istio-ztunnel
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
hub: cgr.dev/chainguard-private
4
image: ztunnel
5
tag: 1.30@sha256:5c24fc8155d25b3ce969065f456ccccaacc05846cd2817ffa6a96f4c91f5aa09
6
variant: ""
7
_internal_defaults_do_not_set:
8
# Hub to pull from. Image will be `Hub/Image:Tag-Variant`
9
hub: registry.istio.io/testing
10
# Tag to pull from. Image will be `Hub/Image:Tag-Variant`
11
tag: latest
12
# Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
13
variant: ""
14
# Image name to pull from. Image will be `Hub/Image:Tag-Variant`
15
# If Image contains a "/", it will replace the entire `image` in the pod.
16
image: ztunnel
17
# Same as `global.network`, but will override it if set.
18
# Network defines the network this cluster belong to. This name
19
# corresponds to the networks in the map of mesh networks.
20
network: ""
21
global:
22
# When enabled, default NetworkPolicy resources will be created
23
networkPolicy:
24
enabled: false
25
# resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
26
# If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
27
resourceName: ""
28
# Labels to apply to all top level resources
29
labels: {}
30
# Annotations to apply to all top level resources
31
annotations: {}
32
# Additional volumeMounts to the ztunnel container
33
volumeMounts: []
34
# Additional volumes to the ztunnel pod
35
volumes: []
36
# Tolerations for the ztunnel pod
37
tolerations:
38
- effect: NoSchedule
39
operator: Exists
40
- key: CriticalAddonsOnly
41
operator: Exists
42
- effect: NoExecute
43
operator: Exists
44
# Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
45
podAnnotations:
46
prometheus.io/port: "15020"
47
prometheus.io/scrape: "true"
48
# Additional labels to apply on the pod level
49
podLabels: {}
50
# Pod resource configuration
51
resources:
52
requests:
53
cpu: 200m
54
# Ztunnel memory scales with the size of the cluster and traffic load
55
# While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
56
memory: 512Mi
57
resourceQuotas:
58
enabled: false
59
pods: 5000
60
# Certificate Revocation List (CRL) support for plugged-in CAs.
61
# When enabled, ztunnel will check certificates against the CRL
62
peerCaCrl:
63
enabled: false
64
# List of secret names to add to the service account as image pull secrets
65
imagePullSecrets: []
66
# A `key: value` mapping of environment variables to add to the pod
67
env: {}
68
# Override for the pod imagePullPolicy
69
imagePullPolicy: ""
70
# Settings for multicluster
71
multiCluster:
72
# The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
73
# with Istiod configuration.
74
clusterName: ""
75
# meshConfig defines runtime configuration of components.
76
# For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
77
# components.
78
# TODO: https://github.com/istio/istio/issues/43248
79
meshConfig:
80
defaultConfig:
81
proxyMetadata: {}
82
# This value defines:
83
# 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
84
# 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
85
# Default K8S value is 30 seconds
86
terminationGracePeriodSeconds: 30
87
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
88
# Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
89
revision: ""
90
# The customized CA address to retrieve certificates for the pods in the cluster.
91
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
92
caAddress: ""
93
# The customized XDS address to retrieve configuration.
94
# This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
95
# By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
96
xdsAddress: ""
97
# Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
98
istioNamespace: istio-system
99
# Configuration log level of ztunnel binary, default is info.
100
# Valid values are: trace, debug, info, warn, error
101
logLevel: info
102
# To output all logs in json format
103
logAsJson: false
104
# Set to `type: RuntimeDefault` to use the default profile if available.
105
seLinuxOptions: {}
106
# TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
107
#seLinuxOptions:
108
# type: spc_t
109
110
# resourceScope controls what resources will be processed by helm.
111
# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
112
# It can be one of:
113
# - all: all resources are processed
114
# - cluster: only cluster-scoped resources are processed
115
# - namespace: only namespace-scoped resources are processed
116
resourceScope: all
117
# K8s DaemonSet update strategy.
118
# https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
119
updateStrategy:
120
type: RollingUpdate
121
rollingUpdate:
122
maxSurge: 1
123
maxUnavailable: 0
124
# DNS policy for the ztunnel pod
125
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
126
dnsPolicy: ""
127
# DNS config for the ztunnel pod
128
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
129
dnsConfig: {}
130
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.