JENNY BROWN: Hi.
Today I'll be talking to you about
an exciting new capability Google Cloud has developed
called Apigee Adapter for Envoy.
[MUSIC PLAYING]
The goal of Apigee Adapter for Envoy
is to help you integrate Envoy-based services
into your Apigee environment.
This means you could do things like publish your services
as APIs, make them visible to other developers,
add governance capabilities to control access to those APIs,
and analyze usage metrics to see how
your APIs are being consumed.
Let's talk a little bit more about how we do this.
Behind the scenes, Apigee Adapter for Envoy boy
uses Envoy's external authorization filter,
which is designed to allow Envoy to delegate authorization
decisions to an external system.
In this demo, I'll show you how to use
Envoy to protect an end point.
I'll add an Envoy facade on it, which
is configured to talk to the Apigee Adapter for Envoy.
Let's dive in.
I have an API product, which, in Apigee, is the subscription
point or what consumers subscribe to.
To begin with, I have nothing configured in this API product.
The first step is to bind the endpoint httpbin.org
to the API product.
With this command I've just entered,
we have provided a CLI, which allows
you to add the endpoint httpbin.org to the product
httpbin.
When I refresh my page, you'll see
the endpoint is bound to the API product, httpbin.
Now we can turn our attention to the components that are
going to run on my workstation.
I'll start with Analytics which, is shipped by Apigee.
It gathers metrics from Envoy that
measures the consumption of the API,
such as the number of successes, who's
been invoking APIs, et cetera.
I'm entering a simple script that
starts the analytics component of the adapter.
And the analytics component is now running.
The next component I'm going to start is Envoy itself.
Before I start Envoy, I want to highlight two pieces
in the configuration--
the prefix and how it handles requests.
I'll be matching the prefix httpbin.
I'm configuring it such that all requests
will pass through the Envoy proxy
and go to the Apigee adapter.
The adapter will determine whether the consumer has access
or not, and will reject those that don't have access.
Let's go ahead and start Envoy.
So now I have the analytics and Envoy components started.
The last component that I need to start
is the Apigee adapter for Envoy itself.
This is what advises Envoy whether to allow or deny
a call.
And for that, I've got a script here.
Now all three components are running.
Let's try and access the API endpoint get.
Because I don't have a token, it didn't work
and the call was rejected.
Let me go and get the token from Apigee.
Once I have the token, I'll rerun the command
to access the API endpoint, this time
by passing a token as a parameter.
And this time around, I'm able to access the API endpoint.
Now let's take a look at what was in that token.
It has the audience, remote service client.
It also indicates which products the consumer can access.
In this case.
That's the product httpbin.
These elements were then enforced by Envoy.
What I just showed you is how an API consumer
would access this endpoint.
Another way this could be done is
by publishing this endpoint and a product on an API portal.
When developers come to the API portal,
they can view and access their APIs.
The API portal also allows developers to grab credentials
for their httpbin product.
The credentials are masked here for security purposes.
Once developers get their credentials,
they can access the API, like I showed earlier.
Through all these interactions, analytics
are being collected and transmitted
to the Apigee control panel.
Looking at API metrics here, you'll
notice that httpbin.org is getting requests,
and I can view the data for that.
This is how you can use the Apigee adapter for Envoy
to enforce policies for any service that's using Envoy.
Now that you know how it works and what it does,
let me talk to you about how to start using the Apigee
adapter for Envoy.
The easiest way to get started is
from our Docs page, which I've linked in the description
for this video.
That's where we've outlined three examples that you
can follow to get started--
native Envoy with Apigee Edge for public cloud,
Istio side car with Apigee hybrid,
and native Envoy with Apigee for private cloud.
The Apigee adapter for Envoy can also
be used by anyone who uses Istio or Google Anthos service mesh.
To get started with those, get in touch with your Google Cloud
account team.
In summary, the Apigee adapter for Envoy
gives you an easy way to plug API management capabilities,
such as publishing, visibility, governance, and usage
analytics, into those services that require them.
Links to more information, like code labs and blog posts,
are in the description below.
And be sure to check out our other videos
and let us know what else you'd like to learn about Apigee.
[MUSIC PLAYING]