Manually Installing Sisense Helm Chart - with SSL

You can install the Sisense Helm chart itself directly on your Kubernetes cluster, meaning installing the Sisense app itself, with secured HTTPS (without using the sisense.sh script).

For this example, since nginx-ingress is reaching its end of life by March 2026, we are going to use new the implementation of Nginx Gateway Fabric (and use Gateway and httpRoute instead of ingress).

Prerequisites

  • Prerequisites for Single node deployment

  • Prerequisites for Multi node or Cloud deployment

  • Your own certificate file (<filename>.crt) and a matching key file (<filename>.key) located in your server (unless you are using a certificate from a cloud provider, such as AWS Certificate Manager)

  • You MUST generate the relevant gateway-api CRDs in order for this to work:

    Copy 
    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml

    customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io created
    customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io created
    customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created
    customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io created
    customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io created

Nginx Gatway Fabric (NGF) Installation

For this example, we will install NGF on namespace nginx-gateway-fabric.

  1. Create the namespace:

    Copy 
    kubectl create ns nginx-gateway-fabric

  2. If you are using a certificate from a cloud provider, such as AWS Certificate Manager, then skip this step and proceed to the next step.

    Otherwise, in that namespace, create a Kubernetes secret of the type TLS (for this example, we will call it my-tls, but you can use whatever name you prefer):

    Copy 
    kubectl create secret tls my-tls -n nginx-gateway-fabric --key=<filename>.key --cert=<filename>.crt)

    # Validate that the secret exists:
    kubectl -n nginx-gateway-fabric get secret my-tls
    NAME          TYPE                DATA   AGE
    my-tls   kubernetes.io/tls   2      1m

  3. Prepare your values file for the NGF installation.

  • Example for on-prem deployment: ngf-on-prem-values.yaml

  • Example for AWS EKS deployment: ngf-eks-values.yaml

    Key differences:

    • The nginx on the on-prem is daemonSet while on cloud is deployment

    • In the cloud example, there are added annotations. For example:

      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:my-region-1:123456789012:certificate/12345678-abcd-some-cert-arn9582abc

      This tells NGF to use a certificate on AWS, thereby removing the need to create a TLS secret in your Kubernetes cluster.

    • When using your own TLS secret in your cluster, you can see in the on-prem example that the gateways: part contains the following:

      Copy 
      tls:
        mode: Terminate
        certificateRefs:
        - kind: Secret
          name: my-tls

Note:

The gateways part is mandatory. It created a Kubernetes resource of the type Gateway in the namespace where the NGF Helm chart is deployed.

  1. Install the NGF helm chart:

    Copy 
    helm install -n nginx-gateway-fabric nginx-gateway-fabric oci://ghcr.io/nginx/charts/nginx-gateway-fabric --values <your-values-file>.yaml

    NAME: nginx-gateway-fabric
    LAST DEPLOYED: Tue Jan 13 17:00:31 2026
    NAMESPACE: nginx-gateway-fabric
    STATUS: deployed
    REVISION: 1
    TEST SUITE: None

    # Wait briefly, and validate everything is OK:
    kubectl -n nginx-gateway-fabric get pod
    NAME                                    READY   STATUS    RESTARTS   AGE
    nginx-gateway-fabric-5978dff679-97lhv   1/1     Running   0          43s
    nginx-gateway-fabric-5978dff679-xpwtl   1/1     Running   0          43s
    sisense-gateway-nginx-g2m5g             1/1     Running   0          42s
    sisense-gateway-nginx-lkjnr             1/1     Running   0          42s
    sisense-gateway-nginx-m56hn             1/1     Running   0          42s

    # Make sure the Gateway is created (for cloud, you will see an LB address):
    kubectl -n nginx-gateway-fabric get gateway
    NAME              CLASS   ADDRESS         PROGRAMMED   AGE
    sisense-gateway   nginx   10.43.216.115   True         64s

Sisense Deployment

Continue with the Sisense deployment (Manually Installing Sisense Helm Chart - Single Node or Manually Installing Sisense Helm Chart - Multinode/Cloud), but with the following change:

In your values.yaml file, add the following values:

  • global.external_kube_apiserver_address - your https dns address

  • api-gateway.httpRoute.enabled - must be true

  • api-gateway.httpRoute.gatewayName - the name of Gateway you have in the NGF namespace

  • api-gateway.httpRoute.gatewayNamespace - the name of the namespace which has your NGF Gateway resource (in this document, it is the same namespace where you installed NGF).

Copy 
global:
  applicationDnsName: "https://my-ssl-env.sisense.com"

api-gateway:
  httpRoute:
    enabled: true
    gatewayName: "sisense-gateway"
    gatewayNamespace: "nginx-gateway-fabric"

When the deployment is complete, you can see that httpRoute also exists your Sisense namespace:

Copy 
kubectl -n sisense get httproute

NAME            HOSTNAMES                    AGE
sisense-route   ["my-ssl-env.sisense.com"]   5m54s