Cilium 1.20 expands Gateway API and opens eBPF datapath to plugins

Cilium 1.20 ships with Gateway API 1.6 support (ExternalAuth, ListenerSets, CORS, TCPRoute and UDPRoute), beta plugins for its eBPF datapath, and automatic netkit/veth datapath selection. The release also adds a choice between an internal CA and SPIRE for ztunnel in sidecarless mutual TLS.

• Gateway API moves from 1.4 to 1.6, adding ExternalAuth, ListenerSets, CORS, TCPRoute and UDPRoute
• eBPF datapath plugins run as a separate process via a CRD and gRPC, in beta
• bpf.datapathMode=auto picks netkit on Linux 6.8+ and falls back to veth
• ztunnel adds internal CA or SPIRE identities; legacy Mutual Authentication is deprecated