Cilium 1.20 Expands Kubernetes Gateway API Support and Opens eBPF Datapath

Expanded Gateway API Capabilities

Cilium 1.20 introduces significant advancements in its Kubernetes Gateway API support, moving from version 1.4 to 1.6. Key additions include ExternalAuth, ListenerSets, CORS filtering, TCPRoute, and UDPRoute. These features extend traffic management capabilities to include HTTP authentication and non-HTTP services like databases and DNS, integrating them under the standard Kubernetes API used for web and gRPC traffic.

Enhanced Authorization and Layer 4 Routing

The ExternalAuth feature enables HTTPRoute to consult an external authorization service before forwarding requests to an application. This allows for conditional request handling, such as forwarding, redirecting to a login page, or rejection, and can pass identity headers. TCPRoute and UDPRoute eliminate the need for LoadBalancer or NodePort Services for plain Layer 4 traffic, simplifying network configurations for these types of services.

Improved Multi-Team Gateway Management

ListenerSets address ownership challenges in multi-team environments. Application teams can now add listeners from their own namespaces, while platform teams maintain control over the shared Gateway and define which namespaces can extend it. This change removes a common bottleneck where central platform teams were required for every new hostname or port configuration.

Open eBPF Datapath for Customization

A major change in Cilium 1.20 is the opening of its eBPF datapath to third-party plugins. Previously, cloud providers needing custom instrumentation or networking behaviors had to contribute changes upstream or maintain their own forks. Now, plugins can run separately, offering greater flexibility and reducing the overhead for custom network integrations.

Alignment with Kubernetes Networking Trends

These updates align with broader trends in Kubernetes networking, where the Gateway API is increasingly recommended as organizations transition away from older controllers like Ingress NGINX. Cilium's implementation is notable for providing CNI, service networking, and gateway functions within a single project, offering a unified solution.