執行 kubectl -n apigee get apigeeissues 後，系統會顯示類似下列的錯誤訊息：
NAME SEVERITY REASON DOCUMENTATION AGE
ingress-cert-expired-my-org-my-virtualhost ERROR AIS_INGRESS_CERT_EXPIREY https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_CERT_EXPIREY 5h18m
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-21 (世界標準時間)。"],[[["\u003cp\u003eThis document pertains specifically to Apigee hybrid users and addresses issues related to expiring or expired ingress certificates.\u003c/p\u003e\n"],["\u003cp\u003eAn \u003ccode\u003eApigeeIssue\u003c/code\u003e with the \u003ccode\u003eReason\u003c/code\u003e \u003ccode\u003eAIS_INGRESS_CERT_EXPIREY\u003c/code\u003e indicates that an ingress certificate is either expiring within 14 days or has already expired.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ekubectl describe apigeeissue ISSUE_NAME\u003c/code\u003e command can be used to diagnose the issue and find the affected \u003ccode\u003eApigeeRouteConfig\u003c/code\u003e and the Kubernetes secret containing the problematic certificate.\u003c/p\u003e\n"],["\u003cp\u003eResolving the issue involves identifying the virtual host in \u003ccode\u003eoverrides.yaml\u003c/code\u003e, updating the \u003ccode\u003esslCertPath\u003c/code\u003e and \u003ccode\u003esslKeyPath\u003c/code\u003e with new certificate and key files, and applying these changes using \u003ccode\u003ehelm upgrade\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIf issues persist after following the provided resolution steps, users should gather diagnostic information, such as the Google Cloud Project ID, Apigee organization name, \u003ccode\u003eSpec.Details\u003c/code\u003e, and relevant certificate files, before contacting Google Cloud Customer Care.\u003c/p\u003e\n"]]],[],null,["# Ingress cert expiry\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nThere is no equivalent\n[Apigee Edge](https://docs.apigee.com/api-platform/get-started/get-started) documentation for this topic.*\n| **Note:** This document is applicable for Apigee hybrid users only.\n\n\u003cbr /\u003e\n\nSymptom\n-------\n\n\nAn `ApigeeIssue` with `Reason` `AIS_INGRESS_CERT_EXPIREY` is\nshown when viewing resources in the `apigee` namespace.\n\nError messages\n--------------\n\n\nAfter running `kubectl -n apigee get apigeeissues`, an error like the following is\ndisplayed: \n\n```scdoc\nNAME SEVERITY REASON DOCUMENTATION AGE\ningress-cert-expired-my-org-my-virtualhost ERROR AIS_INGRESS_CERT_EXPIREY https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_CERT_EXPIREY 5h18m\n```\n\nPossible causes\n---------------\n\nCause: Ingress certificate is expiring soon\n-------------------------------------------\n\n\nThe ingress certificate stored in the Kubernetes secret referenced by an\n`ApigeeRouteConfig` is expiring within the next 14 days.\n\n### Diagnosis\n\n\nRun the following command: \n\n```\nkubectl -n apigee describe apigeeissue ISSUE_NAME\n```\n\n\nWhere \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n`ingress-cert-expiring-soon-my-org-my-virtualhost`.\n\n\nThe output should look similar to the following: \n\n```vb.net\nName: ingress-cert-expiring-soon-my-org-my-virtualhost\nNamespace: apigee\nLabels: ais-reason=AIS_INGRESS_CERT_EXPIREY\nAnnotations: \u003cnone\u003e\nAPI Version: apigee.cloud.google.com/v1alpha1\nKind: ApigeeIssue\nMetadata:\n Creation Timestamp: 2023-06-12T17:03:43Z\n Generation: 1\n Owner References:\n API Version: apigee.cloud.google.com/v1alpha2\n Kind: ApigeeOrganization\n Name: my-org\n UID: 7e83a52c-ce00-4bed-98be-55835ada1817\n Resource Version: 3281563\n UID: adc775c2-376d-4bf9-9860-500b2b2b8273\nSpec:\n Details: Ingress certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is expiring in 5.409373245s at 2024-03-11 19:04:12 +0000 UTC\n Documentation: https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_CERT_EXPIREY\n Reason: AIS_INGRESS_CERT_EXPIREY\n Severity: WARNING\nEvents: \u003cnone\u003e\n``` \n\n```actionscript-3\nSpec:\n Details: Ingress certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" is expiring in 5.409373245s at 2024-03-11 19:04:12 +0000 UTC\n```\n\n\nThe contents of `Spec.Details` explains the name of the\n`ApigeeRouteConfig` that refers to the Kubernetes secret containing the ingress\ncertificate which is expiring soon.\n\n### Resolution\n\n1.\n Use `kubectl describe` to display the name of the `ApigeeRouteConfig`\n which has the ingress cert which is expiring soon:\n\n ```\n kubectl -n apigee describe apigeeissue ISSUE_NAME\n ```\n\n\n Where \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n `ingress-cert-expiring-soon-my-org-my-virtualhost`.\n\n\n In this example, the `ApigeeRouteConfig` `my-org-my-virtualhost` is\n referencing the secret `my-org-my-virtualhost`.\n2.\n Determine the `virtualhost` name from the `ApigeeRouteConfig`.\n\n\n The `ApigeeRouteConfig`'s name is in the format:\n `\u003cApigee organization\u003e-\u003cvirtualhost name\u003e`.\n\n\n In this example, `my-org` is the Apigee organization and the virtualhost name is\n `my-virtualhost`.\n3. Find the corresponding virtualhost in your `overrides.yaml`.\n\n ```\n virtualhosts:\n ...\n - name: my-virtualhost\n selector:\n app: apigee-ingressgateway\n sslCertPath: ./certs/vhost.pem\n sslKeyPath: ./certs/vhost.key\n ...\n ```\n4.\n Update the certificate and key listed in the `sslCertPath` and\n `sslKeyPath` files.\n\n5. Apply the changes to the virtualhost:\n\n ```\n helm upgrade ENV_GROUP_NAME apigee-virtualhost/ \\\n --namespace apigee \\\n --set envgroup=ENV_GROUP_NAME \\\n -f overrides.yaml\n ```\n\nCause: Ingress certificate is expired\n-------------------------------------\n\n\nThe ingress certificate stored in the Kubernetes secret referenced by an\n`ApigeeRouteConfig` has expired.\n\n### Diagnosis\n\n\nRun the following command: \n\n```\nkubectl -n apigee describe apigeeissue ISSUE_NAME\n```\n\n\nWhere \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n`ingress-cert-expired-my-org-my-virtualhost`.\n\n\nSomething similar to the following is returned: \n\n```vb.net\nName: ingress-cert-expired-my-org-my-virtualhost\nNamespace: apigee\nLabels: ais-reason=AIS_INGRESS_CERT_EXPIREY\nAnnotations: \u003cnone\u003e\nAPI Version: apigee.cloud.google.com/v1alpha1\nKind: ApigeeIssue\nMetadata:\n Creation Timestamp: 2023-06-12T17:03:43Z\n Generation: 1\n Owner References:\n API Version: apigee.cloud.google.com/v1alpha2\n Kind: ApigeeOrganization\n Name: my-org\n UID: 7e83a52c-ce00-4bed-98be-55835ada1817\n Resource Version: 3281563\n UID: adc775c2-376d-4bf9-9860-500b2b2b8273\nSpec:\n Details: Ingress certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" expired at: 2024-03-11 19:12:10 +0000 UTC\n Documentation: https://cloud.google.com/apigee/docs/hybrid/troubleshooting/AIS_INGRESS_CERT_EXPIREY\n Reason: AIS_INGRESS_CERT_EXPIREY\n Severity: ERROR\nEvents: \u003cnone\u003e\n``` \n\n```actionscript-3\nSpec:\n Details: Ingress certificate in secret \"my-org-my-virtualhost\" for ApigeeRouteConfig \"my-org-my-virtualhost\" expired at: 2024-03-11 19:12:10 +0000 UTC\n```\n\n\nThe contents of `Spec.Details` explains the name of the\n`ApigeeRouteConfig` that refers to the Kubernetes secret containing the ingress\ncertificate which has expired.\n\n### Resolution\n\n1.\n Use `kubectl describe` to display the name of the `ApigeeRouteConfig`\n which has the expired ingress cert:\n\n ```\n kubectl -n apigee describe apigeeissue ISSUE_NAME\n ```\n\n\n Where \u003cvar translate=\"no\"\u003eISSUE_NAME\u003c/var\u003e is the name of the issue. For example,\n `ingress-cert-expired-my-org-my-virtualhost`.\n\n\n In this example, the `ApigeeRouteConfig` `my-org-my-virtualhost` is\n referencing the secret `my-org-my-virtualhost`.\n2.\n Determine the `virtualhost` name from the `ApigeeRouteConfig`.\n\n\n The `ApigeeRouteConfig`'s name is in the format:\n `\u003cApigee organization\u003e-\u003cvirtualhost name\u003e`.\n\n\n In this example, `my-org` is the Apigee organization and the virtualhost name is\n `my-virtualhost`.\n3. Find the corresponding virtualhost in your `overrides.yaml`.\n\n ```\n virtualhosts:\n ...\n - name: my-virtualhost\n selector:\n app: apigee-ingressgateway\n sslCertPath: ./certs/vhost.pem\n sslKeyPath: ./certs/vhost.key\n ...\n ```\n4.\n Update the certificate and key listed in the `sslCertPath` and\n `sslKeyPath` files.\n\n5. Apply the changes to the virtualhost:\n\n ```\n helm upgrade ENV_GROUP_NAME apigee-virtualhost/ \\\n --namespace apigee \\\n --set envgroup=ENV_GROUP_NAME \\\n -f overrides.yaml\n ```\n\nMust gather diagnostic information\n----------------------------------\n\n\nIf the problem persists even after following the above instructions, gather\nthe following diagnostic information and then contact [Google Cloud Customer Care](https://cloud.google.com/support-hub/):\n\n1. The Google Cloud Project ID.\n2. The name of the Apigee hybrid organization.\n3. The `Spec.Details` field of the `ApigeeIssue`.\n4. (optional) Files referenced by `sslCertPath` and `sslKeyPath` for the affected virtualhost."]]
