Envoy

Cloud-native L7 and L4 proxy. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v1.39.3-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0

Pull:

podman pull oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0

Published 2026-10-11T04:00:46Z80.4 MiB compressed

Usage

TLS certificates come from the in-cluster ClusterIssuer private-ca, bootstrapped by a namespaced SelfSigned Issuer. This batch does not use Let's Encrypt or any external ACME endpoint. Metrics are on in the values below; comments mark the production settings.

Example, not validated on this page until a matching published digest is recorded.

Image pin overlay:

global:
  images:
    envoyProxy:
      image: "oci.thepeoples.io/hardened/envoy:v1.39.3-tpio.1@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0"
# TLS: Gateway/HTTPRoute certs from the in-cluster private CA Issuer. No external ACME.

Production Helm values (metrics on, private CA only where TLS applies):

# Production-oriented Helm values for envoyproxy/gateway-helm v1.9.2.
# This batch hardens only the Envoy proxy data plane
# (global.images.envoyProxy). Control plane and ratelimit stay upstream
# (allowlist not_in_scope_yet). Image pins come from catalog/image-meta.json
# chart_values and the generated values-images overlay.
# TLS: Gateway/HTTPRoute certificates from ClusterIssuer private-ca
# (validate/manifests/private-ca.yaml). No external ACME.
# https://gateway.envoyproxy.io/v1.9/install/install-helm/
# https://gateway.envoyproxy.io/v1.9/tasks/observability/proxy-metric/
# https://www.envoyproxy.io/docs/envoy/v1.39.3/operations/admin#get--stats-prometheus
# https://artifacthub.io/packages/helm/envoy-gateway/gateway-helm

# Data-plane Prometheus scrape is on by default at /stats/prometheus.
# Disable later with an EnvoyProxy CR:
#   spec.telemetry.metrics.prometheus.disable: true
# https://gateway.envoyproxy.io/v1.9/tasks/observability/proxy-metric/#disable-prometheus

global:
  images:
    envoyProxy:
      pullPolicy: IfNotPresent
      # image set by the image-pin overlay:
      # oci.thepeoples.io/hardened/envoy:<tag>@<digest>

config:
  envoyGateway:
    logging:
      level:
        default: info
    # Gateway API telemetry for the managed Envoy fleet.
    # https://gateway.envoyproxy.io/v1.9/tasks/observability/proxy-metric/
    provider:
      type: Kubernetes

deployment:
  replicas: 1 # control plane; not this batch's image
  pod:
    annotations:
      prometheus.io/scrape: "true" # control-plane /metrics on :19001
      prometheus.io/port: "19001"
      prometheus.io/path: "/metrics"
    # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes

In-cluster issuer (SelfSigned bootstrap → ClusterIssuer private-ca):

# In-cluster private CA used by Traefik and Envoy TLS, and by the cert-manager
# Certificate check. A namespaced SelfSigned Issuer bootstraps CA certificate
# private-ca; ClusterIssuer private-ca then signs leaf certificates in any
# namespace (clusterResourceNamespace = cert-manager release namespace).
# No external ACME. Validation evidence must name issuerRef.name: private-ca.
# https://cert-manager.io/docs/configuration/selfsigned/
# https://cert-manager.io/docs/configuration/ca/
# https://cert-manager.io/docs/usage/certificate/
apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-bootstrap
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: private-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: hardened-oci-private-ca
  secretName: private-ca
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-bootstrap
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: private-ca
spec:
  ca:
    secretName: private-ca
---
# Demo leaf for Traefik tlsStore.default.defaultCertificate and Envoy Gateway
# TLS. Issue a copy in the ingress namespace (or reference this Secret) so
# Traefik/Envoy can mount it. issuerRef.name is private-ca.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ingress-tls
  namespace: cert-manager
spec:
  secretName: ingress-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: whoami.hardened.example
  dnsNames:
    - whoami.hardened.example
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: private-ca
    kind: ClusterIssuer
    group: cert-manager.io

helm upgrade --install eg oci://docker.io/envoyproxy/gateway-helm --version v1.9.2 \
  --namespace envoy-gateway-system --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the Gateway proxy. Depends on cert-manager (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/envoy@sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0

Rebuild and licence

Same upstream digest plus an apt dist-upgrade layer (ladder c).

Licence: Apache-2.0.

Envoy is Apache-2.0. Ubuntu base packages keep their own licenses; sources via the Ubuntu archive.

Upstream source