istio-gateway
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
_internal_defaults_do_not_set:
4
# Name allows overriding the release name. Generally this should not be set
5
name: ""
6
# revision declares which revision this gateway is a part of
7
revision: ""
8
9
# Controls the spec.replicas setting for the Gateway deployment if set.
10
# Otherwise defaults to Kubernetes Deployment default (1).
11
replicaCount:
12
13
kind: Deployment
14
15
rbac:
16
# If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
17
# when using http://gateway-api.org/.
18
enabled: true
19
20
serviceAccount:
21
# If set, a service account will be created. Otherwise, the default is used
22
create: true
23
# Annotations to add to the service account
24
annotations: {}
25
# The name of the service account to use.
26
# If not set, the release name is used
27
name: ""
28
29
podAnnotations:
30
prometheus.io/port: "15020"
31
prometheus.io/scrape: "true"
32
prometheus.io/path: "/stats/prometheus"
33
inject.istio.io/templates: "gateway"
34
sidecar.istio.io/inject: "true"
35
36
# Define the security context for the pod.
37
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
38
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
39
securityContext: {}
40
containerSecurityContext: {}
41
42
service:
43
# Type of service. Set to "None" to disable the service entirely
44
type: LoadBalancer
45
# Set to a specific ClusterIP, or "" for automatic assignment
46
clusterIP: ""
47
# Additional labels to add to the service selector
48
selectorLabels: {}
49
ports:
50
- name: status-port
51
port: 15021
52
protocol: TCP
53
targetPort: 15021
54
- name: http2
55
port: 80
56
protocol: TCP
57
targetPort: 80
58
- name: https
59
port: 443
60
protocol: TCP
61
targetPort: 443
62
annotations: {}
63
loadBalancerIP: ""
64
loadBalancerSourceRanges: []
65
externalTrafficPolicy: ""
66
healthCheckNodePort:
67
externalIPs: []
68
ipFamilyPolicy: ""
69
ipFamilies: []
70
## Whether to automatically allocate NodePorts (only for LoadBalancers).
71
# allocateLoadBalancerNodePorts: false
72
## Set LoadBalancer class (only for LoadBalancers).
73
# loadBalancerClass: ""
74
75
resources:
76
requests:
77
cpu: 100m
78
memory: 128Mi
79
limits:
80
cpu: 2000m
81
memory: 1024Mi
82
83
autoscaling:
84
enabled: true
85
minReplicas: 1
86
maxReplicas: 5
87
targetCPUUtilizationPercentage: 80
88
targetMemoryUtilizationPercentage: {}
89
autoscaleBehavior: {}
90
91
# Pod environment variables
92
env: {}
93
94
# Use envVarFrom to define full environment variable entries with complex sources,
95
# such as valueFrom.secretKeyRef, valueFrom.configMapKeyRef. Each item must include a `name` and `valueFrom`.
96
#
97
# Example:
98
# envVarFrom:
99
# - name: EXAMPLE_SECRET
100
# valueFrom:
101
# secretKeyRef:
102
# name: example-name
103
# key: example-key
104
envVarFrom: []
105
106
# Deployment Update strategy
107
strategy: {}
108
109
# Sets the Deployment minReadySeconds value
110
minReadySeconds:
111
112
# Optionally configure a custom readinessProbe. By default the control plane
113
# automatically injects the readinessProbe. If you wish to override that
114
# behavior, you may define your own readinessProbe here.
115
readinessProbe: {}
116
117
# Labels to apply to all resources
118
labels:
119
# By default, don't enroll gateways into the ambient dataplane
120
"istio.io/dataplane-mode": none
121
122
# Annotations to apply to all resources
123
annotations: {}
124
125
nodeSelector: {}
126
127
tolerations: []
128
129
topologySpreadConstraints: []
130
131
affinity: {}
132
133
# If specified, the gateway will act as a network gateway for the given network.
134
networkGateway: ""
135
136
# Ports for the network gateway service. Only used when networkGateway is set.
137
networkGatewayPorts:
138
status-port:
139
port: 15021
140
targetPort: 15021
141
tls:
142
port: 15443
143
targetPort: 15443
144
tls-istiod:
145
port: 15012
146
targetPort: 15012
147
tls-webhook:
148
port: 15017
149
targetPort: 15017
150
151
# Specify image pull policy if default behavior isn't desired.
152
# Default behavior: latest images will be Always else IfNotPresent
153
imagePullPolicy: ""
154
155
imagePullSecrets: []
156
157
# This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
158
#
159
# By default, the `podDisruptionBudget` is disabled (set to `{}`),
160
# which means that no PodDisruptionBudget resource will be created.
161
#
162
# The PodDisruptionBudget can be only enabled if autoscaling is enabled
163
# with minReplicas > 1 or if autoscaling is disabled but replicaCount > 1.
164
#
165
# To enable the PodDisruptionBudget, configure it by specifying the
166
# `minAvailable` or `maxUnavailable`. For example, to set the
167
# minimum number of available replicas to 1, you can update this value as follows:
168
#
169
# podDisruptionBudget:
170
# minAvailable: 1
171
#
172
# Or, to allow a maximum of 1 unavailable replica, you can set:
173
#
174
# podDisruptionBudget:
175
# maxUnavailable: 1
176
#
177
# You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
178
# For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
179
#
180
# podDisruptionBudget:
181
# minAvailable: 1
182
# unhealthyPodEvictionPolicy: AlwaysAllow
183
#
184
# To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
185
#
186
# podDisruptionBudget: {}
187
#
188
podDisruptionBudget: {}
189
190
# Configure the DNS policy for the gateway pods. See
191
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
192
dnsPolicy: ""
193
194
# Configure DNS settings for the gateway pods. See
195
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
196
dnsConfig: {}
197
198
# Sets the per-pod terminationGracePeriodSeconds setting.
199
terminationGracePeriodSeconds: 30
200
201
# A list of `Volumes` added into the Gateway Pods. See
202
# https://kubernetes.io/docs/concepts/storage/volumes/.
203
volumes: []
204
205
# A list of `VolumeMounts` added into the Gateway Pods. See
206
# https://kubernetes.io/docs/concepts/storage/volumes/.
207
volumeMounts: []
208
209
# Inject initContainers into the Gateway Pods.
210
initContainers: []
211
212
# Inject additional containers into the Gateway Pods.
213
additionalContainers: []
214
215
# Configure this to a higher priority class in order to make sure your Istio gateway pods
216
# will not be killed because of low priority class.
217
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
218
# for more detail.
219
priorityClassName: ""
220
221
# Configure the lifecycle hooks for the gateway. See
222
# https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/.
223
lifecycle: {}
224
225
# When enabled, a default NetworkPolicy for gateways will be created
226
global:
227
networkPolicy:
228
enabled: false
229
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.