InfoQ: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes
Cilium 1.20 has been released with support for Kubernetes Gateway API 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute. The release also adds a beta eBPF datapath plugin mechanism that runs as a separate process, a bpf.datapathMode=auto setting that selects netkit or veth per node, and further work on the ztunnel sidecarless mutual TLS proxy. The ztunnel release notes say the older Mutual Authentication feature is deprecated.
What changes for platform teams
Platform teams can let application teams add listeners through ListenerSets while keeping control of the shared Gateway, and can use ExternalAuth for HTTP authorisation at the gateway. Mixed-kernel fleets can use automatic netkit selection without splitting node pools, but operators should check the release notes for action needed on legacy Mutual Authentication, Kafka-aware policies, Envoy Go extensions and custom CNI configuration.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules