gateway-helm

# Global settings

global:

# If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.

# -- Global override for image registry

imageRegistry: ""

# -- Global override for image pull secrets

imagePullSecrets: []

# If set, these override image-specific values: useful when installing the chart in a private registry environment.

# Override image-specific values directly if a global override is not desired.

images:

envoyGateway:

# -- Full image for the Envoy Gateway control plane Deployment installed by this chart.

image: cgr.dev/chainguard-private/envoy-gateway:1.9.3-r2@sha256:26d269d869190577d60fc4c721dae6df0438c2baf725f85b567473f96baa59b6

# -- Image pull policy for the Envoy Gateway control plane Deployment.

# Default behavior: latest images will be Always else IfNotPresent.

pullPolicy: IfNotPresent

# -- Pull secrets for the Envoy Gateway control plane Deployment.

pullSecrets: []

ratelimit:

# This is the full image name including the hub, repo, and tag.

image: cgr.dev/chainguard-private/envoy-ratelimit:1.9.3-r2@sha256:65241d9f44e6db32ac68d4a99e047bcf9cc69589cfa5f328ac52716dcc748a08

# Specify image pull policy if default behavior isn't desired.

# Default behavior: latest images will be Always else IfNotPresent.

pullPolicy: IfNotPresent

# List of secrets in the same namespace of the component that can be used to pull images from private repositories.

pullSecrets: []

envoyProxy:

# -- Full image for the managed Envoy Proxy data plane.

# This updates the generated `envoyProxy` config and does not change the `envoy-gateway`

# control plane Deployment image. If not specified, the default image built into

# `envoy-gateway` is used.

image: cgr.dev/chainguard-private/envoy:distroless-v1.39.6-r1@sha256:0731a7795b38102aaf071ffcf9136695bc44a30a85e6cbb593d8cb1ff8081e7b

# -- Image pull policy for the managed Envoy Proxy data plane.

# Default behavior: IfNotPresent.

pullPolicy: ""

# -- Pull secrets for the managed Envoy Proxy data plane.

pullSecrets: []

# Values for CRDs dependency

crds:

# -- Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately.

enabled: true

# -- Labels to apply to all resources

commonLabels: {}

podDisruptionBudget:

minAvailable: 0

# maxUnavailable: 1

# unhealthyPodEvictionPolicy: IfHealthyBudget

deployment:

annotations: {}

envoyGateway:

image:

# if both this and global.imageRegistry are specified, this has to include both registry and repository explicitly, eg docker.io/envoyproxy/gateway

repository: ""

tag: ""

imagePullPolicy: ""

imagePullSecrets: []

# -- Additional environment variables for the envoy-gateway container.

extraEnv: []

resources:

limits:

memory: 1024Mi

requests:

cpu: 100m

memory: 256Mi

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

privileged: false

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsGroup: 65532

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

# -- Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty.

# Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim:

# wasmCacheVolume:

# persistentVolumeClaim:

# claimName: envoy-gateway-wasm-cache

strategy: {}

wasmCacheVolume: {}

# Kubernetes best practice for controllers: use a startupProbe with a generous

# failure threshold to avoid premature liveness/readiness failures during initialization.

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes

startupProbe:

httpGet:

path: /healthz

port: 8081

failureThreshold: 30

periodSeconds: 1

successThreshold: 1

timeoutSeconds: 1

livenessProbe:

httpGet:

path: /healthz

port: 8081

periodSeconds: 20

successThreshold: 1

timeoutSeconds: 1

readinessProbe:

httpGet:

path: /readyz

port: 8081

periodSeconds: 10

successThreshold: 1

timeoutSeconds: 1

ports:

- name: grpc

port: 18000

targetPort: 18000

- name: ratelimit

port: 18001

targetPort: 18001

- name: wasm

port: 18002

targetPort: 18002

- name: metrics

port: 19001

targetPort: 19001

priorityClassName: null

replicas: 1

pod:

affinity: {}

annotations:

prometheus.io/scrape: 'true'

prometheus.io/port: '19001'

labels: {}

topologySpreadConstraints: []

tolerations: []

nodeSelector: {}

# Additional volumeMounts on the deployment definition.

extraVolumeMounts: []

# - name: foo

# mountPath: "/etc/foo"

# readOnly: true

# Additional volumes on the deployment definition.

extraVolumes: []

# - name: foo

# configMap:

# name: myconfigmap

# -- Additional init containers on the deployment definition. Also used for native sidecars (an init container with restartPolicy: Always).

initContainers: []

# - name: sidecar

# image: my-sidecar:latest

# restartPolicy: Always

# -- Additional sidecar containers on the deployment definition.

extraContainers: []

# - name: sidecar

# image: my-sidecar:latest

securityContext:

runAsNonRoot: true

runAsGroup: 65532

runAsUser: 65532

fsGroup: 65532

seccompProfile:

type: RuntimeDefault

service:

# If set to PreferClose, the Envoy fleet will prioritize connecting to the Envoy Gateway pods that are topologically closest to them.

trafficDistribution: ""

annotations: {}

# -- Service type. Can be set to LoadBalancer with specific IP, e.g.:

# type: LoadBalancer

# loadBalancerIP: 10.236.90.20

type: "ClusterIP"

hpa:

enabled: false

minReplicas: 1

maxReplicas: 1

metrics: []

behavior: {}

config:

# -- EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.

envoyGateway:

gateway:

controllerName: gateway.envoyproxy.io/gatewayclass-controller

provider:

type: Kubernetes

logging:

level:

default: info

extensionApis: {}

createNamespace: false

# -- Override the namespace for resources deployed by the chart.

# Defaults to the release namespace.

namespaceOverride: ""

kubernetesClusterDomain: cluster.local

# -- Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.

certgen:

job:

annotations: {}

args: []

pod:

annotations: {}

labels: {}

securityContext:

runAsNonRoot: true

runAsGroup: 65532

runAsUser: 65532

fsGroup: 65532

seccompProfile:

type: RuntimeDefault

resources: {}

affinity: {}

tolerations: []

nodeSelector: {}

ttlSecondsAfterFinished: 30

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

privileged: false

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsGroup: 65532

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

rbac:

annotations: {}

labels: {}

topologyInjector:

enabled: true

annotations: {}