Ingress for multiple orgs in apigee hybrid

[shalipriya]

We have apigee runtime setup installed for one org. We wanted to add another org in same cluster. As per documents I have to create newoverride.yaml file. Should I create a new service for ingress? Will that create a new loadbalancer again? 

[kidiyoor]

Multiple Apigee orgs in a k8s cluster is not supported in production even with our latest release 1.8. I am assuming you are trying this in non-prod.

Yes, every Apigee org should have its only Ingress deployments and load balancers.

[shalipriya]

Yes I am trying for nonprod. Instead of default service we are using customized service.yaml to create network loadbalancer in AWS. My doubt is if one cluster has 3 orgs. Then we need to create three loadbalancer? In that case what target IP to be given in service.yaml.

[kidiyoor · Accepted solution]

Yes, you need to create three load balancers with three different external IPs. You should configure each one of them with right selector label-

  selector:
    app: apigee-ingressgateway 
    ingress_name: INGRESS_NAME # use right ingress name.
    org: ORG_NAME # Use right org name.

[shalipriya]

What target ports should we give in service yaml file. All targets in listener is giving unhealthy health checks. I am referring to the loadbalancer created by ingress. 

[kidiyoor]

Target port for runtime traffic is 8443 and 15021 is the health check port(as mentioned here). If the target is still unhealthy it could be due to security groups/firewall rules.

Could you share load balancer details that you are trying to configure ? Maybe you are missing few security groups related annotations in your service, you would have to refer AWS load balancer documentation for this.

[shalipriya]

We have 3 org. So in all 3 service yaml I have to give same runtime traffic port? Instead of 443 port as mentioned in sample service yaml file will be using our customized ports. We are planning to use same domain name for all 3 orgs with different port numbers. 

[kidiyoor]

The service need to have target port as 8443, the exposed port(Eg. 443) can be anything.

If you are using 3 different service(each with its own load balancer and ingress deployment) then I don't see why you have to use different ports, you can use 443 in all three services.

[shalipriya]

We have planned to use our customized loadbalancer amazon NLB. Once ingress loadbalancer are created we will manually add those listeners to our customized NLB. So with one NLB and three different port numbers.