For more information about using this Helm chart, see the Helm installation guide.

KeyTypeDescriptionDefault
affinityobjectSet affinity rules for pod scheduling, such as ’nodeAffinity:'.{}
agentgatewayobjectEnable the integration with Agent Gateway, which lets you use kgateway to help manage agent connectivity across MCP servers, A2A agents, and REST APIs.{"enabled":false}
controllerobjectConfigure the kgateway control plane deployment.{"extraEnv":{},"image":{"pullPolicy":"","registry":"","repository":"gloo-gateway-controller","tag":""},"logLevel":"info","replicaCount":1,"service":{"ports":{"agwGrpc":9978,"grpc":9977,"health":9093,"metrics":9092},"type":"ClusterIP"},"strategy":{},"xds":{"tls":{"enabled":false}}}
controller.extraEnvobjectAdd extra environment variables to the controller container.{}
controller.imageobjectConfigure the controller container image.{"pullPolicy":"","registry":"","repository":"gloo-gateway-controller","tag":""}
controller.image.pullPolicystringSet the image pull policy for the controller.""
controller.image.registrystringSet the image registry for the controller.""
controller.image.repositorystringSet the image repository for the controller."gloo-gateway-controller"
controller.image.tagstringSet the image tag for the controller.""
controller.logLevelstringSet the log level for the controller."info"
controller.replicaCountintSet the number of controller pod replicas.1
controller.serviceobjectConfigure the controller service.{"ports":{"agwGrpc":9978,"grpc":9977,"health":9093,"metrics":9092},"type":"ClusterIP"}
controller.service.portsobjectSet the service ports for gRPC and health endpoints.{"agwGrpc":9978,"grpc":9977,"health":9093,"metrics":9092}
controller.service.typestringSet the service type for the controller."ClusterIP"
controller.strategyobjectChange the rollout strategy from the Kubernetes default of a RollingUpdate with 25% maxUnavailable, 25% maxSurge. E.g., to recreate pods, minimizing resources for the rollout but causing downtime: strategy: type: Recreate E.g., to roll out as a RollingUpdate but with non-default parameters: strategy: type: RollingUpdate rollingUpdate: maxSurge: 100%{}
controller.xdsobjectConfigure TLS settings for the xDS gRPC servers.{"tls":{"enabled":false}}
controller.xds.tls.enabledboolEnable TLS encryption for xDS communication. When enabled, both the main xDS server (port 9977) and agent gateway xDS server (port 9978) will use TLS. When TLS is enabled, you must create a Secret named ‘kgateway-xds-cert’ in the kgateway installation namespace. The Secret must be of type ‘kubernetes.io/tls’ with ’tls.crt’, ’tls.key’, and ‘ca.crt’ data fields present.false
deploymentAnnotationsobjectAdd annotations to the kgateway deployment.{}
discoveryNamespaceSelectorslistList of namespace selectors (OR’ed): each entry can use ‘matchLabels’ or ‘matchExpressions’ (AND’ed within each entry if used together). Kgateway includes the selected namespaces in config discovery. For more information, see the docs https://kgateway.dev/docs/operations/install/#namespace-discovery.[]
fullnameOverridestringOverride the full name of resources created by the Helm chart, which is ‘kgateway’. If you set ‘fullnameOverride: “foo”, the full name of the resources that the Helm release creates become ‘foo’, such as the deployment, service, and service account for the kgateway control plane in the kgateway-system namespace."gloo-gateway"
imageobjectConfigure the default container image for the components that Helm deploys. You can override these settings for each particular component in that component’s section, such as ‘controller.image’ for the kgateway control plane. If you use your own private registry, make sure to include the imagePullSecrets.{"pullPolicy":"IfNotPresent","registry":"us-docker.pkg.dev/developers-369321/gloo-gateway","tag":"2.0.0-local"}
image.pullPolicystringSet the default image pull policy."IfNotPresent"
image.registrystringSet the default image registry."us-docker.pkg.dev/developers-369321/gloo-gateway"
image.tagstringSet the default image tag."2.0.0-local"
imagePullSecretslistSet a list of image pull secrets for Kubernetes to use when pulling container images from your own private registry instead of the default kgateway registry.[]
inferenceExtensionobjectConfigure the integration with the Gateway API Inference Extension project, which lets you use kgateway to route to AI inference workloads like LLMs that run locally in your Kubernetes cluster. Documentation for Inference Extension can be found here: https://kgateway.dev/docs/integrations/inference-extension/{"autoProvision":false,"enabled":false}
inferenceExtension.autoProvisionboolEnable automatic provisioning for Inference Extension. Deprecated: this is deprecated in v2.1 and will be removed in v2.2.false
inferenceExtension.enabledboolEnable Inference Extension. If enabled, agentgateway.enabled should also be set to true. Enabling inference extension without agentgateway is deprecated in v2.1 and will not be supported in v2.2.false
licensing.agentgatewayLicenseKeystringContact Sales if you do not have a Solo Enterprise for agentgateway license key.nil
licensing.createSecretboolIf you use your own Secret, changing the Secret will only take effect when you run ‘kubectl -n gloo-system rollout restart deployment/gloo-gateway’. The Secret should have one or both keys inside of it: ‘agentgateway-license-key’ and ‘gloo-gateway-license-key’.true
licensing.glooGatewayLicenseKeystringContact Sales if you do not have a Gloo Gateway license key.nil
licensing.secretNamestringName of the Secret containing Gloo Gateway and/or Solo Enterprise for agentgateway license keys."gloo-gateway-license-keys"
nameOverridestringAdd a name to the default Helm base release, which is ‘kgateway’. If you set ’nameOverride: “foo”, the name of the resources that the Helm release creates become ‘kgateway-foo’, such as the deployment, service, and service account for the kgateway control plane in the kgateway-system namespace.""
nodeSelectorobjectSet node selector labels for pod scheduling, such as ‘kubernetes.io/arch: amd64’.{}
podAnnotationsobjectAdd annotations to the kgateway pods.{"prometheus.io/scrape":"true"}
podSecurityContextobjectSet the pod-level security context. For example, ‘fsGroup: 2000’ sets the filesystem group to 2000.{}
policyMergeobjectPolicy merging settings. Currently, TrafficPolicy’s extAuth, extProc, and transformation policies support deep merging. E.g., to enable deep merging of extProc policy in TrafficPolicy: policyMerge: trafficPolicy: extProc: DeepMerge{}
resourcesobjectConfigure resource requests and limits for the container, such as ’limits.cpu: 100m’ or ‘requests.memory: 128Mi’.{}
securityContextobjectSet the container-level security context, such as ‘runAsNonRoot: true’.{}
serviceAccountobjectConfigure the service account for the deployment.{"annotations":{},"create":true,"name":""}
serviceAccount.annotationsobjectAdd annotations to the service account.{}
serviceAccount.createboolSpecify whether a service account should be created.true
serviceAccount.namestringSet the name of the service account to use. If not set and create is true, a name is generated using the fullname template.""
tolerationslistSet tolerations for pod scheduling, such as ‘key: “nvidia.com/gpu”’.[]
validationobjectConfigure validation behavior for route and policy safety checks in the control plane. This setting determines how invalid configuration is handled to prevent security bypasses and to maintain multi-tenant isolation.{"level":"standard"}
validation.levelstringValidation level. Accepted values: “standard” or “strict” (case-insensitive). Standard replaces invalid routes with a direct 500 response and continues applying valid configuration. Strict adds xDS preflight validation and blocks snapshots that would NACK in Envoy. Default is “standard”."standard"