Cilium 1.20 Unifies Kubernetes Ingress and L4 Routing via Gateway API v1.6 and eBPF

The Cilium project has released version 1.20, introducing significant enhancements centered on Kubernetes Gateway API v1.6 adoption, multi-protocol traffic management, and cloud provider extensibility. Key technical highlights include support for the Gateway API ExternalAuth filter (GEP-1494), integration of TCPRoute and UDPRoute for non-HTTP workloads, and ListenerSets for multi-tenant gateway configurations. The release also delivers beta support for AWS ENI IPAM with IPv6 prefix delegation, in-place migration from cluster-pool to multi-pool IPAM without rebuilding clusters, and support for upstream Kubernetes ClusterNetworkPolicy (KCNP). Additionally, new datapath plugins enable cloud providers to hook custom eBPF programs directly into Cilium's core datapath. This release matters because it accelerates the consolidation of cluster networking, security enforcement, and ingress routing into a single infrastructure layer. Traditionally, engineering teams running Kubernetes have maintained fragmented stacks: one tool for CNI networking, another for Ingress controllers (such as Ingress NGINX), and separate middleboxes or sidecars for external authentication. With the upstream retirement of Ingress NGINX, operators face an imperative to modernize ingress architecture. Cilium 1.20 allows platform teams to handle edge authentication before requests reach application pods, while simultaneously routing diverse traffic types—from databases and message brokers over TCP to telemetry and VoIP over UDP—through a single declarative Gateway API. In the broader cloud native landscape, infrastructure primitives are increasingly standardizing around upstream Kubernetes APIs while delegating performance-critical execution to eBPF. Capabilities that once required proprietary Custom Resource Definitions (CRDs) or out-of-tree plugins are being normalized into standards like Gateway API, Multi-Cluster Services (MCS), and ClusterNetworkPolicy. Cilium's alignment with these standards reflects a wider maturation: platform operators no longer have to choose between portability across clouds and high-performance kernel-level networking. Furthermore, enabling modular datapath plugins positions Cilium as a foundational network operating system that hyperscalers can customize without maintaining divergent downstream forks. In practice, platform operators should evaluate their ingress migration timelines. Teams currently managing dedicated ingress controllers can pilot Gateway API on Cilium 1.20, centralizing authentication policies using external auth providers via standard HTTPRoute attachments. Enterprise environments on AWS running dual-stack IPv6 architectures can leverage the new ENI IPAM capabilities to streamline VPC address routing. When planning upgrades, operators should note that the legacy mutual authentication beta is deprecated in favor of ztunnel-based SPIFFE/HBONE mTLS flows, and test existing NetworkPolicies against the newly supported tiered ClusterNetworkPolicy model before standardizing in staging and production.