feat: defaulting webhooks for security policies

Tyk Operator

Tyk Gateway is a modern, ultra-performant, purpose-built, and open source API Gateway.

Tyk Operator brings Full Lifecycle API Management capabilities to Kubernetes. You can configure Ingress, APIs, Security Policies, Authentication, Authorization, Mediation by using GitOps best practices with Custom Resources and Kubernetes-native primitives.

Introduction

What can you do with Tyk Operator?

Tyk Operator can configure Tyk Gateway as a drop-in replacement for standard Kubernetes Ingress. You can manage your API definitions and security policies with it. It also works with the Classic Portal so you can manage your Classic Portal declaratively.

Custom Tyk Objects are available as CRDs and documentation for each of these custom resources are available here.

Tyk Licensing

Tyk Operator and Tyk Gateway are both 100% Open Source. Tyk Operator will operate on a single gateway.

Feel free to reach to our commercial team (or your account manager for existing customers) if you need advice about architecture, licensing, or just to discuss your requirements for runnning in HA, scaling across clusters, nodes & namespaces.

What benefits Tyk Operator has?

You can get the benefits of GitOps with declarative API configurations:

Security and Compliance: All changes must go through peer review through pull requests. The configurations are versioned in your version control system and approved by your API Product Owner and Platform team.
Kubernetes-Native Developer Experience: API Developers enjoy a smoother Continuous Integration process as they can develop, test, and deploy the microservices and API configurations together using familiar development toolings and pipeline.
Reliability: With declarative API configurations, you have a single source of truth to recover after any system failures, reducing the meantime to recovery from hours to minutes.

Documentation

Learning with Videos

Quickstart Examples

HTTP Proxy

apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
  name: httpbin
spec:
  name: httpbin
  do_not_track: false
  use_keyless: true
  protocol: http
  active: true
  proxy:
    target_url: http://httpbin.org
    listen_path: /httpbin
    strip_listen_path: true

TCP Proxy

apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
  name: redis-tcp
spec:
  name: redis-tcp
  active: true
  protocol: tcp
  listen_port: 6380
  proxy:
    target_url: tcp://localhost:6379

GraphQL Proxy

apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
  name: trevorblades
spec:
  name: trevorblades
  use_keyless: true
  protocol: http
  active: true
  proxy:
    target_url: https://countries.trevorblades.com
    listen_path: /trevorblades
    strip_listen_path: true
  graphql:
    enabled: true
    execution_mode: proxyOnly
    schema: |
      directive @cacheControl(maxAge: Int, scope: CacheControlScope) on FIELD_DEFINITION | OBJECT | INTERFACE

      enum CacheControlScope {
        PUBLIC
        PRIVATE
      }

      type Continent {
        code: ID!
        name: String!
        countries: [Country!]!
      }

      input ContinentFilterInput {
        code: StringQueryOperatorInput
      }

      type Country {
        code: ID!
        name: String!
        native: String!
        phone: String!
        continent: Continent!
        capital: String
        currency: String
        languages: [Language!]!
        emoji: String!
        emojiU: String!
        states: [State!]!
      }

      input CountryFilterInput {
        code: StringQueryOperatorInput
        currency: StringQueryOperatorInput
        continent: StringQueryOperatorInput
      }

      type Language {
        code: ID!
        name: String
        native: String
        rtl: Boolean!
      }

      input LanguageFilterInput {
        code: StringQueryOperatorInput
      }

      type Query {
        continents(filter: ContinentFilterInput): [Continent!]!
        continent(code: ID!): Continent
        countries(filter: CountryFilterInput): [Country!]!
        country(code: ID!): Country
        languages(filter: LanguageFilterInput): [Language!]!
        language(code: ID!): Language
      }

      type State {
        code: String
        name: String!
        country: Country!
      }

      input StringQueryOperatorInput {
        eq: String
        ne: String
        in: [String]
        nin: [String]
        regex: String
        glob: String
      }

      """The `Upload` scalar type represents a file upload."""
      scalar Upload
    playground:
      enabled: true
      path: /playground

Universal Data Graph - Stitching REST with GraphQL

apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
  name: udg
spec:
  name: Universal Data Graph Example
  use_keyless: true
  protocol: http
  active: true
  proxy:
    target_url: ""
    listen_path: /udg
    strip_listen_path: true
  graphql:
    enabled: true
    execution_mode: executionEngine
    schema: |
      type Country {
        name: String
        code: String
        restCountry: RestCountry
      }

      type Query {
        countries: [Country]
      }

      type RestCountry {
        altSpellings: [String]
        subregion: String
        population: String
      }
    type_field_configurations:
      - type_name: Query
        field_name: countries
        mapping:
          disabled: false
          path: countries
        data_source:
          kind: GraphQLDataSource
          data_source_config:
            url: "https://countries.trevorblades.com"
            method: POST
            status_code_type_name_mappings: []
      - type_name: Country
        field_name: restCountry
        mapping:
          disabled: true
          path: ""
        data_source:
          kind: HTTPJSONDataSource
          data_source_config:
            url: "https://restcountries.com/v2/alpha/{{ .object.code }}"
            method: GET
            default_type_name: RestCountry
            status_code_type_name_mappings:
              - status_code: 200
    playground:
      enabled: true
      path: /playground

IDE Integration

API developers may add K8s extensions to popular IDEs to enjoy auto-completion while editing Tyk CRD YAML files. Here's the detail steps.

VS Code

Watch video tutorial here.

Steps

Go to the following link: https://marketplace.visualstudio.com/items?itemName=ms-kubernetes-tools.vscode-kubernetes-tools
Click on Install. This will prompt you to open Visual Studios.
Click Open Visual Studios at the subsequent prompt. This will open VS Code and take you to the Extensions' section.
Click Install in the Kubernetes extension page.

Note: The extension should take effect immediately. In case it doesn't, simply restart VS Code.

GoLand

Steps

Open Plugins settings following official GoLand documentation https://www.jetbrains.com/help/go/managing-plugins.html
Install Kubernetes plugin (https://plugins.jetbrains.com/plugin/10485-kubernetes)
Open GoLand Preferences as described here,
Go to Languages & Frameworks > Kubernetes
Click Add URLs and add https://raw.githubusercontent.com/TykTechnologies/tyk-operator/{version_tag}/helm/crds/crds.yaml,
1. For example, if you would like to use CRDs of v0.9.0, replace {version_tag} with v0.9.0 and add https://raw.githubusercontent.com/TykTechnologies/tyk-operator/v0.9.0/helm/crds/crds.yaml
2. Please add CRDs of master for latest CRDs, as follows https://raw.githubusercontent.com/TykTechnologies/tyk-operator/master/helm/crds/crds.yaml
Apply and save changes.

Community

Tyk Operator is under active development.

We are building the operator to enable you to build and ship your APIs faster and more safely.

If you find any defects, please raise an issue. We welcome code contributions as well.

If you require any features that we have not yet implemented, please take your time to create a GitHub issue detailing your use case so that we may prioritise accordingly.

For larger and more in-depth feature requests, please consider starting an RFC thread in the Discussions area.