SPEAKER: Hello, and welcome to this episode of the Apigee
Accelerator Series.
In this video, we'll demonstrate how
to expose your APIs to external consumers
on the internet via Apigee.
When you first provision an Apigee X instance,
one of the steps you'll need to decide
is whether you want to allow traffic from external clients.
By themselves, newly created Apigee X instances
are only accessible to clients within your Google Cloud
network.
Internal API consumers can reach your APIs
using Apigee's internal IP address,
but they won't be visible to external consumers.
While this might be fine for some organizations,
many need to expose their APIs to external consumers
over the internet.
Using Google Cloud Load Balancing,
you can provide external access to your Apigee instances
wherever they're located.
Google Cloud Load Balancing is a globally-distributed
software-defined managed service for all your API
and application traffic.
With Cloud Load Balancing, you can also
enable Cloud Armor for WAF and DDoS protection,
or leverage Cloud CDN for global caching
using Google's edge network.
To expose an Apigee X instance to the internet,
simply deploy an external load balancer in your Google Cloud
VPC.
You'll assign an external IP address
and hostname to this load balancer,
and this is where your external consumers will connect.
Apigee's provisioning tools, such as our step-by-step
wizard, offer to create an external load balancer for you
during the setup process, and this
is the quickest way to get started if you'd
like to enable external access.
However, if you decide to begin with internal-only access
and later realize you need to expose APIs externally,
this sample will show you how.
There are a couple of ways to connect the External Load
Balancer to your Apigee X instance.
In this sample, we leverage Private Service Connect,
or PSC, to connect to the Apigee instance.
You can find more information about these options
in our documentation.
Now let's see how to deploy this sample.
In order to run this sample, you'll
need an Apigee X instance provisioned
with no internet access configured.
As a user, you'll need permissions
to configure access routing.
This can be granted through the Compute Network Admin role.
You'll also need the ability to create environments in Apigee,
and this can be enabled using the Org Admin
or the Environment Admin role.
To deploy this sample, you'll also
need the command-line tools shown here.
If you're using Google Cloud Shell,
these are already installed.
We've included a Cloud Shell tutorial which you can simply
click to quickly get started.
Now that you're in the Cloud Shell environment,
you can follow the step-by-step instructions.
First, change to the directory for this sample.
To deploy the sample, first open up the env.sh file
and set the configuration to reference your Apigee project,
VPC network, and subnet.
Next, run the included script to deploy the load balancer
components.
This process will take some time to complete while certificate
provisioning occurs.
When the script completes, you should
see a message showing the external runtime hostname
and a sample curl command.
Run the curl command to send a test request.
You should see a success response returned,
along with the response body, "Apigee ingress is healthy,"
which indicates the instance is reachable via the external URL.
If you see an SSL error, wait a second and try again.
Now let's take a quick look at what components were created.
Go to the Apigee Management UI at Apigee.Google.com.
Under the Admin Environment section,
you should see a sample environment.
Under the Environment Groups section,
you should see a corresponding group
with a host name that was created.
For this sample, we use nip.io to provide a DNS entry
based on the external IP of the load balancer.
Apigee uses the hostname of incoming requests
to route API calls to the correct environment.
Under the Instances section, you can see the PSC Service
Attachment.
The external load balancer connects to this.
Next, switch to the GCP Console and select Load Balancing
under Network Services.
You should see the load balancer that
was deployed by the script.
If you click the load balancer, you'll
see the Details page, showing the external IP address
and port number and the TLS certificate that
was provisioned with the external nip.io hostname.
At the bottom of the Load Balancer Details page,
you can see the backend configuration.
The backend service contains a Network Endpoint Group, or NEG,
that points to the PSC Service Attachment we saw before.
Now you've seen how simple it is to create an external load
balancer in front of Apigee.
When you're done with the sample,
you can provide us with your feedback.
And then, you can use the cleanup script
to delete the configuration that was deployed to your Google
Cloud project.
We hope you found this useful, and if you enjoyed the video,
please hit the Like button below.
You can also subscribe to our channel
to see more videos in the Apigee Accelerator series.
And if you have questions, please post them
on the Apigee community.
Thanks for watching.