Skip to content
SPECIFICTION
Get listed

Antrea

antrea.io

Free plan Open source WindowsLinuxAPISelf-hosted
Visit antrea.io
Spec score 9.0 #1 of 31 in Microsegmentation Software

What it is

Antrea provides networking and security for Kubernetes workloads by implementing the Container Network Interface and Kubernetes NetworkPolicy. It uses Open vSwitch as its data plane, including for Kubernetes Service load balancing. Depending on infrastructure and use case, clusters can use VXLAN or Geneve overlays or run without an overlay. Antrea extends Kubernetes policy controls with tiers, rule priorities, cluster-level policies, and Node policies. It can federate clusters with a unified data plane, multi-cluster Services, and security posture. Diagnostics include command-line and UI tools for packet tracing, policy analysis, and flow inspection; metrics can be exported to Prometheus. Pod traffic encryption with IPsec or WireGuard is supported between Linux nodes, but not on Windows nodes. Deployment guides cover Amazon EKS, Azure AKS, and Google GKE, with GKE marked Alpha. The project requires a Kubernetes cluster and the Open vSwitch kernel module on every node, and its overview says it has been tested with Kubernetes 1.23 or later. Antrea is an open-source CNCF sandbox project under Apache License 2.0.

Spec sheet

What it does
Antrea is a Kubernetes-native CNI that provides pod networking and Kubernetes NetworkPolicy enforcement.Read 15 Oct 2026 · antrea.io
Purpose
Antrea implements the Container Network Interface and Kubernetes NetworkPolicy to provide pod networking and security for Kubernetes workloads.Read 3 Oct 2026 · antrea.io
Deployment
A standard installation is performed by applying one YAML manifest, with Helm and cloud-specific guides also documented.Read 15 Oct 2026 · antrea.io
Integrations
The documentation lists integrations and guides for Prometheus, Octant, Multus, and Fluentd.Read 3 Oct 2026 · antrea.io
Support
The project directs users to its Kubernetes Slack channel, mailing lists, community meetings, and office hours.Read 3 Oct 2026 · antrea.io
API documentation
The documentation lists Antrea API groups and a generated Antrea API reference for developers.Read 15 Oct 2026 · antrea.io
Azure support
The AKS guide says Azure support is no longer tested starting with Antrea 2.5 and Azure-related issues are handled on a best-effort basis.Read 3 Oct 2026 · antrea.io
CLI
The project documents antctl, a command-line tool for diagnostics and operational inspection.Read 15 Oct 2026 · antrea.io
Cloud deployment
The documentation provides deployment guides for Amazon EKS, Azure AKS, and Google GKE, with GKE marked Alpha.Read 3 Oct 2026 · antrea.io
CNCF community
CNCF reports 313 contributors and 71 contributing organizations.Read 15 Oct 2026 · cncf.io
CNCF health
CNCF reports a health score of 38, describing it as concerning.Read 15 Oct 2026 · cncf.io
CNCF origin
CNCF records the first commit as 14 June 2019.Read 15 Oct 2026 · cncf.io
CNCF status
CNCF accepted Antrea on 28 April 2021 at Sandbox maturity.Read 15 Oct 2026 · cncf.io
Data plane
It uses Open vSwitch as the programmable networking data plane.Read 15 Oct 2026 · antrea.io
Documentation depth
Documentation covers installation, cloud deployment, configuration, policies, encryption, troubleshooting, APIs, Windows, integrations, multicluster and developer workflows.Read 15 Oct 2026 · antrea.io
Encryption
Inter-node pod traffic can be encrypted with IPsec or WireGuard tunnels.Read 15 Oct 2026 · antrea.io
GitHub activity
The public repository shows about 1.8k stars, 502 forks and more than 4,600 commits.Read 15 Oct 2026 · github.com
Latest release
GitHub lists Antrea v2.7.0 as the latest release and dates it 15 August 2026.Read 15 Oct 2026 · github.com
Layer 7 policy
Antrea supports application-aware Layer 7 HTTP and TLS network policies.Read 15 Oct 2026 · antrea.io
Licence
The repository is released under the Apache License 2.0.Read 15 Oct 2026 · github.com
Limit: operational complexity
The documented prerequisites, node kernel-module requirement and extensive configuration surface make deployment dependent on Kubernetes and host-level expertise.Read 15 Oct 2026 · antrea.io
Limit: production maturity
CNCF classifies Antrea as a Sandbox project, a category intended for experimental projects that are not yet widely tested in production.Read 15 Oct 2026 · cncf.io
Multi-cluster
It can federate clusters with shared data-plane and multi-cluster Service capabilities.Read 15 Oct 2026 · antrea.io
Network modes
It supports overlay networking with VXLAN or Geneve and can also run without an overlay, depending on the infrastructure and use case.Read 3 Oct 2026 · antrea.io
Network policies
The policy model adds tiers, rule priorities, cluster-wide policies and node policies to Kubernetes NetworkPolicy.Read 15 Oct 2026 · antrea.io
Observability
The project includes packet tracing, policy analysis, flow inspection, Prometheus metrics and flow export tools.Read 15 Oct 2026 · antrea.io
Origin news
VMware announced Antrea's CNCF Sandbox acceptance on 5 May 2021 and said the project was originally released in November 2019.Read 15 Oct 2026 · blogs.vmware.com
Overlay networking
Pods can use VXLAN or Geneve overlays, with optional IPsec encryption between nodes.Read 15 Oct 2026 · antrea.io
Policy features
Its policy model adds policy tiering, rule priorities, cluster-level policies, and Node policies to Kubernetes NetworkPolicy.Read 3 Oct 2026 · antrea.io
Praise: extensibility
VMware's announcement highlights Open vSwitch's extensible architecture as enabling rapid feature growth and interoperability contributions.Read 15 Oct 2026 · blogs.vmware.com
Prerequisite
Clusters need NodeIPAMController enabled and the Open vSwitch kernel module on every node.Read 15 Oct 2026 · antrea.io
Project status
Antrea identifies itself as a Cloud Native Computing Foundation sandbox project.Read 3 Oct 2026 · antrea.io
Prometheus
The Antrea Agent exposes metrics through the Antrea apiserver, using port 10350 by default.Read 15 Oct 2026 · github.com
Release additions
Version 2.7.0 adds external-to-pod flow export, IPv6 SecondaryNetwork support, AntreaNodeConfig and FlowStreamService.Read 15 Oct 2026 · github.com
Release operational limit
The v2.7.0 notes warn that rolling updates on large clusters can temporarily disrupt Egress and ServiceExternalIP ownership.Read 15 Oct 2026 · github.com
Release security change
Version 2.7.0 authenticates and encrypts Antrea Agent gossip traffic by default.Read 15 Oct 2026 · github.com
Requirements
The overview says Antrea has been tested with Kubernetes 1.23 or later and requires the Open vSwitch kernel module on every Kubernetes node.Read 3 Oct 2026 · antrea.io
Security process
Security issues are requested by private email to CNCF Antrea maintainers rather than public GitHub issues.Read 15 Oct 2026 · github.com
Security-process limitation
The project security policy says it does not currently assign CVE identifiers itself.Read 15 Oct 2026 · github.com
Self-hosting
Antrea runs inside user-managed Kubernetes clusters on private cloud, public cloud or bare metal infrastructure.Read 15 Oct 2026 · antrea.io
Supported Kubernetes
The project has been tested with Kubernetes 1.23 and later.Read 15 Oct 2026 · antrea.io
Theia integration
Theia supplies Grafana-based visualization of Antrea network flows and policy recommendations.Read 15 Oct 2026 · antrea.io
VM policy
Antrea-native policies can be enforced on virtual machines and bare-metal nodes outside Kubernetes.Read 15 Oct 2026 · antrea.io
Windows support
The same Open vSwitch data-plane approach supports Kubernetes nodes running Windows.Read 15 Oct 2026 · antrea.io

Plans and prices

Antrea Free Apache License 2.0 · requires a Kubernetes cluster and Open vSwitch kernel module on every Kubernetes node Read 3 Oct 2026 · antrea.io

Every Antrea plan and price →

Strong points and limits

Strong points

  • Uses Open vSwitch for pod networking and Service load balancing.
  • Supports overlay and non-overlay networking.
  • Adds cluster-level and Node policies.
  • Provides packet tracing and flow inspection.
  • Exports metrics to Prometheus.

Limits

  • Requires a Kubernetes cluster and Open vSwitch kernel module on every node.
  • Traffic encryption is not supported on Windows nodes.
  • GKE deployment guide is marked Alpha.
  • Azure support is best-effort and no longer tested from Antrea 2.5.

Who it suits

Antrea suits teams running Kubernetes that need pod networking, network policies, diagnostics, or multi-cluster federation. Operators should account for its node requirements and the Windows encryption limit.

Verdict

Antrea extends Kubernetes networking and policy features with diagnostics and multi-cluster capabilities. Its requirements and platform-specific encryption and cloud-support limits matter for deployment planning.

Where Specifiction places it

Alternatives to AntreaAll alternatives →