Cilium 1.20 moves its Gateway API support from version 1.4 to 1.6 and, for the first time, lets outside code plug into its eBPF datapath without a fork. For platform teams, the practical gains are Layer 4 routes and delegated listeners in the gateway, plus one setting that picks netkit or veth per node on fleets with mixed kernel versions.
The release was announced on the CNCF blog on 14 September by Cilium engineers Nico Vibert and Donia Chaiehloudj, and InfoQ covered it on 21 October. Teams running Cilium should read the upgrade notes before moving, especially if they use the legacy mutual authentication feature, which is now deprecated.
What changed in Cilium's Gateway API support?
Cilium now implements Gateway API 1.6. New pieces include ExternalAuth, ListenerSets, CORS filters, TCPRoute, UDPRoute and BackendTLSPolicy, according to the release notes on GitHub. HTTPRoutes also gain 303, 307 and 308 redirects.
ExternalAuth lets an HTTPRoute ask an external authorization service before a request is forwarded. The gateway can pass the request, redirect to a login page or reject it, and the authorizer can add identity headers for the application. Teams that put an auth proxy in front of every service can move that check into the gateway.
TCPRoute and UDPRoute cover plain Layer 4 traffic, so a database or DNS service no longer needs its own LoadBalancer or NodePort Service just to be reachable.
ListenerSets matter most on shared clusters. Application teams can add listeners from their own namespaces while the platform team keeps ownership of the shared Gateway. Vibert and Chaiehloudj said the release makes Gateway API "a much broader traffic management layer."
The timing helps. Many teams are moving off the retired Ingress NGINX controller, and Gateway API is the usual destination.
How do Cilium datapath plugins work?
Datapath plugins let third parties hook into Cilium's eBPF datapath without patching upstream code. Google developed the feature. Each plugin runs as its own process, ships as its own image and talks to the Cilium agent over gRPC. A plugin registers through a CiliumDatapathPlugin custom resource, and a plugin crash does not take the agent down.
Setting the resource's attachmentPolicy to Always makes Cilium fail closed if it cannot reach the plugin. That is the right choice for security tooling and a risky one for anything you have not tested.
The feature is beta. Cilium's documentation warns that plugins can break the datapath or weaken security, and that plugin authors may need to keep up with internal changes. Most platform teams will meet this through a cloud provider or vendor rather than write plugins themselves.
Can you run netkit on a mixed-kernel fleet?
Yes, if you opt in. Netkit replaces the veth pair between a pod and its host and needs Linux 6.8 or later. Until now, a fleet with older kernels had to be split into separate node pools to use it.
Setting bpf.datapathMode=auto makes each agent check its host at startup and use netkit where the kernel supports it, veth everywhere else. The default stays veth, so nothing changes until you set it. Operators can see what each node chose with cilium-dbg status or the cilium_feature_datapath_config metric.
What else should platform teams check?
Ztunnel, the per-node proxy for sidecarless mutual TLS added in 1.19, can now use an internal CA or SPIRE-issued identities. It remains beta.
Kubernetes ClusterNetworkPolicy is supported, including the Admin and Baseline tiers.
Clusters can migrate from cluster-pool to multi-pool IPAM in place, without a rebuild.
Services honour the PreferSameZone and PreferSameNode traffic distribution hints.
IPv6 prefix allocation for AWS ENI IPAM is in beta, and the Multi-Cluster Services API implementation is now stable.
The cilium-cni binary shrank from 76 MB to 16 MB.
The release notes flag possible action for users of legacy mutual authentication, Kafka-aware policies, Envoy Go extensions, the v2alpha1 CiliumNodeConfig API, the libnetwork integration and custom CNI configuration.
Expect ListenerSets and ExternalAuth to see real use first. Datapath plugins are the bigger architectural shift, but they will take longer to reach production clusters.
