--- title: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath... description: Cilium 1.20 broadens Kubernetes Gateway API support and opens its eBPF datapath to plugins. It moves from Gateway API 1.4 to 1.6, adding ExternalAuth,... canonical: https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes | daily.dev og:description: Cilium 1.20 broadens Kubernetes Gateway API support and opens its eBPF datapath to plugins. It moves from Gateway API 1.4 to 1.6, adding ExternalAuth,... og:url: https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j og:image: https://api.daily.dev/og/posts/5dOV4HM1J.png og:image:alt: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 0 upvotes · 0 comments ## Summary Cilium 1.20 broadens Kubernetes Gateway API support and opens its eBPF datapath to plugins. It moves from Gateway API 1.4 to 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute, bringing HTTP auth and non-HTTP traffic like databases and DNS under one API. A new plugin mechanism lets operators extend the eBPF datapath as a separate process via gRPC, though it's beta and meant for Cilium internals experts. Setting bpf.datapathMode=auto lets agents auto-select netkit (Linux 6.8+) or fall back to veth across mixed-kernel fleets. Ztunnel, Cilium's sidecarless mTLS proxy, now supports SPIRE-issued identities alongside an internal CA. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What new Gateway API features does Cilium 1.20 support? Cilium 1.20 moves from Gateway API 1.4 to 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute. ExternalAuth lets an HTTPRoute consult an external authorization service before forwarding, redirecting, or rejecting a request. TCPRoute and UDPRoute bring plain Layer 4 traffic like databases and DNS under the Gateway API instead of requiring LoadBalancer or NodePort Services. _Teams planning a Gateway API rollout can track Cilium's feature additions on daily.dev._ ### How does Cilium's new eBPF datapath plugin system work? A plugin runs as a separate process that can be built, versioned, and upgraded independently of Cilium itself, communicating through a small custom resource and a gRPC interface. It's currently beta and intended for operators with detailed knowledge of Cilium's internals, since a plugin can break Cilium or weaken security and may need updates as Cilium's architecture changes. _Platform engineers evaluating custom networking extensions follow eBPF datapath changes on daily.dev._ ### What is Cilium's bpf.datapathMode=auto setting and when should I use it? Setting bpf.datapathMode=auto makes each Cilium agent test its host at start-up, use the netkit network device where the kernel supports it, and fall back to a traditional veth pair elsewhere. Netkit requires Linux 6.8 or later. The default remains veth, so existing installations are unaffected unless an operator opts in, avoiding the need to split mixed-kernel fleets into separate node pools. _Operators managing mixed-kernel Kubernetes fleets can check datapath compatibility notes on daily.dev._ ## Similar posts on daily.dev - [Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more](https://daily.dev/posts/cilium-1-20-gateway-api-externalauth-tcproute-udproute-eni-ipam-for-ipv6-and-more-yswg7phsz) · CNCF · 8 upvotes · 0 comments - [Understanding Kubernetes Network Security](https://daily.dev/posts/understanding-kubernetes-network-security-i5js8crfk) · cilium · 4 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#service-mesh](https://daily.dev/tags/service-mesh), [#cilium](https://daily.dev/tags/cilium), [#gateway-api](https://daily.dev/tags/gateway-api) [View this post on daily.dev](https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes","url":"https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j"},"datePublished":"2026-10-21T09:02:49.434Z","dateModified":"2026-10-21T09:03:19.449Z","description":"Cilium 1.20 broadens Kubernetes Gateway API support and opens its eBPF datapath to plugins. It moves from Gateway API 1.4 to 1.6, adding ExternalAuth,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/466c8a01ab23c90403d3675e9fa683cc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/466c8a01ab23c90403d3675e9fa683cc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kubernetes,service-mesh,cilium,gateway-api","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cilium-1-20-expands-gateway-api-and-opens-ebpf-datapath-for-kubernetes-5dov4hm1j#faq","mainEntity":[{"@type":"Question","name":"What new Gateway API features does Cilium 1.20 support?","acceptedAnswer":{"@type":"Answer","text":"Cilium 1.20 moves from Gateway API 1.4 to 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute. ExternalAuth lets an HTTPRoute consult an external authorization service before forwarding, redirecting, or rejecting a request. TCPRoute and UDPRoute bring plain Layer 4 traffic like databases and DNS under the Gateway API instead of requiring LoadBalancer or NodePort Services. Teams planning a Gateway API rollout can track Cilium's feature additions on daily.dev."}},{"@type":"Question","name":"How does Cilium's new eBPF datapath plugin system work?","acceptedAnswer":{"@type":"Answer","text":"A plugin runs as a separate process that can be built, versioned, and upgraded independently of Cilium itself, communicating through a small custom resource and a gRPC interface. It's currently beta and intended for operators with detailed knowledge of Cilium's internals, since a plugin can break Cilium or weaken security and may need updates as Cilium's architecture changes. Platform engineers evaluating custom networking extensions follow eBPF datapath changes on daily.dev."}},{"@type":"Question","name":"What is Cilium's bpf.datapathMode=auto setting and when should I use it?","acceptedAnswer":{"@type":"Answer","text":"Setting bpf.datapathMode=auto makes each Cilium agent test its host at start-up, use the netkit network device where the kernel supports it, and fall back to a traditional veth pair elsewhere. Netkit requires Linux 6.8 or later. The default remains veth, so existing installations are unaffected unless an operator opts in, avoiding the need to split mixed-kernel fleets into separate node pools. Operators managing mixed-kernel Kubernetes fleets can check datapath compatibility notes on daily.dev."}}]} ```