diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md index 046fe067c7..e6fa9730e6 100644 --- a/charts/gateway-helm/README.md +++ b/charts/gateway-helm/README.md @@ -113,6 +113,9 @@ helm uninstall eg -n envoy-gateway-system | global.images.envoyGateway.image | string | `nil` | | | global.images.envoyGateway.pullPolicy | string | `nil` | | | global.images.envoyGateway.pullSecrets | list | `[]` | | +| global.images.envoyProxy.image | string | `""` | | +| global.images.envoyProxy.pullPolicy | string | `""` | | +| global.images.envoyProxy.pullSecrets | list | `[]` | | | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | | | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | | | global.images.ratelimit.pullSecrets | list | `[]` | | diff --git a/charts/gateway-helm/templates/_helpers.tpl b/charts/gateway-helm/templates/_helpers.tpl index 567b8dea85..d289700bd5 100755 --- a/charts/gateway-helm/templates/_helpers.tpl +++ b/charts/gateway-helm/templates/_helpers.tpl @@ -158,11 +158,61 @@ imagePullSecrets: {{ toYaml list }} {{- end }} {{- end }} +{{/* +Resolve the Envoy Proxy image. +*/}} +{{- define "eg.envoyProxy.image" -}} +{{- $imageParts := splitn "/" 2 .Values.global.images.envoyProxy.image -}} +{{/* if global.imageRegistry is defined, it takes precedence always */}} +{{- $registryName := default $imageParts._0 .Values.global.imageRegistry -}} +{{- $repositoryTag := $imageParts._1 -}} +{{- $repositoryParts := splitn ":" 2 $repositoryTag -}} +{{- $repositoryName := $repositoryParts._0 -}} +{{- $imageTag := default "distroless-dev" $repositoryParts._1 -}} +{{- printf "%s/%s:%s" $registryName $repositoryName $imageTag -}} +{{- end -}} + +{{/* +Resolve the Envoy Proxy image pull secrets. +*/}} +{{- define "eg.envoyProxy.image.pullSecrets" -}} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{ toYaml .Values.global.imagePullSecrets }} +{{- else if .Values.global.images.envoyProxy.pullSecrets -}} +imagePullSecrets: +{{ toYaml .Values.global.images.envoyProxy.pullSecrets }} +{{- else }} +imagePullSecrets: {{ toYaml list }} +{{- end }} +{{- end }} {{/* The default Envoy Gateway configuration. */}} {{- define "eg.default-envoy-gateway-config" -}} +{{- if or .Values.global.images.envoyProxy.image .Values.config.envoyGateway.envoyProxy }} +{{- $envoyProxyBase := .Values.config.envoyGateway.envoyProxy | default dict }} +{{- $imageOverride := dict }} +{{- if .Values.global.images.envoyProxy.image }} + {{- $container := dict "image" (include "eg.envoyProxy.image" .) }} + {{- if .Values.global.images.envoyProxy.pullPolicy }} + {{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }} + {{- end }} + {{- $deployment := dict "container" $container }} + {{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }} + {{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }} + {{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYaml).imagePullSecrets }} + {{- $_ := set $deployment "pod" $pullSecrets }} + {{- end }} + {{- $kubernetes := dict "envoyDeployment" $deployment }} + {{- $provider := dict "type" "Kubernetes" "kubernetes" $kubernetes }} + {{- $imageOverride = dict "provider" $provider }} +{{- end }} +{{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }} +envoyProxy: +{{ toYaml $merged | indent 2 }} +{{- end }} provider: type: Kubernetes kubernetes: diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index 884092dc46..1fde6fbe71 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -1,6 +1,6 @@ # Global settings global: - # If set, these take highest precedence and change both envoyGateway and ratelimit's container registry and pull secrets. + # If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets. # -- Global override for image registry imageRegistry: "" # -- Global override for image pull secrets @@ -25,6 +25,15 @@ global: pullPolicy: IfNotPresent # List of secrets in the same namespace of the component that can be used to pull images from private repositories. pullSecrets: [] + envoyProxy: + # This is the full image name including the hub, repo, and tag for the Envoy Proxy data plane. + # If not specified, uses the default image built into envoy-gateway. + image: "" + # Specify image pull policy if default behavior isn't desired. + # Default behavior: IfNotPresent. + pullPolicy: "" + # List of secrets in the same namespace of the component that can be used to pull images from private repositories. + pullSecrets: [] # -- Labels to apply to all resources commonLabels: {} diff --git a/release-notes/current.yaml b/release-notes/current.yaml index 83d6baf62d..50e41645ad 100644 --- a/release-notes/current.yaml +++ b/release-notes/current.yaml @@ -47,6 +47,7 @@ new features: | Added support for default EnvoyProxy settings on EnvoyGatewaySpec that can be overridden by GatewayClass or Gateway-level EnvoyProxy configurations. A new MergeType field allows choosing between Replace (default), StrategicMerge, or JSONMerge strategies for combining configurations. Added support for sending Envoy Gateway route metadata to external authorization backends via `SecurityPolicy.spec.extAuth.includeRouteMetadata`. Added support for path override in ExtAuth HTTP service. + Added support for defining Envoy Proxy image, pullPolicy, and pullSecrets via the helm chart. Note that to merge these helm-configured values with EnvoyProxy resources, the EnvoyProxy must include `mergeType: StrategicMerge` or `mergeType: JSONMerge`. bug fixes: | Fixed local rate limit rules with identical sourceCIDR client selectors producing conflicting descriptors. diff --git a/site/content/en/latest/install/gateway-helm-api.md b/site/content/en/latest/install/gateway-helm-api.md index 671e10bdb3..415d76595b 100644 --- a/site/content/en/latest/install/gateway-helm-api.md +++ b/site/content/en/latest/install/gateway-helm-api.md @@ -77,6 +77,9 @@ The Helm chart for Envoy Gateway | global.images.envoyGateway.image | string | `nil` | | | global.images.envoyGateway.pullPolicy | string | `nil` | | | global.images.envoyGateway.pullSecrets | list | `[]` | | +| global.images.envoyProxy.image | string | `""` | | +| global.images.envoyProxy.pullPolicy | string | `""` | | +| global.images.envoyProxy.pullSecrets | list | `[]` | | | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | | | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | | | global.images.ratelimit.pullSecrets | list | `[]` | | diff --git a/test/helm/gateway-helm/global-images-config.in.yaml b/test/helm/gateway-helm/global-images-config.in.yaml index ee8250cbea..5d3d9c7fd3 100644 --- a/test/helm/gateway-helm/global-images-config.in.yaml +++ b/test/helm/gateway-helm/global-images-config.in.yaml @@ -12,3 +12,9 @@ global: pullSecrets: - name: "secret3" - name: "secret4" + envoyProxy: + image: "private-hub/envoyproxy/envoy:dev" + pullPolicy: Always + pullSecrets: + - name: "secret5" + - name: "secret6" diff --git a/test/helm/gateway-helm/global-images-config.out.yaml b/test/helm/gateway-helm/global-images-config.out.yaml index 0c6e7f43ed..8d3d478756 100644 --- a/test/helm/gateway-helm/global-images-config.out.yaml +++ b/test/helm/gateway-helm/global-images-config.out.yaml @@ -28,6 +28,18 @@ data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway + envoyProxy: + provider: + kubernetes: + envoyDeployment: + container: + image: private-hub/envoyproxy/envoy:dev + imagePullPolicy: Always + pod: + imagePullSecrets: + - name: secret5 + - name: secret6 + type: Kubernetes extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller