fix(helm): define default EnvoyProxy image

[Aditya7880900936]

What type of PR is this?

fix(helm): define default EnvoyProxy image in gateway-helm chart

What this PR does / why we need it:

This PR sets global.images.envoyProxy.image in charts/gateway-helm/values.tmpl.yaml to the same default image used by DefaultEnvoyProxyImage.

Previously, the Helm chart left this value empty and relied on the controller-side default image. As a result, the Envoy proxy image was not visible in rendered Helm manifests, making it difficult for image discovery, mirroring, and air-gapped deployment workflows that scan rendered manifests.

This change keeps the Helm chart default aligned with the controller default and ensures the Envoy image appears in rendered chart output.

Additionally, this PR updates the release documentation to ensure the Helm chart value is updated alongside DefaultEnvoyProxyImage during future releases, and regenerates the corresponding Helm documentation and golden test outputs.

Which issue(s) this PR fixes:

Fixes #9144

Release Notes: No

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	72245e7
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a593ef3ff78d10008f9c64b
😎 Deploy Preview	https://deploy-preview-9163--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f0847b73e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.42%. Comparing base (2621405) to head (72245e7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9163   +/-   ##
=======================================
  Coverage   75.42%   75.42%           
=======================================
  Files         252      252           
  Lines       41642    41642           
=======================================
  Hits        31408    31408           
+ Misses       8102     8101    -1     
- Partials     2132     2133    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Aditya7880900936]

Hi @zhaohuabing , please have a look on this PR and feel free to suggest any changes

[Aditya7880900936]

Hi @zhaohuabing , please have a look on this PR and feel free to suggest any changes

[zhaohuabing]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf861bf149

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Aditya7880900936]

Thanks for the suggestion @zhaohuabing ! I've updated the merge logic so that the image override is applied to envoyDaemonSet.container when envoyDaemonSet is configured, to envoyDeployment.container when envoyDeployment is configured, and otherwise defaults to envoyDeployment. I also addressed the remaining review comments by removing the stray character in RELEASING.md and adding a release note.

[Aditya7880900936]

hi @zhaohuabing , please have a look on this PR and feel free to suggest any changes

[zhaohuabing]

Could we add a helm test for config.envoyGateway.envoyProxy.provider.kubernetes.envoyDaemonSet to assert image lands under envoyDaemonSet?

[zhaohuabing]

The non-empty default causes the chart to overwrite an Envoy proxy image supplied through the config.envoyGateway.envoyProxy path. This makes envoyProxy behave differently from every other image in the chart — ratelimit (config…rateLimitDeployment.container.image) and the control-plane image (deployment.envoyGateway.image.*) both let the more specific/inline setting win over the global knob. We should keep that consistent.

Repro (config-only, no global override — regresses vs. the current release):

config:
  envoyGateway:
    envoyProxy:
      provider:
        kubernetes:
          envoyDeployment:
            container:
              image: private-hub/envoyproxy/envoy:custom   # gets replaced by distroless-dev

The root cause is a .Values mutation: mustMergeOverwrite shares nested-map references and mutates .Values.config.envoyGateway.envoyProxy in place, so the user's image is gone before the ConfigMap's outer merge runs. Please wrap the base with deepCopy:

- {{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }}
+ {{- $merged := mustMergeOverwrite (dict) (deepCopy $envoyProxyBase) $imageOverride }}

This makes an inline config image win — consistent with ratelimit.

Two more asks before this is ready:

1. Add snapshot coverage for the new logic — one case with an inline config proxy image (asserting it's preserved), and one with envoyDaemonSet (asserting the image lands under envoyDaemonSet and the daemonset config is retained). The envoyDaemonSet branch is currently untested.
2. In the release note, mention that an inline config proxy image now takes precedence over global.images.envoyProxy.image, matching ratelimit/control-plane behavior.

[Aditya7880900936]

Hi @zhaohuabing ,
Addressed the review feedback:

• Updated the merge logic to use deepCopy before mustMergeOverwrite to avoid mutating the original values.
• Added Helm regression tests covering both:
  • envoyDaemonSet image injection from global.images.envoyProxy.image
  • Existing inline envoyDeployment.container.image override behavior.
• Rebased the branch on the latest main and resolved the merge conflicts.

Thanks for the review!

[zhaohuabing]

@Aditya7880900936 could you please fix the gen check?

[Aditya7880900936]

Hi @zhaohuabing,

I've been investigating the gen-check failure locally.

I rebased onto the latest main and reran make generate, make helm-template, and make -k gen-check. The only differences being reported are the generated gateway-dev:<git-sha> image tags in the new Helm golden outputs. Since the Helm generation uses the current Git commit SHA for the default controller image tag, every new amend/rebase changes those generated outputs again.

The functional changes introduced by this PR remain the same; only the generated controller image tag differs.

Is there an expected way to make these Helm golden outputs deterministic, or am I missing an additional regeneration step for these test fixtures?

Thanks!

[Aditya7880900936]

Hi @zhaohuabing,

I've been investigating the gen-check failure locally.

I rebased onto the latest main and reran make generate, make helm-template, and make -k gen-check. The only differences being reported are the generated gateway-dev:<git-sha> image tags in the new Helm golden outputs. Since the Helm generation uses the current Git commit SHA for the default controller image tag, every new amend/rebase changes those generated outputs again.

The functional changes introduced by this PR remain the same; only the generated controller image tag differs.

Is there an expected way to make these Helm golden outputs deterministic, or am I missing an additional regeneration step for these test fixtures?

Thanks!