Skip to content

fix(helm): apply global.imagePullSecrets to Envoy Proxy deployments #7657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blacksd wants to merge 2 commits into
base: main
Choose a base branch
from
+7 −0
Open

fix(helm): apply global.imagePullSecrets to Envoy Proxy deployments #7657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd39b4c
feat: add imagePullSecrets to the Envoy Deployment
blacksd Dec 4, 2025
8171812
docs: add release note for imagePullSecrets fix
blacksd Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions charts/gateway-helm/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,12 @@ The default Envoy Gateway configuration.
provider:
type: Kubernetes
kubernetes:
{{- if .Values.global.imagePullSecrets }}
envoyDeployment:
pod:
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 10 }}
{{- end }}
Comment on lines +159 to +164
Copy link
Contributor

@jukie jukie Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure these get mapped to the EnvoyGateway CRD and configmap which doesn't support these fields - https://gateway.envoyproxy.io/docs/api/extension_types/#envoygatewaykubernetesprovider

Copy link
Contributor

@jukie jukie Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The image pull secrets defined in the helm chart get applied to the envoy-gateway controller deployment but this helm chart doesn't manage EnvoyProxy resources which is what you appear to be trying to inject into.

Copy link
Contributor

@jukie jukie Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some options:

  • Add the concept of a global EnvoyProxy as a field within kubernetesprovider and then the controller would default to this instead of empty. It would then follow an inheritance chain like other resources and values from separate EnvoyProxy resources would override
  • If your only concern is imagePullSecrets, perhaps a new global field could be added under kubernetesprovider which then gets checked by the relevant resources during provisioning (rate limit, envoyproxy, etc)

Copy link
Member

@zirain zirain Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this won't be worked before #4764.

Copy link
Author

@blacksd blacksd Dec 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My immediately following concern would have been to address the distroless image that's not overridden with the global image selection.
Thanks for referencing the other issue; perhaps I can help moving that forward.

rateLimitDeployment:
container:
image: {{ include "eg.ratelimit.image" . }}
Expand Down
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ new features: |
bug fixes: |
Fixed configured OIDC authorization endpoint being overridden by discovered endpoints from issuer's well-known URL.
Fix 500 errors caused by partially invalid BackendRefs; traffic is now correctly routed between valid backends and 500 responses according to their configured weights.
Fixed Helm chart not applying global.imagePullSecrets to dynamically created Envoy Proxy deployments.

# Enhancements that improve performance.
performance improvements: |
Expand Down
Loading