Bidang pengelolaan Apigee Hybrid harus dapat menjangkau
layanan MART
di bidang runtime. Oleh karena itu, Anda harus mengekspos endpoint MART
ke permintaan yang berasal dari luar cluster.
Endpoint MART adalah koneksi TLS yang aman. Hybrid menggunakan
layanan gateway masuk
Istio untuk mengekspos traffic ke endpoint ini.
Topik ini menjelaskan langkah-langkah yang harus dilakukan untuk mengekspos endpoint MART.
Menambahkan akun layanan MART
MART memerlukan akun layanan GCP untuk autentikasi.
Pada langkah penyiapan GCP, Tambahkan akun layanan, Anda
membuat akun layanan tanpa peran untuk MART.
Temukan file kunci yang Anda download untuk akun layanan tersebut.
File harus memiliki ekstensi .json.
Tambahkan jalur file kunci ke properti mart.serviceAccountPath:
...
mart:
sslCertPath:
sslKeyPath:
hostAlias:
serviceAccountPath: "path to a file"
...
Pasangan kunci/sertifikat MART harus diotorisasi oleh certificate authority (CA).
Jika sebelumnya Anda belum membuat pasangan kunci/sertifikat yang diotorisasi, Anda harus melakukannya
sekarang dan memasukkan nama file kunci dan sertifikat untuk nilai properti
yang sesuai. Jika Anda memerlukan bantuan untuk membuat pasangan kunci/sertifikat yang diotorisasi, lihat
Mendapatkan kredensial TLS: Contoh.
mart.hostAlias.
(Wajib) Nama DNS yang memenuhi syarat untuk endpoint server MART. Misalnya,
foo-mart.mydomain.com.
Misalnya, jika alias host adalah nama domain yang memenuhi syarat:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis documentation version (1.4) is end-of-life and users should upgrade to a newer, supported version.\u003c/p\u003e\n"],["\u003cp\u003eThe Apigee Hybrid management plane requires access to the MART service in the runtime plane, necessitating the exposure of the MART endpoint to external requests via a secure TLS connection.\u003c/p\u003e\n"],["\u003cp\u003eExposing the MART endpoint requires a trusted TLS key/certificate pair, which cannot be self-signed, and a qualified domain name.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003emart.serviceAccountPath\u003c/code\u003e property in the configuration file must include the path to the JSON key file for the MART service account.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003emart.sslCertPath\u003c/code\u003e, \u003ccode\u003emart.sslKeyPath\u003c/code\u003e, and \u003ccode\u003emart.hostAlias\u003c/code\u003e properties need to be specified in the overrides file, ensuring the Common Name (CN) in the certificate matches the \u003ccode\u003emart.hostAlias\u003c/code\u003e value.\u003c/p\u003e\n"]]],[],null,["# MART configuration\n\n| You are currently viewing version 1.4 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThe Apigee Hybrid management plane must be able to reach the\n[MART service](/apigee/docs/hybrid/v1.4/what-is-hybrid#management-api-mart)\nin the runtime plane. For this reason, you must expose the MART\nendpoint to requests coming from outside of the cluster.\nThe MART endpoint is a secure TLS connection. Hybrid uses an\n[Istio\ningress gateway service](https://istio.io/docs/tasks/traffic-management/ingress/) to expose traffic to this endpoint.\n| The MART setup requires you to provide a trusted TLS key/certificate pair and a qualified domain name. Self-signed certificates are not permitted. For an example showing how to obtain a certificate signed by a CA, see [Obtain\n| TLS credentials](/apigee/docs/hybrid/v1.4/lets-encrypt).\n\n\nThis topic explains the steps to take to expose the MART endpoint.\n\nAdding the MART service account\n-------------------------------\n\n\nMART requires a GCP service account for authentication.\n\n1. In the GCP setup step, [Add service accounts](/apigee/docs/hybrid/v1.4/precog-serviceaccounts), you created a service account with no role for MART. Locate the key file you downloaded for that service account. The file should have a `.json` extension.\n2. Add the key file path to the `mart.serviceAccountPath` property: \n\n ```\n ...\n mart:\n sslCertPath:\n sslKeyPath:\n hostAlias:\n serviceAccountPath: \"path to a file\"\n ...\n ```\n\n\n For example: \n\n ```\n ...\n mart:\n sslCertPath:\n sslKeyPath:\n hostAlias:\n serviceAccountPath: \"your_keypath/mart-service-account.json\n ...\n ```\n\nAdding TLS credentials and the host alias\n-----------------------------------------\n\n1. Open your overrides file.\n2. Add the `mart.sslCertPath`, `mart.sslKeyPath`, and `mart.hostAlias` properties. The following table describes these properties:\n\n\n For example, where the host alias is a qualified domain name: \n\n ```\n ...\n\n mart:\n sslCertPath: \u003cvar translate=\"no\"\u003epath-to-file\u003c/var\u003e/mart-server.crt\n sslKeyPath: \u003cvar translate=\"no\"\u003epath-to-file\u003c/var\u003e/mart-server.key\n hostAlias: foo-mart.mydomain.com\n serviceAccountPath: \"your_keypath/mart-service-account.json\n\n ...\n ```\n3. Save your changes."]]
