Cilium v1.20.0

Cilium 1.20 focuses on production maturity and scale, introducing full support for Gateway API 1.6 (including TCP/UDP), native Kubernetes ClusterNetworkPolicy, and a new extensible eBPF datapath. Major performance optimizations to the load balancer and Envoy synchronization significantly improve its behavior in large-scale multi-cluster environments.

Gateway API v1.6.1 with TCP/UDP support and External Auth — Enables standard Kubernetes Gateway API for non-HTTP traffic (databases, game servers) and adds critical enterprise features like delegated listener ownership for multi-tenant teams and external authentication.

Upstream Kubernetes ClusterNetworkPolicy and Cluster Mesh Policy Entities — Simplifies policy management in large-scale environments by adopting standard Kubernetes ClusterNetworkPolicy and introducing a 'cluster-mesh' entity for easy cross-cluster security rules.

Extensible eBPF Datapath Plugins — Allows platform teams to inject custom eBPF code into the Cilium datapath without forking the project, enabling provider-specific optimizations and instrumentation.

Scalability Enhancements for Large-Scale Load Balancing and Envoy Updates — Significantly improves control plane responsiveness and reduces memory overhead in large clusters by flattening load-balancer state and using incremental Envoy updates (Delta xDS).

Enhanced Ztunnel Identity and Transparent Encryption — Enables zero-trust pod-to-pod encryption that supports modern identity providers like SPIRE and handles local node traffic, providing stronger security with less configuration overhead.