Antrea v2.5.3

Changed

• Add documentation for restricting Antrea Multi-cluster ServiceExports to mitigate the risk of arbitrary namespace imports. (#8251, @luolanzone @antoninbas)

Fixed

• Retry AntreaProxy Service synchronization after transient failures to ensure datapath state converges. (#8206, @hongliangl)
• Fix host-local IPAM GC releasing in-use Pod IPs. (#8240, @antoninbas)
• Return the error when adding messages to a bundle fails, so failed OVS flow installations are retried. (#8211, @hongliangl)
• Fix scrambled Aggregate-mode stats/throughput IEs in FlowAggregator IPFIX export. (#8228, @Dyanngg)
• Recover Service group install after a timed-out bundle commit. (#8190, @hongliangl)
• Annotate end-of-initial-events bookmark for watch-list clients to fix cache sync stalled issue on a Rancher cluster. (#8124, @stroebs)
• Stop forwarding antctl caller credentials to Agents, authenticating with a short-lived token minted for the dedicated antctl ServiceAccount instead. (#8251, @antoninbas)
• Check requester authorization for SupportBundleCollection authSecret, rejecting requests where the requester cannot read the referenced Secret. (#8251, @antoninbas)
• Do not realize Groups whose childGroups are nested too deeply, preventing an antrea-controller crash caused by a ChildGroups cycle. (#8251, @antoninbas)
• Check requester authorization for PacketCapture fileServer, rejecting requests where the requester cannot read the file server credentials. (#8251, @antoninbas)
• Prevent antrea-agent panic on short reject packets. (#8251, @antoninbas)
• Prevent antrea-agent panic on non-echo ICMPv6 packet-in. (#8251, @antoninbas)
• Sanitize comment and log-prefix args in iptables rule builder to prevent injection of arbitrary rules. (#8251, @antoninbas)
• Bind Windows ovsdb-server to loopback instead of all interfaces. (#8251, @antoninbas)
• Prevent antrea-agent panic on short IGMP packets. (#8251, @antoninbas)
• Fix antrea-agent panic on Traceflow to a portless Service. (#8251, @antoninbas)
• Bound FQDN tracking growth in fqdnController with a single capped cache. (#8251, @antoninbas)
• Fix NetworkPolicy stats panic caused by stale OpenFlow flows after pipeline table changes. (#7952, @luolanzone)
• Strengthen IPPool status update retries to reduce failures under concurrent updates. (#7996, @wenqiq)
• Fix wrong bitmap index in IPPool AllocateRange, which could cause double allocation. (#7945, @OmAmbole009)
• Clamp negative IPFIX delta counts to 0 instead of wrapping them on FlowExporter. (#7883, @Denyme24)
• Update github.com/moby/spdystream to v0.5.1 to address CVE-2026-35469. (#8007, @renovatebot)
• Update github.com/gopacket/gopacket, google.golang.org/grpc, go.opentelemetry.io/otel, and golang.org/x/text to address CVEs. (#8267, @luolanzone)