Cilium

v1.20.0Networking & Messaging

Jul 29, 2026Copy link

Cilium v1.20.0 is a major feature release introducing Gateway API v1.6.1, Kubernetes Cluster Network Policy support, IPv6 ENI IPAM beta, datapath plugins, and substantial datapath optimizations. It carries 14 mandatory breaking changes including removal of the docker libnetwork plugin, Envoy Go Extensions, Kafka-aware policies, deprecated CNI/encryption/load-balancer flags and CRDs, and a CNI configuration default version bump. A grpc-go security update is also included. All operators must review deprecated flags, CRD versions, and endpoint identifier usage before upgrading.

• breakingDocker libnetwork plugin removed

  The docker libnetwork plugin is removed in v1.20.0. If you use Cilium's libnetwork integration for Docker daemon networking, you must remove or migrate that configuration before or at upgrade.

• breakingEnvoy Go Extensions and Kafka-aware policies removed

  Envoy Go Extensions (proxylib) and Kafka-aware network policies are removed in v1.20.0, having been deprecated since v1.16. If you enforce Kafka L7 policies or use proxylib, migrate to CiliumEnvoyConfig-based solutions before upgrade.

• breakingv2alpha1 CiliumNodeConfig API removed

  The v2alpha1 CiliumNodeConfig API is removed in v1.20.0; it was promoted to v2 in v1.16. Update any manifests or tools referencing cilium.io/v2alpha1 CiliumNodeConfig to use v2.

• breakingBeta Mutual Auth deprecated

  Beta Mutual Auth support is deprecated in v1.20.0 and will be removed in a future release. Plan to stop using this feature.

• breakingEncryption IPsec interface option removed

  The encryption.ipsec.interface Helm value and bpf_network.c program are removed in v1.20.0. If this value appears in your Helm configuration, remove it; the program was unused since at least v1.18.

• breakingEncryption strict-mode flags removed

  Three encryption-strict-mode flags are removed in v1.20.0: enable-encryption-strict-mode, encryption-strict-mode-cidr, and encryption-strict-mode-allow-remote-node-identities. Remove these from agent or Helm configuration if present.

• breakingk8s-api-server flag removed

  The k8s-api-server daemon flag is removed in v1.20.0. Remove this from agent configuration if present.

• breakingAWS pagination flag replaced

  The aws-pagination-enabled Cilium operator flag is removed in v1.20.0 in favor of aws-max-results-per-call. Update operator configuration accordingly.

• breakingDeprecated cloud IPAM fields removed

  Long-deprecated cloud provider IPAM fields are removed in v1.20.0: spec.eni.instance-id, spec.eni.min-allocate, spec.eni.pre-allocate, spec.eni.max-above-watermark, and status.azure.interfaces[].GatewayIP. Remove these from CiliumNode specs if present.

• breakingClustermesh MCS API Helm value replaced

  The clustermesh.enableMCSAPISupport Helm value is removed in v1.20.0 in favor of clustermesh.mcsapi.enabled. Update Helm values if you reference the old name.

• breakingNode-port algorithm and mode flags removed

  Two load-balancing flags are removed in v1.20.0: node-port-algorithm and node-port-mode. Remove these from agent configuration if present.

• breakingCES slice-mode flag removed

  The ces-slice-mode flag is removed in v1.20.0. Remove this from agent configuration if present.

• breakingEndpoint identifier lookup migration required

  Endpoints created by the CNI plugin are no longer addressable by legacy container-id or pod-name identifiers via the Cilium agent API in v1.20.0. Use cni-attachment-id:<containerID>:<ifName> or cep-name:<namespace/name> instead.

• breakingCNP/CCNP Proxylib fields removed

  Proxylib-related fields are removed from CNP and CCNP CRDs in v1.20.0. Remove any L7 proxylib policies and migrate to CiliumEnvoyConfig.

• breakingCNI configuration version default changed

  The default CNI configuration version is bumped from 0.3.1 to 1.0.0 in v1.20.0. If this breaks CNI compatibility with your environment, use the cni.customConf Helm value to revert to 0.3.1.

• breakingHubble labelsContext metric format changed

  Hubble metrics labelsContext parsing now requires comma-separated values (e.g. labelsContext=source_ip,destination_ip). Previous configurations mixing commas and pipes will fail. Update labelsContext configuration if you use it.

• securitygrpc-go security update

  grpc-go is updated to v1.82.1 to address a security issue. The fix ships in v1.20.0 and applies to all deployments.