# Cilium v1.20.1 — 1.20.1

- Product: Cilium (https://whatsnew.fyi/product/cilium)
- Vendor: Cilium
- Date: 2026-08-18
- Version: v1.20.1
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.20.1
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.20.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions
- **changed** — Demote stale ADS endpoint warning
- **changed** — Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service
- **fixed** — Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged
- **fixed** — Don't look for TCP header on fragmented packets in DSR
- **fixed** — Tolerate unknown CT protocols and rely on policies in host firewall
- **fixed** — Fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed
- **fixed** — Turn ARP off on the base devices before bringing them up
- **fixed** — Avoid warning about endpoints being deleted in endpoint watchdog
- **fixed** — Fix silent CIDR policy bypass and traffic drops after agent restart
- **fixed** — Allow envoy.httpUpstreamLingerTimeout to accept 0 as a chart value and template into configmap
- **fixed** — Restore http-idle-timeout as the route idle timeout source in Envoy
- **fixed** — Fix a BPF verifier reject on pre-v5.12 kernels when IPv6 is enabled
- **fixed** — Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices
- **fixed** — Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel
- **fixed** — Fix spurious unable to find ifindex for interface MAC agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules
- **fixed** — Fix abnormal IP allocation caused by hostnetwork pod
- **fixed** — Fix unintended RevDNAT for client-to-pod TCP connections when an identical connection was previously established through a DSR Service
- **fixed** — Allow setting endpointPolicyUpdateTimeoutDuration in Helm

Summary of Changes
------------------

**Major Changes:**
* docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR cilium/cilium#47615, Upstream PR cilium/cilium#47351, @MrFreezeex)

**Minor Changes:**
* envoy: demote stale ADS endpoint warning (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47148, @nezdolik)
* Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47529, @julianwiedmann)

**Bugfixes:**
* azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47449, @jaredledvina)
* bpf: dsr: don't look for TCP header on fragmented packets (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47640, @julianwiedmann)
* bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47621, Upstream PR cilium/cilium#47343, @smagnani96)
* clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47824, @MrFreezeex)
* datapath: turn ARP off on the base devices before bringing them up (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47838, @aanm)
* endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47625, @christarazi)
* endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47880, @weizhoublue)
* envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47741, @jdw6359)
* envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47583, @aanm)
* Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47765, @julianwiedmann)
* Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR cilium/cilium#47967, Upstream PR cilium/cilium#47802, @bimmlerd)
* Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47727, @aanm)
* Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47295, @aanm)
* Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47552, @haozhangami)
* Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47593, @julianwiedmann)
* fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47754, @weizhoublue)
* Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46842, @pidreher)
* gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47840, @mhofstetter)
* gateway-api: mark unresolved backend service ports in route status (Backpo

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.20.1]_