Skip to content

feat(chart): Allow configuring envoy proxy image via helm chart #8785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arkodg merged 7 commits into from
Apr 27, 2026
Merged

feat(chart): Allow configuring envoy proxy image via helm chart #8785

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f65bd6a
feat: Allow configuring envoy proxy defaults via helm chart
mgs255 Apr 18, 2026
2b35ba4
PR feedback - add test - fix helpers script
mgs255 Apr 22, 2026
4d91abb
Merge branch 'main' into helm-chart-add-envoy-proxy-image-options
mgs255 Apr 22, 2026
636d3b6
pr feedback - add release note
mgs255 Apr 25, 2026
28e6904
Merge branch 'main' into helm-chart-add-envoy-proxy-image-options
mgs255 Apr 25, 2026
710575a
Merge branch 'main' into helm-chart-add-envoy-proxy-image-options
mgs255 Apr 27, 2026
151af56
PR feedback - add envoyProxy to list of applications respecting globa…
mgs255 Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions charts/gateway-helm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,9 @@ helm uninstall eg -n envoy-gateway-system
| global.images.envoyGateway.image | string | `nil` | |
| global.images.envoyGateway.pullPolicy | string | `nil` | |
| global.images.envoyGateway.pullSecrets | list | `[]` | |
| global.images.envoyProxy.image | string | `""` | |
| global.images.envoyProxy.pullPolicy | string | `""` | |
| global.images.envoyProxy.pullSecrets | list | `[]` | |
| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | |
| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | |
| global.images.ratelimit.pullSecrets | list | `[]` | |
Expand Down
50 changes: 50 additions & 0 deletions charts/gateway-helm/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,11 +158,61 @@ imagePullSecrets: {{ toYaml list }}
{{- end }}
{{- end }}

{{/*
Resolve the Envoy Proxy image.
*/}}
{{- define "eg.envoyProxy.image" -}}
{{- $imageParts := splitn "/" 2 .Values.global.images.envoyProxy.image -}}
{{/* if global.imageRegistry is defined, it takes precedence always */}}
{{- $registryName := default $imageParts._0 .Values.global.imageRegistry -}}
{{- $repositoryTag := $imageParts._1 -}}
{{- $repositoryParts := splitn ":" 2 $repositoryTag -}}
{{- $repositoryName := $repositoryParts._0 -}}
{{- $imageTag := default "distroless-dev" $repositoryParts._1 -}}
{{- printf "%s/%s:%s" $registryName $repositoryName $imageTag -}}
{{- end -}}

{{/*
Resolve the Envoy Proxy image pull secrets.
*/}}
{{- define "eg.envoyProxy.image.pullSecrets" -}}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.global.imagePullSecrets }}
{{- else if .Values.global.images.envoyProxy.pullSecrets -}}
imagePullSecrets:
{{ toYaml .Values.global.images.envoyProxy.pullSecrets }}
{{- else }}
imagePullSecrets: {{ toYaml list }}
{{- end }}
{{- end }}

{{/*
The default Envoy Gateway configuration.
*/}}
{{- define "eg.default-envoy-gateway-config" -}}
{{- if or .Values.global.images.envoyProxy.image .Values.config.envoyGateway.envoyProxy }}
{{- $envoyProxyBase := .Values.config.envoyGateway.envoyProxy | default dict }}
{{- $imageOverride := dict }}
{{- if .Values.global.images.envoyProxy.image }}
{{- $container := dict "image" (include "eg.envoyProxy.image" .) }}
{{- if .Values.global.images.envoyProxy.pullPolicy }}
{{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }}
Comment on lines +197 to +200

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Allow pull policy/secret overrides without image override

The pullPolicy and pullSecrets wiring is nested under if .Values.global.images.envoyProxy.image, so these new values are ignored unless global.images.envoyProxy.image is also set. In practice, users cannot set only pull policy or pull secrets while keeping Envoy Gateway’s default proxy image, even though those values were added as independent chart knobs.

Useful? React with 👍 / 👎.

{{- end }}
{{- $deployment := dict "container" $container }}
{{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }}
{{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }}
{{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYaml).imagePullSecrets }}
{{- $_ := set $deployment "pod" $pullSecrets }}
{{- end }}
{{- $kubernetes := dict "envoyDeployment" $deployment }}
{{- $provider := dict "type" "Kubernetes" "kubernetes" $kubernetes }}
{{- $imageOverride = dict "provider" $provider }}
{{- end }}
{{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }}
envoyProxy:
{{ toYaml $merged | indent 2 }}
{{- end }}
provider:
type: Kubernetes
kubernetes:
Expand Down
11 changes: 10 additions & 1 deletion charts/gateway-helm/values.tmpl.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Global settings
global:
# If set, these take highest precedence and change both envoyGateway and ratelimit's container registry and pull secrets.
# If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.
# -- Global override for image registry
imageRegistry: ""
# -- Global override for image pull secrets
Expand All @@ -25,6 +25,15 @@ global:
pullPolicy: IfNotPresent
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
pullSecrets: []
envoyProxy:
# This is the full image name including the hub, repo, and tag for the Envoy Proxy data plane.
# If not specified, uses the default image built into envoy-gateway.
image: ""
# Specify image pull policy if default behavior isn't desired.
# Default behavior: IfNotPresent.
pullPolicy: ""
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
pullSecrets: []

# -- Labels to apply to all resources
commonLabels: {}
Expand Down
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ new features: |
Added support for default EnvoyProxy settings on EnvoyGatewaySpec that can be overridden by GatewayClass or Gateway-level EnvoyProxy configurations. A new MergeType field allows choosing between Replace (default), StrategicMerge, or JSONMerge strategies for combining configurations.
Added support for sending Envoy Gateway route metadata to external authorization backends via `SecurityPolicy.spec.extAuth.includeRouteMetadata`.
Added support for path override in ExtAuth HTTP service.
Added support for defining Envoy Proxy image, pullPolicy, and pullSecrets via the helm chart. Note that to merge these helm-configured values with EnvoyProxy resources, the EnvoyProxy must include `mergeType: StrategicMerge` or `mergeType: JSONMerge`.

bug fixes: |
Fixed local rate limit rules with identical sourceCIDR client selectors producing conflicting descriptors.
Expand Down
3 changes: 3 additions & 0 deletions site/content/en/latest/install/gateway-helm-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,9 @@ The Helm chart for Envoy Gateway
| global.images.envoyGateway.image | string | `nil` | |
| global.images.envoyGateway.pullPolicy | string | `nil` | |
| global.images.envoyGateway.pullSecrets | list | `[]` | |
| global.images.envoyProxy.image | string | `""` | |
| global.images.envoyProxy.pullPolicy | string | `""` | |
| global.images.envoyProxy.pullSecrets | list | `[]` | |
| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | |
| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | |
| global.images.ratelimit.pullSecrets | list | `[]` | |
Expand Down
6 changes: 6 additions & 0 deletions test/helm/gateway-helm/global-images-config.in.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,9 @@ global:
pullSecrets:
- name: "secret3"
- name: "secret4"
envoyProxy:
image: "private-hub/envoyproxy/envoy:dev"
pullPolicy: Always
pullSecrets:
- name: "secret5"
- name: "secret6"
12 changes: 12 additions & 0 deletions test/helm/gateway-helm/global-images-config.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,18 @@ data:
envoy-gateway.yaml: |
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyGateway
envoyProxy:
provider:
kubernetes:
envoyDeployment:
container:
image: private-hub/envoyproxy/envoy:dev
imagePullPolicy: Always
pod:
imagePullSecrets:
- name: secret5
- name: secret6
type: Kubernetes
extensionApis: {}
gateway:
controllerName: gateway.envoyproxy.io/gatewayclass-controller
Expand Down
Loading