v1.4.0

Network Policy Agent (v1.4.0)

Warning

This release is not backward compatible. Review the downgrade impact below before upgrading.

The internal pod identifier format used by the Network Policy Agent has been updated to improve pod namespace separation during Network Policy enforcement within the cluster.

Upgrade: Existing pod enforcement state is migrated to the new format automatically. No manual action is required.

Downgrade: If you later roll back to an earlier version, Network Policy enforcement will not apply to pods created before the rollback until their nodes are replaced.

What's Changed

• merge release-1.3 into main by @yash97 in #556
• Added NPA agent IT for upgrades and rollback by @viveksb007 in #566
• chore: deps bump for CVE fix by @viveksb007 in #577
• fix(ebpf): propagate map write errors from update wrappers by @parlakisik in #562
• Fix attach-state collision in GetPodNamespacedName by @parlakisik in #563
• Fix conntrack reverse flow bypass by @Pavani-Panakanti in #584
• ebpf sdk version bumped and shifted bpf maps authority by @viveksb007 in #590
• fix(deps): bump Go minimum version to 1.26.4 to resolve stdlib vulnerabilities by @parlakisik in #593
• fix: cloudwatch log-level filtering by @srikanthjg in #583
• Migrate base images to AL23 (latest-al23) by @1wos in #558
• adding code coverage report in readme. by @yash97 in #524
• fix(utils): make GetPodIdentifier injective to prevent cross-namespac… by @parlakisik in #576

New Contributors

• @parlakisik made their first contribution in #562
• @1wos made their first contribution in #558

Full Changelog: v1.3.5...v1.4.0