feat(chart): Allow configuring envoy proxy image via helm chart by mgs255 · Pull Request #8785 · envoyproxy/gateway

mgs255 · 2026-04-18T18:02:59Z

This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under global.images.envoyProxy:

Value	Type	Default	Description
`global.images.envoyProxy.image`	string	`""`	Full image name (`registry/repo:tag`) for the Envoy Proxy container
`global.images.envoyProxy.pullPolicy`	string	`""`	Image pull policy
`global.images.envoyProxy.pullSecrets`	list	`[]`	Image pull secrets

When any of these are set, the chart generates an envoyProxy: block inside the EnvoyGateway ConfigMap, wiring into the existing EnvoyGatewaySpec.envoyProxy field (added in #7698). The global imageRegistry override takes highest precedence, consistent with other chart components.

Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via config.envoyGateway.envoyProxy; the image values are merged on top.

Closes #4764.

This commit is a continuation of the previous work to support supplying default proxy settings added in envoyproxy#7698 and adds three new chart values under `global.images.envoyProxy`: | Value | Type | Default | Description | |----------------------------------------|--------|------|---------------------------------------------------------------------| | `global.images.envoyProxy.image` | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container | | `global.images.envoyProxy.pullPolicy` | string | `""` | Image pull policy | | `global.images.envoyProxy.pullSecrets` | list | `[]` | Image pull secrets | When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in envoyproxy#7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components. Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top. Closes envoyproxy#4764. Signed-off-by: Michael Sommerville <[email protected]>

netlify · 2026-04-18T18:03:04Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`151af56`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69ef0d16ad8b200008ed9025
😎 Deploy Preview	https://deploy-preview-8785--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f65bd6a196

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-18T18:08:15Z

+  {{- $deployment := dict "container" $container }}
+  {{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }}
+    {{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }}
+    {{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYamlArray) }}


Decode pull secrets as map before extracting list

This parses the helper output with fromYamlArray, but eg.envoyProxy.image.pullSecrets renders a YAML object (imagePullSecrets: ...), not a top-level YAML array. Helm’s fromYamlArray only converts YAML arrays, so when users set global.imagePullSecrets or global.images.envoyProxy.pullSecrets, this conversion can yield an invalid/empty value and the generated envoyProxy.provider.kubernetes.envoyDeployment.pod.imagePullSecrets will not be populated as intended.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-18T18:08:15Z

+{{- if .Values.global.images.envoyProxy.image }}
+  {{- $container := dict "image" (include "eg.envoyProxy.image" .) }}
+  {{- if .Values.global.images.envoyProxy.pullPolicy }}
+    {{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }}


Allow pull policy/secret overrides without image override

The pullPolicy and pullSecrets wiring is nested under if .Values.global.images.envoyProxy.image, so these new values are ignored unless global.images.envoyProxy.image is also set. In practice, users cannot set only pull policy or pull secrets while keeping Envoy Gateway’s default proxy image, even though those values were added as independent chart knobs.

Useful? React with 👍 / 👎.

codecov · 2026-04-18T18:11:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.37%. Comparing base (dd203e5) to head (151af56).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8785      +/-   ##
==========================================
- Coverage   74.38%   74.37%   -0.02%     
==========================================
  Files         246      246              
  Lines       39292    39292              
==========================================
- Hits        29229    29225       -4     
- Misses       8035     8038       +3     
- Partials     2028     2029       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2026-04-19T02:35:21Z

thanks ! can you add some tests

Signed-off-by: Michael Sommerville <[email protected]>

jukie · 2026-04-23T03:59:18Z

Can you update the descriptions to include envoyProxy?

jukie · 2026-04-23T04:04:01Z

Overall LGTM! One nit on yaml comments and then please add a release note as well

jukie · 2026-04-25T02:51:46Z

/retest

Signed-off-by: Michael Sommerville <[email protected]>

arkodg

LGTM thanks

…l registry Signed-off-by: Michael Sommerville <[email protected]>

mgs255 · 2026-04-27T08:31:19Z

/retest

zhaohuabing

LGTM. Thanks!

…yproxy#8785) * feat: Allow configuring envoy proxy defaults via helm chart This commit is a continuation of the previous work to support supplying default proxy settings added in envoyproxy#7698 and adds three new chart values under `global.images.envoyProxy`: | Value | Type | Default | Description | |----------------------------------------|--------|------|---------------------------------------------------------------------| | `global.images.envoyProxy.image` | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container | | `global.images.envoyProxy.pullPolicy` | string | `""` | Image pull policy | | `global.images.envoyProxy.pullSecrets` | list | `[]` | Image pull secrets | When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in envoyproxy#7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components. Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top. Closes envoyproxy#4764. Signed-off-by: Michael Sommerville <[email protected]> Signed-off-by: Jake Oliver <[email protected]>

…rt (envoyproxy#8785)" This reverts commit 092cc67. Signed-off-by: Karol Szwaj <[email protected]>

* fix json report (#8614) Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 4768ca7) * fix: deep copy status in translator layer to avoid race (#8778) Signed-off-by: Rudrakh Panigrahi <[email protected]> (cherry picked from commit 3f70a89) * fix: force HTTP1 for upstream connections for WS and WSS backends (#8699) * force HTTP1 for upstream connections for WS and WSS backends Signed-off-by: Huabing (Robin) Zhao <[email protected]> * use different clusters for mixed upstream protocols Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix lint Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 7633125) * fix: reason with multiple errors rejected validation (#8859) * fix: reason with multiple errors rejected validation Signed-off-by: zirain <[email protected]> * release notes Signed-off-by: zirain <[email protected]> * fix lint Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 7811d86) * feat(chart): Allow configuring envoy proxy image via helm chart (#8785) * feat: Allow configuring envoy proxy defaults via helm chart This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under `global.images.envoyProxy`: | Value | Type | Default | Description | |----------------------------------------|--------|------|---------------------------------------------------------------------| | `global.images.envoyProxy.image` | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container | | `global.images.envoyProxy.pullPolicy` | string | `""` | Image pull policy | | `global.images.envoyProxy.pullSecrets` | list | `[]` | Image pull secrets | When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in #7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components. Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top. Closes #4764. Signed-off-by: Michael Sommerville <[email protected]> (cherry picked from commit 8570285) * add rn and version bump Signed-off-by: Karol Szwaj <[email protected]> * fix: respect backend endpoint hostname for health checks (#8929) * fix: respect backend endpoint hostname for health checks - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <[email protected]> Co-authored-by: Codex <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: zirain <[email protected]> Co-authored-by: Codex <[email protected]> Co-authored-by: zirain <[email protected]> * update release notes Signed-off-by: Karol Szwaj <[email protected]> * fix gen-check Signed-off-by: Karol Szwaj <[email protected]> * Revert "feat(chart): Allow configuring envoy proxy image via helm chart (#8785)" This reverts commit 092cc67. Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Michael Sommerville <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Michael Sommerville <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: Codex <[email protected]>

mgs255 requested a review from a team as a code owner April 18, 2026 18:03

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

arkodg added this to the v1.8.0-rc.1 Release milestone Apr 19, 2026

mgs255 added 2 commits April 22, 2026 15:15

PR feedback - add test - fix helpers script

2b35ba4

Signed-off-by: Michael Sommerville <[email protected]>

Merge branch 'main' into helm-chart-add-envoy-proxy-image-options

4d91abb

jukie reviewed Apr 23, 2026

View reviewed changes

jukie added the cherrypick/release-v1.7.3 label Apr 23, 2026

jukie mentioned this pull request Apr 24, 2026

fix: apply global image config to proxy pods #8307

Closed

mgs255 added 2 commits April 25, 2026 18:38

pr feedback - add release note

636d3b6

Signed-off-by: Michael Sommerville <[email protected]>

Merge branch 'main' into helm-chart-add-envoy-proxy-image-options

28e6904

arkodg previously approved these changes Apr 26, 2026

View reviewed changes

arkodg requested a review from jukie April 26, 2026 02:51

Merge branch 'main' into helm-chart-add-envoy-proxy-image-options

710575a

mgs255 dismissed arkodg’s stale review via 710575a April 27, 2026 07:10

PR feedback - add envoyProxy to list of applications respecting globa…

151af56

…l registry Signed-off-by: Michael Sommerville <[email protected]>

zhaohuabing approved these changes Apr 27, 2026

View reviewed changes

arkodg merged commit 8570285 into envoyproxy:main Apr 27, 2026
42 of 43 checks passed

cnvergence added a commit to cnvergence/gateway that referenced this pull request May 8, 2026

Revert "feat(chart): Allow configuring envoy proxy image via helm cha…

6bf15d1

…rt (envoyproxy#8785)" This reverts commit 092cc67. Signed-off-by: Karol Szwaj <[email protected]>

lindeskar mentioned this pull request Jun 2, 2026

Helm: Set compatible proxy image in global.images.envoyProxy.image #9144

Open

Uh oh!

Conversation

mgs255 commented Apr 18, 2026

Uh oh!

netlify Bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg commented Apr 19, 2026

Uh oh!

jukie Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jukie commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jukie commented Apr 25, 2026

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

mgs255 commented Apr 27, 2026

Uh oh!

zhaohuabing left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

netlify Bot commented Apr 18, 2026 •

edited

Loading

codecov Bot commented Apr 18, 2026 •

edited

Loading

jukie Apr 23, 2026 •

edited

Loading

jukie commented Apr 23, 2026 •

edited

Loading