Tyk

​

Overview

​

What Gets Created

• Standard Tyk Gateway Workload (RELEASE_NAME-tyk-api-gateway) — the gateway process, autoscaling between minScale and maxScale replicas on CPU. API definitions and policies are mounted from your secrets at startup.
• Redis and Redis Sentinel — the Redis template (v3.4.2) is deployed as a subchart, creating a Redis workload, a Sentinel workload, their volume sets, their config and password secrets, and an identity and policy for each (RELEASE_NAME-redis-identity, RELEASE_NAME-sentinel-identity, RELEASE_NAME-redis-policy, RELEASE_NAME-sentinel-policy). The gateway connects through Sentinel, not to Redis directly.
• Identity & Policy — an identity (RELEASE_NAME-tyk-identity) bound to the gateway with reveal on exactly the secrets it mounts: your admin secret, your API and policy secrets when set, and the bundled Redis and Sentinel password secrets.
• No template-created credential secret — the admin API key lives only in the prerequisite secret you create.

​

Prerequisites

​

1. Admin API Key (Required)

printf '%s' "$(openssl rand -hex 32)" | cpln secret create-opaque --name my-tyk-admin-secret --encoding plain -f -

​

2. API Definitions (Optional)

kind: secret
name: my-tyk-apis
description: my-tyk-apis
tags: {}
type: dictionary
data:
  app1.json: >-
    { "api_id": "app1", "name": "app1", "org_id": "default", "use_keyless":
    true, "use_jwt": false, "disable_rate_limit": true, "definition": {
    "location": "header", "key": "version" }, "version_data": { "not_versioned":
    true, "versions": { "Default": { "name": "Default", "use_extended_paths":
    true } } }, "proxy": { "listen_path": "/app1", "target_url":
    "http://app1.example-gvc.cpln.local:80", "strip_listen_path": true },
    "active": true}

cpln apply -f my-tyk-apis.yaml

​

3. Policies (Optional)

kind: secret
name: my-tyk-policies
description: my-tyk-policies
tags: {}
type: opaque
data:
  encoding: plain
  payload: |-
    {
      "app1-rate-limit": {
        "org_id": "default",
        "active": true,
        "rate": 20,
        "per": 100,
        "quota_max": 0,
        "quota_renewal_rate": 0,
        "quota_remaining": 0,
        "access_rights": {
          "app1": {
            "api_id": "app1",
            "api_name": "app1",
            "versions": ["Default"]
          }
        }
      }
    }

cpln apply -f my-tyk-policies.yaml

​

Installation

​

Configuration

image: tykio/tyk-gateway:v5.10.0

listenPort: 8080 # REQUIRED - the port the gateway listens on

# ─── Prerequisite secrets ─────────────────────────────────────────────────────
# All three must EXIST BEFORE INSTALL. See README Prerequisites for the exact
# `cpln secret create-*` commands.

# The admin secret is the Gateway Control API key (X-Tyk-Authorization on /tyk/*),
# which creates, lists and revokes API keys — so it never transits Helm values.
adminSecretName: my-tyk-admin-secret # REQUIRED - opaque secret (encoding: plain) holding the admin API key

# These two are OPTIONAL — set either to "" to omit it. But note what happens if
# you omit the APIs: the gateway falls back to the demo API definitions baked
# into the upstream image and will happily serve "Tyk Test API" instead of
# nothing, which looks like a working install until you notice it is not yours.
apiSecretName: my-tyk-apis # dictionary secret holding your API definition JSON files; "" = serve the image's demo APIs
policySecretName: my-tyk-policies # opaque secret holding your policies JSON; "" = no policies

# ─── Gateway ──────────────────────────────────────────────────────────────────
allowMasterKeys: false # true lets a key created with no access_rights reach EVERY API on this gateway

resources:
  cpu: 50m
  memory: 128Mi

autoscaling:
  maxScale: 3
  metric: cpu
  minScale: 1
  scaleToZeroDelay: 300
  target: 100

multiZone: false # OPTIONAL - Deploys replicas across multiple zones (confirm availability in your location)

# ─── Access ───────────────────────────────────────────────────────────────────
externalAccess: false # true publishes the gateway — INCLUDING its /tyk admin API — to the internet
internalAccess: # OPTIONAL - Sets the internal firewall scope
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list, e.g. //gvc/GVC_NAME/workload/WORKLOAD_NAME

# ─── Bundled Redis + Sentinel ─────────────────────────────────────────────────
# Tyk's token, rate-limit and analytics store. It serves this gateway only and is
# never reachable from outside the GVC, so the passwords are template plumbing —
# but they are used AS-IS, so change them before installing.
redis:
  redis:
    resources:
      cpu: 200m
      memory: 256Mi
    replicas: 2
    auth:
      password:
        enabled: true
        value: change-me-tyk-redis
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true
  sentinel:
    resources:
      cpu: 200m
      memory: 256Mi
    replicas: 3
    auth:
      password:
        enabled: true
        value: change-me-tyk-sentinel
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true

​

API Definitions and Policies

• apiSecretName — name of the dictionary secret holding your API definitions. Each key is a JSON filename mounted at /opt/tyk-gateway/apps. Set to "" to omit the mount — but see the demo-API warning in Prerequisites.
• policySecretName — name of the opaque secret holding your policies JSON, mounted at /opt/tyk-gateway/policies/policies.json. Set to "" to run with no policies.
• listenPort — the port the gateway listens on. Control Plane reserves a set of container ports; the chart refuses to render on one of them rather than letting the workload be rejected at apply time.

​

Master Keys

• allowMasterKeys — when true, a key created through /tyk/keys with no access_rights section can call every API on this gateway. Defaults to false, matching upstream Tyk.

​

Access

• externalAccess — when true, the gateway’s external inbound firewall opens to 0.0.0.0/0 and Control Plane assigns a *.cpln.app canonical endpoint. Defaults to false.
• internalAccess.type — which workloads inside Control Plane may reach the gateway. Defaults to same-gvc.
• internalAccess.workloads — list of workload links, used only when type is workload-list.

​

Resources and Autoscaling

• resources.cpu / resources.memory — CPU and memory allocated to the gateway workload.
• autoscaling.minScale / autoscaling.maxScale — minimum and maximum number of gateway replicas.
• autoscaling.metric — scaling metric (cpu by default).
• autoscaling.target — target metric value that triggers a scale-up.
• autoscaling.scaleToZeroDelay — seconds of inactivity before scaling to zero (only applies when minScale is 0).
• multiZone — when true, spreads replicas across availability zones within the location.

​

Redis and Sentinel

• redis.redis.replicas — number of Redis replicas.
• redis.sentinel.replicas — number of Sentinel replicas; 3 is the default and the recommended minimum for failover.
• redis.redis.persistence.enabled / redis.sentinel.persistence.enabled — persist data and Sentinel state to volume sets.
• redis.redis.auth.password.value / redis.sentinel.auth.password.value — the Redis and Sentinel passwords.

​

Outbound Connectivity

​

Connecting

cpln secret reveal my-tyk-admin-secret

​

Ports

​

Upgrading From 1.2.1 or Earlier

printf '%s' "$(openssl rand -hex 32)" | cpln secret create-opaque --name my-tyk-admin-secret --encoding plain -f -

​

Important Notes

• Create the admin secret before installing. A missing secret does not fail the install — Helm reports success and the gateway then sits at zero replicas with no container logs at all.
• externalAccess: true publishes the admin API, because /tyk/* shares the listener with your proxied APIs. The admin secret is then the only control in front of key creation and revocation.
• allowMasterKeys: true grants blanket access. Any key created without access_rights reaches every API on the gateway. Leave it false unless you have a specific reason.
• Leaving apiSecretName empty serves Tyk’s demo API, not an empty gateway. The install looks healthy while none of your APIs are loaded.
• Egress is closed, so every target_url must resolve to an in-GVC *.cpln.local host.
• Change the bundled Redis and Sentinel passwords — they ship as change-me-… placeholders and are used exactly as written.
• The gateway declares no health probes, so ready: true arrives before it can serve. A workload was ready roughly 30 seconds before it had connected to Redis, logging storage: Redis is either down or was not configured in between. Use GET /hello and check that redis reports pass rather than trusting the readiness signal, and expect the same gap when an autoscaled replica starts.
• Access changes take up to a couple of minutes to propagate. A change that appears to do nothing has usually just not settled yet.
• The first helm upgrade after an install restarts the bundled Redis, briefly interrupting rate-limit and key lookups even when nothing changed. Later no-op upgrades do not.
• The prerequisite secrets are not owned by the release — your admin, API, and policy secrets survive cpln helm uninstall and must be deleted manually if you no longer need them.

​

External References