Cilium v1.20.0 - Gateway And Service Traffic Changes

Cilium v1.20.0 was published on July 29, 2026. The main operator change is the move from Gateway API v1.4 to v1.6.1, with broader traffic routing and backend controls for data services as well as HTTP applications.

The full release notes and downloads are on the GitHub release page.

The version jump covers capabilities that graduated across two upstream Gateway API releases. That scope makes API object and controller compatibility part of upgrade planning, especially on clusters where another component manages Gateway API resources. Validate the installed resources and route status before moving production traffic.

BackendTLSPolicy adds TLS and certificate validation between a Gateway and its backend services. This matters when the edge proxy is not the end of the trust boundary. Database gateways, internal APIs, and ingestion endpoints can keep validated TLS on the service side of the proxy.

Support for TCPRoute and UDPRoute brings databases, DNS servers, and other non HTTP protocols into the same Gateway API model used for HTTP and gRPC. It reduces the need for a separate routing model merely because a workload carries a stream or datagram protocol.

Operators can set bpf.datapathMode=auto to select netkit on kernels that support it and fall back to veth elsewhere. The default remains veth, so existing clusters do not switch merely by installing the release. Mixed kernel fleets can still run different datapath devices under one setting, which makes node level rollout checks important.

The other material lifecycle change is migration from cluster-pool IPAM to multi-pool IPAM without rebuilding the cluster. That removes a large infrastructure dependency from the allocator transition. It does not remove the need to check address pools, node allocation state, and workload reachability before widening the rollout.

Maglev now reads the service.cilium.io/weight annotation from EndpointSlices. A backend with weight zero receives no new connections while existing connections can continue. For stateful consumers, streaming workers, and long lived database sessions, this is a cleaner maintenance control than removing a backend and terminating every active flow at once.

The operational boundary is still connection based. Weight zero does not promise that an existing session will finish quickly, so deploy automation must retain its own timeout and termination policy. The annotation controls new selection, not application shutdown behavior.

This is a stable release, not a release candidate or beta, but the notes identify configurations that require action. Check the upgrade guide before changing clusters that use legacy Mutual Authentication, Envoy Go extensions, Kafka aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, libnetwork integration, or a custom CNI configuration.

Treat those items as rollout gates rather than cleanup for later. The release summary does not spell out each migration in full. Inventory the affected API objects and integrations first, apply the documented transition, and only then move the control plane and agents. The complete scope remains available on the Cilium v1.20.0 release page.