Topik ini menjelaskan cara mengaktifkan TLS satu arah dan mTLS di ingress Istio.
Mengonfigurasi TLS satu arah
Gunakan TLS satu arah untuk mengamankan endpoint proxy API di ingress Istio. Untuk mengaktifkan TLS satu arah, Anda mengonfigurasi traffic masuk dengan pasangan kunci/sertifikat TLS atau dengan Secret Kubernetes, seperti yang dijelaskan dalam opsi berikut.
Opsi 1: pasangan kunci/sertifikat
Berikan file kunci dan sertifikat SSL di properti virtualhosts dalam file penggantian Anda:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, dan $CERT_FILE dan $KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Opsi 2: Secret Kubernetes
Buat Secret Kubernetes di namespace istio-system dan tambahkan nama Secret ke file penggantian Anda:
Konfigurasikan properti virtualhosts di file penggantian Anda:
virtualhosts:
- name: $ENVIRONMENT_GROUP_NAME
tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.
sslSecret: $SECRET_NAME
Mengonfigurasi mTLS
Sebagai ganti TLS satu arah, Anda dapat mengonfigurasi mTLS di ingress Istio. Ada dua
opsi untuk mengonfigurasi mTLS, seperti yang dijelaskan di bawah.
Opsi 1: pasangan kunci/sertifikat dan file CA
Berikan sertifikat Certificate Authority (CA) dengan file kunci dan sertifikat SSL di
properti virtualhosts dalam file penggantian Anda:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, $CA_FILE adalah sertifikat resmi, dan $CERT_FILE dan
$KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Opsi 2: Secret Kubernetes
Buat dua secret Kubernetes di namespace
istio-system. Secret pertama adalah untuk CA dan yang kedua adalah untuk pasangan kunci/sertifikat SSL.
Kemudian, tambahkan ke file penggantian Anda.
Buat dua secret Kubernetes di namespace
istio-system. Secret pertama adalah untuk CA dan yang kedua adalah untuk pasangan kunci/sertifikat SSL:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eThis document details the process of enabling one-way TLS and mTLS on the Istio ingress for securing API proxy endpoints.\u003c/p\u003e\n"],["\u003cp\u003eOne-way TLS can be configured using either TLS key/cert pairs or by using a Kubernetes Secret.\u003c/p\u003e\n"],["\u003cp\u003emTLS configuration options include using a key/cert pair with a CA certificate file or utilizing two distinct Kubernetes Secrets, one for the CA and another for the SSL cert/key pair.\u003c/p\u003e\n"],["\u003cp\u003eIt is important to know this documentation is for version 1.3 of the Apigee hybrid documentation which is now end of life and should be upgraded.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS and mTLS on the Istio ingress\n\n| You are currently viewing version 1.3 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable on-way TLS and mTLS on the Istio ingress.\n\nConfiguring one-way TLS\n-----------------------\n\nUse one-way TLS to secure API proxy endpoints on the Istio ingress. To enable\none-way TLS, you configure the ingress with TLS cert/key pairs or with a Kubernetes\nSecret, as explained in the following options.\n\n### Option 1: key/cert pair\n\n\nProvide SSL cert and key files in the `virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and \u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.3/install-download-install#create-tls-certificates).\n\n### Option 2: Kubernetes Secret\n\n\nCreate a [Kubernetes Secret](https://kubernetes.io/docs/concepts/configuration/secret/) in the `istio-system`\nnamespace and add the Secret name to your overrides file:\n\n1. Create the Secret: \n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.\n sslSecret: $SECRET_NAME\n ```\n\nConfiguring mTLS\n----------------\n\n\nInstead of one-way TLS, you can configure [mTLS](https://en.wikipedia.org/wiki/Mutual_authentication) on the Istio ingress. There are two\noptions for configuring mTLS, as explained below.\n\n### Option 1: key/cert pair and CA file\n\n\nProvide a Certificate Authority (CA) certificate with SSL cert and key files in the\n`virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL\n caCertPath: \"$CA_FILE\"\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, \u003cvar translate=\"no\"\u003e$CA_FILE\u003c/var\u003e is an authorized certificate, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.3/install-download-install#create-tls-certificates).\n\n### Option 2: Kubernetes Secrets\n\nCreate two Kubernetes secrets in the `istio-system` namespace. The first secret is for the CA and the second is for the SSL cert/key pair. Then, add them to your overrides file.\n\n1. Create two Kubernetes secrets in the `istio-system` namespace. The first secret is for the CA and the second is for the SSL cert/key pair: \n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Create a secret for the CA: \n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME-cacert \\\n --from-file=cacert=$CA_FILE\n ```\n3. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL # Note: Be sure to specify MUTUAL\n sslSecret: $SECRET_NAME\n ```"]]
