v1.15.4 (2026-02-12)

• fe5412f18 release v1.15.4
• 5b263ed93 remove unnecessary logs
• 8291be7a9 refactor(controller): clean up redundant logic in vpc controller (#6295)
• b60f10006 fix: skip IPAM init for empty IP annotation and handle nil IPRangeList (#6296)
• 673317212 fix duplicate description
• c72287473 refactor(ovn_leader_checker): improve readability and naming (#6263)
• 26dab970f fix(iptables-eip): look up subnet directly by name instead of resolving through NAD (#6287)
• 25d473e73 fix(deps): update golang (#6289)
• 9a1db503b prepare for next release

Contributors

• Mengxin Liu
• Zespre Chang
• renovate[bot]
• zbb88888

v1.15.3 (2026-02-09)

• c5c83b57d release v1.15.3
• 58aa0fd2e update cert manager
• 9a0fa3cf8 perf: only enqueue subnet when not ready (#6268)
• 6ce9c3039 fix(deps): update module golang.org/x/sys to v0.41.0 (#6282)
• f0075adf0 chore(deps): update module golang.org/x/oauth2 to v0.35.0 (#6279)
• a3f04c743 controller: fix stale ip cr after subnet deletion (#6275)
• b0d9b4316 cni-server: add static fdb entry for subnets with u2o enabled (#6269)
• 3ab93d666 controller: fix ips owned by subnet u2o ip and mcast querier ip deleted in gc (#6132)
• ae142dbf9 security: specify a storage limit for containers (#6259)
• bf66a67bd chore(deps): update dependency go to v1.25.7 (#6266)
• f68017379 fix: Ensure Kubevirt optimizations do not use old migration state (#6239)
• ccf825412 fix localnet port should not be static "patch-localnet." (#6244)
• 5f2252890 rbac: replace wildcard with a clear list of allowed verbs (#6233)
• 54001627e remove duplicate description (#6234)
• 1fade93b2 Add vendor ID to transit switches (#6186)
• 8882096b9 prepare for next release

Contributors

• Eli Treuherz
• Mengxin Liu
• changluyi
• jskrill
• renovate[bot]
• 张祖建

v1.14.30 (2026-02-06)

• edd8727f5 release v1.14.30
• 789cecb81 cni-server: add static fdb entry for subnets with u2o enabled (#6269)
• 970878091 controller: fix ips owned by subnet u2o ip and mcast querier ip deleted in gc (#6132)
• ad122cfc1 security: specify a storage limit for containers (#6259)
• 810fb8368 chore(deps): update dependency go to v1.25.7 (#6267)
• 5818b0ac8 prepare for next release

Contributors

• Mengxin Liu
• renovate[bot]
• 张祖建

v1.14.29 (2026-02-02)

• 2eb89ba0b release v1.14.29
• 26385a6fb fix patch err not Get API (#6245)
• 4309d76c0 fix localnet port should not be static "patch-localnet." (#6244)
• 0a9ac8653 rbac: replace wildcard with a clear list of allowed verbs (#6233)
• ede6f5cab remove duplicate description (#6234)
• b192811d5 prepare for next release

Contributors

• Mengxin Liu
• changluyi
• 张祖建

v1.15.2 (2026-01-29)

• a4ecdaac8 release v1.15.2
• 0622723d3 fix: skip NetworkUnavailable condition in non-primary CNI mode (#6195)
• 25acdabb4 fix(vpcnatgw): nat gateway uses faulty default network (#6212)
• b64138b90 controller: fix vpc egress gateway forward policy not working for targets within the internal subnet's cidr (#6222)
• c608e4841 controller: fix vpc egress gateway not working for targets within the internal subnet's cidr (#6218)
• 90eea0ed3 Update start-ic-db.sh to have gen_conn_addr function defined (#6216)
• c0e9ec780 fix: caching NAD CRD should before all kubeovn crds and pod (#6198)
• e3296ba1f prepare for next release

Contributors

• Mengxin Liu
• SKALA NETWORKS
• andrewlee1089
• dnugmanov
• zbb88888
• 张祖建

v1.14.28 (2026-01-28)

• 816fa70b6 release v1.14.28
• 949ea6ec5 controller: fix vpc egress gateway forward policy not working for targets within the internal subnet's cidr (#6222)
• 0527b9bf6 controller: fix vpc egress gateway not working for targets within the internal subnet's cidr (#6218)
• 9c0e2723e prepare for next release

Contributors

• Mengxin Liu
• 张祖建

v1.15.1 (2026-01-25)

• 02d360b90 release v1.15.1
• b29a0ab9a fix(vpc-nat-gw): use consistent provider for all pod annotations (#6204)
• b3d96f7cd fix(vpcnatgw): cannot DNAT same EIP and same external port on two different protocols (#6201)
• e22295bb1 fix: cleanup auto-created vlan subinterfaces on interface switch (#6193)
• a8be30f83 fix 1.15 base image build
• f6f0b9848 fix: enforce neighbor address validation in configuration (#6134)
• 0f605b825 fix: acquire specified subnet from annotation (#6180)
• 508d9e816 chore(deps): update dependency go to v1.25.6 (#6170)
• 21aaa869b add metallb underlay v6 dualcase (#6159)
• 7ff5bd3c4 fix(helm): rolling upgrade strategy for ovs is wrong (#6160)
• 2a1e6f570 fix(deps): update golang (#6155)
• 05424e620 fix(deps): update golang (#6152)
• 2c40054c5 fix(deps): update golang (#6149)
• d906cccb3 some left crd add description (#6147)
• 4135e1f12 fix(deps): update module golang.org/x/sys to v0.40.0 (#6145)
• 1cef6f91b add kube-ovn cr description (#6133)
• 03efbe58f feat(chart): introduce extraEnv variable for all components (#6142)
• 65df1a7f2 feat(chart): make DaemonSet update strategy configurable in values.yaml (#6136)
• d575fe803 bugfix kube-ovn image tag from v.1.14.0 to v1.15.0, add default labels (#6135)
• b00cbe47f chore(deps): update dependency talos to v1.12.1 (#6126)
• 59aa5cff3 ci: fix loading vpc-nat-gateway image into kind cluster (#6128)
• 4a4d94e69 ci: fix non-primary cni e2e test (#6127)
• 26d9c0259 fix: add validation for iptables rules to prevent malformed commands in nat gateway pod (#6125)
• a8b25e78f cleanup e2e tests
• 78b6de652 Add open flow sync refer to ovn-k8s (#6117)
• 6035ee206 prepare for next release

Contributors

• Diego Gsponer
• Johann Schley
• Mengxin Liu
• SKALA NETWORKS
• changluyi
• clyi
• renovate[bot]
• zbb88888
• zhangzujian
• 张祖建

v1.14.27 (2026-01-23)

• edad2a50f release v1.14.27
• 9ac4ac62e fix(vpcnatgw): cannot DNAT same EIP and same external port on two different protocols (#6201)
• 2f7908a35 fix: cleanup auto-created vlan subinterfaces on interface switch (#6193) (#6197)
• 0f81ac2a3 prepare for next release

Contributors

• Mengxin Liu
• SKALA NETWORKS
• changluyi

v1.14.26 (2026-01-16)

• 42213f789 release v1.14.26
• 545c01cde 1. fix u2o cause metallb underlay err (#6173)
• 5c72c5512 chore(deps): update dependency go to v1.25.6 (#6171)
• 32c5cd2fb fix(helm): rolling upgrade strategy for ovs is wrong (#6160)
• 164b74263 fix(deps): update golang (#6157)
• a6ce50f3e fix(deps): update golang (#6151)
• 5a2624924 some left crd add description (#6147)
• b47447e4e add kube-ovn cr description (#6133)
• 5b4f9de97 feat(chart): introduce extraEnv variable for all components (#6142)
• 5b44ff477 fix(deps): update module golang.org/x/sys to v0.40.0 (#6139)
• cdd8dedef feat(chart): make DaemonSet update strategy configurable in values.yaml (#6136)
• dea20c45a Add open flow sync refer to ovn-k8s (#6117)
• 544889392 prepare for next release

Contributors

• Johann Schley
• Mengxin Liu
• SKALA NETWORKS
• changluyi
• renovate[bot]

v1.15.0 (2026-01-01)

Notable Changes

• ACL log supports ratelimiting. #5938
• Subnet with centralized gateway now supports nodeSelectors. #5956
• Overlay encapsulation NIC selection. #5946
• Performace: skip conntrack for specific dst CIDRs. #5821
• NetworkPolicy supports lax mode which only deny traffic type of TCP, UDP and SCTP. That means ARP, ICMP and DHCP traffic are alaways allowed. #5745
• Remove internal-port type interface code. #5794
• IPPool
  • Multiple IPPools now can bind to the same Namespace. #5731
  • Pods in a bound namespace will only get IPs from the bound pool(s), not other ranges in the subnet. #5731
  • IPPool will create an AddressSet that can be work with VPC Policy Route and ACL. #5920
• AdminNetworkPolicy now supports specify egress peers using FQDNs. #5703
• Using ARP for IPv4 network ready check: now you don't need ACL allow rules for gateway to make Pod running. #5716
• Non-primary CNI mode: you can run Kube-OVN as the secondary only network, without annoying unused annotations and logical switch port allocations. #5618
• VPC NAT Gateway:
  • No default EIP mode: the secondary interface can initialize without a default EIP to avoid the waste. #5605
  • Custom routes: you can control the route rules within the vpc-nat-gateway Pods to control traffic paths. #5608
  • Gratuitous ARP: VPC NAT Gateway automatically sends gratuitous ARP packets during initialization to accelerate network convergence. #5607
• Healthchecks for static endpoints in SwitchLBRules: SLR with both selector or endpoints key can support healthchecks. #5435
• Underlay
  • Node Selectors for ProviderNetwork: instead of adding/removing nodes to the ProviderNetwork one by one, you can use node selectors to simplify the workflow. #5518
  • Different NetworkProviders can now share the same VLAN. #5471
  • Auto create VLAN sub-interfaces. #5966
  • Auto move VLAN sub-interfaces to OVS bridges. #5949
• Adding pod_name and pod_namespace labels to interface metrics. #5463
• IPSec
  • Support cert-manager to issue certificates. #5365
  • Request new certificate if current certificate is not trusted. #5710
• kubectl-ko
  • Collect IPSec and xFRM information. #5472
  • Replace Endpoint with EndpointSlice. #5425
• NetworkAttachment caching: reduce APIServer load in large-scale deployments with Multus. #5386
• Upgrade OVS to 3.5 and OVN to 25.03. #5537

Contributors

• Abdul Basit
• Abhishek Pandey
• Bryan Lee
• Caleb Tallquist
• Congqi Zhao
• Copilot
• DiMalovanyy
• Hargrove Wang
• Joachim Hill-Grannec
• Kevin Carter
• Mengxin Liu
• Paul
• SKALA NETWORKS
• Six
• Vishal Mohan
• andrewlee1089
• aoc55
• changluyi
• cmdy
• dependabot[bot]
• dnugmanov
• github-actions[bot]
• isabelleatkins
• lfpython
• mengyu0829
• narutoqq
• pengpeng wu
• renovate[bot]
• xieyanker
• zbb88888
• zhangzujian
• 张祖建