> ## Documentation Index
> Fetch the complete documentation index at: https://tyk.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Tyk Self-Managed on Kubernetes

> Install the full Tyk Self-Managed stack (Gateway, Dashboard, Portal, Pump, Operator, Redis, and PostgreSQL) on Kubernetes using Helm.

| Edition    | Deployment Type      |
| :--------- | :------------------- |
| Enterprise | Self-Managed, Hybrid |

<Note>
  Running on Podman, containerd, or another container runtime? See [Container Runtimes](/docs/deployment-and-operations/container-runtimes).
</Note>

## Compatible Kubernetes Versions

1.33.x, 1.34.x, 1.35.x

## Prerequisites

* A running Kubernetes cluster. This can be local (minikube, kind, or Docker Desktop) or a managed cloud cluster (EKS, GKE, or AKS).
* [kubectl](https://kubernetes.io/docs/tasks/tools/) installed and connected to your cluster.
* [Helm](https://helm.sh/docs/intro/install/) 3.12 or later.
* Tyk license keys. The Dashboard license is required; the Operator and Portal licenses are optional. Get a free trial at [tyk.io/self-managed-trial](https://tyk.io/self-managed-trial/).
* 4GB RAM or more available to the cluster.

## Instructions

This guide deploys the full Tyk stack with the opinionated, trial-ready configuration from the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository. The bundled `values.yaml` enables Pump analytics to PostgreSQL, audit logging, hashed-key listing, OPA, and Dashboard security defaults out of the box.

### Step 1: Clone and Configure

1. Clone the [tyk-install](https://github.com/TykTechnologies/tyk-install) repository and navigate to the Kubernetes self-managed directory:

   ```bash theme={null}
   git clone https://github.com/TykTechnologies/tyk-install
   cd tyk-install/kubernetes/helm-self-managed
   ```

2. Copy the example environment file and add your license keys:

   ```bash theme={null}
   cp .env.example .env
   ```

3. Open `.env` and set your license key:

   ```bash theme={null}
   TYK_LICENSE_KEY=<your-dashboard-license>
   TYK_OPERATOR_LICENSE=<your-operator-license>
   TYK_PORTAL_LICENSE=<your-portal-license>
   ```

4. Load the environment variables into your shell:

   ```bash theme={null}
   source .env
   ```

### Step 2: Create the Namespace and Secrets

The secrets store your licenses, the shared API secret, database connection strings, and the bootstrap admin user. The values come from the `.env` file you loaded in Step 1.

```bash theme={null}
# Create the namespace
kubectl create namespace tyk

# Create the main Tyk secret
kubectl create secret generic tyk-conf \
  --namespace tyk \
  --from-literal=APISecret=$TYK_API_SECRET \
  --from-literal=AdminSecret=$TYK_ADMIN_SECRET \
  --from-literal=DashLicense=$TYK_LICENSE_KEY \
  --from-literal=OperatorLicense=$TYK_OPERATOR_LICENSE \
  --from-literal=DevPortalLicense=$TYK_PORTAL_LICENSE \
  --from-literal=adminUserFirstName=$ADMIN_FIRST_NAME \
  --from-literal=adminUserLastName=$ADMIN_LAST_NAME \
  --from-literal=adminUserEmail=$ADMIN_EMAIL \
  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
  --from-literal=DashDatabaseConnectionString="$DashDatabaseConnectionString" \
  --from-literal=DevPortalDatabaseConnectionString="$DevPortalDatabaseConnectionString"

# Create the Developer Portal secret
kubectl create secret generic secrets-tyk-tyk-dev-portal \
  --namespace tyk \
  --from-literal=adminUserPassword=$ADMIN_PASSWORD \
  --from-literal=adminUserEmail=$ADMIN_EMAIL
```

### Step 3: Install Dependencies

Install PostgreSQL and Redis from Bitnami, wait for them to become ready, then install cert-manager (required by the Tyk Operator).

```bash theme={null}
# Add the Bitnami repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Install PostgreSQL (also creates the portal database)
helm install tyk-postgres bitnami/postgresql \
  --namespace tyk \
  --set image.repository=bitnamilegacy/postgresql \
  --set auth.username=$POSTGRES_USER \
  --set auth.password=$POSTGRES_PASSWORD \
  --set auth.database=$POSTGRES_DB \
  --set primary.initdb.scripts."init\.sql"="CREATE DATABASE portal;" \
  --set primary.persistence.size=20Gi \
  --version 12.12.10

# Install Redis
helm install tyk-redis oci://registry-1.docker.io/bitnamicharts/redis \
  --namespace tyk \
  --set image.repository=bitnamilegacy/redis \
  --set auth.enabled=false \
  --version 19.0.2

# Wait for the databases to be ready (about 2 minutes)
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql -n tyk
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=redis -n tyk

# Install cert-manager (required for the Tyk Operator)
helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.17.4 \
  --set crds.enabled=true
```

<Note>
  Waiting for PostgreSQL and Redis to report ready before installing Tyk prevents the Gateway, Dashboard, and Pump pods from entering `CrashLoopBackOff` while they wait for a database connection.
</Note>

### Step 4: Install the Tyk Stack

```bash theme={null}
# Add the Tyk Helm repository
helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update

# Install Tyk with the bundled values file
helm install tyk tyk-helm/tyk-stack \
  --namespace tyk \
  --values values.yaml

# Watch the pods come up (press Ctrl+C once all are Running or Completed)
kubectl get pods -n tyk -w
```

Expected pods:

| Pod                    | Status  |
| ---------------------- | ------- |
| `gateway-xxx`          | Running |
| `dashboard-xxx`        | Running |
| `tyk-pump-xxx`         | Running |
| `tyk-portal-xxx`       | Running |
| `tyk-postgres-xxx`     | Running |
| `tyk-redis-xxx`        | Running |
| `tyk-tyk-operator-xxx` | Running |

### Step 5: Access the Services

The bundled `values.yaml` sets the Gateway, Dashboard, and Portal services to `LoadBalancer`. Choose the access method that matches your environment.

**Local cluster (port-forward):** the quickest way to reach the services on a local cluster. Run each command in a separate terminal:

```bash theme={null}
kubectl port-forward -n tyk svc/dashboard-svc-tyk-tyk-dashboard 3000:3000
kubectl port-forward -n tyk svc/gateway-svc-tyk-tyk-gateway 8080:8080
kubectl port-forward -n tyk svc/dev-portal-svc-tyk-tyk-dev-portal 3001:3001
```

**Cloud cluster (LoadBalancer):** EKS, GKE, and AKS provision an external address for each service. List them and wait for `EXTERNAL-IP` to be assigned:

```bash theme={null}
kubectl get svc -n tyk
```

For production setups with custom domains and TLS, configure Ingress (AWS ALB, GKE GCE, AKS Application Gateway, or NGINX). See the [helm-self-managed README](https://github.com/TykTechnologies/tyk-install/tree/main/kubernetes/helm-self-managed) for per-provider Ingress configuration.

### Step 6: Get Admin Credentials

The chart bootstraps the admin user from the `tyk-conf` secret. Retrieve the credentials to log in to the Tyk Dashboard:

```bash theme={null}
# Admin email
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserEmail}' | base64 -d && echo

# Admin password
kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.adminUserPassword}' | base64 -d && echo
```

### Step 7: Verify the Installation

Test that all components are responding (adjust the host if you are not using port-forward):

```bash theme={null}
# Gateway
curl http://localhost:8080/hello

# Dashboard
curl http://localhost:3000/hello

# Portal
curl http://localhost:3001/ready
```

You are now ready to [create an API](/docs/api-management/gateway-config-managing-classic#create-an-api), or manage APIs declaratively with [Tyk Operator](/docs/api-management/automations/operator), which is installed as part of this stack.

## Configuration

Two files control the deployment:

| File          | Purpose                                                                                   |
| ------------- | ----------------------------------------------------------------------------------------- |
| `.env`        | License keys, the shared API secret, database credentials, and the bootstrap admin user.  |
| `values.yaml` | Tyk stack configuration for the Gateway, Dashboard, Pump, Developer Portal, and Operator. |

The bundled `values.yaml` is tuned for trials and evaluation, with Pump analytics to PostgreSQL, audit logging, hashed-key listing, OPA, and Dashboard security settings enabled. Inline comments mark the options to change for production and performance. For production deployments, also review the [Planning for Production](/docs/planning-for-production) guide and the [helm-self-managed README](https://github.com/TykTechnologies/tyk-install/tree/main/kubernetes/helm-self-managed) for Ingress, TLS, autoscaling, and troubleshooting.

### Hybrid Control Plane and Data Plane

The installation above deploys a single, self-contained Tyk stack. To distribute API traffic across multiple data centers or regions, you can instead run a hybrid topology: a central Control Plane that hosts the management components and one or more remote Data Planes whose Gateways serve traffic locally and sync configuration from the Control Plane over [Tyk MDCB](/docs/api-management/mdcb).

To set up a hybrid deployment with Helm:

* Install the [Control Plane](/docs/api-management/mdcb#installing-in-a-kubernetes-cluster-with-our-helm-chart) first to provision the Dashboard, MDCB, and supporting services.
* Install each [Data Plane](/docs/api-management/mdcb#installing-in-a-kubernetes-cluster-with-our-helm-chart-1) using the connection details produced by the Control Plane installation.

## Cleanup

```bash theme={null}
# Remove the Tyk stack
helm uninstall tyk -n tyk

# Remove the databases (this deletes all data)
helm uninstall tyk-postgres -n tyk
helm uninstall tyk-redis -n tyk

# Remove secrets and persistent volume claims
kubectl delete secrets -n tyk --all
kubectl delete pvc -n tyk --all

# Delete the namespace
kubectl delete namespace tyk
```

To remove cert-manager (only if you installed it specifically for Tyk):

```bash theme={null}
kubectl delete namespace cert-manager
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Pods Not Starting">
    Pods fail to initialize or remain in a pending state.

    ```bash theme={null}
    # Check pod details
    kubectl describe pod -n tyk <pod-name>

    # Check recent events
    kubectl get events -n tyk --sort-by='.lastTimestamp' | tail -20

    # Check pod logs
    kubectl logs -n tyk <pod-name>
    ```
  </Accordion>

  <Accordion title="Secret Issues">
    Missing or incorrectly configured Kubernetes secrets prevent proper authentication and configuration.

    ```bash theme={null}
    # Verify the secret exists and has all required keys
    kubectl get secret tyk-conf -n tyk -oyaml

    # Decode and verify specific values
    kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d && echo
    kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo

    # If the secret is missing or incorrect, recreate it
    kubectl delete secret tyk-conf -n tyk
    # Re-export the environment variables and run Step 3 again
    source .env
    ```
  </Accordion>

  <Accordion title="Portal Login Returns &#x22;Bad Request&#x22;">
    Developer Portal authentication fails with a bad request error.

    Set `PORTAL_DISABLECSRFCHECK=true` in `values.yaml` under `tyk-dev-portal.extraEnvs`. This is needed when accessing the Developer Portal via HTTP or a LoadBalancer IP. Set it to `false` when using a proper domain with TLS and Ingress.
  </Accordion>

  <Accordion title="Database Connection Issues">
    The Developer Portal or Tyk Dashboard cannot connect to the PostgreSQL database.

    ```bash theme={null}
    # Check PostgreSQL is running
    kubectl get pods -n tyk -l app.kubernetes.io/name=postgresql

    # Test database connectivity from a pod
    kubectl exec -it -n tyk deployment/dashboard-tyk-tyk-dashboard -- /bin/sh
    # Inside the pod:
    env | grep DATABASE

    # Verify the connection string format in the secret
    kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashDatabaseConnectionString}' | base64 -d && echo
    # Expected format: postgresql://user:password@host:5432/database

    # Check PostgreSQL logs
    kubectl logs -n tyk -l app.kubernetes.io/name=postgresql
    ```
  </Accordion>

  <Accordion title="License Key Issues">
    The Tyk Dashboard or other components fail due to a missing or invalid license key.

    ```bash theme={null}
    # Verify the license key is set
    kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.DashLicense}' | base64 -d && echo

    # Check Dashboard logs for license errors
    kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100 | grep -i license

    # Check license expiration in the Tyk Dashboard:
    # Settings > License
    ```
  </Accordion>

  <Accordion title="Gateway Not Loading APIs">
    Tyk Gateway fails to retrieve or display API definitions from the Tyk Dashboard.

    ```bash theme={null}
    # Check the Gateway is connected to the Dashboard
    kubectl logs -n tyk -l app=gateway-tyk-tyk-gateway --tail=100

    # Force a Gateway reload (using APISecret for auth)
    API_SECRET=$(kubectl get secret tyk-conf -n tyk -o jsonpath='{.data.APISecret}' | base64 -d)
    curl -X GET http://localhost:8080/tyk/reload \
      -H "X-Tyk-Authorization: $API_SECRET"

    # Confirm the APIs are published in the Dashboard:
    # APIs > check the "Published" status
    ```
  </Accordion>

  <Accordion title="Dashboard Not Accessible">
    The Tyk Dashboard web interface is unavailable or unreachable.

    ```bash theme={null}
    # Check Dashboard pod status
    kubectl get pods -n tyk -l app=dashboard-tyk-tyk-dashboard

    # Check the Dashboard service
    kubectl get svc -n tyk | grep dashboard

    # Check Dashboard logs
    kubectl logs -n tyk -l app=dashboard-tyk-tyk-dashboard --tail=100

    # If using a LoadBalancer, verify an external IP is assigned
    kubectl get svc -n tyk dashboard-svc-tyk-tyk-dashboard

    # If using Ingress, verify the ingress is created
    kubectl get ingress -n tyk
    kubectl describe ingress -n tyk <dashboard-ingress-name>
    ```
  </Accordion>

  <Accordion title="Operator Issues">
    Tyk Operator fails to start or manage custom resources.

    ```bash theme={null}
    # Check the operator pod is running
    kubectl get pods -n tyk -l control-plane=tyk-operator-controller-manager

    # Check operator logs
    kubectl logs -n tyk -l control-plane=tyk-operator-controller-manager --tail=100

    # Verify the operator secret exists
    kubectl get secret tyk-operator-conf -n tyk

    # Check the CRDs are installed
    kubectl get crds | grep tyk
    ```
  </Accordion>

  <Accordion title="Ingress Not Working">
    Ingress routes fail to direct traffic to the services.

    ```bash theme={null}
    # Verify the ingress controller is installed
    kubectl get pods -n kube-system | grep ingress  # For NGINX
    kubectl get pods -n kube-system | grep aws-load-balancer  # For AWS LB Controller

    # Check the ingress resource
    kubectl get ingress -n tyk
    kubectl describe ingress -n tyk <ingress-name>

    # For AWS ALB, check the AWS console for ALB creation
    # For GKE, check the Google Cloud console for the Load Balancer

    # Verify DNS is pointing to the ingress address
    nslookup gateway.yourdomain.com
    ```
  </Accordion>
</AccordionGroup>

## Legacy Helm Chart

<Warning>
  `tyk-pro` chart is deprecated. Please use our [Tyk Stack helm chart](/docs/product-stack/tyk-charts/tyk-stack-chart) instead.

  We recommend all users migrate to the `tyk-stack` Chart. Please review the [Configuration](/docs/product-stack/tyk-charts/tyk-stack-chart) section of the new helm chart and cross-check with your existing configurations while planning for migration.
</Warning>

Tyk Helm chart is the preferred (and easiest) way to install **Tyk Self-Managed** on Kubernetes.
The helm chart `tyk-helm/tyk-pro` will install full Tyk platform with **Tyk Manager**, **Tyk Gateways** and **Tyk Pump** into your Kubernetes cluster. You can also choose to enable the installation of **Tyk Operator** (to manage your APIs in a declarative way).

### Prerequisites

1. **Tyk License**

   If you are evaluating Tyk on Kubernetes, [contact us](https://tyk.io/about/contact/) to obtain a temporary license.

2. **Data stores**

   The following are required for a Tyk Self-Managed installation:

   * Redis   - Should be installed in the cluster or reachable from inside the cluster (for SaaS option).
     You can find instructions for a simple Redis installation bellow.
   * MongoDB or SQL - Should be installed in the cluster or be reachable by the **Tyk Manager** (for SaaS option).

   You can find supported MongoDB and SQL versions [here](/docs/planning-for-production/database-settings).

   Installation instructions for Redis and MongoDB/SQL are detailed below.

3. **Helm**

   Installed [Helm 3](https://helm.sh/)
   Tyk Helm Chart is using Helm v3 version (i.e. not Helm v2).

### Installing the data stores

For Redis, MongoDB or SQL you can use these rather excellent charts provided by Bitnami

<Tabs>
  <Tab title="Redis">
    <br />

    ```bash theme={null}
    helm install tyk-redis bitnami/redis -n tyk --version 19.0.2
    ```

    <Note>
      Please make sure you are installing Redis versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/docs/planning-for-production/database-settings#redis).
    </Note>

    Follow the notes from the installation output to get connection details and password.

    ```console theme={null}
      Redis(TM) can be accessed on the following DNS names from within your cluster:

        tyk-redis-master.tyk.svc.cluster.local for read/write operations (port 6379)
        tyk-redis-replicas.tyk.svc.cluster.local for read-only operations (port 6379)

      export REDIS_PASSWORD=$(kubectl get secret --namespace tyk tyk-redis -o jsonpath="{.data.redis-password}" | base64 --decode)
    ```

    The DNS name of your Redis as set by Bitnami is `tyk-redis-master.tyk.svc.cluster.local:6379` (Tyk needs the name including the port)
    You can update them in your local `values.yaml` file under `redis.addrs` and `redis.pass`
    Alternatively, you can use `--set` flag to set it in Tyk installation. For example  `--set redis.pass=$REDIS_PASSWORD`
  </Tab>

  <Tab title="MongoDB">
    <br />

    ```bash theme={null}
    helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3
    ```

    <Note>
      Bitnami MongoDB images is not supported on darwin/arm64 architecture.
    </Note>

    Follow the notes from the installation output to get connection details and password. The DNS name of your MongoDB as set with Bitnami is `tyk-mongo-mongodb.tyk.svc.cluster.local` and you also need to set the `authSource` parameter to `admin`. The full `mongoURL` should be similar to `mongoURL: mongodb://root:pass@tyk-mongo-mongodb.tyk.svc.cluster.local:27017/tyk_analytics?authSource=admin`. You can update them in your local `values.yaml` file under `mongo.mongoURL` Alternatively, you can use `--set` flag to set it in your Tyk installation.

    <Note>
      **Important Note regarding MongoDB**

      This Helm chart enables the *PodDisruptionBudget* for MongoDB with an arbiter replica-count of 1. If you intend to perform
      system maintenance on the node where the MongoDB pod is running and this maintenance requires for the node to be drained,
      this action will be prevented due the replica count being 1. Increase the replica count in the helm chart deployment to
      a minimum of 2 to remedy this issue.
    </Note>
  </Tab>

  <Tab title="SQL">
    <br />

    ```bash theme={null}
    helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10
    ```

    <Note>
      Please make sure you are installing PostgreSQL versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/docs/tyk-self-managed/install#requirements).
    </Note>

    Follow the notes from the installation output to get connection details and password. The DNS name of your Postgres service as set by Bitnami is `tyk-postgres-postgresql.tyk.svc.cluster.local`.
    You can update connection details in `values.yaml` file under `postgres`.
  </Tab>
</Tabs>

***

**Quick Redis and MongoDB PoC installation**

<Warning>
  Another option for Redis and MongoDB, to get started quickly, is to use our **simple-redis** and **simple-mongodb** charts.
  Please note that these provided charts must not ever be used in production and for anything
  but a quick start evaluation only. Use external redis or Official Redis Helm chart in any other case.
  We provide this chart, so you can quickly get up and running, however it is not meant for long term storage of data for example.

  ```bash theme={null}
  helm install redis tyk-helm/simple-redis -n tyk
  helm install mongo tyk-helm/simple-mongodb -n tyk
  ```
</Warning>

### Instructions

As well as our official Helm repo, you can also find it in [ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-pro).
[Open in ArtifactHub](https://artifacthub.io/packages/helm/tyk-helm/tyk-pro)

If you are interested in contributing to our charts, suggesting changes, creating PRs or any other way,
please use [GitHub Tyk-helm-chart repo](https://github.com/TykTechnologies/tyk-helm-chart/tree/master/tyk-pro)
or contact us in [Tyk Community forum](https://community.tyk.io/) or through our sales team.

1. **Add Tyk official Helm repo to your local Helm repository**

   ```bash theme={null}
   helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
   helm repo update
   ```

2. **Create namespace for your Tyk deployment**

   ```bash theme={null}
   kubectl create namespace tyk
   ```

3. **Getting the values.yaml of the chart**

   Before we proceed with installation of the chart you need to set some custom values.
   To see what options are configurable on a chart and save that options to a custom values.yaml file run:

   ```bash theme={null}
   helm show values tyk-helm/tyk-pro > values.yaml
   ```

4. **License setting**

   For the **Tyk Self-Managed** chart we need to set the license key in your custom `values.yaml` file under `dash.license` field
   or use `--set dash.license={YOUR-LICENSE_KEY}` with the `helm install` command.

   Tyk Self-Managed licensing allow for different numbers of Gateway nodes to connect to a single Dashboard instance.
   To ensure that your Gateway pods will not scale beyond your license allowance, please ensure that the Gateway's resource kind is `Deployment`
   and the replica count to your license node limit. By default, the chart is configured to work with a single node license: `gateway.kind=Deployment` and `gateway.replicaCount=1`.

   <Note>
     **Please Note**

     There may be intermittent issues on the new pods during the rolling update process, when the total number of online
     gateway pods is more than the license limit with lower amounts of Licensed nodes.
   </Note>

5. **Installing Tyk Self managed**

   Now we can install the chart using our custom values:

   ```bash theme={null}
   helm install tyk-pro tyk-helm/tyk-pro -f ./values.yaml -n tyk --wait
   ```

   <Note>
     **Important Note regarding MongoDB**

     The `--wait` argument is important to successfully complete the bootstrap of your **Tyk Manager**.
   </Note>

### Pump Installation

By default pump installation is disabled. You can enable it by setting `pump.enabled` to `true` in `values.yaml` file.
Alternatively, you can use `--set pump.enabled=true` while doing helm install.

**Quick Pump configuration(Supported from tyk helm v0.10.0)**

1. **Mongo Pump**

   To configure mongo pump, do following changings in `values.yaml` file:

   1. Set `backend` to `mongo`.
   2. Set connection string in `mongo.mongoURL`.

2. **Postgres Pump**

   To configure postgres pump, do following changings in `values.yaml` file:

   1. Set `backend` to `postgres`.
   2. Set connection string parameters in `postgres` section.

### Tyk Developer Portal

You can disable the bootstrapping of the Developer Portal by the `portal.bootstrap: false` in your local `values.yaml` file.

### Using TLS

You can turn on the TLS option under the gateway section in your local `values.yaml` file which will make your Gateway
listen on port 443 and load up a dummy certificate. You can set your own default certificate by replacing the file in the `certs/` folder.

### Mounting Files

To mount files to any of the Tyk stack components, add the following to the mounts array in the section of that component.
For example:

```bash theme={null}
- name: aws-mongo-ssl-cert
 filename: rds-combined-ca-bundle.pem
 mountPath: /etc/certs
```

### Sharding APIs

Sharding is the ability for you to decide which of your APIs are loaded on which of your Tyk Gateways. This option is
turned off by default, however, you can turn it on by updating the `gateway.sharding.enabled` option. Once you do that you
will also need to set the `gateway.sharding.tags` field with the tags that you want that particular Gateway to load. (ex. tags: "external,ingress".)
You can then add those tags to your APIs in the API Designer, under the **Advanced Options** tab, and
the **Segment Tags (Node Segmentation)** section in your Tyk Dashboard.
Check [Tyk Gateway Sharding](/docs/api-management/api-sharding#what-is-api-sharding-) for more details.