Skip to content
Edit page
Copy page

API Platform Gateway - Kubernetes Standalone Mode

This guide explains how to run API Platform Gateway in Standalone Mode using the gateway Helm chart only (without the Gateway Operator).

Standalone mode is recommended when you want:

  • Direct Helm-based lifecycle management of gateway components.
  • A simpler footprint without operator-managed CRDs.
  • Explicit control over values and release upgrades.

For mode selection and architecture context, see API Platform Kubernetes Gateway deployment modes.

What Gets Deployed

The gateway chart deploys the runtime components used by API Platform Gateway (controller and gateway runtime workloads) from chart templates and values.

Chart reference:

  • OCI chart: oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway, version 2026.10.0

Prerequisites

  • Kubernetes 1.24+
  • Helm 3.14+
  • kubectl
  • cert-manager (required for cert-manager-backed TLS flows)
  • WSO2 subscription credentials to pull the chart and images from the WSO2 private registry (registry.wso2.com)

Install cert-manager

helm repo add jetstack https://charts.jetstack.io --force-update
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true

Verify:

kubectl get pods -n cert-manager

Log in to the WSO2 private registry

Log Helm in to the registry so it can pull the chart:

helm registry login registry.wso2.com

Create an image pull secret so the cluster can pull the gateway images. Create it in the namespace you install into:

kubectl create secret docker-registry wso2-subscription-creds \
  --docker-server=registry.wso2.com \
  --docker-username=<wso2-username> \
  --docker-password=<wso2-password>
# For a non-default namespace, add `-n <namespace>`.

The install commands below pass this secret to the chart with wso2.subscription.imagePullSecret.

Create the Encryption Key Secret

At-rest encryption is mandatory and fail-closed. The chart refuses to render without an AES-256 key Secret. Create it in the namespace you install into, before installing the chart.

openssl rand 32 > default-aesgcm256-v1.bin
kubectl create secret generic gateway-encryption-keys \
  --from-file=default-aesgcm256-v1.bin=default-aesgcm256-v1.bin && \
  rm default-aesgcm256-v1.bin   # remove the plaintext key only after the Secret is created
# For a non-default namespace, first `kubectl create namespace <namespace>`,
# then add `-n <namespace>` to both this command and `helm install`.

The Secret's key entry must be named default-aesgcm256-v1.bin. See Security Hardening → Encryption Keys for key rotation and multi-key setups.

Install Gateway Chart

Use one of the following patterns.

Default install

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --set gateway.controller.encryptionKeys.enabled=true \
  --set gateway.controller.encryptionKeys.secretName=gateway-encryption-keys

Install into a dedicated namespace

kubectl create namespace api-gateway

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --namespace api-gateway \
  --set gateway.controller.encryptionKeys.enabled=true \
  --set gateway.controller.encryptionKeys.secretName=gateway-encryption-keys

Install with control-plane overrides

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --set gateway.controller.controlPlane.host="platform.example.com" \
  --set gateway.controller.controlPlane.port=8443 \
  --set gateway.controller.controlPlane.token.value="your-token-here" \
  --set gateway.controller.encryptionKeys.enabled=true \
  --set gateway.controller.encryptionKeys.secretName=gateway-encryption-keys

Install with a values file

custom-values.yaml must define the image pull secret and the mandatory encryption settings:

wso2:
  subscription:
    imagePullSecret: wso2-subscription-creds
gateway:
  controller:
    encryptionKeys:
      enabled: true
      secretName: gateway-encryption-keys

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  -f custom-values.yaml

Verify Installation

helm status ap-gateway
kubectl get all -l app.kubernetes.io/instance=ap-gateway

Check logs:

# Controller logs
kubectl logs -l app.kubernetes.io/component=controller

# Gateway runtime logs
kubectl logs -l app.kubernetes.io/component=gateway-runtime

Upgrade and Uninstall

Upgrade:

helm upgrade ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway --version 2026.10.0 -f custom-values.yaml

Uninstall:

helm uninstall ap-gateway

Namespace-scoped uninstall:

helm uninstall ap-gateway --namespace api-gateway

Core Configuration Areas

Most runtime configuration is controlled in values.yaml. Common sections:

  • gateway.controller.image, gateway.gatewayRuntime.image
  • gateway.<component>.deployment.*
  • gateway.<component>.service.*
  • gateway.controller.controlPlane.*
  • gateway.controller.logging.*
  • gateway.controller.tls.*
  • gateway.controller.upstreamCerts.*
  • gateway.config.policy_engine.*

Refer to inline comments in chart values.yaml for all supported fields.

TLS Configuration

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --set gateway.controller.tls.enabled=true

Production-style example:

gateway:
  controller:
    tls:
      enabled: true
      certificateProvider: cert-manager
      certManager:
        createIssuer: false
        issuerRef:
          name: letsencrypt-prod
          kind: Issuer
        commonName: api.example.com
        dnsNames:
          - api.example.com
          - "*.api.example.com"

Option 2: Existing TLS secret

kubectl create secret tls gateway-tls \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --set gateway.controller.tls.enabled=true \
  --set gateway.controller.tls.certificateProvider=secret \
  --set gateway.controller.tls.secret.name=gateway-tls

Upstream Custom CAs

When calling upstream services that use private/self-signed CAs:

kubectl create secret generic upstream-ca-certs \
  --from-file=ca1.crt=path/to/ca1.crt \
  --from-file=ca2.crt=path/to/ca2.crt

helm install ap-gateway oci://registry.wso2.com/wso2-api-platform/sts/helm-charts/gateway \
  --version 2026.10.0 \
  --set wso2.subscription.imagePullSecret=wso2-subscription-creds \
  --set gateway.controller.upstreamCerts.enabled=true \
  --set gateway.controller.upstreamCerts.secretName=upstream-ca-certs

Create and Invoke API

Port-forward Gateway Controller Service

kubectl port-forward svc/ap-gateway-controller 9090:9090 9094:9094

Verify the Gateway Controller's admin endpoint is running

curl --fail http://localhost:9094/api/admin/v1/health

Deploy an API configuration

The management API uses basic auth with the credentials from your Helm values (controller.auth.basic.users; the chart default is admin / admin). Export them, changing them if you overrode the chart defaults:

export ADMIN_USERNAME=admin
export ADMIN_PASSWORD=admin

curl -X POST http://localhost:9090/api/management/v1/rest-apis \
  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
  -H "Content-Type: application/yaml" \
  --data-binary @- <<'EOF'
apiVersion: gateway.api-platform.wso2.com/v1
kind: RestApi
metadata:
  name: reading-list-api-v1.0
spec:
  displayName: Reading-List-API
  version: v1.0
  context: /reading-list/$version
  upstream:
    main:
      url: https://apis.bijira.dev/samples/reading-list-api-service/v1.0
  policies:
    - name: set-headers
      version: v1
      params:
        request:
          headers:
            - name: x-wso2-apip-gateway-version
              value: v1.0.0
        response:
          headers:
            - name: x-environment
              value: development
  operations:
    - method: GET
      path: /books
    - method: POST
      path: /books
    - method: GET
      path: /books/{id}
    - method: PUT
      path: /books/{id}
    - method: DELETE
      path: /books/{id}
EOF

Test routing through the gateway

curl http://localhost:8080/reading-list/v1.0/books
curl -k https://localhost:8443/reading-list/v1.0/books

Next Steps