954).
- Remove the unused
SYS_ADMINcapability from OVS containers (#7950). - Update Go to v1.27.4 and
golang.org/x/cryptoto v0.59.0 (#7945, #7965). - Align release-branch E2E tooling with the supported Go version (#7956).