Topik ini menjelaskan cara mengaktifkan klien non-SNI, klien HTTP, dan kombinasi keduanya
untuk digunakan dengan Apigee hybrid.
Cara mengonfigurasi klien non-SNI
Bagian ini menjelaskan cara mengaktifkan dukungan untuk klien non-SNI (Server Name Indication) di Apigee hybrid. Klien non-SNI menggunakan port 443 dan diperlukan jika Anda ingin mengintegrasikan
instance runtime campuran dengan Cloud Load Balancing Google
atau untuk klien yang tidak mendukung SNI.
Buat definisi resource kustom (CRD) ApigeeRoute. Pastikan enableNonSniClient
ditetapkan ke true:
credential_name adalah nama Secret Kubernetes yang di-deploy ke cluster yang berisi kredensial TLS untuk virtualhost Anda. Anda dapat menemukan nama kredensial dengan
Perintah kubectl berikut:
kubectl -n apigee get ApigeeRoutes -o=yaml | grep credentialName
hostnames harus ditetapkan ke karakter pengganti "*".
Buka file penggantian dan buat perubahan yang dijelaskan di langkah berikutnya.
Untuk setiap grup lingkungan, tambahkan nama ApigeeRoute ke properti additionalGateways. Contoh:
Apa yang terjadi jika cluster memiliki lebih dari satu organisasi?
Karena ingress berada di tingkat cluster untuk port tertentu (443), dan hanya boleh ada satu pasangan kunci/sertifikat untuk CRD ApigeeRoute, semua organisasi harus memiliki pasangan kunci/sertifikat yang sama.
Apa yang terjadi jika cluster memiliki lebih dari satu grup lingkungan. Apakah akan berfungsi
jika host virtual memiliki pasangan kunci/sertifikat yang sama?
Semua nama host di semua grup lingkungan harus menggunakan pasangan kunci/sertifikat yang sama.
Mengapa kita membuat ApigeeRoute, bukan Gateway?
ApigeeRoutes dapat divalidasi oleh Apigee; tetapi,
Gateway (CRD Istio) tidak dapat.
Secara teknis, bahkan Gateway dapat berfungsi, tetapi kita dapat mencegah potensi kesalahan konfigurasi
(melalui webhook validasi).
Mengaktifkan klien HTTP
Bagian ini menjelaskan dukungan untuk klien HTTP yang akan digunakan dengan Apigee hybrid.
Buat definisi resource kustom (CRD) ApigeeRoute. Contoh:
hostname harus ditetapkan ke karakter pengganti "*".
credential_name adalah nama Secret Kubernetes yang di-deploy ke cluster yang berisi kredensial TLS untuk virtualhost Anda. Anda dapat menemukan nama kredensial dengan
Perintah kubectl berikut:
kubectl -n apigee get ApigeeRoutes -o=yaml | grep credentialName
Buka file penggantian dan buat perubahan yang dijelaskan di langkah berikutnya.
Untuk setiap grup lingkungan, tambahkan nama ApigeeRoute ke properti additionalGateways. Contoh:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis document provides instructions on enabling non-SNI clients, HTTP clients, or a combination of both for Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eEnabling non-SNI clients requires setting \u003ccode\u003eenableNonSniClient\u003c/code\u003e to \u003ccode\u003etrue\u003c/code\u003e in the ApigeeRoute custom resource definition (CRD) and configuring the \u003ccode\u003eadditionalGateways\u003c/code\u003e property in the overrides file.\u003c/p\u003e\n"],["\u003cp\u003eTo enable HTTP clients, an ApigeeRoute CRD must be created with the port set to 80 and the protocol to HTTP, then added to the \u003ccode\u003eadditionalGateways\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eSupporting both non-SNI and HTTP clients requires a combined ApigeeRoute CRD configuration that includes both port 443 (HTTPS) and port 80 (HTTP) within the same definition.\u003c/p\u003e\n"],["\u003cp\u003eWhen using multiple orgs or environment groups, all must share the same key/cert pair for the ApigeeRoute CRD.\u003c/p\u003e\n"]]],[],null,["# Enable non-SNI and HTTP clients\n\n| You are currently viewing version 1.7 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable non-SNI clients, HTTP clients, and a combination of both\nfor use with Apigee hybrid.\n\nHow to configure a non-SNI client\n---------------------------------\n\nThis section explains how to enable support for non-SNI ([Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)) clients in Apigee hybrid. A non-SNI client uses port 443 and is required if you want to integrate hybrid runtime instances with Google [Cloud Load Balancing](https://cloud.google.com/load-balancing/docs) or for clients that do not support SNI.\n\n1. Create an ApigeeRoute custom resource definition (CRD). Be sure that `enableNonSniClient` is set to `true`: \n\n ```actionscript-3\n apiVersion: apigee.cloud.google.com/v1alpha1\n kind: ApigeeRoute\n metadata:\n name: route_name\n namespace: apigee\n spec:\n hostnames:\n - \"*\"\n ports:\n - number: 443\n protocol: HTTPS\n tls:\n credentialName: credential_name\n mode: SIMPLE\n #optional\n minProtocolVersion: TLS_AUTO\n selector:\n app: istio-ingressgateway\n enableNonSniClient: true\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003eroute_name\u003c/var\u003e is the name you give to the CRD.\n - \u003cvar translate=\"no\"\u003ecredential_name\u003c/var\u003e is the name of a Kubernetes Secret deployed to the cluster that contains TLS credentials for your virtualhost. You can find the credential name with the following `kubectl` Command: \n\n ```\n kubectl -n apigee get ApigeeRoutes -o=yaml | grep credentialName\n ```\n - `hostnames` must be set to the wildcard \"\\*\". **Note:**Do not create two ApigeeRoute objects with a wildcard \"\\*\" hostname.\n2. Open your overrides file and make the change described in the next step.\n3. For each environment group, add the ApigeeRoute name to the `additionalGateways` property. For example: \n\n ```scdoc\n virtualhosts:\n - name: default\n sslCertPath: ./certs/fullchain.pem\n sslKeyPath: ./certs/privkey.pem\n additionalGateways: [\"route_name\"]\n ```\n4. Save the CRD file. For example: `ApigeeRoute.yaml`\n5. Apply the CRD to the cluster: \n\n ```\n kubectl apply -f ApigeeRoute.yaml -n apigee\n ```\n6. Apply the change to `virtualhosts`: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides.yaml --settings virtualhosts --env $ENVIRONMENT\n ```\n\nUsage notes\n-----------\n\n- **What happens if the cluster has more than one org?**\n\n\n Since the ingress is at the cluster level for a given port (443), and there can only\n be one key/cert pair for the ApigeeRoute CRD, all orgs must share the same key/cert pair.\n- **What happens if the cluster has more than one environment group. Will it work\n if the virtual hosts share the same key/cert pair?**\n\n\n All hostnames across all environment groups must use the same key/cert pair.\n- **Why are we creating an ApigeeRoute instead of Gateway?**\n\n\n ApigeeRoutes can be validated by Apigee; however,\n [Gateway](https://istio.io/latest/docs/reference/config/networking/gateway/) (the Istio CRD) cannot be.\n Technically, even Gateway can work, but we can prevent potential configuration mistakes\n (through a validation webhook).\n\nEnable HTTP clients\n-------------------\n\n\nThis section explains support for HTTP clients for use with Apigee hybrid.\n| **Note:** We do not recommend enabling port 80. All transmission, especially API traffic, should be over TLS (1.2 or higher).\n\n1. Create an ApigeeRoute custom resource definition (CRD). For example: \n\n ```actionscript-3\n apiVersion: apigee.cloud.google.com/v1alpha1\n kind: ApigeeRoute\n metadata:\n name: route_name\n namespace: apigee\n spec:\n hostnames:\n - \"*\"\n ports:\n - number: 80\n protocol: HTTP\n selector:\n app: istio-ingressgateway\n enableNonSniClient: true\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003eroute_name\u003c/var\u003e is the name you give to the CRD.\n - `hostnames` must be set to the wildcard \"\\*\". **Note:**Do not create two ApigeeRoute objects with a wildcard \"\\*\" hostname.\n2. Open your overrides file and make the change described in the next step.\n3. For each environment group, add the ApigeeRoute name to the `additionalGateways` property. For example: \n\n ```scdoc\n virtualhosts:\n - name: default\n sslCertPath: ./certs/fullchain.pem\n sslKeyPath: ./certs/privkey.pem\n additionalGateways: [\"route_name\"]\n ```\n4. Save the CRD file. For example: `ApigeeRoute.yaml`\n5. Apply the CRD to the cluster: \n\n ```\n kubectl apply -f ApigeeRoute.yaml -n apigee\n ```\n6. Apply the change to `virtualhosts`: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides.yaml --settings virtualhosts --env $ENVIRONMENT\n ```\n\nEnable support for both non-SNI and HTTP clients\n------------------------------------------------\n\n\nThis section explains how to enable **both** non-SNI (port 443) and HTTP (port 80) clients\nfor use with Apigee hybrid.\n| **Note:** We do not recommend enabling port 80. All transmission, especially API traffic, should be over TLS (1.2 or higher).\n\n1. Create an ApigeeRoute custom resource definition (CRD). For example: \n\n ```actionscript-3\n apiVersion: apigee.cloud.google.com/v1alpha1\n kind: ApigeeRoute\n metadata:\n name: route_name\n namespace: apigee\n spec:\n hostnames:\n - \"*\"\n ports:\n - number: 443\n protocol: HTTPS\n tls:\n credentialName: credential_name\n mode: SIMPLE\n #optional\n minProtocolVersion: TLS_AUTO\n - number: 80\n protocol: HTTP\n selector:\n app: istio-ingressgateway\n enableNonSniClient: true\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003eroute_name\u003c/var\u003e is the name you give to the CRD.\n - `hostname` must be set to the wildcard \"\\*\". **Note:**Do not create two ApigeeRoute objects with a wildcard \"\\*\" hostname.\n - \u003cvar translate=\"no\"\u003ecredential_name\u003c/var\u003e is the name of a Kubernetes Secret deployed to the cluster that contains TLS credentials for your virtualhost. You can find the credential name with the following `kubectl` Command: \n\n ```\n kubectl -n apigee get ApigeeRoutes -o=yaml | grep credentialName\n ```\n2. Open your overrides file and make the change described in the next step.\n3. For each environment group, add the ApigeeRoute name to the `additionalGateways` property. For example: \n\n ```scdoc\n virtualhosts:\n - name: default\n sslCertPath: ./certs/fullchain.pem\n sslKeyPath: ./certs/privkey.pem\n additionalGateways: [\"route_name\"]\n ```\n4. Save the CRD file. For example: `ApigeeRoute.yaml`\n5. Apply the CRD to the cluster: \n\n ```\n kubectl apply -f ApigeeRoute.yaml -n apigee\n ```\n6. Apply the change to `virtualhosts`: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides.yaml --settings virtualhosts --env $ENVIRONMENT\n ```"]]
