[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-18 (世界標準時間)。"],[[["\u003cp\u003eVirtual hosts in Apigee hybrid enable the handling of API requests directed to host aliases associated with a specific environment group.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003evirtualhosts[]\u003c/code\u003e property can be configured to include multiple virtual hosts, allowing for different TLS certificate/key pairs for each.\u003c/p\u003e\n"],["\u003cp\u003eApplying changes to the \u003ccode\u003evirtualhosts\u003c/code\u003e property involves using \u003ccode\u003ehelm upgrade\u003c/code\u003e with the \u003ccode\u003eapigee-virtualhost\u003c/code\u003e chart and the environment group name, or using \u003ccode\u003ehelm upgrade\u003c/code\u003e without this flag if additional properties are being modified.\u003c/p\u003e\n"],["\u003cp\u003eEach \u003ccode\u003evirtualhost\u003c/code\u003e requires a TLS key and certificate for secure communication with the ingress gateway, and these credentials should be compatible with the host aliases used in the environment group.\u003c/p\u003e\n"],["\u003cp\u003eFor best practices in security, it is recommended to use a separate TLS cert/key pair for each virtual host, or utilize a Subject Alternative Name (SAN) certificate shared across the domain for a single virtual host.\u003c/p\u003e\n"]]],[],null,["# Configure virtual hosts\n\n| You are currently viewing version 1.13 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic discusses the [virtualhosts](/apigee/docs/hybrid/v1.13/config-prop-ref#virtualhosts) configuration property.\nVirtual hosts allow Apigee hybrid to handle\nAPI requests to hostaliases associated with an environment group. For more information, see\n[Routing and base\npaths](/apigee/docs/api-platform/fundamentals/environments-overview#routing) in the [About\nenvironments and environment groups](/apigee/docs/api-platform/fundamentals/environments-overview) topic. \n\n```text\n...\nvirtualhosts:\n - name: my-env-group\n sslCertPath: ./certs/fullchain.pem\n sslKeyPath: ./certs/privkey.key\n...\n```\n\n\nWhen an API proxy call comes, it is routed to the host alias(es) of the environment group\nwhere the API proxy is deployed.\n\n\nFor instructions on how to apply `virtualhosts` to the cluster, see\n[Applying virtualhosts changes](#applying). For information about configuring\nTLS, see [Configuring TLS and mTLS on the Istio ingress](/apigee/docs/hybrid/v1.13/ingress-tls).\n\nAdding multiple virtual hosts\n-----------------------------\n\n\nThe `virtualhosts[]` property is an array, and therefore you can create more than\none. \n\n```text\n...\nvirtualhosts:\n - name: my-env-group-1\n sslCertPath: ./certs/fullchain1.pem\n sslKeyPath: ./certs/privkey1.key\n\n - name: my-env-group-2\n sslCertPath: ./certs/fullchain2.pem\n sslKeyPath: ./certs/privkey2.key\n...\n```\n| **Tip:** For security purposes, it is best practice to have a separate TLS cert/key pair for each virtual host. If you are using a Subject Alternative Name (SAN ) certificate, this TLS cert/key pair should be used on one virtual host that is shared across the domain.\n\n\nFor information about configuring\nTLS, see [Configuring TLS and mTLS on the Istio ingress](/apigee/docs/hybrid/v1.13/ingress-tls).\n\nApplying `virtualhosts` changes\n-------------------------------\n\n\nIf you only add or change the `virtualhosts` property, apply the changes with the `apigee-virtualhost` chart and the name of the environment group to which you are applying the changes: \n\n```\nhelm upgrade $ENV_GROUP apigee-virtualhost/ \\\n --namespace apigee \\\n --atomic \\\n --set envgroup=$ENV_GROUP \\\n -f OVERRIDES_FILE.yaml\n```\n| **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ENV_GROUP*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\nIf, for example, you change\n`virtualhosts` and `env`,\nthen you must apply the change with `helm upgrade` without using the\n\u003cvar translate=\"no\"\u003eENV_GROUP\u003c/var\u003e` apigee-virtualhost/`flag to update the cluster. For\nexample:\n\nRun helm upgrade for each environment you want to update. \n\n```\nhelm upgrade $ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --atomic \\\n --set env=$ENV_NAME \\\n -f OVERRIDES_FILE.yaml\n```\n| **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ENV_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\nTLS keys and certificates\n-------------------------\n\nThe `virtualhost` property requires a TLS key and certificate.\nThe key/cert are used to provide secure communication with the ingress gateway and\nmust be compatible with the host aliases used in the specified environment group.\n\n\nIt is up to you how you generate proper TLS certificate/key pairs for your hybrid\nconfiguration. The following topics are provided as samples only, intended primarily\nfor trying out or testing a new hybrid installation if it isn't feasible to obtain\nTLS credentials in another way:\n\n- See [Obtain TLS credentials](/apigee/docs/hybrid/v1.13/lets-encrypt) for a set of sample steps for creating an authorized TLS certificate/key pair.\n- You can use a self-signed certificate/key pair(s) for testing purposes only. See [Generate self-signed TLS credentials](/apigee/docs/hybrid/v1.13/environment-self-signed-tls)."]]
