[lindeskar]

What this PR does / why we need it:

Makes the managed Envoy Proxy image visible in rendered gateway-helm manifests, so image mirroring and air-gapped tooling that scans helm template / ArgoCD output can discover it.

global.images.envoyProxy.image now defaults to DefaultEnvoyProxyImage, substituted at chart generation time the same way ${GatewayImage} is. The chart default follows the controller default automatically, with no extra manual release step.

Setting the default exposed two issues in the existing helper, both fixed here:

• It merged the global image over config.envoyGateway.envoyProxy and mutated .Values in place, so an inline Envoy Proxy image was silently replaced. The helper now emits only chart-derived defaults, and the ConfigMap's existing merge lets inline settings take precedence, matching the ratelimit and control plane images.
• It always rendered envoyDeployment. When config.envoyGateway.envoyProxy configures envoyDaemonSet, the image now lands there instead.

Because the default is non-empty, global.imageRegistry and global.imagePullSecrets now also apply to the Envoy Proxy image, as the values docs already describe. This is called out as a breaking change. global.images.envoyProxy.image: "" restores the previous behavior.

A GatewayClass or Gateway EnvoyProxy with mergeType set could select a different workload kind than a less specific configuration, and the merge then kept both envoyDeployment and envoyDaemonSet, so both workloads were created. MergeEnvoyProxyConfigs now converts the less specific workload to the selected kind before merging. Its container, pod and name carry over, so a mirrored default image still applies. Settings that only fit the previous kind are dropped, including its patch and, when switching to a DaemonSet, envoyHpa.

Which issue(s) this PR fixes:

Fixes #9144

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: Doc comment only on EnvoyProxySpec.mergeType describing the workload-kind merge behavior requested in review; no schema change.
• Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
• Tests added/updated: Added helm golden cases for an inline Envoy Proxy image, envoyDaemonSet, and opting out with an empty image; added MergeEnvoyProxyConfigs cases for workload-kind conversion in both directions and at both merge steps.
• Docs: Regenerated the helm README/API docs and updated RELEASING.md.
• Release notes: Added new_features/, breaking_changes/ and bug_fixes/ fragments.
• Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed.
• Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
• Codex review: Requested a Codex review and addressed all of its comments.
• Copilot review: Requested a Copilot review and addressed all of its comments.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	1832c86
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6ae48ef3cf6b31cf3e909137
😎 Deploy Preview	https://deploy-preview-10101--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[lindeskar]

Hi maintainers! Anything we can do to move this forward?

[lindeskar]

I will close this now, but can gladly reopen if the issue gets attention once more

[zhaohuabing]

One case the chart can't address: a GatewayClass or Gateway EnvoyProxy with mergeType set and envoyDaemonSet is merged onto an EnvoyGateway default that contains envoyDeployment, yielding both.

Hi @lindeskar Could you please also address it in this PR? Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.19%. Comparing base (382f4b7) to head (3343e65).
⚠️ Report is 161 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10101      +/-   ##
==========================================
+ Coverage   81.34%   82.19%   +0.84%     
==========================================
  Files         265      277      +12     
  Lines       41035    44014    +2979     
==========================================
+ Hits        33381    36178    +2797     
- Misses       7653     7835     +182     
  Partials        1        1              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lindeskar]

Thanks @zhaohuabing, done in a600e79.

MergeEnvoyProxyConfigs now converts the less specific workload to the kind the more specific EnvoyProxy selects before merging, so the result only ever has one of envoyDeployment / envoyDaemonSet.