gateway-helm
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Global settings
2
global:
3
# If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.
4
# -- Global override for image registry
5
imageRegistry: ""
6
# -- Global override for image pull secrets
7
imagePullSecrets: []
8
# If set, these override image-specific values: useful when installing the chart in a private registry environment.
9
# Override image-specific values directly if a global override is not desired.
10
images:
11
envoyGateway:
12
# -- Full image for the Envoy Gateway control plane Deployment installed by this chart.
13
image: cgr.dev/scratch-images/test-tmp/envoy-gateway:1.8.4-r2@sha256:fa29f41f1f990522ed81d1e328a4eaf362965063559a5253b359d99811003435
14
# -- Image pull policy for the Envoy Gateway control plane Deployment.
15
# Default behavior: latest images will be Always else IfNotPresent.
16
pullPolicy: IfNotPresent
17
# -- Pull secrets for the Envoy Gateway control plane Deployment.
18
pullSecrets: []
19
ratelimit:
20
# This is the full image name including the hub, repo, and tag.
21
image: cgr.dev/scratch-images/test-tmp/envoy-ratelimit:1.8.4-r2@sha256:1e1fbf048845d62886b25747610d889bc8cd81ca0a58568d44f4d2b94e1453d3
22
# Specify image pull policy if default behavior isn't desired.
23
# Default behavior: latest images will be Always else IfNotPresent.
24
pullPolicy: IfNotPresent
25
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
26
pullSecrets: []
27
envoyProxy:
28
# -- Full image for the managed Envoy Proxy data plane.
29
# This updates the generated `envoyProxy` config and does not change the `envoy-gateway`
30
# control plane Deployment image. If not specified, the default image built into
31
# `envoy-gateway` is used.
32
image: cgr.dev/scratch-images/test-tmp/envoy:distroless-v1.38.4-r0@sha256:f0919d2298a4222f1a4ce256f5c2f346b66340efab7a13284e7a1a2c2044c840
33
# -- Image pull policy for the managed Envoy Proxy data plane.
34
# Default behavior: IfNotPresent.
35
pullPolicy: ""
36
# -- Pull secrets for the managed Envoy Proxy data plane.
37
pullSecrets: []
38
# Values for CRDs dependency
39
crds:
40
# -- Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.
41
enabled: true
42
# -- Labels to apply to all resources
43
commonLabels: {}
44
podDisruptionBudget:
45
minAvailable: 0
46
# maxUnavailable: 1
47
# unhealthyPodEvictionPolicy: IfHealthyBudget
48
deployment:
49
annotations: {}
50
envoyGateway:
51
image:
52
# if both this and global.imageRegistry are specified, this has to include both registry and repository explicitly, eg docker.io/envoyproxy/gateway
53
repository: ""
54
tag: ""
55
imagePullPolicy: ""
56
imagePullSecrets: []
57
# -- Additional environment variables for the envoy-gateway container.
58
extraEnv: []
59
resources:
60
limits:
61
memory: 1024Mi
62
requests:
63
cpu: 100m
64
memory: 256Mi
65
securityContext:
66
allowPrivilegeEscalation: false
67
capabilities:
68
drop:
69
- ALL
70
privileged: false
71
readOnlyRootFilesystem: true
72
runAsNonRoot: true
73
runAsGroup: 65532
74
runAsUser: 65532
75
seccompProfile:
76
type: RuntimeDefault
77
# -- Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty.
78
# Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim:
79
# wasmCacheVolume:
80
# persistentVolumeClaim:
81
# claimName: envoy-gateway-wasm-cache
82
strategy: {}
83
wasmCacheVolume: {}
84
# Kubernetes best practice for controllers: use a startupProbe with a generous
85
# failure threshold to avoid premature liveness/readiness failures during initialization.
86
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
87
startupProbe:
88
httpGet:
89
path: /healthz
90
port: 8081
91
failureThreshold: 30
92
periodSeconds: 1
93
successThreshold: 1
94
timeoutSeconds: 1
95
livenessProbe:
96
httpGet:
97
path: /healthz
98
port: 8081
99
periodSeconds: 20
100
successThreshold: 1
101
timeoutSeconds: 1
102
readinessProbe:
103
httpGet:
104
path: /readyz
105
port: 8081
106
periodSeconds: 10
107
successThreshold: 1
108
timeoutSeconds: 1
109
ports:
110
- name: grpc
111
port: 18000
112
targetPort: 18000
113
- name: ratelimit
114
port: 18001
115
targetPort: 18001
116
- name: wasm
117
port: 18002
118
targetPort: 18002
119
- name: metrics
120
port: 19001
121
targetPort: 19001
122
priorityClassName: null
123
replicas: 1
124
pod:
125
affinity: {}
126
annotations:
127
prometheus.io/scrape: 'true'
128
prometheus.io/port: '19001'
129
labels: {}
130
topologySpreadConstraints: []
131
tolerations: []
132
nodeSelector: {}
133
# Additional volumeMounts on the deployment definition.
134
extraVolumeMounts: []
135
# - name: foo
136
# mountPath: "/etc/foo"
137
# readOnly: true
138
# Additional volumes on the deployment definition.
139
extraVolumes: []
140
# - name: foo
141
# configMap:
142
# name: myconfigmap
143
securityContext:
144
runAsNonRoot: true
145
runAsGroup: 65532
146
runAsUser: 65532
147
fsGroup: 65532
148
seccompProfile:
149
type: RuntimeDefault
150
service:
151
# If set to PreferClose, the Envoy fleet will prioritize connecting to the Envoy Gateway pods that are topologically closest to them.
152
trafficDistribution: ""
153
annotations: {}
154
# -- Service type. Can be set to LoadBalancer with specific IP, e.g.:
155
# type: LoadBalancer
156
# loadBalancerIP: 10.236.90.20
157
type: "ClusterIP"
158
hpa:
159
enabled: false
160
minReplicas: 1
161
maxReplicas: 1
162
metrics: []
163
behavior: {}
164
config:
165
# -- EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.
166
envoyGateway:
167
gateway:
168
controllerName: gateway.envoyproxy.io/gatewayclass-controller
169
provider:
170
type: Kubernetes
171
logging:
172
level:
173
default: info
174
extensionApis: {}
175
createNamespace: false
176
# -- Override the namespace for resources deployed by the chart.
177
# Defaults to the release namespace.
178
namespaceOverride: ""
179
kubernetesClusterDomain: cluster.local
180
# -- Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
181
certgen:
182
job:
183
annotations: {}
184
args: []
185
pod:
186
annotations: {}
187
labels: {}
188
securityContext:
189
runAsNonRoot: true
190
runAsGroup: 65532
191
runAsUser: 65532
192
fsGroup: 65532
193
seccompProfile:
194
type: RuntimeDefault
195
resources: {}
196
affinity: {}
197
tolerations: []
198
nodeSelector: {}
199
ttlSecondsAfterFinished: 30
200
securityContext:
201
allowPrivilegeEscalation: false
202
capabilities:
203
drop:
204
- ALL
205
privileged: false
206
readOnlyRootFilesystem: true
207
runAsNonRoot: true
208
runAsGroup: 65532
209
runAsUser: 65532
210
seccompProfile:
211
type: RuntimeDefault
212
rbac:
213
annotations: {}
214
labels: {}
215
topologyInjector:
216
enabled: true
217
annotations: {}
218
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.