Tetrate Enterprise Gateway for EnvoyVersion: v1.8.xTEG Image Versions
Image versions for TEG v1.8.5.
The TEG control-plane, data-plane Envoy and supporting images are public. Tetrate builds of Envoy Gateway are published to credentialed Tetrate registries, and the FIPS images live in a dedicated credentialed FIPS registry — see Install TEG with FIPS.
Envoy images should be updated to 1.38.8 (upstream) or v1.8.5.5 (Tetrate and FIPS) to fix GHSA-3wvj-j6qm-62mr, CVE-2026-35189 and denial-of-service vulnerabilities in the OAuth2 and API key auth HTTP filters, and to stop trusting the compromised eMudhra intermediate CAs. They also include the latest Envoy bug fixes.
Public images
These images can be pulled without Tetrate credentials. They are the images the Helm chart uses by default; the chart may pin an earlier TEG or Envoy patch, so override the image tags to pick up the versions listed here.
| Repository | Name | Version |
|---|---|---|
| docker.io/tetrate | teg-envoy-gateway | v1.8.5.2 |
| docker.io/tetrate | teg-envoy | v1.8.5.5 |
| docker.io/tetrate | teg-envoy | distroless-v1.8.5.5 |
| docker.io/envoyproxy | gateway | v1.8.5 |
| docker.io/envoyproxy | ratelimit | 8fe6ea42 |
| docker.io/tetrate | gen-istio-cert | v0.6.0 |
| docker.io | redis | 8.6.7 |
Tetrate builds (credentialed)
Tetrate rebuilds Envoy Gateway with security and bug fixes that are not yet in the upstream
v1.8.5 image. These builds are published only to the credentialed
Tetrate registry.
The Envoy images in this registry are the same builds as the public teg-envoy images above. They
are still published for existing deployments; new deployments should use the public teg-envoy
images.
| Repository | Name | Version |
|---|---|---|
| tetrate-envoy-gateway.containers.dl.tetrate.io | gateway | v1.8.5.2-tetrate |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | v1.8.5.5 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | distroless-v1.8.5.5 |
FIPS
The FIPS images are published to and consumed from a single credentialed registry,
fips-containers.teg.tetratelabs.com — see Install TEG with FIPS. The
control-plane, Envoy Gateway and rate limit FIPS images are built for linux/amd64 only; the Envoy
FIPS images are built for linux/amd64 and linux/arm64.
| Repository | Name | Version |
|---|---|---|
| fips-containers.teg.tetratelabs.com | teg-envoy-gateway | v1.8.5.2 |
| fips-containers.teg.tetratelabs.com | envoy | v1.8.5.5 |
| fips-containers.teg.tetratelabs.com | envoy | distroless-v1.8.5.5 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | v1.8.5.5 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | distroless-v1.8.5.5 |
| fips-containers.teg.tetratelabs.com | gateway | v1.8.5.2-tetrate |
| fips-containers.teg.tetratelabs.com | ratelimit | v2026.10.22.0 |
Helm charts
The charts are public; FIPS and Tetrate builds are selected through image overrides.
| Repository | Chart | Version |
|---|---|---|
| oci://docker.io/tetrate | teg-envoy-gateway-helm | v1.8.5 |
| oci://docker.io/tetrate | teg-crds-helm | v1.8.5 |
| oci://docker.io/tetrate | teg-resources-helm | v1.8.5 |
| oci://docker.io/tetrate | teg-keycloak-demo-helm | v1.8.5 |