chore(main): release 0.17.0

[github-actions]

🤖 I have created a release beep boop

0.17.0 (2026-08-29)

Features

• aaa: built-in osvbng vendor dictionary for l2gw radius attributes (43ed1e5)
• config: implement auto cpu layout tiers and cp-cores intent knob (#435) (64d15d0)
• ha: l2gw circuit sync with standby pre-install and promotion enable (0e92a4b)
• l2gw: config schema, session model, and AAA attribute plumbing (167f8f3)
• l2gw: dataplane dhcp trigger snoop arming and multi-nni access (582051e)
• l2gw: dhcpv6 relay identity options for aaa policies (7444d92)
• l2gw: export per-circuit counters via telemetry sdk (9827251)
• l2gw: layer 2 wholesale gateway with dhcp-triggered circuits (#402) (4d772e1)
• l2gw: packet-triggered circuits with tuple identity and idle-timeout (#403) (c7f4bcb)
• l2gw: reconcile static maps and allocators on config commit (5f5a710)
• l2gw: vxlan overlay nnis via generic tunnel rx dispatch (#404) (d316718)
• l2gw: wholesale circuit control plane (c6b3801)
• logger: per-key storm sampler, sampled auth-failure logging (#436) (bcae7d7)
• qos: hierarchical qos control plane with port and s-vlan aggregates (#422) (95e35f0)
• qos: hqos observability - session and hierarchy views, CLI renderings, prometheus fixes (#434) (b8f47a8)
• southbound: evpn-signaled vxlan tunnels with dynamic vtep discovery (#409) (6e21c0f)
• southbound: generate osvbng_l2gw binapi bindings (31b7b36)
• southbound: l2gw circuit stats and paired counter indices (dba1065)
• southbound: l2gw circuit wrappers and interface (6ffcb53)
• southbound: pseudowire headend termination prep and vxlan transport termination (#405) (c668a58)
• southbound: regenerate osvbng_l2gw binapi for trigger svlan range (7910fa6)

Bug Fixes

• aaa: make the accounting bucket sleep interruptible (#458) (98cdd83)
• cgnat: key mappings and bypass by the session vrf on every programming path (#505) (86ef344)
• cgnat: refuse pool config that crash-loops or silently misconfigures (#509) (9bd7938)
• ci: record the swept state on the rig, not in an actions variable (#470) (a8a4053)
• dhcpv6: reject overflowing option lengths instead of panicking (#431) (6545ccd)
• dhcpv6: send LDRA Relay-Reply to port 547, not 546 (#424) (46b7101)
• docker: decide the plugin drop from a marker the tmp purge cannot delete (#465) (8475153)
• docker: grow the hugepage pool instead of resetting it (#433) (0925816)
• docker: treat the auto core sentinel as unset before taskset (#471) (77f1a58)
• docker: wait for the dataplane API socket before starting osvbngd (#477) (3e2d358)
• ha: restore synced sessions on graceful switchover and resolve encap sub-interface (ed9e3da)
• ha: restore synced sessions on graceful switchover and resolve encap sub-interface (#400) (b76ee3d)
• ha: send the srg garp flood on the access interface with per-session vlan encap (#418) (1150e78)
• ipoe: send unsolicited na for restored sessions (#451) (d66ff01)
• pppoe: bind the session interface unnumbered on ha restore (#510) (1e7b0f7)
• pppoe: make dual-stack dhcpv6 reach the dataplane (#446) (f13730d)
• pppoe: size session interface mtu as mru plus pppoe overhead (#406) (2066cf5)
• qos: convert AAA download-rate from bps to kbps without truncation (#426) (8c6d452)
• scripts: avoid set -e death in deploy-vm.sh on hosts without SMT (#413) (a8835da)
• shm: drain one punt ring per VPP thread for the v2 punt protocol (#415) (52e23a5)
• southbound: disable kernel ipv6 on interfaces claimed for the dataplane (#461) (975d806)
• southbound: re-attach ipoe sessions on already-exists instead of failing restore (#462) (20619c4)

Reverts

• worker pin, identical cores across labs concentrate contention (#467) (ef3e87b)

---

This PR was generated with Release Please. See documentation.