envoyproxy · zhaohuabing · Jun 22, 2026 · Apr 24, 2026 · Jun 10, 2026 · Jun 22, 2026
@@ -2,5 +2,5 @@ dependencies:
 - name: crds
   repository: ""
   version: 0.0.0
-digest: sha256:aeada3fbffa2565a325406ad014001fd2685f7c0c9cfc1167da4f10c75a1bd65
-generated: "2026-02-17T14:34:30.962808-07:00"
+digest: sha256:16cbbceffe2a6946ae7cbb20b5a8313267bc77f4669caba20fffb3ff64a773a6
+generated: "2026-05-22T21:27:32.703929139-03:00"
@@ -27,3 +27,4 @@ sources:
 dependencies:
   - name: crds
     version: "0.0.0"
+    condition: crds.enabled
@@ -89,6 +89,7 @@ helm uninstall eg -n envoy-gateway-system
 | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
 | commonLabels | object | `{}` | Labels to apply to all resources |
 | config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. |
+| crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. |
 | createNamespace | bool | `false` |  |
 | deployment.annotations | object | `{}` |  |
 | deployment.envoyGateway.extraEnv | list | `[]` | Additional environment variables for the envoy-gateway container. |

@@ -35,6 +35,11 @@ global:
       # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
       pullSecrets: []
 
+# Values for CRDs dependency
+crds:
+  # -- Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.
+  enabled: true
+
 # -- Labels to apply to all resources
 commonLabels: {}
 

@@ -18,6 +18,7 @@ new features: |
   Added support for `filterContext` field in Lua EnvoyExtensionPolicy, allowing shared Lua scripts to be parameterized per route via `request_handle:filterContext()`.
   Added support for `ListenerSet` as a `targetRef` kind in `ClientTrafficPolicy`, allowing client traffic settings to be applied to a named group of listeners without a gateway-wide policy.
   Added a `fromMetadata` field to global rate limit `limit` in `BackendTrafficPolicy`, allowing the limit value to be sourced from per-request dynamic metadata (e.g. set by an upstream ext_proc), falling back to the static `requests`/`unit` when the metadata is absent.
+  Added support for disabling the `crds` dependency on the gateway-helm chart via `crds.enabled` variable.
   Added `spec.clientIPDetection.xForwardedFor.disableXForwardedForAppend` to ClientTrafficPolicy to disable Envoy's automatic X-Forwarded-For append behavior when using XFF-based client IP detection.
   Added a `failedRefetchDuration` field to JWT providers in `SecurityPolicy`, configuring how long Envoy waits before re-fetching the JWKS after a failed fetch. If not specified, Envoy's default of 1 second is used.
 

@@ -32,6 +32,7 @@ The Helm chart for Envoy Gateway
 | certgen | object | `{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
 | commonLabels | object | `{}` | Labels to apply to all resources |
 | config.envoyGateway | object | `{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}` | EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. |
+| crds.enabled | bool | `true` | Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. |
 | createNamespace | bool | `false` |  |
 | deployment.annotations | object | `{}` |  |
 | deployment.envoyGateway.extraEnv | list | `[]` | Additional environment variables for the envoy-gateway container. |

@@ -33,7 +33,7 @@ Install the Gateway API CRDs and Envoy Gateway:
 The default Helm install applies both Gateway API CRDs and Envoy Gateway CRDs. If your Kubernetes provider already
 manages Gateway API CRDs for the cluster, confirm that the provider-installed Gateway API version and channel are
 compatible with the Envoy Gateway release and the Gateway API resources you plan to use. If they are compatible,
-install only the Envoy Gateway CRDs separately, then install the Envoy Gateway Helm chart with `--skip-crds`.
+install only the Envoy Gateway CRDs separately, then install the Envoy Gateway Helm chart with `--set crds.enabled=false`.
 {{% /alert %}}
 
 ```shell
@@ -89,14 +89,14 @@ helm template eg oci://docker.io/envoyproxy/gateway-crds-helm \
 **Note**: We're using `helm template` piped into `kubectl apply` instead of `helm install` due to a [known Helm limitation](https://github.com/helm/helm/pull/12277)
 related to large CRDs in the `templates/` directory.
 
-Once the CRDs are installed, you can install the main Envoy Gateway Helm chart without re-applying CRDs by using the `--skip-crds` flag:
+Once the CRDs are installed, you can install the main Envoy Gateway Helm chart without re-applying CRDs by disabling the dependency via `--set crds.enabled=false`:
 
 ```shell
 helm install eg oci://docker.io/envoyproxy/gateway-helm \
   --version {{< helm-version >}} \
   -n envoy-gateway-system \
   --create-namespace \
-  --skip-crds
+  --set crds.enabled=false
 ```
 
 ### Clusters with compatible provider-managed Gateway API CRDs
@@ -132,13 +132,12 @@ helm install eg oci://docker.io/envoyproxy/gateway-helm \
   --version {{< helm-version >}} \
   -n envoy-gateway-system \
   --create-namespace \
-  --skip-crds \
-  --set crds.gatewayAPI.safeUpgradePolicy.enabled=false
+  --set crds.enabled=false
 ```
 
 If the provider-managed Gateway API CRDs are not compatible with your Envoy Gateway release or required Gateway API
 resources, do not mix them with another copy installed by Envoy Gateway. Use a compatible Gateway API CRD installation
-method for the cluster first, then install Envoy Gateway with `--skip-crds`.
+method for the cluster first, then install Envoy Gateway with `--set crds.enabled=false`.
 
 ## Upgrading from the previous version