> ## Documentation Index
> Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tyk

> Deploy Tyk on Control Plane using the Template Catalog. Covers configuration, scaling, and API gateway management with Redis-backed token storage, rate limiting, and analytics.

## Overview

Tyk is an open-source API management platform that controls, secures, and monitors API traffic. This template deploys a Tyk API Gateway workload on Control Plane alongside Redis and Redis Sentinel, which serve as the backing store for tokens, analytics, rate limits, and gateway state.

<Note>
  This template does not create a GVC. You must deploy it into an existing GVC.
</Note>

### What Gets Created

* **Standard Workload** — Tyk API Gateway (`RELEASE_NAME-tyk-api-gateway`): the gateway process, autoscaling between `minScale` and `maxScale` replicas. API definitions and policies are mounted from Control Plane secrets at startup.
* **Secret** — Gateway admin secret (`RELEASE_NAME-tyk-gateway-secret`): a dictionary secret containing the admin API key used for management operations.
* **Identity & Policy** — An identity (`RELEASE_NAME-tyk-identity`) bound to the gateway workload with `reveal` access to the gateway secret, Redis auth secrets, and optionally the API definitions and policy secrets.
* **Redis and Redis Sentinel** — The [Redis](/template-catalog/templates/redis) template (v3.1.1) is deployed as a dependency, creating a Redis workload, a Sentinel workload, and their associated secrets, identities, and policies.

## Prerequisites

Tyk loads API definitions and policies from files at startup. You must create the corresponding Control Plane secrets **before** deploying the template.

### 1. Create the API Definitions Secret

Each key in the dictionary is a filename (e.g. `app1.json`) containing a Tyk API definition object. Create the secret using `cpln apply`:

```yaml theme={null}
kind: secret
name: my-tyk-apis
description: my-tyk-apis
tags: {}
type: dictionary
data:
  app1.json: >-
    { "api_id": "app1", "name": "app1", "org_id": "default", "use_keyless":
    true, "use_jwt": false, "disable_rate_limit": true, "definition": {
    "location": "header", "key": "version" }, "version_data": { "not_versioned":
    true, "versions": { "Default": { "name": "Default", "use_extended_paths":
    true } } }, "proxy": { "listen_path": "/app1", "target_url":
    "http://app1.example-gvc.cpln.local:80", "strip_listen_path": true },
    "active": true}
```

Set `apiSecretName` in your values to the name of this secret. To omit API definitions entirely, leave `apiSecretName` empty.

### 2. Create the Policies Secret

The policies secret is a single opaque secret containing a JSON object where each key is a policy ID:

```yaml theme={null}
kind: secret
name: my-tyk-policies
description: my-tyk-policies
tags: {}
type: opaque
data:
  encoding: plain
  payload: |-
    {
      "app1-rate-limit": {
        "org_id": "default",
        "active": true,
        "rate": 20,
        "per": 100,
        "quota_max": 0,
        "quota_renewal_rate": 0,
        "quota_remaining": 0,
        "access_rights": {
          "app1": {
            "api_id": "app1",
            "api_name": "app1",
            "versions": ["Default"]
          }
        }
      }
    }
```

Set `policySecretName` in your values to the name of this secret. To omit policies entirely, leave `policySecretName` empty.

## Installation

To install, follow the instructions for your preferred method:

<CardGroup cols={2}>
  <Card title="UI" href="/template-catalog/install-manage/ui" icon="laptop">
    Browse, install, and manage templates visually
  </Card>

  <Card title="CLI" href="/template-catalog/install-manage/cli" icon="terminal">
    Manage templates from your terminal
  </Card>

  <Card title="Terraform" href="/template-catalog/install-manage/terraform" icon={<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><g fill-rule="evenodd"><path d="M77.941 44.5v36.836L46.324 62.918V26.082zm0 0" fill="#5c4ee5"/><path d="M81.41 81.336l31.633-18.418V26.082L81.41 44.5zm0 0" fill="#4040b2"/><path d="M11.242 42.36L42.86 60.776V23.941L11.242 5.523zm0 0M77.941 85.375L46.324 66.957v36.82l31.617 18.418zm0 0" fill="#5c4ee5"/></g></svg>}>
    Declare templates in your Terraform configurations
  </Card>

  <Card
    title="Pulumi"
    href="/template-catalog/install-manage/pulumi"
    icon={<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" id="Pulumi-Icon--Streamline-Svg-Logos" height="24" width="24">
    <desc>
        Pulumi Icon Streamline Icon: https://streamlinehq.com
    </desc>
    <path fill="#f26e7e" d="M4.683025 13.3318c0.869125 -0.5018 0.870575 -2.1264 0.003225 -3.62865s-2.27504 -2.313275 -3.1441725 -1.811475C0.672945 8.3935 0.6715 10.0181 1.53885 11.52035c0.86735 1.502275 2.27505 2.313275 3.144175 1.81145Zm0.0052 3.2167c0.86735 1.502275 0.865925 3.126875 -0.003225 3.628675 -0.86915 0.5018 -2.2768275 -0.309225 -3.144175 -1.81145 -0.8673525 -1.50225 -0.8659075 -3.126875 0.003225 -3.628675 0.8691325 -0.5018 2.276825 0.309225 3.144175 1.81145Zm5.922875 3.4243c0.86735 1.50225 0.8659 3.126775 -0.003225 3.62875 -0.869125 0.501775 -2.27685 -0.309325 -3.1442 -1.81155 -0.867325 -1.50225 -0.865875 -3.12685 0.00325 -3.628675 0.869125 -0.5018 2.276825 0.309225 3.144175 1.811475Zm-0.001925 -6.845275c0.86735 1.50225 0.8659 3.12685 -0.003225 3.628675 -0.869125 0.5018 -2.276825 -0.309225 -3.144175 -1.811475 -0.86735 -1.50225 -0.8659 -3.12685 0.003225 -3.62865 0.869125 -0.501825 2.276825 0.3092 3.144175 1.81145Z" stroke-width="0.25"></path>
    <path fill="#8a3391" d="M22.45775 11.524125c0.86725 -1.502225 0.865925 -3.12685 -0.003225 -3.62865 -0.869125 -0.501825 -2.276825 0.3092 -3.144175 1.811475 -0.86735 1.50225 -0.8659 3.126825 0.003225 3.62865 0.869125 0.501825 2.276825 -0.3092 3.144175 -1.811475Zm0.000175 3.2151c0.869075 0.5018 0.870625 2.1264 0.003225 3.62865 -0.86735 1.50225 -2.27505 2.313275 -3.144175 1.81145 -0.869125 -0.5018 -0.870575 -2.126425 -0.003225 -3.62865 0.86735 -1.50225 2.27505 -2.313275 3.144175 -1.81145ZM16.536225 18.157875c0.86915 0.501825 0.8706 2.126425 0.00325 3.628675 -0.86735 1.502125 -2.275075 2.313225 -3.1442 1.81145 -0.869125 -0.50175 -0.870575 -2.126425 -0.003225 -3.62865 0.867375 -1.502275 2.27505 -2.3133 3.144175 -1.811475Zm-0.003325 -6.843775c0.869125 0.5018 0.870575 2.126425 0.003225 3.628675s-2.27505 2.313275 -3.1442 1.811475c-0.869125 -0.501825 -0.870575 -2.126425 -0.003225 -3.628675 0.86735 -1.502275 2.27505 -2.313275 3.1442 -1.811475Z" stroke-width="0.25"></path>
    <path fill="#f7bf2a" d="M15.138225 2.06721c0 1.003615 -1.40625 1.817215 -3.14095 1.817215 -1.7347 0 -3.14095 -0.8136 -3.14095 -1.817215C8.856325 1.06359 10.262575 0.25 11.997275 0.25c1.7347 0 3.14095 0.81359 3.14095 1.81721ZM9.2166 5.482375c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172s1.40625 -1.817225 3.14095 -1.817225c1.7347 0 3.14095 0.8136 3.14095 1.817225Zm8.71005 1.8172c1.7347 0 3.14095 -0.813575 3.14095 -1.8172s-1.40625 -1.817225 -3.14095 -1.817225c-1.7347 0 -3.14095 0.8136 -3.14095 1.817225s1.40625 1.8172 3.14095 1.8172Zm-2.788425 1.605625c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172 0 -1.0036 1.40625 -1.8172 3.14095 -1.8172 1.7347 0 3.14095 0.8136 3.14095 1.8172Z" stroke-width="0.25"></path>
    </svg>}
  >
    Declare templates in your Pulumi programs
  </Card>
</CardGroup>

## Configuration

The default `values.yaml` for this template:

```yaml theme={null}
image: tykio/tyk-gateway:v5.10.0

listenPort: 8080 # REQUIRED - The port exposed on the Tyk workload

apiSecretName: my-tyk-apis # REQUIRED - The name of the pre-configured Control Plane secret that contains your API definitions
policySecretName: my-tyk-policies # REQUIRED - The name of the pre-configured Control Plane secret that contains your policies
# Note: if you wish to omit one of these secrets, leave the value empty and it will be omitted from the workload's configuration

adminSecret: mysecret # REQUIRED - The value you set to be the admin API key for management of Tyk

resources:
  cpu: 50m
  memory: 128Mi

autoscaling:
  maxScale: 3
  metric: cpu
  minScale: 1
  scaleToZeroDelay: 300
  target: 100

multiZone: false # OPTIONAL - Deploys replicas across multiple zones (confirm availability in your location)

externalAccess: true # OPTIONAL - Set to true to expose the workload to the internet; set to false for internal-only access
internalAccess: # OPTIONAL - Sets the internal firewall scope
  type: none # options: none, same-gvc, same-org, workload-list
  workloads:  # Note: can only be used if type is same-gvc or workload-list
    #- //gvc/GVC_NAME/workload/WORKLOAD_NAME

redis:
  redis:
    resources:
      cpu: 200m
      memory: 256Mi
      minCpu: 80m
      minMemory: 128Mi
    replicas: 2
    auth:
      password:
        enabled: true
        value: myRedisPassword
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true
  sentinel:
    resources:
      cpu: 200m
      memory: 256Mi
      minCpu: 80m
      minMemory: 128Mi
    replicas: 3
    auth:
      password:
        enabled: true
        value: mySentinelPassword
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true
```

### API Definitions & Policies

* `apiSecretName` — Name of the pre-existing Control Plane secret containing API definitions. Each key in the dictionary is a JSON filename mounted at `/opt/tyk-gateway/apps`. **Must be created before deploying.**
* `policySecretName` — Name of the pre-existing Control Plane opaque secret containing the policies JSON, mounted at `/opt/tyk-gateway/policies/policies.json`. **Must be created before deploying.**

Leave either value empty to omit that mount from the gateway workload.

### Admin Secret

* `adminSecret` — The admin API key used for gateway management operations (e.g. creating keys, reloading APIs). **Change before deploying to production.** Stored in a dictionary secret and injected into the gateway at startup.

### Resources & Autoscaling

* `resources.cpu` / `resources.memory` — CPU and memory allocated to the Tyk Gateway workload.
* `autoscaling.minScale` / `autoscaling.maxScale` — Minimum and maximum number of gateway replicas.
* `autoscaling.metric` — Scaling metric (`cpu` by default).
* `autoscaling.target` — Target metric value that triggers a scale-up.
* `autoscaling.scaleToZeroDelay` — Seconds of inactivity before scaling to zero (only applies when `minScale` is `0`).
* `multiZone` — When `true`, spreads replicas across availability zones within the location.

### Access

* `externalAccess` — Set to `true` to expose the gateway publicly. Set to `false` for internal-only access.
* `internalAccess.type` — Controls which workloads can connect to the gateway internally:

| Type            | Description                                                     |
| --------------- | --------------------------------------------------------------- |
| `none`          | No internal access allowed                                      |
| `same-gvc`      | Allow access from all workloads in the same GVC                 |
| `same-org`      | Allow access from all workloads in the same organization        |
| `workload-list` | Allow access only from specific workloads listed in `workloads` |

* `internalAccess.workloads` — List of specific workload links, used when `type` is `workload-list`.

### Redis

The Redis subchart is configured under the `redis` key. See the [Redis template](/template-catalog/templates/redis) for full configuration details. Key options:

* `redis.redis.replicas` — Number of Redis replicas.
* `redis.redis.auth.password.enabled` / `redis.redis.auth.password.value` — Redis password authentication. **Change before deploying to production.**
* `redis.redis.persistence.enabled` — Persist Redis data to a volume set.
* `redis.sentinel.replicas` — Number of Sentinel replicas (3 recommended for production).
* `redis.sentinel.auth.password.enabled` / `redis.sentinel.auth.password.value` — Sentinel password authentication. **Change before deploying to production.**
* `redis.sentinel.persistence.enabled` — Persist Sentinel state to a volume set.

### Connecting to the Gateway

Access the gateway from within the same GVC at:

```text theme={null}
RELEASE_NAME-tyk-api-gateway.GVC_NAME.cpln.local:8080
```

When `externalAccess` is `true`, the gateway is also reachable via its public Control Plane endpoint.

The Tyk management API is available on the same port under the `/tyk/` path. Requests require the `x-tyk-authorization` header set to the value of `adminSecret`.

### Ports

| Port   | Protocol | Description                              |
| ------ | -------- | ---------------------------------------- |
| `8080` | HTTP     | API traffic and management API (`/tyk/`) |

## External References

<CardGroup cols={2}>
  <Card title="Tyk Documentation" icon="book" href="https://tyk.io/docs">
    Official Tyk API Gateway documentation
  </Card>

  <Card title="Tyk API Definition Objects" icon="book" href="https://tyk.io/docs/5.0/tyk-gateway-api/api-definition-objects/">
    Reference for the API definition JSON structure
  </Card>

  <Card title="Tyk Policies Guide" icon="book" href="https://tyk.io/docs/5.1/basic-config-and-security/security/security-policies/policies-guide/">
    Guide for configuring Tyk access policies
  </Card>

  <Card title="Tyk Template" icon="github" href="https://github.com/controlplane-com/templates/tree/main/tyk">
    View the source files, default values, and chart definition
  </Card>
</CardGroup>