Tetrate Enterprise Gateway for EnvoyVersion: v1.9.xTEG Image Versions
Image versions for TEG v1.9.3.
TEG is published in three editions — see TEG Editions. The community images are public; the enterprise and enterprise FIPS images live in credentialed Tetrate registries.
Envoy images should be updated to 1.39.6 (upstream) or v1.9.3 (Tetrate and FIPS) to fix GHSA-3wvj-j6qm-62mr, CVE-2026-35189 and denial-of-service vulnerabilities in the OAuth2 and API key auth HTTP filters, and to stop trusting the compromised eMudhra intermediate CAs. They also include the latest Envoy bug fixes.
Community (public)
This is the flavour the Helm chart uses by default. Images can be pulled without Tetrate credentials.
The community images are kept updated with the upstream images but may not include the security and bug fixes that Tetrate ships in the Enterprise and Enterprise FIPS images. Use an enterprise edition if you need those fixes.
| Repository | Name | Version |
|---|---|---|
| docker.io/tetrate | teg-envoy-gateway | v1.9.3 |
| docker.io/tetrate | teg-envoy | v1.9.3 |
| docker.io/tetrate | teg-envoy | distroless-v1.9.3 |
| docker.io/envoyproxy | gateway | v1.9.3 |
| docker.io/envoyproxy | ratelimit | 5ae0682e |
| docker.io/tetrate | gen-istio-cert | v0.6.0 |
| docker.io | redis | 8.6.7 |
Enterprise (non-FIPS)
The enterprise edition publishes its own control-plane, Envoy Gateway, and data-plane Envoy images, which may carry Tetrate fixes that the public community images do not, along with the Tetrate build of the rate limit service. The Redis image is the public one listed above.
| Repository | Name | Version |
|---|---|---|
| tetrate-envoy-gateway.containers.dl.tetrate.io | teg-envoy-gateway | v1.9.3 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | v1.9.3 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | envoy | distroless-v1.9.3 |
| tetrate-envoy-gateway.containers.dl.tetrate.io | gateway | v1.9.3-tetrate |
| tetrate-envoy-gateway.containers.dl.tetrate.io | ratelimit | v2026.10.28.0 |
Enterprise FIPS
The FIPS images include the same Tetrate security and bug fixes as the enterprise edition and are
FIPS certified — see TEG Editions. Every FIPS image
is published to and consumed from a single registry, fips-containers.teg.tetratelabs.com. FIPS images
are built for linux/amd64 only.
| Repository | Name | Version |
|---|---|---|
| fips-containers.teg.tetratelabs.com | teg-envoy-gateway | v1.9.3 |
| fips-containers.teg.tetratelabs.com | envoy | v1.9.3 |
| fips-containers.teg.tetratelabs.com | envoy | distroless-v1.9.3 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | v1.9.3 |
| fips-containers.teg.tetratelabs.com | envoy-clibs | distroless-v1.9.3 |
| fips-containers.teg.tetratelabs.com | gateway | v1.9.3-tetrate |
| fips-containers.teg.tetratelabs.com | ratelimit | v2026.10.28.0 |
Helm charts
The charts are public for every edition; the edition is selected through image overrides.
| Repository | Chart | Version |
|---|---|---|
| oci://docker.io/tetrate | teg-envoy-gateway-helm | v1.9.3 |
| oci://docker.io/tetrate | teg-crds-helm | v1.9.3 |
| oci://docker.io/tetrate | teg-resources-helm | v1.9.3 |
| oci://docker.io/tetrate | teg-keycloak-demo-helm | v1.9.3 |