---
title: "Step 5: Install the API gateway"
description: Install the API gateway release, openlm-gateway, which routes /api calls from the web UIs to the OpenLM Platform services.
product: OpenLM Platform
---

Install the **API gateway** before OpenLM Platform. The web UIs send their data requests to `https://<your address>/api/...`, and the gateway receives each one and passes it to the matching service. The gateway is a separate, small Helm release.

Load the variables from `openlm-install.env`, the file you created from the [installation worksheet](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/before-you-start/worksheet):

```bash
source ./openlm-install.env
```

## 5.1 Add the OpenLM Helm repository

You added the repository in step 4, so update it now. Install the latest API gateway release with every OpenLM Platform release. While the charts are release candidates, Helm finds it only with `--devel`.

```bash
helm repo add openlm https://openlm-helm.github.io/helmcharts && helm repo update openlm
```

The gateway chart is `openlm/openlm-apigateway`. If the machine you run Helm on can't reach the internet, download the chart on a machine that can, with `helm pull openlm/openlm-apigateway --devel`. It may print `unable to find exact version requested; falling back to closest available version`, which is harmless. Copy the `.tgz` file over and use it in place of `openlm/openlm-apigateway` in [5.4](#54-install-the-gateway). The cluster also needs the gateway images: see **Private registry (air-gapped)** under [Settings reference](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/reference/api-gateway#settings-reference) on the API gateway page.

## 5.2 Create the gateway secrets

Store the gateway's API secret and the Redis password in two Kubernetes secrets:

```bash
kubectl -n "$NS" create secret generic openlm-gateway-secrets \
  --from-literal=APISecret="$GATEWAY_SECRET" --dry-run=client -o yaml | kubectl -n "$NS" apply -f -
kubectl -n "$NS" create secret generic openlm-gateway-redis \
  --from-literal=password="$REDIS_PASSWORD" --dry-run=client -o yaml | kubectl -n "$NS" apply -f -
```

## 5.3 Write the gateway values

Write the gateway settings to `gateway-values.yaml`:

```bash
cat > gateway-values.yaml <<EOF
openShiftRoute: { enabled: $ON_OPENSHIFT, host: "$DOMAIN" }   # OpenShift: the gateway creates the /api Route
storageClassName: $STORAGE_CLASS
tyk-oss:
  global:
    secrets:
      useSecretName: openlm-gateway-secrets
    redis:
      addrs: ["$REDIS_HOST:$REDIS_PORT"]
      useSSL: $REDIS_TLS
      passSecret: { name: openlm-gateway-redis, keyName: password }
      storage: { database: 0 }
  tyk-gateway:
    gateway:
      hostName: $DOMAIN
      ingress: { enabled: false }        # /api is part of the platform's single Ingress
EOF
```

## 5.4 Install the gateway

Name the release exactly **`openlm-gateway`**. OpenLM Platform sends `/api` to a service whose name comes from the release name. For every gateway setting, see [API gateway](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/reference/api-gateway).

Install the release:

```bash
helm upgrade --install openlm-gateway openlm/openlm-apigateway --devel \
  -n "$NS" -f gateway-values.yaml --wait --timeout 10m
```

:::tip[Check]
Confirm that the gateway runs:

```bash
kubectl -n "$NS" get pods | grep gateway
kubectl -n "$NS" get service gateway-svc-openlm-gateway-tyk-gateway
# OpenShift only:
oc -n "$NS" get route openlm-gateway -o custom-columns=HOST:.spec.host,PATH:.spec.path
```

The gateway pod is `Running` and `1/1`, and the service exists. On OpenShift, the `openlm-gateway` Route shows your `DOMAIN` and the path `/api`. If the pod restarts, read its log with `kubectl -n $NS logs <gateway pod name>`. If the errors mention `redis`, check `REDIS_HOST`, `REDIS_PASSWORD`, and `REDIS_TLS`.
:::