How to connect multiple backend k8s services across namespaces from Apigee to achieve Multitenancy

[samirj]

We have a GKE cluster with multiple namesspaces for different Customers. Each namespace has Kubernetes service named "myService". 

We want to connect to these k8s services from Apigee proxies. When request comes from customer A  then "myService" from Namespace for Customer A should be called from Apigee proxy.

Similarly ,  When request comes from customer B then "myService" from Namespace for Customer B should be called from Apigee proxy.

What can be the optimal solution to make these 1-to-1 connections possible from Apigee proxy to corrospnding k8s service on respective Namespace.

@imesh @strebel @anilsr 

[strebel]

Hi @samirj, 

I assume you're using Apigee hybrid deployed to the same Kubernetes cluster as your backend services are running (this is important to use Kubernetes' internal DNS). 

This is a common use case that requires you to implement a mapping of your customer id (People usually get this from the App or a claim in the JWT) to a hostname. If you have consistent naming then you could extract the namespace using an Apigee policy from the token directly. Otherwise a KVM might be useful to figure out what namespace and service you want to call.

In any case you'll want to use the Kubernetes Service's internal hostname for as the target of your API proxy.
The last thing you need to do is to set this value as the target.url as described here.

[samirj]

@strebel  thanks for the response. We are using Apigee X. In this case the same above solutioin will apply ?

[strebel · Accepted solution]

That's a slightly more complicated story then. GKE provides integration with Cloud DNS that would allow you to address the service from a VPC outside the cluster. Please see this link here: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns#vpc_scope_dns