> ## Documentation Index
> Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Tyk

> Deploy Tyk on Control Plane using the Template Catalog. An API gateway with authentication, rate limiting, quotas and analytics, backed by Redis Sentinel, with the admin API key held in a prerequisite secret and no public access by default.

## Overview

Tyk is an open-source API management platform that controls, secures, and monitors API traffic. This template deploys a Tyk Gateway workload on Control Plane alongside Redis and Redis Sentinel, which back the gateway's token, rate-limit, quota, and analytics storage.

Your API definitions and policies come from Control Plane secrets you control, and the Gateway Control API key — the credential that creates and revokes every API key on the gateway — comes from an [opaque secret](/guides/create-secret/opaque) you create before installing.

<Warning>
  **Version 1.3.0 is a security fix. Read [Upgrading From 1.2.1 or Earlier](#upgrading-from-1-2-1-or-earlier) before you upgrade.** Versions up to 1.2.1 shipped three defaults that compounded: the Gateway Control API key was the `values.yaml` value `mysecret`, `externalAccess` defaulted to `true` so that API was on the public internet, and `TYK_GW_ALLOWMASTERKEYS` was hardcoded to `true` so a key created with no `access_rights` reached every API on the gateway. One guessed word yielded a key to everything. In 1.3.0 the admin key moved to a prerequisite secret, external access defaults to off, master keys are a knob that defaults to off, and `internalAccess.type` now defaults to `same-gvc` instead of `none` — **those last three change the behavior of an existing install when you upgrade, and the internal-access change widens in-GVC reachability rather than narrowing it.**
</Warning>

<Note>
  This template does not create a GVC. You must deploy it into an existing GVC.
</Note>

### What Gets Created

* **Standard Tyk Gateway Workload** (`RELEASE_NAME-tyk-api-gateway`) — the gateway process, autoscaling between `minScale` and `maxScale` replicas on CPU. API definitions and policies are mounted from your secrets at startup.
* **Redis and Redis Sentinel** — the [Redis](/template-catalog/templates/redis) template (v3.4.2) is deployed as a subchart, creating a Redis workload, a Sentinel workload, their volume sets, their config and password secrets, and an identity and policy for each (`RELEASE_NAME-redis-identity`, `RELEASE_NAME-sentinel-identity`, `RELEASE_NAME-redis-policy`, `RELEASE_NAME-sentinel-policy`). The gateway connects through Sentinel, not to Redis directly.
* **Identity & Policy** — an identity (`RELEASE_NAME-tyk-identity`) bound to the gateway with `reveal` on exactly the secrets it mounts: your admin secret, your API and policy secrets when set, and the bundled Redis and Sentinel password secrets.
* **No template-created credential secret** — the admin API key lives only in the prerequisite secret you create.

## Prerequisites

**The admin secret must exist before you install**, and you will normally want the API and policy secrets too. All are referenced by name only, so none of their contents pass through Helm values or land in the release.

### 1. Admin API Key (Required)

This is `TYK_GW_SECRET`, the key for the Gateway Control API served under `/tyk/*` and sent as the `X-Tyk-Authorization` header. Whoever holds it can create, list, and revoke every API key on the gateway, so generate a strong random value:

```bash theme={null}
printf '%s' "$(openssl rand -hex 32)" | cpln secret create-opaque --name my-tyk-admin-secret --encoding plain -f -
```

Set `adminSecretName` to the name you used. The chart refuses to render without it.

### 2. API Definitions (Optional)

A [dictionary secret](/guides/create-secret/dictionary) whose keys are `*.json` filenames and whose values are Tyk API definitions, mounted at `/opt/tyk-gateway/apps`. Because the values are multi-line JSON, write a manifest and apply it:

```yaml theme={null}
kind: secret
name: my-tyk-apis
description: my-tyk-apis
tags: {}
type: dictionary
data:
  app1.json: >-
    { "api_id": "app1", "name": "app1", "org_id": "default", "use_keyless":
    true, "use_jwt": false, "disable_rate_limit": true, "definition": {
    "location": "header", "key": "version" }, "version_data": { "not_versioned":
    true, "versions": { "Default": { "name": "Default", "use_extended_paths":
    true } } }, "proxy": { "listen_path": "/app1", "target_url":
    "http://app1.example-gvc.cpln.local:80", "strip_listen_path": true },
    "active": true}
```

```bash theme={null}
cpln apply -f my-tyk-apis.yaml
```

Set `apiSecretName` to the name you used.

<Warning>
  **Leaving `apiSecretName` empty does not serve nothing — it serves Tyk's demo API.** With no definitions mounted, the gateway falls back to the API definitions baked into the upstream image and boots serving `Tyk Test API`. The install looks entirely healthy — the workload is ready and `/hello` reports `redis: pass` — while serving none of your APIs. Set the secret, or expect the vendor demo endpoint on your listener.
</Warning>

### 3. Policies (Optional)

An [opaque secret](/guides/create-secret/opaque) with encoding `plain`, holding a single JSON object of policies keyed by policy ID, mounted at `/opt/tyk-gateway/policies/policies.json`:

```yaml theme={null}
kind: secret
name: my-tyk-policies
description: my-tyk-policies
tags: {}
type: opaque
data:
  encoding: plain
  payload: |-
    {
      "app1-rate-limit": {
        "org_id": "default",
        "active": true,
        "rate": 20,
        "per": 100,
        "quota_max": 0,
        "quota_renewal_rate": 0,
        "quota_remaining": 0,
        "access_rights": {
          "app1": {
            "api_id": "app1",
            "api_name": "app1",
            "versions": ["Default"]
          }
        }
      }
    }
```

```bash theme={null}
cpln apply -f my-tyk-policies.yaml
```

Set `policySecretName` to the name you used, or leave it `""` to run with no policies. You can edit both secrets independently after install, as long as their names stay the same.

<Warning>
  **A missing prerequisite secret wedges the install rather than failing it.** `cpln helm install` still exits 0 and reports success, every resource is created, and the gateway then never becomes ready — with no container logs at all, because the container never started. The only place the reason appears is `cpln workload get-deployments RELEASE_NAME-tyk-api-gateway --gvc GVC_NAME`, as `The secret <name> no longer exists. Workload updates are paused until the secret is added or the reference to the secret removed.` Create the secrets first and check the deployment rather than trusting the Helm output.
</Warning>

## Installation

To install, follow the instructions for your preferred method:

<CardGroup cols={2}>
  <Card title="UI" href="/template-catalog/install-manage/ui" icon="laptop">
    Browse, install, and manage templates visually
  </Card>

  <Card title="CLI" href="/template-catalog/install-manage/cli" icon="terminal">
    Manage templates from your terminal
  </Card>

  <Card title="Terraform" href="/template-catalog/install-manage/terraform" icon={<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><g fill-rule="evenodd"><path d="M77.941 44.5v36.836L46.324 62.918V26.082zm0 0" fill="#5c4ee5"/><path d="M81.41 81.336l31.633-18.418V26.082L81.41 44.5zm0 0" fill="#4040b2"/><path d="M11.242 42.36L42.86 60.776V23.941L11.242 5.523zm0 0M77.941 85.375L46.324 66.957v36.82l31.617 18.418zm0 0" fill="#5c4ee5"/></g></svg>}>
    Declare templates in your Terraform configurations
  </Card>

  <Card
    title="Pulumi"
    href="/template-catalog/install-manage/pulumi"
    icon={<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" id="Pulumi-Icon--Streamline-Svg-Logos" height="24" width="24">
    <desc>
        Pulumi Icon Streamline Icon: https://streamlinehq.com
    </desc>
    <path fill="#f26e7e" d="M4.683025 13.3318c0.869125 -0.5018 0.870575 -2.1264 0.003225 -3.62865s-2.27504 -2.313275 -3.1441725 -1.811475C0.672945 8.3935 0.6715 10.0181 1.53885 11.52035c0.86735 1.502275 2.27505 2.313275 3.144175 1.81145Zm0.0052 3.2167c0.86735 1.502275 0.865925 3.126875 -0.003225 3.628675 -0.86915 0.5018 -2.2768275 -0.309225 -3.144175 -1.81145 -0.8673525 -1.50225 -0.8659075 -3.126875 0.003225 -3.628675 0.8691325 -0.5018 2.276825 0.309225 3.144175 1.81145Zm5.922875 3.4243c0.86735 1.50225 0.8659 3.126775 -0.003225 3.62875 -0.869125 0.501775 -2.27685 -0.309325 -3.1442 -1.81155 -0.867325 -1.50225 -0.865875 -3.12685 0.00325 -3.628675 0.869125 -0.5018 2.276825 0.309225 3.144175 1.811475Zm-0.001925 -6.845275c0.86735 1.50225 0.8659 3.12685 -0.003225 3.628675 -0.869125 0.5018 -2.276825 -0.309225 -3.144175 -1.811475 -0.86735 -1.50225 -0.8659 -3.12685 0.003225 -3.62865 0.869125 -0.501825 2.276825 0.3092 3.144175 1.81145Z" stroke-width="0.25"></path>
    <path fill="#8a3391" d="M22.45775 11.524125c0.86725 -1.502225 0.865925 -3.12685 -0.003225 -3.62865 -0.869125 -0.501825 -2.276825 0.3092 -3.144175 1.811475 -0.86735 1.50225 -0.8659 3.126825 0.003225 3.62865 0.869125 0.501825 2.276825 -0.3092 3.144175 -1.811475Zm0.000175 3.2151c0.869075 0.5018 0.870625 2.1264 0.003225 3.62865 -0.86735 1.50225 -2.27505 2.313275 -3.144175 1.81145 -0.869125 -0.5018 -0.870575 -2.126425 -0.003225 -3.62865 0.86735 -1.50225 2.27505 -2.313275 3.144175 -1.81145ZM16.536225 18.157875c0.86915 0.501825 0.8706 2.126425 0.00325 3.628675 -0.86735 1.502125 -2.275075 2.313225 -3.1442 1.81145 -0.869125 -0.50175 -0.870575 -2.126425 -0.003225 -3.62865 0.867375 -1.502275 2.27505 -2.3133 3.144175 -1.811475Zm-0.003325 -6.843775c0.869125 0.5018 0.870575 2.126425 0.003225 3.628675s-2.27505 2.313275 -3.1442 1.811475c-0.869125 -0.501825 -0.870575 -2.126425 -0.003225 -3.628675 0.86735 -1.502275 2.27505 -2.313275 3.1442 -1.811475Z" stroke-width="0.25"></path>
    <path fill="#f7bf2a" d="M15.138225 2.06721c0 1.003615 -1.40625 1.817215 -3.14095 1.817215 -1.7347 0 -3.14095 -0.8136 -3.14095 -1.817215C8.856325 1.06359 10.262575 0.25 11.997275 0.25c1.7347 0 3.14095 0.81359 3.14095 1.81721ZM9.2166 5.482375c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172s1.40625 -1.817225 3.14095 -1.817225c1.7347 0 3.14095 0.8136 3.14095 1.817225Zm8.71005 1.8172c1.7347 0 3.14095 -0.813575 3.14095 -1.8172s-1.40625 -1.817225 -3.14095 -1.817225c-1.7347 0 -3.14095 0.8136 -3.14095 1.817225s1.40625 1.8172 3.14095 1.8172Zm-2.788425 1.605625c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172 0 -1.0036 1.40625 -1.8172 3.14095 -1.8172 1.7347 0 3.14095 0.8136 3.14095 1.8172Z" stroke-width="0.25"></path>
    </svg>}
  >
    Declare templates in your Pulumi programs
  </Card>
</CardGroup>

## Configuration

The default `values.yaml` for this template:

```yaml theme={null}
image: tykio/tyk-gateway:v5.10.0

listenPort: 8080 # REQUIRED - the port the gateway listens on

# ─── Prerequisite secrets ─────────────────────────────────────────────────────
# All three must EXIST BEFORE INSTALL. See README Prerequisites for the exact
# `cpln secret create-*` commands.

# The admin secret is the Gateway Control API key (X-Tyk-Authorization on /tyk/*),
# which creates, lists and revokes API keys — so it never transits Helm values.
adminSecretName: my-tyk-admin-secret # REQUIRED - opaque secret (encoding: plain) holding the admin API key

# These two are OPTIONAL — set either to "" to omit it. But note what happens if
# you omit the APIs: the gateway falls back to the demo API definitions baked
# into the upstream image and will happily serve "Tyk Test API" instead of
# nothing, which looks like a working install until you notice it is not yours.
apiSecretName: my-tyk-apis # dictionary secret holding your API definition JSON files; "" = serve the image's demo APIs
policySecretName: my-tyk-policies # opaque secret holding your policies JSON; "" = no policies

# ─── Gateway ──────────────────────────────────────────────────────────────────
allowMasterKeys: false # true lets a key created with no access_rights reach EVERY API on this gateway

resources:
  cpu: 50m
  memory: 128Mi

autoscaling:
  maxScale: 3
  metric: cpu
  minScale: 1
  scaleToZeroDelay: 300
  target: 100

multiZone: false # OPTIONAL - Deploys replicas across multiple zones (confirm availability in your location)

# ─── Access ───────────────────────────────────────────────────────────────────
externalAccess: false # true publishes the gateway — INCLUDING its /tyk admin API — to the internet
internalAccess: # OPTIONAL - Sets the internal firewall scope
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list, e.g. //gvc/GVC_NAME/workload/WORKLOAD_NAME

# ─── Bundled Redis + Sentinel ─────────────────────────────────────────────────
# Tyk's token, rate-limit and analytics store. It serves this gateway only and is
# never reachable from outside the GVC, so the passwords are template plumbing —
# but they are used AS-IS, so change them before installing.
redis:
  redis:
    resources:
      cpu: 200m
      memory: 256Mi
    replicas: 2
    auth:
      password:
        enabled: true
        value: change-me-tyk-redis
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true
  sentinel:
    resources:
      cpu: 200m
      memory: 256Mi
    replicas: 3
    auth:
      password:
        enabled: true
        value: change-me-tyk-sentinel
    firewall:
      internal_inboundAllowType: same-gvc
    persistence:
      enabled: true
```

### API Definitions and Policies

* `apiSecretName` — name of the dictionary secret holding your API definitions. Each key is a JSON filename mounted at `/opt/tyk-gateway/apps`. Set to `""` to omit the mount — but see the demo-API warning in [Prerequisites](#2-api-definitions-optional).
* `policySecretName` — name of the opaque secret holding your policies JSON, mounted at `/opt/tyk-gateway/policies/policies.json`. Set to `""` to run with no policies.
* `listenPort` — the port the gateway listens on. Control Plane reserves a set of container ports; the chart refuses to render on one of them rather than letting the workload be rejected at apply time.

Both secrets are read at boot. After editing either one, redeploy the gateway workload or call `/tyk/reload` for the change to take effect.

### Master Keys

* `allowMasterKeys` — when `true`, a key created through `/tyk/keys` with no `access_rights` section can call **every** API on this gateway. **Defaults to `false`**, matching upstream Tyk.

<Warning>
  **This default changed in 1.3.0 and it will break key-creation requests that used to work.** Versions up to 1.2.1 hardcoded master keys on, so any request that POSTed a bare session object was silently granted blanket access. With `allowMasterKeys: false`, the same request is refused — the exact response depends on the endpoint:

  | Request                                                  | Response                                                                              |
  | -------------------------------------------------------- | ------------------------------------------------------------------------------------- |
  | `POST /tyk/keys/create` with `"access_rights": {}`       | `400` — `Failed to create key, keys must have at least one Access Rights record set.` |
  | `POST /tyk/keys/{custom-key}` with `"access_rights": {}` | `500` — `Failed to create key, ensure security settings are correct.`                 |

  In both cases the gateway logs the real reason: `Master keys disallowed in configuration, key not added.` with `err="master keys disabled"`. The fix is to give each key an `access_rights` entry naming the APIs it may reach; setting `allowMasterKeys: true` restores the old behavior and the old exposure.
</Warning>

### Access

* `externalAccess` — when `true`, the gateway's external inbound firewall opens to `0.0.0.0/0` and Control Plane assigns a `*.cpln.app` canonical endpoint. **Defaults to `false`.**
* `internalAccess.type` — which workloads inside Control Plane may reach the gateway. **Defaults to `same-gvc`.**
* `internalAccess.workloads` — list of workload links, used only when `type` is `workload-list`.

| Type            | Description                                                               |
| --------------- | ------------------------------------------------------------------------- |
| `none`          | No internal access allowed                                                |
| `same-gvc`      | Allow access from all workloads in the same GVC                           |
| `same-org`      | Allow access from all workloads in the same organization                  |
| `workload-list` | Allow access only from the workloads listed in `internalAccess.workloads` |

<Warning>
  **`externalAccess: true` puts the Tyk admin API on the public internet.** `/tyk/*` is served on the same port as your proxied APIs and cannot be split onto another listener, so publishing the gateway publishes its key-management API with it and the admin secret becomes the only thing in front of it. Prefer leaving it `false` and reaching the gateway from inside the GVC.
</Warning>

<Note>
  Setting `externalAccess: false` together with `internalAccess.type: none` would leave nothing able to reach the gateway, so the chart fails the render with a message naming both knobs instead of installing something unreachable.

  **An access change takes up to a couple of minutes to take effect.** Enabling external access was measured at 30 seconds from upgrade to the first `200`, and closing internal access at about 32 seconds; re-poll before concluding a knob did nothing. Note that a request blocked by the internal firewall **times out** rather than returning `403` — a hang is what a correctly closed internal firewall looks like here, not a sign that the gateway is down.
</Note>

### Resources and Autoscaling

* `resources.cpu` / `resources.memory` — CPU and memory allocated to the gateway workload.
* `autoscaling.minScale` / `autoscaling.maxScale` — minimum and maximum number of gateway replicas.
* `autoscaling.metric` — scaling metric (`cpu` by default).
* `autoscaling.target` — target metric value that triggers a scale-up.
* `autoscaling.scaleToZeroDelay` — seconds of inactivity before scaling to zero (only applies when `minScale` is `0`).
* `multiZone` — when `true`, spreads replicas across availability zones within the location.

### Redis and Sentinel

The bundled Redis is configured under the `redis` key; see the [Redis template](/template-catalog/templates/redis) for full configuration details.

* `redis.redis.replicas` — number of Redis replicas.
* `redis.sentinel.replicas` — number of Sentinel replicas; 3 is the default and the recommended minimum for failover.
* `redis.redis.persistence.enabled` / `redis.sentinel.persistence.enabled` — persist data and Sentinel state to volume sets.
* `redis.redis.auth.password.value` / `redis.sentinel.auth.password.value` — the Redis and Sentinel passwords.

This Redis serves only this gateway and is never reachable from outside the GVC, so its passwords remain Helm values rather than prerequisite secrets. **They are used exactly as written**, so replace both `change-me-…` placeholders before installing.

### Outbound Connectivity

The gateway ships with an empty outbound firewall (`outboundAllowCIDR: []`), so it cannot open connections to the public internet.

<Warning>
  **Every API's `target_url` must point at an upstream inside the same GVC**, addressed over internal DNS — for example `http://my-app.GVC_NAME.cpln.local:8080`. GVC-internal traffic is governed by the destination workload's internal firewall rather than by the gateway's egress, so in-GVC proxying works normally with egress closed. To proxy to an API on the public internet, add `outboundAllowCIDR` or `outboundAllowHostname` to the gateway workload; there is no value for it in the chart.
</Warning>

## Connecting

| Path               | Address                                                                                          | Notes                                                                                                                                                               |
| ------------------ | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Public gateway     | `https://CANONICAL_ENDPOINT`                                                                     | Only when `externalAccess` is `true`. Read the endpoint from `status.canonicalEndpoint` in `cpln workload get RELEASE_NAME-tyk-api-gateway --gvc GVC_NAME -o yaml`. |
| Internal gateway   | `http://RELEASE_NAME-tyk-api-gateway.GVC_NAME.cpln.local:8080`                                   | Subject to `internalAccess.type`. Use `listenPort` if you changed it.                                                                                               |
| Proxied API        | `GATEWAY_ADDRESS/LISTEN_PATH`                                                                    | `listen_path` comes from each API definition, e.g. `/app1`.                                                                                                         |
| Admin API          | `GATEWAY_ADDRESS/tyk/keys`, `/tyk/apis`, `/tyk/reload`                                           | Send the header `X-Tyk-Authorization` set to the payload of your `adminSecretName` secret.                                                                          |
| Health check       | `GATEWAY_ADDRESS/hello`                                                                          | Reports gateway version and Redis connectivity.                                                                                                                     |
| Redis and Sentinel | `RELEASE_NAME-redis.GVC_NAME.cpln.local:6379`, `RELEASE_NAME-sentinel.GVC_NAME.cpln.local:26379` | Internal only; passwords are the `redis.*.auth.password.value` values.                                                                                              |

Reveal the admin key when you need it:

```bash theme={null}
cpln secret reveal my-tyk-admin-secret
```

### Ports

| Port   | Protocol | Description                                 |
| ------ | -------- | ------------------------------------------- |
| `8080` | HTTP     | API traffic and the admin API under `/tyk/` |

## Upgrading From 1.2.1 or Earlier

<Warning>
  **Three defaults change behavior on upgrade: the gateway stops being reachable from the internet, key-creation requests without `access_rights` start failing, and the internal firewall opens from `none` to `same-gvc` so every workload in the GVC can now reach the gateway.** None is a fault; all three will surprise you if you have not planned for them — set `internalAccess.type` explicitly if you want the old, closed behavior.
</Warning>

| Behavior                     | 1.2.1 and earlier                             | 1.3.0                                                                |
| ---------------------------- | --------------------------------------------- | -------------------------------------------------------------------- |
| Admin API key                | `adminSecret` value, defaulting to `mysecret` | `adminSecretName`, naming an opaque secret you create                |
| External access              | `externalAccess`, defaulting to `true`        | `externalAccess`, defaulting to `false`                              |
| Internal access              | `internalAccess.type`, defaulting to `none`   | `internalAccess.type`, defaulting to `same-gvc`                      |
| Master keys                  | Hardcoded on, no knob                         | `allowMasterKeys`, defaulting to `false`                             |
| Redis and Sentinel passwords | `myRedisPassword` / `mySentinelPassword`      | `change-me-tyk-redis` / `change-me-tyk-sentinel` placeholders        |
| Chart-created secret         | A dictionary secret holding the admin key     | None for the admin key — only the bundled Redis and Sentinel secrets |

What to do before upgrading:

<Steps>
  <Step title="Create the admin key secret">
    The gateway will not start without it. Use a freshly generated value rather than carrying `mysecret` forward — it has been published in a public repository for the life of the earlier versions, and any key minted with it should be considered compromised:

    ```bash theme={null}
    printf '%s' "$(openssl rand -hex 32)" | cpln secret create-opaque --name my-tyk-admin-secret --encoding plain -f -
    ```

    Set `adminSecretName` to that name and remove `adminSecret` from your values — it no longer exists in the chart. Every client calling `/tyk/*` needs the new value in its `X-Tyk-Authorization` header.
  </Step>

  <Step title="Decide whether the gateway should stay public">
    If clients outside Control Plane call your APIs, set `externalAccess: true` explicitly — and understand that this also republishes `/tyk/*`. If every caller is inside the GVC, do nothing and the default `same-gvc` covers them.
  </Step>

  <Step title="Audit any key created without access rights">
    Under the old hardcoded setting, such keys reach every API on the gateway. List them with `GET /tyk/keys`, then reissue each one with an `access_rights` entry naming only the APIs it needs. Requests that create bare keys now fail — see [Master Keys](#master-keys) for the exact responses.
  </Step>

  <Step title="Set the Redis and Sentinel passwords">
    The placeholder defaults are used verbatim if you leave them, so set both `redis.redis.auth.password.value` and `redis.sentinel.auth.password.value` to values of your own.
  </Step>
</Steps>

## Important Notes

* **Create the admin secret before installing.** A missing secret does not fail the install — Helm reports success and the gateway then sits at zero replicas with no container logs at all.
* **`externalAccess: true` publishes the admin API**, because `/tyk/*` shares the listener with your proxied APIs. The admin secret is then the only control in front of key creation and revocation.
* **`allowMasterKeys: true` grants blanket access.** Any key created without `access_rights` reaches every API on the gateway. Leave it `false` unless you have a specific reason.
* **Leaving `apiSecretName` empty serves Tyk's demo API**, not an empty gateway. The install looks healthy while none of your APIs are loaded.
* **Egress is closed**, so every `target_url` must resolve to an in-GVC `*.cpln.local` host.
* **Change the bundled Redis and Sentinel passwords** — they ship as `change-me-…` placeholders and are used exactly as written.
* **The gateway declares no health probes, so `ready: true` arrives before it can serve.** A workload was ready roughly 30 seconds before it had connected to Redis, logging `storage: Redis is either down or was not configured` in between. Use `GET /hello` and check that `redis` reports `pass` rather than trusting the readiness signal, and expect the same gap when an autoscaled replica starts.
* **Access changes take up to a couple of minutes to propagate.** A change that appears to do nothing has usually just not settled yet.
* **The first `helm upgrade` after an install restarts the bundled Redis**, briefly interrupting rate-limit and key lookups even when nothing changed. Later no-op upgrades do not.
* **The prerequisite secrets are not owned by the release** — your admin, API, and policy secrets survive `cpln helm uninstall` and must be deleted manually if you no longer need them.

## External References

<CardGroup cols={2}>
  <Card title="Tyk Gateway Documentation" icon="book" href="https://tyk.io/docs/">
    Official Tyk API Gateway documentation
  </Card>

  <Card title="Gateway Configuration Options" icon="gear" href="https://tyk.io/docs/tyk-oss-gateway/configuration/">
    Every gateway setting and its environment-variable name
  </Card>

  <Card title="Gateway Control API" icon="code" href="https://tyk.io/docs/api-management/gateway-config-managing-classic/">
    Reference for the admin endpoints under /tyk/
  </Card>

  <Card title="API Definition Objects" icon="file-code" href="https://tyk.io/docs/api-management/gateway-config-tyk-classic/">
    Reference for the API definition JSON structure
  </Card>

  <Card title="Security Policies" icon="shield" href="https://tyk.io/docs/api-management/policies/">
    Guide for configuring Tyk access policies
  </Card>

  <Card title="Tyk Template" icon="github" href="https://github.com/controlplane-com/templates/tree/main/tyk">
    View the source files, default values, and chart definition
  </Card>
</CardGroup>