You are currently viewing version 1.6 of the Apigee hybrid documentation.This version is end of life. You should upgrade to a newer version. For more information, seeSupported versions.

The Apigee Hybrid management plane ordinarily communicates with theMART service in the runtime plane viaApigee Connect. This is the recommended configuration. However, if you want to use the MART Istio ingress gateway service instead of Apigee Connect, you will want to expose the MART endpoint to requests coming from outside of the cluster. The MART endpoint is a secure TLS connection. Hybrid uses anIstio ingress gateway service to expose traffic to this endpoint.

This MART setup requires you to provide a trusted TLS key/certificate pairand a qualified domain name. Self-signed certificates are not permitted. For an exampleshowing how to obtain a certificate signed by a CA, seeObtain TLS credentials.

This topic explains the steps to take to expose the MART endpoint.

Adding the MART service account

MART requires a Google Cloud service account for authentication.

1. In the Google Cloud setup step,Add service accounts, you created a service account with no role for MART. Locate the key file you downloaded for that service account. The file should have a.json extension.
2. Add the key file path to themart.serviceAccountPath property:

   ...mart:  sslCertPath:  sslKeyPath:  hostAlias:serviceAccountPath: "path to a file"...

   For example:

   ...mart:  sslCertPath:  sslKeyPath:  hostAlias:serviceAccountPath: "your_keypath/mart-service-account.json...

Adding TLS credentials and the host alias

1. Open your overrides file.
2. Add themart.sslCertPath,mart.sslKeyPath, andmart.hostAlias properties. The following table describes these properties:

   Property	Value
   mart.sslCertPath mart.sslKeyPath	The MART certificate/key pair must be authorized by a certificate authority (CA). If you have not previously created an authorized cert/key pair, then you must do so now and enter the certificate and key filenames for the corresponding property values. If you need help generating the authorized cert/key pair, seeObtain TLS credentials: An example.NOTE: The Common Name (CN) in the cert must agree with the value specified in themart.hostAlias property. If the CN is*.hybrid-domain.net and you've registered the hostmart.hybrid-domain.net, then you would setmart.hostAlias to the valuemart.hybrid-domain.net.
   mart.hostAlias.	(Required) A qualified DNS name for the MART server endpoint. For example,foo-mart.mydomain.com.

   For example, where the host alias is a qualified domain name:

   ...mart:  sslCertPath:path-to-file/mart-server.crt  sslKeyPath:path-to-file/mart-server.key  hostAlias: foo-mart.mydomain.com  serviceAccountPath: "your_keypath/mart-service-account.json...

3. Save your changes.