Antrea is a Kubernetes networking solution written in Go that implements container networking and security services using Open vSwitch as its data plane. The project operates at Layer 3/4 to provide comprehensive networking capabilities for Kubernetes clusters, with support for both Linux and Windows nodes. Open vSwitch serves as the foundation for implementing Pod networking and Kubernetes Network Policies efficiently, while also enabling hardware offloading for demanding workloads.
The repository is classified across multiple networking and security domains including container communication, overlay networks, software-defined networking, network policy enforcement, and multi-cluster support. It functions as a CNI plugin for Kubernetes and supports various deployment scenarios from private clouds to public clouds and bare metal infrastructure. Users can select appropriate traffic modes with or without overlay networking based on their specific infrastructure requirements.
Antrea's feature set extends significantly beyond basic networking. The project provides a comprehensive network policy model that builds upon standard Kubernetes Network Policies with additions such as policy tiering, rule priorities, cluster-level policies, and Node policies. The platform includes multi-cluster networking capabilities that federate multiple Kubernetes clusters with unified data plane and security posture. For observability, Antrea integrates with Theia to provide fine-grained visibility into workload communication, network flow visualization in Grafana dashboards, and automated Network Policy recommendations.
The project supports encryption of inter-Node Pod traffic through IPsec or WireGuard tunnels, addressing security requirements for sensitive deployments. Antrea-native policies can be enforced on non-Kubernetes nodes including virtual machines and baremetal servers, with the related Nephe project extending security policies to VMs across cloud environments. The platform includes troubleshooting and monitoring tools with CLI and UI capabilities for packet tracing, policy analysis, and flow inspection, along with Prometheus metrics exposure and network flow export capabilities.
The repository shares contributors with significant Kubernetes ecosystem projects including projectcontour/contour, kubernetes/kubernetes, and kubernetes/website, demonstrating its integration within the broader cloud-native community.
Antrea requires Kubernetes 1.23 or later and mandates that the Open vSwitch kernel module be present on every cluster node. The NodeIPAMController must be enabled, either through kubeadm configuration or via Antrea Controller's NodeIPAM feature. Deployment is simplified through a single YAML manifest file application. The project is licensed under Apache License 2.0 and maintains CII Best Practices certification, reflecting its commitment to security and code quality standards.
