# Manually Installing Sisense Helm Chart - with SSL *Source: https://docs.sisense.com/main/SisenseLinux/installing-sisense-helm-ssl.htm* --- Last updated: June 10, 2026 | | | | --- | --- | | [Tier](https://www.sisense.com/pricing/#pricing) | [Deployment](https://docs.sisense.com/main/SisenseLinux/introduction-to-sisense-cloud-managed-services.md#ComparisonofManagedCloudandSelfHosted) | | Enterprise | On-Prem | You can install the Sisense Helm chart itself directly on your Kubernetes cluster, meaning installing the Sisense app itself, with secured HTTPS (without using the *sisense.sh* script). For this example, since [nginx-ingress is reaching its end of life](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/) by March 2026, we are going to use new the implementation of [Nginx Gateway Fabric](https://github.com/nginx/nginx-gateway-fabric) (and use `Gateway` and `httpRoute` instead of `ingress`). ## Prerequisites - [Prerequisites for Single node deployment](https://docs.sisense.com/main/SisenseLinux/installing-sisense-helm-singlenode.md) - [Prerequisites for Multi node or Cloud deployment](https://docs.sisense.com/main/SisenseLinux/installing-sisense-helm-multinode.md) - Your own certificate file (`.crt`) and a matching key file (`.key`) located in your server (unless you are using a certificate from a cloud provider, such as AWS Certificate Manager) - You MUST generate the relevant gateway-api CRDs in order for this to work: [Copy](javascript:void(0);) ``` kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io created ``` ## Nginx Gatway Fabric (NGF) Installation For this example, we will install NGF on namespace `nginx-gateway-fabric`. 1. Create the namespace: [Copy](javascript:void(0);) ``` kubectl create ns nginx-gateway-fabric ``` 2. If you are using a certificate from a cloud provider, such as AWS Certificate Manager, then skip this step and proceed to the next step. Otherwise, in that namespace, create a Kubernetes secret of the type TLS (for this example, we will call it `my-tls`, but you can use whatever name you prefer): [Copy](javascript:void(0);) ``` kubectl create secret tls my-tls -n nginx-gateway-fabric --key=.key --cert=.crt) # Validate that the secret exists: kubectl -n nginx-gateway-fabric get secret my-tls NAME          TYPE                DATA   AGE my-tls   kubernetes.io/tls   2      1m ``` 3. Prepare your values file for the NGF installation. - Example for on-prem deployment: [ngf-on-prem-values.yaml](https://docs.sisense.com/main/ngf-on-prem-values.yaml) - Example for AWS EKS deployment: [ngf-eks-values.yaml](https://docs.sisense.com/main/ngf-eks-values.yaml) Key differences: - The nginx on the on-prem is `daemonSet` while on cloud is `deployment` - In the cloud example, there are added annotations. For example: `service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:my-region-1:123456789012:certificate/12345678-abcd-some-cert-arn9582abc` This tells NGF to use a certificate on AWS, thereby removing the need to create a TLS secret in your Kubernetes cluster. - When using your own TLS secret in your cluster, you can see in the on-prem example that the `gateways:` part contains the following: [Copy](javascript:void(0);) ``` tls:   mode: Terminate   certificateRefs:   - kind: Secret     name: my-tls ``` Note: The `gateways` part is mandatory. It created a Kubernetes resource of the type `Gateway` in the namespace where the NGF Helm chart is deployed. 1. Install the NGF helm chart: [Copy](javascript:void(0);) ``` helm install -n nginx-gateway-fabric nginx-gateway-fabric oci://ghcr.io/nginx/charts/nginx-gateway-fabric --values .yaml NAME: nginx-gateway-fabric LAST DEPLOYED: Tue Jan 13 17:00:31 2026 NAMESPACE: nginx-gateway-fabric STATUS: deployed REVISION: 1 TEST SUITE: None # Wait briefly, and validate everything is OK: kubectl -n nginx-gateway-fabric get pod NAME                                    READY   STATUS    RESTARTS   AGE nginx-gateway-fabric-5978dff679-97lhv   1/1     Running   0          43s nginx-gateway-fabric-5978dff679-xpwtl   1/1     Running   0          43s sisense-gateway-nginx-g2m5g             1/1     Running   0          42s sisense-gateway-nginx-lkjnr             1/1     Running   0          42s sisense-gateway-nginx-m56hn             1/1     Running   0          42s # Make sure the Gateway is created (for cloud, you will see an LB address): kubectl -n nginx-gateway-fabric get gateway NAME              CLASS   ADDRESS         PROGRAMMED   AGE sisense-gateway   nginx   10.43.216.115   True         64s ``` ## Sisense Deployment Continue with the Sisense deployment ([Manually Installing Sisense Helm Chart - Single Node](https://docs.sisense.com/main/SisenseLinux/installing-sisense-helm-singlenode.md) or [Manually Installing Sisense Helm Chart - Multinode/Cloud](https://docs.sisense.com/main/SisenseLinux/installing-sisense-helm-multinode.md)), but with the following change: In your `values.yaml` file, add the following values: - `global.external_kube_apiserver_address` - your https dns address - `api-gateway.httpRoute.enabled` - must be `true` - `api-gateway.httpRoute.gatewayName` - the name of `Gateway` you have in the NGF namespace - `api-gateway.httpRoute.gatewayNamespace` - the name of the namespace which has your NGF `Gateway` resource (in this document, it is the same namespace where you installed NGF). [Copy](javascript:void(0);) ``` global:   applicationDnsName: "https://my-ssl-env.sisense.com" api-gateway:   httpRoute:     enabled: true     gatewayName: "sisense-gateway"     gatewayNamespace: "nginx-gateway-fabric" ``` When the deployment is complete, you can see that `httpRoute` also exists your Sisense namespace: [Copy](javascript:void(0);) ``` kubectl -n sisense get httproute NAME            HOSTNAMES                    AGE sisense-route   ["my-ssl-env.sisense.com"]   5m54s ```