Cilium 1.20 arrives with three concrete upgrades that affect traffic control, pod networking, and extensibility: the Gateway API moves to v1.6 and adds ExternalAuth, CORS filters, ListenerSets, plus TCPRoute and UDPRoute for non‑HTTP traffic; ENI IPAM gains beta IPv6 support, enabling dual‑stack pods on AWS; and the datapath can now auto‑select between netkit and the traditional veth pair. Each change reduces operational friction for teams that already run Cilium as their CNI and opens new pathways for security and performance tuning.
Cilium Gateway API enhancements
The Gateway API component jumps from version 1.4 to 1.6. New resources include ExternalAuth for pre‑application authentication, CORS filters for cross‑origin handling, and ListenerSet definitions that group listeners. Importantly, TCPRoute and UDPRoute extend the API beyond HTTP, allowing north‑south traffic such as database or RPC streams to be described in the same declarative model. For teams using Ingress NGINX, the implication is a potential migration path to a single CNI‑based control plane, consolidating ingress and egress policies under one source of truth.
ENI IPAM with IPv6 support
Previously, Cilium’s ENI IPAM mode on AWS only allocated IPv4 addresses. In 1.20 the feature is marked beta for IPv6, letting the operator attach an IPv6 /80 prefix to each node’s ENI via Prefix Delegation and hand out pod addresses from that range. The configuration is straightforward:
ipam:
mode: eni
eni:
enabled: true
ipv6:
enabled: true
Pods on an EKS cluster now report both an IPv4 and an IPv6 address, e.g., 192.168.128.71,2a05:d01c:38d:4c02:909e::e771. This makes the pod IPs VPC‑routable on IPv6, which can simplify security groups and reduce reliance on NAT for dual‑stack workloads.
Automatic datapath mode selection (netkit auto)
Netkit replaces the veth pair with a high‑performance device, but it requires kernel ≥ 6.8. Cilium 1.20 introduces the bpf.datapathMode=auto flag. At startup each agent probes the host kernel; if netkit is supported it is enabled, otherwise the agent falls back to veth. The default remains veth, so existing clusters are unchanged until the flag is set. Operators can verify the chosen mode with cilium-dbg status and the cilium_feature_datapath_config metric.
Datapath plugins (beta)
Extending Cilium’s eBPF datapath previously required upstream contributions or maintaining a fork. The new plugin model runs third‑party code as a separate process that Cilium calls into, eliminating the need to patch the core. This approach lowers the maintenance burden for cloud providers or specialized platforms that need custom datapath logic.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
AI and data‑intensive workloads often need low‑latency, dual‑stack networking; the IPv6 ENI mode removes a long‑standing barrier on AWS. Security engineers can now enforce authentication and CORS policies at the gateway level before traffic reaches services, reducing the attack surface of individual pods. SRE teams gain a simpler upgrade path for netkit by toggling a single flag, while still supporting mixed‑kernel fleets. Finally, organizations that require bespoke datapath behavior should evaluate the beta plugin interface as a lower‑risk alternative to forking Cilium. Monitoring the cilium_feature_datapath_config metric and validating Gateway API resources in a staging environment are practical first steps before production rollout.
