gateway-helm
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Global settings
2
global:
3
# If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.
4
# -- Global override for image registry
5
imageRegistry: ""
6
# -- Global override for image pull secrets
7
imagePullSecrets: []
8
# If set, these override image-specific values: useful when installing the chart in a private registry environment.
9
# Override image-specific values directly if a global override is not desired.
10
images:
11
envoyGateway:
12
# This is the full image name including the hub, repo, and tag.
13
image: cgr.dev/chainguard-private/envoy-gateway:latest@sha256:9e8e02ce95696008d039b4da83c4ebf26c7f1cc180c5ea349bded008e069131a
14
# Specify image pull policy if default behavior isn't desired.
15
# Default behavior: latest images will be Always else IfNotPresent.
16
pullPolicy: IfNotPresent
17
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
18
pullSecrets: []
19
ratelimit:
20
# This is the full image name including the hub, repo, and tag.
21
image: cgr.dev/chainguard-private/envoy-ratelimit:latest@sha256:cc26792de6ce9f526e365807f4d463310d3eaaf34a63ddb2481c3c954cc1d63d
22
# Specify image pull policy if default behavior isn't desired.
23
# Default behavior: latest images will be Always else IfNotPresent.
24
pullPolicy: IfNotPresent
25
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
26
pullSecrets: []
27
envoyProxy:
28
# This is the full image name including the hub, repo, and tag for the Envoy Proxy data plane.
29
# If not specified, uses the default image built into envoy-gateway.
30
image: ""
31
# Specify image pull policy if default behavior isn't desired.
32
# Default behavior: IfNotPresent.
33
pullPolicy: ""
34
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
35
pullSecrets: []
36
# Values for CRDs dependency
37
crds:
38
# -- Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.
39
enabled: true
40
# -- Labels to apply to all resources
41
commonLabels: {}
42
podDisruptionBudget:
43
minAvailable: 0
44
# maxUnavailable: 1
45
deployment:
46
annotations: {}
47
envoyGateway:
48
image:
49
# if both this and global.imageRegistry are specified, this has to include both registry and repository explicitly, eg docker.io/envoyproxy/gateway
50
repository: ""
51
tag: ""
52
imagePullPolicy: ""
53
imagePullSecrets: []
54
# -- Additional environment variables for the envoy-gateway container.
55
extraEnv: []
56
resources:
57
limits:
58
memory: 1024Mi
59
requests:
60
cpu: 100m
61
memory: 256Mi
62
securityContext:
63
allowPrivilegeEscalation: false
64
capabilities:
65
drop:
66
- ALL
67
privileged: false
68
runAsNonRoot: true
69
runAsGroup: 65532
70
runAsUser: 65532
71
seccompProfile:
72
type: RuntimeDefault
73
ports:
74
- name: grpc
75
port: 18000
76
targetPort: 18000
77
- name: ratelimit
78
port: 18001
79
targetPort: 18001
80
- name: wasm
81
port: 18002
82
targetPort: 18002
83
- name: metrics
84
port: 19001
85
targetPort: 19001
86
priorityClassName: null
87
replicas: 1
88
pod:
89
affinity: {}
90
annotations:
91
prometheus.io/scrape: 'true'
92
prometheus.io/port: '19001'
93
labels: {}
94
topologySpreadConstraints: []
95
tolerations: []
96
nodeSelector: {}
97
# Additional volumeMounts on the deployment definition.
98
extraVolumeMounts: []
99
# - name: foo
100
# mountPath: "/etc/foo"
101
# readOnly: true
102
# Additional volumes on the deployment definition.
103
extraVolumes: []
104
# - name: foo
105
# configMap:
106
# name: myconfigmap
107
service:
108
# If set to PreferClose, the Envoy fleet will prioritize connecting to the Envoy Gateway pods that are topologically closest to them.
109
trafficDistribution: ""
110
annotations: {}
111
# -- Service type. Can be set to LoadBalancer with specific IP, e.g.:
112
# type: LoadBalancer
113
# loadBalancerIP: 10.236.90.20
114
type: "ClusterIP"
115
hpa:
116
enabled: false
117
minReplicas: 1
118
maxReplicas: 1
119
metrics: []
120
behavior: {}
121
config:
122
# -- EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.
123
envoyGateway:
124
gateway:
125
controllerName: gateway.envoyproxy.io/gatewayclass-controller
126
provider:
127
type: Kubernetes
128
logging:
129
level:
130
default: info
131
extensionApis: {}
132
createNamespace: false
133
# -- Override the namespace for resources deployed by the chart.
134
# Defaults to the release namespace.
135
namespaceOverride: ""
136
kubernetesClusterDomain: cluster.local
137
# -- Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
138
certgen:
139
job:
140
annotations: {}
141
args: []
142
pod:
143
annotations: {}
144
labels: {}
145
resources: {}
146
affinity: {}
147
tolerations: []
148
nodeSelector: {}
149
ttlSecondsAfterFinished: 30
150
securityContext:
151
allowPrivilegeEscalation: false
152
capabilities:
153
drop:
154
- ALL
155
privileged: false
156
readOnlyRootFilesystem: true
157
runAsNonRoot: true
158
runAsGroup: 65532
159
runAsUser: 65532
160
seccompProfile:
161
type: RuntimeDefault
162
rbac:
163
annotations: {}
164
labels: {}
165
topologyInjector:
166
enabled: true
167
annotations: {}
168
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.