Envoy AI Gateway v1.1.0 alters Helm controller security context

Envoy AI Gateway v1.1.0 introduces several new features, including token counting APIs, per-request upstream credentials, stream idle timeout with failover, MCP hostname routing, OpenTelemetry GenAI tracing, and HTTP CONNECT egress. According to the project's GitHub release notes, this update does not require CRD migrations and maintains backward compatibility for most configurations. However, the Helm chart now enforces a restricted podSecurityContext and container securityContext for the controller, setting non-root UID/GID 65532, dropping all capabilities, disallowing privilege escalation, and using the RuntimeDefault seccomp profile. Previously, these security contexts were left empty.

Operators should carefully review their Helm configuration before upgrading, especially if they use a custom controller image that cannot operate under UID 65532 or requires elevated privileges. If compatibility issues arise, the security contexts can be overridden in the Helm values to restore the previous empty state. Additionally, operators running multiple replicas should consider enabling a Pod Disruption Budget to ensure high availability during updates. This change reflects a broader trend in projects adopting stricter default security postures, which can improve resilience but may require adjustments for legacy or custom deployments.