feat(chart): Allow configuring envoy proxy image via helm chart (#8785)

* feat: Allow configuring envoy proxy defaults via helm chart

This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under `global.images.envoyProxy`:

| Value | Type | Default | Description |
|----------------------------------------|--------|------|---------------------------------------------------------------------|
| `global.images.envoyProxy.image`       | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container |
| `global.images.envoyProxy.pullPolicy`  | string | `""` | Image pull policy                                                   |
| `global.images.envoyProxy.pullSecrets` | list   | `[]` | Image pull secrets                                                  |

When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in #7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components.

Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top.

Closes #4764.

Signed-off-by: Michael Sommerville <msommerville@gmail.com>
(cherry picked from commit 8570285)

Author: mgs255

charts/gateway-helm/README.md

@@ -103,6 +103,9 @@ helm uninstall eg -n envoy-gateway-system
 | global.images.envoyGateway.image | string | `nil` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |
 | global.images.envoyGateway.pullSecrets | list | `[]` |  |
+| global.images.envoyProxy.image | string | `""` |  |
+| global.images.envoyProxy.pullPolicy | string | `""` |  |
+| global.images.envoyProxy.pullSecrets | list | `[]` |  |
 | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:05c08d03"` |  |
 | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
 | global.images.ratelimit.pullSecrets | list | `[]` |  |

charts/gateway-helm/templates/_helpers.tpl

@@ -148,11 +148,61 @@ imagePullSecrets: {{ toYaml list }}
 {{- end }}
 {{- end }}
 
+{{/*
+Resolve the Envoy Proxy image.
+*/}}
+{{- define "eg.envoyProxy.image" -}}
+{{-   $imageParts := splitn "/" 2 .Values.global.images.envoyProxy.image -}}
+{{/*    if global.imageRegistry is defined, it takes precedence always */}}
+{{-   $registryName := default $imageParts._0 .Values.global.imageRegistry -}}
+{{-   $repositoryTag := $imageParts._1 -}}
+{{-   $repositoryParts := splitn ":" 2 $repositoryTag -}}
+{{-   $repositoryName := $repositoryParts._0 -}}
+{{-   $imageTag := default "distroless-dev" $repositoryParts._1 -}}
+{{-   printf "%s/%s:%s" $registryName $repositoryName $imageTag -}}
+{{- end -}}
+
+{{/*
+Resolve the Envoy Proxy image pull secrets.
+*/}}
+{{- define "eg.envoyProxy.image.pullSecrets" -}}
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{ toYaml .Values.global.imagePullSecrets }}
+{{- else if .Values.global.images.envoyProxy.pullSecrets -}}
+imagePullSecrets:
+{{ toYaml .Values.global.images.envoyProxy.pullSecrets }}
+{{- else }}
+imagePullSecrets: {{ toYaml list }}
+{{- end }}
+{{- end }}
 
 {{/*
 The default Envoy Gateway configuration.
 */}}
 {{- define "eg.default-envoy-gateway-config" -}}
+{{- if or .Values.global.images.envoyProxy.image .Values.config.envoyGateway.envoyProxy }}
+{{- $envoyProxyBase := .Values.config.envoyGateway.envoyProxy | default dict }}
+{{- $imageOverride := dict }}
+{{- if .Values.global.images.envoyProxy.image }}
+  {{- $container := dict "image" (include "eg.envoyProxy.image" .) }}
+  {{- if .Values.global.images.envoyProxy.pullPolicy }}
+    {{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }}
+  {{- end }}
+  {{- $deployment := dict "container" $container }}
+  {{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }}
+    {{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }}
+    {{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYaml).imagePullSecrets }}
+    {{- $_ := set $deployment "pod" $pullSecrets }}
+  {{- end }}
+  {{- $kubernetes := dict "envoyDeployment" $deployment }}
+  {{- $provider := dict "type" "Kubernetes" "kubernetes" $kubernetes }}
+  {{- $imageOverride = dict "provider" $provider }}
+{{- end }}
+{{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }}
+envoyProxy:
+{{ toYaml $merged | indent 2 }}
+{{- end }}
 provider:
   type: Kubernetes
   kubernetes:

charts/gateway-helm/values.tmpl.yaml

@@ -1,6 +1,6 @@
 # Global settings
 global:
-  # If set, these take highest precedence and change both envoyGateway and ratelimit's container registry and pull secrets.
+  # If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.
   # -- Global override for image registry
   imageRegistry: ""
   # -- Global override for image pull secrets
@@ -25,6 +25,15 @@ global:
       pullPolicy: IfNotPresent
       # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
       pullSecrets: []
+    envoyProxy:
+      # This is the full image name including the hub, repo, and tag for the Envoy Proxy data plane.
+      # If not specified, uses the default image built into envoy-gateway.
+      image: ""
+      # Specify image pull policy if default behavior isn't desired.
+      # Default behavior: IfNotPresent.
+      pullPolicy: ""
+      # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
+      pullSecrets: []
 
 podDisruptionBudget:
   minAvailable: 0

release-notes/current.yaml

@@ -10,6 +10,7 @@ security updates: |
   Bump Envoy ratelimit image to `05c08d03`.
 # New features or capabilities added in this release.
 new features: |
+  Added support for defining Envoy Proxy image, pullPolicy, and pullSecrets via the helm chart.  Note that to merge these helm-configured values with EnvoyProxy resources, the EnvoyProxy must include `mergeType: StrategicMerge` or `mergeType: JSONMerge`.
 
 bug fixes: |
   Rejected ClientTrafficPolicy if invalid TLS cipher suites are configured.

site/content/en/latest/install/gateway-helm-api.md

@@ -67,6 +67,9 @@ The Helm chart for Envoy Gateway
 | global.images.envoyGateway.image | string | `nil` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |
 | global.images.envoyGateway.pullSecrets | list | `[]` |  |
+| global.images.envoyProxy.image | string | `""` |  |
+| global.images.envoyProxy.pullPolicy | string | `""` |  |
+| global.images.envoyProxy.pullSecrets | list | `[]` |  |
 | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:05c08d03"` |  |
 | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
 | global.images.ratelimit.pullSecrets | list | `[]` |  |

test/helm/gateway-helm/global-images-config.in.yaml

@@ -12,3 +12,9 @@ global:
       pullSecrets:
         - name: "secret3"
         - name: "secret4"
+    envoyProxy:
+      image: "private-hub/envoyproxy/envoy:dev"
+      pullPolicy: Always
+      pullSecrets:
+        - name: "secret5"
+        - name: "secret6"

test/helm/gateway-helm/global-images-config.out.yaml

@@ -28,6 +28,18 @@ data:
   envoy-gateway.yaml: |
     apiVersion: gateway.envoyproxy.io/v1alpha1
     kind: EnvoyGateway
+    envoyProxy:
+      provider:
+        kubernetes:
+          envoyDeployment:
+            container:
+              image: private-hub/envoyproxy/envoy:dev
+              imagePullPolicy: Always
+            pod:
+              imagePullSecrets:
+              - name: secret5
+              - name: secret6
+        type: Kubernetes
     extensionApis: {}
     gateway:
       controllerName: gateway.envoyproxy.io/gatewayclass-controller