Notice:
This is the "latest" release of Envoy Gateway, which contains the most recent commits from the main branch.
This release might not be stable.
Please refer to the /docs documentation for the most current information.

Gateway Helm Chart

  3 minute read  

Version: v0.0.0-latest Type: application AppVersion: latest

The Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

NameEmailUrl
envoy-gateway-steering-committeehttps://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
envoy-gateway-maintainershttps://github.com/envoyproxy/gateway/blob/main/CODEOWNERS

Source Code

Requirements

RepositoryNameVersion
crds0.0.0

Values

KeyTypeDefaultDescription
certgenobject{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify values.yaml to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
commonLabelsobject{}Labels to apply to all resources
config.envoyGatewayobject{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.
crds.enabledbooltrueInstall Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.
createNamespaceboolfalse
deployment.annotationsobject{}
deployment.envoyGateway.extraEnvlist[]Additional environment variables for the envoy-gateway container.
deployment.envoyGateway.image.repositorystring""
deployment.envoyGateway.image.tagstring""
deployment.envoyGateway.imagePullPolicystring""
deployment.envoyGateway.imagePullSecretslist[]
deployment.envoyGateway.resources.limits.memorystring"1024Mi"
deployment.envoyGateway.resources.requests.cpustring"100m"
deployment.envoyGateway.resources.requests.memorystring"256Mi"
deployment.envoyGateway.securityContext.allowPrivilegeEscalationboolfalse
deployment.envoyGateway.securityContext.capabilities.drop[0]string"ALL"
deployment.envoyGateway.securityContext.privilegedboolfalse
deployment.envoyGateway.securityContext.runAsGroupint65532
deployment.envoyGateway.securityContext.runAsNonRootbooltrue
deployment.envoyGateway.securityContext.runAsUserint65532
deployment.envoyGateway.securityContext.seccompProfile.typestring"RuntimeDefault"
deployment.envoyGateway.strategyobject{}
deployment.pod.affinityobject{}
deployment.pod.annotations.“prometheus.io/port”string"19001"
deployment.pod.annotations.“prometheus.io/scrape”string"true"
deployment.pod.extraVolumeMountslist[]
deployment.pod.extraVolumeslist[]
deployment.pod.labelsobject{}
deployment.pod.nodeSelectorobject{}
deployment.pod.securityContext.runAsGroupint65532
deployment.pod.securityContext.runAsNonRootbooltrue
deployment.pod.securityContext.runAsUserint65532
deployment.pod.securityContext.seccompProfile.typestring"RuntimeDefault"
deployment.pod.tolerationslist[]
deployment.pod.topologySpreadConstraintslist[]
deployment.ports[0].namestring"grpc"
deployment.ports[0].portint18000
deployment.ports[0].targetPortint18000
deployment.ports[1].namestring"ratelimit"
deployment.ports[1].portint18001
deployment.ports[1].targetPortint18001
deployment.ports[2].namestring"wasm"
deployment.ports[2].portint18002
deployment.ports[2].targetPortint18002
deployment.ports[3].namestring"metrics"
deployment.ports[3].portint19001
deployment.ports[3].targetPortint19001
deployment.priorityClassNamestringnil
deployment.replicasint1
global.imagePullSecretslist[]Global override for image pull secrets
global.imageRegistrystring""Global override for image registry
global.images.envoyGateway.imagestringnilFull image for the Envoy Gateway control plane Deployment installed by this chart.
global.images.envoyGateway.pullPolicystringnilImage pull policy for the Envoy Gateway control plane Deployment. Default behavior: latest images will be Always else IfNotPresent.
global.images.envoyGateway.pullSecretslist[]Pull secrets for the Envoy Gateway control plane Deployment.
global.images.envoyProxy.imagestring""Full image for the managed Envoy Proxy data plane. This updates the generated envoyProxy config and does not change the envoy-gateway control plane Deployment image. If not specified, the default image built into envoy-gateway is used.
global.images.envoyProxy.pullPolicystring""Image pull policy for the managed Envoy Proxy data plane. Default behavior: IfNotPresent.
global.images.envoyProxy.pullSecretslist[]Pull secrets for the managed Envoy Proxy data plane.
global.images.ratelimit.imagestring"docker.io/envoyproxy/ratelimit:master"
global.images.ratelimit.pullPolicystring"IfNotPresent"
global.images.ratelimit.pullSecretslist[]
hpa.behaviorobject{}
hpa.enabledboolfalse
hpa.maxReplicasint1
hpa.metricslist[]
hpa.minReplicasint1
kubernetesClusterDomainstring"cluster.local"
namespaceOverridestring""Override the namespace for resources deployed by the chart. Defaults to the release namespace.
podDisruptionBudget.minAvailableint0
service.annotationsobject{}
service.trafficDistributionstring""
service.typestring"ClusterIP"Service type. Can be set to LoadBalancer with specific IP, e.g.: type: LoadBalancer loadBalancerIP: 10.236.90.20
topologyInjector.annotationsobject{}
topologyInjector.enabledbooltrue

Last modified July 3, 2026: docs(gateway-helm): clarify envoyProxy image values (#9222) (29cb5809)