feat: add global image settings for all images in the EG chart

charts/gateway-helm/templates/_helpers.tpl

@@ -60,3 +60,56 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+The name of the Envoy Gateway image.
+*/}}
+{{- define "eg.image" -}}
+{{- if .Values.deployment.envoyGateway.image.repository }}
+{{- .Values.deployment.envoyGateway.image.repository }}:{{ .Values.deployment.envoyGateway.image.tag | default .Values.global.images.envoyGateway.tag | default .Chart.AppVersion }}
+{{- else if .Values.global.images.envoyGateway.image }}
+{{- .Values.global.images.envoyGateway.image }}
+{{- else }}
+docker.io/envoyproxy/gateway:{{ .Chart.Version }}
+{{- end }}
+{{- end }}
+
+{{/*
+Pull policy for the Envoy Gateway image.
+*/}}
+{{- define "eg.image.pullPolicy" -}}
+{{ .Values.deployment.envoyGateway.imagePullPolicy | default .Values.global.images.envoyGateway.pullPolicy | default "IfNotPresent" }}
+{{- end }}
+
+{{/*
+Pull secrets for the Envoy Gateway image.
+*/}}
+{{- define "eg.image.pullSecrets" -}}
+{{- if .Values.deployment.envoyGateway.imagePullSecrets -}}
+imagePullSecrets:
+{{ toYaml .Values.deployment.envoyGateway.imagePullSecrets }}
+{{- else if .Values.global.images.envoyGateway.imagePullSecrets -}}
+imagePullSecrets:
+{{ toYaml .Values.global.images.envoyGateway.imagePullSecrets }}
+{{- else -}}
+imagePullSecrets: []
+{{- end }}
+{{- end }}
+
+{{/*
+The default Envoy Gateway configuration.
+*/}}
+{{- define "eg.default-envoy-gateway-config" -}}
+provider:
+  type: Kubernetes
+  kubernetes:
+    rateLimitDeployment:
+      container:
+        {{- if .Values.global.images.ratelimit.image }}
+        image: {{ .Values.global.images.ratelimit.image }}
+        {{- else }}
+        image: "docker.io/envoyproxy/ratelimit:master"
+        {{- end }}
+    shutdownManager:
+      image: {{ include "eg.image" . }}
+{{- end }}

charts/gateway-helm/templates/certgen.yaml

@@ -31,17 +31,14 @@ spec:
               fieldPath: metadata.namespace
         - name: KUBERNETES_CLUSTER_DOMAIN
           value: {{ .Values.kubernetesClusterDomain }}
-        image: {{ .Values.deployment.envoyGateway.image.repository }}:{{ .Values.deployment.envoyGateway.image.tag | default .Chart.AppVersion }}
-        imagePullPolicy: {{ .Values.deployment.envoyGateway.imagePullPolicy }}
+        image: {{ include "eg.image" . }}
+        imagePullPolicy: {{ include "eg.image.pullPolicy" . }}
         name: envoy-gateway-certgen
         {{- with .Values.certgen.job.resources }}
         resources:
           {{- toYaml . | nindent 10 }}
         {{- end }}
-      {{- with .Values.deployment.envoyGateway.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "eg.image.pullSecrets" . | nindent 6 }}
       restartPolicy: Never
       securityContext:
         runAsGroup: 65534

charts/gateway-helm/templates/envoy-gateway-config.yaml

@@ -9,4 +9,7 @@ data:
   envoy-gateway.yaml: |
     apiVersion: gateway.envoyproxy.io/v1alpha1
     kind: EnvoyGateway
-    {{- toYaml .Values.config.envoyGateway | nindent 4 }}
+    {{- $baseEnvoyGatewayConfig := include "eg.default-envoy-gateway-config" . | fromYaml }}
+    {{- $userEnvoyGatewayConfig := .Values.config.envoyGateway }}
+    {{- $mergedEnvoyGatewayConfig := merge $userEnvoyGatewayConfig $baseEnvoyGatewayConfig }}
+    {{- toYaml $mergedEnvoyGatewayConfig | nindent 4 }}

charts/gateway-helm/templates/envoy-gateway-deployment.yaml

@@ -49,8 +49,8 @@ spec:
               fieldPath: metadata.namespace
         - name: KUBERNETES_CLUSTER_DOMAIN
           value: {{ .Values.kubernetesClusterDomain }}
-        image: {{ .Values.deployment.envoyGateway.image.repository }}:{{ .Values.deployment.envoyGateway.image.tag | default .Chart.AppVersion }}
-        imagePullPolicy: {{ .Values.deployment.envoyGateway.imagePullPolicy }}
+        image: {{ include "eg.image" . }}
+        imagePullPolicy: {{ include "eg.image.pullPolicy" . }}
         livenessProbe:
           httpGet:
             path: /healthz
@@ -80,10 +80,7 @@ spec:
         - mountPath: /certs
           name: certs
           readOnly: true
-      {{- with .Values.deployment.envoyGateway.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "eg.image.pullSecrets" . | nindent 6 }}
       securityContext:
         runAsNonRoot: true
       serviceAccountName: envoy-gateway

charts/gateway-helm/values.tmpl.yaml

@@ -1,9 +1,32 @@
+# The global settings for the Envoy Gateway Helm chart.
+# These values will be used if the values are not overridden in the other sections.
+global:
+  images:
+    envoyGateway:
+      # This is the full image name including the hub, repo, and tag.
+      image: ${GatewayImage}
+      # Specify image pull policy if default behavior isn't desired.
+      # Default behavior: latest images will be Always else IfNotPresent.
+      pullPolicy: ${GatewayImagePullPolicy}
+      # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
+      imagePullSecrets: []
+    ratelimit:
+      # This is the full image name including the hub, repo, and tag.
+      image: "docker.io/envoyproxy/ratelimit:master"
+      # TODO: zhaohuabing add support for imagePullSecrets for ratelimit
+      # Specify image pull policy if default behavior isn't desired.
+      # Default behavior: latest images will be Always else IfNotPresent.
+      # pullPolicy: IfNotPresent
+      # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
+      # imagePullSecrets: []
+    # statsd: TODO: zhaohuabing add custom image support for statsd image
+
 deployment:
   envoyGateway:
     image:
-      repository: ${ImageRepository}
-      tag: '${ImageTag}'
-    imagePullPolicy: ${ImagePullPolicy}
+      repository: ""
+      tag: ""
+    imagePullPolicy: ""
     imagePullSecrets: []
     resources:
       limits:
@@ -36,9 +59,6 @@ config:
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
     provider:
       type: Kubernetes
-      kubernetes:
-        shutdownManager:
-          image: ${ImageRepository}:${ImageTag}
     logging:
       level:
         default: info

site/content/en/latest/install/api.md

@@ -31,12 +31,11 @@ The Helm chart for Envoy Gateway
 | certgen.rbac.labels | object | `{}` |  |
 | config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` |  |
 | config.envoyGateway.logging.level.default | string | `"info"` |  |
-| config.envoyGateway.provider.kubernetes.shutdownManager.image | string | `"docker.io/envoyproxy/gateway:latest"` |  |
 | config.envoyGateway.provider.type | string | `"Kubernetes"` |  |
 | createNamespace | bool | `false` |  |
-| deployment.envoyGateway.image.repository | string | `"docker.io/envoyproxy/gateway"` |  |
-| deployment.envoyGateway.image.tag | string | `"latest"` |  |
-| deployment.envoyGateway.imagePullPolicy | string | `"IfNotPresent"` |  |
+| deployment.envoyGateway.image.repository | string | `""` |  |
+| deployment.envoyGateway.image.tag | string | `""` |  |
+| deployment.envoyGateway.imagePullPolicy | string | `""` |  |
 | deployment.envoyGateway.imagePullSecrets | list | `[]` |  |
 | deployment.envoyGateway.resources.limits.cpu | string | `"500m"` |  |
 | deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` |  |
@@ -56,5 +55,9 @@ The Helm chart for Envoy Gateway
 | deployment.ports[2].port | int | `19001` |  |
 | deployment.ports[2].targetPort | int | `19001` |  |
 | deployment.replicas | int | `1` |  |
+| global.images.envoyGateway.image | string | `nil` |  |
+| global.images.envoyGateway.imagePullSecrets | list | `[]` |  |
+| global.images.envoyGateway.pullPolicy | string | `nil` |  |
+| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` |  |
 | kubernetesClusterDomain | string | `"cluster.local"` |  |
 

test/helm/default-config.in.yaml

@@ -0,0 +1,5 @@
+global:
+  images:
+    envoyGateway:
+      image: "docker.io/envoyproxy/gateway-dev:latest"
+      pullPolicy: Always

test/helm/default.yaml → test/helm/default-config.out.yaml

@@ -35,6 +35,9 @@ data:
         default: info
     provider:
       kubernetes:
+        rateLimitDeployment:
+          container:
+            image: docker.io/envoyproxy/ratelimit:master
         shutdownManager:
           image: docker.io/envoyproxy/gateway-dev:latest
       type: Kubernetes
@@ -372,7 +375,7 @@ spec:
         - name: KUBERNETES_CLUSTER_DOMAIN
           value: cluster.local
         image: docker.io/envoyproxy/gateway-dev:latest
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         livenessProbe:
           httpGet:
             path: /healthz
@@ -409,6 +412,7 @@ spec:
         - mountPath: /certs
           name: certs
           readOnly: true
+      imagePullSecrets: []
       securityContext:
         runAsNonRoot: true
       serviceAccountName: envoy-gateway
@@ -520,8 +524,9 @@ spec:
         - name: KUBERNETES_CLUSTER_DOMAIN
           value: cluster.local
         image: docker.io/envoyproxy/gateway-dev:latest
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         name: envoy-gateway-certgen
+      imagePullSecrets: []
       restartPolicy: Never
       securityContext:
         runAsGroup: 65534

test/helm/deployment-images-config.in.yaml

@@ -0,0 +1,11 @@
+# The image in the deployment is replaced with the image from the global configuration.
+# It's retained for backwards compatibility.
+deployment:
+  envoyGateway:
+    image:
+      repository: private-hub/envoyproxy/gateway
+      tag: abcdef12
+    imagePullPolicy: IfNotPresent
+    imagePullSecrets:
+    - name: "secret1"
+    - name: "secret2"