Cilium 1.20 widens Gateway API and opens its eBPF datapath to plugins

Mixed-kernel Kubernetes fleets can now share one pod datapath setting, while the older Mutual Authentication feature moves toward removal.

Cilium 1.20 has shipped with a major expansion of its Gateway API support, moving from version 1.4 to 1.6 and adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute, which lets HTTP authentication and plain Layer 4 services such as databases and DNS be managed through the same Kubernetes API. A new beta plugin mechanism lets third parties build and upgrade eBPF datapath extensions as separate processes that talk to Cilium over a custom resource and gRPC, although Cilium warns these plugins can break the agent or weaken security. The release also adds an auto mode for the pod datapath that uses netkit where the kernel supports it, which requires Linux 6.8 or later, and falls back to veth elsewhere, so mixed-kernel fleets no longer need separate node pools. Finally, the ztunnel proxy for sidecarless mutual TLS gains a choice between an internal certificate authority and SPIRE-issued identities, plus Prometheus metrics, while the older Mutual Authentication feature is now deprecated. Operators planning an upgrade should review the release notes for changes affecting legacy Mutual Authentication, Kafka-aware policies, Envoy Go extensions and custom CNI configuration.