Cilium 1.20 expands Gateway API, opens eBPF datapath to plugins

New release brings TCP/UDP routing, external authentication, and automatic datapath selection for mixed Linux kernel clusters

By LineZotpaper

Published21 October 2026

Read Time2 min

Cilium 1.20 has been released, introducing broader Kubernetes Gateway API support, an extensible eBPF datapath for third-party plugins, and improvements to sidecarless mutual TLS. The update also simplifies managing fleets with different Linux kernel versions through automatic datapath selection.

The Cilium project announced version 1.20, building on its networking capabilities for Kubernetes. Engineers Nico Vibert and Donia Chaihloudj described Gateway API as 'a much broader traffic management layer' in this release, which moves from Gateway API 1.4 to 1.6. New features include ExternalAuth for HTTP authentication against external services, ListenerSets to allow application teams to manage listeners without platform team intervention, CORS filtering, and support for TCPRoute and UDPRoute for non-HTTP traffic such as databases and DNS.

Platform engineer Mohamed Salem BEN ATAIA praised ListenerSets on LinkedIn, saying, 'It removes a platform bottleneck.' The direction aligns with broader Kubernetes community recommendations as organisations move away from the retired Ingress NGINX controller. AWS has similarly reached GA for Gateway API support in its Load Balancer Controller, though Cilium differs by offering CNI, service networking, and gateway functions from a single project.

The second major change opens Cilium's eBPF datapath to third-party plugins, allowing cloud providers to implement custom instrumentation or networking behaviour without maintaining a fork. Plugins run as separate processes, communicating via gRPC, and can be versioned independently. Vibert and Chaihloudj noted, 'Datapath plugins, developed by Google, make Cilium less like a sealed networking appliance and more like a network operating system.' The plugin mechanism remains beta and is not intended for general use, as it can break Cilium or weaken security.

Cilium 1.20 also introduces automatic selection of the pod datapath. Setting "bpf.datapathMode=auto" makes each agent test its host at startup, using netkit on compatible kernels (Linux 6.8 or later) and falling back to traditional veth pairs elsewhere. The default remains veth, so existing installations are unaffected unless operators opt in.

Finally, version 1.20 adds improvements to ztunnel, the per-node proxy for sidecarless mutual TLS. Operators can now choose between an internal certificate authority and SPIRE-issued workload identities, with Prometheus metrics for monitoring. Ztunnel establishes TLS 1.3 over an HBONE tunnel to avoid first-packet loss, encrypting supported TCP traffic between pods on the same node. It remains beta, while the older Mutual Authentication feature is deprecated. Users upgrading should consult the release notes for breaking changes.

Analysis

Why This Matters

Platform teams managing Kubernetes ingress can reduce operational bottlenecks with ListenerSets and unified Gateway API support for HTTP, TCP, and UDP traffic.
The extensible eBPF datapath lets cloud providers and advanced operators customise networking without forking Cilium, potentially accelerating innovation in Kubernetes networking.
Automatic datapath selection simplifies cluster management across different Linux kernel versions, lowering adoption friction for netkit and improved performance.

Background

Cilium is an open-source networking project for containerised environments like Kubernetes. It uses eBPF to enforce network security and routing policies. Kubernetes recently recommended Gateway API as the successor to the retired Ingress NGINX controller, driving platform adoption. AWS and Cilium have both delivered Gateway API support, with Cilium offering a single-stack solution for CNI, service networking, and gateways.

Key Perspectives

Cilium developers: The release expands functionality while maintaining performance and security, with plugins positioned as a power-user feature for advanced customization. Platform engineers (e.g., Mohamed Salem BEN ATAIA): ListenerSets and broader Gateway API support reduce central configuration overhead, enabling more agile management of ingress traffic. Operators and security teams: The plugin system carries security risks and is beta; operators must weigh customisation benefits against potential instability. Ztunnel also remains beta, requiring careful evaluation before production use.

What to Watch

Adoption of netkit-based datapath and whether Cilium eventually changes the default from veth.
Progress of ztunnel from beta to stable, particularly its overlap with Istio’s ambient mode.
Development of certified plugins from cloud providers and the growth of the plugin ecosystem.
Upstream Kubernetes integration for Gateway API features like ExternalAuth and listener namespacing.

Sources

Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes · InfoQ

Checked

6 claims in this story checked against 1 source: 2 supported.

Show each claim

SupportedThe headline says Cilium 1.20 opens its eBPF datapath to plugins.InfoQ: “A second change opens Cilium's eBPF datapath to third-party plugins.”
Not in the sourcesThe story quotes the engineers describing Gateway API as “a much broader traffic management layer.”InfoQ: “In the release announcement , Cilium engineers Nico Vibert and Donia Chaiehloudj describe Gateway API as a "much broader traffic management layer" in version 1.20.”
Partly supportedThe story spells the engineer’s name as Donia Chaihloudj.InfoQ: “Cilium engineers Nico Vibert and Donia Chaiehloudj”
Partly supportedListenerSets let application teams manage listeners without platform-team intervention.InfoQ: “Application teams can add listeners from their own namespaces while a platform team retains control of the shared Gateway and decides which namespaces may extend it.”
SupportedThe engineers say datapath plugins make Cilium less like a sealed networking appliance and more like a network operating system.InfoQ: “"Datapath plugins, developed by Google, make Cilium less like a sealed networking appliance and more like a network operating system." Nico Vibert and Donia Chaiehloudj”
Partly supportedZtunnel establishes TLS 1.3 over HBONE to avoid first-packet loss.InfoQ: “Ztunnel holds a new connection while it establishes TLS 1.3 over an HBONE tunnel, avoiding the first-packet loss possible with Cilium's older mutual-authentication design”