Cilium 1.20 just made the Gateway API a first-class enforcement plane: ExternalAuth, TCPRoute and UDPRoute support, and ENI IPAM for IPv6 all push Cilium from a dataplane and network policy engine toward being the default north–south gateway, auth decision point, and cloud-native IP allocator.
That sentence is not an exaggeration. ExternalAuth lets Cilium call out to external authorization endpoints during Gateway API processing — think OPA, an external RBAC service, or an identity provider evaluating requests before they reach backends. Add TCPRoute/UDPRoute and you no longer need to bolt on a separate TCP/UDP L4 gateway to get protocol-aware routing. Then tack on ENI IPAM for IPv6 and Cilium can allocate AWS ENI-backed IPv6 addresses so workloads are reachable with provider-managed addressing on EKS clusters.
Operationally this changes a few big things for platform teams:
-
Centralized auth decisions at the gateway: ExternalAuth makes the gateway the obvious place to enforce authz for HTTP and non-HTTP protocols. That reduces duplication, but it also concentrates the trust boundary in the data plane. If you treat Cilium as just "networking," you now have an identity and policy surface to audit.
-
Protocol parity without sidecars: TCPRoute/UDPRoute support lets teams express L4 routing in Gateway API instead of inventing custom CRDs or running separate TCP load balancers. For mixed L7/L4 stacks this simplifies routing topology.
-
IPv6 on cloud with provider IPAM semantics: ENI IPAM for IPv6 matters because, on AWS, ENIs are the mechanism that ties provider-managed IPv6 addresses to nodes or secondary interfaces. Cilium offering ENI-backed IPv6 addresses reduces the custom work needed to make dual-stack or IPv6-only workloads directly routable in a VPC.
Practical headaches you should expect: ENI IPAM interacts with cloud quotas and attachment limits — Cilium’s allocator will now sit next to cloud controller managers in the responsibility graph. Update capacity planning and alerts for ENI saturation. ExternalAuth introduces latency and failure modes at the gateway: put circuit breakers and local-fallback policies in front of auth endpoints. Finally, the more the Gateway does, the bigger the blast radius; security reviews must include the dataplane, not just control-plane RBAC.
Meshery becoming a CNCF incubating project matters here, too. With Cilium pushing deeper into service-mesh and gateway responsibilities, observability and conformance tooling that understands multi-mesh topologies and Gateway API semantics becomes necessary. Meshery's incubation strengthens the ecosystem for testing Gateway API behaviors and interoperability across implementations.
OpenTelemetry: carbon signals and agent telemetry triage
Separately, OpenTelemetry discussions are no longer just about spans and metrics. There’s active work to represent software carbon intensity as an OpenTelemetry semantic convention — effectively treating carbon emissions as telemetry you can pipeline, aggregate, and alert on alongside latency and error rates. That’s the right evolution: teams will make placement, batch-windowing, and resource choices differently if carbon intensity is a first-class signal.
At the same time, CNCF commentary highlights an urgent operational problem: AI and coding agents produce huge volumes of low-signal telemetry. The OpenTelemetry Collector is increasingly positioned as the place to filter and reduce that data before it hits backends. If you’re experimenting with agentic tooling and you’re shipping every keystroke and intermediate inference result, expect your observability bill and signal-noise ratio to explode. The Collector’s processors and sampling strategies are where you should automate culling.
This isn't just feature creep; it's a pattern. Projects that consolidate adjacent responsibilities — network enforcement, auth, IPAM — win simplicity but create new cross-cutting risks. Cilium 1.20 is the right direction for teams aiming to reduce component sprawl, but it's also overdue for platform owners to revise operational playbooks: capacity planning for ENIs, latency budgets for ExternalAuth, and stricter audits of dataplane privileges.
Final thought: watch the combo. A Gateway API implementation that enforces auth and allocates provider IPs is the kind of thing that accelerates platform convergence — and platform lock-in. Meanwhile, adding carbon as a telemetry axis and filtering agent noise will change what we monitor and why. If you're building a platform today, plan to make your gateway and your telemetry pipeline first-class subjects in your runbooks and budgets.