Install Tyk Self-Managed on Kubernetes

​

Compatible Kubernetes Versions

​

Prerequisites

• A running Kubernetes cluster. This can be local (minikube, kind, or Docker Desktop) or a managed cloud cluster (EKS, GKE, or AKS).
• kubectl installed and connected to your cluster.
• Helm 3.12 or later.
• Tyk license keys. The Dashboard license is required; the Operator and Portal licenses are optional. Get a free trial at tyk.io/self-managed-trial.
• 4GB RAM or more available to the cluster.

​

Instructions

​

Step 1: Clone and Configure

1. Clone the tyk-install repository and navigate to the Kubernetes self-managed directory:
   git clone https://github.com/TykTechnologies/tyk-install
   cd tyk-install/kubernetes/helm-self-managed
   
2. Copy the example environment file and add your license keys:
   cp .env.example .env
   
3. Open .env and set your license key:
   TYK_LICENSE_KEY=<your-dashboard-license>
   TYK_OPERATOR_LICENSE=<your-operator-license>
   TYK_PORTAL_LICENSE=<your-portal-license>
   
4. Load the environment variables into your shell:
   source .env
   

​

Step 2: Create the Namespace and Secrets

# Create the namespace
kubectl create namespace tyk

# Create the main Tyk secret
kubectl create secret generic tyk-conf \
  --namespace tyk \
  --from-literal=APISecret=$TYK_API_SECRET \
  --from-literal=AdminSecret=$TYK_ADMIN_SECRET \
  --from-literal=DashLicense=$TYK_LICENSE_KEY \
  --from-literal=OperatorLicense=$TYK_OPERATOR_LICENSE \
  --from-literal=DevPortalLicense=$TYK_PORTAL_LICENSE \
  --from-literal=adminUserFirstName=$ADMIN_FIRST_NAME \
  --from-literal=adminUserLastName=$ADMIN_LAST_NAME \
  --from-literal=adminUserEmail=$ADMIN_EMAIL \
  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
  --from-literal=DashDatabaseConnectionString="$DashDatabaseConnectionString" \
  --from-literal=DevPortalDatabaseConnectionString="$DevPortalDatabaseConnectionString"

# Create the Developer Portal secret
kubectl create secret generic secrets-tyk-tyk-dev-portal \
  --namespace tyk \
  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
  --from-literal=adminUserEmail=$ADMIN_EMAIL

​

Step 3: Install Dependencies

# Add the Bitnami repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Install PostgreSQL (also creates the portal database)
helm install tyk-postgres bitnami/postgresql \
  --namespace tyk \
  --set image.repository=bitnamilegacy/postgresql \
  --set auth.username=$POSTGRES_USER \
  --set auth.password=$POSTGRES_PASSWORD \
  --set auth.database=$POSTGRES_DB \
  --set primary.initdb.scripts."init\.sql"="CREATE DATABASE portal;" \
  --set primary.persistence.size=20Gi \
  --version 12.12.10

# Install Redis
helm install tyk-redis oci://registry-1.docker.io/bitnamicharts/redis \
  --namespace tyk \
  --set image.repository=bitnamilegacy/redis \
  --set auth.enabled=false \
  --version 19.0.2

# Wait for the databases to be ready (about 2 minutes)
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql -n tyk
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=redis -n tyk

# Install cert-manager (required for the Tyk Operator)
helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.17.4 \
  --set crds.enabled=true

​

Step 4: Install the Tyk Stack

# Add the Tyk Helm repository
helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update

# Install Tyk with the bundled values file
helm install tyk tyk-helm/tyk-stack \
  --namespace tyk \
  --values values.yaml

# Watch the pods come up (press Ctrl+C once all are Running or Completed)
kubectl get pods -n tyk -w

​

Step 5: Access the Services

kubectl port-forward -n tyk svc/dashboard-svc-tyk-tyk-dashboard 3000:3000
kubectl port-forward -n tyk svc/gateway-svc-tyk-tyk-gateway 8080:8080
kubectl port-forward -n tyk svc/dev-portal-svc-tyk-tyk-dev-portal 3001:3001

kubectl get svc -n tyk

​

Step 6: Get Admin Credentials

# Admin email
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserEmail}' | base64 -d && echo

# Admin password
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserPassword}' | base64 -d && echo

​

Step 7: Verify the Installation

# Gateway
curl http://localhost:8080/hello

# Dashboard
curl http://localhost:3000/hello

# Portal
curl http://localhost:3001/ready

​

Configuration

​

Hybrid Control Plane and Data Plane

• Install the Control Plane first to provision the Dashboard, MDCB, and supporting services.
• Install each Data Plane using the connection details produced by the Control Plane installation.

​

Cleanup

# Remove the Tyk stack
helm uninstall tyk -n tyk

# Remove the databases (this deletes all data)
helm uninstall tyk-postgres -n tyk
helm uninstall tyk-redis -n tyk

# Remove secrets and persistent volume claims
kubectl delete secrets -n tyk --all
kubectl delete pvc -n tyk --all

# Delete the namespace
kubectl delete namespace tyk

kubectl delete namespace cert-manager

​

Troubleshooting

# Check pod details
kubectl describe pod -n tyk <pod-name>

# Check recent events
kubectl get events -n tyk --sort-by='.lastTimestamp' | tail -20

# Check pod logs
kubectl logs -n tyk <pod-name>

# Verify the secret exists and has all required keys
kubectl get secret tyk-conf -n tyk -oyaml

# Decode and verify specific values
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d && echo
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo

# If the secret is missing or incorrect, recreate it
kubectl delete secret tyk-conf -n tyk
# Re-export the environment variables and run Step 3 again
source .env

# Check PostgreSQL is running
kubectl get pods -n tyk -l app.kubernetes.io/name=postgresql

# Test database connectivity from a pod
kubectl exec -it -n tyk deployment/dashboard-tyk-tyk-dashboard -- /bin/sh
# Inside the pod:
env | grep DATABASE

# Verify the connection string format in the secret
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashDatabaseConnectionString}' | base64 -d && echo
# Expected format: postgresql://user:password@host:5432/database

# Check PostgreSQL logs
kubectl logs -n tyk -l app.kubernetes.io/name=postgresql

# Verify the license key is set
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo

# Check Dashboard logs for license errors
kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100 | grep -i license

# Check license expiration in the Tyk Dashboard:
# Settings > License

# Check the Gateway is connected to the Dashboard
kubectl logs -n tyk -l app=gateway-tyk-tyk-gateway --tail=100

# Force a Gateway reload (using APISecret for auth)
API_SECRET=$(kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d)
curl -X GET http://localhost:8080/tyk/reload \
  -H "X-Tyk-Authorization: $API_SECRET"

# Confirm the APIs are published in the Dashboard:
# APIs > check the "Published" status

# Check Dashboard pod status
kubectl get pods -n tyk -l app=dashboard-tyk-tyk-dashboard

# Check the Dashboard service
kubectl get svc -n tyk | grep dashboard

# Check Dashboard logs
kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100

# If using a LoadBalancer, verify an external IP is assigned
kubectl get svc -n tyk dashboard-svc-tyk-tyk-dashboard

# If using Ingress, verify the ingress is created
kubectl get ingress -n tyk
kubectl describe ingress -n tyk <dashboard-ingress-name>

# Check the operator pod is running
kubectl get pods -n tyk -l control-plane=tyk-operator-controller-manager

# Check operator logs
kubectl logs -n tyk -l control-plane=tyk-operator-controller-manager --tail=100

# Verify the operator secret exists
kubectl get secret tyk-operator-conf -n tyk

# Check the CRDs are installed
kubectl get crds | grep tyk

# Verify the ingress controller is installed
kubectl get pods -n kube-system | grep ingress  # For NGINX
kubectl get pods -n kube-system | grep aws-load-balancer  # For AWS LB Controller

# Check the ingress resource
kubectl get ingress -n tyk
kubectl describe ingress -n tyk <ingress-name>

# For AWS ALB, check the AWS console for ALB creation
# For GKE, check the Google Cloud console for the Load Balancer

# Verify DNS is pointing to the ingress address
nslookup gateway.yourdomain.com

​

Legacy Helm Chart

​

Prerequisites

1. Tyk License If you are evaluating Tyk on Kubernetes, contact us to obtain a temporary license.
2. Data stores The following are required for a Tyk Self-Managed installation:
   • Redis - Should be installed in the cluster or reachable from inside the cluster (for SaaS option). You can find instructions for a simple Redis installation bellow.
   • MongoDB or SQL - Should be installed in the cluster or be reachable by the Tyk Manager (for SaaS option).
   You can find supported MongoDB and SQL versions here. Installation instructions for Redis and MongoDB/SQL are detailed below.
3. Helm Installed Helm 3 Tyk Helm Chart is using Helm v3 version (i.e. not Helm v2).

​

Installing the data stores

helm install tyk-redis bitnami/redis -n tyk --version 19.0.2

  Redis(TM) can be accessed on the following DNS names from within your cluster:

    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)

  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)

helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3

helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10

helm install redis tyk-helm/simple-redis -n tyk
helm install mongo tyk-helm/simple-mongodb -n tyk

​

Instructions

1. Add Tyk official Helm repo to your local Helm repository
   helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
   helm repo update
   
2. Create namespace for your Tyk deployment
   kubectl create namespace tyk
   
3. Getting the values.yaml of the chart Before we proceed with installation of the chart you need to set some custom values. To see what options are configurable on a chart and save that options to a custom values.yaml file run:
   helm show values tyk-helm/tyk-pro > values.yaml
   
4. License setting For the Tyk Self-Managed chart we need to set the license key in your custom values.yaml file under dash.license field or use --set dash.license={YOUR-LICENSE_KEY} with the helm install command. Tyk Self-Managed licensing allow for different numbers of Gateway nodes to connect to a single Dashboard instance. To ensure that your Gateway pods will not scale beyond your license allowance, please ensure that the Gateway’s resource kind is Deployment and the replica count to your license node limit. By default, the chart is configured to work with a single node license: gateway.kind=Deployment and gateway.replicaCount=1.
   Please NoteThere may be intermittent issues on the new pods during the rolling update process, when the total number of online gateway pods is more than the license limit with lower amounts of Licensed nodes.
5. Installing Tyk Self managed Now we can install the chart using our custom values:
   helm install tyk-pro tyk-helm/tyk-pro -f ./values.yaml -n tyk --wait
   
   Important Note regarding MongoDBThe --wait argument is important to successfully complete the bootstrap of your Tyk Manager.

​

Pump Installation

1. Mongo Pump To configure mongo pump, do following changings in values.yaml file:
   1. Set backend to mongo.
   2. Set connection string in mongo.mongoURL.
2. Postgres Pump To configure postgres pump, do following changings in values.yaml file:
   1. Set backend to postgres.
   2. Set connection string parameters in postgres section.

​

Tyk Developer Portal

​

Using TLS

​

Mounting Files

- name: aws-mongo-ssl-cert
 filename: rds-combined-ca-bundle.pem
 mountPath: /etc/certs

​

Sharding APIs