Tetrate Enterprise Gateway for Envoy (TEG) editions

Starting with TEG 1.9.0, TEG is published in three editions. All three are built from the same source, ship the same Helm chart, expose the same APIs and CRDs, and are configured identically. They differ in where the images are published, whether they come with Tetrate support, whether the phone-home client reports by default, and — for the FIPS edition — which cryptographic libraries the binaries are built against.

	Community	Enterprise	Enterprise FIPS
Control-plane image	docker.io/tetrate/teg-envoy-gateway	tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway	fips-containers.teg.tetratelabs.com/teg-envoy-gateway
Data-plane Envoy image	docker.io/tetrate/teg-envoy	tetrate-envoy-gateway.containers.dl.tetrate.io/envoy	fips-containers.teg.tetratelabs.com/envoy
Registry credentials	Not required	Required	Required
Tetrate support	None — community support only	Included with a TEG Subscription	Included with a TEG Subscription
Phone home	Always on, cannot be disabled	Off by default, opt-in	Off by default, opt-in
FIPS-validated cryptography	No	No	Yes
WAF (ExtendedSecurityPolicy)	Bundled in the data-plane image	Bundled in the data-plane image	Bundled in the data-plane image (FIPS WAF module)
Platforms	linux/amd64, linux/arm64	linux/amd64, linux/arm64	Control plane linux/amd64; data plane linux/amd64, linux/arm64
Helm chart	oci://docker.io/tetrate/teg-envoy-gateway-helm	oci://docker.io/tetrate/teg-envoy-gateway-helm	oci://docker.io/tetrate/teg-envoy-gateway-helm

The Helm chart is published publicly for every edition. You select an edition by pointing the chart at that edition's images — there is no separate chart to install.

info

The enterprise and enterprise FIPS images are hosted in credentialed Tetrate registries and are available to TEG Subscription customers, along with Tetrate support. Contact your Tetrate representative for a username and password.

Which edition should I use?

• Community — evaluation, development, and any deployment that does not need Tetrate support and where reporting instance status to Tetrate is acceptable. This is the default the chart installs, and it needs no credentials. It comes with no Tetrate support — join us in the #teg channel on the Tetrate Community Slack.
• Enterprise — production deployments under a TEG Subscription, which includes Tetrate support, and which must not report to Tetrate unless explicitly enabled.
• Enterprise FIPS — subscription deployments that must use FIPS 140-2 validated cryptography. See Install FIPS-validated TEG.

The Web Application Firewall is available in every edition: the composer dynamic module that implements it is baked into every published data-plane Envoy image, so ExtendedSecurityPolicy works without any image customization. The FIPS data-plane image bundles the FIPS build of that module, for which a few Coraza directives are unavailable — see Web Application Firewall.

Phone home

The phone-home client periodically reports the status of your TEG instance to Tetrate. Tetrate uses these reports to detect which versions are running in the field, so customers can be notified about CVEs and available updates that affect them.

Each report contains:

• the product identifier (teg);
• a cluster identifier — the UID of the cluster's kube-system namespace;
• an instance identifier — the UID of the namespace TEG is installed in;
• the installed TEG version and the version of each reported component.

No traffic data, no configuration, no Gateway API resources, and no client or workload identities are collected. Reports are sent once per hour over TLS to phone-home.tetrate.io:443, and a failed report is logged and discarded — it never affects the control plane or the data plane.

Whether the client runs depends on the edition:

• In the community edition, phone home is always on and cannot be disabled at runtime. The phoneHome.enabled Helm value has no effect on it.
• In the enterprise and enterprise FIPS editions, phone home is off by default and is enabled by setting phoneHome.enabled=true in your Helm values.

Install a specific edition

Community

The community edition is what the chart installs by default, so no image overrides are needed. Follow the Quickstart Guide.

Enterprise

The enterprise edition publishes both the control plane and the data-plane Envoy image to the credentialed Tetrate registry, so point both at it: use tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway for the control plane and tetrate-envoy-gateway.containers.dl.tetrate.io/envoy for the data plane. Enterprise images may carry Tetrate fixes that the public community images do not.

Create a pull secret with the credentials provided by Tetrate:

export TEG_USER="<teg-username>"
export TEG_PASS="<teg-password>"

kubectl create namespace envoy-gateway-system

kubectl create secret docker-registry teg-enterprise-creds \
  --docker-server="tetrate-envoy-gateway.containers.dl.tetrate.io" \
  --docker-username=${TEG_USER} \
  --docker-password=${TEG_PASS} \
  --docker-email="${USER}@" \
  -n envoy-gateway-system

Create a values.yaml file that points the control plane and the data plane at the enterprise images:

deployment:
tegEnvoyGateway:
  image:
    repository: tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway
    tag: v0.0.0-latest
    pullSecrets:
      - name: teg-enterprise-creds
config:
envoyProxy:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        container:
          image: "tetrate-envoy-gateway.containers.dl.tetrate.io/envoy:distroless-v1.9.0"
        pod:
          imagePullSecrets:
            - name: teg-enterprise-creds
# Phone home is off by default in the enterprise edition. Set this to true to opt in.
phoneHome:
enabled: false

The enterprise data-plane image bundles the same dynamic modules as the public one, so the WAF keeps working out of the box.

Install the chart with those values:

helm install teg oci://docker.io/tetrate/teg-envoy-gateway-helm \
  --version v0.0.0-latest \
  --values values.yaml \
  -n envoy-gateway-system

Enterprise FIPS

The enterprise FIPS edition pulls every image — control plane, data-plane Envoy, Envoy Gateway, and the rate limit service — from the credentialed Tetrate FIPS registry. See Install FIPS-validated TEG for the full instructions, and Verify FIPS Image to verify the installed artifacts.

Confirm which edition is running

The control-plane image tells you which edition is installed:

kubectl -n envoy-gateway-system get deployment teg-envoy-gateway \
    -o jsonpath="{.spec.template.spec.containers[0].image}"

For the enterprise editions, the PHONE_HOME_ENABLED environment variable on the same container reflects the phoneHome.enabled value the chart was installed with:

kubectl -n envoy-gateway-system get deployment teg-envoy-gateway \
    -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='PHONE_HOME_ENABLED')].value}"

For the enterprise FIPS edition, verify the cryptographic build as described in Verify FIPS Image.