• 7162bc4af fix(controller): prevalidate nat gw name and normalize long labels (#6604)
• 2bbdc5ee8 docs: update NEXT.md with Post-v1.15.0 features (#6603)
• b95c867c2 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#6602)
• 798ede99f fix(deps): update module golang.org/x/sys to v0.43.0 (#6601)
• 4420b520b fix(controller): clean up orphaned LBHCs during multi-SLR deletion (#6596)
• 558c6f874 fix(daemon): reorder SR-IOV representor lifecycle to prevent CmdAdd/CmdDel race (#6593)
• 378a42282 fix(e2e): preload agnhost image into KIND nodes before running tests (#6594)
• 6cf33fa5f fix: add SplitTrimmed to prevent index out of range and empty token propagation (#6592)
• 4f96a74a0 feat: support BGP and EVPN for vpc-egress-gateway (#6224)
• 58fa36b54 docs: updated CHANGELOG.md (#6590)
• 815b4e1dc chore(deps): update dependency go to v1.26.2 (#6586)
• 2a63959ba fix(controller): preserve VPC policy route next hops during OVN diff (#6577)
• ee61003d5 fix: add nil checks for net.ParseIP/ParseCIDR at input boundaries to prevent panic (#6581)
• d336c9801 feat(crd):auto check and generate CRDs in dev workflow (#6569)
• 4d9e8e60d fix(deps): update module kernel.org/pub/linux/libs/security/libcap/cap to v1.2.78 (#6576)
• 82be2d108 Update contact link for Kube-OVN Community
• 075f3860f change slack channel
• 02a0bbffb fix(chart-v2): fix extraEnvs indent in controller-deployment template (#6575)
• b2f395135 fix(deps): update module go.podman.io/image/v5 to v5.39.2 (#6573)
• 814d525a2 fix(deps): update module github.com/moby/moby/client to v0.4.0 (#6572)
• 59cb1f51b Update USERS.md (#6562)
• c8f4dc901 auto gen crd (#6548)
• eaaf7c6a1 fix(e2e): wait for second provider network bridge in underlay AfterEach (#6567)
• f06903105 fix(deps): update module google.golang.org/grpc to v1.80.0 (#6566)
• ecba16115 fix(deps): update module github.com/osrg/gobgp/v4 to v4.4.0 (#6565)
• 4c122e416 fix(slr): handle orphaned ip_port_mappings and overwrites (#6558)
• 779b0ec7c chore(deps): update dependency gobgp to v4.4.0 (#6564)
• 178f22832 fix(deps): update module github.com/containerd/nerdctl/v2 to v2.2.2 (#6561)
• 133a2f72b fix(daemon): filter link-local and loopback addresses in loopEncapIPCheck (#6559)
• 67790efda fix(daemon): match pod IPs to EGW by protocol instead of index position
• fd5f3ced1 fix(daemon): add missing NatOutgoing check in getLocalPodIPsNeedPR and getSubnetsNeedPR
• a082bb6c0 fix(daemon): prevent panic on ips index out of bounds in pod policy routing
• 2378f5000 fix(daemon): fix rulespec in cleanObsoleteIptablesRules skipping "-A FORWARD" prefix
• ab1c2cdb1 fix(daemon): add missing return after OVS bridge creation failure in setExGateway
• 271b91ffa fix(daemon): remove dead protocol assignments in generateNatOutgoingPolicyChainRules
• 6d2bceada test(e2e): add skip version for kubevirt NAD change test (#6556)
• 848e2b0de fix(deps): update module kubevirt.io/client-go to v1.8.1 (#6551)
• dcdb1afd0 chore(deps): update dependency kubevirt to v1.8.1 (#6552)
• 42dae6722 fix(deps): update module kubevirt.io/api to v1.8.1 (#6550)
• f1e071be2 fix(daemon): harden protocol iteration and bounds checks in gateway (#6547)
• eca75a5d3 fix(daemon): add TrimManagedFields to all daemon informer factories (#6546)
• ecf66bfb4 fix(daemon): replace bulk netlink dumps with targeted queries (#6540)
• e07a2d2ae ci: add least-privilege permissions to GitHub Actions workflows (#6544)
• ac3666ef2 fix(controller): handle missing logical switch in handleMcastQuerierChange (#6542)
• 4146075dc fix(ci): tolerate pod disappearing during cleanup log collection (#6543)
• 2f30f501b fix(deps): update module github.com/cert-manager/cert-manager to v1.20.1 (#6535)
• d208d2f9c fix(e2e): use diff-based merge patch for DaemonSet instead of full object (#6539)
• 99d183108 fix: wrap EIP error shadowing and use uint64 for iptables counters (#6538)
• 16456fe68 fix(informer): return nil instead of error in VM indexer to prevent client-go panic (#6537)
• b54a61501 fix(controller): prevent invalid ACL generation for named ports and IPBlock except CIDRs (#6536)
• ed67bac5f chore(deps): update dependency cert-manager to v1.20.1 (#6534)
• 09023e77a fix(e2e): pin and preload kubevirt containerdisk image in KIND (#6533)
• b2d57d79e feat(controller): support per-pod NIC granular DHCP control via annotations (#6475)
• 023250be8 fix(controller): add finish logs for all gc functions (#6532)
• 0074ae34f fix(controller): defer subnet processing until vlan is fully ready (#6527)
• edd3de227 update dependency (#6526)
• d3070d139 fix(controller): clean orphaned attachment IPs on KubeVirt NAD hotplug (#6519)
• 0e0fa7d1b docs: updated CHANGELOG.md (#6528)
• ca9491418 fix: check northd endpoint by pod IP protocol in ovn leader checker (#6523)
• 19546786e fix(daemon): clean VLAN subinterfaces and label when excluding node from provider network (#6521)
• 932fcccef fix(daemon): skip invalid policy routing rules when pod lacks matching protocol IP (#6522)
• 2c28bfae3 chore(deps): upgrade k8s dependencies to v1.35.3 (#6518)
• b129a0b9e fix(deps): update module kubevirt.io/api to v1.8.0 (#6516)
• c9ee30249 fix(deps): update module kubevirt.io/client-go to v1.8.0 (#6517)
• 289868e76 feat(controller): use BigInt for SubnetStatus IP count fields (#6403)
• 1ce02e4f2 fix(controller): use defer to protect vpcKeyMutex unlock in subnet handler (#6515)
• b0cf83470 fix(netpol): use parenthesis around ipblock expressions
• 62c79dd07 chore(ci): add test for netpol regression #6508
• f701ecc31 fix(daemon): use multiple KubeVirt labels for VM launcher pod lookup (#6512)
• 8957bac67 perf(daemon): avoid full netlink dump in getIfaceByIP (#6513)
• ed82f2201 chore(deps): update azure/setup-helm action to v5 (#6511)
• 1221eec1f chore(charts): update readme and values on v2 chart
• 119adbaa9 fix(controller): filter empty VIP strings from SwitchLBRule annotation (#6507)
• 3f2d212a5 fix(ci): restart coredns pods after kube-ovn install in Talos test (#6504)
• fbf5c3d38 ci: only fail on pod restarts caused by panic or SIGSEGV (#6506)
• c84bc03d7 docs: updated CHANGELOG.md (#6505)
• 0f2e7d6d3 fix(controller): remove dead code in retryDelDupChassis (#6503)
• 456037cfa fix(controller): clone ExternalIDs map and skip empty pgName in node handling (#6502)
• 8596ca271 chore(deps): update dependency golangci-lint to v2.11.4 (#6500)
• 5005a4d82 docs: updated CHANGELOG.md (#6501)
• c84be7509 fix(controller): fix variable shadowing in cleanDuplicatedChassis (#6496)
• e7451a9dc fix(e2e): increase VM StartSync ready timeout from 2m to 3m (#6499)
• f1a627c73 fix(controller): prevent dual-stack cross-deletion of local DNS cache policy routes (#6497)
• 2eac83918 fix(controller): handle npsLister.List error in checkAndUpdateNodePortGroup (#6498)
• 9d8f3367c fix(e2e): add retry to pre-corruption DB health check in HA test (#6495)
• 40e4f5783 fix(controller): use exact match instead of substring match for VIP lookup in syncVirtualPort (#6491)
• 9e707d7dd refactor(controller): remove legacy svcMatchNetworkPolicies code (#6494)
• 58f08b5a7 fix(ipam): release allocated static IPs on partial allocation failure (#6493)
• fd8ea4143 fix(controller): use consistent dual-stack check in subnet finalizer removal (#6492)
• 745fb7f70 fix(controller): fix nil deref, cache mutation, and early return bugs in subnet controller (#6490)
• e8ba7b0f7 fix(controller): prevent checkSubnetConflict from swallowing conflict errors (#6489)
• f6e1fb119 fix(controller): handle restartable init containers in DeleteNamedPortByPod (#6486)
• e7df610cc refactor(controller): eliminate duplicate OVN/K8s queries in pod controller (#6485)
• 9cc36dc88 fix(controller): resolve variable shadowing causing IPAM key mismatch in per-interface static IP allocation (#6484)
• 3c8fb0e18 fix(controller): prevent panics from nil deref and data races in pod controller (#6483)
• 6035b84d5 chore(deps): update dependency talos to v1.12.6 (#6481)
• 924434330 fix(daemon): create listen sockets before starting controller to avoid race (#6478)
• 5a0009ad6 fix(e2e): wait for OVS bridge cleanup before Docker disconnect in vlan subinterface tests (#6480)
• 436d4c5b8 fix(helm): match control-plane nodes by label presence when value is empty (#6479)
• 5d36c6068 fix(deps): update module google.golang.org/grpc to v1.79.3 [security] (#6477)
• f584eb59b fix(daemon): sort encap IP list for deterministic ovs-vsctl output (#6473)
• 610106b20 fix(controller): reuse addPolicyRouteToVpc to handle empty NextHopIP correctly (#6472)
• ecf61525c docs: updated CHANGELOG.md (#6471)
• a9bbb2180 fix(daemon): race condition between setExGateway and configProviderNic (#6469)
• beaf89ee5 fix(daemon): handle tombstone objects in subnet and service delete handlers (#6470)
• 42c450992 fix(deps): update module kubevirt.io/api to v1.7.2 (#6467)
• b2f2738b6 chore(deps): update dependency kubevirt to v1.7.2 (#6466)
• f8e1f5830 Fix misleading log message on VPC Policy Route addition. (#6464)
• 6bfb85848 dist: add 25.03 ACL compatibility for OVN patch (#6463)
• 7709e240c fix: FIP/DNAT/SNAT spec update handlers (#6412)
• 009e0c5a0 fix(controller): remove Service ClusterIP from NetworkPolicy address sets (#6461)
• a3b00701a fix(controller): backfill nat gateway lan ip safely (#6424)
• 5b43fb24c kind: enable OwnerReferencesPermissionEnforcement (#6456)
• a80b1185d fix: restore NIC name during provider network cleanup in exchangeLinkName mode (#6455)
• f364d3302 fix(deps): update module github.com/containernetworking/plugins to v1.9.1 (#6459)
• a494ab32e chore(deps): update dependency cni-plugin to v1.9.1 (#6458)
• 2d641b9ad fix: avoid error log for missing VPC annotation on underlay pods (#6454)
• 169b14ac7 fix: persist node IP annotation to API server during IPAM init (#6453)
• 636f5166c Improve hairpin logic to support FIP, SNAT from any CIDR within the VPC and LoadBalancers (#6445)
• 15c4ece9d fix: add webhook self-exclusion to prevent recovery deadlock (#6452)
• 9c4837026 fix: harden provider network cleanup to prevent orphaned bridges and routes (#6448)
• dc5ad3b07 Split ECMP next-hops in custom VPC policy routes (#6405)
• b6014c0e1 chore(deps): update dorny/paths-filter action to v4 (#6446)
• 7cd20ce63 kubectl-ko: fix trace failure when arping returns multiple MAC matches (#6444)
• 2cf8fa40d fix(deps): update module golang.org/x/tools to v0.43.0 (#6442)
• 68dc63fa4 chore(deps): update dependency submariner to v0.23.1 (#6441)
• caa98a5f8 chore(deps): update dependency helm to v4.1.3 (#6440)
• 1acf8ee62 docs: updated CHANGELOG.md (#6438)
• a033c7c8a docs: updated CHANGELOG.md (#6437)
• 4960f4c00 docs: updated CHANGELOG.md (#6436)
• 86692e6f2 feat: Extend SG API to have tiers, larger priority range, localAddress and port matches (#6330)
• 078cbecd2 controller: do not set blockOwnerDeletion for ip resources (#6435)
• 838c18b2c allow any eip share external subnet gw in one (native) vlan (#6426)
• 5fd1241e8 fix(ut): use Eventually for ovsdb cache queries in chassis tests (#6431)
• f2f3f632b fix(deps): update golang (#6427)
• 0e10d55fb chart: remove unused values (#6418)
• dad7f3c62 fix: add ipv6_src to LB selection_fields for IPv6 session affinity (#6422)
• b391b1c10 fix(e2e): wait for namespace IPPool annotation before creating workloads to prevent race condition (#6421)
• 01e5d9742 fix(helm): make v2 helm chart run upgrade logic within ovn (#6410)
• 23626e7d0 fix(deps): update module github.com/cert-manager/cert-manager to v1.20.0 (master) (#6416)
• 13f996011 fix: scope ipBlock.except to its own CIDR in NetworkPolicy ACL rules (#6419)
• f96b05c5a fix: reconcile subnet and localnet network_name on vlan provider change (#6393)
• d5a9cae85 chore(deps): update dependency talos to v1.12.5 (#6411)
• d57584d92 fix(deps): update module github.com/containerd/containerd/v2 to v2.2.2 (#6417)
• 6d6c3e0c6 chore(deps): update dependency cert-manager to v1.20.0 (#6415)
• f364d9b8b feat: support custom resources and bandwidth limits for VpcEgressGateway (#6407)
• a2010033f fix(e2e): preload pause image into kind cluster to prevent flaky test timeouts (#6414)
• f7995d2f1 fix(e2e): prevent OVS datapath race condition in underlay tests (#6413)
• 07f73a489 chore(deps): update dependency golangci-lint to v2.11.3 (master) (#6402)
• 78b2f742e fix: scope SLR deletion to its own VPC to avoid deleting VIPs across VPCs (#6391)
• 6284594c4 fix(helm): allow explicit override of ovs-ovn DaemonSet update strategy (#6406)
• 0fa99c5f3 chore(deps): update docker/setup-buildx-action action to v4 (#6396)
• d8544f97f chore(deps): update aquasecurity/trivy-action action to v0.35.0 (#6404)
• 30a143e68 fix(deps): update module google.golang.org/grpc to v1.79.2 (#6400)
• 9a968ef77 fix(deps): update golang (#6409)
• cef09fee8 chore(deps): update dependency go to v1.26.1 (#6399)
• c86151b0d fix(deps): update module github.com/moby/moby/client to v0.3.0 (#6395)
• 5d4cc325f fix(deps): update module github.com/moby/moby/api to v1.54.0 (#6394)
• bfd45ab3a ci: wait for metallb-memberlist secret before speaker rollout (#6389)
• 0567c9a62 fix: add retry logic to checkLeader() and checkDaemonSet() in kubectl-ko (#6387)
• e19238eec fix: kubevirt e2e subnet delete timeout and IP CRD label management (#6388)
• 3986ad68d fix(daemon): start IPSec service after certificates are configured in OVSDB (#6383)
• 6e8dda15d fix(deps): update module github.com/brianvoe/gofakeit/v7 to v7.14.1 (#6386)
• 8f155a3ec feat: enable ip forward should skip fastpath (#6384)
• 50ac6c89c ci: disable valgrind for metallb e2e and increase speaker rollout timeout (#6385)
• e5ab5a041 fix(e2e): wait for OpenFlow rules and add curl retry in metallb underlay test (#6382)
• 48aca4072 fix: protect ANP/BNP/CNP priority maps from concurrent access (#6373)
• 74eeefa11 chore(deps): update aquasecurity/trivy-action action to v0.34.2 (#6380)
• 6d6c5580c fix: BGP speaker reads IPs from pod annotations instead of pod status (#6344)
• 44f2e62e9 fix(deps): update module github.com/osrg/gobgp/v4 to v4.3.0 (#6372)
• e6a657c8e fix(daemon): handle OVS bridge creation race condition with exchangeLinkName (#6374)
• 503c357e9 test(e2e): increase VPC egress gateway curl timeout to 2 minutes (#6379)
• 3543938b8 fix(e2e): stabilize ANP domain E2E tests and fix hasDomainNames override bug (#6376)
• 75b79117c allow from snat eip to fip eip (#6329)
• 4293cbc39 docs: updated CHANGELOG.md (#6375)
• e5de0b374 chore(deps): update dependency gobgp to v4.3.0 (#6371)
• 3168803a5 test(e2e): optimize test execution time by reducing unnecessary waits (#6369)
• 605d61574 ci: wait for control-plane nodes before labeling in chart install (#6370)
• ede1d7123 fix(e2e): reuse OVSDB client in address set tests to avoid HA deadlock (#6368)
• 43ff19a89 ci: fix building base images
• e9b65ce70 fix: prevent subnet from getting permanently stuck when VLAN is not ready (#6352)
• b0d58bbb6 cni-server: fix vlan id reference (#6365)
• e229c02ad fix(ha): detect and recover from split-brain leader with incomplete cluster membership (#6363)
• cf48799f4 fix(e2e): poll for ovs-ovn pod readiness instead of single snapshot check (#6364)
• c4eeb1d51 fix(e2e): replace hard sleeps and unretried checks with WaitUntil polling (#6362)
• e43e1d994 fix(ci): redesign log upload steps in build-x86-image workflow (#6361)
• 334e6c496 fix(e2e): wait for endpoints and retry service trace in kubectl-ko test (#6358)
• f9865af39 fix(e2e): wait for flow cleanup before checking service after deletion in metallb test (#6359)
• d9721475b ci: use larger runner for Talos installation test (#6360)
• 058b3de59 docs: updated CHANGELOG.md (#6357)
• 2dab3d6d9 fix(deps): update module golang.org/x/net to v0.51.0 (#6353)
• 1c654cbf7 fix(e2e): poll for OVS bridge addresses in ovn-vpc-nat-gw test (#6355)
• bbd1abe68 chore(deps): update github artifact actions (#6356)
• 5400b1e3f fix(e2e): retry check-cluster after HA db corruption recovery (#6354)
• 62408948e fix: add retry logic to kubectl-ko getOvnCentralPod for leader election (#6351)
• 21141a3ef fix: use targeted patch in calcSubnetStatusIP to prevent U2O status overwrite (#6350)
• 3dd3fff8f fix(e2e): wait for DNSNameResolver ready before CNP connectivity checks (#6349)
• 53b0946c5 fix: fix SLR e2e flaky failure caused by VIP not being cleaned up (#6347)
• 9e1109c58 fix(e2e): wait for RAFT cluster convergence in HA db corruption test (#6348)
• d655c9002 fix(deps): update module github.com/cert-manager/cert-manager to v1.19.4 (#6334)
• 21594f749 fix(e2e): fix checkPolicy logic bug and improve underlay test diagnostics (#6346)
• 8e592b36a fix: add retry logic to vpc-egress-gateway e2e curl connectivity check (#6345)
• f5b527489 fix: add retry logic to SLR e2e connectivity test to fix flaky failure (#6343)
• ca8b1c8e0 feat: introduce serviceMonitor and labels to services (#6340)
• 4c8de6288 chore(deps): update dependency cert-manager to v1.19.4 (#6332)
• 344798172 chore(deps): update dependency kubevirt to v1.7.1 (#6333)
• 1c1cc9354 fix(deps): update module kubevirt.io/client-go to v1.7.1 (#6325)
• 06f766c17 fix(deps): update module kubevirt.io/api to v1.7.1 (#6324)
• 66ed19714 chore(deps): update kindest/node docker tag to v1.35.1 (#6317)
• 4fe155dcf fix(kind): set containerd LimitNOFILE to 4096 to avoid valgrind failure (#6337)
• 42ff3555f docs: update NEXT.md with Post-v1.15.0 changes (#6336)
• 7ad2a5157 only build base for last 3 release branch
• 820341d46 fix(ovn): update patches for compatibility with upstream OVN branch-25.03 (#6331)
• 830362a7e fix(loadbalancers): ip_port_mapping is overwritten by new vips (#6302)
• 53bad7e85 fix: avoid OVN northd "No path for static route" warning on startup (#6323)
• 6ef934de3 fix: skip unallocated pods during IPAM initialization to avoid spurious errors (#6327)
• 0e8d11fd7 chore(deps): update actions/checkout action to v6 (#6322)
• 0cad95f53 fix(ovn): add use-after-free fix for en-sync-sb to null check patch (#6326)
• 7cb33fac6 feat: check for pod restarts after installation (#6311)
• 73a05d0c9 ci: upload kubectl-ko-log when check-restarts step fails (#6321)
• 58b9f596e feat(helm):Add affinity and nodeSelector support for ovs-ovn and ovs-ovn-dpdk DaemonSets using v2 chart (#6308)
• a067e089f chore(deps): update actions/setup-python action to v6.2.0 (#6319)
• 0201cbb55 chore(deps): update helm/kind-action action to v1.14.0 (#6320)
• 62b3d9b0c fix(deps): update module gopkg.in/k8snetworkplumbingwg/multus-cni.v4 to v4.2.4 (#6318)
• 5c6e746ff fix(ovn): add null check before sbrec delete calls to prevent crashes (#6316)
• 82283a25b chore(deps): update dependency multus to v4.2.4 (#6314)
• bb4cbf37c chore(deps): update dependency talos to v1.12.4 (#6305)
• 50144a391 fix(deps): update module google.golang.org/grpc to v1.79.1 (#6303)
• 7d8b617bd chore(deps): update dependency submariner to v0.22.1 (#6298)
• ed37cf740 chore(deps): update aquasecurity/trivy-action action to v0.34.1 (#6304)
• 4c2be59aa chore(deps): update actions/checkout action to v5.0.1 (#6313)
• 5a6d74991 chore(deps): update dependency go to v1.26.0 (master) (#6292)
• 23af56309 chore(deps): update dependency golangci-lint to v2.10.1 (master) (#6299)
• 3a28ee1b3 fix(controller): prevent NPE in isOvnSubnet when subnet is nil (#6312)
• 2332aff14 add CLAUDE.md and link to AGENTS.md
• dedad4748 feat: add GitHub Actions workflow for linting and testing Helm charts (#6184)
• e65ff4ef6 docs: updated CHANGELOG.md (#6300)
• 7c0812df6 remove unnecessary logs
• 436b519ec refactor(controller): clean up redundant logic in vpc controller (#6295)
• a0e4135e0 fix: skip IPAM init for empty IP annotation and handle nil IPRangeList (#6296)
• 8978c1818 networkpolicy: provider-scoped policies for multi-network pods (#6223)
• 401160e77 fix duplicate description
• 524b6c0a4 fix(iptables-eip): look up subnet directly by name instead of resolving through NAD (#6287)
• 503fbc8b7 chore(deps): update dependency helm to v4.1.1 (#6290)
• e819cb30b fix(deps): update golang (#6288)
• 7dfd0235c refactor(ovn_leader_checker): improve readability and naming (#6263)
• 772531f8b docs: updated CHANGELOG.md (#6284)
• 08c83ddcf add skip test
• 1adb28a8e perf: only enqueue subnet when not ready (#6268)
• 45e0afead fix(deps): update golang (#6281)
• 2186c1342 fix: go modernize doesn't work (#6262)
• 0f698339b chore(deps): update dependency talos to v1.12.3 (#6278)
• 8f48fa9a5 controller: fix stale ip cr after subnet deletion (#6275)
• d43c8a270 fix(deps): update module github.com/prometheus-community/pro-bing to v0.8.0 (#6277)
• 066ce1208 docs: updated CHANGELOG.md (#6276)
• c76533220 cni-server: add static fdb entry for subnets with u2o enabled (#6269)
• f3e7304cc controller: fix ips owned by subnet u2o ip and mcast querier ip deleted in gc (#6132)
• d55ce5ac3 fix(deps): update module go.podman.io/image/v5 to v5.39.1 (#6271)
• 081cef09c chore(deps): update dependency go to v1.25.7 (#6264)
• 15c7c7984 security: specify a storage limit for containers (#6259)
• 872553774 feat: add user-defined annotations support for nat gw sts template creation (#6256)
• f97672edf charts: add external-gateway-config-ns option for controller (#6211)
• 193f231a1 refactor: extract pprof and metrics/health server helpers to pkg/metrics (#6260)
• f285541a4 refactor: profiling, Retry, assignAddress, runIfLinkExists (#6258)
• 93fca05a6 ignore .context
• 4b4df5fa6 fix: not gen vlan deepcopy (#6257)
• dc7afa4e6 fix typo (#6253)
• 6dfd15168 fix(deps): update module github.com/cert-manager/cert-manager to v1.19.3 (#6251)
• 70a2e3cd7 chore(deps): update dependency cert-manager to v1.19.3 (#6250)
• 2e089ff34 Fix qos not work (#6231)
• fb806189b docs: updated CHANGELOG.md (#6247)
• 0ae88bbf6 fix: Ensure Kubevirt optimizations do not use old migration state (#6239)
• 9d4330ef9 Set Kubevirt live-migrations multi-chassis options for all VM nics (#6241)
• 98a3b1ecd fix localnet port should not be static "patch-localnet." (#6244)
• 7cd3789df rbac: replace wildcard with a clear list of allowed verbs (#6233)
• 8f63d677e fix(deps): update module github.com/onsi/gomega to v1.39.1 (#6237)
• 9b814d74f fix(deps): update module github.com/onsi/ginkgo/v2 to v2.28.1 (#6238)
• 64e05655f remove duplicate description (#6234)
• ff584e907 refactor: do not read pid file when calling ovs/ovn appctl command (#6230)
• a0dd53de4 docs: updated CHANGELOG.md (#6232)
• 2238e2f6a fix(vpcnatgw): nat gateway uses faulty default network (#6212)
• 503af3dbe docs: updated CHANGELOG.md (#6225)
• 98c448618 controller: fix vpc egress gateway forward policy not working for targets within the internal subnet's cidr (#6222)
• 80aef1dbe fix(deps): update module github.com/godbus/dbus/v5 to v5.2.2 (#6219)
• 42393cf94 controller: fix vpc egress gateway not working for targets within the internal subnet's cidr (#6218)
• 7fade0694 e2e: fix OOM on ginkgo build (#6217)
• 083389754 Update start-ic-db.sh to have gen_conn_addr function defined (#6216)
• 87993313d fix(deps): update module github.com/moby/moby/client to v0.2.2 (#6213)
• af72723b2 fix: caching NAD CRD should before all kubeovn crds and pod (#6198)
• dd1880d50 docs: updated CHANGELOG.md (#6209)
• cb157cfa9 fix(vpc-nat-gw): use consistent provider for all pod annotations (#6204)
• 658725ff2 fix(deps): update module github.com/puzpuzpuz/xsync/v4 to v4.4.0 (#6206)
• 9636d7247 fix: host no kube-ovn-speaker log (#6196)
• ab5106902 docs: updated CHANGELOG.md (#6203)
• 25cc1dd34 test: run ginkgo via go tool (#6191)
• 62b1494ff fix: skip NetworkUnavailable condition in non-primary CNI mode (#6195)
• bc813ee34 fix(vpcnatgw): cannot DNAT same EIP and same external port on two different protocols (#6201)
• 64c3ac759 chore(deps): update dependency helm to v4.1.0 (#6200)
• f87749dec chore(deps): update dependency talos to v1.12.2 (#6199)
• 83a7b37d2 fix: cleanup auto-created vlan subinterfaces on interface switch (#6193)
• 21d6cbbf6 fix master base image build err
• 6d06763bf Add vendor ID to transit switches (#6186)
• 6a40d68ed fix: enforce neighbor address validation in configuration (#6134)
• a52abe2d1 fix: webhook e2e (#6163)
• 864f2c678 issue#6181 lb的IPPortMappings不为空时，不允许忽略IPPortMapping (#6182)
• 332875929 refactor: consolidate pod deletion logic for stateful and VM pods (#6183)
• cdf4feedd fix: acquire specified subnet from annotation (#6180)
• 3979f55cf docs: updated CHANGELOG.md (#6175)
• 6d7d5ebbb chore(deps): update dependency helm to v4.0.5 (#6167)
• 968dfbb14 fix(deps): update module github.com/sirupsen/logrus to v1.9.4 (#6168)
• 77e5e9c17 chore(deps): update dependency go to v1.25.6 (#6169)
• 0ae0d13ec add metallb underlay v6 dualcase (#6159)
• 2238d4797 feat: support static IP/MAC for multiple interfaces on same switch (#6060)
• d74b7c696 fix(helm): rolling upgrade strategy for ovs is wrong (#6160)
• 5d93ff826 chore(deps): update dependency cilium to v1.18.6 (#6161)
• a8b356bbb fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.5 (#6158)
• 45174b137 fix(deps): update module github.com/puzpuzpuz/xsync/v4 to v4.3.0 (#6156)
• 80b830661 fix(deps): update golang (#6154)
• fc2966448 chore(deps): update module golang.org/x/text to v0.33.0 (#6150)
• 670b875e6 fix(deps): update golang (#6148)
• 5d0dec44d some left crd add description (#6147)
• 0661c5b07 fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.4 (#6140)
• 1fd404e5f add kube-ovn cr description (#6133)
• d44e5738b feat(chart): introduce extraEnv variable for all components (#6142)
• 74cd1481a update dep check branch
• 079fa2fc8 chore(deps): update dependency golangci-lint to v2.8.0 (#6141)
• 974e92b31 fix(deps): update module github.com/onsi/gomega to v1.39.0 (#6143)
• fd2f14d2d fix(deps): update module golang.org/x/sys to v0.40.0 (#6144)
• 66525ea12 feat(chart): make DaemonSet update strategy configurable in values.yaml (#6136)
• a8300e338 fiix panic if namespace is deleted before pod is processed (#6131)
• 0c9250b2b ci: fix loading vpc-nat-gateway image into kind cluster (#6128)
• 547ea5e17 ci: fix non-primary cni e2e test (#6127)
• b6a25a243 chore(deps): update dependency submariner to v0.22.0 (master) (#6014)
• 9223fa292 fix: add validation for iptables rules to prevent malformed commands in nat gateway pod (#6125)
• 8afcfa8c0 sync vpc-dns crd
• 77da4e19c vpc-dns custom corefile
• cd48d86a5 chore(deps): update dependency talos to v1.12.1 (#6126)
• 5dea828d0 set transform on informers to remove objects' managed fields (#6119)
• 5d79ed901 Add open flow sync refer to ovn-k8s (#6117)
• e02d4b9f4 chore(deps): update dependency gobgp to v4.2.0 (#6121)
• 0e102b54f fix(deps): update module github.com/osrg/gobgp/v4 to v4.2.0 (#6122)
• ce91f14a6 docs: updated CHANGELOG.md (#6120)
• c9fa657b1 prepare for next release

Contributors

• Abhishek Pandey
• Akbar Kusuma Negara
• Aleksei Sviridkin
• Asish Kumar
• Chanyeol Yoon
• Chris Chiu
• Eli Treuherz
• ILYAS ABDELLAOUI
• Johann Schley
• Juan Morete
• Mengxin Liu
• SKALA NETWORKS
• SkalaNetworks
• Tongruishan
• Uğur Tafralı
• Volodymyr Tsap
• Zespre Chang
• andrewlee1089
• changluyi
• clyi
• dependabot[bot]
• dnugmanov
• donghee-park-rsk
• github-actions[bot]
• jimyag
• jskrill
• renovate[bot]
• zbb88888
• zhangzujian
• 张祖建

v1.15.27 (2026-09-20)

This release updates OpenTelemetry dependencies to patched versions and hardens the initial OVN monitor setup against startup stalls.

Changes

• f9e3a2da7 Upgrade OpenTelemetry modules to v1.45.0, including the patched OTLP trace exporter and SDK versions, with the required logging and protobuf dependency updates.
• b3de3eba1 Bound the initial OVN monitor RPC by the configured connection timeout and added regression coverage for reconnect lock cleanup and timeout handling.

v1.15.26 (2026-09-16)

This release replaces the historical underlay ARP flood option with the upstream OVN northd behavior that forwards broadcast ARP/ND requests to MC_UNKNOWN.

Changes

• e190f4aa5 Replace the Kube-OVN-specific NB option bcast_arp_req_flood with the upstream northd change that forwards broadcast ARP/ND requests to MC_UNKNOWN instead of flooding MC_FLOOD_L2. GARP packets still use MC_FLOOD_L2.

v1.15.25 (2026-09-14)

This release includes dependency and security updates, dual-stack EIP/SNAT policy fixes, FRR BGP test reliability improvements, DHCP option parsing fixes, and KubeVirt E2E installation updates.

Changes

• 8675b5cdd Update containerd to v2.2.8.
• 1fd205d53 Update golang.org/x modules.
• 2565d9b62 Update Go to 1.26.8, dependencies, and gRPC.
• 18c0f6a95 Use per-family matches for dual-stack EIP/SNAT policies.
• 3a80b85f8 Persist FRR BGP topology configuration in E2E tests.
• 11eeb3616 Preserve commas inside braced DHCP option values.
• 36fcd66d3 Install Multus and KubeVirt from the release checkout in conformance E2E.

v1.15.24 (2026-08-22)

This release includes dependency updates, controller reliability fixes, IPPool exclude-IP allocation fixes, OVN-IC route consistency improvements, and KubeVirt E2E serialization.

Changes

• ac4e6972a Update golang.org/x/net to v0.58.0.
• 5411eb959 Run KubeVirt tests serially.
• 6e3803854 Update the Go toolchain.
• c73cd6e05 Add gzip compression for logrotate output.
• 5beff6ac6 Update Go to 1.26.7 and gRPC to v1.83.1.
• b6d20c391 Prevent random allocation of excluded IPs after IPPool reconciliation.
• 43e2d480e Update Kubernetes dependencies.
• fb3d77631 Keep OVN-IC routes and gateways consistent.
• f3a0e5798 Stop overwriting VPC status during bootstrap.
• b9595599c Tolerate a database outage during TLS rotation.

v1.15.23 (2026-08-12)

This release adds bounded BFD session recovery for VPC Egress Gateways, makes controller leader election timings configurable, regenerates the Kubernetes API code, and updates Go dependencies.

Both Helm charts use kubeovn/kube-ovn:v1.15.23-dpdk for hybrid DPDK deployments. The next patch build tag kubeovn/kube-ovn-base:v1.15.24-dpdk has also been published from the v1.15.23-dpdk base image.

• ddb4413bb release v1.15.23
• fe36f9020 [reelase-1.15] fix(gateway): add bounded BFD session recovery (#7208)
• 57cba9f6a Update golang (#7213)
• 83b04d632 fix(deps): update module golang.org/x/mod to v0.39.0 (#7207)
• ec82a2e6b chore(codegen): regenerate Kubernetes API code (#7193)
• 9b2232343 [release-1.15] feat: make controller leader election timings configurable (#7178)
• 354dc594d prepare for next release

Contributors

• renovate[bot]
• zhangzujian
• 张祖建

v1.15.22 (2026-08-07)

Both Helm charts now use kubeovn/kube-ovn:v1.15.22-dpdk for hybrid DPDK deployments.

• 05dfb2558 release v1.15.22
• 59f26cdf3 fix(cni): refresh IPv6 neighbor caches (#7140)
• d467e6d69 [release-1.15] fix(ovn-central): tolerate transient duplicate leaders (#7145)
• 8c0107b44 [release-1.15] fix(gateway): harden bfdd control operations (#7143)
• c21e65cb7 fix: use fully qualified CRD names in cleanup.sh
• 592581b3b ci: pin Kamaji chart download (#7133)
• d31219ed4 [release-1.15] ci: add hosted OVN central e2e coverage (#7126)
• bc32c3bf4 prepare for next release

Contributors

• Hadi
• zhangzujian
• 张祖建

v1.15.21 (2026-08-04)

• 49e74eff7 release v1.15.21
• a55f5959e [release-1.15] feat(vpc-egress-gateway): accept bandwidth quantities (#7124)
• add6eef33 [release-1.15] fix(ovn-central): recover from invalid raft headers (#7122)
• a9cd30f68 [release-1.15] fix(ipam): preserve IP pool allocation state (#7114)
• e61ad3298 prepare for next release

Contributors

• zhangzujian
• 张祖建

• 81e594023 release v1.15.20
• 6b271f3e0 [release-1.15] fix(metallb): preserve internal underlay VIP traffic (#7066)
• b9229726f feat: infer pod subnet from named IPPool (#7083)
• 69b6ba9f7 fix(deps): update vulnerable Go modules (#7079)
• 3455ec1ac [release-1.15] fix(chart): correct v2 agent capability name (#7075)
• c6b5e381b Revert "fix: prevent subnet status update loop in patchSubnetStatus (#7058)" (#7069)
• fee5e3f53 fix(controller): extend BFD liveness probe timeout (#7064)
• 8dd20f7da fix: prevent subnet status update loop in patchSubnetStatus (#7058)
• 9f779e9f2 fix(gateway): recover missing BFD sessions (#7051)
• 44b993bf6 fix(chart): correct ovs-ipsec-keys volume indentation and Talos IPSEC docs (#7041)
• 88b440446 fix ipam only ip leak (#7034)
• 4856c9a1b ci: clean up chart releases and keep latest release correct (#7032)
• e98bc1d17 prepare for next release

Contributors

• Abdd
• Aleksei Sviridkin
• Mengxin Liu
• changluyi
• xieyanker
• zhangzujian
• 张祖建

• 247189e75 release v1.15.19
• 6dbb738a5 fix: bump GoBGP to v4.7.0 (#7030)
• c278ae416 [release-1.15] chart: support HCP ovn-central scheduling (#7013)
• aebb90a35 fix(deps): update module golang.org/x/tools to v0.48.0 (#7024)
• ff8961b14 fix(deps): update golang (#7022)
• 977ac3c7b fix(deps): update golang (#7017)
• 43a0667d5 fix: drop orphan centralized nat outgoing tcp packets (#7000)
• c4efb3c72 chore(deps): update dependency go to v1.26.5 (#7012)
• 7cc777720 build: add OCI labels to images (#7008)
• 1f5f7dc51 prepare for next release

Contributors

• Mengxin Liu
• renovate[bot]
• 张祖建

• 2ae3cf5c5 release v1.15.18
• 701125fbc [release-1.15] feat: support HCP ovn-central chart deployment (#6993)
• 1bf35be6b chore(deps): update module golang.org/x/text to v0.39.0 (#7003)
• d300cf2f9 fix: restore ip_src hash for policy route ECMP (#6997)
• 73b760abe fix(kubectl-ko): honor KUBE_OVN_NS instead of hardcoded kube-system namespace (#6992)
• 009176cdf fix: reject subnet gateway static IP allocation (#6981)
• 400168fcb fix: require subnet for attachment provider (#6966)
• d61772e51 feat: configure OVN DB server TLS options (#6977)
• 2e3397465 fix veg init for mismatched IP families (#6963)
• 2a57edc69 prepare for next release

Contributors

• Mengxin Liu
• changluyi
• dmitriy-bty
• renovate[bot]
• 张祖建

• 5287d63c2 release v1.15.17
• 2acdac085 fix: skip non-security-group port groups in sg gc (#6961)
• b64752b09 fix vpc egress local policy without bfd (#6927)
• fe71bb3dc build: include ovs and ovn commits in version (#6945)
• 47de841fd feat: rotate kube-ovn TLS certificates (#6931)
• 5ec9e0dab prepare for next release

Contributors

• Mengxin Liu
• changluyi
• 张祖建

• 726b8df0b release v1.15.16
• b881fdfc6 fix(deps): update module golang.org/x/tools to v0.47.0 (#6938)
• c776d03fa build: refresh kubectl golang.org/x deps and CNI plugin rebuilds (#6929)
• 5307cad85 prepare for next release

Contributors

• Mengxin Liu
• renovate[bot]
• 张祖建

• 6c5e4b9e4 release v1.15.15
• 9245913a4 fix(deps): update containerd to v2.2.5 (#6916)
• 2c9e26bf6 fix: reconcile vpc bfd ha chassis on node changes (#6900)
• 13edea2d9 fix(ovs): make DeleteNat idempotent when target NAT row is absent (#6911)
• 0f298cb03 fix(ci): adapt dpdk base OVN to OVS nd API (#6895)
• b1130f7e7 fix(controller): enable ARP learning on VPC routers that have peerings (#6882)
• 946487ce4 fix(subnet): allow all-ones host as gateway for IPv6 subnet (#6883)
• 758e6ef64 prepare for next release

Contributors

• Apinant.u
• Mengxin Liu
• 张祖建

• 8a9088a6f release v1.15.14
• 4aad80aef fix(deps): update golang to v0.46.0 (#6862)
• 109c350cf fix(controller): skip service/endpointslice enqueueing when lb is disabled (#6859)
• ee3667cad fix(images): adapt OVN pinctrl to new OVS compose_nd_ns signature (#6857)
• 82cbb956f fix(deps): update golang to v0.56.0 (#6855)
• 8f6adf46f fix(controller): correct EIP v6 label update in SNAT/DNAT status patch (#6846)
• 03b7532fd fix(controller): avoid wiping priority-0 CNP map entries on zero-value key (#6844)
• f9a312973 fix(controller): avoid nil queue panic in DNS name resolver handlers (#6845)
• e096355be fix(controller): avoid nil pointer panic when attachment default subnet is gone (#6843)
• 59d4aff13 fix(ovs): check error before dereferencing logical router on static route deletion (#6842)
• 680185c05 fix(controller): re-enqueue VMI migration when target pod is not yet … (#6834)
• 0b5028908 fix(controller): avoid nil pointer panic in chassis and static route gc (#6835)
• fd5ce5d84 fix(controller): skip orphaned subnet instead of breaking namespace subnet loop (#6836)
• db2a7d979 fix(deps): update golang (#6839)
• 567077cbb prepare for next release

Contributors

• Jiri Jezek
• Mengxin Liu
• renovate[bot]

• 8709a0b54 release v1.15.13
• 765122430 chore(deps): update golang to v1.26.4 (#6809)
• b8baba35e fix(controller): correct egress sync status field on ACL update failure (#6804)
• 3ea32e215 fix(controller): populate v6ip from cached EIP in handleAddVpcExternalSubnet (#6799)
• c14378626 fix: restrict hook log file permissions (#6794)
• 649c65b48 fix: report VEG workload network readiness (#6790)
• caa1c1e9a fix(veg): raise default bfdd CPU limit (#6788)
• 299c5daef chore(deps): update Kubernetes and runtime dependencies (#6780)
• 91515b676 fix(controller): avoid panic in external VPC sync when no logical switch is found (#6777)
• 957132a86 fix(deps): update golang (#6772)
• 09c4a9585 prepare for next release

Contributors

• Harisudarsan
• Mengxin Liu
• Rohan
• renovate[bot]
• zhangzujian
• 张祖建

• 88c8e621f release v1.15.12
• b4437b98c feat: backport u2o overlay only routing to release-1.15 (#6751)
• aa0bd3996 feat(cni): package ipvlan plugin in kube-ovn image (#6747) (#6748)
• 50ca826b2 prepare for next release

Contributors

• Mengxin Liu
• changluyi

• c231e542c release v1.15.11
• e15870c99 Block vpc deletion while SNAT, DNAT or FIP rules are using it (#6718)
• 8947ed5e5 chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1
• 0d24cb786 revert(ha): undo cluster integrity check (#6363) for release-1.15 (#6723)
• 83a08f044 fix: use status variable instead of hardcoded ConditionTrue in loopOvn0Check (#6719)
• 38e2eea31 fix(deps): update golang (#6710)
• 1aef8ea31 fix(deps): update module github.com/osrg/gobgp/v4 to v4.5.0
• f712c2eb9 chore(deps): update dependency go to v1.26.3 (#6706)
• c0bee1279 fix(image): rebase OVN patches for branch-25.03 ARP/ND localnet rename (#6707) (#6708)
• 2269b208c fix(controller): keep VM LSP port-group memberships when a sibling pod is alive (#6666)
• 41c2a578d fix(speaker): require NODE_NAME and inject POD_IPS in v2 chart (#6669)
• 43297c2e5 fix: add env NODE_NAME in spicker pod (#6664)
• 42b6bf3b6 fix: docker timeout always (#6662)
• d1f1cb2aa fix(controller): serialize centralized subnet reconcile in node update path (#6627) (#6640)
• e72f5edd6 chore(deps): bump github.com/moby/spdystream in /test/cnp (#6639)
• 11a2d8985 prepare for next release

Contributors

• 09mulcs
• Andrei Kvapil
• Mengxin Liu
• Vitaly
• changluyi
• dependabot[bot]
• renovate[bot]
• zbb88888

• a0e8fb099 release v1.15.10
• 0369b997b Fix/upgrade 1.15 error (#6615)
• 7e4b1ab31 fix(deps): update module golang.org/x/tools to v0.44.0 (#6613)
• e9fdb8343 fix(deps): update golang (#6607)
• 02afa6e45 fix(deps): update module golang.org/x/sys to v0.43.0 (#6597)
• cfd40d97a prepare for next release

Contributors

• Mengxin Liu
• changluyi
• renovate[bot]

• 64eb81f53 release v1.15.9
• 854164e4b chore(deps): update dependency go to v1.26.2 (#6587)
• 3a2264795 fix(controller): preserve VPC policy route next hops during OVN diff (#6577)
• 541993fd7 fix(controller): reuse addPolicyRouteToVpc to handle empty NextHopIP correctly (#6472)
• 100933162 Split ECMP next-hops in custom VPC policy routes (#6405)
• 1099892d2 deps: update k8s to v1.34.6 (#6579)
• 09a9e2316 fix(chart-v2): fix extraEnvs indent in controller-deployment template (#6575)
• 72b6b3174 ci: only fail on pod restarts caused by panic or SIGSEGV (#6506) (#6568)
• 662100f7f fix(slr): handle orphaned ip_port_mappings and overwrites (#6558)
• 8ff5589a7 fix(ha): adapt OvnDatabaseControl call for release-1.15 compatibility
• ca652669a fix: wrap EIP error shadowing and use uint64 for iptables counters (#6538)
• b54aa2140 fix(ha): detect and recover from split-brain leader with incomplete cluster membership (#6363)
• 9a164334a fix(daemon): skip invalid policy routing rules when pod lacks matching protocol IP (#6522)
• 9ca482dfc fix(controller): prevent invalid ACL generation for named ports and IPBlock except CIDRs (#6536)
• 3e7c07914 fix(daemon): harden protocol iteration and bounds checks in gateway (#6547)
• 51c9bca8b fix: protect ANP/BNP/CNP priority maps from concurrent access (#6373)
• 7daebcc27 fix(controller): use defer to protect vpcKeyMutex unlock in subnet handler (#6515)
• 1a9acfa50 fix(informer): return nil instead of error in VM indexer to prevent client-go panic (#6537)
• f46c0b180 ci: install multus before kubevirt e2e tests
• 5f2dec037 Set Kubevirt live-migrations multi-chassis options for all VM nics (#6241)
• 38965a6fe prepare for next release

Contributors

• Asish Kumar
• ILYAS ABDELLAOUI
• Mengxin Liu
• SKALA NETWORKS
• Uğur Tafralı
• jskrill
• renovate[bot]
• 张祖建

• 0060dd23c release v1.15.8
• d1fd99f50 fix: check northd endpoint by pod IP protocol in ovn leader checker (#6523)
• eeafcfdfd fix(netpol): use parenthesis around ipblock expressions
• 5c7bd2852 fix: resolve unused imports and missing errors package in node_test.go
• 4cbcae30f Fix misleading log message on VPC Policy Route addition. (#6464)
• f7bdbea82 fix(daemon): handle tombstone objects in subnet and service delete handlers (#6470)
• 3b4479f73 fix(daemon): sort encap IP list for deterministic ovs-vsctl output (#6473)
• 8952152f2 fix(controller): prevent dual-stack cross-deletion of local DNS cache policy routes (#6497)
• e424a0f88 fix(controller): fix variable shadowing in cleanDuplicatedChassis (#6496)
• 33d44c5a2 fix(controller): use exact match instead of substring match for VIP lookup in syncVirtualPort (#6491)
• f6cdf479e fix(controller): fix nil deref, cache mutation, and early return bugs in subnet controller (#6490)
• 183db4685 fix(controller): handle restartable init containers in DeleteNamedPortByPod (#6486)
• 7bd041833 fix(controller): prevent panics from nil deref and data races in pod controller (#6483)
• e4fab4cb0 prepare for next release

Contributors

• Mengxin Liu
• SkalaNetworks
• andrewlee1089
• changluyi

• e7bd69c77 release v1.15.7
• 3ca483d00 fix(deps): update module google.golang.org/grpc to v1.79.3 [security] (#6477)
• 6812bf03a fix(ipam): release allocated static IPs on partial allocation failure (#6493)
• 18247bbf1 prepare for next release

Contributors

• Mengxin Liu
• renovate[bot]
• 张祖建

• b32aee09f release v1.15.6
• a31ba277b dist: add 25.03 ACL compatibility for OVN patch (#6463)
• f3dca4b60 fix: BGP speaker reads IPs from pod annotations instead of pod status (#6344)
• a01efb4ed kind: enable OwnerReferencesPermissionEnforcement (#6456)
• abb302d50 controller: do not set blockOwnerDeletion for ip resources
• cdcd7034d prepare for next release

Contributors

• Mengxin Liu
• changluyi
• zhangzujian

• 77eb581ff release v1.15.5
• f7f135314 fix(deps): update module golang.org/x/tools to v0.43.0 (#6432)
• a0d787433 fix: use targeted patch in calcSubnetStatusIP to prevent U2O status overwrite (#6350)
• 0fda9a69a fix(deps): update golang (#6430)
• 99876f673 fix(helm): make v2 helm chart run upgrade logic within ovn (#6410)
• 883121029 fix: add ipv6_src to LB selection_fields for IPv6 session affinity (#6422)
• 9c89b8e9d fix: scope ipBlock.except to its own CIDR in NetworkPolicy ACL rules (#6419)
• 7a6460130 fix(deps): update golang (#6428)
• bacf2d842 fix: reconcile subnet and localnet network_name on vlan provider change (#6393)
• bcf256532 feat: support custom resources and bandwidth limits for VpcEgressGateway (#6407)
• 40bfa3432 fix: scope SLR deletion to its own VPC to avoid deleting VIPs across VPCs (#6391)
• bdf022348 chore(deps): update aquasecurity/trivy-action action to v0.35.0 (#6404)
• 08fbad4f3 fix(deps): update golang (#6408)
• 02266c08f update trivy for arm build
• e1274ab2c chore(deps): update dependency go to v1.26.1 (release-1.15) (#6397)
• 3bf23ab6a feat(helm):Add affinity and nodeSelector support for ovs-ovn and ovs-ovn-dpdk DaemonSets using v2 chart (#6308)
• 1d130e5b2 bump k8s to v1.34.5 (#6366)
• 0720adb48 fix(kind): set containerd LimitNOFILE to 4096 to avoid valgrind failure (#6337)
• 95b2b80fc fix: prevent subnet from getting permanently stuck when VLAN is not ready (#6352)
• ca9282c0d cni-server: fix vlan id reference (#6365)
• b78c94c56 fix(deps): update module golang.org/x/net to v0.51.0 (#6341)
• 1b4dd3144 feat: introduce serviceMonitor and labels to services (#6340)
• b67d8a480 fix(ovn): update patches for compatibility with upstream OVN branch-25.03 (#6331)
• 7fee4a495 fix(loadbalancers): ip_port_mapping is overwritten by new vips (#6302)
• e3a1fd660 fix(ovn): add null check before sbrec delete calls to prevent crashes (#6316)
• 77bb39380 chore(deps): update dependency go to v1.26.0 (#6293)
• aeccd2d33 fix lint issues
• be347caf1 fix(controller): prevent NPE in isOvnSubnet when subnet is nil (#6312)
• 7ee1a5632 update .gitignore
• def05ac8e add CLAUDE.md and link to AGENTS.md
• 103894d95 prepare for next release

Contributors

• Johann Schley
• Juan Morete
• Mengxin Liu
• SKALA NETWORKS
• changluyi
• renovate[bot]
• 张祖建

• fe5412f18 release v1.15.4
• 5b263ed93 remove unnecessary logs
• 8291be7a9 refactor(controller): clean up redundant logic in vpc controller (#6295)
• b60f10006 fix: skip IPAM init for empty IP annotation and handle nil IPRangeList (#6296)
• 673317212 fix duplicate description
• c72287473 refactor(ovn_leader_checker): improve readability and naming (#6263)
• 26dab970f fix(iptables-eip): look up subnet directly by name instead of resolving through NAD (#6287)
• 25d473e73 fix(deps): update golang (#6289)
• 9a1db503b prepare for next release

Contributors

• Mengxin Liu
• Zespre Chang
• renovate[bot]
• zbb88888

• c5c83b57d release v1.15.3
• 58aa0fd2e update cert manager
• 9a0fa3cf8 perf: only enqueue subnet when not ready (#6268)
• 6ce9c3039 fix(deps): update module golang.org/x/sys to v0.41.0 (#6282)
• f0075adf0 chore(deps): update module golang.org/x/oauth2 to v0.35.0 (#6279)
• a3f04c743 controller: fix stale ip cr after subnet deletion (#6275)
• b0d9b4316 cni-server: add static fdb entry for subnets with u2o enabled (#6269)
• 3ab93d666 controller: fix ips owned by subnet u2o ip and mcast querier ip deleted in gc (#6132)
• ae142dbf9 security: specify a storage limit for containers (#6259)
• bf66a67bd chore(deps): update dependency go to v1.25.7 (#6266)
• f68017379 fix: Ensure Kubevirt optimizations do not use old migration state (#6239)
• ccf825412 fix localnet port should not be static "patch-localnet." (#6244)
• 5f2252890 rbac: replace wildcard with a clear list of allowed verbs (#6233)
• 54001627e remove duplicate description (#6234)
• 1fade93b2 Add vendor ID to transit switches (#6186)
• 8882096b9 prepare for next release

Contributors

• Eli Treuherz
• Mengxin Liu
• changluyi
• jskrill
• renovate[bot]
• 张祖建