Manually Installing Sisense Helm Chart - with SSL

Last updated: October 21, 2026

You can install the Sisense Helm chart itself directly on your Kubernetes cluster, meaning installing the Sisense app itself, with secured HTTPS (without using the sisense.sh script).

For this example, since nginx-ingress is reaching its end of life by March 2026, we are going to use the new implementation of Nginx Gateway Fabric (and use Gateway and httpRoute instead of ingress).

The Sisense Helm chart does not create the Gateway and does not terminate TLS itself. It creates an HTTPRoute that attaches to a Gateway that you install and that terminates TLS (in this example, the NGF Gateway).

Prerequisites

• Prerequisites for Single node deployment

• Prerequisites for Multi node or Cloud deployment

• A DNS host name for Sisense (for example, my-ssl-env.sisense.com) that resolves to the address of your Gateway. The HTTPRoute requires a host name; an IP address is not accepted.

• Your own certificate file (<filename>.crt) and a matching key file (<filename>.key) located in your server (unless you are using a certificate from a cloud provider, such as AWS Certificate Manager)

• You MUST install the Gateway API CRDs (standard channel) in order for this to work. For example (sisense.sh uses version v1.6.1 of the Gateway API CRDs):

  Copy

  kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
  
  # Validate that the CRDs exist:
  kubectl get crd | grep gateway.networking.k8s.io

Nginx Gatway Fabric (NGF) Installation

For this example, we will install NGF on namespace nginx-gateway-fabric.

1. Create the namespace:

   Copy

   kubectl create ns nginx-gateway-fabric

2. If you are using a certificate from a cloud provider, such as AWS Certificate Manager, then skip this step and proceed to the next step.

   Otherwise, in that namespace, create a Kubernetes secret of the type TLS (for this example, we will call it my-tls, but you can use whatever name you prefer):

   Copy

   kubectl create secret tls my-tls -n nginx-gateway-fabric --key=<filename>.key --cert=<filename>.crt
   
   # Validate that the secret exists:
   kubectl -n nginx-gateway-fabric get secret my-tls
   NAME          TYPE                DATA   AGE
   my-tls   kubernetes.io/tls   2      1m

3. Prepare your values file for the NGF installation.

• Example for on-prem deployment: ngf-on-prem-values.yaml

• Example for AWS EKS deployment: ngf-eks-values.yaml

  Key differences:

  • The nginx on the on-prem is daemonSet while on cloud is deployment

  • In the cloud example, there are added annotations. For example:

    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:my-region-1:123456789012:certificate/12345678-abcd-some-cert-arn9582abc

    This tells NGF to use a certificate on AWS, thereby removing the need to create a TLS secret in your Kubernetes cluster.

  • When using your own TLS secret in your cluster, you can see in the on-prem example that the gateways: part contains the following:

    Copy

    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: my-tls

4. Install the NGF helm chart:

   Copy

   helm install -n nginx-gateway-fabric nginx-gateway-fabric oci://ghcr.io/nginx/charts/nginx-gateway-fabric --values <your-values-file>.yaml
   
   NAME: nginx-gateway-fabric
   LAST DEPLOYED: Tue Jan 13 17:00:31 2026
   NAMESPACE: nginx-gateway-fabric
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
   
   # Wait briefly, and validate everything is OK:
   kubectl -n nginx-gateway-fabric get pod
   NAME                                    READY   STATUS    RESTARTS   AGE
   nginx-gateway-fabric-5978dff679-97lhv   1/1     Running   0          43s
   nginx-gateway-fabric-5978dff679-xpwtl   1/1     Running   0          43s
   sisense-gateway-nginx-g2m5g             1/1     Running   0          42s
   sisense-gateway-nginx-lkjnr             1/1     Running   0          42s
   sisense-gateway-nginx-m56hn             1/1     Running   0          42s
   
   # Make sure the Gateway is created (for cloud, you will see an LB address):
   kubectl -n nginx-gateway-fabric get gateway
   NAME              CLASS   ADDRESS         PROGRAMMED   AGE
   sisense-gateway   nginx   10.43.216.115   True         64s

Sisense Deployment

Continue with the Sisense deployment (Manually Installing Sisense Helm Chart - Single Node or Installing Sisense with Helm on an Existing Cluster (Multinode/Cloud)), but with the following change:

In your values.yaml file, add the following values:

• global.external_kube_apiserver_address - the full HTTPS URL that users open in the browser, including the scheme (for example, https://my-ssl-env.sisense.com). Sisense uses it as its system address.

• global.applicationDnsName - the host name only, without https:// (for example, my-ssl-env.sisense.com). The chart uses it as the host name of the HTTPRoute. It is required when api-gateway.httpRoute.enabled is true, and it must not be an IP address; otherwise the installation fails.

• global.ssl.enabled - true

• api-gateway.httpRoute.enabled - must be true

• api-gateway.httpRoute.gatewayName - the name of Gateway you have in the NGF namespace (default: sisense-gateway)

• api-gateway.httpRoute.gatewayNamespace - the name of the namespace which has your NGF Gateway resource (in this document, it is the same namespace where you installed NGF). The default is default.

global:
  external_kube_apiserver_address: "https://my-ssl-env.sisense.com"
  applicationDnsName: "my-ssl-env.sisense.com"
  ssl:
    enabled: true

api-gateway:
  httpRoute:
    enabled: true
    gatewayName: "sisense-gateway"
    gatewayNamespace: "nginx-gateway-fabric"

When api-gateway.httpRoute.enabled is true, the chart also creates three NGF resources for the HTTPRoute: a ClientSettingsPolicy (raises the request body size limit, for example for large .sdata imports), an UpstreamSettingsPolicy, and a SnippetsFilter (proxy timeouts). These resources require the NGF CRDs, which the NGF Helm chart installs. If your Gateway is not NGF, disable them:

api-gateway:
  clientSettingsPolicy:
    enabled: false
  upstreamSettingsPolicy:
    enabled: false
  snippetsFilter:
    enabled: false

When the deployment is complete, you can see that httpRoute also exists in your Sisense namespace:

kubectl -n sisense get httproute

NAME            HOSTNAMES                    AGE
sisense-route   ["my-ssl-env.sisense.com"]   5m54s