apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: "2026-06-09T13:33:29Z" generateName: envoy-gateway-56b969757f- labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway pod-template-hash: 56b969757f name: envoy-gateway-56b969757f-ch6kt namespace: envoy-gateway-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: envoy-gateway-56b969757f uid: 1497880c-5c44-4bdb-aa17-7ac78d9f6545 resourceVersion: "599" uid: 8eb957bf-a4bc-4903-8779-bd4db60bfa12 spec: containers: - args: - server - --config-path=/config/envoy-gateway.yaml env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8081 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 name: grpc protocol: TCP - containerPort: 18001 name: ratelimit protocol: TCP - containerPort: 18002 name: wasm protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8081 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 500m memory: 1Gi requests: cpu: 100m memory: 256Mi securityContext: allowPrivilegeEscalation: false terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /config name: envoy-gateway-config readOnly: true - mountPath: /certs name: certs readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-r5nxg readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-50-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true serviceAccount: envoy-gateway serviceAccountName: envoy-gateway terminationGracePeriodSeconds: 10 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - configMap: defaultMode: 420 name: envoy-gateway-config name: envoy-gateway-config - name: certs secret: defaultMode: 420 secretName: envoy-gateway - name: kube-api-access-r5nxg projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:30Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:29Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:39Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:39Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:29Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://d9c198d258bd84d245924cc91780226687530e17b9181468b1cb0c6bf9b411da image: docker.io/envoyproxy/gateway:v1.1.2 imageID: docker.io/envoyproxy/gateway@sha256:fd0d63e24e814238767687bc2329b908d8a0239bafe39ef542faeeacc6dc7321 lastState: {} name: envoy-gateway ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:33:29Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-09T13:33:29Z" - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/path: /stats/prometheus prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: "2026-06-09T13:33:46Z" generateName: envoy-sample-sample-gw-038a7a21-7789fdf7df- labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample pod-template-hash: 7789fdf7df name: envoy-sample-sample-gw-038a7a21-7789fdf7df-6fcl2 namespace: envoy-gateway-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: envoy-sample-sample-gw-038a7a21-7789fdf7df uid: 9353f318-23ff-45cd-b766-241b0deb23ae resourceVersion: "760" uid: 480b732b-8b11-46cb-a982-4c91e154b1f4 spec: automountServiceAccountToken: false containers: - args: - --service-cluster sample/sample-gw - --service-node $(ENVOY_POD_NAME) - | --config-yaml admin: access_log: - name: envoy.access_loggers.file typed_config: "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog path: /dev/null address: socket_address: address: 127.0.0.1 port_value: 19000 layered_runtime: layers: - name: global_config static_layer: envoy.restart_features.use_eds_cache_for_ads: true re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 dynamic_resources: ads_config: api_type: DELTA_GRPC transport_api_version: V3 grpc_services: - envoy_grpc: cluster_name: xds_cluster set_node_on_first_message_only: true lds_config: ads: {} resource_api_version: V3 cds_config: ads: {} resource_api_version: V3 static_resources: listeners: - name: envoy-gateway-proxy-ready-0.0.0.0-19001 address: socket_address: address: 0.0.0.0 port_value: 19001 protocol: TCP filter_chains: - filters: - name: envoy.filters.network.http_connection_manager typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager stat_prefix: eg-ready-http route_config: name: local_route virtual_hosts: - name: prometheus_stats domains: - "*" routes: - match: prefix: /stats/prometheus route: cluster: prometheus_stats http_filters: - name: envoy.filters.http.health_check typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck pass_through_mode: false headers: - name: ":path" string_match: exact: /ready - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router clusters: - name: prometheus_stats connect_timeout: 0.250s type: STATIC lb_policy: ROUND_ROBIN load_assignment: cluster_name: prometheus_stats endpoints: - lb_endpoints: - endpoint: address: socket_address: address: 127.0.0.1 port_value: 19000 - connect_timeout: 10s load_assignment: cluster_name: xds_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18000 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: connection_keepalive: interval: 30s timeout: 5s name: xds_cluster type: STRICT_DNS transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 - name: wasm_cluster type: STRICT_DNS connect_timeout: 10s load_assignment: cluster_name: wasm_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18002 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: {} transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 overload_manager: refresh_interval: 0.25s resource_monitors: - name: "envoy.resource_monitors.global_downstream_max_connections" typed_config: "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig max_active_downstream_connections: 50000 - --log-level warn - --cpuset-threads - --drain-strategy immediate command: - envoy env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: envoyproxy/envoy:distroless-v1.31.2 imagePullPolicy: IfNotPresent lifecycle: preStop: httpGet: path: /shutdown/ready port: 19002 scheme: HTTP name: envoy ports: - containerPort: 10080 name: http-80 protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 1 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 512Mi startupProbe: failureThreshold: 30 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: certs readOnly: true - mountPath: /sds name: sds - args: - envoy - shutdown-manager command: - envoy-gateway env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - envoy-gateway - envoy - shutdown livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: shutdown-manager readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 32Mi startupProbe: failureThreshold: 30 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-50-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: envoy-sample-sample-gw-038a7a21 serviceAccountName: envoy-sample-sample-gw-038a7a21 terminationGracePeriodSeconds: 900 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: certs secret: defaultMode: 420 secretName: envoy - configMap: defaultMode: 420 items: - key: xds-trusted-ca.json path: xds-trusted-ca.json - key: xds-certificate.json path: xds-certificate.json name: envoy-sample-sample-gw-038a7a21 optional: false name: sds status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:49Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:46Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:57Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:57Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:33:46Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://642736260eef08ffb20a8475a2f546ad0c53e60772f2d2e6132915d08db11a32 image: docker.io/envoyproxy/envoy:distroless-v1.31.2 imageID: docker.io/envoyproxy/envoy@sha256:2e7924c371e5e038ac71aa3a270004b41c4dfd5431851c05b0b9e025ab2ba1b7 lastState: {} name: envoy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:33:48Z" - containerID: containerd://b5368fc04525d27242bb02abb87fad168147b0f85e251496aaa9ed82178840ac image: docker.io/envoyproxy/gateway:v1.1.2 imageID: docker.io/envoyproxy/gateway@sha256:fd0d63e24e814238767687bc2329b908d8a0239bafe39ef542faeeacc6dc7321 lastState: {} name: shutdown-manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:33:49Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.9 podIPs: - ip: 10.244.0.9 qosClass: Burstable startTime: "2026-06-09T13:33:46Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: envoy-gateway meta.helm.sh/release-namespace: envoy-gateway-system creationTimestamp: "2026-06-09T13:33:29Z" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm app.kubernetes.io/version: v1.1.2 control-plane: envoy-gateway helm.sh/chart: gateway-helm-v1.1.2 name: envoy-gateway namespace: envoy-gateway-system resourceVersion: "556" uid: ba8d14c7-fcce-46f0-a27c-77f3e43b2beb spec: clusterIP: 10.96.76.95 clusterIPs: - 10.96.76.95 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 18000 protocol: TCP targetPort: 18000 - name: ratelimit port: 18001 protocol: TCP targetPort: 18001 - name: wasm port: 18002 protocol: TCP targetPort: 18002 - name: metrics port: 19001 protocol: TCP targetPort: 19001 selector: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: creationTimestamp: "2026-06-09T13:33:46Z" labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample name: envoy-sample-sample-gw-038a7a21 namespace: envoy-gateway-system resourceVersion: "707" uid: 825cf29e-bac8-4651-9729-08c99bb4a0fc spec: allocateLoadBalancerNodePorts: true clusterIP: 10.96.10.230 clusterIPs: - 10.96.10.230 externalTrafficPolicy: Local healthCheckNodePort: 32395 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: http-80 nodePort: 31820 port: 80 protocol: TCP targetPort: 10080 selector: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample sessionAffinity: None type: LoadBalancer status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: envoy-gateway meta.helm.sh/release-namespace: envoy-gateway-system creationTimestamp: "2026-06-09T13:33:29Z" generation: 1 labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm app.kubernetes.io/version: v1.1.2 control-plane: envoy-gateway helm.sh/chart: gateway-helm-v1.1.2 name: envoy-gateway namespace: envoy-gateway-system resourceVersion: "603" uid: 50bb59fb-af2a-452f-b859-96be602d7208 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: null labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway spec: containers: - args: - server - --config-path=/config/envoy-gateway.yaml env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8081 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 name: grpc protocol: TCP - containerPort: 18001 name: ratelimit protocol: TCP - containerPort: 18002 name: wasm protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8081 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 500m memory: 1Gi requests: cpu: 100m memory: 256Mi securityContext: allowPrivilegeEscalation: false terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /config name: envoy-gateway-config readOnly: true - mountPath: /certs name: certs readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true serviceAccount: envoy-gateway serviceAccountName: envoy-gateway terminationGracePeriodSeconds: 10 volumes: - configMap: defaultMode: 420 name: envoy-gateway-config name: envoy-gateway-config - name: certs secret: defaultMode: 420 secretName: envoy-gateway status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:33:39Z" lastUpdateTime: "2026-06-09T13:33:39Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:33:29Z" lastUpdateTime: "2026-06-09T13:33:39Z" message: ReplicaSet "envoy-gateway-56b969757f" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" creationTimestamp: "2026-06-09T13:33:46Z" generation: 1 labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample name: envoy-sample-sample-gw-038a7a21 namespace: envoy-gateway-system resourceVersion: "764" uid: 14404858-b340-421c-a0c9-37afeb93f7fb spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: prometheus.io/path: /stats/prometheus prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: null labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample spec: automountServiceAccountToken: false containers: - args: - --service-cluster sample/sample-gw - --service-node $(ENVOY_POD_NAME) - | --config-yaml admin: access_log: - name: envoy.access_loggers.file typed_config: "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog path: /dev/null address: socket_address: address: 127.0.0.1 port_value: 19000 layered_runtime: layers: - name: global_config static_layer: envoy.restart_features.use_eds_cache_for_ads: true re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 dynamic_resources: ads_config: api_type: DELTA_GRPC transport_api_version: V3 grpc_services: - envoy_grpc: cluster_name: xds_cluster set_node_on_first_message_only: true lds_config: ads: {} resource_api_version: V3 cds_config: ads: {} resource_api_version: V3 static_resources: listeners: - name: envoy-gateway-proxy-ready-0.0.0.0-19001 address: socket_address: address: 0.0.0.0 port_value: 19001 protocol: TCP filter_chains: - filters: - name: envoy.filters.network.http_connection_manager typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager stat_prefix: eg-ready-http route_config: name: local_route virtual_hosts: - name: prometheus_stats domains: - "*" routes: - match: prefix: /stats/prometheus route: cluster: prometheus_stats http_filters: - name: envoy.filters.http.health_check typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck pass_through_mode: false headers: - name: ":path" string_match: exact: /ready - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router clusters: - name: prometheus_stats connect_timeout: 0.250s type: STATIC lb_policy: ROUND_ROBIN load_assignment: cluster_name: prometheus_stats endpoints: - lb_endpoints: - endpoint: address: socket_address: address: 127.0.0.1 port_value: 19000 - connect_timeout: 10s load_assignment: cluster_name: xds_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18000 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: connection_keepalive: interval: 30s timeout: 5s name: xds_cluster type: STRICT_DNS transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 - name: wasm_cluster type: STRICT_DNS connect_timeout: 10s load_assignment: cluster_name: wasm_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18002 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: {} transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 overload_manager: refresh_interval: 0.25s resource_monitors: - name: "envoy.resource_monitors.global_downstream_max_connections" typed_config: "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig max_active_downstream_connections: 50000 - --log-level warn - --cpuset-threads - --drain-strategy immediate command: - envoy env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: envoyproxy/envoy:distroless-v1.31.2 imagePullPolicy: IfNotPresent lifecycle: preStop: httpGet: path: /shutdown/ready port: 19002 scheme: HTTP name: envoy ports: - containerPort: 10080 name: http-80 protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 1 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 512Mi startupProbe: failureThreshold: 30 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: certs readOnly: true - mountPath: /sds name: sds - args: - envoy - shutdown-manager command: - envoy-gateway env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - envoy-gateway - envoy - shutdown livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: shutdown-manager readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 32Mi startupProbe: failureThreshold: 30 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: envoy-sample-sample-gw-038a7a21 serviceAccountName: envoy-sample-sample-gw-038a7a21 terminationGracePeriodSeconds: 900 volumes: - name: certs secret: defaultMode: 420 secretName: envoy - configMap: defaultMode: 420 items: - key: xds-trusted-ca.json path: xds-trusted-ca.json - key: xds-certificate.json path: xds-certificate.json name: envoy-sample-sample-gw-038a7a21 optional: false name: sds status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:33:57Z" lastUpdateTime: "2026-06-09T13:33:57Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:33:46Z" lastUpdateTime: "2026-06-09T13:33:57Z" message: ReplicaSet "envoy-sample-sample-gw-038a7a21-7789fdf7df" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: envoy-gateway meta.helm.sh/release-namespace: envoy-gateway-system creationTimestamp: "2026-06-09T13:33:29Z" generation: 1 labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway pod-template-hash: 56b969757f name: envoy-gateway-56b969757f namespace: envoy-gateway-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: envoy-gateway uid: 50bb59fb-af2a-452f-b859-96be602d7208 resourceVersion: "602" uid: 1497880c-5c44-4bdb-aa17-7ac78d9f6545 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway pod-template-hash: 56b969757f template: metadata: annotations: prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: null labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway pod-template-hash: 56b969757f spec: containers: - args: - server - --config-path=/config/envoy-gateway.yaml env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8081 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 1 name: envoy-gateway ports: - containerPort: 18000 name: grpc protocol: TCP - containerPort: 18001 name: ratelimit protocol: TCP - containerPort: 18002 name: wasm protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8081 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 500m memory: 1Gi requests: cpu: 100m memory: 256Mi securityContext: allowPrivilegeEscalation: false terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /config name: envoy-gateway-config readOnly: true - mountPath: /certs name: certs readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true serviceAccount: envoy-gateway serviceAccountName: envoy-gateway terminationGracePeriodSeconds: 10 volumes: - configMap: defaultMode: 420 name: envoy-gateway-config name: envoy-gateway-config - name: certs secret: defaultMode: 420 secretName: envoy-gateway status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" creationTimestamp: "2026-06-09T13:33:46Z" generation: 1 labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample pod-template-hash: 7789fdf7df name: envoy-sample-sample-gw-038a7a21-7789fdf7df namespace: envoy-gateway-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: envoy-sample-sample-gw-038a7a21 uid: 14404858-b340-421c-a0c9-37afeb93f7fb resourceVersion: "763" uid: 9353f318-23ff-45cd-b766-241b0deb23ae spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample pod-template-hash: 7789fdf7df template: metadata: annotations: prometheus.io/path: /stats/prometheus prometheus.io/port: "19001" prometheus.io/scrape: "true" creationTimestamp: null labels: app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway app.kubernetes.io/name: envoy gateway.envoyproxy.io/owning-gateway-name: sample-gw gateway.envoyproxy.io/owning-gateway-namespace: sample pod-template-hash: 7789fdf7df spec: automountServiceAccountToken: false containers: - args: - --service-cluster sample/sample-gw - --service-node $(ENVOY_POD_NAME) - | --config-yaml admin: access_log: - name: envoy.access_loggers.file typed_config: "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog path: /dev/null address: socket_address: address: 127.0.0.1 port_value: 19000 layered_runtime: layers: - name: global_config static_layer: envoy.restart_features.use_eds_cache_for_ads: true re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 dynamic_resources: ads_config: api_type: DELTA_GRPC transport_api_version: V3 grpc_services: - envoy_grpc: cluster_name: xds_cluster set_node_on_first_message_only: true lds_config: ads: {} resource_api_version: V3 cds_config: ads: {} resource_api_version: V3 static_resources: listeners: - name: envoy-gateway-proxy-ready-0.0.0.0-19001 address: socket_address: address: 0.0.0.0 port_value: 19001 protocol: TCP filter_chains: - filters: - name: envoy.filters.network.http_connection_manager typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager stat_prefix: eg-ready-http route_config: name: local_route virtual_hosts: - name: prometheus_stats domains: - "*" routes: - match: prefix: /stats/prometheus route: cluster: prometheus_stats http_filters: - name: envoy.filters.http.health_check typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck pass_through_mode: false headers: - name: ":path" string_match: exact: /ready - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router clusters: - name: prometheus_stats connect_timeout: 0.250s type: STATIC lb_policy: ROUND_ROBIN load_assignment: cluster_name: prometheus_stats endpoints: - lb_endpoints: - endpoint: address: socket_address: address: 127.0.0.1 port_value: 19000 - connect_timeout: 10s load_assignment: cluster_name: xds_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18000 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: connection_keepalive: interval: 30s timeout: 5s name: xds_cluster type: STRICT_DNS transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 - name: wasm_cluster type: STRICT_DNS connect_timeout: 10s load_assignment: cluster_name: wasm_cluster endpoints: - load_balancing_weight: 1 lb_endpoints: - load_balancing_weight: 1 endpoint: address: socket_address: address: envoy-gateway port_value: 18002 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" explicit_http_config: http2_protocol_options: {} transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext common_tls_context: tls_params: tls_maximum_protocol_version: TLSv1_3 tls_certificate_sds_secret_configs: - name: xds_certificate sds_config: path_config_source: path: "/sds/xds-certificate.json" resource_api_version: V3 validation_context_sds_secret_config: name: xds_trusted_ca sds_config: path_config_source: path: "/sds/xds-trusted-ca.json" resource_api_version: V3 overload_manager: refresh_interval: 0.25s resource_monitors: - name: "envoy.resource_monitors.global_downstream_max_connections" typed_config: "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig max_active_downstream_connections: 50000 - --log-level warn - --cpuset-threads - --drain-strategy immediate command: - envoy env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: envoyproxy/envoy:distroless-v1.31.2 imagePullPolicy: IfNotPresent lifecycle: preStop: httpGet: path: /shutdown/ready port: 19002 scheme: HTTP name: envoy ports: - containerPort: 10080 name: http-80 protocol: TCP - containerPort: 19001 name: metrics protocol: TCP readinessProbe: failureThreshold: 1 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 512Mi startupProbe: failureThreshold: 30 httpGet: path: /ready port: 19001 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: certs readOnly: true - mountPath: /sds name: sds - args: - envoy - shutdown-manager command: - envoy-gateway env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: ENVOY_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name image: docker.io/envoyproxy/gateway:v1.1.2 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - envoy-gateway - envoy - shutdown livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: shutdown-manager readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 32Mi startupProbe: failureThreshold: 30 httpGet: path: /healthz port: 19002 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: envoy-sample-sample-gw-038a7a21 serviceAccountName: envoy-sample-sample-gw-038a7a21 terminationGracePeriodSeconds: 900 volumes: - name: certs secret: defaultMode: 420 secretName: envoy - configMap: defaultMode: 420 items: - key: xds-trusted-ca.json path: xds-trusted-ca.json - key: xds-certificate.json path: xds-certificate.json name: envoy-sample-sample-gw-038a7a21 optional: false name: sds status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 kind: List metadata: resourceVersion: ""