Managing Apigee ingress gateway

You are currently viewing version 1.14 of the Apigee hybrid documentation. For more information, see Supported versions.

Version 1.14 

   Supported versions:

• v1.15 (latest)                        
• v1.14                        
• v1.13                         
• List of supported versions

   Unsupported versions:

• v1.12                         
• v1.11                         
• v1.10                                      
• v1.9                                         
• v1.8                                         
• v1.7                                         
• v1.6                                         
• v1.5                                         
• v1.4                                         
• v1.3                                         
• v1.2                                         
• v1.1                                         

Configuring Apigee ingress gateway

You can configure your ingress gateways in your overrides.yaml. For example:

Syntax

ingressGateways:
- name: INGRESS_NAME
  replicaCountMin: REPLICAS_MIN
  replicaCountMax: REPLICAS_MAX
  resources:
    requests:
      cpu: CPU_COUNT_REQ
      memory: MEMORY_REQ
    limits:
      cpu: CPU_COUNT_LIMIT
      memory: MEMORY_LIMIT
  svcAnnotations:  # optional.
    SVC_ANNOTATIONS_KEY: SVC_ANNOTATIONS_VALUE
  svcLoadBalancerIP: SVC_LOAD_BALANCER_IP # optional

Example

ingressGateways:
- name: prod1
  replicaCountMin: 2
  replicaCountMax: 100
  resources:
    requests:
      cpu: 1
      memory: 1Gi
    limits:
      cpu: 2
      memory: 2Gi
  svcAnnotations:  # optional. See Known issue 243599452.
    networking.gke.io/load-balancer-type: "Internal"
  svcLoadBalancerIP: 198.252.0.123 

• INGRESS_NAME is the name of the ingress gateway deployment. This can be any name that meets the following requirements:
  • Have a maximum length of 17 characters
  • Contain only lowercase alphanumeric characters, '-' or '.'
  • Start with an alphanumeric character
  • End with an alphanumeric character

  See ingressGateways[].name in the Configuration property reference

• REPLICAS_MIN and REPLICAS_MAX The minimum and maximum replica counts for Apigee ingress gateway in your installation. See ingressGateways[].replicaCountMin and ingressGateways[].replicaCountMax in the Configuration property reference.
• CPU_COUNT_REQ and MEMORY_REQ The CPU and memory request for each replica of Apigee ingress gateway in your installation.
  Set these properties if you had previously set them for your Cloud Service Mesh ingress gateway in Apigee hybrid version 1.8 or earlier, for example in your overlay.yaml file.

  See ingressGateways[].resources.requests.cpu and ingressGateways[].resources.requests.memory in the Configuration property reference.

• CPU_COUNT_LIMIT and MEMORY_LIMIT The maximum CPU and memory limits for each replica of Apigee ingress gateway in your installation.
  Set these properties if you had previously set them for your Cloud Service Mesh ingress gateway in Apigee hybrid version 1.8 or earlier, for example in your overlay.yaml file.

  See ingressGateways[].resources.limits.cpu and ingressGateways[].resources.limits.memory in the Configuration property reference.

• SVC_ANNOTATIONS_KEY SVC_ANNOTATIONS_VALUE (optional):
  Note: The ingressGateways[].svcAnnotations field in overrides.yaml is not working as expected. See Known issue 243599452

  This is a key-value pair that provides annotations for your default ingress service. Your cloud platform uses annotations to help configure your hybrid installation, for example setting the loadbalancer type to either internal or external. For example:

  ingressGateways:
    svcAnnotations:
      networking.gke.io/load-balancer-type: "Internal"

  Annotations vary from platform to platform. See your platform documentation for required and suggested annotations.

  Note: You do not need to set Annotations here if you are creating your own Kubernetes service for ingress gateway deployment as documented in Expose Apigee ingress gateway.
  See ingressGateways[].svcAnnotations in the Configuration property reference.
• SVC_LOAD_BALANCER_IP (optional). On platforms that support specifying the load balancer IP address, the load balancer will be created with this IP address. On platforms that do not allow you to specify the load balancer IP address, this property is ignored.
  Caution: Make sure not to specify the same IP address as the current istio-ingressgateway. This could cause problems while that service is still on the cluster.
  Note: You do not need to set LoadBalancerIP if you are creating your own Kubernetes service for ingress gateway deployment as documented in Expose Apigee ingress gateway.
  See ingressGateways[].svcLoadBalancerIP in the Configuration property reference.

Apply the Apigee ingress gateway configuration

Apply changes to the organization scope:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Note: If you see an error saying Error: UPGRADE FAILED: "ORG_NAME" has no deployed releases, replace upgrade with install and try the command again.

Management tasks

Some common management tasks for the Apigee ingress gateway:

Scaling Apigee ingress gateway:

Update the following properties in your overrides file.

• ingressGateways[].replicaCountMax
• ingressGateways[].replicaCountMin

See ingressGateways in the Configuration properties reference for details.

Apply the changes:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Updating resource allocation

Update the following properties in your overrides file.

• ingressGateways[].resources.limits.cpu
• ingressGateways[].resources.limits.memory
• ingressGateways[].resources.requests.cpu
• ingressGateways[].resources.requests.memory

See ingressGateways in the Configuration properties reference for details.

Apply the changes:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Updating the Apigee ingress gateway service

Update the following properties in your overrides file.

• ingressGateways[].svcAnnotations
• ingressGateways[].svcLoadBalancerIP

See ingressGateways in the Configuration properties reference for details.

Apply the changes:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Disable the loadbalancer for the default Apigee ingress gateway service:

If you create a custom Kubernetes service for your ingress gateway deployment, you can disable creation of a load balancer on the default Kubernetes service. Update the ingressGateways[].svcType property to ClusterIP in your overrides file. For example:

ingressGateways:
  - name: my-ingress-gateway
    replicaCountMin: 2
    replicaCountMax: 10
    svcType: ClusterIP

Apply the changes:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Configure TLS and mTLS

See Configuring TLS and mTLS on the ingress gateway.

Enabling non-SNI clients

See Enable non-SNI and HTTP clients.

Installing additional Apigee ingress gateways

In the overrides.yaml file you can add multiple ingress gateways. The ingressGateways configuration property is an array. For more information, see ingressGateways in the Configuration properties reference.

For example:

ingressGateways:
- name: fruit
  replicaCountMin: 2
  replicaCountMax: 10

- name: meat
  replicaCountMin: 2
  replicaCountMax: 10

Apply the changes:

helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml

Mapping virtual hosts to Apigee ingress gateway deployments

You can use selector labels to map a virtual host to an Apigee ingress gateway deployment. In the following example, the virtual host spam-vh is configured to run on the ingress gateway labeled meat and the other two virtual hosts run on the fruit ingress gateway. The ingress gateways must be properly labeled, as explained in Installing additional Cloud Service Mesh gateways.

Note: You must specify both of the selectors: selector:app and selector:ingress_name to properly apply an ingress gateway to a virtual host.

Tip: For security purposes, it is best practice to have a separate TLS cert/key pair for each virtual host. If you are using a Subject Alternative Name (SAN ) certificate, this TLS cert/key pair should be used on one virtual host that is shared across the domain.

virtualhosts:
- name: spam-vh
  sslCertPath: cert-spam.crt
  sslKeyPath: cert-spam.key
  selector:
    app: apigee-ingressgateway
    ingress_name: meat
- name: banana-vh
  sslCertPath: cert-banana.crt
  sslKeyPath: cert-banana.key
  selector:
    app: apigee-ingressgateway
    ingress_name: fruit
- name: plum-vh
  sslCertPath: cert-plum.crt
  sslKeyPath: cert-plum.key
  selector:
    app: apigee-ingressgateway
    ingress_name: fruit

    

Adding custom ciphersuites to Apigee ingress gateway deployments

You can add custom ciphersuites to your Apigee ingress gateway deployment with the virtualhosts.cipherSuites property in your overrides file.

See virtualhosts.cipherSuites for the default ciphersuites enabled in Apigee hybrid.

You can enable older versions of TLS with the virtualhosts.minTLSProtocolVersion property and add custom ciphersuites to your Apigee ingress gateway deployment with the virtualhosts.cipherSuites property in your overrides file.

For example, to enable TLS v.1.1:

virtualhosts:
- name: ENV_GROUP_NAME
  minTLSProtocolVersion: "1.1"
  cipherSuites:
  - "ECDHE-ECDSA-AES128-GCM-SHA256"
  - "ECDHE-RSA-AES128-GCM-SHA256"
  - "ECDHE-ECDSA-AES256-GCM-SHA384"
  - "ECDHE-RSA-AES256-GCM-SHA384"
  - "ECDHE-ECDSA-CHACHA20-POLY1305"
  - "ECDHE-RSA-CHACHA20-POLY1305"
  - "ECDHE-ECDSA-AES128-SHA"
  - "ECDHE-RSA-AES128-SHA"
  - "ECDHE-ECDSA-AES256-SHA"
  - "ECDHE-RSA-AES256-SHA"
  ...

Note: This property overrides the list of cipher suites supported by Envoy, and does not append to it.

Customize Ingress access logs

You can customize the Apigee ingress gateway access log destination and format with the istiod.accessLogFile and istiod.accessLogFormat configuration properties. In the following example, the output will be sent to /dev/stdout, which is the default value for istiod.accessLogFile:

istiod:
  accessLogFormat: '{"request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","status":"%RESPONSE_CODE%"}'

You can disable Apigee ingress gateway access logging by assigning istiod.accessLogFile and empty value. For example:

istiod:
  accessLogFile: ''

FAQ

How does this work with my existing Cloud Service Mesh/Istio installation in another namespace?

As long as Apigee is installed in a dedicated namespace - Apigee ingress gateway can be run alongside an already existing Cloud Service Mesh/Istio installation in the cluster. Apigee ingress gateway doesn't store any configuration in apiserver hence there won't be any conflict.

Who is responsible for upgrading Apigee ingress gateway components?

Apigee takes care of upgrades to Apigee ingress gateway components Apigee ingress gateway which happens during regular hybrid upgrades and patch releases.

How do I expose port 80 in Apigee ingress gateway?

Port 80 is not supported by Apigee ingress gateway. If you are migrating from Cloud Service Mesh to Apigee ingress gateway, and you followed the instructions in the community post to enable Port 80, it will not work with Apigee Ingress gateway.