DEVOURED
Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more
Cilium 1.20 adds native IPv6 support for AWS ENI IPAM and introduces a plugin architecture to extend its eBPF datapath without project forks.
What: Cilium 1.20 upgrades to Gateway API v1.6, adds TCPRoute and UDPRoute support, and introduces datapath plugins. It also enables dual-stack IPv6/IPv4 for AWS ENI IPAM and provides a 'netkit auto' mode for easier performance optimization.
Why it matters: By allowing cloud providers to extend the eBPF datapath through plugins rather than forks, Cilium is transitioning from a standalone tool to a extensible network operating system foundation.
Takeaway: If you are on AWS and waiting for IPv6 parity, update to 1.20; otherwise, consider migrating from Ingress NGINX to Cilium's native Gateway API implementation.
Deep dive
- Gateway API Expansion: Supports TCPRoute/UDPRoute for non-HTTP services and ExternalAuth for centralized north-south traffic authorization.
- Datapath Plugins: Allows third parties to instrument the eBPF datapath via separate processes, eliminating the need to maintain private forks.
- ENI IPv6 Support: Finally bridges the feature parity gap with IPv4 on AWS, allowing pods to receive routable IPv6 addresses.
- Netkit Auto: Simplifies deployment by auto-selecting the high-performance 'netkit' device on supported kernels (>= 6.8) and falling back to 'veth' on older ones.
- ListenerSets: Enables safe, multi-tenant delegation of Gateway configuration to application namespaces.
- Weighted Maglev: Supports granular traffic splitting and connection-preserving maintenance drains for selectorless services.
Decoder
- eBPF: A technology that allows running sandboxed programs in the Linux kernel for networking, observability, and security without changing kernel source code.
- ENI IPAM: AWS-specific IP address management that assigns VPC-routable IP addresses directly to Kubernetes pods.
- Maglev: A network load balancer hashing algorithm, originally from Google, designed for consistent backend traffic distribution.
- veth: A virtual ethernet pair used to connect containers to a host's network namespace, now being superseded by higher-performance netkit.
Original article
Full article content is not available for inline reading.
Explore all 54 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi