Tetrate Enterprise Gateway for EnvoyVersion: v1.9.xTEG Image Versions
Image versions for TEG v1.9.2.
TEG is published in three editions — see TEG Editions. The community images are public; the enterprise and enterprise FIPS images live in credentialed Tetrate registries.
Envoy images should be updated to 1.39.4 (upstream) or 1.9.2.4 (Tetrate and FIPS) to fix CVE-2026-35189 and denial-of-service vulnerabilities in the OAuth2 and API key auth HTTP filters. They also include the latest Envoy bug fixes.
Community (public)
These are the images the Helm chart uses by default. They can be pulled without Tetrate credentials.
| Repository | Name | Version |
|---|---|---|
| docker.io/tetrate | teg-envoy-gateway | v1.9.2 |
| docker.io/tetrate | teg-envoy | v1.9.2.4 |
| docker.io/tetrate | teg-envoy | distroless-v1.9.2.4 |
| docker.io/envoyproxy | gateway | v1.9.2 |
| docker.io/envoyproxy | ratelimit | 0482748e |
| docker.io/tetrate | gen-istio-cert | v0.5.0 |
| docker.io | redis | 8.6.7 |
Enterprise (non-FIPS)
The enterprise edition publishes its own control-plane and data-plane Envoy images, which may carry Tetrate fixes that the public community images do not, and pins the Tetrate build of the rate limit service. The Envoy Gateway and Redis images are the public ones listed above.
| Repository | Name | Version |
|---|---|---|
| tetrate-envoy-gateway.containers.dl.tetrate.io | teg-envoy-gateway | v1.9.2 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | v1.9.2.4 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | distroless-v1.9.2.4 |
| docker.io/tetrate | ratelimit | v2026.10.14.0 |
Enterprise FIPS
Every FIPS image is published to and consumed from a single registry,
fips-containers.teg.tetratelabs.com. FIPS images are built for linux/amd64 only.
| Repository | Name | Version |
|---|---|---|
| fips-containers.teg.tetratelabs.com | teg-envoy-gateway | v1.9.2 |
| fips-containers.teg.tetratelabs.com | envoy | v1.9.2.4 |
| fips-containers.teg.tetratelabs.com | envoy | distroless-v1.9.2.4 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | v1.9.2.4 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | distroless-v1.9.2.4 |
| fips-containers.teg.tetratelabs.com | gateway | v1.9.2-tetrate |
| fips-containers.teg.tetratelabs.com | ratelimit | v2026.10.14.0 |
Helm charts
The charts are public for every edition; the edition is selected through image overrides.
| Repository | Chart | Version |
|---|---|---|
| oci://docker.io/tetrate | teg-envoy-gateway-helm | v1.9.2 |
| oci://docker.io/tetrate | teg-crds-helm | v1.9.2 |
| oci://docker.io/tetrate | teg-resources-helm | v1.9.2 |
| oci://docker.io/tetrate | teg-keycloak-demo-helm | v1.9.2 |