Notice:
This is the "latest" release of Envoy Gateway, which contains the most recent commits from the main branch.
This release might not be stable.
Please refer to the /docs documentation for the most current information.

Gateway Helm Chart

  4 minute read  

Version: v0.0.0-latest Type: application AppVersion: latest

The Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

NameEmailUrl
envoy-gateway-steering-committeehttps://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
envoy-gateway-maintainershttps://github.com/envoyproxy/gateway/blob/main/CODEOWNERS

Source Code

Requirements

RepositoryNameVersion
crds0.0.0

Values

KeyTypeDefaultDescription
certgenobject{"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify values.yaml to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
commonLabelsobject{}Labels to apply to all resources
config.envoyGatewayobject{"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}}EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.
crds.enabledbooltrueInstall Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.
createNamespaceboolfalse
deployment.annotationsobject{}
deployment.envoyGateway.extraEnvlist[]Additional environment variables for the envoy-gateway container.
deployment.envoyGateway.image.repositorystring""
deployment.envoyGateway.image.tagstring""
deployment.envoyGateway.imagePullPolicystring""
deployment.envoyGateway.imagePullSecretslist[]
deployment.envoyGateway.livenessProbe.httpGet.pathstring"/healthz"
deployment.envoyGateway.livenessProbe.httpGet.portint8081
deployment.envoyGateway.livenessProbe.periodSecondsint20
deployment.envoyGateway.livenessProbe.successThresholdint1
deployment.envoyGateway.livenessProbe.timeoutSecondsint1
deployment.envoyGateway.readinessProbe.httpGet.pathstring"/readyz"
deployment.envoyGateway.readinessProbe.httpGet.portint8081
deployment.envoyGateway.readinessProbe.periodSecondsint10
deployment.envoyGateway.readinessProbe.successThresholdint1
deployment.envoyGateway.readinessProbe.timeoutSecondsint1
deployment.envoyGateway.resources.limits.memorystring"1024Mi"
deployment.envoyGateway.resources.requests.cpustring"100m"
deployment.envoyGateway.resources.requests.memorystring"256Mi"
deployment.envoyGateway.securityContext.allowPrivilegeEscalationboolfalse
deployment.envoyGateway.securityContext.capabilities.drop[0]string"ALL"
deployment.envoyGateway.securityContext.privilegedboolfalse
deployment.envoyGateway.securityContext.readOnlyRootFilesystembooltrue
deployment.envoyGateway.securityContext.runAsGroupint65532
deployment.envoyGateway.securityContext.runAsNonRootbooltrue
deployment.envoyGateway.securityContext.runAsUserint65532
deployment.envoyGateway.securityContext.seccompProfile.typestring"RuntimeDefault"
deployment.envoyGateway.startupProbe.failureThresholdint30
deployment.envoyGateway.startupProbe.httpGet.pathstring"/healthz"
deployment.envoyGateway.startupProbe.httpGet.portint8081
deployment.envoyGateway.startupProbe.periodSecondsint1
deployment.envoyGateway.startupProbe.successThresholdint1
deployment.envoyGateway.startupProbe.timeoutSecondsint1
deployment.envoyGateway.strategyobject{}Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty. Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim: wasmCacheVolume: persistentVolumeClaim: claimName: envoy-gateway-wasm-cache
deployment.envoyGateway.wasmCacheVolumeobject{}
deployment.minReadySecondsint0Minimum number of seconds a newly created Pod must be Ready, with no container crashing, before Kubernetes considers it available and proceeds to replace the next Pod during a rolling update. Zero (the Kubernetes default) means each new replica is eligible as soon as its readiness probe passes, so on a multi-replica deployment the whole rollout can replace every replica within seconds of each other. Raising this gives already-connected Envoy proxies (and anything else relying on this controller’s xDS/SDS streams) a bake period to reconnect and resync against a stable subset of replicas before the next one is cycled, bounding how many proxies can be disrupted at once by a single controller rollout.
deployment.pod.affinityobject{}
deployment.pod.annotations.“prometheus.io/port”string"19001"
deployment.pod.annotations.“prometheus.io/scrape”string"true"
deployment.pod.extraVolumeMountslist[]
deployment.pod.extraVolumeslist[]
deployment.pod.labelsobject{}
deployment.pod.nodeSelectorobject{}
deployment.pod.securityContext.fsGroupint65532
deployment.pod.securityContext.runAsGroupint65532
deployment.pod.securityContext.runAsNonRootbooltrue
deployment.pod.securityContext.runAsUserint65532
deployment.pod.securityContext.seccompProfile.typestring"RuntimeDefault"
deployment.pod.tolerationslist[]
deployment.pod.topologySpreadConstraintslist[]
deployment.ports[0].namestring"grpc"
deployment.ports[0].portint18000
deployment.ports[0].targetPortint18000
deployment.ports[1].namestring"ratelimit"
deployment.ports[1].portint18001
deployment.ports[1].targetPortint18001
deployment.ports[2].namestring"wasm"
deployment.ports[2].portint18002
deployment.ports[2].targetPortint18002
deployment.ports[3].namestring"metrics"
deployment.ports[3].portint19001
deployment.ports[3].targetPortint19001
deployment.priorityClassNamestringnil
deployment.progressDeadlineSecondsint0Kubernetes’ Deployment.spec.progressDeadlineSeconds, i.e. how long a rollout can run without making progress before it’s marked failed. Kubernetes requires this to be strictly greater than minReadySeconds and defaults it to 600 when unset — so minReadySeconds values of 600 or more will make the Deployment fail to apply unless this is also raised to exceed it. Leave unset (the default here) to accept Kubernetes’ own default of 600.
deployment.replicasint1
global.imagePullSecretslist[]Global override for image pull secrets
global.imageRegistrystring""Global override for image registry
global.images.envoyGateway.imagestringnilFull image for the Envoy Gateway control plane Deployment installed by this chart.
global.images.envoyGateway.pullPolicystringnilImage pull policy for the Envoy Gateway control plane Deployment. Default behavior: latest images will be Always else IfNotPresent.
global.images.envoyGateway.pullSecretslist[]Pull secrets for the Envoy Gateway control plane Deployment.
global.images.envoyProxy.imagestring""Full image for the managed Envoy Proxy data plane. This updates the generated envoyProxy config and does not change the envoy-gateway control plane Deployment image. If not specified, the default image built into envoy-gateway is used.
global.images.envoyProxy.pullPolicystring""Image pull policy for the managed Envoy Proxy data plane. Default behavior: IfNotPresent.
global.images.envoyProxy.pullSecretslist[]Pull secrets for the managed Envoy Proxy data plane.
global.images.ratelimit.imagestring"docker.io/envoyproxy/ratelimit:master"
global.images.ratelimit.pullPolicystring"IfNotPresent"
global.images.ratelimit.pullSecretslist[]
hpa.behaviorobject{}
hpa.enabledboolfalse
hpa.maxReplicasint1
hpa.metricslist[]
hpa.minReplicasint1
kubernetesClusterDomainstring"cluster.local"
namespaceOverridestring""Override the namespace for resources deployed by the chart. Defaults to the release namespace.
podDisruptionBudget.minAvailableint0
service.annotationsobject{}
service.trafficDistributionstring""
service.typestring"ClusterIP"Service type. Can be set to LoadBalancer with specific IP, e.g.: type: LoadBalancer loadBalancerIP: 10.236.90.20
topologyInjector.annotationsobject{}
topologyInjector.enabledbooltrue

Last modified September 1, 2026: Add deployment.minReadySeconds values field to gateway-helm chart (df3f30b39)