404 not found

[FredyR4zox]

Hi,

I've been trying to getting tyk gateway to work but i haven't been successful.
At first, i tried using the API Definitions templates with the Ingress but it worked for some seconds and then puff, it stopped working without me changing anything. Only sending more requests. Not even restarting the pods corrected it.
I have tried with TLS and without TLS, only using API Definitions without the Ingress (templating). and still nothing.
Sometimes it works but then stops working (rarely works).
The errors are mostly 404 Not found errors but sometimes they don't even reach the gateway.
I have the log_level at debug but it isn't helpful.

Does anyone know what is going on with this?

Here goes my files and some screenshots of the API Definitions and such.

Thank you.

When I set the protocol to https in the API Definition, an error occurs. It says "implement me".
It comes from here:
https://github.com/TykTechnologies/tyk-operator/blob/master/pkg/client/gateway/client.go line 61

[asoorm]

Hello and thank you for your query @FredyR4zox .

It looks like you are using Tyk Operator with an Open Source Gateway installation. Tyk Operator only operates on a single Gateway, not a cluster of Gateways - it looks like the reason it kind of worked, then stopped, is because the K8s service is RR load balancing to 2 nodes which don't work, and 1 node which does. This is a licensing limitation.

https://github.com/TykTechnologies/tyk-operator/blob/master/docs/installation/installation.md#tyk-licensing

Would you like me to put you in-touch with an Account Exec / Solution Architect to set you up with a PoC / Trial License?

[flyte]

Tyk Operator will operate on a single gateway

I haven't been able to find any broader explanation for this quote from the readme. I'm trying to work out whether it indeed means a single Pod, or whether a set of Pods behind a Service is considered a "single gateway", as opposed to a multi-availability-zone deployment?

Is it permissible to run two open source gateways behind a service if you handle their individual configurations yourself? Is it just Tyk Operator that is only licensed to configure a single Pod?

I'd like to make sure I understand where these limitations lie before I design Tyk into our architecture.

Perhaps there's a document somewhere outlining these restrictions?

[FredyR4zox]

Hi @asoorm,

Ah, makes sense :/ I will use only one gateway then. Right now I don't need the full gateway.
But can I serve services from different namespaces? I can have 10 services from the default namespace and other 10 from other namespace?
And what about the https thing ("implement me")? Can I provide my certificate to the gateway so that i don't use a self signed cert?

Thank you for your answer.

[asoorm]

But can I serve services from different namespaces? I can have 10 services from the default namespace and other 10 from other namespace?

Absolutely - yes you can

apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
  name: httpbin
spec:
  name: httpbin
  use_keyless: true
  protocol: http
  active: true
  proxy:
    target_url: http://httpbin.foo.svc:8000           # targeting httpbin service in the foo namespace
    listen_path: /httpbin
    strip_listen_path: true

Can I provide my certificate to the gateway so that i don't use a self signed cert?

https://tyk.io/docs/basic-config-and-security/security/tls-and-ssl/#tykconf

You can load your TLS certificate into Tyk by mounting it as a volume & referencing it in the tyk.conf, or via env var.

[FredyR4zox]

Nice Nice!

One more question: if i have the Self-Managed Launch option, how long is the trial? And how much does it cost?
Is the priced fixed?

Thank you

[FredyR4zox]

BTW, is there any way to blacklist a jwt?
I give to tyk the public key of the jwt (of the public-private keys used to sign and verify the token) so that tyk can validate the jwt that the user provided. When the users "logs out", i have to "blacklist" that jwt so that they can no longer access my services with that jwt.

I am doing the jwt validation of the tyk gateway and not on my services.

Can i do this with tyk?

The generation of these tokens is made with a custom service that I have.

[asoorm]

One more question: if i have the Self-Managed Launch option, how long is the trial? And how much does it cost?

I don't know much about Licensing costs - It's worth reaching out to commercial team with your use-case. https://tyk.io/sign-up/

[asoorm]

BTW, is there any way to blacklist a jwt? ...

There is no way to blacklist a JWT directly with Tyk as this is a kind of non-standard flow. First step - I would always recommend using a short-lived JWT access token. That way, the token would naturally expire every few minutes.

Other options are possible dependent on how you generate your JWT access token.

If an OIDC Identity Provider (Gluu, Okta, Ping, Auth0, Keycloak etc) generated the JWT access token, then you should be able to write a custom plugin which triggers post_auth hook. So after Tyk has validated the JWT, the plugin passes the attempted access token to an OAuth2 introspection endpoint in your Identity Provider. This will tell the plugin whether the token is still active or not & the plugin can then fail authorization. https://github.com/asoorm/tyk-go-plugins/tree/master/oauth2_introspection

If your access token JWT was generated in a custom way, you might achieve similar in one of 2 ways:

1. When the customer logs out of your app, your logout process sends an API call to a Tyk plugin which adds the access token to a blocklist. Your Tyk plugin then just has to validate the incoming token against that block list on every api call. You will need to do some garbage collection here, by removing expired tokens from that block list.

2. Implementing your own introspection endpoint to mimic a similar introspection like functionality as mentioned above.