You are currently viewing version 1.1 of the Apigee hybrid documentation.This version is end of life. You should upgrade to a newer version. For more information, seeSupported versions.

This topic is intended as an example only. It explains how to obtain a TLS certificate from the certificate authority (CA)Let's Encrypt. These steps are provided primarily as an example to follow if you do not have another ready way to obtain a certificate/key pair that is authorized by a CA. The example shows how to generate certificates using theLet's Encrypt CA, theCertbot client, and Google Cloud PlatformCloud DNS.

Where you can use these credentials

You must provide TLS credentials for two Istio ingress gateways that are exposed outside the cluster:

Gateway	TLS requirement
MART ingress gateway	Requires an authorized TLS certificate/key pair.
Runtime ingress gateway	You can use a self-signed certificate/key pair or authorized TLS credentials.

See alsoExternal connections.

Requirements

• You will need a domain name obtained through a domain name registrar. You can register a domain name through Google Domains or another domain registrar of your choice.

Configure Cloud DNS

To obtain authorized TLS credentials, you must have a qualified domain name. The followingsteps explain how toGoogle Cloud DNS toobtain a domain name and manage your domain servers.

1. Open theGoogle Cloud console and log in with the account you created inStep 1: Create a Google Cloud account.
2. Select the project that you created inStep 2: Create a GCP project.
3. Enable the DNS API. SeeEnabling APIs.
4. Create two static IP addresses:
   • If you are on GKE, follow the instructions in Reserving a static external IP address to create two static IP addresses. You can give the addresses any name you wish, for example:apigee-hybrid-mart andapigee-hybrid-runtime. When you finish, you will have two IP numbers to use in the cluster configuration in the next step. For example:35.225.131.189 and34.66.75.196
   • If you are on Anthos GKE, follow instructions in the Anthos GKE documentation to create two static IP addresses.
5. Create a managed public zone. For instructions, see Create a managed public zone.
6. Get the External IP you reserved for theapigee-hybrid-mart.
7. Create record set for the MART endpoint. Enter the External IP you obtained in the previous step and add a prefix to the domain name, such asmart. For instructions, seeCreate a new record.

   

8. Get the External IP that you reserved forapigee-hybrid-runtime.
9. Create record set for the Istio ingress endpoint. This is the address for making API calls to the hybrid gateway. Enter the External IP you obtained in the previous step and add a prefix to the domain name, such asapitest. For instructions, seeCreate a new record.

   

10. Copy the DNS record data, as shown in the following example:

    

11. Return to your domain page atGoogle Domains.
12. Select your domain.
13. SelectDNS.
14. In the Name Servers section, clickEdit.

15. Enter the domain name servers that you copied from the Network Services Cloud DNS page:

    

Now, your Google Cloud DNS will manage the DNS records for your domain.

Install Certbot on a VM

Now that you have Cloud DNS set up to manage your domain servers, you will install the Certbot client with thedns_google plugin on a Cloud VM. The client enables you to get authorized certificates for your domain from a Let's Encrypt endpoint.

1. Open theGoogle Cloud console and log in with the account you created inStep 1: Create a Google Cloud account.
2. Select the project that you created inStep 2: Create a GCP project.
3. SelectIAM & admin > Service accounts.

   TheService accounts view displays a list of the project’s service accounts.

4. To create a new service account, click+Create Service Account at the top of the view.

   TheService account details view displays.

5. In theService account name field, enter the name of the service account.

   

   You can optionally add a description in theService account description field. Descriptions are helpful at reminding you what a particular service account is used for.

6. ClickCreate.

   GCP creates a new service account and displays theService account permissions view. Use this view to assign a role to your new service account.

7. Click theSelect a role drop-down list.
8. Select theProject Owner role.
9. ClickContinue.
10. ClickDone.
11. In the GCP console, selectCompute Engine > VM Instances.
12. Create a VM instance namedcertmanager.
13. Under the Boot Disk section, choose CentOS7 and 20 GB for the SSD persistent drive.
14. Set the Service Account to the one you created above.
15. Install Certbot and thedns_google plugin on the machine and run the Certbot client:

    sudo su -yum -y install yum-utilsyum install certbot -yyum install certbot-dns-google -ycertbot certonly --dns-google -d*.your_domain_name,*.your_domain_name --server https://acme-v02.api.letsencrypt.org/directory

    For example:

    sudo su -yum -y install yum-utilsyum install certbot -yyum install certbot-dns-google -ycertbot certonly --dns-google -d*.apigee-hybrid-docs.net,*.apigee-hybrid-docs.net --server https://acme-v02.api.letsencrypt.org/directory

16. You can now find your authorized certificate and private key files in this directory:cd /etc/letsencrypt/live/your_domain_name/

    For example:

    cd /etc/letsencrypt/live/apigee-hybrid-docs.netls  cert.pem  chain.pem  fullchain.pem  privkey.pem  README

17. Copy the filesfullchain.pem andprivkey.pem to your local machine.
18. Update your overrides file to point to the certificate and private key. For thehostAlias, use the DNS name that you created previously.

    For example:

    envs:  - name: test    sslCertPath: "$HOME/hybrid/apigee-hybrid-setup/tls/fullchain.pem"    sslKeyPath: "$HOME/hybrid/apigee-hybrid-setup/tls/privkey.pem"    hostAlias: "apitest.apigee-hybrid-docs.net"mart:  nodeSelector:    key: cloud.google.com/gke-nodepool    value: apigee-runtime  sslCertPath: "$HOME/hybrid/apigee-hybrid-setup/tls/fullchain.pem"  sslKeyPath: "$HOME/hybrid/apigee-hybrid-setup/tls/privkey.pem"  replicaCountMin: 1  replicaCountMax: 1  hostAlias: "mart.apigee-hybrid-docs.net"

19. Apply the changes:

    If you changed themart configuration, apply the changes:

    apigeectl apply -fyour_overrides_file -c mart

    If you changed theenvs configuration, apply the changes:

    apigeectl apply -fyour_overrides_file -c runtime

Test the configuration

Deploy and test a proxy, as explained inCreate and deploy a new API proxy.