Bidang pengelolaan Apigee Hybrid harus dapat menjangkau
layanan MART
di bidang runtime. Oleh karena itu, Anda harus mengekspos endpoint MART
ke permintaan yang berasal dari luar cluster.
Endpoint MART adalah koneksi TLS yang aman. Hybrid menggunakan
layanan gateway masuk
Istio untuk mengekspos traffic ke endpoint ini.
Topik ini menjelaskan langkah-langkah yang harus dilakukan untuk mengekspos endpoint MART.
Menambahkan akun layanan MART
MART memerlukan akun layanan GCP untuk autentikasi.
Pada langkah penyiapan GCP, Tambahkan akun layanan, Anda
membuat akun layanan tanpa peran untuk MART.
Temukan file kunci yang Anda download untuk akun layanan tersebut.
File harus memiliki ekstensi .json.
Tambahkan jalur file kunci ke properti mart.serviceAccountPath:
...
mart:
sslCertPath:
sslKeyPath:
hostAlias:
serviceAccountPath: "path to a file"
...
Pasangan kunci/sertifikat MART harus diotorisasi oleh certificate authority (CA).
Jika sebelumnya Anda belum membuat pasangan kunci/sertifikat yang diotorisasi, Anda harus melakukannya
sekarang dan memasukkan nama file kunci dan sertifikat untuk nilai properti
yang sesuai. Jika Anda memerlukan bantuan untuk membuat pasangan kunci/sertifikat yang diotorisasi, lihat
Mendapatkan kredensial TLS: Contoh.
mart.hostAlias.
(Wajib) Nama DNS yang memenuhi syarat untuk endpoint server MART. Misalnya,
foo-mart.mydomain.com.
Misalnya, jika alias host adalah nama domain yang memenuhi syarat:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis documentation is for Apigee hybrid version 1.1, which is end-of-life, and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eThe MART endpoint must be exposed to external requests for the Apigee Hybrid management plane to function, using a secure TLS connection facilitated by an Istio ingress gateway service.\u003c/p\u003e\n"],["\u003cp\u003eExposing the MART endpoint requires a trusted TLS key/certificate pair and a qualified domain name; self-signed certificates are not allowed.\u003c/p\u003e\n"],["\u003cp\u003eA GCP service account is necessary for MART authentication, and the path to its key file (with a \u003ccode\u003e.json\u003c/code\u003e extension) must be specified in the \u003ccode\u003emart.serviceAccountPath\u003c/code\u003e property of the overrides file.\u003c/p\u003e\n"],["\u003cp\u003eIn the overrides file, the \u003ccode\u003emart.sslCertPath\u003c/code\u003e, \u003ccode\u003emart.sslKeyPath\u003c/code\u003e, and \u003ccode\u003emart.hostAlias\u003c/code\u003e properties must be defined, ensuring the certificate's Common Name (CN) matches the value specified in the \u003ccode\u003emart.hostAlias\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# MART configuration\n\n| You are currently viewing version 1.1 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThe Apigee Hybrid management plane must be able to reach the\n[MART service](/apigee/docs/hybrid/v1.1/what-is-hybrid#management-api-mart)\nin the runtime plane. For this reason, you must expose the MART\nendpoint to requests coming from outside of the cluster.\nThe MART endpoint is a secure TLS connection. Hybrid uses an\n[Istio\ningress gateway service](https://istio.io/docs/tasks/traffic-management/ingress/) to expose traffic to this endpoint.\n| The MART setup requires you to provide a trusted TLS key/certificate pair and a qualified domain name. Self-signed certificates are not permitted. For an example showing how to obtain a certificate signed by a CA, see [Obtain\n| TLS credentials](/apigee/docs/hybrid/v1.1/lets-encrypt).\n\n\nThis topic explains the steps to take to expose the MART endpoint.\n\nAdding the MART service account\n-------------------------------\n\n\nMART requires a GCP service account for authentication.\n\n1. In the GCP setup step, [Add service accounts](/apigee/docs/hybrid/v1.1/precog-serviceaccounts), you created a service account with no role for MART. Locate the key file you downloaded for that service account. The file should have a `.json` extension.\n2. Add the key file path to the `mart.serviceAccountPath` property: \n\n ```\n ...\n mart:\n sslCertPath:\n sslKeyPath:\n hostAlias:\n serviceAccountPath: \"path to a file\"\n ...\n ```\n\n\n For example: \n\n ```\n ...\n mart:\n sslCertPath:\n sslKeyPath:\n hostAlias:\n serviceAccountPath: \"your_keypath/mart-service-account.json\n ...\n ```\n\nAdding TLS credentials and the host alias\n-----------------------------------------\n\n1. Open your overrides file.\n2. Add the `mart.sslCertPath`, `mart.sslKeyPath`, and `mart.hostAlias` properties. The following table describes these properties:\n\n\n For example, where the host alias is a qualified domain name: \n\n ```\n ...\n\n mart:\n sslCertPath: \u003cvar translate=\"no\"\u003epath-to-file\u003c/var\u003e/mart-server.crt\n sslKeyPath: \u003cvar translate=\"no\"\u003epath-to-file\u003c/var\u003e/mart-server.key\n hostAlias: foo-mart.mydomain.com\n serviceAccountPath: \"your_keypath/mart-service-account.json\n\n ...\n ```\n3. Save your changes."]]
