🔒 Encryption & Authentication

• 🔐 Encryption Strict Modes: Both IPsec and WireGuard transparent encryption modes now support a "strict mode" to require traffic to be encrypted between nodes. Unencrypted traffic will be dropped in this mode. (cilium/cilium#39239, cilium/cilium#42115, @rgo3, @julianwiedmann)
• 🚇 Ztunnel Beta: You can enroll namespaces into Ztunnel, which enables TCP connections between workloads to be transparently encrypted and authenticated. (cilium/cilium#42766, cilium/cilium#42819, cilium/cilium#43227 and others, @ldelossa, @rgo3, @nddq)
• 👥 Mutual Authentication: The out-of-band Mutual Authentication feature is now disabled by default, pending community feedback. If you have a requirement for mTLS, consider trying the new Ztunnel integration. (cilium/cilium#42665, @christarazi)
• ↪️ Accelerate IPsec: The IPsec encryption mode now supports BPF Host Routing for faster route lookups (cilium/cilium#41997, @pchaigno)

🚠 Networking

• 🚀 BIG TCP in Tunnels: Leverage upcoming Linux support for BIG TCP when communicating over UDP-based tunnels such as VXLAN and Geneve. (cilium/cilium#43416, @gentoo-root)
• 🥌 Packetization-Layer Path MTU Discovery: Detect maximum transmission unit (MTU) sizes for network paths using TCP. (cilium/cilium#42012, cilium/cilium#43710, @tommyp1ckles)
• 🚆 IPv6 Underlay: You can now choose IPv6 for the tunnel underlay address family on dual-stack clusters. (cilium/cilium#40324, @pchaigno)
• 🏷️ Multi-Pool IPAM is ready for wider use: Update the Multi-Pool IPAM feature to work with IPsec and direct routing modes, and promote it from Beta to Stable. (cilium/cilium#40460, cilium/cilium#42191, @pippolo84)
• 🎭 More Configurable Masquerade: IP Masquerade configuration can now be customized for traffic sent to nodes in other IP subnets, and addresses in IPAM pools can be excluded from masquerade (cilium/cilium#37568, @behzad-mir; cilium/cilium#43380, @alimehrabikoshki)

🕸️ Services and Service Mesh

• 📣 Layer-2 Announcements: Add support for Neighbor Discovery Advertisements for IPv6 Layer-2 Announcements. (cilium/cilium#39648, @msune)
• 🔁 IPv6 Service Loopback: Pods can now connect to themselves via a Kubernetes "loopback service" using IPv6. (cilium/cilium#39594, @saiaunghlyanhtet)
• ⛩️ Gateway API Enhancements: Cilium's GAMMA support now includes support for using GRPCRoute as well as HTTPRoute. (cilium/cilium#41936, @youngnick)

🛣️ Border Gateway Protocol (BGP)

• 🔌 Advertise Addresses from Interfaces: There's a new Interface BGP advertisement type that allows advertisement of IPs assigned on local interfaces. This can be useful for example in multi-homing setups, where a common node's loopback address can be advertised via multiple BGP sessions over different network interfaces. (cilium/cilium#42469, @rastislavs)
• ✉️ Override Source IP addresses: You can override the auto-generated BGP session source IP with the IP address applied on the configured sourceInterface to allow binding the BGP connection to the loopback address which is not tied to the specific physical interface's lifecycle (cilium/cilium#42583, @rastislavs)
• 🔁 Withdraw Empty Routes: Optionally withdraw BGP routes when a service has 0 endpoints, to allow balancing to a different DC/cluster with externalTrafficPolicy=Cluster (cilium/cilium#40717, @oblazek)
• ⚠️ Move to cilium.io/v2 API: The support for the older CiliumBGPPeeringPolicy v1 API is now removed and should be replaced with v2 APIs. (cilium/cilium#42278, @rastislavs)

🛰️ Observability

• 🔬 Trace IP Options: Configure Cilium and Hubble to trace specific packets through the cluster using IP Options. (cilium/cilium#41306, @Bigdelle)
• 🚩 Filter Encrypted Flows: Filter flows when using the hubble command line to understand the encryption status of the traffic, either --encrypted or --unencrypted. (cilium/cilium#43096, @SRodi)
• 🔖 Tag Drops with Policy Names: Hubble v1.Events drop messages now include which Network Policy caused the drop. (cilium/cilium#41693, @41ks)

🌅 Performance and Scale

• ⚡ Faster Network Policy Computation: Improve Cilium resource usage for handling selectors in network policies. (cilium/cilium#42008, @jrajahalme; cilium/cilium#42580, @odinuge)
• 🔌 More Efficient Connection Tracking: Several improvements have been made to reduce the number of connections being tracked by Cilium, particularly when using Geneve, VXLAN or WireGuard. (cilium/cilium#38782, @BenoitKnecht; cilium/cilium#41990, @bersoare)
• 💾 Better Scale in AWS: Reduce memory usage for cilium-operator in large AWS environments with many resources. (cilium/cilium#42529, @liyihuang)

⚙️ Operations

• 📦 Access Helm charts via Registry: Helm charts are also available under quay.io/cilium/charts/cilium (cilium/cilium#43624, @aanm)
• 📊 Metrics Encryption: Add TLS/mTLS support for Prometheus metrics exposed by the Cilium Operator. (cilium/cilium#42077, @phuhung273)
• 🤖 Easier Multi-Cluster install: There's now support for auto-installing the Custom Resource Definitions (CRDs) for Multi-Cluster Services (MCS). (cilium/cilium#40729, @MrFreezeex)
• 📜 Simpler Certificate Management: Streamline Cluster Mesh and Hubble certificate generation when using GitOps approaches. (cilium/cilium#42298, @MrFreezeex)
• 🛠️ Cilium dependencies were updated to Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, and GoBGP v3.37. (cilium/cilium#43422, @aanm; cilium/cilium#40569, @sayboras; cilium/cilium#41936, @youngnick; cilium/cilium#42824, @rastislavs).

🏠 Community

• ❤️ Production Case Studies: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
• 📰 See studies with Airbnb, Cloudera, Cybozu, ESnet, Nutanix, OVHcloud, TikTok, University of Wisconsin–Madison.
• 🇺🇸 Atlanta Events: The community gathered at CiliumCon and the Cilium Developer Summit in Atlanta.
• 🇳🇱 Amsterdam Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit in Amsterdam, March 23-27. Read more about where to find Cilium during the show.
• 🔟 Cilium is 10: Read the 2025 Cilium Annual Report to see the latest project milestones, a decade on from its first commit.