Cilium v1.20.1 - CIDR Policy Bypass And DSR Recovery

Cilium v1.20.1 shipped on 18 August 2026 as a stable patch on the 1.20 line, not a release candidate. The change that matters in production is a silent CIDR policy bypass, plus matching traffic drops, after an agent restart. The same tag also shortens recovery for broken TCP flows that hit a DSR-enabled Service and fixes an MCS-API CRD race when clustermesh-apiserver starts before the CRD version is installed.

The full release notes and downloads are on the GitHub release page.

Batch jobs and stream processors on Kubernetes often sit behind CIDR allow lists and NetworkPolicy objects. v1.20.1 fixes a silent CIDR policy bypass after the Cilium agent restarts, and the matching case where traffic is dropped instead of allowed. That is a correctness bug, not a log cleanup.

A NetworkPolicy update could be ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity after a pod relabel. Tightened or relaxed policy did not apply until that wait ended. Pod relabel during a rollout is the trigger. Controllers that rewrite labels to move work between queues sit on that path.

The Helm chart now exposes endpointPolicyUpdateTimeoutDuration. If policy apply latency is already a paging signal, that value can be set without a fork of the chart templates. The ipcache CIDR reference counter now keys on canonical prefixes, which stops duplicate or split counts when the same range is written in more than one form.

Verbose policy logging could crash the endpoint manager on restored endpoints. That combination shows up during an incident: debug flags go on, agents restart, and the process that should explain the policy dump instead exits. The crash is fixed in this tag.

Direct Server Return is still a common way to keep Service traffic off the hop back through the load balancer. Disrupted TCP connections that access a DSR-enabled Service now recover faster. Fragmented packets no longer send the DSR BPF path looking for a TCP header that may not sit in the first fragment.

Unintended RevDNAT then applied to client to pod TCP connections when an identical connection had previously been established through a DSR Service. Direct pod access after a Service call could still see rewritten addresses. Clients that talk to a pod IP after using the Service are in the blast radius.

On the host side, ARP is now turned off on the base devices before those devices are brought up. The host firewall BPF path tolerates unknown conntrack protocols and relies on policies rather than treating an unknown protocol as a hard error.

Kernels older than 5.12 could hit a BPF verifier reject when IPv6 was enabled. The notes call that pre-v5.12. If a node pool is still on that kernel generation, this patch is the difference between the datapath loading and the agent refusing to program IPv6.

The only item listed under Major Changes is documentation. Cluster Mesh docs were rewritten with a new introduction, updated load balancing guidance, and Helm first setup plus certificate configuration. That rewrite does not change the datapath. It does change the install path operators copy from.

The code fix that does matter for multi cluster is the MCS-API CRD install and upgrade race. If clustermesh-apiserver started before the CRD version was actually installed, the install or upgrade could fail. Startup order during a Helm apply is not guaranteed, so this is a real upgrade flake, not a documentation leftover.

Azure IPAM stopped writing redundant CiliumNode status updates on every sync when the node’s Azure interfaces were unchanged. That cuts apiserver write traffic on large Azure node pools. On EKS ENI IPAM, the agent now waits for the ENI netlink interface before it programs ingress routes and rules, which removes the spurious “unable to find ifindex for interface MAC” warning. Hostnetwork pods also had an abnormal IP allocation path; that path is closed.

The operator could deadlock on shutdown when CiliumEndpointSlices were in play. Gateway API got several status and ingestion fixes, including mixed HTTP and TCP listeners on one Gateway. An HTTPRoute pointing at that Gateway was rejected with NotAllowedByListeners when the TCP listener set an explicit AllowedRoutes.Kinds restriction. Helm now accepts 0 for envoy.httpUpstreamLingerTimeout and templates it into the ConfigMap. The Envoy path also restores http-idle-timeout as the route idle timeout source.

v1.20.1 is a patch, not a beta. The notes do not list a migration guide or a breaking API change. The practical reason to move from 1.20.0 is the CIDR bypass after restart, the two minute NetworkPolicy ignore window after a relabel, the DSR RevDNAT and recovery bugs, and the Cluster Mesh CRD race. CI and workflow refactors in the same tag are internal.

Confirm envoy.httpUpstreamLingerTimeout and endpointPolicyUpdateTimeoutDuration in the Helm values if those knobs are in use. A linger value of 0 is now a first class chart input rather than something the template drops.