Cilium 1.20 Advances to Gateway API v1.6, Adds IPv6 AWS ENI IPAM and Extensible eBPF Datapath Plugins
Cilium 1.20 moves to Gateway API v1.6.1 with ExternalAuth and TCPRoute/UDPRoute, adds beta IPv6 AWS ENI IPAM, extensible datapath plugins, and shrinks its CNI binary from 77 MB to 16 MB.
Overview
Cilium, the eBPF-based networking and security project for Kubernetes, released version 1.20 on July 29, 2026, according to the official GitHub release page. The release moves Cilium’s Gateway API implementation from v1.4 to v1.6.1, adds beta support for IPv6 addresses through AWS ENI IPAM, introduces extensible eBPF “datapath plugins,” and shrinks the cilium-cni binary from roughly 77 MB to 16 MB. The CNCF Blog published a detailed walkthrough of the release’s features on September 14.
What We Know
Gateway API jumps to v1.6.1
Cilium 1.20 moves its Gateway API support from v1.4 to v1.6.1, “bringing support for capabilities that graduated across both upstream releases,” according to the GitHub release notes. Among the additions is a new ExternalAuth filter: “HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494,” the release notes state. The CNCF Blog describes the mechanism in more detail: “You attach the filter to an HTTPRoute, and for every matching request the gateway checks with an external authorization service before forwarding any traffic.”
The release also adds TCPRoute and UDPRoute support, letting non-HTTP traffic run through the same Gateway API model as HTTP and gRPC. “Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic,” per the GitHub release notes. The Kubernetes Gateway API specification itself graduated TCPRoute and UDPRoute to standard status in version 1.6, as The Machine Herald previously reported; Cilium 1.20 is now implementing that graduated spec.
A feature called ListenerSets, which the release notes label “Delegate Gateway Listeners,” lets “application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway,” according to GitHub. Cilium also adds BackendTLSPolicy support, letting “operators configure TLS and backend certificate validation for traffic between the gateway and application services,” per the same release notes, along with native CORS support and additional 303, 307 and 308 HTTPRoute redirect codes.
IPv6 comes to AWS ENI IPAM, in beta
Cilium 1.20 adds beta support for allocating IPv6 prefixes through AWS ENI IPAM — the mode that gives Kubernetes pods routable addresses directly on a VPC. The GitHub release notes describe it as building “on the move to the multi-pool allocator.” Separately, the release adds in-place migration from cluster-pool IPAM to multi-pool IPAM: “Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt,” according to the same notes.
Extensible eBPF datapath plugins
Cilium 1.20 introduces what the release notes call an “Extensible Datapath”: “Datapath plugins let cloud providers extend or instrument Cilium’s eBPF datapath with independently versioned programs, without maintaining a Cilium fork,” according to GitHub. The CNCF Blog adds that with the plugins, “third-party code can instrument Cilium’s eBPF datapath as its own plugin, running as a separate process that Cilium reaches out to, without patching or forking Cilium itself.”
The release also adds automatic selection of Cilium’s netkit datapath mode: setting bpf.datapathMode=auto makes an agent “use netkit automatically on supported kernels and fall back to veth on other nodes,” per the GitHub release notes, which note the default setting remains veth.
Cluster mesh, network policy and observability changes
Cilium’s implementation of the Kubernetes Multi-Cluster Services API is now stable, described in the release notes as “recommended for portable service discovery through ClusterMesh.” The release also adds support for the upstream Kubernetes ClusterNetworkPolicy API, “including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy,” according to GitHub, and a new cluster-mesh policy entity that “selects every endpoint across a mesh, making cross-cluster security policies easier to express.”
On the ztunnel sidecarless mTLS path introduced in Cilium 1.19 — previously covered by The Machine Herald — the 1.20 release notes describe improved identity management: “The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node.”
Cilium’s service load balancer also gains the Kubernetes PreferSameZone and PreferSameNode traffic distribution hints, and Maglev consistent-hashing load balancing now honors a service.cilium.io/weight annotation on EndpointSlices. “A weight of zero drains new connections while allowing existing connections to continue,” the release notes state.
Smaller binary, updated dependencies
The cilium-cni binary installed on every node “has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node,” according to the GitHub release notes. The release also updates its dependency baseline: Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2, while runtime and builder images move to Ubuntu 26.04 and the default CNI configuration version moves from 0.3.1 to 1.0.0, per the same notes.
Cilium 1.20 is, by the project’s own count, a large release: “More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars,” according to GitHub.
What We Don’t Know
The release notes flag that some upgrading users “may need to take action” if they rely on legacy Mutual Authentication, Envoy Go extensions, Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, libnetwork integration, or a custom CNI configuration, per GitHub, but the notes point to a separate upgrade guide for specifics rather than detailing each migration path themselves. Adoption figures — how many clusters have upgraded to 1.20, or how widely the new IPv6 ENI IPAM and datapath-plugin features are being used in production — have not been published.