Cilium 1.20 has been released with expanded support for Kubernetes Gateway API, reaching version 1.6 from 1.4 and introducing features that extend traffic management beyond web services to databases and DNS. The release, announced by Cilium engineers Nico Vibert and Donia Chaiehloudj, also includes a new plugin system for its eBPF datapath, automatic selection of network devices across mixed kernel versions, and continued development of sidecarless mutual TLS through the ztunnel proxy.
The Gateway API update brings ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute to Cilium's traffic management capabilities. ExternalAuth lets an HTTPRoute check with an external authorization service before routing a request to an application, allowing the gateway to forward, redirect to a login page, or reject based on the response, while the authorizer can send identity headers to the application. TCPRoute and UDPRoute eliminate the need to use LoadBalancer or NodePort Services for plain Layer 4 traffic. ListenerSets solve an ownership challenge by letting application teams add listeners from their own namespaces while a platform team maintains control of the shared Gateway and determines which namespaces can extend it. A second major change opens Cilium's eBPF datapath to third-party plugins, allowing cloud providers needing custom instrumentation or networking behavior to avoid contributing changes upstream or maintaining a fork. The plugin runs as a separate process and can be built, versioned and upgraded independently, with Cilium communicating through a small custom resource and a gRPC interface. The release also introduces automatic selection of the pod datapath: setting bpf.datapathMode=auto makes each agent test its host at startup, use netkit where the kernel supports it, and fall back to a traditional veth pair elsewhere, with netkit requiring Linux 6.8 or later.
According to Vibert and Chaiehloudj, Gateway API becomes "a much broader traffic management layer" in version 1.20. Platform engineer Mohamed Salem BEN ATAIA wrote on LinkedIn that ListenerSets close the gap between teams owning Routes and needing a central change for a new hostname or port, stating in his assessment that "It removes a platform bottleneck." The authors describe the plugin mechanism, developed by Google, as making Cilium "less like a sealed networking appliance and more like a network operating system."
The shift aligns with broader movement in Kubernetes networking toward Gateway API as organizations move away from the retired Ingress NGINX controller, with AWS also reaching general availability with Gateway API support in its Load Balancer Controller for HTTP, gRPC, TCP and UDP. Cilium's implementation differs because the same project can provide the CNI, service networking and gateway functions together. The plugin mechanism is beta and isn't presented as a general extension system for ordinary cluster users—Cilium's documentation says it's intended for operators with detailed knowledge of Cilium's internals and warns that a plugin can break Cilium or weaken security. The automatic datapath selection avoids dividing mixed fleets into separate node pools solely to select a datapath mode, according to Vibert and Chaiehloudj.
Version 1.20 advances ztunnel, the per-node proxy introduced in Cilium 1.19 for sidecarless mutual TLS, adding a choice between an internal certificate authority and SPIRE-issued workload identities along with Prometheus metrics for enrollment and connection health. Ztunnel holds a new connection while it establishes TLS 1.3 over an HBONE tunnel, avoiding the first-packet loss possible with Cilium's older mutual-authentication design and encrypting supported TCP traffic between pods on the same node. This approach parallels Istio's ambient mode, with the Cilium implementation building on the ztunnel project originally created for Istio. Cilium's ztunnel remains beta, while its older Mutual Authentication feature is now deprecated, and operators considering an upgrade should consult the 1.20 release notes for possible action on legacy Mutual Authentication, Kafka-aware policies, Envoy Go extensions, custom CNI configuration and several deprecated APIs. The extensible datapath and ListenerSets together suggest platform teams will gain flexibility without sacrificing central governance, while the question remains whether third-party plugin adoption will fragment operational patterns across cloud providers or converge around shared abstractions.