Configure virtual hosts

This topic discusses the virtualhosts configuration property. Virtual hosts allow Apigee hybrid to handle API requests to hostaliases associated with an environment group. For more information, see Routing and base paths in the About environments and environment groups topic. 

...
virtualhosts:
  - name: my-env-group
    sslCertPath: ./certs/fullchain.pem
    sslKeyPath: ./certs/privkey.key
...

When an API proxy call comes, it is routed to the host alias(es) of the environment group where the API proxy is deployed.

For instructions on how to apply virtualhosts to the cluster, see Applying virtualhosts changes. For information about configuring TLS, see Configuring TLS and mTLS on the Istio ingress.

Adding multiple virtual hosts

The virtualhosts[] property is an array, and therefore you can create more than one. 

...
virtualhosts:
  - name: my-env-group-1
    sslCertPath: ./certs/fullchain1.pem
    sslKeyPath: ./certs/privkey1.key

  - name: my-env-group-2
    sslCertPath: ./certs/fullchain2.pem
    sslKeyPath: ./certs/privkey2.key
...

For information about configuring TLS, see Configuring TLS and mTLS on the Istio ingress.

Applying virtualhosts changes

If you only add or change the virtualhosts property, and nothing else, then you can apply those changes with the ‑‑settings flag: 

apigeectl apply -f overrides-file.yaml ‑‑settings virtualhosts

If, for example, you change virtualhosts and env, then you must apply the change without using ‑‑settings, like this, to update the cluster. For example:

apigeectl apply -f overrides-file.yaml --env my-environment

or, to update the component for all environments: 

apigeectl apply -f overrides-file.yaml --all-envs

TLS keys and certificates

The virtualhost property requires a TLS key and certificate. The key/cert are used to provide secure communication with the ingress gateway and must be compatible with the host aliases used in the specified environment group.

It is up to you how you generate proper TLS certificate/key pairs for your hybrid configuration. The following topics are provided as samples only, intended primarily for trying out or testing a new hybrid installation if it isn't feasible to obtain TLS credentials in another way: