The OpenDaylight Project on Monday released the third version of its network controller software, also naming the founding 12 members of a new end user advisory group, both signs that the open source software-defined networking project maintains momentum despite recent setbacks with sponsors.

The new release, called Lithium in keeping with the project's atomic number naming scheme, adds native support for OpenStack Neutron, the cloud architecture toolkit's networking module. That integration is aimed at enhancing the OpenDaylight SDN controller for users pursuing network functions virtualization (NFV) — a hot technology with service providers at the moment — says OpenDaylight executive director Neela Jacques.

"Over the last six months there's been a huge shift, as people have gone from white papers to real urgency" about getting NFV into production, says Jacques. Lithium brings new support for service chaining, a critical component of NFV deployments. "You can't do NFV with just OpenStack and the hardware," says Jacques.

With that in mind, OpenDaylight Lithium's new native support for Neutron comes even as a debate swirls within the OpenStack community over the networking module's technical approach and viability.

"Neutron is evolving," says Jacques. "Rather than comment and judge from the outside, we want to be part of the solution."

Lithium also adds security enhancements, which include a new secure channel for communication between the controller and network devices, an audit and analysis tool for network traffic, and full support for Java 8, which has security improvements over Java 7.

OpenDaylight's security focus heightened significantly following the December revelation of a critical vulnerability in the controller software that went un-patched for months. David Jorm, the veteran security expert with IIX who first decried OpenDaylight's security process on a project email list, now chairs the project's technical security committee.

Jorm says OpenDaylight has made "enormous progress" on security this year. "We've gone from having no security response process to a well-oiled machine," he says in an email to SDxCentral, pointing out new security issue documentation and an ongoing summer internship project to enhance security engineering.

"I would say OpenDaylight's security stance is now well and truly on par with other large, mature, and successful open source projects," says Jorm.

OpenDaylight's roller-coaster ride from Helium (the second release) to Lithium also included turmoil with major founding vendors of the project, after Juniper and VMware both reduced their sponsorship to the silver level.

That sponsor setback doesn't appear to have slowed OpenDaylight's momentum with developers and end users though. The project has a growing developer base, with 152 individual contributors in the past month and 351 in the past year, according to Open HUB. Thousands more work on code downstream from the active committers, says Jacques.

Also announced Monday were 11 new members of the OpenDaylight Advisory Group, an end user group with technical input on the project. Joining Comcast, the first Advisory Group member, are representatives from Telefónica I+D, AT&T, Orange, CableLabs, Arizona State University, Caltech, China Telecom, Nasdaq, Deutsche Telekom, T-Mobile, and China Mobile.