Deploy Hybrid Gateways with Tyk Cloud

Introduction

Tyk Cloud hosts and manages the control planes for you. You can deploy the data planes across multiple locations:

as Cloud Gateways: Deployed and managed in Tyk Cloud, in any of our available regions. These are SaaS gateways, so there are no deployment or operational concerns.
as Hybrid Gateways: This is a self-managed data plane, deployed in your infrastructure and managed by yourself. Your infrastructure can be a public or private cloud, or even your own data center.

This page describes the deployment of hybrid data planes and how to connect them to Tyk Cloud, in both Kubernetes and Docker environments.

Prerequisites

Tyk Cloud Account, register here if you don’t have one yet:
A Redis instance for each data plane, used as ephemeral storage for distributed rate limiting, token storage and analytics. You will find instructions for a simple Redis installation in the steps below.
No incoming firewall rules are needed, as the connection between Tyk Hybrid Gateways and Tyk Cloud is always initiated from the Gateways, not from Tyk Cloud.

Tyk Hybrid Gateway configuration

The hybrid gateways in the data plane connect to the control plane in Tyk Cloud using the Tyk Dashboard API Access Credentials. Follow the guides below to create the configuration that we will be used in later sections to create a deployment: Login to your Tyk Cloud account deployments section and click on ADD HYBRID DATA PLANE

Fill in the details and then click SAVE DATA PLANE CONFIG

Save Tyk Cloud hybrid configuration home

This will open up a page with the data plane configuration details that we need.

Save Tyk Cloud hybrid configuration masked details

Those details are:

	Docker	Helm
key	api_key	gateway.rpc.apiKey
org_id	rpc_key	gateway.rpc.rpcKey
data_planes_connection_string (mdcb)	connection_string	gateway.rpc.connString

You can also click on OPEN DETAILS

This will reveal instructions that you can use to connect your hybrid data plane to Tyk Cloud.

Deploy with Docker

Step 1: Clone and configure

Clone the tyk-install repository and navigate to the hybrid directory:

git clone https://github.com/TykTechnologies/tyk-install.git
cd tyk-install/docker/hybrid

Step 2: Configure the Gateway connection to the control plane

Edit confs/tyk.env and set your MDCB credentials:

TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING=your-mdcb.cloud-ara.tyk.io:443
TYK_GW_SLAVEOPTIONS_RPCKEY=your-org-id
TYK_GW_SLAVEOPTIONS_APIKEY=your-dashboard-api-key
TYK_GW_SLAVEOPTIONS_GROUPID=your-group-id

Variable	Description
`TYK_GW_SLAVEOPTIONS_CONNECTIONSTRING`	MDCB endpoint from the control plane
`TYK_GW_SLAVEOPTIONS_RPCKEY`	Organization ID
`TYK_GW_SLAVEOPTIONS_APIKEY`	Dashboard User API Key
`TYK_GW_SLAVEOPTIONS_GROUPID`	Data plane cluster identifier (used when running multiple data planes)

To enable API sharding (optional), add to confs/tyk.env:

TYK_GW_DBAPPCONFOPTIONS_NODEISSEGMENTED=true
TYK_GW_DBAPPCONFOPTIONS_TAGS=qa,uat

Step 3: Configure the Pump connection to the control plane

Edit confs/pump.env with the same MDCB credentials:

TYK_PMP_PUMPS_HYBRID_META_CONNECTIONSTRING=your-mdcb.cloud-ara.tyk.io:443
TYK_PMP_PUMPS_HYBRID_META_RPCKEY=your-org-id
TYK_PMP_PUMPS_HYBRID_META_APIKEY=your-dashboard-api-key
TYK_PMP_PUMPS_HYBRID_META_GROUPID=your-group-id

Step 4: Start services

docker compose up -d

Wait for all health checks to pass (~30 seconds), then verify the containers are running:

docker compose ps

Expected containers:

Container	Port	Status
`tyk-gateway`	8080	Running
`tyk-pump`	N/A	Running
`tyk-redis`	6379	Running

Step 5: Verify the connection

curl http://localhost:8080/hello

Expected response:

{"status":"pass","version":"5.x.x","description":"Tyk GW"}

Then verify in your control plane: Navigate to Deployments > your Control Plane. Your hybrid data plane should appear under Hybrid data planes.

Deploy in Kubernetes with Helm Chart

Prerequisites

Kubernetes 1.19+
Helm 3+
Connection details to remote control plane from the above section.

The following quick start guide explains how to use the Tyk Data Plane Helm chart to configure Tyk Gateway that includes:

Redis for key storage
Tyk Pump to send analytics to Tyk Cloud and Prometheus

At the end of this quickstart Tyk Gateway should be accessible through service gateway-svc-hybrid-dp-tyk-gateway at port 8080. Pump is also configured with Hybrid Pump which sends aggregated analytics to Tyk Cloud, and Prometheus Pump which expose metrics locally at :9090/metrics. 1. Set connection details Set the below environment variables and replace values with connection details to your Tyk Cloud remote control plane. See the above section on how to get the connection details.

MDCB_UserKey=9d20907430e440655f15b851e4112345
MDCB_OrgId=64cadf60173be90001712345
MDCB_ConnString=mere-xxxxxxx-hyb.aws-euw2.cloud-ara.tyk.io:443
MDCB_GroupId=your-group-id

2. Then use Helm to install Redis and Tyk

NAMESPACE=tyk
APISecret=foo
REDIS_BITNAMI_CHART_VERSION=19.0.2

helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update

helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis

helm upgrade hybrid-dp tyk-helm/tyk-data-plane -n $NAMESPACE --create-namespace \
  --install \
  --set global.remoteControlPlane.userApiKey=$MDCB_UserKey \
  --set global.remoteControlPlane.orgId=$MDCB_OrgId \
  --set global.remoteControlPlane.connectionString=$MDCB_ConnString \
  --set global.remoteControlPlane.groupID=$MDCB_GroupId \
  --set global.secrets.APISecret="$APISecret" \
  --set global.redis.addrs="{tyk-redis-master.$NAMESPACE.svc.cluster.local:6379}" \
  --set global.redis.passSecret.name=tyk-redis \
  --set global.redis.passSecret.keyName=redis-password

3. Done! Now Tyk Gateway should be accessible through service gateway-svc-hybrid-dp-tyk-gateway at port 8080. Pump is also configured with Hybrid Pump which sends aggregated analytics to Tyk Cloud, and Prometheus Pump which expose metrics locally at :9090/metrics. For the complete installation guide and configuration options, please see Tyk Data Plane Chart.

Remove hybrid data plane configuration

Please note the action of removing a hybrid data plane configuration cannot be undone.To remove the hybrid data plane configuration, navigate to the page of the hybrid data plane you want to remove and click OPEN DETAILS

Then click on REMOVE DATA PLANE CONFIGS

Confirm the removal by clicking DELETE HYBRID DATA PLANE

Tyk Cloud hybrid confirm removal of configs

Tyk Cloud MDCB Supported versions

This section lists the supported MDCB version for hybrid setup

Dashboard	Gateway	MDCB
v5.2.0	v5.2.0	v2.4.0
v5.1.2	v5.1.2	v2.3.0
v5.1.1	v5.1.1	v2.3.0
v5.1.0	v5.1.0	v2.3.0
v5.0.5	v5.0.5	v2.2.0
v5.0.4	v5.0.4	v2.2.0
v5.0.3	v5.0.3	v2.2.0
v5.0.2	v5.0.2	v2.2.0
v5.0.1	v5.0.1	v2.1.1
v5.0.0	v5.0.0	v2.1.1
v4.3.3	v4.3.3	v2.1.0
v4.3.2	v4.3.2	v2.0.4
v4.3.1	v4.3.1	v2.0.4
v4.3.0	v4.3.0	v2.0.4
v4.2.4	v4.2.4	v2.0.3
v4.2.3	v4.2.3	v2.0.3
v4.0.10	v4.0.10	v2.0.4
v4.0.9	v4.0.9	v2.0.3
v4.0.8	v4.0.8	v2.0.3
v3.2.3	v3.2.3	v1.8.1
v3.0.9	v3.0.9	v1.7.11

Deploy Legacy Hybrid Gateways

tyk-hybrid chart is deprecated. Please use our Tyk Data Plane helm chart instead.We recommend that all users to migrate to the tyk-data-plane Chart. Please review the Configuration section of the new helm chart and cross-check with your existing configurations while planning for migration.

Add the Tyk official Helm repo tyk-helm to your local Helm repository

helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update

The helm charts are also available on ArtifactHub.

Then create a new namespace that will be hosting the Tyk Gateways

kubectl create namespace tyk

Get the default values.yaml for configuration

Before proceeding with installation of the chart we need to set some custom values. First save the full original values.yaml to a local copy:

helm show values tyk-helm/tyk-hybrid > values.yaml

Configure Tyk Gateway and its connection to Tyk Cloud

You need to modify the following values in your custom values.yaml file:

gateway.rpc.apiKey - Tyk Dashboard API Access Credentials of the user created earlier
gateway.rpc.rpcKey - Organization ID
gateway.rpc.connString - MDCB connection string
gateway.rpc.group_id(optional) - if you have multiple data plane (e.g. in different regions), specify the data plane group (string) to which the gateway you are deploying belong. The data planes in the same group share one Redis instance.
gateway.sharding.enabled and gateway.sharding.tags(optional) - you can enable sharding to selectively load APIs to specific gateways, using tags. By default, sharding is disabled and the gateway will load all APIs.

Configure the connection to Redis

You can connect the gateway to any Redis instance already deployed (as DBaaS or hosted in your private infrastructure). In case you don’t have a Redis instance yet, here’s how to deploy Redis in Kubernetes using Bitnami Helm charts.

helm install tyk-redis bitnami/redis -n tyk --version 19.0.2 --set image.repository=bitnamilegacy/redis

Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of supported versions.

Follow the notes from the installation output to get connection details and password.

  Redis(TM) can be accessed on the following DNS names from within your cluster:

    tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
    tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)

  export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)

You need to modify the following values in your custom values.yaml file:

redis.addrs: the name of the Redis instance including the port as set by Bitnami tyk-redis-master.tyk.svc.cluster.local:6379
redis.pass: password set in redis ($REDIS_PASSWORD). Alternatively, you can use —set flag to set it during helm installation. For example --set redis.pass=$REDIS_PASSWORD.

Install Hybrid data plane

Install the chart using the configured custom values file:

helm install tyk-hybrid tyk-helm/tyk-hybrid -f values.yaml -n tyk

You should see the prompt:

At this point, Tyk Hybrid is fully installed and should be accessible.

Check that the installation was successful

The hybrid data planes are not yet visible in Tyk Cloud (coming soon!). Here is how you can check that the deployment was successful. Run this command in your terminal to check that all pods in the tyk namespace are running:

kubectl get pods -n tyk

Expected result:

NAME                                  READY   STATUS    RESTARTS   AGE
gateway-tyk-hybrid-54b6c498f6-2xjvx   1/1     Running   0          4m27s
tyk-redis-master-0                    1/1     Running   0          47m
tyk-redis-replicas-0                  1/1     Running   0          47m
tyk-redis-replicas-1                  1/1     Running   0          46m
tyk-redis-replicas-2                  1/1     Running   0          46m

Note: if you are using a Redis instance hosted somewhere else, then no Redis pods will appear here. Run this command in your terminal to check that the services were correctly created:

kubectl get service -n tyk

Expected result:

NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
gateway-svc-tyk-hybrid   NodePort    10.96.232.123    <none>        443:32668/TCP   44m
tyk-redis-headless       ClusterIP   None             <none>        6379/TCP        47m
tyk-redis-master         ClusterIP   10.109.203.244   <none>        6379/TCP        47m
tyk-redis-replicas       ClusterIP   10.98.206.202    <none>        6379/TCP        47m

Note: IP adresses might differ on your system. Finally, from your terminal, send an HTTP call to the /hello endpoint of the gateway gateway-svc-tyk-hybrid: Note: you may need to port forward if you’re testing on a local machine, e.g. kubectl port-forward service/gateway-svc-tyk-hybrid -n tyk 8080:443

curl http://hostname:8080/hello -i

Expected result:

HTTP/1.1 200 OK
Content-Type: application/json
Date: Fri, 17 Mar 2023 10:35:35 GMT
Content-Length: 234

{
  "status":"pass",
  "version":"4.3.3",
  "description":"Tyk GW",
  "details":{
    "redis": {"status":"pass","componentType":"datastore","time":"2023-03-15T11:39:10Z"},
    "rpc": {"status":"pass","componentType":"system","time":"2023-03-15T11:39:10Z"}}
}

​Introduction

​Prerequisites

​Tyk Hybrid Gateway configuration

​Deploy with Docker

​Step 1: Clone and configure

​Step 2: Configure the Gateway connection to the control plane

​Step 3: Configure the Pump connection to the control plane

​Step 4: Start services

​Step 5: Verify the connection

​Deploy in Kubernetes with Helm Chart

​Remove hybrid data plane configuration

​Tyk Cloud MDCB Supported versions

​Deploy Legacy Hybrid Gateways

Introduction

Prerequisites

Tyk Hybrid Gateway configuration

Deploy with Docker

Step 1: Clone and configure

Step 2: Configure the Gateway connection to the control plane

Step 3: Configure the Pump connection to the control plane

Step 4: Start services

Step 5: Verify the connection

Deploy in Kubernetes with Helm Chart

Remove hybrid data plane configuration

Tyk Cloud MDCB Supported versions

Deploy Legacy Hybrid Gateways