Tetrate Enterprise Gateway for EnvoyVersion: v1.9.xteg-envoy-gateway-helm
The Helm chart for Tetrate Enterprise Gateway for Envoy
Homepage: https://tetrate.io/
Requirements
| Repository | Name | Version |
|---|---|---|
| oci://docker.io/envoyproxy | gateway-helm | v1.9.0 |
Values
| Key | Type | Default | Description |
|---|---|---|---|
| certgen | object | {"job":{"affinity":{},"annotations":{},"nodeSelector":{},"pod":{"labels":{}},"resources":{},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}} | TEG Certificate Generation Job configuration used to generate TLS Certificates for Redis |
| certgen.job.affinity | object | {} | Affinity rules for certgen job pod scheduling |
| certgen.job.nodeSelector | object | {} | Node selector for certgen job pod scheduling (e.g. pin to amd64 nodes) |
| certgen.job.pod | object | - | Tetrate Enterprise Gateway for Envoy certgen job pod configuration |
| certgen.job.pod.labels | object | {} | Custom labels to add to the certgen job pods (in addition to standard labels) |
| certgen.job.tolerations | list | [] | Tolerations for certgen job pod scheduling |
| commonLabels | object | {} | Labels to apply to all resources created by this chart (Deployment, Job, Service, RBAC, etc.) |
| config.envoyProxy | object | {"logging":{"level":{"default":"warn"}},"provider":{"kubernetes":{"envoyDeployment":{"container":{"image":"docker.io/tetrate/teg-envoy:distroless-v1.9.0"}}},"type":"Kubernetes"}} | Configuration for every Envoy Proxy replica in each Gateway which uses the GatewayClass created by this chart (named by gatewayClass.name, which references the EnvoyProxy resource made from these values). This is merged with defaults to product an EnvoyProxy object (https://gateway.envoyproxy.io/latest/api/extension_types/#envoyproxyspec). Values specified here take precedence. |
| config.envoyProxy.logging.level.default | string | "warn" | All Envoy log areas to log at level warn Individual areas can be altered with eg oauth2: debug |
| config.envoyProxy.provider | object | {"kubernetes":{"envoyDeployment":{"container":{"image":"docker.io/tetrate/teg-envoy:distroless-v1.9.0"}}},"type":"Kubernetes"} | Default data-plane Envoy image for the EnvoyProxy resource. This is a Built-on-Envoy image that bundles the dynamic modules required for WAF, so WAF works out of the box without any image customization. Override this to use a FIPS Envoy image (e.g. fips-containers.teg.tetratelabs.com/envoy:distroless-vX.Y.Z). |
| deployment | object | - | Tetrate Enterprise Gateway for Envoy control plane components configuration options |
| deployment.tegEnvoyGateway | object | - | Tetrate Enterprise Gateway for Envoy deployment configuration |
| deployment.tegEnvoyGateway.annotations | object | {} | Custom annotations to add to the Deployment metadata |
| deployment.tegEnvoyGateway.container | object | {"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}} | Tetrate Enterprise Gateway for Envoy con configuration |
| deployment.tegEnvoyGateway.image | object | - | Tetrate Enterprise Gateway for Envoy image configuration |
| deployment.tegEnvoyGateway.image.pullPolicy | string | "IfNotPresent" | Tetrate Enterprise Gateway for Envoy image pull policy |
| deployment.tegEnvoyGateway.image.pullSecrets | list | [] | Tetrate Enterprise Gateway for Envoy image pull secrets |
| deployment.tegEnvoyGateway.image.repository | string | "docker.io/tetrate/teg-envoy-gateway" | Tetrate Enterprise Gateway for Envoy image repository |
| deployment.tegEnvoyGateway.image.tag | string | "v1.9.0" | Tetrate Enterprise Gateway for Envoy image tag |
| deployment.tegEnvoyGateway.pod | object | {"affinity":{},"annotations":{},"labels":{},"nodeSelector":{},"securityContext":{"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"topologySpreadConstraints":[]} | Tetrate Enterprise Gateway for Envoy pod configuration |
| deployment.tegEnvoyGateway.pod.annotations | object | {} | Custom annotations to add to pods |
| deployment.tegEnvoyGateway.pod.labels | object | {} | Custom labels to add to pods (in addition to standard labels) |
| deployment.tegEnvoyGateway.replicas | int | 1 | Tetrate Enterprise Gateway for Envoy replicas in cluster |
| deployment.tegEnvoyGateway.resources | object | {} | Tetrate Enterprise Gateway for Envoy deployment resources More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
| gateway-helm | object | {"commonLabels":{},"config":{"envoyGateway":{"envoyProxy":{"dynamicModules":[{"doNotClose":true,"name":"composer","source":{"local":{"path":"/usr/local/lib/tetrateio/libcomposer.so"},"type":"Local"}},{"name":"ip-restriction","source":{"local":{"path":"/usr/local/lib/tetrateio/libip-restriction.so"},"type":"Local"}},{"name":"dns-gateway","source":{"local":{"path":"/usr/local/lib/tetrateio/libdns-gateway.so"},"type":"Local"}}]},"extensionApis":{"enableEnvoyPatchPolicy":true},"provider":{"kubernetes":{"overwrite_control_plane_certs":false,"rateLimitDeployment":{"container":{"env":[{"name":"LOG_FORMAT","value":"json"},{"name":"REDIS_HEALTH_CHECK_ACTIVE_CONNECTION","value":"false"},{"name":"REDIS_TYPE","value":"SINGLE"},{"name":"REDIS_TLS_CACERT","value":"/redis-certs/ca.crt"}]}}}},"rateLimit":{"backend":{"redis":{"tls":{"certificateRef":{"name":"redis-tls"}},"url":"teg-redis.envoy-gateway-system.svc.cluster.local:6379"},"type":"Redis"}}}}} | Envoy Gateway installation configuration. Detailed configuration documentation can be found here: https://github.com/envoyproxy/gateway/tree/main/charts/gateway-helm Tetrate Enterprise Gateway for Envoy configures underlying Envoy gateway installation configuration. In case there are any conflicts, between TEG configuration and EG configuration provided here, EG configuration is given precedence. |
| gateway-helm.commonLabels | object | {} | Labels to apply to all Envoy Gateway (subchart) resources |
| gateway-helm.config.envoyGateway.rateLimit.backend.redis.url | string | "teg-redis.envoy-gateway-system.svc.cluster.local:6379" | If you change the namespace or name of the Redis Service, change this to match |
| gatewayClass | object | - | GatewayClass created by this chart for the Tetrate Enterprise Gateway for Envoy data plane. |
| gatewayClass.enabled | bool | true | Create the GatewayClass. Set to false when the class is managed separately, or to install TEG alongside an existing installation that already owns a GatewayClass of this name. |
| gatewayClass.name | string | "teg" | Name of the GatewayClass. Gateways select it via spec.gatewayClassName. The controller that reconciles it is taken from gateway-helm.config.envoyGateway.gateway.controllerName, so the two cannot drift apart. |
| phoneHome | object | {"enabled":false} | Phone-home telemetry. Only affects the enterprise edition, where phone-home is off by default and this opts in. The community edition always reports regardless of this value. |
| phoneHome.enabled | bool | false | Enable the phone-home client in the enterprise edition (no effect on the community edition). |
| podDisruptionBudget | object | {"minAvailable":0} | PodDisruptionBudget configuration for the teg manager pods |
| podDisruptionBudget.minAvailable | int | 0 | Minimum number of pods that must remain available. |
| redis | object | - | TEG Redis deployment configuration. While the TEG-managed Redis instance is a great way to get started, it is not deployed in a production-hardened manner and should be considered suitable for demo purposes only. It is a single, non-replicated instance with no persistence, no high availability and no backup, so a restart loses all rate limit counters. For production, run your own hardened Redis: set redis.disabled=true and point gateway-helm.config.envoyGateway.rateLimit.backend.redis.url at it. |
| redis.disabled | bool | false | Redis enabled by default |
| redis.image | object | - | Redis image configuration |
| redis.image.pullPolicy | string | "IfNotPresent" | Redis image pull policy in cluster |
| redis.image.pullSecrets | list | [] | Redis image pull secrets |
| redis.image.repository | string | "redis" | Redis image repository |
| redis.image.tag | string | "8.6.3" | Redis image tag |
| redis.password | string | "" | default user auth password for redis deployment |
| redis.replicas | int | 1 | Redis replicas to deploy |
| redis.resources | object | {} | Redis deployment resources More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
| redis.service | object | - | Redis service configuration |
| redis.service.port | int | 6379 | Redis service exposed port |
| redis.service.type | string | "ClusterIP" | Redis service type |