From 3a7729828e93b18de71ec799646f52ec93ce5d18 Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Wed, 22 Apr 2026 13:21:33 +0200 Subject: [PATCH 1/7] feat(helm): add startupProbe to envoy-gateway deployment Signed-off-by: Clement Phu --- .../templates/envoy-gateway-deployment.yaml | 14 ++++------- charts/gateway-helm/values.tmpl.yaml | 23 +++++++++++++++++++ .../gateway-helm/certgen-annotations.out.yaml | 14 +++++++++-- test/helm/gateway-helm/certgen-args.out.yaml | 14 +++++++++-- .../helm/gateway-helm/certgen-labels.out.yaml | 14 +++++++++-- .../certjen-custom-scheduling.out.yaml | 14 +++++++++-- test/helm/gateway-helm/common-labels.out.yaml | 14 +++++++++-- .../control-plane-with-pdb.out.yaml | 14 +++++++++-- .../helm/gateway-helm/default-config.out.yaml | 14 +++++++++-- .../deployment-annotations.out.yaml | 14 +++++++++-- .../deployment-custom-topology.out.yaml | 14 +++++++++-- .../deployment-images-config.out.yaml | 14 +++++++++-- .../deployment-priorityclass.out.yaml | 14 +++++++++-- .../deployment-repo-no-registry.out.yaml | 14 +++++++++-- .../deployment-securitycontext.out.yaml | 14 +++++++++-- .../envoy-gateway-config.out.yaml | 14 +++++++++-- ...ay-gateway-namespace-config-watch.out.yaml | 14 +++++++++-- ...-gateway-gateway-namespace-config.out.yaml | 14 +++++++++-- ...teway-namespace-namespaceselector.out.yaml | 14 +++++++++-- .../global-images-config.out.yaml | 14 +++++++++-- ...l-pullsecrets-override-deployment.out.yaml | 14 +++++++++-- ...lobal-pullsecrets-override-global.out.yaml | 14 +++++++++-- ...obal-registry-override-deployment.out.yaml | 14 +++++++++-- .../global-registry-override-global.out.yaml | 14 +++++++++-- ...orizontal-pod-autoscaler-disabled.out.yaml | 14 +++++++++-- .../horizontal-pod-autoscaler.out.yaml | 14 +++++++++-- .../gateway-helm/namespace-override.out.yaml | 14 +++++++++-- .../service-customization.out.yaml | 14 +++++++++-- .../gateway-helm/webhook-disabled.out.yaml | 14 +++++++++-- 29 files changed, 351 insertions(+), 64 deletions(-) diff --git a/charts/gateway-helm/templates/envoy-gateway-deployment.yaml b/charts/gateway-helm/templates/envoy-gateway-deployment.yaml index 9018fe750d..d6218a0269 100644 --- a/charts/gateway-helm/templates/envoy-gateway-deployment.yaml +++ b/charts/gateway-helm/templates/envoy-gateway-deployment.yaml @@ -73,12 +73,10 @@ spec: {{- end }} image: {{ include "eg.image" . }} imagePullPolicy: {{ include "eg.image.pullPolicy" . }} + startupProbe: + {{- toYaml .Values.deployment.envoyGateway.startupProbe | nindent 10 }} livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 + {{- toYaml .Values.deployment.envoyGateway.livenessProbe | nindent 10 }} name: envoy-gateway ports: {{- range .Values.deployment.ports }} @@ -90,11 +88,7 @@ spec: containerPort: 9443 {{- end }} readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 + {{- toYaml .Values.deployment.envoyGateway.readinessProbe | nindent 10 }} resources: {{- toYaml .Values.deployment.envoyGateway.resources | nindent 10 }} securityContext: diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index a6033a3cb4..65f4985370 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -85,6 +85,28 @@ deployment: # claimName: envoy-gateway-wasm-cache strategy: {} wasmCacheVolume: {} + startupProbe: + httpGet: + path: /healthz + port: 8081 + failureThreshold: 30 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 ports: - name: grpc port: 18000 @@ -150,6 +172,7 @@ config: controllerName: gateway.envoyproxy.io/gatewayclass-controller provider: type: Kubernetes + kubernetes: {} logging: level: default: info diff --git a/test/helm/gateway-helm/certgen-annotations.out.yaml b/test/helm/gateway-helm/certgen-annotations.out.yaml index feba266302..fe4f514518 100644 --- a/test/helm/gateway-helm/certgen-annotations.out.yaml +++ b/test/helm/gateway-helm/certgen-annotations.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/certgen-args.out.yaml b/test/helm/gateway-helm/certgen-args.out.yaml index 45f8cd5bd6..12dcc8eb4c 100644 --- a/test/helm/gateway-helm/certgen-args.out.yaml +++ b/test/helm/gateway-helm/certgen-args.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/certgen-labels.out.yaml b/test/helm/gateway-helm/certgen-labels.out.yaml index e26d6e9cd4..8807b46d8a 100644 --- a/test/helm/gateway-helm/certgen-labels.out.yaml +++ b/test/helm/gateway-helm/certgen-labels.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml b/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml index 73f78073a7..6a3bb8b521 100644 --- a/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml +++ b/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/common-labels.out.yaml b/test/helm/gateway-helm/common-labels.out.yaml index 2ff07f455c..ed5faceddc 100644 --- a/test/helm/gateway-helm/common-labels.out.yaml +++ b/test/helm/gateway-helm/common-labels.out.yaml @@ -505,12 +505,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -527,8 +536,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/control-plane-with-pdb.out.yaml b/test/helm/gateway-helm/control-plane-with-pdb.out.yaml index 4574a7288c..76bd302415 100644 --- a/test/helm/gateway-helm/control-plane-with-pdb.out.yaml +++ b/test/helm/gateway-helm/control-plane-with-pdb.out.yaml @@ -480,12 +480,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -502,8 +511,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/default-config.out.yaml b/test/helm/gateway-helm/default-config.out.yaml index 4b830cdf66..3293d24fc7 100644 --- a/test/helm/gateway-helm/default-config.out.yaml +++ b/test/helm/gateway-helm/default-config.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-annotations.out.yaml b/test/helm/gateway-helm/deployment-annotations.out.yaml index 91f1a55297..9d1ebc0cf0 100644 --- a/test/helm/gateway-helm/deployment-annotations.out.yaml +++ b/test/helm/gateway-helm/deployment-annotations.out.yaml @@ -469,12 +469,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -491,8 +500,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-custom-topology.out.yaml b/test/helm/gateway-helm/deployment-custom-topology.out.yaml index f4098f324c..b7283a749e 100644 --- a/test/helm/gateway-helm/deployment-custom-topology.out.yaml +++ b/test/helm/gateway-helm/deployment-custom-topology.out.yaml @@ -493,12 +493,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -515,8 +524,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-images-config.out.yaml b/test/helm/gateway-helm/deployment-images-config.out.yaml index 8afbb85e57..4b46dcabd1 100644 --- a/test/helm/gateway-helm/deployment-images-config.out.yaml +++ b/test/helm/gateway-helm/deployment-images-config.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: private-hub/envoyproxy/gateway:abcdef12 imagePullPolicy: IfNotPresent + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-priorityclass.out.yaml b/test/helm/gateway-helm/deployment-priorityclass.out.yaml index 04ece07608..9865d4780c 100644 --- a/test/helm/gateway-helm/deployment-priorityclass.out.yaml +++ b/test/helm/gateway-helm/deployment-priorityclass.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml b/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml index 9332ec27b9..5b941414fc 100644 --- a/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml +++ b/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: envoy/gateway:abcdef imagePullPolicy: IfNotPresent + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-securitycontext.out.yaml b/test/helm/gateway-helm/deployment-securitycontext.out.yaml index 80c3c78527..a6c6192f4e 100644 --- a/test/helm/gateway-helm/deployment-securitycontext.out.yaml +++ b/test/helm/gateway-helm/deployment-securitycontext.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/envoy-gateway-config.out.yaml b/test/helm/gateway-helm/envoy-gateway-config.out.yaml index e6c717eb6b..6b0f23cf15 100644 --- a/test/helm/gateway-helm/envoy-gateway-config.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-config.out.yaml @@ -467,12 +467,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -489,8 +498,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml index 3d7c09135d..687b82961b 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml @@ -874,12 +874,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -896,8 +905,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml index fe79a8e514..8288a9dd4c 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml @@ -565,12 +565,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -587,8 +596,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml index b89a0841ef..7e1d644f56 100644 --- a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml +++ b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml @@ -609,12 +609,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -631,8 +640,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/global-images-config.out.yaml b/test/helm/gateway-helm/global-images-config.out.yaml index 5b7e2c0c1b..f4764a3d4e 100644 --- a/test/helm/gateway-helm/global-images-config.out.yaml +++ b/test/helm/gateway-helm/global-images-config.out.yaml @@ -481,12 +481,21 @@ spec: value: cluster.local image: private-hub/envoyproxy/gateway:abcdef12 imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -503,8 +512,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml index b4e133ddba..0344bda7f8 100644 --- a/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml +++ b/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml @@ -469,12 +469,21 @@ spec: value: cluster.local image: private.registry/envoy/gateway:abcdef imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -491,8 +500,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml index 6a0a89ec67..ff2a15550a 100644 --- a/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml +++ b/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml @@ -469,12 +469,21 @@ spec: value: cluster.local image: private.registry/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -491,8 +500,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/global-registry-override-deployment.out.yaml b/test/helm/gateway-helm/global-registry-override-deployment.out.yaml index 4787f3b069..7630eda170 100644 --- a/test/helm/gateway-helm/global-registry-override-deployment.out.yaml +++ b/test/helm/gateway-helm/global-registry-override-deployment.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: private.registry/envoy/gateway:abcdef imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/global-registry-override-global.out.yaml b/test/helm/gateway-helm/global-registry-override-global.out.yaml index a41d0e677b..3429ff2131 100644 --- a/test/helm/gateway-helm/global-registry-override-global.out.yaml +++ b/test/helm/gateway-helm/global-registry-override-global.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: private.registry/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml index d3c3611b16..0851221f80 100644 --- a/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml +++ b/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml index 0ec250e39f..5ac5ed60e5 100644 --- a/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml +++ b/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml @@ -464,12 +464,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -486,8 +495,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/namespace-override.out.yaml b/test/helm/gateway-helm/namespace-override.out.yaml index 6e6b1c1c32..2bc9aa7f84 100644 --- a/test/helm/gateway-helm/namespace-override.out.yaml +++ b/test/helm/gateway-helm/namespace-override.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/service-customization.out.yaml b/test/helm/gateway-helm/service-customization.out.yaml index 2f2bc2f715..1b295ceeaf 100644 --- a/test/helm/gateway-helm/service-customization.out.yaml +++ b/test/helm/gateway-helm/service-customization.out.yaml @@ -469,12 +469,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -491,8 +500,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/webhook-disabled.out.yaml b/test/helm/gateway-helm/webhook-disabled.out.yaml index 7bbbfd2491..1d8043f0d9 100644 --- a/test/helm/gateway-helm/webhook-disabled.out.yaml +++ b/test/helm/gateway-helm/webhook-disabled.out.yaml @@ -453,12 +453,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -473,8 +482,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi From dc37c89efe81a32d328c9b670196b359ec37592d Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Mon, 27 Apr 2026 11:43:52 +0200 Subject: [PATCH 2/7] fix: add gen-check results Signed-off-by: Clement Phu --- charts/gateway-helm/README.md | 18 +++++++++++++++++- .../en/latest/install/gateway-helm-api.md | 18 +++++++++++++++++- .../gateway-helm/deployment-extraenv.out.yaml | 14 ++++++++++++-- .../deployment-volume-mounts.out.yaml | 14 ++++++++++++-- 4 files changed, 58 insertions(+), 6 deletions(-) diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md index b5e1c1cc9c..d8b4642349 100644 --- a/charts/gateway-helm/README.md +++ b/charts/gateway-helm/README.md @@ -92,7 +92,7 @@ helm uninstall eg -n envoy-gateway-system |-----|------|---------|-------------| | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. | | commonLabels | object | `{}` | Labels to apply to all resources | -| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | +| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"kubernetes":{},"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | | crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. | | createNamespace | bool | `false` | | | deployment.annotations | object | `{}` | | @@ -101,6 +101,16 @@ helm uninstall eg -n envoy-gateway-system | deployment.envoyGateway.image.tag | string | `""` | | | deployment.envoyGateway.imagePullPolicy | string | `""` | | | deployment.envoyGateway.imagePullSecrets | list | `[]` | | +| deployment.envoyGateway.livenessProbe.httpGet.path | string | `"/healthz"` | | +| deployment.envoyGateway.livenessProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.livenessProbe.periodSeconds | int | `20` | | +| deployment.envoyGateway.livenessProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.livenessProbe.timeoutSeconds | int | `1` | | +| deployment.envoyGateway.readinessProbe.httpGet.path | string | `"/readyz"` | | +| deployment.envoyGateway.readinessProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.readinessProbe.periodSeconds | int | `10` | | +| deployment.envoyGateway.readinessProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.readinessProbe.timeoutSeconds | int | `1` | | | deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` | | | deployment.envoyGateway.resources.requests.cpu | string | `"100m"` | | | deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` | | @@ -112,6 +122,12 @@ helm uninstall eg -n envoy-gateway-system | deployment.envoyGateway.securityContext.runAsNonRoot | bool | `true` | | | deployment.envoyGateway.securityContext.runAsUser | int | `65532` | | | deployment.envoyGateway.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | +| deployment.envoyGateway.startupProbe.failureThreshold | int | `30` | | +| deployment.envoyGateway.startupProbe.httpGet.path | string | `"/healthz"` | | +| deployment.envoyGateway.startupProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.startupProbe.periodSeconds | int | `1` | | +| deployment.envoyGateway.startupProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.startupProbe.timeoutSeconds | int | `1` | | | deployment.envoyGateway.strategy | object | `{}` | Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty. Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim: wasmCacheVolume: persistentVolumeClaim: claimName: envoy-gateway-wasm-cache | | deployment.envoyGateway.wasmCacheVolume | object | `{}` | | | deployment.pod.affinity | object | `{}` | | diff --git a/site/content/en/latest/install/gateway-helm-api.md b/site/content/en/latest/install/gateway-helm-api.md index 6be6315b8f..5b29411ba0 100644 --- a/site/content/en/latest/install/gateway-helm-api.md +++ b/site/content/en/latest/install/gateway-helm-api.md @@ -31,7 +31,7 @@ The Helm chart for Envoy Gateway |-----|------|---------|-------------| | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. | | commonLabels | object | `{}` | Labels to apply to all resources | -| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | +| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"kubernetes":{},"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | | crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. | | createNamespace | bool | `false` | | | deployment.annotations | object | `{}` | | @@ -40,6 +40,16 @@ The Helm chart for Envoy Gateway | deployment.envoyGateway.image.tag | string | `""` | | | deployment.envoyGateway.imagePullPolicy | string | `""` | | | deployment.envoyGateway.imagePullSecrets | list | `[]` | | +| deployment.envoyGateway.livenessProbe.httpGet.path | string | `"/healthz"` | | +| deployment.envoyGateway.livenessProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.livenessProbe.periodSeconds | int | `20` | | +| deployment.envoyGateway.livenessProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.livenessProbe.timeoutSeconds | int | `1` | | +| deployment.envoyGateway.readinessProbe.httpGet.path | string | `"/readyz"` | | +| deployment.envoyGateway.readinessProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.readinessProbe.periodSeconds | int | `10` | | +| deployment.envoyGateway.readinessProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.readinessProbe.timeoutSeconds | int | `1` | | | deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` | | | deployment.envoyGateway.resources.requests.cpu | string | `"100m"` | | | deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` | | @@ -51,6 +61,12 @@ The Helm chart for Envoy Gateway | deployment.envoyGateway.securityContext.runAsNonRoot | bool | `true` | | | deployment.envoyGateway.securityContext.runAsUser | int | `65532` | | | deployment.envoyGateway.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | +| deployment.envoyGateway.startupProbe.failureThreshold | int | `30` | | +| deployment.envoyGateway.startupProbe.httpGet.path | string | `"/healthz"` | | +| deployment.envoyGateway.startupProbe.httpGet.port | int | `8081` | | +| deployment.envoyGateway.startupProbe.periodSeconds | int | `1` | | +| deployment.envoyGateway.startupProbe.successThreshold | int | `1` | | +| deployment.envoyGateway.startupProbe.timeoutSeconds | int | `1` | | | deployment.envoyGateway.strategy | object | `{}` | Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty. Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim: wasmCacheVolume: persistentVolumeClaim: claimName: envoy-gateway-wasm-cache | | deployment.envoyGateway.wasmCacheVolume | object | `{}` | | | deployment.pod.affinity | object | `{}` | | diff --git a/test/helm/gateway-helm/deployment-extraenv.out.yaml b/test/helm/gateway-helm/deployment-extraenv.out.yaml index 4b83572e90..a4eb3d0fae 100644 --- a/test/helm/gateway-helm/deployment-extraenv.out.yaml +++ b/test/helm/gateway-helm/deployment-extraenv.out.yaml @@ -469,12 +469,21 @@ spec: value: "50" image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -491,8 +500,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-volume-mounts.out.yaml b/test/helm/gateway-helm/deployment-volume-mounts.out.yaml index d8d7ae539c..6d4dd456fb 100644 --- a/test/helm/gateway-helm/deployment-volume-mounts.out.yaml +++ b/test/helm/gateway-helm/deployment-volume-mounts.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi From 9619c4586095fb256cc8d9ebb1d52c63da22f2ea Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Mon, 11 May 2026 10:43:20 +0200 Subject: [PATCH 3/7] feat(helm): rm kubernetes provider config Signed-off-by: Clement Phu --- charts/gateway-helm/README.md | 2 +- charts/gateway-helm/values.tmpl.yaml | 1 - site/content/en/latest/install/gateway-helm-api.md | 2 +- 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md index d8b4642349..2889e94b97 100644 --- a/charts/gateway-helm/README.md +++ b/charts/gateway-helm/README.md @@ -92,7 +92,7 @@ helm uninstall eg -n envoy-gateway-system |-----|------|---------|-------------| | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. | | commonLabels | object | `{}` | Labels to apply to all resources | -| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"kubernetes":{},"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | +| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | | crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. | | createNamespace | bool | `false` | | | deployment.annotations | object | `{}` | | diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index 65f4985370..5c9cec8ee8 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -172,7 +172,6 @@ config: controllerName: gateway.envoyproxy.io/gatewayclass-controller provider: type: Kubernetes - kubernetes: {} logging: level: default: info diff --git a/site/content/en/latest/install/gateway-helm-api.md b/site/content/en/latest/install/gateway-helm-api.md index 5b29411ba0..899556db0f 100644 --- a/site/content/en/latest/install/gateway-helm-api.md +++ b/site/content/en/latest/install/gateway-helm-api.md @@ -31,7 +31,7 @@ The Helm chart for Envoy Gateway |-----|------|---------|-------------| | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. | | commonLabels | object | `{}` | Labels to apply to all resources | -| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"kubernetes":{},"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | +| config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. | | crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. | | createNamespace | bool | `false` | | | deployment.annotations | object | `{}` | | From c750f1b0c9f3b60cf88660236ca2b1b9fd8faec4 Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Mon, 11 May 2026 11:07:15 +0200 Subject: [PATCH 4/7] feat(helm): add comment best practice startupProbe Signed-off-by: Clement Phu --- charts/gateway-helm/values.tmpl.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index 5c9cec8ee8..36c7f39de8 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -85,6 +85,9 @@ deployment: # claimName: envoy-gateway-wasm-cache strategy: {} wasmCacheVolume: {} + # Kubernetes best practice for controllers: use a startupProbe with a generous + # failure threshold to avoid premature liveness/readiness failures during initialization. + # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes startupProbe: httpGet: path: /healthz From 3a80be617e020f5ce8eab0e1d4aa46a610023714 Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Fri, 12 Jun 2026 10:28:33 +0200 Subject: [PATCH 5/7] chore: add release-note for startupProbe Signed-off-by: Clement Phu --- .../current/new_features/startup-probe-helm-deployment.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 release-notes/current/new_features/startup-probe-helm-deployment.md diff --git a/release-notes/current/new_features/startup-probe-helm-deployment.md b/release-notes/current/new_features/startup-probe-helm-deployment.md new file mode 100644 index 0000000000..68b9841b1a --- /dev/null +++ b/release-notes/current/new_features/startup-probe-helm-deployment.md @@ -0,0 +1 @@ +Added `startupProbe` to the envoy-gateway Deployment with configurable liveness and readiness probes via Helm values. From 7a245e46b7ff7c40c134001b39f8bca7ab1c817c Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Wed, 1 Jul 2026 19:26:11 +0200 Subject: [PATCH 6/7] fix(release): add PR number for linter Signed-off-by: Clement Phu --- ... 8820-startupProbe-envoy-gateway-deployment.md} | 0 .../certgen-pod-securitycontext.out.yaml | 14 ++++++++++++-- .../deployment-pod-securitycontext.out.yaml | 14 ++++++++++++-- .../helm/gateway-helm/deployment-strategy.out.yaml | 14 ++++++++++++-- .../deployment-wasm-cache-volume.out.yaml | 14 ++++++++++++-- .../safe-upgrade-policy-disabled.out.yaml | 14 ++++++++++++-- 6 files changed, 60 insertions(+), 10 deletions(-) rename release-notes/current/new_features/{startup-probe-helm-deployment.md => 8820-startupProbe-envoy-gateway-deployment.md} (100%) diff --git a/release-notes/current/new_features/startup-probe-helm-deployment.md b/release-notes/current/new_features/8820-startupProbe-envoy-gateway-deployment.md similarity index 100% rename from release-notes/current/new_features/startup-probe-helm-deployment.md rename to release-notes/current/new_features/8820-startupProbe-envoy-gateway-deployment.md diff --git a/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml b/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml index 4b830cdf66..3293d24fc7 100644 --- a/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml +++ b/test/helm/gateway-helm/certgen-pod-securitycontext.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml b/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml index 4b830cdf66..3293d24fc7 100644 --- a/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml +++ b/test/helm/gateway-helm/deployment-pod-securitycontext.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-strategy.out.yaml b/test/helm/gateway-helm/deployment-strategy.out.yaml index 32f34471a9..9cdbb5f8f5 100644 --- a/test/helm/gateway-helm/deployment-strategy.out.yaml +++ b/test/helm/gateway-helm/deployment-strategy.out.yaml @@ -470,12 +470,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -492,8 +501,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml b/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml index ded5972768..03a5b872a3 100644 --- a/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml +++ b/test/helm/gateway-helm/deployment-wasm-cache-volume.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi diff --git a/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml b/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml index 94c02e6c1b..6dff2afab5 100644 --- a/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml +++ b/test/helm/gateway-helm/safe-upgrade-policy-disabled.out.yaml @@ -465,12 +465,21 @@ spec: value: cluster.local image: docker.io/envoyproxy/gateway-dev:latest imagePullPolicy: Always + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz + port: 8081 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 livenessProbe: httpGet: path: /healthz port: 8081 - initialDelaySeconds: 15 periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 @@ -487,8 +496,9 @@ spec: httpGet: path: /readyz port: 8081 - initialDelaySeconds: 5 periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 resources: limits: memory: 1024Mi From 9bbb9e4a394442f59f3a1d00b84c55d50b9baa30 Mon Sep 17 00:00:00 2001 From: Clement Phu Date: Tue, 21 Jul 2026 15:26:44 +0200 Subject: [PATCH 7/7] fix(release): fix linter lowercase Signed-off-by: Clement Phu --- ...ployment.md => 8820-startup-probe-envoy-gateway-deployment.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename release-notes/current/new_features/{8820-startupProbe-envoy-gateway-deployment.md => 8820-startup-probe-envoy-gateway-deployment.md} (100%) diff --git a/release-notes/current/new_features/8820-startupProbe-envoy-gateway-deployment.md b/release-notes/current/new_features/8820-startup-probe-envoy-gateway-deployment.md similarity index 100% rename from release-notes/current/new_features/8820-startupProbe-envoy-gateway-deployment.md rename to release-notes/current/new_features/8820-startup-probe-envoy-gateway-deployment.md