Antrea Roadmap

This document lists the new features being considered for the future. The intention is for Antrea contributors and users to know what features could come in the near future, and to share feedback and ideas. Priorities for the project may change over time and so this roadmap is likely to evolve. A feature that is not listed now does not mean it will not be considered for Antrea. We definitely welcome suggestions and ideas from everyone about the roadmap and Antrea features. Reach us through Issues, Slack and / or Google Group!

Planned Features

The following features are considered for the near future:

  • Windows support improvements Antrea supports Windows K8s Node since version 0.7.0. However, a few features including: Egress, NodePortLocal, IPsec encryption are not supported for Windows Node yet. We will continue to add more features for Windows, and improve Antrea Agent and OVS installation on Windows Nodes.

  • Antrea NetworkPolicy enhancements Antrea added support for Antrea-native policies in addition to K8s NetworkPolicy since version 0.8.0, and already supports Antrea (Namespace scoped) NetworkPolicy, ClusterNetworkPolicy, ClusterGroup, Tier, and features including traffic statistics, traffic logging, policy realization status, Drop and Reject actions, policy priority, AppliedTo at rule level, Namespace isolation, FQDN and Service as egress rule destination. We will continue to add more advanced NetworkPolicy features.

  • Network diagnostics and observability Network diagnostics and observability is one area we want to focus on. Antrea already implements some useful features on this front, including Octant UI plugin, CLI, Traceflow, network flow export and visualization, Prometheus metrics, OVS flow dumping and packet tracing, NetworkPolicy diagnostics. We will continue to enhance existing features and add new features to help diagnose K8s networking and NetworkPolicy implementation, and to provide good visibility into the Antrea network.

  • NFV and Telco use cases We plan to explore and provide support for NFV and Telco use cases. We will add native Pod multi-interface support in Antrea, and support Pod interfaces on SRIOV devices, OVS DPDK bridge, overlay network, and Network Service Chaining.

  • L7 security policy and visibility Enhance Antrea to provide application level security and visibility to K8s workloads. This includes extending Antrea-native NetworkPolicies to support L7 / application protocols (HTTP, DNS, etc.), and extending Antrea diagnostics and observability features to get into application level visibility.

  • Multi-cluster networking We would extend Antrea from CNI of a single Kubernetes cluster to multi-cluster networking, and implement multi-cluster features like multi-cluster Services, cross-cluster connectivity, multi-cluster NetworkPolicies. Antrea multi-cluster functionalities are under active development. Check the Antrea Multi-cluster user guide to learn what features are already supported.

  • Analytics With the network flows exported by Antrea, we plan to further build an analytics solution that consumes the network flows, and provides traffic analysis, NetworkPolicy recommendation, security and network performance monitoring. We already started a sub-project of Antrea - Theia - for network flow visibility and analytics. Stay tunned!

  • K8s Node security So far Antrea focuses on K8s Pod networking and security, but we would like to extend Antrea-native NetworkPolicies to cover protection of K8s Nodes too.

  • NetworkPolicy scale and performance tests Evaluate and benchmark the NetworkPolicy implementation performance at a large scale, including the policy computation performance of Antrea Controller and the OVS datapath performance.

  • OVS with DPDK or AF_XDP Leverage OVS with DPDK or AF_XDP for high performance.