Cilium 1.20 asks Ingress NGINX users to hand north-south traffic to the CNI they already run

The release post says plainly what it wants. "If you are still running Ingress NGINX, now is the time to let the CNI you already run take on that traffic management too," the post says ^[5]. The project is talking to its own installed base, and the feature list under the line is narrower than the pitch.

Two minor versions of Gateway API absorbed in one Cilium release is a real jump ^[15]. The addition that changes an operator's week is ExternalAuth, which the post describes as handling authentication and authorization before a request reaches the application ^[4]. For a team whose auth hop today is an ingress annotation pointing at an internal service, that is the same call from a different process, owned by a different rota.

The work in leaving an ingress controller is in the annotations, not the route objects. Take every Ingress object you actually serve traffic with and sort its annotations into three piles: ones that map to a first-class Gateway API v1.6 object or filter, ones you would have to rebuild as an ExternalAuth or CORS config, and ones nobody remembers switching on. The second pile is the migration estimate. The release post does not publish that mapping ^[18].

TCPRoute and UDPRoute are the parts I would move first. Non-HTTP traffic is traffic an HTTP ingress controller never carried, so nothing is taken away from a system that currently works.

Version 1.20 also supports the stable MCS API and Kubernetes ClusterNetworkPolicy next to Cilium's own CRDs ^[7]. A platform team can write portable manifests where portability matters and keep CiliumNetworkPolicy for everything else.

The AWS half of the release is aimed at a different reader: the one who has run out of VPC IPv4 space. Datadog built the ENI IPv6 support, four years after the feature request was first raised ^[10]. That dates the original ask to roughly 2022 ^[16]. It ships as beta, so most teams get a test-cluster answer this quarter.

On the datapath side, netkit needed kernel 6.8 or newer, so a fleet with mixed kernels either skipped it or split nodes into pools by kernel version and configured each pool separately ^[13]. netkit replaces the veth pair and its overhead to bring pod networking to host-level throughput ^[11]. Meta has rolled it out across millions of containers, and ByteDance reports a 10% performance improvement in its own tests ^[12].

Consolidating makes sense when Cilium is already the CNI and the rebuild pile fits inside one sprint. When it does not fit, moving the TCP and UDP routes first gets part of the benefit without putting a login path behind a new authorization filter in the same change window. ExternalAuth is the part with a bill attached: every route behind the gateway then depends on a config the platform team owns ^[4].