Tetrate Enterprise Gateway for Envoy (TEG) editions

Starting with TEG 1.9.0, TEG is published in three editions. All three are built from the same source, ship the same Helm chart, expose the same APIs and CRDs, and are configured identically. They differ in where the images are published, whether they come with Tetrate support, whether the phone-home client reports by default, and — for the FIPS edition — which cryptographic libraries the binaries are built against.

	Community	Enterprise	Enterprise FIPS
Control-plane images (TEG and Envoy Gateway)	docker.io/tetrate/teg-envoy-gateway docker.io/envoyproxy/gateway	tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway tetrate-envoy-gateway.containers.dl.tetrate.io/gateway	fips-containers.teg.tetratelabs.com/teg-envoy-gateway fips-containers.teg.tetratelabs.com/gateway
Data-plane Envoy image	docker.io/tetrate/teg-envoy	tetrate-envoy-gateway.containers.dl.tetrate.io/envoy	fips-containers.teg.tetratelabs.com/envoy
Rate limit image	docker.io/envoyproxy/ratelimit	tetrate-envoy-gateway.containers.dl.tetrate.io/ratelimit	fips-containers.teg.tetratelabs.com/ratelimit
Registry credentials	Not required	Required	Required
Tetrate support	None — community support only	Included with a TEG Subscription	Included with a TEG Subscription
Phone home	Always on, cannot be disabled	Off by default, opt-in	Off by default, opt-in
FIPS-validated cryptography	No	No	Yes
WAF (ExtendedSecurityPolicy)	Bundled in the data-plane image	Bundled in the data-plane image	Bundled in the data-plane image (FIPS WAF module)
Platforms	linux/amd64, linux/arm64	linux/amd64, linux/arm64	Control plane linux/amd64; data plane linux/amd64, linux/arm64
Helm chart	oci://docker.io/tetrate/teg-envoy-gateway-helm	oci://docker.io/tetrate/teg-envoy-gateway-helm	oci://docker.io/tetrate/teg-envoy-gateway-helm

The Helm chart is published publicly for every edition. You select an edition by pointing the chart at that edition's images — there is no separate chart to install.

info

The enterprise and enterprise FIPS images are hosted in credentialed Tetrate registries and are available to TEG Subscription customers, along with Tetrate support. Contact your Tetrate representative for a username and password.

Which edition should I use?

• Community — evaluation, development, and any deployment that does not need Tetrate support and where reporting instance status to Tetrate is acceptable. This is the default the chart installs, and it needs no credentials. It comes with no Tetrate support — join us in the #teg channel on the Tetrate Community Slack.
• Enterprise — production deployments under a TEG Subscription, which includes Tetrate support, and which must not report to Tetrate unless explicitly enabled.
• Enterprise FIPS — subscription deployments that must use FIPS 140-2 validated cryptography. See the enterprise FIPS tab under Install a specific edition.

The Web Application Firewall is available in every edition: the composer dynamic module that implements it is baked into every published data-plane Envoy image, so ExtendedSecurityPolicy works without any image customization. The FIPS data-plane image bundles the FIPS build of that module, for which a few Coraza directives are unavailable — see Web Application Firewall.

Phone home

The phone-home client periodically reports the status of your TEG instance to Tetrate. Tetrate uses these reports to detect which versions are running in the field, so customers can be notified about CVEs and available updates that affect them.

Each report contains:

• the product identifier (teg);
• a cluster identifier — the UID of the cluster's kube-system namespace;
• an instance identifier — the UID of the namespace TEG is installed in;
• the installed TEG version and the version of each reported component.

No traffic data, no configuration, no Gateway API resources, and no client or workload identities are collected. Reports are sent once per hour over TLS to phone-home.tetrate.io:443, and a failed report is logged and discarded — it never affects the control plane or the data plane.

Whether the client runs depends on the edition:

• In the community edition, phone home is always on and cannot be disabled at runtime. The phoneHome.enabled Helm value has no effect on it.
• In the enterprise and enterprise FIPS editions, phone home is off by default and is enabled by setting phoneHome.enabled=true in your Helm values.

Install a specific edition

Community

The community edition is what the chart installs by default, so no image overrides are needed. Follow the Quickstart Guide.

Enterprise

The enterprise edition publishes the control plane, the Envoy Gateway controller, the data-plane Envoy image, and the rate limit service to the credentialed Tetrate registry, so point all four at it: use tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway for the control plane, tetrate-envoy-gateway.containers.dl.tetrate.io/gateway for Envoy Gateway, tetrate-envoy-gateway.containers.dl.tetrate.io/envoy for the data plane, and tetrate-envoy-gateway.containers.dl.tetrate.io/ratelimit for the rate limit service. Enterprise images may carry Tetrate fixes that the public community images do not.

Create a pull secret with the credentials provided by Tetrate:

export TEG_USER="<teg-username>"
export TEG_PASS="<teg-password>"

kubectl create namespace envoy-gateway-system

kubectl create secret docker-registry teg-enterprise-creds \
  --docker-server="tetrate-envoy-gateway.containers.dl.tetrate.io" \
  --docker-username=${TEG_USER} \
  --docker-password=${TEG_PASS} \
  --docker-email="${USER}@" \
  -n envoy-gateway-system

Create a values.yaml file that points the control plane, the data plane, the Envoy Gateway controller, and the rate limit service at the enterprise images:

deployment:
tegEnvoyGateway:
  image:
    repository: tetrate-envoy-gateway.containers.dl.tetrate.io/teg-envoy-gateway
    tag: v1.9.3
    pullSecrets:
      - name: teg-enterprise-creds
config:
envoyProxy:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        container:
          image: "tetrate-envoy-gateway.containers.dl.tetrate.io/envoy:distroless-v1.9.3"
        pod:
          imagePullSecrets:
            - name: teg-enterprise-creds
gateway-helm:
global:
  images:
    envoyGateway:
      image: "tetrate-envoy-gateway.containers.dl.tetrate.io/gateway:v1.9.3-tetrate"
      pullSecrets:
        - name: teg-enterprise-creds
    ratelimit:
      image: "tetrate-envoy-gateway.containers.dl.tetrate.io/ratelimit:v2026.10.28.0"
      pullSecrets:
        - name: teg-enterprise-creds
# Phone home is off by default in the enterprise edition. Set this to true to opt in.
phoneHome:
enabled: false

The enterprise data-plane image bundles the same dynamic modules as the public one, so the WAF keeps working out of the box.

Install the chart with those values:

helm install teg oci://docker.io/tetrate/teg-envoy-gateway-helm \
  --version v1.9.3 \
  --values values.yaml \
  -n envoy-gateway-system

Upgrading from a release before TEG 1.9.3

As of TEG 1.9.3, the Tetrate Rate Limit image is no longer published to docker.io/tetrate/ratelimit. If your values file pulls it from there, point it at tetrate-envoy-gateway.containers.dl.tetrate.io/ratelimit and add the pull secret as shown above.

Enterprise FIPS

The enterprise FIPS edition pulls every image — control plane, Envoy Gateway, data-plane Envoy, and the rate limit service — from the credentialed Tetrate FIPS registry, fips-containers.teg.tetratelabs.com. The images include the same Tetrate fixes as the enterprise edition and are FIPS certified. The FIPS control-plane images are built for linux/amd64 only; the data-plane Envoy image is available for linux/amd64 and linux/arm64.

Create a pull secret with the FIPS registry credentials provided by Tetrate:

export TEG_USER="<teg-username>"
export TEG_PASS="<teg-password>"

kubectl create namespace envoy-gateway-system

kubectl create secret docker-registry tetrate-fips-creds \
  --docker-server="fips-containers.teg.tetratelabs.com" \
  --docker-username=${TEG_USER} \
  --docker-password=${TEG_PASS} \
  --docker-email="${USER}@" \
  -n envoy-gateway-system

Create a values.yaml file that points the control plane, the data plane, the Envoy Gateway controller, and the rate limit service at the FIPS images:

deployment:
tegEnvoyGateway:
  image:
    repository: fips-containers.teg.tetratelabs.com/teg-envoy-gateway
    tag: v1.9.3
    pullSecrets:
      - name: tetrate-fips-creds
config:
envoyProxy:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        container:
          image: "fips-containers.teg.tetratelabs.com/envoy:distroless-v1.9.3"
        pod:
          imagePullSecrets:
            - name: tetrate-fips-creds
gateway-helm:
global:
  images:
    envoyGateway:
      image: "fips-containers.teg.tetratelabs.com/gateway:v1.9.3-tetrate"
      pullSecrets:
        - name: tetrate-fips-creds
    ratelimit:
      image: "fips-containers.teg.tetratelabs.com/ratelimit:v2026.10.28.0"
      pullSecrets:
        - name: tetrate-fips-creds
# Phone home is off by default in the enterprise FIPS edition. Set this to true to opt in.
phoneHome:
enabled: false

Install the chart with those values:

helm install teg oci://docker.io/tetrate/teg-envoy-gateway-helm \
  --version v1.9.3 \
  --values values.yaml \
  -n envoy-gateway-system

Upgrading from a release before TEG 1.9.0

As of TEG 1.9.0, every FIPS image is published to and consumed from fips-containers.teg.tetratelabs.com. The FIPS data-plane Envoy image moved here from tetrate-envoy-gateway.containers.dl.tetrate.io/envoy and is now tagged with the TEG release version rather than the upstream Envoy version. If you are upgrading from an earlier release, update the Envoy proxy image override in your values file accordingly.

FIPS-approved TLS cipher suites. The FIPS builds use TLS 1.2 with FIPS-approved cipher suites both between TEG components and for connections with clients and backends. They rely on Google's BoringCrypto module, whose Security Policy only covers TLS 1.2. The cipher suites are:

• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-GCM-SHA384

ClientTrafficPolicy and EnvoyProxy can still set TLS versions and cipher suites for client and backend connections, but the FIPS builds override those settings and enforce TLS 1.2 with the suites above.

Verification. To confirm the installed artifacts are the FIPS builds, see Verify FIPS Image.

Confirm which edition is running

The control-plane image tells you which edition is installed:

kubectl -n envoy-gateway-system get deployment teg-envoy-gateway \
    -o jsonpath="{.spec.template.spec.containers[0].image}"

For the enterprise editions, the PHONE_HOME_ENABLED environment variable on the same container reflects the phoneHome.enabled value the chart was installed with:

kubectl -n envoy-gateway-system get deployment teg-envoy-gateway \
    -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='PHONE_HOME_ENABLED')].value}"

For the enterprise FIPS edition, verify the cryptographic build as described in Verify FIPS Image.