The module lifecycle stage: Preview

The module has requirements for installation

v0.9.3

Bug Fixes

  • Fixed excessive NodeNetworkInterface status updates by the agent. The status is now updated only when it actually changes, and the lastProbeTime field of conditions is no longer refreshed on every synchronization, which reduces the load on the Kubernetes API server

Chore

  • Added the Git commit hash of the build to the startup log message of the module components

v0.9.2

Security Updates

  • Fixed CVEs in module images and dependencies

Chore

  • Added a “Promote” stage to CI for module release signing and secure development compliance

v0.9.1

Improvements

  • Added Phase and Age columns to kubectl get output for IPAddressPool and ClusterIPAddressPool
  • Added anti-affinity for controller and scheduler pods to prevent replica pods from being scheduled on the same node

Bug Fixes

  • Fixed an issue where IPAddress/ClusterIPAddress would get permanently stuck in the Pending state after modifying the associated Network or IPAddressPool, instead of automatically retrying
  • Fixed an issue where a new address could be allocated from an IPAddressPool or ClusterIPAddressPool that is currently being deleted
  • Fixed incorrect namespaced name formatting in the status conditions of IPAddress and ClusterIPAddress
  • Fixed the IPAddress.status.usedByPods field to ensure it no longer contains stale entries after an address is no longer in use

Security Updates

  • Fixed CVEs in module images and dependencies

Chore

  • Added Svace static analyzer checks to the CI pipeline

v0.9.0

Highlights

  • Added the PrimaryCNI ClusterNetwork type for reserving cni-cilium Pod addresses with IPAddress, e.g. stable VM addresses across live migration

New Features

  • The module maintains the singleton PrimaryCNI ClusterNetwork main
  • The agent routes PrimaryCNI addresses between nodes, replacing vm-route-forge
  • A Pod can request a PrimaryCNI address via {"type":"Main","ipAddress":"<address>"} in the networks-spec annotation

Improvements

  • An IPAddress owned by a non-Pod resource (e.g. a VirtualMachine) stays bound while the owner exists
  • The Bound condition of an IPAddress is now always present (False when unused)
  • Added the D8SDNObsoleteClusterNetworkFound alert for a ClusterNetwork occupying the reserved name main

Bug Fixes

  • Fixed the agent clearing usedByPods and Attached of an IPAddress used by a Pod on another node

Chore

  • Added e2e tests for PrimaryCNI

v0.8.1

Improvements

  • The d8-sdn namespace now runs in the restricted Pod Security Standards mode

Bug Fixes

  • Fixed a stale network.deckhouse.io/networks-status annotation that remained on a Pod or VM after all its additional networks were removed

Security Updates

  • Updated vulnerable dependencies in module images

Chore

  • Removed the unused intermediate llvm image from the module release bundle
  • Bumped modules-gitlab-ci to v19.0

v0.8.0

Highlights

  • The module is now available in the CE, BE, SE, and SE+ editions in addition to EE, FE, and CSE
  • Added short names for module resources

Bug Fixes

  • Fixed the agent failing to write (or writing incompletely) the networks-status pod annotation for pods with multiple secondary networks during a temporary network attachment error
  • Fixed IPAddress resource name collisions

Security Updates

  • Fixed CVE-2026-56855, CVE-2026-78662, and CVE-2026-84304, and updated other vulnerable dependencies in module images and build tooling

Documentation

  • Removed the documentation of the unimplemented SRIOVVirtualFunction SystemNetwork type

Chore

  • Changed the agent’s healthcheck port from 4264 to 4275
  • Reorganized the CI/CD pipeline structure
  • Fixed module validation issues reported by dmt lint
  • Included documentation, OpenAPI schemas, and CRDs in the module release bundle

v0.7.0

New Features

  • Added the spec.mtu field to Network and ClusterNetwork resources to configure pod interface MTU — pod interfaces inherit the value and changing it triggers reconciliation of already attached pods on the node

Bug Fixes

  • Fixed NodeNetworkInterface resources stuck in Terminating when interface creation failed and status.ifName was never set
  • Fixed transient agent errors when link list dumps are interrupted by concurrent changes on the node

Security Updates

  • Fixed CVEs in module images and dependencies

v0.6.10

Improvements

  • The agent now waits for the SDN controller to become ready before starting. This prevents errors in the logs

Bug Fixes

  • Fixed agent CrashLoopBackOff in the CSE edition with CRI containerd v2 caused by mounting the entire /sys filesystem into a container with a read-only root filesystem
  • Fixed altname overflow for a Veth pair when Namespace or Pod names are long by hashing them

v0.6.9

Security Updates

  • Fixed CVE GHSA-hrxh-6v49-42gf
  • Fixed securityContext settings
  • Added SecurityPolicyException for the agent

Chore

  • Fixed CSE build

v0.6.8

Bug Fixes

  • Fixed Veth interface name generation to avoid name collisions

Documentation

  • Added Changelog and Release Notes

v0.6.7

Security Updates

  • Fixed CVEs
  • Fixed RBAC rules

Chore

  • Updated the CI/CD pipeline structure

v0.6.6

Highlights

  • Tap and Bridge interfaces are no longer created inside Pods
  • IP addresses are now assigned to the Veth interface inside the Pod

Improvements

  • Added deploy dependencies for WebhookConfiguration

Security Updates

  • Fixed CVEs
  • Expanded ClusterAdmin RBAC permissions for NodeNetworkInterfaces

v0.6.5

Chore

  • Added mount-points.yaml for CSE with CRI v2 support

v0.6.4

Chore

  • Adapted the module build process for Deckhouse Certified Security Edition (CSE)

v0.6.3

Improvements

  • Added UID and GID configuration for Tap interfaces

v0.6.2

Highlights

  • Denied empty labelSelector.matchLabels in CRD validation

Improvements

  • Added Tap interface creation with the correct options for KubeVirt (multi-queue)

v0.6.1

Improvements

  • Replaced klog with deckhouse/log
  • Refactored the controller structure and logging

Bug Fixes

  • Fixed SR-IOV issues
  • Added automatic UP of the parent interface for VLANs in the agent
  • Fixed minor issues in the agent

Security Updates

  • Added the SystemNetworks resource to RBAC roles
  • Fixed CVEs

v0.6.0

New Features

  • Added eBPF-based DHCP support in the agent

Bug Fixes

  • Allowed the control-plane-manager ServiceAccount to use ValidatingAdmissionPolicy for NodeNetworkInterfaces
  • Fixed DRA resource compatibility with Kubernetes 1.35

Documentation

  • Added an IP address warning for ClusterNetwork of type Access
  • Added a hugepages configuration example

v0.5.4

Improvements

  • Added the NNI label network.deckhouse.io/interface-name
  • Added Ready and IPAddressPool additionalPrinterColumns for ClusterNetwork and Network
  • Moved IP address assignment from Tap to Bridge

Bug Fixes

  • Fixed IPAddressLease handling for IPAddress resources with OwnerReferences

Security Updates

  • Fixed CVEs

v0.5.3

Bug Fixes

  • Fixed ClusterNetwork behavior for the Access type

v0.5.2

Security Updates

  • Fixed CVEs

Chore

  • Fixed module.yaml import in werf for CI

v0.5.1

New Features

  • Added SystemNetwork support on top of bond interfaces
  • Added the ClusterIPAddressLease resource for ClusterIPAddress

v0.5.0

New Features

  • Added SystemNetwork functionality

Improvements

  • Added periodic restoration of a missing CNI conflist in the agent
  • Added unix socket connection retries and improved logging in the CNI plugin
  • Updated the golang-alpine base image to 1.25

v0.4.2

Security Updates

  • Added RBAC rules for SDN resources

v0.4.1

Improvements

  • Added validation for NetworkClass spec.vlan.idPool

Bug Fixes

  • Fixed VLAN allocation for Network resources in the controller
  • Fixed an NNI cache lookup error in the agent

Documentation

  • Added Russian translations for the Network and ClusterNetwork CRD descriptions

v0.4.0

New Features

  • Added IPAM functionality for IP address management

Documentation

  • Added IPAM documentation
  • Reviewed and refactored documentation

Chore

  • Added E2E tests for IPAM
  • Added a Makefile and fixed Go lint issues

v0.3.0

New Features

  • Added the UnderlayNetwork CRD and controller
  • Added SR-IOV support and passthrough of physical network devices into Pods via the DRA plugin and the UnderlayNetwork resource

Improvements

  • Automated AdmissionWebhook TLS certificate provisioning via Deckhouse hooks
  • Set VPA updateMode to InPlaceOrRecreate

Bug Fixes

  • Created bond interfaces are now automatically brought UP

Security Updates

  • Fixed CVEs

Documentation

  • Added UnderlayNetwork configuration documentation

Chore

  • Added E2E tests for bond interfaces

v0.2.0

Highlights

  • Allowed bond interfaces when creating networks
  • Renamed Vlan to VLAN in CRDs and updated resource descriptions

Improvements

  • Mounted the containerd directory in the agent and detect permanent MAC addresses via ethtool
  • Optimized the controller cache and added pprof support

Bug Fixes

  • Fixed bond metadata handling in the controller and agent
  • Fixed garbage collection for NodeNetworkInterface resources
  • Fixed disabling an interface that already has an IP address assigned

Documentation

  • Updated module documentation

Chore

  • Removed E2E logic from the module and moved it to the shared pipeline
  • Removed the unused main network mode
  • Updated CI and the module description

v0.1.0

Highlights

  • Released the first version of the SDN module with basic network management capabilities

Dependencies

  • Raised the minimum supported Deckhouse version to 1.72