Cilium 1.20.0-pre.3: eBPF dataplane, kube-proxy-replacement, and Hubble observability guidance

Summary

Cilium 1.20.0-pre.3 appears in pre-release Helm packaging and image references. The artifacts show incremental work in three practical areas platform teams should watch: eBPF dataplane changes (CO-RE, maps, program variants), kube-proxy-replacement and L4/L7 load-balancing behavior, and deeper Hubble-driven observability without per-pod sidecars. Because these are pre-release artifacts, they are the right time to exercise CI, kernel compatibility checks, and observability-cost planning.

What the pre-release artifacts indicate

The Helm chart and image references for 1.20.0-pre.3 suggest focused, incremental changes rather than a breaking API shift. Key themes to watch:

• eBPF dataplane enhancements: more CO-RE artifacts and map variants can reduce distro-specific kernel module needs, but they can also change how Cilium validates and loads BPF programs during install and upgrades.
• Load-balancing / L4-L7 handling: continued tweaks to the kube-proxy-replacement codepath and to Envoy integration can alter connection tracking, NAT, and affinity edge cases; these often surface as Helm values and config knobs in pre-releases.
• Observability integrations: Hubble and related pipelines are being extended to expose richer network- and socket-level telemetry, enabling many use cases without a sidecar per pod but raising cardinality and storage concerns for backends.

None of these are necessarily breaking changes, but pre-releases are where subtle regressions appear. If you consume the Helm chart, stage this chart in a gating channel and validate thoroughly.

Quick Helm install to stage the chart

Use your own repo and values as appropriate. This example installs the pre-release Helm chart into kube-system and enables Hubble for testing:

helm repo add cilium https://helm.cilium.io/
helm repo update
helm install cilium cilium/cilium --version 1.20.0-pre.3 -n kube-system --create-namespace \
  --set global.kubeProxyReplacement=partial \
  --set hubble.enabled=true

Operational checks platform engineers must validate

Pre-release artifacts commonly introduce subtle operational impacts. Make the following deterministic checks part of your gating tests:

• Helm packaging and install paths: validate your Helm values for cluster initialization, kube-proxy-replacement mode, hubble settings, and operator reconciliation. Run a full staging install and ensure Helm templates and CRD handling match your automation.

• Kernel, BTF and libbpf compatibility: validate node images include BTF (or supply vmlinux) and that libbpf and bpftool versions meet the chart's requirements. Run Cilium diagnostics and any vendor-provided preflight checks in CI to surface missing kernel helpers.

• Connection tracking and NAT semantics: exercise externalTrafficPolicy=Local, services behind external load balancers, and synthetic TCP/UDP load tests to detect changes to conntrack limits, NAT behaviour, or affinity under the kube-proxy-replacement path.

• Observability cardinality and retention: enable Hubble in staging and measure event/series growth. Plan sampling, label reduction, and retention policies for Prometheus, Cortex/Thanos, or OTel backends before enabling full telemetry.

• Policy enforcement and rollout safety: test CiliumNetworkPolicy changes in dry-run or staged modes where possible. Progressive rollout and automation that can detect and revert broad deny outcomes reduce blast radius for misapplied rules.

Diagnostics and verification tips

• Use the Helm chart in a staging namespace and validate pod and daemonset rollout (kubectl -n kube-system get pods; kubectl -n kube-system rollout status ds/cilium).
• Run Cilium diagnostics and collect logs (the cilium CLI and cilium-bugtool are useful when available) and verify Hubble telemetry ingestion into your observability stack.
• Automate tests that cover connectivity, policy enforcement, and L7 routing with and without sidecars.

CNCF and ecosystem context

The trend across CNCF observability discussions is consolidation around eBPF as both a dataplane and a telemetry primitive. Practical implications:

• Sidecar reduction: many L3–L7 signals can be surfaced without an Envoy sidecar per pod for a subset of use cases, lowering CPU/memory costs but moving more responsibility into kernel execution.
• Telemetry fidelity vs. cost: richer BPF-derived labels and events increase cardinality, so ingestion contracts (label names, resource attributes, sampling) must be stable and coordinated across projects to avoid breaking downstream storage and query costs.
• Hybrid meshes: expect hybrid patterns where Istio or other control planes drive routing/policy while Cilium enforces dataplane primitives via BPF; validate mTLS, L7 routing, and cross-tool observability correlation in those scenarios.

Actionable checklist for platform teams

• Stage pre-release charts into a gating channel and run full upgrade CI including synthetic traffic, e2e policy tests, and API compatibility smoke tests.
• Validate node images for BTF or vmlinux and lock expected libbpf/bpftool versions in build images. Fail CI if required kernel features are missing.
• Project telemetry budget impact from Hubble/eBPF signals into Prometheus/Cortex/OTel costs. Define sampling and label-reduction policies before enabling full telemetry.
• Harden policy rollout: use progressive rollouts, dry-runs, and automated reversion for unintended wide-deny outcomes.
• Test coexistence with Envoy/Istio: run hybrid scenarios to validate control-plane/dataplane interaction, mTLS, L7 routing, and trace correlation.

Conclusion

This week's activity was focused on dataplane and observability iteration rather than control-plane releases. Pre-release artifacts like Cilium 1.20.0-pre.3 are where integration points and operational regressions surface early; treat them as required inputs to your upgrade gate. Plan CI tests, kernel compatibility checks, and telemetry budgets so you can adopt the eBPF-driven improvements without reactive firefighting.

Sources

• Cilium Project Journey Report (CNCF) – positioning of Cilium and eBPF in cloud-native networking and observability
• cilium 1.20.0-pre.3 Helm chart on Artifact Hub – latest pre-release packaging for Cilium
• Cilium joins the CNCF – CNCF blog on Cilium as an incubating (now graduated) eBPF-based project
• Cloud Native Computing Foundation reaffirms Istio maturity with project graduation
• Observability Day: Project Updates – CNCF YouTube session on observability initiatives
• Flux: July 2022 Update (for historical context on Flux cadence and ecosystem role)
• eBPF and Service Mesh: Performance and Observability – technical blog on eBPF’s role versus traditional meshes