This topic discusses the virtualhosts configuration property. Virtual hosts allow Apigee hybrid to handle API requests to hostaliases associated with an environment group. For more information, see Routing and base paths in the About environments and environment groups topic.
... virtualhosts: - name: my-env-group sslCertPath: ./certs/fullchain.pem sslKeyPath: ./certs/privkey.pem ...
When an API proxy call comes, it is routed to the host alias(es) of the environment group where the API proxy is deployed.
Adding multiple virtual hosts
virtualhosts property is an array, and therefore you can create more than
... virtualhosts: - name: my-env-group-1 sslCertPath: ./certs/fullchain.pem sslKeyPath: ./certs/privkey.pem - name: my-env-group-2 sslCertPath: ./certs/fullchain.pem sslKeyPath: ./certs/privkey.pem ...
For information about configuring TLS, see Configuring TLS and mTLS on the Istio ingress.
If you only add or change the
property, and nothing else, then you can apply those changes with the
apigeectl apply -f overrides-file.yaml ‑‑settings virtualhosts
If, for example, you change
envs, then you must
apply the change without using
‑‑settings, like this, to update the cluster. For
apigeectl apply -f overrides-file.yaml --envs my-environment
or, to update the component for all environments:
apigeectl apply -f overrides-file.yaml --all-envs
TLS keys and certificates
virtualhost property requires a TLS key and certificate.
The key/cert are used to provide secure communication with the ingress gateway and
must be compatible with the host aliases used in the specified environment group.
It is up to you how you generate proper TLS certificate/key pairs for your hybrid configuration. The following topics are provided as samples only, intended primarily for trying out or testing a new hybrid installation if it isn't feasible to obtain TLS credentials in another way:
- See Obtain TLS credentials for a set of sample steps for creating an authorized TLS certificate/key pair.
- You can use a self-signed certificate/key pair(s) for testing purposes only. See Generate self-signed TLS credentials.