Create an APIMExtensionPolicy

This page applies to Apigee and Apigee hybrid.

View Apigee Edge documentation.

This page describes how to create an APIMExtensionPolicy to create the required traffic extension on the Google Kubernetes Engine (GKE) Gateway running in your cluster.

Before you begin

Before you begin this task, complete the following steps:

• Confirm that your GKE cluster has a Workload Identity configured. See Create a workload identity for the required steps.
• Confirm that your cluster has a GKE Gateway configured and working. See Deploying gateways for more details.
• Install the Apigee Operator for Kubernetes. See Install Apigee Operator for Kubernetes for installation instructions.

Required roles

If you assign the required roles to your service account as described in Install the Apigee Operator for Kubernetes, no additional IAM roles or permissions are required to complete these tasks.

You can choose to authorize actions on resources in your Google Kubernetes Engine cluster using the built-in role-based access control (RBAC) mechanism in Kubernetes. For more information, see Authorize actions in clusters using role-based access control.

Create the APIMExtensionPolicy

In this step, create the APIMExtensionPolicy and apply it to the GKE Gateway running in your cluster. This policy governs all traffic going through the Gateway and its associated HTTPRoutes, operating similarly to a flowhook at the environment level in Apigee today.

Note:When the APIMExtensionPolicy is applied to a gateway, the Apigee Operator for Kubernetes creates the required traffic extension. This traffic extension is not compatible with any other traffic extensions that may be present on the gateway. If you have multiple traffic extensions, or prefer to manage the ordering of the traffic extensions yourself, use the ApigeeBackendService instead. Using the ApigeeBackendService allows you to integrate Apigee into a GCPTrafficExtension resource alongside other extensions. See Create an ApigeeBackendService for more information.

Create the APIM Extension policy:

1. Create a new file named global-ext-lb1-apim-policy.yaml in the apim namespace.
2. Copy the following content into the new file:

   # global-ext-lb1-apim-policy.yaml
   apiVersion: apim.googleapis.com/v1
   kind: APIMExtensionPolicy
   metadata:
     name: global-ext-lb1-apim-policy
     namespace: apim
   spec:
     apigeeEnv: ENV_NAME # optional
     location: global
     failOpen: false
     timeout: 1000ms
     defaultSecurityEnabled: true
     targetRef: # identifies the Gateway where the extension should be applied
       name: global-ext-lb1
       kind: Gateway
       namespace: default

   Where ENV_NAME is the name of the Apigee environment created in the installation step Create an Apigee environment.

   Note: If you install the Apigee Operator for Kubernetes using the generateEnv=TRUE flag, the apigeeEnv field is not required.

   You can view all available environments in the Apigee Environments page in the Google Cloud console:

   Go to Environments

3. Apply the policy:

   kubectl -n apim apply -f global-ext-lb1-apim-policy.yaml

   Once the policy is applied, the Apigee Operator for Kubernetes creates networking resources in the background.

4. Check the status of the APIM Extension policy using the following command:

   kubectl -n apim get APIMExtensionPolicy

   The output should look similar to the following, with a State of RUNNING:

   NAME                         STATE      ERRORMESSAGE
   global-ext-lb1-apim-policy   RUNNING  

   Note: It may take up to five minutes for the policy to propagate to all load balancer instances.
5. Use the following command to send a request to the Gateway:

   curl http://GATEWAY_IP_ADDRESS/get -H "Host: HOST_NAME"

   Where:

   • GATEWAY_IP_ADDRESS is the IP address of the Gateway. You can retrieve the Gateway IP address using the following command, where GATEWAY_NAME is the name of the Gateway:

     kubectl get gateways.gateway.networking.k8s.io GATEWAY_NAME -o=jsonpath="{.status.addresses[0].value}"

   • HOST_NAME is the hostname defined in the Gateway's HTTPRoute.
6. The request should fail because default security is enabled by setting defaultSecurityEnabled: true in the API Extension policy resource. You should see a response similar to the following:

   {"fault":{"faultstring":"Raising fault. Fault name : RF-insufficient-request-raise-fault","detail":{"errorcode":"steps.raisefault.RaiseFault"}}}

   This indicates that the Apigee extension policy is active and that API key enforcement and access token verification is active.

What's next

• Learn how to Add policies to the GKE Gateway.
• Learn how to Uninstall the Apigee Operator for Kubernetes.